project-tiny-context-harness 0.8.7 → 0.8.10

package/assets/skills/long-task-workflow/SKILL.md

@@ -25,6 +25,8 @@ For non-UI meaning, complete and accurate Source defaults to the finest independ
 
 One Source-embedded `semantic-fact-manifest-v1` is the task-local canonical index; durable meaning remains in its existing owning Context and exact values remain Source, never copied into Contract. It freezes a complete Inspector Census, explicit N/A/exclusion basis, non-sampling/non-truncation counts/digests, Fact Cells/Facts, dynamic populations, every Fact × required-method obligation, comparator/parameters/tolerance/mask, Oracle/environment and blockers. Require exact conservation: `Expected Semantic Facts = Source Indexed Facts = Contract Indexed Facts`, and `Fact × required-method obligations = Contract proof bindings = current Final-Gate semantic_fact results`. Every current result carries attributable actual observation/environment, frozen comparison authority, Oracle and pass/fail verdict; proof reaches the furthest independently failing boundary. Aggregate strings, representative/pairwise samples, default paths, implementation-generated expectations, ungrounded N/A, proxy-only/self-reported results and one broad pass Boolean cannot close atomic rows. Any material Source hidden as supporting-only, or any missing, extra, duplicate, unresolved, unreadable, unmapped, unimplemented, unexecuted, stale, failed, authority-drifted, reused or indistinguishable identity blocks Authority Lock or Final Gate. Genuine external authority stays a typed External Confirmation. This adds no second plan, value authority, Gate, state or implementation-order rule.
 
+Shared Engineering Quality stays thin around those semantic authorities. Before implementation, the universal Architecture Deliberation also routes triggered quality attributes or records a concrete preservation basis; during implementation, owner/boundary/failure/resource guardrails constrain correctness without prescribing order or feedback cadence; Final Gate is the sole Long-Task Engineering Quality Conformance carrier. Every material independently falsifiable invariant uses existing Source-backed technical obligations/global constraints/forbidden shortcuts, owner/path/Bindings, project-owned Checks and an independent Assertion when functional behavior could pass separately. A performance claim requires a workload, metric, baseline or budget, environment, comparator/tolerance and real benchmark/probe. Final Gate proves exactly that declared project-check-bound set—not overall code quality. Exact expected semantics remain in Semantic Facts or selected design, and no quality Boolean, matrix, Source aspect, Claim/risk kind, Contract field, second Gate, state or Receipt is added.
+
 Only fresh evidence from the complete current final snapshot may create machine acceptance. Exactly fresh `machine_accepted` with no pending External Confirmation is `AcceptedDeliveryTerminal` and may support the full declared-observable no-drift conclusion. Otherwise report the task as unfinished or qualified. `machine_accepted_external_pending` means machine-verifiable authority passed while named external confirmation remains; it proves only the declared machine scope and is not full delivery completion. Machine acceptance has no direct native-Goal effect. Never substitute prose, progress, historical tests, Receipts, one exit code or Agent judgment for the Final Gate.
 
 Anti-Degradation Assurance requires current-implementation Context to match the indexed code/runtime and protects the controlling purpose, enabling key logic, two jointly necessary implementation responsibilities, theorem boundary and adjacent `F = Implementation Freedom Boundary` from implicit weakening. `F` is an efficiency/anti-process-bloat invariant, not a third responsibility or no-drift theorem premise: within declared Source/Contract, architecture, security, forbidden-shortcut, irreversible-effect and external-action boundaries, the current Goal owns implementation order, methods, local feedback cadence and optional one-agent or multi-agent/subagent execution. Harness must not add a development phase/method permission Gate, per-edit verification mandate, agent allocator/scheduler, delegation proof or persistent delegation state. Replacing any protected invariant requires an explicit project-owner design-purpose decision and replacement proof; a new development-stage constraint must additionally identify a distinct path that final proof or a lighter project-owned check cannot cover and have positive net ROI. Agent inference, coordinated edits or cost alone do not authorize it. Mechanism changes use a two-stage hard gate. First prove `Coverage_new ⊇ Coverage_old`, `FalseNegative_new ⊆ FalseNegative_old`, and that Authority, fail-closed behavior and complete-current-final-snapshot proof cannot be bypassed. If non-degradation cannot be proved, preserve the current formal acceptance path. Only after that gate passes may positive net ROI compare incremental anti-degradation or purpose benefit with every incremental Authoring, Runtime, State, Recovery, maintenance, test, process, introduction and migration cost. No cost reduction compensates for weaker drift interception; positive net ROI permits consideration but never overrides the first gate. This creates no second Authority, Gate or state.
@@ -52,7 +54,7 @@ A Draft Outcome is an Outcome in that pre-Authority-Lock Draft, not a new schema
 
