repo-harness 0.19.2 → 0.19.5

package/README.es.md

@@ -702,8 +702,8 @@ repositorio adopte la misma política.
 
 ## Versión actual
 
-- Paquete npm: `repo-harness@0.19.2`
-- Sello de workflow generado: `repo-harness@0.19.2+template@0.19.2`
+- Paquete npm: `repo-harness@0.19.5`
+- Sello de workflow generado: `repo-harness@0.19.5+template@0.19.5`
 - Repositorio de GitHub: `Ancienttwo/repo-harness`
 - Notas de versión e historial: [`docs/CHANGELOG.md`](docs/CHANGELOG.md)
 

package/README.fr.md

@@ -697,8 +697,8 @@ adopte la même policy.
 
 ## Release actuelle
 
-- Package npm : `repo-harness@0.19.2`
-- Generated workflow stamp : `repo-harness@0.19.2+template@0.19.2`
+- Package npm : `repo-harness@0.19.5`
+- Generated workflow stamp : `repo-harness@0.19.5+template@0.19.5`
 - Dépôt GitHub : `Ancienttwo/repo-harness`
 - Notes et historique de release : [`docs/CHANGELOG.md`](docs/CHANGELOG.md)
 

package/README.ja.md

@@ -694,8 +694,8 @@ commit script や hooks に組み込まないでください。
 
 ## 現在の Release
 
-- npm package：`repo-harness@0.19.2`
-- Generated workflow stamp：`repo-harness@0.19.2+template@0.19.2`
+- npm package：`repo-harness@0.19.5`
+- Generated workflow stamp：`repo-harness@0.19.5+template@0.19.5`
 - GitHub repository：`Ancienttwo/repo-harness`
 - Release notes and history：[`docs/CHANGELOG.md`](docs/CHANGELOG.md)
 

package/README.md

@@ -665,8 +665,8 @@ repo-harness commit scripts or hooks unless that repo adopts the same policy.
 
 ## Current Release
 
-- npm package: `repo-harness@0.19.2`
-- Generated workflow stamp: `repo-harness@0.19.2+template@0.19.2`
+- npm package: `repo-harness@0.19.5`
+- Generated workflow stamp: `repo-harness@0.19.5+template@0.19.5`
 - GitHub repository: `Ancienttwo/repo-harness`
 - Release notes and history: [`docs/CHANGELOG.md`](docs/CHANGELOG.md)
 

package/README.zh-CN.md

@@ -630,8 +630,8 @@ commit script 或 hook，除非目标仓库采用同样的 policy。
 
 ## 当前 Release
 
-- npm package：`repo-harness@0.19.2`
-- Generated workflow stamp：`repo-harness@0.19.2+template@0.19.2`
+- npm package：`repo-harness@0.19.5`
+- Generated workflow stamp：`repo-harness@0.19.5+template@0.19.5`
 - GitHub repository：`Ancienttwo/repo-harness`
 - Release notes 和 history：[`docs/CHANGELOG.md`](docs/CHANGELOG.md)
 

package/agents/fleet/explorer.md

@@ -1,9 +1,9 @@
 ---
 name: explorer
-description: Read-only codebase explorer on Sonnet at high effort. Use to locate files, symbols, call paths, tests, uncertainties, and candidate affected surfaces before implementation or judgment. Returns `FINDINGS: COMPLETE/PARTIAL/BLOCKED` with file:line evidence; never edits, decides architecture, or judges acceptance — hand the map to fast-worker, deep-reasoner, or gatekeeper.
+description: Read-only codebase explorer on Sonnet at medium effort. Use to locate files, symbols, call paths, tests, uncertainties, and candidate affected surfaces before implementation or judgment. Returns `FINDINGS: COMPLETE/PARTIAL/BLOCKED` with file:line evidence; never edits, decides architecture, or judges acceptance — hand the map to fast-worker, deep-reasoner, or gatekeeper.
 tools: ["Read", "Grep", "Glob", "Bash"]
 model: sonnet
-effort: high
+effort: medium
 ---
 
