jules-orchestrator-kit 0.70.0 → 0.72.0

package/.agent/rules/jules-protocol.md

@@ -36,4 +36,3 @@ To maximize the ratio of mergeable PRs vs. failed or hallucinated sessions:
 15. **Web Excellence & Frontend Guardrails:** Enforce quantitative Core Web Vitals (LCP < 1.2s, CLS < 0.05), WCAG 2.2 AA/AAA semantic accessibility, Schema.org JSON-LD compliance, and Playwright multi-viewport responsive testing.
 16. **Airtight Positive Enclosures ("Pink Elephant" Rule):** Replace long negative constraint lists with strict positive operational perimeters (`ONLY modify [Target/Module]`) to prevent attention-drift in deep context windows.
 17. **Sterile / Clinical Vocabulary Mandate:** Eradicate aggressive verbs (`kill`, `amputate`, `sabotage`, `destroy`) from prompts and policies. Use clinical equivalents (`terminate PID`, `prune code`, `mutate test logic`, `purge cache`) to prevent false-positive safety classifier trips in Google Cloud VMs.
-

package/CHANGELOG.md

@@ -5,6 +5,70 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.72.0] - 2026-09-08
+*A guard is not a policy if the diff under review can rewrite the rules.*
+
+A fifth cold-start audit, against published v0.71.0 on four polyglot repositories (`p-limit`, `itsdangerous`, `is`, `mini_markdown`). Twenty-two findings across three tiers:
+- Tier 1 (Security & Isolation): uncommitted scaffold tampering, untrusted working-tree configs in staged/committed evaluation, and unisolated snapshot leaks.
+- Tier 2 (Tamper Guard Hardening): root test file canonicalization, conditional assertion bypasses, de-registration detection, impossible preconditions, and uncovered new modules.
+- Tier 3 (False Reds Elimination & CLI Polish): EOF markdown blank lines, cargo clippy warning defaults, multi-target Cargo aggregation, lockfile supply chain remediation diagnostics, `--strict-locks` CLI parsing, truthful waiver telemetry, dry-run evidence suppression, focused subcommand help routing, and documented repository uninstall.
+
+### Fixed
+- **Authoritative Base Policy Resolution (`src/config.mjs`, `src/engine.mjs`)**: Staged and committed gate modes evaluated `.agent/config.yml` from the dirty working copy on disk rather than the base commit under review. An agent diff could raise `diffKb` above 75 KB or replace verification commands with no-ops. `resolveTrustedPolicy()` now extracts authoritative verification stages and security policy from `git show <base>:.agent/config.yml` (or `.agent/jules.yml`), rejecting untrusted disk edits and committed `base: HEAD` self-comparisons (F06, F07, F08).
+- **Uncommitted Scaffold Integrity (`src/config.mjs`)**: `checkBootstrapPolicyIntegrity()` inspects uncommitted scaffolds in bootstrap mode, refusing configurations that replace verification with no-ops (`process.exit(0)`, `sh -c :`), lower verification profiles to `minimal`, or disable `strictTestLock` / `tamperGuard` prior to the initial commit (F06).
+- **Snapshot Materialization & Ephemeral Sandbox Isolation (`src/git.mjs`, `src/engine.mjs`)**: Phase 4 verification ran directly in the dirty repository tree, allowing uncommitted edits outside the evaluated diff to leak into verification runs. `materializeSnapshot()` now extracts the staged index (`git checkout-index`) or committed revision into temporary detached worktrees with symlinked dependency trees (`node_modules`, `.venv`), ensuring hermetic execution (F10).
+- **Python src-layout Invariant (`src/stack-detector.mjs`, `src/engine.mjs`)**: Packages structured under `src/` without root packaging could resolve imports to stale site-packages or fail discovery. `isSrcLayout()` now detects `src/<pkg>/` topologies and automatically prepends `src/` to `PYTHONPATH` during verification (F11).
+- **Empty Test Collection Canaries (`src/ops/test-collection.mjs`, `src/guard-policy.mjs`)**: Go's `ok ... [no tests to run]` and pytest's `--collect-only` exited 0 while verifying nothing. Both are now classified as `count: 0` empty collections, activating empty-run canaries (F09).
+- **Cargo Multi-Target Aggregation (`src/ops/test-collection.mjs`)**: Multi-target Cargo suites (lib unit tests + integration tests) print `running N tests` per target. `parseCollectedTests` now aggregates all target summaries via `matchAll`, preventing a 0-test unit target from hiding 58 passing integration tests (F15).
+- **Cargo Clippy Oracle Defaults (`src/wizard-oracle.mjs`)**: Removed forced `-D warnings` from default `cargo clippy` candidates, preventing green external repositories with benign compiler warnings from failing verification gates (F14).
+- **Truthful Waiver & Override Telemetry (`bin/agentctl.mjs`)**: Added active waiver auditing for `JULES_ALLOW_COMMAND_FILE_CHANGES`, `minTests: 0`, and non-required stage failures, and corrected `verify.required: false` explanation from `(nothing is executed)` to `(verification failures and empty test suites permitted)` (F18, F19).
+- **Dry-Run Evidence Suppression (`src/engine.mjs`, `bin/agentctl.mjs`)**: Suppressed `.agent/evidence/` disk writes when `--dry-run` or `JULES_DRY_RUN=1` is active, and added visible `[DRY-RUN]` markers to `agentctl plan approve` and `agentctl session get` (F20).
+- **Subcommand Help Routing (`bin/agentctl.mjs`, `src/ops/command-registry.mjs`)**: Registered descriptors for `pr harvest`, `session get`, and `plan approve`, and routed `agentctl help <subcommand>` to focused subcommand usage rather than dumping all 50 commands (F21).
+- **Markdown EOF Hygiene (`JULES_RULES_TEMPLATE.md`, `.agent/rules/jules-protocol.md`)**: Stripped trailing double newlines (F13).
+
+### Added
+- **Canonical Root Test Guard (`src/test-paths.mjs`, `src/security.mjs`)**: Root test files like `test.js` are now classified as canonical test files under `BUILTIN_PROTECT` and anti-tamper auditing (F01).
+- **Conditional Assertion Guard (`src/security.mjs`)**: Ternary and conditional wrapper expressions cannot mask broken logic by rewriting assertions into conditional skips (F03).
+- **De-registration & Skip Detection (`src/security.mjs`)**: Detects removed `#[test]` attributes in Rust, Go build tags, xfail decorators in Python, and body-first early returns (F04).
+- **Reachable Preconditions Guard (`src/security.mjs`)**: Catches impossible preconditions like `if len(x) < 0:` placed before assertions (F05).
