mapify-cli 3.35.2__tar.gz → 3.36.0__tar.gz

{mapify_cli-3.35.2 → mapify_cli-3.36.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: mapify-cli
-Version: 3.35.2
+Version: 3.36.0
 Summary: MAP Framework installer - Modular Agentic Planner for Claude Code
 Project-URL: Homepage, https://github.com/azalio/map-framework
 Project-URL: Repository, https://github.com/azalio/map-framework.git

{mapify_cli-3.35.2 → mapify_cli-3.36.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "mapify-cli"
-version = "3.35.2"
+version = "3.36.0"
 description = "MAP Framework installer - Modular Agentic Planner for Claude Code"
 authors = [{ name = "MAP Framework Contributors" }]
 readme = "README.md"

{mapify_cli-3.35.2 → mapify_cli-3.36.0}/src/mapify_cli/__init__.py

@@ -23,7 +23,7 @@ Or install globally:
     mapify check
 """
 
-__version__ = "3.35.2"
+__version__ = "3.36.0"
 
 # MUST stay the first import: it turns "this interpreter is older than 3.11" into
 # a message that says so, instead of the ImportError raised by `from datetime

{mapify_cli-3.35.2 → mapify_cli-3.36.0}/src/mapify_cli/delivery/file_copier.py

@@ -13,9 +13,10 @@ import os
 import secrets
 import shutil
 import stat
+import subprocess
 import tempfile
 import time
-from collections.abc import Iterator
+from collections.abc import Generator
 from dataclasses import dataclass
 from fnmatch import fnmatchcase
 from pathlib import Path
@@ -608,7 +609,7 @@ def _windows_gitignore_mutex_name(project_stat: os.stat_result) -> str:
 @contextlib.contextmanager
 def _windows_project_gitignore_mutex(
     project_stat: os.stat_result,
-) -> Iterator[None]:
+) -> Generator[None, None, None]:
     """Acquire a process-shared Windows mutex without a filesystem artifact."""
     ctypes: Any = importlib.import_module("ctypes")
     wintypes: Any = importlib.import_module("ctypes.wintypes")
@@ -672,7 +673,7 @@ def _windows_project_gitignore_mutex(
 def _windows_pinned_project_root(
     project_root: Path,
     project_original: os.stat_result,
-) -> Iterator[None]:
+) -> Generator[None, None, None]:
     """Prevent replacement of a Windows project directory during mutation."""
     ctypes: Any = importlib.import_module("ctypes")
     wintypes: Any = importlib.import_module("ctypes.wintypes")
@@ -726,7 +727,7 @@ def _windows_pinned_project_root(
 def _pinned_project_root(
     project_root: Path,
     project_original: os.stat_result,
-) -> Iterator[int | None]:
+) -> Generator[int | None, None, None]:
     """Pin the project identity used by every relative .gitignore operation."""
     if os.name == "nt":
         with _windows_pinned_project_root(project_root, project_original):
@@ -765,14 +766,6 @@ def _pinned_project_root(
         os.close(descriptor)
 
 
-def _gitignore_lock_path(project_root: Path) -> Path:
-    """Resolve the shared lock from stable filesystem identity, not spelling."""
-    return _gitignore_lock_path_for_stat(
-        project_root,
-        _validated_project_root_stat(project_root),
-    )
-
-
 def _unsafe_gitignore_lock(lock_path: Path, reason: str) -> NoReturn:
     raise UpdateRuntimeGitignoreSecurityError(
         f"unsafe MAP .gitignore lock at {lock_path}: {reason}"
@@ -900,7 +893,7 @@ def _unlock_descriptor(descriptor: int) -> None:
 @contextlib.contextmanager
 def _project_gitignore_lock(
     project_root: Path,
-) -> Iterator[tuple[int | None, os.stat_result]]:
+) -> Generator[tuple[int | None, os.stat_result], None, None]:
     """Serialize a complete MAP-owned root .gitignore transaction."""
     project_original = _validated_project_root_stat(project_root)
     with _pinned_project_root(project_root, project_original) as directory_fd:
@@ -1220,11 +1213,106 @@ def _has_effective_gitignore_path(lines: list[bytes], required_path: str) -> boo
     )
 
