jules-orchestrator-kit 0.71.0 → 0.72.0

package/.agent/rules/jules-protocol.md

@@ -36,4 +36,3 @@ To maximize the ratio of mergeable PRs vs. failed or hallucinated sessions:
 15. **Web Excellence & Frontend Guardrails:** Enforce quantitative Core Web Vitals (LCP < 1.2s, CLS < 0.05), WCAG 2.2 AA/AAA semantic accessibility, Schema.org JSON-LD compliance, and Playwright multi-viewport responsive testing.
 16. **Airtight Positive Enclosures ("Pink Elephant" Rule):** Replace long negative constraint lists with strict positive operational perimeters (`ONLY modify [Target/Module]`) to prevent attention-drift in deep context windows.
 17. **Sterile / Clinical Vocabulary Mandate:** Eradicate aggressive verbs (`kill`, `amputate`, `sabotage`, `destroy`) from prompts and policies. Use clinical equivalents (`terminate PID`, `prune code`, `mutate test logic`, `purge cache`) to prevent false-positive safety classifier trips in Google Cloud VMs.
-

package/CHANGELOG.md

@@ -5,6 +5,36 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.72.0] - 2026-09-08
+*A guard is not a policy if the diff under review can rewrite the rules.*
+
+A fifth cold-start audit, against published v0.71.0 on four polyglot repositories (`p-limit`, `itsdangerous`, `is`, `mini_markdown`). Twenty-two findings across three tiers:
+- Tier 1 (Security & Isolation): uncommitted scaffold tampering, untrusted working-tree configs in staged/committed evaluation, and unisolated snapshot leaks.
+- Tier 2 (Tamper Guard Hardening): root test file canonicalization, conditional assertion bypasses, de-registration detection, impossible preconditions, and uncovered new modules.
+- Tier 3 (False Reds Elimination & CLI Polish): EOF markdown blank lines, cargo clippy warning defaults, multi-target Cargo aggregation, lockfile supply chain remediation diagnostics, `--strict-locks` CLI parsing, truthful waiver telemetry, dry-run evidence suppression, focused subcommand help routing, and documented repository uninstall.
+
+### Fixed
+- **Authoritative Base Policy Resolution (`src/config.mjs`, `src/engine.mjs`)**: Staged and committed gate modes evaluated `.agent/config.yml` from the dirty working copy on disk rather than the base commit under review. An agent diff could raise `diffKb` above 75 KB or replace verification commands with no-ops. `resolveTrustedPolicy()` now extracts authoritative verification stages and security policy from `git show <base>:.agent/config.yml` (or `.agent/jules.yml`), rejecting untrusted disk edits and committed `base: HEAD` self-comparisons (F06, F07, F08).
+- **Uncommitted Scaffold Integrity (`src/config.mjs`)**: `checkBootstrapPolicyIntegrity()` inspects uncommitted scaffolds in bootstrap mode, refusing configurations that replace verification with no-ops (`process.exit(0)`, `sh -c :`), lower verification profiles to `minimal`, or disable `strictTestLock` / `tamperGuard` prior to the initial commit (F06).
+- **Snapshot Materialization & Ephemeral Sandbox Isolation (`src/git.mjs`, `src/engine.mjs`)**: Phase 4 verification ran directly in the dirty repository tree, allowing uncommitted edits outside the evaluated diff to leak into verification runs. `materializeSnapshot()` now extracts the staged index (`git checkout-index`) or committed revision into temporary detached worktrees with symlinked dependency trees (`node_modules`, `.venv`), ensuring hermetic execution (F10).
+- **Python src-layout Invariant (`src/stack-detector.mjs`, `src/engine.mjs`)**: Packages structured under `src/` without root packaging could resolve imports to stale site-packages or fail discovery. `isSrcLayout()` now detects `src/<pkg>/` topologies and automatically prepends `src/` to `PYTHONPATH` during verification (F11).