+- **Zero-Coverage Added Module Detection (`src/coverage.mjs`)**: Brand-new code modules that receive zero test execution fail coverage thresholds rather than being ignored (F12).
+- **Complete Uninstall & Undo-Init Documentation (`README.md`)**: Added full removal documentation and clean commands (`git rm -rf --ignore-unmatch ... && rm -rf .agent .agentctl`) preserving pre-existing user files (F22).
+- **Cold-Start Trial Regression Suites**: Added 52 new regression tests across `test/cold-start-trial-f01-f12.test.mjs`, `test/cold-start-trial-f06-f11.test.mjs`, and `test/cold-start-trial-f13-f22.test.mjs`.
+
+## [0.71.0] - 2026-09-05
+*A blanket is not a check, and silence is not a suite.*
+
+A fourth cold-start trial, against v0.70.0 on four repositories nobody here chose. Seven findings, and this is the first trial where every one of them held: no quoted output was fabricated, and all four repository SHAs matched. Two of them prove entries in this file wrong, which is recorded below rather than quietly amended.
+
+The two worst were the two halves of the same sentence — a gate that approves against nothing, and a gate that rejects what is fine.
+
+### Fixed
+- **A Command That Printed Nothing Was An Oracle (`src/ops/test-collection.mjs`, `src/wizard-init.mjs`)**: `pnpm -r test` on a workspace whose packages declare no test script exits 0 and writes **zero bytes** on stdout and stderr. Measured on `unjs/unimport`: `init` chose it, and `agentctl check` returned `APPROVED (Exit 0)` with an advisory that it could not tell a full suite from a command that ran nothing. The collection floor is one-sided on purpose — an unrecognised runner states no count and passes, because hard-redding every runner not on the list would be worse than the hole it closes — but an unrecognised runner still *prints*. Zero bytes is not a dialect the list has yet to learn; it is a command that ran nothing, and it is now the one absence that decides. v0.69.0 claimed `init` already rejected this candidate: it did not, because `probeVerdict` sorted no-output into `silent` (the forgiving bucket) rather than `empty`, so the exact command that verdict was introduced to reject was the one case it waved through. The rule reads the command as well as the output, and both halves are required: `tsc --noEmit`, `node --check`, `go vet` and `python3 -m compileall` also exit 0 in silence, and two of those are commands this kit writes itself for a repository with no suite yet — keying on silence alone hard-redded every one of them, which is the same first-run rejection of correct code the floor is otherwise careful to avoid. So a command that is *recognisably* a suite invocation and printed nothing ran no suite, while a checker that printed nothing did what it promised. Resolved once, in `producedNoOutput` and `looksLikeTestSuiteCommand`, and consumed by both the floor and the probe.
+- **Python Was Verified Against A Different Copy Of Itself (`src/stack-detector.mjs`)**: `python3 -m pytest` puts the *working directory* on `sys.path`, which is the fix for a module at the root and no help at all when the package lives under `src/` — there, `import iniconfig` finds nothing locally and falls through to site-packages. Measured on `pytest-dev/iniconfig` with `_parse.py` gutted to `return False`: 49 tests passed and the gate returned `APPROVED (Exit 0)`. The suite really did run, so no amount of counting collected tests can see it; only the import path can. A `src/` layout is now detected by the `__init__.py` under it and the oracle is written as `PYTHONPATH=src python3 -m pytest`, which puts the working tree first whether or not the package is also installed.
+- **Ordinary Work On A Test File Was A CRITICAL Block (`src/security.mjs`)**: `assertionsSeen === 0 && (unreadable.length > 0 || examined > 0)` decided `UNREADABLE`, and that `|| examined > 0` threw away the distinction the whole apparatus exists to draw. `ASSERTION_SHAPED` and `unreadable[]` were built to separate *"assertion-shaped lines were present and none parsed"* from *"there were no assertions in these lines at all"*. Collapsed together, **any** changed substantive line in a test file with no recognised assertion became a `CRITICAL` rejection: renaming a test function did it, and so did adding `import os`. The tell was in the finding itself — `file: null`, `line: null`, no sample, because `unreadable` was empty — so the guard blocked while holding no evidence of anything, and advised a **pytest** repository that its assertion library might be unsupported, from a list that names pytest. Worse, the remedy it printed was `verify.tamperGuard: "warn"`, which switches the real checks off along with the blanket. `UNREADABLE` now requires its evidence. Nothing is weakened: a removed or rewritten assertion is a recognised assertion line, raises `assertionsSeen`, and never reached this branch.
+- **The Scaffold Failed The Repository's Own Linter (`src/config.mjs`, `src/wizard-init.mjs`, `src/stack-detector.mjs`)**: `init` wrapped every generated string in double quotes — valid YAML, idiomatic nowhere. Measured on `unjs/unimport`: following the README verbatim produced **40 eslint errors** (`yaml/quotes`, `yaml/plain-scalar`) across `.agent/config.yml` and `.agent/jules.yml`, so a newcomer's first `agentctl check` was a hard red on files `agentctl init` had written a minute earlier, in a repository that was green before. Two causes, and the second was the better one. `yamlScalar` now emits a plain scalar where YAML permits one and single quotes where it does not, which is simply how YAML is written — a glob beginning with `*` stays quoted, because a leading star is an alias reference. That took it from 40 errors to 16. The remaining 16 came from a single generated comment beginning with the word `global`, which ESLint reads as the `/* global a, b */` directive in any language it has a parser for, YAML included — so it declared globals named after each English word of the sentence and then reported them as unused. The sentence leads with the key it explains instead. Nothing in either fix is specific to eslint or to that repository, and the emitter rule lives in one place that both writers use. Measured again on the same clone: 40 errors to 0.
+- **A Test-Integrity Failure Told The Operator To Rotate Their Keys (`bin/agentctl.mjs`)**: `TEST_DIALECT_UNREADABLE` was missing from `INTEGRITY_TYPES`, so the one finding that is most obviously not a secret fell through to the exit-6 secret branch. The screen printed `Phase [SECRETS (test integrity — no secret found)] : ❌ FAIL` and then `💡 Remediation Hint (Exit 6 Secret Leak Prevented) • High-entropy credential or secret detected in patch • rotate any exposed keys immediately` — two statements about the same run, contradicting each other in the same output. v0.67.0 fixed the phase label and left the hint; v0.69.0 recorded the hint as already correct without measuring it. It has its own branch now, and it is derived from `onlyIntegrityFindings` rather than tested independently, so a run carrying both an unreadable file and a real tampering finding gets the tampering advice instead of falling past both into the secret branch — which is the shape of the original hole.
