substrate-ai 0.20.142 → 0.20.144

package/dist/cli/index.js

@@ -1,17 +1,17 @@
 #!/usr/bin/env node
-import { FileKvStore, SUBSTRATE_OWNED_SETTINGS_KEYS, VALID_PHASES, buildPipelineStatusOutput, createDatabaseAdapter, createDoltOperatorReader, findPackageRoot, formatOutput, formatPipelineStatusHuman, formatPipelineSummary, formatTokenTelemetry, getAllDescendantPids, getAutoHealthData, getSubstrateDefaultSettings, inspectProcessTree, parseDbTimestampAsUtc, registerHealthCommand, resolveBmadMethodSrcPath, resolveBmadMethodVersion } from "../health-DTJaiJOd.js";
+import { FileKvStore, SUBSTRATE_OWNED_SETTINGS_KEYS, VALID_PHASES, buildPipelineStatusOutput, createDatabaseAdapter, createDoltOperatorReader, findPackageRoot, formatOutput, formatPipelineStatusHuman, formatPipelineSummary, formatTokenTelemetry, getAllDescendantPids, getAutoHealthData, getSubstrateDefaultSettings, inspectProcessTree, parseDbTimestampAsUtc, registerHealthCommand, resolveBmadMethodSrcPath, resolveBmadMethodVersion } from "../health-0kOtC07t.js";
 import { createLogger } from "../logger-KeHncl-f.js";
 import { createEventBus } from "../helpers-CElYrONe.js";
 import { AdapterRegistry, BudgetConfigSchema, CURRENT_CONFIG_FORMAT_VERSION, CURRENT_TASK_GRAPH_VERSION, ConfigError, CostTrackerConfigSchema, DEFAULT_CONFIG, DoltClient, DoltNotInstalled, GlobalSettingsSchema, InMemoryDatabaseAdapter, IngestionServer, MonitorDatabaseImpl, OPERATIONAL_FINDING, PartialGlobalSettingsSchema, PartialProviderConfigSchema, ProvidersSchema, RoutingRecommender, STORY_METRICS, TelemetryConfigSchema, addTokenUsage, aggregateTokenUsageForRun, checkDoltInstalled, compareRunMetrics, createAmendmentRun, createConfigSystem, createDecision, createPipelineRun, createStderrLogger, getActiveDecisions, getAllCostEntriesFiltered, getBaselineRunMetrics, getDecisionsByCategory, getDecisionsByPhaseForRun, getLatestCompletedRun, getLatestRun, getPipelineRunById, getPlanningCostTotal, getRetryableEscalations, getRunMetrics, getRunningPipelineRuns, getSessionCostSummary, getSessionCostSummaryFiltered, getStoryMetricsForRun, getTokenUsageSummary, incrementRunRestarts, initSchema, initWorkGraphSchema, initializeDolt, listRunMetrics, loadParentRunDecisions, supersedeDecision, swallowDebug, tagRunAsBaseline, updatePipelineRun } from "../dist-DiNK6QOD.js";
-import { AdapterTelemetryPersistence, AppError, DoltRepoMapMetaRepository, DoltSymbolRepository, ERR_REPO_MAP_STORAGE_WRITE, EpicIngester, GLOBSTAR, GitClient, GrammarLoader, Minimatch, Minipass, RepoMapInjector, RepoMapModule, RepoMapQueryEngine, RepoMapStorage, SymbolParser, createContextCompiler, createDispatcher, createEventEmitter, createGitWorktreeManager, createImplementationOrchestrator, createPackLoader, createPhaseOrchestrator, createStopAfterGate, createTelemetryAdvisor, escape, formatPhaseCompletionSummary, getFactoryRunSummaries, getScenarioResultsForRun, getTwinRunsForRun, listGraphRuns, registerExportCommand, registerFactoryCommand, registerRunCommand, registerScenariosCommand, resolveStoryKeys, runAnalysisPhase, runPlanningPhase, runProbeAuthor, runSolutioningPhase, unescape, validateStopAfterFromConflict } from "../run-DHHryElL.js";
+import { AdapterTelemetryPersistence, AppError, DoltRepoMapMetaRepository, DoltSymbolRepository, ERR_REPO_MAP_STORAGE_WRITE, EpicIngester, GLOBSTAR, GitClient, GrammarLoader, Minimatch, Minipass, RepoMapInjector, RepoMapModule, RepoMapQueryEngine, RepoMapStorage, SymbolParser, createContextCompiler, createDispatcher, createEventEmitter, createGitWorktreeManager, createImplementationOrchestrator, createPackLoader, createPhaseOrchestrator, createStopAfterGate, createTelemetryAdvisor, escape, formatPhaseCompletionSummary, getFactoryRunSummaries, getScenarioResultsForRun, getTwinRunsForRun, listGraphRuns, registerExportCommand, registerFactoryCommand, registerRunCommand, registerScenariosCommand, resolveStoryKeys, runAnalysisPhase, runPlanningPhase, runProbeAuthor, runSolutioningPhase, unescape, validateStopAfterFromConflict } from "../run-CUcRdKFK.js";
 import "../adapter-registry-DIcrxjH8.js";
-import { RunManifest, SupervisorLock, ZERO_FINDINGS_BY_AUTHOR, ZERO_FINDING_COUNTS, ZERO_PROBE_AUTHOR_METRICS, aggregateProbeAuthorMetrics, parseRuntimeProbes, readCurrentRunId, resolveMainRepoRoot, resolveRunManifest, rollupFindingCounts, rollupFindingsByAuthor, rollupProbeAuthorByClass, rollupProbeAuthorMetrics, runAcTraceabilityCheck } from "../manifest-read-BgZ6mR5R.js";
+import { RunManifest, SupervisorLock, ZERO_FINDINGS_BY_AUTHOR, ZERO_FINDING_COUNTS, ZERO_PROBE_AUTHOR_METRICS, aggregateProbeAuthorMetrics, parseRuntimeProbes, readCurrentRunId, resolveMainRepoRoot, resolveRunManifest, rollupFindingCounts, rollupFindingsByAuthor, rollupProbeAuthorByClass, rollupProbeAuthorMetrics, runAcTraceabilityCheck } from "../manifest-read-DPN4jjTc.js";
 import "../errors-B21JUhcc.js";
 import "../routing-DFxoKHDt.js";
 import { WorkGraphRepository } from "../work-graph-repository-DZyJv5pV.js";
 import "../decisions-CzSIEeGP.js";
 import "../decision-router-BAPpON_C.js";
-import "../interactive-prompt-OMlqP7Lm.js";
+import "../interactive-prompt-DTLnCbk2.js";
 import "../recovery-engine-BKGBeBnW.js";
 import "../version-manager-impl-qFBiO4Eh.js";
 import { registerUpgradeCommand } from "../upgrade-DB7KzD9c.js";
@@ -7052,7 +7052,7 @@ async function runStatusAction(options) {
 			logger$15.debug({ err }, "Work graph query failed, continuing without work graph data");
 		}
 		if (run === void 0) {
-			const { inspectProcessTree: inspectProcessTree$1 } = await import("../health-Cf5RjwHi.js");
+			const { inspectProcessTree: inspectProcessTree$1 } = await import("../health-P6IZuE0b.js");
 			const substrateDirPath = join(projectRoot, ".substrate");
 			const processInfo = inspectProcessTree$1({
 				projectRoot,
@@ -8581,7 +8581,7 @@ async function runSupervisorAction(options, deps = {}) {
 								await initSchema(expAdapter);
 								const { runRunAction: runPipeline } = await import(
 									/* @vite-ignore */
-									"../run-DStT56J1.js"
+									"../run-B5KqcL9T.js"
 );
 								const runStoryFn = async (opts) => {
 									const exitCode = await runPipeline({

