substrate-ai 0.20.48 → 0.20.50

package/dist/cli/index.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
-import { FileStateStore, RunManifest, SUBSTRATE_OWNED_SETTINGS_KEYS, SupervisorLock, VALID_PHASES, WorkGraphRepository, ZERO_FINDINGS_BY_AUTHOR, ZERO_FINDING_COUNTS, ZERO_PROBE_AUTHOR_METRICS, aggregateProbeAuthorMetrics, buildPipelineStatusOutput, createDatabaseAdapter, createStateStore, findPackageRoot, formatOutput, formatPipelineStatusHuman, formatPipelineSummary, formatTokenTelemetry, getAllDescendantPids, getAutoHealthData, getSubstrateDefaultSettings, inspectProcessTree, parseDbTimestampAsUtc, parseRuntimeProbes, registerHealthCommand, resolveBmadMethodSrcPath, resolveBmadMethodVersion, resolveMainRepoRoot, resolveRunManifest, rollupFindingCounts, rollupFindingsByAuthor, rollupProbeAuthorMetrics } from "../health-BV-rzjf7.js";
+import { FileStateStore, RunManifest, SUBSTRATE_OWNED_SETTINGS_KEYS, SupervisorLock, VALID_PHASES, WorkGraphRepository, ZERO_FINDINGS_BY_AUTHOR, ZERO_FINDING_COUNTS, ZERO_PROBE_AUTHOR_METRICS, aggregateProbeAuthorMetrics, buildPipelineStatusOutput, createDatabaseAdapter, createStateStore, findPackageRoot, formatOutput, formatPipelineStatusHuman, formatPipelineSummary, formatTokenTelemetry, getAllDescendantPids, getAutoHealthData, getSubstrateDefaultSettings, inspectProcessTree, parseDbTimestampAsUtc, parseRuntimeProbes, registerHealthCommand, resolveBmadMethodSrcPath, resolveBmadMethodVersion, resolveMainRepoRoot, resolveRunManifest, rollupFindingCounts, rollupFindingsByAuthor, rollupProbeAuthorMetrics } from "../health-sQ1X_5_6.js";
 import { createLogger } from "../logger-KeHncl-f.js";
 import { createEventBus } from "../helpers-CElYrONe.js";
 import { AdapterRegistry, BudgetConfigSchema, CURRENT_CONFIG_FORMAT_VERSION, CURRENT_TASK_GRAPH_VERSION, ConfigError, CostTrackerConfigSchema, DEFAULT_CONFIG, DoltClient, DoltNotInstalled, GlobalSettingsSchema, InMemoryDatabaseAdapter, IngestionServer, MonitorDatabaseImpl, OPERATIONAL_FINDING, PartialGlobalSettingsSchema, PartialProviderConfigSchema, ProvidersSchema, RoutingRecommender, STORY_METRICS, TelemetryConfigSchema, addTokenUsage, aggregateTokenUsageForRun, checkDoltInstalled, compareRunMetrics, createAmendmentRun, createConfigSystem, createDecision, createDoltClient, createPipelineRun, getActiveDecisions, getAllCostEntriesFiltered, getBaselineRunMetrics, getDecisionsByCategory, getDecisionsByPhaseForRun, getLatestCompletedRun, getLatestRun, getPipelineRunById, getPlanningCostTotal, getRetryableEscalations, getRunMetrics, getRunningPipelineRuns, getSessionCostSummary, getSessionCostSummaryFiltered, getStoryMetricsForRun, getTokenUsageSummary, incrementRunRestarts, initSchema, initializeDolt, listRunMetrics, loadParentRunDecisions, supersedeDecision, tagRunAsBaseline, updatePipelineRun } from "../dist-VcMmfo2w.js";
 import "../adapter-registry-DXLMTmfD.js";
-import { AdapterTelemetryPersistence, AppError, DoltRepoMapMetaRepository, DoltSymbolRepository, ERR_REPO_MAP_STORAGE_WRITE, EpicIngester, GitClient, GrammarLoader, RepoMapInjector, RepoMapModule, RepoMapQueryEngine, RepoMapStorage, SymbolParser, createContextCompiler, createDispatcher, createEventEmitter, createImplementationOrchestrator, createPackLoader, createPhaseOrchestrator, createStopAfterGate, createTelemetryAdvisor, formatPhaseCompletionSummary, getFactoryRunSummaries, getScenarioResultsForRun, getTwinRunsForRun, listGraphRuns, registerExportCommand, registerFactoryCommand, registerRunCommand, registerScenariosCommand, resolveStoryKeys, runAnalysisPhase, runPlanningPhase, runProbeAuthor, runSolutioningPhase, validateStopAfterFromConflict } from "../run-Cdu2K3tg.js";