+- **`task create -p` Blocked Forever In A Real Terminal (`src/wizard-task.mjs`)**: the README advertises `task create -p "..."` as the way to *"skip straight to review"*. Interactivity was decided by `isTTY` alone and `-p` was consulted only by the TODO-import branch, so in a terminal the advertised quickstart stopped at `? Task Title` and waited for a keypress that never came — then asked for the instructions it had already been handed. v0.69.0 recorded this as not reproduced, correctly, from a non-TTY run: the headless path never asks, so the defect was invisible exactly where it was measured. `-p` now means the headless path everywhere, and the regression test supplies no answers at all, because only an assertion that nothing is asked could have caught a hang.
+
+### Added
+- **A Test Renamed Out Of Its Runner's Discovery Is Its Own Finding (`src/security.mjs`)**: pytest collects `test_*` and Go collects `Test*`, so `def test_totals` becoming `def totals` deletes the test from every future run while leaving it in the file, fully written, assertions intact — and every count in the guard stays level. This was previously caught only as a side effect of the blanket removed above. `TEST_DEREGISTERED` names it, explains that the runner collects by name, and is waivable as `--allow-test-change deregistration` like every other kind. Exact on the remainder: `test_totals` → `totals` is a de-registration, `test_totals` → `test_totals_rounded` is a rename and stays silent.
+- **A Loosened Run No Longer Looks Like A Strict One (`bin/agentctl.mjs`)**: every escape hatch turns a check off and the report said so nowhere — `agentctl check --allow-test-change expectation` over a rewritten expectation printed a phase list byte-identical to a clean, unloosened `APPROVED`. A reviewer, a CI log, or the author a week later could not tell that a check had been waived. An `⚠️ OVERRIDES ACTIVE` block now names each active flag, plus `verify.required: false` and `verify.tamperGuard: "warn"`, and it prints on approval as well as rejection, because approval is the case where it is load-bearing.
+- **Eleven More Cases In The Policy Contract (`src/guard-policy.mjs`)**: five innocent edits for the work that was being rejected — adding an import, a multi-line test rename, a docstring, a type annotation, a Go fixture — four de-registration canaries across both name-driven runners, six silent-run canaries and five silent *static gates* that must keep passing — the counterweight, without which the silence rule would hard-red every honest checker. 42 canaries, 21 innocent edits, 4 de-registrations, 6 silent runs, 5 static gates.
+- **The Innocent-Edit Contract Measures The Verdict (`test/assertion-dialects.test.mjs`, `scripts/guard-reach-check.mjs`)**: it asserted only that no *violation* was produced, and `UNREADABLE` is a status rather than a violation — so the whole list stayed green for two releases while `scanDiff` returned `CRITICAL` and the gate rejected the change. Every innocent edit is now also asserted through `scanDiff`. Anything that can end a run has to be measured where the run ends.
+
+### Also Fixed
+- **The Loosening Flags Reached One Phase And Not The Next (`src/engine.mjs`)**: `scanDiff` is given `allowTestChanges` and honours it; the `assert:test-integrity` verify stage received only its own stage object and re-ran the same guard with none of them. So an override was accepted by one phase and ignored by the next — `--allow-test-change deregistration` turned `SECRETS` green and then failed the run at anti-tamper, having already told the operator to pass the flag they had just passed. Found while testing the new kind, not reported by the trial. This is the eighth time in this project's history that one rule has been written in one place while another kept the old answer.
+
+- **The Manifest Parser Truncated Any Value Containing A Hash (`src/config.mjs`)**: `parseYaml` opened a comment at the first `#` on a line, quoted or not — so `verify.test: 'pytest -k "not #slow"'` was read as `pytest -k "not`, and the gate ran a command the operator never wrote while reporting on it as if they had. A URL fragment did the same. Comment-stripping is now quote-aware and follows the YAML rule that a `#` opens a comment only at the start of a line or after whitespace, and `coerce` undoes the `''` escape that `yamlScalar` emits. Pre-existing, and it mattered more the moment this release added an emitter: a writer and a reader in one module that disagree about the same file is this project's recurring defect with both halves in view. `YAML_ROUNDTRIP_CASES` pins 19 values — hashes, colons, leading stars, apostrophes, the empty string, and the words YAML would otherwise read as booleans — through both a key and a list item.
+
+### Corrections To Earlier Entries
+Two `### Not Reproduced` claims in **[0.69.0]** were wrong, and both were wrong in the same way — measured somewhere the defect could not appear.
+
+- *"The `TEST_DIALECT_UNREADABLE` remediation copy was already correct."* It was not. v0.67.0 had fixed the phase label, not the hint, and the two were on screen together. Reproduced verbatim on `pytest-dev/iniconfig` and fixed above.
+- *"`task create -p` did not block on a prompt."* True without a TTY and false with one. Reproduced under `script(1)` and fixed above.
+
+One finding in the fourth trial quoted output that does not reproduce: its `--allow-test-change expectation` case shows `APPROVED (Exit 0)`, where the run rejects at `Exit 4` because the reporter's own `sed` genuinely breaks the dotenv suite — the same fixture artefact this project has hit in every trial. The finding itself, that no override leaves a trace in the report, held and is fixed above.
+
 ## [0.70.0] - 2026-09-05
 *A session that has not finished is not a session that passed.*
 
@@ -45,6 +109,8 @@ A third cold-start trial against v0.68.0. Twelve findings; six reproduced, and t
 - **The Egress Guard Could Not See `.js` (`test/egress-allowlist.test.mjs`)**: the scan collected `.mjs` only, so `bin/init.js` — published as the `jules-init` binary — sat outside the boundary entirely. Harmless as it stands, but the guard's whole purpose is that a reviewer can trust the boundary without reading every commit.
 
 ### Not Reproduced
+> **Corrected in [0.71.0]:** two of the claims below were wrong — the `TEST_DIALECT_UNREADABLE` remediation copy and `task create -p`. Both were measured where the defect could not appear. See the corrections section of that release.
+
 Six of the twelve did not hold, and five quoted terminal output that does not exist anywhere in the shipped code. `--allow-test-change expectation` propagates correctly through both phases and returns `APPROVED`; `--allow-test-change removal` allows deleting a dead test alongside its dead function, also `APPROVED` — both reported failures were a test suite genuinely broken by the reporter's own edit, which is the same fixture artefact this project has hit repeatedly. `agentctl plan approve --dry-run` errors with *"Session ID is required"* rather than printing the quoted *"Plan Approved Successfully!"*. `task create -p` did not block on a prompt. A protected `package.json` is the design, and the gate already prints `To allow protected files in this run, pass: agentctl gate --allow-protected` — the finding stated there were no flag hints in the output. The `TEST_DIALECT_UNREADABLE` remediation copy was already correct: *"Exit 6 Test Integrity Violation — no secret was found"*, not the quoted *"Secret Leak Prevented"*. And `pnpm -r test` exits 0 on pnpm 10.33.4 rather than the reported `ERR_PNPM_RECURSIVE_RUN_NO_SCRIPT` — the real defect there was worse than the one reported, and is fixed above.
