sawbuck 0.1.34 → 0.1.36

package/README.md

@@ -2,10 +2,21 @@
 
 **Sign your agent to a contract so it does what you want.**
 
-You write the contract (what a real win looks like); Sawbuck enforces it, re-proving every win from the agent's **source** edits alone, so a result that only passed because the agent edited the test, mocked the grader, or loosened a rule reads `gamed` and goes back. Deterministic and zero-LLM: no model in the verdict, nothing read from the agent's trajectory. Attach it and it carries your repo's history along: what broke in these files before, surfaced before you touch them.
+You write the contract (what a real win looks like); Sawbuck enforces it, re-proving every win from the agent's **source** edits alone, so a test that went from red to green only because the agent edited the test, mocked the grader, or loosened a declared config reads `gamed` and goes back. Deterministic and zero-LLM: no model in the verdict, nothing read from the agent's trajectory. Attach it and it carries your repo's history along: what broke in these files before, surfaced before you touch them.
 
 > Sawbuck is the reference implementation of the [Verified-Outcome Contract](CONTRACT.md): the open interface for a coding loop you can trust.
 
+In Claude Code, install the plugin and keep working:
+
+```
+/plugin marketplace add sawbuck-ai/reins
+/plugin install sawbuck-reins@sawbuck
+```
+
+The first time you open a git repository with no contract, Claude finishes your task and offers once to sign it. Say yes: every turn checks protected paths, and every commit is re-proved.
+
+Or from the command line:
+
 ```sh
 # 1 · try it (no install, no commitment): verify your latest change right now
 npx sawbuck check
@@ -13,7 +24,7 @@ npx sawbuck check
 # 2 · enforce it: attach once to this repo
 npm i -g sawbuck
 sawbuck attach            # every commit (a git post-commit hook)
-sawbuck attach --claude   # or every Claude Code turn (a project-scoped Stop hook)
+sawbuck attach --claude   # or protected paths every Claude Code turn, plus every commit (a project-scoped Stop hook)
 ```
 
 **Zero-config:** it auto-detects your test command, so there is nothing to write to start.
@@ -38,12 +49,12 @@ Exit codes: `0` verified · `1` regression · `2` gamed · `3` inconclusive · `
 
 ## What it does
 
-- **Verifies the win.** `check` re-runs your metric from the source diff alone. A faked green (a deleted, weakened, or skipped test; a mocked grader; an edited golden file; a loosened config) reads `gamed`. Deterministic, zero-LLM, $0, and it cannot be argued with because it never reads the trajectory. Red-teamed across 9 ecosystems and 26 adversarial scenarios ([promptwheel/bench/REDTEAM.md](https://github.com/promptwheel-ai/promptwheel/blob/main/bench/REDTEAM.md)).
+- **Verifies the win.** `check` re-runs your metric from the source diff alone. A test that went from red to green because of a deleted, weakened, or skipped test, a mocked grader, an edited golden file, or a loosened declared config reads `gamed`. A suite weakened while it stays green is not proved: there is no win to re-run. Tripwires catch skips and removed assertions in a signed repo. Deterministic, zero-LLM, $0, and it never reads the trajectory. No appeals once signed; `--allow` is recorded. Red-teamed across 9 ecosystems in 26 scenarios: 12 caught, 10 stated limits, 4 honest ([promptwheel/bench/REDTEAM.md](https://github.com/promptwheel-ai/promptwheel/blob/main/bench/REDTEAM.md)).
 - **Says what it cannot see.** A cheat that lives inside the source itself (a value hardcoded to the one visible case, logic keyed to the test environment) is invisible to a source-only re-run, by construction. That limit is in [the contract](CONTRACT.md#3-the-integrity-boundary-what-counts-as-gaming), not hidden.
 - **Remembers what broke.** `context` surfaces the relevant history (reverts, fragile areas, test-weakening) for the files you are touching: a ranked trail guide, before you act.
 - **Shows you everything.** `status` is the inventory: what it has caught for you over time, the debt accruing now, and whether it is armed here, in one view. On-demand, so it is quiet until you go looking.
 - **Rides on, does not replace.** Sawbuck is the verify + memory layer. Your agent and your loop stay yours.
-- **Clean on and off.** the default `attach` touches nothing in your worktree (the hook lives in `.git/`, the record is excluded locally); `--claude` writes one git-excluded settings file; `detach` is a true inverse. `trace` shows every byte it placed, and `detach --verify` proves the repo came back unchanged.
+- **Clean on and off.** the default `attach` touches nothing in your worktree (the hook lives in `.git/`, the record is excluded locally); `--claude` writes one git-excluded settings file; `detach` removes what it wired. Signed contract files stay because they are yours to review; `--purge` deletes the record. `trace` shows every byte it placed, and `detach --verify` proves the wiring is gone.
 