+- **Empty Test Collection Canaries (`src/ops/test-collection.mjs`, `src/guard-policy.mjs`)**: Go's `ok ... [no tests to run]` and pytest's `--collect-only` exited 0 while verifying nothing. Both are now classified as `count: 0` empty collections, activating empty-run canaries (F09).
+- **Cargo Multi-Target Aggregation (`src/ops/test-collection.mjs`)**: Multi-target Cargo suites (lib unit tests + integration tests) print `running N tests` per target. `parseCollectedTests` now aggregates all target summaries via `matchAll`, preventing a 0-test unit target from hiding 58 passing integration tests (F15).
+- **Cargo Clippy Oracle Defaults (`src/wizard-oracle.mjs`)**: Removed forced `-D warnings` from default `cargo clippy` candidates, preventing green external repositories with benign compiler warnings from failing verification gates (F14).
+- **Truthful Waiver & Override Telemetry (`bin/agentctl.mjs`)**: Added active waiver auditing for `JULES_ALLOW_COMMAND_FILE_CHANGES`, `minTests: 0`, and non-required stage failures, and corrected `verify.required: false` explanation from `(nothing is executed)` to `(verification failures and empty test suites permitted)` (F18, F19).
+- **Dry-Run Evidence Suppression (`src/engine.mjs`, `bin/agentctl.mjs`)**: Suppressed `.agent/evidence/` disk writes when `--dry-run` or `JULES_DRY_RUN=1` is active, and added visible `[DRY-RUN]` markers to `agentctl plan approve` and `agentctl session get` (F20).
+- **Subcommand Help Routing (`bin/agentctl.mjs`, `src/ops/command-registry.mjs`)**: Registered descriptors for `pr harvest`, `session get`, and `plan approve`, and routed `agentctl help <subcommand>` to focused subcommand usage rather than dumping all 50 commands (F21).
+- **Markdown EOF Hygiene (`JULES_RULES_TEMPLATE.md`, `.agent/rules/jules-protocol.md`)**: Stripped trailing double newlines (F13).
+
+### Added
+- **Canonical Root Test Guard (`src/test-paths.mjs`, `src/security.mjs`)**: Root test files like `test.js` are now classified as canonical test files under `BUILTIN_PROTECT` and anti-tamper auditing (F01).
+- **Conditional Assertion Guard (`src/security.mjs`)**: Ternary and conditional wrapper expressions cannot mask broken logic by rewriting assertions into conditional skips (F03).
+- **De-registration & Skip Detection (`src/security.mjs`)**: Detects removed `#[test]` attributes in Rust, Go build tags, xfail decorators in Python, and body-first early returns (F04).
+- **Reachable Preconditions Guard (`src/security.mjs`)**: Catches impossible preconditions like `if len(x) < 0:` placed before assertions (F05).
+- **Zero-Coverage Added Module Detection (`src/coverage.mjs`)**: Brand-new code modules that receive zero test execution fail coverage thresholds rather than being ignored (F12).
+- **Complete Uninstall & Undo-Init Documentation (`README.md`)**: Added full removal documentation and clean commands (`git rm -rf --ignore-unmatch ... && rm -rf .agent .agentctl`) preserving pre-existing user files (F22).
+- **Cold-Start Trial Regression Suites**: Added 52 new regression tests across `test/cold-start-trial-f01-f12.test.mjs`, `test/cold-start-trial-f06-f11.test.mjs`, and `test/cold-start-trial-f13-f22.test.mjs`.
+
 ## [0.71.0] - 2026-09-05
 *A blanket is not a check, and silence is not a suite.*
 

package/JULES_RULES_TEMPLATE.md

@@ -124,4 +124,3 @@ HARD CONSTRAINTS:
 - BEFORE opening the PR: Run `git fetch origin <base> && git rebase origin/<base>`, then re-verify. If the rebase leaves an empty diff, the work already landed — do NOT submit.
 - Remove any scratch files you created for debugging before submitting. Do not delete files that are part of the project.
