Issue 224 Managed Lint Delivery Plan
Issue 224 Managed Lint Delivery Plan
Status: In progress — local T7/final A4 accepted; delivery/provider closeout pending
Current frontier: published CI repair
The first published head 7055f06c8a97dca2103b4563c31d8d7fc5bc84bb exposed new required-CI evidence: the source suite failed 58 of 893 tests across 10 files (/tmp/issue224-ci-source-clean.log). The initial built observations included two Project Verifier preservation failures; the complete built RED later recorded four failures and 66 passes. Root returned PR225 to draft. The final frozen repair now passes the local cumulative gates below, closing local T7/final A4 acceptance. Delivery/provider closeout remains pending: PR225 still publishes 7055f06c as a draft; no fourth commit, second push or green remote-check result is claimed.
The five disjoint test repair owners below are complete and frozen. Their historical allocation is retained; it is not an active permission to resume edits. Parent alone owns shared build outputs, cumulative gates and publication. The separately scoped helper and catalog repairs follow this table.
| Focused owner | Exclusive test paths |
|---|---|
| T7-ci-policy | apps/cli/src/cli/portfolio-policy.test.ts |
| T7-ci-scaffold | apps/cli/src/scaffold/output.test.ts, apps/cli/src/scaffold/settings-selection.test.ts, apps/cli/src/scaffold/output-root-dependencies.test.ts |
| T7-ci-platform | apps/cli/src/platform/scoped-scaffold-operation.test.ts, apps/cli/src/scaffold/generated-gate-scoping.test.ts |
| T7-ci-consumers | apps/cli/src/cli/portfolio-catalog.test.ts, apps/cli/src/cli/portfolio-preview.test.ts, apps/cli/src/scaffold/output-wiki-plugin-alias.test.ts, apps/cli/src/update/wiki-alignment-owner.test.ts |
| T7-ci-built | apps/cli/src/cli/behavioral-portfolio.test.ts, apps/cli/src/cli/safety-invariants.test.ts, apps/cli/src/cli/scaffold-subagent-alignment.test.ts, apps/cli/src/scaffold/project-verifier-preservation.test.ts, apps/cli/src/scripts/release-publication.test.ts, scripts/behavior-contract/issue-215-update-benchmark.mjs |
Frozen test-owner evidence: policy 50/50, scaffold 39/39, platform 6/6 and consumers 8/8 pass; handoffs are /tmp/issue224-ci-{policy,scaffold,platform,consumers,built}-handoff.md. The built repair changes three fixture files within its allocated scope; the other allocated tests remain unchanged. Pre-catalog full built 70/70 (/tmp/issue224-ci-built-green.log) and update 71/71 (/tmp/issue224-ci-update.log) remain historical observations superseded for current acceptance by the final runs below. Release 61/61 (/tmp/issue224-ci-release.log) remains applicable because its release inputs are unchanged. Earlier narrow runtime, installed-package and real-consumer proofs retain their exact-input limits.
Bounded T7 CI follow-ups and dependencies
These are planning-only follow-ups within existing CLI ownership. Test authors may work on disjoint files, but evidence consuming a helper or production input waits for that input's frozen handoff.
| Task / status | Exclusive write scope and behavior | Dependencies / evidence |
|---|---|---|
| T7-ci-helper — complete/frozen | apps/cli/test-fixtures/portfolio/application.ts: load saved settings through the canonical ProjectSettings service, retaining lint; preserve relative links with verbatimSymlinks: true on both cached fixture copies. | Consumes the existing settings-service contract. Supersedes the legacy loader attempt that dropped lint. Ordered public pair RED 1/2 to GREEN 2/2; /tmp/issue224-ci-policy-helper-handoff.md. The policy owner's final 50-case result follows this freeze. |
| T7-ci-catalog — complete/frozen, locally accepted | apps/cli/src/scaffold/output.ts and new apps/cli/src/scaffold/managed-lint-catalog-retirement.test.ts, owned by the separate runtime source worker. Retain an unchanged exact receipt-owned root Oxlint catalog value while effective future references remain, independently of lint enrollment. Do not upgrade unselected consumers or adopt authored/edited catalog values; retire safely after the last future consumer disappears. | Public fixture proof consumes T7-ci-helper; the combined focused command consumes frozen T7-ci-scaffold root-dependency tests. /tmp/issue224-ci-catalog-progress.md and final /tmp/issue224-ci-catalog-handoff.md: public RED, final 11 new cases plus 2 root-dependency cases pass; scoped lint, CLI types and format pass. Final cumulative proof below closes local acceptance. The temporary upgrade refinement was rejected/reverted and is not final evidence. |
| T7-ci-cumulative — complete locally, parent-owned | Existing T7 build/package custody, cumulative command execution and evidence accounting; no additional source scope is granted here. | All five test owners and helper/catalog inputs frozen. Final source904/update71/built70/operators119, unchanged-input release61, build/integration5/installed package/types, root static and repaired-file lint/format pass. Both final consumer reports bind the final CLI hash; all1,328 tracked input hashes remain unchanged. Provider closeout remains a separate pending delivery gate. |
The catalog regression was a production defect: selected-owner-only planning retired a managed root catalog leaf still referenced by an unselected package. Its repaired retention projection considers effective future manifests/declarations and receipt-authorized dependency retirement; lint selection remains unchanged. Parent accepted the frozen runtime repair through the final local evidence below. Local T7/final A4 acceptance is closed without changing requirements or granting new publication authority.
Final local acceptance evidence
| Gate | Validated result | Evidence |
|---|---|---|
| Full source | 904/904 tests, 57/57 files | /tmp/issue224-ci-final-source.log |
| Full update / built | 71/71 tests, 1 file; 70/70 tests, 5 files | /tmp/issue224-ci-final-update.log, /tmp/issue224-ci-final-built.log |
| Release / operators | 61/61 tests, 10 files, unchanged release inputs; 119/119 tests, 7 files | /tmp/issue224-ci-release.log, /tmp/issue224-ci-final-operators.log |
| Build / generated integration / installed package / types | All four gates pass; generated integration 5/5 tests across 2 files | /tmp/issue224-ci-final-gate-exits.json |
| Root static / repaired-file checks | Root static passes on exact tracked diff; explicit-config lint and format pass | /tmp/issue224-ci-final-static-worktree-result.json, /tmp/issue224-ci-final-scoped.json |
| Input identity / focused reviews | 1,328 tracked input hashes unchanged; both parent focused reviews have no findings in their scopes | /tmp/issue224-ci-final-inputs.json, /tmp/issue224-ci-test-review.md, /tmp/issue224-ci-runtime-review.md |
Final CLI SHA256: a8ff8cd55397b707a3423b1df1b2a0226e35a8289401937385655be0d47fea4d; installed archive SHA256: d4f6d19133bbaf8c593a37ec752825599265a47f8e62bc63e3165c47b34ba13e. Final consumer reports under .devpunks/delivery/issue224/consumer-repos/{ci-app-evidence,devpunks-intelligence-evidence}/ci-final-verification.json both bind that CLI. C1 passes all28 expected cases with159 critical files unchanged after explicit built-CLI refresh logs/130-ci-final-scaffold.json; failed global-hi attempt120 is retained and superseded, not passing evidence. C2 applies241 files, reports identical root/owner231 findings and matching candidate231/sample, matches the single-file hook, keeps exclusions clean, and restores all5,580 hashes. These are local witnesses, not remote CI results.
Final scoped docs validation passes: bun run --cwd apps/wiki check:content reports current content; bun run --cwd apps/wiki test:ci passes16/16 tests across4 files (public routes6, public wiki contract3, sync-content6, source-page-tree1). Logs: /tmp/issue224-ci-docs-final-content.log and /tmp/issue224-ci-docs-final-contracts.log. Both owned files pass git diff --check; all8 task JSON records parse and all3 relative links resolve. Accepted task contracts and historical AC/review evidence are preserved.