 ## Commands
 
@@ -60,11 +71,12 @@ Exit codes: `0` verified · `1` regression · `2` gamed · `3` inconclusive · `
 | `sawbuck turn` | frame + context in one block: what `attach --claude` runs on every prompt and again right after a compaction |
 | `sawbuck recall` | related notes for your current change from extra memory providers you compose in (bring your own) |
 | `sawbuck trace` · `sawbuck doctor` · `detach --verify` | show the footprint; check the attachment resolves; prove a clean removal |
+| `sawbuck contract` | one command to sign a repo: keeps your contract, adds tests and tripwires if there are none, protected paths, the supply-chain guards, and the architecture lock. `--dry-run` previews it. |
 | `sawbuck where` · `sawbuck statusline` | list every repo it is attached to; a one-line status-line segment (🐴 watching / N caught / steer %) |
 
 ## Give your agent the contract
 
-`sawbuck init` writes this block into your `AGENTS.md` for you (and `CLAUDE.md` / `.cursorrules` if present; `--no-agent-block` to skip), and `sawbuck attach --claude` enforces the same thing every turn via the hook. Here it is to paste yourself if you want:
+`sawbuck init` writes this block into your `AGENTS.md` for you (and `CLAUDE.md` / `.cursorrules` if present; `--no-agent-block` to skip), and `sawbuck attach --claude` enforces it through the hook: every turn checks protected paths, and every commit is re-proved. Here it is to paste yourself if you want:
 
     This repo is under a Sawbuck contract: a change is done only when the win survives verification
     from the source alone. Before finishing, run `sawbuck check`. If it reads `gamed`, the green came
@@ -72,7 +84,11 @@ Exit codes: `0` verified · `1` regression · `2` gamed · `3` inconclusive · `
     Run `sawbuck context` first to see what broke in these files before (reverts, weakened tests,
     fragile spots). Never skip, weaken, or delete a test to go green.
 
-**Measured, not assumed.** On a scenario whose natural fix sits inside a protected module, driven past two forced compactions (and again on Haiku, and under "urgent hotfix" pressure): with no rule the agent edited the protected file 17 of 17 times; with a rule in any form, including a mandate, 0 of 45. The model honors a rule it was told. The gate is for the rule nobody told it, the session that outlived the summary, and the proof that it held: `attach --claude` re-reads the mandates from the repo on every turn, re-impresses them after a compaction (`sawbuck turn`), and blocks a turn that leaves a protected path changed. Numbers and method: [sawbuck.ai/contracts](https://sawbuck.ai/contracts).
+**Rewritten history.** Logbook reads git, so a squash or a rebase takes a revert with it. `sawbuck context` also reads the reflog for commits no branch reaches any more and shows them for the files in hand, and once attached it keeps them in `.sawbuck/rewritten.jsonl` after the reflog expires. It stays local: a clone does not get it, nothing older than the reflog comes back, and work that was never committed is not in git at all. Your steering is separate: `reins` reads your agent transcripts, not git.
+
+**Tested claims.** Every claim above, and every limit, is a test in [`test/claims.test.mjs`](test/claims.test.mjs), run on a clean account.
+
+**Measured, not assumed.** On a scenario whose natural fix sits inside a protected module, 62 trials: 52 driven past a forced compaction (two on the default model, one on Haiku) and 10 shallow, some under "urgent hotfix" pressure. With no rule the agent edited the protected file 17 of 17 times; with a rule in any form, including a mandate, 0 of 45. Earlier scenarios did not tempt it (no rule, 0 of 17), and the wall never had to fire. The model honors a rule it was told. The gate is for the rule nobody told it, the session that outlived the summary, and the proof that it held: `attach --claude` re-reads the mandates from the repo on every turn, re-impresses them after a compaction (`sawbuck turn`), and sends back a turn that leaves a protected path changed, up to three times by default. Numbers and method: [sawbuck.ai/contracts](https://sawbuck.ai/contracts).
 
