vibe-coding-master 0.7.0 → 0.7.2

package/README.md

@@ -390,11 +390,11 @@ VCM runs it from the active task worktree.
 
 ### Auto Memory
 
-Enable `Auto memory` in the `VCM Harness` sidebar group to collect durable role
-knowledge after a complete task passes Final Acceptance. Project Manager,
-Architect, Coder, Tester, and an enabled Gate Reviewer submit memory drafts in
-sequence. Harness Engineer verifies and consolidates them before VCM applies
-the result.
+`Auto memory` is the switch for the entire automated memory workflow. During
+Review Task Harness after Final Acceptance, Project Manager, Architect, Coder,
+Tester, and an enabled Gate Reviewer submit proposals in sequence through
+`vcm-propose-memory`. Harness Engineer verifies and consolidates them before VCM
+applies the result. Roles cannot edit active memory directly.
 
 Canonical memory is stored under the base repository's `.ai/vcm/memory/`.
 Harness Studio shows current memory and task-local applied history. Memory is
@@ -405,14 +405,16 @@ Post-task processing is ordered by the backend:
 
 ```text
 Final Acceptance
-  -> Auto Memory, when enabled
+  -> Review Task Harness
+  -> Memory proposals and Harness Engineer review, when Auto Memory is enabled
   -> Task Harness Retrospective
 ```
 
-Auto Memory adds no retrospective prerequisite when it is disabled. When it is
-enabled, both automatic and manual retrospective requests wait until memory has
-been applied for the current Final Acceptance. A failed memory review must be
-retried from Harness Studio before retrospective can run.
+When Auto Memory is disabled, Review Task Harness does not collect proposals or
+ask Harness Engineer to update memory. When enabled, both automatic and manual
+review requests complete the memory phase before retrospective analysis. A
+failed memory review must be retried from Harness Studio before retrospective
+can continue.
 
 ## Closing a Task
 

package/dist/backend/api/harness-routes.js

@@ -154,15 +154,21 @@ export function registerHarnessRoutes(app, deps) {
     });
     app.post("/api/projects/harness/task-retrospective", async (request) => {
         const { project, task } = await requireHarnessTaskContext(deps, request.body?.taskSlug);
-        await deps.autoMemoryService.assertTaskRetrospectiveReady({
+        const trigger = request.body?.trigger === "auto" ? "auto" : "manual";
+        const memoryInput = {
             baseRepoRoot: project.repoRoot,
             taskRepoRoot: task.worktreePath,
             taskSlug: task.taskSlug,
             handoffDir: task.handoffDir,
-            roundReady: true
-        });
+            roundReady: true,
+            requestTrigger: trigger
+        };
+        await deps.autoMemoryService.reconcileTask(memoryInput);
+        const memoryReadiness = await deps.autoMemoryService.getTaskRetrospectiveReadiness(memoryInput);
+        if (!memoryReadiness.ready) {
+            return deps.harnessFeedbackService.getState(project.repoRoot, task.taskSlug);
+        }
         await deps.autoMemoryService.assertHarnessEngineerAvailable(task.worktreePath);
-        const trigger = request.body?.trigger === "auto" ? "auto" : "manual";
         return deps.harnessFeedbackService.startTaskRetrospective(project.repoRoot, {
             taskSlug: task.taskSlug,
             taskRepoRoot: task.worktreePath,

package/dist/backend/cli/install-vcm-harness.js

@@ -20,6 +20,7 @@ import { renderTesterHarnessRules } from "../templates/harness/tester-agent.js";
 import { renderVcmFinalAcceptanceSkillRules } from "../templates/harness/vcm-final-acceptance-skill.js";
 import { renderVcmHarnessBootstrapSkillRules } from "../templates/harness/vcm-harness-bootstrap-skill.js";
 import { renderVcmLongRunningValidationSkillRules } from "../templates/harness/vcm-long-running-validation-skill.js";
+import { renderVcmProposeMemorySkillRules } from "../templates/harness/vcm-propose-memory-skill.js";
 import { renderVcmReportHarnessIssueSkillRules } from "../templates/harness/vcm-report-harness-issue-skill.js";
 import { renderVcmRouteMessageSkillRules } from "../templates/harness/vcm-route-message-skill.js";
 import { readVcmPackageVersion } from "../app-version.js";
@@ -248,6 +249,12 @@ const WHOLE_FILES = [
         mode: 0o644,
         content: renderSkillFile("VCM Report Harness Issue Skill", "vcm-report-harness-issue", "Use when a VCM role notices a reusable harness problem and needs to record feedback for Harness Engineer review.", renderVcmReportHarnessIssueSkillRules())
     },
+    {
+        path: ".claude/skills/vcm-propose-memory/SKILL.md",
+        category: "skill",
+        mode: 0o644,
+        content: renderSkillFile("VCM Propose Memory Skill", "vcm-propose-memory", "Use only when VCM requests a role memory proposal during Task Harness Review.", renderVcmProposeMemorySkillRules())
+    },
     {
         path: ".ai/tools/request-gate-review",
         category: "runtime-tool",
@@ -476,6 +483,7 @@ function fixedDirectories() {
         ".claude/skills/vcm-route-message/",
         ".claude/skills/vcm-gate-review/",
         ".claude/skills/vcm-report-harness-issue/",
+        ".claude/skills/vcm-propose-memory/",
         ".ai/vcm/translations/",
         ".ai/vcm/gate-reviews/",
         ".ai/tools/",

