safeword 0.76.0 → 0.78.0

package/codex-plugin/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "safeword",
-  "version": "0.76.0",
+  "version": "0.78.0",
   "description": "Safeword workflow guidance and gates for Codex.",
   "author": {
     "name": "Arcade AI"

package/codex-plugin/hooks.json

@@ -6,7 +6,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "bunx --bun safeword@0.76.0 hook codex session-start --plugin-hook",
+            "command": "bunx --bun safeword@0.78.0 hook codex session-start --plugin-hook",
             "timeout": 120,
             "statusMessage": "Loading Safeword standing instructions"
           }
@@ -19,7 +19,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "bunx --bun safeword@0.76.0 hook codex pre-tool-use --plugin-hook",
+            "command": "bunx --bun safeword@0.78.0 hook codex pre-tool-use --plugin-hook",
             "timeout": 30,
             "statusMessage": "Checking Safeword edit gates"
           }
@@ -32,7 +32,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "bunx --bun safeword@0.76.0 hook codex post-tool-use --plugin-hook",
+            "command": "bunx --bun safeword@0.78.0 hook codex post-tool-use --plugin-hook",
             "timeout": 30,
             "statusMessage": "Surfacing Safeword post-tool context"
           }
@@ -45,7 +45,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "bunx --bun safeword@0.76.0 hook codex user-prompt-submit --plugin-hook",
+            "command": "bunx --bun safeword@0.78.0 hook codex user-prompt-submit --plugin-hook",
             "timeout": 30,
             "statusMessage": "Checking queued Safeword prompt context"
           }
@@ -58,7 +58,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "bunx --bun safeword@0.76.0 hook codex stop --plugin-hook",
+            "command": "bunx --bun safeword@0.78.0 hook codex stop --plugin-hook",
             "timeout": 600,
             "statusMessage": "Checking Safeword stop continuation"
           }

package/codex-plugin/skills/bdd/SKILL.md

@@ -70,6 +70,12 @@ bun .safeword/hooks/write-review-stamp.ts --author-agent "author-agent" --review
 
 If the reviewer finds blocking issues, fix them and re-review — don't stamp.
 
+All BDD review exits share one lifecycle rule: `REVIEW_PENDING` is a live
+review, not a verdict. Keep its `review_id`, collect it through the returned
+typed `nextActions` until terminal, and never start a replacement review or
+advance/stamp while it is pending. `REVIEW_STALE` means rerun against the
+current artifacts. Only a terminal verdict may advance the phase.
+
 The plan-implementation exit applies the same discipline to the implementation plan (see references/PLAN_IMPLEMENTATION.md's exit). Other phase exits don't need an independent review by default — they carry their
 own guards (intake's user sub-phase gates, implement's tests, the done-gate's
 evidence checks). When the **review gate** is enabled (`reviewGate` in

package/codex-plugin/skills/bdd/references/SCENARIOS.md

@@ -198,7 +198,7 @@ delivery retries on exponential backoff`). IDs are 1-indexed per job and
 
 **Entry:** Agent enters `scenario-gate` phase.
 
-Run the **`$safeword:review-spec`** skill — it is the gate procedure (vacuous-pass, AODI, determinism risks, adversarial pass + negative-case, cross-cutting checks, and the findings format). It reads the active ticket's `.feature` source when present, using `test-definitions.md` only as the R/G/R ledger, reports findings, and is re-invokable standalone after scenario edits. Apply its findings, then complete the plain-language completeness check and exit below.
+Run the **`$safeword:review-spec`** skill — it is the gate procedure (vacuous-pass, AODI, determinism risks, adversarial pass + negative-case, cross-cutting checks, and the findings format). It reads the active ticket's `.feature` source when present, using `test-definitions.md` only as the R/G/R ledger, reports findings, and is re-invokable standalone after scenario edits. Its final reconciliation maps material dimensions, affected surfaces, and declared public outcomes to scenarios or explicit deferrals, then challenges whether the planned proof exercises the boundary each load-bearing scenario claims. Apply its findings, then complete the plain-language completeness check and exit below.
 
 ### Are the reviewed scenarios complete?
 
@@ -207,7 +207,7 @@ Ask the user: **Do these scenarios now fully cover the intended behavior and imp
 ### Scenario Gate Exit
 
 1. Each scenario passes the vacuous-pass test and AODI (Atomic, Observable, Deterministic, Independent)
-2. Adversarial pass + cross-cutting checks complete; findings presented in the findings format (or confirmed clean)
+2. Adversarial pass + cross-cutting checks complete, including coverage reconciliation and the proof-claim challenge; findings presented in the findings format (or confirmed clean)
 3. **Check for one build-only kill-risk.** Run this checkpoint only here, after
    items 1–2 pass — never during intake, define-behavior, or while scenario
    validation is incomplete. While items 1–2 are incomplete, remain in

package/codex-plugin/skills/bdd/references/TDD.md

@@ -41,6 +41,19 @@ same actor-facing entry point and actor-visible result that the `When` and
 - **Observe the `Then` as the actor-visible result.** Store, editor, or component
   state is supporting evidence; it does not prove a visible UI result, emitted
   CLI output, or external API response.
+- **Assert the result's material values.** A proxy property is not enough: when a
+  `Then` names an actor or typed result, assert those fields in the emitted
+  output. Assert attempt order only when that order is part of the promised
+  behavior.
+- **Prove the whole scenario in its primary test.** Material `Given`, `When`,
+  and `Then` clauses must hold together at the claimed boundary; evidence
+  scattered across separate tests does not prove their interaction.
+- **Preserve timing and cardinality.** If the scenario promises behavior within
+  the same invocation, attempt, or session, a retry or second call is not
+  equivalent proof.
+- **Prove every material outline row.** A `Scenario Outline` is complete only
+  when each behaviorally distinct example traverses the claimed boundary;
+  otherwise narrow the scenario or add the missing proof.
 - **Keep evidence limits explicit.** When the real boundary cannot be automated
   reliably, use the existing `@manual` or `@live` path and perform and record
   that check separately. A tag, skip reason, or narrower automated test does
@@ -120,7 +133,12 @@ At the bottom of `test-definitions.md`, add one row for the whole-ticket cross-s
 - Modify test files in a REFACTOR commit — blocked at commit-time (test changes during cleanup are behavior changes in disguise)
 - Add extra checkboxes like `- [ ] REVIEW` — only RED/GREEN/REFACTOR
 
-**Evidence before claims:** Show test output, don't just claim "tests pass". Run the targeted suite at GREEN for fast feedback; run the FULL suite once at scenario close (after REFACTOR) to catch cross-module regressions.
+**Evidence before claims:** Show terminal test output, don't just claim "tests
+pass." A launched, queued, lock-waiting, timed-out, or still-running command is
+not GREEN. Mark GREEN only after the relevant command reaches a terminal result
+that reports the intended test passing. Run the targeted suite at GREEN for
+fast feedback; run the FULL suite once at scenario close (after REFACTOR) to
+catch cross-module regressions.
 
 ### Red flags — stop and rethink:
 

package/codex-plugin/skills/closeout/SKILL.md

@@ -89,6 +89,12 @@ successful result whose `data.agent_filing_needed` is `false` and whose derived
 current session has an empty filing spool. Zero substantial findings and every
 finding successfully filed are both complete outcomes.
 
+Each successful run seals the last complete JSONL record from one immutable
+transcript read. If preview reporting appends more complete records, apply
+validates the sealed byte prefix and runs retro only over the bounded appended
+window before advancing the receipt. A partial trailing record is neither
+sealed nor lost; mutation or truncation of the sealed prefix fails closed.
+
 Failed extraction, failed filing, pending drafts, malformed output, or an
 identity mismatch means no cleanup. Report every failure and its recovery
 action. A request to skip retro does not create a bypass: preserve the worktree
@@ -113,9 +119,11 @@ or mints one from terminal green hosted CI. Only when neither proof is available
 does it run the project's verification, build, typecheck, and BDD plans. It does not rerun
 dependency audit: that changing intelligence is enforced at the
 delivery-time, pre-merge boundary and cannot repair an immutable merged head.
-It reuses the exact verification and retrospective snapshots through matching
-preview and apply invocations. New transcript content or changed repository
-state makes the plan stale instead of silently expanding its evidence window.
+It reuses the exact verification snapshot and sealed retrospective evidence
+through matching preview and apply invocations. Append-only transcript progress
+advances through the bounded retrospective window without changing the cleanup
+authorization digest. Changed repository state, cleanup targets, or any mutation
+of the sealed transcript prefix still makes the plan stale.
 After the topic worktree is gone, preview requires its fresh clean-head receipt.
 It binds the resulting repository state and exact PR identity to `PLAN_DIGEST`.
 Report the complete operation list and all blockers. Do not apply a blocked plan.

package/codex-plugin/skills/quality-review/SKILL.md

@@ -178,6 +178,14 @@ Each pass:
    bun .safeword/hooks/run-review.ts review run quality-review changed-file [more-changed-files...] --agent-handoff --json
    ```
 
+   A healthy deep review may return `REVIEW_PENDING` after its foreground
+   courtesy wait. That is a handoff, not a failed route: keep the returned
+   `review_id`, continue other useful work, then run the typed `nextActions`
+   status command until it reaches a terminal result. Never start a second
+   review for the same sources merely because the first is still running.
+   Apply the normal verdict rules only to the collected terminal result; if it
+   is `REVIEW_STALE`, rerun against the current sources.
+
    Claude-authored work prefers headless Codex; Codex-authored work prefers
    headless Claude. The coordinator uses a neutral snapshot, checks reviewer
    provenance, preserves the exact preferred-route failure, and records any

package/codex-plugin/skills/review-spec/SKILL.md

@@ -111,6 +111,15 @@ Eight lenses across the whole scenario set (not per scenario) — each asks "wha
 - **Invariant binding** — for each normative clause in `spec.md` (never / must not / always / only), name the scenario whose failure would falsify it **and** the condition under which it fails; a bare scenario reference is not a binding, it's a pointer that survives the invariant being violated. An invariant no scenario would catch is a **must-fix** — cheapest to write now, while no code exists to work around. Worse than a gap is the scenario whose title names the invariant while its `Given` establishes a weaker precondition: it reads as coverage and proves nothing, so report it as a vacuous pass, not a missing scenario. Found live in QRX2DN — the spec forbade an unbound session mutating ticket state, every row named `never_uses_a_fallback_for` bound a session id, and the no-identity case the invariant actually named shipped as a defect (#1425).
 - **Wiring** — for each behavior that crosses a module/command boundary, is there a scenario exercised end-to-end through the real entry point (real config → real collaborators, mocking only the process boundary), not only via injected internals? A path reachable solely through a `provider: none`-style short circuit has no wiring coverage (see `testing/SKILL.md` → Wiring Tests).
 
+Finish by reconciling the set instead of adding speculative cases: every
+material partition retained in `dimensions.md`, affected surface, and public
+command or user-visible outcome declared in ticket scope needs a scenario or an
+explicit `skip: <reason>`. For each load-bearing scenario ask: _could the
+proposed test pass while the user-facing claim is still broken?_ Same-process
+proof cannot establish caller-exit survival; an injected fake cannot establish
+real CLI wiring; a unit test cannot establish a runtime or protocol boundary.
+Report a proof-boundary mismatch now so the implementation plan can correct it.
+
 ## Findings format
 
 Report findings the way safeword talks to the user — lead with the answer, structure only because a multi-finding review earns it, end with the call:

package/codex-plugin/skills/tdd-review/SKILL.md

@@ -27,7 +27,7 @@ Key the review off the **last checked** box in the current scenario — that's t
 
 Depth scales with the step: lightweight after RED, moderate after GREEN, full after REFACTOR.
 
-## After RED — review the test
+## After RED — adversarially review the test
 
 Focused review (~1 minute). Check the test that was just written:
 
@@ -42,6 +42,11 @@ Focused review (~1 minute). Check the test that was just written:
 - **Fails for the right reason — confirmed by the run, not the eye?** Execute the test now and read the actual failure: it must report the _missing behavior_, not a syntax, import, or setup error. This is the one bullet you don't judge by reading — the run is the evidence.
 - **Right test type?** Load the testing skill and consult its scope hierarchy (E2E > Integration > Unit). Was a higher-scope test practical here? Did we drop to unit when integration would catch more?
 - **Coverage adequacy?** Consult testing guide's bug detection matrix. Ask: "What could still break that this test wouldn't catch?" Flag gaps — missing edge cases, error paths, or boundary values. **Where a gap goes:** a missing scenario is a scope change, not a mid-implement edit — defer it to a follow-up ticket, or loop back to define-behavior, re-run the scenario-gate, and re-enter plan-implementation (update impl-plan.md for the new scenario) before implement. Don't silently append scenarios to a signed-off `test-definitions.md`.
+- **Proof matches the claim?** Could this test pass while the user-facing claim
+  remains broken? Challenge the actual test boundary, not its title: a
+  same-process test cannot prove caller-exit survival, an injected fake cannot
+  prove real CLI wiring, and a unit test cannot prove a runtime or protocol
+  boundary.
 
 **Vacuity guard (the external check).** A test that would pass without the feature proves nothing. The RED→GREEN transition is the proof it's wired to the behavior: it must be failing _now_, and the minimal implementation is what turns it green. If a test ever passes _before_ its implementation exists, it's vacuous — fix the test, not the code.
 

package/codex-plugin/skills/verify/SKILL.md

@@ -41,16 +41,26 @@ For task, patch, or no-ticket work, this proof isn't required — note it's miss
 
 ### 1. Find Current Ticket (if any)
 
+Use the installed resolver. It reconciles this runtime's session binding with
+the current PR or worktree's Git changes and fails closed when those signals
+conflict. It never scans the global `in_progress` backlog. A session-bound
+ticket remains relevant after its status changes during closeout; a changed
+`done` ticket remains eligible.
+
 ```bash
-# Find in_progress tickets, excluding epics
 PROJECT_DIR="${CLAUDE_PROJECT_DIR:-$(git rev-parse --show-toplevel 2> /dev/null || pwd)}"
-NS_ROOT="$(bun "$PROJECT_DIR/.safeword/hooks/resolve-namespace-root.ts" "$PROJECT_DIR")"
-for f in "$NS_ROOT"/tickets/*/ticket.md; do
-  [ -f "$f" ] || continue
-  grep -q "^status: in_progress" "$f" && ! grep -q "^type: epic" "$f" && echo "$f"
-done | head -1
+bun "$PROJECT_DIR/.safeword/hooks/resolve-verify-ticket.ts" "$PROJECT_DIR"
 ```
 
+If Safeword's injected context names a ticket but the host exposes no runtime
+identity to the helper, rerun with `--ticket <id>`. Multiple changed tickets
+fail closed with the same instruction. No candidate means continue without an
+active ticket.
+
+Git cannot infer current work from commits made directly on an up-to-date
+default branch because there is no distinct merge-base range. In that case,
+pass `--ticket <id>` when ticket context is required.
+
 If a ticket is found, read it to get:
 
 - `parent:` field (if any)
@@ -147,9 +157,21 @@ else
   exit 1
 fi
 
+# >>> verification_lanes (behavior covered by verify-skill.test.ts)
+# Run every lane for complete evidence, but preserve the first non-zero status
+# so a later successful lane cannot turn the aggregate invocation green.
+verification_status=0
+record_verification_status() {
+  if [ "$lane_status" -ne 0 ] && [ "$verification_status" -eq 0 ]; then
+    verification_status="$lane_status"
+  fi
+}
+
 # --- Test suite (resolved by safeword project test-plan — one source of truth) ---
 plan_kind=verify
 run_plan
+lane_status=$?
+record_verification_status
 