package/dist/{health-DTJaiJOd.js → health-0kOtC07t.js}

@@ -1,6 +1,6 @@
 import { createLogger } from "./logger-KeHncl-f.js";
 import { DoltClient, DoltQueryError, createDatabaseAdapter$1 as createDatabaseAdapter, getLatestRun, getPipelineRunById, initSchema } from "./dist-DiNK6QOD.js";
-import { resolveMainRepoRoot, resolveRunManifest } from "./manifest-read-BgZ6mR5R.js";
+import { resolveMainRepoRoot, resolveRunManifest } from "./manifest-read-DPN4jjTc.js";
 import { createRequire } from "module";
 import { dirname, join } from "path";
 import { existsSync, readFileSync } from "node:fs";
@@ -1000,4 +1000,4 @@ function registerHealthCommand(program, _version = "0.0.0", projectRoot = proces
 
 //#endregion
 export { BMAD_BASELINE_TOKENS_FULL, DEFAULT_STALL_THRESHOLD_SECONDS, FileKvStore, STOP_AFTER_VALID_PHASES, STORY_KEY_PATTERN, SUBSTRATE_OWNED_SETTINGS_KEYS, VALID_PHASES, __commonJS, __require, __toESM, buildPipelineStatusOutput, createDatabaseAdapter$1 as createDatabaseAdapter, createDoltOperatorReader, findPackageRoot, formatOutput, formatPipelineStatusHuman, formatPipelineSummary, formatTokenTelemetry, getAllDescendantPids, getAutoHealthData, getSubstrateDefaultSettings, inspectProcessTree, isOrchestratorProcessLine, parseDbTimestampAsUtc, registerHealthCommand, resolveBmadMethodSrcPath, resolveBmadMethodVersion, runHealthAction, validateStoryKey };
-//# sourceMappingURL=health-DTJaiJOd.js.map
+//# sourceMappingURL=health-0kOtC07t.js.map