 You are the read-only explorer. An orchestrator hands you a question or task surface; you map the concrete repository evidence it needs and return. You do not edit, decide architecture, or judge acceptance.

package/agents/fleet/fast-worker.md

@@ -1,8 +1,8 @@
 ---
 name: fast-worker
-description: Fast execution worker on Opus at medium effort. Use for well-scoped implementation, tests, refactoring, documentation, and mechanical changes; verifies with the project's real commands and returns `RESULT: DONE/PARTIAL/BLOCKED` with the evidence. Not for planning, architecture, or high-risk judgment — those go to deep-reasoner or stay with the orchestrator.
-model: opus
-effort: medium
+description: Fast execution worker on Sonnet at high effort. Use for well-scoped implementation, tests, refactoring, documentation, and mechanical changes; verifies with the project's real commands and returns `RESULT: DONE/PARTIAL/BLOCKED` with the evidence. Not for planning, architecture, or high-risk judgment — those go to deep-reasoner or stay with the orchestrator.
+model: sonnet
+effort: high
 ---
 
 You are a fast execution worker. An orchestrator hands you well-scoped tasks — implementation, tests, refactoring, documentation, mechanical changes — and you execute them directly and return. You do not plan, decide architecture, or ship.

package/agents/fleet/root-cause-prover.md

@@ -1,9 +1,9 @@
 ---
 name: root-cause-prover
-description: Bugfix diagnosis and pre-fix evidence specialist on Opus at high effort. Use to prove a concrete root cause, reproduce it, add a candidate regression guard, and capture the existing four-field Root Cause Evidence shape before implementation; returns `DIAGNOSIS: CONFIRMED|LIKELY|BLOCKED`. It never fixes production source or changes the gate.
+description: Bugfix diagnosis and pre-fix evidence specialist on Opus at xhigh effort. Use to prove a concrete root cause, reproduce it, add a candidate regression guard, and capture the existing four-field Root Cause Evidence shape before implementation; returns `DIAGNOSIS: CONFIRMED|LIKELY|BLOCKED`. It never fixes production source or changes the gate.
 tools: ["Read", "Grep", "Glob", "Bash"]
 model: opus
-effort: high
+effort: xhigh
 ---
 
 You are the bounded bugfix diagnosis and pre-fix evidence specialist. The orchestrator gives you an active bugfix contract in an isolated worktree; you prove or falsify the cause and prepare evidence for the existing gate. You never implement the production fix or reinterpret the gate.

package/assets/hooks/lib/workflow-state.sh

@@ -1862,7 +1862,15 @@ workflow_contract_allows_path() {
     esac
 
     if [[ "$section" == "allowed_paths" && "$trimmed" =~ ^-[[:space:]]*(.+)$ ]]; then
-      item="$(workflow_strip_quotes "${BASH_REMATCH[1]}")"
+      item="${BASH_REMATCH[1]}"
+      # Drop a YAML inline comment: `#` at the start or after whitespace, outside a leading quoted scalar.
+      case "$item" in
+        \"*\"*) item="\"$(printf '%s' "${item:1}" | cut -d'"' -f1)\"" ;;
+        \'*\'*) item="'$(printf '%s' "${item:1}" | cut -d"'" -f1)'" ;;
+        *) item="$(printf '%s' "$item" | sed -E 's/^#.*$//; s/[[:space:]]+#.*$//')" ;;
+      esac
+      item="$(workflow_strip_quotes "$item")"
+      [[ -n "$item" ]] || continue
       pattern="$item"
       if [[ "$pattern" == */ ]]; then
         [[ "$file_path" == "$pattern"* ]] && return 0

package/assets/reference-configs/external-tooling.md

@@ -517,7 +517,7 @@ Minimal manifest shape:
   "run_id": "20260629T023507Z-aibridge-screenshot",
   "provider": {
     "name": "aibridge",
-    "version": "1.5.0"
+    "version": "1.6.1"
   },
   "subject": {
     "task_type": "unity.ui",
@@ -609,7 +609,7 @@ diff -qr ~/.agents/skills/geju ~/.codex/skills/geju
 ### CodeGraph
 
 ```bash
-bun add -g @colbymchenry/codegraph@1.5.0 && codegraph sync . && codegraph status .
+bun add -g @colbymchenry/codegraph@1.6.1 && codegraph sync . && codegraph status .
 ```
 
