mapify-cli 3.33.0__tar.gz → 3.34.0__tar.gz

{mapify_cli-3.33.0 → mapify_cli-3.34.0}/.claude/skills/README.md

@@ -19,7 +19,7 @@ MAP uses `skillClass` in `skill-rules.json` to make the runtime role explicit.
 | Skill | Class | Notes |
 |-------|-------|-------|
 | `map-state` | `hybrid` | Explains branch-scoped planning and ships hooks/scripts that surface focus and completion checks |
-| `map-learn` | `task` | Manual slash workflow with `disable-model-invocation: true`; writes learned rules from a completed workflow handoff |
+| `map-learn` | `task` | Model-invocable slash workflow; writes learned rules from a completed workflow handoff |
 | `map-plan`, `map-efficient`, `map-fast`, `map-debug`, `map-tdd`, `map-task`, `map-check`, `map-review`, `map-resume`, `map-release`, `map-explain` | `task` | Skill-backed slash workflows invoked directly by the user |
 
 ## Skills vs Agents
@@ -50,7 +50,7 @@ MAP uses `skillClass` in `skill-rules.json` to make the runtime role explicit.
 
 Use a `reference` skill when the content is mostly durable knowledge: conventions, decision trees, examples, troubleshooting, or domain guidance. Reference skills should be safe to load opportunistically and should avoid owning multi-step mutation procedures.
 
-Use a `task` skill when the skill behaves like a workflow: it has required steps, validation gates, agent calls, file writes, commits, releases, or other deterministic procedures. Manual slash task skills should normally use `disable-model-invocation: true` and an `argument-hint` so users see a clear invocation shape.
+Use a `task` skill when the skill behaves like a workflow: it has required steps, validation gates, agent calls, file writes, commits, releases, or other deterministic procedures. Task skills advertise an `argument-hint` and retain `enforcement: manual` as routing metadata, not a model-invocation block. All MAP skills are model-invocable except `map-release`, which alone keeps `disable-model-invocation: true`. Descriptions and negative triggers control routing; in-skill confirmation gates still apply, including version-specific major-upgrade consent in `map-upgrade`.
 
 Use `hybrid` only when both are true: the skill is useful as reference material, and it also ships runtime helpers such as hooks or scripts. Hybrid skills must list `runtimeEffects` in `skill-rules.json` so users can tell which behavior comes from reading instructions and which behavior comes from installed hooks or scripts.
 

{mapify_cli-3.33.0 → mapify_cli-3.34.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: mapify-cli
-Version: 3.33.0
+Version: 3.34.0
 Summary: MAP Framework installer - Modular Agentic Planner for Claude Code
 Project-URL: Homepage, https://github.com/azalio/map-framework
 Project-URL: Repository, https://github.com/azalio/map-framework.git
@@ -54,6 +54,8 @@ Description-Content-Type: text/markdown
   <a href="https://github.com/azalio/map-framework"><img src="https://img.shields.io/github/stars/azalio/map-framework?style=social" alt="GitHub stars"></a>
 </p>
 
+After `mapify upgrade`, Claude can invoke any MAP skill through the Skill tool on your behalf except `/map-release`, which remains manual-only. Workflow confirmation gates still apply; `/map-upgrade` requires explicit consent for a major version.
+
 ## Why MAP Exists
 
 Most AI agents rush straight to code — fast wrong answers, silent rework.
@@ -103,6 +105,14 @@ For Go projects requiring build tags, set `checks.go.tags: integration,netgo` in
 Claude Code is the default provider. Cross-AI review compares explicit host and
 reviewer adapter vendors; same-vendor or unknown provenance is not labeled
 independent ([details](docs/USAGE.md#cross-ai-peer-review---cross-ai-runtime)).
+An [offline historical review corpus](docs/USAGE.md#offline-historical-review-corpus)
+provides pinned introducing diffs, adjudicator-only labels and audited controls.
+It starts no reviewers and makes no evaluation or policy-promotion claims.
+An opt-in [bounded subscription pilot](docs/USAGE.md#bounded-subscription-review-pilot)
+adds offline preparation/reporting and a separately acknowledged, at-most-six-call
+Claude CLI runner. Its v2 inputs are complete allowlisted `-U30` diffs; prompts
+estimated above 60,000 tokens are excluded, never truncated. Results require
+manual adjudication; historical v1 runs cannot be resumed.
 
 Claude Code:
 
@@ -140,11 +150,15 @@ $map-plan → $map-efficient → $map-check → $map-review → $map-learn
 
 That's the whole golden path.
 
