simt-dev 0.6.2 → 0.7.0

package/docs/decisions/ADR-113-a-pre-push-that-carries-only-documentation-skips-the-test-gate-and-says-so.md

@@ -0,0 +1,87 @@
+---
+simt-affects: ["src/hooks/dispatcher.mjs", "src/commands/hooks.mjs", "simt.json", "test/hooks.test.mjs"]
+simt-supersedes: []
+---
+
+# ADR-113 — a pre-push that carries only documentation skips the test gate, and says so
+
+Status: **accepted** · 2026-10-31
+
+## Context
+
+The shared dispatcher runs a repository's declared pre-push gates on every push.
+For this repository that is the full test suite — fifteen hundred tests, minutes
+of wall clock — and the push it guards is frequently the one shape of push the
+suite adds nothing to: a release commit (version, changelog, manifest pin), a
+tag, a documentation edit. The suite runs there for the same reason it runs
+anywhere, which is the correct reason in general and a tax in this case.
+
+The dispatcher's standing commitments shape what the fix may be. It fails
+closed, never fail open: a gate that cannot run is a failure, not a skip. It
+never weakens a control to make a hook pass, and a control is downgraded only
+from the manifest, where a reviewer sees it. And it reports what did not run,
+so "passed" can never be mistaken for "only some of it passed". A skip that is
+invisible is a weakened control the reader did not approve; a skip that is
+guessed at is a fail-open.
+
+git answers both problems: it feeds the pre-push hook a ref list on stdin —
+one line per ref being pushed, with the local and remote shas — so the push
+can be diffed against exactly what the remote already has, and the manifest is
+already the declared home of gate configuration.
+
+## Ruling
+
+1. **The `test` gate is the only gate a push can skip, and only on evidence.**
+   Before running its gates, the dispatcher classifies the push from the ref
+   list git fed on stdin. The `test` gate is skipped when, and only when, every
+   ref being pushed is one of: a branch whose diff against the remote is at
+   most a declared number of commits and touches only declared paths; a tag
+   whose commit is confirmed already delivered; or a deletion. Every other gate
+   runs unconditionally: they are cheap and repo-specific, and a skip the
+   classifier does not own is a skip it did not earn.
+2. **The skip is opt-in per repository, and absence runs the suite.** The
+   classification is declared in the manifest as `gates.prePushSkipTest` with
+   `maxCommits` and `paths`. A repository without the key runs the full suite
+   on every push; a key with missing or mis-shaped fields does the same. The
+   control is downgraded from the manifest where a reviewer sees it, and a
+   downgrade the manifest cannot state precisely is one it did not make.
+3. **Every uncertainty fails closed to the full suite, and a skip is reported.**
+   An unreadable ref list, a new branch (no remote sha to diff against), a tag
+   whose commit cannot be confirmed already delivered, a commit count above the
+   ceiling, a file outside the declared paths, or a git error each run the suite.
+   When the skip does fire, the report prints the gate as `SKIPPED` with the
+   reason — the commit count, file count, and tag count that earned it — so the
+   reader sees the suite was not run and why.
+
+## Consequences
+
+- A push of one or two documentation or release commits no longer pays for the
+  full suite in this repository, whose manifest declares a ceiling of two
+  commits over markdown, `docs/`, `package.json` and `simt.json` — the shape
+  of a release commit.
+- The file list is a tree diff over `remote..local`, so a force push is judged
+  on the trees it replaces, not on the commits it adds.
+- A release tag rides along in the skip. In the release flow a tag names commits
+  already delivered (and tested) by a branch push, so the classifier accepts it
+  only when the commit it points to is reachable from a remote-tracking ref, or
+  is among the commits the same push is delivering on a branch. A tag on a
+  commit no pushed ref contains runs the suite: the gate does not assume a tag
+  is harmless, it verifies the commit behind it.
+- The classification reads the repository's git state, so it runs on the real
+  root; the disposable worktree at HEAD is for the gates, and a push that
+  earns the skip does not need one.
+- Nothing in this ruling widens to other events. Pre-commit has no ref list to
+  classify and keeps running its gates on every commit.
+
+## Rejected
+
+- **Skip by file extension in the hook, with no manifest declaration.** The
+  hook would then own a policy no reviewer can read in a diff, which is the
+  exact failure the manifest requirement exists to prevent — and a reader of
+  another repository could not tell whether its suite had run.
+- **Skip when the push is small, whatever it touches.** A two-line change to a
+  gate definition is a code change the suite exists to catch, and a size
+  threshold without a path rule cannot tell it from a two-line doc edit.
+- **Make the skip silent.** The dispatcher's report is its contract: a gate
+  that did not run is named with its disposition and its reason, or the reader
+  cannot distinguish "passed" from "never ran".

package/docs/decisions/ADR-114-the-bench-pairs-at-the-task-level-a-missing-cost-is-not-zero-and-an-unasked-cross-group-compare-is-refused.md

