oh-my-agent-commandcode 0.0.0-stage → 20.38.4

package/README.md

@@ -1,3 +1,36 @@
-# Temporary Holding Version
+# oh-my-agent-commandcode
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+[oh-my-agent](https://github.com/first-fluke/oh-my-agent) for
+[Command Code](https://commandcode.ai) as a mod package: the oma hook bridge
+(`mods/oma.ts`) plus every oh-my-agent skill (`skills/`), loaded together by
+one `cmd mods add`.
+
+Requires the `oma` CLI on PATH (`npm install -g oh-my-agent`). Every hook
+fails open: without `oma` the mod changes nothing.
+
+## Install
+
+```bash
+cmd mods add oh-my-agent-commandcode        # this project
+cmd mods add -g oh-my-agent-commandcode     # your user
+cmd mods add ./path/to/commandcode-mod         # a local checkout or `oma emit` output
+```
+
+Try it without installing: `cmd --mod ./path/to/commandcode-mod/mods/oma.ts`.
+Review what it registers first: `cmd mods inspect ./path/to/commandcode-mod`.
+
+## What the mod does
+
+| Command Code hook | oh-my-agent handler |
+| --- | --- |
+| `transformInput` | keyword-detector (workflow activation) and skill-injector; the prompt passes through unchanged |
+| `appendSystemPrompt` | injects the detected context into the system prompt |
+| `onSessionStart` | code-intelligence-primer and state-boundary |
+| `beforeToolCall` (`shell_command`) | scm-guard (blocks staging likely secrets), test-filter (failures-only test output) |
+| `onStop` | persistent-mode keeps an unfinished workflow running |
+
+Each hook runs `oma hook script --vendor commandcode --script <name>`; the
+handler logic lives in the installed CLI, so updating `oma` updates the
+behaviour. A project where `oma link` already registered
+`.commandcode/settings.json` hooks keeps those; this mod adds the prompt and
+tool hooks the settings file cannot express.

package/filter-test-output.sh

@@ -0,0 +1,52 @@
+#!/usr/bin/env bash
+# filter-test-output.sh — Strip passing test indicators, keep failures and summaries
+# Pipe usage: test_command 2>&1 | bash filter-test-output.sh
+#
+# Supported: vitest, jest, mocha, pytest, go test, cargo test, rspec,
+#            flutter/dart test, swift test, dotnet test, gradle/mvn test,
+#            mix test, phpunit
+# Bypass: OMA_TEST_FILTER=0
+
+if [[ "${OMA_TEST_FILTER:-1}" == "0" ]]; then
+  cat
+  exit 0
+fi
+
+awk '
+  # vitest/jest/mocha: remove individual passing tests
+  /^[[:space:]]*[✓√✔][[:space:]]/ { next }
+
+  # jest: remove PASS file headers
+  /^[[:space:]]*PASS[[:space:]]/ { next }
+
+  # go test: remove passing tests and ok package lines
+  /^--- PASS:/ { next }
+  /^[[:space:]]*ok[[:space:]]+[a-zA-Z]/ { next }
+
+  # pytest: remove PASSED lines
+  /PASSED[[:space:]]*$/ { next }
+
+  # cargo test: remove "test ... ok" lines
+  /^test .+ \.\.\. ok$/ { next }
+
+  # flutter/dart: remove passing tests (+N without -N, excluding summary)
+  /^[0-9][0-9]:[0-9][0-9] \+[0-9]+: / && !/\-[0-9]+/ && !/All tests/ { next }
+
+  # swift: remove passed test cases
+  /Test Case .* passed/ { next }
+
+  # dotnet: remove individual Passed lines (keep "Passed!" summary)
+  /^[[:space:]]*Passed[[:space:]]/ && !/Passed!/ { next }
+
+  # gradle/mvn: remove individual test pass indicators
+  /^[[:space:]]*Tests run:.*Failures: 0.*Errors: 0/ { next }
+
+  # phpunit: remove dots-only progress lines
+  /^[.]+$/ { next }
+
+  # rspec: remove passing example dots (single-char lines)
+  /^[.]+[[:space:]]*$/ { next }
+
+  # keep everything else
+  { print }
+'

