project-tiny-context-harness 0.8.6 → 0.8.8

package/assets/context_templates/context.toml

@@ -1,14 +1,19 @@
 # Schema v4 Minimal Context graph manifest.
 # Keep the default product/domain area for ordinary projects. Role context nodes
 # are read-purpose slices owned by an area or, only when cross-domain, by the project root.
-# An area is a durable ownership/discovery unit, not a read/edit ACL or a required
-# one-to-one workspace mapping. One area may own several code/workspace roots.
+# A monorepo may place only Context-bearing implementation workspaces under
+# project_context/workspaces/<workspace-id>/**. Each represented Context workspace
+# maps one code root through existing area root/context fields and may contain several Areas.
+# Keep cross-workspace Areas under project_context/areas/**; do not create empty
+# Context directories for code workspaces with no durable facts.
+# Prefer a small top-level repository-common default Area; keep workspace-local
+# Context on-demand unless its facts are genuinely near-universal.
 # Use read_policy = "default" only for near-universal recovery facts; prefer
 # "on-demand" for specialized architecture, contract, deployment or history detail.
 # Default/on-demand selection defines the starting read set, not a maximum:
 # widen to any relevant area/shared Context when task dependencies require it.
-# Monorepos need no additional manifest fields; record useful code/workspace
-# ownership in area or architecture Context and use project-owned scope checks.
+# This optional sparse mirror adds no workspace schema or read/edit ACL. Use
+# project-owned scope checks for task-local intended/supporting changed paths.
 # `ty-context doctor` reports the deterministic default read footprint and exact duplicates.
 # When migrating deep files under project_context/areas/**, refine obvious
 # contract/foundation/subdomain/verification/deployment/implementation-index/

package/assets/context_templates/verification.md

@@ -6,19 +6,21 @@ This role Context records critical repeat-execution paths for the owning area. K
 
 - Owning area: `main`.
 
-## Verification Paths
-
+## Verification Paths
+
 - `npm test` or the shortest project-specific test, smoke, CI, probe or validation command.
 - Verification paths are reusable execution instances, not independent definitions of the verification target. For capability, metric or acceptance claims, first use the owning module's design Context to decide what claim should be proven, then choose the command or probe.
-- For a multi-Area repository with a project-owned changed-path/target-scope verifier, record its stable command and inputs here. It validates intended/supporting change scope for task-attributable paths; it does not restrict which Context or code may be read.
+- Prefer project-native type/compiler/lint/architecture/contract/behavior/benchmark/probe paths. Name what each path can and cannot falsify; a broad pass, Harness heuristic or static shape signal must not be presented as overall code quality or runtime-performance proof.
+- For a multi-workspace repository with a project-owned changed-path/target-scope verifier, record its stable command and inputs here. It validates intended workspace(s) plus allowed supporting changes for task-attributable paths; it does not restrict which Context or code may be read.
 
 ## Required Preparation
 
 - List only durable setup such as services, env files, fixtures, local runtimes or external dependencies needed before rerun.
 
-## Expected Signals
-
-- Name the stage, health check, status, artifact shape or observable signal that means the path reached the intended point.
+## Expected Signals
+
+- Name the stage, health check, status, artifact shape or observable signal that means the path reached the intended point.
+- For repeatable performance/capacity checks, record the stable workload/fixture, metric, environment or environment class, baseline or budget, comparator/tolerance and result location. Keep one-off measured values and pass/fail claims out of Context.
 
 ## Acceptable Warnings
 

package/assets/skills/context_development_engineer/SKILL.md

@@ -19,15 +19,15 @@ When an active `long-task-workflow` binding exists, that Skill owns lifecycle, t
 
 1. 读取 `project_context/global.md`、`project_context/architecture.md`、`project_context/context.toml`、default area root，并按 triggers/read policy 收集相关 on-demand Context 候选。
 2. 在判断 `Context Delta` 前，用任务中明确的 area/module/API/Schema/state/security/verification/deployment 等少量高信号词，对 `project_context/**` 做一次 bounded text search；把命中的 Context 与 manifest 候选合并，读取真正相关文件，并在代码或语义依赖暴露其他 owner 时继续扩读。搜索只补充语义判断，不创建索引、缓存或第二权威，也不创建读取隔离。
-3. 在 multi-Area、monorepo 或其他多产品目标仓库中，把“为理解任务而读取什么”和“用户要修改哪个产品目标”分开。Area/default/read policy 既不是读取 ACL，也不是修改授权；Area 与 workspace 不要求一一对应。若用户表达和耐久 ownership 仍无法区分多个实质不同的同级产品目标，在产品编辑前只问一个精确的目标问题；跨 Area 任务显式列全目标，共享/后端读取只进入 supporting scope。
+3. 在 monorepo 或其他多产品目标仓库中，把“为理解任务而读取什么”和“本任务 intended workspace(s)”分开。可选的 `project_context/workspaces/<workspace-id>/**` 只镜像确有耐久 Context 的实现 workspace；每个已表示 Context workspace 用现有 manifest `root/context` 精确对应一个代码根，内部 Area 负责语义 ownership，跨 workspace Area 留在顶层，未表示的代码 workspace 不建空目录。目录/default/read policy 既不是读取 ACL，也不是修改授权。用用户、产品、路径和仓库事实消歧；仍有多个实质不同的同级目标时，产品编辑前只问一个精确问题。跨 workspace 任务显式列全 intended 与 supporting/shared scope。
 4. 确认目标、约束、成功标准、影响域、验证/部署路径和风险。能从代码或 Context 得到的事实不要重复询问。
 5. Context 决定“应该是什么”；代码说明“现在是什么”；测试和运行证据证明行为。冲突是实现漂移、缺失工作或 stale Context，不能由代码静默重定义归属。
-6. 第一处实现编辑前，完成并对用户可见地给出一次简洁、仓库事实绑定的 `Architecture Deliberation`。不输出私有思维链；输出结论及其 Context、模块/路径、symbol/extension point 和验证依据。风险只改变深度，不取消这个环节。
+6. 第一处实现编辑前，完成并对用户可见地给出一次简洁、仓库事实绑定的 `Architecture Deliberation`，同时给出适用工程质量属性或具体 preservation basis。不输出私有思维链；输出结论及其 Context、模块/路径、symbol/extension point 和验证依据。风险只改变深度，不取消这个环节。
 7. 根据架构考量决定唯一 `Context Delta: none|required`。影响 durable architecture boundary、module ownership、API / Schema / data contract、state / runtime semantics、dependency direction、verification / deployment semantics 或 durable rationale / tradeoff 时为 `required`，先更新 owning Context。不要创建 `plan.md`、Task Contract 文件或 Markdown 映射表。
 8. 用 Agent 内部计划保持 goal、non-goals、owner、boundaries、implementation surfaces、risk 和 verification 清晰。默认流程不要求或验证固定 `plan.md`、matrix、verdict 或 evidence ledger。
-9. 实现后先运行 project-owned verification。仓库已有 changed-path / target-scope checker 时，以本任务准确变更路径和 intended/supporting targets 调用；没有时在 Conformance 中按 durable owner 审查最终 diff，不能把无 provenance 的既有脏改动算进本任务。再在 `Contract Conformance` 中对当前候选快照执行 `Architecture Conformance`，随后单独做 Context drift check；报告实现、验证、架构符合性、Context 状态和 blockers。
-
-## 必经 Architecture Deliberation
+9. 实现顺序、方法和反馈节奏仍由 Goal 决定，但遵守下述边界型实现质量纪律。实现后先运行 project-owned verification。仓库已有 changed-path / target-scope checker 时，以本任务准确变更路径和 intended/supporting targets 调用；没有时在 Conformance 中按 durable owner 审查最终 diff，不能把无 provenance 的既有脏改动算进本任务。再在 `Contract Conformance` 中对当前候选快照执行包含 `Architecture Conformance` 的 `Engineering Quality Conformance`，随后单独做 Context drift check；报告实现、验证、工程/架构符合性、Context 状态和 blockers。
+
+## 必经 Architecture Deliberation 与适用质量判断
 