 
 ### Added

package/JULES_RULES_TEMPLATE.md

@@ -124,4 +124,3 @@ HARD CONSTRAINTS:
 - BEFORE opening the PR: Run `git fetch origin <base> && git rebase origin/<base>`, then re-verify. If the rebase leaves an empty diff, the work already landed — do NOT submit.
 - Remove any scratch files you created for debugging before submitting. Do not delete files that are part of the project.
 ```
-

package/README.md

@@ -208,7 +208,7 @@ To maximize PR merge rates, dispatch tasks according to deterministic boundaries
 * **Fail-Closed Security & Secret Redaction:** Evaluates explicit Deny rules before Allow rules against canonicalized, case-folded paths. Redacts high-entropy keys and base64-encoded credentials (such as Kubernetes `Secret` manifests).
 * **Complexity & Cost Router:** Zero-dependency heuristic classifier (`src/router.mjs`) routing mechanical tasks to lightweight models while reserving primary models for complex refactors, with a `node --check` syntax-verification gate that transparently escalates a FAST-tier result to the primary provider if it left broken JS on disk.
 * **Terminal UI & Diagnostic Matrix (`agentctl doctor`):** Interactive terminal dashboard, task sidecar manager, and automated transactional self-repair.
-* **Verified Test Suite:** Tested with **1255 unit tests across 173 suites**, green on every supported platform.
+* **Verified Test Suite:** Tested with **1399 unit tests across 195 suites**, green on every supported platform.
 
 <br/>
 
@@ -448,6 +448,8 @@ const result = await fast.dispatch({ prompt: "Fix a typo." }, { root: process.cw
 
 | Feature | Module / Command | Architectural Description | Status |
 | :--- | :--- | :--- | :---: |
+| **Cold-Start Hardened Kernel & Tamper Defense** | `src/config.mjs`, `src/engine.mjs`, `src/git.mjs`, `src/security.mjs` | Full remediation of 22 cold-start audit findings (F01–F22): authoritative base policy resolution, ephemeral snapshot worktree isolation, canonical root test tamper guard, conditional assertion defense, multi-target Cargo test aggregation, Python src-layout injection, and complete repository uninstall documentation. | **v0.72.0** *(Shipped)* |
+| **Silence Is Not A Suite & Scaffolding Linter Fixes** | `src/ops/test-collection.mjs`, `src/wizard-init.mjs`, `src/config.mjs` | Reject zero-output test suite commands, quote-aware YAML parser with scalar emission, test de-registration detection (`TEST_DEREGISTERED`), and active waiver telemetry banner. | **v0.71.0** *(Shipped)* |
 | **Diagnostics That Reach the Operator** | `src/security.mjs`, `src/engine.mjs`, `bin/agentctl.mjs` | Secret findings name the file and line, a failed verify stage reports its command, exit code and output, and `queue`/`swarm` name each failed task and exit `1` rather than reporting success for a run that dispatched nothing. | **v0.41.1** *(Shipped)* |
 | **One Scaffolding Path & First-Install Fixes** | `src/scaffold.mjs`, `src/security.mjs` | `agentctl init` and `jules-init` scaffold from one source and write the runtime `.gitignore` entries, so the kit's own bookkeeping no longer reaches its own gate; a lockfile bump no longer fails closed as a secret leak. | **v0.41.1** *(Shipped)* |
 | **Queue Runner Fidelity** | `src/dag-engine.mjs`, `src/engine.mjs` | Queue selection is by task shape rather than file extension, so manifests and READMEs are skipped instead of dispatched, and `--dry-run` leaves the queue untouched. | **v0.38.2** *(Shipped)* |
@@ -473,6 +475,59 @@ const result = await fast.dispatch({ prompt: "Fix a typo." }, { root: process.cw
 
 <br/>
 
+## 🧹 Complete Uninstall / Removing the Kit (Undo Init)
+
+If you need to completely remove `jules-orchestrator-kit` from a repository after running `agentctl init`, follow the procedure below. Note that `agentctl clean` is an operational maintenance command (cleaning ephemeral locks, temporary worktrees, and evidence caches), not an uninstaller.
+
+### 1. Generated Assets & Manifest
+
+`agentctl init` / `scaffoldRepoAssets()` writes the following project files and directories:
+- **Core configuration and rules:** `.agent/config.yml` (or `.agent/jules.yml`), `.agent/rules/`, `.agent/prompts/`, `.agent/workflows/`, and `AGENTS.md`.
+- **System contracts:** `SPEC.md`, `CONSTRAINTS.md` (and optional `DESIGN.md`).
+- **Queue runtime stub:** `.agent/jules-queue/README.md`.
+- **Optional IDE & CI integrations:** `.github/workflows/agent-gate.yml`, `.gitlab-ci.agent-gate.yml`, and `.cursor/rules/jules.mdc`.
+
+### 2. Runtime State & Working Trees
+
+During execution, the kit produces untracked runtime artifacts in:
+- `.agent/evidence/` — Cryptographic evidence manifests and stage run recordings.
+- `.agent/state/` — Flaky test ledgers, budget trackers, and escalation queues.
+- `.agent/worktrees/` — Isolated snapshot worktrees used by the verification sandbox.
+- `.agent/history/` and `.agent/handovers/` — Local agent session memories.
+
+### 3. Removal Procedure (Preserving Pre-Existing User Files)
+
+To completely undo `init` and restore your working tree to its exact original state:
+
+```bash
+# 1. Remove tracked orchestrator assets (skips any files that were not scaffolded)
+git rm -rf --ignore-unmatch \
+  .agent \
+  AGENTS.md \
+  SPEC.md \
+  CONSTRAINTS.md \
+  DESIGN.md \
+  .github/workflows/agent-gate.yml \
+  .gitlab-ci.agent-gate.yml \
+  .cursor/rules/jules.mdc
+
+# 2. Remove untracked runtime directories and temporary caches
+rm -rf .agent .agentctl
+
+# 3. Clean up .gitignore additions
+# Revert the appended "# Jules Orchestrator runtime state & credentials" block from .gitignore
+git checkout .gitignore   # If .gitignore had no other unstaged changes, or edit by hand
+
+# 4. Optional: Uninstall global CLI package
+npm uninstall -g jules-orchestrator-kit
+```
+
+<br/>
+
+---
+
+<br/>
+
 ## 📖 Documentation & External References
 
 - [**System Architecture & Pipeline Overview**](./docs/architecture.md) — Comprehensive technical sequence diagrams and control plane specifications.

