safeword 0.78.2 → 0.78.3

package/codex-plugin/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "safeword",
-  "version": "0.78.2",
+  "version": "0.78.3",
   "description": "Safeword workflow guidance and gates for Codex.",
   "author": {
     "name": "Arcade AI"

package/codex-plugin/hooks.json

@@ -6,7 +6,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "bunx --bun safeword@0.78.2 hook codex session-start --plugin-hook",
+            "command": "bunx --bun safeword@0.78.3 hook codex session-start --plugin-hook",
             "timeout": 120,
             "statusMessage": "Loading Safeword standing instructions"
           }
@@ -19,7 +19,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "bunx --bun safeword@0.78.2 hook codex pre-tool-use --plugin-hook",
+            "command": "bunx --bun safeword@0.78.3 hook codex pre-tool-use --plugin-hook",
             "timeout": 30,
             "statusMessage": "Checking Safeword edit gates"
           }
@@ -32,7 +32,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "bunx --bun safeword@0.78.2 hook codex post-tool-use --plugin-hook",
+            "command": "bunx --bun safeword@0.78.3 hook codex post-tool-use --plugin-hook",
             "timeout": 30,
             "statusMessage": "Surfacing Safeword post-tool context"
           }
@@ -45,7 +45,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "bunx --bun safeword@0.78.2 hook codex user-prompt-submit --plugin-hook",
+            "command": "bunx --bun safeword@0.78.3 hook codex user-prompt-submit --plugin-hook",
             "timeout": 30,
             "statusMessage": "Checking queued Safeword prompt context"
           }
@@ -58,7 +58,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "bunx --bun safeword@0.78.2 hook codex stop --plugin-hook",
+            "command": "bunx --bun safeword@0.78.3 hook codex stop --plugin-hook",
             "timeout": 600,
             "statusMessage": "Checking Safeword stop continuation"
           }

package/codex-plugin/skills/bdd/references/SCENARIOS.md

@@ -118,6 +118,9 @@ Write each saved `.feature` scenario to these rules — they head off at authori
 - **Declarative, business language** — name the intent, not the UI mechanics. "When the customer submits the order" ✓, not "When the user clicks `#submit` and waits 200ms" ✗. Reads as living documentation and survives implementation changes.
 - **`Given` is state, not action** — establish the world, don't act in it. "Given the cart holds one item" ✓, not "Given the customer adds an item" ✗ (an action belongs in `When`).
 - **No `or` in the `Then`** — one outcome per scenario; "returns 200 **or** 201" is two scenarios. For one behavior across many inputs, use a `Scenario Outline` with an `Examples` table, not copy-pasted scenarios.
+- **Keep acceptance examples representative** — scenarios cover externally meaningful behavior partitions and boundaries, not every parser permutation or corruption mechanism. Put exhaustive schema, arithmetic, malformed-field, and implementation-level matrices in table-driven lower-level tests.
+- **Keep one numbered Rule boundary** — for a scenario under a numbered Rule, every asserted outcome must prove that enclosing Rule. If a `Then` also proves an independently valuable invariant owned by another Rule, split it into that Rule's scenario. Unnumbered grouping Rules and scenarios without lineage keep the exemptions below.
+- **Keep outlines coherent** — rows vary one behavioral dimension and retain the same outcome shape. Unrelated defect mechanisms that merely share a generic rejection belong in separate scenarios or lower-level contract matrices.
 
 Two of these rules mirror gate checks — **one behavior** is AODI's **Atomic**, and externally-observable outcomes are its **Observable** (both in the Scenario Quality Gate below). Author for them here; the gate still validates every scenario adversarially.
 

package/codex-plugin/skills/bdd/references/TDD.md

@@ -55,9 +55,15 @@ same actor-facing entry point and actor-visible result that the `When` and
   when each behaviorally distinct example traverses the claimed boundary;
   otherwise narrow the scenario or add the missing proof.
 - **Keep evidence limits explicit.** When the real boundary cannot be automated
-  reliably, use the existing `@manual` or `@live` path and perform and record
-  that check separately. A tag, skip reason, or narrower automated test does
-  not prove the broader scenario by itself.
+  reliably, use the existing `@manual` or `@live` path and record the command or
+  steps performed, observed result, and retained evidence identity in the ticket
+  work log under a concrete timestamped heading. Annotate the ledger with that
+  exact identity, for example `RED skip: manual — see work log 2026-08-14T18:30Z
+"paid route proof"`, and record GREEN only after that manual check succeeds.
+  This annotation is agent-attested evidence; the gate checks that a reason is
+  present, not that the referenced work-log entry resolves. A tag, generic skip
+  reason, or narrower automated test does not prove the broader scenario by itself;
+  fixtures and lower-level tests may de-risk it, but cannot lend it their evidence.
 
 If a scenario accidentally names incidental UI mechanics rather than product
 behavior, loop back to define-behavior and rewrite it; do not silently reinterpret
@@ -72,7 +78,7 @@ When the scenario source is a `.feature` file and the Cucumber lane exists, RED
 - **Verify RED on the reported step status, not the exit code alone.** Safeword's scaffolded `test:bdd` runs cucumber-js _without_ `--dry-run`, so undefined/pending steps exit non-zero — a genuine RED. But `cucumber-js --dry-run` _reports_ undefined/ambiguous/pending steps while still **exiting 0**; a lane (or host profile) built on `--dry-run` will look green even when steps are missing. Never substitute a bare `--dry-run` for this RED check, and when a dry-run/check profile is the host's spec-ahead lane, confirm RED by the reported undefined/pending count it prints, not by its exit status.
 - Keep step definitions thin; call app, API, CLI, or shell helpers from steps. Do not bury business logic in Cucumber glue.
 - Use Vitest for lower-level implementation proof when it gives faster or more precise coverage, especially pure functions and module contracts.
-- A scenario is not complete until both the relevant implementation tests and `test:bdd` pass, unless the feature is explicitly tagged `@manual` or `@live` with a skip reason.
+- A scenario is not complete until both the relevant implementation tests and `test:bdd` pass. An explicitly tagged `@manual` or `@live` scenario instead requires the ticket-work-log evidence and ledger annotations described above.
 
 ### Walking Skeleton (first scenario only)
 
@@ -102,7 +108,7 @@ Then they see the dashboard
 
 **Annotation rule (enforced by hook):** every `[x]` transition must carry either a commit SHA (proving which commit did that step) or `skip: <non-empty reason>` (a deliberate, auditable omission). Bare `[x]` without an annotation is blocked at the write-time hook. Pre-existing bare `[x]` from before this rule shipped is silently allowed — the validation is forward-looking only.
 
-**Uncommittable RED states:** Prefer a real RED commit. Use this escape hatch only when a partial RED state cannot pass structural commit gates because the repo rejects incomplete code, such as:
+**Uncommittable RED states:** Prefer a real RED commit. For the uncommittable-partial-state reason below, use this escape hatch only when a partial RED state cannot pass structural commit gates because the repo rejects incomplete code. Manual/live evidence uses the separate path above. Examples of uncommittable partial states include:
 
 - a type-only scaffold that trips unused-property lint before behavior exists
 - an interface rename that cannot compile until all callers are updated

package/codex-plugin/skills/closeout/SKILL.md

@@ -2,7 +2,7 @@
 name: closeout
 description: Close a completed local delivery safely. Use when wrapping up a
   finished coding session by verifying it, merging only with explicit authority,
-  running the mandatory retrospective, and cleaning the exact merged branch and
+  capturing retrospective learning, and cleaning the exact merged branch and
   worktree. Do NOT use for cloud-agent tasks, unmerged work, or cleanup without
   a pull request.
 ---
@@ -62,29 +62,32 @@ unobservable results are not merge proof; report the recovery check and stop.
 
 If the command reported an error but fresh observation proves the expected head
 was merged, report that the remote merge succeeded, do not retry it, and proceed
-to the mandatory retrospective. On every invocation, re-observe durable state
+to retrospective capture. On every invocation, re-observe durable state
 and continue only the unfinished suffix. Treat an absent cleanup target as
 complete only after proving it was the exact planned target. If the pull request
-is merged, its retrospective is complete, and its exact branch and worktree are
-already absent, report that the session is already closed.
+is merged and its exact branch and worktree are already absent, report that the
+session is already closed and report the retrospective's observed state.
 
 The guard records a private, atomic verification receipt in Git's shared common
 directory after green hosted CI covers a clean exact PR head, or after every
 local verification lane passes on that head.
 For 24 hours, that receipt can prove the immutable head when an interrupted
 cleanup must resume from a surviving worktree after the topic worktree is gone.
-A missing, stale, malformed, dirty-state, or wrong-head receipt blocks cleanup.
+After the topic worktree is gone, a missing, stale, malformed, dirty-state, or
+wrong-head receipt blocks interrupted cleanup resumption.
 