 ## Entry And Authoring Loop
 
-1. Read the user request or external initial proposal, selected design resources and minimum controlling Context. Collect the architecture owners, extension points and boundaries needed for the shared deliberation before deciding `Context Delta`.
+1. Read the user request or external initial proposal, selected design resources and minimum controlling Context. Collect the architecture owners, extension points, boundaries and risk-triggered engineering-quality attributes needed for the shared deliberation before deciding `Context Delta`.
    - For material production UI, read the Contract-authoring visual guidance before Compile. When selected resources arrive as an implementation handoff, require one marked `design-resource-handoff-v1` in `task.source_paths` and run `ty-context design-resource preflight <handoff.md>`. Require its canonical Fact manifest, frozen Inspector Census, complete standard/custom axes and property catalog, exact `subject × target × condition × variation × property` Fact Cells, all property-required proofs and exact manifest↔handoff equality; incomplete resource/dependency/Census closure, aggregate state labels, sampling/truncation, ambiguous condition profiles, unsupported evidence, unresolvable located digests, unresolved lineage/conflicts/blockers, missing exact-target layout/pixel Facts or stale identities are blocking. Traverse affected surface/control/target keys from owning Context through `DESIGN.md`, then open every affected selected `exact-target` or `constraint` as Context-reachable ordinary Source. Confirm selection basis, readable immutable identity/digest, declared surface/condition/variation/property coverage and editable upstream owner/locator/update route. A registry or handoff index mention is not consumption. Missing, stale, unreadable, truncated or conflicting resources remain `decision_required`; if only the editable upstream is unavailable, the immutable target may guide implementation but requested resource edits remain a manual/external boundary. An unconfigured starter, candidate, style-only rule or inspiration-only reference is incomplete design authority unless Source explicitly scopes the result as prototype/non-fidelity or supplies a selected target before implementation. When Controls exist, bind them through Product `surface_bindings` to the required production target, existing route/component Bindings and a root-entry journey; each selected target's identity/conditions/files, complete Fact/proof set, canonical per-Fact expectations, covered Source Claims/root Assertion, per-method independent Assertions and blocker lineage must match the handoff before typed evidence can prove it.
    - If the user is asking to generate or iterate standalone design resources before Contract authoring rather than execute this delivery, use `design-resource-authoring` instead. Its result may later return as ordinary Source; it creates no Contract Draft or Authority.
 2. If a valid active binding exists, run `ty-context long-task resume <workdir>`, directly load the installed package-managed `long-task-workflow` Skill and read the lifecycle reference. This recovery path does not depend on implicit invocation.
@@ -62,11 +64,11 @@ A Draft Outcome is an Outcome in that pre-Authority-Lock Draft, not a new schema
 6. Continue reading repository, Source and Context and revise the same Draft. A request to synthesize, refine, complete, implement or use judgment delegates plan-level authoring, but it does not invent the user's tradeoff priorities. Before comparative research or a material product, technical, architecture or provider selection, identify the criteria that could change the research scope, candidate set or recommendation. Infer them only from the user's words, Source, Context or controlling constraints. If quality versus cost, speed, reliability, privacy, lock-in, operational burden or another material priority is unknown or ambiguous, stop before that research or selection and ask one concise targeted clarification. Do not impose a questionnaire, re-ask known preferences or interrupt minor reversible choices whose recommendation would not change.
 7. Once the material preference envelope is clear, decide what research is needed. Use current authoritative or primary evidence for external capability, pricing, quota, license, compatibility, region, security posture or support claims. When one recommendation is then defensible, record it in real Source with the authoring instruction, preference/evidence basis and exact added meaning instead of pausing for approval. Append the delegated item without rewriting the user's original text when ordinary prose is the Source. Return only when authoritative requirements conflict, the user explicitly reserves the choice, a material preference remains unknown, critical semantics have no defensible recommendation or no falsifiable acceptance standard can be formed.
 8. Contract expansion remains limited to meaning-preserving structural decomposition, evidence-backed repository binding and choices first recorded as delegated real Source. Never place a new product rule, default, threshold, recovery behavior, permission or platform/data scope only in Contract YAML. Default plan delegation authorizes meaning, not action: payment, contracting, production deployment or publication, destructive production mutation, real permission grants, sensitive-data transmission and required legal/security/human approval remain named external confirmations. Any conflicting, user-reserved, missing-preference or unsupported semantic remains `decision_required`.
-9. Before formal Compile and the first implementation edit, complete the shared `Architecture Deliberation` once and surface concise repository-bound conclusions rather than private reasoning. Cover the current owner/extension point/source of truth, dependencies and lifecycle, selected and rejected alternatives, a plausible future-change challenge, touched debt and its disposition, forbidden shortcuts and project-owned Checks. Even a preservation result names concrete owners and why no new or worsened debt is introduced. Put durable conclusions in owning Context and material falsifiable delivery conclusions in real marked Source plus existing Contract fields, then decide `Context Delta: none|required`. A material scope, owner, Context or design change before implementation stales and refreshes the deliberation.
+9. Before formal Compile and the first implementation edit, complete the shared `Architecture Deliberation` once and surface concise repository-bound conclusions rather than private reasoning. Cover the current owner/extension point/source of truth, dependencies and lifecycle, selected and rejected alternatives, a plausible future-change challenge, touched debt and its disposition, forbidden shortcuts, project-owned Checks and each triggered quality attribute or concrete preservation basis. Correctness/invariants and maintainability/changeability always receive at least preservation; reliability/resource lifecycle, concurrency/consistency, performance/capacity/cost, security/privacy/safety, compatibility/migration/rollout and operability/observability/testability activate only when material. Even a preservation result names concrete owners and why no new or worsened debt is introduced. Put durable conclusions in owning Context and material falsifiable delivery conclusions in real marked Source plus existing Contract fields, then decide `Context Delta: none|required`. A material scope, owner, Context, design, quality-applicability or debt-disposition change before implementation stales and refreshes the deliberation.
 10. Close every real Control's 22 canonical fields through `field_coverage` and its Outcome's cross-Control meaning through `control_relation_closure`; use `specified`, explicit `not_applicable` or blocking `unresolved`, and give the closure exact applicability refs even when no Controls apply. Independently close the semantic manifest: exact Source/context input inventory and digests; all standard/custom family, unit, relation, population, axis/value/combination, property, Fact Cell, Fact, proof, Oracle, environment and blocker Census identities; complete generation counts/digests; and exact Source→Fact→Claim/applicability→proof binding equality. Each machine proof maps to one single-Fact Assertion and typed `semantic_fact` capability; each external proof maps to an impact-complete External Confirmation. Declare only actual applicability profiles, each with an atomic, duplicate-free dimension assignment plus exact target, journey, Given condition/input/state refs and ordered When refs. Every Claim lists all applicable profiles; every Claim-bearing Assertion proves one Claim in one matching profile and all required proof surfaces. Declare each execution target's runtime capabilities and require the production family, cold-start and production-root capabilities where applicable. Give every Assertion the minimum all-of Evidence Capabilities that can actually prove its Claim. Every behavioral Claim-bearing Assertion also needs a same-Check claim-local `replace_json_value` or `replace_text` wrong-semantic witness and a claimless target-runtime liveness Assertion that remains passing; whole-file replacement is compatibility-only and cannot prove semantic binding. Population declares a universe Binding whose carriers are Check inputs and proves exact universe = eligible = observed plus valid exclusions. Separate required success and degradation Checks. Type every external confirmation with impacted Claim refs and target-blocking effect. For selected design targets, keep resource-integrity Checks distinct from root-bound implementation conformance, freeze the validated handoff and target resources, preserve exact condition equality, map every covered handoff Source Item into separate attributable Assertions, bind each verification method to its own `design_method` evidence with exact per-condition `fact_refs`, distinct record and primary-observation paths plus a unique current primary digest for every condition, require the cell union to equal the complete target fact set, and declare current actual/comparison artifacts. Preserve every blocker's required target capabilities; use a machine Claim only on the exact capability-qualified target, otherwise keep a target-blocking External Confirmation. Playwright must attach both declared cell artifacts in every project instance. Use `context_snapshot_mode: full`. Run read-only `ty-context long-task preflight <workdir>`, repair every semantic manifest, handoff, Contract and `decision_required` error in the same Draft, then formally Compile only when ready.
 11. When the first Compile returns `execution_model_checkpoint.required: true`, obey its terminal-turn boundary. Unless an earlier user message explicitly states this task's current-model or switch-and-resume strategy, do no product implementation, file edit, build or test after that result; end the current turn and ask the user to choose `continue_current_model` or switch models and then resume the active Long-Task. Generic “continue”, “resume”, “finish” or “continue the Goal” language does not satisfy the checkpoint. Later revisions return `required: false` and do not repeat it.
 