 Without a `promptwheel.config.json` the check measures your detected test command. To make it count more (coverage, lint, latency, an eval) or to protect a path with a mandate, `sawbuck init` writes the config and explains each line with evidence from your history.
 

package/contract-cmd.mjs

@@ -0,0 +1,64 @@
+#!/usr/bin/env node
+// sawbuck contract: one command that signs a repo to a working contract. Keeps whatever contract is already
+// here, adds your tests and tripwires if there is none, then the supply-chain protections and the architecture
+// lock. Zero-LLM. Re-running changes nothing. Protected product code (auth, billing) is suggested, never added:
+// freezing those is a person's decision.
+import { execFileSync } from 'node:child_process';
+import { readFileSync, writeFileSync, existsSync, mkdtempSync, rmSync, cpSync, mkdirSync } from 'node:fs';
+import { join, dirname, resolve } from 'node:path';
+import { tmpdir } from 'node:os';
+import { fileURLToPath } from 'node:url';
+import { PW } from './bins.mjs';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const repo = process.argv[2] || process.cwd();
+const dry = process.argv.includes('--dry-run');
+const cfgPath = join(repo, 'promptwheel.config.json');
+const run = (args, cwd, stdio = ['ignore', 'pipe', 'pipe']) => execFileSync(process.execPath, args, { cwd, encoding: 'utf8', stdio });
+
+// the preset as the engine writes it, in a scratch repo, so the contract and the engine cannot drift apart
+const scratch = mkdtempSync(join(tmpdir(), 'sawbuck-contract-'));
+try {
+  execFileSync('git', ['init', '-q'], { cwd: scratch, stdio: 'ignore' });
+  writeFileSync(join(scratch, 'package.json'), '{"name":"scratch"}\n');
+  run([PW, 'init', '--preset', 'supply-chain', '--no-agent-block'], scratch);
+  const preset = JSON.parse(readFileSync(join(scratch, 'promptwheel.config.json'), 'utf8'));
+  const had = existsSync(cfgPath);
+  if (dry) {
+    process.stdout.write(`sawbuck contract would ${had ? 'add to' : 'write'} ${cfgPath}: ${preset.metrics.length} guards and ${preset.mandates.length} protected-path rules, the scanners under .promptwheel/packs/, and promptwheel.lock.json.\n`);
+  } else {
+    if (!had) run([join(HERE, 'init.mjs'), '-y', '--no-investigate'], repo);
+    const cfg = existsSync(cfgPath) ? JSON.parse(readFileSync(cfgPath, 'utf8')) : { repeat: 1, metrics: [] };
+    const before = { m: (cfg.mandates || []).length, g: (cfg.metrics || []).length };
+    const names = (l) => new Set((l || []).map((x) => x && x.name));
+    const hasM = names(cfg.mandates), hasG = names(cfg.metrics);
+    cfg.mandates = [...(cfg.mandates || []), ...preset.mandates.filter((m) => !hasM.has(m.name))];
+    cfg.metrics = [...(cfg.metrics || []), ...preset.metrics.filter((m) => !hasG.has(m.name))];
+    cfg.evaluatorPaths = [...new Set([...(cfg.evaluatorPaths || []), ...(preset.evaluatorPaths || [])])];
+    cfg.allowTrailer = false;
+    writeFileSync(cfgPath, JSON.stringify(cfg, null, 2) + '\n');
+    const pack = join(repo, '.promptwheel', 'packs', 'supply-chain');
+    mkdirSync(pack, { recursive: true });
+    cpSync(join(scratch, '.promptwheel', 'packs', 'supply-chain'), pack, { recursive: true });
+    // the gate measures in clean worktrees, so the scanners must reach git. A repo attached earlier, or one that
+    // ignores .promptwheel/ for the outcome record, would hide them and every guard would read unmeasurable.
+    for (const f of [join(repo, '.gitignore'), resolve(repo, execFileSync('git', ['-C', repo, 'rev-parse', '--git-path', 'info/exclude'], { encoding: 'utf8' }).trim())]) {
+      if (!existsSync(f)) continue;
+      const text = readFileSync(f, 'utf8');
+      const next = text.replace(/^\.promptwheel\/?[ \t]*$/gm, '.promptwheel/*\n!.promptwheel/packs/');
+      if (next !== text) writeFileSync(f, next);
+    }
+    const locked = existsSync(join(repo, 'promptwheel.lock.json'));
+    if (!locked) run([join(pack, 'lock.mjs'), 'write', repo], repo);
+    const added = (cfg.mandates.length - before.m) + (cfg.metrics.length - before.g);
+    process.stdout.write(added || !locked ? `sawbuck: signed. ${cfg.metrics.length} guards, ${cfg.mandates.length} protected-path rules, and the shape of this repo in promptwheel.lock.json.\n` : 'sawbuck: already signed, nothing changed.\n');
+  }
+} finally { rmSync(scratch, { recursive: true, force: true }); }
+
+// a suggestion, not a rule: only a person should freeze product code
+let files = [];
+try { files = execFileSync('git', ['-C', repo, 'ls-files'], { encoding: 'utf8', maxBuffer: 256 * 1024 * 1024, stdio: ['ignore', 'pipe', 'ignore'] }).split('\n'); } catch { /* not a repo: attach says so */ }
+const seen = new Set();
+for (const f of files) { const m = f.match(/^(.*?(?:^|\/)(?:auth|authentication|billing|payments?|migrations))\//); if (m && !/(^|\/)(node_modules|test|tests|docs?)\//.test(m[1])) seen.add(m[1]); }
+if (seen.size) process.stdout.write(`\n  To protect product code too, add these to "mandates" in promptwheel.config.json:\n${[...seen].slice(0, 5).map((d) => `    { "name": "${d.replace(/\W+/g, '-')}", "paths": ["${d}/**"], "reason": "changed by a person" }`).join('\n')}\n`);
+if (!dry) process.stdout.write('\n  Commit promptwheel.config.json, promptwheel.lock.json and .promptwheel/packs/. Then /sawbuck-reins:watch or sawbuck attach --claude arms it.\n');