 
+def _git_info_exclude_path(project_root: Path) -> Path | None:
+    """Return ``<git-common-dir>/info/exclude`` for a repo rooted at *project_root*.
+
+    ``info/exclude`` patterns anchor at the repository top level, so a project
+    root that is merely a subdirectory of a repo (or not a repo at all, or git
+    is unavailable) returns None and the caller keeps the tracked ``.gitignore``.
+    Linked worktrees share the common dir, hence one exclude file per clone.
+    """
+    try:
+        proc = subprocess.run(
+            ["git", "rev-parse", "--show-toplevel", "--git-common-dir"],
+            cwd=project_root,
+            capture_output=True,
+            text=True,
+            timeout=10,
+            check=False,
+        )
+    except (OSError, subprocess.SubprocessError):
+        return None
+    lines = proc.stdout.splitlines()
+    if proc.returncode != 0 or len(lines) != 2:
+        return None
+    toplevel, common = Path(lines[0]), Path(lines[1])
+    try:
+        if toplevel.resolve() != project_root.resolve():
+            return None
+    except OSError:
+        return None
+    if not common.is_absolute():
+        common = project_root / common
+    return common / "info" / "exclude"
+
+
+def _prepare_info_exclude_directory(exclude: Path) -> None:
+    """Create ``info/`` when missing and require it to be a direct directory."""
+    try:
+        exclude.parent.mkdir(parents=True, exist_ok=True)
+        current = os.lstat(exclude.parent)
+    except OSError as exc:
+        _unsafe_project_gitignore(
+            exclude, f"could not prepare {exclude.parent} ({exc})"
+        )
+    if stat.S_ISLNK(current.st_mode) or not stat.S_ISDIR(current.st_mode):
+        _unsafe_project_gitignore(
+            exclude, "the info directory must be a direct directory"
+        )
+
+
 def _has_gitignore_marker(lines: list[bytes], marker: str) -> bool:
     encoded = marker.encode()
     return any(line == encoded or line.startswith(encoded + b" ") for line in lines)
 
 
+def _merge_runtime_exclude(
+    exclude: Path,
+    gitignore_lines: list[bytes],
+    project_root: Path,
+    project_original: os.stat_result,
+) -> bool | None:
+    """Append missing runtime paths to the git exclude file.
+
+    Presence in either file counts (OR).  Returns True when the exclude file
+    was rewritten, False when nothing was needed, and None when a ``.gitignore``
+    negation (which outranks ``info/exclude``) defeats an exclude entry, so the
+    caller must repair the tracked ``.gitignore`` instead.
+    """
+    existing, original = _read_safe_gitignore(exclude, None)
+    exclude_lines = existing.splitlines()
+    # .gitignore outranks info/exclude: evaluate exclude rules first.
+    combined = exclude_lines + gitignore_lines
+    missing = [
+        path
+        for path in _UPDATE_RUNTIME_GITIGNORE_PATHS
+        if not _has_effective_gitignore_path(combined, path)
+    ]
+    if not missing:
+        return False
+    if any(
+        line.startswith(b"!") and _negation_targets_path(line, path.encode())
+        for path in missing
+        for line in gitignore_lines
+    ):
+        return None
+    _prepare_info_exclude_directory(exclude)
+    block: list[bytes] = []
+    if not _has_gitignore_marker(exclude_lines, _UPDATE_RUNTIME_GITIGNORE_MARKER):
+        block.append(_UPDATE_RUNTIME_GITIGNORE_MARKER.encode())
+    block.extend(path.encode() for path in missing)
+    separator = b"" if not existing or existing.endswith(b"\n") else b"\n"
+    _atomic_replace_gitignore(
+        exclude,
+        existing + separator + b"\n".join(block) + b"\n",
+        original,
+        None,
+        project_root,
+        project_original,
+    )
+    return True
+
+
 def _merge_project_gitignore_locked(
     project_root: Path,
     directory_fd: int | None,
@@ -1234,20 +1322,39 @@ def _merge_project_gitignore_locked(
     include_sofa: bool = False,
     include_agent_memory_local: bool = False,
     include_settings_local: bool = False,
+    runtime_exclude: Path | None = None,
 ) -> int:
-    """Append selected MAP-owned blocks while the shared lock is held."""
+    """Append selected MAP-owned blocks while the shared lock is held.
+
+    With ``runtime_exclude`` set, the runtime block goes to that git exclude
+    file instead of the tracked ``.gitignore``; privacy blocks always stay in
+    ``.gitignore``.
+    """
     gitignore = project_root / ".gitignore"
     existing, original = _read_safe_gitignore(gitignore, directory_fd)
     _validate_project_root_unchanged(project_root, project_original)
     existing_lines = existing.splitlines()
 
     additions: list[bytes] = []
+    exclude_changed = False
     if include_runtime:
         missing_runtime_paths = [
             path
             for path in _UPDATE_RUNTIME_GITIGNORE_PATHS
             if not _has_effective_gitignore_path(existing_lines, path)
         ]
+        if runtime_exclude is not None:
+            outcome = _merge_runtime_exclude(
+                runtime_exclude,
+                existing_lines,
+                project_root,
+                project_original,
+            )
+            # None: a .gitignore negation outranks info/exclude, so the
+            # tracked-file repair below still applies.
+            if outcome is not None:
+                exclude_changed = outcome
+                missing_runtime_paths = []
         if missing_runtime_paths:
             runtime_lines: list[bytes] = []
             marker = _UPDATE_RUNTIME_GITIGNORE_MARKER.encode()
@@ -1291,7 +1398,7 @@ def _merge_project_gitignore_locked(
 