-Architecture quality uses the existing authority model, not a new gate or field. The visible deliberation proves that architecture work occurred, not that subjective quality is machine-proven. Encode every material falsifiable invariant as a Source-backed technical obligation/global constraint/forbidden shortcut plus owner/path/Binding boundaries and a project-owned executable Check. Functional acceptance cannot substitute when the architecture claim can fail independently. An unverifiable design preference remains task-local, durable Context or `decision_required`; it must not be promoted into false proof.
+Engineering quality uses the existing authority model, not a new stage, Gate or field. The visible deliberation makes the checkpoint reviewable but does not machine-prove subjective quality. Encode every material falsifiable architecture or quality invariant as a Source-backed technical obligation/global constraint/forbidden shortcut plus owner/path/Binding boundaries, a project-owned executable Check and a separate Assertion when functional acceptance could pass independently. Never substitute a broad quality Boolean, functional pass or prose review. An unverifiable preference remains task-local, durable Context or `decision_required`; it must not be promoted into false proof.
 
 ## Rolling Execution
 
@@ -74,7 +76,7 @@ After Authority Lock and the one-time execution-model checkpoint are satisfied,
 
 Re-evaluate `Context Delta` whenever implementation or repair discovers a durable fact. Controlling Context changes always use Authority Revision; they require a user decision only when mapped Claims, targets, proof obligations or another decision boundary changes. Graph-derived, non-explicit `implementation-index` and `archive` are Supporting Context in referenced mode and may auto-revise when only navigation/background changed. Full snapshot mode treats every selected Context file as controlling.
 
-If rolling implementation materially changes scope, ownership, dependency direction, the selected design or a debt disposition, refresh the Architecture Deliberation and express any authority change through marked Source/Context plus protected revision before continuing. This is refinement of the same checkpoint, not a second workflow stage.
+If rolling implementation materially changes scope, ownership, dependency direction, the selected design, quality-attribute applicability or a debt disposition, refresh the Architecture Deliberation and express any authority change through marked Source/Context plus protected revision before continuing. This is refinement of the same checkpoint, not a second workflow stage.
 
 Use `verify --explain [--outcome/--check]` when execution cost is unclear; it previews declared main and Counterfactual runner invocations without executing or writing Progress. Use targeted `verify --outcome/--check` for optional feedback and repair when its expected localization value exceeds its cost. Progress is repair evidence only and never acceptance authority. Keep precise findings attached to the owning Source item, Claim, Assertion, Check, Binding and owner path. Do not add another model-switch pause or turn delegation into a Harness scheduler, state or proof source.
 
@@ -95,7 +97,7 @@ Complete Context, implementation and project tests, create a clean candidate com
 
 Final Gate recompiles Source authority, captures semantic and raw Contract protected-input identity, validates active task/revision/compiled/worktree identity, creates one Git-tree snapshot and reruns every required Global and Outcome Check. It requires exactly one current typed semantic result for every and only every compiled Fact × machine-method obligation, preserving actual observation/environment, frozen expected/comparison/tolerance/mask/Oracle authority and passing verdict; external obligations remain named confirmations. It then recompiles again and requires unchanged Contract/fragments, Source semantic manifest, Controlling Context, verifier, runner and verification/workdir inputs, plus unchanged workspace/tree and Active Authority, before acceptance. It derives Stage results and target qualification from that run; it does not trust targeted Progress as a Stage pass. A target-runtime Check must exercise its exact target in that current Gate execution; rerunning a reader for a historical or tracked status report is not live target proof. Design-resource integrity, an isolated route or `visual_render` cannot replace required root-bound `design_conformance`, and unresolved semantic or design blockers remain blocking. Final Gate, Stop and close never trust historical Progress, Receipt or compiled cache.
 
-Final Gate is the Long-Task path's sole `Architecture Conformance` carrier. It reruns the declared architecture obligations/constraints/forbidden shortcuts, owner/path/Binding boundaries and project-owned Checks on that same snapshot and blocks scope escape, bypass, duplicate authority, a second source of truth, wrong dependency direction, undeclared boundary change or new/worsened debt represented by those invariants. Do not also run the default Workflow's standalone Contract Conformance closure. Any later candidate or authority change invalidates the Gate and uses the existing freshness path again.
+Final Gate is the Long-Task path's sole `Engineering Quality Conformance` and `Architecture Conformance` carrier. It reruns the declared architecture/quality obligations, constraints and forbidden shortcuts, owner/path/Binding boundaries, independent Assertions and project-owned Checks on that same snapshot. It blocks the represented scope escape, bypass, duplicate authority, second source of truth, wrong dependency direction, undeclared boundary/lifecycle change, silent failure, unsupported performance claim or new/worsened debt. It proves only those declared falsifiable invariants, never overall code quality. Do not also run the default Workflow's Contract Conformance closure. Any later candidate or authority change invalidates the Gate and uses the existing freshness path again.
 
