specfuse-loop 0.25.0__tar.gz → 0.26.0__tar.gz

{specfuse_loop-0.25.0/specfuse_loop.egg-info → specfuse_loop-0.26.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: specfuse-loop
-Version: 0.25.0
+Version: 0.26.0
 Summary: Local-first executor for the Specfuse Plan + Work Unit gate-cycle methodology.
 Author: Specfuse contributors
 License: Apache-2.0

{specfuse_loop-0.25.0 → specfuse_loop-0.26.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "specfuse-loop"
-version = "0.25.0"
+version = "0.26.0"
 description = "Local-first executor for the Specfuse Plan + Work Unit gate-cycle methodology."
 readme = "README.md"
 requires-python = ">=3.10"

{specfuse_loop-0.25.0 → specfuse_loop-0.26.0}/specfuse/loop/closing_requirements.py

@@ -155,6 +155,25 @@ FEATURE_ORACLE_VERDICT_RE = re.compile(
     rf"^###\s+{re.escape(FEATURE_ORACLE_KEY)}:\s*(PASS|FAIL)\s*$", re.MULTILINE,
 )
 
+#: A re-close's `## Measurements` carry-accounting line (FEAT-2026-0117/T03),
+#: required only when `GATE-NN-CRITERIA.md` has at least one
+#: `carried_from_attempt` entry — a first close has no new obligation.
+#: `entries` is duck-typed (`criteria_state.CriterionStateEntry`, or anything
+#: with a `carried_from_attempt` attribute): this registry stays a pure-data
+#: module with no import of the artifact schema it describes.
+def carry_summary_is_required(entries) -> bool:
+    """True when at least one entry carries a green forward from a prior
+    attempt — the trigger for the `## Measurements` carry-accounting line."""
+    return any(entry.carried_from_attempt is not None for entry in entries)
+
+
+def render_carry_summary(entries) -> str:
+    """The exact `## Measurements` line a close pastes when `entries` carries
+    any criterion forward: `carried forward: N criteria, re-measured: M`."""
+    carried = sum(1 for entry in entries if entry.carried_from_attempt is not None)
+    return f"carried forward: {carried} criteria, re-measured: {len(entries) - carried}"
+
+
 GATE_REVIEW_FILENAME_TEMPLATE = "GATE-{next_gate:02d}-REVIEW.md"
 
 
@@ -378,6 +397,19 @@ CLOSING_REQUIREMENTS: dict[str, list[Requirement]] = {
             file=RETROSPECTIVE_FILENAME,
             enforced_by="check_feature_oracle_verdict_recorded",
         ),
+        Requirement(
+            id="close-o", wu_type="close", phase="pre-squash",
+            description=(
+                "When GATE-NN-CRITERIA.md carries at least one entry forward "
+                "from a prior attempt, RETROSPECTIVE.md's Measurements "
+                "section records the render_carry_summary(entries) line — "
+                "'carried forward: N criteria, re-measured: M' — so the "
+                "close states what it inherited (FEAT-2026-0117/T03)"
+            ),
+            file=RETROSPECTIVE_FILENAME,
+            applies_when="criteria_artifact_present",
+            enforced_by="check_carry_summary_recorded",
+        ),
     ],
     "close-intermediate": [
         Requirement(

{specfuse_loop-0.25.0 → specfuse_loop-0.26.0}/specfuse/loop/criteria_state.py

@@ -20,7 +20,8 @@ FEAT-2026-0056/PLAN.md and GATE-01.md for the design this module encodes.
 from __future__ import annotations
 
 import re
-from dataclasses import dataclass
+from dataclasses import dataclass, field
+from pathlib import Path
 from typing import Optional
 
 #: An oracle's scope classification. `narrow` oracles (a scoped test nodeid,
@@ -41,6 +42,11 @@ _FIELD_PATTERNS = {
     "state": re.compile(r"^- \*\*state:\*\*\s*`([^`]+)`", re.MULTILINE),
     "proved_at_sha": re.compile(r"^- \*\*proved_at_sha:\*\*\s*`([^`]+)`", re.MULTILINE),
     "attempt": re.compile(r"^- \*\*attempt:\*\*\s*`?([^`\n]+)`?", re.MULTILINE),
+    "carried_from_attempt": re.compile(
+        r"^- \*\*carried_from_attempt:\*\*\s*`?([^`\n]+)`?", re.MULTILINE
+    ),
+    "covers": re.compile(r"^- \*\*covers:\*\*\s*(.+)$", re.MULTILINE),
+    "invalidated_by": re.compile(r"^- \*\*invalidated_by:\*\*\s*(.+)$", re.MULTILINE),
 }
 
