plumbbob 0.6.6 → 0.8.0

package/node_modules/checkride/dist/pm/detect.js

@@ -0,0 +1,60 @@
+/**
+ * Package-manager detection.
+ *
+ * Resolves which package manager a repo uses so the orchestrator can translate
+ * each adapter's canonical `pnpm exec <tool>` invocation into that PM's form.
+ * Resolution order (D5): the declared `packageManager` field wins (it is the
+ * author's explicit intent), then a lockfile, then a `pnpm` default. Every fs
+ * touch is injectable so the logic is unit-testable without a real repo.
+ */
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+const KNOWN = new Set(['pnpm', 'npm', 'yarn', 'bun']);
+/** Narrow a raw name to a known package manager. */
+function isPackageManager(name) {
+    return KNOWN.has(name);
+}
+/** Lockfile → package manager, in resolution priority when several coexist. */
+const LOCKFILES = [
+    { file: 'pnpm-lock.yaml', pm: 'pnpm' },
+    { file: 'bun.lock', pm: 'bun' },
+    { file: 'bun.lockb', pm: 'bun' },
+    { file: 'yarn.lock', pm: 'yarn' },
+    { file: 'package-lock.json', pm: 'npm' },
+];
+/** Parse the `packageManager` field value (`"yarn@3.6.1"` → `'yarn'`), if known. */
+function parseField(value) {
+    if (!value)
+        return null;
+    const name = value.split('@')[0]?.trim() ?? '';
+    return isPackageManager(name) ? name : null;
+}
+/** Read the `packageManager` field from `cwd`'s package.json, or `undefined`. */
+function readPackageManagerField(cwd) {
+    try {
+        const pkg = JSON.parse(readFileSync(join(cwd, 'package.json'), 'utf8'));
+        return pkg.packageManager;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Resolve the package manager for `cwd`: the declared `packageManager` field,
+ * else the first matching lockfile, else `pnpm`. `fileExists` and
+ * `packageManagerField` are injectable for tests.
+ */
+export function detectPackageManager(input = {}) {
+    const cwd = input.cwd ?? process.cwd();
+    const fileExists = input.fileExists ?? ((file) => existsSync(join(cwd, file)));
+    const readField = input.packageManagerField ?? (() => readPackageManagerField(cwd));
+    const declared = parseField(readField());
+    if (declared)
+        return declared;
+    for (const { file, pm } of LOCKFILES) {
+        if (fileExists(file))
+            return pm;
+    }
+    return 'pnpm';
+}
+//# sourceMappingURL=detect.js.map

package/node_modules/checkride/dist/pm/detect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"detect.js","sourceRoot":"","sources":["../../src/pm/detect.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAIjC,MAAM,KAAK,GAAwB,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;AAE3E,oDAAoD;AACpD,SAAS,gBAAgB,CAAC,IAAY;IACpC,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC;AAED,+EAA+E;AAC/E,MAAM,SAAS,GAAoD;IACjE,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE,MAAM,EAAE;IACtC,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,KAAK,EAAE;IAC/B,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,KAAK,EAAE;IAChC,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE;IACjC,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAAE,EAAE,KAAK,EAAE;CACzC,CAAC;AAEF,oFAAoF;AACpF,SAAS,UAAU,CAAC,KAAyB;IAC3C,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC/C,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9C,CAAC;AAED,iFAAiF;AACjF,SAAS,uBAAuB,CAAC,GAAW;IAC1C,IAAI,CAAC;QACH,MAAM,GAAG,GAAgC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QACrG,OAAO,GAAG,CAAC,cAAc,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAII,EAAE;IAEN,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACvC,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/E,MAAM,SAAS,GAAG,KAAK,CAAC,mBAAmB,IAAI,CAAC,GAAG,EAAE,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC;IAEpF,MAAM,QAAQ,GAAG,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC;IACzC,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE9B,KAAK,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,SAAS,EAAE,CAAC;QACrC,IAAI,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,EAAE,CAAC;IAClC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/node_modules/checkride/dist/pm/index.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Package-manager module — the public surface for detecting a repo's package
+ * manager and translating each adapter's canonical `pnpm exec <tool>` prefix
+ * into that PM's form. Detection lives in `detect.ts`, translation in
+ * `translate.ts`; siblings import only from here.
+ */
+export type { PackageManager } from './detect.js';
+export { detectPackageManager } from './detect.js';
+export { isAvailableUnder, translateExec } from './translate.js';
+//# sourceMappingURL=index.d.ts.map

