vibe-coding-master 0.7.50 → 0.8.0

package/dist/backend/templates/handoff.js

@@ -1,4 +1,4 @@
-import { ARCHITECT_DEBUG_STATUSES, ARCHITECTURE_BRIEF_STATUSES, ARCHITECTURE_DIAGNOSIS_DISPOSITIONS, ARCHITECTURE_EVIDENCE_STATUSES, ARCHITECTURE_PLAN_RESULTS, CODER_COMPLETION_DECISIONS, DOCS_REPORT_DECISIONS, FINAL_ACCEPTANCE_DECISIONS, L3_ACTIONS, L3_REQUIRED_VALUES, PLANNING_PROGRESS_STATUSES, STRICT_NONE_VALUE, TEST_INFRASTRUCTURE_STATUSES, TEST_RESULTS, renderArtifactOptions } from "../../shared/validation/artifact-contract.js";
+import { ARCHITECT_DEBUG_DISPOSITIONS, ARCHITECT_DEBUG_STATUSES, ARCHITECTURE_BRIEF_STATUSES, ARCHITECTURE_DIAGNOSIS_DISPOSITIONS, ARCHITECTURE_EVIDENCE_STATUSES, ARCHITECTURE_PLAN_RESULTS, CODER_COMPLETION_DECISIONS, DOCS_REPORT_DECISIONS, DOCS_SYNC_CORRECTION_OWNERS, FINAL_ACCEPTANCE_DECISIONS, L3_ACTIONS, L3_REQUIRED_VALUES, PLANNING_PROGRESS_STATUSES, STRICT_NONE_VALUE, TEST_INFRASTRUCTURE_STATUSES, TEST_RESULTS, renderArtifactOptions } from "../../shared/validation/artifact-contract.js";
 const CURRENT_HANDOFF_NOTICE = "<!-- VCM current handoff: replace this file with one complete, self-contained snapshot of the current result. Restate all still-relevant evidence; do not refer to a prior revision, route message, Session, or transcript as evidence. -->";
 export function renderArchitectureBriefTemplate(taskSlug) {
     return `# Architecture Brief: ${taskSlug}
@@ -409,7 +409,7 @@ TBD
 
 ## Final Disposition
 
-TBD
+${renderArtifactOptions(ARCHITECT_DEBUG_DISPOSITIONS)}
 `;
 }
 export function renderArchitectureDiagnosisTemplate(taskSlug) {
@@ -516,6 +516,14 @@ TBD
 
 TBD
 
+## Correction Owner
+
+${renderArtifactOptions(DOCS_SYNC_CORRECTION_OWNERS)}
+
+## Correction Evidence
+
+${STRICT_NONE_VALUE}
+
 ## Decision
 
 ${renderArtifactOptions(DOCS_REPORT_DECISIONS)}
@@ -584,6 +592,10 @@ Evidence: none
 
 Authorization Text: none
 Violated Rule: none
+
+## User-Approved Follow-Up
+
+Approval Text: none
 `;
 }
 export function renderFinalAcceptanceTemplate(taskSlug) {

