paqad-ai 1.46.2 → 1.49.0

package/CHANGELOG.md

@@ -1,5 +1,189 @@
 # paqad-ai
 
+## 1.49.0
+
+### Minor Changes
+
+- 93bdd54: Stage-Spine 09 (#324): record and consume the lane — scale process depth to risk.
+
+  paqad's deterministic classify→route→lane engine was fully built but never invoked
+  in a live session, so every change (a one-line typo or an auth migration) paid the
+  same full ceremony and the ledger's `lane` was always null. This wires the existing
+  engine into the prompt seam and makes the lane real:
+
+  - The prompt seam runs the deterministic classifier + router on the prompt text,
+    stashes the chosen lane, and records it on the change's open ledger row (no LLM
+    call added — path/prompt signals only).
+  - The pre-code gate scales the specification requirement to the lane: the **fast**
+    lane relaxes it (planning-only) while **graduated/full** keep the frozen-spec
+    requirement. A null lane fails safe to full.
+  - A new optional `sensitivity: high` per module in `module-map.yml` floors any change
+    touching a sensitive path back to the full lane — a cheap, deterministic risk floor.
+  - The completion backstop consumes the recorded lane instead of a hardcoded `'full'`,
+    so a small change is no longer forced through the heaviest quality measurement set.
+
+  Enforcement is tiered by host (hard-block on Claude Code; record-only on Codex/Gemini;
+  prompt-followed on advisory hosts).
+
+- 93bdd54: Stage-Spine 10 (#325): one end-of-change paqad receipt — surface the verdict, cut the noise.
+
+  paqad's most valuable narration moment (the final verdict) had no reliable visible
+  surface and didn't use the contract's own words, while the cheapest moments (per-stage
+  boundaries) were spoken twice. This inverts the cadence:
+
+  - The trust verdict now speaks the contract vocabulary — `Safe to merge` /
+    `Needs your attention` / `Inconclusive` with the fixed status glyphs, led by the
+    `▸ paqad` frame — consuming `paqad-voice.ts` (fulfilling its single-source claim).
+  - A new end-of-change **receipt** composes the verdict headline with one line per stage,
+    each carrying honest provenance: a stage that was only marked (no artifact, or a
+    near-zero duration) reads 🟡 "marked (no recorded work)", never 🟢 "done".
+  - The receipt is emitted as a visible `{systemMessage}` on the Claude completion hook
+    (was buried on stdout); the git/CI backstop keeps plain text.
+  - The duplicated per-marker END narration line is muted (the ledger write is unchanged —
+    only the second spoken line is dropped).
+  - The generated narration contract now states, per host, who narrates: Claude Code's
+    hooks speak for you, but on Codex/Gemini the record hook is silent so the model must
+    narrate its own markers — it no longer claims hook-driven ledger narration there.
+
+- 93bdd54: Stage-Spine 11 (#326): truth tooling — `paqad-ai config effective` and a real `decision` CLI verb.
+
+  Two small commands that make the framework honest and self-explaining:
+
+  - **`paqad-ai config effective`** prints, per knob, the value that actually binds, the
+    surface it came from (env → local `.paqad/.config` → tracked `configs/.config.*` →
+    default), and the gate that consumes it. A knob shown `consumed by: NOTHING` is a
+    placebo — a setting a team can change with no effect. The scan flags 12 verified
+    placebos (the strictness/escalation/decision-threshold/research knobs). `rule_compliance`
+    and `stages_mode` are shown through their real floored resolvers so the yaml-as-real-input
+    truth (#319) is visible. Strictly read-only.
+  - **`paqad-ai decision create|resolve|list`** is a real, install-resolved CLI verb for the
+    Decision Pause Contract, replacing the `node runtime/base/skills/decision/scripts/*.mjs`
+    path the contract named — which ENOENTs in a real onboarded project (the scripts only
+    exist in the dev repo). It wraps the existing engine (`createPendingDecision` /
+    `resolvePendingDecision` — same ULID mint, same packet format, no fork), validates the
+    category with a nearest-match suggestion, supports `--other "<text>"` write-ins on
+    resolve, and lists pending/resolved packets. The generated Decision Pause Contract now
+    names `npx paqad-ai decision …`.
