weir-harness 1.2.0 → 1.2.1

package/src/capabilities/publisher.js

@@ -1,129 +0,0 @@
-// Tasks 11.1/11.2 of the session-capability-manager change: pre-publish
-// target and reference validation, plus immutable-generation publishing with
-// the universal → DSH root bridge.
-//
-// 11.1 — after resolution a target path must stay INSIDE its selected scope
-// root; a symlink escaping the root is refused and named. Absolute paths,
-// traversal paths and credential-carrying references are refused. An
-// unrecognized install-lock schema stops everything — never migrated,
-// rewritten, downgraded or deleted.
-//
-// 11.2 — staging lands on the target filesystem first; publications are
-// serialized per scope/identity; the active manifest pointer, provenance and
-// operation receipt switch in ONE atomic publication (the group-2
-// distribution pointer). The active generation and local changes are
-// re-checked with CAS before switching. A platform without supported atomic
-// switch is reported unsupported — never delete-then-copy. Staging output
-// maps to the DSH-recognized global / workspace skill roots; bundled paths
-// are never allowed targets; the workspace root comes from the host session
-// workspace resolver.
-import { realpathSync } from 'node:fs'
-import { isAbsolute, join, resolve, sep } from 'node:path'
-import { createHash } from 'node:crypto'
-
-export const LOCK_SCHEMA_VERSION = 1
-
-const message = error => (error instanceof Error ? error.message : String(error))
-
-/**
- * The scope roots staging output may map to (11.2). `bundled` is present for
- * completeness of the table and is always a REFUSED target.
- * @param {{ agentsHome?: string, workspaceRoot?: string, bundledRoot?: string }} roots
- */
-export function resolveScopeRoots({ agentsHome, workspaceRoot, bundledRoot } = {}) {
-  const roots = {}
-  if (typeof agentsHome === 'string' && agentsHome.length > 0) roots.global = join(agentsHome, 'skills')
-  if (typeof workspaceRoot === 'string' && workspaceRoot.length > 0) roots.workspace = join(workspaceRoot, '.agents', 'skills')
-  return {
-    roots,
-    /** @param {string} scope */
-    rootFor(scope) {
-      if (scope === 'bundled') return { allowed: false, reason: 'bundled paths are not publish targets' }
-      const root = roots[scope]
-      if (!root) return { allowed: false, reason: `scope root for "${scope}" is not configured` }
-      return { allowed: true, root }
-    },
-  }
-}
-
-/** @param {unknown} ref */
-export function referenceProblem(ref) {
-  if (typeof ref !== 'string' || ref.length === 0) return 'reference must be a non-empty string'
-  if (isAbsolute(ref)) return `absolute reference refused: ${ref}`
-  if (ref.split(/[\\/]+/).includes('..')) return `traversal reference refused: ${ref}`
-  if (/(token|secret|password|key|credential)[:=]/i.test(ref)) return `credential-carrying reference refused`
-  return null
-}
-
-/**
- * The resolved target must stay inside the scope root; a symlink escaping
- * the root is refused and named (11.1).
- * @param {string} scopeRoot @param {string} targetPath
- * @param {{ realpath?: (path: string) => string }} [deps]
- */
-export function validateTargetInsideRoot(scopeRoot, targetPath, deps = {}) {
-  const realpath = deps.realpath ?? realpathSync
-  const root = realpath(scopeRoot)
-  let resolved
-  try {
-    resolved = realpath(targetPath)
-  } catch {
-    resolved = resolve(targetPath)
-  }
-  const inside = resolved === root || resolved.startsWith(`${root}${sep}`)
-  if (!inside) {
-    return { ok: false, reason: `target escapes the scope root: ${resolved} is outside ${root}${resolved === targetPath ? '' : ` (symlink from ${targetPath})`}` }
-  }
-  return { ok: true, resolved }
-}
-
-/**
- * The install lock must be schema-recognized before any write (11.1):
- * anything else stops without migrating, rewriting, downgrading or deleting.