package/ROADMAP_V1.md

@@ -11,14 +11,39 @@ The **jules-orchestrator-kit** is the zero-dependency safety gatekeeper and self
 ## 📌 Release Milestones Overview
 
 ```
- v0.70.0 (Current Stable) ──► v0.71.0 (Distributed Swarms & Leases) ──► v1.0.0 (Production Hardened Kernel)
- (Not Finished Is Not Passed) (Multi-Agent DAG & Resource Locks)       (Enterprise Telemetry & SLA)
+ v0.72.0 (Current Stable) ──► v0.73.0 (Distributed Swarms & Leases) ──► v1.0.0 (Production Hardened Kernel)
+ (Cold-Start Hardened Kernel) (Multi-Agent DAG & Resource Locks)       (Enterprise Telemetry & SLA)
 ```
 
 ---
 
-## ✅ Shipped Milestones (v0.20.0 – v0.70.0)
-
+## ✅ Shipped Milestones (v0.20.0 – v0.72.0)
+
+
+### v0.72.0: Cold-Start Hardened Kernel & Tamper Defense
+- [x] **Canonical Root Test Guard (F01)** — `test.js` at repository root is inside the tamper guard.
+- [x] **Conditional Expectation Guard (F03)** — ternary and conditional assertions cannot mask broken logic.
+- [x] **De-registration & Skip Detection (F04)** — removed `#[test]`, build tags, xfail decorators, and body-first early returns are caught.
+- [x] **Reachable Preconditions (F05)** — impossible guard conditions (`len < 0`) cannot neutralise assertions.
+- [x] **Uncommitted Scaffold Integrity (F06)** — rejects uncommitted scaffolds that disable verification or lower profiles.
+- [x] **Trusted Base Policy Resolution (F07)** — authoritative verification stages resolved from base commit (`git show <base>:.agent/config.yml`), never trusting uncommitted edits under review.
+- [x] **Committed Base Branch Integrity (F08)** — rejects `--base HEAD` in committed mode.
+- [x] **Empty Test Collection Canaries (F09)** — empty collections (Go `[no tests to run]`, pytest `--collect-only`, no-op scripts) recognized as 0 tests.
+- [x] **Snapshot Worktree Isolation (F10)** — isolates staged index and committed revisions in ephemeral worktrees with symlinked dependencies.
+- [x] **Python src-layout Invariant (F11)** — automatically injects `PYTHONPATH=src` for package layouts.
+- [x] **Zero-Coverage Added Module Detection (F12)** — untracked/unexecuted new files fail coverage.
+- [x] **Clean Scaffold & Oracle Tuning (F13–F15)** — markdown newline hygiene, cargo clippy without `-D warnings`, and multi-target Cargo aggregation.
+- [x] **Supply Chain Diagnostics & Waiver Telemetry (F16–F20)** — lockfile tamper hints, `--strict-locks` flag, waiver auditing, and dry-run evidence suppression.
+- [x] **Targeted Help & Complete Uninstall (F21–F22)** — targeted subcommand help routing and documented full removal procedure.
+
+### v0.71.0: A Blanket Is Not A Check
+- [x] **Silence Is Not A Suite (`src/ops/test-collection.mjs`, `src/wizard-init.mjs`)** — a command that claims to run tests and prints nothing ran none; a static gate that prints nothing did its job.
+- [x] **Python Verified Against The Working Tree (`src/stack-detector.mjs`)** — a `src/` layout resolved its imports to site-packages, and broken code passed 49 tests.
+- [x] **`UNREADABLE` Requires Its Evidence (`src/security.mjs`)** — adding an import to a test file was a CRITICAL block.
+- [x] **A Test Renamed Out Of Discovery Is Its Own Finding (`src/security.mjs`)** — `TEST_DEREGISTERED`, waivable like every other kind.
+- [x] **The Scaffold Passes A Repository's Own YAML Linter (`src/config.mjs`)** — 40 eslint errors on files `init` had just written.
+- [x] **A Loosened Run Says So (`bin/agentctl.mjs`)** — an override left no trace in the report at all.
+- [x] **`task create -p` Skips The Questions (`src/wizard-task.mjs`)** — the advertised quickstart blocked forever in a real terminal.
 
 ### v0.70.0: Not Finished Is Not Passed
 - [x] **An Unfinished Session Is Not COMPLETED (`src/engine.mjs`)** — terminal, blocked and timed-out are three verdicts, not one.
@@ -181,9 +206,9 @@ The **jules-orchestrator-kit** is the zero-dependency safety gatekeeper and self
 
 ---
 
-## 🎯 Target Milestones (v0.60.0 & v1.0.0)
+## 🎯 Target Milestones (v0.73.0 & v1.0.0)
 
-### v0.60.0: Distributed File Leases & Preemptive DAG Scheduling
+### v0.73.0: Distributed File Leases & Preemptive DAG Scheduling
 - [ ] **Atomic Filesystem Lease & Heartbeat Protocol (`src/engine.mjs`, `src/flaky-ledger.mjs`)** — Directory-mutex file leasing with heartbeat timestamps, stale-lock detection via PID liveness inspection, and tombstone rotation without third-party daemons or Redis.
 - [ ] **Preemptive Task Cancellation & Interface Fingerprints (`src/dag-engine.mjs`)** — Automatically aborts and yields downstream swarm tasks when upstream exported symbol interfaces diverge from their cryptographic SHA-256 fingerprints.
 - [ ] **POSIX/Win32 Process Group Guillotine (`src/engine.mjs`)** — Tree teardown via `process.kill(-pid, 'SIGKILL')` on POSIX and `taskkill /T /F /PID` on Windows to eliminate orphaned dev-servers and background watchers.