package/node_modules/checkride/dist/pm/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/pm/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,YAAY,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC"}

package/node_modules/checkride/dist/pm/index.js

@@ -0,0 +1,9 @@
+/**
+ * Package-manager module — the public surface for detecting a repo's package
+ * manager and translating each adapter's canonical `pnpm exec <tool>` prefix
+ * into that PM's form. Detection lives in `detect.ts`, translation in
+ * `translate.ts`; siblings import only from here.
+ */
+export { detectPackageManager } from './detect.js';
+export { isAvailableUnder, translateExec } from './translate.js';
+//# sourceMappingURL=index.js.map

package/node_modules/checkride/dist/pm/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/pm/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC"}

package/node_modules/checkride/dist/pm/translate.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Exec-prefix translation.
+ *
+ * The adapter registry keeps its canonical `pnpm exec <tool>` form (D5); this
+ * is the single seam that rewrites that prefix for whichever package manager a
+ * repo actually uses. Only the `pnpm exec` prefix is translated — `pnpm audit`,
+ * custom-check commands, and built-ins pass through untouched, so the default
+ * pnpm run is byte-identical to before.
+ */
+import type { PackageManager } from './detect.js';
+/**
+ * Rewrite a canonical `pnpm exec <tool> …` invocation for `pm`. Anything that
+ * is not a `pnpm exec` prefix (a `pnpm audit`, a custom check's own command, a
+ * built-in) is returned unchanged, and so is every invocation under `pnpm`
+ * itself — the default stays exactly as it was.
+ */
+export declare function translateExec(command: string, args: readonly string[], pm: PackageManager): {
+    command: string;
+    args: string[];
+};
+/**
+ * Can this adapter run under `pm`? Audit is package-manager-specific — its
+ * flags and JSON shape don't port — so `pnpm audit` (the `security` slot) is
+ * unavailable on a non-pnpm PM until a per-PM audit adapter lands (b5).
+ * Everything else is PM-agnostic once its exec prefix is translated.
+ */
+export declare function isAvailableUnder(command: string, args: readonly string[], pm: PackageManager): boolean;
+//# sourceMappingURL=translate.d.ts.map

package/node_modules/checkride/dist/pm/translate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"translate.d.ts","sourceRoot":"","sources":["../../src/pm/translate.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AASlD;;;;;GAKG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,cAAc,GACjB;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAKrC;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,EAAE,EAAE,cAAc,GAAG,OAAO,CAGtG"}

package/node_modules/checkride/dist/pm/translate.js

@@ -0,0 +1,40 @@
+/**
+ * Exec-prefix translation.
+ *
+ * The adapter registry keeps its canonical `pnpm exec <tool>` form (D5); this
+ * is the single seam that rewrites that prefix for whichever package manager a
+ * repo actually uses. Only the `pnpm exec` prefix is translated — `pnpm audit`,
+ * custom-check commands, and built-ins pass through untouched, so the default
+ * pnpm run is byte-identical to before.
+ */
+/** The exec command each non-pnpm PM uses in place of `pnpm exec`. */
+const EXEC_COMMAND = {
+    npm: 'npx',
+    yarn: 'yarn',
+    bun: 'bunx',
+};
+/**
+ * Rewrite a canonical `pnpm exec <tool> …` invocation for `pm`. Anything that
+ * is not a `pnpm exec` prefix (a `pnpm audit`, a custom check's own command, a
+ * built-in) is returned unchanged, and so is every invocation under `pnpm`
+ * itself — the default stays exactly as it was.
+ */
+export function translateExec(command, args, pm) {
+    const isExec = command === 'pnpm' && args[0] === 'exec';
+    if (!isExec || pm === 'pnpm')
+        return { command, args: [...args] };
+    // Drop 'exec'; keep <tool> and its arguments, e.g. `npx oxlint --type-aware`.
+    return { command: EXEC_COMMAND[pm], args: args.slice(1) };
+}
+/**
+ * Can this adapter run under `pm`? Audit is package-manager-specific — its
+ * flags and JSON shape don't port — so `pnpm audit` (the `security` slot) is
+ * unavailable on a non-pnpm PM until a per-PM audit adapter lands (b5).
+ * Everything else is PM-agnostic once its exec prefix is translated.
+ */
+export function isAvailableUnder(command, args, pm) {
+    if (command === 'pnpm' && args[0] === 'audit')
+        return pm === 'pnpm';
+    return true;
+}
+//# sourceMappingURL=translate.js.map