package/mods/oma.ts

@@ -0,0 +1,347 @@
+/**
+ * oh-my-agent — Command Code (commandcode.ai) mod bridge.
+ *
+ * SSOT source. `oma emit --target commandcode-mod` copies this file to
+ * `commandcode-mod/mods/oma.ts`, the entry `package.json#commandcode.mods`
+ * lists, so `cmd mods add oh-my-agent-commandcode` (or a local path) loads it.
+ *
+ * Command Code's settings-file hooks (`.agents/hooks/variants/commandcode.json`)
+ * cover SessionStart / PostToolUse / Stop only — there is no prompt-submit
+ * hook. A mod sees the full lifecycle through `cmd.hooks({...})`, so this
+ * bridge maps the Command Code ModApi hooks onto oma's vendor-agnostic core
+ * handlers the same way the opencode bridge does: every handler runs as a
+ * subprocess of the installed `oma` CLI (`oma hook script --vendor commandcode
+ * --script <name>`), which answers in the commandcode dialect (Claude-shaped
+ * JSON: `hookSpecificOutput.additionalContext`, `updatedInput`,
+ * `permissionDecision`, `{decision: "block", reason}`). Extraction is
+ * defensive (top-level OR `hookSpecificOutput`).
+ *
+ * Dependency-free: no `@commandcode/harness` import (the types are bundled
+ * with the CLI, not installable), and the ModApi shape is satisfied
+ * structurally. Fail-open everywhere: a missing `oma` binary, a timeout or
+ * malformed output leaves the host unchanged. Command Code also catches a
+ * throwing hook (`mod_error`), so nothing here can crash a session.
+ *
+ * Hook mapping:
+ *   transformInput        ← UserPromptSubmit
+ *       Runs keyword-detector + skill-injector on the typed prompt and stashes
+ *       the returned context. Returns `{action: "continue"}` — the prompt
+ *       itself is never rewritten.
+ *   appendSystemPrompt    ← context injection
+ *       Appends the stashed session-start and prompt context to the system
+ *       prompt. The value only changes when a new prompt is typed or a session
+ *       starts, so it stays byte-stable across the rounds of one run (the
+ *       provider prompt cache keys off the bytes).
+ *   onSessionStart        ← SessionStart
+ *       Runs code-intelligence-primer + state-boundary (the commandcode
+ *       SessionStart chain) and stashes their context.
+ *   beforeToolCall        ← PreToolUse (shell_command only)
+ *       scm-guard first: a deny becomes `{block: true, additionalContext}`
+ *       (the reason becomes the tool result the model sees). Then test-filter
+ *       rewrites test-runner invocations via `{input: {...input, command}}`.
+ *   onStop                ← Stop (persistent-mode)
+ *       Runs persistent-mode; a block decision becomes `{continue: true,
+ *       reason}` — Command Code's documented force-continue channel (capped at
+ *       8 consecutive continuations by the host; persistent-mode's own
+ *       reinforcement cap terminates first). The run-end hook cannot alter
+ *       the result, so it is not used for this.
+ */
+
+import { spawnSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+
+/** persistent-mode may run a goal stop gate (25s cap); the rest keep 5s. */
+const PERSISTENT_MODE_TIMEOUT_MS = 30_000;
+const DEFAULT_TIMEOUT_MS = 5_000;
+
+/** Command Code's shell tool (`cmd mods inspect` and the bundled examples). */
+const SHELL_TOOLS = new Set(["shell_command", "bash"]);
+
+// ── Structural ModApi subset ──────────────────────────────────
+
+type TransformInputResult =
+  | { action: "continue" }
+  | { action: "transform"; text: string }
+  | { action: "handled"; message?: string };
+
+interface BeforeToolCallResult {
+  block?: boolean;
+  additionalContext?: string;
+  input?: Record<string, unknown>;
+}
+
+interface OmaModHooks {
+  transformInput?: (args: {
+    text: string;
+  }) =>
+    | TransformInputResult
+    | undefined
+    | Promise<TransformInputResult | undefined>;
+  appendSystemPrompt?: (args: {
+    state?: unknown;
+  }) => string | undefined | Promise<string | undefined>;
+  onSessionStart?: (args: { source?: string }) => void | Promise<void>;
+  beforeToolCall?: (args: {
+    toolCallId?: string;
+    toolName: string;
+    input: Record<string, unknown>;
+    state?: unknown;
+  }) =>