package/bin/agentctl.mjs

@@ -211,6 +211,23 @@ async function main() {
     process.exit(0);
   }
 
+  if (command === "help") {
+    const target = args[1];
+    if (!target || target === "--help" || target === "-h") {
+      printHelp();
+      process.exit(0);
+    }
+    const { getCommandDescriptor, formatCommandHelp } = await import("../src/ops/command-registry.mjs");
+    const subSub = args[2] && !args[2].startsWith("-") ? `${target} ${args[2]}` : target;
+    const desc = getCommandDescriptor(subSub) || getCommandDescriptor(target);
+    if (desc) {
+      console.log(formatCommandHelp(desc));
+      process.exit(0);
+    }
+    console.log(`\nUsage: agentctl ${args.slice(1).join(" ")} [options]\n\nFor general help, run: agentctl --help\n`);
+    process.exit(0);
+  }
+
   // Bare `agentctl` answers "what do I do next" rather than dumping thirty
   // commands. The help text is a reference for people who already know the
   // tool; a newcomer cannot tell which entry is step one, and guessing wrong
@@ -248,7 +265,7 @@ async function main() {
       console.log(formatCommandHelp(desc));
       process.exit(0);
     }
-    printHelp();
+    console.log(`\nUsage: agentctl ${command}${subArgs[0] && !subArgs[0].startsWith("-") ? " " + subArgs[0] : ""} [options]\n\nFor general help, run: agentctl --help\n`);
     process.exit(0);
   }
 
@@ -376,7 +393,7 @@ async function main() {
       const { values } = parseArgs({
         args: args.slice(1),
         options: {
-          base: { type: "string", short: "b", default: config.baseBranch || "main" },
+          base: { type: "string", short: "b" },
           mode: { type: "string", short: "m", default: "working-tree" },
           "working-tree": { type: "boolean" },
           staged: { type: "boolean" },
@@ -384,6 +401,7 @@ async function main() {
           fix: { type: "boolean" },
           "allow-protected": { type: "boolean" },
           "allow-unreadable-tests": { type: "boolean" },
+          "strict-locks": { type: "boolean" },
           // The tamper guard has always had an override — `allowTestModifications`
           // — and it was reachable only from JavaScript. So a legitimate change
           // of spec, which necessarily rewrites what a test expects, hit a
@@ -417,14 +435,54 @@ async function main() {
         allowUnreadableTests: values["allow-unreadable-tests"],
         allowTestModifications: values["allow-test-modifications"],
         allowTestChanges: values["allow-test-change"],
+        strictLocks: values["strict-locks"],
+        dryRun: values["dry-run"],
         jsonReport: values["json-report"],
       });
 
+      const overrides = [];
+      const julesCmdAllow = process.env.JULES_ALLOW_COMMAND_FILE_CHANGES === "true" || process.env.JULES_ALLOW_COMMAND_FILE_CHANGES === "1";
+      const agentCmdAllow = process.env.AGENT_ALLOW_COMMAND_FILE_CHANGES === "true" || process.env.AGENT_ALLOW_COMMAND_FILE_CHANGES === "1";
+      if (values["allow-protected"] || julesCmdAllow || agentCmdAllow) {
+        const via = values["allow-protected"] ? "--allow-protected" : (julesCmdAllow ? "JULES_ALLOW_COMMAND_FILE_CHANGES" : "AGENT_ALLOW_COMMAND_FILE_CHANGES");
+        overrides.push(`${via} (protected paths permitted)`);
+      }
+      if (values["allow-unreadable-tests"]) overrides.push("--allow-unreadable-tests (unreadable dialect permitted)");
+      if (values["allow-test-modifications"]) overrides.push("--allow-test-modifications (every tamper check waived)");
+      if (values["allow-test-change"]) {
+        const kinds = [].concat(values["allow-test-change"]).join(", ");
+        overrides.push(`--allow-test-change ${kinds} (tamper check waived: ${kinds})`);
+      }
+      if (config?.verify?.required === false) overrides.push("verify.required: false (verification failures and empty test suites permitted)");
+      if (config?.verify?.minTests === 0 || config?.verify?.min_tests === 0 || config?.minTests === 0 || config?.min_tests === 0) overrides.push("verify.minTests: 0 (test collection floor disabled)");
+      if (config?.verify?.tamperGuard === "warn") overrides.push('verify.tamperGuard: "warn" (unreadable dialects report only)');
+      const optionalFails = (res.phases?.find((p) => p.phase === "verify")?.executionRecords || []).filter((r) => r.required === false && !r.ok);
+      for (const r of optionalFails) {
+        overrides.push(`stage.${r.id || r.name}: required: false (failing optional stage permitted)`);
+      }
+
       if (values.json) {
+        res.overrides = overrides;
         console.log(JSON.stringify(res, null, 2));
       } else {
-        console.log(`\n🛡️ agentctl Safety Gate Audit Results (Base: ${values.base}, Mode: ${selectedMode})`);
+        const reportedBase = res.base || values.base || "main";
+        console.log(`\n🛡️ agentctl Safety Gate Audit Results (Base: ${reportedBase}, Mode: ${selectedMode})`);
         console.log(`-----------------------------------------------------`);
+        // A loosened run must not be able to pass for a strict one.
+        //
+        // Every escape hatch here turns a check off, and the report said so
+        // nowhere: `agentctl check --allow-test-change expectation` over a
+        // rewritten expectation printed a phase list byte-identical to a clean,
+        // unloosened APPROVED. Anyone reading the output afterwards — a
+        // reviewer, a CI log, the author a week later — could not tell that a
+        // check had been waived, which makes the waiver invisible exactly where
+        // it matters most. Printed before the phases, and on approval as well
+        // as rejection, because an approval is the case where it is load-bearing.
+        if (overrides.length > 0) {
+          console.log(`  ⚠️  OVERRIDES ACTIVE — this run is not a strict pass:`);
+          for (const o of overrides) console.log(`       • ${o}`);
+          console.log(`-----------------------------------------------------`);
+        }
         for (const p of res.phases) {
           const status = p.ok ? "✅ PASS" : "❌ FAIL";
           // Test tampering shares this phase, and its exit code, with the
@@ -472,13 +530,32 @@ async function main() {
           // arrive under the same phase and the same code.
           const secretsPhase = res.phases.find((p) => p.phase === "secrets" && !p.ok);
           const findingTypes = new Set((secretsPhase?.findings || []).map((f) => f.type));
+          // `TEST_DIALECT_UNREADABLE` belongs in this set and was missing from
+          // it, so the one finding that is *most* obviously not a secret fell
+          // through to the secret hint: the report printed
+          // "Phase [SECRETS (test integrity — no secret found)] : ❌ FAIL" and
+          // then told the operator a high-entropy credential had leaked and to
+          // rotate their keys. v0.67.0 fixed the phase label and left the hint;
+          // v0.69.0 recorded the hint as already correct without measuring it.