 # --- Gherkin acceptance lane (resolved by safeword project test-plan --kind bdd:
 #     cucumber-js, behave, … — godog/cucumber-rs fold into the Go/Rust test lanes).
@@ -159,15 +181,21 @@ bdd_plan="$(run_safeword project test-plan --kind bdd --format sh)"
 rc=$?
 if [ "$rc" -ne 0 ]; then
   echo "❌ Evidence generation failed: safeword project test-plan --kind bdd exited $rc (red, not a passed check)" >&2
+  lane_status=$rc
+  record_verification_status
 elif [ -z "$bdd_plan" ]; then
   echo "Gherkin acceptance lane: ⏭️ Skipped — no acceptance lane detected"
 else
   bash -c "$bdd_plan"
+  lane_status=$?
+  record_verification_status
 fi
 
 # --- Build check (resolved by safeword project test-plan) ---
 plan_kind=build
 run_plan
+lane_status=$?
+record_verification_status
 
 # --- Typecheck: static type-check where the stack has one — `tsc --noEmit` for
 #     TypeScript (the same signal CI's lint job runs, #436), mypy/pyright for
@@ -179,12 +207,19 @@ run_plan
 #     it isn't a gap. ---
 plan_kind=typecheck
 run_plan
+lane_status=$?
+record_verification_status
 