+    | BeforeToolCallResult
+    | undefined
+    | Promise<BeforeToolCallResult | undefined>;
+  onStop?: (args: {
+    state?: unknown;
+    stopReason?: string;
+    turnNumber?: number;
+    lastAssistantText?: string;
+  }) =>
+    | { continue?: boolean; reason?: string }
+    | undefined
+    | Promise<{ continue?: boolean; reason?: string } | undefined>;
+}
+
+/** The ModApi members this bridge touches; the real `ModApi` is a superset. */
+export interface OmaModApi {
+  cwd?: string;
+  hooks: (hooks: OmaModHooks) => unknown;
+  on?: (
+    event: string,
+    handler: (event: Record<string, unknown>) => void,
+  ) => unknown;
+}
+
+// ── Subprocess dispatch ───────────────────────────────────────
+
+/** Directory of this mod; exported so test-filter can find filter-test-output.sh. */
+function bridgeDir(): string {
+  try {
+    return fileURLToPath(new URL("..", import.meta.url));
+  } catch {
+    return "";
+  }
+}
+
+/**
+ * Run one oma core handler through the installed CLI: JSON on stdin, JSON on
+ * stdout. Fail-open (null) on any error. `cwd` is the Command Code workspace
+ * root so the handler resolves the project the same way every other vendor
+ * does. A non-zero exit (persistent-mode blocks with exit 2) is expected and
+ * stdout is still parsed.
+ */
+function runCore(
+  script: string,
+  payload: Record<string, unknown>,
+  cwd: string,
+  timeoutMs = DEFAULT_TIMEOUT_MS,
+): Record<string, unknown> | null {
+  try {
+    const bin = process.env.OMA_BIN || "oma";
+    const dir = bridgeDir();
+    const res = spawnSync(
+      bin,
+      ["hook", "script", "--vendor", "commandcode", "--script", script],
+      {
+        input: JSON.stringify(payload),
+        cwd,
+        encoding: "utf-8",
+        timeout: timeoutMs,
+        maxBuffer: 4 * 1024 * 1024,
+        env: dir ? { ...process.env, OMA_HOOK_BRIDGE_DIR: dir } : process.env,
+        // A bare binary name on Windows resolves through PATHEXT (`oma.cmd`,
+        // `oma.exe`) only via the shell; the args are fixed literals.
+        shell: process.platform === "win32" && !/[\\/]/.test(bin),
+      },
+    );
+    const out = (res.stdout ?? "").trim();
+    if (!out) return null;
+    return JSON.parse(out) as Record<string, unknown>;
+  } catch {
+    return null;
+  }
+}
+
+// ── Dialect extraction ────────────────────────────────────────
+
+function extractAdditionalContext(
+  out: Record<string, unknown> | null,
+): string | null {
+  if (!out) return null;
+  if (typeof out.additionalContext === "string" && out.additionalContext) {
+    return out.additionalContext;
+  }
+  const hso = out.hookSpecificOutput;
+  if (hso && typeof hso === "object") {
+    const nested = (hso as Record<string, unknown>).additionalContext;
+    if (typeof nested === "string" && nested) return nested;
+  }
+  return null;
+}
+
+function extractUpdatedInput(
+  out: Record<string, unknown> | null,
+): Record<string, unknown> | null {
+  if (!out) return null;
+  const read = (v: unknown): Record<string, unknown> | null =>
+    v && typeof v === "object" && !Array.isArray(v)
+      ? (v as Record<string, unknown>)
+      : null;
+  const direct = read(out.updatedInput);
+  if (direct) return direct;
+  const hso = out.hookSpecificOutput;
+  if (hso && typeof hso === "object") {
+    return read((hso as Record<string, unknown>).updatedInput);
+  }
+  return null;
+}
+
+function extractDenyReason(out: Record<string, unknown> | null): string | null {
+  if (!out) return null;
+  const hso = out.hookSpecificOutput;
+  if (hso && typeof hso === "object") {
+    const h = hso as Record<string, unknown>;
+    if (h.permissionDecision === "deny") {
+      return typeof h.permissionDecisionReason === "string" &&
+        h.permissionDecisionReason
+        ? h.permissionDecisionReason
+        : "Blocked by oma scm-guard.";
+    }
+  }
+  if (out.permission === "deny" || out.decision === "deny") {
+    const reason = out.user_message ?? out.reason;
+    return typeof reason === "string" && reason
+      ? reason
+      : "Blocked by oma scm-guard.";
+  }
+  return null;
+}
+
+// ── Mod factory ───────────────────────────────────────────────