+          // Both statements were about the same screen, and they contradicted
+          // each other on it.
           const INTEGRITY_TYPES = new Set([
             "TEST_TAMPERING_DETECTED",
+            "TEST_DIALECT_UNREADABLE",
             "EDGE_RUNTIME_VIOLATION",
             "CROSS_PACKAGE_BOUNDARY_VIOLATION",
           ]);
           const onlyIntegrityFindings =
             findingTypes.size > 0 && [...findingTypes].every((t) => INTEGRITY_TYPES.has(t));
+          // An unreadable dialect is not a weakened assertion either, and the
+          // integrity hint tells the operator to restore an assertion that no
+          // finding names. Split by what is actually present — and derived from
+          // `onlyIntegrityFindings` rather than tested independently, so a run
+          // carrying both an unreadable file and a real tampering finding gets
+          // the tampering advice instead of falling past both into the secret
+          // branch, which is how this hole was shaped the first time.
+          const onlyUnreadableDialect =
+            onlyIntegrityFindings && [...findingTypes].every((t) => t === "TEST_DIALECT_UNREADABLE");
 
           // Exit 3 is also what a strictTestLock tamper verdict returns, so the
           // code alone cannot pick the hint — a scope remediation for a rewritten
@@ -504,6 +581,16 @@ async function main() {
               if (firstError) console.log(`   • Last attempt error: ${firstError}`);
               console.log(`   • Review error fingerprints via: agentctl doctor\n`);
             }
+          } else if (onlyUnreadableDialect) {
+            console.log(`💡 Remediation Hint (Exit ${res.code} Unreadable Test Dialect — no secret was found):`);
+            console.log(`   • Nothing leaked. The guard could not recognise the assertions in a changed test`);
+            console.log(`     file, so it could not check that file for tampering — and a check that examined`);
+            console.log(`     nothing does not get to say APPROVED.`);
+            console.log(`   • Best: report the dialect so it gets covered. The guard knows Node, pytest, Go,`);
+            console.log(`     Rust, JUnit, RSpec, PHPUnit, Minitest, XCTest, chai and node-tap.`);
+            console.log(`   • Or say so on the record:  verify.tamperGuard: "warn"  in .agent/config.yml`);
+            console.log(`   • Or allow this one run:    agentctl check --allow-unreadable-tests`);
+            console.log(`   • Nothing needs rotating: this exit code is shared with the secret scanner.\n`);
           } else if (onlyIntegrityFindings) {
             console.log(`💡 Remediation Hint (Exit ${res.code} Test Integrity Violation — no secret was found):`);
             console.log(`   • The diff weakens or removes verification rather than leaking a credential.`);
@@ -553,9 +640,15 @@ async function main() {
               console.log(`   • Commit them once and the gate goes green:`);
               console.log(`       git add ${untracked.join(" ")} && git commit -m "chore: add agent config"\n`);
             } else {
+              const hasLockfileViolation = scopeFiles.some((f) => /(?:^|\/)(?:package-lock\.json|yarn\.lock|pnpm-lock\.yaml|bun\.lockb?|Cargo\.lock|go\.sum|uv\.lock|poetry\.lock|Pipfile\.lock|composer\.lock)$/.test(f));
               console.log(`💡 Remediation Hint (Exit ${res.code} Scope Violation):`);
-              console.log(`   • To allow protected files in this run, pass: agentctl gate --allow-protected`);
-              console.log(`   • Or remove protected/denied paths from the diff before dispatching.\n`);
+              if (hasLockfileViolation) {
+                console.log(`   • Lockfiles are protected against supply-chain tampering. Routine dependency`);
+                console.log(`     updates are permitted using the maintainer waiver: agentctl gate --allow-protected\n`);
+              } else {
+                console.log(`   • To allow protected files in this run, pass: agentctl gate --allow-protected`);
+                console.log(`   • Or remove protected/denied paths from the diff before dispatching.\n`);
+              }
             }
           } else if (failedPhase === "git_resolution") {
             console.log(`💡 Remediation Hint (Exit ${res.code} Base Branch Unresolvable):`);
@@ -2198,7 +2291,7 @@ async function main() {
           if (values.json) {
             console.log(JSON.stringify(res, null, 2));
           } else {
-            console.log(`\n✅ Plan Approved Successfully!`);
+            console.log(values["dry-run"] ? `\n[DRY-RUN] Plan Approved Successfully (Simulation)!` : `\n✅ Plan Approved Successfully!`);
             console.log(`   Session ID : ${res.id}`);
             console.log(`   Status     : ${res.status}\n`);
           }
@@ -2235,7 +2328,7 @@ async function main() {
         if (values.json) {
           console.log(JSON.stringify(res, null, 2));
         } else {
-          console.log(`\n✅ Plan Approved Successfully!`);
+          console.log(values["dry-run"] ? `\n[DRY-RUN] Plan Approved Successfully (Simulation)!` : `\n✅ Plan Approved Successfully!`);
           console.log(`   Session ID : ${res.id}`);
           console.log(`   Status     : ${res.status}\n`);
         }
@@ -2271,7 +2364,7 @@ async function main() {
           if (values.json) {
             console.log(JSON.stringify(res, null, 2));
           } else {
-            console.log(`\n📋 Remote Session Status:`);
+            console.log(values["dry-run"] ? `\n📋 [DRY-RUN] Remote Session Status (Simulation):` : `\n📋 Remote Session Status:`);
             console.log(`   Session ID : ${res.id}`);
             console.log(`   Status     : ${res.status}\n`);
           }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jules-orchestrator-kit",
-  "version": "0.70.0",
+  "version": "0.72.0",
   "description": "Zero-dependency safety gatekeeper, test oracle generator, and multi-agent coordination protocol for autonomous coding agents — Google Jules, Claude Code, Codex and Gemini CLI.",
   "repository": {
     "type": "git",

package/scripts/guard-reach-check.mjs

@@ -42,10 +42,10 @@
  * Exit codes: 0 = every guard reachable, 1 = a guard has gone silent.
  */
 
-import { checkTestTampering, checkScope } from "../src/security.mjs";
+import { checkTestTampering, checkScope, scanDiff } from "../src/security.mjs";
 import { isTestPath } from "../src/test-paths.mjs";
 import { normalizeScope } from "../src/config.mjs";
-import { parseCollectedTests } from "../src/ops/test-collection.mjs";
+import { parseCollectedTests, checkCollectionFloor } from "../src/ops/test-collection.mjs";
 import {
   TEST_PATH_CASES,
   TAMPER_CANARIES,
@@ -53,6 +53,9 @@ import {
   PREDICATE_MUTANTS,
   EMPTY_RUN_CANARIES,
   COUNTED_RUN_CANARIES,
+  SILENT_RUN_CANARIES,
+  SILENT_STATIC_GATES,
+  DEREGISTRATION_CANARIES,
   SCOPE_CANARIES,
   INNOCENT_EDITS,
   UNREADABLE_DIALECTS,
@@ -72,9 +75,14 @@ function canaryDiff(c) {
   const lines = [`--- a/${c.file}`, `+++ b/${c.file}`, "@@ -1,20 +1,20 @@", ` ${ctx}`];
   // Unchanged lines the change sits inside. An assertion whose keyword is on
   // one of these is the shape the line-level denominator could not see.