package/contract.mjs

@@ -72,7 +72,7 @@ export function hashOf(repo, file, { store = false } = {}) {
 // `store` keeps each file's content in the object database (see hashOf), which the baseline does.
 export function protectedDirty(repo, { store = false } = {}) {
   let changed = [];
-  try { changed = [...new Set([...gitOut(repo, ['diff', '--name-only', 'HEAD']).split('\n'), ...gitOut(repo, ['ls-files', '--others', '--exclude-standard']).split('\n')].filter(Boolean))]; }
+  try { changed = [...new Set([...gitOut(repo, ['diff', '--name-only', '--no-renames', 'HEAD']).split('\n'), ...gitOut(repo, ['ls-files', '--others', '--exclude-standard']).split('\n')].filter(Boolean))]; }
   catch { return {}; }
   const res = mandatesInForce(repo).flatMap((m) => pathsOf(m).map(globToRe));
   const out = {};
@@ -99,7 +99,7 @@ export function globToRe(glob) {
 // which changed paths violate which mandate: [{ name, reason, files, committed? }]. The rules are the
 // working tree's plus the committed ones (mandatesInForce); pass { ref: null } for the working tree alone.
 export function mandateHits(repo, changedPaths, opts = {}) {
-  const list = opts.ref === null ? resolvedMandates(repo) : mandatesInForce(repo, opts.ref || 'HEAD');
+  const list = opts.list || (opts.ref === null ? resolvedMandates(repo) : mandatesInForce(repo, opts.ref || 'HEAD'));
   const out = [];
   for (const m of list) {
     const res = pathsOf(m).map(globToRe);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "sawbuck",
-  "version": "0.1.34",
-  "description": "Sign your agent to a contract: a deterministic, zero-LLM check re-proves every win from the agent's source edits alone, so a green that came from editing the test, grader, or config is caught and sent back. Works in Claude Code, Codex, git hooks, and CI.",
+  "version": "0.1.36",
+  "description": "Sign your agent to a contract: a deterministic, zero-LLM check re-proves each win from the agent's source edits alone, so a test that went green by editing the test, grader, or config is sent back. For Claude Code, with Codex support in beta.",
   "type": "module",
   "license": "Apache-2.0",
   "engines": {
@@ -34,10 +34,12 @@
   },
   "dependencies": {
     "@promptwheel/logbook": "0.9.10",
-    "promptwheel": "0.7.11"
+    "promptwheel": "0.7.13"
   },
   "files": [
     "sawbuck.mjs",
+    "rewrites.mjs",
+    "contract-cmd.mjs",
     "bins.mjs",
     "contract.mjs",
     "init.mjs",

package/reflect.mjs

@@ -131,7 +131,7 @@ function appendActivity(v, rep, standing = false) {
   const why = k === 'gamed' ? (gm?.gamingReason || 'the win came from editing the goalposts')
     : k === 'regression' ? 'a guarded metric regressed beyond noise'
     : k === 'allowed' ? ('declared intentional: ' + (rep.allowed?.reason || ''))
-    : k === 'verified' ? 'the source earned the green'
+    : k === 'verified' ? 'the check passed'
     : 'could not certify a pass';
   // `standing`: this check re-proved the span of a gamed verdict that is still up, not a new catch
   const ev = { at: new Date().toISOString(), kind: k, sha, file, reason: String(why).slice(0, 160), by: by || null, ...(standing ? { standing: true } : {}) };