+Need to reorder unstarted work in an active run? Use the audited
+[`resequence_pending` command](docs/USAGE.md#reorder-pending-subtasks)
+without resetting the current step, retries, results or baselines.
+
 - **Start with `/map-plan`** for anything non-trivial — it clarifies behavior and splits the work into contract-sized subtasks.
 - **Starting from a PRD?** Run `/map-prd-review` directly, or accept `/map-plan`'s optional readiness preflight. A non-ready result shows the gaps and asks whether to revise or continue planning anyway.
 - **Already scoped?** Go straight to `/map-efficient`.
 - **Tiny edit?** `/map-plan` off-ramps you to a direct edit or `/map-fast` instead of forcing full planning.
-- **Too foggy to plan?** `/map-wayfind` resolves open design decisions on a durable map. Evidence-first research is on by default: factual lookups stay light; uncertain decisions get independent investigations and targeted checks, with four attempts before asking to extend the budget. Research handoffs are checked before `/map-plan`; historical decisions retain explicit legacy provenance.
+- **Too foggy to plan?** `/map-wayfind` resolves open design decisions on a durable map. Evidence-first research is on by default: factual lookups stay light; uncertain decisions get independent investigations and targeted checks, with no default attempt cap for authorized read-only work. Opt in at task start with `configure_research --budget-limit N`; existing caps remain binding and extensions require scoped user approval. Consequential or genuinely expensive actions still need separate consent. Stale open-ticket evidence can be explicitly refreshed without erasing history or resetting that budget. Research handoffs are checked before `/map-plan`; historical decisions retain explicit legacy provenance.
 - **Want one entry point?** `/map-auto` routes and drives the chain autonomously; hard-stops only on `dangerous_action`/`safety_guardrail` holds.
 
 > Codex CLI ships the same 23 MAP skill entry points and invokes them with `$`:
@@ -171,6 +185,12 @@ manual checks report errors explicitly. The public `mapify upgrade` command is
 separate and unchanged: it upgrades only the CLI and does not refresh project
 files. See [Automatic and manual framework updates](docs/USAGE.md#automatic-and-manual-framework-updates).
 
+If a legacy `map-debug` skill cannot load its `../../references/` documents, refresh
+the project after upgrading the CLI:
+`mapify init . --force --no-git --provider codex --refresh-existing`
+(use `--provider claude` for Claude). This restores missing managed references;
+upgrading the CLI alone does not.
+
 ## Case Study: 90 days → 7 days
 
 The DevOpsConf 2026 case study applies this process to a production Kubernetes Project Operator:
@@ -214,6 +234,8 @@ The DevOpsConf 2026 case study applies this process to a production Kubernetes P
 | `/map-release` | Package release workflow; Codex `$map-release` shares the same commit-bound CI gates |
 | `/map-resume` | Resume interrupted workflows |
 
+For stacked PRs, use `/map-review --base-ref runtime` (Codex: `$map-review --base-ref runtime`) to review only the child branch's changes against its parent's merge-base, including dirty work. Trusted review policy still comes from the default branch.
+
 [Detailed usage and options →](docs/USAGE.md)
 
 ## Why Engineers Stick With It
@@ -222,7 +244,11 @@ The DevOpsConf 2026 case study applies this process to a production Kubernetes P
 - **Reviewable diffs** — `/map-plan` and `/map-efficient` require per-subtask size, concern, and constraint metadata, then validate `blueprint.json` *before* implementation, so oversized or mixed-concern plans fail early.
 - **Gates that check the plan, not vibes** — `/map-check` and `/map-review` validate against the spec, tests, and diff instead of asking whether code "looks fine".
 - **Clean-room review** — `/map-review` auto-bundles available spec, plan, tests, verification, and coverage evidence into a single durable input (`.map/<branch>/review-bundle.json`); standalone external-PR review needs no Actor blueprint. `--detached` opens a read-only worktree for inspection without touching your branch.
-- **Project memory** — `/map-learn` turns hard-won fixes and gotchas into reusable context, so the next session doesn't relearn them.
+- **Bounded review/fix cycles** — `/map-review` retains round history and unresolved findings across restarts, suppresses acknowledged repeat publications, and stops after three unsuccessful attempts for reconsideration—not approval. Explicit abandonment recovers stale pending rounds without resetting that budget. Incremental re-review falls back to full review when baseline or dependency coverage is uncertain.
+- **Snapshot-bound review receipts** — review completeness, code approval, runner-executed checks and human consent are separate records. Missing reviewers, scope gaps or stale evidence cannot approve a changed snapshot. Read-only reviewers receive base/current source and attribution in the bundle; Codex findings remain available with explicit `INCOMPLETE` status until capability enforcement is verified.
+- **Trusted review policy (shadow rollout)** — root and applicable ancestor `REVIEW.md` guidance comes from pinned default-branch Git objects, not proposed head content. Its hash joins the existing runtime/capability fingerprint; unknown authority prevents approval. New security/consent gates default to **shadow**: record diagnostics and pending snapshot/policy/action-bound holds without new blockers or weakening existing checks. Opt into **strict** with `review: {security_gates: strict}` in trusted-default `.map/config.yaml`; sensitive/unknown changes then require full coverage and independent security receipts regardless of auto/quick or disabled ledger enforcement. Human provenance is not yet verifiable: holds never become consent, and strict review-ready stays blocked. Corpus and evaluated promotion remain later #523 stages.
+- **Evidence-backed findings** — the existing Step A.3 separates confirmed defects, refuted claims and insufficient evidence. Validation checks the failure scenario, reachability and baseline; remediation searches a bounded scope for the same bug class. Adversarial agreement requires independent evidence-backed validations, not votes. Author reactions cannot close findings on their own.
+- **Project memory** — `/map-learn` turns hard-won fixes and gotchas into reusable context, so the next session doesn't relearn them. Automatic session memory also records bounded, redacted prompt topics and conservative tool observations, even outside a MAP workflow; observed references are not proof of successful outcomes. See [session memory](docs/USAGE.md#session-memory) for limits and recovery behavior.
 