package/dist/backend/services/auto-memory-service.js

@@ -62,11 +62,16 @@ export function createAutoMemoryService(deps) {
     }
     async function getState(baseRepoRoot, taskRepoRoot) {
         await ensureTaskMemorySnapshot(deps.fs, baseRepoRoot, taskRepoRoot);
-        const [active, runs, files] = await Promise.all([
+        let [active, runs, files] = await Promise.all([
             loadActiveState(taskRepoRoot),
             listRuns(taskRepoRoot),
             listMemoryFiles(taskRepoRoot)
         ]);
+        if (active && !(await deps.appSettings.getPreferences()).autoMemoryEnabled) {
+            await discardActiveReview(taskRepoRoot, active);
+            active = undefined;
+            runs = await listRuns(taskRepoRoot);
+        }
         return {
             version: 1,
             status: active?.status ?? "idle",
@@ -79,6 +84,13 @@ export function createAutoMemoryService(deps) {
     async function reconcileTask(input) {
         await ensureTaskMemorySnapshot(deps.fs, input.baseRepoRoot, input.taskRepoRoot);
         const active = await loadActiveState(input.taskRepoRoot);
+        const preferences = await deps.appSettings.getPreferences();
+        if (!preferences.autoMemoryEnabled) {
+            if (active) {
+                await discardActiveReview(input.taskRepoRoot, active);
+            }
+            return getState(input.baseRepoRoot, input.taskRepoRoot);
+        }
         if (active?.status === "collecting") {
             await dispatchCurrentDraft(input.baseRepoRoot, input.taskRepoRoot, active);
             return getState(input.baseRepoRoot, input.taskRepoRoot);
@@ -87,11 +99,7 @@ export function createAutoMemoryService(deps) {
             await dispatchHarnessReview(input.baseRepoRoot, input.taskRepoRoot, active);
             return getState(input.baseRepoRoot, input.taskRepoRoot);
         }
-        if (active || !input.roundReady) {
-            return getState(input.baseRepoRoot, input.taskRepoRoot);
-        }
-        const preferences = await deps.appSettings.getPreferences();
-        if (!preferences.autoMemoryEnabled) {
+        if (active || !input.roundReady || !input.requestTrigger) {
             return getState(input.baseRepoRoot, input.taskRepoRoot);
         }
         if (deps.isHarnessEngineerAvailable && !(await deps.isHarnessEngineerAvailable(input.baseRepoRoot))) {
@@ -122,6 +130,7 @@ export function createAutoMemoryService(deps) {
             taskSlug: input.taskSlug,
             status: "collecting",
             finalAcceptanceHash,
+            trigger: input.requestTrigger,
             createdAt: timestamp,
             updatedAt: timestamp,
             drafts
@@ -138,6 +147,7 @@ export function createAutoMemoryService(deps) {
             createdAt: timestamp,
             updatedAt: timestamp,
             finalAcceptanceHash,
+            trigger: input.requestTrigger,
             beforeHashes: hashMemorySet(before)
         });
         await persistActiveState(input.taskRepoRoot, state);
@@ -159,13 +169,15 @@ export function createAutoMemoryService(deps) {
             return {
                 ready: false,
                 disposition,
+                trigger: active.trigger,
                 reason: disposition === "failed"
                     ? "Auto Memory failed for this task. Retry it before Task Harness Retrospective."
                     : `Auto Memory is ${disposition} for this task.`
             };
         }
-        if (await hasCompletedRunForFinalAcceptance(input.taskRepoRoot, finalAcceptanceHash)) {
-            return { ready: true, disposition: "completed" };
+        const completedRun = await findCompletedRunForFinalAcceptance(input.taskRepoRoot, finalAcceptanceHash);
+        if (completedRun) {
+            return { ready: true, disposition: "completed", trigger: completedRun.trigger };
         }
         return {
             ready: false,
@@ -173,18 +185,6 @@ export function createAutoMemoryService(deps) {
             reason: "Auto Memory must complete for this Final Acceptance before Task Harness Retrospective."
         };
     }
-    async function assertTaskRetrospectiveReady(input) {
-        const readiness = await getTaskRetrospectiveReadiness(input);
-        if (readiness.ready) {
-            return;
-        }
-        throw new VcmError({
-            code: "TASK_MEMORY_REVIEW_NOT_READY",
-            message: "Task Harness Retrospective must run after Auto Memory.",
-            statusCode: 409,
-            hint: readiness.reason
-        });
-    }
     async function isRoleMemoryTurn(taskRepoRoot, role) {
         const state = await loadActiveState(taskRepoRoot);
         const draft = state?.status === "collecting" ? currentDraft(state) : undefined;
@@ -192,6 +192,13 @@ export function createAutoMemoryService(deps) {
     }
     async function handleRoleHook(input) {
         const state = await loadActiveState(input.taskRepoRoot);
+        if (!(await deps.appSettings.getPreferences()).autoMemoryEnabled) {
+            if (state) {
+                await discardActiveReview(input.taskRepoRoot, state);
+                return true;
+            }
+            return false;
+        }
         const draft = state?.status === "collecting" ? currentDraft(state) : undefined;
         if (!state || !draft || draft.role !== input.role) {
             return false;
@@ -237,13 +244,17 @@ export function createAutoMemoryService(deps) {
     }
     async function handleHarnessEngineerHook(input) {
         const state = await loadActiveState(input.taskRepoRoot);
+        if (!(await deps.appSettings.getPreferences()).autoMemoryEnabled) {
+            if (state) {
+                await discardActiveReview(input.taskRepoRoot, state);
+                return true;
+            }
+            return false;
+        }
         if (state?.status === "reviewing" && !state.reviewPromptDispatchedAt) {
             return false;
         }
         if (!state || state.status !== "reviewing") {
-            if (input.eventName === "Stop") {
-                await captureHarnessEngineerChanges(input.baseRepoRoot, input.taskRepoRoot, input.taskSlug);
-            }
             return false;
         }
         if (input.eventName === "UserPromptSubmit" || input.eventName === "PostCompact") {
@@ -329,6 +340,10 @@ export function createAutoMemoryService(deps) {
     }
     async function assertHarnessEngineerAvailable(taskRepoRoot) {
         const state = await loadActiveState(taskRepoRoot);
+        if (state && !(await deps.appSettings.getPreferences()).autoMemoryEnabled) {