package/rewrites.mjs

@@ -0,0 +1,60 @@
+// What a rewrite erased. Logbook reads history, so a squash, a rebase or a force push takes the lesson with
+// it: a reverted attempt stops being there to find. Git keeps those commits in the reflog for a while, so
+// the commits a branch no longer reaches are read from there, kept in .sawbuck/rewritten.jsonl once this repo
+// is attached (the reflog expires, the ledger does not), and surfaced by `context` for the paths in hand.
+// Reads git only, no model, no network. The ledger is local: a clone does not get it. Never writes in a repo
+// sawbuck is not attached to.
+import { execFileSync } from 'node:child_process';
+import { existsSync, readFileSync, appendFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+const MAX = 300;
+const g = (repo, ...a) => { try { return execFileSync('git', ['-C', repo, ...a], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], maxBuffer: 32 * 1024 * 1024 }); } catch { return ''; } };
+
+function ledger(repo) {
+  try { return readFileSync(join(repo, '.sawbuck', 'rewritten.jsonl'), 'utf8').split('\n').filter(Boolean).map((l) => JSON.parse(l)); } catch { return []; }
+}
+
+// commits the reflog remembers and no ref reaches. An amend or a rebase replays the same subject, so a commit
+// whose subject is still reachable was not lost, only rewritten.
+function fromReflog(repo) {
+  const raw = g(repo, 'log', '--reflog', '--not', '--all', '-n', String(MAX), '--format=%x00%H%x09%cI%x09%s', '--name-only', '--no-renames');
+  if (!raw.trim()) return [];
+  const kept = new Set(g(repo, 'log', '--all', '-n', '5000', '--format=%s').split('\n'));
+  const out = [];
+  for (const chunk of raw.split('\0').slice(1)) {
+    const [head, ...rest] = chunk.split('\n');
+    const [sha, at, ...s] = head.split('\t');
+    const subject = s.join('\t');
+    if (!sha || kept.has(subject)) continue;
+    out.push({ sha, at, subject, revert: /^revert\b/i.test(subject), files: rest.filter(Boolean).slice(0, 50) });
+  }
+  return out;
+}
+
+export function erasedCommits(repo) {
+  const known = ledger(repo);
+  const seen = new Set(known.map((e) => e.sha));
+  const fresh = fromReflog(repo).filter((e) => !seen.has(e.sha));
+  if (fresh.length && existsSync(join(repo, '.sawbuck', 'state.json'))) {
+    try { appendFileSync(join(repo, '.sawbuck', 'rewritten.jsonl'), fresh.map((e) => JSON.stringify(e)).join('\n') + '\n'); } catch {}
+  }
+  return [...known, ...fresh];
+}
+
+// the lines `context` adds for the paths in hand: reverts first, then the checks that caught something here
+export function erasedBlock(repo, changed) {
+  const touched = new Set(changed);
+  const hits = erasedCommits(repo).filter((e) => (e.files || []).some((f) => touched.has(f)))
+    .sort((a, b) => (b.revert - a.revert) || String(b.at).localeCompare(String(a.at))).slice(0, 3);
+  let caught = [];
+  try {
+    caught = readFileSync(join(repo, '.sawbuck', 'activity.jsonl'), 'utf8').split('\n').filter(Boolean).map((l) => JSON.parse(l))
+      .filter((e) => e.kind === 'gamed' && touched.has(e.file)).slice(-2).reverse();
+  } catch {}
+  if (!hits.length && !caught.length) return '';
+  const lines = ['not in git history any more (recovered locally, leads):'];
+  for (const e of hits) lines.push(`    - ${e.revert ? 'reverted' : 'erased by a rewrite'}: ${e.subject} (${e.sha.slice(0, 12)}, ${String(e.at).slice(0, 10)})`);
+  for (const e of caught) lines.push(`    - caught as gamed on ${e.file} (${e.sha}, ${String(e.at).slice(0, 10)})`);
+  return lines.join('\n');
+}