 ```
-

package/README.md

@@ -208,7 +208,7 @@ To maximize PR merge rates, dispatch tasks according to deterministic boundaries
 * **Fail-Closed Security & Secret Redaction:** Evaluates explicit Deny rules before Allow rules against canonicalized, case-folded paths. Redacts high-entropy keys and base64-encoded credentials (such as Kubernetes `Secret` manifests).
 * **Complexity & Cost Router:** Zero-dependency heuristic classifier (`src/router.mjs`) routing mechanical tasks to lightweight models while reserving primary models for complex refactors, with a `node --check` syntax-verification gate that transparently escalates a FAST-tier result to the primary provider if it left broken JS on disk.
 * **Terminal UI & Diagnostic Matrix (`agentctl doctor`):** Interactive terminal dashboard, task sidecar manager, and automated transactional self-repair.
-* **Verified Test Suite:** Tested with **1299 unit tests across 174 suites**, green on every supported platform.
+* **Verified Test Suite:** Tested with **1399 unit tests across 195 suites**, green on every supported platform.
 
 <br/>
 
@@ -448,6 +448,8 @@ const result = await fast.dispatch({ prompt: "Fix a typo." }, { root: process.cw
 
 | Feature | Module / Command | Architectural Description | Status |
 | :--- | :--- | :--- | :---: |
+| **Cold-Start Hardened Kernel & Tamper Defense** | `src/config.mjs`, `src/engine.mjs`, `src/git.mjs`, `src/security.mjs` | Full remediation of 22 cold-start audit findings (F01–F22): authoritative base policy resolution, ephemeral snapshot worktree isolation, canonical root test tamper guard, conditional assertion defense, multi-target Cargo test aggregation, Python src-layout injection, and complete repository uninstall documentation. | **v0.72.0** *(Shipped)* |
+| **Silence Is Not A Suite & Scaffolding Linter Fixes** | `src/ops/test-collection.mjs`, `src/wizard-init.mjs`, `src/config.mjs` | Reject zero-output test suite commands, quote-aware YAML parser with scalar emission, test de-registration detection (`TEST_DEREGISTERED`), and active waiver telemetry banner. | **v0.71.0** *(Shipped)* |
 | **Diagnostics That Reach the Operator** | `src/security.mjs`, `src/engine.mjs`, `bin/agentctl.mjs` | Secret findings name the file and line, a failed verify stage reports its command, exit code and output, and `queue`/`swarm` name each failed task and exit `1` rather than reporting success for a run that dispatched nothing. | **v0.41.1** *(Shipped)* |
 | **One Scaffolding Path & First-Install Fixes** | `src/scaffold.mjs`, `src/security.mjs` | `agentctl init` and `jules-init` scaffold from one source and write the runtime `.gitignore` entries, so the kit's own bookkeeping no longer reaches its own gate; a lockfile bump no longer fails closed as a secret leak. | **v0.41.1** *(Shipped)* |
 | **Queue Runner Fidelity** | `src/dag-engine.mjs`, `src/engine.mjs` | Queue selection is by task shape rather than file extension, so manifests and READMEs are skipped instead of dispatched, and `--dry-run` leaves the queue untouched. | **v0.38.2** *(Shipped)* |
@@ -473,6 +475,59 @@ const result = await fast.dispatch({ prompt: "Fix a typo." }, { root: process.cw
 
 <br/>
 
+## 🧹 Complete Uninstall / Removing the Kit (Undo Init)
+
+If you need to completely remove `jules-orchestrator-kit` from a repository after running `agentctl init`, follow the procedure below. Note that `agentctl clean` is an operational maintenance command (cleaning ephemeral locks, temporary worktrees, and evidence caches), not an uninstaller.
+
+### 1. Generated Assets & Manifest
+
+`agentctl init` / `scaffoldRepoAssets()` writes the following project files and directories:
+- **Core configuration and rules:** `.agent/config.yml` (or `.agent/jules.yml`), `.agent/rules/`, `.agent/prompts/`, `.agent/workflows/`, and `AGENTS.md`.