-## 4. Complete the current session's retrospective
+## 4. Capture retrospective learning without making it cleanup authority
 
 After merge is independently confirmed, invoke the cleanup guard in preview
 mode. Its host hook supplies a short-lived, single-consumer binding to this exact
 session (and Cursor transcript). Codex Desktop may instead supply its authenticated
 current `CODEX_THREAD_ID`, consistent with SafeWord's other Codex identity bridges.
-A missing or expired binding or identity fails closed; there is no newest-session
-fallback and callers cannot nominate another receipt, session, transcript, or spool.
+A missing or expired binding or identity is advisory for repository cleanup; there is
+no newest-session fallback and callers cannot nominate another receipt, session,
+transcript, or spool. Report the missing evidence without treating it as authority over
+the worktree or branches.
 
-The guard runs `safeword retro run --json` itself and accepts only a
+The guard runs `safeword retro run --json --auto-extract` itself and accepts only a
 successful result whose `data.agent_filing_needed` is `false` and whose derived
 current session has an empty filing spool. Zero substantial findings and every
 finding successfully filed are both complete outcomes.
@@ -95,13 +98,16 @@ validates the sealed byte prefix and runs retro only over the bounded appended
 window before advancing the receipt. A partial trailing record is neither
 sealed nor lost; mutation or truncation of the sealed prefix fails closed.
 
-Failed extraction, failed filing, pending drafts, malformed output, or an
-identity mismatch means no cleanup. Report every failure and its recovery
-action. A request to skip retro does not create a bypass: preserve the worktree
-and branches and explain that the retrospective is required before cleanup.
+Repository cleanup does not depend on a complete retrospective. A missing binding, an
+incomplete retrospective, extraction failure, malformed output, or identity mismatch is
+advisory: report it and continue evaluating cleanup from fresh repository evidence.
+
+Filing failure or pending drafts are advisory for repository cleanup too. Report the
+exact recovery action and the risk that deleting the worktree could discard captured
+but unfiled learning, but do not let retrospective state authorize or block cleanup.
 
 When the authenticated preview reports pending drafts and includes
-`plan.retro.spoolPath`, invoke the `safeword:retro-filer` skill with that exact
+`plan.retro.spoolPath`, invoke the `$safeword:retro-filer` skill with that exact
 path, then rerun the preview. This is the closeout recovery continuation: the
 guard derived the path from its short-lived host-session binding, so do not
 substitute, discover, or accept a caller-provided spool path.
@@ -128,8 +134,10 @@ After the topic worktree is gone, preview requires its fresh clean-head receipt.
 It binds the resulting repository state and exact PR identity to `PLAN_DIGEST`.
 Report the complete operation list and all blockers. Do not apply a blocked plan.
 
-With the user's cleanup intent already established by invoking closeout, apply
-only the unchanged preview:
+Invocation permits preview only and grants no destructive cleanup authority.
+After reporting the exact operations and blockers, apply only when the current
+user request explicitly authorizes cleanup. Cleanup authority is consumed when
+apply is attempted, and applies only to the unchanged preview:
 
 ```sh
 bun .safeword/scripts/closeout-cleanup.ts --pr PR_NUMBER --yes --plan PLAN_DIGEST

package/codex-plugin/skills/finish-review/SKILL.md

@@ -7,9 +7,10 @@ description: Use only right after the shared review coordinator reports it's run
 
 # Finish Review After Route Exhaustion
 
-Use this workflow only as the immediate continuation of a class-1 coordinator
-result. It adds best-effort feedback when no CLI reviewer completed; it never
-creates independent-review evidence.
+Use this workflow only as the immediate continuation of a class-1 (requires
+independent/cross-model review, unlike class-2's self-verifiable checks)
+coordinator result. It adds best-effort feedback when no CLI reviewer
+completed; it never creates independent-review evidence.
 
 ## Entry gate
 

package/codex-plugin/skills/lint/SKILL.md

@@ -33,7 +33,7 @@ Run these commands based on project type. All detected languages run for polyglo
     bun run lint 2>&1 || true
   fi
   # Prettier - format all files
-  bun run format --if-present 2>&1 || true
+  bun run --if-present format 2>&1 || true
   # TypeScript type check (if tsconfig.json exists)
   [ -f tsconfig.json ] && bunx tsc --noEmit 2>&1 || true
 }

package/codex-plugin/skills/review-spec/SKILL.md

@@ -78,7 +78,9 @@ Common vacuous patterns, each with its fix (apply only when you can state the do
 | **Deterministic** | Same result on repeated runs   | Time/random/external dependency |
 | **Independent**   | No ordering dependency         | "After Scenario 2 runs..."      |
 
-**Atomic** — a single `When`→`Then` is atomic even if the `Then` asserts several properties of ONE outcome ("returns 200 with body X"). Flag non-atomic only when two genuinely independent behaviors could pass/fail separately (two `When` steps, or two `Then`s asserting different system-level effects) — never for a merely compound `Then`.
+**Atomic** — a single `When`→`Then` is atomic even if the `Then` asserts several properties of ONE outcome ("returns 200 with body X"). Flag non-atomic only when two genuinely independent behaviors could pass/fail separately (two `When` steps or two `Then`s asserting different system-level effects) — never for a merely compound `Then`.
+
+**Rule ownership** — review a coherent outcome under the Rule whose invariant it proves. An outcome owned by a different Rule is a lineage defect, not an atomicity defect; move or split it and report that single root cause.
 
 **Observable** — an assertion on a user/caller-visible outcome ("is denied", "passes the gate", "the plan contains X") IS observable even if the mechanism is internal; flag non-observable only for internal-detail-only assertions ("the cache was populated", "the private field is set").
 
@@ -98,6 +100,8 @@ After AODI validation, argue against your own scenario list: "What breaks that n
 
 One lens to always run — **negative-case coverage**: for each happy-path scenario, is there a rejection-path counterpart? Partitioning should already have produced the invalid-input classes; this pass is the backstop. Common pairs — create ↔ duplicate, read ↔ not-found, update ↔ not-allowed, act ↔ precondition-failed. Treat a gap as **should-strengthen**, not must-fix — a sibling AC often already covers the rejection: _"Happy path X has no rejection counterpart — add a scenario for path Z?"_ For one behavior across many inputs, use a `Scenario Outline`.
 
+For each `Scenario Outline`, confirm its rows vary one behavioral dimension and keep the same outcome shape. Do not group unrelated defect mechanisms merely because they share a generic rejection. Keep feature scenarios representative; exhaustive parser, schema, arithmetic, malformed-field, and implementation-corruption matrices belong in table-driven lower-level tests, while externally meaningful boundaries and failure classes required by the cross-cutting checks remain acceptance scenarios.
+
 ## Cross-cutting checks
 
 Eight lenses across the whole scenario set (not per scenario) — each asks "what's missing?":

package/codex-plugin/skills/self-review/SKILL.md

@@ -10,8 +10,8 @@ description: Use when finishing spec.md before writing test-definitions.md, or
 
 Review the artifact you just authored, then earn its review stamp so the next
 step is unblocked. This is **Tier 1** — a fast, built-in first pass: you review
-your own work, no sub-agent involved. Tier 2 (the fork review at each phase
-exit) is the independent check; that happens separately.
+your own work, no sub-agent involved. Tier 2 (the phase-exit review) is the