package/node_modules/checkride/dist/pm/translate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"translate.js","sourceRoot":"","sources":["../../src/pm/translate.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,sEAAsE;AACtE,MAAM,YAAY,GAAoD;IACpE,GAAG,EAAE,KAAK;IACV,IAAI,EAAE,MAAM;IACZ,GAAG,EAAE,MAAM;CACZ,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAC3B,OAAe,EACf,IAAuB,EACvB,EAAkB;IAElB,MAAM,MAAM,GAAG,OAAO,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC;IACxD,IAAI,CAAC,MAAM,IAAI,EAAE,KAAK,MAAM;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC;IAClE,8EAA8E;IAC9E,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe,EAAE,IAAuB,EAAE,EAAkB;IAC3F,IAAI,OAAO,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO;QAAE,OAAO,EAAE,KAAK,MAAM,CAAC;IACpE,OAAO,IAAI,CAAC;AACd,CAAC"}

package/node_modules/checkride/package.json

@@ -1,6 +1,6 @@
 {
   "name": "checkride",
-  "version": "0.1.6",
+  "version": "0.3.0",
   "description": "An agent harness for TypeScript repositories: one command that is the definition of done, plus mechanically enforced module boundaries.",
   "license": "MIT",
   "author": "Rob McLarty",
@@ -39,24 +39,11 @@
   "files": [
     "dist",
     "templates",
+    "schema",
     "README.md",
     "CHANGELOG.md",
     "LICENSE"
   ],
-  "devDependencies": {
-    "@ast-grep/cli": "0.42.1",
-    "@stryker-mutator/core": "9.6.1",
-    "@stryker-mutator/vitest-runner": "9.6.1",
-    "@types/node": "22.20.0",
-    "@vitest/coverage-v8": "4.1.5",
-    "cspell": "10.0.0",
-    "fallow": "2.48.0",
-    "markdownlint-cli2": "0.22.1",
-    "oxlint": "1.61.0",
-    "oxlint-tsgolint": "0.21.1",
-    "typescript": "6.0.3",
-    "vitest": "4.1.5"
-  },
   "scripts": {
     "check": "tsc --build && node dist/cli.js",
     "check:all": "tsc --build && node dist/cli.js --all",
@@ -71,6 +58,22 @@
     "mutation": "stryker run",
     "build": "tsc --build",
     "build:clean": "tsc --build --clean",
-    "types": "tsc --build"
+    "types": "tsc --build",
+    "prepublishOnly": "tsc --build && vitest run"
+  },
+  "devDependencies": {
+    "@ast-grep/cli": "0.42.1",
+    "@stryker-mutator/core": "9.6.1",
+    "@stryker-mutator/vitest-runner": "9.6.1",
+    "@types/node": "22.20.0",
+    "@vitest/coverage-v8": "4.1.5",
+    "ajv": "8.20.0",
+    "cspell": "10.0.0",
+    "fallow": "2.48.0",
+    "markdownlint-cli2": "0.22.1",
+    "oxlint": "1.61.0",
+    "oxlint-tsgolint": "0.21.1",
+    "typescript": "6.0.3",
+    "vitest": "4.1.5"
   }
-}
+}