 Machine acceptance covers only declared machine authority. Preserve every pending external confirmation through `final-gate`, `status`, `resume`, `stop-check`, the package-owned Stop Hook and `close`; accepted output identifies `acceptance_scope: declared_machine_authority` and `native_goal_effect: none`, while `closed_scope: machine_authority` means only Authority cleanup. Do not invent external-confirmation or native-Goal tracking state.
 
@@ -103,4 +105,4 @@ Before invoking platform-native Goal completion, perform one veto-only conforman
 
 ## Handoff
 
-Report implementation, effective risk, Architecture Deliberation/Conformance status, Claim Coverage, Stage frontier/results, declared target profile, exact `target_state`, Live Gate result, acceptance scope, every pending external confirmation, Context status and blockers. Use verifier terms exactly: `progress_passing` means targeted repair evidence, `progress_stale` is a freshness fact rather than a current pass or immediate rerun command, `final_workflow_status: null` means unfinished, `authority_revision_adopted` means return to rolling execution, and `machine_accepted_external_pending` must retain its named confirmations and never be summarized as `AcceptedDeliveryTerminal` or full no-drift delivery. Contract target states are only `implementation_complete`, `target_profile_usable` and `production_release_ready`; terminal failure uses `not_accepted` or `blocked_external`. Never shorten targeted progress to “Outcome complete” or invent per-platform progress/status. State the theorem boundary honestly: undeclared or inaccurate Source cannot be discovered mechanically; the named project oracle must be semantically sound; the supported direct-literal verifier dependency graph is frozen while other declared verification inputs, indirect runtime access, installed package/runtime behavior, Harness verifier and Git metadata form the trusted computing boundary; the visible checkpoint cannot prove private reasoning or universal future-proofing; native-Goal/model selection belongs to the host/user; and internal platform delegation is not observed.
+Report implementation, effective risk, Architecture Deliberation and Engineering Quality/Architecture Conformance status, Claim Coverage, Stage frontier/results, declared target profile, exact `target_state`, Live Gate result, acceptance scope, every pending external confirmation, Context status and blockers. Use verifier terms exactly: `progress_passing` means targeted repair evidence, `progress_stale` is a freshness fact rather than a current pass or immediate rerun command, `final_workflow_status: null` means unfinished, `authority_revision_adopted` means return to rolling execution, and `machine_accepted_external_pending` must retain its named confirmations and never be summarized as `AcceptedDeliveryTerminal` or full no-drift delivery. Contract target states are only `implementation_complete`, `target_profile_usable` and `production_release_ready`; terminal failure uses `not_accepted` or `blocked_external`. Never shorten targeted progress to “Outcome complete” or invent per-platform progress/status. State the theorem boundary honestly: undeclared or inaccurate Source cannot be discovered mechanically; the named project oracle must be semantically sound; the supported direct-literal verifier dependency graph is frozen while other declared verification inputs, indirect runtime access, installed package/runtime behavior, Harness verifier and Git metadata form the trusted computing boundary; Final Gate proves only its declared project-check-bound quality set; the visible checkpoint cannot prove private reasoning or universal future-proofing; native-Goal/model selection belongs to the host/user; and internal platform delegation is not observed.

package/assets/skills/long-task-workflow/references/authority-lifecycle.md

@@ -67,7 +67,7 @@ Report their exact meaning: `progress_passing` is current targeted repair eviden
 
 ## Final Gate And Terminal Paths
 
-Before Final Gate, complete Context/code/tests and create a clean candidate commit. Final Gate first verifies the accepted compiled authority is still fresh, then recompiles Source authority and records semantic plus raw protected-input identity for the Contract and fragments, the Source-embedded semantic manifest, every Source file, full Controlling Context, verifier/runner, recursively frozen local verifier dependencies, `verification_inputs` and workdir inputs. It validates the common-dir record/marker, creates one Git-tree snapshot and reruns every Check and sensitivity control. Non-UI semantic evidence must reproduce exactly every compiled machine Fact × method expectation with one attributable actual observation/environment/comparison/verdict under frozen expected/tolerance/mask/Oracle authority; selected-design method evidence must reproduce its exact compiled `fact_results` universe; every verdict passes, while named external obligations remain pending rather than fabricated. After execution it recompiles and re-hashes the same full protected set; any change returns `protected_inputs_changed_during_final_gate`, while an Active Authority race returns `active_authority_changed_during_final_gate`. Only unchanged protected inputs, workspace/tree and Authority may be accepted. It is the sole Long-Task `Architecture Conformance` carrier and the sole non-UI semantic and selected-design closure carrier: material deliberation conclusions must already be declared through existing obligations/constraints/forbidden shortcuts, owners/paths/Bindings and project-owned Checks, and no separate default Contract Conformance closure runs. A target-runtime Check must exercise its exact target again in that Final Gate execution; rereading historical status does not become live proof merely because the reader reran. The Receipt reports the target profile/state and every Stage as `passed`, `failed`, `blocked_external` or `blocked_dependency`.
+Before Final Gate, complete Context/code/tests and create a clean candidate commit. Final Gate first verifies the accepted compiled authority is still fresh, then recompiles Source authority and records semantic plus raw protected-input identity for the Contract and fragments, the Source-embedded semantic manifest, every Source file, full Controlling Context, verifier/runner, recursively frozen local verifier dependencies, `verification_inputs` and workdir inputs. It validates the common-dir record/marker, creates one Git-tree snapshot and reruns every Check and sensitivity control. Non-UI semantic evidence must reproduce exactly every compiled machine Fact × method expectation with one attributable actual observation/environment/comparison/verdict under frozen expected/tolerance/mask/Oracle authority; selected-design method evidence must reproduce its exact compiled `fact_results` universe; every verdict passes, while named external obligations remain pending rather than fabricated. After execution it recompiles and re-hashes the same full protected set; any change returns `protected_inputs_changed_during_final_gate`, while an Active Authority race returns `active_authority_changed_during_final_gate`. Only unchanged protected inputs, workspace/tree and Authority may be accepted. It is the sole Long-Task `Engineering Quality Conformance`/`Architecture Conformance` carrier and the sole non-UI semantic and selected-design closure carrier: material independently falsifiable deliberation conclusions must already be declared through existing Source-backed obligations/constraints/forbidden shortcuts, owners/paths/Bindings, project-owned Checks and separate Assertions when functional behavior can pass independently. It proves exactly that declared project-check-bound engineering-quality set, not overall code quality, and no separate default Contract Conformance closure runs. A target-runtime Check must exercise its exact target again in that Final Gate execution; rereading historical status does not become live proof merely because the reader reran. The Receipt reports the target profile/state and every Stage as `passed`, `failed`, `blocked_external` or `blocked_dependency`.
 