package/dist/backend/templates/harness/architect-agent.js

@@ -42,13 +42,14 @@ ${renderRoleMemoryRules("architect")}
 
 - Architect may invoke only \`vcm-architect-evidence-worker\`, \`vcm-architect-scaffold-worker\`, and \`vcm-architect-validation-worker\`.
 - Every worker must run in the foreground and return before the current Architect turn continues. Do not run workers in the background or end the turn while a worker is active.
-- Give each worker an exact bounded assignment, repo-relative paths, questions or commands, and one report path. Pass paths instead of copying full source, documents, or plans into the worker prompt.
+- Give each worker an exact bounded assignment, repo-relative paths, and one report path. Pass paths instead of copying full source, documents, or plans into the worker prompt.
 - Worker output is evidence or execution output, never an architecture decision. Architect owns every conclusion, plan, change boundary, validation interpretation, and final claim.
 - Use \`vcm-architect-evidence-worker\` for bounded bulk reading when relevant evidence spans multiple files or modules. Evidence workers may run in parallel only when their read scopes are disjoint.
+- Give evidence workers only repo-relative paths, symbols, documents, and questions. They have no shell access.
 - Evidence workers write reports under \`.ai/vcm/architect-workers/evidence/\`. Architect must review every report, verify decision-bearing claims against current code, and consolidate accepted facts into \`architecture-evidence.md\`.
 - In Planning Code Reading, supporting non-decision-bearing read requirements may be satisfied by an accepted evidence-worker report; requirements that say Architect must personally read or verify may not.
 - Use \`vcm-architect-scaffold-worker\` after the plan and Scaffold Manifest are complete for exact scaffold execution and mechanical text or configuration changes already fixed by the plan.
-- Use \`vcm-architect-validation-worker\` for exact non-interactive commands already selected by Architect. The worker does not select validation scope, modify tests or code, diagnose failures, or decide whether validation is sufficient.
+- Use \`vcm-architect-validation-worker\` for every assignment that requires a shell command, including read-only repository inspection commands. The worker runs only exact non-interactive commands already selected by Architect and does not select validation scope, modify tests or code, diagnose failures, or decide whether validation is sufficient.
 - Do not rerun a green command already reported by another Architect worker merely to execute it in the main Architect context.
 - Validation workers write reports under \`.ai/vcm/architect-workers/validation/\`. Architect must interpret the raw results and copy required evidence into the owning Architect artifact.
 
@@ -352,16 +353,16 @@ Each rewritten \`architecture-diagnosis.md\` must be a complete, self-contained
 
 - Compare every durable fact changed by the task across architecture docs, active plans, testing docs, known issues, code, and generated context. Resolve contradictions before reporting \`synced\`.
 - Verify names, ownership, dependency direction, lifecycle, public contracts, validation commands, current gaps, and active-plan status against their owning source.
-- Do not edit tester-owned \`docs/TESTING.md\` during post-validation docs sync. If it contradicts accepted code, generated context, or other durable docs, report the exact conflict to project-manager for Tester correction.
+- Do not edit tester-owned \`docs/TESTING.md\` during post-validation docs sync. If it contradicts accepted code, generated context, or other durable docs, return \`Decision: blocked\`, \`Correction Owner: tester\`, and the exact conflict as Correction Evidence.
 - Run \`.ai/tools/check-durable-docs\` after durable-doc changes. A failing audit prevents \`Decision: synced\`; fix Architect-owned findings and report Tester-owned findings for routing.
 
 #### Docs Sync Report
 
 - Write \`.ai/vcm/handoffs/docs-sync-report.md\` for post-validation docs sync in Code-Change Flow, Architect Debug Flow, or a code-producing Architecture Diagnosis Flow. Do not write it for Docs-Only Flow or a Debug/Diagnosis Branch.
 - In Docs-Only Flow, submit the complete \`.ai/vcm/handoffs/docs-update-report.md\` before returning to PM. It must record the decision, changed and reviewed documents, evidence reviewed, checks performed, commit, and remaining documentation issues.
-- The report records decision, evidence reviewed, current-truth reconciliation, generated-context freshness, cross-document consistency, architecture docs, active plans, testing-doc consistency, known-issues disposition, durable-doc audit command and result, docs updated, docs left unchanged, remaining documentation risks, and handoff notes.
+- The report records decision, evidence reviewed, current-truth reconciliation, generated-context freshness, cross-document consistency, architecture docs, active plans, testing-doc consistency, known-issues disposition, durable-doc audit command and result, docs updated, docs left unchanged, remaining documentation risks, correction owner/evidence, and handoff notes.
 - Each rewritten \`docs-sync-report.md\` must be a complete, self-contained snapshot of the current docs-sync result and must not rely on a prior report revision.
-- \`Decision\` must be \`synced\`, \`unchanged\`, or \`blocked\`.
+- \`Decision: synced\` or \`unchanged\` requires \`Correction Owner: none\` and \`Correction Evidence: None.\`. \`Decision: blocked\` requires exactly one \`Correction Owner: architect|coder|tester\` and concrete Correction Evidence.
 