 每个实现需求都执行一次。small code task 可以得到“保持现有架构”的浅层结论，但必须具体指出当前 owner / extension point、未改变的 durable boundary、验证入口，以及为何没有引入或加重技术债，不能用“无需架构考虑”跳过。
 
@@ -54,30 +54,44 @@ When an active `long-task-workflow` binding exists, that Skill owns lifecycle, t
 - 应复用的 extension point，或新抽象为何确有净收益；
 - 哪个 project-owned lint/AST/dependency/contract test 能证明边界。
 
-范围、owner、controlling Context、dependency direction 或选定设计发生实质变化时，原考量失效，继续实现前先更新。持久结论进入最小 owning Context；实现细节留在代码。不要把“代码更优雅”当作架构要求，也不要让 Harness 变成跨语言通用 dependency analyzer。
-
-## Architecture Conformance
-
-默认流程在项目验证之后，把架构符合性作为 `Contract Conformance` 的必检子项，只针对当前候选快照检查：
-
-- 实际改动是否逃逸预期 capability/path；
-- owner、dependency direction、service/facade/adapter 和唯一 source of truth 是否被绕过或复制；
-- API/Schema/data/state/persistence/lifecycle/recovery 是否出现未声明变化；
-- 是否命中 forbidden shortcut，是否运行了声明的 project-owned architecture/modularity checks；
-- 是否新增或加重重复、职责膨胀、脆弱耦合或无依据抽象等技术债。
+适用质量属性是风险触发的约束与权衡，不是要求全部最大化的 checklist。正确性/invariant 与 maintainability/modularity/changeability 至少给出 preservation 判断；external I/O、async/long-lived resource 或 partial failure 触发 reliability/resource lifecycle；共享可变状态、并行、事务、消息、重试或多 writer 触发 concurrency/consistency；显式性能要求/声称或 hot path、无界 population、I/O、batch/cache/serialization/memory/public abstraction 风险触发 performance/capacity/cost；trust/identity/permission/sensitive data/external input/audit/irreversible effect 触发 security/privacy/safety；公共 API/schema/protocol/storage/config/versioned state 触发 compatibility/migration/rollout；生产 runtime、后台任务或外部集成触发 operability/observability/testability。精确产品/技术谓词继续由 Semantic Facts 拥有，精确选定 UI/UX 值由 selected-design closure 拥有。
+
+性能声称必须绑定 workload、metric、baseline 或 budget、environment、comparator/tolerance 和 project-owned benchmark/probe；静态形状检查不能证明运行时性能。没有可归因测量时，只能报告 preservation 或未验证，不能声称改善或满足预算。未触发的质量族给出具体 preservation basis，不创建空矩阵。
+
+范围、owner、controlling Context、dependency direction、选定设计、质量适用性或 debt disposition 发生实质变化时，原考量失效，继续实现前先更新。持久结论进入最小 owning Context；实现细节留在代码。不要把“代码更优雅”当作架构要求，也不要让 Harness 变成跨语言通用 dependency analyzer。
+
+## Implementation Quality Discipline
+
+实现自由保留在当前 Goal，但必须复用 owning service/facade/adapter/extension point 和唯一 source of truth，做最小而完整、语义清晰且在真实边界验证的修改；不得吞掉 failure、发明未授权 default、隐藏 mutable global state 或复制 owner-held rule。只有真实路径需要时才补齐 timeout/cancellation/retry/idempotency/transaction/concurrency/resource-release；只有稳定概念或有证据的变化轴具有正净收益时才引入抽象。函数更短、文件更多或接口更多本身不等于质量。优先使用项目原生 type/compiler/lint/architecture/behavior/benchmark/probe，不让 Harness 启发式或实现自产 expected 代替权威。
+
+这些是边界 guardrails，不是新阶段、逐编辑强制动作或“整体代码已干净”的机器结论。
+
+## Engineering Quality Conformance
+
+默认流程在项目验证之后，把工程质量符合性作为 `Contract Conformance` 的必检子项，只针对当前候选快照检查；`Architecture Conformance` 是其中的架构子集：
+
+- 实际改动是否逃逸预期 capability/path；
+- owner、dependency direction、service/facade/adapter 和唯一 source of truth 是否被绕过或复制；
+- API/Schema/data/state/persistence/lifecycle/recovery 是否出现未声明变化；
+- 适用的 failure/resource、concurrency/consistency、security、compatibility/rollout、operability 或 performance 不变量是否有真实处理与可归因的当前候选证据；
+- 是否存在 silent fallback、swallowed failure、resource leak、不可恢复 partial state 或无 workload/environment/measurement 支撑的性能声称；
+- 是否命中 forbidden shortcut，是否运行了声明的 project-owned architecture/modularity checks；
+- 是否新增或加重重复、职责膨胀、脆弱耦合或无依据抽象等技术债。
 
 发现问题就返回实现并重跑受影响验证；候选代码或配置再变化，先前 closure 失效。新增或加重技术债默认阻塞交付，除非项目已有显式、收窄、带 owner/reason/tracking/removal condition 的例外。无关 legacy debt 不自动扩张任务范围，但本次触达、依赖或加重的债不能隐藏。
 
-active Long-Task 下不再执行这个默认 closure；同一架构义务由 Contract 中现有 obligations/constraints/forbidden shortcuts、owners/paths/Bindings 和 executable Checks 表达，并只由 Final Gate 对最终快照收口。
+active Long-Task 下不再执行这个默认 closure；同一义务由 Contract 中现有 Source-backed obligations/constraints/forbidden shortcuts、owners/paths/Bindings 和 executable Checks 表达。功能行为通过但工程质量不变量仍可能失败时，必须使用独立 Assertion，不能用 `quality == true`、功能 pass 或 prose review 聚合代替。Final Gate 是唯一 `Engineering Quality Conformance`/`Architecture Conformance` carrier，只证明声明、可证伪且绑定项目检查的集合，不证明整体代码质量；不新增 Source aspect、Claim/risk kind、字段、Gate、状态或 Receipt。
 