+
+/**
+ * oh-my-agent Command Code mod.
+ *
+ * @satisfies ModFactory
+ */
+export default function omaMod(cmd: OmaModApi): void {
+  const cwd = cmd.cwd || process.cwd();
+
+  // The host session id arrives on `run_start` (and `session_start`), which
+  // fire AFTER the first transformInput. persistent-mode state is keyed by
+  // session, so the id is locked at first dispatch: a real id learned before
+  // then wins, otherwise a per-process fallback keeps every handler of this
+  // session on one key.
+  const fallbackSessionId = `commandcode-${process.pid}-${Date.now().toString(36)}`;
+  let hostSessionId = "";
+  let lockedSessionId = "";
+  const sessionId = (): string => {
+    if (!lockedSessionId) lockedSessionId = hostSessionId || fallbackSessionId;
+    return lockedSessionId;
+  };
+  const learnSessionId = (event: Record<string, unknown>): void => {
+    const id = event.sessionId;
+    if (typeof id === "string" && id && !hostSessionId) hostSessionId = id;
+  };
+  try {
+    cmd.on?.("run_start", learnSessionId);
+    cmd.on?.("session_start", learnSessionId);
+  } catch {
+    // Observation only — never fail the factory.
+  }
+
+  let sessionContext = "";
+  let promptContext = "";
+
+  cmd.hooks({
+    onSessionStart: ({ source }) => {
+      const payload = {
+        prompt: "",
+        cwd,
+        sessionId: sessionId(),
+        hook_event_name: "SessionStart",
+        ...(source ? { source } : {}),
+      };
+      const parts: string[] = [];
+      for (const script of [
+        "code-intelligence-primer.ts",
+        "state-boundary.ts",
+      ]) {
+        const ctx = extractAdditionalContext(runCore(script, payload, cwd));
+        if (ctx) parts.push(ctx);
+      }
+      sessionContext = parts.join("\n\n");
+    },
+
+    transformInput: ({ text }) => {
+      const payload = {
+        prompt: text,
+        cwd,
+        sessionId: sessionId(),
+        hook_event_name: "UserPromptSubmit",
+      };
+      const parts: string[] = [];
+      for (const script of ["keyword-detector.ts", "skill-injector.ts"]) {
+        const ctx = extractAdditionalContext(runCore(script, payload, cwd));
+        if (ctx) parts.push(ctx);
+      }
+      // Overwrite — even with "" — so a previous prompt's context is never
+      // re-injected for this one.
+      promptContext = parts.join("\n\n");
+      return { action: "continue" };
+    },
+
+    appendSystemPrompt: () => {
+      const joined = [sessionContext, promptContext]
+        .filter(Boolean)
+        .join("\n\n");
+      return joined || undefined;
+    },
+
+    beforeToolCall: ({ toolName, input }) => {
+      if (!SHELL_TOOLS.has(toolName)) return undefined;
+      const command = input?.command;
+      if (typeof command !== "string" || !command) return undefined;
+      const payload = {
+        tool_name: "Bash",
+        tool_input: { command },
+        cwd,
+        sessionId: sessionId(),
+        hook_event_name: "PreToolUse",
+      };
+
+      const denyReason = extractDenyReason(
+        runCore("scm-guard.ts", payload, cwd),
+      );
+      if (denyReason) return { block: true, additionalContext: denyReason };
+
+      const updated = extractUpdatedInput(
+        runCore("test-filter.ts", payload, cwd),
+      );
+      const rewritten = updated?.command;
+      if (typeof rewritten === "string" && rewritten && rewritten !== command) {
+        return { input: { ...input, command: rewritten } };
+      }
+      return undefined;
+    },
+
+    onStop: ({ lastAssistantText }) => {
+      const pm = runCore(
+        "persistent-mode.ts",
+        {
+          cwd,
+          sessionId: sessionId(),
+          hook_event_name: "Stop",
+          ...(lastAssistantText ? { response: lastAssistantText } : {}),
+        },
+        cwd,
+        PERSISTENT_MODE_TIMEOUT_MS,
+      );
+      if (pm?.decision !== "block") return undefined;
+      const reason =
+        typeof pm.reason === "string" && pm.reason
+          ? pm.reason
+          : "The active OMA workflow is not complete. Continue executing it.";
+      return { continue: true, reason };
+    },
+  });
+}

package/package.json

@@ -1,6 +1,32 @@
 {
   "name": "oh-my-agent-commandcode",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "20.38.4",
+  "description": "oh-my-agent hooks and skills for Command Code",
+  "license": "MIT",
+  "homepage": "https://firstfluke.com/oh-my-agent",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/first-fluke/oh-my-agent"
+  },
+  "type": "module",
+  "keywords": [
+    "cmd-mod",
+    "cmd-mod-hook",
+    "agent-skills",
+    "oh-my-agent"
+  ],
+  "files": [
+    "mods",
+    "skills",
+    "filter-test-output.sh",
+    "README.md"
+  ],
+  "commandcode": {
+    "mods": [
+      "./mods/oma.ts"
+    ],
+    "skills": [
+      "./skills"
+    ]
+  }
+}

package/skills/_shared/conditional/experiment-ledger.md

@@ -0,0 +1,28 @@
+# Experiment Ledger
+
+Load when comparing an actual hypothesis with a baseline or another approach. Routine implementation, formatting, and every failed check do not require experiment bookkeeping.
+
+## Location and ownership
+
+Use `../runtime/memory-protocol.md` for the configured coordination store. The default is `.agents/state/memories/experiment-ledger-{sessionId}.md`. The coordinator maintains the shared ledger; parallel agents write task/run-scoped results for the coordinator to merge, avoiding concurrent edits to the same table. Reuse an existing experiment artifact when it already carries the evidence.
+
+## Record a comparison
+
+1. State the hypothesis, affected scope, baseline revision, and success criteria before changing behavior.
+2. Capture comparable baseline and candidate measurements as described in `quality-score.md`. Preserve required binary checks and raw evidence paths.
+3. Record the decision and reason: retain, repair, discard, or inconclusive. A missing or noisy measurement is not a loss. Do not rank unrelated tasks or agents by average score delta.
+4. If discarding, remove only changes owned by that experiment after inspecting the diff. Preserve user edits, other agents' work, and useful failure evidence.
+
+Suggested fields, not a parsed schema:
+
+| Experiment / task / run | Hypothesis | Baseline evidence | Candidate evidence | Required checks | Decision and reason | Changed paths |
+|---|---|---|---|---|---|---|
+| IDs from active run | Specific mechanism | Revision and report | Revision and report | pass / fail / missing | retain / repair / discard / inconclusive | Owned files |
+
+Keep units and comparison criteria beside metric deltas. A scalar composite is optional only when the project already defines and computes it; there is no OMA default formula.
+
+## End of an experiment
+
+Summarize the selected approach, unresolved limits, and evidence. A discarded attempt becomes a lesson only when its cause and reusable prevention are understood (`../core/lessons-learned.md`). Do not generate lessons or modify canonical skills from a numeric threshold.
+
+The ledger records work; it does not grant more retries, spending, commits, or permission to remove workspaces. Those follow the active task budget and `../core/execution-policy.md`.

