vibe-coding-master 0.4.4 → 0.4.6

package/dist/backend/adapters/git-adapter.js

@@ -135,6 +135,42 @@ export function createGitAdapter(runner) {
             }
             return result.stdout;
         },
+        async getCommitList(repoRoot, range) {
+            const result = await runGit(runner, repoRoot, ["log", "--format=%H%x00%s%x00%cI%x1e", range]);
+            if (result.exitCode !== 0) {
+                throw new VcmError({
+                    code: "GIT_ERROR",
+                    message: "Unable to read Git commit list.",
+                    statusCode: 400,
+                    hint: result.stderr
+                });
+            }
+            return result.stdout
+                .split("\x1e")
+                .map((record) => record.trim())
+                .filter(Boolean)
+                .map((record) => {
+                const [sha = "", subject = "", committedAt = ""] = record.split("\0");
+                return {
+                    sha: sha.trim(),
+                    subject: subject.trim(),
+                    committedAt: committedAt.trim() || undefined
+                };
+            })
+                .filter((commit) => commit.sha.length > 0);
+        },
+        async getMergeBase(repoRoot, leftRef, rightRef) {
+            const result = await runGit(runner, repoRoot, ["merge-base", leftRef, rightRef]);
+            if (result.exitCode !== 0) {
+                throw new VcmError({
+                    code: "GIT_ERROR",
+                    message: "Unable to find Git merge base.",
+                    statusCode: 400,
+                    hint: result.stderr
+                });
+            }
+            return result.stdout.trim();
+        },
         async isIgnored(repoRoot, repoRelativePath) {
             const result = await runGit(runner, repoRoot, ["check-ignore", "-q", "--", repoRelativePath]);
             if (result.exitCode === 0) {

package/dist/backend/api/harness-routes.js

@@ -32,9 +32,11 @@ export function registerHarnessRoutes(app, deps) {
         return deps.harnessService.updateHarnessFileContent(task.worktreePath, request.query.path ?? "", request.body.content);
     });
     app.get("/api/projects/harness/repository-diff", async (request) => {
-        const { task } = await requireHarnessTaskContext(deps, request.query.taskSlug);
-        const scope = request.query.scope === "all" ? "all" : "harness";
-        return deps.harnessService.getRepositoryDiff(task.worktreePath, scope);
+        const { project, task } = await requireHarnessTaskContext(deps, request.query.taskSlug);
+        return deps.harnessService.getRepositoryDiff(task.worktreePath, {
+            baseRepoRoot: project.repoRoot,
+            commitSha: request.query.commit
+        });
     });
     app.get("/api/projects/harness/bootstrap", async (request) => {
         const { project, task } = await requireHarnessTaskContext(deps, request.query.taskSlug);