package/dist/{health-Cf5RjwHi.js → health-P6IZuE0b.js}

@@ -1,7 +1,7 @@
-import { DEFAULT_STALL_THRESHOLD_SECONDS, getAllDescendantPids, getAutoHealthData, inspectProcessTree, isOrchestratorProcessLine, registerHealthCommand, runHealthAction } from "./health-DTJaiJOd.js";
+import { DEFAULT_STALL_THRESHOLD_SECONDS, getAllDescendantPids, getAutoHealthData, inspectProcessTree, isOrchestratorProcessLine, registerHealthCommand, runHealthAction } from "./health-0kOtC07t.js";
 import "./logger-KeHncl-f.js";
 import "./dist-DiNK6QOD.js";
-import "./manifest-read-BgZ6mR5R.js";
+import "./manifest-read-DPN4jjTc.js";
 import "./work-graph-repository-DZyJv5pV.js";
 import "./decisions-CzSIEeGP.js";
 

package/dist/{interactive-prompt-OMlqP7Lm.js → interactive-prompt-DTLnCbk2.js}

@@ -1,5 +1,5 @@
 import { createLogger } from "./logger-KeHncl-f.js";
-import { readCurrentRunId, resolveMainRepoRoot } from "./manifest-read-BgZ6mR5R.js";
+import { readCurrentRunId, resolveMainRepoRoot } from "./manifest-read-DPN4jjTc.js";
 import { join } from "node:path";
 import { mkdir, readFile, writeFile } from "node:fs/promises";
 import * as readline from "node:readline";
@@ -180,4 +180,4 @@ async function runInteractivePrompt(decisionContext) {
 
 //#endregion
 export { runInteractivePrompt };
-//# sourceMappingURL=interactive-prompt-OMlqP7Lm.js.map
+//# sourceMappingURL=interactive-prompt-DTLnCbk2.js.map

package/dist/{manifest-read-BgZ6mR5R.js → manifest-read-DPN4jjTc.js}

@@ -8,7 +8,7 @@ import { YAMLException, load } from "js-yaml";
 import { existsSync, promises, readFileSync, readdirSync, statSync } from "node:fs";
 import { execSync, spawn } from "node:child_process";
 import * as path$2 from "node:path";
-import { basename as basename$1, dirname as dirname$1, join as join$1, resolve as resolve$1 } from "node:path";
+import { basename as basename$1, delimiter, dirname as dirname$1, join as join$1, resolve as resolve$1 } from "node:path";
 import { z } from "zod";
 import { mkdir as mkdir$1, open, readFile as readFile$1, unlink as unlink$1, writeFile as writeFile$1 } from "node:fs/promises";
 import * as fs from "fs";
@@ -2357,6 +2357,166 @@ var TestSuiteCheck = class {
 	}
 };
 