 Commit, verifier migration, clear and abandon share one active-state lock. Stop/close clear only the identity actually accepted through CAS and preserve `machine_accepted_external_pending` plus every named external confirmation in output. Final Gate/Stop/close identify `acceptance_scope: declared_machine_authority` and `native_goal_effect: none`; close additionally identifies `closed_scope: machine_authority`. The Stop Hook emits the same scope as one non-blocking message for either accepted machine status. A stale Receipt exposes no accepted workflow status.
 

package/assets/skills/long-task-workflow/references/contract-authoring.md

@@ -72,21 +72,23 @@ Declare cheap machine-checkable prerequisites through existing environment requi
 - `task.target_profile` declares `required_state` plus a non-empty, duplicate-free `required_target_refs`. Each ref resolves to a `product` execution target with one bounded runtime family, root entrypoint and explicit capabilities. A required product target declares its family capability plus `cold-start` and `production-root`; every Stage Gate and every `critical_user_path` Outcome provides root `target_runtime` proof for every required ref. Optional support/observer targets never substitute.
 - Use `implementation_complete` only when code-level implementation is the selected target, `target_profile_usable` when the declared required targets must be usable, and `production_release_ready` only when release gates are part of the selected target. These are terminal target qualifications, not Outcome progress states.
 
-## Architecture Deliberation And Closure
-
-Architecture Deliberation occurs once for every implementation delivery before formal Compile and the first implementation edit; risk changes depth, not occurrence. Surface concise conclusions and repository evidence rather than private chain-of-thought. A preservation result still names the concrete owner/extension point and explains why durable boundaries and debt do not worsen. Material work covers module ownership, unique source of truth, dependency direction, API/schema/data boundary, state lifecycle, persistence/recovery, security boundary, compatibility/migration, selected and rejected alternatives, one plausible future-change challenge, touched technical debt and forbidden bypasses.
-
-Represent every material falsifiable invariant with existing Contract fields:
+## Engineering Quality Deliberation And Closure
+
+Architecture Deliberation occurs once for every implementation delivery before formal Compile and the first implementation edit; risk changes depth, not occurrence. Surface concise conclusions and repository evidence rather than private chain-of-thought. A preservation result still names the concrete owner/extension point, applicable engineering-quality attributes or their concrete preservation basis, and why durable boundaries and debt do not worsen. Material work covers module ownership, unique source of truth, dependency direction, API/schema/data boundary, state/resource lifecycle, persistence/recovery, security boundary, compatibility/migration, selected and rejected alternatives, one plausible future-change challenge, touched technical debt, forbidden bypasses and triggered failure/load/threat scenarios.
+
+Correctness/invariants and maintainability/changeability always receive at least preservation. Reliability/resource lifecycle, concurrency/consistency, performance/capacity/cost, security/privacy/safety, compatibility/migration/rollout and operability/observability/testability activate only when the Source or implementation risk makes them material. Exact expected predicates remain in Semantic Facts or selected-design authority. A performance claim additionally binds workload, metric, baseline or budget, environment, comparator/tolerance and a project-owned benchmark/probe; static shape cannot prove runtime performance.
+
+Represent every material independently falsifiable architecture or engineering-quality invariant with existing Contract fields:
 
 1. a Source-backed technical obligation, global constraint or forbidden shortcut;
 2. owner Context and expected/support/forbidden paths;
 3. a Binding to the implementation carrier when Counterfactual sensitivity is required;
-4. a project-owned executable architecture check, such as the repository's lint, AST, dependency or contract test;
-5. a separate Assertion when functional behavior could pass while the architecture invariant fails.
-
-New or worsened debt is unacceptable unless a project-owned bounded exception identifies owner, rationale, tracking and removal/expiry condition. Unrelated legacy debt does not automatically expand delivery scope, but debt touched, relied on or worsened by the implementation cannot remain hidden. Material changes to scope, owner, Context, dependency direction, selected design or debt disposition refresh the deliberation and, after Authority Lock, use protected revision.
-
-Do not encode subjective “clean architecture” or generic quality prose as machine authority. If no reliable observation can falsify it, keep it as durable Context/review judgment or return `decision_required`. Harness routes the repository's architecture check; it does not become a language-generic dependency analyzer. Final Gate is the only Long-Task Architecture Conformance carrier and reruns these declared Checks on its current snapshot; do not add a default-workflow closure, architecture field, second Gate or state.
+4. a project-owned executable type, compiler, lint, AST, dependency, contract, behavior, benchmark or probe Check; and
+5. a separate Assertion when functional behavior could pass while the quality invariant fails.
+
+New or worsened debt is unacceptable unless a project-owned bounded exception identifies owner, rationale, tracking and removal/expiry condition. Unrelated legacy debt does not automatically expand delivery scope, but debt touched, relied on or worsened by the implementation cannot remain hidden. Material changes to scope, owner, Context, dependency direction, selected design or debt disposition refresh the deliberation and, after Authority Lock, use protected revision.
+
+Do not encode subjective “clean architecture”, `quality == true`, a functional pass or generic quality prose as machine authority. If no reliable observation can falsify it, keep it as durable Context/review judgment or return `decision_required`. Harness routes repository-native checks; it does not become a language-generic dependency, quality or performance analyzer. Final Gate is the only Long-Task Engineering Quality/Architecture Conformance carrier and reruns these declared Checks on its current snapshot. It proves only the declared project-check-bound invariant set, not overall code quality. Do not add a default-workflow closure, quality matrix, Source aspect, Claim/risk kind, Contract field, second Gate, state or Receipt.
 