 ### Background Jobs
 

package/dist/backend/templates/harness/architect-evidence-worker-agent.js

@@ -7,11 +7,13 @@ You are \`vcm-architect-evidence-worker\`, a foreground evidence-collection suba
 ### Scope
 
 - Investigate only the modules, files, documents, and questions assigned by Architect.
+- You have no shell access. Accept only assignments expressed as repo-relative paths, symbols, documents, and questions.
 - Read the assigned implementation and supporting project artifacts in full where required by the assignment.
 - Record repository facts with exact repo-relative file paths and symbol or section names.
 - Separate verified facts, contradictions, and unresolved items.
 - Do not design architecture, recommend implementation, decide scope, change contracts, edit project files, run validation, or communicate with project-manager or the user.
 - Do not claim a complete semantic relationship from text matches. Architect owns LSP navigation and verification of definitions, references, callers, callees, implementations, public surfaces, and decision-bearing behavior paths.
+- Do not reconstruct command output. If command output is required, report it as unresolved so Architect can assign it to \`vcm-architect-validation-worker\`.
 
 ### Evidence Output
 

package/dist/backend/templates/harness/architect-validation-worker-agent.js

@@ -6,7 +6,7 @@ You are \`vcm-architect-validation-worker\`, a foreground command-execution suba
 
 ### Scope
 
-- Run only the exact commands, working directory, and validation targets assigned by Architect.
+- Run only the exact commands, working directory, and assigned targets provided by Architect, including read-only repository inspection commands.
 - Do not choose validation scope, design or modify tests, edit production code, change configuration, diagnose architecture, repair failures, or decide whether the task passes.
 - Preserve each command's real exit code and output. Do not add wrappers, pipelines, retries, skips, or fallback commands unless Architect assigned them.
 - Use \`.ai/tools/run-long-check\` and \`.ai/tools/watch-job\` when the assigned command requires supervised long-running execution. Remain in the foreground until every assigned command reaches a terminal result.

package/dist/backend/templates/harness/claude-root.js

@@ -6,7 +6,7 @@ export function renderRootClaudeHarnessRules() {
 - \`vcm-route-message\` is the only channel for PM-hub dispatch and reporting among project-manager, architect, coder, and tester. Gate Review and tool-role work use their dedicated VCM skills and controllers. Follow the route skill's write-then-stop rule.
 - Before every PM dispatch to Architect, Coder, or Tester, project-manager must use \`vcm-workflow-review\`. Only an accepted Workflow Progress transition grants the next route.
 - \`vcm-task-state\` is recoverable context only. Workflow permission comes only from accepted \`workflow-progress.md\` submissions.
-- Use \`vcm-long-running-validation\` for long-running validation. Follow the background job limits below.
+- Workflow roles use \`vcm-long-running-validation\` for long-running validation and follow the background job limits below.
 - Use \`vcm-report-harness-issue\` when you notice a reusable VCM harness problem. Record feedback; do not contact Harness Engineer directly.
 - The root \`<VCM-memory>\` block is shared project memory. Treat every \`<VCM-memory>\` block as read-only and use \`vcm-propose-memory\` only when VCM assigns an exact memory proposal or candidate path.
 - Only the user may approve scope reduction, skipped required validation, Gate Review skip or override, skipped required docs sync, accepted unresolved task-scope risk, or weakening of baseline Harness rules. PM may record and route the user's approval but cannot grant it.
@@ -14,7 +14,7 @@ export function renderRootClaudeHarnessRules() {
 
 ## VCM Managed Artifacts
 
-- VCM-managed Markdown under \`.ai/vcm/handoffs/\`, Coder Worker reports, request-scoped Gate Review reports, route messages, memory proposals, and Harness Feedback must be submitted with \`.ai/tools/vcm-artifact\`; never write or edit the authoritative path directly.
+- Workflow roles must submit VCM-managed Markdown under \`.ai/vcm/handoffs/\`, Coder Worker reports, request-scoped Gate Review reports, route messages, memory proposals, and Harness Feedback with \`.ai/tools/vcm-artifact\`; never write or edit the authoritative path directly.
 - Write the candidate outside \`.ai/vcm/\`, then run \`.ai/tools/vcm-artifact <kind> --file <candidate> --mode <draft|final>\`. Dynamic artifacts also require the exact VCM-assigned \`--path\`.
 - Use \`draft\` while an allowed lifecycle remains incomplete. Use \`final\` before routing or consuming a terminal artifact. A failed submission leaves the authoritative artifact unchanged; correct every reported violation and submit again.
 - Do not route, review, or rely on a candidate file. Only the VCM-written authoritative path is workflow evidence.
@@ -27,7 +27,7 @@ If a reusable harness problem is suspected, it is enough to record a concise fee
 