     if not additions:
         _validate_gitignore_unchanged(gitignore, original, directory_fd)
-        return 0
+        return 1 if exclude_changed else 0
     separator = b"" if not existing or existing.endswith(b"\n") else b"\n"
     replacement = existing + separator + b"".join(additions)
     _atomic_replace_gitignore(
@@ -1312,11 +1419,17 @@ def _merge_project_gitignore(
     include_sofa: bool = False,
     include_agent_memory_local: bool = False,
     include_settings_local: bool = False,
+    runtime_to_git_exclude: bool = False,
 ) -> int:
     """Safely, atomically, and serially append MAP-owned ignore blocks."""
     project_root = project_path.resolve(strict=True)
     if not project_root.is_dir():
         raise NotADirectoryError(f"MAP project root is not a directory: {project_root}")
+    runtime_exclude = (
+        _git_info_exclude_path(project_root)
+        if include_runtime and runtime_to_git_exclude
+        else None
+    )
     with _project_gitignore_lock(project_root) as (directory_fd, project_original):
         return _merge_project_gitignore_locked(
             project_root,
@@ -1326,6 +1439,7 @@ def _merge_project_gitignore(
             include_sofa=include_sofa,
             include_agent_memory_local=include_agent_memory_local,
             include_settings_local=include_settings_local,
+            runtime_exclude=runtime_exclude,
         )
 
 
@@ -1336,10 +1450,17 @@ def merge_update_runtime_gitignore(
     agent_memory_local: bool = False,
     settings_local: bool = False,
 ) -> int:
-    """Atomically establish runtime and requested privacy ignore entries."""
+    """Atomically establish runtime and requested privacy ignore entries.
+
+    The runtime block is local state, so in a git repo rooted at *project_path*
+    it goes to ``<git-common-dir>/info/exclude`` and leaves the tracked
+    ``.gitignore`` clean; elsewhere it falls back to ``.gitignore``.  Privacy
+    blocks are repo policy and always go to ``.gitignore``.
+    """
     return _merge_project_gitignore(
         project_path,
         include_runtime=True,
+        runtime_to_git_exclude=True,
         include_sofa=sofa,
         include_agent_memory_local=agent_memory_local,
         include_settings_local=settings_local,

{mapify_cli-3.35.2 → mapify_cli-3.36.0}/src/mapify_cli/templates/agents/monitor.md

@@ -136,6 +136,10 @@ state-changing orchestration continues in its original checkout. A standalone
      Only a diagnostic satisfying every condition in “Explicitly approved
      baseline gate failures” may be excluded from the scoped verdict; keep
      the full build gate failed and continue the other checks.
+   **VERIFICATION EXECUTION GATE (MANDATORY — same weight as BUILD GATE):** an applicable check (the lint/type/test target the repo's CI or Makefile runs for the touched code) that could NOT execute — tool missing, check skipped, a Makefile target that prints "skipped" and exits 0 — is NOT a pass.
+   - Set `valid: false` with issue `verification not executed: <tool> (<reason>)`.
+   - List the tool in `tools_run` with status `unavailable` or `skipped`; never omit it.
+   - Allowed remedies: install the tool or run the repo's tools target, then re-run; or explicit user deferral recorded in the conversation.
 3. Verify Goal is achieved — trace code path to confirm the stated outcome
 4. Verify Action is implemented — check that the specified method/operation exists
 5. **Verify mutation boundary (MANDATORY):** Run
@@ -329,7 +333,7 @@ All language handlers produce a standardized JSON format:
   "findings": [
     { "tool": "ruff", "file": "src/main.py", "line": 42, "severity": "error", "code": "F821", "message": "Undefined name" }
   ],
-  "tools_run": ["ruff", "mypy"]
+  "tools_run": ["ruff", "mypy", {"tool": "golangci-lint", "status": "unavailable"}]
 }
 ```
 
@@ -1741,6 +1745,9 @@ GOOD: "suggestion": "Use path\\to\\file"
 Before returning JSON, verify:
 
 ```
+□ 0. VERIFICATION EXECUTION GATE: every applicable lint/type/test check actually ran;
+     any that could not run is an issue (`verification not executed: <tool> (<reason>)`) → valid=false
+
 □ 1. All required fields present:
      valid, summary, issues, passed_checks, failed_checks,
      feedback_for_actor, estimated_fix_time, mcp_tools_used

{mapify_cli-3.35.2 → mapify_cli-3.36.0}/src/mapify_cli/templates/agents/task-decomposer.md