package/node_modules/checkride/schema/checkride.config.schema.json

@@ -0,0 +1,97 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "https://raw.githubusercontent.com/robmclarty/checkride/main/schema/checkride.config.schema.json",
+  "title": "checkride configuration",
+  "description": "Schema for checkride.config.json — add it only to deviate from the zero-config defaults.",
+  "type": "object",
+  "additionalProperties": false,
+  "properties": {
+    "$schema": {
+      "type": "string",
+      "description": "URL of this JSON Schema, for editor validation and autocompletion."
+    },
+    "extends": {
+      "description": "Preset(s) to inherit — a file path (./base.json) or package specifier (@acme/preset), or an array of them. Bases merge left-to-right and the local config wins over all; objects deep-merge, arrays and scalars replace (arrays are not concatenated).",
+      "oneOf": [
+        { "type": "string" },
+        { "type": "array", "items": { "type": "string" } }
+      ]
+    },
+    "timeout": {
+      "type": "number",
+      "minimum": 0,
+      "description": "Default per-check timeout in seconds. Unset, checks fall back to the built-in 600s cap; 0 here or on a check disables the cap."
+    },
+    "checks": {
+      "type": "object",
+      "description": "Per-slot configuration. A key that matches a catalogue slot (types, format, lint, struct, dead, test, docs, links, spell, mutation, security, publint, attw) configures that slot; any other key is a custom check that runs alongside the catalogue. Naming an opt-in slot (format, mutation, security, publint, attw) here also opts it into the default run.",
+      "additionalProperties": {
+        "$ref": "#/definitions/slotConfig"
+      }
+    }
+  },
+  "definitions": {
+    "slotConfig": {
+      "description": "How to fill a slot: an adapter name, false to disable it, an adapter with overrides, or a custom check.",
+      "oneOf": [
+        {
+          "type": "string",
+          "description": "Adapter name that fills this slot, beating detection."
+        },
+        {
+          "const": false,
+          "description": "Disable this slot (skipped, not failed)."
+        },
+        { "$ref": "#/definitions/useConfig" },
+        { "$ref": "#/definitions/customCheck" }
+      ]
+    },
+    "useConfig": {
+      "type": "object",
+      "description": "Pick an adapter by name and override individual fields.",
+      "required": ["use"],
+      "additionalProperties": false,
+      "properties": {
+        "use": {
+          "type": "string",
+          "description": "Adapter name to select from the registry."
+        },
+        "command": { "type": "string" },
+        "args": { "type": "array", "items": { "type": "string" } },
+        "description": { "type": "string" },
+        "outputFile": { "type": ["string", "null"] },
+        "changedArgs": { "type": "array", "items": { "type": "string" } },
+        "fixArgs": { "type": "array", "items": { "type": "string" } },
+        "timeout": { "type": "number", "minimum": 0 }
+      }
+    },
+    "customCheck": {
+      "type": "object",
+      "description": "A bare command that needs no adapter.",
+      "required": ["command"],
+      "additionalProperties": false,
+      "properties": {
+        "command": {
+          "type": "string",
+          "description": "Executable to spawn."
+        },
+        "args": { "type": "array", "items": { "type": "string" } },
+        "description": { "type": "string" },
+        "outputFile": { "type": ["string", "null"] },
+        "changedArgs": { "type": "array", "items": { "type": "string" } },
+        "fixArgs": { "type": "array", "items": { "type": "string" } },
+        "timeout": { "type": "number", "minimum": 0 },
+        "name": { "type": "string" },
+        "detect": {
+          "type": "array",
+          "items": { "type": "string" },
+          "description": "Marker files that gate a non-catalogue custom check: it runs only when at least one listed file exists, and is skipped otherwise. Ignored on an entry that fills a catalogue slot."
+        },
+        "order": {
+          "enum": ["first", "last"],
+          "description": "Where a non-catalogue custom check runs relative to the catalogue. Default 'last'."
+        }
+      }
+    }
+  }
+}

package/node_modules/checkride/schema/checkride.summary.schema.json

@@ -0,0 +1,57 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "https://raw.githubusercontent.com/robmclarty/checkride/main/schema/checkride.summary.schema.json",
+  "title": "checkride run summary",
+  "description": "Schema for .check/summary.json — the aggregate report every run writes. A public API for agents and gate consumers. Fields are additive under schema_version 1: they are added (in lockstep with this schema), never renamed, removed, or retyped without a version bump. See docs/contract.md.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schema_version", "timestamp", "ok", "checks_run", "total_duration_ms", "checks"],
+  "properties": {
+    "schema_version": {
+      "const": 1,
+      "description": "Version of this report shape. Bumped only for a breaking (non-additive) change."
+    },
+    "timestamp": {
+      "type": "string",
+      "description": "ISO 8601 time the report was written."
+    },
+    "ok": {
+      "type": "boolean",
+      "description": "True when every check passed (skipped checks count as ok). Can be vacuous — see checks_run."
+    },
+    "checks_run": {
+      "type": "integer",
+      "minimum": 0,
+      "description": "Count of checks that actually executed (skipped entries excluded). ok=true with checks_run=0 is a vacuous green: nothing was verified. Gate consumers should treat it as a failure (or run with --strict, which exits 2)."
+    },
+    "total_duration_ms": {
+      "type": "number",
+      "minimum": 0,
+      "description": "Sum of all check durations in milliseconds."
+    },
+    "checks": {
+      "type": "array",
+      "items": { "$ref": "#/definitions/check" },
+      "description": "One entry per selected slot, in pipeline order."
+    }
+  },
+  "definitions": {
+    "check": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["name", "adapter", "description", "ok", "exit_code", "duration_ms", "output_file"],
+      "properties": {
+        "name": { "type": "string", "description": "Slot name (e.g. lint), or a custom check's key." },
+        "adapter": { "type": ["string", "null"], "description": "Adapter that ran (e.g. oxlint), or null when the slot resolved to nothing." },
+        "description": { "type": "string", "description": "Human description of the check." },
+        "ok": { "type": "boolean", "description": "Pass/fail after any baseline masking; skipped checks are ok." },
+        "skipped": { "type": "boolean", "description": "Present (true) when the check did not execute; see reason." },
+        "reason": { "type": "string", "description": "Why a skipped check sat out (no tool detected, disabled in config, unavailable under this package manager, ...)." },
+        "exit_code": { "type": ["integer", "null"], "description": "The tool's exit code; -1 for spawn failure or timeout; null when skipped." },
+        "duration_ms": { "type": "number", "description": "Wall-clock duration in milliseconds (0 when skipped)." },
+        "output_file": { "type": ["string", "null"], "description": "The .check/ file holding the tool's raw JSON output, when it emits JSON on stdout." },
+        "baselined": { "type": "integer", "minimum": 1, "description": "Present only when a committed baseline masked diagnostics: how many current findings are grandfathered." }
+      }
+    }
+  }
+}