 <details>
 <summary><b>More under the hood</b> — calibrated effort, mutation boundaries, token budgets, retry quarantine, run-health diagnostics, skill IR audit</summary>
@@ -235,7 +261,7 @@ The DevOpsConf 2026 case study applies this process to a production Kubernetes P
 - **Token budget and research ROI reports** — Actor and review prompt builders append active-path budget decisions to `.map/<branch>/token_budget.json`, while `token_accounting.json` and `/map-tokenreport` separate research-agent/researcher cost from Actor/Monitor cost.
 - **Clean retry quarantine** — after repeated Monitor rejection, write-capable workflows switch the next attempt into clean-retry mode using `.map/<branch>/retry_quarantine.json` instead of raw failed-session context.
 - **Run health report** — workflows write `.map/<branch>/run_health_report.json` during closeout: terminal status, step progress, retry counters, artifact presence, hook-injection status, and advisory signals. CI can fail inconsistent closeouts with `python3 .map/scripts/map_step_runner.py validate_run_health_report`. All runner subcommands support read-only `--help` / `-h`; for example, `python3 .map/scripts/map_step_runner.py write_run_health_report --help`.
-- **Lossless serial blocker repair** — independently approved repairs run in a private checkout with their own Monitor and full gate, preserving the paused task's phase, results, retries and dirty files. Concurrent waves and overlapping repair paths fail closed; see [the repair protocol](docs/USAGE.md#independent-serial-blocker-repair).
+- **Lossless serial blocker repair** — standalone repositories and linked Git worktrees are supported; independently approved repairs run in a private checkout with their own Monitor and full gate, preserving the paused task's phase, results, retries and dirty files. Concurrent waves and overlapping repair paths fail closed; see [the repair protocol](docs/USAGE.md#independent-serial-blocker-repair).
 - **Compact recovery surface** — `/map-resume` keeps the active recovery flow short and moves low-frequency notes to `resume-reference.md`, so recovery after `/clear` or context exhaustion gives the next checkpoint action without loading the whole appendix.
 - **Skill IR audit** — release checks lower shipped Claude and Codex `SKILL.md` files into a typed `SkillIR`, verify content hashes, catch unsupported frontmatter, reject missing supporting-file links, and block injection-like instructions before `mapify init` copies surfaces into user repos.
 
@@ -272,7 +298,7 @@ After a good first workflow, you should see:
 
 - a written plan or spec before implementation starts;
 - small implementation contracts instead of one giant AI diff;
-- verification and review artifacts under `.map/<branch>/`;
+- verification and review artifacts under `.map/<branch>/`, including runner-executed acceptance proofs rather than self-reported AC checkboxes;
 - review comments focused on correctness and semantics, not formatting noise;
 - `/map-learn` preserving project rules, gotchas, and handoffs for future sessions.
 
@@ -334,6 +360,8 @@ mapify init . --no-autonomy     # remove the autonomy posture
 
 ## Trouble?
 
+- **Static analysis reports `local: -n: invalid option` on macOS** → Update MAP and refresh your provider's installed project files (`mapify init . --refresh-existing`, adding `--provider codex` for Codex). The Go/mypy diagnostic parser supports system Bash 3.2; upgrading Bash is not required for this parser. Re-run analysis rather than trusting an earlier empty report.
+
 - **Command not found** → Run `mapify init` in your project first.
 - **`init` stops on a Python version** → `python3` on your `PATH` is older than 3.11; the hooks run under it. Install 3.11+ (`brew install python@3.12` / `uv python install 3.12`), then `mapify check`. To install anyway, pass `--skip-python-check` or set `MAPIFY_SKIP_PYTHON_CHECK=1` — hooks stay non-functional until `python3` is upgraded ([details](docs/INSTALL.md#why-python3-on-path-matters)).
 - **A hook printed "MAP requires Python 3.11 or newer"** → same cause, detected at run time; the message names the interpreter it ran under. Context hooks report and let the session continue; the two PreToolUse gates (`safety-guardrails.py`, `workflow-gate.py`) deny the tool call instead of allowing it unguarded, so fix `python3` in another terminal to unblock.