 ## Agent Fleet
@@ -637,23 +637,26 @@ mapping.
 
 | Source `model` | Codex `model` | Source `effort` | Codex `model_reasoning_effort` |
 |---|---|---|---|
-| `opus` | `gpt-5.6-terra` | `low`, `medium`, `high`, `xhigh`, `max` | same string, unchanged |
-| `sonnet`, `haiku` | `gpt-5.6-luna` | `low`, `medium`, `high`, `xhigh`, `max` | same string, unchanged |
-| `fable` | `gpt-5.6-sol` | `low`, `medium`, `high`, `xhigh`, `max` | same string, unchanged |
+| `opus` | `gpt-6-astra` | `low`, `medium`, `high`, `xhigh`, `max` | same string, unchanged |
+| `sonnet`, `haiku` | `gpt-6-luna` | `low`, `medium`, `high`, `xhigh`, `max` | same string, unchanged |
+| `fable` | `gpt-6.1-sol` | `low`, `medium`, `high`, `xhigh`, `max` | same string, unchanged |
 
-Three per-agent target overrides are applied after tuple validation, on top of
+Seven per-agent target overrides are applied after tuple validation, on top of
 the family row above, and are the only model/effort remaps in the generator:
-`fast-worker` (`opus`/`medium`) targets `gpt-6-astra` at `low` (light) reasoning;
-`deep-worker` (`opus`/`high`) and `gatekeeper` (`opus`/`high`) both target
-`gpt-6-astra` at `medium` reasoning. Every other agent's Codex model and effort follow the family row
-unchanged.
+`explorer` (`sonnet`/`medium`) targets `gpt-6-luna` at `high` reasoning;
+`deep-reasoner` (`opus`/`xhigh`) targets `gpt-6-astra` at `high` reasoning;
+`fast-worker` (`sonnet`/`high`) targets `gpt-6.1-sol` at `medium` reasoning;
+`deep-worker` (`opus`/`high`) targets `gpt-6.1-sol` at `high` reasoning;
+`gatekeeper` (`opus`/`high`) targets `gpt-6-astra` at `medium` reasoning;
+`root-cause-prover` (`opus`/`xhigh`) targets `gpt-6-astra` at `high` reasoning;
+`harness-evaluator` (`opus`/`high`) targets `gpt-6-astra` at `medium` reasoning.
 