 ## VCM Background Jobs
 
-- Never run the Bash tool with \`run_in_background: true\`. Never detach a process with \`nohup\`, \`setsid\`, \`disown\`, or a trailing \`&\`. VCM denies these calls.
+- Workflow roles never run the Bash tool with \`run_in_background: true\` or detach a process with \`nohup\`, \`setsid\`, \`disown\`, or a trailing \`&\`. VCM denies these calls for workflow roles.
 - The only sanctioned long-running mechanism is the \`vcm-long-running-validation\` skill: \`.ai/tools/run-long-check\` plus \`.ai/tools/watch-job\`. Only one job may run at a time.
 - The moment a command might run longer than 2 minutes, switch to that skill instead of running the command directly.
 - While a job is running, stay in the current turn and keep calling \`.ai/tools/watch-job\` until it reports a terminal result; VCM blocks turn-end while a job is running, and a job without a live watcher is killed automatically.

package/dist/backend/templates/harness/coder-agent.js

@@ -12,6 +12,7 @@ ${renderRoleMemoryRules("coder")}
 - Implement assigned file/function-level scaffold items; do not analyze, review, dispute, or redesign architecture, module boundaries, public contracts, dependency direction, durable docs strategy, validation strategy, or final test adequacy.
 - Treat the architecture plan and scaffold as execution instructions, not review targets. Do not critique, reinterpret, or challenge them during Coder work.
 - In a PM-routed Docs-Only Flow, update the assigned documentation and related documentation needed for consistency without changing production code or tests.
+- When PM routes a Coder-owned correction from a blocked docs-sync report, update only the assigned documentation, commit it, rerun applicable L0/L1 checks, and replace \`.ai/vcm/handoffs/coder-completion.md\` with current evidence so the delivery flow can return through Tester and both post-implementation Gates.
 
 ### Code Navigation
 

package/dist/backend/templates/harness/harness-engineer-agent.js

@@ -72,12 +72,13 @@ You are not part of the task workflow round state.
 - Own VCM-managed project memory in the root and role \`<VCM-memory>\` blocks.
 - When Auto Memory is disabled, do not request proposals or update memory.
 - During a Retrospective that includes Auto Memory Review, first inspect every
-  entry in every current memory snapshot. Verify each entry against current
-  code, durable documentation, and final task evidence. For every substantive
-  entry, decide whether to retain, update, remove, or move it to a durable
-  document; record the decision reason, the impact of removing it, and whether
-  memory or a durable document is the correct source. Complete this full review
-  even when every proposal says \`no-change\`.
+  entry assigned in the existing-memory entries file. That file is the complete
+  decision set: emit exactly one decision for every listed \`itemId\`, copying
+  its target and entry exactly. Verify each entry against current code, durable
+  documentation, and final task evidence. Decide whether to retain, update,
+  remove, or move it to a durable document; record the decision reason, the
+  impact of removing it, and whether memory or a durable document is the correct
+  source. Complete this full review even when every proposal says \`no-change\`.
 - After reviewing existing memory, verify every role proposal against task
   evidence, including any Architect planning-session candidate assigned by VCM.
   Review every proposal item separately; never accept or reject an entire role
@@ -201,15 +202,17 @@ Issue drafts must include title, problem, reproduction, expected behavior,
 actual behavior, VCM version when known, affected harness/UI area, impact, and a
 suggested fix if known.
 
-Before adding a later finding to an issue used in the current conversation,
-check that issue's current state.
+Consider an existing issue only when it is already identified in the current
+conversation. Do not search or enumerate the issue tracker to find related or
+duplicate issues.
 
-Do not add actionable work to a closed issue. Create a new issue and reference
-the closed issue instead.
+For such a known issue, check its current state before adding a later finding.
+Do not add actionable work to a closed issue; create a new issue and reference
+that known closed issue instead.
 
 Add a comment only when the finding updates or corrects the same work. If the
 finding can be implemented, tested, and closed independently, create a separate
-issue and reference the related issue.
+issue and reference the known related issue.
 