 ## Proxy And Target Runtime Independence
 

package/dist/commands/check-modularity.js

@@ -39,7 +39,7 @@ export async function checkModularity(args) {
                     : file.overLimit
                         ? "observed-risk"
                         : "ok";
-            console.log(`${prefix}: ${file.relativePath} ${file.lines} lines statements=${file.metrics.maxFunctionStatements} branches=${file.metrics.maxBranchComplexity} exports=${file.metrics.exports} transitions=${file.metrics.stateTransitions} responsibilities=${file.metrics.responsibilities.join(",") || "none"} statement_at=${formatLocation(file.metrics.maxFunctionStatementsLocation)} branch_at=${formatLocation(file.metrics.maxBranchComplexityLocation)}`);
+            console.log(`${prefix}: ${file.relativePath} ${file.lines} lines analysis=${file.metrics.analysis} statements=${formatMetric(file.metrics.maxFunctionStatements)} branches=${formatMetric(file.metrics.maxBranchComplexity)} exports=${formatMetric(file.metrics.exports)} transitions=${formatMetric(file.metrics.stateTransitions)} responsibilities=${formatResponsibilities(file.metrics.responsibilities)} statement_at=${formatLocation(file.metrics.maxFunctionStatementsLocation, file.metrics.maxFunctionStatements !== null)} branch_at=${formatLocation(file.metrics.maxBranchComplexityLocation, file.metrics.maxBranchComplexity !== null)}`);
         }
         for (const error of report.errors) {
             console.error(`error: ${error}`);
@@ -63,9 +63,21 @@ export async function checkModularity(args) {
         process.exitCode = 1;
     }
 }
-function formatLocation(location) {
+function formatLocation(location, supported) {
+    if (!supported) {
+        return "n/a";
+    }
     return location ? `${location.symbol}:${location.line}` : "none";
 }
+function formatMetric(value) {
+    return value === null ? "n/a" : String(value);
+}
+function formatResponsibilities(value) {
+    if (value === null) {
+        return "n/a";
+    }
+    return value.join(",") || "none";
+}
 function parseArgs(args) {
     const parsed = {
         touched: false,
@@ -160,7 +172,8 @@ function helpText() {
   check-modularity --base <ref> [--limit 300] [--fail-on-warning]
   check-modularity --config-only
 
-Audits physical lines, per-function statements and branch complexity, exports, state transitions and module responsibilities.
+Portable heuristic risk signal: all selected files get physical-line analysis; JS/TS gets lexical function/branch/export/state-transition/responsibility metrics; Python gets lexical per-function statement/branch metrics; other included formats are line-only.
+The report names analysis=js-ts-heuristic|python-heuristic|line-only and prints n/a for unsupported metrics. It is not complete cross-language static analysis, architecture proof or runtime-performance evidence; prefer project-native tools for those claims.
 For --touched and --base, existing findings are reported but only new or worsened non-line complexity is a warning; physical lines remain a risk signal and new files are audited in full.
 The default is warning-only; --fail-on-warning lets projects opt into CI enforcement.
 Generated configs default to modularity.policy: strict_except_generated; omitted policy is treated as scoped_waivers for compatibility.

package/dist/commands/design-resource.js

@@ -1,5 +1,6 @@
+import { publishDesignResourceHandoffBundle } from "../lib/design-resource-handoff-bundle.js";
 import { preflightDesignResourceHandoff } from "../lib/design-resource-handoff-validation.js";
-import { normalizeRepositoryFile } from "../lib/long-task-paths.js";
+import { normalizeRepositoryCwd, normalizeRepositoryFile, } from "../lib/long-task-paths.js";
 import { canonicalJson } from "../lib/strict-codec.js";
 export async function designResource(args) {
     const [subcommand = "help", ...rest] = args;
@@ -7,6 +8,10 @@ export async function designResource(args) {
         help();
         return;
     }
+    if (subcommand === "bundle") {
+        await bundle(rest);
+        return;
+    }
     if (subcommand !== "preflight")
         throw new Error(`Unknown design-resource subcommand: ${subcommand}`);
     const json = rest.includes("--json");
@@ -25,8 +30,63 @@ export async function designResource(args) {
     console.log(`Coverage: ${result.counts.subjects} subjects x 8 dimensions (${result.counts.coverage} grouped rows)`);
     console.log(`Acceptance blockers: ${result.counts.acceptance_blockers}`);
 }
+async function bundle(args) {
+    const positional = [];
+    const manifests = [];
+    let maxHandoffBytes = null;
+    let json = false;
+    for (let index = 0; index < args.length; index += 1) {
+        const item = args[index];
+        if (item === "--json") {
+            json = true;
+            continue;
+        }
+        if (item === "--manifest") {
+            const value = args[index + 1];
+            if (!value)
+                throw new Error("--manifest requires a path");
+            manifests.push(normalizeRepositoryFile(value, "design_resource_bundle_manifest"));
+            index += 1;
+            continue;
+        }
+        if (item === "--max-handoff-bytes") {
+            const value = args[index + 1];
+            if (!value)
+                throw new Error("--max-handoff-bytes requires an integer");
+            maxHandoffBytes = Number(value);
+            index += 1;
+            continue;
+        }
+        if (item.startsWith("--"))
+            throw new Error(`Unknown design-resource bundle option: ${item}`);
+        positional.push(item);
+    }
+    if (positional.length !== 2 ||
+        manifests.length === 0 ||
+        maxHandoffBytes === null)
+        throw new Error("usage: ty-context design-resource bundle <draft-dir> <new-output-dir> --manifest <facts.json> [--manifest <facts.json> ...] --max-handoff-bytes <bytes> [--json]");
+    const result = await publishDesignResourceHandoffBundle({
+        repository: process.cwd(),
+        draft_directory: normalizeRepositoryCwd(positional[0], "design_resource_bundle_draft_directory"),
+        output_directory: normalizeRepositoryCwd(positional[1], "design_resource_bundle_output_directory"),
+        manifest_paths: manifests,
+        max_handoff_bytes: maxHandoffBytes,
+    });
+    if (json) {
+        process.stdout.write(canonicalJson(result));
+        return;
+    }
+    console.log(`Design resource handoff bundle published: ${result.output_directory}`);
+    console.log(`Handoffs: ${result.handoffs.length}`);
+    console.log(`Targets: ${result.handoffs.map((item) => item.target_key).join(", ")}`);
+}
 function help() {
     console.log(`ty-context design-resource commands:
   preflight <handoff.md> [--json]
-                       Validate one selected implementation handoff`);
+                       Validate one selected implementation handoff
+  bundle <draft-dir> <new-output-dir> --manifest <facts.json> [...]
+         --max-handoff-bytes <bytes> [--json]
+                       Validate manifest-backed one-target handoffs and
+                       atomically publish the complete target set; the
+                       output parent directory must already exist`);
 }