package/node_modules/checkride/templates/shared/cspell.json

@@ -12,6 +12,7 @@
   ],
   "words": [
     "checkride",
+    "baselined",
     "biome",
     "cspell",
     "devDeps",

package/node_modules/checkride/templates/shared/prettierrc.json

@@ -0,0 +1,6 @@
+{
+  "printWidth": 100,
+  "singleQuote": true,
+  "trailingComma": "all",
+  "semi": true
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "plumbbob",
-  "version": "0.6.6",
-  "description": "Attention-first build process: 12 skills + a CLI that keep you the decider — guidance, not enforcement.",
+  "version": "0.8.0",
+  "description": "Attention-first build process: 12 skills + a CLI that keep you the decider — guidance on the work, a latch on the record.",
   "keywords": [
     "claude-code",
     "claude",
@@ -48,13 +48,14 @@
     "@types/node": "^24.0.0",
     "@vitest/coverage-v8": "^4.1.9",
     "fallow": "^2.103.0",
+    "fascicle": "0.8.16",
     "markdownlint-cli2": "^0.22.1",
     "oxlint": "^1.69.0",
     "typescript": "^6.0.3",
     "vitest": "^4.1.8"
   },
   "dependencies": {
-    "checkride": "0.1.6"
+    "checkride": "0.3.0"
   },
   "bundleDependencies": [
     "checkride"
@@ -63,6 +64,9 @@
     "clean": "rm -rf dist",
     "build": "tsc -p tsconfig.build.json",
     "check": "checkride",
-    "test": "vitest run"
+    "test": "vitest run",
+    "eval:baseline": "pnpm build && node test/evals/run.ts --sweep baseline",
+    "eval:latched": "pnpm build && node test/evals/run.ts --sweep latched",
+    "eval:report": "node test/evals/run.ts --report"
   }
 }

package/skills/pb-build/SKILL.md

@@ -83,6 +83,15 @@ differs from the model you're running as, say so before implementing — the hum
    `--body` for the deterministic done-when + seam + diffstat fallback). Do **not** bump
    the version or changelog — that is the human's `/version` call.
 
+   **The latch makes this pause real (D64).** On the default (non-`--auto`) path you
+   build the step and reach the pause *in one turn* — so under plumbbob's turn hook the
+   checkpoint at the end of that turn is **refused** ("no human turn since this step
+   began"), and that refusal **is** the pause working as designed. Do exactly what the
+   pause already asks: present the diff and the self-review, **end the turn**, and the
+   human's next message is the tick that lands the checkpoint when you re-fire. **Never
+   route around a refusal with a raw `git commit`** — the work plane stays free (D10/D13),
+   but the *record* is latched on purpose.
+
 ## `--auto` — let the agent be the clock (opt-in)
 
 `/pb-build --auto` is the explicit escape hatch when the human wants unattended
@@ -141,3 +150,8 @@ just the one more entry already in the halt list above.
   `build` writes the diff, `after` is advisory — none can checkpoint, flip a step, or
   chain. `blocked` → unblock and re-run; `drift` → `/pb-refine`. You are still the one
   who verifies and (bar `--auto`) the human is still the clock.
+- **A refused checkpoint is the pause, not an error (D64).** Under plumbbob's turn
+  hook a same-turn `checkpoint` is refused by design — present the diff, **end the
+  turn**, and the human's next message is the tick that lands it on re-fire. Never route
+  around it with a raw `git commit`; `--auto`, a typed range, or `auto: true` are the
+  only self-approvals.