+            await discardActiveReview(taskRepoRoot, state);
+            return;
+        }
         if (!state || state.status === "failed") {
             return;
         }
@@ -341,6 +356,10 @@ export function createAutoMemoryService(deps) {
     }
     async function assertNoActiveReview(taskRepoRoot) {
         const state = await loadActiveState(taskRepoRoot);
+        if (state && !(await deps.appSettings.getPreferences()).autoMemoryEnabled) {
+            await discardActiveReview(taskRepoRoot, state);
+            return;
+        }
         if (!state) {
             return;
         }
@@ -437,17 +456,6 @@ export function createAutoMemoryService(deps) {
             await failReview(taskRepoRoot, state, `Harness Engineer memory result could not be applied: ${errorMessage(error)}`);
         }
     }
-    async function captureHarnessEngineerChanges(baseRepoRoot, taskRepoRoot, taskSlug) {
-        await ensureTaskMemorySnapshot(deps.fs, baseRepoRoot, taskRepoRoot);
-        const [before, after] = await Promise.all([
-            readMemorySet(baseRepoRoot),
-            readMemorySet(taskRepoRoot)
-        ]);
-        if (sameHashes(hashMemorySet(before), hashMemorySet(after))) {
-            return;
-        }
-        await createAppliedRun(baseRepoRoot, taskRepoRoot, taskSlug, "harness-engineer", before, after);
-    }
     async function createAppliedRun(baseRepoRoot, taskRepoRoot, taskSlug, source, before, after) {
         assertCompleteMemorySet(after);
         const timestamp = now();
@@ -513,6 +521,7 @@ export function createAutoMemoryService(deps) {
                 failedAt: run.failedAt,
                 revertedAt: run.revertedAt,
                 finalAcceptanceHash: run.finalAcceptanceHash,
+                trigger: run.trigger,
                 diff: run.diff ?? "",
                 canRevert: run.status === "applied" && !run.revertedAt && Boolean(run.afterHashes),
                 error: run.error
@@ -534,8 +543,11 @@ export function createAutoMemoryService(deps) {
         return files;
     }
     async function hasCompletedRunForFinalAcceptance(taskRepoRoot, finalAcceptanceHash) {
+        return Boolean(await findCompletedRunForFinalAcceptance(taskRepoRoot, finalAcceptanceHash));
+    }
+    async function findCompletedRunForFinalAcceptance(taskRepoRoot, finalAcceptanceHash) {
         const runs = await listRuns(taskRepoRoot);
-        return runs.some((run) => run.finalAcceptanceHash === finalAcceptanceHash && (run.status === "applied" || run.status === "reverted"));
+        return runs.find((run) => run.finalAcceptanceHash === finalAcceptanceHash && (run.status === "applied" || run.status === "reverted"));
     }
     async function loadActiveState(taskRepoRoot) {
         const statePath = resolveRepoPath(taskRepoRoot, MEMORY_REVIEW_STATE_PATH);
@@ -551,6 +563,10 @@ export function createAutoMemoryService(deps) {
     async function clearActiveState(taskRepoRoot) {
         await deps.fs.removePath?.(resolveRepoPath(taskRepoRoot, MEMORY_REVIEW_STATE_PATH), { force: true });
     }
+    async function discardActiveReview(taskRepoRoot, state) {
+        await clearActiveState(taskRepoRoot);
+        await deps.fs.removePath?.(resolveRepoPath(taskRepoRoot, `${MEMORY_REVIEW_RUNS_ROOT}/${state.runId}`), { recursive: true, force: true });
+    }
     async function readRun(taskRepoRoot, runId) {
         const runPath = resolveRepoPath(taskRepoRoot, `${MEMORY_REVIEW_RUNS_ROOT}/${requireSafeRunId(runId)}/run.json`);
         if (!(await deps.fs.pathExists(runPath))) {
@@ -590,7 +606,6 @@ export function createAutoMemoryService(deps) {
         reconcileTask,
         getState,
         getTaskRetrospectiveReadiness,
-        assertTaskRetrospectiveReady,
         getFile,
         updateFile,
         revertRun,
@@ -629,44 +644,36 @@ function toActiveReview(state) {
         updatedAt: state.updatedAt,
         currentRole: state.status === "collecting" ? currentDraft(state)?.role : undefined,
         drafts: state.drafts,
+        trigger: state.trigger,
         error: state.error
     };
 }
 function buildRoleDraftPrompt(taskRepoRoot, state, draft) {
     return [
-        "[VCM Auto Memory Draft]",
+        "[VCM Task Harness Review: Memory Proposal]",
         "",
-        "The task passed Final Acceptance. Propose only durable, reusable memory supported by this task's evidence.",
+        "Use the vcm-propose-memory skill to submit the assigned proposal.",
         `Task worktree: ${taskRepoRoot}`,
         `Current shared memory: ${resolveRepoPath(taskRepoRoot, `${MEMORY_ROOT}/shared.md`)}`,
         `Current role memory: ${resolveRepoPath(taskRepoRoot, `${MEMORY_ROOT}/roles/${draft.role}.md`)}`,
         `Write the draft to: ${resolveRepoPath(taskRepoRoot, draft.path)}`,
         "",
-        "Use this structure:",
-        "# Memory Draft",
-        "Decision: update | no-change",
-        "## Add",
-        "## Update",
-        "## Remove",
-        "## Evidence",
-        "",
-        "Do not edit memory files, route messages, or handoff artifacts. Do not record task narrative, temporary state, unverified conclusions, or rules that belong in the harness.",
         "End the turn after writing the draft."
     ].join("\n");
 }
 function buildHarnessReviewPrompt(taskRepoRoot, state) {
     const runRoot = resolveRepoPath(taskRepoRoot, `${MEMORY_REVIEW_RUNS_ROOT}/${state.runId}`);
     return [
-        "[VCM Auto Memory Review]",
+        "[VCM Task Harness Review: Memory Review]",
         "",
-        "Review the role drafts and task evidence, then produce the complete next memory set.",
+        "Auto Memory is enabled. Review the role proposals and task evidence, then produce the complete next memory set.",
         `Task worktree: ${taskRepoRoot}`,
         `Role drafts: ${path.join(runRoot, "drafts")}`,
         `Current memory snapshot: ${path.join(runRoot, "before")}`,
         `Write the complete reviewed memory set to: ${path.join(runRoot, "after")}`,
         "",
         "Keep only verified, durable, reusable project knowledge. Merge duplicates, remove stale entries, and keep role-specific knowledge in the matching role file.",
-        "Memory is context, not authority. Keep harness rules and task-specific narrative out of memory.",
+        "Do not record task narrative, temporary state, unverified conclusions, or Harness rules.",
         "Do not edit product code, harness files, the canonical base-repository memory, or review metadata.",
         "All existing files already exist in the after directory. Edit those files in place and end the turn when review is complete."
     ].join("\n");