+//#endregion
+//#region packages/sdlc/dist/verification/checks/contamination-check.js
+/** Map of language → source extensions used for foreign-language detection. */
+const LANGUAGE_EXTENSIONS = {
+	typescript: [
+		".ts",
+		".tsx",
+		".mts",
+		".cts"
+	],
+	javascript: [
+		".js",
+		".jsx",
+		".mjs",
+		".cjs"
+	],
+	python: [".py"],
+	go: [".go"],
+	rust: [".rs"],
+	java: [".java"],
+	kotlin: [".kt", ".kts"]
+};
+/** JS-family toolchain manifests whose appearance flips build detection. */
+const JS_TOOLCHAIN_MANIFESTS = [
+	"package.json",
+	"tsconfig.json",
+	"package-lock.json",
+	"pnpm-lock.yaml",
+	"yarn.lock",
+	"bun.lockb",
+	"vite.config.ts",
+	"vite.config.js"
+];
+/** Droppings that must never appear in a story diff, regardless of language. */
+const ALWAYS_DENY_SEGMENTS = [
+	"node_modules",
+	".venv",
+	"__pycache__"
+];
+/**
+* Collect every `language: <x>` declaration in the profile (single-project
+* `project.language` plus monorepo `packages[].language`). Line-based parse —
+* no yaml dependency. Returns [] when the profile is absent/unreadable.
+*/
+function readProfileLanguages(workingDir) {
+	const profilePath = join$1(workingDir, ".substrate", "project-profile.yaml");
+	if (!existsSync(profilePath)) return [];
+	try {
+		const content = readFileSync(profilePath, "utf-8");
+		const langs = new Set();
+		for (const m of content.matchAll(/^\s*(?:-\s+)?language:\s*['"]?([a-z]+)['"]?\s*$/gm)) if (m[1] !== void 0) langs.add(m[1]);
+		return [...langs];
+	} catch {
+		return [];
+	}
+}
+/** Language of a file per LANGUAGE_EXTENSIONS, or undefined for neutral files. */
+function fileLanguage(file) {
+	const lower = file.toLowerCase();
+	for (const [lang, exts] of Object.entries(LANGUAGE_EXTENSIONS)) if (exts.some((e) => lower.endsWith(e))) return lang;
+	return void 0;
+}
+/**
+* Pure classification of a changed-file list against the project's declared
+* languages. Exported for unit testing.
+*/
+function classifyContamination(changedFiles, allowedLanguages) {
+	const allowJs = allowedLanguages.includes("typescript") || allowedLanguages.includes("javascript");
+	const foreignSourceFiles = [];
+	const foreignToolchainManifests = [];
+	const droppings = [];
+	for (const raw of changedFiles) {
+		const file = raw.replace(/\\/g, "/").replace(/^\.\//, "");
+		const segments = file.split("/");
+		if (segments.some((s) => ALWAYS_DENY_SEGMENTS.includes(s))) {
+			droppings.push(file);
+			continue;
+		}
+		if (!allowJs && segments.includes("dist")) {
+			droppings.push(file);
+			continue;
+		}
+		const base = segments[segments.length - 1] ?? "";
+		if (!allowJs && JS_TOOLCHAIN_MANIFESTS.includes(base)) {
+			foreignToolchainManifests.push(file);
+			continue;
+		}
+		const lang = fileLanguage(file);
+		if (lang !== void 0 && !allowedLanguages.includes(lang)) {
+			if (allowJs && (lang === "typescript" || lang === "javascript")) continue;
+			foreignSourceFiles.push({
+				file,
+				language: lang
+			});
+		}
+	}
+	return {
+		foreignSourceFiles,
+		foreignToolchainManifests,
+		droppings
+	};
+}
+var ContaminationCheck = class {
+	name = "scope-contamination";
+	tier = "A";
+	async run(context) {
+		const start = Date.now();
+		const changedFiles = context.changedFiles ?? [];
+		if (changedFiles.length === 0) return {
+			status: "pass",
+			details: "no changed files to inspect",
+			duration_ms: Date.now() - start,
+			findings: []
+		};
+		const allowedLanguages = readProfileLanguages(context.workingDir);
+		if (allowedLanguages.length === 0) {
+			const findings$1 = [{
+				category: "contamination-skip",
+				severity: "warn",
+				message: `no project profile with declared languages at ${context.workingDir} — cannot check for foreign-toolchain contamination (run substrate init to generate one)`
+			}];
+			return {
+				status: "warn",
+				details: renderFindings(findings$1),
+				duration_ms: Date.now() - start,
+				findings: findings$1
+			};
+		}
+		const verdict = classifyContamination(changedFiles, allowedLanguages);
+		const findings = [];
+		if (verdict.droppings.length > 0) findings.push({
+			category: "contamination-droppings",
+			severity: "error",
+			message: `story diff contains build/dependency droppings that must never be committed: ${verdict.droppings.slice(0, 10).join(", ")}` + (verdict.droppings.length > 10 ? ` (+${String(verdict.droppings.length - 10)} more)` : "")
+		});
+		if (verdict.foreignToolchainManifests.length > 0) findings.push({
+			category: "contamination-toolchain",
+			severity: "error",
+			message: `story introduces a JS toolchain on a ${allowedLanguages.join("/")} project: ${verdict.foreignToolchainManifests.join(", ")}. This is the exact trigger that flips build detection to npm and masks real story outcomes (field finding #12).`
+		});
+		if (verdict.foreignSourceFiles.length > 0) findings.push({
+			category: "contamination-language",
+			severity: "error",
+			message: `story writes source files in language(s) the project does not use (declared: ${allowedLanguages.join(", ")}): ` + verdict.foreignSourceFiles.slice(0, 10).map((f) => `${f.file} [${f.language}]`).join(", ")
+		});
+		if (findings.length === 0) return {
+			status: "pass",
+			details: `no contamination across ${String(changedFiles.length)} changed file(s)`,
+			duration_ms: Date.now() - start,
+			findings: []
+		};
+		return {
+			status: "fail",
+			details: renderFindings(findings),
+			duration_ms: Date.now() - start,
+			findings
+		};
+	}
+};
+
 //#endregion
 //#region packages/sdlc/dist/verification/probes/types.js
 /**
@@ -2554,6 +2714,35 @@ function parseRuntimeProbes(storyContent) {
 