@@ -0,0 +1,74 @@
+---
+simt-affects: ["src/bench/report.mjs", "src/bench/run.mjs", "src/bench/ablate.mjs", "src/bench/variants.mjs", "src/advice/advice.mjs", "src/commands/bench.mjs", "test/bench.test.mjs"]
+simt-supersedes: []
+---
+
+# ADR-114 — the bench pairs at the task level, a missing cost is not zero, and an unasked cross-group compare is refused
+
+Status: **accepted** · 2026-10-31
+
+## Context
+
+Review 0003 (Q46) verified three failures in the bench statistics and read a fourth
+in the code:
+
+- One task with ten reps produced `pairedRuns 10, mcnemar p 0.00195` — the run-level
+  pairing treated reps of a task as independent tasks, inflating significance by an
+  order of magnitude.
+- A claude run with usage but no prices table reported `C $0.0000 | CPI $0.0000` — a
+  missing cost read as a zero cost, the cheapest outcome measurable.
+- `gold` and `noop` harness runs of the same arm name pooled into one 50 % row — the
+  harness that produced each run was invisible.
+- Ablation tested ~N sections at α 0.05 each with no multiplicity correction, and the
+  bootstrap CPI confidence intervals silently dropped the resamples whose cost was
+  undefined.
+
+Plan 0004 §1 fixes the shape of the answer: repeats of a task are not independent
+tasks; the cost per verified outcome is undefined when none resolve, never zero; and
+non-inferiority is judged by a one-sided 95 % lower bound of ΔR above −2 percentage
+points, with inconclusive evidence reported when the interval is too wide to decide.
+
+## Ruling
+
+1. **Pairing is at the task level only.** `compareArms` collapses each arm to
+   task means and pairs on shared tasks. The exact two-sided sign test on task-mean R
+   replaces McNemar (the sign of a task-mean difference does not assume the 0/1
+   contingency McNemar requires); the Wilcoxon signed-rank test runs on task-mean C.
+   `pairedRuns` survives as a descriptive count (Σ min reps) and is never used in a
+   statistic.
+2. **An unknown cost is null, never zero.** `computeRunCost` returns `{ usd, source }`
+   with `source` ∈ `priced | reported | missing`; `usd` is null when no prices table
+   applies and the harness reported no cost. A task's C is null if any rep's cost is
+   missing, an arm's C likewise, and the arm's C confidence interval is null rather
+   than narrowed to the resamples that happened to price out. `CPI` is total cost
+   divided by resolved outcomes and is null when the cost is incomplete or nothing
+   resolved — never zero, never a favourable finite score.
+3. **A report row is a (harness, model, arm, experiment) group.** Pooling across
+   harnesses is gone. A `--compare` whose arm name matches more than one group is
+   refused as ambiguous, and a compare that crosses harness, model or experiment is
+   refused unless the caller passes `crossGroup` (CLI `--cross-group`).
+4. **Multiplicity is controlled with Holm step-down.** The family is the set of
+   comparisons tested in one run — the ablation sections, and per slot the
+   variant-versus-baseline comparisons — and the adjusted p-values feed the canary
+   escalation decision.
+5. **The verdict is a non-inferiority verdict.** With `n < 5` paired tasks the
+   verdict is `insufficient-tasks` — the smallest two-sided sign-test p-value at
+   n = 4 is 0.125, so fewer tasks cannot reject at α = 0.05 and the sample is said
+   to be too small, not that the p-value was high. Otherwise: `non-inferior` when
+   the one-sided 95 % lower bound of ΔR is above −2 pp, `inferior` when the two-sided
+   bound is entirely below 0, `inconclusive` when the interval is too wide to decide.
+6. **v1 records keep reading.** A numeric `costUsd` is a reported cost; a null one is
+   missing. No migration, no new schema version.
+
+## Consequences
+
+- `mcnemarTest` stays exported and is exercised by its unit test; `compareArms` no
+  longer returns an `mcnemar` key, so its only live caller inside the tool is the
+  sign test.
+- `simt bench report` markdown gains Harness and Model columns, a `Sign` row, and
+  non-inferiority and verdict lines; the `--cross-group` flag exists only to override
+  refusal.
+- `simt bench ablate` and `simt bench variants` escalate on Holm-adjusted p-values,
+  and a section entry carries `rTest` instead of `mcnemar`.
+- Advice skips un-costed runs when grounding a cost floor, and variant ranking treats
+  an unknown cost as worst — it cannot be ranked cheaper than anything.

package/docs/decisions/ADR-115-the-index-stamps-its-schema-version-migrates-older-databases-in-place-and-serves-newer-ones-from-a-sidecar.md