{mapify_cli-3.33.0 → mapify_cli-3.34.0}/README.md

@@ -9,6 +9,8 @@
   <a href="https://github.com/azalio/map-framework"><img src="https://img.shields.io/github/stars/azalio/map-framework?style=social" alt="GitHub stars"></a>
 </p>
 
+After `mapify upgrade`, Claude can invoke any MAP skill through the Skill tool on your behalf except `/map-release`, which remains manual-only. Workflow confirmation gates still apply; `/map-upgrade` requires explicit consent for a major version.
+
 ## Why MAP Exists
 
 Most AI agents rush straight to code — fast wrong answers, silent rework.
@@ -58,6 +60,14 @@ For Go projects requiring build tags, set `checks.go.tags: integration,netgo` in
 Claude Code is the default provider. Cross-AI review compares explicit host and
 reviewer adapter vendors; same-vendor or unknown provenance is not labeled
 independent ([details](docs/USAGE.md#cross-ai-peer-review---cross-ai-runtime)).
+An [offline historical review corpus](docs/USAGE.md#offline-historical-review-corpus)
+provides pinned introducing diffs, adjudicator-only labels and audited controls.
+It starts no reviewers and makes no evaluation or policy-promotion claims.
+An opt-in [bounded subscription pilot](docs/USAGE.md#bounded-subscription-review-pilot)
+adds offline preparation/reporting and a separately acknowledged, at-most-six-call
+Claude CLI runner. Its v2 inputs are complete allowlisted `-U30` diffs; prompts
+estimated above 60,000 tokens are excluded, never truncated. Results require
+manual adjudication; historical v1 runs cannot be resumed.
 
 Claude Code:
 
@@ -95,11 +105,15 @@ $map-plan → $map-efficient → $map-check → $map-review → $map-learn
 
 That's the whole golden path.
 
+Need to reorder unstarted work in an active run? Use the audited
+[`resequence_pending` command](docs/USAGE.md#reorder-pending-subtasks)
+without resetting the current step, retries, results or baselines.
+
 - **Start with `/map-plan`** for anything non-trivial — it clarifies behavior and splits the work into contract-sized subtasks.
 - **Starting from a PRD?** Run `/map-prd-review` directly, or accept `/map-plan`'s optional readiness preflight. A non-ready result shows the gaps and asks whether to revise or continue planning anyway.
 - **Already scoped?** Go straight to `/map-efficient`.
 - **Tiny edit?** `/map-plan` off-ramps you to a direct edit or `/map-fast` instead of forcing full planning.
-- **Too foggy to plan?** `/map-wayfind` resolves open design decisions on a durable map. Evidence-first research is on by default: factual lookups stay light; uncertain decisions get independent investigations and targeted checks, with four attempts before asking to extend the budget. Research handoffs are checked before `/map-plan`; historical decisions retain explicit legacy provenance.
+- **Too foggy to plan?** `/map-wayfind` resolves open design decisions on a durable map. Evidence-first research is on by default: factual lookups stay light; uncertain decisions get independent investigations and targeted checks, with no default attempt cap for authorized read-only work. Opt in at task start with `configure_research --budget-limit N`; existing caps remain binding and extensions require scoped user approval. Consequential or genuinely expensive actions still need separate consent. Stale open-ticket evidence can be explicitly refreshed without erasing history or resetting that budget. Research handoffs are checked before `/map-plan`; historical decisions retain explicit legacy provenance.
 - **Want one entry point?** `/map-auto` routes and drives the chain autonomously; hard-stops only on `dangerous_action`/`safety_guardrail` holds.
 
 > Codex CLI ships the same 23 MAP skill entry points and invokes them with `$`:
@@ -126,6 +140,12 @@ manual checks report errors explicitly. The public `mapify upgrade` command is
 separate and unchanged: it upgrades only the CLI and does not refresh project
 files. See [Automatic and manual framework updates](docs/USAGE.md#automatic-and-manual-framework-updates).
 
+If a legacy `map-debug` skill cannot load its `../../references/` documents, refresh
+the project after upgrading the CLI:
+`mapify init . --force --no-git --provider codex --refresh-existing`
+(use `--provider claude` for Claude). This restores missing managed references;
+upgrading the CLI alone does not.
+
 ## Case Study: 90 days → 7 days
 
 The DevOpsConf 2026 case study applies this process to a production Kubernetes Project Operator:
@@ -169,6 +189,8 @@ The DevOpsConf 2026 case study applies this process to a production Kubernetes P
 | `/map-release` | Package release workflow; Codex `$map-release` shares the same commit-bound CI gates |
 | `/map-resume` | Resume interrupted workflows |
 
+For stacked PRs, use `/map-review --base-ref runtime` (Codex: `$map-review --base-ref runtime`) to review only the child branch's changes against its parent's merge-base, including dirty work. Trusted review policy still comes from the default branch.
+
 [Detailed usage and options →](docs/USAGE.md)
 
 ## Why Engineers Stick With It
@@ -177,7 +199,11 @@ The DevOpsConf 2026 case study applies this process to a production Kubernetes P
 - **Reviewable diffs** — `/map-plan` and `/map-efficient` require per-subtask size, concern, and constraint metadata, then validate `blueprint.json` *before* implementation, so oversized or mixed-concern plans fail early.
 - **Gates that check the plan, not vibes** — `/map-check` and `/map-review` validate against the spec, tests, and diff instead of asking whether code "looks fine".
 - **Clean-room review** — `/map-review` auto-bundles available spec, plan, tests, verification, and coverage evidence into a single durable input (`.map/<branch>/review-bundle.json`); standalone external-PR review needs no Actor blueprint. `--detached` opens a read-only worktree for inspection without touching your branch.
-- **Project memory** — `/map-learn` turns hard-won fixes and gotchas into reusable context, so the next session doesn't relearn them.
+- **Bounded review/fix cycles** — `/map-review` retains round history and unresolved findings across restarts, suppresses acknowledged repeat publications, and stops after three unsuccessful attempts for reconsideration—not approval. Explicit abandonment recovers stale pending rounds without resetting that budget. Incremental re-review falls back to full review when baseline or dependency coverage is uncertain.
+- **Snapshot-bound review receipts** — review completeness, code approval, runner-executed checks and human consent are separate records. Missing reviewers, scope gaps or stale evidence cannot approve a changed snapshot. Read-only reviewers receive base/current source and attribution in the bundle; Codex findings remain available with explicit `INCOMPLETE` status until capability enforcement is verified.
+- **Trusted review policy (shadow rollout)** — root and applicable ancestor `REVIEW.md` guidance comes from pinned default-branch Git objects, not proposed head content. Its hash joins the existing runtime/capability fingerprint; unknown authority prevents approval. New security/consent gates default to **shadow**: record diagnostics and pending snapshot/policy/action-bound holds without new blockers or weakening existing checks. Opt into **strict** with `review: {security_gates: strict}` in trusted-default `.map/config.yaml`; sensitive/unknown changes then require full coverage and independent security receipts regardless of auto/quick or disabled ledger enforcement. Human provenance is not yet verifiable: holds never become consent, and strict review-ready stays blocked. Corpus and evaluated promotion remain later #523 stages.
+- **Evidence-backed findings** — the existing Step A.3 separates confirmed defects, refuted claims and insufficient evidence. Validation checks the failure scenario, reachability and baseline; remediation searches a bounded scope for the same bug class. Adversarial agreement requires independent evidence-backed validations, not votes. Author reactions cannot close findings on their own.
+- **Project memory** — `/map-learn` turns hard-won fixes and gotchas into reusable context, so the next session doesn't relearn them. Automatic session memory also records bounded, redacted prompt topics and conservative tool observations, even outside a MAP workflow; observed references are not proof of successful outcomes. See [session memory](docs/USAGE.md#session-memory) for limits and recovery behavior.
 
 <details>
 <summary><b>More under the hood</b> — calibrated effort, mutation boundaries, token budgets, retry quarantine, run-health diagnostics, skill IR audit</summary>
@@ -190,7 +216,7 @@ The DevOpsConf 2026 case study applies this process to a production Kubernetes P
 - **Token budget and research ROI reports** — Actor and review prompt builders append active-path budget decisions to `.map/<branch>/token_budget.json`, while `token_accounting.json` and `/map-tokenreport` separate research-agent/researcher cost from Actor/Monitor cost.
 - **Clean retry quarantine** — after repeated Monitor rejection, write-capable workflows switch the next attempt into clean-retry mode using `.map/<branch>/retry_quarantine.json` instead of raw failed-session context.
 - **Run health report** — workflows write `.map/<branch>/run_health_report.json` during closeout: terminal status, step progress, retry counters, artifact presence, hook-injection status, and advisory signals. CI can fail inconsistent closeouts with `python3 .map/scripts/map_step_runner.py validate_run_health_report`. All runner subcommands support read-only `--help` / `-h`; for example, `python3 .map/scripts/map_step_runner.py write_run_health_report --help`.
-- **Lossless serial blocker repair** — independently approved repairs run in a private checkout with their own Monitor and full gate, preserving the paused task's phase, results, retries and dirty files. Concurrent waves and overlapping repair paths fail closed; see [the repair protocol](docs/USAGE.md#independent-serial-blocker-repair).
+- **Lossless serial blocker repair** — standalone repositories and linked Git worktrees are supported; independently approved repairs run in a private checkout with their own Monitor and full gate, preserving the paused task's phase, results, retries and dirty files. Concurrent waves and overlapping repair paths fail closed; see [the repair protocol](docs/USAGE.md#independent-serial-blocker-repair).
 - **Compact recovery surface** — `/map-resume` keeps the active recovery flow short and moves low-frequency notes to `resume-reference.md`, so recovery after `/clear` or context exhaustion gives the next checkpoint action without loading the whole appendix.
 - **Skill IR audit** — release checks lower shipped Claude and Codex `SKILL.md` files into a typed `SkillIR`, verify content hashes, catch unsupported frontmatter, reject missing supporting-file links, and block injection-like instructions before `mapify init` copies surfaces into user repos.
 
@@ -227,7 +253,7 @@ After a good first workflow, you should see:
 
 - a written plan or spec before implementation starts;
 - small implementation contracts instead of one giant AI diff;
-- verification and review artifacts under `.map/<branch>/`;
+- verification and review artifacts under `.map/<branch>/`, including runner-executed acceptance proofs rather than self-reported AC checkboxes;
 - review comments focused on correctness and semantics, not formatting noise;
 - `/map-learn` preserving project rules, gotchas, and handoffs for future sessions.
 
@@ -289,6 +315,8 @@ mapify init . --no-autonomy     # remove the autonomy posture
 
 ## Trouble?
 
+- **Static analysis reports `local: -n: invalid option` on macOS** → Update MAP and refresh your provider's installed project files (`mapify init . --refresh-existing`, adding `--provider codex` for Codex). The Go/mypy diagnostic parser supports system Bash 3.2; upgrading Bash is not required for this parser. Re-run analysis rather than trusting an earlier empty report.
+
 - **Command not found** → Run `mapify init` in your project first.
 - **`init` stops on a Python version** → `python3` on your `PATH` is older than 3.11; the hooks run under it. Install 3.11+ (`brew install python@3.12` / `uv python install 3.12`), then `mapify check`. To install anyway, pass `--skip-python-check` or set `MAPIFY_SKIP_PYTHON_CHECK=1` — hooks stay non-functional until `python3` is upgraded ([details](docs/INSTALL.md#why-python3-on-path-matters)).
 - **A hook printed "MAP requires Python 3.11 or newer"** → same cause, detected at run time; the message names the interpreter it ran under. Context hooks report and let the session continue; the two PreToolUse gates (`safety-guardrails.py`, `workflow-gate.py`) deny the tool call instead of allowing it unguarded, so fix `python3` in another terminal to unblock.

{mapify_cli-3.33.0 → mapify_cli-3.34.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "mapify-cli"
-version = "3.33.0"
+version = "3.34.0"
 description = "MAP Framework installer - Modular Agentic Planner for Claude Code"
 authors = [{ name = "MAP Framework Contributors" }]
 readme = "README.md"

{mapify_cli-3.33.0 → mapify_cli-3.34.0}/src/mapify_cli/__init__.py

@@ -23,7 +23,7 @@ Or install globally:
     mapify check
 """
 
-__version__ = "3.33.0"
+__version__ = "3.34.0"
 
 # MUST stay the first import: it turns "this interpreter is older than 3.11" into
 # a message that says so, instead of the ImportError raised by `from datetime

{mapify_cli-3.33.0 → mapify_cli-3.34.0}/src/mapify_cli/config/project_config.py

@@ -726,6 +726,14 @@ updates.auto: true
 # review.cross_ai.runtime: codex          # default target: claude|codex|gemini|opencode
 # review.cross_ai.timeout_seconds: 180
 
+# Security/human review gates (#523): shadow records evidence without new blockers.
+# Strict requires independent security coverage and verified human consent.
+# Human provenance is not supported yet, so strict sensitive reviews stay pending.
+# This option is read ONLY from .map/config.yaml committed on the trusted default
+# branch, never from PR-head or mutable local config. Existing review gates remain.
+# review:
+#   security_gates: shadow  # shadow (default) | strict
+
 # Per-subtask git worktree isolation (#284). Controls filesystem isolation for
 # each Actor run in `/map-efficient`. Enum values:
 #   off      — never create worktrees; sequential execution always.

{mapify_cli-3.33.0 → mapify_cli-3.34.0}/src/mapify_cli/memory/capture.py

@@ -14,21 +14,30 @@ exceptions and no-op silently — a hook must never block Claude.
 from __future__ import annotations
 
 import functools
+import hashlib
 import json
 import logging
+import os
 import re
 from datetime import UTC, datetime
+from itertools import chain
 from pathlib import Path
 from typing import Any
 
 from mapify_cli.memory.digest_schema import (
+    CAPTURE_EVENT_BYTES,
+    EVENT_CAPTURE_TRUNCATED,
     EVENT_ENDED,
     EVENT_TURN,
+    EVENT_USER_PROMPT,
+    PROMPT_PREFIX_CHARS,
     SCRATCH_ENDED_FIELDS,
     SCRATCH_TURN_FIELDS,
+    bounded_text,
     redact_secret_path,
     sanitize_value,
 )
+from mapify_cli.memory.evidence import native_tool_events
 from mapify_cli.ralph_state import sanitize_branch_name
 
 logger = logging.getLogger(__name__)
@@ -328,8 +337,44 @@ def _extract_edit_paths(obj: Any, out: list[str]) -> None:
             _extract_edit_paths(value, out)
 
 
+def _prompt_event(record: object) -> dict[str, Any] | None:
+    """Select human text only, never assistant prose or user-carried results."""
+    if not isinstance(record, dict):
+        return None
+    if record.get("isMeta") or record.get("isCompactSummary"):
+        return None
+    if record.get("type") == "response_item":
+        message = record.get("payload")
+        if not isinstance(message, dict) or message.get("type") != "message":
+            return None
+    elif record.get("type") == "user":
+        message = record.get("message")
+    else:
+        return None
+    if not isinstance(message, dict) or message.get("role") != "user":
+        return None
+    content = message.get("content")
+    if isinstance(content, list):
+        if any(isinstance(block, dict) and block.get("type") == "tool_result" for block in content):
+            return None
+        content = "\n".join(
+            block["text"] for block in content
+            if isinstance(block, dict) and block.get("type") in {"text", "input_text"}
+            and isinstance(block.get("text"), str)
+        )
+    if not isinstance(content, str) or not content.strip():
+        return None
+    cleaned = bounded_text(content, len(content))
+    return {
+        "event": EVENT_USER_PROMPT,
+        "prompt_hash": hashlib.sha256(content.encode("utf-8")).hexdigest(),
+        "prefix": cleaned[:PROMPT_PREFIX_CHARS],
+        "truncated": len(cleaned) > PROMPT_PREFIX_CHARS,
+    }
+
+
 def _files_from_transcript(
-    transcript_path: Path, start: int
+    transcript_path: Path, start: int, events: list[dict[str, Any]] | None = None
 ) -> tuple[list[str], int]:
     """Recover files edited since transcript line *start*.
 
@@ -353,13 +398,17 @@ def _files_from_transcript(
     start = max(start, 0)
 
     raw_paths: list[str] = []
+    event_bytes = 0
+    omitted = 0
     total = start
     try:
         with open(transcript_path, encoding="utf-8", errors="replace") as fh:
             for idx, line in enumerate(fh):
-                total = idx + 1
                 if idx < start:
                     continue  # already consumed by a prior turn
+                if not line.endswith("\n"):
+                    break  # retry a partially written trailing record next time
+                total = idx + 1
                 line = line.strip()
                 if not line:
                     continue
@@ -368,9 +417,23 @@ def _files_from_transcript(
                 except json.JSONDecodeError:
                     continue
                 _extract_edit_paths(rec, raw_paths)
+                if events is not None:
+                    prompt = _prompt_event(rec)
+                    candidates = chain([prompt] if prompt is not None else [], native_tool_events(rec))
+                    for event in candidates:
+                        size = len(json.dumps(event, ensure_ascii=True)) + 512
+                        if event_bytes + size <= CAPTURE_EVENT_BYTES - 1024:
+                            events.append(event)
+                            event_bytes += size
+                        else:
+                            omitted += 1
     except OSError:
+        if events is not None:
+            events.clear()
         return [], start
 
+    if omitted and events is not None:
+        events.append({"event": EVENT_CAPTURE_TRUNCATED, "omitted_events": omitted})
     return _redact_and_dedup(raw_paths), total
 
 
@@ -378,6 +441,7 @@ def _derive_files_touched(
     stdin_data: dict[str, Any],
     scratch_dir: Path | None = None,
     sid: str | None = None,
+    events: list[dict[str, Any]] | None = None,
 ) -> tuple[list[str], int | None]:
     """Extract the file paths touched this turn, from one of two sources.
 