-## Multi-Area / Monorepo Context 与修改边界
+## 稀疏 Context Workspace / Monorepo 修改边界
 
 - Context 的职责是把 UI/UX Authority、产品、后端、架构、安全、验证/部署等耐久事实存进正确的全局、共享或 Area owner，并让 Agent 低成本找回；它不能保证软约束下的 Agent 一定正确应用，行为仍由项目检查和 review 证明。
-- Workspace/package/repository root 是代码、构建和依赖单元；Area 是产品/技术责任和 Context owner。一个 Area 可以拥有多个 workspace，共享/基础设施/治理 Area 可以没有独立 workspace。ownership 有长期价值时，每个代码/workspace root 只指定一个 primary Area owner，并把映射写进 Area `Code Entry Points`、architecture Context 或项目自己的 ownership resolver；不要机械地为每个 workspace 新建 Area。
-- 默认集合、manifest/trigger 候选和 bounded search 只是起始 working set，不是最大可读集合。开发 B 时可以读取 A/C 或共享后端；只有它们变成用户意图中的修改目标时才进入 target scope。不要把全量 Context 设成所有任务默认，也不要做强制读取闭包。
-- “首页、页面、客户端、前端”等泛词只有在仓库中确实对应多个实质不同的同级产品目标、且用户/路径/owner 事实仍不能消歧时才阻塞。不能仅凭 default Area、最近修改、最近读取或通用关键词选择客户端。已明确的单目标直接继续；跨端目标全部列明。
-- 最终 scope check 区分 intended product targets、allowed supporting changes、forbidden sibling targets 与实际 task-attributable paths。优先复用 verification Context 指向的项目原生 verifier；它可以理解项目自己的 ownership/applicability。Tiny Context 不创建通用 npm/Nx/Bazel/Cargo/Maven workspace mapper、import/path/runtime scanner、持久 target declaration、applicability matrix、Registry 或第二 Authority。
-- 单 Area/非 monorepo 不增加 schema、迁移或状态；只有仓库实际暴露多个仍然歧义的产品目标时才需要询问。显式 Long-Task 继续由既有 expected/supporting/forbidden/unclassified classifier、Authority Revision、`scope_escape` 和 Final Gate 负责，不再运行一套默认 classifier。
+- Context 继续集中在 `project_context/**`。Monorepo 可以只为确有耐久非代码事实的实现 workspace 建 `project_context/workspaces/<workspace-id>/**`；每个已表示 Context workspace 通过现有 `[[areas]].root/context` 精确映射一个仓库相对代码根，并可包含多个负责不同语义的 Area。完整 workspace 清单仍由 package-manager/build 配置拥有，没 Context 的 workspace 不建空目录。
+- 只属于一个实现 workspace 的 Area/role Context 放在该 Context workspace 内；真正跨 workspace、仓库级、共享、基础设施或治理 Area 继续放在顶层 `project_context/areas/**`。单 workspace/非 monorepo 保持原有顶层布局。不要新增 `[[workspaces]]`、`workspace` 字段、自动拓扑扫描或迁移。
+- Monorepo 的 default Area 通常只保留顶层、仓库公共的最小恢复事实；workspace-local Context 默认 `on-demand`，除非它确实近乎所有任务都需要。不能因为某个客户端被表示，就把它变成隐式全局默认。
+- 默认集合、manifest/trigger 候选和 bounded search 只是起始 working set，不是最大可读集合。开发 B 时可以按需读取 A/C、共享后端、`DESIGN.md` 或相关代码；不要把全量 Context 设成所有任务默认，也不要把 Context workspace 变成强制读取闭包。
+- “首页、页面、客户端、前端”等泛词只有在仓库中确实对应多个实质不同的同级 workspace、且用户/产品/路径/owner 事实仍不能消歧时才阻塞。不能仅凭 default Area、最近修改、最近读取或通用关键词选择客户端。已明确的单目标直接继续；跨端任务列全 intended workspace，并明确 supporting/shared scope。
+- 最终 scope check 区分 intended workspaces、allowed supporting changes、forbidden sibling targets 与实际 task-attributable paths。优先复用 verification Context 指向的项目原生 verifier；没有时在最终 diff/owner Conformance 中检查，且不归因无 provenance 的既有脏改动。Tiny Context 不创建通用 workspace mapper、import/path/runtime scanner、持久 target declaration、Registry 或第二 Authority。
+- 根 `DESIGN.md` 仍是当前共享项目 Design Authority；Context workspace 目录不会自动拆出多套设计系统。单 Area/非 monorepo 不增加 schema、迁移、状态或行为成本。显式 Long-Task 继续由既有 classifier、Authority Revision、`scope_escape` 和 Final Gate 负责，不再运行一套默认 classifier。
 
 ## Capability-First Delivery Boundary
 
@@ -145,15 +159,16 @@ Without an active Long-Task, final-current-candidate Contract Conformance confir
 
 If an active Long-Task applies, do not run the preceding default closure. Express material visual expectations through its existing Requirement, full Control projection, Product `surface_bindings`, Assertion, Check, Stage, Technical Binding and external-confirmation mechanisms. Include the validated residual handoff in real `task.source_paths` and every declared immutable resource in target verification inputs; make target keys/conditions/files equal the handoff. Map covered Source Items into the root conformance Assertion and one independent Assertion per declared verification method. Every method × condition cell carries exact `fact_refs` and canonical `fact_expectations`—subject/variation/property, sensitivity, expected located digest, comparator parameters/tolerance/mask, Oracle and environment—and current typed evidence supplies set-equal per-Fact `fact_results` with actual observation/environment/comparison/verdict; all rows pass and their union closes every required Fact × method obligation. Bind each handoff blocker with the same Source Items and methods. Bind every Control to a required production target and root-entry journey; bind selected exact/constraint targets to typed `design_conformance` actual/comparison evidence. Final Gate is the sole Long-Task carrier. A blocker cannot be dismissed in-band, and scope removal requires revised Source/Contract authority. A design candidate or planned target cannot unlock fidelity implementation: selection must become real Context-reachable Source with one canonical adoption record and an adopted Authority Revision first. Do not introduce a second visual plan, value copy, acceptance document or lifecycle.
 
-## Modularity Check
+## Modularity Check
 
 新实现、重构、重复逻辑、模块边界或影响面控制需要内部记录 `Modularity Check: none|required|exception`。
 
-- 可用 `ty-context check-modularity --file <path> --limit 300` 做计划编辑审计，用 `make validate-code-modularity` 或 `ty-context check-modularity --touched --limit 300 --fail-on-warning` 做交付前硬审计；项目本地 Skill 的 limit 优先。
-- 同时检查物理行数、单函数语句数、分支复杂度、导出数、状态转换和职责；压成一行不能规避。
-- 风险点按 product surface、hook、model、adapter、component、service / facade 或 verification helper 等稳定边界判断，优先复用现有 extension point。
-- 只实施高收益、低风险、语义稳定的抽象；不为一次性代码、不稳定语义或视觉整洁做抽象。
-- `exception` 必须由 `<harnessRoot>/config.yaml` 中 lifecycle-complete waiver 授权，至少包含收窄的 `path`/`category`、`owner`、`introduced_at`、`reason`、`tracking_issue`、`expiry_condition`。交付说明不是机器豁免，已有债务不得继续接收新职责。
+- 可用 `ty-context check-modularity --file <path> --limit 300` 做计划编辑审计，用 `make validate-code-modularity` 或 `ty-context check-modularity --touched --limit 300 --fail-on-warning` 做交付前硬审计；项目本地 Skill 的 limit 优先。
+- 该 capability-aware signal 对所有已纳入格式检查物理行风险；JS/TS family 另做 lexical 单函数语句/分支、导出、状态转换和职责启发式；Python 只做专用 lexical 单函数语句/分支；其他格式（含没有 SFC parser 的 Vue）是 line-only。报告的 `analysis` 说明能力，不支持的指标为 `n/a` 而不是零，且不得参与 risk/regression。
+- 这是 portable risk signal，不是完整跨语言 static analysis、架构证明或运行时性能证据；对应主张优先用 project-native 工具。压缩 JS/TS/Python 代码不能规避其受支持的 lexical 指标。
+- 风险点按 product surface、hook、model、adapter、component、service / facade 或 verification helper 等稳定边界判断，优先复用现有 extension point。
+- 只实施高收益、低风险、语义稳定的抽象；不为一次性代码、不稳定语义或视觉整洁做抽象。
+- `exception` 必须由 `<harnessRoot>/config.yaml` 中 lifecycle-complete waiver 授权，至少包含收窄的 `path`/`category`、`owner`、`introduced_at`、`reason`、`tracking_issue`、`expiry_condition`。交付说明不是机器豁免，已有债务不得继续接收新职责。旧版跨语言 JS 启发式造成且只覆盖现已不支持指标的 waiver，由显式 `ty-context upgrade` 安全清理；普通 `sync` 不做迁移，其他 stale/invalid waiver 继续 fail closed。
 
 ## 自动化机会
 
@@ -163,8 +178,8 @@ If an active Long-Task applies, do not run the preceding default closure. Expres
 