@@ -0,0 +1,69 @@
+---
+simt-affects: ["src/index/persist.mjs", "src/index/store.mjs", "src/commands/map.mjs", "test/index.test.mjs", "test/map.test.mjs"]
+simt-supersedes: []
+---
+
+# ADR-115 — the index stamps its schema version, migrates older databases in place, serves newer ones from a sidecar, and names a corrupt index
+
+Status: **accepted** · 2026-10-31 · filed as review 0003 Q44
+
+## Context
+
+Review 0003 (Q44) verified three failures in the local index's persistence:
+
+- The database carried no schema version a reader trusted. A newer simt
+  silently rewrote a database an older simt had written, and two pinned
+  versions rewrote one file past each other — the ADR-059 flip-flop.
+- The FTS tables, whose tokenizer lives in their definition, were
+  recreated by a per-write wipe (`ensureFtsSchema`) whenever the stored DDL
+  drifted: a migration that ran on every build, unnamed and unobservable.
+- Every read failure answered `[]`. "Locked", "no such column" and "corrupt"
+  all looked like a cold index, so a damaged database read back as an empty
+  one and the command quoted the emptiness as the repository's shape.
+
+Plan 0004 §1 fixes the shape of the answer: the index declares the version it
+was written at; a version change is a named, ordered migration; a file this
+version does not own is not opened for write; and a read failure is named, not
+silenced.
+
+## Ruling
+
+1. **The version is stamped on every write.** `PRAGMA user_version` carries
+   the schema version in the sqlite database; the meta `schema` row is kept
+   as the fallback for databases written before the stamp existed, and as the
+   version carrier in the jsonl backend, whose lines carry no pragma.
+2. **Migrations are an ordered list, and the 3 → 4 step is the FTS
+   recreation.** Each step is idempotent and runs in list order; a database
+   older than the current version is opened in place and upgraded on the next
+   write. A database at a version past the last step is not opened for write
+   at all — opening it would demote the stamp.
+3. **A file a newer version owns stays with its owner.** This version reads
+   and writes a sidecar named after itself, `index.v<SCHEMA_V>.sqlite` (and
+   `.jsonl`); the canonical file is untouched. A sidecar that has not been
+   built yet is cold, not broken. `indexFileFor` is the single owner of the
+   sidecar name, shared by readers and writers.
+4. **A read returns `{ rows, error }`, and a failure is named.** `INDEX_BUSY`
+   is a retryable write contention; `INDEX_CORRUPT` is a file that cannot be
+   read as a database. The store's read wrappers attach the error to the row
+   array, so callers that iterate are untouched and callers that report can
+   tell a broken index from an empty one. `loadGraph` answers `broken`
+   alongside `cold` and `stale`: `cold` is "nothing here", `broken` is
+   "something is here and the read failed".
+5. **A corrupt canonical file is rebuilt in place by the next build.** The
+   index is a cache of git blobs (ADR-089): a damaged file is named on read
+   and replaced on write, and the rebuildability that makes the file
+   disposable is what makes in-place replacement safe.
+
+## Consequences
+
+- `ensureFtsSchema` and its per-write wipe are gone; the FTS tables converge
+  through the named migration, which runs once per upgrade, not per build.
+- `migrateDb` stays module-private: it is called by the writer, and the
+  dead-code gate reads an export as a promise to a caller this package does
+  not have.
+- `reindex`'s `force = version !== SCHEMA_V` remains sound: an older database
+  is fully rewritten and then migrated in place; a newer one is left alone
+  and the build goes to the sidecar.
+- `simt repoindex`, `simt init` and `simt map` output paths are unchanged;
+  `SQLITE_FILE` and `JSONL_FILE` keep their names, and the sidecar is the
+  only new file this ruling introduces.

package/docs/decisions/ADR-116-rust-support-reaches-the-example-path-the-indent-and-the-bench-runner.md

@@ -0,0 +1,100 @@
+---
+simt-affects: ["rules/mdc/test-gate.mdc", "src/projection/baselines.mjs", "src/bench/mine.mjs", "src/compare/learn.mjs", "test/bench.test.mjs", "test/mdc.test.mjs", "test/baselines.test.mjs", "test/compare.test.mjs"]
+simt-supersedes: []
+---
+
+# ADR-116 — Rust support reaches the example path, the indent and the bench runner
+
+Status: **accepted** · 2026-10-31
+
+## Context
+
+ADR-062 made Rust a first-class adoption: `has-cargo-toml` selects the `rust` profile,
+`simt init` seeds `cargo fmt --check`, `cargo clippy -- -D warnings` and `cargo test`
+when `cargo` is on PATH, and dependabot watches `Cargo.toml`. Much of the rest of the
+tool already knew the ecosystem — the index extracts Rust `use` edges and records `.rs`
+files, `simt secrets` reads `Cargo.lock`, the monorepo reader reads `[workspace] members`
+from `Cargo.toml`, and the card resolves `cargo build` and a focused `cargo test {name}`.
+
+Three places a Rust repository reads or runs did not know it:
+
+- `rules/mdc/test-gate.mdc` substitutes one example test path, and only Go had a
+  per-signal default. A Rust repository was handed `path/to/the.changed.test.ts` — an
+  instruction that names a file its test gate can never run.
+- The shared `.editorconfig` assigns four spaces to Python, Java and Kotlin, and left
+  `.rs` at the default two. Rust's own formatter writes four, so the shared baseline
+  contradicted `cargo fmt` in every Rust repository that adopted it.
+- `detectTestRunner` knew package.json, vitest, Go, Python, Gradle and Maven. A Cargo
+  repository fell through to no runner, so `simt bench mine` could not grade a Rust
+  patch and `simt gate` could not select its tests.
+
+The gate classifier had the same blind spot in its heuristic fallback: a declared
+`cargo test` was classified through the declared command, but a command read from a
+repository that had not declared it was not recognised as a test gate.
+
+## Ruling
+
+1. **A Rust repository is shown a Rust test path.** `exampleTestPath` gains
+   `default-has-cargo-toml: tests/the_changed.rs`. Rust's test paths are Cargo
+   integration tests in `tests/`; inline `#[cfg(test)]` modules live in the source file
+   and have no separate path to name. The signal is the detection fact, not a new stack
+   tag, so ADR-013 and ADR-062 still hold.
+2. **`.rs` is four spaces in the shared editorconfig.** It joins the
+   `[*.{py,pyi,java,kt,kts,rs}]` section with `indent_size = 4`, matching rustfmt.
+3. **The bench runs Cargo the way Cargo can be run.** A `tests/<stem>.rs` file is a
+   test target, so a patch touching only integration tests selects one `--test <stem>`
+   per file (`cargo test --test api`). A patch touching a source file means inline unit
+   tests, which have no file argument, so the crate's whole test binary runs
+   (`cargo test`). No changed files also runs the crate. The prompt command, the
+   executed command and the parser come from the same branch, so a preview cannot name
+   a narrower command than the one that ran.
+4. **Cargo's text output is parsed by its result lines.** `parseCargoTestOutput` accepts
+   only lines of the form `test <name> ... ok|FAILED|ignored`. `ignored` is neither a
+   pass nor a failure. `test result:` summaries and compile output are not tests. The
+   parser is shared by `simt bench mine`, `simt bench grade` and `simt gate`, which all
+   go through `detectTestRunner`.
+5. **`cargo test` is classified as a test gate.** The fallback in
+   `classifyGateCommand` recognises it alongside `npm test`, `node --test`, `pytest` and
+   `go test`, with ADR-003's focused-default ruling.
+
+This record does not supersede ADR-062 (what a fresh Rust adoption seeds) or ADR-092
+(which test edges count). It closes the three reader-facing gaps those records left
+open.
+
+## Consequences
+
+- A Rust repository's projected `test-gate` names `tests/the_changed.rs`; no TypeScript
+  or Go example path leaks into it. The signal is `has-cargo-toml`, so a mixed
+  repository with both `package.json` and `Cargo.toml` is shown the Rust example.
+- Every repository that adopts `.editorconfig` now writes `.rs` at four spaces. A
+  repository that deliberately wants another indent still overrides it below the
+  region, which is what last-match-wins is for.
+- `simt gate <path>` on a Rust repository selects `cargo test --test <target>` for an
+  integration test and `cargo test` for a source file. The bench can mine and grade
+  Rust tasks with the same evidence discipline as the other ecosystems.
+- The parser has no JSON dependency: `cargo test --format json` is nightly-only, and
+  this package has zero runtime dependencies and must not require a nightly toolchain
+  to read a test result.
+- Acceptance: the Rust render of `test-gate` names only `tests/the_changed.rs`; the
+  editorconfig section for `.rs` states four spaces; a Cargo runner is detected for
+  both `tests/*.rs` and `src/*.rs`; libtest output yields passed and failed names and
+  drops ignored tests.
+
+## Rejected
+
+- **A `rust` stack tag.** Rust is detected by `has-cargo-toml`; adding a tag would give
+  one ecosystem two identities and break the fact/tag separation ADR-013 relies on.
+- **Seeding `typecheck: cargo check`.** ADR-062 rules the seeded Rust gates to format,
+  lint and test. Adding a gate changes what a fresh adoption declares, and that is a
+  separate decision with its own acceptance tests, not a silent part of this one.
+- **A conventional `tests/foo.rs` → `src/foo.rs` edge.** A Cargo integration test is a
+  separate crate and need not mirror a source file. ADR-092 permits a conventional edge
+  only when the convention is real; guessing one would manufacture test coverage that
+  does not exist.
+- **A Rust toolchain pin check.** The Rust profile requires a pin only where the
+  repository commits one. `src/toolchain.mjs` is deliberately Node-specific; extending
+  it to read `rust-toolchain.toml` or `rust-version` is a new belief and needs its own
+  record.
+- **Adding `.rs` to `FORMATTABLE`.** That set is the staged-file list for Prettier.
+  Rust formatting is a declared command gate (`cargo fmt --check`), and handing `.rs`
+  to Prettier would format it with the wrong tool.

package/docs/decisions/README.md

@@ -68,6 +68,59 @@ record's status line — never by editing the ruling in place.
 | [058](ADR-058-one-tool-three-channels-and-the-order-is-forced.md) | One tool, three channels, and the order is forced | accepted |
 | [059](ADR-059-the-version-a-repository-runs-is-the-one-it-pinned.md) | The version a repository runs is the one it pinned, and the gate refuses otherwise | accepted |
 | [060](ADR-060-a-repository-with-nothing-to-run-is-adopted-and-says-so.md) | A repository with nothing to run is adopted and says so; a gate is verified where it runs | accepted |
+| [061](ADR-061-the-skill-registry-is-workspace-data.md) | The skill registry is workspace data, and the package ships none of it | **accepted** · 2026-10-12 · filed as S61 |
+| [062](ADR-062-a-fresh-adoption-seeds-the-gates-it-can-run.md) | A fresh adoption seeds the canonical gates it can run, and never more | **accepted** · 2026-10-13 · filed as S40 |
+| [063](ADR-063-the-adoption-escape-hatch-is-opt-in.md) | The adoption escape hatch is opt-in, and the default writes in place | **accepted** · 2026-10-13 · filed after a consumer asked why every adoption branched |
+| [064](ADR-064-the-context-meter-counts-what-the-tool-wrote.md) | The context meter counts what the tool wrote, and says what it did not | **accepted** · 2026-10-13 · filed after review 0002 S38 |
+| [065](ADR-065-a-pack-is-one-shared-rule-set-pinned-by-digest.md) | A pack is one shared rule set, vendored into the repository and pinned by digest | **accepted** · 2026-10-13 · filed as S39 |
+| [066](ADR-066-a-monorepo-projects-once-per-package.md) | A monorepo projects once per package | **accepted** · 2026-10-13 · filed as S41 |
+| [067](ADR-067-which-harnesses-read-agents-md-is-a-column.md) | Which harnesses read AGENTS.md is a column, and a row without a document gets none | **accepted** · 2026-10-13 · filed as S42 |
+| [068](ADR-068-the-mcp-revision-list-cites-what-was-read.md) | The revision list is a claim about revisions that were read | **accepted** · 2026-10-13 · filed as S43 |
+| [069](ADR-069-the-conformance-lint-checks-the-published-specification.md) | The conformance lint checks the published specification | **accepted** · 2026-10-13 · filed as S44 |
+| [070](ADR-070-the-json-payload-carries-its-own-version.md) | The JSON payload carries its own version | **accepted** · 2026-10-13 · filed as S51 |
+| [071](ADR-071-a-rule-that-can-be-narrowed-is-written-narrow.md) | A rule that can be narrowed is written narrow | **accepted** · 2026-10-14 · filed as S50 |
+| [072](ADR-072-the-budget-is-a-declaration-beside-the-gates.md) | The budget is a declaration beside the gates, not a number inside the projection | **accepted** · 2026-10-14 · filed as S38 |
+| [073](ADR-073-a-kernel-is-a-smaller-projection-the-repository-asks-for.md) | A kernel is a smaller projection the repository asks for, not one it is given | **accepted** · 2026-10-14 · filed as S38 (R07) · ruling 6 narrowed by ADR-084 |
+| [074](ADR-074-a-rule-and-a-decision-are-readable-by-uri.md) | A rule and a decision are addressable, so they are readable by URI | **accepted** · 2026-10-14 · filed as S43 |
+| [075](ADR-075-nothing-leaves-the-machine.md) | Nothing leaves the machine: no telemetry, local transcripts, loopback models by default | **accepted** · 2026-10-14 · filed as D7 (R06) |
+| [076](ADR-076-a-change-to-what-agents-read-is-measured.md) | A change to what agents read is measured before it ships, or labelled unmeasured in its record | **accepted** · 2026-10-15 · filed as D1 (R01) |
+| [077](ADR-077-the-command-card-leads-the-region-and-reads-committed-evidence.md) | The command card leads the region, and is derived from committed evidence only | **accepted** · 2026-10-16 · filed as R10 (plan 0003) · ruling 1 narrowed by ADR-086 |
+| [078](ADR-078-a-line-the-repository-already-proves-does-not-ship.md) | A line the repository already proves does not ship, and the author says so | **accepted** · 2026-10-16 · filed as R09 (plan 0003) |
+| [079](ADR-079-the-rules-are-enforced-at-the-tool-call-from-one-policy-table.md) | The rules are enforced at the tool call, from one policy table every harness renders | **accepted** · 2026-10-16 · filed as R15 (plan 0003) |
+| [080](ADR-080-the-tools-own-names-are-not-repositories-and-neither-reader-decides-by-shape.md) | The tool's own names are not repositories, and neither reader decides by shape | **accepted** · 2026-10-16 · settles what `rules why` calls a repository |
+| [081](ADR-081-a-tracker-is-read-through-the-repositorys-template.md) | A tracker is read through the repository's template | **accepted** · 2026-10-16 · rulings 1 and 2 superseded by ADR-082 |
+| [082](ADR-082-the-tracker-override-is-a-manifest-key.md) | The tracker override is a manifest key, and init keeps what it did not write | **accepted** · 2026-10-16 · supersedes ADR-081 rulings 1 and 2 |
+| [083](ADR-083-a-budget-is-met-by-cutting-the-kernel-and-hard-is-the-floor.md) | A budget is met by cutting the kernel, and the hard constraints are the floor | **accepted** · 2026-10-17 · filed as R08 (plan 0003) · ruling 7 narrowed by ADR-084 |
+| [084](ADR-084-a-workspace-carries-its-repeated-rules-once.md) | A workspace carries its repeated rules once, and the region does not read the reader's home | **accepted** · 2026-10-17 · filed as R11 (plan 0003) |
+| [085](ADR-085-the-region-ends-with-the-names-it-kept-out.md) | The region ends with the names of what it kept out | **accepted** · 2026-10-18 · filed as R12 (plan 0003) |
+| [086](ADR-086-the-stable-prefix-comes-first-and-the-lock-records-both-digests.md) | The stable prefix comes first, and the lock records both digests | **accepted** · 2026-10-18 · filed as R13 (plan 0003) |
+| [087](ADR-087-a-run-is-evidence-for-one-tree.md) | A run is evidence for one tree | **accepted** · 2026-10-18 · filed as R17 (plan 0003) |
+| [088](ADR-088-a-marked-line-is-enforced-by-a-checker.md) | A marked line is enforced by a checker | **accepted** · 2026-10-18 · filed as R19 (plan 0003) · ruling 3 narrowed by ADR-090 |
+| [089](ADR-089-the-local-index-is-a-cache-of-git-blobs.md) | The local index is a cache of git blobs | **accepted** · 2026-10-18 · filed as R20 (plan 0003) |
+| [090](ADR-090-an-optional-adapter-is-off-until-named.md) | An optional adapter is off until a repository names it | **accepted** · 2026-10-18 · filed as R21 (plan 0003) |
+| [091](ADR-091-the-map-ranks-files-a-task-mentions.md) | The map ranks the files a task mentions, and the files next to them | **accepted** · 2026-10-18 · filed as R22 (plan 0003) |
+| [092](ADR-092-tests-are-imports-conventions-and-coverage.md) | A test is an import, a conventional neighbour, or a coverage record | **accepted** · 2026-10-18 · filed as R24 (plan 0003) |
+| [093](ADR-093-why-names-what-governs-a-file.md) | why names what governs a file | **accepted** · 2026-10-18 · filed as R25 (plan 0003) |
+| [094](ADR-094-a-change-runs-the-tests-that-import-it.md) | a change runs the tests that import it | **accepted** · 2026-10-18 · filed as R16 (plan 0003) |
+| [095](ADR-095-gate-output-keeps-the-failures.md) | gate output keeps the failures | **accepted** · 2026-10-18 · filed as R18 (plan 0003) |
+| [096](ADR-096-impact-names-who-a-change-reaches.md) | impact names who a change reaches | **accepted** · 2026-10-18 · filed as R23 (plan 0003) |
+| [097](ADR-097-the-channels-publish-by-hand-and-the-version-rides-in-as-an-input.md) | the channels publish by hand, and the version rides in as an input | **accepted** · 2026-10-25 · ruling 3's Homebrew precondition is superseded by [ADR-098](ADR-098-the-fourth-channel-is-one-file-and-it-needs-no-toolchain.md), which also restates what each channel now waits on |
+| [098](ADR-098-the-fourth-channel-is-one-file-and-it-needs-no-toolchain.md) | The fourth channel is one file, and it needs no toolchain | **accepted** · 2026-10-26 · supersedes ADR-058 ruling 5 · narrows ADR-058 ruling 7 and ADR-097 ruling 3 · supersedes ADR-059 ruling 3 · ruling 3's cross-host byte-identicality narrowed by [ADR-099](ADR-099-the-release-verifies-served-bytes-and-the-formula-mirrors-them.md) |
+| [099](ADR-099-the-release-verifies-served-bytes-and-the-formula-mirrors-them.md) | the release verifies served bytes, and the formula mirrors them | **accepted** · 2026-10-27 · narrows ADR-098 ruling 3 |
+| [100](ADR-100-a-staged-diff-is-the-last-gate-before-history-and-it-runs-inside-the-tool.md) | a staged diff is the last gate before history, and it runs inside the tool | **accepted** · 2026-10-27 |
+| [101](ADR-101-a-file-lease-belongs-to-one-session-and-the-pre-edit-hook-refuses-another.md) | a file lease belongs to one session, and the pre-edit hook refuses another's edit | **accepted** · 2026-10-28 |
+| [102](ADR-102-the-two-queued-review-rows-are-closed-by-ruling.md) | the two rows review 0002 left queued are closed by ruling, not by authoring | **accepted** · 2026-10-28 |
+| [103](ADR-103-co-projected-duplicates-merge-down.md) | duplicates stand alone, fingerprints generalize, references spell out | **accepted** · 2026-10-28 |
+| [104](ADR-104-the-pre-tool-use-policy-reads-the-command-the-way-a-shell-reads-it.md) | the pre-tool-use policy reads the command the way a shell reads it | **accepted** · 2026-10-28 |
+| [105](ADR-105-the-json-ceiling-shrinks-arrays-and-never-cuts-bytes.md) | the JSON ceiling shrinks arrays and never cuts bytes | **accepted** · 2026-10-29 |
+| [106](ADR-106-the-harness-hook-runs-through-a-repo-shim.md) | the harness hook runs through a repo shim, and `failClosed` only with it | **accepted** · 2026-10-29 |
+| [107](ADR-107-an-install-can-name-one-harness-and-the-skipped-ones-are-named.md) | an install can be narrowed to one harness, and the skipped ones are named | **accepted** · 2026-10-30 |
+| [108](ADR-108-an-adoption-builds-the-index-and-a-command-refreshes-it-on-read.md) | an adoption builds the index, and a command that reads it refreshes it on read | **accepted** · 2026-10-30 |
+| [109](ADR-109-simt-dev-is-its-own-consumer-and-the-guards-that-kept-it-from-being-one-are-retired.md) | simt-dev is its own consumer, and the guards that kept it from being one are retired | **accepted** · 2026-10-30 |
+| [110](ADR-110-the-lock-file-follows-the-manifest-name-and-the-old-name-is-read-until-the-next-write.md) | the lock is `simt.lock.json`, and the old name is read until the next write | **accepted** · 2026-10-30 |
+| [111](ADR-111-the-tool-ships-one-agent-rendered-per-harness-and-installs-it-with-init-and-a-command.md) | the tool ships one agent, rendered per harness, and installs it with init and a command | **accepted** · 2026-10-30 |
+| [112](ADR-112-the-registry-is-what-simt-dev-ships-and-a-repo-owns-its-own-skills.md) | the registry is what simt-dev ships, and a repo owns its own skills | **accepted** · 2026-10-31 · supersedes ADR-009 ruling 4 |
+| [116](ADR-116-rust-support-reaches-the-example-path-the-indent-and-the-bench-runner.md) | Rust support reaches the example path, the indent and the bench runner | **accepted** · 2026-10-31 |
 