+independent check; that happens separately.
 
 **Stakes set depth.** Tier 2 may never run — review as if your stamp is the last
 word before code gets built on this spec, because often it is. Cheap floor means

package/codex-plugin/skills/ticket-system/SKILL.md

@@ -166,5 +166,8 @@ single-action task.
 | Need test definitions for a feature OR acceptance criteria             | `./.safeword/templates/test-definitions-feature.md`                   |
 | Feature spans 3+ components OR needs technical spec                    | `./.safeword/templates/design-doc-template.md`                        |
 | Making decision with long-term impact OR trade-offs                    | `./.safeword/templates/architecture-template.md`                      |
+| Recording a structural or hard-to-reverse decision as its own record   | `./.safeword/templates/adr-template.md`                               |
+| Planning a feature's implementation before TDD starts                  | `./.safeword/templates/impl-plan-template.md`                         |
+| Guarding a temporary upstream workaround so its removal isn't missed   | `./.safeword/templates/tripwire-template.md`                          |
 | Task needs context anchoring                                           | `./.safeword/templates/ticket-template.md`                            |
 | Starting execution of a plan, ticket, or spec                          | `./.safeword/templates/work-log-template.md`                          |

package/dist/{architecture-N5ZC4CDU.js → architecture-RQ377ZER.js}

@@ -9,23 +9,23 @@ import {
   planSelfHealProject,
   selfHealProject,
   selfHealProjectPreservingProse
-} from "./chunk-I4KBHRZW.js";
+} from "./chunk-LH2FAQTI.js";
 import {
   discoverUnreadableWorkspaces,
   extractMonorepoArchitectureSnapshot
-} from "./chunk-3EJNDIAO.js";
+} from "./chunk-VZ5B2SIO.js";
 import {
   GENERATED_ARCHITECTURE_FILENAME,
   isArchitectureDocumentEnforcementEnabled,
   readConfiguredPath,
   resolveGeneratedArchitecturePath,
   toRepoDirectory
-} from "./chunk-GKR44BCH.js";
+} from "./chunk-RVDXBHUG.js";
 import {
   readJson,
   writeJson
-} from "./chunk-S2T356DA.js";
-import "./chunk-QTG2EXFT.js";
+} from "./chunk-HF3DXZEA.js";
+import "./chunk-QLOUSTQE.js";
 
 // src/commands/architecture.ts
 import { execFileSync } from "child_process";
@@ -650,4 +650,4 @@ export {
   architectureStage,
   architectureStaged
 };
-//# sourceMappingURL=architecture-N5ZC4CDU.js.map
+//# sourceMappingURL=architecture-RQ377ZER.js.map

package/dist/{architecture-document-UBA5UT4J.js → architecture-document-KS3CLSYN.js}

@@ -7,11 +7,11 @@ import {
   selfHeal,
   selfHealProject,
   selfHealProjectPreservingProse
-} from "./chunk-I4KBHRZW.js";
-import "./chunk-3EJNDIAO.js";
-import "./chunk-GKR44BCH.js";
-import "./chunk-S2T356DA.js";
-import "./chunk-QTG2EXFT.js";
+} from "./chunk-LH2FAQTI.js";
+import "./chunk-VZ5B2SIO.js";
+import "./chunk-RVDXBHUG.js";
+import "./chunk-HF3DXZEA.js";
+import "./chunk-QLOUSTQE.js";
 export {
   isSafewordOwned,
   isWouldChangeAction,
@@ -22,4 +22,4 @@ export {
   selfHealProject,
   selfHealProjectPreservingProse
 };
-//# sourceMappingURL=architecture-document-UBA5UT4J.js.map
+//# sourceMappingURL=architecture-document-KS3CLSYN.js.map

package/dist/{architecture-monorepo-E4JUYJGV.js → architecture-monorepo-NJWWU65G.js}

@@ -3,13 +3,13 @@ import {
   discoverWorkspaces,
   extractMonorepoArchitectureSnapshot,
   monorepoFingerprintOf
-} from "./chunk-3EJNDIAO.js";
-import "./chunk-S2T356DA.js";
-import "./chunk-QTG2EXFT.js";
+} from "./chunk-VZ5B2SIO.js";
+import "./chunk-HF3DXZEA.js";
+import "./chunk-QLOUSTQE.js";
 export {
   discoverUnreadableWorkspaces,
   discoverWorkspaces,
   extractMonorepoArchitectureSnapshot,
   monorepoFingerprintOf
 };
-//# sourceMappingURL=architecture-monorepo-E4JUYJGV.js.map
+//# sourceMappingURL=architecture-monorepo-NJWWU65G.js.map

package/dist/{boundary-HLJILY7R.js → boundary-OPTC2RVJ.js}

@@ -7,25 +7,25 @@ import {
 } from "./chunk-3D25MSWD.js";
 import {
   createPhaseAnchorScope
-} from "./chunk-USPVNZ63.js";
+} from "./chunk-BZWO3BVD.js";
 import {
   classifyAnnotation,
   isValidSha,
   isValidSkipReason,
   parseCheckboxAnnotation
 } from "./chunk-Z4ESH6KU.js";
-import "./chunk-Q5KLE6ZF.js";
+import "./chunk-OKPRQGFG.js";
 import {
   warn
 } from "./chunk-QSLVO4XF.js";
 import {
   readConfiguredPathFromContent,
   ticketDirectoriesForConfiguredRoot
-} from "./chunk-GKR44BCH.js";
+} from "./chunk-RVDXBHUG.js";
 import {
   readFileSafe
-} from "./chunk-S2T356DA.js";
-import "./chunk-QTG2EXFT.js";
+} from "./chunk-HF3DXZEA.js";
+import "./chunk-QLOUSTQE.js";
 
 // src/commands/boundary.ts
 import { execFileSync as execFileSync2 } from "child_process";
@@ -630,4 +630,4 @@ function boundary(options) {
 export {
   boundary
 };
-//# sourceMappingURL=boundary-HLJILY7R.js.map
+//# sourceMappingURL=boundary-OPTC2RVJ.js.map