package/dist/backend/services/harness-service.js

@@ -17,6 +17,7 @@ import { renderTesterHarnessRules } from "../templates/harness/tester-agent.js";
 import { renderVcmFinalAcceptanceSkillRules } from "../templates/harness/vcm-final-acceptance-skill.js";
 import { renderVcmHarnessBootstrapSkillRules } from "../templates/harness/vcm-harness-bootstrap-skill.js";
 import { renderVcmLongRunningValidationSkillRules } from "../templates/harness/vcm-long-running-validation-skill.js";
+import { renderVcmProposeMemorySkillRules } from "../templates/harness/vcm-propose-memory-skill.js";
 import { renderVcmReportHarnessIssueSkillRules } from "../templates/harness/vcm-report-harness-issue-skill.js";
 import { renderVcmRouteMessageSkillRules } from "../templates/harness/vcm-route-message-skill.js";
 import { submitTerminalInput } from "../runtime/terminal-submit.js";
@@ -142,6 +143,14 @@ const HARNESS_FILES = [
         ownership: "whole-file",
         renderRules: renderVcmReportHarnessIssueSkillRules
     },
+    {
+        kind: "skill-vcm-propose-memory",
+        path: ".claude/skills/vcm-propose-memory/SKILL.md",
+        title: "VCM Propose Memory Skill",
+        frontmatter: renderSkillFrontmatter("vcm-propose-memory", "Use only when VCM requests a role memory proposal during Task Harness Review."),
+        ownership: "whole-file",
+        renderRules: renderVcmProposeMemorySkillRules
+    },
     {
         kind: "agent-gate-reviewer",
         path: ".claude/agents/gate-reviewer.md",