Q1–Q24, all accepted ACs, SPEC and architecture remain unchanged. The original retained full-review ordinal remains1 and repair_count remains1; the two parent focused reviews introduce no new full-review ordinal. The initial three-commit/one-push exception is consumed. On 2026-09-23 the user explicitly authorized exactly one additional hook-bypassed commit and one push for this frozen repair. Publication and provider readback remain pending; no broader gate exception or further publication authority is granted.
The current frontier supersedes earlier local-pending states and completion/publication claims in historical task logs and conformance entries below. Their evidence and input limits are retained; local acceptance does not close delivery/provider publication.
Execution authority and state
architecture_applicability: architecture-bearing: settings, generated policy, multiple runtime adapters and adoption cumulatively change one capability.- Authority: SPEC, approved Q1–Q24 grill and explicit full-delivery instruction. Planning grill frontier is empty; all decisions are locked.
task_identity_mode: planning-only;relation_mode: unprojected.backlog_sync_skip_reason: stable remote spec retention/provider projection is pending known publication-hook failures. The user authorized full implementation; the parent directs reversible implementation before the final publication gate. This is an explicit workflow deviation, not provider readback or remote retention. Tn are local execution identities only. Root owns later retention/projection.- Preserve PR225's child branch
team/stefan/issue-224-lint-boundariesover PR223'steam/stefan/issue-217-ci-costatfeb46e4e91cb31fb51ef7a40fb692a90e195a538. - Stack lifecycle update: #223 merged at
71e84184be2e0eff48cffae43face01df5d300aband its branch deletion automatically closed #225. Closeout retargets/reopens #225 ontomaincontaining the merged parent. Parent and merged-main trees are identical; rebase only after active writers finish. - No gate bypass, merge, release publication or consumer mutation is inferred.
- Root owns plan review, implementation task release, cumulative validation, release classification and publication. This authoring task writes PLAN only.
Grounding and resolved ledger
Existing project-settings/{model,service}.ts and scaffold/settings-selection.ts
carry saved intent. General repository-detector.ts discovery remains available
for non-lint consumers. context-planning/compiler.ts separates broad guidance
pack selection from lint-only asset applicability. scaffold/output.ts currently
materializes lint across manifests, and content/wiki.ts is an independent wiki
lint producer; both must agree with selected scope authority.
Existing .devpunks/selection.json is derived explanatory state with root/workspace
config facts. Extend it with derived routes; do not add a hand-maintained registry.
features/commit-gate/quality.ts, packaged runner, edited-file hook, and
runtime/scripts.ts are distinct consumers of the same route. Local binary
selection already exists in runtime validation, but bare config discovery splits
policy. Physical temporary edited-file inputs must preserve logical source paths.
Evidence: both issue224 research reports, SPEC Context/Technical Decisions and the parent's bounded source inspection. The retained Oxlint 1.80.0 consumer witness is prior-defect evidence. No framework API upgrade is planned. Before relying on Oxlint JSONC/extends/plugin/typed or stdin semantics, T3/T5 must consult current installed 1.80.0 CLI/help/source and official https://oxc.rs/docs/guide/usage/linter/config and preserve a real process witness. Never substitute assumed stdin flags. Parallel research was considered; reuse the existing independent research instead of repeating it. Exact implementation symbols may change behind the frozen seam; new public behavior or ownership must amend this plan before consumers proceed.
Target Ownership Topology
CLI project-settings + existing lifecycle composition
saved selection (intent)
-> compiler + scaffold output
local framework evidence + project-owned policy
-> effective config + existing selection.json derived routes
-> portable managed-lint module (data/scripts)
-> generated package/root commands
-> commit-gate runner
-> edited-file adapter
-> update validation / repository healthSettings owns selection and validation, not inferred framework copies. The policy module owns preserved configuration meaning. The compiler owns derivation. The portable route module owns eligibility and command construction, not writes or process execution. Adapters own process/file-safety mechanics. Update owns coherent activation, receipts and proof; check owns truthful read-only inspection.
Declared Dependency Graph
T1 settings ─────────────────┐
T2 route seam -> T3 policy ───┤
└───────> T5 adapters ─┴-> T4 generation -> T6 adoption
├-> T7 proof
└-> T8 guidance/docsAll dependency edges point from consumers to settled public inputs. Runtime code must not import CLI orchestration; general discovery must not depend on lint selection. T5 can start after T2 because the route artifact contract is frozen by T2 and tests construct representative derived route inputs; it cannot claim full producer parity until T4 and T6/T7 validate the generated outputs together.
Public Seam Contract
| Seam | Owner | Allowed consumers and invariants |
|---|---|---|
| Saved lint settings | T1 | Existing lifecycle/settings APIs; distinguish missing, empty, invalid; preserve unrelated fields |
| Derived lint route contract in selection.json | T2, produced T4 | Root/package commands, gate, edit hook, preview/check; version/validate the same schema |
| Portable managed-lint resolve/command API | T2 | All managed adapters; input logical repository source separately from physical temp bytes; output eligibility/owner/config/cwd/local tool/threshold/argv/diagnostic or actionable conflict |
| Shared path exclusions | T2 | Portable pure predicate reused by JS routing and the existing Python hook adapter; hard wiki and saved exclusions do not require a fabricated JS scope. Build paths are excluded only when project policy says so. Non-JS nearest-project behavior stays in its existing hook adapter. |
| Project policy composition result | T3 | T4/T6; effective policy inputs, transitive dependencies, preservation diagnostics and conflicts; filesystem reading through supplied repository context |
| Generated commands/config/materialization | T4 | Consumers use explicit scope config and local tool, root dispatch only; install portable runtime independently of commitGate enablement |
| Runtime check/fix adapters | T5 | Existing gate and edit-hook entrypoints share process-result classification/execution; preserve read-only precommit, controlled fix safety, empty-work semantics and native feedback |
| Adoption/check result | T6 | Existing CLI presenters/results; findings separate from operational failure and authority conflict |
The policy compiler distinguishes full inventory inputs from active compiled policyInputs; comparison-only and manifest reads remain in dependency identity without becoming effective-policy snapshot authority.
Compiled project policy is a snapshot of project-owned inputs. Its derived route must carry exact SHA-256 policy input identities; the resolver checks them before execution and reports a stale-policy conflict until normal reconciliation recompiles changed inputs. General dependency paths still drive affected-owner selection. This prevents a shared policy edit from silently running an older inlined policy.
Runtime distribution uses the existing neutral .agents/scripts/ surface: managed-lint.mjs and managed-lint-runner.mjs are emitted there independently of Commit Gate enablement. The gate imports its sibling resolver; projected hooks resolve the neutral repository path so every provider mirror shares it.
T2 establishes names/types and a fixture-consumable contract before T3/T5 proceed. Missing/invalid current selection cannot fall back to recursive success. Runtime proof must use actual selection and current settings, or report stale authority.
Recovery ownership amendment
Readonly plan review: no bounded blockers; verified authority origins, old-journal compatibility, T4→T6 ordering, disjoint custody and focused RED/guard coverage. T4 is released before T6; A3 remains pending.
Public interruption-before-receipt evidence (/tmp/issue224-t6-stage3-recovery-blocker.md) reopens T4 then T6 under AC028–033/RAC-5. The accepted ownership topology and T4→T6 dependency stay unchanged. T4 first adds an optional typed effective ownership receipt input to its existing generation/materialization seam; ordinary callers still read the live receipt. It rechecks exact current file hashes, script values and the selection receipt. T6 then records planned managed-file hashes in the pending publication journal before file mutation, verifies the journal identity plus confined exact file/structured readback, and passes the recovered in-memory receipt through both planning/materialization call paths. No early live receipt publication or authority inferred from filenames/current bytes is permitted.