 `fast-worker`, `deep-worker`, `root-cause-prover`, and `harness-evaluator`
 receive `sandbox_mode = "workspace-write"`; every other role receives
 `sandbox_mode = "read-only"`. Current assignments are explorer
-(`sonnet/high`), deep-reasoner (`opus/xhigh`), fast-worker (`opus/medium`),
+(`sonnet/medium`), deep-reasoner (`opus/xhigh`), fast-worker (`sonnet/high`),
 deep-worker (`opus/high`), gatekeeper (`opus/high`), root-cause-prover
-(`opus/high`), and harness-evaluator (`opus/high`). Root-cause-prover's prompt further limits
+(`opus/xhigh`), and harness-evaluator (`opus/high`). Root-cause-prover's prompt further limits
 writes to bugfix evidence inside the active contract's allowed paths;
 harness-evaluator runs existing skill/adoption surfaces only when both repo and
 HOME pass the runner's disposable boundary: skills uses `--require-disposable`,
@@ -1007,6 +1010,27 @@ letter into its terminal job receipt, and is byte-idempotent on the same signal
 and approval reference. `status --json` reports unresolved or invalid
 acceptance evidence, and the strict architecture gate fails closed on either;
 the command never chooses or infers an architecture decision.
+
+For accepted apply, acceptance records an exact request intent before invoking
+ArchContext and the original result before running refresh actions. A retry
+with this pending evidence uses the provider's `projection-apply-readback-v1`
+capability. Readback returns the immutable committed receipt, original refresh
+signals, and a freshly verified current fixed point without changing provider
+delivery state. The same candidate, approval reference, request, and snapshot
+must still match. If the provider proves the exact request has no committed
+receipt, only an intent without a recorded result may retry apply; the provider
+checks the receipt again within its writer lock before writing. Errors and
+missing capabilities never authorize another apply.
+
+To recover an older interrupted accept that has no local intent, run
+`repo-harness architecture-projection accept --recover --signal-id <sha256> --approval-reference <original-event-id> --json`.
+This explicit command only resumes a committed apply. It fails if the provider
+has no receipt, and never creates an apply or poisons a fresh candidate with an
+unrecoverable intent. Adoption recovery is unsupported and fails closed; it is
+not converted into apply. Pending evidence remains content-bound local runtime
+state after completion; the final acceptance receipt is the resolution authority.
+The readback capability must be present in both the packaged CLI and its daemon;
+installing a new CLI alone does not upgrade a running daemon.
 If a candidate's exact reason set is only `verified-flow-proof-changed`, use
 `repo-harness architecture-projection reconcile --signal-id <sha256> --json`
 after refreshing the configured CodeGraph index. Reconciliation runs the same

package/assets/skill-version.json

@@ -1,6 +1,6 @@
 {
-  "version": "0.19.2",
-  "templateVersion": "0.19.2",
+  "version": "0.19.5",
+  "templateVersion": "0.19.5",
   "skillName": "repo-harness",
   "contractId": "tasks-first-harness-v1",
   "compatibility": {

package/assets/templates/helpers/archive-workflow.sh

@@ -491,6 +491,9 @@ rewrite_archive_projection_file() {
     awk \
       -v source_path="${archive_projection_sources[$index]}" \
       -v destination_path="${archive_projection_destinations[$index]}" '
+      # Executable acceptance criteria are frozen authority, not navigation.
+      /^## / { verification_plan = ($0 ~ /^## Verification Plan[[:space:]]*$/) }
+      verification_plan { print; next }
       {
         remaining = $0
         rendered = ""

package/assets/templates/helpers/check-agent-tooling.sh

@@ -1071,7 +1071,7 @@ function readAgentFleetSource(agent) {
   return { status: "read", path: sourcePath, hash: source.hash };
 }
 
-// Read-only mirror of install-agent-fleet.sh's loadUserManagedReceipt(): this
+// Read-only mirror of install-profile.ts's readAgentFleetUserManagedReceipt(): this
 // checker never writes ~/.repo-harness/agent-fleet-user-managed.json, it only
 // consults it so an operator-accepted customized file is not misreported as
 // drift. Any malformation invalidates the whole receipt (fail-closed) rather

package/assets/templates/helpers/contract-run.ts

@@ -337,7 +337,14 @@ function parseList(block: string, key: string): string[] {
     if (!inList) continue;
     if (/^\S/.test(line) || /^\s+[a-zA-Z0-9_-]+:/.test(line)) break;
     const match = line.match(/^\s*-\s*(.+)$/);
-    if (match) values.push(match[1].trim().replace(/^["']|["']$/g, ""));
+    if (!match) continue;
+    let value = match[1].trim();
+    const quote = value[0];
+    const close = quote === '"' || quote === "'" ? value.indexOf(quote, 1) : -1;
+    // Drop a YAML inline comment: `#` at the start or after whitespace, outside a leading quoted scalar.
+    value = close > 0 ? value.slice(0, close + 1) : value.replace(/(^|\s+)#.*$/, "").trim();
+    value = value.replace(/^["']|["']$/g, "");
+    if (value.length > 0) values.push(value);
   }
   return values;
 }