+import { AdapterTelemetryPersistence, AppError, DoltRepoMapMetaRepository, DoltSymbolRepository, ERR_REPO_MAP_STORAGE_WRITE, EpicIngester, GitClient, GrammarLoader, RepoMapInjector, RepoMapModule, RepoMapQueryEngine, RepoMapStorage, SymbolParser, createContextCompiler, createDispatcher, createEventEmitter, createImplementationOrchestrator, createPackLoader, createPhaseOrchestrator, createStopAfterGate, createTelemetryAdvisor, formatPhaseCompletionSummary, getFactoryRunSummaries, getScenarioResultsForRun, getTwinRunsForRun, listGraphRuns, registerExportCommand, registerFactoryCommand, registerRunCommand, registerScenariosCommand, resolveStoryKeys, runAnalysisPhase, runPlanningPhase, runProbeAuthor, runSolutioningPhase, validateStopAfterFromConflict } from "../run-CFRXRuRO.js";
 import "../errors-CogpxBUg.js";
 import "../routing-CcBOCuC9.js";
 import "../decisions-C0pz9Clx.js";
@@ -3667,7 +3667,7 @@ async function runStatusAction(options) {
 			logger$13.debug({ err }, "Work graph query failed, continuing without work graph data");
 		}
 		if (run === void 0) {
-			const { inspectProcessTree: inspectProcessTree$1 } = await import("../health-DQrsmYTt.js");
+			const { inspectProcessTree: inspectProcessTree$1 } = await import("../health-BQ5dj53s.js");
 			const substrateDirPath = join(projectRoot, ".substrate");
 			const processInfo = inspectProcessTree$1({
 				projectRoot,
@@ -5204,7 +5204,7 @@ async function runSupervisorAction(options, deps = {}) {
 								await initSchema(expAdapter);
 								const { runRunAction: runPipeline } = await import(
 									/* @vite-ignore */
-									"../run-syUfEHEq.js"
+									"../run-C6jy25us.js"
 );
 								const runStoryFn = async (opts) => {
 									const exitCode = await runPipeline({

package/dist/{health-DQrsmYTt.js → health-BQ5dj53s.js}

@@ -1,4 +1,4 @@
-import { DEFAULT_STALL_THRESHOLD_SECONDS, getAllDescendantPids, getAutoHealthData, inspectProcessTree, isOrchestratorProcessLine, registerHealthCommand, runHealthAction } from "./health-BV-rzjf7.js";
+import { DEFAULT_STALL_THRESHOLD_SECONDS, getAllDescendantPids, getAutoHealthData, inspectProcessTree, isOrchestratorProcessLine, registerHealthCommand, runHealthAction } from "./health-sQ1X_5_6.js";
 import "./logger-KeHncl-f.js";
 import "./dist-VcMmfo2w.js";
 import "./decisions-C0pz9Clx.js";

package/dist/{health-BV-rzjf7.js → health-sQ1X_5_6.js}

@@ -4135,6 +4135,101 @@ function detectsEventDrivenAC(sourceEpicContent) {
 	return false;
 }
 /**
+* Source-AC keywords that signal a state-integrating implementation. The six
+* categories — subprocess, filesystem, git, database, network, registry —
+* mirror the behavioral-signal enumeration in the create-story.md prompt
+* (Phase 1, v0.20.42, obs_2026-05-01_017 hotfix).
+*
+* Code identifiers are case-sensitive (e.g., `execSync(`, `Dolt`).
+* Natural-language phrases are case-insensitive (e.g., "reads from disk").
+*
+* Used by `detectsStateIntegratingAC` to gate probe-author dispatch for
+* state-integrating stories whose ACs do NOT use event-driven phrasing
+* (hooks, timers, signals, webhooks). Coexists with `EVENT_DRIVEN_KEYWORDS`:
+* ACs matching both heuristics trigger a single probe-author dispatch.
+*/
+const STATE_INTEGRATING_KEYWORDS = [
+	/\bexecSync\(/,
+	/\bspawn\(/,
+	/\bexec\(/,
+	/\bchild_process\b/,
+	/\bspawns\b/i,
+	/\binvokes?\b/i,
+	/\bfs\.read/,
+	/\bfs\.write/,
+	/\breadFile\b/,
+	/\bwriteFile\b/,
+	/\bpath\.join\b/,
+	/\bhomedir\(\)/,
+	/\bos\.homedir\(\)/,
+	/\breads?\s+from\s+disk\b/i,
+	/\bwrites?\s+to\s+disk\b/i,
+	/\bscans?\s+(?:the\s+)?filesystem\b/i,
+	/\bgit\s+log\b/,
+	/\bgit\s+push\b/,
+	/\bgit\s+pull\b/,
+	/\bgit\s+merge\b/,
+	/\bqueries?\s+git\b/i,
+	/\bruns?\s+git\b/i,
+	/\bDolt\b/,
+	/\bmysql\b/i,
+	/\bpg\b/,
+	/\bsqlite\b/i,
+	/\bINSERT\b/,
+	/\bSELECT\b/,
+	/\bqueries?\s+the\s+database\b/i,
+	/\bwrites?\s+to\s+[Dd]olt\b/,
+	/\bfetch\(/,
+	/\baxios\b/i,
+	/\bhttp\.get\(/,
+	/\bhttps\.get\(/,
+	/\bfetches?\b/i,
+	/\bPOSTs?\s+to\b/i,
+	/\bcalls?\s+the\s+API\b/i,
+	/\bqueries?\s+(?:the\s+)?registry\b/i,
+	/\bscans?\s+(?:the\s+)?registry\b/i
+];
+/** Phrases that indicate a keyword match is in a mock/stub context (not real state). */
+const MOCK_QUALIFIER_PHRASES = [
+	"mocks the",
+	"stubs the",
+	"mock ",
+	"stub "
+];
+/**
+* Returns true when a line contains a mock/stub qualifier, indicating the
+* keyword match is in a test-double context rather than production state.
+*/
+function lineHasMockQualifier(line) {
+	const lower = line.toLowerCase();
+	return MOCK_QUALIFIER_PHRASES.some((phrase) => lower.includes(phrase));
+}
+/**
+* Returns true if the source AC text mentions a state-integrating operation:
+* subprocess, filesystem, git, database, network, or registry interaction.
+*
+* Exported for use by probe-author-integration.ts (Story 65-1) so the
+* orchestrator can gate probe-author dispatch on the same heuristic.
+*
+* Mock guard (AC #4): scans each matching line for mock/stub qualifiers
+* ("mocks the", "stubs the", "mock ", "stub "). If every match is in a
+* mock context, returns false — ground truth is whether the production
+* code path hits real state. If any match is NOT in a mock context,
+* returns true.
+*
+* Coexists with `detectsEventDrivenAC` (Story 60-11): when an AC matches
+* both heuristics, the orchestrator dispatches probe-author once (dispatch
+* gate uses `||`). No double-dispatch.
+*/
+function detectsStateIntegratingAC(sourceContent) {
+	const lines = sourceContent.split("\n");
+	for (const line of lines) {
+		const hasKeyword = STATE_INTEGRATING_KEYWORDS.some((p) => p.test(line));
+		if (hasKeyword && !lineHasMockQualifier(line)) return true;
+	}
+	return false;
+}
+/**
 * Returns true if any probe's command line invokes a known production trigger.
 */
 function probesInvokeProductionTrigger(probes) {
@@ -6779,5 +6874,5 @@ function registerHealthCommand(program, _version = "0.0.0", projectRoot = proces
 }
 
 //#endregion
-export { BMAD_BASELINE_TOKENS_FULL, DEFAULT_STALL_THRESHOLD_SECONDS, DoltMergeConflict, FileStateStore, FindingsInjector, RunManifest, RuntimeProbeListSchema, STOP_AFTER_VALID_PHASES, STORY_KEY_PATTERN$1 as STORY_KEY_PATTERN, SUBSTRATE_OWNED_SETTINGS_KEYS, SupervisorLock, VALID_PHASES, WorkGraphRepository, ZERO_FINDINGS_BY_AUTHOR, ZERO_FINDING_COUNTS, ZERO_PROBE_AUTHOR_METRICS, __commonJS, __require, __toESM, aggregateProbeAuthorMetrics, applyConfigToGraph, buildPipelineStatusOutput, createDatabaseAdapter$1 as createDatabaseAdapter, createDefaultVerificationPipeline, createGraphOrchestrator, createSdlcCodeReviewHandler, createSdlcCreateStoryHandler, createSdlcDevStoryHandler, createSdlcPhaseHandler, createStateStore, detectCycles, detectsEventDrivenAC, extractTargetFilesFromStoryContent, findPackageRoot, formatOutput, formatPipelineStatusHuman, formatPipelineSummary, formatTokenTelemetry, getAllDescendantPids, getAutoHealthData, getSubstrateDefaultSettings, inspectProcessTree, isOrchestratorProcessLine, parseDbTimestampAsUtc, parseRuntimeProbes, registerHealthCommand, renderFindings, resolveBmadMethodSrcPath, resolveBmadMethodVersion, resolveGraphPath, resolveMainRepoRoot, resolveRunManifest, rollupFindingCounts, rollupFindingsByAuthor, rollupProbeAuthorMetrics, runHealthAction, validateStoryKey };
-//# sourceMappingURL=health-BV-rzjf7.js.map
+export { BMAD_BASELINE_TOKENS_FULL, DEFAULT_STALL_THRESHOLD_SECONDS, DoltMergeConflict, FileStateStore, FindingsInjector, RunManifest, RuntimeProbeListSchema, STOP_AFTER_VALID_PHASES, STORY_KEY_PATTERN$1 as STORY_KEY_PATTERN, SUBSTRATE_OWNED_SETTINGS_KEYS, SupervisorLock, VALID_PHASES, WorkGraphRepository, ZERO_FINDINGS_BY_AUTHOR, ZERO_FINDING_COUNTS, ZERO_PROBE_AUTHOR_METRICS, __commonJS, __require, __toESM, aggregateProbeAuthorMetrics, applyConfigToGraph, buildPipelineStatusOutput, createDatabaseAdapter$1 as createDatabaseAdapter, createDefaultVerificationPipeline, createGraphOrchestrator, createSdlcCodeReviewHandler, createSdlcCreateStoryHandler, createSdlcDevStoryHandler, createSdlcPhaseHandler, createStateStore, detectCycles, detectsEventDrivenAC, detectsStateIntegratingAC, extractTargetFilesFromStoryContent, findPackageRoot, formatOutput, formatPipelineStatusHuman, formatPipelineSummary, formatTokenTelemetry, getAllDescendantPids, getAutoHealthData, getSubstrateDefaultSettings, inspectProcessTree, isOrchestratorProcessLine, parseDbTimestampAsUtc, parseRuntimeProbes, registerHealthCommand, renderFindings, resolveBmadMethodSrcPath, resolveBmadMethodVersion, resolveGraphPath, resolveMainRepoRoot, resolveRunManifest, rollupFindingCounts, rollupFindingsByAuthor, rollupProbeAuthorMetrics, runHealthAction, validateStoryKey };
+//# sourceMappingURL=health-sQ1X_5_6.js.map

package/dist/{run-syUfEHEq.js → run-C6jy25us.js}

@@ -1,8 +1,8 @@
-import "./health-BV-rzjf7.js";
+import "./health-sQ1X_5_6.js";
 import "./logger-KeHncl-f.js";
 import "./helpers-CElYrONe.js";
 import "./dist-VcMmfo2w.js";
-import { normalizeGraphSummaryToStatus, registerRunCommand, resolveMaxReviewCycles, runRunAction, wireNdjsonEmitter } from "./run-Cdu2K3tg.js";
+import { normalizeGraphSummaryToStatus, registerRunCommand, resolveMaxReviewCycles, runRunAction, wireNdjsonEmitter } from "./run-CFRXRuRO.js";
 import "./routing-CcBOCuC9.js";
 import "./decisions-C0pz9Clx.js";
 

package/dist/{run-Cdu2K3tg.js → run-CFRXRuRO.js}

@@ -1,4 +1,4 @@
-import { BMAD_BASELINE_TOKENS_FULL, DoltMergeConflict, FileStateStore, FindingsInjector, RunManifest, RuntimeProbeListSchema, STOP_AFTER_VALID_PHASES, STORY_KEY_PATTERN, VALID_PHASES, WorkGraphRepository, __commonJS, __require, __toESM, applyConfigToGraph, buildPipelineStatusOutput, createDatabaseAdapter, createDefaultVerificationPipeline, createGraphOrchestrator, createSdlcCodeReviewHandler, createSdlcCreateStoryHandler, createSdlcDevStoryHandler, createSdlcPhaseHandler, detectCycles, detectsEventDrivenAC, extractTargetFilesFromStoryContent, formatOutput, formatPipelineSummary, formatTokenTelemetry, inspectProcessTree, parseDbTimestampAsUtc, renderFindings, resolveGraphPath, resolveMainRepoRoot, validateStoryKey } from "./health-BV-rzjf7.js";
+import { BMAD_BASELINE_TOKENS_FULL, DoltMergeConflict, FileStateStore, FindingsInjector, RunManifest, RuntimeProbeListSchema, STOP_AFTER_VALID_PHASES, STORY_KEY_PATTERN, VALID_PHASES, WorkGraphRepository, __commonJS, __require, __toESM, applyConfigToGraph, buildPipelineStatusOutput, createDatabaseAdapter, createDefaultVerificationPipeline, createGraphOrchestrator, createSdlcCodeReviewHandler, createSdlcCreateStoryHandler, createSdlcDevStoryHandler, createSdlcPhaseHandler, detectCycles, detectsEventDrivenAC, detectsStateIntegratingAC, extractTargetFilesFromStoryContent, formatOutput, formatPipelineSummary, formatTokenTelemetry, inspectProcessTree, parseDbTimestampAsUtc, renderFindings, resolveGraphPath, resolveMainRepoRoot, validateStoryKey } from "./health-sQ1X_5_6.js";
 import { createLogger } from "./logger-KeHncl-f.js";
 import { TypedEventBusImpl, createEventBus, createTuiApp, isTuiCapable, printNonTtyWarning, sleep } from "./helpers-CElYrONe.js";
 import { ADVISORY_NOTES, Categorizer, ConsumerAnalyzer, DEFAULT_GLOBAL_SETTINGS, DispatcherImpl, DoltClient, ESCALATION_DIAGNOSIS, EXPERIMENT_RESULT, EfficiencyScorer, IngestionServer, LogTurnAnalyzer, OPERATIONAL_FINDING, Recommender, RoutingRecommender, RoutingResolver, RoutingTelemetry, RoutingTokenAccumulator, RoutingTuner, STORY_METRICS, STORY_OUTCOME, SubstrateConfigSchema, TEST_EXPANSION_FINDING, TEST_PLAN, TelemetryNormalizer, TelemetryPipeline, TurnAnalyzer, addTokenUsage, aggregateTokenUsageForRun, aggregateTokenUsageForStory, callLLM, createConfigSystem, createDatabaseAdapter$1, createDecision, createPipelineRun, createRequirement, detectInterfaceChanges, getArtifactByTypeForRun, getArtifactsByRun, getDecisionsByCategory, getDecisionsByPhase, getDecisionsByPhaseForRun, getLatestRun, getPipelineRunById, getRunMetrics, getRunningPipelineRuns, getStoryMetricsForRun, getTokenUsageSummary, initSchema, listRequirements, loadModelRoutingConfig, registerArtifact, updatePipelineRun, updatePipelineRunConfig, upsertDecision, writeRunMetrics, writeStoryMetrics } from "./dist-VcMmfo2w.js";
@@ -8412,8 +8412,11 @@ const TIMEOUT_RETRY_MULTIPLIER = 1.5;
 /**
 * Execute the probe-author integration phase.
 *
-* Gate 1 — Event-driven AC check: calls `detectsEventDrivenAC(epicContent)`.
-*   Skip if the source AC does not describe a hook, timer, signal, or webhook.
+* Gate 1 — Event-driven or state-integrating AC check: calls
+*   `detectsEventDrivenAC(epicContent)` and `detectsStateIntegratingAC(epicContent)`
+*   (Story 65-1). Skip if the source AC describes neither an event-driven
+*   mechanism (hook, timer, signal, webhook) nor a state-integrating operation
+*   (subprocess, filesystem, git, database, network, registry).
 *
 * Gate 2 — Idempotency check: reads storyFilePath and checks for an existing
 *   `## Runtime Probes` section. Skip if present (probes already authored).
@@ -8440,8 +8443,8 @@ async function runProbeAuthor(deps, params) {
 		input: 0,
 		output: 0
 	};
-	if (bypassGates !== true && !detectsEventDrivenAC(epicContent)) {
-		logger$14.debug({ storyKey }, "probe-author: source AC not event-driven — skipping");
+	if (bypassGates !== true && !detectsEventDrivenAC(epicContent) && !detectsStateIntegratingAC(epicContent)) {
+		logger$14.debug({ storyKey }, "probe-author: source AC neither event-driven nor state-integrating — skipping");
 		emitEvent?.("probe-author:skipped", {
 			storyKey,
 			runId: pipelineRunId,
@@ -13443,7 +13446,7 @@ function createImplementationOrchestrator(deps) {
 				const section = extractStorySection(epicFull, storyKey);
 				probeAuthorEpicContent = section ?? epicFull;
 			} catch {}
-			if (detectsEventDrivenAC(probeAuthorEpicContent)) {
+			if (detectsEventDrivenAC(probeAuthorEpicContent) || detectsStateIntegratingAC(probeAuthorEpicContent)) {
 				let artifactHasProbes = false;
 				try {
 					const artifactContent = readFileSync(storyFilePath, "utf-8");
@@ -45366,4 +45369,4 @@ function registerRunCommand(program, _version = "0.0.0", projectRoot = process.c
 
 //#endregion
 export { AdapterTelemetryPersistence, AppError, DoltRepoMapMetaRepository, DoltSymbolRepository, ERR_REPO_MAP_STORAGE_WRITE, EpicIngester, GitClient, GrammarLoader, RepoMapInjector, RepoMapModule, RepoMapQueryEngine, RepoMapStorage, SymbolParser, createContextCompiler, createDispatcher, createEventEmitter, createImplementationOrchestrator, createPackLoader, createPhaseOrchestrator, createStopAfterGate, createTelemetryAdvisor, formatPhaseCompletionSummary, getFactoryRunSummaries, getScenarioResultsForRun, getTwinRunsForRun, listGraphRuns, normalizeGraphSummaryToStatus, registerExportCommand, registerFactoryCommand, registerRunCommand, registerScenariosCommand, resolveMaxReviewCycles, resolveStoryKeys, runAnalysisPhase, runPlanningPhase, runProbeAuthor, runRunAction, runSolutioningPhase, validateStopAfterFromConflict, wireNdjsonEmitter };
-//# sourceMappingURL=run-Cdu2K3tg.js.map
+//# sourceMappingURL=run-CFRXRuRO.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "substrate-ai",
-  "version": "0.20.48",
+  "version": "0.20.50",
   "description": "Substrate — multi-agent orchestration daemon for AI coding agents",
   "type": "module",
   "license": "MIT",

package/packs/bmad/eval/probe-author-state-integrating-corpus.yaml

@@ -0,0 +1,312 @@
+##
+# Probe-Author State-Integrating Defect Corpus
+#
+# Version: v1 (2026-05-03)
+# Substrate version when corpus authored: v0.20.49
+#
+# Purpose: Oracle for the state-integrating eval harness
+# (Story 65-3, scripts/eval-probe-author-state-integrating.mjs).
+# Each entry documents a defect class where the broken implementation
+# reads/writes/queries external state incorrectly. The eval dispatches
+# probe-author against each entry's source_ac and asserts that the
+# authored probe's shape matches the entry's signature regexes.
+#
+# Schema (each applicable_entries item):
+#   id                    — unique kebab-label
+#   story_key             — optional; reference only
+#   description           — one-line human label
+#   source_ac             — AC text sent to probe-author
+#   broken_implementation — what the broken impl does
+#   real_state_condition  — the real-state condition that breaks it
+#   signature             — non-empty list of regex strings; ALL must
+#                           match JSON.stringify(probe) for ANY probe
+#   mock_authored_probes  — ≥1 probe; used in --dry-run mode
+##
+
+applicable_entries:
+  - id: entry-1-obs017-git-log-wrong-cwd
+    story_key: '2-4'
+    description: git log called with cwd=fleetRoot instead of per-project directory
+    source_ac: |
+      For each project repository in the fleet, the morning briefing generator
+      reads the most recent 10 commits authored in the last 24 hours using
+      `git log --since=24h --format="%H %s" --no-merges`. Attribution must be
+      per-project: commits from repository A must not appear in the briefing
+      for repository B. The implementation invokes `git log` with the correct
+      `cwd` set to each project's root directory.
+    broken_implementation: |
+      fetchGitLog() calls `execSync('git log ...', { cwd: fleetRoot })` where
+      fleetRoot is the top-level directory containing all project subdirectories.
+      All commits from all repos are attributed to every project, causing
+      cross-project commit leakage.
+    real_state_condition: |
+      Two or more git repositories exist as sibling directories under a common
+      parent. Each repo has distinct commits. The broken implementation returns
+      all commits regardless of which project directory is requested.
+    signature:
+      - 'git\s+log'
+      - 'alpha|beta|fleet|project.?[AB]|repo.?[12]|tmpdir|mkdtemp'
+    mock_authored_probes:
+      - name: per-project-git-log-attribution
+        sandbox: host
+        command: |
+          # Create two sibling repos with distinct commits
+          PARENT=$(mktemp -d)
+          mkdir -p "$PARENT/repo-alpha" "$PARENT/repo-beta"
+          cd "$PARENT/repo-alpha" && git init && git config user.email "t@t" && git config user.name "T"
+          echo "alpha" > a.txt && git add . && git commit -m "alpha commit"
+          cd "$PARENT/repo-beta" && git init && git config user.email "t@t" && git config user.name "T"
+          echo "beta" > b.txt && git add . && git commit -m "beta commit"
+          # Probe: verify git log is called per-project, not for the fleet root
+          # Run git log for repo-alpha and confirm only alpha commits appear
+          OUTPUT=$(cd "$PARENT/repo-alpha" && git log --format="%s" 2>&1)
+          echo "$OUTPUT"
+          echo "$OUTPUT" | grep -q "alpha commit" && echo "alpha-found" || echo "alpha-missing"
+          echo "$OUTPUT" | grep -q "beta commit" && echo "beta-found" || echo "beta-missing"
+        expect_stdout_regex:
+          - 'alpha-found'
+        expect_stdout_no_regex:
+          - 'beta-found'
+
+  - id: entry-2-subprocess-synthesized-vs-real
+    story_key: '2-5'
+    description: npm outdated called with mocked input instead of real subprocess
+    source_ac: |
+      The dependency staleness checker invokes `npm outdated --json` as a real
+      subprocess in the project directory. The output JSON is parsed to identify
+      packages where the `current` version is behind `wanted` or `latest`. The
+      implementation must NOT use cached or synthetic data; it must invoke npm
+      as an external process each time.
+    broken_implementation: |
+      runDependencyCheck() returns a hardcoded JSON fixture `{ "lodash": { "current":
+      "4.17.20", "wanted": "4.17.21", "latest": "4.17.21" } }` instead of
+      spawning a real npm process. Tests pass but the feature silently shows
+      stale data in production.
+    real_state_condition: |
+      A real npm project directory with a package.json exists on disk. The
+      real npm outdated output differs from the hardcoded fixture (either
+      empty or different packages).
+    signature:
+      - 'npm\s+outdated'
+      - 'current|wanted|latest|outdated'
+    mock_authored_probes:
+      - name: npm-outdated-real-subprocess
+        sandbox: host
+        command: |
+          # Create a minimal npm project
+          TMPDIR=$(mktemp -d)
+          cd "$TMPDIR"
+          echo '{"name":"probe-test","version":"1.0.0","dependencies":{}}' > package.json
+          npm install --silent
+          # Run the implementation — it must invoke npm outdated, not return a fixture
+          node dist/cli/index.js dependency-check --project "$TMPDIR" --output json
+        expect_stdout_regex:
+          - '\{|\[|dependencies|outdated|packages'
+        expect_stdout_no_regex:
+          - 'fixture|mock|synthetic|hardcoded'
+
+  - id: entry-3-tilde-path-not-expanded
+    story_key: '2-6'
+    description: fs.readFileSync called with literal tilde path instead of expanded home directory
+    source_ac: |
+      The configuration reader reads the user's config file at `~/.config/myapp/config.json`.
+      The path must be expanded to the actual home directory before reading. The implementation
+      uses `os.homedir()` or equivalent to resolve `~` to the absolute path. A literal
+      `~` in the path passed to `fs.readFileSync` is not a valid filesystem path on Linux/macOS.
+    broken_implementation: |
+      configReader() calls `fs.readFileSync('~/.config/myapp/config.json', 'utf8')`.
+      The literal tilde is not expanded by Node.js's fs module, causing ENOENT
+      on every read even when the config file exists at the real path.
+    real_state_condition: |
+      The config file exists at the real expanded path (e.g., /home/user/.config/myapp/config.json)
+      but does NOT exist at the literal path `~/.config/myapp/config.json`. The broken
+      implementation throws ENOENT while the correct implementation reads successfully.
+    signature:
+      - 'HOME|homedir\(\)|\$HOME|home.*dir'
+      - '\.config|config\.json|tilde|~'
+    mock_authored_probes:
+      - name: config-path-tilde-expansion
+        sandbox: host
+        command: |
+          # Ensure config file exists at real expanded path
+          REAL_CONFIG="$HOME/.config/myapp/config.json"
+          mkdir -p "$(dirname "$REAL_CONFIG")"
+          echo '{"setting":"value"}' > "$REAL_CONFIG"
+          # Implementation must read it successfully
+          node dist/cli/index.js config read
+        expect_stdout_regex:
+          - 'setting|value|config'
+        expect_stdout_no_regex:
+          - 'ENOENT|no such file|tilde'
+
+  - id: entry-4-db-mocked-vs-real
+    story_key: '2-7'
+    description: DB query returns canned response instead of real Dolt wg_stories state
+    source_ac: |
+      The sprint planning report queries the `wg_stories` Dolt table for all
+      stories with `status = 'PLANNED'` in the current sprint. The query must
+      execute against the live Dolt database; the result count must reflect
+      the actual number of planned stories. Using an in-memory mock or
+      hardcoded fixture is not acceptable.
+    broken_implementation: |
+      queryPlannedStories() returns a hardcoded array `[{ id: 'fake-1', status:
+      'PLANNED', sprint: 1 }]` without connecting to Dolt. The sprint planning
+      report always shows 1 planned story regardless of actual database state.
+    real_state_condition: |
+      The Dolt database has 0 or ≥2 planned stories. The broken implementation
+      always returns exactly 1, masking the real state.
+    signature:
+      - 'dolt|mysql|wg_stories|planned.stories'
+      - 'PLANNED|status.*planned|count|rowCount'
+    mock_authored_probes:
+      - name: wg-stories-planned-count-from-db
+        sandbox: host
+        command: |
+          # Query the real Dolt database for planned stories
+          node dist/cli/index.js status --output-format json | \
+            node -e "const d=JSON.parse(require('fs').readFileSync('/dev/stdin','utf8')); \
+            console.log(JSON.stringify({planned: (d.stories||[]).filter(s=>s.status==='PLANNED').length}))"
+        expect_stdout_regex:
+          - 'planned'
+        expect_stdout_no_regex:
+          - 'mock|fixture|fake|hardcoded'
+
+  - id: entry-5-network-mocked-vs-real
+    story_key: '2-8'
+    description: npm registry fetch intercepted by test double instead of real network call
+    source_ac: |
+      The version checker fetches the latest published version of a package from
+      the npm registry using `npm view <package> version` or `https://registry.npmjs.org/<package>/latest`.
+      The fetch must reach the real npm registry; intercepted or cached responses
+      are not acceptable. The result is compared against the locally installed version.
+    broken_implementation: |
+      getLatestVersion() returns a hardcoded version string `"1.2.3"` without
+      making any network request. The comparison always uses stale data, masking
+      cases where the registry has a newer version.
+    real_state_condition: |
+      The real npm registry has a version for the package that may differ from
+      the hardcoded `"1.2.3"`. The broken implementation always returns `"1.2.3"`.
+    signature:
+      - 'npm\s+view|registry\.npmjs|npm.*version'
+      - 'latest|version|registry|current'
+    mock_authored_probes:
+      - name: npm-registry-fetch-real-version
+        sandbox: host
+        command: |
+          # Verify the version checker reaches the real registry
+          node dist/cli/index.js check-version --package js-yaml --output json
+        expect_stdout_regex:
+          - 'version|latest|current'
+        expect_stdout_no_regex:
+          - '1\.2\.3|hardcoded|mock|fixture'
+
+  - id: entry-6-registry-scan-single-vs-multi
+    story_key: '2-9'
+    description: registry scan passes on single-package workspace but fails on multi-package monorepo
+    source_ac: |
+      The workspace version-constraint scanner reads all `package.json` files in
+      a monorepo workspace and reports packages where the declared version in one
+      workspace package conflicts with the version declared in another. The scanner
+      must handle workspaces with ≥2 packages. A single-package workspace is not
+      a valid test fixture for cross-package constraint detection.
+    broken_implementation: |
+      scanVersionConstraints() only reads the root `package.json` and ignores
+      sub-package `package.json` files. It passes on single-package workspaces
+      but misses cross-package conflicts in real multi-package monorepos.
+    real_state_condition: |
+      A workspace with ≥2 packages exists, where package A declares `"lodash": "^4.17.0"`
+      and package B declares `"lodash": "^3.10.0"`. The broken implementation
+      reports no conflicts; the correct implementation reports the constraint mismatch.
+    signature:
+      - 'mktemp|tmpdir|tmp.*dir'
+      - 'package\.json|workspace|monorepo|packages'
+    mock_authored_probes:
+      - name: multi-package-version-constraint-scan
+        sandbox: host
+        command: |
+          # Create a two-package monorepo fixture
+          ROOT=$(mktemp -d)
+          mkdir -p "$ROOT/packages/pkg-a" "$ROOT/packages/pkg-b"
+          echo '{"name":"root","workspaces":["packages/*"]}' > "$ROOT/package.json"
+          echo '{"name":"pkg-a","dependencies":{"lodash":"^4.17.0"}}' > "$ROOT/packages/pkg-a/package.json"
+          echo '{"name":"pkg-b","dependencies":{"lodash":"^3.10.0"}}' > "$ROOT/packages/pkg-b/package.json"
+          node dist/cli/index.js scan-constraints --root "$ROOT" --output json
+        expect_stdout_regex:
+          - 'conflict|mismatch|lodash|constraint'
+        expect_stdout_no_regex:
+          - 'no conflicts|clean|ok'
+
+  - id: entry-7-git-op-empty-vs-real-repo
+    story_key: '2-10'
+    description: git tag/describe returns empty on empty repo but silently passes
+    source_ac: |
+      The release versioner reads the latest git tag from the repository using
+      `git tag --sort=-version:refname` or `git describe --tags --abbrev=0`.
+      The result must be a non-empty string representing the most recent version tag.
+      On a repository with no tags, the implementation must return an explicit error
+      or default value, not an empty string silently treated as a valid version.
+    broken_implementation: |
+      getLatestTag() runs `git tag` in the repo and returns the first line of output.
+      On a fresh repository with no tags, `git tag` returns empty output, and the
+      function returns an empty string `""` which is used as a version string
+      without validation, causing downstream failures.
+    real_state_condition: |
+      A git repository with ≥1 annotated or lightweight tag exists. The probe
+      must assert that the output is a non-empty version string matching a semver
+      pattern (e.g., `v1.0.0` or `1.0.0`).
+    signature:
+      - 'git\s+tag|git\s+describe'
+      - 'v\d+\.\d+|semver|non.?empty|tag.*version|version.*tag'
+    mock_authored_probes:
+      - name: git-tag-non-empty-assertion
+        sandbox: host
+        command: |
+          # Create a git repo with a real tag
+          REPO=$(mktemp -d)
+          cd "$REPO" && git init && git config user.email "t@t" && git config user.name "T"
+          echo "init" > README.md && git add . && git commit -m "initial"
+          git tag v1.0.0
+          # Run the versioner — must return the tag, not empty
+          node dist/cli/index.js get-version --repo "$REPO"
+        expect_stdout_regex:
+          - 'v1\.0\.0|1\.0\.0'
+        expect_stdout_no_regex:
+          - '^$|empty|undefined|null'
+
+  - id: entry-8-spawn-swallows-nonzero-exit
+    story_key: '2-11'
+    description: spawn invocation ignores non-zero exit code from tsc, masking TypeScript errors
+    source_ac: |
+      The TypeScript validation step runs `tsc --noEmit` to check for compile
+      errors. If `tsc` exits with a non-zero exit code, the validation must
+      report failure. The implementation must not swallow the exit code; a
+      TypeScript compile error in the project must cause the validation to
+      return a failure result, not a success result.
+    broken_implementation: |
+      runTscCheck() spawns `tsc --noEmit` but wraps the call in a try/catch
+      that catches ENOENT and sets result.success=true on any other error
+      (including non-zero exit). TypeScript compile errors are silently
+      treated as validation success.
+    real_state_condition: |
+      A TypeScript file with a deliberate type error (e.g., `const x: number = "string"`)
+      exists. The broken implementation reports success; the correct implementation
+      reports failure with the tsc error output.
+    signature:
+      - 'tsc'
+      - 'exit.*code|exitCode|nonzero|non.zero|status.*[^0]|process\.exit'
+    mock_authored_probes:
+      - name: tsc-nonzero-exit-detected
+        sandbox: host
+        command: |
+          # Create a TS file with a deliberate type error
+          TMPDIR=$(mktemp -d)
+          echo '{"compilerOptions":{"strict":true,"noEmit":true}}' > "$TMPDIR/tsconfig.json"
+          echo 'const x: number = "this is a string error";' > "$TMPDIR/bad.ts"
+          # Run the TypeScript validation — must detect and report failure
+          node dist/cli/index.js validate-ts --project "$TMPDIR" --output json; true
+        expect_stdout_regex:
+          - 'error|fail|invalid|type.*error|tsc.*error'
+        expect_stdout_no_regex:
+          - '"success":true|"valid":true|"passed":true'
+
+excluded_entries: []