 Do not submit issues yourself unless the harness owner gives explicit
 in-session authorization. Do not include private source code, secrets, private

package/dist/backend/templates/harness/project-manager-agent.js

@@ -103,8 +103,9 @@ PM may leave this path only through the allowed branches below.
 - **Tester Failure:** If Tester returns \`Test Result: fail\` with \`Test Infrastructure Status: none\`, \`repaired\`, or \`production-change-required\`, suspend the main flow and enter Architect Debug Branch.
 - **Validation Revision:** If the validation-adequacy Gate returns \`request_changes\`, route the complete report to Tester. Tester must correct the tests or evidence, rerun required validation, commit tracked Tester-owned changes, and replace \`test-report.md\` before PM reruns the Gate. If corrected validation returns \`fail\`, apply Tester Test-Infrastructure Repair or Tester Failure from that result.
 - **Tester Code-Diff Correction:** If every code-diff finding has \`Finding Scope: test-only\`, route the complete report to Tester. After correction, repeat Tester validation, validation-adequacy Gate, and \`code-diff --source coder\`.
+- **User-Approved Post-Validation Work:** After Tester returns \`pass\` and both post-implementation Gates succeed, route Tester again only when the user explicitly approves additional Tester-owned work in the current task. Submit the user's exact approval through \`User-Approved Follow-Up\`, not Workflow Override. After Tester completes and commits the work, repeat Tester validation, validation-adequacy Gate, and \`code-diff --source coder\`.
 - **Code-Diff Correction:** If any code-diff finding has \`Finding Scope: implementation\`, suspend the main flow and enter Architect Debug Branch with the complete Gate report.
-- **Docs Sync Correction:** \`Decision: synced\` or \`unchanged\` continues to Final Acceptance. \`Decision: blocked\` remains at docs sync unless the report identifies an allowed Debug, Diagnosis, or user-decision branch.
+- **Docs Sync Correction:** \`Decision: synced\` or \`unchanged\` continues to Final Acceptance only with \`Correction Owner: none\`. For \`Decision: blocked\`, route the exact \`Correction Owner\`: Architect repeats docs sync; Coder corrects Coder-owned documentation and returns through Tester and both post-implementation Gates; Tester corrects Tester-owned tests or \`docs/TESTING.md\`, reruns validation, and returns through both Gates. Then rerun Architect docs sync.
 - **Final Acceptance Follow-Up:** Route \`needs-coder-follow-up\` to Coder, \`needs-architect-follow-up\` to Architect, \`needs-docs-sync\` to Architect docs sync, and \`blocked-by-user-decision\` to the user. After follow-up work, resume from the earliest affected Code-Change Flow step and repeat every downstream Gate.
 - **User Decision:** Pause only when the flow requires user intent, external authorization, or an exact user-approved exception. Resume from the suspended step after the user's decision is recorded.
 - **Gate Runtime:** \`started\` or \`running\` waits for the VCM callback. \`failed_to_start\` stops the flow for VCM retry, skip, or override handling. Other successful tool results continue according to the main flow.
@@ -165,6 +166,7 @@ The shared path is:
 - **Architecture Diagnosis:** If Tester returns \`Test Result: fail\` with \`Test Infrastructure Status: none\`, \`repaired\`, or \`production-change-required\`, enter Architecture Diagnosis Branch.
 - **Validation Revision:** If the validation-adequacy Gate returns \`request_changes\`, route the complete report to Tester. After Tester corrects tests or evidence, reruns validation, commits tracked Tester-owned changes, and replaces \`test-report.md\`, rerun the Gate.
 - **Tester Code-Diff Correction:** If every code-diff finding has \`Finding Scope: test-only\`, route the complete report to Tester. After correction, repeat Tester validation, validation-adequacy Gate, and \`code-diff --source architect-debug\`.
+- **User-Approved Post-Validation Work:** After Tester returns \`pass\` and both Gates succeed, the user may explicitly approve additional Tester-owned work. Route Tester with the exact \`User-Approved Follow-Up\` approval, then repeat Tester validation and both Gates.
 - **Code-Diff Revision:** If any code-diff finding has \`Finding Scope: implementation\`, route the complete report to Architect Debug Mode. After correction, repeat Tester validation, validation-adequacy Gate, and \`code-diff --source architect-debug\`.
 