package/assets/templates/helpers/ensure-task-workflow.sh

@@ -1016,8 +1016,8 @@ ARCHITECTURE_INDEX_EOF
     "provider": "archctx",
     "proposal_author": "local",
     "stages": {
-      "scan": { "provider_version": "0.5.10", "required_features": ["module-statistics-v1", "refactor-assessment-v1", "recommendation-v3"] },
-      "verify": { "provider_version": "0.5.10", "required_features": ["refactor-resolution-v1"] }
+      "scan": { "provider_version": "0.6.1", "required_features": ["module-statistics-v1", "refactor-assessment-v1", "recommendation-v3"] },
+      "verify": { "provider_version": "0.6.1", "required_features": ["refactor-resolution-v1"] }
     },
     "workflow_routing": {
       "module_refactor": "work_package",

package/assets/templates/helpers/heartbeat-triage.sh

@@ -179,7 +179,7 @@ run_workflow_check() {
   if [[ "$status" -eq 0 ]]; then
     add_entry "workflow-check" "pass" "check-task-workflow.sh --strict passed" "$output"
   else
-    summary="$(printf '%s\n' "$output" | first_line)"
+    summary="$(first_line <<<"$output")"
     add_entry "workflow-check" "fail" "${summary:-check-task-workflow.sh --strict failed}" "$output"
   fi
 }

package/assets/templates/helpers/install-agent-fleet.sh

@@ -16,8 +16,14 @@ bun_version_is_supported() {
 
 RUNTIME_BIN=""
 BUN_VERSION=""
-PATH_BUN="$(command -v bun 2>/dev/null || true)"
-for candidate in "$PATH_BUN" "${HOME}/.bun/bin/bun"; do
+# A caller that already validated its Bun hands it over explicitly; only a
+# standalone invocation discovers Bun by name.
+if [[ -n "${REPO_HARNESS_BUN_BIN:-}" ]]; then
+  BUN_CANDIDATES=("$REPO_HARNESS_BUN_BIN")
+else
+  BUN_CANDIDATES=("$(command -v bun 2>/dev/null || true)" "${HOME}/.bun/bin/bun")
+fi
+for candidate in "${BUN_CANDIDATES[@]}"; do
   [[ -n "$candidate" && -x "$candidate" ]] || continue
   candidate_version="$("$candidate" --version 2>/dev/null || true)"
   [[ -n "$BUN_VERSION" ]] || BUN_VERSION="$candidate_version"
@@ -105,11 +111,16 @@ const MANAGED_AGENTS = ["explorer", "deep-reasoner", "fast-worker", "deep-worker
 const WRITABLE_AGENTS = new Set(["fast-worker", "deep-worker", "root-cause-prover", "harness-evaluator"]);
 const CLAUDE_TARGET_DIR = path.join(HOME, ".claude", "agents");
 const CODEX_TARGET_DIR = path.join(HOME, ".codex", "agents");
-const USER_MANAGED_RECEIPT_PATH = path.join(HOME, ".repo-harness", "agent-fleet-user-managed.json");
 const SOURCE_DIR = process.env.REPO_HARNESS_AGENT_FLEET_SOURCE_DIR;
-const { readInstalledProfile, managedInstallSurfaceIsCurrent } = require(
+const {
+  readInstalledProfile,
+  managedInstallSurfaceIsCurrent,
+  agentFleetUserManagedReceiptPath,
+  readAgentFleetUserManagedReceipt,
+} = require(
   path.join(SOURCE_DIR, "../../src/cli/installer/install-profile.ts"),
 );
+const USER_MANAGED_RECEIPT_PATH = agentFleetUserManagedReceiptPath({ ...process.env, HOME });
 const installedProfile = readInstalledProfile();
 