+- **System contracts:** `SPEC.md`, `CONSTRAINTS.md` (and optional `DESIGN.md`).
+- **Queue runtime stub:** `.agent/jules-queue/README.md`.
+- **Optional IDE & CI integrations:** `.github/workflows/agent-gate.yml`, `.gitlab-ci.agent-gate.yml`, and `.cursor/rules/jules.mdc`.
+
+### 2. Runtime State & Working Trees
+
+During execution, the kit produces untracked runtime artifacts in:
+- `.agent/evidence/` — Cryptographic evidence manifests and stage run recordings.
+- `.agent/state/` — Flaky test ledgers, budget trackers, and escalation queues.
+- `.agent/worktrees/` — Isolated snapshot worktrees used by the verification sandbox.
+- `.agent/history/` and `.agent/handovers/` — Local agent session memories.
+
+### 3. Removal Procedure (Preserving Pre-Existing User Files)
+
+To completely undo `init` and restore your working tree to its exact original state:
+
+```bash
+# 1. Remove tracked orchestrator assets (skips any files that were not scaffolded)
+git rm -rf --ignore-unmatch \
+  .agent \
+  AGENTS.md \
+  SPEC.md \
+  CONSTRAINTS.md \
+  DESIGN.md \
+  .github/workflows/agent-gate.yml \
+  .gitlab-ci.agent-gate.yml \
+  .cursor/rules/jules.mdc
+
+# 2. Remove untracked runtime directories and temporary caches
+rm -rf .agent .agentctl
+
+# 3. Clean up .gitignore additions
+# Revert the appended "# Jules Orchestrator runtime state & credentials" block from .gitignore
+git checkout .gitignore   # If .gitignore had no other unstaged changes, or edit by hand
+
+# 4. Optional: Uninstall global CLI package
+npm uninstall -g jules-orchestrator-kit
+```
+
+<br/>
+
+---
+
+<br/>
+
 ## 📖 Documentation & External References
 
 - [**System Architecture & Pipeline Overview**](./docs/architecture.md) — Comprehensive technical sequence diagrams and control plane specifications.

package/ROADMAP_V1.md

@@ -11,14 +11,30 @@ The **jules-orchestrator-kit** is the zero-dependency safety gatekeeper and self
 ## 📌 Release Milestones Overview
 
 ```
- v0.71.0 (Current Stable) ──► v0.72.0 (Distributed Swarms & Leases) ──► v1.0.0 (Production Hardened Kernel)
- (A Blanket Is Not A Check)   (Multi-Agent DAG & Resource Locks)       (Enterprise Telemetry & SLA)
+ v0.72.0 (Current Stable) ──► v0.73.0 (Distributed Swarms & Leases) ──► v1.0.0 (Production Hardened Kernel)
+ (Cold-Start Hardened Kernel) (Multi-Agent DAG & Resource Locks)       (Enterprise Telemetry & SLA)
 ```
 
 ---
 
-## ✅ Shipped Milestones (v0.20.0 – v0.71.0)
-
+## ✅ Shipped Milestones (v0.20.0 – v0.72.0)
+
+
+### v0.72.0: Cold-Start Hardened Kernel & Tamper Defense
+- [x] **Canonical Root Test Guard (F01)** — `test.js` at repository root is inside the tamper guard.
+- [x] **Conditional Expectation Guard (F03)** — ternary and conditional assertions cannot mask broken logic.
+- [x] **De-registration & Skip Detection (F04)** — removed `#[test]`, build tags, xfail decorators, and body-first early returns are caught.
+- [x] **Reachable Preconditions (F05)** — impossible guard conditions (`len < 0`) cannot neutralise assertions.
+- [x] **Uncommitted Scaffold Integrity (F06)** — rejects uncommitted scaffolds that disable verification or lower profiles.
+- [x] **Trusted Base Policy Resolution (F07)** — authoritative verification stages resolved from base commit (`git show <base>:.agent/config.yml`), never trusting uncommitted edits under review.
+- [x] **Committed Base Branch Integrity (F08)** — rejects `--base HEAD` in committed mode.