 - area/domain/subdomain：产品或包责任；contract：API/schema/event/workflow/interface；foundation：稳定概念；verification/deployment：可重复路径；implementation-index：导航；decision-rationale：会影响未来选择的稳定原因。
 - 模块 Context 只保留 principles、design logic、rejected alternative/tradeoff 和长期约束；不编造 rationale，不复制实现摘要、命令输出、debug 过程、截图、日志、临时 JSON、raw payload、测试报告或 secrets。
-- `Context Delta: none|required` 是唯一长期事实结果；`Architecture Deliberation` 是可见但 task-local 的流程检查点，`Architecture Context Hit`、`Decision Rationale Hit` 与 `Modularity Check` 仍只是内部路由问题。
+- `Context Delta: none|required` 是唯一长期事实结果；`Architecture Deliberation`、适用质量判断和 `Engineering Quality Conformance` 是可见但 task-local 的流程检查点/子项，`Architecture Context Hit`、`Decision Rationale Hit` 与 `Modularity Check` 仍只是内部路由问题。
 
 ## 输出边界
 
-不默认创建 `.work_products/**`、tech plan、ADR、implementation doc、review/test/release 文档或 lifecycle phases。`Architecture Deliberation` 与 `Architecture Conformance` 通过工作更新和交付状态可见，不生成新的持久产物。用户明确要求独立开发/技术方案时可以临时生成；稳定结论仍提炼回 `project_context/**`。
+不默认创建 `.work_products/**`、tech plan、ADR、implementation doc、review/test/release 文档或 lifecycle phases。`Architecture Deliberation` 与 `Engineering Quality Conformance`（含 `Architecture Conformance`）通过工作更新和交付状态可见，不生成新的持久产物，也不增加 Contract/aspect/Claim/risk/Gate/state。用户明确要求独立开发/技术方案时可以临时生成；稳定结论仍提炼回 `project_context/**`。

package/assets/skills/long-task-workflow/SKILL.md

@@ -25,6 +25,8 @@ For non-UI meaning, complete and accurate Source defaults to the finest independ
 
 One Source-embedded `semantic-fact-manifest-v1` is the task-local canonical index; durable meaning remains in its existing owning Context and exact values remain Source, never copied into Contract. It freezes a complete Inspector Census, explicit N/A/exclusion basis, non-sampling/non-truncation counts/digests, Fact Cells/Facts, dynamic populations, every Fact × required-method obligation, comparator/parameters/tolerance/mask, Oracle/environment and blockers. Require exact conservation: `Expected Semantic Facts = Source Indexed Facts = Contract Indexed Facts`, and `Fact × required-method obligations = Contract proof bindings = current Final-Gate semantic_fact results`. Every current result carries attributable actual observation/environment, frozen comparison authority, Oracle and pass/fail verdict; proof reaches the furthest independently failing boundary. Aggregate strings, representative/pairwise samples, default paths, implementation-generated expectations, ungrounded N/A, proxy-only/self-reported results and one broad pass Boolean cannot close atomic rows. Any material Source hidden as supporting-only, or any missing, extra, duplicate, unresolved, unreadable, unmapped, unimplemented, unexecuted, stale, failed, authority-drifted, reused or indistinguishable identity blocks Authority Lock or Final Gate. Genuine external authority stays a typed External Confirmation. This adds no second plan, value authority, Gate, state or implementation-order rule.
 
+Shared Engineering Quality stays thin around those semantic authorities. Before implementation, the universal Architecture Deliberation also routes triggered quality attributes or records a concrete preservation basis; during implementation, owner/boundary/failure/resource guardrails constrain correctness without prescribing order or feedback cadence; Final Gate is the sole Long-Task Engineering Quality Conformance carrier. Every material independently falsifiable invariant uses existing Source-backed technical obligations/global constraints/forbidden shortcuts, owner/path/Bindings, project-owned Checks and an independent Assertion when functional behavior could pass separately. A performance claim requires a workload, metric, baseline or budget, environment, comparator/tolerance and real benchmark/probe. Final Gate proves exactly that declared project-check-bound set—not overall code quality. Exact expected semantics remain in Semantic Facts or selected design, and no quality Boolean, matrix, Source aspect, Claim/risk kind, Contract field, second Gate, state or Receipt is added.
+
 Only fresh evidence from the complete current final snapshot may create machine acceptance. Exactly fresh `machine_accepted` with no pending External Confirmation is `AcceptedDeliveryTerminal` and may support the full declared-observable no-drift conclusion. Otherwise report the task as unfinished or qualified. `machine_accepted_external_pending` means machine-verifiable authority passed while named external confirmation remains; it proves only the declared machine scope and is not full delivery completion. Machine acceptance has no direct native-Goal effect. Never substitute prose, progress, historical tests, Receipts, one exit code or Agent judgment for the Final Gate.
 
 Anti-Degradation Assurance requires current-implementation Context to match the indexed code/runtime and protects the controlling purpose, enabling key logic, two jointly necessary implementation responsibilities, theorem boundary and adjacent `F = Implementation Freedom Boundary` from implicit weakening. `F` is an efficiency/anti-process-bloat invariant, not a third responsibility or no-drift theorem premise: within declared Source/Contract, architecture, security, forbidden-shortcut, irreversible-effect and external-action boundaries, the current Goal owns implementation order, methods, local feedback cadence and optional one-agent or multi-agent/subagent execution. Harness must not add a development phase/method permission Gate, per-edit verification mandate, agent allocator/scheduler, delegation proof or persistent delegation state. Replacing any protected invariant requires an explicit project-owner design-purpose decision and replacement proof; a new development-stage constraint must additionally identify a distinct path that final proof or a lighter project-owned check cannot cover and have positive net ROI. Agent inference, coordinated edits or cost alone do not authorize it. Mechanism changes use a two-stage hard gate. First prove `Coverage_new ⊇ Coverage_old`, `FalseNegative_new ⊆ FalseNegative_old`, and that Authority, fail-closed behavior and complete-current-final-snapshot proof cannot be bypassed. If non-degradation cannot be proved, preserve the current formal acceptance path. Only after that gate passes may positive net ROI compare incremental anti-degradation or purpose benefit with every incremental Authoring, Runtime, State, Recovery, maintenance, test, process, introduction and migration cost. No cost reduction compensates for weaker drift interception; positive net ROI permits consideration but never overrides the first gate. This creates no second Authority, Gate or state.
@@ -52,7 +54,7 @@ A Draft Outcome is an Outcome in that pre-Authority-Lock Draft, not a new schema
 