 // A generated persona carries role identity only. The anti-extras execution
@@ -136,19 +147,23 @@ function buildFamilyEffortMap(sourceLabel, targetModel, targetLabel) {
 }
 
 const MODEL_EFFORT_MAP = {
-  opus: buildFamilyEffortMap("Opus", "gpt-5.6-terra", "GPT-5.6 Terra"),
-  sonnet: buildFamilyEffortMap("Sonnet", "gpt-5.6-luna", "GPT-5.6 Luna"),
-  haiku: buildFamilyEffortMap("Haiku", "gpt-5.6-luna", "GPT-5.6 Luna"),
-  fable: buildFamilyEffortMap("Fable", "gpt-5.6-sol", "GPT-5.6 Sol"),
+  opus: buildFamilyEffortMap("Opus", "gpt-6-astra", "GPT-6 Astra"),
+  sonnet: buildFamilyEffortMap("Sonnet", "gpt-6-luna", "GPT-6 Luna"),
+  haiku: buildFamilyEffortMap("Haiku", "gpt-6-luna", "GPT-6 Luna"),
+  fable: buildFamilyEffortMap("Fable", "gpt-6.1-sol", "GPT-6.1 Sol"),
 };
 
 // Per-agent Codex target overrides — the only model/effort remaps in the fleet.
-// fast-worker targets Astra at low reasoning; deep-worker and gatekeeper
-// target Astra at medium. Everything else follows the family default.
+// Every role carries an explicit target so Codex model/effort never drift with
+// the Claude-side family default.
 const AGENT_TARGET_OVERRIDES = {
-  "fast-worker": { model: "gpt-6-astra", effort: "low", targetDescription: "GPT-6 Astra at low reasoning" },
-  "deep-worker": { model: "gpt-6-astra", effort: "medium", targetDescription: "GPT-6 Astra at medium reasoning" },
+  explorer: { model: "gpt-6-luna", effort: "high", targetDescription: "GPT-6 Luna at high reasoning" },
+  "deep-reasoner": { model: "gpt-6-astra", effort: "high", targetDescription: "GPT-6 Astra at high reasoning" },
+  "fast-worker": { model: "gpt-6.1-sol", effort: "medium", targetDescription: "GPT-6.1 Sol at medium reasoning" },
+  "deep-worker": { model: "gpt-6.1-sol", effort: "high", targetDescription: "GPT-6.1 Sol at high reasoning" },
   gatekeeper: { model: "gpt-6-astra", effort: "medium", targetDescription: "GPT-6 Astra at medium reasoning" },
+  "root-cause-prover": { model: "gpt-6-astra", effort: "high", targetDescription: "GPT-6 Astra at high reasoning" },
+  "harness-evaluator": { model: "gpt-6-astra", effort: "medium", targetDescription: "GPT-6 Astra at medium reasoning" },
 };
 
 function readSource(agent) {
@@ -305,33 +320,6 @@ function validateUserManagedCodex(agent, content) {
   }
 }
 
-function loadUserManagedReceipt(allowedPaths) {
-  if (!fs.existsSync(USER_MANAGED_RECEIPT_PATH)) return { ok: true, hashes: new Map() };
-  try {
-    const parsed = JSON.parse(fs.readFileSync(USER_MANAGED_RECEIPT_PATH, "utf8"));
-    if (
-      parsed?.protocol !== 1
-      || parsed?.authority !== "user-managed-agent-fleet"
-      || !Array.isArray(parsed.files)
-    ) return { ok: false, hashes: new Map() };
-    const hashes = new Map();
-    for (const entry of parsed.files) {
-      if (
-        !entry
-        || typeof entry.path !== "string"
-        || !allowedPaths.has(entry.path)
-        || typeof entry.sha256 !== "string"
-        || !/^sha256:[a-f0-9]{64}$/.test(entry.sha256)
-        || hashes.has(entry.path)
-      ) return { ok: false, hashes: new Map() };
-      hashes.set(entry.path, entry.sha256);
-    }
-    return { ok: true, hashes };
-  } catch (_error) {
-    return { ok: false, hashes: new Map() };
-  }
-}
-
 function writeUserManagedReceipt(files) {
   fs.mkdirSync(path.dirname(USER_MANAGED_RECEIPT_PATH), { recursive: true });
   const receipt = {
@@ -426,8 +414,6 @@ const targets = prepared.flatMap(({ agent, source, parsed, mapped }) => {
     },
   ];
 });
-const allowedTargetPaths = new Set(targets.map((target) => target.path));
-
 if (acceptUserManaged) {
   const acceptedFiles = [];
   let invalid = false;
@@ -462,7 +448,7 @@ if (acceptUserManaged) {
 
