substrate-ai 0.20.27 → 0.20.28

package/dist/cli/index.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
-import { FileStateStore, RunManifest, SUBSTRATE_OWNED_SETTINGS_KEYS, SupervisorLock, VALID_PHASES, WorkGraphRepository, ZERO_FINDING_COUNTS, buildPipelineStatusOutput, createDatabaseAdapter, createStateStore, findPackageRoot, formatOutput, formatPipelineStatusHuman, formatPipelineSummary, formatTokenTelemetry, getAllDescendantPids, getAutoHealthData, getSubstrateDefaultSettings, inspectProcessTree, parseDbTimestampAsUtc, registerHealthCommand, resolveBmadMethodSrcPath, resolveBmadMethodVersion, resolveMainRepoRoot, resolveRunManifest, rollupFindingCounts } from "../health-0_axmI2t.js";
+import { FileStateStore, RunManifest, SUBSTRATE_OWNED_SETTINGS_KEYS, SupervisorLock, VALID_PHASES, WorkGraphRepository, ZERO_FINDING_COUNTS, buildPipelineStatusOutput, createDatabaseAdapter, createStateStore, findPackageRoot, formatOutput, formatPipelineStatusHuman, formatPipelineSummary, formatTokenTelemetry, getAllDescendantPids, getAutoHealthData, getSubstrateDefaultSettings, inspectProcessTree, parseDbTimestampAsUtc, registerHealthCommand, resolveBmadMethodSrcPath, resolveBmadMethodVersion, resolveMainRepoRoot, resolveRunManifest, rollupFindingCounts } from "../health-Dx9hm9x1.js";
 import { createLogger } from "../logger-KeHncl-f.js";
 import { createEventBus } from "../helpers-CElYrONe.js";
 import { AdapterRegistry, BudgetConfigSchema, CURRENT_CONFIG_FORMAT_VERSION, CURRENT_TASK_GRAPH_VERSION, ConfigError, CostTrackerConfigSchema, DEFAULT_CONFIG, DoltClient, DoltNotInstalled, GlobalSettingsSchema, IngestionServer, MonitorDatabaseImpl, OPERATIONAL_FINDING, PartialGlobalSettingsSchema, PartialProviderConfigSchema, ProvidersSchema, RoutingRecommender, STORY_METRICS, TelemetryConfigSchema, addTokenUsage, aggregateTokenUsageForRun, checkDoltInstalled, compareRunMetrics, createAmendmentRun, createConfigSystem, createDecision, createDoltClient, createPipelineRun, getActiveDecisions, getAllCostEntriesFiltered, getBaselineRunMetrics, getDecisionsByCategory, getDecisionsByPhaseForRun, getLatestCompletedRun, getLatestRun, getPipelineRunById, getPlanningCostTotal, getRetryableEscalations, getRunMetrics, getRunningPipelineRuns, getSessionCostSummary, getSessionCostSummaryFiltered, getStoryMetricsForRun, getTokenUsageSummary, incrementRunRestarts, initSchema, initializeDolt, listRunMetrics, loadParentRunDecisions, supersedeDecision, tagRunAsBaseline, updatePipelineRun } from "../dist-CqtWS9wF.js";
 import "../adapter-registry-DXLMTmfD.js";
-import { AdapterTelemetryPersistence, AppError, DoltRepoMapMetaRepository, DoltSymbolRepository, ERR_REPO_MAP_STORAGE_WRITE, EpicIngester, GitClient, GrammarLoader, RepoMapInjector, RepoMapModule, RepoMapQueryEngine, RepoMapStorage, SymbolParser, createContextCompiler, createDispatcher, createEventEmitter, createImplementationOrchestrator, createPackLoader, createPhaseOrchestrator, createStopAfterGate, createTelemetryAdvisor, formatPhaseCompletionSummary, getFactoryRunSummaries, getScenarioResultsForRun, getTwinRunsForRun, listGraphRuns, registerExportCommand, registerFactoryCommand, registerRunCommand, registerScenariosCommand, resolveStoryKeys, runAnalysisPhase, runPlanningPhase, runSolutioningPhase, validateStopAfterFromConflict } from "../run-DQcG05Ar.js";
+import { AdapterTelemetryPersistence, AppError, DoltRepoMapMetaRepository, DoltSymbolRepository, ERR_REPO_MAP_STORAGE_WRITE, EpicIngester, GitClient, GrammarLoader, RepoMapInjector, RepoMapModule, RepoMapQueryEngine, RepoMapStorage, SymbolParser, createContextCompiler, createDispatcher, createEventEmitter, createImplementationOrchestrator, createPackLoader, createPhaseOrchestrator, createStopAfterGate, createTelemetryAdvisor, formatPhaseCompletionSummary, getFactoryRunSummaries, getScenarioResultsForRun, getTwinRunsForRun, listGraphRuns, registerExportCommand, registerFactoryCommand, registerRunCommand, registerScenariosCommand, resolveStoryKeys, runAnalysisPhase, runPlanningPhase, runSolutioningPhase, validateStopAfterFromConflict } from "../run-BmRu588B.js";
 import "../errors-1uLGqnvr.js";
 import "../routing-CcBOCuC9.js";
 import "../decisions-C0pz9Clx.js";
@@ -3667,7 +3667,7 @@ async function runStatusAction(options) {
 			logger$12.debug({ err }, "Work graph query failed, continuing without work graph data");
 		}
 		if (run === void 0) {
-			const { inspectProcessTree: inspectProcessTree$1 } = await import("../health-CrEdV2B3.js");
+			const { inspectProcessTree: inspectProcessTree$1 } = await import("../health-C6x1jDlX.js");
 			const substrateDirPath = join(projectRoot, ".substrate");
 			const processInfo = inspectProcessTree$1({
 				projectRoot,
@@ -5198,7 +5198,7 @@ async function runSupervisorAction(options, deps = {}) {
 								await initSchema(expAdapter);
 								const { runRunAction: runPipeline } = await import(
 									/* @vite-ignore */
-									"../run-DQ29oNG2.js"
+									"../run-CV3EAUZK.js"
 );
 								const runStoryFn = async (opts) => {
 									const exitCode = await runPipeline({

package/dist/{health-CrEdV2B3.js → health-C6x1jDlX.js}

@@ -1,4 +1,4 @@
-import { DEFAULT_STALL_THRESHOLD_SECONDS, getAllDescendantPids, getAutoHealthData, inspectProcessTree, isOrchestratorProcessLine, registerHealthCommand, runHealthAction } from "./health-0_axmI2t.js";
+import { DEFAULT_STALL_THRESHOLD_SECONDS, getAllDescendantPids, getAutoHealthData, inspectProcessTree, isOrchestratorProcessLine, registerHealthCommand, runHealthAction } from "./health-Dx9hm9x1.js";
 import "./logger-KeHncl-f.js";
 import "./dist-CqtWS9wF.js";
 import "./decisions-C0pz9Clx.js";

package/dist/{health-0_axmI2t.js → health-Dx9hm9x1.js}

@@ -3744,6 +3744,70 @@ const CATEGORY_TIMEOUT = "runtime-probe-timeout";
 * from "tool errored loudly".
 */
 const CATEGORY_ASSERTION_FAIL = "runtime-probe-assertion-fail";
+/**
+* Story 60-11: source AC describes an event-driven mechanism (hook, timer,
+* signal, webhook) but no probe's command invokes a known production-trigger
+* pattern. Strata Run 13 (Story 1-12, 2026-04-26): vault conflict hook
+* shipped SHIP_IT non-functional because the dev's probe ran the hook script
+* directly with `bash .git/hooks/post-merge` — git only fires post-merge on
+* a SUCCESSFUL merge, so under conflict (the hook's actual use case) the
+* production trigger never fires. Direct-invocation probe missed it; only
+* e2e smoke caught it. Sibling to obs_012's success-shape gap.
+*
+* Severity is warn (advisory, non-blocking) until the heuristic is
+* calibrated against several runs. Flip to error once false-positive rate
+* is verified low.
+*/
+const CATEGORY_MISSING_TRIGGER = "runtime-probe-missing-production-trigger";
+/**
+* Source-AC keywords that signal an event-driven implementation. Word-boundary
+* matched, case-insensitive. When any of these appears in source AC text AND
+* no probe's command invokes a known production trigger, the check emits a
+* `runtime-probe-missing-production-trigger` warn finding.
+*
+* Each keyword is paired with the trigger patterns that satisfy it:
+*   - `git hook` / `post-merge` / etc. → satisfied by `git merge|pull|push|commit|rebase`
+*   - `systemd` / `timer` / `unit` → satisfied by `systemctl ... start|enable|trigger`
+*   - `cron` / `crontab` / `schedule` → satisfied by `crontab|run-parts|schedule`
+*   - `signal` / `SIGHUP|SIGTERM|SIGUSR` → satisfied by `kill -<signal>`
+*   - `webhook` / `HTTP POST` / `endpoint` → satisfied by `curl ... -X POST` or wget
+*   - `inotify` / `path watch` → satisfied by `touch|mkdir|rm` (filesystem mutation)
+*/
+const EVENT_DRIVEN_KEYWORDS = [
+	/\b(?:git\s+hook|post-merge|post-commit|post-rewrite|pre-push|pre-commit|pre-merge-commit)\b/i,