 ## Entry And Authoring Loop
 
-1. Read the user request or external initial proposal, selected design resources and minimum controlling Context. Collect the architecture owners, extension points and boundaries needed for the shared deliberation before deciding `Context Delta`.
+1. Read the user request or external initial proposal, selected design resources and minimum controlling Context. Collect the architecture owners, extension points, boundaries and risk-triggered engineering-quality attributes needed for the shared deliberation before deciding `Context Delta`.
    - For material production UI, read the Contract-authoring visual guidance before Compile. When selected resources arrive as an implementation handoff, require one marked `design-resource-handoff-v1` in `task.source_paths` and run `ty-context design-resource preflight <handoff.md>`. Require its canonical Fact manifest, frozen Inspector Census, complete standard/custom axes and property catalog, exact `subject × target × condition × variation × property` Fact Cells, all property-required proofs and exact manifest↔handoff equality; incomplete resource/dependency/Census closure, aggregate state labels, sampling/truncation, ambiguous condition profiles, unsupported evidence, unresolvable located digests, unresolved lineage/conflicts/blockers, missing exact-target layout/pixel Facts or stale identities are blocking. Traverse affected surface/control/target keys from owning Context through `DESIGN.md`, then open every affected selected `exact-target` or `constraint` as Context-reachable ordinary Source. Confirm selection basis, readable immutable identity/digest, declared surface/condition/variation/property coverage and editable upstream owner/locator/update route. A registry or handoff index mention is not consumption. Missing, stale, unreadable, truncated or conflicting resources remain `decision_required`; if only the editable upstream is unavailable, the immutable target may guide implementation but requested resource edits remain a manual/external boundary. An unconfigured starter, candidate, style-only rule or inspiration-only reference is incomplete design authority unless Source explicitly scopes the result as prototype/non-fidelity or supplies a selected target before implementation. When Controls exist, bind them through Product `surface_bindings` to the required production target, existing route/component Bindings and a root-entry journey; each selected target's identity/conditions/files, complete Fact/proof set, canonical per-Fact expectations, covered Source Claims/root Assertion, per-method independent Assertions and blocker lineage must match the handoff before typed evidence can prove it.
    - If the user is asking to generate or iterate standalone design resources before Contract authoring rather than execute this delivery, use `design-resource-authoring` instead. Its result may later return as ordinary Source; it creates no Contract Draft or Authority.
 2. If a valid active binding exists, run `ty-context long-task resume <workdir>`, directly load the installed package-managed `long-task-workflow` Skill and read the lifecycle reference. This recovery path does not depend on implicit invocation.
@@ -62,11 +64,11 @@ A Draft Outcome is an Outcome in that pre-Authority-Lock Draft, not a new schema
 6. Continue reading repository, Source and Context and revise the same Draft. A request to synthesize, refine, complete, implement or use judgment delegates plan-level authoring, but it does not invent the user's tradeoff priorities. Before comparative research or a material product, technical, architecture or provider selection, identify the criteria that could change the research scope, candidate set or recommendation. Infer them only from the user's words, Source, Context or controlling constraints. If quality versus cost, speed, reliability, privacy, lock-in, operational burden or another material priority is unknown or ambiguous, stop before that research or selection and ask one concise targeted clarification. Do not impose a questionnaire, re-ask known preferences or interrupt minor reversible choices whose recommendation would not change.
 7. Once the material preference envelope is clear, decide what research is needed. Use current authoritative or primary evidence for external capability, pricing, quota, license, compatibility, region, security posture or support claims. When one recommendation is then defensible, record it in real Source with the authoring instruction, preference/evidence basis and exact added meaning instead of pausing for approval. Append the delegated item without rewriting the user's original text when ordinary prose is the Source. Return only when authoritative requirements conflict, the user explicitly reserves the choice, a material preference remains unknown, critical semantics have no defensible recommendation or no falsifiable acceptance standard can be formed.
 8. Contract expansion remains limited to meaning-preserving structural decomposition, evidence-backed repository binding and choices first recorded as delegated real Source. Never place a new product rule, default, threshold, recovery behavior, permission or platform/data scope only in Contract YAML. Default plan delegation authorizes meaning, not action: payment, contracting, production deployment or publication, destructive production mutation, real permission grants, sensitive-data transmission and required legal/security/human approval remain named external confirmations. Any conflicting, user-reserved, missing-preference or unsupported semantic remains `decision_required`.
-9. Before formal Compile and the first implementation edit, complete the shared `Architecture Deliberation` once and surface concise repository-bound conclusions rather than private reasoning. Cover the current owner/extension point/source of truth, dependencies and lifecycle, selected and rejected alternatives, a plausible future-change challenge, touched debt and its disposition, forbidden shortcuts and project-owned Checks. Even a preservation result names concrete owners and why no new or worsened debt is introduced. Put durable conclusions in owning Context and material falsifiable delivery conclusions in real marked Source plus existing Contract fields, then decide `Context Delta: none|required`. A material scope, owner, Context or design change before implementation stales and refreshes the deliberation.
+9. Before formal Compile and the first implementation edit, complete the shared `Architecture Deliberation` once and surface concise repository-bound conclusions rather than private reasoning. Cover the current owner/extension point/source of truth, dependencies and lifecycle, selected and rejected alternatives, a plausible future-change challenge, touched debt and its disposition, forbidden shortcuts, project-owned Checks and each triggered quality attribute or concrete preservation basis. Correctness/invariants and maintainability/changeability always receive at least preservation; reliability/resource lifecycle, concurrency/consistency, performance/capacity/cost, security/privacy/safety, compatibility/migration/rollout and operability/observability/testability activate only when material. Even a preservation result names concrete owners and why no new or worsened debt is introduced. Put durable conclusions in owning Context and material falsifiable delivery conclusions in real marked Source plus existing Contract fields, then decide `Context Delta: none|required`. A material scope, owner, Context, design, quality-applicability or debt-disposition change before implementation stales and refreshes the deliberation.
 10. Close every real Control's 22 canonical fields through `field_coverage` and its Outcome's cross-Control meaning through `control_relation_closure`; use `specified`, explicit `not_applicable` or blocking `unresolved`, and give the closure exact applicability refs even when no Controls apply. Independently close the semantic manifest: exact Source/context input inventory and digests; all standard/custom family, unit, relation, population, axis/value/combination, property, Fact Cell, Fact, proof, Oracle, environment and blocker Census identities; complete generation counts/digests; and exact Source→Fact→Claim/applicability→proof binding equality. Each machine proof maps to one single-Fact Assertion and typed `semantic_fact` capability; each external proof maps to an impact-complete External Confirmation. Declare only actual applicability profiles, each with an atomic, duplicate-free dimension assignment plus exact target, journey, Given condition/input/state refs and ordered When refs. Every Claim lists all applicable profiles; every Claim-bearing Assertion proves one Claim in one matching profile and all required proof surfaces. Declare each execution target's runtime capabilities and require the production family, cold-start and production-root capabilities where applicable. Give every Assertion the minimum all-of Evidence Capabilities that can actually prove its Claim. Every behavioral Claim-bearing Assertion also needs a same-Check claim-local `replace_json_value` or `replace_text` wrong-semantic witness and a claimless target-runtime liveness Assertion that remains passing; whole-file replacement is compatibility-only and cannot prove semantic binding. Population declares a universe Binding whose carriers are Check inputs and proves exact universe = eligible = observed plus valid exclusions. Separate required success and degradation Checks. Type every external confirmation with impacted Claim refs and target-blocking effect. For selected design targets, keep resource-integrity Checks distinct from root-bound implementation conformance, freeze the validated handoff and target resources, preserve exact condition equality, map every covered handoff Source Item into separate attributable Assertions, bind each verification method to its own `design_method` evidence with exact per-condition `fact_refs`, distinct record and primary-observation paths plus a unique current primary digest for every condition, require the cell union to equal the complete target fact set, and declare current actual/comparison artifacts. Preserve every blocker's required target capabilities; use a machine Claim only on the exact capability-qualified target, otherwise keep a target-blocking External Confirmation. Playwright must attach both declared cell artifacts in every project instance. Use `context_snapshot_mode: full`. Run read-only `ty-context long-task preflight <workdir>`, repair every semantic manifest, handoff, Contract and `decision_required` error in the same Draft, then formally Compile only when ready.
 11. When the first Compile returns `execution_model_checkpoint.required: true`, obey its terminal-turn boundary. Unless an earlier user message explicitly states this task's current-model or switch-and-resume strategy, do no product implementation, file edit, build or test after that result; end the current turn and ask the user to choose `continue_current_model` or switch models and then resume the active Long-Task. Generic “continue”, “resume”, “finish” or “continue the Goal” language does not satisfy the checkpoint. Later revisions return `required: false` and do not repeat it.
 