 const receipt = force
   ? { ok: true, hashes: new Map() }
-  : loadUserManagedReceipt(allowedTargetPaths);
+  : readAgentFleetUserManagedReceipt({ ...process.env, HOME });
 if (!receipt.ok) {
   console.log("[fleet] user-managed receipt: invalid");
   process.exit(1);

package/assets/templates/helpers/sprint-backlog.sh

@@ -486,7 +486,7 @@ backlog_counts() {
 
 next_pending_row() {
   local file="$1"
-  backlog_rows "$file" | awk -F '\t' '$2 == "[ ]" { print; exit }'
+  backlog_rows "$file" | awk -F '\t' '!found && $2 == "[ ]" { print; found = 1 }'
 }
 
 # Mint one persisted task id: 32 random bytes rendered as lowercase hex. A task
@@ -1043,7 +1043,7 @@ cmd_start_task() {
     echo "sprint-backlog: task reference '$task_ref' is ambiguous (${match_count} backlog rows match); fix duplicate indices or task names first" >&2
     exit 1
   fi
-  target_row="$(backlog_rows "$sprint_file" | TASK_REF="$task_ref" awk -F '\t' '$1 == ENVIRON["TASK_REF"] || $3 == ENVIRON["TASK_REF"] { print; exit }')"
+  target_row="$(backlog_rows "$sprint_file" | TASK_REF="$task_ref" awk -F '\t' '!found && ($1 == ENVIRON["TASK_REF"] || $3 == ENVIRON["TASK_REF"]) { print; found = 1 }')"
 
   local target_index target_status target_task target_mode target_acceptance
   target_index="$(printf '%s' "$target_row" | cut -f1)"

package/assets/templates/helpers/verify-contract.sh

@@ -190,8 +190,18 @@ contract_allowed_paths() {
     in_paths && /^[[:space:]]*-[[:space:]]*/ {
       line = $0
       sub(/^[[:space:]]*-[[:space:]]*/, "", line)
+      # Drop a YAML inline comment: `#` at the start or after whitespace, outside a leading quoted scalar.
+      q = substr(line, 1, 1)
+      close_at = (q == "\"" || q == "'\''") ? index(substr(line, 2), q) : 0
+      if (close_at > 0) {
+        line = substr(line, 1, close_at + 1)
+      } else {
+        sub(/^#.*$/, "", line)
+        sub(/[[:space:]]+#.*$/, "", line)
+      }
       gsub(/^["'\''`]+|["'\''`]+$/, "", line)
-      print trim(line)
+      line = trim(line)
+      if (line != "") print line
     }
   '
 }

package/assets/templates/helpers/verify-sprint.sh

@@ -193,8 +193,18 @@ contract_allowed_paths() {
     in_paths && /^[[:space:]]*-[[:space:]]*/ {
       line = $0
       sub(/^[[:space:]]*-[[:space:]]*/, "", line)
+      # Drop a YAML inline comment: `#` at the start or after whitespace, outside a leading quoted scalar.
+      q = substr(line, 1, 1)
+      close_at = (q == "\"" || q == "'\''") ? index(substr(line, 2), q) : 0
+      if (close_at > 0) {
+        line = substr(line, 1, close_at + 1)
+      } else {
+        sub(/^#.*$/, "", line)
+        sub(/[[:space:]]+#.*$/, "", line)
+      }
       gsub(/^["'\''`]+|["'\''`]+$/, "", line)
-      print trim(line)
+      line = trim(line)
+      if (line != "") print line
     }
   '
 }