package/dist/index.d.ts

@@ -2,6 +2,7 @@ export { commands } from "./commands/index.js";
 export { compileDeliveryContract, type CompileDeliveryOptionsV2, } from "./lib/long-task-delivery-compiler.js";
 export { DELIVERY_CONTRACT_FILE, parseDeliveryContract, parseDeliveryContractBundle, } from "./lib/long-task-delivery-parser.js";
 export { evaluateContractBoundary } from "./lib/long-task-boundary-check.js";
+export { publishDesignResourceHandoffBundle, type DesignResourceHandoffBundleOptions, type DesignResourceHandoffBundleResult, } from "./lib/design-resource-handoff-bundle.js";
 export { preflightDesignResourceHandoff } from "./lib/design-resource-handoff-validation.js";
 export { classifyLongTaskRisk, validateRiskProof, } from "./lib/long-task-risk.js";
 export { verifyDeliveryContract } from "./lib/long-task-verifier-v2.js";

package/dist/index.js

@@ -2,6 +2,7 @@ export { commands } from "./commands/index.js";
 export { compileDeliveryContract, } from "./lib/long-task-delivery-compiler.js";
 export { DELIVERY_CONTRACT_FILE, parseDeliveryContract, parseDeliveryContractBundle, } from "./lib/long-task-delivery-parser.js";
 export { evaluateContractBoundary } from "./lib/long-task-boundary-check.js";
+export { publishDesignResourceHandoffBundle, } from "./lib/design-resource-handoff-bundle.js";
 export { preflightDesignResourceHandoff } from "./lib/design-resource-handoff-validation.js";
 export { classifyLongTaskRisk, validateRiskProof, } from "./lib/long-task-risk.js";
 export { verifyDeliveryContract } from "./lib/long-task-verifier-v2.js";

package/dist/lib/design-resource-fact-manifest-validation.d.ts

@@ -1,3 +1,4 @@
 import type { DesignResourceObservableFactManifestV1 } from "./design-resource-fact-manifest-types.js";
-import type { ParsedDesignResourceHandoffV1 } from "./design-resource-handoff-types.js";
-export declare function loadAndValidateDesignResourceFactManifests(repository: string, parsed: ParsedDesignResourceHandoffV1): Promise<Map<string, DesignResourceObservableFactManifestV1>>;
+import type { ParsedDesignResourceHandoffInputV1, ParsedDesignResourceHandoffV1 } from "./design-resource-handoff-types.js";
+export declare function parseDesignResourceFactManifests(parsed: ParsedDesignResourceHandoffInputV1, contents: Map<string, Buffer>): Map<string, DesignResourceObservableFactManifestV1>;
+export declare function validateDesignResourceFactManifests(parsed: ParsedDesignResourceHandoffV1, contents: Map<string, Buffer>, manifests: Map<string, DesignResourceObservableFactManifestV1>, validateProjection: boolean): void;

package/dist/lib/design-resource-fact-manifest-validation.js

@@ -1,18 +1,9 @@
-import { readFile } from "node:fs/promises";
-import path from "node:path";
 import { parseDesignResourceFactManifestJson } from "./design-resource-fact-manifest-shape.js";
 import { validateDesignResourceFactManifestUniverse } from "./design-resource-fact-manifest-universe.js";
 import { invalidDesignResourceHandoff } from "./design-resource-handoff-validation-primitives.js";
-import { assertProtectedRepositoryFile } from "./long-task-protected-files.js";
-export async function loadAndValidateDesignResourceFactManifests(repository, parsed) {
+export function parseDesignResourceFactManifests(parsed, contents) {
     const resources = new Map(parsed.handoff.resources.map((resource) => [resource.key, resource]));
-    const contents = new Map();
-    for (const resource of parsed.handoff.resources) {
-        const file = await assertProtectedRepositoryFile(repository, path.resolve(repository, ...resource.path.split("/")), `design_resource:${resource.key}`);
-        contents.set(resource.key, await readFile(file));
-    }
     const manifests = new Map();
-    const sourceItems = new Map(Object.entries(parsed.source_item_kinds));
     for (const target of parsed.handoff.targets) {
         const manifestRef = target.source_profile.fact_manifest_resource_ref;
         const manifestResource = resources.get(manifestRef);
@@ -32,13 +23,23 @@ export async function loadAndValidateDesignResourceFactManifests(repository, par
         if (manifest.target_key !== target.key ||
             manifest.scope_key !== parsed.handoff.scope.key)
             invalid("fact_manifest_identity_mismatch", `${target.key}:${manifest.scope_key}:${manifest.target_key}`);
-        validateDesignResourceFactManifestUniverse(manifest, parsed.handoff, target, resources, contents, sourceItems);
-        validateManifestProjection(parsed.handoff, target.key, manifest);
         manifests.set(target.key, manifest);
     }
     sameSet([...manifests.keys()], parsed.handoff.targets.map((target) => target.key), "fact_manifest_target_set_mismatch", "handoff");
     return manifests;
 }
+export function validateDesignResourceFactManifests(parsed, contents, manifests, validateProjection) {
+    const resources = new Map(parsed.handoff.resources.map((resource) => [resource.key, resource]));
+    const sourceItems = new Map(Object.entries(parsed.source_item_kinds));
+    for (const target of parsed.handoff.targets) {
+        const manifest = manifests.get(target.key);
+        if (!manifest)
+            invalid("fact_manifest_target_missing", target.key);
+        validateDesignResourceFactManifestUniverse(manifest, parsed.handoff, target, resources, contents, sourceItems);
+        if (validateProjection)
+            validateManifestProjection(parsed.handoff, target.key, manifest);
+    }
+}
 function validateManifestProjection(handoff, targetKey, manifest) {
     const target = handoff.targets.find((item) => item.key === targetKey);
     const targetConditions = new Set(target.condition_refs);
@@ -77,12 +78,16 @@ function validateManifestProjection(handoff, targetKey, manifest) {
     exactRows(handoff.acceptance_blockers.filter((row) => row.target_refs.includes(targetKey)), manifest.acceptance_blockers, "acceptance_blockers", targetKey);
 }
 function exactRows(handoffRows, manifestRows, collection, targetKey) {
-    const handoff = new Map(handoffRows.map((row) => [row.key, canonicalJson(row)]));
-    const manifest = new Map(manifestRows.map((row) => [row.key, canonicalJson(row)]));
-    sameSet([...handoff.keys()], [...manifest.keys()], `manifest_handoff_${collection}_set_mismatch`, targetKey);
-    for (const [key, value] of manifest)
-        if (handoff.get(key) !== value)
-            invalid(`manifest_handoff_${collection}_row_mismatch`, `${targetKey}:${key}`);
+    const handoff = new Map(handoffRows.map((row) => [row.key, row]));
+    if (handoff.size !== manifestRows.length)
+        invalid(`manifest_handoff_${collection}_set_mismatch`, `${targetKey}:count:${handoff.size}:${manifestRows.length}`);
+    for (const manifestRow of manifestRows) {
+        const handoffRow = handoff.get(manifestRow.key);
+        if (!handoffRow)
+            invalid(`manifest_handoff_${collection}_set_mismatch`, `${targetKey}:missing:${manifestRow.key}`);
+        if (canonicalJson(handoffRow) !== canonicalJson(manifestRow))
+            invalid(`manifest_handoff_${collection}_row_mismatch`, `${targetKey}:${manifestRow.key}`);
+    }
 }
 function canonicalJson(value) {
     if (Array.isArray(value))