- * @param {unknown} lockPayload
- */
-export function lockVerdict(lockPayload) {
-  if (lockPayload === null || typeof lockPayload !== 'object' || Array.isArray(lockPayload)) {
-    return { recognized: false, reason: 'install lock payload is not an object' }
-  }
-  if (lockPayload.schemaVersion !== LOCK_SCHEMA_VERSION) {
-    return { recognized: false, reason: `unrecognized install-lock schema version: ${JSON.stringify(lockPayload.schemaVersion)} — stopping without migrating, rewriting, downgrading or deleting` }
-  }
-  return { recognized: true }
-}
-
-/**
- * The pre-publish re-check (11.2): the active generation must still match
- * what the caller prepared against, and the local content must be untouched
- * since the managed digest was recorded.
- * @param {{ activeGeneration: string|null, expectedActive: string|null,
- *   localDigest: string|null, managedDigest: string|null }} input
- */
-export function publishPrecondition({ activeGeneration, expectedActive, localDigest, managedDigest }) {
-  if (activeGeneration !== expectedActive) {
-    return { ok: false, reason: `active generation moved: expected ${expectedActive ?? 'none'}, found ${activeGeneration ?? 'none'}` }
-  }
-  if (typeof managedDigest === 'string' && managedDigest.length > 0 && localDigest !== managedDigest) {
-    return { ok: false, reason: 'local content diverged from the last managed digest — showing the diff and pausing publication (overwrite / leave unchanged required)' }
-  }
-  return { ok: true }
-}
-
-/**
- * One immutable generation record (11.2): generation id, file manifest and
- * provenance — content-addressed by the manifest digest.
- * @param {{ identity: string, files: Record<string, string>, provenance: unknown, receipt: unknown }} input
- */
-export function generationRecordOf({ identity, files, provenance, receipt }) {
-  const manifest = Object.fromEntries(Object.entries(files).sort(([a], [b]) => a.localeCompare(b)).map(([path, content]) => [path, createHash('sha256').update(String(content)).digest('hex')])
-  )
-  return {
-    generationId: createHash('sha256').update(JSON.stringify([identity, manifest])).digest('hex').slice(0, 16),
-    identity,
-    manifest,
-    provenance,
-    receipt,
-  }
-}
-
-export const __message = message

package/src/capabilities/skill-admission.js

@@ -1,181 +0,0 @@
-// Skill-side session-level admission of the session capability manager
-// (design D2, tasks 4.6). ONE core check against the SERVER-SIDE current
-// selection — the accepted authority snapshot, never a client-filtered list —
-// backs three blocking paths:
-//   1. `skill` tool calls (admit/loadBody): an unselected skill gets an
-//      explicit 'unavailable' result and its body is NEVER loaded.
-//   2. Slash submissions (validateSlash): the server-side revalidation mount
-//      point for the slash pipeline — a client-side filtered list can never
-//      smuggle an unselected skill through.
-//   3. Subagent prompt publication (admitPromptPublication): a skill prompt
-//      may only be published into a child session while the skill is still
-//      selected at publication time.
-// While the session's admission fence is held (an Apply is committing),
-// not-yet-handed-off calls are refused; handed-off reads may complete, but a
-// read whose authority changed before completion is revoked BEFORE any content
-// is returned: read is not authorization. Admission writes nothing and audits
-// nothing — durable policy events stay with the Apply and refresh engines.