-Architecture quality uses the existing authority model, not a new gate or field. The visible deliberation proves that architecture work occurred, not that subjective quality is machine-proven. Encode every material falsifiable invariant as a Source-backed technical obligation/global constraint/forbidden shortcut plus owner/path/Binding boundaries and a project-owned executable Check. Functional acceptance cannot substitute when the architecture claim can fail independently. An unverifiable design preference remains task-local, durable Context or `decision_required`; it must not be promoted into false proof.
+Engineering quality uses the existing authority model, not a new stage, Gate or field. The visible deliberation makes the checkpoint reviewable but does not machine-prove subjective quality. Encode every material falsifiable architecture or quality invariant as a Source-backed technical obligation/global constraint/forbidden shortcut plus owner/path/Binding boundaries, a project-owned executable Check and a separate Assertion when functional acceptance could pass independently. Never substitute a broad quality Boolean, functional pass or prose review. An unverifiable preference remains task-local, durable Context or `decision_required`; it must not be promoted into false proof.
 
 ## Rolling Execution
 
@@ -74,7 +76,7 @@ After Authority Lock and the one-time execution-model checkpoint are satisfied,
 
 Re-evaluate `Context Delta` whenever implementation or repair discovers a durable fact. Controlling Context changes always use Authority Revision; they require a user decision only when mapped Claims, targets, proof obligations or another decision boundary changes. Graph-derived, non-explicit `implementation-index` and `archive` are Supporting Context in referenced mode and may auto-revise when only navigation/background changed. Full snapshot mode treats every selected Context file as controlling.
 
-If rolling implementation materially changes scope, ownership, dependency direction, the selected design or a debt disposition, refresh the Architecture Deliberation and express any authority change through marked Source/Context plus protected revision before continuing. This is refinement of the same checkpoint, not a second workflow stage.
+If rolling implementation materially changes scope, ownership, dependency direction, the selected design, quality-attribute applicability or a debt disposition, refresh the Architecture Deliberation and express any authority change through marked Source/Context plus protected revision before continuing. This is refinement of the same checkpoint, not a second workflow stage.
 
 Use `verify --explain [--outcome/--check]` when execution cost is unclear; it previews declared main and Counterfactual runner invocations without executing or writing Progress. Use targeted `verify --outcome/--check` for optional feedback and repair when its expected localization value exceeds its cost. Progress is repair evidence only and never acceptance authority. Keep precise findings attached to the owning Source item, Claim, Assertion, Check, Binding and owner path. Do not add another model-switch pause or turn delegation into a Harness scheduler, state or proof source.
 
@@ -95,7 +97,7 @@ Complete Context, implementation and project tests, create a clean candidate com
 
 Final Gate recompiles Source authority, captures semantic and raw Contract protected-input identity, validates active task/revision/compiled/worktree identity, creates one Git-tree snapshot and reruns every required Global and Outcome Check. It requires exactly one current typed semantic result for every and only every compiled Fact × machine-method obligation, preserving actual observation/environment, frozen expected/comparison/tolerance/mask/Oracle authority and passing verdict; external obligations remain named confirmations. It then recompiles again and requires unchanged Contract/fragments, Source semantic manifest, Controlling Context, verifier, runner and verification/workdir inputs, plus unchanged workspace/tree and Active Authority, before acceptance. It derives Stage results and target qualification from that run; it does not trust targeted Progress as a Stage pass. A target-runtime Check must exercise its exact target in that current Gate execution; rerunning a reader for a historical or tracked status report is not live target proof. Design-resource integrity, an isolated route or `visual_render` cannot replace required root-bound `design_conformance`, and unresolved semantic or design blockers remain blocking. Final Gate, Stop and close never trust historical Progress, Receipt or compiled cache.
 
-Final Gate is the Long-Task path's sole `Architecture Conformance` carrier. It reruns the declared architecture obligations/constraints/forbidden shortcuts, owner/path/Binding boundaries and project-owned Checks on that same snapshot and blocks scope escape, bypass, duplicate authority, a second source of truth, wrong dependency direction, undeclared boundary change or new/worsened debt represented by those invariants. Do not also run the default Workflow's standalone Contract Conformance closure. Any later candidate or authority change invalidates the Gate and uses the existing freshness path again.
+Final Gate is the Long-Task path's sole `Engineering Quality Conformance` and `Architecture Conformance` carrier. It reruns the declared architecture/quality obligations, constraints and forbidden shortcuts, owner/path/Binding boundaries, independent Assertions and project-owned Checks on that same snapshot. It blocks the represented scope escape, bypass, duplicate authority, second source of truth, wrong dependency direction, undeclared boundary/lifecycle change, silent failure, unsupported performance claim or new/worsened debt. It proves only those declared falsifiable invariants, never overall code quality. Do not also run the default Workflow's Contract Conformance closure. Any later candidate or authority change invalidates the Gate and uses the existing freshness path again.
 
 Machine acceptance covers only declared machine authority. Preserve every pending external confirmation through `final-gate`, `status`, `resume`, `stop-check`, the package-owned Stop Hook and `close`; accepted output identifies `acceptance_scope: declared_machine_authority` and `native_goal_effect: none`, while `closed_scope: machine_authority` means only Authority cleanup. Do not invent external-confirmation or native-Goal tracking state.
 
@@ -103,4 +105,4 @@ Before invoking platform-native Goal completion, perform one veto-only conforman
 
 ## Handoff
 
-Report implementation, effective risk, Architecture Deliberation/Conformance status, Claim Coverage, Stage frontier/results, declared target profile, exact `target_state`, Live Gate result, acceptance scope, every pending external confirmation, Context status and blockers. Use verifier terms exactly: `progress_passing` means targeted repair evidence, `progress_stale` is a freshness fact rather than a current pass or immediate rerun command, `final_workflow_status: null` means unfinished, `authority_revision_adopted` means return to rolling execution, and `machine_accepted_external_pending` must retain its named confirmations and never be summarized as `AcceptedDeliveryTerminal` or full no-drift delivery. Contract target states are only `implementation_complete`, `target_profile_usable` and `production_release_ready`; terminal failure uses `not_accepted` or `blocked_external`. Never shorten targeted progress to “Outcome complete” or invent per-platform progress/status. State the theorem boundary honestly: undeclared or inaccurate Source cannot be discovered mechanically; the named project oracle must be semantically sound; the supported direct-literal verifier dependency graph is frozen while other declared verification inputs, indirect runtime access, installed package/runtime behavior, Harness verifier and Git metadata form the trusted computing boundary; the visible checkpoint cannot prove private reasoning or universal future-proofing; native-Goal/model selection belongs to the host/user; and internal platform delegation is not observed.
+Report implementation, effective risk, Architecture Deliberation and Engineering Quality/Architecture Conformance status, Claim Coverage, Stage frontier/results, declared target profile, exact `target_state`, Live Gate result, acceptance scope, every pending external confirmation, Context status and blockers. Use verifier terms exactly: `progress_passing` means targeted repair evidence, `progress_stale` is a freshness fact rather than a current pass or immediate rerun command, `final_workflow_status: null` means unfinished, `authority_revision_adopted` means return to rolling execution, and `machine_accepted_external_pending` must retain its named confirmations and never be summarized as `AcceptedDeliveryTerminal` or full no-drift delivery. Contract target states are only `implementation_complete`, `target_profile_usable` and `production_release_ready`; terminal failure uses `not_accepted` or `blocked_external`. Never shorten targeted progress to “Outcome complete” or invent per-platform progress/status. State the theorem boundary honestly: undeclared or inaccurate Source cannot be discovered mechanically; the named project oracle must be semantically sound; the supported direct-literal verifier dependency graph is frozen while other declared verification inputs, indirect runtime access, installed package/runtime behavior, Harness verifier and Git metadata form the trusted computing boundary; Final Gate proves only its declared project-check-bound quality set; the visible checkpoint cannot prove private reasoning or universal future-proofing; native-Goal/model selection belongs to the host/user; and internal platform delegation is not observed.