package/dist/lib/design-resource-fact-universe-catalog.js

@@ -101,7 +101,7 @@ export function validateManifestFactCells(manifest, sourceItems, census) {
         actual.set(fingerprint, cell.key);
         validateFactCellDisposition(cell, coveredFacts);
     }
-    sameSet([...actual.keys()], expectedFactCellFingerprints(manifest), "manifest_expected_fact_cell_universe_mismatch", manifest.target_key);
+    assertExpectedFactCellFingerprints(manifest, actual);
     unique(coveredFacts, "manifest_fact_ref_reused_by_cells");
     sameSet(coveredFacts, manifest.facts.map((fact) => fact.key), "manifest_expected_canonical_fact_set_mismatch", manifest.target_key);
 }
@@ -134,18 +134,28 @@ function validateFactCellDisposition(cell, coveredFacts) {
         cell.disposition === "unavailable")
         invalid("manifest_fact_cell_unresolved", cell.key);
 }
-function expectedFactCellFingerprints(manifest) {
-    const expected = [];
+function assertExpectedFactCellFingerprints(manifest, actual) {
+    const variationsBySubject = new Map();
+    for (const variation of manifest.variations) {
+        const rows = variationsBySubject.get(variation.subject_ref) ?? [];
+        rows.push(variation.key);
+        variationsBySubject.set(variation.subject_ref, rows);
+    }
+    let expectedCount = 0;
     for (const subject of manifest.subjects)
         for (const condition of manifest.conditions)
-            for (const variation of manifest.variations.filter((item) => item.subject_ref === subject.key))
+            for (const variationRef of variationsBySubject.get(subject.key) ?? [])
                 for (const property of manifest.properties)
-                    expected.push(factCellFingerprint({
+                    if (!actual.has(factCellFingerprint({
                         subject_ref: subject.key,
                         target_ref: manifest.target_key,
                         condition_ref: condition.key,
-                        variation_ref: variation.key,
+                        variation_ref: variationRef,
                         property_ref: property.key,
-                    }));
-    return expected;
+                    })))
+                        invalid("manifest_expected_fact_cell_universe_mismatch", `${manifest.target_key}:missing:${subject.key}:${condition.key}:${variationRef}:${property.key}`);
+                    else
+                        expectedCount += 1;
+    if (actual.size !== expectedCount)
+        invalid("manifest_expected_fact_cell_universe_mismatch", `${manifest.target_key}:count:${actual.size}:${expectedCount}`);
 }

package/dist/lib/design-resource-fact-universe-helpers.js

@@ -1,11 +1,15 @@
+import { createHash } from "node:crypto";
 import { DESIGN_RESOURCE_STANDARD_CONDITION_AXES, } from "./design-resource-fact-manifest-types.js";
 import { invalidDesignResourceHandoff } from "./design-resource-handoff-validation-primitives.js";
-import { sha256Hex } from "./strict-codec.js";
 export function manifestIdentityDigest(rows) {
-    return sha256Hex(rows
-        .map((row) => stableJson(row))
-        .sort()
-        .join("\n"));
+    const hash = createHash("sha256");
+    const identities = rows.map((row) => stableJson(row)).sort();
+    for (let index = 0; index < identities.length; index += 1) {
+        if (index > 0)
+            hash.update("\n");
+        hash.update(identities[index]);
+    }
+    return hash.digest("hex");
 }
 export function manifestCollectionRows(manifest) {
     return new Map([

package/dist/lib/design-resource-handoff-bundle.d.ts

@@ -0,0 +1,31 @@
+import type { DesignResourceManifestCollectionName } from "./design-resource-fact-manifest-types.js";
+export interface DesignResourceHandoffBundleOptions {
+    repository: string;
+    draft_directory: string;
+    output_directory: string;
+    manifest_paths: string[];
+    max_handoff_bytes: number;
+}
+export interface DesignResourceHandoffBundleResult {
+    status: "published";
+    output_directory: string;
+    handoffs: Array<{
+        path: string;
+        sha256: string;
+        bytes: number;
+        scope_key: string;
+        target_key: string;
+    }>;
+    manifests: Array<{
+        path: string;
+        sha256: string;
+        scope_key: string;
+        target_key: string;
+        collections: Array<{
+            name: DesignResourceManifestCollectionName;
+            expected_count: number;
+            identity_sha256: string;
+        }>;
+    }>;
+}
+export declare function publishDesignResourceHandoffBundle(options: DesignResourceHandoffBundleOptions): Promise<DesignResourceHandoffBundleResult>;