The journal keeps backward compatibility with existing version1 records using an optional managed-file field; absent evidence stays conservative. Use the existing planned managed-file set and hash semantics, excluding receipt/project-owned paths as already defined by that set. Modified, missing, escaping or identity-mismatched entries gain no recovered ownership. Pending output is not source-cleanliness proof.
Repair sequence: T4 optional seam/public exact-receipt tests → frozen T4 gate → T6 journal/caller/recovery tests → A3 cumulative gate. Only one worker is eligible at each step because T6 consumes T4. Owned paths remain T4 scaffold/output.ts + managed-lint-generation files/tests and T6 update/run.ts + run.test.ts. Existing TDD/codebase-design/quality-types/Effect/simplify guidance applies unchanged. RED is the retained actual interruption-before-receipt retry; focused guards cover changed config/script/selection, old journal without hashes, wrong identity and read-only planning/check. Final coupled lifecycle and strict zero-write/recovery cases remain required before A3.
Responsibility Acceptance Criteria
| criterion_id | owner | Observable assertion / evidence | due_architecture_wave | tasks |
|---|---|---|---|---|
| RAC-1 | Settings | Save/read empty vs missing scopes; invalid roots rejected; unrelated settings preserved in T1 tests | A1 | T1 |
| RAC-2 | Portable route module | One eligible owner and explicit command; wiki/fixture exclusion shared by logical paths; T2 public API tests | A1 | T2 |
| RAC-3 | Policy/compiler | Inherited rules and local framework assets reach real generated config; no guidance-pack leakage; T3/T4 tests | A2 | T3,T4 |
| RAC-4 | Runtime adapters | Same effective route, per-kind staged ownership and safe temporary-file semantics; T5 subprocess tests | A2 | T5 |
| RAC-5 | Adoption/check | Faults block dependent activation; receipts/retirement/cache identity remain truthful; T6 integration tests | A3 | T6 |
| RAC-6 | End-to-end proof | Actual generated entrypoints agree and repeat update converges; T7 runtime matrix | A4 | T7 |
| RAC-7 | Operator knowledge | Canonical hi-cli source/sync receipt and implemented docs match verified public behavior; T8 inspection | A4 | T8 |
Each checkpoint rechecks every criterion due so far, inspecting actual imports, owners, schema consumers and migration entries. Only consumers of unproved responsibilities wait; unrelated disjoint work remains eligible.
Architecture Waves
| architecture_wave | Topology delta / entry dependencies | Criteria due | Temporary seams / checkpoint |
|---|---|---|---|
| A1 | T1 saved intent and T2 route seam established from approved spec | RAC-1,RAC-2 | No production adoption yet; root accepts public contract |
| A2 | T3/T4 compose and publish; T5 migrates runtime consumers | RAC-3,RAC-4 | M1/M2 allowed until A3; verify real generated route compatibility |
| A3 | T6 reconciles lifecycle, cache, receipts and health | RAC-5 | Remove M1/M2; adoption must be coherent |
| A4 | T7 public runtime proof and T8 operator knowledge | RAC-6,RAC-7 | Zero migration entries and all prior RAC evidence passing |
Migration Ledger
| id | introducing task | Reason / allowed consumers | removal task | expiry wave | Removal proof |
|---|---|---|---|---|---|
| M1 (removed) | T4 | Existing legacy config/readback retained as policy input while adoption staged; only migration inventory/preview may consume legacy execution targets | T6 | A3 | No managed live route selects old target; modified/unowned policy preserved; second update converges |
| M2 (removed) | T2 | Derived route schema exists before all producers and runtime consumers migrate; no successful adoption claim during transition | T6 | A3 | Generated commands, gate, edit hook, preview/check consume one route authority; missing/invalid states fail truthfully |
Active migration ledger: empty. M1 and M2 above are removed history. A3 removal proof is /tmp/issue224-t6-a3-final-handoff.md and its340-case inventory closure: exact ownership/preservation/repeat and shared-route recovery checks pass. Local A4 is accepted through final T7 proof and retained T8 evidence; delivery/provider closeout remains pending.
Execution Frontier and common task gates
Earliest frontiers: W1 = T1,T2; W2 = T3,T5 after T2; W3 = T4 after T1,T3,T5; W4 = T6 after T4,T5; W5 = T7,T8 after T6. Labels are not global barriers. Release every currently eligible disjoint task when its own dependencies and input proof pass. Parent verifies agent configuration/manifest and delegates ownership.
Every behavior task uses incremental public RED -> minimal GREEN -> refactor, not all tests first. Capture actual failure and success plus before/after relevant input hashes. A failing setup is not behavioral RED. Parent checks changed-file lint/type safety, tests and scope diff before releasing dependents. Shared source reads are safe only after their producing task releases custody; checks rerun if relevant input hashes change. Concurrent test tasks use isolated temporary repos, no shared mutable fixture destinations, no dp-ai writes and no service ports. Build/public fixture regeneration is exclusive to T7. Sync is exclusive to T8. All paths below are repository-relative except explicit canonical skill paths.
Tasks
T1: Persist explicit Software Scope selection
{
"depends_on": [],
"location": "apps/cli/src/features/project-settings/**",
"owned_paths": [
"apps/cli/src/features/project-settings/**",
"apps/cli/src/scaffold/settings-selection.ts",
"apps/cli/src/scaffold/settings-selection.test.ts",
"apps/cli/src/scaffold/stage.ts",
"apps/cli/src/cli/ensure-command.ts",
"apps/cli/src/cli/ensure-command.test.ts",
"apps/cli/src/features/repository-scaffolding/interaction.ts",
"apps/cli/src/cli/scaffold-presenter.ts",
"apps/cli/src/platform/scoped-scaffold-operation.ts",
"apps/cli/src/features/scaffold-operation/model.ts"
],
"read_dependencies": [
"SPEC.md: AC-002\u2013004, AC-009\u2013011, AC-040\u2013042",
"closed grill Q1\u2013Q24",
"existing repository/settings/runtime contracts"
],
"shared_runtime_resources": "Exclusive temporary repository per task/test; read-only installed tools. No shared mutable build outputs or ports.",
"relevant_input_set": "Hash SPEC, task read dependencies, selected tool versions, fixtures and owned source before/after checks; invalidate proof if any consumed input changes.",
"wave_boundary": "W1",
"description": "Add typed saved scopes/exclusions and contained manifest-root validation, normalization and missing-versus-empty behavior. Carry the intent through init/ensure/scaffold settings handoff without guessing software ownership or altering general discovery. Preserve rootless and explicit-root support and unrelated settings.",
"acceptance_criteria": "AC-002\u2013004, AC-009\u2013011, AC-040\u2013042",
"validation": "bun run --cwd apps/cli test -- src/features/project-settings/service.test.ts src/scaffold/settings-selection.test.ts src/cli/ensure-command.test.ts",
"status": "Complete",
"log": [
"2026-09-22: parent accepted reviewed first frontier and delegated scoped implementation.",
"Parent expanded scope to the existing PlanStageScaffoldInput.settings type so explicit lint selection can cross stage composition.",
"Parent Task Gate passed: inspected settings schema/service and init/ensure/stage propagation; 32 real filesystem/prompt tests, typecheck, scoped lint, diff check. Activation and inventory remain explicit downstream scope."