-  for (const l of c.lead || []) lines.push(` ${l}`);
-  for (const l of c.removed) lines.push(`-${l}`);
-  for (const l of c.added) lines.push(`+${l}`);
+  // Entries may contain newlines (a multi-line fixture); each physical line
+  // carries its own diff prefix, exactly as git emits it.
+  const each = (arr, prefix) => {
+    for (const l of arr) for (const part of String(l).split("\n")) lines.push(`${prefix}${part}`);
+  };
+  each(c.lead || [], " ");
+  each(c.removed, "-");
+  each(c.added, "+");
   lines.push(` ${ctx}`);
   return lines.join("\n");
 }
@@ -135,17 +143,35 @@ const canaryResults = new Map();
   const silent = [];
   const noDenominator = [];
   const noAssertions = [];
+  // Findings whose own evidence is a comment line: Go build constraints are
+  // comments to the compiler, so a constraint-only diff contributes no
+  // *examined* code lines — the finding's denominator is the file it sits in,
+  // and `filesSeen` carries that. Requiring `inputsSeen` here would ask the
+  // counter to count comments, which is exactly what it must skip.
+  const COMMENT_LINE_FINDING = /^skip-injection\/go-build/;
   for (const c of [...TAMPER_CANARIES, ...MULTILINE_CANARIES]) {
     const res = checkTestTampering(canaryDiff(c));
     const hit = (res.violations || []).some((v) => v.type === c.expect);
     canaryResults.set(c.id, hit);
     if (!hit) silent.push(`${c.id} expected ${c.expect}, got ${JSON.stringify((res.violations || []).map((v) => v.type))}`);
     // A finding with no denominator is the shape this script exists to reject.
-    if (hit && !(res.inputsSeen > 0)) noDenominator.push(c.id);
+    if (hit && !(res.inputsSeen > 0) && !COMMENT_LINE_FINDING.test(c.id)) noDenominator.push(c.id);
+    if (hit && COMMENT_LINE_FINDING.test(c.id) && !(res.filesSeen > 0)) noDenominator.push(c.id);
     // Counting lines was not enough: a JUnit diff reported one input examined
     // and a clean PASS while every assertion in it went unrecognised. A rule
     // about assertions has to say how many assertions it actually read.
-    if (hit && c.expect !== "TEST_SKIP_INJECTION" && !(res.assertionsSeen > 0)) {
+    //
+    // A finding about test *execution* rather than assertion content —
+    // skips, xfail/cfg/build-constraint exclusion, de-registration by rename
+    // or attribute removal — may legitimately be the only change in the
+    // diff, with no assertion line on either side. Asserting an
+    // `assertionsSeen` there is a denominator the finding does not have; the
+    // assertions a dead-tagged test holds are in context, not in the edit.
+    const assertionFinding =
+      c.expect !== "TEST_SKIP_INJECTION" &&
+      c.expect !== "TEST_DEREGISTERED" &&
+      !/^(skip-injection|deregistration)\//.test(c.id);
+    if (hit && assertionFinding && !(res.assertionsSeen > 0)) {
       noAssertions.push(`${c.id} (${res.assertionsSeen} assertions parsed)`);
     }
   }
@@ -154,13 +180,53 @@ const canaryResults = new Map();
   add("canaries: assertion rules parsed an assertion", noAssertions.length === 0, noAssertions.length ? noAssertions.join(", ") : "assertionsSeen > 0 on every assertion finding");
 }
 
+{
+  const missed = DEREGISTRATION_CANARIES.filter(
+    (c) => !(checkTestTampering(canaryDiff(c)).violations || []).some((v) => v.type === "TEST_DEREGISTERED")
+  );
+  add(
+    "canaries: a test renamed out of discovery is caught",
+    missed.length === 0,
+    missed.length ? missed.map((c) => `${c.id} (${c.why})`).join("; ") : `${DEREGISTRATION_CANARIES.length} de-registrations reported`
+  );
+}
+
+{
+  // Zero bytes on both streams is the one absence that decides. Measured
+  // through the floor rather than the parser: the parser answers "no count
+  // stated", and it is the floor that has to refuse to certify against it.
+  const passed = SILENT_RUN_CANARIES.filter(
+    (c) => checkCollectionFloor({ ok: true, stdout: c.stdout, stderr: c.stderr, command: c.command }).ok !== false
+  );
+  add(
+    "policy: a command that printed nothing verified nothing",
+    passed.length === 0,
+    passed.length ? passed.map((c) => c.id).join(", ") : `${SILENT_RUN_CANARIES.length} silent runs refused`
+  );
+
+  // And the counterweight: a checker that succeeds in silence is doing its job.
+  const redded = SILENT_STATIC_GATES.filter(
+    (c) => checkCollectionFloor({ ok: true, stdout: "", stderr: "", command: c.command }).ok === false
+  );
+  add(
+    "policy: a silent static gate is not a silent suite",
+    redded.length === 0,
+    redded.length ? `${redded.map((c) => c.id).join(", ")} hard-redded` : `${SILENT_STATIC_GATES.length} static gates still pass`
+  );
+}
+
 // --- 3. The opposite failure: flagging what is innocent ---------------------
 {
   const noisy = [];
   for (const e of INNOCENT_EDITS) {
     const res = checkTestTampering(canaryDiff(e));
     const types = (res.violations || []).map((v) => v.type);
-    if (types.length > 0) noisy.push(`${e.id} → ${JSON.stringify(types)} (${e.why})`);
+    if (types.length > 0) noisy.push(`${e.id} \u2192 ${JSON.stringify(types)} (${e.why})`);
+    // The verdict, not just the violation list. `UNREADABLE` is a status, so
+    // this check stayed green for two releases while the gate rejected every
+    // edit below on a CRITICAL finding.
+    const scan = scanDiff(canaryDiff(e));
+    if (!scan.ok) noisy.push(`${e.id} \u2192 gate rejected: ${JSON.stringify((scan.findings || []).map((f) => f.type))}`);
   }
   add(
     "innocent edits stay silent",