package/dist/backend/services/harness-service.js

@@ -246,15 +246,8 @@ export function createHarnessService(deps) {
                     : formatHarnessApplyMessage(committed.harnessCommit, true)
             };
         },
-        async getRepositoryDiff(repoRoot, scope = "harness") {
-            if (!deps.git) {
-                throw new VcmError({
-                    code: "HARNESS_GIT_UNAVAILABLE",
-                    message: "Git-backed repository diff is not available in this VCM runtime.",
-                    statusCode: 501
-                });
-            }
-            return getRepositoryDiffReport(deps.git, repoRoot, scope, now());
+        async getRepositoryDiff(repoRoot, input = {}) {
+            return getRepositoryDiffReport(requireRepositoryDiffGit(deps.git), repoRoot, input, now());
         },
         async getBootstrapStatus(repoRoot, targetRepoRoot = repoRoot) {
             return getHarnessBootstrapStatus(deps, repoRoot, targetRepoRoot, now);
@@ -345,7 +338,6 @@ export function createHarnessService(deps) {
             const timestamp = now();
             if (input.eventName === "Stop" && state.targetRepoRoot) {
                 await bumpHarnessRevision(deps.fs, state.targetRepoRoot, timestamp);
-                await commitHarnessVisibleChanges(deps.git, state.targetRepoRoot, "chore(vcm-harness): bootstrap project context");
             }
             await persistHarnessBootstrapRunState(deps.fs, repoRoot, {
                 ...state,
@@ -449,12 +441,42 @@ function shortCommit(commit) {
 }
 const REPOSITORY_DIFF_MAX_FILES = 250;
 const REPOSITORY_DIFF_MAX_DIFF_CHARS = 180_000;
-async function getRepositoryDiffReport(git, repoRoot, scope, generatedAt) {
-    const commitInfo = await git.getCommitInfo(repoRoot, "HEAD");
-    const rawDiff = await git.getCommitDiff(repoRoot, "HEAD");
-    const allFiles = parseCommitDiffFiles(rawDiff)
-        .filter((file) => scope === "all" || file.category !== "product_code");
+function requireRepositoryDiffGit(git) {
+    if (!git?.getCommitDiff ||
+        !git.getCommitInfo ||
+        !git.getCommitList ||
+        !git.getHeadCommit ||
+        !git.getMergeBase) {
+        throw new VcmError({
+            code: "HARNESS_GIT_UNAVAILABLE",
+            message: "Git-backed repository diff is not available in this VCM runtime.",
+            statusCode: 501
+        });
+    }
+    return git;
+}
+async function getRepositoryDiffReport(git, repoRoot, input, generatedAt) {
+    const baseRef = input.baseRepoRoot
+        ? await git.getHeadCommit(input.baseRepoRoot)
+        : "HEAD^";
+    const mergeBase = await git.getMergeBase(repoRoot, baseRef, "HEAD");
+    const commits = (await git.getCommitList(repoRoot, `${mergeBase}..HEAD`)).map(toRepositoryDiffCommit);
     const warnings = [];
+    const selectedCommit = selectRepositoryDiffCommit(commits, input.commitSha);
+    if (!selectedCommit) {
+        return {
+            version: 1,
+            repoRoot,
+            generatedAt,
+            commits,
+            summary: createEmptyRepositoryDiffSummary(),
+            files: [],
+            warnings
+        };
+    }
+    const commitInfo = await git.getCommitInfo(repoRoot, selectedCommit.sha);
+    const rawDiff = await git.getCommitDiff(repoRoot, selectedCommit.sha);
+    const allFiles = parseCommitDiffFiles(rawDiff);
     const files = allFiles.slice(0, REPOSITORY_DIFF_MAX_FILES);
     if (allFiles.length > files.length) {
         warnings.push(`Diff file list is truncated to ${REPOSITORY_DIFF_MAX_FILES} files.`);
@@ -466,8 +488,8 @@ async function getRepositoryDiffReport(git, repoRoot, scope, generatedAt) {
     return {
         version: 1,
         repoRoot,
-        scope,
         generatedAt,
+        commits,
         commit: {
             sha: commitInfo.sha,
             shortSha: commitInfo.sha.slice(0, 12),
@@ -491,6 +513,36 @@ async function getRepositoryDiffReport(git, repoRoot, scope, generatedAt) {
         warnings
     };
 }
+function toRepositoryDiffCommit(commit) {
+    return {
+        sha: commit.sha,
+        shortSha: commit.sha.slice(0, 12),
+        subject: commit.subject,
+        committedAt: commit.committedAt
+    };
+}
+function selectRepositoryDiffCommit(commits, requestedSha) {
+    const normalizedSha = requestedSha?.trim();
+    if (normalizedSha) {
+        return commits.find((commit) => commit.sha === normalizedSha || commit.shortSha === normalizedSha);
+    }
+    return commits[0];
+}
+function createEmptyRepositoryDiffSummary() {
+    return {
+        totalFiles: 0,
+        committedFiles: 0,
+        stagedFiles: 0,
+        unstagedFiles: 0,
+        untrackedFiles: 0,
+        additions: 0,
+        deletions: 0,
+        harnessFiles: 0,
+        productCodeFiles: 0,
+        truncatedFiles: 0,
+        binaryFiles: 0
+    };
+}
 function parseCommitDiffFiles(rawDiff) {
     const chunks = rawDiff.split(/(?=^diff --git )/m).filter((chunk) => chunk.startsWith("diff --git "));
     return chunks.map(parseCommitDiffFile);
@@ -1435,15 +1487,18 @@ Required work:
 - Fill target docs/ARCHITECTURE.md with project-level module overview, responsibilities, relationships, dependency direction, project-wide constraints, and links to module-level architecture docs.
 - Create or update target module-level ARCHITECTURE.md files for clear module boundaries listed by module-index.json.
 - Fill target docs/TESTING.md with project-native validation levels, commands, validation selection rules, final-validation cleanup, test layout, integration/E2E case lists, generated-context freshness checks, and known testing gaps.
+- Review git status and git diff in the target task worktree.
+- Stage only allowed bootstrap harness changes and create a commit in the target task worktree.
 
 Boundaries:
 - Do not write to the base repository root.
 - Do not edit product source, product tests, package manifests, lockfiles, deployment config, secrets, or VCM managed blocks.
 - Preserve user-authored content.
 - Do not create new validation wrapper tools.
+- VCM will not create the bootstrap commit for you.
 
 Final response:
-Summarize files reviewed, files updated, generated artifacts, verified claims, inferred claims, unknowns, confirmation-needed items, and suggested validation commands.`;
+Summarize files reviewed, files updated, generated artifacts, commit hash, final git status, verified claims, inferred claims, unknowns, confirmation-needed items, and suggested validation commands.`;
 }
 export function createScriptFixedHarnessInstaller(scriptPath = path.resolve(process.cwd(), "scripts/install-vcm-harness.mjs")) {
     return async (repoRoot) => {

package/dist/backend/services/session-service.js

@@ -206,6 +206,7 @@ export function createSessionService(deps) {
         return updated;
     }
     async function launchProjectTranslatorSession(repoRoot, input, launchMode) {
+        const taskContext = await resolveProjectToolTaskContext(repoRoot, input, "Translator");
         const live = toRoleSessionRecordView(getRegisteredProjectTranslatorSession(deps.registry, deps.runtime), deps.runtime);
         if (live && live.status === "running") {
             return withHarnessRevisionView(repoRoot, live);
@@ -227,12 +228,10 @@ export function createSessionService(deps) {
             });
         }
         await deps.fs.ensureDir(resolveRepoPath(repoRoot, TRANSLATION_DIR));
-        const transcriptPath = launchMode === "resume" && persisted?.transcriptPath
-            ? persisted.transcriptPath
-            : claudeTranscriptPath(repoRoot, claudeSessionId);
+        const transcriptPath = claudeTranscriptPath(taskContext.taskRepoRoot, claudeSessionId);
         const startCommand = {
             ...deps.claude.buildRoleStartCommand(TRANSLATOR_ROLE, config.claudeCommand, permissionMode, claudeSessionId, launchMode === "resume", model, effort),
-            cwd: repoRoot
+            cwd: taskContext.taskRepoRoot
         };
         const runtimeSession = await deps.runtime.createSession({
             taskSlug: PROJECT_TRANSLATOR_SCOPE,
@@ -242,8 +241,8 @@ export function createSessionService(deps) {
             cwd: startCommand.cwd,
             env: {
                 VCM_API_URL: deps.apiUrl,
-                VCM_TASK_REPO_ROOT: repoRoot,
-                VCM_TASK_SLUG: PROJECT_TRANSLATOR_SCOPE,
+                VCM_TASK_REPO_ROOT: taskContext.taskRepoRoot,
+                VCM_TASK_SLUG: taskContext.taskSlug,
                 VCM_ROLE: TRANSLATOR_ROLE,
                 VCM_SESSION_ID: claudeSessionId
             },
@@ -278,6 +277,7 @@ export function createSessionService(deps) {
         return withHarnessRevisionView(repoRoot, record);
     }
     async function launchProjectHarnessEngineerSession(repoRoot, input, launchMode) {
+        const taskContext = await resolveProjectToolTaskContext(repoRoot, input, "Harness Engineer");
         const live = toRoleSessionRecordView(getRegisteredProjectHarnessEngineerSession(deps.registry, deps.runtime), deps.runtime);
         if (live && live.status === "running") {
             return withHarnessRevisionView(repoRoot, live);
@@ -299,12 +299,10 @@ export function createSessionService(deps) {
             });
         }
         await deps.fs.ensureDir(resolveRepoPath(repoRoot, HARNESS_ENGINEER_DIR));
-        const transcriptPath = launchMode === "resume" && persisted?.transcriptPath
-            ? persisted.transcriptPath
-            : claudeTranscriptPath(repoRoot, claudeSessionId);
+        const transcriptPath = claudeTranscriptPath(taskContext.taskRepoRoot, claudeSessionId);
         const startCommand = {
             ...deps.claude.buildRoleStartCommand(HARNESS_ENGINEER_ROLE, config.claudeCommand, permissionMode, claudeSessionId, launchMode === "resume", model, effort),
-            cwd: repoRoot
+            cwd: taskContext.taskRepoRoot
         };
         const runtimeSession = await deps.runtime.createSession({
             taskSlug: PROJECT_HARNESS_ENGINEER_SCOPE,
@@ -314,8 +312,8 @@ export function createSessionService(deps) {
             cwd: startCommand.cwd,
             env: {
                 VCM_API_URL: deps.apiUrl,
-                VCM_TASK_REPO_ROOT: repoRoot,
-                VCM_TASK_SLUG: PROJECT_HARNESS_ENGINEER_SCOPE,
+                VCM_TASK_REPO_ROOT: taskContext.taskRepoRoot,
+                VCM_TASK_SLUG: taskContext.taskSlug,
                 VCM_ROLE: HARNESS_ENGINEER_ROLE,
                 VCM_SESSION_ID: claudeSessionId
             },
@@ -349,6 +347,22 @@ export function createSessionService(deps) {
         await persistHarnessEngineerSession(deps.fs, repoRoot, record);
         return withHarnessRevisionView(repoRoot, record);
     }
+    async function resolveProjectToolTaskContext(repoRoot, input, roleLabel) {
+        const taskSlug = input.taskSlug?.trim();
+        if (!taskSlug) {
+            throw new VcmError({
+                code: "PROJECT_TOOL_TASK_REQUIRED",
+                message: `${roleLabel} requires an active task worktree.`,
+                statusCode: 409,
+                hint: "Create or select a task, then start or resume this project tool session."
+            });
+        }
+        const task = await deps.taskService.loadTask(repoRoot, taskSlug);
+        return {
+            taskSlug: task.taskSlug,
+            taskRepoRoot: getTaskRuntimeRepoRoot(task)
+        };
+    }
     async function notifyHarnessUpdatedForSession(repoRoot, session) {
         const runtimeSession = deps.runtime.getSession(session.id);
         if (!runtimeSession || runtimeSession.status !== "running") {
@@ -515,6 +529,7 @@ export function createSessionService(deps) {
             }
             if (existing?.claudeSessionId) {
                 return this.resumeProjectTranslatorSession(repoRoot, {
+                    taskSlug: input.taskSlug,
                     permissionMode: input.permissionMode ?? existing.permissionMode,
                     model: input.model ?? existing.model,
                     effort: input.effort ?? existing.effort,
@@ -611,6 +626,7 @@ export function createSessionService(deps) {
             }
             if (existing?.claudeSessionId) {
                 return this.resumeProjectHarnessEngineerSession(repoRoot, {
+                    taskSlug: input.taskSlug,
                     permissionMode: input.permissionMode ?? existing.permissionMode,
                     model: input.model ?? existing.model,
                     effort: input.effort ?? existing.effort,
@@ -661,12 +677,10 @@ export function createSessionService(deps) {
                     .then((session) => scopeProjectRoleSession(session, taskSlug));
             }
             if (role === TRANSLATOR_ROLE) {
-                void taskSlug;
-                return this.startProjectTranslatorSession(repoRoot, input);
+                return this.startProjectTranslatorSession(repoRoot, { ...input, taskSlug });
             }
             if (role === HARNESS_ENGINEER_ROLE) {
-                void taskSlug;
-                return this.startProjectHarnessEngineerSession(repoRoot, input);
+                return this.startProjectHarnessEngineerSession(repoRoot, { ...input, taskSlug });
             }
             return launchRoleSession(repoRoot, taskSlug, role, input, "fresh");
         },
@@ -676,12 +690,10 @@ export function createSessionService(deps) {
                     .then((session) => scopeProjectRoleSession(session, taskSlug));
             }
             if (role === TRANSLATOR_ROLE) {
-                void taskSlug;
-                return this.resumeProjectTranslatorSession(repoRoot, input);
+                return this.resumeProjectTranslatorSession(repoRoot, { ...input, taskSlug });
             }
             if (role === HARNESS_ENGINEER_ROLE) {
-                void taskSlug;
-                return this.resumeProjectHarnessEngineerSession(repoRoot, input);
+                return this.resumeProjectHarnessEngineerSession(repoRoot, { ...input, taskSlug });
             }
             return launchRoleSession(repoRoot, taskSlug, role, input, "resume");
         },
@@ -732,12 +744,10 @@ export function createSessionService(deps) {
                 return scopeProjectRoleSession(await launchProjectGateReviewerSession(repoRoot, input, "fresh", taskSlug), taskSlug);
             }
             if (role === TRANSLATOR_ROLE) {
-                void taskSlug;
-                return this.restartProjectTranslatorSession(repoRoot, input);
+                return this.restartProjectTranslatorSession(repoRoot, { ...input, taskSlug });
             }
             if (role === HARNESS_ENGINEER_ROLE) {
-                void taskSlug;
-                return this.restartProjectHarnessEngineerSession(repoRoot, input);
+                return this.restartProjectHarnessEngineerSession(repoRoot, { ...input, taskSlug });
             }
             const existing = await this.getRoleSession(repoRoot, taskSlug, role);
             if (!existing) {

package/dist/backend/services/translation-service.js

@@ -904,6 +904,7 @@ export function createTranslationService(deps) {
             });
         }
         return deps.translationWorkerService.createConversationJob(input.repoRoot, {
+            taskSlug: input.taskSlug,
             direction: input.direction,
             sourceText: input.text,
             sourceLanguage: input.sourceLanguage,

package/dist/backend/services/translation-worker-service.js

@@ -207,7 +207,7 @@ export function createTranslationWorkerService(deps) {
                 queue.updatedAt = next.updatedAt;
                 await saveQueue(repoRoot, queue);
             }
-            const session = await ensureTranslatorSession(repoRoot, next.targetLanguage);
+            const session = await ensureTranslatorSession(repoRoot, next.targetLanguage, next.taskSlug);
             await submitTerminalInput(deps.runtime, session.id, batch?.prompt ?? await buildQueuePrompt(repoRoot, next));
             const dispatchedAt = now();
             for (const item of batch?.items ?? [next]) {
@@ -255,7 +255,7 @@ export function createTranslationWorkerService(deps) {
         await saveQueue(repoRoot, queue);
         return { items: candidates, prompt };
     }
-    async function ensureTranslatorSession(repoRoot, targetLanguage) {
+    async function ensureTranslatorSession(repoRoot, targetLanguage, taskSlug) {
         void targetLanguage;
         if (!deps.sessionService) {
             throw new VcmError({
@@ -265,6 +265,7 @@ export function createTranslationWorkerService(deps) {
             });
         }
         return deps.sessionService.ensureProjectTranslatorSession(repoRoot, {
+            taskSlug,
             model: "default",
             effort: "medium"
         });
@@ -873,6 +874,7 @@ export function createTranslationWorkerService(deps) {
         },
         async createFileJob(repoRoot, input) {
             await ensureLayout(repoRoot);
+            const taskSlug = requireTranslationTaskSlug(input.taskSlug);
             const sourcePath = normalizeRepoRelative(input.sourcePath);
             const absoluteSourcePath = resolveRepoPath(repoRoot, sourcePath);
             assertInsideRepo(repoRoot, absoluteSourcePath);
@@ -925,6 +927,7 @@ export function createTranslationWorkerService(deps) {
                 type: input.force ? "force-retranslate" : "file",
                 status: "queued",
                 targetLanguage,
+                taskSlug,
                 jobId,
                 requestPath: job.requestPath,
                 expectedResultPath: job.resultPath,
@@ -997,6 +1000,7 @@ export function createTranslationWorkerService(deps) {
         },
         async createBootstrapRun(repoRoot, input) {
             await ensureLayout(repoRoot);
+            const taskSlug = requireTranslationTaskSlug(input.taskSlug);
             const targetLanguage = input.targetLanguage.trim() || "zh-CN";
             const candidatePaths = (input.candidatePaths?.length
                 ? input.candidatePaths
@@ -1020,6 +1024,7 @@ export function createTranslationWorkerService(deps) {
                 type: "bootstrap",
                 status: "queued",
                 targetLanguage,
+                taskSlug,
                 jobId: runId,
                 requestPath: run.requestPath,
                 expectedResultPath: run.reportPath,
@@ -1054,6 +1059,7 @@ export function createTranslationWorkerService(deps) {
         },
         async createMemoryUpdate(repoRoot, input) {
             await ensureLayout(repoRoot);
+            const taskSlug = requireTranslationTaskSlug(input.taskSlug);
             const targetLanguage = input.targetLanguage.trim() || "zh-CN";
             const timestamp = now();
             const runId = `memory-update-${Date.now()}-${createId().slice(0, 8)}`;
@@ -1065,6 +1071,7 @@ export function createTranslationWorkerService(deps) {
                 type: "memory-update",
                 status: "queued",
                 targetLanguage,
+                taskSlug,
                 jobId: runId,
                 requestPath
             });
@@ -1130,6 +1137,7 @@ export function createTranslationWorkerService(deps) {
         },
         async createConversationJob(repoRoot, input) {
             await ensureLayout(repoRoot);
+            const taskSlug = requireTranslationTaskSlug(input.taskSlug);
             const sourceText = input.sourceText.trimEnd();
             if (!sourceText.trim()) {
                 throw new VcmError({
@@ -1159,6 +1167,7 @@ export function createTranslationWorkerService(deps) {
                 type: "conversation",
                 status: "queued",
                 targetLanguage,
+                taskSlug,
                 jobId,
                 requestPath: job.requestPath,
                 expectedResultPath: job.resultPath
@@ -1287,10 +1296,27 @@ export function createTranslationWorkerService(deps) {
             }
         },
         ensureTranslatorSession(repoRoot) {
-            return ensureTranslatorSession(repoRoot, "zh-CN");
+            void repoRoot;
+            throw new VcmError({
+                code: "TRANSLATION_TASK_REQUIRED",
+                message: "Translator requires an active task worktree.",
+                statusCode: 409
+            });
         }
     };
 }
+function requireTranslationTaskSlug(value) {
+    const taskSlug = value?.trim();
+    if (!taskSlug) {
+        throw new VcmError({
+            code: "TRANSLATION_TASK_REQUIRED",
+            message: "Translation requires an active task worktree.",
+            statusCode: 409,
+            hint: "Create or select a task before starting translation."
+        });
+    }
+    return taskSlug;
+}
 async function listBrowserEntries(repoRoot, fs, currentPath, limit) {
     const directoryPath = resolveRepoPath(repoRoot, currentPath);
     const names = (await fs.readDir(directoryPath)).filter((name) => !isIgnoredBrowserName(name));
@@ -1496,6 +1522,7 @@ function isQueueItem(value) {
         typeof candidate.type === "string" &&
         typeof candidate.status === "string" &&
         typeof candidate.targetLanguage === "string" &&
+        typeof candidate.taskSlug === "string" &&
         typeof candidate.requestPath === "string";
 }
 function isFileJob(value) {

package/dist/backend/templates/harness/harness-engineer-agent.js

@@ -27,6 +27,7 @@ You are not part of the task workflow round state.
 
 - Propose harness changes as reviewable diffs.
 - Do not silently apply edits.
+- During a VCM-managed bootstrap run, apply permitted bootstrap edits directly in the active task worktree and commit them yourself.
 - Do not overwrite VCM fixed managed blocks.
 - Keep project-specific customization outside VCM managed blocks.
 - If a fixed managed block appears wrong, draft a VCM issue instead of editing
@@ -34,6 +35,7 @@ You are not part of the task workflow round state.
 - Include affected files, impacted roles, session restart/reminder impact, and
   validation recommendations with every proposal.
 - Do not edit production source code as part of harness maintenance.
+- VCM does not create Harness Engineer commits after your turn.
 
 ## VCM Feedback
 

package/dist/backend/templates/harness/vcm-harness-bootstrap-skill.js

@@ -19,7 +19,9 @@ This skill is an operating procedure. It does not replace the deterministic VCM
 3. Fill project context: add or update non-managed project facts in \`CLAUDE.md\` above the VCM managed block.
 4. Fill durable docs: update \`docs/ARCHITECTURE.md\`, module-level \`ARCHITECTURE.md\` files, and \`docs/TESTING.md\` with detailed project-specific content.
 5. Preserve user-authored content and VCM managed blocks.
-6. Report evidence, unknowns, confirmation-needed areas, generation failures, and recommended deterministic VCM actions.
+6. Review \`git status\` and \`git diff\`.
+7. Stage only allowed bootstrap harness changes and create a commit in the active task worktree.
+8. Report evidence, commit hash, final git status, unknowns, confirmation-needed areas, generation failures, and recommended deterministic VCM actions.
 
 ## Typical Outputs
 
@@ -64,12 +66,20 @@ This skill is an operating procedure. It does not replace the deterministic VCM
 - Keep historical investigation details, superseded failures, temporary diagnostics, and per-task validation logs out of \`docs/TESTING.md\`.
 - Keep reviewer ownership of validation strategy and testing documentation clear.
 
+### Commit
+
+- Create the bootstrap commit yourself after the allowed files are updated.
+- Do not include product source, product tests, package manifests, lockfiles, deployment config, secrets, or VCM managed-block changes in the commit.
+- VCM will not commit bootstrap changes after your turn.
+
 ## Final Summary
 
 Include:
 
 - files reviewed
 - files drafted or updated
+- commit hash
+- final git status
 - verified claims
 - inferred claims
 - unknowns