 #### Successful Exit
@@ -198,6 +200,7 @@ Architecture Diagnosis Mode must run before another Debug Mode fix or Coder disp
 - **Tester Failure:** If Tester returns \`Test Result: fail\` with \`Test Infrastructure Status: none\`, \`repaired\`, or \`production-change-required\`, pause and report to the user. If required validation remains unavailable, ask whether the user explicitly approves retaining that exact Coverage Gap.
 - **Validation Revision:** If the validation-adequacy Gate returns \`request_changes\`, route the complete report to Tester. After Tester corrects tests or evidence, reruns validation, commits tracked Tester-owned changes, and replaces \`test-report.md\`, rerun the Gate.
 - **Tester Code-Diff Correction:** If every code-diff finding has \`Finding Scope: test-only\`, route the complete report to Tester. After correction, repeat Tester validation, validation-adequacy Gate, and \`code-diff --source architect-diagnosis\`.
+- **User-Approved Post-Validation Work:** After Tester returns \`pass\` and both Gates succeed, the user may explicitly approve additional Tester-owned work. Route Tester with the exact \`User-Approved Follow-Up\` approval, then repeat Tester validation and both Gates.
 - **Code-Diff Revision:** If any code-diff finding has \`Finding Scope: implementation\`, route the complete report to Architecture Diagnosis Mode. After correction, repeat Tester validation, validation-adequacy Gate, and \`code-diff --source architect-diagnosis\`.
 
 #### Successful Exit
@@ -370,6 +373,7 @@ PM may lightly rewrite the user's words to:
 - Use the \`vcm-final-acceptance\` skill only to close a complete code-delivery flow, including Architect Debug Flow or an Architecture Diagnosis Flow that produced code changes.
 - Do not run Final Acceptance for Docs-Only Flow, Validation-Only Flow, Communication-Only Flow, PR-Preparation Flow, analysis-only Diagnosis, Architect Debug Branch, or Architecture Diagnosis Branch.
 - Start final acceptance only after Tester, required Gate Reviews, and required docs-sync gates pass, or explicit user approval is recorded for each exact exception. Gate Review skip or override is valid only when recorded by VCM from the user's action.
+- In any complete delivery flow, a blocked docs-sync report routes its exact Correction Owner before Final Acceptance; after that owner completes the correction, repeat every invalidated validation, Gate, and docs-sync step.
 - Confirm applicable evidence exists: architecture plan or architecture diagnosis when required, test result, required Gate Review decisions, docs-sync decision when required, unresolved risks, known-issues disposition, and cleanup status.
 - Check evidence presence, ownership, currency, and explicit result only; do not judge technical design quality, code quality, test adequacy, or documentation correctness during final acceptance.
 - In Code-Change Flow, handle every non-accepted decision through Final Acceptance Follow-Up. In another eligible flow, route missing evidence, unresolved risk, or required user approval to the responsible role or user before closing the task.

package/dist/backend/templates/harness/tester-agent.js

@@ -71,6 +71,12 @@ ${renderRoleMemoryRules("tester")}
 - A required check that fails, is skipped, or cannot be completed by Tester continuation is a blocking validation issue and requires \`Test Result: fail\`.
 - Update \`docs/TESTING.md\` when validation strategy, commands, level mapping, integration/E2E case definitions, selection rules, final-validation cleanup, test gaps, or test expectations change.
 
+### User-Approved Post-Validation Work
+
+- Use this path only when project-manager routes the user's exact approval after a passing Test Report and successful validation-adequacy and code-diff Gates.
+- Complete only the approved Tester-owned tests, fixtures, test-only helpers, scripts, or \`docs/TESTING.md\` work; do not reinterpret the approval as production scope.
+- Commit the work, rerun all affected validation, and replace \`test-report.md\` with the current complete result. The prior passing report and Gate decisions are no longer current evidence.
+
 ### Test-Infrastructure Repair
 
 - Use this repair path only when project-manager routes a reported test-infrastructure defect back to Tester.

package/dist/backend/templates/harness/vcm-workflow-review-skill.js

@@ -28,6 +28,10 @@ Evidence: <current artifact, Gate result, or user request supporting this dispat
 
 Authorization Text: none
 Violated Rule: none
+
+## User-Approved Follow-Up
+
+Approval Text: none
 \`\`\`
 
 Use \`Requested Flow\` only to start a flow, switch a top-level flow, enter or replace a Branch, or return from a Branch. Otherwise use \`none\`.
@@ -53,8 +57,20 @@ Violated Rule: <copy the exact VCM rejection reason>
 
 VCM binds that authorization to this exact task state, flow, target role, evidence, and violated rule. It applies once and is consumed by the matching dispatch. Do not infer, broaden, or reuse authorization.
 