+
+## 1.48.0
+
+### Minor Changes
+
+- 93e45d3: Stage-Spine 05 (#320): artifact-bearing stage markers — prove the work, not just the claim.
+
+  A stage-end marker can now carry an artifact the recorder validates over its real
+  on-disk bytes: `paqad:stage <stage> end -- <path>` (and `paqad-ai stage end <stage>
+--artifact <path>`). The thinking stages — planning, specification, review — must
+  reference a substantive (present, non-empty) artifact to count as complete. A bare
+  marker pair, a missing file, or an empty file now folds to **inconclusive**, not
+  complete, and no longer clears the pre-code gate. Mutation stages (development, checks,
+  documentation_sync) are unchanged — the observed edit is their proof. Reuses the single
+  `hashArtifacts` path (returns null when no real bytes exist) and preserves same-turn
+  remediation (#307) and the docs/`.paqad` scope exclusion (#310).
+
+- 93e45d3: Stage-Spine 06 (#321): per-change completion gate — stop later changes free-riding on the first.
+
+  The end-of-change completeness gate no longer fires only once per session. On a passing
+  verify, finalize now appends a `close` row and resets the session ledger's `.open` pointer
+  (`closeSessionOrdinal`), so the next stage/edit opens a fresh ordinal and the pre-code gate
+  re-arms — change #2+ earns its own verdict instead of inheriting change #1's markers. The
+  verify-once early return is gone (each Stop re-verifies the open change; the last verify is
+  the verdict), and the redo cap now counts only failed verifies since the last stage mutation,
+  so re-verifying never spuriously trips it while a stuck change still marches to `blocked`
+  (#303 bite-once preserved). Docs-only / `.paqad`-only changes still no-op (#310).
+
+- 93e45d3: Stage-Spine 07 (#322): deterministic ticket intake — make "do PQD-123" fetch the real ticket.
+
+  Wires the front door of the ticket → PR loop so the spec grounds in the actual ticket text
+  instead of a guess from the id:
+
+  - **`paqad-ai intake fetch <ref>`** — GitHub issues via `gh issue view` (mapped through a new
+    `GithubIssuesTicketProvider`), Jira via the Atlassian MCP in-session; prints the normalized
+    ticket and records an optional `ticket_intake` stage row. Graceful when `gh` is absent or the
+    ref is unrecognised; intake is a bookend and never blocks a change.
+  - **Prompt-seam detector** (`detectTicketRefs`) + a Claude-Code `UserPromptSubmit` arming hook:
+    a ticket ref in a prompt surfaces a `▸ paqad` line pointing at `intake fetch`. Advisory on
+    hosts without the seam.
+  - Adds an optional "Stage 0 — ticket_intake" to the feature-development rule and fixes the
+    `conventions.intake_decisions` → `process.intake_decisions` key mismatch in the policy text.
+
+- 93e45d3: Stage-Spine 08 (#323): ship `paqad-ai deliver` — wire the dead delivery engine and close the CI loop.
+
+  The ~1,900-line delivery engine (branch/commit/PR + CI wait-for-green + on-red-stop + evidence
+  comment) had no invocation path. `paqad-ai deliver` now runs the tested chain end-to-end:
+
+  - `--dry-run` renders the branch/commit/PR text without pushing.
+  - The real path asks first via a mandatory `delivery.open_pr` Decision Packet (opening a PR is
+    outward-facing and hard to reverse), then runs `renderDelivery → runDelivery → runCiGate`,
+    waits for CI (`wait_for_green` / `on_red: stop`), stops with a clear reason on red (never a
+    false success), and posts the rendered verification evidence to the PR on green.
+  - Reuses `src/delivery/*` — no hand-rolled git/gh flow.
+
+  Also fixes the delivery-policy evidence instruction that promised an auto-posted comment that
+  never happened: it now names `paqad-ai deliver` (auto-posts on green) plus the manual
+  `paqad-ai evidence --output … && gh pr comment --body-file …` fallback.
+
+  Deferred (follow-ups): a Bash `PreToolUse` deny of hand-rolled `gh pr create` / `git push` while
+  a `delivery.open_pr` packet is pending (the pause is already enforced by the verb), and adding a
+  delivery block to this repo's `feature-development.yaml` + having `paqad-ai update` append missing
+  default blocks (ties to #12).
+
+## 1.47.0
+
+### Minor Changes
+
+- 49db0e3: Make the session-context rule contract fail-safe (#316). `writeRuleContext` could
+  write a drift-, memory-, or retrieval-only artifact with zero rules when the compiled
+  rules store was absent or empty. Because the framework bootstrap only loads the full
+  `docs/instructions/rules/` tree when the artifact is _missing_, a rules-less file was
+  silently treated as the rule contract and every project rule vanished from context.
+  The writer now prepends an explicit fallback marker to any written artifact that
+  carries no rule manifest, so a bootstrap-obedient agent always knows to load the rules
+  in full. A populated store is unchanged (byte-identical).
+- 49db0e3: Ship `paqad-ai spec freeze` and activate the built-but-dead spec sign-off engine
+  (#317). The `src/spec/` freeze machinery (build → evaluate → freeze → write frozen
+  sidecar) was fully implemented and tested but had no caller and no instruction naming
+  it, so the "spec frozen and signed off before code" promise was enforced by nothing.
+  The new `spec freeze <spec-file>` verb wires the existing engine end to end: it prints
+  every freeze blocker and exits non-zero (nothing written) when the spec is not
+  freezable, and on a clean spec writes the frozen sidecar at `.paqad/specs/<id>.frozen.json`.
+  The specification-stage instructions and the feature-development rule now name the
+  command so the agent runs it. No freeze logic is reimplemented.
+- 49db0e3: Build the deterministic check runner and stop assuming tests passed (#318). The
+  `checks` stage is meant to be 100% deterministic — run format/test/build and block
+  on red — but nothing executed the commands: the resolver had no caller and the
+  completion backstop hardcoded `code_tests_lint_passed: true`, so a change with
+  failing tests could still be reported green by the framework layer.
+
+  New `paqad-ai checks run` verb resolves the project's mapped commands, executes
+  them, and persists one `StructuredTestResult` per command (the shape the
+  `code-tests-lint` gate already consumes) to `.paqad/checks/last-run.json`; it exits
+  non-zero on any red. The completion backstop now reads that report: it populates
+  `structured_test_results`, derives `code_tests_lint_passed` from real execution (no
+  longer a hardcoded `true`), and replaces the `code-tests-lint` gate's skipped
+  placeholder with the report-driven verdict — a red report blocks the completion
+  verdict, a green one passes, and an absent report reads as Inconclusive rather than
+  a vacuous green. Deterministic throughout: a command's exit code is the verdict.
+
+- 49db0e3: Arm the rule-scripts gate by generating the rule-script map at onboarding (#319).
+  paqad's deterministic, no-LLM rule enforcement engine was live but disarmed on every
+  fresh project: `rule-script-map.yml` — the map linking rules to their compiled
+  scripts — was produced by no code path, so the enforcement seam fast-skipped on the
+  missing map and the gate passed by default. And the strictness a team set in
+  `feature-development.yaml` (`checks.rule_compliance.mode`) was read from a different
+  surface at runtime (`.config`, default `warn`), so a team asking for `strict` silently
+  got `warn`.
+
+  New `paqad-ai rules compile` verb (and `compileRuleScripts`) generates the map from
+  the rule tree — embedding stable rule ids and listing every rule via the existing
+  analyzer + atomic-writer, carrying over any bound scripts — and the onboarding
+  orchestrator now runs it after the rule refresh, so a fresh project is armed. The
+  strictness resolver now folds the project's on-disk `feature-development.yaml`
+  `rule_compliance.mode` as a real, team-tracked floor (stricter of it and `.config`
+  wins; local/env may only raise), and the policy merge no longer silently drops
+  `rule_compliance` when a project supplies its own workflow file. No enforcement or
+  atomic-apply logic is reimplemented.
+
 ## 1.46.2
 
 ### Patch Changes