package/assets/skills/long-task-workflow/references/authority-lifecycle.md

@@ -67,7 +67,7 @@ Report their exact meaning: `progress_passing` is current targeted repair eviden
 
 ## Final Gate And Terminal Paths
 
-Before Final Gate, complete Context/code/tests and create a clean candidate commit. Final Gate first verifies the accepted compiled authority is still fresh, then recompiles Source authority and records semantic plus raw protected-input identity for the Contract and fragments, the Source-embedded semantic manifest, every Source file, full Controlling Context, verifier/runner, recursively frozen local verifier dependencies, `verification_inputs` and workdir inputs. It validates the common-dir record/marker, creates one Git-tree snapshot and reruns every Check and sensitivity control. Non-UI semantic evidence must reproduce exactly every compiled machine Fact × method expectation with one attributable actual observation/environment/comparison/verdict under frozen expected/tolerance/mask/Oracle authority; selected-design method evidence must reproduce its exact compiled `fact_results` universe; every verdict passes, while named external obligations remain pending rather than fabricated. After execution it recompiles and re-hashes the same full protected set; any change returns `protected_inputs_changed_during_final_gate`, while an Active Authority race returns `active_authority_changed_during_final_gate`. Only unchanged protected inputs, workspace/tree and Authority may be accepted. It is the sole Long-Task `Architecture Conformance` carrier and the sole non-UI semantic and selected-design closure carrier: material deliberation conclusions must already be declared through existing obligations/constraints/forbidden shortcuts, owners/paths/Bindings and project-owned Checks, and no separate default Contract Conformance closure runs. A target-runtime Check must exercise its exact target again in that Final Gate execution; rereading historical status does not become live proof merely because the reader reran. The Receipt reports the target profile/state and every Stage as `passed`, `failed`, `blocked_external` or `blocked_dependency`.
+Before Final Gate, complete Context/code/tests and create a clean candidate commit. Final Gate first verifies the accepted compiled authority is still fresh, then recompiles Source authority and records semantic plus raw protected-input identity for the Contract and fragments, the Source-embedded semantic manifest, every Source file, full Controlling Context, verifier/runner, recursively frozen local verifier dependencies, `verification_inputs` and workdir inputs. It validates the common-dir record/marker, creates one Git-tree snapshot and reruns every Check and sensitivity control. Non-UI semantic evidence must reproduce exactly every compiled machine Fact × method expectation with one attributable actual observation/environment/comparison/verdict under frozen expected/tolerance/mask/Oracle authority; selected-design method evidence must reproduce its exact compiled `fact_results` universe; every verdict passes, while named external obligations remain pending rather than fabricated. After execution it recompiles and re-hashes the same full protected set; any change returns `protected_inputs_changed_during_final_gate`, while an Active Authority race returns `active_authority_changed_during_final_gate`. Only unchanged protected inputs, workspace/tree and Authority may be accepted. It is the sole Long-Task `Engineering Quality Conformance`/`Architecture Conformance` carrier and the sole non-UI semantic and selected-design closure carrier: material independently falsifiable deliberation conclusions must already be declared through existing Source-backed obligations/constraints/forbidden shortcuts, owners/paths/Bindings, project-owned Checks and separate Assertions when functional behavior can pass independently. It proves exactly that declared project-check-bound engineering-quality set, not overall code quality, and no separate default Contract Conformance closure runs. A target-runtime Check must exercise its exact target again in that Final Gate execution; rereading historical status does not become live proof merely because the reader reran. The Receipt reports the target profile/state and every Stage as `passed`, `failed`, `blocked_external` or `blocked_dependency`.
 
 Commit, verifier migration, clear and abandon share one active-state lock. Stop/close clear only the identity actually accepted through CAS and preserve `machine_accepted_external_pending` plus every named external confirmation in output. Final Gate/Stop/close identify `acceptance_scope: declared_machine_authority` and `native_goal_effect: none`; close additionally identifies `closed_scope: machine_authority`. The Stop Hook emits the same scope as one non-blocking message for either accepted machine status. A stale Receipt exposes no accepted workflow status.
 

package/assets/skills/long-task-workflow/references/contract-authoring.md

@@ -72,21 +72,23 @@ Declare cheap machine-checkable prerequisites through existing environment requi
 - `task.target_profile` declares `required_state` plus a non-empty, duplicate-free `required_target_refs`. Each ref resolves to a `product` execution target with one bounded runtime family, root entrypoint and explicit capabilities. A required product target declares its family capability plus `cold-start` and `production-root`; every Stage Gate and every `critical_user_path` Outcome provides root `target_runtime` proof for every required ref. Optional support/observer targets never substitute.
 - Use `implementation_complete` only when code-level implementation is the selected target, `target_profile_usable` when the declared required targets must be usable, and `production_release_ready` only when release gates are part of the selected target. These are terminal target qualifications, not Outcome progress states.
 
-## Architecture Deliberation And Closure
-
-Architecture Deliberation occurs once for every implementation delivery before formal Compile and the first implementation edit; risk changes depth, not occurrence. Surface concise conclusions and repository evidence rather than private chain-of-thought. A preservation result still names the concrete owner/extension point and explains why durable boundaries and debt do not worsen. Material work covers module ownership, unique source of truth, dependency direction, API/schema/data boundary, state lifecycle, persistence/recovery, security boundary, compatibility/migration, selected and rejected alternatives, one plausible future-change challenge, touched technical debt and forbidden bypasses.
-
-Represent every material falsifiable invariant with existing Contract fields:
+## Engineering Quality Deliberation And Closure
+
+Architecture Deliberation occurs once for every implementation delivery before formal Compile and the first implementation edit; risk changes depth, not occurrence. Surface concise conclusions and repository evidence rather than private chain-of-thought. A preservation result still names the concrete owner/extension point, applicable engineering-quality attributes or their concrete preservation basis, and why durable boundaries and debt do not worsen. Material work covers module ownership, unique source of truth, dependency direction, API/schema/data boundary, state/resource lifecycle, persistence/recovery, security boundary, compatibility/migration, selected and rejected alternatives, one plausible future-change challenge, touched technical debt, forbidden bypasses and triggered failure/load/threat scenarios.
+
+Correctness/invariants and maintainability/changeability always receive at least preservation. Reliability/resource lifecycle, concurrency/consistency, performance/capacity/cost, security/privacy/safety, compatibility/migration/rollout and operability/observability/testability activate only when the Source or implementation risk makes them material. Exact expected predicates remain in Semantic Facts or selected-design authority. A performance claim additionally binds workload, metric, baseline or budget, environment, comparator/tolerance and a project-owned benchmark/probe; static shape cannot prove runtime performance.
+
+Represent every material independently falsifiable architecture or engineering-quality invariant with existing Contract fields:
 