+## User-Approved Post-Validation Work
+
+When Tester has returned \`pass\`, validation-adequacy and code-diff are both successful, and the user explicitly approves additional Tester-owned work in the current task, propose Tester again with:
+
+\`\`\`text
+Authorization Text: none
+Violated Rule: none
+Approval Text: <user's exact approval>
+\`\`\`
+
+This is a normal one-time follow-up approval, not a Workflow Override. Do not use it before both Gates are successful, for required unresolved coverage, for another owner, or without the user's exact approval. After Tester completes the approved work, rerun Tester validation and every invalidated Gate.
+
 ## Completion
 
-When the active flow has completed without another role dispatch, increment Revision, copy the confirmed history exactly, set \`Status: completed\`, and set every Proposed Dispatch and User Authorization value to \`none\`. VCM accepts completion only when the flow's required final artifact and Gate evidence exists.
+When the active flow has completed without another role dispatch, increment Revision, copy the confirmed history exactly, set \`Status: completed\`, and set every Proposed Dispatch, User Authorization, and User-Approved Follow-Up value to \`none\`. VCM accepts completion only when the flow's required final artifact and Gate evidence exists.
 `;
 }

package/dist/shared/validation/artifact-check.js

@@ -1,4 +1,4 @@
-import { ARCHITECT_DEBUG_STATUSES, ARCHITECTURE_BRIEF_STATUSES, ARCHITECTURE_DIAGNOSIS_DISPOSITIONS, ARCHITECTURE_EVIDENCE_STATUSES, ARCHITECTURE_PLAN_RESULTS, CODER_COMPLETION_DECISIONS, DOCS_REPORT_DECISIONS, FINAL_ACCEPTANCE_DECISIONS, L3_ACTIONS, L3_REQUIRED_VALUES, PLANNING_PROGRESS_STATUSES, STRICT_NONE_VALUE, TEST_INFRASTRUCTURE_STATUSES, TEST_RESULTS } from "./artifact-contract.js";
+import { ARCHITECT_DEBUG_DISPOSITIONS, ARCHITECT_DEBUG_STATUSES, ARCHITECTURE_BRIEF_STATUSES, ARCHITECTURE_DIAGNOSIS_DISPOSITIONS, ARCHITECTURE_EVIDENCE_STATUSES, ARCHITECTURE_PLAN_RESULTS, CODER_COMPLETION_DECISIONS, DOCS_REPORT_DECISIONS, DOCS_SYNC_CORRECTION_OWNERS, FINAL_ACCEPTANCE_DECISIONS, L3_ACTIONS, L3_REQUIRED_VALUES, PLANNING_PROGRESS_STATUSES, STRICT_NONE_VALUE, TEST_INFRASTRUCTURE_STATUSES, TEST_RESULTS } from "./artifact-contract.js";
 import { getArtifactDefinition } from "./artifact-registry.js";
 const PLACEHOLDER_PATTERN = /(^|\n)\s*(TBD|Not run yet\.?|status:\s*draft)\s*(\n|$)/i;
 export function checkMarkdownArtifact(kind, artifactPath, content, options = {}) {
@@ -94,7 +94,14 @@ function validateArtifactFields(kind, content, mode) {
         return [];
     }
     if (kind === "architect-debug") {
-        return validateLifecycleField(content, "Status", ARCHITECT_DEBUG_STATUSES, "completed", mode);
+        const invalidFields = validateLifecycleField(content, "Status", ARCHITECT_DEBUG_STATUSES, "completed", mode);
+        if (mode === "final") {
+            const disposition = readArtifactSectionContent(content, "Final Disposition")?.trim().toLowerCase();
+            if (!isAllowedValue(disposition, ARCHITECT_DEBUG_DISPOSITIONS)) {
+                invalidFields.push(renderExactSectionError("Final Disposition", ARCHITECT_DEBUG_DISPOSITIONS.join("|"), disposition));
+            }
+        }
+        return invalidFields;
     }
     if (kind === "architecture-diagnosis") {
         const disposition = readArtifactSectionContent(content, "Final Disposition")?.trim().toLowerCase();
@@ -244,9 +251,35 @@ function validateArtifactFields(kind, content, mode) {
         }
         return invalidFields;
     }
-    if (kind === "docs-update-report" || kind === "docs-sync-report") {
+    if (kind === "docs-update-report") {
         return validateDecision(content, DOCS_REPORT_DECISIONS);
     }
+    if (kind === "docs-sync-report") {
+        const invalidFields = validateDecision(content, DOCS_REPORT_DECISIONS);
+        const decision = readArtifactSectionContent(content, "Decision")?.trim().toLowerCase();
+        const owner = readArtifactSectionContent(content, "Correction Owner")?.trim().toLowerCase();
+        const evidence = readArtifactSectionContent(content, "Correction Evidence");
+        if (!isAllowedValue(owner, DOCS_SYNC_CORRECTION_OWNERS)) {
+            invalidFields.push(renderExactSectionError("Correction Owner", DOCS_SYNC_CORRECTION_OWNERS.join("|"), owner));
+        }
+        if (decision === "synced" || decision === "unchanged") {
+            if (owner !== "none") {
+                invalidFields.push(renderExactSectionError("Correction Owner", "none", owner, `when Decision is ${decision}`));
+            }
+            if (!isExactNone(evidence)) {
+                invalidFields.push(renderExactSectionError("Correction Evidence", STRICT_NONE_VALUE, evidence, `when Decision is ${decision}`));
+            }
+        }
+        if (decision === "blocked") {
+            if (!owner || owner === "none") {
+                invalidFields.push("Correction Owner must be architect, coder, or tester when Decision is blocked.");
+            }
+            if (!hasSubstantiveSectionValue(evidence)) {
+                invalidFields.push("Correction Evidence must identify the unresolved documentation correction when Decision is blocked.");
+            }
+        }
+        return invalidFields;
+    }
     if (kind === "final-acceptance") {
         return validateDecision(content, FINAL_ACCEPTANCE_DECISIONS);
     }