package/sawbuck-hook.mjs

@@ -50,7 +50,9 @@ const writeRec = (r) => { try { mkdirSync(stDir, { recursive: true }); writeFile
 const logActivity = (ev) => { try { mkdirSync(stDir, { recursive: true }); appendFileSync(join(stDir, 'activity.jsonl'), JSON.stringify({ at: new Date().toISOString(), ...ev }) + '\n'); } catch {} };
 const hasCommit = (ref) => { try { execFileSync('git', ['-C', repo, 'cat-file', '-e', `${ref}^{commit}`], { stdio: 'ignore' }); return true; } catch { return false; } };
 let rec = readRec();
-if (head && st.lastSha && head !== st.lastSha) {
+// the first turn after attach has no lastSha yet: its baseline is what that turn started from
+const from = st.lastSha || (st.turnBaseline && st.turnBaseline.sha) || '';
+if (head && from && head !== from) {
   let standing = !!(rec && rec.latest && rec.latest.kind === 'gamed' && rec.latest.base && rec.latest.sha !== head.slice(0, 8));
   if (standing && !hasCommit(rec.latest.base)) {
     // the span can no longer be re-proved (a rebase, a squash, a pruned branch took its base away):
@@ -61,7 +63,7 @@ if (head && st.lastSha && head !== st.lastSha) {
     writeRec(rec);
     standing = false;
   }
-  node(join(HERE, 'reflect.mjs'), ['--repo', repo, '--base', standing ? rec.latest.base : st.lastSha, '--head', head, ...(by ? ['--by', by] : []), ...(userMode ? ['--no-auto'] : [])]);
+  node(join(HERE, 'reflect.mjs'), ['--repo', repo, '--base', standing ? rec.latest.base : from, '--head', head, ...(by ? ['--by', by] : []), ...(userMode ? ['--no-auto'] : [])]);
   rec = readRec();
 }
 st.lastSha = head || st.lastSha;
@@ -81,15 +83,17 @@ const saveState = () => { try { mkdirSync(stDir, { recursive: true }); writeFile
 // edit COMMITTED since the baseline's commit counts too: a commit mid-turn does not walk through.
 if (stop && !process.env.SAWBUCK_NO_ENFORCE) {
   const now = new Date().toISOString();
-  const dirty = [...new Set([...git('diff', '--name-only', 'HEAD').split('\n'), ...git('ls-files', '--others', '--exclude-standard').split('\n')].filter(Boolean))];
+  const dirty = [...new Set([...git('diff', '--name-only', '--no-renames', 'HEAD').split('\n'), ...git('ls-files', '--others', '--exclude-standard').split('\n')].filter(Boolean))];
   const base = (st.turnBaseline && typeof st.turnBaseline === 'object') ? st.turnBaseline : null;
   const baseline = (base && base.files && typeof base.files === 'object') ? base.files : {};
-  const committedSince = (base && base.sha && head && base.sha !== head) ? git('diff', '--name-only', base.sha, 'HEAD').split('\n').filter(Boolean) : [];
+  const committedSince = (base && base.sha && head && base.sha !== head) ? git('diff', '--name-only', '--no-renames', base.sha, 'HEAD').split('\n').filter(Boolean) : [];
   const hashNow = {}; for (const f of dirty) if (Object.prototype.hasOwnProperty.call(baseline, f)) hashNow[f] = hashOf(repo, f);
   const untouched = (f) => Object.prototype.hasOwnProperty.call(baseline, f) && hashNow[f] === baseline[f];
   const changed = [...new Set([...dirty.filter((f) => !untouched(f)), ...committedSince])];
   const leftAlone = dirty.filter(untouched);
-  const hits = changed.length ? mandateHits(repo, changed) : [];
+  // the rules in force when the turn began: a rule this turn adds does not apply to it, so signing a contract does
+  // not block itself, and one it deletes or narrows still holds
+  const hits = changed.length ? mandateHits(repo, changed, base && Array.isArray(base.rules) ? { list: base.rules } : {}) : [];
   st.lastStopAt = now;   // the next prompt may take a fresh baseline only because this stop happened
   st.lastStopHead = head || null;   // and where HEAD stood: a commit between turns is the person's, not the agent's
   if (hits.length) {
@@ -197,7 +201,7 @@ function ensureExcluded(r) {
     const f = resolve(r, rel);
     // the record dirs + the logbook's root ledger cache (events.jsonl). Rewrite the block to
     // the CURRENT set rather than bail on presence, so a grown set retrofits existing repos.
-    const WANT = '# >>> sawbuck >>>\n.sawbuck/\n.promptwheel/\nevents.jsonl\nannotations.jsonl\nannotation-reviews.jsonl\ndecision-cards.jsonl\nLOGBOOK.md\nJOURNEY.md\n# <<< sawbuck <<<\n';
+    const WANT = '# >>> sawbuck >>>\n.sawbuck/\n.promptwheel/*\n!.promptwheel/packs/\nevents.jsonl\nannotations.jsonl\nannotation-reviews.jsonl\ndecision-cards.jsonl\nLOGBOOK.md\nJOURNEY.md\n.claude/settings.local.json\n# <<< sawbuck <<<\n';
     const body = existsSync(f) ? readFileSync(f, 'utf8') : '';
     const stripped = body.replace(/# >>> sawbuck >>>[\s\S]*?# <<< sawbuck <<<\n?/g, '');
     const next = (stripped && !stripped.endsWith('\n') ? stripped + '\n' : stripped) + WANT;

package/sawbuck.mjs

@@ -13,6 +13,7 @@
 // proves the repo came back clean; `doctor` checks the attachment still resolves.
 