],
"files edited/created": [
"apps/cli/src/features/project-settings/model.ts",
"apps/cli/src/features/project-settings/service.ts",
"apps/cli/src/features/project-settings/index.ts",
"apps/cli/src/features/project-settings/service.test.ts",
"apps/cli/src/scaffold/settings-selection.ts",
"apps/cli/src/scaffold/settings-selection.test.ts",
"apps/cli/src/cli/ensure-command.ts",
"apps/cli/src/cli/ensure-command.test.ts",
"apps/cli/src/features/repository-scaffolding/interaction.ts",
"apps/cli/src/features/scaffold-operation/model.ts",
"apps/cli/src/scaffold/stage.ts"
],
"task_identity_mode": "planning-only",
"backlog_item_id": "not_applicable",
"backlog_item_url": "not_applicable",
"relation_mode": "unprojected",
"backlog_sync_skip_reason": "Remote spec retention/provider projection pending publication hooks; parent explicitly directs authorized reversible implementation first.",
"assigned_skills": [
"tdd",
"codebase-design",
"quality-types",
"effect"
],
"implementation_skill_guidance": [
{
"skill": "tdd",
"applicable_behavior": "Write one public behavior RED before production edits; prove GREEN, then refactor."
},
{
"skill": "codebase-design",
"applicable_behavior": "Keep accepted responsibility behind its small public seam; adapter and owner tests prove locality."
},
{
"skill": "quality-types",
"applicable_behavior": "Decode untrusted boundary data, preserve typed states, and test owned public behavior with real filesystem/process seams."
},
{
"skill": "effect",
"applicable_behavior": "Preserve existing Effect v4 schemas and typed failure channels; read opensrc/effect.md and resolve opensrc path Effect-TS/effect before changing Effect behavior."
}
],
"tdd_status": "passed",
"tdd_target": "Saving explicit [] remains intentional empty while missing scopes returns selection-needed; invalid/escaping roots cannot mutate saved state.",
"red_command": "bun run --cwd apps/cli test -- src/features/project-settings/service.test.ts src/scaffold/settings-selection.test.ts src/cli/ensure-command.test.ts",
"expected_red_failure": "Current schema/readback drops or cannot distinguish saved lint selection.",
"green_command": "bun run --cwd apps/cli test -- src/features/project-settings/service.test.ts src/scaffold/settings-selection.test.ts src/cli/ensure-command.test.ts",
"reason_not_testable": "",
"red_evidence": "/tmp/t1-red.log, /tmp/t1-red2.log, /tmp/t1-red3.log, /tmp/t1-red4.log",
"green_evidence": "/tmp/t1-final-tests.log, /tmp/t1-final-types.log, /tmp/t1-final-lint.log; /tmp/t1-input-identities.json",
"codebase_design_notes": "Introduce explicit intent without adding framework/route state",
"review_mode": "cli",
"runtime_validation": "not_required",
"runtime_target": "not_applicable",
"runtime_evidence": "not_applicable",
"runtime_cleanup": "not_applicable",
"architecture_wave": "A1",
"behavior_owner": "Settings service and existing lifecycle composition",
"integration_surface": "Saved lint settings",
"public_seam": "Saved lint settings",
"topology_delta": "Introduce explicit intent without adding framework/route state",
"forbidden_ownership": "No control-plane service, no global discovery redefinition, no independent settings/policy registry, no unowned-file deletion.",
"temporary_seams": [],
"responsibility_acceptance_criteria": [
"RAC-1"
]
}T2: Establish portable managed lint route seam
{
"depends_on": [],
"location": "apps/cli/src/data/scripts/managed-lint.mjs",
"owned_paths": [
"apps/cli/src/data/scripts/managed-lint.mjs",
"apps/cli/src/data/scripts/managed-lint.d.mts",
"apps/cli/src/data/scripts/managed-lint.test.ts"
],
"read_dependencies": [
"SPEC.md: AC-005–008, AC-018–024, AC-040",
"closed grill Q1–Q24",
"existing repository/settings/runtime contracts"
],
"shared_runtime_resources": "Exclusive temporary repository per task/test; read-only installed tools. No shared mutable build outputs or ports.",
"relevant_input_set": "Hash SPEC, task read dependencies, selected tool versions, fixtures and owned source before/after checks; invalidate proof if any consumed input changes.",
"wave_boundary": "W1",
"description": "Own the shared pure eligibility/owner/route validation and command-construction interface, including derived selection.json route schema. Use exact selected owners, hard wiki exclusions, persisted excludes and nested unselected manifest boundaries. Resolve most-specific ownership, explicit cwd/config/local supported tool and represented failure threshold; distinguish logical source paths from physical temporary input. Return actionable diagnostics without executing commands or mutating files.",
"acceptance_criteria": "AC-005–008, AC-018–024, AC-040",
"validation": "bun run --cwd apps/cli test -- src/data/scripts/managed-lint.test.ts",
"status": "Complete",
"log": [
"2026-09-22: parent accepted reviewed first frontier and delegated scoped implementation.",
"Parent inspected frozen route implementation and reran 8 tests; verified exact hashes. RAC-2 passed; T3/T5 may consume immutable current seam.",
"Parent exact inherited app-config lint found 303 errors in portable JS; earlier narrow lint proof is not equivalent. Queue JSDoc/narrowing repair and project-policy input freshness after T5 releases T2 read custody. No suppression/gate weakening.",
"Parent gate accepted freshness/JSDoc repair: 9 public tests, exact inherited-config lint zero errors, strict typecheck. Shared local TS project now includes the runtime. Declaration hash eecf9fd3adf642d0d826239239f127720bce095f0ada1176e678437f57fb4530.",
"Shared exclusion API gate passed:13tests including original9, inherited lint zero errors, types/format pass; pure predicate uses existing logic with validated path and prevalidated exclusion inputs. Current declaration0e70ec565d882e6fadbb1d6de2b47e649675231f9ad1a291ecda199bcefaf694."
],
"files edited/created": [
"apps/cli/src/data/scripts/managed-lint.mjs",
"apps/cli/src/data/scripts/managed-lint.d.mts",
"apps/cli/src/data/scripts/managed-lint.test.ts"
],
"task_identity_mode": "planning-only",
"backlog_item_id": "not_applicable",
"backlog_item_url": "not_applicable",
"relation_mode": "unprojected",
"backlog_sync_skip_reason": "Remote spec retention/provider projection pending publication hooks; parent explicitly directs authorized reversible implementation first.",
"assigned_skills": [
"tdd",
"codebase-design",
"quality-types"
],
"implementation_skill_guidance": [
{
"skill": "tdd",
"applicable_behavior": "Write one public behavior RED before production edits; prove GREEN, then refactor."
},
{
"skill": "codebase-design",
"applicable_behavior": "Keep accepted responsibility behind its small public seam; adapter and owner tests prove locality."
},
{
"skill": "quality-types",
"applicable_behavior": "Decode untrusted boundary data, preserve typed states, and test owned public behavior with real filesystem/process seams."
}
],
"tdd_status": "passed",
"tdd_target": "The same logical file resolves one explicit selected owner; wiki/nested fixture returns excluded and ordinary test yields explicit canonical config command.",
"red_command": "bun run --cwd apps/cli test -- src/data/scripts/managed-lint.test.ts",
"expected_red_failure": "No shared resolver currently produces the accepted owner/exclusion route and explicit command.",
"green_command": "bun run --cwd apps/cli test -- src/data/scripts/managed-lint.test.ts",
"reason_not_testable": "",
"red_evidence": "Observed changed project policy returned ready before repair; original runtime RED categories preserved.",
"green_evidence": "13 public resolver tests/types/scoped lint/format; /tmp/issue224-t2-exclusion-result.md; final shared predicate and policy freshness receipt in IMPLEMENTATION-NOTES.md",
"codebase_design_notes": "One deep decision seam reused by independent adapters",
"review_mode": "cli",
"runtime_validation": "not_required",
"runtime_target": "not_applicable",
"runtime_evidence": "not_applicable",
"runtime_cleanup": "not_applicable",
"architecture_wave": "A1",
"behavior_owner": "Portable packaged runtime domain module",
"integration_surface": "Portable managed-lint API / derived route schema",
"public_seam": "Portable managed-lint API / derived route schema",
"topology_delta": "One deep decision seam reused by independent adapters",
"forbidden_ownership": "No control-plane service, no global discovery redefinition, no independent settings/policy registry, no unowned-file deletion.",
"temporary_seams": [
"M2"
],
"responsibility_acceptance_criteria": [
"RAC-2"
]
}T3: Preserve and compose project policy inputs
{
"depends_on": [
"T2"
],
"location": "apps/cli/src/features/managed-lint-policy/**",
"owned_paths": [
"apps/cli/src/features/managed-lint-policy/**"
],
"read_dependencies": [
"SPEC.md: AC-013–017, AC-024, AC-026–029",
"T2 public seam contract",
"producer task outputs: T2"
],
"shared_runtime_resources": "Exclusive temporary repository per task/test; read-only installed tools. No shared mutable build outputs or ports.",
"relevant_input_set": "Hash SPEC, task read dependencies, selected tool versions, fixtures and owned source before/after checks; invalidate proof if any consumed input changes.",
"wave_boundary": "W2",
"description": "Add bounded policy inventory/composition behind one result interface: recognized/direct/script-target/parent/renamed JSON/JSONC and transitive extends, explicit rule semantics and path-relative references. Preserve project-owned oxlint.project.json or compatible shared inputs; report unsupported dynamic/opaque policies and semantic conflicts. Return exact transitive input identities and prospective changes; leave writes/activation to existing scaffold/update owners.",
"acceptance_criteria": "AC-013–017, AC-024, AC-026–029",
"validation": "bun run --cwd apps/cli test -- src/features/managed-lint-policy/index.test.ts",
"status": "Complete",
"log": [
"T2 passed; released together on the reviewed disjoint W2 frontier.",
"Initial 8 tests/real Oxlint policy parity and exact scoped lint passed. Parent integration review requires proof for unrelated check scripts, transitive known check-to-lint aliases, and exact receipt-owned generated command reuse before final gate. Bounded scoped repair delegated.",
"Parent accepted 16 public tests, real Oxlint policy parity, exact inherited lint exit0 and CLI types. Alias analysis and exact receipt-managed commands proven; T4 retains prior threshold evidence.",
"Parent accepted active policyInputs repair:18 public tests, zero inherited lint errors, types pass; full inventory inputs remain separate. Current source hash e5f75381d02177a347aab4f72f64d7b8ab3e4ec4d81f80f6e4a615844be5edd5."
],
"files edited/created": [
"apps/cli/src/features/managed-lint-policy/index.ts",
"apps/cli/src/features/managed-lint-policy/index.test.ts"
],
"task_identity_mode": "planning-only",
"backlog_item_id": "not_applicable",
"backlog_item_url": "not_applicable",
"relation_mode": "unprojected",
"backlog_sync_skip_reason": "Remote spec retention/provider projection pending publication hooks; parent explicitly directs authorized reversible implementation first.",
"assigned_skills": [
"tdd",
"codebase-design",
"quality-types"
],
"implementation_skill_guidance": [
{
"skill": "tdd",
"applicable_behavior": "Write one public behavior RED before production edits; prove GREEN, then refactor."
},
{
"skill": "codebase-design",
"applicable_behavior": "Keep accepted responsibility behind its small public seam; adapter and owner tests prove locality."
},
{
"skill": "quality-types",
"applicable_behavior": "Decode untrusted boundary data, preserve typed states, and test owned public behavior with real filesystem/process seams."
}
],
"tdd_status": "passed",
"tdd_target": "A renamed parent JSON policy reached through extends preserves explicit no-explicit-any choice and relative override meaning when executed with the candidate canonical config.",
"red_command": "bun run --cwd apps/cli test -- src/features/managed-lint-policy/index.test.ts",
"expected_red_failure": "Current local-only policy handling loses inherited choices or cannot produce the effective candidate.",
"green_command": "bun run --cwd apps/cli test -- src/features/managed-lint-policy/index.test.ts",
"reason_not_testable": "",
"red_evidence": "Alias and receipt tests each failed expected ready/actual conflict before integration repair.",
"green_evidence": "20 policy tests/scoped lint/format; /tmp/issue224-t3-command-handoff.md; earlier real Oxlint inherited-policy witness /tmp/hi224-t3-policy-inputs-witness.json retained",
"codebase_design_notes": "Isolate preservation complexity behind candidate/conflict result",
"review_mode": "cli",
"runtime_validation": "required",
"runtime_target": "Isolated representative consumer executing installed supported Oxlint and generated local routes.",
"runtime_evidence": "Real Oxlint inherited-policy/config/relative-plugin witness in /tmp/hi224-t3-policy-inputs-witness.json; command inventory recovery /tmp/issue224-t3-command-handoff.md",
"runtime_cleanup": "Remove only task-owned temporary consumer directories/processes; preserve evidence paths and consumer repositories.",
"architecture_wave": "A2",
"behavior_owner": "CLI managed policy domain module",
"integration_surface": "Project policy composition result",
"public_seam": "Project policy composition result",
"topology_delta": "Isolate preservation complexity behind candidate/conflict result",
"forbidden_ownership": "No control-plane service, no global discovery redefinition, no independent settings/policy registry, no unowned-file deletion.",
"temporary_seams": [],
"responsibility_acceptance_criteria": [
"RAC-3"
]
}T4: Generate eligible assets and canonical routes
{
"depends_on": [
"T1",
"T3",
"T5"
],
"location": "apps/cli/src/features/context-planning/**",
"owned_paths": [
"apps/cli/src/features/context-planning/**",
"apps/cli/src/scaffold/output.ts",
"apps/cli/src/scaffold/output*.test.ts",
"apps/cli/src/content/wiki.ts",
"apps/cli/src/features/commit-gate/index.ts",
"apps/cli/src/features/commit-gate/index.test.ts",
"apps/cli/src/features/commit-gate/quality.ts",
"apps/cli/src/features/commit-gate/quality.test.ts",
"apps/cli/src/scaffold/managed-lint-generation.test.ts",
"apps/cli/src/scaffold/managed-lint-generation.ts"
],
"read_dependencies": [
"SPEC.md: AC-001–003, AC-005–008, AC-012–019, AC-023–027, AC-030–031",
"T2 public seam contract",
"producer task outputs: T1,T3"
],
"shared_runtime_resources": "Exclusive temporary repository per task/test; read-only installed tools. No shared mutable build outputs or ports.",
"relevant_input_set": "Hash SPEC, task read dependencies, selected tool versions, fixtures and owned source before/after checks; invalidate proof if any consumed input changes.",
"wave_boundary": "W3",
"description": "Consume saved scopes and shared route/policy contracts. Separate lint asset evidence from unchanged broad packsForScope guidance. Generate canonical configs and existing selection.json explanatory routes only for selected owners; remove independent wiki lint generation. Produce managed package/root/CI-consumable commands with explicit policy and ownership-safe custom compatibility diagnostics. Materialize required portable runtime independently of commitGate enabled. Keep owned config/script retirement proposed until T6 validates activation. Materialize the packaged managed-lint runner and resolver independently of Commit Gate enablement; generated owner/root scripts delegate to its frozen invocation contract.",
"acceptance_criteria": "AC-001–003, AC-005–008, AC-012–019, AC-023–027, AC-030–031",
"validation": "bun run --cwd apps/cli test -- src/scaffold/managed-lint-generation.test.ts src/scaffold/output-root-materialization.test.ts src/features/context-planning/compiler.test.ts src/features/commit-gate/quality.test.ts",
"status": "Complete",
"log": [
"Paused after98/99 tests to repair requested T3 active policyInputs and T5 runner/Python preservation; process exited safely and producer read custody released. Resume brief retained locally.",
"Parent gate:107 tests/types/format/scoped lint, actual generated Oxlint and second-generation preservation; CI direct commands conflict with exact path/line, managed script calls accepted. Frozen final hashes verified. T6 owns cumulative candidate/health inventory freshness.",
"After T6 adoption source freeze, complete npm exec CI and selected-root aggregation checks from t4-final-integration-checks.md; final proof must consume repaired T5 runtime."
],
"files edited/created": [],
"task_identity_mode": "planning-only",
"backlog_item_id": "not_applicable",
"backlog_item_url": "not_applicable",
"relation_mode": "unprojected",
"backlog_sync_skip_reason": "Remote spec retention/provider projection pending publication hooks; parent explicitly directs authorized reversible implementation first.",
"assigned_skills": [
"tdd",
"codebase-design",
"quality-types"
],
"implementation_skill_guidance": [
{
"skill": "tdd",
"applicable_behavior": "Write one public behavior RED before production edits; prove GREEN, then refactor."
},
{
"skill": "codebase-design",
"applicable_behavior": "Keep accepted responsibility behind its small public seam; adapter and owner tests prove locality."
},
{
"skill": "quality-types",
"applicable_behavior": "Decode untrusted boundary data, preserve typed states, and test owned public behavior with real filesystem/process seams."
}
],
"tdd_status": "passed",
"tdd_target": "Public materialization of selected React-email backend and frontend emits only locally justified rules, preserves inherited policy, and never creates wiki/fixture lint output even with disabled Commit Gate.",
"red_command": "bun run --cwd apps/cli test -- src/scaffold/managed-lint-generation.test.ts src/scaffold/output-root-materialization.test.ts src/features/context-planning/compiler.test.ts src/features/commit-gate/quality.test.ts",
"expected_red_failure": "Current output enumerates all manifests/wiki or broad guidance leaks unrelated lint assets.",
"green_command": "bun run --cwd apps/cli test -- src/scaffold/managed-lint-generation.test.ts src/scaffold/output-root-materialization.test.ts src/features/context-planning/compiler.test.ts src/features/commit-gate/quality.test.ts",
"reason_not_testable": "",
"red_evidence": "Original generation/activation REDs retained in /tmp/hi-t4-evidence and /tmp/t4-*-red.log; latest four rediscovery REDs and unchanged strict update RED in /tmp/issue224-t4-gate-convergence-{generation,update}-red.log",
"green_evidence": "137 owning tests plus unchanged strict update, types/lint/format; /tmp/issue224-t4-gate-convergence-handoff.md; parent verified frozen owned/producer receipts",
"codebase_design_notes": "Publish derived routes without a second authority registry",
"review_mode": "cli",
"runtime_validation": "required",
"runtime_target": "Isolated representative consumer executing installed supported Oxlint and generated local routes.",
"runtime_evidence": "Actual emitted root/package/gate/local Oxlint and threshold proof in /tmp/issue224-t4-final-handoff.md (see current source receipts); public full repeat update in /tmp/issue224-t4-gate-convergence-update-green.log",
"runtime_cleanup": "Remove only task-owned temporary consumer directories/processes; preserve evidence paths and consumer repositories.",
"architecture_wave": "A2",
"behavior_owner": "CLI context compiler and scaffold composition",
"integration_surface": "Generated configs / selection.json / quality commands",
"public_seam": "Generated configs / selection.json / quality commands",
"topology_delta": "Publish derived routes without a second authority registry",
"forbidden_ownership": "No control-plane service, no global discovery redefinition, no independent settings/policy registry, no unowned-file deletion.",
"temporary_seams": [
"M1",
"M2"
],
"responsibility_acceptance_criteria": [
"RAC-3"
]
}T5: Migrate staged and edited-file runtime adapters
{
"depends_on": [
"T2"
],
"location": "apps/cli/src/data/scripts/commit-gate-runner.mjs",
"owned_paths": [
"apps/cli/src/data/scripts/commit-gate-runner.mjs",
"apps/cli/src/data/scripts/commit-gate-runner.d.ts",
"apps/cli/src/data/scripts/commit-gate-runner.test.ts",
"apps/cli/src/data/hooks/format-edited-file.mjs",
"apps/cli/src/data/hooks/format-edited-file.d.mts",
"apps/cli/src/data/hooks/format-edited-file.test.ts",
"apps/cli/src/data/scripts/managed-lint-runner.mjs",
"apps/cli/src/data/scripts/managed-lint-runner.test.ts",
"apps/cli/src/data/scripts/managed-lint-runner.d.mts",
"apps/cli/tsconfig.json"
],
"read_dependencies": [
"SPEC.md: AC-001, AC-005–008, AC-018–025",
"T2 public seam contract",
"producer task outputs: T2"
],
"shared_runtime_resources": "Exclusive temporary repository per task/test; read-only installed tools. No shared mutable build outputs or ports.",
"relevant_input_set": "Hash SPEC, task read dependencies, selected tool versions, fixtures and owned source before/after checks; invalidate proof if any consumed input changes.",
"wave_boundary": "W2",
"description": "Consume frozen T2 routes in existing adapters; remove independent lint config/owner guessing. Exclusions precede coverage and suppress both managed lint/format. Handle mixed commits, old/new rename endpoints, deletions and shared dependent inputs per owner/check kind. Keep safe local process resolution, read-only precommit checks, disabled/coexisting hooks and edited-file compare/fix/retry safety. Prove logical source matching for temporary fix bytes with actual Oxlint support; preserve project-local typed context. Own the generated package/root execution adapter in managed-lint-runner.mjs: --root optional explicit repository root, --scope exact owner optional (omitted dispatches selected owners), --format human|json, and file arguments after -- resolved from caller cwd. Omitted files enumerate eligible owner sources. Exit 0 for empty/clean, nonzero for findings under route threshold, distinct operational/config failure; use only resolver-produced explicit config/local tool invocation. Freeze tested invocation details before T4 consumes it.",
"acceptance_criteria": "AC-001, AC-005–008, AC-018–025",
"validation": "bun run --cwd apps/cli test -- src/data/scripts/commit-gate-runner.test.ts src/data/hooks/format-edited-file.test.ts; bun run --cwd apps/cli test -- src/data/scripts/managed-lint-runner.test.ts",
"status": "Complete",
"log": [
"T2 passed; released together on the reviewed disjoint W2 frontier.",
"Parent accepted T5 behavior: 48 real subprocess/public tests, CLI types, no new inherited-config lint errors. Existing promisify(execFileCallback) strict-void-return remains on unchanged original line; no rules suppressed and no unrelated debt repair. T2 repaired hashes unchanged.",
"Final Python/shared classification repair passed parent gate. Explicit build exclusion corrects unsupported brief shorthand. Gate inherited promisify hard error remains separately recorded unchanged debt.",
"Adoption preserved five regression failures: shared stderr classification and missing native process facts. Scoped runner/declaration/test repair owns only T5 files; T6 caller integration follows frozen producer."
],
"files edited/created": [
"apps/cli/src/data/scripts/commit-gate-runner.mjs",
"apps/cli/src/data/scripts/commit-gate-runner.d.ts",
"apps/cli/src/data/scripts/commit-gate-runner.test.ts",
"apps/cli/src/data/hooks/format-edited-file.mjs",
"apps/cli/src/data/hooks/format-edited-file.test.ts",
"apps/cli/src/data/scripts/managed-lint-runner.mjs",
"apps/cli/src/data/scripts/managed-lint-runner.test.ts",
"apps/cli/src/data/scripts/managed-lint-runner.d.mts",
"apps/cli/tsconfig.json"
],
"task_identity_mode": "planning-only",
"backlog_item_id": "not_applicable",
"backlog_item_url": "not_applicable",
"relation_mode": "unprojected",
"backlog_sync_skip_reason": "Remote spec retention/provider projection pending publication hooks; parent explicitly directs authorized reversible implementation first.",
"assigned_skills": [
"tdd",
"codebase-design",
"quality-types"
],
"implementation_skill_guidance": [
{
"skill": "tdd",
"applicable_behavior": "Write one public behavior RED before production edits; prove GREEN, then refactor."
},
{
"skill": "codebase-design",
"applicable_behavior": "Keep accepted responsibility behind its small public seam; adapter and owner tests prove locality."
},
{
"skill": "quality-types",
"applicable_behavior": "Decode untrusted boundary data, preserve typed states, and test owned public behavior with real filesystem/process seams."
}
],
"tdd_status": "passed",
"tdd_target": "An excluded-only staged fixture/wiki change launches no quality process; selected normal test source uses the canonical route, and temporary edit input keeps logical overrides.",
"red_command": "bun run --cwd apps/cli test -- src/data/scripts/commit-gate-runner.test.ts src/data/hooks/format-edited-file.test.ts src/data/scripts/managed-lint-runner.test.ts",
"expected_red_failure": "Current staged selection/hook discovery launches tools for excluded paths or chooses another policy.",
"green_command": "bun run --cwd apps/cli test -- src/data/scripts/commit-gate-runner.test.ts src/data/hooks/format-edited-file.test.ts src/data/scripts/managed-lint-runner.test.ts",
"reason_not_testable": "",
"red_evidence": "Runtime REDs retained by worker; final root-dispatch public test failed with empty HI_STAGED_FILES in both root-selection states before repair.",
"green_evidence": "103 adapter tests, null-status regression restored; /tmp/issue224-t5-null-handoff.md; scoped lint/format and frozen receipt verified",
"codebase_design_notes": "Thin adapters share decisions while retaining distinct mutation safety",
"review_mode": "cli",
"runtime_validation": "required",
"runtime_target": "Isolated representative consumer executing installed supported Oxlint and generated local routes.",
"runtime_evidence": "Actual Oxlint execution/classification and native process facts in /tmp/issue224-t5-null-handoff.md; real Ruff0.15.7 /tmp/t5-real-ruff-proof.json; supported Linux runtime only",
"runtime_cleanup": "Remove only task-owned temporary consumer directories/processes; preserve evidence paths and consumer repositories.",
"architecture_wave": "A2",
"behavior_owner": "Packaged gate and edit-hook adapters",
"integration_surface": "Runtime staged/check/fix entrypoints",
"public_seam": "Runtime staged/check/fix entrypoints",
"topology_delta": "Thin adapters share decisions while retaining distinct mutation safety",
"forbidden_ownership": "No control-plane service, no global discovery redefinition, no independent settings/policy registry, no unowned-file deletion.",
"temporary_seams": [
"M2"
],
"responsibility_acceptance_criteria": [
"RAC-4"
]
}T6: Reconcile adoption, validation, cache and health
{
"depends_on": [
"T4",
"T5"
],
"location": "apps/cli/src/update/**",
"owned_paths": [
"apps/cli/src/update/**",
"apps/cli/src/runtime/scripts.ts",
"apps/cli/src/runtime/scripts.test.ts",
"apps/cli/src/runtime/validation-candidate.ts",
"apps/cli/src/runtime/validation-candidate.test.ts",
"apps/cli/src/features/scaffold-update/**",
"apps/cli/src/features/scaffold-state/generation-inputs.ts",
"apps/cli/src/features/scaffold-state/generation-inputs.test.ts",
"apps/cli/src/features/repository-check/**",
"apps/cli/src/platform/repository-check-capabilities.ts",
"apps/cli/src/presentation/operation-result/repository-check-facts.ts",
"apps/cli/src/presentation/operation-result/lint-preview-facts.ts",
"apps/cli/src/cli/update-presenter.ts",
"apps/cli/src/cli/update-presenter.test.ts"
],
"read_dependencies": [
"SPEC.md: AC-001, AC-009–011, AC-026–034, AC-037–042",
"T2 public seam contract",
"producer task outputs: T4,T5"
],
"shared_runtime_resources": "Exclusive temporary repository per task/test; read-only installed tools. No shared mutable build outputs or ports.",
"relevant_input_set": "Hash SPEC, task read dependencies, selected tool versions, fixtures and owned source before/after checks; invalidate proof if any consumed input changes.",
"wave_boundary": "W4",
"description": "Use the shared route for preview validation and read-only health, including inference paths that must not manufacture selection. Inventory known alias/root/CI conflicts and preserve unsupported commands. Validate complete proposed policy/routes/tools/retirements before coherent dependent activation. Operational/config/authority failures block; source findings remain preview findings. Retire only receipt-owned unmodified assets after preserving policy. Include exact scope/routes/transitive policy/toolchain/source inputs in affected proof identity, handle incomplete reuse safely, preserve interruption/retry and second-update convergence. Include a rootless supported-package candidate in adoption proof, not only final regression.",
"acceptance_criteria": "AC-001, AC-009–011, AC-026–034, AC-037–042",
"validation": "bun run --cwd apps/cli test -- src/update/run.test.ts src/runtime/scripts.test.ts src/runtime/validation-candidate.test.ts src/features/repository-check/application.test.ts src/features/scaffold-update/validation-plan.test.ts src/features/scaffold-update/validation-cache/cache.test.ts",
"status": "Complete",
"log": [
"T6 internal disjoint wave: adoption owns runtime/update/scaffold-update and their presenters; health owns repository-check and generation-inputs. Current briefs supersede broad ownership. Coupled application.test.ts imports update/run; coupled suites/types wait both frozen, independent closure tests may run concurrently. One cumulative T6 gate remains. Readonly review findings resolved before dispatch.",
"Both internal source writers frozen. Health 75 tests pass; adoption 137/142 pass with five T5 integration failures. Detailed handoffs /tmp/t6-health-handoff.md and /tmp/issue224-t6-adoption-handoff.md. Combined lifecycle/types/lint and current producer proof remain.",
"Final A3 accepted:340/340 exhaustive nine-file gate; types/lint/format; exact owned/producer hashes and test-ID multiplicity closure. Rootless native adoption, receipt-owned wiki config/plugin retirement, modified/unowned preservation, fresh native interrupted-publication retry and repeat/check convergence. /tmp/issue224-t6-a3-final-handoff.md."
],
"files edited/created": [],
"task_identity_mode": "planning-only",
"backlog_item_id": "not_applicable",
"backlog_item_url": "not_applicable",
"relation_mode": "unprojected",
"backlog_sync_skip_reason": "Remote spec retention/provider projection pending publication hooks; parent explicitly directs authorized reversible implementation first.",
"assigned_skills": [
"tdd",
"codebase-design",
"quality-types",
"effect"
],
"implementation_skill_guidance": [
{
"skill": "tdd",
"applicable_behavior": "Write one public behavior RED before production edits; prove GREEN, then refactor."
},
{
"skill": "codebase-design",
"applicable_behavior": "Keep accepted responsibility behind its small public seam; adapter and owner tests prove locality."
},
{
"skill": "quality-types",
"applicable_behavior": "Decode untrusted boundary data, preserve typed states, and test owned public behavior with real filesystem/process seams."
},
{
"skill": "effect",
"applicable_behavior": "Preserve existing Effect v4 schemas and typed failure channels; read opensrc/effect.md and resolve opensrc path Effect-TS/effect before changing Effect behavior."