-import { isSegment } from './store/paths.js'
-import { createSkillIdentity, skillIdentityKey } from './skill-identity.js'
-
-const message = error => error instanceof Error ? error.message : String(error)
-
-/** English user-facing denial messages (template layer). */
-const MESSAGES = {
-  'invalid-session': () => 'The session is unavailable.',
-  'invalid-identity': name => `Skill "${name}" has an invalid identity.`,
-  'admission-fence-held': name => `Skill "${name}" is temporarily unavailable: the session selection is being updated.`,
-  'selection-authority-unavailable': name => `Skill "${name}" is unavailable: the session selection is not loaded.`,
-  'skill-not-selected': name => `Skill "${name}" is not selected for this session.`,
-}
-
-/**
- * @typedef {{ status: 'admitted', revision: number, identityKey: string }
- *   | { status: 'unavailable', reason: string, revision: number|null, message: string }} Admission
- * @typedef {{ status: 'loaded', revision: number, content: unknown }
- *   | { status: 'revoked', reason: 'selection-revoked', revision: number|null, message: string }
- *   | { status: 'unavailable', reason: string, revision: number|null, message: string }} LoadResult
- */
-
-/**
- * @param {{
- *   authority: (sessionId: string) => unknown | Promise<unknown>,
- *   fence: { admit(scope: string): boolean, isHeld?(scope: string): boolean },
- *   trace?: (event: string, data?: unknown) => void,
- * }} options
- * `authority` returns the current in-memory authority snapshot
- * ({ revision, selection: { skills } }) or null when not loaded; the Apply
- * engine's authority() is the canonical source.
- */
-export function createSkillAdmission(options) {
-  const { authority, fence, trace = () => {} } = options
-  if (typeof authority !== 'function') throw new TypeError('An authority accessor is required')
-  if (!fence || typeof fence.admit !== 'function') throw new TypeError('An admission fence is required')
-
-  /** Selected identity keys of an authority snapshot. @param {unknown} snapshot @returns {Set<string>|null} */
-  function selectedKeys(snapshot) {
-    const skills = snapshot !== null && typeof snapshot === 'object'
-      ? /** @type {{ selection?: { skills?: unknown } }} */ (snapshot).selection?.skills
-      : null
-    if (!Array.isArray(skills)) return null
-    const keys = new Set()
-    for (const raw of skills) {
-      try { keys.add(skillIdentityKey(raw)) } catch { /* stray entries stay unauthorized */ }
-    }
-    return keys
-  }
-
-  /** @param {unknown} snapshot @returns {number|null} */
-  function revisionOf(snapshot) {
-    return snapshot !== null && typeof snapshot === 'object' && Number.isSafeInteger(/** @type {{ revision?: unknown }} */ (snapshot).revision)
-      ? /** @type {number} */ (/** @type {{ revision: number }} */ (snapshot).revision)
-      : null
-  }
-
-  /** @param {string} reason @param {number|null} revision @param {string} name */
-  const denial = (reason, revision, name) => ({
-    status: /** @type {const} */ ('unavailable'), reason, revision,
-    message: (MESSAGES[reason] ?? MESSAGES['skill-not-selected'])(name),
-  })
-
-  /**
-   * The single admission core: fence first (an Apply is committing), then the
-   * current authority snapshot, then exact identity membership. Exact
-   * identities only — the host still resolves skills by name; precision lives
-   * in the Weir manifest, never in a host-side identity lookup.
-   * @param {string} sessionId @param {unknown} identity
-   * @returns {Promise<Admission>}
-   */
-  async function check(sessionId, identity) {
-    if (!isSegment(sessionId)) return denial('invalid-session', null, 'unknown')
-    /** @type {string} */ let key
-    /** @type {string} */ let name
-    try {
-      const value = createSkillIdentity(identity)
-      key = skillIdentityKey(value)
-      name = value.name
-    } catch (error) {
-      trace('admission-denied', { sessionId, reason: 'invalid-identity', error: message(error) })
-      return denial('invalid-identity', null, 'unknown')
-    }
-    if (!fence.admit(sessionId)) {
-      // The fence is held: not-yet-handed-off calls are refused while the
-      // session's Apply commits.
-      trace('admission-denied', { sessionId, reason: 'admission-fence-held', name })
-      return denial('admission-fence-held', null, name)
-    }
-    const snapshot = await authority(sessionId)
-    const revision = revisionOf(snapshot)
-    if (revision === null) {
-      // Fail closed: no loaded authority means nothing is authorized.