 //#endregion
 //#region packages/sdlc/dist/verification/probes/executor.js
+/**
+* H1.3 (hardening program, field finding #6): shape the probe environment so
+* probe commands run in the PROJECT'S environment, not the orchestrator's.
+*
+* The field failure: probe `registry-rejects-undeclared-source` ran bare
+* `python` from the inherited PATH — outside the project venv — and died with
+* `ModuleNotFoundError: No module named 'structlog'` even though the behavior
+* it tested passed in-env. That single false negative flipped an
+* LGTM_WITH_NOTES story to VERIFICATION_FAILED and destabilized the rest of
+* the run.
+*
+* When the working dir carries a project-local env (`.venv/bin` — created by
+* uv, venv, virtualenv alike), prepend it to PATH and set VIRTUAL_ENV so bare
+* `python`/`pytest`/console-script invocations resolve inside the project.
+* PATH prepending (rather than command rewriting) is quoting-hazard-free and
+* tool-agnostic. POSIX layout only (`bin/`) — matches substrate's supported
+* platforms; extend for `Scripts/` if Windows dispatch ever lands.
+*
+* Pure given (cwd, baseEnv) + exported for testing.
+*/
+function buildProbeEnv(cwd, baseEnv = process.env) {
+	const venvBin = join$1(cwd, ".venv", "bin");
+	if (!existsSync(venvBin)) return baseEnv;
+	return {
+		...baseEnv,
+		VIRTUAL_ENV: join$1(cwd, ".venv"),
+		PATH: `${venvBin}${delimiter}${baseEnv.PATH ?? ""}`
+	};
+}
 /** Return the last N bytes of a UTF-8 string (sliced by length for simplicity). */
 function tail(text, bytes = PROBE_TAIL_BYTES) {
 	return text.length <= bytes ? text : text.slice(text.length - bytes);
@@ -3042,7 +3231,13 @@ function probesInvokeProductionTrigger(probes) {
 	for (const probe of probes) for (const pattern of TRIGGER_COMMAND_PATTERNS) if (pattern.test(probe.command)) return true;
 	return false;
 }
-const defaultExecutors = { host: (probe, cwd) => executeProbeOnHost(probe, { cwd: cwd ?? process.cwd() }) };
+const defaultExecutors = { host: (probe, cwd) => {
+	const effectiveCwd = cwd ?? process.cwd();
+	return executeProbeOnHost(probe, {
+		cwd: effectiveCwd,
+		env: buildProbeEnv(effectiveCwd)
+	});
+} };
 var RuntimeProbeCheck = class {
 	name = "runtime-probes";
 	tier = "A";
@@ -4257,6 +4452,7 @@ function createDefaultVerificationPipeline(bus, config) {
 		new AcceptanceCriteriaEvidenceCheck(),
 		new BuildCheck(),
 		new TestSuiteCheck(),
+		new ContaminationCheck(),
 		new RuntimeProbeCheck(),
 		new SourceAcFidelityCheck(),
 		new SourceAcShelloutCheck(),
@@ -6040,4 +6236,4 @@ async function resolveRunManifest(dbRoot, runId) {
 
 //#endregion
 export { FindingsInjector, RunManifest, RuntimeProbeListSchema, SupervisorLock, ZERO_FINDINGS_BY_AUTHOR, ZERO_FINDING_COUNTS, ZERO_PROBE_AUTHOR_METRICS, aggregateProbeAuthorMetrics, applyConfigToGraph, createDefaultVerificationPipeline, createGraphOrchestrator, createSdlcCodeReviewHandler, createSdlcCreateStoryHandler, createSdlcDevStoryHandler, createSdlcPhaseHandler, detectsEventDrivenAC, detectsStateIntegratingAC, extractTargetFilesFromStoryContent, parseRuntimeProbes, readCurrentRunId, renderFindings, resolveGraphPath, resolveMainRepoRoot, resolveRunManifest, rollupFindingCounts, rollupFindingsByAuthor, rollupProbeAuthorByClass, rollupProbeAuthorMetrics, runAcTraceabilityCheck, runStaleVerificationRecovery };
-//# sourceMappingURL=manifest-read-BgZ6mR5R.js.map
+//# sourceMappingURL=manifest-read-DPN4jjTc.js.map

package/dist/modules/interactive-prompt/index.js

@@ -1,6 +1,6 @@
 import "../../logger-KeHncl-f.js";
 import "../../dist-DiNK6QOD.js";
-import "../../manifest-read-BgZ6mR5R.js";
-import { runInteractivePrompt } from "../../interactive-prompt-OMlqP7Lm.js";
+import "../../manifest-read-DPN4jjTc.js";
+import { runInteractivePrompt } from "../../interactive-prompt-DTLnCbk2.js";
 
 export { runInteractivePrompt };

package/dist/{run-DStT56J1.js → run-B5KqcL9T.js}

@@ -1,14 +1,14 @@
-import "./health-DTJaiJOd.js";
+import "./health-0kOtC07t.js";
 import "./logger-KeHncl-f.js";
 import "./helpers-CElYrONe.js";
 import "./dist-DiNK6QOD.js";
-import { normalizeGraphSummaryToStatus, registerRunCommand, resolveMaxReviewCycles, resolveProbeAuthorStateIntegrating, runRunAction, wireNdjsonEmitter } from "./run-DHHryElL.js";
-import "./manifest-read-BgZ6mR5R.js";
+import { normalizeGraphSummaryToStatus, registerRunCommand, resolveMaxReviewCycles, resolveProbeAuthorStateIntegrating, runRunAction, wireNdjsonEmitter } from "./run-CUcRdKFK.js";
+import "./manifest-read-DPN4jjTc.js";
 import "./routing-DFxoKHDt.js";
 import "./work-graph-repository-DZyJv5pV.js";
 import "./decisions-CzSIEeGP.js";
 import "./decision-router-BAPpON_C.js";
-import "./interactive-prompt-OMlqP7Lm.js";
+import "./interactive-prompt-DTLnCbk2.js";
 import "./recovery-engine-BKGBeBnW.js";
 