+- [x] **Empty Test Collection Canaries (F09)** — empty collections (Go `[no tests to run]`, pytest `--collect-only`, no-op scripts) recognized as 0 tests.
+- [x] **Snapshot Worktree Isolation (F10)** — isolates staged index and committed revisions in ephemeral worktrees with symlinked dependencies.
+- [x] **Python src-layout Invariant (F11)** — automatically injects `PYTHONPATH=src` for package layouts.
+- [x] **Zero-Coverage Added Module Detection (F12)** — untracked/unexecuted new files fail coverage.
+- [x] **Clean Scaffold & Oracle Tuning (F13–F15)** — markdown newline hygiene, cargo clippy without `-D warnings`, and multi-target Cargo aggregation.
+- [x] **Supply Chain Diagnostics & Waiver Telemetry (F16–F20)** — lockfile tamper hints, `--strict-locks` flag, waiver auditing, and dry-run evidence suppression.
+- [x] **Targeted Help & Complete Uninstall (F21–F22)** — targeted subcommand help routing and documented full removal procedure.
 
 ### v0.71.0: A Blanket Is Not A Check
 - [x] **Silence Is Not A Suite (`src/ops/test-collection.mjs`, `src/wizard-init.mjs`)** — a command that claims to run tests and prints nothing ran none; a static gate that prints nothing did its job.
@@ -190,9 +206,9 @@ The **jules-orchestrator-kit** is the zero-dependency safety gatekeeper and self
 
 ---
 
-## 🎯 Target Milestones (v0.60.0 & v1.0.0)
+## 🎯 Target Milestones (v0.73.0 & v1.0.0)
 
-### v0.60.0: Distributed File Leases & Preemptive DAG Scheduling
+### v0.73.0: Distributed File Leases & Preemptive DAG Scheduling
 - [ ] **Atomic Filesystem Lease & Heartbeat Protocol (`src/engine.mjs`, `src/flaky-ledger.mjs`)** — Directory-mutex file leasing with heartbeat timestamps, stale-lock detection via PID liveness inspection, and tombstone rotation without third-party daemons or Redis.
 - [ ] **Preemptive Task Cancellation & Interface Fingerprints (`src/dag-engine.mjs`)** — Automatically aborts and yields downstream swarm tasks when upstream exported symbol interfaces diverge from their cryptographic SHA-256 fingerprints.
 - [ ] **POSIX/Win32 Process Group Guillotine (`src/engine.mjs`)** — Tree teardown via `process.kill(-pid, 'SIGKILL')` on POSIX and `taskkill /T /F /PID` on Windows to eliminate orphaned dev-servers and background watchers.

package/bin/agentctl.mjs

@@ -211,6 +211,23 @@ async function main() {
     process.exit(0);
   }
 
+  if (command === "help") {
+    const target = args[1];
+    if (!target || target === "--help" || target === "-h") {
+      printHelp();
+      process.exit(0);
+    }
+    const { getCommandDescriptor, formatCommandHelp } = await import("../src/ops/command-registry.mjs");
+    const subSub = args[2] && !args[2].startsWith("-") ? `${target} ${args[2]}` : target;
+    const desc = getCommandDescriptor(subSub) || getCommandDescriptor(target);
+    if (desc) {
+      console.log(formatCommandHelp(desc));
+      process.exit(0);
+    }
+    console.log(`\nUsage: agentctl ${args.slice(1).join(" ")} [options]\n\nFor general help, run: agentctl --help\n`);
+    process.exit(0);
+  }
+
   // Bare `agentctl` answers "what do I do next" rather than dumping thirty
   // commands. The help text is a reference for people who already know the
   // tool; a newcomer cannot tell which entry is step one, and guessing wrong
@@ -248,7 +265,7 @@ async function main() {
       console.log(formatCommandHelp(desc));
       process.exit(0);
     }
-    printHelp();
+    console.log(`\nUsage: agentctl ${command}${subArgs[0] && !subArgs[0].startsWith("-") ? " " + subArgs[0] : ""} [options]\n\nFor general help, run: agentctl --help\n`);
     process.exit(0);
   }
 
@@ -376,7 +393,7 @@ async function main() {