@@ -342,6 +342,7 @@ Return **ONLY** valid JSON in this exact structure:
   - Example: "Use existing RateLimiter middleware, configure for /api/* routes"
 **subtasks[].test_strategy**: Required object with unit/integration/e2e keys plus `scenario_dimensions`. Use "N/A" for levels not applicable.
   - **scenario_dimensions** (required): Object with four keys — `happy_path`, `error`, `edge_case`, `security`. Each describes at least one planned test covering that dimension. Use "N/A" for dimensions not relevant to the subtask. Testing-heavy subtasks must cover at minimum 4 dimensions.
+  - **Repo lint/type gate (MANDATORY for code subtasks)**: when the repo has a lint/type target (Makefile `lint`/`check`, CI lint or type-check step), the subtask's verification MUST include the repo's lint/type target for the touched code, not only build/vet. If the tool may be absent locally, name the install/tools target in the verification step.
   - MUST map `validation_criteria` → tests:
     - For each `VCn:` criterion, include at least one planned test name that covers it.
     - Recommended naming: include `vc<n>` in the test name (e.g., `test_vc1_*`, `TestVC1*`) for deterministic grep-ability.

{mapify_cli-3.35.2 → mapify_cli-3.36.0}/src/mapify_cli/templates/codex/agents/decomposer.toml

@@ -307,6 +307,7 @@ Return **ONLY** valid JSON in this exact structure:
   - Example: "Use existing RateLimiter middleware, configure for /api/* routes"
 **subtasks[].test_strategy**: Required object with unit/integration/e2e keys plus `scenario_dimensions`. Use "N/A" for levels not applicable.
   - **scenario_dimensions** (required): Object with four keys — `happy_path`, `error`, `edge_case`, `security`. Each describes at least one planned test covering that dimension. Use "N/A" for dimensions not relevant to the subtask. Testing-heavy subtasks must cover at minimum 4 dimensions.
+  - **Repo lint/type gate (MANDATORY for code subtasks)**: when the repo has a lint/type target (Makefile `lint`/`check`, CI lint or type-check step), the subtask's verification MUST include the repo's lint/type target for the touched code, not only build/vet. If the tool may be absent locally, name the install/tools target in the verification step.
   - MUST map `validation_criteria` → tests:
     - For each `VCn:` criterion, include at least one planned test name that covers it.
     - Recommended naming: include `vc<n>` in the test name (e.g., `test_vc1_*`, `TestVC1*`) for deterministic grep-ability.

{mapify_cli-3.35.2 → mapify_cli-3.36.0}/src/mapify_cli/templates/codex/agents/monitor.toml

@@ -127,6 +127,11 @@ Verification sequence (execute in order):
    If build/compile fails -> valid: false immediately with compilation errors.
    Do NOT proceed to other checks.
 
+   VERIFICATION EXECUTION GATE (MANDATORY -- same weight as BUILD GATE): an applicable check (the lint/type/test target the repo's CI or Makefile runs for the touched code) that could NOT execute -- tool missing, check skipped, a Makefile target that prints "skipped" and exits 0 -- is NOT a pass.
+   - Set valid: false with issue `verification not executed: <tool> (<reason>)`.
+   - List the tool in tools_run with status `unavailable` or `skipped`; never omit it.
+   - Allowed remedies: install the tool or run the repo's tools target, then re-run; or explicit user deferral recorded in the conversation.
+
 3. Verify Goal is achieved -- trace code path to confirm the stated outcome
 4. Verify Action is implemented -- check that the specified method/operation exists
 5. Verify mutation boundary (MANDATORY): Run
@@ -1260,6 +1265,7 @@ Expected output:
 
 Before returning your review JSON:
 1. Did I run the BUILD GATE (build/compile command)?
+1a. Did I run the VERIFICATION EXECUTION GATE (every applicable lint/type/test check executed, none unavailable/skipped)?
 2. Did I check all 11 validation dimensions systematically?
 3. Did I verify documentation against source of truth (if applicable)?
 4. Are all issues specific with location and actionable suggestions?

{mapify_cli-3.35.2/src/mapify_cli/templates → mapify_cli-3.36.0/src/mapify_cli/templates/codex}/hooks/post-compact-context.py

@@ -110,6 +110,19 @@ def state_string(state: dict, key: str, default: str = "") -> str:
     return default
 
 
+def active_wave_bits(state: dict) -> list[str]:
+    """Return ``wave=i/n`` and ``phases=...`` bits when the wave loop is engaged."""
+    waves = state.get("execution_waves")
+    phases = state.get("subtask_phases")
+    wave_idx = state.get("current_wave_index", 0)
+    if not (isinstance(waves, list) and waves and isinstance(phases, dict) and phases):
+        return []
+    if not isinstance(wave_idx, int) or isinstance(wave_idx, bool):
+        return []
+    per_subtask = " ".join(f"{sid}:{phase}" for sid, phase in phases.items())
+    return [f"wave={wave_idx + 1}/{len(waves)}", f"phases=[{per_subtask}]"]
+
+
 def load_json(path: Path) -> dict | None:
     try:
         data = json.loads(path.read_text(encoding="utf-8"))
@@ -209,10 +222,17 @@ def build_reprime(branch: str, branch_dir: Path) -> str | None:
     step_id = state_string(state, "current_step_id")
     subtask_id = state_string(state, "current_subtask_id")
 