-      trace('admission-denied', { sessionId, reason: 'selection-authority-unavailable', name })
-      return denial('selection-authority-unavailable', null, name)
-    }
-    const selected = selectedKeys(snapshot) ?? new Set()
-    if (!selected.has(key)) {
-      trace('admission-denied', { sessionId, reason: 'skill-not-selected', name })
-      return denial('skill-not-selected', revision, name)
-    }
-    return { status: 'admitted', revision, identityKey: key }
-  }
-
-  return {
-    /** Path 1: `skill` tool call admission. */
-    admit: check,
-
-    /**
-     * Path 2: slash submission revalidation. The server-side mount point for
-     * the slash pipeline: the submission is re-checked against the CURRENT
-     * selection even when the client already filtered its list.
-     * @param {string} sessionId @param {unknown} identity
-     * @returns {Promise<Admission>}
-     */
-    async validateSlash(sessionId, identity) {
-      const result = await check(sessionId, identity)
-      trace('slash-revalidation', { sessionId, status: result.status, ...(result.status === 'unavailable' ? { reason: result.reason } : {}) })
-      return result
-    },
-
-    /**
-     * Path 3: subagent prompt publication. A skill prompt may only be
-     * published into a child session under the current selection; a
-     * publication attempted after the skill's removal is refused.
-     * @param {string} sessionId @param {unknown} identity
-     * @returns {Promise<Admission>}
-     */
-    async admitPromptPublication(sessionId, identity) {
-      const result = await check(sessionId, identity)
-      trace('prompt-publication', { sessionId, status: result.status, ...(result.status === 'unavailable' ? { reason: result.reason } : {}) })
-      return result
-    },
-
-    /**
-     * Load a skill body under admission. The loader is invoked ONLY after
-     * admission (an unselected skill's body is never read); when the
-     * handed-off read completes, the authority is re-checked BEFORE any
-     * content is returned — a superseded revision or a removed identity
-     * revokes the publication. Read is not authorization.
-     * @param {string} sessionId @param {unknown} identity
-     * @param {() => Promise<unknown>} loader
-     * @returns {Promise<LoadResult>}
-     */
-    async loadBody(sessionId, identity, loader) {
-      const admitted = await check(sessionId, identity)
-      if (admitted.status !== 'admitted') return admitted
-      // Handed-off read: it may finish even while a later Apply holds the
-      // fence; the publication check below is the gate that matters.
-      const content = await loader()
-      const snapshot = await authority(sessionId)
-      const revision = revisionOf(snapshot)
-      const selected = revision === null ? null : selectedKeys(snapshot)
-      if (revision !== admitted.revision || !selected?.has(admitted.identityKey)) {
-        trace('publication-revoked', { sessionId, from: admitted.revision, to: revision })
-        return {
-          status: 'revoked', reason: /** @type {const} */ ('selection-revoked'), revision,
-          message: 'The skill content was read under a superseded selection and will not be published.',
-        }
-      }
-      return { status: 'loaded', revision: admitted.revision, content }
-    },
-  }
-}

package/src/capabilities/update-lifecycle.js

@@ -1,106 +0,0 @@
-// Tasks 11.3/11.4/11.5 of the session-capability-manager change: the check
-// cadence, the verified manual update, and the opt-in automatic update.
-//
-// 11.3 — checks are read-only: a 24h cadence with a single make-up check for
-// an overdue startup, a manual "Check now" that either triggers immediately
-// or joins the one in-flight check (at most one at any time), and a failure
-// backoff of 48h / 96h capped at 7d. offline / unknown / private-source are
-// reported separately from up-to-date. A check NEVER runs check/update/
-// upgrade against a real install directory.
-//
-// 11.4 — a manual update runs only after explicit user confirmation (source
-// and ref named), then verifies BEFORE the atomic swap: requested
-// source/ref satisfied, expected identity at the expected location, content
-// identity recorded, lock schema recognized. A tool reporting success while
-// the post-conditions fail is recorded as a failure — nothing publishes and
-// last-good stays.
-//
-// 11.5 — automatic updates are OFF by default. opt-in is an explicit grant
-// per source/scope, never implied by a preset load, a check or one manual
-// update. Before running: tool baseline, target layout, lock schema,
-// provenance unchanged, no local edits — any failure pauses THAT entry with
-// a report and no retry loop. A running session never auto-adopts published
-// content.
-
-export const CHECK_CADENCE_MS = 86_400_000
-export const CHECK_BACKOFF_MS = Object.freeze([172_800_000, 345_600_000, 604_800_000])
-
-/**
- * The check scheduler (11.3): at most one check in flight; manual joins the
- * in-flight one; overdue startup makes up exactly once; failures back off.
- */
-export function createCheckScheduler({ now = Date.now } = {}) {
-  let inFlight = false
-  let lastCheckAt = null
-  let failures = 0
-  return {
-    /** When the next scheduled check may run. */
-    nextAt() {
-      // No completed check yet: overdue since epoch, made up exactly once.
-      if (lastCheckAt === null) return 0
-      const interval = failures === 0 ? CHECK_CADENCE_MS : CHECK_BACKOFF_MS[Math.min(failures - 1, CHECK_BACKOFF_MS.length - 1)]
-      return lastCheckAt + interval
-    },
-    /**
-     * Whether a check should start; when one starts the caller must settle it.
-     * @param {'scheduled'|'manual'} reason
-     * @returns {{ start: boolean, joinedInFlight: boolean, reason: string|null }}
-     */
-    requestCheck(reason) {
-      if (inFlight) return { start: false, joinedInFlight: true, reason: null }
-      if (reason === 'scheduled' && now() < this.nextAt()) return { start: false, joinedInFlight: false, reason: 'not-due' }
-      inFlight = true
-      return { start: true, joinedInFlight: false, reason: null }
-    },
-    settle(ok) {
-      inFlight = false
-      failures = ok ? 0 : failures + 1
-      lastCheckAt = now()
-    },
-    get inFlight() { return inFlight },
-  }
-}
-
-/**
- * The classified check outcome (11.3): offline / unknown / private-source
- * are reported separately from up-to-date and from real changes.
- * @param {'up-to-date'|'changed'|'offline'|'unknown'|'private-source'} outcome
- */
-export function checkOutcomeOf(outcome) {
-  const known = ['up-to-date', 'changed', 'offline', 'unknown', 'private-source']
-  return known.includes(outcome) ? outcome : 'unknown'
-}
-
-/**
- * The manual-update post-conditions (11.4): every one must hold before the
- * atomic swap; any failure records a failure and publishes nothing.
- * @param {{ requestedSatisfied: boolean, identityAtLocation: boolean, contentIdentityRecorded: boolean, lockRecognized: boolean }} input
- */
-export function manualUpdatePostconditions(input) {
-  const failures = []
-  if (!input.requestedSatisfied) failures.push('requested source/ref not satisfied by staging')
-  if (!input.identityAtLocation) failures.push('expected identity not at the expected location')
-  if (!input.contentIdentityRecorded) failures.push('content identity was not recorded')
-  if (!input.lockRecognized) failures.push('install-lock schema not recognized')
-  return failures.length === 0 ? { ok: true } : { ok: false, failures }
-}
-
-/**
- * The automatic-update gates (11.5): opt-in is a per source/scope grant and
- * every precondition must hold; any failure pauses the entry (no retry loop).
- * @param {{ optedIn: boolean, toolBaselineOk: boolean, layoutOk: boolean, lockRecognized: boolean, provenanceUnchanged: boolean, noLocalEdits: boolean }} input
- */
-export function autoUpdateVerdict(input) {
-  if (!input.optedIn) return { run: false, reason: 'automatic updates are off for this source/scope (no explicit opt-in)' }
-  const gates = [
-    ['toolBaselineOk', input.toolBaselineOk, 'executor baseline check failed'],
-    ['layoutOk', input.layoutOk, 'target layout check failed'],
-    ['lockRecognized', input.lockRecognized, 'install-lock schema not recognized'],
-    ['provenanceUnchanged', input.provenanceUnchanged, 'provenance changed'],
-    ['noLocalEdits', input.noLocalEdits, 'local edits present'],
-  ]
-  for (const [, ok, reason] of gates) {
-    if (!ok) return { run: false, reason: `${reason} — this entry is paused and reported, no retry loop` }
-  }
-  return { run: true }
-}

package/src/edit-lock/remote-service.js

@@ -1,28 +0,0 @@
-/** Tool service for exactly one authenticated child channel. No local fs
- * capability and no fallback. Parent must bind the other end before admission.
- * @param {ReturnType<typeof import('./peer-client.js').createEditLockPeerClient>} client
- * @param {object} agent
- * @param {(agent:object)=>boolean} isRegisteredAgent */
-export function createRemoteEditLockService(client, agent, isRegisteredAgent) {
-  let closed = false
-  /** @param {{agent:object,callId:string,signal:AbortSignal}} exec */
-  function authorize(exec) {
-    if (closed || exec.agent !== agent || !isRegisteredAgent(agent)) throw new Error('agent has no authenticated remote edit execution')
-  }
-  return Object.freeze({
-    service:Object.freeze({
-      /** @param {{agent:object,callId:string,signal:AbortSignal}} exec @param {unknown} request */
-      async publish(exec,request) {
-        authorize(exec)
-        return client.request('publish',exec.callId,request,exec.signal)
-      },
-      /** @param {{agent:object,callId:string,signal:AbortSignal}} exec @param {unknown} request */
-      async publishBatch(exec,request) {
-        authorize(exec)
-        return client.request('batch',exec.callId,request,exec.signal)
-      },
-    }),
-    // This only closes local admission; durable stop is acknowledged by parent.
-    close() {closed = true; client.close()},
-  })
-}

package/src/worktree/contract-guidance.test.js

@@ -1,100 +0,0 @@
-import { test } from 'node:test'
-import assert from 'node:assert/strict'
-import { mkdtempSync, mkdirSync, realpathSync, rmSync } from 'node:fs'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
-import { createLaneService } from './lanes.js'
-import { renderChildContract } from './prompts.js'
-
-// Exercise the real refusal/serialization path without spawning git processes.
-async function fixture(t, states, maxActive = 4) {
-  const root = realpathSync(mkdtempSync(join(tmpdir(), 'worktree-guidance-')))
-  t.after(() => rmSync(root, { recursive: true, force: true }))
-  const commonDir = join(root, '.git')
-  mkdirSync(join(commonDir, 'info'), { recursive: true })
-  const lanes = states.map((state, i) => ({
-    id: `lane-${i}`, state, path: join(root, '.weir/worktrees', `lane-${i}`),
-    branch: `weir/lane-${i}`, base: { branch: 'main' }, scope: [],
-  }))
-  let adds = 0
-  const service = createLaneService({
-    git: {
-      version: async () => [2, 40, 0], supported: () => true,
-      repoOf: async () => ({ mainRoot: root, commonDir }),
-      currentBranch: async () => 'main', revParse: async () => 'base',
-      worktreeList: async () => [{ path: root }, ...lanes.map(({ path }) => ({ path }))],
-      worktreeAdd: async () => { adds++ },
-    },
-    settings: () => ({ enabled: true, root: '.weir/worktrees', maxActive, autoSetup: false }),
-    shellRun: null, ask: null, notify() {}, audit() {}, modeOf: () => false,
-  })
-  const repo = await service.repoFor(root)
-  await repo.ledger.replace({ schemaVersion: 1, seq: lanes.length, lanes })
-  return { service, repo, lanes, session: { id: 'owner', header: { cwd: root } }, adds: () => adds }
-}
-
-test('MAX_ACTIVE lists every active lane and prefers the landable lane', async (t) => {
-  const h = await fixture(t, ['working', 'landable', 'ready', 'abandoned'], 3)
-  const before = h.repo.ledger.read()
-  await assert.rejects(h.service.open(h.session, { title: 'new' }), (error) => {
-    const payload = error.toJSON()
-    assert.equal(payload.code, 'MAX_ACTIVE')
-    assert.deepEqual(payload.data.lanes.map(({ id, state }) => ({ id, state })),
-      h.lanes.slice(0, 3).map(({ id, state }) => ({ id, state })))
-    for (const lane of payload.data.lanes) assert.ok(payload.message.includes(`${lane.id} · ${lane.state}`))
-    assert.match(payload.next.hint, /worktree_land.*lane-1/)
-    assert.match(payload.data.lanes[0].hint, /wait.*lane-0.*worktree_abandon/)
-    assert.doesNotMatch(payload.message, /lane-3/)
-    return true
-  })
-  assert.deepEqual(h.repo.ledger.read(), before)
-  assert.equal(h.adds(), 0)
-})
-
-test('MAX_ACTIVE without a landable lane recommends waiting or abandonment', async (t) => {
-  const h = await fixture(t, ['working'], 1)
-  await assert.rejects(h.service.open(h.session, { title: 'new' }), (error) => {
-    assert.equal(error.code, 'MAX_ACTIVE')
-    assert.match(error.next.hint, /wait.*lane-0.*worktree_abandon/)
-    assert.doesNotMatch(error.next.hint, /worktree_land/)
-    return true
-  })
-})
-
-test('SCOPE_OVERLAP serializes only overlapping globs from both scopes and recovery', async (t) => {
-  const h = await fixture(t, ['working'])
-  await h.repo.ledger.update((ledger) => {
-    ledger.lanes[0].scope = ['src/auth/**', 'docs/**', 'src/shared/**']
-    return { ledger }
-  })
-  const before = h.repo.ledger.read()
-  await assert.rejects(h.service.open(h.session, { title: 'new', scope: ['src/**', 'test/**'] }), (error) => {
-    const payload = error.toJSON()
-    assert.equal(payload.code, 'SCOPE_OVERLAP')
-    assert.equal(payload.lane, 'lane-0')
-    assert.deepEqual(payload.data.overlapping, { scope: ['src/**'], laneScope: ['src/auth/**', 'src/shared/**'] })
-    assert.match(payload.message, /narrow the new scope/)
-    assert.match(payload.message, /wait for lane lane-0 to land/)
-    assert.match(payload.next.hint, /src\/auth\/\*\*/)
-    return true
-  })
-  assert.deepEqual(h.repo.ledger.read(), before)
-  assert.equal(h.adds(), 0)
-})
-
-test('worker guidance is present only in the write contract; read-only contract stays exact', () => {
-  const lane = { id: 'lane-1', path: '/repo/lane-1', branch: 'weir/lane-1', base: { branch: 'main' }, scope: ['src/**'] }
-  const write = renderChildContract(lane, { readOnly: false })
-  const read = renderChildContract(lane, { readOnly: true })
-  for (const line of [
-    'Report blockers and outcomes in your final report; do not send_message to the parent (its id is not available to you).',
-    'Run every command, tests included, with workdir at the lane root; the integration-test root resolves lane-locally by default.',
-  ]) {
-    assert.ok(write.includes(line))
-    assert.ok(!read.includes(line))
-  }
-  assert.equal(read, `<lane id="lane-1">
-You are investigating lane lane-1 at /repo/lane-1 (branch weir/lane-1).
-- Pass workdir="/repo/lane-1" (or a directory inside it) on every shell call; use absolute paths under it for reads.
-</lane>`)
-})