       const { values } = parseArgs({
         args: args.slice(1),
         options: {
-          base: { type: "string", short: "b", default: config.baseBranch || "main" },
+          base: { type: "string", short: "b" },
           mode: { type: "string", short: "m", default: "working-tree" },
           "working-tree": { type: "boolean" },
           staged: { type: "boolean" },
@@ -384,6 +401,7 @@ async function main() {
           fix: { type: "boolean" },
           "allow-protected": { type: "boolean" },
           "allow-unreadable-tests": { type: "boolean" },
+          "strict-locks": { type: "boolean" },
           // The tamper guard has always had an override — `allowTestModifications`
           // — and it was reachable only from JavaScript. So a legitimate change
           // of spec, which necessarily rewrites what a test expects, hit a
@@ -417,13 +435,38 @@ async function main() {
         allowUnreadableTests: values["allow-unreadable-tests"],
         allowTestModifications: values["allow-test-modifications"],
         allowTestChanges: values["allow-test-change"],
+        strictLocks: values["strict-locks"],
+        dryRun: values["dry-run"],
         jsonReport: values["json-report"],
       });
 
+      const overrides = [];
+      const julesCmdAllow = process.env.JULES_ALLOW_COMMAND_FILE_CHANGES === "true" || process.env.JULES_ALLOW_COMMAND_FILE_CHANGES === "1";
+      const agentCmdAllow = process.env.AGENT_ALLOW_COMMAND_FILE_CHANGES === "true" || process.env.AGENT_ALLOW_COMMAND_FILE_CHANGES === "1";
+      if (values["allow-protected"] || julesCmdAllow || agentCmdAllow) {
+        const via = values["allow-protected"] ? "--allow-protected" : (julesCmdAllow ? "JULES_ALLOW_COMMAND_FILE_CHANGES" : "AGENT_ALLOW_COMMAND_FILE_CHANGES");
+        overrides.push(`${via} (protected paths permitted)`);
+      }
+      if (values["allow-unreadable-tests"]) overrides.push("--allow-unreadable-tests (unreadable dialect permitted)");
+      if (values["allow-test-modifications"]) overrides.push("--allow-test-modifications (every tamper check waived)");
+      if (values["allow-test-change"]) {
+        const kinds = [].concat(values["allow-test-change"]).join(", ");
+        overrides.push(`--allow-test-change ${kinds} (tamper check waived: ${kinds})`);
+      }
+      if (config?.verify?.required === false) overrides.push("verify.required: false (verification failures and empty test suites permitted)");
+      if (config?.verify?.minTests === 0 || config?.verify?.min_tests === 0 || config?.minTests === 0 || config?.min_tests === 0) overrides.push("verify.minTests: 0 (test collection floor disabled)");
+      if (config?.verify?.tamperGuard === "warn") overrides.push('verify.tamperGuard: "warn" (unreadable dialects report only)');
+      const optionalFails = (res.phases?.find((p) => p.phase === "verify")?.executionRecords || []).filter((r) => r.required === false && !r.ok);
+      for (const r of optionalFails) {
+        overrides.push(`stage.${r.id || r.name}: required: false (failing optional stage permitted)`);
+      }
+
       if (values.json) {
+        res.overrides = overrides;
         console.log(JSON.stringify(res, null, 2));
       } else {
-        console.log(`\n🛡️ agentctl Safety Gate Audit Results (Base: ${values.base}, Mode: ${selectedMode})`);
+        const reportedBase = res.base || values.base || "main";
+        console.log(`\n🛡️ agentctl Safety Gate Audit Results (Base: ${reportedBase}, Mode: ${selectedMode})`);
         console.log(`-----------------------------------------------------`);
         // A loosened run must not be able to pass for a strict one.
         //
@@ -435,16 +478,6 @@ async function main() {
         // check had been waived, which makes the waiver invisible exactly where
         // it matters most. Printed before the phases, and on approval as well
         // as rejection, because an approval is the case where it is load-bearing.
-        const overrides = [];
-        if (values["allow-protected"]) overrides.push("--allow-protected (protected paths permitted)");
-        if (values["allow-unreadable-tests"]) overrides.push("--allow-unreadable-tests (unreadable dialect permitted)");
-        if (values["allow-test-modifications"]) overrides.push("--allow-test-modifications (every tamper check waived)");
-        if (values["allow-test-change"]) {
-          const kinds = [].concat(values["allow-test-change"]).join(", ");
-          overrides.push(`--allow-test-change ${kinds} (tamper check waived: ${kinds})`);
-        }
-        if (config.verify?.required === false) overrides.push("verify.required: false (nothing is executed)");
-        if (config.verify?.tamperGuard === "warn") overrides.push('verify.tamperGuard: "warn" (unreadable dialects report only)');
         if (overrides.length > 0) {
           console.log(`  ⚠️  OVERRIDES ACTIVE — this run is not a strict pass:`);
           for (const o of overrides) console.log(`       • ${o}`);
@@ -607,9 +640,15 @@ async function main() {
               console.log(`   • Commit them once and the gate goes green:`);
               console.log(`       git add ${untracked.join(" ")} && git commit -m "chore: add agent config"\n`);
             } else {
+              const hasLockfileViolation = scopeFiles.some((f) => /(?:^|\/)(?:package-lock\.json|yarn\.lock|pnpm-lock\.yaml|bun\.lockb?|Cargo\.lock|go\.sum|uv\.lock|poetry\.lock|Pipfile\.lock|composer\.lock)$/.test(f));
               console.log(`💡 Remediation Hint (Exit ${res.code} Scope Violation):`);
-              console.log(`   • To allow protected files in this run, pass: agentctl gate --allow-protected`);
-              console.log(`   • Or remove protected/denied paths from the diff before dispatching.\n`);
+              if (hasLockfileViolation) {
+                console.log(`   • Lockfiles are protected against supply-chain tampering. Routine dependency`);
+                console.log(`     updates are permitted using the maintainer waiver: agentctl gate --allow-protected\n`);
+              } else {
+                console.log(`   • To allow protected files in this run, pass: agentctl gate --allow-protected`);
+                console.log(`   • Or remove protected/denied paths from the diff before dispatching.\n`);
+              }
             }
           } else if (failedPhase === "git_resolution") {
             console.log(`💡 Remediation Hint (Exit ${res.code} Base Branch Unresolvable):`);
@@ -2252,7 +2291,7 @@ async function main() {
           if (values.json) {
             console.log(JSON.stringify(res, null, 2));
           } else {
-            console.log(`\n✅ Plan Approved Successfully!`);
+            console.log(values["dry-run"] ? `\n[DRY-RUN] Plan Approved Successfully (Simulation)!` : `\n✅ Plan Approved Successfully!`);
             console.log(`   Session ID : ${res.id}`);
             console.log(`   Status     : ${res.status}\n`);
           }
@@ -2289,7 +2328,7 @@ async function main() {
         if (values.json) {
           console.log(JSON.stringify(res, null, 2));
         } else {
-          console.log(`\n✅ Plan Approved Successfully!`);
+          console.log(values["dry-run"] ? `\n[DRY-RUN] Plan Approved Successfully (Simulation)!` : `\n✅ Plan Approved Successfully!`);
           console.log(`   Session ID : ${res.id}`);
           console.log(`   Status     : ${res.status}\n`);
         }
@@ -2325,7 +2364,7 @@ async function main() {
           if (values.json) {
             console.log(JSON.stringify(res, null, 2));
           } else {
-            console.log(`\n📋 Remote Session Status:`);
+            console.log(values["dry-run"] ? `\n📋 [DRY-RUN] Remote Session Status (Simulation):` : `\n📋 Remote Session Status:`);
             console.log(`   Session ID : ${res.id}`);
             console.log(`   Status     : ${res.status}\n`);
           }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jules-orchestrator-kit",
-  "version": "0.71.0",
+  "version": "0.72.0",
   "description": "Zero-dependency safety gatekeeper, test oracle generator, and multi-agent coordination protocol for autonomous coding agents — Google Jules, Claude Code, Codex and Gemini CLI.",
   "repository": {
     "type": "git",

package/scripts/guard-reach-check.mjs

@@ -75,9 +75,14 @@ function canaryDiff(c) {
   const lines = [`--- a/${c.file}`, `+++ b/${c.file}`, "@@ -1,20 +1,20 @@", ` ${ctx}`];
   // Unchanged lines the change sits inside. An assertion whose keyword is on
   // one of these is the shape the line-level denominator could not see.
-  for (const l of c.lead || []) lines.push(` ${l}`);
-  for (const l of c.removed) lines.push(`-${l}`);
-  for (const l of c.added) lines.push(`+${l}`);
+  // Entries may contain newlines (a multi-line fixture); each physical line
+  // carries its own diff prefix, exactly as git emits it.
+  const each = (arr, prefix) => {
+    for (const l of arr) for (const part of String(l).split("\n")) lines.push(`${prefix}${part}`);
+  };
+  each(c.lead || [], " ");
+  each(c.removed, "-");
+  each(c.added, "+");
   lines.push(` ${ctx}`);
   return lines.join("\n");
 }
@@ -138,17 +143,35 @@ const canaryResults = new Map();
   const silent = [];
   const noDenominator = [];
   const noAssertions = [];
+  // Findings whose own evidence is a comment line: Go build constraints are
+  // comments to the compiler, so a constraint-only diff contributes no
+  // *examined* code lines — the finding's denominator is the file it sits in,
+  // and `filesSeen` carries that. Requiring `inputsSeen` here would ask the
+  // counter to count comments, which is exactly what it must skip.
+  const COMMENT_LINE_FINDING = /^skip-injection\/go-build/;
   for (const c of [...TAMPER_CANARIES, ...MULTILINE_CANARIES]) {
     const res = checkTestTampering(canaryDiff(c));
     const hit = (res.violations || []).some((v) => v.type === c.expect);
     canaryResults.set(c.id, hit);
     if (!hit) silent.push(`${c.id} expected ${c.expect}, got ${JSON.stringify((res.violations || []).map((v) => v.type))}`);
     // A finding with no denominator is the shape this script exists to reject.
-    if (hit && !(res.inputsSeen > 0)) noDenominator.push(c.id);
+    if (hit && !(res.inputsSeen > 0) && !COMMENT_LINE_FINDING.test(c.id)) noDenominator.push(c.id);
+    if (hit && COMMENT_LINE_FINDING.test(c.id) && !(res.filesSeen > 0)) noDenominator.push(c.id);
     // Counting lines was not enough: a JUnit diff reported one input examined
     // and a clean PASS while every assertion in it went unrecognised. A rule
     // about assertions has to say how many assertions it actually read.
-    if (hit && c.expect !== "TEST_SKIP_INJECTION" && !(res.assertionsSeen > 0)) {
+    //
+    // A finding about test *execution* rather than assertion content —
+    // skips, xfail/cfg/build-constraint exclusion, de-registration by rename
+    // or attribute removal — may legitimately be the only change in the
+    // diff, with no assertion line on either side. Asserting an
+    // `assertionsSeen` there is a denominator the finding does not have; the
+    // assertions a dead-tagged test holds are in context, not in the edit.
+    const assertionFinding =
+      c.expect !== "TEST_SKIP_INJECTION" &&
+      c.expect !== "TEST_DEREGISTERED" &&
+      !/^(skip-injection|deregistration)\//.test(c.id);
+    if (hit && assertionFinding && !(res.assertionsSeen > 0)) {
       noAssertions.push(`${c.id} (${res.assertionsSeen} assertions parsed)`);
     }
   }