+    wave_bits = active_wave_bits(state)
+    if wave_bits:
+        # Wave loop engaged: current_step_*/current_subtask_id are stale
+        # sequential leftovers; subtask_phases is the live progress record.
+        phase = step_id = subtask_id = ""
+
     lines = ["MAP RE-PRIME after compaction:"]
     state_bits = []
     if workflow:
         state_bits.append(f"workflow={workflow}")
+    state_bits.extend(wave_bits)
     if step_id:
         state_bits.append(f"step={step_id}")
     if phase:
@@ -335,3 +355,4 @@ def main() -> None:
 
 if __name__ == "__main__":
     main()
+

{mapify_cli-3.35.2/src/mapify_cli/templates → mapify_cli-3.36.0/src/mapify_cli/templates/codex}/hooks/workflow-context-injector.py

@@ -501,6 +501,24 @@ def state_string(state: dict, key: str, default: str = "") -> str:
     return default
 
 
+def active_wave_label(state: dict) -> str | None:
+    """Return ``WAVE i/n [ST-x:phase ...]`` when the wave loop is engaged.
+
+    Waves track progress only in ``subtask_phases``; ``current_step_*`` is a
+    stale sequential leftover (advance_wave resets it to 2.2/RESEARCH), so it
+    must not drive the banner while the wave loop is active.
+    """
+    waves = state.get("execution_waves")
+    phases = state.get("subtask_phases")
+    wave_idx = state.get("current_wave_index", 0)
+    if not (isinstance(waves, list) and waves and isinstance(phases, dict) and phases):
+        return None
+    if not isinstance(wave_idx, int) or isinstance(wave_idx, bool):
+        return None
+    per_subtask = " ".join(f"{sid}:{phase}" for sid, phase in phases.items())
+    return f"WAVE {wave_idx + 1}/{len(waves)} [{per_subtask}]"
+
+
 def required_action_for_step(step_id: str, step_phase: str) -> str | None:
     """Return a short required-next-action hint for common steps."""
     if step_id == "1.55":
@@ -713,6 +731,15 @@ def format_reminder(
                 mode = "batch:parallel"
 
     required = required_action_for_step(step_id, step_phase)
+    step_label = f"{step_id} {step_phase}"
+    wave_label = active_wave_label(state)
+    if wave_label:
+        # Wave loop engaged: current_step_*/current_subtask_id are stale
+        # sequential leftovers, so show per-subtask phases instead.
+        step_label = wave_label
+        wave_hint = ""
+        subtask_id = "-"
+        required = None
 
     diag_hint = ""
     diag_file = (
@@ -738,7 +765,7 @@ def format_reminder(
             if len(current_files) > 5:
                 files_hint += f" +{len(current_files) - 5}"
 
-    if not step_id and not step_phase:
+    if not step_id and not step_phase and not wave_label:
         return None
 
     # Context-aware: add goal and subtask title
@@ -772,15 +799,15 @@ def format_reminder(
     except OSError:
         pass
     ts_hint = f" @ {now_utc.strftime('%H:%M:%S.%f')[:-3]}Z (state {state_age_str})"
-    base = f"[MAP]{ts_hint} {step_id} {step_phase}{goal_hint} | ST: {subtask_id}{title_hint} ({progress}) | plan:{plan_ok} mode:{mode}{wave_hint}{diag_hint}{files_hint}{hard_hint}{tag_hint}{authority_hint}"
+    base = f"[MAP]{ts_hint} {step_label}{goal_hint} | ST: {subtask_id}{title_hint} ({progress}) | plan:{plan_ok} mode:{mode}{wave_hint}{diag_hint}{files_hint}{hard_hint}{tag_hint}{authority_hint}"
 
     # Enforce limit: trim goal first, then constraint detail, then word-boundary truncate.
     if len(base) > REMINDER_LIMIT:
         goal_hint = ""
-        base = f"[MAP]{ts_hint} {step_id} {step_phase} | ST: {subtask_id}{title_hint} ({progress}) | plan:{plan_ok} mode:{mode}{wave_hint}{diag_hint}{files_hint}{hard_hint}{tag_hint}{authority_hint}"
+        base = f"[MAP]{ts_hint} {step_label} | ST: {subtask_id}{title_hint} ({progress}) | plan:{plan_ok} mode:{mode}{wave_hint}{diag_hint}{files_hint}{hard_hint}{tag_hint}{authority_hint}"
     if len(base) > REMINDER_LIMIT:
         hard_hint = ""
-        base = f"[MAP]{ts_hint} {step_id} {step_phase} | ST: {subtask_id}{title_hint} ({progress}) | plan:{plan_ok} mode:{mode}{wave_hint}{diag_hint}{files_hint}{tag_hint}{authority_hint}"
+        base = f"[MAP]{ts_hint} {step_label} | ST: {subtask_id}{title_hint} ({progress}) | plan:{plan_ok} mode:{mode}{wave_hint}{diag_hint}{files_hint}{tag_hint}{authority_hint}"
     if len(base) > REMINDER_LIMIT:
         base = _truncate_at_word(base, REMINDER_LIMIT)
 