@@ -419,7 +483,7 @@ def _derive_files_touched(
         except (OSError, ValueError):
             start = 0
 
-    files, total = _files_from_transcript(Path(str(transcript)), start)
+    files, total = _files_from_transcript(Path(str(transcript)), start, events)
     return files, (total if track_offset else None)
 
 
@@ -477,8 +541,9 @@ def append_turn(stdin_data: dict[str, Any], project_dir: Path | str) -> None:
 
         turn_number = _highest_turn_number(scratch_path) + 1
 
+        events: list[dict[str, Any]] = []
         files_touched, new_offset = _derive_files_touched(
-            stdin_data, scratch_dir, effective_sid
+            stdin_data, scratch_dir, effective_sid, events
         )
 
         # Build the record using field names from SCRATCH_TURN_FIELDS.
@@ -492,8 +557,13 @@ def append_turn(stdin_data: dict[str, Any], project_dir: Path | str) -> None:
             SCRATCH_TURN_FIELDS[5]: EVENT_TURN,                    # event
         }
 
+        for event in events:
+            event.update(ts=record["ts"], session_id=record["session_id"], turn=turn_number)
+        batch = "".join(json.dumps(event, ensure_ascii=True) + "\n" for event in events)
         with open(scratch_path, "a", encoding="utf-8") as fh:
-            fh.write(json.dumps(record, ensure_ascii=True) + "\n")
+            fh.write(batch + json.dumps(record, ensure_ascii=True) + "\n")
+            fh.flush()
+            os.fsync(fh.fileno())
 
         # Advance the transcript offset ONLY AFTER the record is durably
         # written — so a crash between the two never skips a transcript range.

{mapify_cli-3.33.0 → mapify_cli-3.34.0}/src/mapify_cli/memory/digest_schema.py

@@ -45,6 +45,36 @@ SCRATCH_ENDED_FIELDS: tuple[str, ...] = (
 # Event-type literals for the "event" field.
 EVENT_TURN: str = "turn"
 EVENT_ENDED: str = "ended"
+EVENT_USER_PROMPT = "user_prompt"
+EVENT_TOOL_USED = "tool_used"
+EVENT_OUTCOME = "outcome"
+EVENT_CAPTURE_TRUNCATED = "capture_truncated"
+PROMPT_PREFIX_CHARS = 512
+TOOL_NAME_CHARS = 80
+TOOL_TARGET_CHARS = 240
+TOOL_CALL_ID_CHARS = 128
+CAPTURE_EVENT_BYTES = 16 * 1024
+PROVIDER_EVIDENCE_BYTES = 48 * 1024
+SCRATCH_EVENT_FIELDS: dict[str, tuple[str, ...]] = {
+    EVENT_TURN: SCRATCH_TURN_FIELDS,
+    EVENT_USER_PROMPT: (
+        "event", "ts", "session_id", "turn", "prompt_hash", "prefix", "truncated",
+    ),
+    EVENT_TOOL_USED: (
+        "event", "ts", "session_id", "turn", "name", "target", "tool_call_id", "truncated",
+    ),
+    EVENT_OUTCOME: (
+        "event", "ts", "session_id", "turn", "tool_call_id", "exit_status", "references",
+    ),
+    EVENT_CAPTURE_TRUNCATED: (
+        "event", "ts", "session_id", "turn", "omitted_events",
+    ),
+}
+
+
+def bounded_text(text: str, limit: int) -> str:
+    """Redact the complete value before imposing a character limit."""
+    return sanitize_value(redact_text(text))[:limit]
 
 # ---------------------------------------------------------------------------
 # Finalized digest frontmatter field names (LLM-produced)
@@ -73,6 +103,10 @@ REDACTION_TOKEN: str = "«redacted»"  # «redacted»
 # the same "openai" key via alternation — the ant variant is the first
 # branch in the alternation group.
 REDACTION_PATTERNS: dict[str, str] = {
+    "pem": r"-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?(?:-----END [A-Z0-9 ]*PRIVATE KEY-----|$)",
+    "assignment": r"(?i)\b(?:api[_-]?key|access[_-]?token|auth[_-]?token|token|password|passwd|secret)\s*[:=]\s*(?:\"[^\"]*\"|'[^']*'|[^\s,;]+)",
+    "bearer": r"(?i)\bBearer\s+[^\s,;]+",
+    "url_userinfo": r"(?i)(?<=://)[^\s/@]+(?::[^\s/@]*)?@",
     # Anthropic/OpenAI API keys.
     # sk-ant-... first (longer, more specific), then generic sk-...
     "openai": r"sk-ant-[A-Za-z0-9-]+|sk-[A-Za-z0-9]{16,}",