 
@@ -55,6 +61,20 @@ class CriterionStateEntry:
     state: Optional[str]
     proved_at_sha: Optional[str]
     attempt: Optional[str]
+    #: Set by `reset_stale_criteria_entries` when a re-arm carries this
+    #: entry's narrow green past the attempt cycle that proved it — the
+    #: attempt number it was carried FROM, not the current attempt.
+    carried_from_attempt: Optional[str] = None
+    #: Paths this criterion's proof depends on — its producing WU's
+    #: `produces:` plus its oracle's test file, when derivable
+    #: (`derive_criterion_covers`, FEAT-2026-0117/T02). Empty when never
+    #: seeded with a `- **covers:**` line: an entry the skeleton step hasn't
+    #: backfilled yet, or one predating this field.
+    covers: list = field(default_factory=list)
+    #: Set by `invalidate_carried_entries` when a re-close's gate diff
+    #: touches a path this (formerly carried) entry `covers` — names that
+    #: path, not the whole diff.
+    invalidated_by: Optional[str] = None
 
 
 #: Matches `GATE-NN-CRITERIA.md` basenames (any `NN`), and nothing else —
@@ -98,6 +118,8 @@ def parse_criteria_state(text: str) -> list[CriterionStateEntry]:
         start = m.end()
         end = headings[i + 1].start() if i + 1 < len(headings) else len(text)
         block = text[start:end]
+        covers_raw = _extract_field(block, "covers")
+        covers = [c.strip() for c in covers_raw.split(",") if c.strip()] if covers_raw else []
         entries.append(
             CriterionStateEntry(
                 criterion_id=criterion_id,
@@ -107,11 +129,77 @@ def parse_criteria_state(text: str) -> list[CriterionStateEntry]:
                 state=_extract_field(block, "state"),
                 proved_at_sha=_extract_field(block, "proved_at_sha"),
                 attempt=_extract_field(block, "attempt"),
+                carried_from_attempt=_extract_field(block, "carried_from_attempt"),
+                covers=covers,
+                invalidated_by=_extract_field(block, "invalidated_by"),
             )
         )
     return entries
 
 
+def resolve_carry_forward_narrow_greens(cfg: "dict | None") -> bool:
+    """Whether a re-armed close carries a `narrow`/`pass` entry's green
+    forward past the attempt cycle that proved it (FEAT-2026-0117/T01).
+
+    Reads `verification.yml` `defaults.carry_forward_narrow_greens` — default
+    True, same project-default precedence tier as `loop.py`'s other
+    `resolve_*` readers. *cfg* is the already-loaded `verification.yml` dict;
+    this module does no file I/O of its own.
+    """
+    if not cfg:
+        return True
+    return (cfg.get("defaults") or {}).get("carry_forward_narrow_greens", True) is not False
+
+
+def reset_stale_criteria_entries(
+    entries: list[CriterionStateEntry], current_attempt: int, carry_narrow: bool,
+) -> list[CriterionStateEntry]:
+    """Reset entries left behind by a superseded attempt cycle (#3279).
+
+    An entry whose recorded `attempt` exceeds *current_attempt* was measured
+    in a cycle a re-arm has since superseded. With *carry_narrow* true, an
+    entry that is also `kind: narrow` and `state: pass` is provably safe to
+    keep — its oracle's scope was knowable, so a re-arm does not invalidate
+    what it proved — and keeps every field, gaining `carried_from_attempt`
+    set to the attempt it was proved on. Every other stale entry resets to
+    `unverified` with its per-attempt fields cleared, exactly as if it had
+    never been verified. Entries at or below the current attempt, and
+    entries with no recorded attempt, are returned unchanged.
+    """
+    refreshed: list[CriterionStateEntry] = []
+    for entry in entries:
+        recorded = entry.attempt
+        try:
+            is_stale = recorded is not None and int(str(recorded).strip()) > current_attempt
+        except (TypeError, ValueError):
+            is_stale = False       # unparseable attempt: leave it for the close
+        if is_stale:
+            if carry_narrow and entry.kind == "narrow" and entry.state == "pass":
+                entry = CriterionStateEntry(
+                    criterion_id=entry.criterion_id,
+                    criterion=entry.criterion,
+                    oracle=entry.oracle,
+                    kind=entry.kind,
+                    state=entry.state,
+                    proved_at_sha=entry.proved_at_sha,
+                    attempt=entry.attempt,
+                    carried_from_attempt=str(recorded).strip(),
+                )
+            else:
+                entry = CriterionStateEntry(
+                    criterion_id=entry.criterion_id,
+                    criterion=entry.criterion,
+                    oracle=None,
+                    kind=None,
+                    state="unverified",
+                    proved_at_sha=None,
+                    attempt=None,
+                    carried_from_attempt=None,
+                )
+        refreshed.append(entry)
+    return refreshed
+
+
 @dataclass(frozen=True)
 class ReverificationWorklist:
     """Partition of a gate's recorded entries for a re-dispatched close attempt.
@@ -138,6 +226,11 @@ def build_reverification_worklist(
     fail` or `state: unverified`, and every `broad` entry regardless of
     state — goes to `reverify`. Fail-safe default: unclassifiable entries
     land in `reverify`, never in `carry_forward`.
+
+    `covers` plays no part in this partition — a `carried_from_attempt`
+    entry with an empty `covers` is kept out of `carry_forward` by
+    `loop.invalidate_carried_entries` resetting it to `unverified` before
+    this runs (FEAT-2026-0117/T02), not by a check here.
     """
     carry_forward: list[CriterionStateEntry] = []
     reverify: list[CriterionStateEntry] = []
@@ -191,5 +284,65 @@ def render_criteria_state(entries: list[CriterionStateEntry]) -> str:
             lines.append(f"- **proved_at_sha:** `{entry.proved_at_sha}`")
         if entry.attempt is not None:
             lines.append(f"- **attempt:** `{entry.attempt}`")
+        if entry.carried_from_attempt is not None:
+            lines.append(f"- **carried_from_attempt:** `{entry.carried_from_attempt}`")
+        if entry.covers:
+            lines.append(f"- **covers:** {', '.join(entry.covers)}")
+        if entry.invalidated_by is not None:
+            lines.append(f"- **invalidated_by:** {entry.invalidated_by}")
         blocks.append("\n".join(lines) + "\n")
     return "\n".join(blocks)
+
+
+_UNITTEST_ORACLE_RE = re.compile(r"-m\s+unittest\s+([\w.]+)")
+_MAVEN_DTEST_RE = re.compile(r"-Dtest=([A-Za-z_][A-Za-z0-9_]*)")
+
+
+def _unittest_module_path(oracle_command: str) -> "Optional[str]":
+    """`tests.foo_bar[.TestX.test_y]` -> `tests/foo_bar.py`, the file the
+    unittest oracle actually runs regardless of which class/method suffix it
+    names. Tries the longest dotted prefix that exists on disk first, so a
+    package (`tests/foo_bar/__init__` style) is not required; falls back to
+    the full dotted-to-slash mapping when nothing on disk matches yet."""
+    m = _UNITTEST_ORACLE_RE.search(oracle_command)
+    if not m:
+        return None
+    parts = m.group(1).split(".")
+    for i in range(len(parts), 0, -1):
+        candidate = "/".join(parts[:i]) + ".py"
+        if Path(candidate).is_file():
+            return candidate
+    return "/".join(parts) + ".py"
+
+
+def _maven_test_class_path(oracle_command: str) -> "Optional[str]":
+    """`-Dtest=FooBarTest` -> its `src/test/**/FooBarTest.java`, only when
+    one actually exists — unlike the unittest case, a Maven class name gives
+    no reliable package-to-path mapping without a filesystem lookup."""
+    m = _MAVEN_DTEST_RE.search(oracle_command)
+    if not m:
+        return None
+    root = Path("src/test")
+    if not root.is_dir():
+        return None
+    matches = sorted(root.rglob(f"{m.group(1)}.java"))
+    return str(matches[0]) if matches else None
+
+
+def derive_criterion_covers(wu, oracle_command: "Optional[str]") -> list:
+    """Paths a criterion's proof depends on (FEAT-2026-0117/T02): its
+    producing WU's `produces:` plus the test file its oracle command names,
+    when derivable. Feeds a seeded entry's `- **covers:**` line so a re-close
+    can tell whether a later diff touched what a carried green actually
+    measured — see `invalidate_carried_entries` in `loop.py`.
+
+    *wu* is anything with a `.produces` list (a `WorkUnit`, or a duck-typed
+    stand-in built from a WU read off disk); *oracle_command* is the entry's
+    recorded `oracle`, or `None` before a close has run it.
+    """
+    covers = list(getattr(wu, "produces", None) or [])
+    if oracle_command:
+        test_path = _unittest_module_path(oracle_command) or _maven_test_class_path(oracle_command)
+        if test_path and test_path not in covers:
+            covers.append(test_path)
+    return covers

specfuse_loop-0.26.0/specfuse/loop/data/VERSION

@@ -0,0 +1 @@
+0.26.0

{specfuse_loop-0.25.0 → specfuse_loop-0.26.0}/specfuse/loop/data/docs/methodology.md

@@ -127,6 +127,22 @@ it mostly does not need. Author-set unless marked driver-owned.
   `attempts`, `cost_usd`, `input_tokens`, `output_tokens`, `duration_seconds`,
   `cumulative_*`, `re_arm_count`, `re_arm_history`, `folded_through_re_arm`,
   `model`/`effort` as resolved, `gate_set`, `driver_version`, `started_at`.
+- `produces_dropped` — driver-owned. Written when a RESULT's `produces_amended:`
+  entries are accepted (`defaults.produces_amendable: true`): the paths dropped
+  from this unit's recorded `produces:` (`.specfuse/rules/result-contract.md`).
+- `covers` — driver-seeded, on a `GATE-NN-CRITERIA.md` entry, not WU frontmatter.
+  The path(s) that criterion's oracle actually exercises; absent when no path is
+  derivable, in which case the criterion is never carried forward.
+- `carried_from_attempt` — driver-owned, on a carried `GATE-NN-CRITERIA.md`
+  entry. The attempt number whose run proved the green being carried.
+- `invalidated_by` — driver-owned, on a `GATE-NN-CRITERIA.md` entry whose
+  carried green was invalidated. Names the path in `covers:` the gate diff
+  touched since `proved_at_sha`.
+
+`defaults.carry_forward_narrow_greens` (`verification.yml`, default `true`) —
+whether a re-close may carry forward a prior attempt's `narrow` green at all;
+see `.specfuse/verification.yml.example` and
+`.specfuse/rules/close-discipline.md` §5.
 
 ## 3. Work unit types
 
@@ -388,12 +404,19 @@ after v2+ revisions ship.
 Every dispatched attempt emits exactly one `attempt_outcome` event to
 `events.jsonl`. The payload carries a standardized set of fields:
 `outcome`, `failure_class`, `failure_signature`, `failure_excerpt`,
-`cost_usd`, `duration_seconds`, `attempt`, and `re_arm_count`. For
-the field-by-field schema see
+`failing_tests`, `cost_usd`, `duration_seconds`, `attempt`, and
+`re_arm_count`. For the field-by-field schema see
 `.specfuse/features/FEAT-2026-0016-attempt-outcome-rearm-contract/PLAN.md`
 § "Event payload shape — `attempt_outcome` v1". The full payload is
 not restated here (one fact, one home).
 
+`failing_tests` is the sorted, de-duplicated list of failing test ids
+`extract_failing_tests` recognised in the gate report (empty when no
+runner-recognised per-test id was found); for `failure_class: tests`,
+`detect_spinning_signature_repeat` treats two non-empty `failing_tests`
+sets as the same failure iff they are equal as sets, ahead of the
+`(failure_class, failure_signature)` comparison (FEAT-2026-0116).
+
 `outcome` taxonomy, as `loop.py` actually emits it — thirteen values,
 bound to the emitter by `tests/test_attempt_outcome_contract.py`:
 
@@ -468,6 +491,20 @@ actioned); `auto_archive_feature` appends it under the feature's archived
 detail section in `roadmap-archive.md`. `defaults.post_merge_issue: true` in
 `verification.yml` restores the issue.
 
+**A RESULT may amend the plan, never add to it (FEAT-2026-0114).** A session's
+`produces_amended:` entry claims a planned `produces:` path the solution did
+not need; `defaults.produces_amendable: true` in `verification.yml` lets the
+driver accept it, dropping the path into `produces_dropped` on the unit.
+Default `false` — an unrecognized amendment is judged as an unjustified
+unchanged deliverable (`.specfuse/rules/result-contract.md`).
+
+**A block may name its own fix (FEAT-2026-0115).** A `blocked` RESULT's
+`blocked_next:` names a drafted fix unit; once the arm checks clear, the
+driver inserts it ahead of the blocked unit and emits `fix_unit_inserted` to
+`events.jsonl` on re-arm. `defaults.fix_unit_insertion: true` in
+`verification.yml` gates the feature accepting one at all;
+`defaults.max_fix_units_per_unit: 2` caps insertions per blocked unit.
+
 **Closing sessions run on sonnet (#3425).** `close`, `close-intermediate`
 and `plan-next` default to `sonnet` at effort `high`, the same model as the
 judge that checks them (lower-only, about $0.46 per close). Opus was 56% of

{specfuse_loop-0.25.0 → specfuse_loop-0.26.0}/specfuse/loop/data/rules/close-discipline.md

@@ -222,6 +222,17 @@ green would be an unsound coverage claim; it re-runs on every close attempt.
 inferred by a reader, the same posture §2 already takes on the hedged-record
 `kind:`. `specfuse lint --closing` is the check.
 
+**A carried `narrow` green is invalidated when the criterion's covered paths
+changed since it was proved.** Each entry may carry a driver-seeded `covers:`
+— the path(s) its oracle actually exercises. On a re-close, a carried entry's
+`narrow` green is invalidated (re-measured, not trusted) when the gate diff
+since that entry's `proved_at_sha` touches a path in its `covers:`. A
+criterion with no derivable `covers:` is never carried — it re-measures on
+every close attempt, the same as a `broad` entry. A carried entry also
+carries `carried_from_attempt`, the attempt number whose run proved it. A
+re-close's `## Measurements` states how much of the gate's state was inherited
+versus fresh: `carried forward: N criteria, re-measured: M`.
+
 ## Split with project-local rules
 
 These are the generic obligations. The concrete grounding — which command is

specfuse_loop-0.26.0/specfuse/loop/data/rules/result-contract.md

@@ -0,0 +1,143 @@
+<!--
+Copyright 2026 Specfuse Contributors
+Licensed under the Apache License, Version 2.0. See LICENSE.
+-->
+
+# Rule: the RESULT block contract
+
+A dispatched work-unit session ends with one fenced `result` block as the last
+thing in its output; the driver reads it, and a session emitting none is a
+failed attempt. The RESULT is **advisory** — the driver re-runs verification
+itself, and that decides done.
+
+## Who reads it — emit it only when something does
+
+This block is a **machine interface**, not a report. Emit it only when a
+program is on the other end: a dispatched work-unit session (always), or a
+skill invoked **non-interactively** from a calling program parsing the
+outcome (`fix-bug` under `autofix_invoke`).
+
+Do **not** emit it on an interactive run — a human typing `/pick-feature` has
+no parser, and the block becomes a slab to scroll past, the verbosity
+[`human-output.md`](human-output.md) prevents. Report per that rule instead.
+Rule of thumb: a person-typed slash command is interactive; a `claude -p`
+dispatch is not.
+
+## The cycle: state intent, act, verify, report
+
+[`verification-discipline.md`](verification-discipline.md) is normative on the
+cycle; this file is normative on how the loop surface reports step 4.
+
+1. **State intent.** One sentence on what you are about to do and why it is the
+   next right step. If it disagrees with the work unit's acceptance criteria,
+   the unit is not what you thought it was.
+2. **Act.** Stay inside that scope. "While I was here I also fixed X" is drift;
+   the work unit's **Do not touch** section is binding.
+3. **Verify.** Re-read what you produced — Write/Edit reports the action taken,
+   not the property you wanted — and run the unit's own verification commands,
+   in declared order, with full output. On the loop that set is the
+   **per-attempt (narrow) tier**: the unit type's gates minus any declaring
+   `tier: broad`, with `tests` through its `narrow_command` over the unit's
+   `produces:` test modules. The full suite, coverage and every `tier: broad`
+   gate are the driver's, once per gate — running them in-session buys
+   nothing. "I assume the tests still pass" is not verification. A
+   behavioural claim needs a run, not a source reading; a rule-or-severity
+   claim needs a **negative observation** — the rule seen rejecting a
+   purpose-built bad input.
+4. **Report.** Report only what verification confirmed.
+
+A failing check leaves you in one of three situations: correctable locally
+(fix the cause, re-run the **whole narrow tier** from the top), spinning
+(three fresh attempts is the driver's budget — emit `status: blocked` with
+evidence rather than guessing), or fundamentally blocked (spec ambiguity,
+generated code that must change, a missing dependency — emit `status: blocked`
+naming the boundary).
+
+## Format
+
+````markdown
+```result
+status: complete | blocked        # complete = "I believe acceptance criteria are met"
+summary: <one sentence on what changed>
+forward_note: <optional — one sentence on what the NEXT unit should know>
+files_changed:
+  - path/to/file
+acceptance_criteria:
+  - text: <criterion, copied from the work unit>
+    met: true | false
+    evidence: <how you know — a test name, a behavior, a line reference>
+blocked_reason: <present only when status is blocked>
+blocked_next:                      # optional — a drafted fix unit
+  kind: fix_unit
+  file: <path to the drafted WU>
+  id: <the drafted WU's id>
+produces_unchanged:                # optional — obligation 1 below
+  - path: <a produces: entry, verbatim>
+    justification: <the command you ran and its output showing the deliverable already holds>
+produces_amended:                 # optional — obligation 1 below
+  - path: <a produces: entry, verbatim>
+    justification: <why the plan named it but the solution didn't need it>
+```
+````
+
+`summary` is backward-looking by this contract's own definition — one sentence
+on what changed. `forward_note` is the other half: what surprised you, or what
+the next unit should know, that `summary` misses. Optional, never required by
+any guard — omit it and the driver's `PROGRESS.md` entry is unchanged
+(FEAT-2026-0106/T02).
+
+## Rules
+
+1. **No git.** Edit files only. The driver stages, squashes, and commits one
+   trailer-carrying commit per unit.
+2. **Verify before reporting.** Do not report success you have not checked.
+3. **Blocked is a valid, respectable outcome.** A precise `blocked_reason`
+   after one honest attempt beats three attempts chasing a `complete`
+   verification keeps rejecting.
+4. **Stop at a boundary rather than working around it.** Generated
+   directories, secrets, and `.git/` internals are off-limits
+   ([`never-touch.md`](never-touch.md),
+   [`security-boundaries.md`](security-boundaries.md)); weakening a failing
+   gate to pass is the same failure class. Silence at a boundary is not
+   permission.
+5. **No secret-looking values in evidence.** The driver reads and may archive
+   this block.
+6. **Never mint or rewrite a correlation ID to make it fit.** A well-formed
+   ID disagreeing across surfaces is `blocked`, not a rename
+   ([`correlation-ids.md`](correlation-ids.md)).
+7. **A "pre-existing" failure claim cites the commit it was measured on.**
+   Calling a failure pre-existing is a claim about a *different* commit,
+   typically the merge-base, that nothing on your own branch establishes.
+   Name the command and commit, give the numbers from both sides, and emit
+   `status: blocked` rather than asserting an unmeasured baseline: a mass of
+   errors sharing one signature (network refused, unresolvable build
+   dependencies) reports where the suite ran, not the repository (#2075).
+8. **A block may name its own fix.** `blocked_next:` points at a drafted work
+   unit — `provenance: agent`, `status: draft`, the five WU sections filled —
+   the driver inserts ahead of this one and re-arms it, when the feature runs
+   `auto` and the draft passes the arm checks; no `blocked_next` escalates
+   unchanged.
+
+## Closing obligations for implementation WUs (FEAT-2026-0049)
+
+1. **Diff against `produces:` first.** Every path in the WU's `produces:` list
+   must show a working-tree change, or the RESULT must justify each unchanged
+   path under `produces_unchanged:` (deliverable already held) or
+   `produces_amended:` (the plan named a path the solution didn't need — drop
+   only, never add) — spelled as `produces:` spells it, plus the proving
+   command and output. The driver reads that list: a justified entry passes
+   and is recorded as `produces_justified`; an unjustified one, or a blank
+   justification, is refused (#198, #3268, outcome `produces_not_in_diff`).
+   Silence on an unchanged deliverable is not valid.
+2. **A plan-level contradiction is `blocked`, not `complete`.** Put the
+   finding in `blocked_reason`; never bury it in a gate document and close
+   `complete`.
+3. **Every `evidence:` cites an executed command** and its observed exit
+   code/output. Reading source or citing another WU's RESULT is not
+   verification.
+4. **Analysis without edits is not a silent attempt.** Say so; end `blocked`
+   rather than spend the attempt on prose.
+
+The driver's whole cycle — re-verify, commit, advance the dependency
+frontier, dispatch next — runs on this block being an honest claim. State
+intent. Act. Verify. Report. Every time.

{specfuse_loop-0.25.0 → specfuse_loop-0.26.0}/specfuse/loop/data/schemas/driver-event.schema.json

@@ -3,7 +3,7 @@
   "$id": "https://specfuse.dev/loop/schemas/driver-event.schema.json",
   "title": "Driver-local envelope registry",
   "description": "Additive to the vendored orchestrator envelope (event.schema.json): shapes the loop driver emits with no orchestrator-side counterpart. validate_event.py resolves each shape against the vendored envelope first; only when absent there does it fall through to this registry. `event_types` (FEAT-2026-0060) widens the event_type enum; task_started, task_completed, and human_escalation are already sanctioned in the vendored enum and must not be duplicated here. `correlation_id` (FEAT-2026-0073) widens the correlation_id pattern to admit the closing-sequence and hygiene shapes `.specfuse/rules/correlation-ids.md` documents; `closing_names` and `hygiene_suffix_pattern` here must state the same set of shapes as that rules file's combined pattern (and as specfuse/loop/lint_plan.py's CORRELATION_ID_RE, which independently enforces the same contract on PLAN.md graphs).",
-  "$comment": "FEAT-2026-0060/T01: event_types derived from the union of every build_event(...) call site in specfuse/loop/loop.py and a corpus sweep of every .specfuse/features/*/events.jsonl, subtracting the vendored envelope enum. attempt_outcome and gate_reached were already-known precedent (loop.py's build_arm_predicate_event docstring); auto_close_decision, arm_predicate_evaluated, re_arm_dispatched, plan_next_draft_lint, and unsandboxed_dispatch are additional driver-local mechanics the orchestrator has no concept of. gate_auto_armed (loop.py build_event call under gate_events.append) and re_arm_rejected (loop.py build_event call under the spinning_reproduction_missing re-arm check) are emitted by real code paths that have never fired in a recorded run, so a corpus-only sweep cannot see them; they are included because call-site derivation does. FEAT-2026-0073/T01: correlation_id added — closing_names and hygiene_suffix_pattern mirror correlation-ids.md's documented shapes and lint_plan.py's CORRELATION_ID_RE verbatim, so the envelope, the rules file, and the PLAN-graph linter state one contract. FEAT-2026-0075/T03: driver_staleness_detected added — emitted at gate completion when a work unit's squash diff touched the driver's own importable surface, naming the editing unit, the driver paths it touched, and the IDs of units this process dispatched afterward (which ran the pre-edit module). FEAT-2026-0100/T02: judged added — emitted once per terminal close after the closing-deliverable guards, carrying the close's own verdict, the judge session's verdict (null when the judge was disabled, timed out, or returned nothing parseable, with the reason beside it), and whether the judge lowered it. FEAT-2026-0109/T01: baseline_attribution added — emitted when the retroactive per-attempt-failure baseline probe (attribute_failure_to_baseline) runs fresh, carrying the gate, the failing-gate set, and the unit whose failed attempt triggered the probe. FEAT-2026-0109/T06: broad_run_result added — emitted whenever the once-per-gate broad verification pass (gate_broad_run_check) actually runs (never on a tree-unchanged dedup skip), carrying the gate, the tree it was measured on, and its pass/fail outcome; a failing broad run additionally raises the existing human_escalation event type with reason: broad_run_gate_failure, which needs no schema addition since human_escalation is already sanctioned in the vendored envelope enum. FEAT-2026-0109/T08: driver_build_pinned added — emitted once per process, before any work unit is dispatched, when this process is itself a materialized pin (`_reexec_pinned`); carries the pin's tree hash and its path so an operator or test can read what build actually ran without inferring it from `ps` output. `driver_staleness_detected` needed no addition here: this unit reuses it with `halted: false` for the pinned, non-halting case (the registry constrains the type list, not the payload), adding `pinned_tree` / `next_pin_tree` fields alongside the existing `halted: true` shape. FEAT-2026-0104/T04: replan added — emitted once a re-plan turn (T03's run_replan_turn) rewrites a unit's body ahead of its last permitted attempt, so gate_eval.py's evaluate_auto_close (check 2, already reading this event_type since FEAT-2026-0018/T02) can disable auto-close for a gate that needed one.",
+  "$comment": "FEAT-2026-0060/T01: event_types derived from the union of every build_event(...) call site in specfuse/loop/loop.py and a corpus sweep of every .specfuse/features/*/events.jsonl, subtracting the vendored envelope enum. attempt_outcome and gate_reached were already-known precedent (loop.py's build_arm_predicate_event docstring); auto_close_decision, arm_predicate_evaluated, re_arm_dispatched, plan_next_draft_lint, and unsandboxed_dispatch are additional driver-local mechanics the orchestrator has no concept of. gate_auto_armed (loop.py build_event call under gate_events.append) and re_arm_rejected (loop.py build_event call under the spinning_reproduction_missing re-arm check) are emitted by real code paths that have never fired in a recorded run, so a corpus-only sweep cannot see them; they are included because call-site derivation does. FEAT-2026-0073/T01: correlation_id added — closing_names and hygiene_suffix_pattern mirror correlation-ids.md's documented shapes and lint_plan.py's CORRELATION_ID_RE verbatim, so the envelope, the rules file, and the PLAN-graph linter state one contract. FEAT-2026-0075/T03: driver_staleness_detected added — emitted at gate completion when a work unit's squash diff touched the driver's own importable surface, naming the editing unit, the driver paths it touched, and the IDs of units this process dispatched afterward (which ran the pre-edit module). FEAT-2026-0100/T02: judged added — emitted once per terminal close after the closing-deliverable guards, carrying the close's own verdict, the judge session's verdict (null when the judge was disabled, timed out, or returned nothing parseable, with the reason beside it), and whether the judge lowered it. FEAT-2026-0109/T01: baseline_attribution added — emitted when the retroactive per-attempt-failure baseline probe (attribute_failure_to_baseline) runs fresh, carrying the gate, the failing-gate set, and the unit whose failed attempt triggered the probe. FEAT-2026-0109/T06: broad_run_result added — emitted whenever the once-per-gate broad verification pass (gate_broad_run_check) actually runs (never on a tree-unchanged dedup skip), carrying the gate, the tree it was measured on, and its pass/fail outcome; a failing broad run additionally raises the existing human_escalation event type with reason: broad_run_gate_failure, which needs no schema addition since human_escalation is already sanctioned in the vendored envelope enum. FEAT-2026-0109/T08: driver_build_pinned added — emitted once per process, before any work unit is dispatched, when this process is itself a materialized pin (`_reexec_pinned`); carries the pin's tree hash and its path so an operator or test can read what build actually ran without inferring it from `ps` output. `driver_staleness_detected` needed no addition here: this unit reuses it with `halted: false` for the pinned, non-halting case (the registry constrains the type list, not the payload), adding `pinned_tree` / `next_pin_tree` fields alongside the existing `halted: true` shape. FEAT-2026-0104/T04: replan added — emitted once a re-plan turn (T03's run_replan_turn) rewrites a unit's body ahead of its last permitted attempt, so gate_eval.py's evaluate_auto_close (check 2, already reading this event_type since FEAT-2026-0018/T02) can disable auto-close for a gate that needed one. FEAT-2026-0115/T01: fix_unit_inserted added — emitted once a blocked RESULT's `blocked_next:` names a drafted fix unit that `insert_fix_unit` validated and inserted ahead of the blocked unit, carrying the fix unit's id, its file, the gate, and the insertion count; the blocked unit's own re-arm (an existing `re_arm_dispatched`, reason `fix_unit_inserted`) rides alongside it, so this is the only genuinely new event_type the mechanic needs.",
   "event_types": [
     "attempt_outcome",
     "gate_reached",
@@ -20,7 +20,8 @@
     "baseline_attribution",
     "broad_run_result",
     "driver_build_pinned",
-    "replan"
+    "replan",
+    "fix_unit_inserted"
   ],
   "correlation_id": {
     "closing_names": [

{specfuse_loop-0.25.0 → specfuse_loop-0.26.0}/specfuse/loop/data/verification.yml.example

@@ -129,11 +129,35 @@
 #                               # Defaults to false (#3424): the checklist is
 #                               # appended under the feature's archived detail
 #                               # section in roadmap-archive.md instead.
+#   produces_amendable: false  # whether the driver accepts a RESULT's
+#                               # `produces_amended:` entries, dropping those
+#                               # paths from the unit's recorded `produces:`.
+#                               # Defaults to false: an amendment claim is
+#                               # ignored and the path is judged as an
+#                               # unjustified unchanged deliverable instead
+#                               # (FEAT-2026-0114).
+#   fix_unit_insertion: true   # whether a blocked RESULT's `blocked_next:`
+#                               # may insert its drafted fix unit instead of
+#                               # escalating. Defaults to true (FEAT-2026-0115).
+#   max_fix_units_per_unit: 2  # cap on `fix_unit_inserted` insertions per
+#                               # blocked unit before it escalates instead
+#                               # (FEAT-2026-0115). Defaults to 2.
+#   carry_forward_narrow_greens: true  # whether a re-close may carry forward a
+#                               # prior attempt's `narrow` GATE-NN-CRITERIA.md
+#                               # green instead of re-measuring it. Defaults to
+#                               # true. A carried green still invalidates when
+#                               # the gate diff since its `proved_at_sha`
+#                               # touches a path in its `covers:` — see
+#                               # `.specfuse/rules/close-discipline.md` §5.
 # defaults:
 #   max_attempts: 3
 #   retain_on_guard_refusal: true
 #   dispatch_skills: false
 #   post_merge_issue: false
+#   produces_amendable: false
+#   fix_unit_insertion: true
+#   max_fix_units_per_unit: 2
+#   carry_forward_narrow_greens: true
 #
 # The re-plan-after-two-failures behaviour (FEAT-2026-0104) reads this same
 # `max_attempts` resolution and adds no config key of its own — a unit's

{specfuse_loop-0.25.0 → specfuse_loop-0.26.0}/specfuse/loop/gate_eval.py

@@ -203,6 +203,19 @@ def _apply_predicate(
             sub_id = wu_id.split("/")[-1] if "/" in wu_id else wu_id
             reasons.append(f"replan_event: {sub_id}")
 
+    # --- Check 2b: No fix_unit_inserted events (FEAT-2026-0115/T03) ---
+    seen_fix_unit_inserted: set[str] = set()
+    fix_unit_inserted_events: list[str] = []
+    for ev in events:
+        if ev.get("event_type") == "fix_unit_inserted":
+            wu_id = ev.get("correlation_id", "unknown")
+            if wu_id in seen_fix_unit_inserted:
+                continue
+            seen_fix_unit_inserted.add(wu_id)
+            fix_unit_inserted_events.append(wu_id)
+            sub_id = wu_id.split("/")[-1] if "/" in wu_id else wu_id
+            reasons.append(f"fix_unit_inserted: {sub_id}")
+
     # --- Checks 3 & 4: Per-WU cost ratios (skip close/close-intermediate and plan-next) ---
     for wm in wu_metrics_list:
         wu_type = wm["type"]
@@ -279,6 +292,8 @@ def _apply_predicate(
         "plan_next_planned": plan_next_planned,
         "blocked_human_events": blocked_human_events,
         "replan_events": replan_events,
+        "fix_unit_inserted_events": fix_unit_inserted_events,
+        "fix_unit_inserted_count": len(fix_unit_inserted_events),
         "final_outcomes": final_outcomes,
         "warnings": warnings,
     }
@@ -388,6 +403,8 @@ def _evaluate_predicate_core(
                 "plan_next_planned": None,
                 "blocked_human_events": [],
                 "replan_events": [],
+                "fix_unit_inserted_events": [],
+                "fix_unit_inserted_count": 0,
                 "final_outcomes": {},
                 "warnings": pre_warnings,
             },