 export { runRunAction };

package/dist/{run-DHHryElL.js → run-CUcRdKFK.js}

@@ -1,11 +1,11 @@
-import { BMAD_BASELINE_TOKENS_FULL, FileKvStore, STOP_AFTER_VALID_PHASES, STORY_KEY_PATTERN, VALID_PHASES, __commonJS, __require, __toESM, buildPipelineStatusOutput, createDatabaseAdapter, formatOutput, formatPipelineSummary, formatTokenTelemetry, inspectProcessTree, parseDbTimestampAsUtc, validateStoryKey } from "./health-DTJaiJOd.js";
+import { BMAD_BASELINE_TOKENS_FULL, FileKvStore, STOP_AFTER_VALID_PHASES, STORY_KEY_PATTERN, VALID_PHASES, __commonJS, __require, __toESM, buildPipelineStatusOutput, createDatabaseAdapter, formatOutput, formatPipelineSummary, formatTokenTelemetry, inspectProcessTree, parseDbTimestampAsUtc, validateStoryKey } from "./health-0kOtC07t.js";
 import { createLogger } from "./logger-KeHncl-f.js";
 import { TypedEventBusImpl, createEventBus, createTuiApp, isTuiCapable, printNonTtyWarning, sleep } from "./helpers-CElYrONe.js";
 import { ADVISORY_NOTES, CLAUDE_AUTH_FAILURE_HINT, CODEX_SANDBOX_BLOCK_HINT, Categorizer, ConsumerAnalyzer, DEFAULT_GLOBAL_SETTINGS, DispatcherImpl, DoltClient, ESCALATION_DIAGNOSIS, EXPERIMENT_RESULT, EfficiencyScorer, IngestionServer, LogTurnAnalyzer, OPERATIONAL_FINDING, Recommender, RoutingRecommender, RoutingResolver, RoutingTelemetry, RoutingTokenAccumulator, RoutingTuner, STORY_METRICS, STORY_OUTCOME, SubstrateConfigSchema, TEST_EXPANSION_FINDING, TEST_PLAN, TelemetryNormalizer, TelemetryPipeline, TurnAnalyzer, addTokenUsage, aggregateTokenUsageForRun, aggregateTokenUsageForStory, callLLM, classifyVersionGap, createConfigSystem, createDatabaseAdapter$1, createDecision, createPipelineRun, createRequirement, createStderrLogger, detectClaudeAuthFailure, detectCodexSandboxBlock, detectInterfaceChanges, getArtifactByTypeForRun, getArtifactsByRun, getDecisionsByCategory, getDecisionsByPhase, getDecisionsByPhaseForRun, getLatestRun, getPipelineRunById, getRunMetrics, getRunningPipelineRuns, getStoryMetricsForRun, getTokenUsageSummary, initSchema, listRequirements, loadModelRoutingConfig, registerArtifact, swallowDebug, updatePipelineRun, updatePipelineRunConfig, upsertDecision, writeRunMetrics, writeStoryMetrics } from "./dist-DiNK6QOD.js";
-import { FindingsInjector, RunManifest, RuntimeProbeListSchema, applyConfigToGraph, createDefaultVerificationPipeline, createGraphOrchestrator, createSdlcCodeReviewHandler, createSdlcCreateStoryHandler, createSdlcDevStoryHandler, createSdlcPhaseHandler, detectsEventDrivenAC, detectsStateIntegratingAC, extractTargetFilesFromStoryContent, parseRuntimeProbes, renderFindings, resolveGraphPath, resolveMainRepoRoot, runAcTraceabilityCheck, runStaleVerificationRecovery } from "./manifest-read-BgZ6mR5R.js";
+import { FindingsInjector, RunManifest, RuntimeProbeListSchema, applyConfigToGraph, createDefaultVerificationPipeline, createGraphOrchestrator, createSdlcCodeReviewHandler, createSdlcCreateStoryHandler, createSdlcDevStoryHandler, createSdlcPhaseHandler, detectsEventDrivenAC, detectsStateIntegratingAC, extractTargetFilesFromStoryContent, parseRuntimeProbes, renderFindings, resolveGraphPath, resolveMainRepoRoot, runAcTraceabilityCheck, runStaleVerificationRecovery } from "./manifest-read-DPN4jjTc.js";
 import { WorkGraphRepository, detectCycles } from "./work-graph-repository-DZyJv5pV.js";
 import { deriveExitCode, routeDecision } from "./decision-router-BAPpON_C.js";
-import { runInteractivePrompt } from "./interactive-prompt-OMlqP7Lm.js";
+import { runInteractivePrompt } from "./interactive-prompt-DTLnCbk2.js";
 import { runRecoveryEngine } from "./recovery-engine-BKGBeBnW.js";
 import { basename, dirname, extname, join } from "path";
 import { access, readFile, readdir, stat } from "fs/promises";
@@ -7542,6 +7542,12 @@ const logger$20 = createLogger("compiled-workflows:git-helpers");
 * @returns Structured result for the orchestrator to inspect
 */
 async function commitDevStoryOutput(storyKey, storyTitle, filesModified, workingDir) {
+	const COMMIT_DENY_SEGMENTS = [
+		"node_modules",
+		".venv",
+		"__pycache__",
+		".substrate-worktrees"
+	];
 	const insideWorktree = [];
 	for (const p of filesModified) {
 		const abs = isAbsolute(p) ? p : resolve$1(workingDir, p);
@@ -7554,6 +7560,14 @@ async function commitDevStoryOutput(storyKey, storyTitle, filesModified, working
 			}, "commitDevStoryOutput: filtered out path outside worktree");
 			continue;
 		}
+		const segments = rel.replace(/\\/g, "/").split("/");
+		if (segments.some((s$1) => COMMIT_DENY_SEGMENTS.includes(s$1))) {
+			logger$20.warn({
+				path: rel,
+				storyKey
+			}, "commitDevStoryOutput: denylisted dependency/artifact path excluded from substrate commit");
+			continue;
+		}
 		insideWorktree.push(rel);
 	}
 	if (insideWorktree.length === 0) return {
@@ -12619,6 +12633,7 @@ function assembleVerificationContext(opts) {
 		outputTokenCount: opts.outputTokenCount,
 		sourceEpicContent: opts.sourceEpicContent,
 		runId: opts.runId,