@@ -1126,3 +1153,4 @@ def main() -> None:
 
 if __name__ == "__main__":
     main()
+

{mapify_cli-3.35.2 → mapify_cli-3.36.0}/src/mapify_cli/templates/codex/skills/map-review/SKILL.md

@@ -218,26 +218,24 @@ contradict a clean precheck require evidence stronger than narrative
 ```bash
 BRANCH=$(python3 .map/scripts/map_utils.py branch)
 BRANCH_DIR=".map/$BRANCH"
-REVIEW_MODE="full"
+WORKFLOW_MODE="full"  # --mode, echoed as `mode`; `review_mode` (normal/adversarial/...) is separate
 # Empty / placeholder review-bundle.md ⇒ lightweight.
 if [ -f ".map/$BRANCH/review-bundle.md" ] && \
    grep -qE 'MISSING|^- $|^—$' ".map/$BRANCH/review-bundle.md" && \
    ! grep -qE '^\s*##' ".map/$BRANCH/review-bundle.md"; then
-   REVIEW_MODE="lightweight"
+   WORKFLOW_MODE="lightweight"
 fi
 # "twin of X", "sibling controller", "mirror of Y" in commit or PR body
 # ⇒ sibling-aware (operator probably wants comparison, not synthesis).
 SIBLING_HINT=""
 if git log -1 --format=%B | grep -iE 'twin of |sibling |mirror of |port of ' >/dev/null; then
-  REVIEW_MODE="sibling-aware"
+  WORKFLOW_MODE="sibling-aware"
   SIBLING_HINT=$(git log -1 --format=%B | grep -oiE '(twin of|sibling|mirror of|port of)[^.]*' | sed -n '1p')
 fi
-# Include only documented project checks as {"<id>":[argv...]}; never invent placeholder passes.
-# Record absent automation as a limitation in the review summary; use {} if no checks exist.
+# Only documented project checks as {"<id>":[argv...]}; no placeholder passes; {} if none (state the limitation).
 : "${CHECK_SPECS_JSON:?Set CHECK_SPECS_JSON to documented project check argv specifications}"
-# Optional positive seconds per admitted check; default 300.
-if [ -z "${CHECK_TIMEOUTS_JSON:-}" ]; then CHECK_TIMEOUTS_JSON='{}'; fi
-python3 - "$CHECK_SPECS_JSON" "$REVIEW_MODE" "$ARGUMENTS" "$SIBLING_HINT" "$CHECK_TIMEOUTS_JSON" <<'PY'
+if [ -z "${CHECK_TIMEOUTS_JSON:-}" ]; then CHECK_TIMEOUTS_JSON='{}'; fi  # optional seconds per check; default 300
+python3 - "$CHECK_SPECS_JSON" "$WORKFLOW_MODE" "$ARGUMENTS" "$SIBLING_HINT" "$CHECK_TIMEOUTS_JSON" <<'PY'
 import json
 import subprocess
 import sys
@@ -269,19 +267,21 @@ print(admission.stdout, end="")
 if json.loads(admission.stdout).get("completed"):
     raise SystemExit("Review already completed; do not dispatch reviewers")
 for check_id in specs:
-    subprocess.run(runner + ["run_test_gate", "--check-id", check_id], check=True)
+    gate = subprocess.run(runner + ["run_test_gate", "--check-id", check_id], capture_output=True, text=True)
+    print("CHECK", check_id, *(f"{k}={json.loads(gate.stdout or '{}').get(k)}" for k in ("passed", "exit_code", "output_artifact")))
+    if gate.returncode: raise SystemExit(f"Check {check_id} failed; read $BRANCH_DIR/<artifact> before any fix")
 PY
 [ "$?" -eq 0 ] || exit 1
 ```
 
-Start before any capture or fan-out. Abort on a start error; in particular
+Start before any capture or fan-out. Stdout is a compact summary (full rows stay in the ledger); for `human_consent` `enforcement` see [review-reference.md](review-reference.md#sensitive-and-unknown-review-gates). Abort on a start error; in particular
 `reconsider_approach` means STOP and request reconsideration, never approval or a
 fourth automatic round. A round is a review/fix iteration, not a reviewer/tool
 retry or an ordering collection. Pending admission restores its identity and inferred mode; all other inputs must still match.
 Completed rounds are immutable. Use `--round-id <stored-id>` for an explicit retry.
-Do not dispatch reviewers when admission reports `completed: true`. For a stale pending round,
+Do not dispatch reviewers when admission reports `completed: true`. For a stale pending round or one whose reviewers could not run,
 explicitly run `abandon_review_round <round-id> --reason "<why>"` through the runner before new admission;
-abandonment preserves audit/findings and consumes an unsuccessful attempt, never resets the cap.
+abandonment preserves audit/findings and consumes an unsuccessful attempt, never resets the cap (out-of-harness review: see reference).
 After the initial full review, verified baseline/static impact enables incremental
 prioritization of delta + affected dependencies + unresolved findings, not exemption
 from admitted required_files coverage. Unknown impact retains full-scope fallback.

{mapify_cli-3.35.2 → mapify_cli-3.36.0}/src/mapify_cli/templates/codex/skills/map-review/review-reference.md

@@ -10,6 +10,12 @@ Human consent is a separate snapshot/policy/action-bound `review_consent` hold i
 
 Shadow consent-store errors are reported in admission output and persisted in the review ledger when writable; they do not deny admission or ready. Never reset a corrupt hold store: existing generic hold blockers remain enforced. Strict consent-store errors still fail closed. Gate configuration is read from the pinned trusted revision independently of `REVIEW.md` content validation; invalid root/area policy cannot downgrade a strict configuration.
 
+Admission reports the hold as `human_consent: {status, hold_id, reason, enforcement}`. `enforcement: "shadow"` is informational: it blocks nothing and there is nothing to resolve yet. `enforcement: "strict"` stops at review-ready until verified human consent exists (#523). `status: "not_required"` means the change is not sensitive.
+
+Admission and `run_test_gate` stdout are compact: the target omits trusted-policy file contents and lists `context_files_count` instead of the repository inventory, and a check reports `target_unchanged` instead of full `before`/`after` targets. Full rows stay in `review-verdict-ledger.json`.
+
+If reviewers could not run for an admitted round, `abandon_review_round` it. A review then done outside the harness is reported as such in the summary; it never produces a ledger verdict or approval.
+
 ## Section Rubrics
 
 - Architecture: boundaries, lifecycle, coupling, public API behavior, stage consumption.
@@ -21,9 +27,72 @@ Shadow consent-store errors are reported in admission output and persisted in th
 
 Required coverage is the admitted `required_files`: changed paths against the selected base,
 including staged/unstaged/untracked inputs, deletions and both rename sides. The full
-`context_files` inventory remains snapshot-bound and available for dependency checks.
+`context_files` inventory remains snapshot-bound; unchanged files are fetched lazily as
+resource `repo:<path>` (frozen on first fetch) and are never listed in the manifest.
 Unread or explicitly skipped optional context does not make review incomplete.
 
+Generated files are excluded from `required_files` and recorded in `row.coverage_skips`
+(`snapshot.coverage_skips`, ledger `completeness.skipped_scope`) only when matched by a file
+name pattern (`*.pb.go`, `*.pb.cc`, `*.pb.h`, `*_pb2.py`, `*_pb2_grpc.py`, `zz_generated*`), a
+trusted `review.generated_patterns` entry (gitattributes-style: a pattern with a leading or inner slash is
+anchored to the repository root, one without a slash matches the base name at any depth, `*` and `?` never cross
+`/`, and `**/`, `/**`, `/**/` span directories), or `linguist-generated` in the root `.gitattributes`
+of the trusted default revision. A `Code generated` header never skips a file, lockfiles stay
+required, and strict `review.security_gates` disables every skip. Their diff hunks appear as
+one-line stubs. `review.exclude_generated: false` turns skipping off.
+
+Unmodified installed MAP files are skipped too (`rule: mapify-managed`, listed in `skipped_scope`):
+a file whose embedded `MAP-MANAGED` header has a `template_hash` equal to the hash of its own payload
+(fully managed files, and fenced files whose fence is intact with no user tail). Edited payloads,
+user tails, missing or malformed headers and files whose JSON was reformatted stay required.
+**Trust trade-off:** the header is self-attested. A PR author can add a self-consistent header to
+any file and it is skipped (visibly, in `skipped_scope`). Use strict `review.security_gates` when PR
+authors are untrusted; it disables this skip. `review.exclude_mapify_managed: false` opts out.
+
+## Sharded Rounds
+
+When the required scope does not fit one reviewer's budget, admission plans `row.shards`
+(deterministic, directory-aware, disjoint; at most `review.max_shards`, default 8) and returns
+`shard_ids`. A single file above the per-shard capacity or more than `max_shards` shards fails
+admission with `review_context_budget_exceeded` (`reason: file_too_large | too_many_shards`).
+Unsharded rounds never see any of this.
+
+- Every scheduled role reviews every shard; there is no per-role coverage exemption. Loop
+  ordering, then shard, then role. `--adversarial` and `--compare-orderings` work unchanged
+  per shard (orderings x shards x roles).
+- Build with `--shard <id>` (`build_review_prompts`, `build_role_review_prompts`,
+  `build_adversarial_review_prompts`). Without it a sharded round returns
+  `{status: "sharded", shard_ids}`. A shard context carries only that shard's source resources and
+  diff; other shards' files are optional `repo:<path>` context. Delivery, finalization token and
+  `context_receipt` are per shard (`ordering:reviewer#sNN`); bind/serve/ack are unchanged.
+- Capture with `capture_review_output --shard <id>`. Shard captures are stored under
+  `review-shards/` (outside the `review-agent-*` namespace). Once every shard of an
+  (ordering, reviewer) is captured the runner writes the canonical `review-agent-<reviewer>.json`:
+  worst-of verdict fields (`verdict`, `risk_assessment`, `recommendation`, minimum scores and
+  confidence), concatenated findings/issues (reviewer finding IDs kept unique; the ledger still
+  keys findings by fingerprint, never by shard), unioned receipts and `context_receipts` per
+  shard. Adversarial aggregates are re-aggregated from the merged per-reviewer outputs. A partial
+  set of shards leaves the round INCOMPLETE.
+- Completeness checks each shard capture's hash, delivery proof and own-file coverage, so a
+  reviewer claiming other shards' files cannot hide an unread shard. The complexity lens is
+  advisory and runs per shard; report its per-shard lines together.
+
+## Context Budget
+
+Admission sizes each path the way its resource is serialized (ASCII-escaped JSON or base64 for sources,
+raw text for the diff, plus the manifest entry), so non-ASCII changes are sharded at admission instead of
+failing at prompt build; the plan and budget check run for every new round, not only the first. Execution-check
+logs longer than 16 Ki characters are shortened in the prompt; the full log is the optional resource
+`check:<id>` (fetched like `repo:<path>`). A changed generated file fetched through `repo:<path>` is served
+with its real base and current content (`status: changed_generated_skipped`).
+
+Each reviewer's required context (manifest, prompt, `diff`, inventory, sources, artifacts) must
+fit `review.context_budget_bytes` (trusted config; env `MAP_REVIEW_CONTEXT_BUDGET_BYTES`; default
+384 KiB). `begin_review_run` estimates it before consent and returns
+`stop_reason: review_context_budget_exceeded` with `total`, `budget`, `top_paths` and `hints`
+without consuming a round; the prompt builders recheck exact bytes and return no partial prompts.
+Split the change, exclude generated files or raise the budget.
+
 ## Compare Orderings
 
 For supported Codex reviews, `codex_review_runner.py` performs binding, delivery,
@@ -152,7 +221,7 @@ Either way it cannot gate the change, and it cannot disappear either.
 Standalone prompt build (the normal fan-out builds these automatically):
 
 ```bash
-python3 .map/scripts/map_step_runner.py build_role_review_prompts \
+python3 .map/scripts/map_step_runner.py build_role_review_prompts ${SHARD:+--shard "$SHARD"} \
   [--roles user_experience,maintainer]
 ```
 
@@ -297,8 +366,9 @@ retries, both ordering collections and the advisory complexity lens:
    For an early final response, retain no final capture: create the same request
    shape from the status's next `remaining` resource/offset and continue delivery.
    Required resources include the manifest, full original prompt (unless initially
-   inline), inventory and source resources marked `required`. Unchanged sources
-   are optional dependency context; fetch them only when needed. Blind stays diff-only.
+   inline), the `diff` resource, inventory and source resources marked `required`. Unchanged
+   repository files are optional: fetch `repo:<path>` only when needed. Blind stays diff-only
+   (prompt and `diff` only).
 2. Store the exact returned chunk JSON in a session-specific pending file under
    `.map/<branch>/review-context-delivery/<session-id>/`, then pass that JSON
    verbatim to the **same agent**:
@@ -356,7 +426,7 @@ BRANCH=$(python3 .map/scripts/map_utils.py branch)
 BRANCH_DIR=".map/$BRANCH"
 REVIEW_ROUND_ID=$(python3 -c 'import json,sys; print(json.load(open(sys.argv[1]))["round_id"])' "$BRANCH_DIR/review-mode.json")
 python3 .map/scripts/map_step_runner.py capture_review_output --reviewer monitor \
-  --round-id "$REVIEW_ROUND_ID" --ordering "${ORDERING_LABEL:-}" <<'MONITOR_EOF'
+  --round-id "$REVIEW_ROUND_ID" --ordering "${ORDERING_LABEL:-}" ${SHARD:+--shard "$SHARD"} <<'MONITOR_EOF'
 <paste the Monitor JSON envelope verbatim>
 MONITOR_EOF
 ```