package/skills/pb-plan/SKILL.md

@@ -45,6 +45,10 @@ an agent can follow with `/pb-build`. The argument only seeds how you get there.
 1. **Scaffold.** If there is no active session, run `plumbbob start "<title>"`
    to create `.plumbbob/` (baseline recorded, session opened). If a session already
    exists, say so and edit the existing `intent.md` rather than starting over.
+   - **If `start` warns that the gate sees no code checks**, surface that to the
+     human now — while they're still deciding, not at the first refused
+     checkpoint — and offer to set the `check` key in `.plumbbob/settings.json`
+     (e.g. `"check": "npm test"`) before any step is built.
 2. **Frame** (`.plumbbob/intent.md`), with the human: the **Problem** in plain words,
    the **smallest thing** that solves it, what **done looks like**, and what you are
    **explicitly NOT doing**. This is the human's convergence — propose wording, but
@@ -103,6 +107,19 @@ an agent can follow with `/pb-build`. The argument only seeds how you get there.
    baseline → plan → steps. Pass a proportional `--body` (the single-quoted stdin
    heredoc) when the rationale is worth carrying; skip it for a small plan. Do this
    only on the human's approval — the plan is their convergence.
+   - **The plan commit is latched too (D64).** Once the turn ledger exists, `checkpoint
+     --plan` refuses to land in the same turn `start` stamped it: present the plan,
+     **end the turn**, and the human's approving message is the tick that lets it
+     commit on re-fire — the refusal *is* the plan pause. Never route around it with a
+     raw `git commit`. (One documented seam: the very first plan of a brand-new
+     session runs `start` *before* the turn hook has ever ticked, so that single
+     commit predates the ledger and stays guidance-governed — it lands without a
+     refusal.)
+   - **Say what the commit publishes.** The close-out line names the tracked folder:
+     `.plumbbob/builds/<slug>/` now rides this branch into the PR, so teammates will
+     see the plan and build record in review. In the same breath, offer the way out:
+     a repo that won't track a tool folder can restart with `plumbbob start --local`
+     (a fully untracked sidecar) before any steps are built.
 7. **Offer to stress-test it.** Suggest `/pb-refine` to attack the frame for holes (or
    to repair the plan as it drifts). Optional, the human's call.
 

package/skills/pb-verify/SKILL.md

@@ -63,6 +63,20 @@ this skill verifies it the same way: **it reads the diff, not the author**.
    (done-when + seam + diffstat) on its own. Either way, do **not** bump the version or
    touch the changelog — that is the human's `/version` call.
 
+## The latch makes the pause real (D64)
+
+When this session runs under plumbbob's turn hook, `plumbbob checkpoint` **refuses to
+land a step in the same turn it was entered** — and that refusal **is** this pause, not
+an error to route around. If the checkpoint prints *"checkpoint refused — no human turn
+since this step began,"* you have reached the pause the hard way: present the diff and
+the self-review, **end the turn**, and the human's next message is the tick that lets
+the checkpoint land when you re-fire. **Never reach for a raw `git commit` to force the
+land** — that forges the very record the latch exists to keep honest, and the
+commit-ask hook asks the human about it anyway. The refusal is a healthy latch doing its
+job on the *record* while the *work* plane stays free (D10/D13); a `/pb-build --auto` or
+a typed step range in the human's own prompt is the only self-approval, and `auto: true`
+in settings is the standing one.
+
 ## The hard contracts
 
 - **Never skip the pause.** Check → self-review → validate, then wait. Approval is
@@ -76,3 +90,7 @@ this skill verifies it the same way: **it reads the diff, not the author**.
 - **`after`-agents advise; they never gate**. Their output feeds the
   self-review — checkride gates, the human approves. `blocked` → unblock and re-run;
   `drift` → `/pb-refine` before checkpointing. No code path makes them blocking.
+- **A refused checkpoint is the pause, never a workaround (D64).** Under the turn
+  hook a same-turn checkpoint is refused *by design* — present the diff, **end the
+  turn**, and let the human's next message re-tick it. Never route around it with a raw
+  `git commit`; the latch guards the record, not the work.