+		...opts.changedFiles !== void 0 ? { changedFiles: opts.changedFiles } : {},
 		...profileBuildCommand !== void 0 ? { buildCommand: profileBuildCommand } : {},
 		...profileTestCommand !== void 0 ? { testCommand: profileTestCommand } : {}
 	};
@@ -13490,6 +13505,34 @@ function summarizeEscalationIssues(issues, cap = 4e3) {
 * the opaque verdict. Best-effort: a probe failure yields an empty list (never
 * blocks escalation). Exported for unit testing.
 */
+/**
+* H1.4 (hardening program, field finding #13): classify a story's ground-truth
+* git diff into implementation vs. pipeline-artifact changes.
+*
+* The field failure: story 2-3 returned status=complete with "239 tests pass"
+* while its branch contained ONLY the create-story spec file — zero source,
+* zero tests (the 239 were the pre-existing suite; true but vacuous). The
+* zero-diff gate never fired because the spec .md IS a diff entry.
+*
+* A file counts as implementation when it lives outside substrate's own
+* artifact trees (`_bmad-output/`, `.substrate/`). Story specs, planning
+* artifacts, and manifest state are pipeline bookkeeping — a "successful"
+* dev pass whose diff is bookkeeping-only produced no implementation.
+*
+* Pure + exported for unit testing.
+*/
+function classifyImplementationDiff(files) {
+	const isArtifact = (f$1) => {
+		const norm = f$1.replace(/\\/g, "/").replace(/^\.\//, "");
+		return norm.startsWith("_bmad-output/") || norm.startsWith(".substrate/");
+	};
+	const artifactOnly = files.filter(isArtifact);
+	const hasImplementation = files.some((f$1) => !isArtifact(f$1));
+	return {
+		hasImplementation,
+		artifactOnly
+	};
+}
 function detectWorkOutsideWorktree(effectiveProjectRoot, projectRoot, checkDiff) {
 	const inWorktreeMode = effectiveProjectRoot !== void 0 && projectRoot !== void 0 && effectiveProjectRoot !== projectRoot;
 	if (!inWorktreeMode) return [];
@@ -15700,6 +15743,31 @@ function createImplementationOrchestrator(deps) {
 				}
 			}
 		}
+		if (devStoryWasSuccess && gitDiffFiles !== void 0 && gitDiffFiles.length > 0) {
+			const implClassification = classifyImplementationDiff(gitDiffFiles);
+			if (!implClassification.hasImplementation) {
+				logger$27.warn({
+					storyKey,
+					artifactFiles: implClassification.artifactOnly.slice(0, 10)
+				}, "dev-story reported success but the diff contains only pipeline artifacts — no implementation was produced");
+				endPhase(storyKey, "dev-story", devStoryModel);
+				updateStory(storyKey, {
+					phase: "ESCALATED",
+					error: "no-implementation",
+					completedAt: new Date().toISOString()
+				});
+				await writeStoryMetricsBestEffort(storyKey, "escalated", 0);
+				await emitEscalation({
+					storyKey,
+					lastVerdict: "no-implementation",
+					reviewCycles: 0,
+					issues: [`dev-story reported COMPLETE but every changed file is a pipeline artifact (${implClassification.artifactOnly.slice(0, 10).join(", ")}) — no source or test files were produced. Self-reported test results on such a story are vacuous (they exercise the pre-existing suite).`],
+					escalationReason: "no-implementation"
+				});
+				await persistState();
+				return;
+			}
+		}
 		let _devOutputCommitHookFailure;
 		const _commitFirstEligible = !noWorktree && _worktreeManager !== void 0 && effectiveProjectRoot !== void 0 && effectiveProjectRoot !== projectRoot;
 		if (_commitFirstEligible && effectiveProjectRoot !== void 0) {
@@ -16056,6 +16124,7 @@ function createImplementationOrchestrator(deps) {
 					devStoryResult: devStorySignals,
 					outputTokenCount: devOutputTokenCount,
 					sourceEpicContent,
+					...gitDiffFiles !== void 0 ? { changedFiles: gitDiffFiles } : {},
 					runId: config.pipelineRunId
 				});
 				const verifSummary = await verificationPipeline.run(verifContext, "A");
@@ -29968,7 +30037,7 @@ var require_uri_all = __commonJS({ "node_modules/uri-js/dist/es5/uri.all.js"(exp
 		var damp = 700;
 		var initialBias = 72;
 		var initialN = 128;
-		var delimiter = "-";
+		var delimiter$1 = "-";
 		/** Regular expressions */
 		var regexPunycode = /^xn--/;
 		var regexNonASCII = /[^\0-\x7E]/;
@@ -30123,7 +30192,7 @@ var require_uri_all = __commonJS({ "node_modules/uri-js/dist/es5/uri.all.js"(exp
 			var i = 0;
 			var n$1 = initialN;
 			var bias = initialBias;
-			var basic = input.lastIndexOf(delimiter);
+			var basic = input.lastIndexOf(delimiter$1);
 			if (basic < 0) basic = 0;
 			for (var j$1 = 0; j$1 < basic; ++j$1) {
 				if (input.charCodeAt(j$1) >= 128) error$1("not-basic");
@@ -30185,7 +30254,7 @@ var require_uri_all = __commonJS({ "node_modules/uri-js/dist/es5/uri.all.js"(exp
 			}
 			var basicLength = output.length;
 			var handledCPCount = basicLength;
-			if (basicLength) output.push(delimiter);
+			if (basicLength) output.push(delimiter$1);
 			while (handledCPCount < inputLength) {
 				var m = maxInt;
 				var _iteratorNormalCompletion2 = true;
@@ -48068,4 +48137,4 @@ function registerRunCommand(program, version = "0.0.0", projectRoot = process.cw
 