 # --- Supply-chain: JavaScript's package-manager audit, Python's `uv audit` or
 #     `pip-audit`, Go's pinned `govulncheck`, and Rust's cargo-deny advisories.
 #     A missing scanner prints a visible skip, never a false green. ---
 plan_kind=deps
 run_plan
+lane_status=$?
+record_verification_status
+
+exit "$verification_status"
+# <<< verification_lanes
 ```
 
 The `$safeword:lint` command handles linting with auto-fix. Report any remaining unfixable errors. Aggregate every attempted stack test into the final `**Test Suite:**` status, and every attempted stack build into the final `**Build:**` status. **Typecheck is part of the gate, not optional:** when the ticket changed TypeScript, a passing targeted-test run is not "ready" until `test-plan --kind typecheck` (or `$safeword:lint`, which runs `tsc --noEmit`) is green — CI's lint job runs it and will go red otherwise. A skipped or empty test-plan is not a failure when the project lacks a matching automated check; it is an explicit evidence gap to mention when the ticket touched that stack.

package/dist/{architecture-MLLLP2QN.js → architecture-4EIJWLZ2.js}

@@ -9,23 +9,23 @@ import {
   planSelfHealProject,
   selfHealProject,
   selfHealProjectPreservingProse
-} from "./chunk-PZTGLQSD.js";
+} from "./chunk-I4KBHRZW.js";
 import {
   discoverUnreadableWorkspaces,
   extractMonorepoArchitectureSnapshot
-} from "./chunk-YP2V3YUV.js";
+} from "./chunk-3EJNDIAO.js";
 import {
   GENERATED_ARCHITECTURE_FILENAME,
   isArchitectureDocumentEnforcementEnabled,
   readConfiguredPath,
   resolveGeneratedArchitecturePath,
   toRepoDirectory
-} from "./chunk-2MI7M2CO.js";
+} from "./chunk-GKR44BCH.js";
 import {
   readJson,
   writeJson
-} from "./chunk-7G6OSNIV.js";
-import "./chunk-6DKB2H5U.js";
+} from "./chunk-S2T356DA.js";
+import "./chunk-BAYWBZ32.js";
 
 // src/commands/architecture.ts
 import { execFileSync } from "child_process";
@@ -650,4 +650,4 @@ export {
   architectureStage,
   architectureStaged
 };
-//# sourceMappingURL=architecture-MLLLP2QN.js.map
+//# sourceMappingURL=architecture-4EIJWLZ2.js.map

package/dist/{architecture-document-OFBN5ZAO.js → architecture-document-Z3GLUOE3.js}

@@ -7,11 +7,11 @@ import {
   selfHeal,
   selfHealProject,
   selfHealProjectPreservingProse
-} from "./chunk-PZTGLQSD.js";
-import "./chunk-YP2V3YUV.js";
-import "./chunk-2MI7M2CO.js";
-import "./chunk-7G6OSNIV.js";
-import "./chunk-6DKB2H5U.js";
+} from "./chunk-I4KBHRZW.js";
+import "./chunk-3EJNDIAO.js";
+import "./chunk-GKR44BCH.js";
+import "./chunk-S2T356DA.js";
+import "./chunk-BAYWBZ32.js";
 export {
   isSafewordOwned,
   isWouldChangeAction,
@@ -22,4 +22,4 @@ export {
   selfHealProject,
   selfHealProjectPreservingProse
 };
-//# sourceMappingURL=architecture-document-OFBN5ZAO.js.map
+//# sourceMappingURL=architecture-document-Z3GLUOE3.js.map

package/dist/{architecture-monorepo-MYENEFSR.js → architecture-monorepo-EIF3E3L3.js}

@@ -3,13 +3,13 @@ import {
   discoverWorkspaces,
   extractMonorepoArchitectureSnapshot,
   monorepoFingerprintOf
-} from "./chunk-YP2V3YUV.js";
-import "./chunk-7G6OSNIV.js";
-import "./chunk-6DKB2H5U.js";
+} from "./chunk-3EJNDIAO.js";
+import "./chunk-S2T356DA.js";
+import "./chunk-BAYWBZ32.js";
 export {
   discoverUnreadableWorkspaces,
   discoverWorkspaces,
   extractMonorepoArchitectureSnapshot,
   monorepoFingerprintOf
 };
-//# sourceMappingURL=architecture-monorepo-MYENEFSR.js.map
+//# sourceMappingURL=architecture-monorepo-EIF3E3L3.js.map

package/dist/{boundary-OWTJP7DH.js → boundary-U5U2PSX2.js}

@@ -7,25 +7,25 @@ import {
 } from "./chunk-3D25MSWD.js";
 import {
   createPhaseAnchorScope
-} from "./chunk-K64BTVJ7.js";
+} from "./chunk-USPVNZ63.js";
 import {
   classifyAnnotation,
   isValidSha,
   isValidSkipReason,
   parseCheckboxAnnotation
 } from "./chunk-Z4ESH6KU.js";
-import "./chunk-URVJZ4NL.js";
+import "./chunk-Q5KLE6ZF.js";
 import {
   warn
 } from "./chunk-QSLVO4XF.js";
 import {
   readConfiguredPathFromContent,
   ticketDirectoriesForConfiguredRoot
-} from "./chunk-2MI7M2CO.js";
+} from "./chunk-GKR44BCH.js";
 import {
   readFileSafe
-} from "./chunk-7G6OSNIV.js";
-import "./chunk-6DKB2H5U.js";
+} from "./chunk-S2T356DA.js";
+import "./chunk-BAYWBZ32.js";
 
 // src/commands/boundary.ts
 import { execFileSync as execFileSync2 } from "child_process";
@@ -112,6 +112,7 @@ import { existsSync as existsSync4, readFileSync as readFileSync4 } from "fs";
 import nodePath5 from "path";
 
 // templates/hooks/lib/dependency-readiness.ts
+import { spawnSync } from "child_process";
 import { createHash } from "crypto";
 import {
   existsSync as existsSync2,
@@ -119,6 +120,7 @@ import {
   readdirSync,
   readFileSync as readFileSync2,
   realpathSync,
+  rmSync,
   statSync as statSync2,
   writeFileSync
 } from "fs";
@@ -132,7 +134,7 @@ import nodePath from "path";
 import nodePath2 from "path";
 
 // templates/hooks/lib/test-runner.ts
-import { execSync, spawnSync } from "child_process";
+import { execSync, spawnSync as spawnSync2 } from "child_process";
 import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
 import nodePath4 from "path";
 var BDD_TEST_TIMEOUT_MS = 5 * 6e4;
@@ -628,4 +630,4 @@ function boundary(options) {
 export {
   boundary
 };
-//# sourceMappingURL=boundary-OWTJP7DH.js.map
+//# sourceMappingURL=boundary-U5U2PSX2.js.map