package/dist/backend/services/runtime-coordinator-service.js

@@ -77,12 +77,10 @@ export function createRuntimeCoordinatorService(deps) {
                 else {
                     await deps.translationService.stopTask(taskRepoRoot, activeTask.taskSlug).catch(() => undefined);
                 }
-                await reconcileAutoMemory(repoRoot, activeTask);
-                if (preferences.autoTaskHarnessReviewEnabled) {
-                    const memoryReadiness = await getTaskRetrospectiveMemoryReadiness(repoRoot, activeTask);
-                    if (memoryReadiness.ready) {
-                        await maybeStartTaskHarnessRetrospective(repoRoot, activeTask);
-                    }
+                await reconcileAutoMemory(repoRoot, activeTask, preferences.autoTaskHarnessReviewEnabled ? "auto" : undefined);
+                const memoryReadiness = await getTaskRetrospectiveMemoryReadiness(repoRoot, activeTask);
+                if ((preferences.autoTaskHarnessReviewEnabled || memoryReadiness.trigger) && memoryReadiness.ready) {
+                    await maybeStartTaskHarnessRetrospective(repoRoot, activeTask, memoryReadiness.trigger ?? "auto");
                 }
                 return { activeTask, gatewayStatus };
             });
@@ -169,7 +167,7 @@ export function createRuntimeCoordinatorService(deps) {
             throw error;
         }
     }
-    async function maybeStartTaskHarnessRetrospective(repoRoot, task) {
+    async function maybeStartTaskHarnessRetrospective(repoRoot, task, trigger) {
         const stateRoot = await deps.getStateRoot(repoRoot);
         const taskRepoRoot = getTaskRuntimeRepoRoot(task);
         const roundState = await deps.roundService.getSessionRoundState({
@@ -188,7 +186,7 @@ export function createRuntimeCoordinatorService(deps) {
                 taskSlug: task.taskSlug,
                 taskRepoRoot,
                 handoffDir: task.handoffDir,
-                trigger: "auto"
+                trigger
             });
         }
         catch (error) {
@@ -198,7 +196,7 @@ export function createRuntimeCoordinatorService(deps) {
             throw error;
         }
     }
-    async function reconcileAutoMemory(repoRoot, task) {
+    async function reconcileAutoMemory(repoRoot, task, requestTrigger) {
         const stateRoot = await deps.getStateRoot(repoRoot);
         const taskRepoRoot = getTaskRuntimeRepoRoot(task);
         const roundState = await deps.roundService.getSessionRoundState({
@@ -212,6 +210,7 @@ export function createRuntimeCoordinatorService(deps) {
             taskRepoRoot,
             taskSlug: task.taskSlug,
             handoffDir: task.handoffDir,
+            requestTrigger,
             roundReady: roundState.status === "stopped"
                 && Boolean(roundState.roundId)
                 && roundState.roleRecovery?.status !== "failed"

package/dist/backend/templates/harness/architect-agent.js

@@ -66,7 +66,7 @@ ${renderRoleMemoryRules("architect")}
 
 - Plan the full accepted task scope routed by PM.
 - \`architecture-plan.md\` must describe the complete implementation for that scope.
-- Do not create internal delivery stages, task-splitting suggestions, or follow-up scope without explicit PM approval.
+- Do not create internal delivery stages, task-splitting suggestions, or follow-up scope.
 - Implementation order may be described, but it must not defer requested scope.
 
 ### Debug Mode

package/dist/backend/templates/harness/claude-root.js

@@ -8,6 +8,8 @@ export function renderRootClaudeHarnessRules() {
 - \`vcm-route-message\` is the only channel for PM-hub dispatch and reporting among project-manager, architect, coder, and tester. Gate Review and tool-role work use their dedicated VCM skills and controllers. Follow the route skill's write-then-stop rule.
 - Use \`vcm-long-running-validation\` for long-running validation. Follow the background job limits below.
 - Use \`vcm-report-harness-issue\` when you notice a reusable VCM harness problem. Record feedback; do not contact Harness Engineer directly.
+- Treat \`.ai/vcm/memory/**\` as read-only. Use \`vcm-propose-memory\` only when VCM assigns a memory proposal during Task Harness Review.
+- Only the user may approve scope reduction, skipped required validation, Gate Review skip or override, skipped required docs sync, accepted unresolved task-scope risk, or weakening of baseline Harness rules. PM may record and route the user's approval but cannot grant it.
 - Project-manager runs \`vcm-gate-review\` unconditionally at every Gate Review trigger point and on VCM Gate Review callbacks; the tool reports the authoritative enable state.
 
 ## VCM Harness Scope

package/dist/backend/templates/harness/coder-agent.js

@@ -101,7 +101,7 @@ Decision: ready_for_review|incomplete|failed
 - Coder validation is limited to baseline unit-level and fast L0/L1 checks; do not run L2/L3/L4, smoke, integration, or E2E validation unless the role message explicitly assigns a targeted fast L2 check.
 - Run available L0/L1 validation after implementation.
 - Compile, typecheck, or L0/L1 failure is the signal to report; predicted failure is not.
-- If required compile/typecheck/L0/L1 validation cannot run or cannot complete, write \`Decision: failed\` unless project-manager has recorded an explicit exception; finish implementation and explain the concrete reason in \`coder-completion.md\` and the route message to project-manager.
+- If required compile/typecheck/L0/L1 validation cannot run or cannot complete, write \`Decision: failed\`. If the user explicitly approved continuing without the exact check, record the approval and reason; the approval does not change Coder's decision.
 - Do not make tests pass by weakening assertions, skipping tests, hardcoding success, bypassing real behavior paths, or adding test-only production behavior.
 
 ### Failure Reporting And Continuation

package/dist/backend/templates/harness/coder-worker-agent.js

@@ -48,7 +48,7 @@ You are \`vcm-coder-worker\`, a bounded implementation worker invoked by Coder.
 - Run assigned L0/L1 checks in the foreground. Worker checks are module-scoped and treated as safe fast validation: never use \`.ai/tools/run-long-check\` or \`.ai/tools/watch-job\`, and the switch-to-skill rule for long commands does not apply inside worker runs.
 - Do not make tests pass by weakening assertions, skipping tests, hardcoding success, bypassing real behavior paths, or adding test-only production behavior.
 - Report failure only from missing assigned targets, compile/typecheck failure, assigned L0/L1 failure, or a concrete inability to run assigned-module tests.
-- If required assigned compile/typecheck/L0/L1 checks cannot run or cannot complete, update worker state to \`failed\` unless Coder recorded a validation exception in the worker task.
+- If required assigned compile/typecheck/L0/L1 checks cannot run or cannot complete, update worker state to \`failed\`. If the user explicitly approved continuing without the exact check, record the approval and reason; the approval does not change the worker state.
 
 ### Git
 

package/dist/backend/templates/harness/harness-engineer-agent.js

@@ -38,9 +38,10 @@ You are not part of the task workflow round state.
   permitted bootstrap edits directly in the active task worktree and commit them
   yourself.
 - Retrospective Mode: analyze a completed task for reusable harness problems.
-  Do not edit harness files; proven repeated findings may update VCM memory.
-- Memory Review Mode: review role memory drafts or proven retrospective memory
-  findings and write only the memory files assigned by VCM.
+  Do not edit harness or memory files.
+- Memory Review Mode: when Auto Memory is enabled and VCM starts the memory
+  phase of Task Harness Review, review role proposals and write only the review
+  output files assigned by VCM.
 - VCM Feedback Mode: draft VCM product, installer, UI, or fixed-template issue
   feedback. Do not submit without explicit in-session user authorization.
 
@@ -50,8 +51,7 @@ You are not part of the task workflow round state.
   explicitly asks you to apply an approved harness change.
 - When applying edits, work only in the active task worktree named by VCM. Do not
   edit the base repository root unless VCM explicitly says so.
-- In Proposal Mode, do not edit files. In Retrospective Mode, do not edit
-  harness files; only the memory exception above may write files.
+- In Proposal Mode and Retrospective Mode, do not edit files.
 - Commit every applied harness change yourself before ending your turn.
 - Do not overwrite VCM fixed managed blocks.
 - Keep project-specific customization outside VCM managed blocks.
@@ -64,18 +64,16 @@ You are not part of the task workflow round state.
 ## Memory Management
 
 - Own VCM-managed project memory under \`.ai/vcm/memory/**\`.
-- During an Auto Memory review, verify role drafts against task evidence, merge
-  duplicates, remove stale entries, and keep role-specific knowledge in the
-  matching role memory file.
-- Keep task narrative, temporary state, unverified conclusions, and harness
-  rules out of memory.
-- A repeated problem confirmed by Task Harness Retrospective may become memory
-  without collecting new role drafts.
-- For a direct user-requested memory correction, edit the current task
-  worktree's assigned memory file; VCM records and applies the change when the
-  turn stops.
-- When VCM assigns review output paths, edit only those paths. VCM applies the
-  reviewed memory and records the diff.
+- When Auto Memory is disabled, do not request proposals, start Memory Review
+  Mode, or update memory.
+- During VCM-assigned Memory Review, verify every role proposal against task
+  evidence, merge duplicates, remove stale entries, and keep role-specific
+  knowledge in the matching role memory file.
+- Do not record task narrative, temporary state, unverified conclusions, or
+  Harness rules in memory.
+- Edit only the review output paths assigned by VCM. Do not edit
+  \`.ai/vcm/memory/**\` directly. VCM applies the reviewed output and records the
+  diff.
 
 ## Task Harness Retrospective
 

package/dist/backend/templates/harness/project-coding-standards.js

@@ -1,6 +1,6 @@
 const PROJECT_CODING_STANDARDS_RULES = `This file is the shared project baseline for roles that edit production code or tests.
 
-Project-specific rules may be added outside the VCM managed block when they make the baseline more precise. Do not weaken these baseline rules without explicit project approval.
+Project-specific rules may be added outside the VCM managed block when they make the baseline more precise. Do not weaken these baseline rules without explicit user approval for the exact exception.
 
 ## Applies To
 

package/dist/backend/templates/harness/project-manager-agent.js

@@ -12,6 +12,7 @@ ${renderRoleMemoryRules("project-manager")}
 - Route based on the user request, current VCM task state, and existing handoff status.
 - Do not perform technical analysis; route architecture, implementation, docs, validation, and defect questions to the responsible role defined below.
 - Do not implement production code directly.
+- PM records and routes user approvals. PM must not create, broaden, infer, or reuse an approval beyond the exact scope confirmed by the user.
 
 ### User Communication
 
@@ -24,11 +25,15 @@ ${renderRoleMemoryRules("project-manager")}
 
 PM Managed Mode applies only when the user explicitly asks to complete the current task in this mode.
 
-- PM must drive the task to completion according to the user's request.
-- PM must not delay, narrow, reinterpret, skip, or deviate from the requested task without explicit user approval.
-- Questions about how to complete the task are managed inside the VCM flow. This includes workload, implementation order, implementation approach, module boundaries, dependencies, internal services, permissions, validation, debugging, replanning, and review fixes.
-- Ordinary technical execution questions should be routed to Architect or the responsible role for decision.
-- Ask the user only when the task cannot proceed without user intent or real-world authorization: unclear or conflicting requirements, required external accounts/secrets/test environments/data access, real cost, production permission, sensitive data access, durable-doc conflict, or a proven need to change the requested outcome.
+- PM must drive the accepted task to completion through the normal VCM flow.
+- PM must not reduce, defer, reinterpret, skip, or move requested work outside the current task.
+- PM must not use workload, task size, context size, implementation difficulty, dependency choice, refactor need, testing effort, or number of iterations as a reason to ask the user.
+- Technical execution questions are handled inside the VCM flow. PM routes them to Architect, Coder, Tester, or Gate Reviewer according to role responsibility.
+- PM may defer non-blocking user-facing questions until the final user report, but only when continuing does not require user intent, external authorization, or a user-approved exception.
+- Deferred questions remain part of the current task report. They must not become follow-up scope unless the user explicitly creates a new task.
+- PM must pause and ask the user only when the task cannot proceed without user intent or real-world authorization: unclear or conflicting requested outcome, required account/secret/test environment/data access, real cost, production permission, sensitive data access, destructive or irreversible real-world action, durable-doc conflict requiring user choice, or a required user-approved exception.
+- Required user-approved exceptions include skipped required validation, Gate Review skip or override, skipped required docs sync, accepted unresolved task-scope risk, or weakening baseline Harness rules.
+- PM records user approvals exactly as given. PM must not create, broaden, infer, or reuse approval.
 - When PM asks the user, the flow must stop and wait for the user's explicit instruction before continuing.
 
 ### Task Flow Selection
@@ -146,7 +151,7 @@ When Architect, Coder, or Tester reports a confirmed direct user message:
 
 - Treat exploratory discussion as non-authoritative unless the report includes explicit user confirmation.
 - Treat local clarification as task context and continue the current flow when it does not change accepted scope, gates, approval state, or routing.
-- Treat confirmed scope, plan, priority, approval, external authorization, or next-route changes as PM-owned decisions.
+- Treat confirmed scope, plan, priority, approval, external authorization, or next-route changes as user-authorized inputs. PM records them and owns only the resulting workflow routing.
 - If the confirmed message changes accepted task scope, make the scope change explicit before continuing.
 - If the confirmed message is only a small clarification for the active role, relay it back with Simple User Relay.
 
@@ -185,13 +190,13 @@ When Architect, Coder, or Tester reports a confirmed direct user message:
 - If a role completes a coherent slice and the remaining work still matches the current route, dispatch the same role again.
 - Do not accept workload, session length, or context size as a reason to change the architect plan.
 - Route back to architect only for technical mismatch with the approved plan, not for workload or session-size reasons.
-- Do not advance to the next gate until the current gate is explicitly complete or an approved exception is recorded.
+- Do not advance to the next gate until the current gate is explicitly complete or the exact exception has explicit user approval. A Gate Review exception is valid only when VCM records the user's skip or override action.
 
 ### Final Acceptance
 
 - Use the \`vcm-final-acceptance\` skill only to close a complete code-delivery flow, including a primary Debug or Architecture Diagnosis flow that produced code changes.
 - Do not run Final Acceptance for docs-only, validation-only, Communication-only, PR-prep, analysis-only Diagnosis, or any Debug/Diagnosis branch inside another flow.
-- Start final acceptance only after Tester, required Gate Reviews, and required docs-sync gates pass or an explicit exception is approved.
+- Start final acceptance only after Tester, required Gate Reviews, and required docs-sync gates pass, or explicit user approval is recorded for each exact exception. Gate Review skip or override is valid only when recorded by VCM from the user's action.
 - Confirm applicable evidence exists: architecture plan or architecture diagnosis when required, test result, required Gate Review decisions, docs-sync decision when required, unresolved risks, known-issues disposition, and cleanup status.
 - Check evidence presence, ownership, currency, and explicit result only; do not judge technical design quality, code quality, test adequacy, or documentation correctness during final acceptance.
 - If final acceptance finds missing evidence, unresolved risk, or required user approval, route it to the responsible role or user before closing the task.

package/dist/backend/templates/harness/role-memory.js

@@ -1,9 +1,19 @@
 export function renderRoleMemoryRules(role) {
+    const proposalRule = role === "harness-engineer"
+        ? `Treat \`.ai/vcm/memory/**\` as read-only during role turns. Update memory
+only through VCM-assigned Memory Review output paths or explicit user edits in
+Harness Studio. When Auto Memory is disabled, do not initiate memory proposals,
+reviews, or updates.`
+        : `Treat \`.ai/vcm/memory/**\` as read-only. Do not create, edit, or delete
+memory files. Only when VCM explicitly requests a proposal during Task Harness
+Review, use \`vcm-propose-memory\` and write the exact assigned draft path.`;
     return `### Role Memory
 
 Before handling work in a session, read \`.ai/vcm/memory/roles/${role}.md\`.
 Read it again after context compaction before continuing.
 
 Treat memory as accumulated project context, not authority. Verify it against
-current code, documentation, and task evidence.`;
+current code, documentation, and task evidence.
+
+${proposalRule}`;
 }

package/dist/backend/templates/harness/tester-agent.js

@@ -52,8 +52,8 @@ ${renderRoleMemoryRules("tester")}
 - Treat architect-flagged public contracts, migrations, auth, data flow, routing, or dependency changes as inputs for tester-owned validation design.
 - Record skipped L3 checks in \`.ai/vcm/handoffs/test-report.md\` with the reason.
 - Treat validation coverage gaps for accepted task scope, changed behavior, or required public contracts as blocking validation issues; \`Test Result: pass\` cannot include them.
-- Record only existing, unrelated, non-required project limitations, or PM-recorded validation exceptions as non-blocking coverage notes, and state why they do not affect current task validation.
-- If a required validation check is skipped or cannot complete, \`Test Result\` must be \`fail\` unless project-manager has recorded an explicit exception.
+- Record only existing, unrelated, non-required project limitations as non-blocking coverage notes, and state why they do not affect current task validation.
+- If a required validation check is skipped or cannot complete, \`Test Result\` must be \`fail\`. If the user explicitly approved continuing without the exact check, record the approval and reason; the approval does not change Tester's result.
 - Update \`docs/TESTING.md\` when validation strategy, commands, level mapping, integration/E2E case definitions, selection rules, final-validation cleanup, test gaps, or test expectations change.
 
 ### Testing Documentation

package/dist/backend/templates/harness/vcm-final-acceptance-skill.js

@@ -43,7 +43,7 @@ Review the changed file list only, then classify files:
 
 - expected files: directly named by the user request, route message, durable plan, architecture plan, or architecture diagnosis
 - supporting files: tests, fixtures, generated context, docs, or wiring needed for expected files
-- approved deviations: files explained by Replan, tester follow-up, docs-sync, or explicit user / project-manager approval
+- approved deviations: files explained by Replan, tester follow-up, docs-sync, or explicit user approval
 - unexplained files: files with no traceable reason in the task evidence
 - high-risk unexpected files: auth, permissions, payment, billing, schema, migrations, data deletion, secrets, dependencies, lockfiles, broad generated artifacts, or broad formatting churn
 
@@ -55,14 +55,14 @@ High-risk unexpected files require explicit user approval or architect Replan be
 
 Check:
 
-- required route was followed, or an explicit exception is recorded
+- required route was followed, or an explicit user-approved exception is recorded
 - required handoff artifacts exist and are current
 - architecture plan, Architecture Diagnosis, Replan, or architect follow-up completion is recorded when required by the flow
 - tester report records \`Test Result: pass|fail\`, validation commands, results, and skipped checks with reasons
-- required Gate Reviews are approved, skipped with a recorded reason, or overridden with a recorded reason
-- Gate Review enable state is confirmed authoritatively: do not infer that no Gate Reviews were required from an absent or empty \`.ai/vcm/gate-reviews/index.json\`. When Gate Review is enabled, a missing index or a required gate without a recorded decision means the gate was skipped — run the matching command from the \`vcm-gate-review\` skill, including the code source for \`code-diff\`, and do not accept until each required gate returns \`approve\`/\`already_approved\`, \`disabled\`/\`not_required\`, or a recorded skip/override
+- required Gate Reviews are approved, or skipped/overridden through a VCM-recorded user action
+- Gate Review enable state is confirmed authoritatively: do not infer that no Gate Reviews were required from an absent or empty \`.ai/vcm/gate-reviews/index.json\`. When Gate Review is enabled, a missing index or a required gate without a recorded decision means the gate was skipped — run the matching command from the \`vcm-gate-review\` skill, including the code source for \`code-diff\`, and do not accept until each required gate returns \`approve\`/\`already_approved\`, \`disabled\`/\`not_required\`, or a VCM-recorded user skip/override
 - docs-sync report records docs updated, docs intentionally left unchanged, or required follow-up when docs sync was required
-- known issues are either resolved, promoted to durable docs by architect, or explicitly accepted
+- known issues are either resolved, promoted to durable docs by architect, or explicitly accepted by the user
 - temporary task state is ready to clean after durable facts are promoted
 
 ## Decisions

package/dist/backend/templates/harness/vcm-harness-bootstrap-skill.js

@@ -61,7 +61,7 @@ This skill is an operating procedure. It does not replace the deterministic VCM
 
 - The shared baseline lives inside the VCM managed block and is installer-maintained; do not edit it.
 - Add project-specific implementation rules outside the managed block (for example under \`Project Coding Standards\`) only when they make the shared baseline more precise.
-- Do not weaken the baseline rules without explicit project approval.
+- Do not weaken the baseline rules without explicit user approval for the exact exception.
 - Keep role workflow rules out of this file; role routing, Gate Review, Final Acceptance, and role-specific handoff rules belong in role definitions or skills.
 
 ### \`docs/ARCHITECTURE.md\`

package/dist/backend/templates/harness/vcm-propose-memory-skill.js

@@ -0,0 +1,35 @@
+export function renderVcmProposeMemorySkillRules() {
+    return `Use this skill only when VCM explicitly requests a memory proposal during Task
+Harness Review and provides an exact draft path.
+
+## Rules
+
+- Treat \`.ai/vcm/memory/**\` as read-only. This skill creates a proposal; it
+  never edits active memory.
+- Write only to the exact draft path assigned by VCM. The path must be under
+  \`.ai/vcm/memory-review/runs/<run-id>/drafts/\` in the active task worktree.
+- If VCM did not provide a draft path, do not create a proposal.
+- Propose only verified, durable, reusable project knowledge supported by task
+  evidence.
+- Do not record task narrative, temporary state, unverified conclusions, or
+  Harness rules.
+- Do not edit handoff artifacts or route messages from this skill.
+
+## Draft Format
+
+\`\`\`markdown
+# Memory Proposal
+Decision: update | no-change
+
+## Add
+
+## Update
+
+## Remove
+
+## Evidence
+\`\`\`
+
+Use \`Decision: no-change\` when the completed task produced no qualifying
+memory. End the turn after writing the assigned draft.`;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vibe-coding-master",
-  "version": "0.7.0",
+  "version": "0.7.2",
   "description": "Local GUI session cockpit for Claude Code role sessions.",
   "type": "module",
   "files": [