 //#endregion
 export { AdapterTelemetryPersistence, AppError, DoltRepoMapMetaRepository, DoltSymbolRepository, ERR_REPO_MAP_STORAGE_WRITE, EpicIngester, GLOBSTAR$1 as GLOBSTAR, GitClient, GrammarLoader, Minimatch$1 as Minimatch, Minipass, RepoMapInjector, RepoMapModule, RepoMapQueryEngine, RepoMapStorage, SymbolParser, createContextCompiler, createDispatcher, createEventEmitter, createGitWorktreeManager, createImplementationOrchestrator, createPackLoader, createPhaseOrchestrator, createStopAfterGate, createTelemetryAdvisor, escape$1 as escape, formatPhaseCompletionSummary, getFactoryRunSummaries, getScenarioResultsForRun, getTwinRunsForRun, listGraphRuns, normalizeGraphSummaryToStatus, registerExportCommand, registerFactoryCommand, registerRunCommand, registerScenariosCommand, resolveMaxReviewCycles, resolveProbeAuthorStateIntegrating, resolveStoryKeys, runAnalysisPhase, runPlanningPhase, runProbeAuthor, runRunAction, runSolutioningPhase, unescape$1 as unescape, validateStopAfterFromConflict, wireNdjsonEmitter };
-//# sourceMappingURL=run-DHHryElL.js.map
+//# sourceMappingURL=run-CUcRdKFK.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "substrate-ai",
-  "version": "0.20.142",
+  "version": "0.20.144",
   "description": "Substrate — multi-agent orchestration daemon for AI coding agents",
   "type": "module",
   "license": "MIT",

package/packs/bmad/prompts/probe-author.md

@@ -8,6 +8,10 @@ You are a **probe-author agent**. Your sole responsibility is to author `## Runt
 
 ## Context
 
+### Project Environment
+
+{{project_env}}
+
 ### Rendered Acceptance Criteria (Story Artifact)
 
 The following is the story's rendered AC section, as produced by the create-story agent: