mapify-cli 3.35.1__tar.gz → 3.36.0__tar.gz

{mapify_cli-3.35.1 → mapify_cli-3.36.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: mapify-cli
-Version: 3.35.1
+Version: 3.36.0
 Summary: MAP Framework installer - Modular Agentic Planner for Claude Code
 Project-URL: Homepage, https://github.com/azalio/map-framework
 Project-URL: Repository, https://github.com/azalio/map-framework.git
@@ -26,6 +26,7 @@ Requires-Dist: pytest-asyncio>=0.26.0; extra == 'dev'
 Requires-Dist: pytest-cov>=4.0.0; extra == 'dev'
 Requires-Dist: pytest-mock>=3.10.0; extra == 'dev'
 Requires-Dist: pytest-timeout>=2.1.0; extra == 'dev'
+Requires-Dist: pytest-xdist>=3.5.0; extra == 'dev'
 Requires-Dist: pytest>=7.0.0; extra == 'dev'
 Requires-Dist: pyyaml>=6.0.0; extra == 'dev'
 Requires-Dist: ruff>=0.1.0; extra == 'dev'
@@ -39,6 +40,7 @@ Requires-Dist: pytest-asyncio>=0.26.0; extra == 'test'
 Requires-Dist: pytest-cov>=4.0.0; extra == 'test'
 Requires-Dist: pytest-mock>=3.10.0; extra == 'test'
 Requires-Dist: pytest-timeout>=2.1.0; extra == 'test'
+Requires-Dist: pytest-xdist>=3.5.0; extra == 'test'
 Requires-Dist: pytest>=7.0.0; extra == 'test'
 Requires-Dist: pyyaml>=6.0.0; extra == 'test'
 Description-Content-Type: text/markdown

{mapify_cli-3.35.1 → mapify_cli-3.36.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "mapify-cli"
-version = "3.35.1"
+version = "3.36.0"
 description = "MAP Framework installer - Modular Agentic Planner for Claude Code"
 authors = [{ name = "MAP Framework Contributors" }]
 readme = "README.md"
@@ -29,6 +29,7 @@ test = [
     "pytest-cov>=4.0.0",
     "pytest-mock>=3.10.0",
     "pytest-timeout>=2.1.0",
+    "pytest-xdist>=3.5.0",
     "pyyaml>=6.0.0",
     "hypothesis>=6.0.0",
     "jsonschema>=4.0.0",
@@ -39,6 +40,7 @@ dev = [
     "pytest-cov>=4.0.0",
     "pytest-mock>=3.10.0",
     "pytest-timeout>=2.1.0",
+    "pytest-xdist>=3.5.0",
     "pyyaml>=6.0.0",
     "hypothesis>=6.0.0",
     "jsonschema>=4.0.0",

{mapify_cli-3.35.1 → mapify_cli-3.36.0}/src/mapify_cli/__init__.py

@@ -23,7 +23,7 @@ Or install globally:
     mapify check
 """
 
-__version__ = "3.35.1"
+__version__ = "3.36.0"
 
 # MUST stay the first import: it turns "this interpreter is older than 3.11" into
 # a message that says so, instead of the ImportError raised by `from datetime

{mapify_cli-3.35.1 → mapify_cli-3.36.0}/src/mapify_cli/delivery/file_copier.py

@@ -13,9 +13,10 @@ import os
 import secrets
 import shutil
 import stat
+import subprocess
 import tempfile
 import time
-from collections.abc import Iterator
+from collections.abc import Generator
 from dataclasses import dataclass
 from fnmatch import fnmatchcase
 from pathlib import Path
@@ -608,7 +609,7 @@ def _windows_gitignore_mutex_name(project_stat: os.stat_result) -> str:
 @contextlib.contextmanager
 def _windows_project_gitignore_mutex(
     project_stat: os.stat_result,
-) -> Iterator[None]:
+) -> Generator[None, None, None]:
     """Acquire a process-shared Windows mutex without a filesystem artifact."""
     ctypes: Any = importlib.import_module("ctypes")
     wintypes: Any = importlib.import_module("ctypes.wintypes")
@@ -672,7 +673,7 @@ def _windows_project_gitignore_mutex(
 def _windows_pinned_project_root(
     project_root: Path,
     project_original: os.stat_result,
-) -> Iterator[None]:
+) -> Generator[None, None, None]:
     """Prevent replacement of a Windows project directory during mutation."""
     ctypes: Any = importlib.import_module("ctypes")
     wintypes: Any = importlib.import_module("ctypes.wintypes")
@@ -726,7 +727,7 @@ def _windows_pinned_project_root(
 def _pinned_project_root(
     project_root: Path,
     project_original: os.stat_result,
-) -> Iterator[int | None]:
+) -> Generator[int | None, None, None]:
     """Pin the project identity used by every relative .gitignore operation."""
     if os.name == "nt":
         with _windows_pinned_project_root(project_root, project_original):
@@ -765,14 +766,6 @@ def _pinned_project_root(
         os.close(descriptor)
 
 
-def _gitignore_lock_path(project_root: Path) -> Path:
-    """Resolve the shared lock from stable filesystem identity, not spelling."""
-    return _gitignore_lock_path_for_stat(
-        project_root,
-        _validated_project_root_stat(project_root),
-    )
-
-
 def _unsafe_gitignore_lock(lock_path: Path, reason: str) -> NoReturn:
     raise UpdateRuntimeGitignoreSecurityError(
         f"unsafe MAP .gitignore lock at {lock_path}: {reason}"
@@ -900,7 +893,7 @@ def _unlock_descriptor(descriptor: int) -> None:
 @contextlib.contextmanager
 def _project_gitignore_lock(
     project_root: Path,
-) -> Iterator[tuple[int | None, os.stat_result]]:
+) -> Generator[tuple[int | None, os.stat_result], None, None]:
     """Serialize a complete MAP-owned root .gitignore transaction."""
     project_original = _validated_project_root_stat(project_root)
     with _pinned_project_root(project_root, project_original) as directory_fd:
@@ -1220,11 +1213,106 @@ def _has_effective_gitignore_path(lines: list[bytes], required_path: str) -> boo
     )
 
 
+def _git_info_exclude_path(project_root: Path) -> Path | None:
+    """Return ``<git-common-dir>/info/exclude`` for a repo rooted at *project_root*.
+
+    ``info/exclude`` patterns anchor at the repository top level, so a project
+    root that is merely a subdirectory of a repo (or not a repo at all, or git
+    is unavailable) returns None and the caller keeps the tracked ``.gitignore``.
+    Linked worktrees share the common dir, hence one exclude file per clone.
+    """
+    try:
+        proc = subprocess.run(
+            ["git", "rev-parse", "--show-toplevel", "--git-common-dir"],
+            cwd=project_root,
+            capture_output=True,
+            text=True,
+            timeout=10,
+            check=False,
+        )
+    except (OSError, subprocess.SubprocessError):
+        return None
+    lines = proc.stdout.splitlines()
+    if proc.returncode != 0 or len(lines) != 2:
+        return None
+    toplevel, common = Path(lines[0]), Path(lines[1])
+    try:
+        if toplevel.resolve() != project_root.resolve():
+            return None
+    except OSError:
+        return None
+    if not common.is_absolute():
+        common = project_root / common
+    return common / "info" / "exclude"
+
+
+def _prepare_info_exclude_directory(exclude: Path) -> None:
+    """Create ``info/`` when missing and require it to be a direct directory."""
+    try:
+        exclude.parent.mkdir(parents=True, exist_ok=True)
+        current = os.lstat(exclude.parent)
+    except OSError as exc:
+        _unsafe_project_gitignore(
+            exclude, f"could not prepare {exclude.parent} ({exc})"
+        )
+    if stat.S_ISLNK(current.st_mode) or not stat.S_ISDIR(current.st_mode):
+        _unsafe_project_gitignore(
+            exclude, "the info directory must be a direct directory"
+        )
+
+
 def _has_gitignore_marker(lines: list[bytes], marker: str) -> bool:
     encoded = marker.encode()
     return any(line == encoded or line.startswith(encoded + b" ") for line in lines)
 