 ADR-001 to ADR-010 resolve the contradictions found across the 16 repos in the 2026-10-05
 audit; each record names the repos whose text it replaces. ADR-011 and ADR-012 are the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "simt-dev",
-  "version": "0.6.2",
+  "version": "0.7.0",
   "description": "An intelligence amplifier for AI coding agents: rules and dual gates adopted by one command, plus local retrieval, task briefs, benches and repo memory — deterministic by default, with local-model adapters that propose and never select.",
   "license": "Apache-2.0",
   "author": "Said Elimam",
@@ -25,6 +25,8 @@
     "src",
     "rules",
     "templates",
+    "agents",
+    "skills",
     "docs/decisions",
     "CHANGELOG.md"
   ],
@@ -41,7 +43,7 @@
     "skills"
   ],
   "scripts": {
-    "test": "node --test --test-concurrency=4 test/*.test.mjs",
+    "test": "node --test --test-concurrency=$(node -p 'os.cpus().length') test/*.test.mjs",
     "lint": "node bin/simt.mjs doctor"
   }
 }

package/rules/core.md

@@ -45,8 +45,8 @@ commands belongs in this repository, not here.
 - Name the exact commands and test files. Partial pass is a blocker; `6/8 pass` is the
   canonical example of a blocked state. Never justify a skip without a pre-existing written
   reason. (ADR-006)
-- Evidence discipline is mandatory everywhere. A **numeric** bar is declared per repo in
-  `simt-dev.json`, never assumed centrally. (ADR-006)
+- Evidence discipline is mandatory everywhere. A **numeric** bar is declared per repo in the
+  repository's manifest (`{manifest}`), never assumed centrally. (ADR-006)
 - The pre-commit hook owns format and lint for staged files; do not re-run what it just ran.
   Manual runs are correct when the hook is absent, when diagnosing a failure, or for a check
   the hook does not cover. (ADR-004)

package/rules/mdc/preview-postflight.mdc

@@ -27,18 +27,17 @@ simt-substitutions:
   # neither, declares that. A worker that serves derivatives and calls no API has no
   # API base URL to set, so it declares only its own custom-domain binding.
   - key: previewApiBaseUrlNote
-    default: "- Point the preview build at the preview API Worker: set `SOCIAL_API_BASE_URL` in the Cloudflare Workers Builds preview environment to the preview API Worker URL."
+    default: "- Point the preview build at the preview API: set the preview environment's API base URL to the preview API URL."
     describe: build-config instruction, when this repo actually has a preview API base URL to set
   - key: googleOnlyNote
-    default: "- Production and public browser flows remain Google-only."
+    default: "- Production and public browser flows use the production identity only."
     describe: the identity policy this repo enforces in production
 ---
 
 # Preview-Only Authenticated Postflight
 
 Authenticated remote postflight and release checks use only {{previewWorkers}}, deployed
-with `AUTH_PROVIDER_POLICY=preview_postflight_password` and a secret-bound Firebase password
-identity (`POSTFLIGHT_PASSWORD_UID`).
+with a preview-only auth provider policy and a secret-bound password identity.
 
 ## Requirements
 
@@ -52,8 +51,8 @@ identity (`POSTFLIGHT_PASSWORD_UID`).
 ## Forbidden
 
 - Authenticated postflight against production domains ({{productionDomains}}).
-- Using real Social Google accounts for feature slice verification.
-- Demanding, pasting, or storing production Google OAuth tokens in chat or tickets.
+- Using real user accounts for feature slice verification.
+- Demanding, pasting, or storing production OAuth tokens in chat or tickets.
 
 ## Allowed Without Account
 

package/rules/mdc/test-gate.mdc

@@ -10,6 +10,8 @@ simt-substitutions:
     describe: how this repo actually runs one named test file
   - key: exampleTestPath
     default: path/to/the.changed.test.ts
+    default-has-go-mod: path/to/the_changed_test.go
+    default-has-cargo-toml: tests/the_changed.rs
     describe: one real test file for this repo, used only as the named example
   - key: pathKinds
     default: feature/contract/route

package/rules/stacks/android.md

@@ -12,9 +12,9 @@ simt-scope: ["AndroidManifest.xml", "**/build.gradle", "**/build.gradle.kts", "*
 
 # Stack profile: Android
 
-Applies to: `has-android-manifest` — some module has a
-`src/main/AndroidManifest.xml`. A JVM backend with no Android module does not get
-this profile; see `jvm`.
+Applies to: Android modules — some module has a `src/main/AndroidManifest.xml`.
+A JVM backend with no Android module does not get this profile; see `simt rules
+show jvm`.
 
 ## Build
 
@@ -27,17 +27,17 @@ this profile; see `jvm`.
 
 ## Modules and layers
 
-- `:core:domain` depends on no other internal module. Enforce it; do not add an
+- The core domain module depends on no other internal module. Enforce it; do not add an
   import that breaks the direction.
 - Layer suffixes: `*Repository`, `*ViewModel`, `*UiState`, `*Screen`, `*Service`.
-- Feature modules never import `androidx.compose.ui.window.Dialog`, M3 `AlertDialog`
-  or M3 `ModalBottomSheet`. The raw `Dialog` window belongs to allowlisted `core:ui`
-  surfaces, and `checkOverlayModalPolicy` fails `./gradlew check` when a feature
-  bypasses it.
+- Feature modules never present a raw `Dialog` window (`androidx.compose.ui.window.Dialog`,
+  M3 `AlertDialog`, M3 `ModalBottomSheet`) that bypasses the shared modal policy.
+  Modals go through the design system's dialog surfaces, and the repo's check fails
+  the build on a bypass.
 
 ## Accessibility
 
-- Every user-facing string is a resource, with a `cd_` content description where an
+- Every user-facing string is a resource, with a content description where an
   icon or image carries meaning. Decorative images declare `contentDescription = null`
   explicitly.
 - Touch targets meet the platform minimum, and the minimum is asserted rather than
@@ -61,5 +61,4 @@ this profile; see `jvm`.
 
 - Unit tests for view models, repositories and mappers; instrumentation tests for UI.
 - `Dispatchers.setMain` in a `@BeforeTest`, restored in `@AfterTest`.
-- Assert behaviour, not implementation. Never weaken an assertion, an accessibility
-  check or a fixture to match current behaviour.
+- Assert behaviour, not implementation — including accessibility checks and fixtures. Never weaken one to match current behaviour.

package/rules/stacks/cloudflare-workers.md

@@ -41,7 +41,7 @@ Applies to: `cloudflare-workers` — a `wrangler.json`, `wrangler.jsonc` or
 - Validate at the edge with the schema layer. Authorization is server-authoritative; a
   client-side role, claim, cache entry or URL parameter grants nothing.
 - `Request`/`Response` are globals. Do not pass them through as values into domain code.
-- Caching defaults to `private, no-store`. Never cache token, account, block, reveal, admin
+- Caching defaults to `private, no-store`. Never cache tokens, account data, admin
   decisions or authenticated errors.
 - Streaming is the default for large bodies; do not buffer without a stated reason.
 

package/rules/stacks/connectiq.md

@@ -25,8 +25,8 @@ Known traps to assume until verified otherwise:
 
 ## Memory
 
-- Memory budgets are hard limits, not targets, and they are the repo's declared gate
-  (`simt-dev.json`). Zero allocation in `onUpdate`; no allocation in a draw callback.
+- Memory budgets are hard limits, not targets, and they are the repo's declared gate in its
+  manifest (`{manifest}`). Zero allocation in `onUpdate`; no allocation in a draw callback.
 - A memory check that "currently exits 1 by design" is not a gate — it is noise that teaches
   everyone to ignore it. Declare the budget or drop the check.
 

package/rules/stacks/container.md

@@ -7,6 +7,8 @@ simt-scope: ["Dockerfile", "*.dockerfile"]
 simt-fallback: false
 ---
 
+# Stack profile: Containers
+
 ## Containers
 
 A Dockerfile is the build. If a rule here and the repo's own instructions disagree, the

package/rules/stacks/dart.md

@@ -8,7 +8,7 @@ simt-scope: ["pubspec.yaml", "**/*.dart"]
 
 # Stack profile: Dart
 
-Applies to: `has-pubspec` — a `pubspec.yaml`. A Flutter project is a Dart project
+Applies to: a committed `pubspec.yaml`. A Flutter project is a Dart project
 with the `flutter` SDK dependency; the Flutter-specific rules live with the tools
 that build it, not here.
 

package/rules/stacks/deno.md

@@ -8,7 +8,7 @@ simt-scope: ["deno.json", "deno.jsonc", "**/*.ts"]
 
 # Stack profile: Deno
 
-Applies to: `has-deno-config` — a `deno.json` or `deno.jsonc`.
+Applies to: a committed `deno.json` or `deno.jsonc`.
 
 ## Build and gates
 

package/rules/stacks/dotnet.md

@@ -8,7 +8,7 @@ simt-scope: ["*.csproj", "*.sln", "*.fsproj"]
 
 # Stack profile: .NET
 
-Applies to: `has-nuget` — a `.csproj` or solution.
+Applies to: a committed `.csproj` or solution.
 
 ## Build and gates
 

package/rules/stacks/elixir.md

@@ -8,7 +8,7 @@ simt-scope: ["mix.exs", "lib/**/*.ex"]
 
 # Stack profile: Elixir
 
-Applies to: `has-mix` — a `mix.exs`.
+Applies to: a committed `mix.exs`.
 
 ## Build and gates
 

package/rules/stacks/go.md

@@ -8,7 +8,7 @@ simt-scope: ["go.mod", "**/*.go"]
 
 # Stack profile: Go
 
-Applies to: `has-go-mod` — a module.
+Applies to: Go modules — a committed `go.mod`.
 
 ## Build and gates
 

package/rules/stacks/jvm.md

@@ -12,8 +12,9 @@ simt-scope: ["build.gradle", "build.gradle.kts", "pom.xml", "settings.gradle", "
 
 # Stack profile: JVM backend
 
-Applies to: `gradle`, `has-maven-pom`, `kotlin`, `java` — a JVM build. The Android
-rules live in the `android` profile, which selects on `has-android-manifest`.
+Applies to: a JVM build — `gradle`, a committed `pom.xml`, Kotlin or Java. The
+Android rules live in the `android` profile (`simt rules show android`), which
+selects when an `AndroidManifest.xml` is present.
 
 ## Build
 
@@ -26,7 +27,7 @@ rules live in the `android` profile, which selects on `has-android-manifest`.
 
 ## Modules and layers
 
-- `:core:domain` depends on no other internal module. Enforce it; do not add an
+- The core domain module depends on no other internal module. Enforce it; do not add an
   import that breaks the direction.
 - Layer suffixes: `*Repository`, `*Service`, `*Mapper`, `*Controller`. A class named
   `*Repository` that talks to HTTP is not a repository.