package/dist/shared/validation/artifact-contract.js

@@ -9,6 +9,12 @@ export const ARCHITECTURE_PLAN_RESULTS = [
 ];
 export const CODER_COMPLETION_DECISIONS = ["ready_for_review", "incomplete", "failed"];
 export const ARCHITECT_DEBUG_STATUSES = ["pending", "completed"];
+export const ARCHITECT_DEBUG_NORMAL_PLAN_DISPOSITION = "normal architecture plan required";
+export const ARCHITECT_DEBUG_DISPOSITIONS = [
+    "local fix completed",
+    ARCHITECT_DEBUG_NORMAL_PLAN_DISPOSITION,
+    "user clarification required"
+];
 export const ARCHITECTURE_DIAGNOSIS_DISPOSITIONS = [
     "analysis completed",
     "diagnosis implementation completed",
@@ -24,6 +30,7 @@ export const TEST_INFRASTRUCTURE_STATUSES = [
 export const L3_REQUIRED_VALUES = ["yes", "no"];
 export const L3_ACTIONS = ["run-existing", "updated", "added"];
 export const DOCS_REPORT_DECISIONS = ["synced", "unchanged", "blocked"];
+export const DOCS_SYNC_CORRECTION_OWNERS = ["none", "architect", "coder", "tester"];
 export const FINAL_ACCEPTANCE_DECISIONS = [
     "accepted",
     "accepted-with-known-risks",

package/dist/shared/validation/artifact-registry.js

@@ -184,6 +184,8 @@ export const ARTIFACT_DEFINITIONS = [
             "Public Contract / Module Boundary Notes",
             "Remaining Documentation Risks",
             "Known Issues Disposition",
+            "Correction Owner",
+            "Correction Evidence",
             "Decision"
         ]
     },
@@ -194,7 +196,8 @@ export const ARTIFACT_DEFINITIONS = [
         requiredHeadings: [
             "Dispatch History",
             "Proposed Dispatch",
-            "User Authorization"
+            "User Authorization",
+            "User-Approved Follow-Up"
         ]
     },
     {