 import { execFileSync } from 'node:child_process';
+import { erasedBlock } from './rewrites.mjs';
 import { readFileSync, writeFileSync, existsSync, chmodSync, mkdirSync, unlinkSync, rmdirSync, rmSync, readdirSync } from 'node:fs';
 import { join, dirname, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -43,7 +44,7 @@ const BLOCK_RE = new RegExp(`\\n?${S_START}[\\s\\S]*?${S_END}\\n?`, 'g');
 // plus the logbook's root working-set (ledger cache, digests, annotation planes). It is
 // memory, not the user's source, a user who wants LOGBOOK.md committed still can explicitly
 // (exclude only affects UNtracked files).
-const RECORD_DIRS = ['.sawbuck/', '.promptwheel/', 'events.jsonl', 'annotations.jsonl', 'annotation-reviews.jsonl', 'decision-cards.jsonl', 'LOGBOOK.md', 'JOURNEY.md'];
+const RECORD_DIRS = ['.sawbuck/', '.promptwheel/*', '!.promptwheel/packs/', 'events.jsonl', 'annotations.jsonl', 'annotation-reviews.jsonl', 'decision-cards.jsonl', 'LOGBOOK.md', 'JOURNEY.md'];
 
 const argv = process.argv.slice(2);
 const cmd = argv[0];
@@ -90,6 +91,7 @@ Usage:
   sawbuck trace [repo]      Show every file Sawbuck has placed in this repo (the footprint)
   sawbuck doctor [repo]     Check the attachment still resolves to a live sawbuck; --all for every repo
   sawbuck where             List every repo Sawbuck is attached to
+  sawbuck contract          Sign this repo: tests, tripwires, protected paths, and the architecture lock (--dry-run to preview)
   sawbuck statusline        One-line segment for your status line (🐴 watching | N caught | steer %)
 
   sawbuck recall [repo]     Related notes for your changes from extra memory providers
@@ -116,6 +118,13 @@ if (cmd === '--version' || cmd === '-v') { console.log(version); process.exit(0)
 if (!cmd || cmd === '--help' || cmd === '-h' || cmd === 'help') { out(help); process.exit(0); }
 
 switch (cmd) {
+  case 'contract': {
+    const top = gitTop(repoArg());
+    if (!top) usage(`${repoArg()} is not a git repository (a contract signs one; run it inside your project)`);
+    try { execFileSync(process.execPath, [join(HERE, 'contract-cmd.mjs'), top, ...rest.filter((a) => a === '--dry-run')], { stdio: 'inherit' }); }
+    catch (e) { process.exit(e.status || 1); }
+    break;
+  }
   case 'init': {
     try { execFileSync(process.execPath, [join(HERE, 'init.mjs'), ...rest], { stdio: 'inherit' }); }
     catch (e) { process.exit(e.status || 1); }
@@ -162,11 +171,14 @@ switch (cmd) {
     if (json) { out(JSON.stringify(rep)); process.exit(code); }
     const m = (rep.metrics || [])[0];
     for (const md of rep.mandates || []) out(`🐴 ⛔ mandate "${md.name}" violated${md.reason ? ': ' + md.reason : ''}  (touched: ${(md.files || []).join(', ')})${md.removed ? '  [deleted in this same change; a mandate stays in force for the change that removes it]' : ''}`);
-    if (rep.verdict === 'pass') out(`🐴 ✓ verified: your ${where} change earned it. ${m ? '"' + m.name + '"' : 'The metric'} held, and the source carried the win (it survives a source-only re-run).`);
+    const win = (rep.metrics || []).find((x) => x.status === 'improved' && !x.tripwire);
+    if (rep.verdict === 'pass' && win) out(`🐴 ✓ verified: your ${where} change earned it. "${win.name}" improved, and the source carried the win (it survives a source-only re-run).`);
+    else if (rep.verdict === 'pass') out(`🐴 ✓ held: nothing got worse in your ${where} change, and there was no win to re-prove.`);
     else if (rep.verdict === 'gamed') out('🐴 🚩 gamed: a win here came from editing the test, config, or grader, not the source. It does NOT survive a source-only re-run, so it does not count.');
     else if (rep.verdict === 'fail' && (rep.mandates || []).length) out('🐴 ✗ sent back: a hard rule in the contract was broken, however green the rest is.');
     else if (rep.verdict === 'fail') out(`🐴 ✗ regression: a guarded metric got worse (${(rep.metrics || []).filter((x) => x.guard && !x.ok).map((x) => x.name).join(', ') || 'a guard'}).`);
     else out('🐴 ≈ inconclusive: the check ran but could not measure your metric (it did not run in isolation). Point it at your real test command: `sawbuck init`, or set setup/linkDirs in promptwheel.config.json.');
+    if ((rep.metrics || []).some((x) => x.heldByTestEdit)) out('🐴 ⚠ your tests changed too, and the old tests fail on this source. Fine for an intended change. Otherwise check the tests were not weakened: a green that stays green is not proved.');
     if (rep.gate && rep.gate.changed) out(`🐴 ⚠ the gate definition changed in this change (fingerprint ${rep.gate.fingerprint.base} -> ${rep.gate.fingerprint.head}): a metric, guard, evaluatorPath or mandate was added, removed or edited.`);
     process.exit(code);
   }
@@ -235,7 +247,7 @@ switch (cmd) {
         const stDir = join(repo, '.sawbuck'); const stPath = join(stDir, 'state.json');
         let st = {}; try { st = JSON.parse(readFileSync(stPath, 'utf8')); } catch {}
         const now = new Date().toISOString();
-        if (mandatesInForce(repo).length) {
+        {   // a baseline even with no rules yet: a turn that signs a contract is judged by the contract it began with
           const prev = st.turnBaseline && typeof st.turnBaseline === 'object' ? st.turnBaseline : null;
           const stoppedSince = st.lastStopAt && st.lastPromptAt && Date.parse(st.lastStopAt) >= Date.parse(st.lastPromptAt);
           const unfinished = !!prev && !!st.lastPromptAt && !stoppedSince;
@@ -256,7 +268,7 @@ switch (cmd) {
             const stillInHead = moved && Object.entries(flagged).some(([f, h]) => { const b = blobAt(repo, sha, f); return h === 'deleted' ? b === '' : (!!h && b === h); });
             const pin = !!(st.lastViolation && st.lastViolation.sha);
             if (moved && !stillInHead && st.lastViolation) delete st.lastViolation.sha;
-            st.turnBaseline = { at: now, sha: ((!moved || stillInHead) && pin && st.lastViolation.sha) || sha, files, lock: lockState(repo) };
+            st.turnBaseline = { at: now, sha: ((!moved || stillInHead) && pin && st.lastViolation.sha) || sha, files, lock: lockState(repo), rules: mandatesInForce(repo) };
           }
         }
         st.lastPromptAt = now;   // every prompt, mandates or not: the walls key their block budgets on it when the harness sends no prompt_id
@@ -375,14 +387,17 @@ switch (cmd) {
 // "nothing notable" every turn would be noise). `speak` forces a reply for the explicit command.
 function contextBlock(repo, speak) {
   const g = (...a) => { try { return execFileSync('git', ['-C', repo, ...a], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim(); } catch { return ''; } };
-  let changed = g('diff', '--name-only', 'HEAD').split('\n').filter(Boolean);
+  // new files count: re-creating what was reverted is the case the history is for
+  let changed = [...new Set([...g('diff', '--name-only', 'HEAD').split('\n'), ...g('ls-files', '--others', '--exclude-standard').split('\n')])].filter(Boolean);
   if (!changed.length) changed = g('diff', '--name-only', 'HEAD~1', 'HEAD').split('\n').filter(Boolean);
   if (!changed.length) return speak ? '🐴 sawbuck: nothing changed to look up (no working edits, and no previous commit to read).' : '';
   const fileArgs = changed.flatMap((f) => ['--file', f]);
   let o = '';
   try { o = execFileSync(process.execPath, [join(HERE, 'rank.mjs'), '--repo', repo, ...fileArgs, '--top', '3'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }); }
   catch (e) { o = (e.stdout || '').toString(); }
-  if (/relevant history/.test(o)) return o.trimEnd();
+  const erased = erasedBlock(repo, changed);
+  if (/relevant history/.test(o)) return [o.trimEnd(), erased].filter(Boolean).join('\n');
+  if (erased) return erased;
   return speak ? '🐴 sawbuck: no notable history for the files you are touching (a clean trail).' : '';
 }
 
@@ -627,6 +642,8 @@ function purgeRecord(repo) {
     const p = join(repo, d);
     try { if (existsSync(p)) { rmSync(p, { recursive: true, force: true }); n++; out(`sawbuck: purged ${p}`); } } catch {}
   }
+  const outcomes = join(repo, '.promptwheel', 'outcomes.jsonl');   // the rest of .promptwheel/ is the signed contract: yours to keep or delete
+  try { if (existsSync(outcomes)) { rmSync(outcomes, { force: true }); n++; out(`sawbuck: purged ${outcomes}`); } } catch {}
   if (!n) out('sawbuck: no record to purge');
 }
 // is `sawbuck` resolvable on PATH? (SAWBUCK_NO_PATH_CHECK forces the strict/offline answer)