 
+def _merge_runtime_exclude(
+    exclude: Path,
+    gitignore_lines: list[bytes],
+    project_root: Path,
+    project_original: os.stat_result,
+) -> bool | None:
+    """Append missing runtime paths to the git exclude file.
+
+    Presence in either file counts (OR).  Returns True when the exclude file
+    was rewritten, False when nothing was needed, and None when a ``.gitignore``
+    negation (which outranks ``info/exclude``) defeats an exclude entry, so the
+    caller must repair the tracked ``.gitignore`` instead.
+    """
+    existing, original = _read_safe_gitignore(exclude, None)
+    exclude_lines = existing.splitlines()
+    # .gitignore outranks info/exclude: evaluate exclude rules first.
+    combined = exclude_lines + gitignore_lines
+    missing = [
+        path
+        for path in _UPDATE_RUNTIME_GITIGNORE_PATHS
+        if not _has_effective_gitignore_path(combined, path)
+    ]
+    if not missing:
+        return False
+    if any(
+        line.startswith(b"!") and _negation_targets_path(line, path.encode())
+        for path in missing
+        for line in gitignore_lines
+    ):
+        return None
+    _prepare_info_exclude_directory(exclude)
+    block: list[bytes] = []
+    if not _has_gitignore_marker(exclude_lines, _UPDATE_RUNTIME_GITIGNORE_MARKER):
+        block.append(_UPDATE_RUNTIME_GITIGNORE_MARKER.encode())
+    block.extend(path.encode() for path in missing)
+    separator = b"" if not existing or existing.endswith(b"\n") else b"\n"
+    _atomic_replace_gitignore(
+        exclude,
+        existing + separator + b"\n".join(block) + b"\n",
+        original,
+        None,
+        project_root,
+        project_original,
+    )
+    return True
+
+
 def _merge_project_gitignore_locked(
     project_root: Path,
     directory_fd: int | None,
@@ -1234,20 +1322,39 @@ def _merge_project_gitignore_locked(
     include_sofa: bool = False,
     include_agent_memory_local: bool = False,
     include_settings_local: bool = False,
+    runtime_exclude: Path | None = None,
 ) -> int:
-    """Append selected MAP-owned blocks while the shared lock is held."""
+    """Append selected MAP-owned blocks while the shared lock is held.
+
+    With ``runtime_exclude`` set, the runtime block goes to that git exclude
+    file instead of the tracked ``.gitignore``; privacy blocks always stay in
+    ``.gitignore``.
+    """
     gitignore = project_root / ".gitignore"
     existing, original = _read_safe_gitignore(gitignore, directory_fd)
     _validate_project_root_unchanged(project_root, project_original)
     existing_lines = existing.splitlines()
 
     additions: list[bytes] = []
+    exclude_changed = False
     if include_runtime:
         missing_runtime_paths = [
             path
             for path in _UPDATE_RUNTIME_GITIGNORE_PATHS
             if not _has_effective_gitignore_path(existing_lines, path)
         ]
+        if runtime_exclude is not None:
+            outcome = _merge_runtime_exclude(
+                runtime_exclude,
+                existing_lines,
+                project_root,
+                project_original,
+            )
+            # None: a .gitignore negation outranks info/exclude, so the
+            # tracked-file repair below still applies.
+            if outcome is not None:
+                exclude_changed = outcome
+                missing_runtime_paths = []
         if missing_runtime_paths:
             runtime_lines: list[bytes] = []
             marker = _UPDATE_RUNTIME_GITIGNORE_MARKER.encode()
@@ -1291,7 +1398,7 @@ def _merge_project_gitignore_locked(
 
     if not additions:
         _validate_gitignore_unchanged(gitignore, original, directory_fd)
-        return 0
+        return 1 if exclude_changed else 0
     separator = b"" if not existing or existing.endswith(b"\n") else b"\n"
     replacement = existing + separator + b"".join(additions)
     _atomic_replace_gitignore(
@@ -1312,11 +1419,17 @@ def _merge_project_gitignore(
     include_sofa: bool = False,
     include_agent_memory_local: bool = False,
     include_settings_local: bool = False,
+    runtime_to_git_exclude: bool = False,
 ) -> int:
     """Safely, atomically, and serially append MAP-owned ignore blocks."""
     project_root = project_path.resolve(strict=True)
     if not project_root.is_dir():
         raise NotADirectoryError(f"MAP project root is not a directory: {project_root}")
+    runtime_exclude = (
+        _git_info_exclude_path(project_root)
+        if include_runtime and runtime_to_git_exclude
+        else None
+    )
     with _project_gitignore_lock(project_root) as (directory_fd, project_original):
         return _merge_project_gitignore_locked(
             project_root,
@@ -1326,6 +1439,7 @@ def _merge_project_gitignore(
             include_sofa=include_sofa,
             include_agent_memory_local=include_agent_memory_local,
             include_settings_local=include_settings_local,
+            runtime_exclude=runtime_exclude,
         )
 
 
@@ -1336,10 +1450,17 @@ def merge_update_runtime_gitignore(
     agent_memory_local: bool = False,
     settings_local: bool = False,
 ) -> int:
-    """Atomically establish runtime and requested privacy ignore entries."""
+    """Atomically establish runtime and requested privacy ignore entries.
+
+    The runtime block is local state, so in a git repo rooted at *project_path*
+    it goes to ``<git-common-dir>/info/exclude`` and leaves the tracked
+    ``.gitignore`` clean; elsewhere it falls back to ``.gitignore``.  Privacy
+    blocks are repo policy and always go to ``.gitignore``.
+    """
     return _merge_project_gitignore(
         project_path,
         include_runtime=True,
+        runtime_to_git_exclude=True,
         include_sofa=sofa,
         include_agent_memory_local=agent_memory_local,
         include_settings_local=settings_local,

{mapify_cli-3.35.1 → mapify_cli-3.36.0}/src/mapify_cli/templates/agents/monitor.md

@@ -136,6 +136,10 @@ state-changing orchestration continues in its original checkout. A standalone
      Only a diagnostic satisfying every condition in “Explicitly approved
      baseline gate failures” may be excluded from the scoped verdict; keep
      the full build gate failed and continue the other checks.
+   **VERIFICATION EXECUTION GATE (MANDATORY — same weight as BUILD GATE):** an applicable check (the lint/type/test target the repo's CI or Makefile runs for the touched code) that could NOT execute — tool missing, check skipped, a Makefile target that prints "skipped" and exits 0 — is NOT a pass.
+   - Set `valid: false` with issue `verification not executed: <tool> (<reason>)`.
+   - List the tool in `tools_run` with status `unavailable` or `skipped`; never omit it.
+   - Allowed remedies: install the tool or run the repo's tools target, then re-run; or explicit user deferral recorded in the conversation.
 3. Verify Goal is achieved — trace code path to confirm the stated outcome
 4. Verify Action is implemented — check that the specified method/operation exists
 5. **Verify mutation boundary (MANDATORY):** Run
@@ -329,7 +333,7 @@ All language handlers produce a standardized JSON format:
   "findings": [
     { "tool": "ruff", "file": "src/main.py", "line": 42, "severity": "error", "code": "F821", "message": "Undefined name" }
   ],
-  "tools_run": ["ruff", "mypy"]
+  "tools_run": ["ruff", "mypy", {"tool": "golangci-lint", "status": "unavailable"}]
 }
 ```
 
@@ -1741,6 +1745,9 @@ GOOD: "suggestion": "Use path\\to\\file"
 Before returning JSON, verify:
 
 ```
+□ 0. VERIFICATION EXECUTION GATE: every applicable lint/type/test check actually ran;
+     any that could not run is an issue (`verification not executed: <tool> (<reason>)`) → valid=false
+
 □ 1. All required fields present:
      valid, summary, issues, passed_checks, failed_checks,
      feedback_for_actor, estimated_fix_time, mcp_tools_used

{mapify_cli-3.35.1 → mapify_cli-3.36.0}/src/mapify_cli/templates/agents/task-decomposer.md

@@ -342,6 +342,7 @@ Return **ONLY** valid JSON in this exact structure:
   - Example: "Use existing RateLimiter middleware, configure for /api/* routes"
 **subtasks[].test_strategy**: Required object with unit/integration/e2e keys plus `scenario_dimensions`. Use "N/A" for levels not applicable.
   - **scenario_dimensions** (required): Object with four keys — `happy_path`, `error`, `edge_case`, `security`. Each describes at least one planned test covering that dimension. Use "N/A" for dimensions not relevant to the subtask. Testing-heavy subtasks must cover at minimum 4 dimensions.
+  - **Repo lint/type gate (MANDATORY for code subtasks)**: when the repo has a lint/type target (Makefile `lint`/`check`, CI lint or type-check step), the subtask's verification MUST include the repo's lint/type target for the touched code, not only build/vet. If the tool may be absent locally, name the install/tools target in the verification step.
   - MUST map `validation_criteria` → tests:
     - For each `VCn:` criterion, include at least one planned test name that covers it.
     - Recommended naming: include `vc<n>` in the test name (e.g., `test_vc1_*`, `TestVC1*`) for deterministic grep-ability.

{mapify_cli-3.35.1 → mapify_cli-3.36.0}/src/mapify_cli/templates/codex/agents/decomposer.toml

@@ -307,6 +307,7 @@ Return **ONLY** valid JSON in this exact structure:
   - Example: "Use existing RateLimiter middleware, configure for /api/* routes"
 **subtasks[].test_strategy**: Required object with unit/integration/e2e keys plus `scenario_dimensions`. Use "N/A" for levels not applicable.
   - **scenario_dimensions** (required): Object with four keys — `happy_path`, `error`, `edge_case`, `security`. Each describes at least one planned test covering that dimension. Use "N/A" for dimensions not relevant to the subtask. Testing-heavy subtasks must cover at minimum 4 dimensions.
+  - **Repo lint/type gate (MANDATORY for code subtasks)**: when the repo has a lint/type target (Makefile `lint`/`check`, CI lint or type-check step), the subtask's verification MUST include the repo's lint/type target for the touched code, not only build/vet. If the tool may be absent locally, name the install/tools target in the verification step.
   - MUST map `validation_criteria` → tests:
     - For each `VCn:` criterion, include at least one planned test name that covers it.
     - Recommended naming: include `vc<n>` in the test name (e.g., `test_vc1_*`, `TestVC1*`) for deterministic grep-ability.

{mapify_cli-3.35.1 → mapify_cli-3.36.0}/src/mapify_cli/templates/codex/agents/monitor.toml

@@ -127,6 +127,11 @@ Verification sequence (execute in order):
    If build/compile fails -> valid: false immediately with compilation errors.
    Do NOT proceed to other checks.
 
+   VERIFICATION EXECUTION GATE (MANDATORY -- same weight as BUILD GATE): an applicable check (the lint/type/test target the repo's CI or Makefile runs for the touched code) that could NOT execute -- tool missing, check skipped, a Makefile target that prints "skipped" and exits 0 -- is NOT a pass.
+   - Set valid: false with issue `verification not executed: <tool> (<reason>)`.
+   - List the tool in tools_run with status `unavailable` or `skipped`; never omit it.
+   - Allowed remedies: install the tool or run the repo's tools target, then re-run; or explicit user deferral recorded in the conversation.
+
 3. Verify Goal is achieved -- trace code path to confirm the stated outcome
 4. Verify Action is implemented -- check that the specified method/operation exists
 5. Verify mutation boundary (MANDATORY): Run
@@ -1260,6 +1265,7 @@ Expected output:
 
 Before returning your review JSON:
 1. Did I run the BUILD GATE (build/compile command)?
+1a. Did I run the VERIFICATION EXECUTION GATE (every applicable lint/type/test check executed, none unavailable/skipped)?
 2. Did I check all 11 validation dimensions systematically?
 3. Did I verify documentation against source of truth (if applicable)?
 4. Are all issues specific with location and actionable suggestions?

{mapify_cli-3.35.1/src/mapify_cli/templates → mapify_cli-3.36.0/src/mapify_cli/templates/codex}/hooks/post-compact-context.py

@@ -110,6 +110,19 @@ def state_string(state: dict, key: str, default: str = "") -> str:
     return default
 
 
+def active_wave_bits(state: dict) -> list[str]:
+    """Return ``wave=i/n`` and ``phases=...`` bits when the wave loop is engaged."""
+    waves = state.get("execution_waves")
+    phases = state.get("subtask_phases")
+    wave_idx = state.get("current_wave_index", 0)
+    if not (isinstance(waves, list) and waves and isinstance(phases, dict) and phases):
+        return []
+    if not isinstance(wave_idx, int) or isinstance(wave_idx, bool):
+        return []
+    per_subtask = " ".join(f"{sid}:{phase}" for sid, phase in phases.items())
+    return [f"wave={wave_idx + 1}/{len(waves)}", f"phases=[{per_subtask}]"]
+
+
 def load_json(path: Path) -> dict | None:
     try:
         data = json.loads(path.read_text(encoding="utf-8"))
@@ -209,10 +222,17 @@ def build_reprime(branch: str, branch_dir: Path) -> str | None:
     step_id = state_string(state, "current_step_id")
     subtask_id = state_string(state, "current_subtask_id")
 
+    wave_bits = active_wave_bits(state)
+    if wave_bits:
+        # Wave loop engaged: current_step_*/current_subtask_id are stale
+        # sequential leftovers; subtask_phases is the live progress record.
+        phase = step_id = subtask_id = ""
+
     lines = ["MAP RE-PRIME after compaction:"]
     state_bits = []
     if workflow:
         state_bits.append(f"workflow={workflow}")
+    state_bits.extend(wave_bits)
     if step_id:
         state_bits.append(f"step={step_id}")
     if phase:
@@ -335,3 +355,4 @@ def main() -> None:
 
 if __name__ == "__main__":
     main()
+

{mapify_cli-3.35.1/src/mapify_cli/templates → mapify_cli-3.36.0/src/mapify_cli/templates/codex}/hooks/workflow-context-injector.py

@@ -501,6 +501,24 @@ def state_string(state: dict, key: str, default: str = "") -> str:
     return default
 
 
+def active_wave_label(state: dict) -> str | None:
+    """Return ``WAVE i/n [ST-x:phase ...]`` when the wave loop is engaged.
+
+    Waves track progress only in ``subtask_phases``; ``current_step_*`` is a
+    stale sequential leftover (advance_wave resets it to 2.2/RESEARCH), so it
+    must not drive the banner while the wave loop is active.
+    """
+    waves = state.get("execution_waves")
+    phases = state.get("subtask_phases")
+    wave_idx = state.get("current_wave_index", 0)
+    if not (isinstance(waves, list) and waves and isinstance(phases, dict) and phases):
+        return None
+    if not isinstance(wave_idx, int) or isinstance(wave_idx, bool):
+        return None
+    per_subtask = " ".join(f"{sid}:{phase}" for sid, phase in phases.items())
+    return f"WAVE {wave_idx + 1}/{len(waves)} [{per_subtask}]"
+
+
 def required_action_for_step(step_id: str, step_phase: str) -> str | None:
     """Return a short required-next-action hint for common steps."""
     if step_id == "1.55":
@@ -713,6 +731,15 @@ def format_reminder(
                 mode = "batch:parallel"
 
     required = required_action_for_step(step_id, step_phase)
+    step_label = f"{step_id} {step_phase}"
+    wave_label = active_wave_label(state)
+    if wave_label:
+        # Wave loop engaged: current_step_*/current_subtask_id are stale
+        # sequential leftovers, so show per-subtask phases instead.
+        step_label = wave_label
+        wave_hint = ""
+        subtask_id = "-"
+        required = None
 
     diag_hint = ""
     diag_file = (
@@ -738,7 +765,7 @@ def format_reminder(
             if len(current_files) > 5:
                 files_hint += f" +{len(current_files) - 5}"
 
-    if not step_id and not step_phase:
+    if not step_id and not step_phase and not wave_label:
         return None
 
     # Context-aware: add goal and subtask title
@@ -772,15 +799,15 @@ def format_reminder(
     except OSError:
         pass
     ts_hint = f" @ {now_utc.strftime('%H:%M:%S.%f')[:-3]}Z (state {state_age_str})"
-    base = f"[MAP]{ts_hint} {step_id} {step_phase}{goal_hint} | ST: {subtask_id}{title_hint} ({progress}) | plan:{plan_ok} mode:{mode}{wave_hint}{diag_hint}{files_hint}{hard_hint}{tag_hint}{authority_hint}"
+    base = f"[MAP]{ts_hint} {step_label}{goal_hint} | ST: {subtask_id}{title_hint} ({progress}) | plan:{plan_ok} mode:{mode}{wave_hint}{diag_hint}{files_hint}{hard_hint}{tag_hint}{authority_hint}"
 
     # Enforce limit: trim goal first, then constraint detail, then word-boundary truncate.
     if len(base) > REMINDER_LIMIT:
         goal_hint = ""
-        base = f"[MAP]{ts_hint} {step_id} {step_phase} | ST: {subtask_id}{title_hint} ({progress}) | plan:{plan_ok} mode:{mode}{wave_hint}{diag_hint}{files_hint}{hard_hint}{tag_hint}{authority_hint}"
+        base = f"[MAP]{ts_hint} {step_label} | ST: {subtask_id}{title_hint} ({progress}) | plan:{plan_ok} mode:{mode}{wave_hint}{diag_hint}{files_hint}{hard_hint}{tag_hint}{authority_hint}"
     if len(base) > REMINDER_LIMIT:
         hard_hint = ""
-        base = f"[MAP]{ts_hint} {step_id} {step_phase} | ST: {subtask_id}{title_hint} ({progress}) | plan:{plan_ok} mode:{mode}{wave_hint}{diag_hint}{files_hint}{tag_hint}{authority_hint}"
+        base = f"[MAP]{ts_hint} {step_label} | ST: {subtask_id}{title_hint} ({progress}) | plan:{plan_ok} mode:{mode}{wave_hint}{diag_hint}{files_hint}{tag_hint}{authority_hint}"
     if len(base) > REMINDER_LIMIT:
         base = _truncate_at_word(base, REMINDER_LIMIT)
 
@@ -1126,3 +1153,4 @@ def main() -> None:
 
 if __name__ == "__main__":
     main()
+

{mapify_cli-3.35.1 → mapify_cli-3.36.0}/src/mapify_cli/templates/codex/skills/map-auto/SKILL.md

@@ -72,7 +72,7 @@ python3 .map/scripts/map_step_runner.py record_auto_phase "<phase>" "<status>" \
   --reason "<why this status>"
 ```
 
-`<phase>` is the workflow name being entered/exited (`map-plan`, `map-efficient`, `map-check`, or `map-review`). `<status>` follows the phase's own vocabulary -- use `completed` on a clean phase close and `aborted`/`failed` on a phase you cannot recover; anything else leaves the chain `in_progress`. Pass every hold id that `auto_decide_holds` auto-approved for this phase in `--evidence-refs`, so the approval is recorded twice: once in the hold's own audit note, once in the phase ledger.
+`<phase>` is the workflow name being entered/exited (`map-plan`, `map-efficient`, `map-check`, or `map-review`). `<status>` follows the phase's own vocabulary -- use `completed` on a clean phase close and `aborted`/`failed` on a phase you cannot recover; anything else leaves the chain `in_progress`. Phase completion and route completion are separate: a `completed` phase closes the chain only when it is the last phase of the selected route -- `map-review` for the multi-phase `map-plan` and `map-efficient` routes, or the route's only phase for the single-phase `map-resume`, `map-check`, and `map-fast` routes. Any earlier `completed` leaves the chain `in_progress` so the next phase is accepted. Pass every hold id that `auto_decide_holds` auto-approved for this phase in `--evidence-refs`, so the approval is recorded twice: once in the hold's own audit note, once in the phase ledger.
 
 **At most one re-entry per phase (HC-2):** `record_auto_phase` mechanically enforces this -- the first record of a phase name is `attempt: 1`, a re-entry is `attempt: 2`, and a third call for the SAME phase name is refused and force-aborts the chain (`chain_status: "aborted"`). Before spending the single permitted re-entry, inspect ground truth -- `git status`/`git diff` and the phase's own `step_state.json` (or equivalent phase artifacts, test output, Monitor verdict) -- to confirm the phase genuinely needs a fresh attempt rather than a partial success being misread as a failure. A second failure of the same phase means STOP and hand off to `$map-resume` -- never attempt a third call for that phase. A chain already `chain_status: "aborted"` or `"blocked"` refuses every further `record_auto_phase` call regardless of phase name; a new `route_task` call is the ONLY legitimate way to continue.
 
@@ -84,8 +84,8 @@ Once routed, drive the selected chain by invoking the existing slash workflows e
 route_task -> [map-plan] -> [map-efficient] -> [map-check] -> [map-review]
 ```
 
-- `map-resume`, `map-check`, and `map-fast` routes are single-phase: run the one workflow, record its result with `record_auto_phase`, and finish.
-- `map-plan` and `map-efficient` routes continue the chain: `map-plan` produces the task plan that `map-efficient` consumes, `map-efficient` implements it, and the chain then continues to `map-check` and `map-review` to close the loop.
+- `map-resume`, `map-check`, and `map-fast` routes are single-phase: run the one workflow, record its result with `record_auto_phase`, and finish -- the route's only phase closes the chain.
+- `map-plan` and `map-efficient` routes continue the chain: `map-plan` produces the task plan that `map-efficient` consumes, `map-efficient` implements it, and the chain then continues to `map-check` and `map-review` to close the loop. The route stays `chain_status: in_progress` after each intermediate phase completes and closes only when `map-review` completes.
 - Invoke each phase by reading and following its own `SKILL.md` in full, exactly as if the user had typed the corresponding slash command -- do not summarize, skip, or reimplement its internal steps. `$map-auto` never shells out to a separate Claude process, a new Python execution engine, or any other new phase-driving mechanism to do this -- phases are driven ONLY by invoking the existing slash workflows above and the three runner subcommands from Steps 1-3.
 - A `valid=false` Monitor verdict INSIDE a phase is that phase's own hard stop: its owning workflow's existing retry/escalation rules apply unchanged. `$map-auto` never overrides, suppresses, or re-runs past a Monitor rejection on the phase's behalf -- a phase that cannot get past Monitor is a failed phase for the purposes of Step 3's re-entry bound.
 - The autopilot run ends at a committed feature branch. `$map-auto` never opens a pull request, never merges, and never polls CI -- report the committed branch, the phases recorded, and stop.

{mapify_cli-3.35.1 → mapify_cli-3.36.0}/src/mapify_cli/templates/codex/skills/map-auto/auto-reference.md

@@ -15,7 +15,7 @@ python3 .map/scripts/map_step_runner.py record_auto_phase <phase> <status> [--br
 
 - `route_task <task>` -- `<task>` is the free-text task description (quote it). `--branch` defaults to the current branch. `--dry-run` recommends a route without marking the chain `in_progress` (see Dry-run usage below).
 - `auto_decide_holds` -- no positional arguments; only `--branch` (defaults to current branch).
-- `record_auto_phase <phase> <status>` -- `<phase>` is the workflow name (`map-plan`, `map-efficient`, `map-check`, `map-review`); `<status>` is the phase's own outcome word (`completed`, `failed`, `aborted`, or any other phase-specific status, which leaves `chain_status` at `in_progress`). `--evidence-refs` takes a comma-separated list of ids (auto-approved hold ids from the surrounding `auto_decide_holds` calls); `--reason` is a free-text note stored on the ledger entry.
+- `record_auto_phase <phase> <status>` -- `<phase>` is the workflow name (`map-plan`, `map-efficient`, `map-check`, `map-review`); `<status>` is the phase's own outcome word (`completed`, `failed`, `aborted`, or any other phase-specific status, which leaves `chain_status` at `in_progress`). A `completed` status closes the chain (`chain_status: "completed"`) only on the LAST phase of the selected route -- `map-review` for multi-phase `map-plan`/`map-efficient` routes, or the single phase of `map-resume`/`map-check`/`map-fast`; a `completed` intermediate phase keeps the chain `in_progress`. `--evidence-refs` takes a comma-separated list of ids (auto-approved hold ids from the surrounding `auto_decide_holds` calls); `--reason` is a free-text note stored on the ledger entry.
 
 ## Chain Walkthrough Example
 
@@ -35,10 +35,12 @@ $ python3 .map/scripts/map_step_runner.py auto_decide_holds
 
 $ python3 .map/scripts/map_step_runner.py record_auto_phase "map-efficient" "completed" \
   --evidence-refs "hold-1" --reason "all subtasks closed, make check green"
-{"status": "success", "chain_status": "completed", "phase": "map-efficient", "attempt": 1, ...}
+{"status": "success", "chain_status": "in_progress", "phase": "map-efficient", "attempt": 1, ...}
 
-# -- chain then continues to map-check, then map-review, each following the same
-#    poll -> drive -> poll -> record loop, until the last phase records "completed" --
+# -- map-efficient is not the last phase of this route: the chain stays
+#    in_progress and continues to map-check, then map-review, each following the
+#    same poll -> drive -> poll -> record loop. Only map-review completing closes
+#    the route (chain_status: "completed") --
 ```
 
 The run ends there: a committed feature branch, `phases[]` in `auto-route.json` holding one entry per phase attempt, and no PR/merge/CI step of any kind.

{mapify_cli-3.35.1 → mapify_cli-3.36.0}/src/mapify_cli/templates/codex/skills/map-release/SKILL.md

@@ -71,7 +71,7 @@ Execute all 12 gates. Read the full gate scripts in [release-reference.md § Pha
 **Gate summary (full commands in reference):**
 - **Gates 1–4:** `make check` — tests, ruff, mypy, pyright, rendered-template parity
 - **Gates 5–6:** Build + twine check
-- **Gate 7:** Security audit (`pip-audit`)
+- **Gate 7:** Security audit of the project's resolved requirements (`uv export` + `pip-audit -r`)
 - **Gates 8–10:** Git state — main branch, clean working directory, up-to-date with origin
 - **Gate 11:** CI run for `git merge-base HEAD origin/main` must have `conclusion: "success"`; unpushed commits may touch only release metadata
 - **Gate 12:** CHANGELOG.md completeness (Unreleased section exists and has content; commit/entry gap check)

{mapify_cli-3.35.1 → mapify_cli-3.36.0}/src/mapify_cli/templates/codex/skills/map-release/release-reference.md

@@ -35,11 +35,20 @@ uv run --with twine twine check dist/*
 ### Gate 7: Security Audit
 
 ```bash
-pip install pip-audit
-pip-audit
+set -euo pipefail
+# Audit the project's resolved dependency set, not the runner interpreter.
+REQS_FILE=$(mktemp "${TMPDIR:-/tmp}/mapify-release-reqs.XXXXXX")
+trap 'rm -f "$REQS_FILE"' EXIT
+uv export --all-extras --all-groups --no-hashes --no-emit-project \
+  --format requirements-txt > "$REQS_FILE"
+# --no-deps audits exactly the exported pins; --disable-pip stops pip from
+# resolving or mutating the runner environment.
+uvx pip-audit -r "$REQS_FILE" --disable-pip --no-deps
 ```
 
 **Expected Results:**
+- ✅ `uv export` resolves the project's dependencies (all extras and groups)
+- ✅ `pip-audit` audits the exported pinned requirements, not the runner environment
 - ✅ No known security vulnerabilities in dependencies
 
 **If vulnerabilities found:** Assess severity; update dependencies if critical.