package/skills/_shared/conditional/exploration-loop.md

@@ -0,0 +1,22 @@
+# Hypothesis Exploration
+
+Load when the user requests alternative approaches, or when the same issue persists after repeated relevant recovery and a different mechanism is worth testing. A failed check count is a prompt to reassess the cause, not an unconditional launch signal. Do not activate for an obvious fix or a noisy metric delta.
+
+## Scope and budget
+
+Use the task's existing aggregate attempt and cost budget. Each hypothesis consumes an attempt; exploration never replenishes retries. For a comparison round, reserve all intended attempts before starting. If the existing workflow requires a multi-candidate round and fewer than two attempts remain, preserve evidence and report the unresolved result instead of starting a partial round. Explicit user, runtime, and workflow limits take precedence; this guide does not add turn quotas or file-count caps.
+
+## Procedure
+
+1. Inspect prior failure evidence. State distinct causal hypotheses and the smallest experiment that distinguishes them. Use only as many alternatives as the uncertainty and budget justify; the active workflow may specify the candidate count.
+2. Identify ownership, baseline revision, required checks, comparison metrics, and artifact paths before editing. Include tests and related files needed to evaluate the mechanism; a fixed file limit must not hide impact.
+3. Isolate alternatives. In authorized multi-agent work, use separate prepared workspaces and preserve the plan task ID and unique run ID in each result. In sequential work, preserve a baseline and apply only the experiment's scoped diff. Do not use a blanket stash, reset, checkout, or cleanup against a workspace with unrelated changes.
+4. Run relevant checks and comparable measurements under `quality-score.md`. Missing evidence remains missing; a candidate with failing required checks cannot win through a higher aggregate score.
+5. Select a candidate only when it satisfies the required behavior and comparison criteria. Apply its owned changes to the target, then refresh affected verification on the integrated result. Preserve diagnostic evidence from other candidates; do not delete unrelated work or an active workspace.
+6. Record the comparison and decision in `experiment-ledger.md`. If no candidate resolves the issue, report the evidence and remaining limitation. Continue only within the existing recovery budget and authorized scope.
+
+## Workflow integration
+
+`/work`, `/orchestrate`, and `/ultrawork` retain their dispatch, required review, and recovery limits. They call this procedure after reassessing a repeated failure, then re-evaluate the failed gate using actual acceptance evidence. This guide does not start a workflow or delegate work by itself.
+
+Use `../runtime/result-contract.md` for task/run/claim identity and `../core/execution-policy.md` for authorization, clarification, and completion.

package/skills/_shared/conditional/quality-score.md

@@ -0,0 +1,33 @@
+# Quality Measurements
+
+Load when the task or active workflow needs a measured baseline or experiment comparison with defined metrics. The mere presence of tests or lint does not activate a scoring phase. Ordinary verification uses the applicable checks directly.
+
+## Preserve independent acceptance gates
+
+Tests, authorization/security requirements, and project acceptance criteria remain independent gates. A performance improvement cannot offset a correctness or security failure. Do not assign default weights, convert checklist completion into a security score, or trigger rollback from an arbitrary grade.
+
+<!-- oma-docs:ignore-start -->
+OMA does not implement a loader for `.agents/config/quality-score.yaml` or a universal composite scorer. If a project already provides a scoring command, record its formula, inputs, applicability, and output; do not infer configuration support from a sample path. A project composite may supplement the evidence but cannot waive mandatory checks.
+<!-- oma-docs:ignore-end -->
+
+## Measure a comparable baseline
+
+1. Define the behavior, metric, units, direction, scope, and acceptance threshold from the task or project. Use the same command, dataset, environment, and measurement method before and after.
+2. Reuse still-current verification artifacts. When new measurements are needed, capture the command's exit status and structured output (JSON, JUnit, SARIF, LCOV, or project equivalent). Do not infer totals from truncated console text.
+3. Record the artifact path and revision/run identity with the result. Mark unavailable measurements as missing with a reason; estimates are labeled and excluded from measured comparisons.
+4. Compare each applicable measure and check result. For noisy metrics, use the project's sampling/tolerance method; a single timing sample does not prove a regression.
+5. Keep a change when it meets required behavior and comparison criteria. Investigate a regression before deciding whether to repair or discard the experiment; preserve unrelated work. Record a material tradeoff when requirements permit it.
+
+For an actual experiment, use `experiment-ledger.md`. Ordinary test passes do not require a ledger row or a new measurement at every phase. Re-measure only affected metrics after relevant changes, failures, or uncertainty.
+
+## Evidence record
+
+Use existing result artifacts or a compact table such as:
+
+| Measure | Baseline | Candidate | Method / evidence | Verdict |
+|---|---|---|---|---|
+| Required tests | pass | pass | exact command, exit status, report paths | pass |
+| Request p95 latency | measured ms | measured ms | same workload, environment, sample method | within target / regression / inconclusive |
+| Security finding | finding ID | remediation status | reproduction and verification paths | resolved / unresolved |
+
+Report missing evidence without inventing a score. Authorization, builds, verification, and completion follow `../core/execution-policy.md`.