 1. a Source-backed technical obligation, global constraint or forbidden shortcut;
 2. owner Context and expected/support/forbidden paths;
 3. a Binding to the implementation carrier when Counterfactual sensitivity is required;
-4. a project-owned executable architecture check, such as the repository's lint, AST, dependency or contract test;
-5. a separate Assertion when functional behavior could pass while the architecture invariant fails.
-
-New or worsened debt is unacceptable unless a project-owned bounded exception identifies owner, rationale, tracking and removal/expiry condition. Unrelated legacy debt does not automatically expand delivery scope, but debt touched, relied on or worsened by the implementation cannot remain hidden. Material changes to scope, owner, Context, dependency direction, selected design or debt disposition refresh the deliberation and, after Authority Lock, use protected revision.
-
-Do not encode subjective “clean architecture” or generic quality prose as machine authority. If no reliable observation can falsify it, keep it as durable Context/review judgment or return `decision_required`. Harness routes the repository's architecture check; it does not become a language-generic dependency analyzer. Final Gate is the only Long-Task Architecture Conformance carrier and reruns these declared Checks on its current snapshot; do not add a default-workflow closure, architecture field, second Gate or state.
+4. a project-owned executable type, compiler, lint, AST, dependency, contract, behavior, benchmark or probe Check; and
+5. a separate Assertion when functional behavior could pass while the quality invariant fails.
+
+New or worsened debt is unacceptable unless a project-owned bounded exception identifies owner, rationale, tracking and removal/expiry condition. Unrelated legacy debt does not automatically expand delivery scope, but debt touched, relied on or worsened by the implementation cannot remain hidden. Material changes to scope, owner, Context, dependency direction, selected design or debt disposition refresh the deliberation and, after Authority Lock, use protected revision.
+
+Do not encode subjective “clean architecture”, `quality == true`, a functional pass or generic quality prose as machine authority. If no reliable observation can falsify it, keep it as durable Context/review judgment or return `decision_required`. Harness routes repository-native checks; it does not become a language-generic dependency, quality or performance analyzer. Final Gate is the only Long-Task Engineering Quality/Architecture Conformance carrier and reruns these declared Checks on its current snapshot. It proves only the declared project-check-bound invariant set, not overall code quality. Do not add a default-workflow closure, quality matrix, Source aspect, Claim/risk kind, Contract field, second Gate, state or Receipt.
 
 ## Proxy And Target Runtime Independence
 

package/dist/commands/check-modularity.js

@@ -39,7 +39,7 @@ export async function checkModularity(args) {
                     : file.overLimit
                         ? "observed-risk"
                         : "ok";
-            console.log(`${prefix}: ${file.relativePath} ${file.lines} lines statements=${file.metrics.maxFunctionStatements} branches=${file.metrics.maxBranchComplexity} exports=${file.metrics.exports} transitions=${file.metrics.stateTransitions} responsibilities=${file.metrics.responsibilities.join(",") || "none"} statement_at=${formatLocation(file.metrics.maxFunctionStatementsLocation)} branch_at=${formatLocation(file.metrics.maxBranchComplexityLocation)}`);
+            console.log(`${prefix}: ${file.relativePath} ${file.lines} lines analysis=${file.metrics.analysis} statements=${formatMetric(file.metrics.maxFunctionStatements)} branches=${formatMetric(file.metrics.maxBranchComplexity)} exports=${formatMetric(file.metrics.exports)} transitions=${formatMetric(file.metrics.stateTransitions)} responsibilities=${formatResponsibilities(file.metrics.responsibilities)} statement_at=${formatLocation(file.metrics.maxFunctionStatementsLocation, file.metrics.maxFunctionStatements !== null)} branch_at=${formatLocation(file.metrics.maxBranchComplexityLocation, file.metrics.maxBranchComplexity !== null)}`);
         }
         for (const error of report.errors) {
             console.error(`error: ${error}`);
@@ -63,9 +63,21 @@ export async function checkModularity(args) {
         process.exitCode = 1;
     }
 }
-function formatLocation(location) {
+function formatLocation(location, supported) {
+    if (!supported) {
+        return "n/a";
+    }
     return location ? `${location.symbol}:${location.line}` : "none";
 }
+function formatMetric(value) {
+    return value === null ? "n/a" : String(value);
+}
+function formatResponsibilities(value) {
+    if (value === null) {
+        return "n/a";
+    }
+    return value.join(",") || "none";
+}
 function parseArgs(args) {
     const parsed = {
         touched: false,
@@ -160,7 +172,8 @@ function helpText() {
   check-modularity --base <ref> [--limit 300] [--fail-on-warning]
   check-modularity --config-only
 
-Audits physical lines, per-function statements and branch complexity, exports, state transitions and module responsibilities.
+Portable heuristic risk signal: all selected files get physical-line analysis; JS/TS gets lexical function/branch/export/state-transition/responsibility metrics; Python gets lexical per-function statement/branch metrics; other included formats are line-only.
+The report names analysis=js-ts-heuristic|python-heuristic|line-only and prints n/a for unsupported metrics. It is not complete cross-language static analysis, architecture proof or runtime-performance evidence; prefer project-native tools for those claims.
 For --touched and --base, existing findings are reported but only new or worsened non-line complexity is a warning; physical lines remain a risk signal and new files are audited in full.
 The default is warning-only; --fail-on-warning lets projects opt into CI enforcement.
 Generated configs default to modularity.policy: strict_except_generated; omitted policy is treated as scoped_waivers for compatibility.

package/dist/lib/context-manifest.js

@@ -6,12 +6,17 @@ export function defaultContextManifestTemplate() {
         "# Schema v4 Minimal Context graph manifest.",
         "# Keep the default product/domain area for ordinary projects. Role context nodes",
         "# are read-purpose slices owned by an area or, only when cross-domain, by the project root.",
-        "# An area is a durable ownership/discovery unit, not a read/edit ACL or a required",
-        "# one-to-one workspace mapping. One area may own several code/workspace roots.",
+        "# A monorepo may place only Context-bearing implementation workspaces under",
+        "# project_context/workspaces/<workspace-id>/**. Each represented Context workspace",
+        "# maps one code root through existing area root/context fields and may contain several Areas.",
+        "# Keep cross-workspace Areas under project_context/areas/**; do not create empty",
+        "# Context directories for code workspaces with no durable facts.",
+        "# Prefer a small top-level repository-common default Area; keep workspace-local",
+        "# Context on-demand unless its facts are genuinely near-universal.",
         "# Default/on-demand selection defines the starting read set, not a maximum;",
         "# widen to any relevant area/shared Context when task dependencies require it.",
-        "# Monorepos need no additional manifest fields; record useful code/workspace",
-        "# ownership in area or architecture Context and use project-owned scope checks.",
+        "# This optional sparse mirror adds no workspace schema or read/edit ACL. Use",
+        "# project-owned scope checks for task-local intended/supporting changed paths.",
         "# When migrating deep files under project_context/areas/**, refine obvious",
         "# contract/foundation/subdomain/verification/deployment/implementation-index/",
         "# decision-rationale/archive files into [[context]] entries instead of keeping",

package/dist/lib/migrations.js

@@ -9,6 +9,7 @@ import { createDesignMdIfMissing, DESIGN_MD_PATH } from "./design-md.js";
 import { ensureDir, listFiles, pathExists, readText, writeTextIfChanged, } from "./fs.js";
 import { harnessConfigPath, harnessRoot } from "./harness-root.js";
 import { legacySdlcHarnessMigration } from "./legacy-sdlc-migration.js";
+import { modularityCapabilityWaiverMigration } from "./modularity-capability-migration.js";
 import { parseYaml, stringifyYaml } from "./yaml.js";
 import { semanticDriftMigrationFields } from "./long-task-semantic-drift-migration.js";
 async function verifyNoop() {
@@ -18,6 +19,7 @@ const REMOVED_NORMAL_LONG_TASK_SKILL = "normal-long-task";
 const REMOVED_NORMAL_LONG_TASK_SKILL_SHA256 = "7a4f755da9a32e07f258d6c7fc5e5c70395257c72efb8a9ad4995cddcc4c73ba";
 export const migrations = [
     legacySdlcHarnessMigration,
+    modularityCapabilityWaiverMigration,
     {
         id: "long-task-v2-semantic-drift-authority",
         introducedIn: "0.7.2",

package/dist/lib/modularity-capability-migration.d.ts

@@ -0,0 +1,2 @@
+import type { Migration } from "./migrations.js";
+export declare const modularityCapabilityWaiverMigration: Migration;