+	/\b(?:systemd\s+(?:unit|service|timer|path)|systemctl|\.timer\b|\.service\b)\b/i,
+	/\b(?:cron\s*(?:job|tab|expression)?|crontab|scheduled\s+task)\b/i,
+	/\b(?:signal\s+handler|SIG(?:HUP|TERM|INT|USR1|USR2|KILL))\b/,
+	/\b(?:webhook|HTTP\s+(?:POST|GET)\s+endpoint|REST\s+endpoint)\b/i,
+	/\b(?:inotify|path\s+watch|file\s+watcher)\b/i
+];
+/**
+* Production-trigger command patterns. If ANY probe's command matches one of
+* these, the heuristic considers the trigger covered. Word-boundary matched.
+*/
+const TRIGGER_COMMAND_PATTERNS = [
+	/\bgit\s+(?:merge|pull|push|commit|rebase|cherry-pick)\b/,
+	/\bsystemctl\b/,
+	/\bcrontab\b|\brun-parts\b/,
+	/\bkill\s+-/,
+	/\bcurl\s+(?:[^|]*\s)?-X\s+(?:POST|GET|PUT|DELETE)/i,
+	/\bwget\s+--method=(?:POST|GET|PUT|DELETE)/i,
+	/\b(?:touch|mkdir|rm)\s+/
+];
+/**
+* Returns true if the source AC text mentions an event-driven mechanism.
+*/
+function detectsEventDrivenAC(sourceEpicContent) {
+	for (const pattern of EVENT_DRIVEN_KEYWORDS) if (pattern.test(sourceEpicContent)) return true;
+	return false;
+}
+/**
+* Returns true if any probe's command line invokes a known production trigger.
+*/
+function probesInvokeProductionTrigger(probes) {
+	for (const probe of probes) for (const pattern of TRIGGER_COMMAND_PATTERNS) if (pattern.test(probe.command)) return true;
+	return false;
+}
 const defaultExecutors = { host: (probe) => executeProbeOnHost(probe, { cwd: process.cwd() }) };
 var RuntimeProbeCheck = class {
 	name = "runtime-probes";
@@ -3797,6 +3861,13 @@ var RuntimeProbeCheck = class {
 			findings: []
 		};
 		const findings = [];
+		if (context.sourceEpicContent !== void 0) {
+			if (detectsEventDrivenAC(context.sourceEpicContent) && !probesInvokeProductionTrigger(parsed.probes)) findings.push({
+				category: CATEGORY_MISSING_TRIGGER,
+				severity: "warn",
+				message: "source AC describes an event-driven mechanism (hook / timer / signal / webhook) but no probe's command invokes a known production trigger (git merge/pull/push, systemctl, crontab, kill -<sig>, curl -X POST, etc.). Probes that call the implementation directly skip the wiring layer the AC's user-facing event would exercise — see strata Run 13 / Story 1-12 for the canonical case (post-merge hook never fires under git's conflict semantic). Authoring guidance: probes/event-driven section of create-story.md."
+			});
+		}
 		for (const probe of parsed.probes) {
 			if (probe.sandbox === "twin") {
 				findings.push({
@@ -5996,4 +6067,4 @@ function registerHealthCommand(program, _version = "0.0.0", projectRoot = proces
 
 //#endregion
 export { BMAD_BASELINE_TOKENS_FULL, DEFAULT_STALL_THRESHOLD_SECONDS, DoltMergeConflict, FileStateStore, FindingsInjector, RunManifest, STOP_AFTER_VALID_PHASES, STORY_KEY_PATTERN$1 as STORY_KEY_PATTERN, SUBSTRATE_OWNED_SETTINGS_KEYS, SupervisorLock, VALID_PHASES, WorkGraphRepository, ZERO_FINDING_COUNTS, __commonJS, __require, __toESM, applyConfigToGraph, buildPipelineStatusOutput, createDatabaseAdapter$1 as createDatabaseAdapter, createDefaultVerificationPipeline, createGraphOrchestrator, createSdlcCodeReviewHandler, createSdlcCreateStoryHandler, createSdlcDevStoryHandler, createSdlcPhaseHandler, createStateStore, detectCycles, extractTargetFilesFromStoryContent, findPackageRoot, formatOutput, formatPipelineStatusHuman, formatPipelineSummary, formatTokenTelemetry, getAllDescendantPids, getAutoHealthData, getSubstrateDefaultSettings, inspectProcessTree, isOrchestratorProcessLine, parseDbTimestampAsUtc, registerHealthCommand, renderFindings, resolveBmadMethodSrcPath, resolveBmadMethodVersion, resolveGraphPath, resolveMainRepoRoot, resolveRunManifest, rollupFindingCounts, runHealthAction, validateStoryKey };
-//# sourceMappingURL=health-0_axmI2t.js.map
+//# sourceMappingURL=health-Dx9hm9x1.js.map

package/dist/{run-DQcG05Ar.js → run-BmRu588B.js}

@@ -1,4 +1,4 @@
-import { BMAD_BASELINE_TOKENS_FULL, DoltMergeConflict, FileStateStore, FindingsInjector, RunManifest, STOP_AFTER_VALID_PHASES, STORY_KEY_PATTERN, VALID_PHASES, WorkGraphRepository, __commonJS, __require, __toESM, applyConfigToGraph, buildPipelineStatusOutput, createDatabaseAdapter, createDefaultVerificationPipeline, createGraphOrchestrator, createSdlcCodeReviewHandler, createSdlcCreateStoryHandler, createSdlcDevStoryHandler, createSdlcPhaseHandler, detectCycles, extractTargetFilesFromStoryContent, formatOutput, formatPipelineSummary, formatTokenTelemetry, inspectProcessTree, parseDbTimestampAsUtc, renderFindings, resolveGraphPath, resolveMainRepoRoot, validateStoryKey } from "./health-0_axmI2t.js";
+import { BMAD_BASELINE_TOKENS_FULL, DoltMergeConflict, FileStateStore, FindingsInjector, RunManifest, STOP_AFTER_VALID_PHASES, STORY_KEY_PATTERN, VALID_PHASES, WorkGraphRepository, __commonJS, __require, __toESM, applyConfigToGraph, buildPipelineStatusOutput, createDatabaseAdapter, createDefaultVerificationPipeline, createGraphOrchestrator, createSdlcCodeReviewHandler, createSdlcCreateStoryHandler, createSdlcDevStoryHandler, createSdlcPhaseHandler, detectCycles, extractTargetFilesFromStoryContent, formatOutput, formatPipelineSummary, formatTokenTelemetry, inspectProcessTree, parseDbTimestampAsUtc, renderFindings, resolveGraphPath, resolveMainRepoRoot, validateStoryKey } from "./health-Dx9hm9x1.js";
 import { createLogger } from "./logger-KeHncl-f.js";
 import { TypedEventBusImpl, createEventBus, createTuiApp, isTuiCapable, printNonTtyWarning, sleep } from "./helpers-CElYrONe.js";
 import { ADVISORY_NOTES, Categorizer, ConsumerAnalyzer, DEFAULT_GLOBAL_SETTINGS, DispatcherImpl, DoltClient, ESCALATION_DIAGNOSIS, EXPERIMENT_RESULT, EfficiencyScorer, IngestionServer, LogTurnAnalyzer, OPERATIONAL_FINDING, Recommender, RoutingRecommender, RoutingResolver, RoutingTelemetry, RoutingTokenAccumulator, RoutingTuner, STORY_METRICS, STORY_OUTCOME, SubstrateConfigSchema, TEST_EXPANSION_FINDING, TEST_PLAN, TelemetryNormalizer, TelemetryPipeline, TurnAnalyzer, addTokenUsage, aggregateTokenUsageForRun, aggregateTokenUsageForStory, callLLM, createConfigSystem, createDatabaseAdapter$1, createDecision, createPipelineRun, createRequirement, detectInterfaceChanges, getArtifactByTypeForRun, getArtifactsByRun, getDecisionsByCategory, getDecisionsByPhase, getDecisionsByPhaseForRun, getLatestRun, getPipelineRunById, getRunMetrics, getRunningPipelineRuns, getStoryMetricsForRun, getTokenUsageSummary, initSchema, listRequirements, loadModelRoutingConfig, registerArtifact, updatePipelineRun, updatePipelineRunConfig, upsertDecision, writeRunMetrics, writeStoryMetrics } from "./dist-CqtWS9wF.js";
@@ -44488,4 +44488,4 @@ function registerRunCommand(program, _version = "0.0.0", projectRoot = process.c
 
 //#endregion
 export { AdapterTelemetryPersistence, AppError, DoltRepoMapMetaRepository, DoltSymbolRepository, ERR_REPO_MAP_STORAGE_WRITE, EpicIngester, GitClient, GrammarLoader, RepoMapInjector, RepoMapModule, RepoMapQueryEngine, RepoMapStorage, SymbolParser, createContextCompiler, createDispatcher, createEventEmitter, createImplementationOrchestrator, createPackLoader, createPhaseOrchestrator, createStopAfterGate, createTelemetryAdvisor, formatPhaseCompletionSummary, getFactoryRunSummaries, getScenarioResultsForRun, getTwinRunsForRun, listGraphRuns, normalizeGraphSummaryToStatus, registerExportCommand, registerFactoryCommand, registerRunCommand, registerScenariosCommand, resolveMaxReviewCycles, resolveStoryKeys, runAnalysisPhase, runPlanningPhase, runRunAction, runSolutioningPhase, validateStopAfterFromConflict, wireNdjsonEmitter };
-//# sourceMappingURL=run-DQcG05Ar.js.map
+//# sourceMappingURL=run-BmRu588B.js.map

package/dist/{run-DQ29oNG2.js → run-CV3EAUZK.js}

@@ -1,8 +1,8 @@
-import "./health-0_axmI2t.js";
+import "./health-Dx9hm9x1.js";
 import "./logger-KeHncl-f.js";
 import "./helpers-CElYrONe.js";
 import "./dist-CqtWS9wF.js";
-import { normalizeGraphSummaryToStatus, registerRunCommand, resolveMaxReviewCycles, runRunAction, wireNdjsonEmitter } from "./run-DQcG05Ar.js";
+import { normalizeGraphSummaryToStatus, registerRunCommand, resolveMaxReviewCycles, runRunAction, wireNdjsonEmitter } from "./run-BmRu588B.js";
 import "./routing-CcBOCuC9.js";
 import "./decisions-C0pz9Clx.js";
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "substrate-ai",
-  "version": "0.20.27",
+  "version": "0.20.28",
   "description": "Substrate — multi-agent orchestration daemon for AI coding agents",
   "type": "module",
   "license": "MIT",

package/packs/bmad/prompts/create-story.md

@@ -158,6 +158,54 @@ Exit-code success is necessary but **not sufficient** for probes calling tools t
 
 Patterns are JavaScript regex (`new RegExp`). Evaluated only when exit code is 0; non-zero exits emit `runtime-probe-fail` and assertions are skipped to avoid redundant findings.
 
+### Probes for event-driven mechanisms must invoke the production trigger
+
+When the source AC describes a hook, timer, signal, webhook, or other event-driven mechanism, the probe MUST invoke the **production trigger** that fires the implementation in real usage — NOT call the implementation script directly. Calling the implementation directly verifies it produces correct outputs given synthetic inputs; it does NOT verify the implementation is wired to the right trigger and will actually fire when the AC's user-facing event occurs.
+
+Strata Run 13 (Story 1-12, post-merge git hook) shipped SHIP_IT after the dev's probe ran the resolver script directly with conflict-marker fixtures. The resolver was correct; the wiring was not. `git`'s `post-merge` hook is **not executed when a merge fails due to conflicts** (per `githooks(5)`) — and the AC's whole point was conflict resolution. The hook never fired in production. Direct invocation hid this entirely.
+
+**Rule**: if the AC describes "when X happens, Y runs", the probe must MAKE X HAPPEN and assert Y ran. Synthesized inputs to Y skip the wiring layer.
+
+| AC describes | Production trigger to invoke | Common wrong shape (DO NOT use) |
+|---|---|---|
+| `post-merge` / `post-commit` / `post-rewrite` git hook | `git merge <branch>` (with the conflict scenario the AC describes) | `bash .git/hooks/post-merge` |
+| `pre-push` git hook | `git push` against a local fixture remote | `bash .git/hooks/pre-push` |
+| systemd unit / timer | `systemctl --user start <unit>` or `systemctl --user start <timer>.timer` then assert `<unit>.service` ran | direct call to the binary the unit invokes |
+| systemd path / inotify trigger | touch / create / modify the watched path; assert the unit fires within N seconds | direct call to the script |
+| cron job | invoke `crontab` to install + run-once via `run-parts` OR shorten the schedule to `* * * * *` and wait | direct call to the script |
+| Signal handler | `kill -<SIGNAL> <pid>` against the running process | direct call to the handler function |
+| Webhook receiver | `curl -X POST <endpoint>` with the actual payload shape | direct call to the handler with synthetic payload |
+
+**Example: post-merge hook probe (the strata 1-12 case, fixed)**
+
+```yaml
+- name: post-merge-hook-fires-and-resolves-conflict
+  sandbox: twin
+  command: |
+    set -e
+    REPO=$(mktemp -d)
+    cd "$REPO" && git init -q
+    git config user.email t@example.com && git config user.name test
+    bash <REPO_ROOT>/hooks/install-vault-hooks.sh "$REPO"
+    echo "human content" > note.md && git add . && git commit -qm initial
+    git checkout -qb branch-jarvis
+    GIT_AUTHOR_NAME=jarvis-bot GIT_AUTHOR_EMAIL=jarvis@bot \
+      bash -c 'echo "jarvis content" > note.md && git commit -aqm "jarvis edit"'
+    git checkout -q main
+    echo "human content edit" > note.md && git commit -aqm "human edit"
+    git merge --no-edit branch-jarvis || true   # produces conflict
+    # If post-merge fired correctly via the production trigger, the conflict is resolved.
+    # If it did NOT fire (because it can't, by design — see githooks(5)), the working
+    # tree still has conflict markers and this assertion catches it.
+  expect_stdout_no_regex:
+    - '<{7}|>{7}'   # conflict markers must NOT remain in tree after resolution
+  expect_stdout_regex:
+    - 'human content'   # human side preserved per "Jarvis yields to human" rule
+  description: real git merge fires (or fails to fire) post-merge — assertion catches both
+```
+
+Note this example, taken to production, would have caught the strata 1-12 bug at runtime-probe phase rather than only at e2e smoke pass. That's the standard 60-10 sets.
+
 ### Examples by artifact class
 
 **Systemd unit:**