}
],
"tdd_status": "required",
"tdd_target": "An inherited policy or scope change invalidates affected validation and a conflicting route blocks dependent activation without losing owned policy or claiming convergence.",
"red_command": "bun run --cwd apps/cli test -- src/update/run.test.ts src/runtime/scripts.test.ts src/runtime/validation-candidate.test.ts src/features/repository-check/application.test.ts src/features/scaffold-update/validation-plan.test.ts src/features/scaffold-update/validation-cache/cache.test.ts",
"expected_red_failure": "Existing preview uses bare config or receipt/cache checks fail to identify divergent live routes.",
"green_command": "bun run --cwd apps/cli test -- src/update/run.test.ts src/runtime/scripts.test.ts src/runtime/validation-candidate.test.ts src/features/repository-check/application.test.ts src/features/scaffold-update/validation-plan.test.ts src/features/scaffold-update/validation-cache/cache.test.ts",
"reason_not_testable": "",
"red_evidence": "/tmp/issue224-t6-adoption-plan-red.log (affected-owner invalidation), /tmp/issue224-t6-adoption-runtime-red.log (missing/disabled selection), /tmp/t6-health-freshness-red.log (8 real input-identity failures), /tmp/issue224-t6-a3-plugin-red.log (legacy owned plugin retirement), /tmp/issue224-t6-a3-installation-report.json (native interrupted retry). Public RED lineage is indexed in /tmp/issue224-t6-adoption-handoff.md and /tmp/t6-health-handoff.md.",
"green_evidence": "Matching adoption-plan-green, adoption-runtime-green, health-freshness-green, a3-plugin-green and a3-pending-green logs; final /tmp/issue224-t6-a3-final-handoff.md and /tmp/issue224-t6-a3-final-inventory-closure.json prove340/340 lifecycle cases, complete case identities and no skipped coverage; types/lint/format and exact source receipts passed.",
"codebase_design_notes": "Reuse existing recovery/proof mechanism, not a second updater/cache",
"review_mode": "cli",
"runtime_validation": "required",
"runtime_target": "Isolated representative consumer executing installed supported Oxlint and generated local routes.",
"runtime_evidence": "Capture command/cwd/config/tool identity, diagnostics, exit result and relevant filesystem/receipt state in implementation notes.",
"runtime_cleanup": "Remove only task-owned temporary consumer directories/processes; preserve evidence paths and consumer repositories.",
"architecture_wave": "A3",
"behavior_owner": "Update composition, validation and read-only health",
"integration_surface": "Adoption/check result and candidate runtime route",
"public_seam": "Adoption/check result and candidate runtime route",
"topology_delta": "Reuse existing recovery/proof mechanism, not a second updater/cache",
"forbidden_ownership": "No control-plane service, no global discovery redefinition, no independent settings/policy registry, no unowned-file deletion.",
"temporary_seams": [
"M1",
"M2"
],
"responsibility_acceptance_criteria": [
"RAC-5"
]
}T7: Prove generated end-to-end parity and package output
Parent-authorized preparation: author the two isolated T7 test files from approved SPEC and frozen T1–T5 contracts while T6 finishes. Execute no checks until transitive runtime inputs freeze; final T6 dependency and post-T8 packaging gate remain. Readonly plan review approved this split with that no-execution condition. See local t7-preparation-amendment.md for custody.
{
"depends_on": [
"T6"
],
"location": "apps/cli/src/managed-lint-contract.test.ts",
"owned_paths": [
"apps/cli/src/managed-lint-contract.test.ts",
"apps/cli/test-fixtures/public-output/**",
"apps/cli/scripts/build-dist.mjs",
"apps/cli/scripts/assert-package-surface.mjs",
"apps/cli/src/scripts/build-dist.test.ts",
"apps/cli/src/data/bundled-baseline-identity.generated.ts"
],
"read_dependencies": [
"SPEC.md: AC-001–034, AC-037–039",
"T2 public seam contract",
"producer task outputs: T6",
"apps/cli/skills/** and src/data/catalog/skills.ts: freeze after T8 sync before final packaging proof"
],
"shared_runtime_resources": "Exclusive temporary repository per task/test; read-only installed tools. Exclusive fixture/build destination; serialize packaging. T8 sync exclusively mutates installed skill mirrors/catalog. T7 final fixture regeneration and packaging build must wait until T8 sync completes; any earlier build evidence is invalidated and rerun after sync. Authoring and isolated tests may proceed concurrently.",
"relevant_input_set": "Hash SPEC, task read dependencies, selected tool versions, fixtures and owned source before/after checks; invalidate proof if any consumed input changes.",
"wave_boundary": "W5",
"description": "Exercise actual generated package/root/CI-command/gate/edit verification plus update candidate paths on isolated mixed/custom/root/rootless repositories. Verify inherited policy diagnostics and thresholds on identical bytes, local framework isolation, exclusions/ordinary tests, rename/delete, custom conflicts, failed adoption/retry and second update. Refresh owned public fixtures from producers, ensure the portable runtime ships in built CLI/baseline and no excluded lint producer resurfaces. Build edits only when packaging needs the new runtime asset; repair behavior in its owning task rather than hiding it in this integration task.",
"acceptance_criteria": "AC-001–034, AC-037–039",
"validation": "bun run --cwd apps/cli test -- src/managed-lint-contract.test.ts src/scripts/build-dist.test.ts",
"status": "Complete locally — final cumulative proof accepted; delivery/provider closeout pending",
"log": [
"Two owned test files authored only; no checks run while transitive inputs mutable. Runtime follows repaired T4/T5 and T6 gate; packaging follows T8 sync.",
"Historical T7 acceptance: normal build,5 actual generated parity/provider/baseline tests, installed tarball source-byte/runtime proof, types/lint/format pass. Normal build updates bundled-baseline-identity.generated.ts as required generator output; other1205 consumed files remain unchanged. /tmp/issue224-t7-final-exits.json and final handoff.",
"Historical CI reopening: published head7055f06c required source CI failed58tests/10files. Five test owners and helper/catalog follow-ups froze; cumulative source/update/build/package/root static/provider evidence was then pending and final A4 open.",
"Final local acceptance: source904/57files, update71, built70, unchanged-input release61, operators119, build/integration5/installed package/types, root static and exact-config repaired-file lint/format pass. Both real-consumer reports bind final CLI a8ff8cd55397b707a3423b1df1b2a0226e35a8289401937385655be0d47fea4d;1,328 tracked input hashes unchanged. Local T7/A4 closed. PR225 remains draft at7055f06c; no fourth commit, second push, or remote GREEN is claimed yet. On 2026-09-23 the user authorized exactly one additional hook-bypassed commit and one push for this frozen repair."
],
"files edited/created": [],
"task_identity_mode": "planning-only",
"backlog_item_id": "not_applicable",
"backlog_item_url": "not_applicable",
"relation_mode": "unprojected",
"backlog_sync_skip_reason": "Remote spec retention/provider projection pending publication hooks; parent explicitly directs authorized reversible implementation first.",
"assigned_skills": [
"tdd",
"codebase-design",
"quality-types"
],
"implementation_skill_guidance": [
{
"skill": "tdd",
"applicable_behavior": "Write one public behavior RED before production edits; prove GREEN, then refactor."
},
{
"skill": "codebase-design",
"applicable_behavior": "Keep accepted responsibility behind its small public seam; adapter and owner tests prove locality."
},
{
"skill": "quality-types",
"applicable_behavior": "Decode untrusted boundary data, preserve typed states, and test owned public behavior with real filesystem/process seams."
}
],
"tdd_status": "passed",
"tdd_target": "A representative generated backend file has equal diagnostics and exit semantics under every managed verification entrypoint while excluded projects produce no lint/format invocation.",
"red_command": "bun run --cwd apps/cli test -- src/managed-lint-contract.test.ts src/scripts/build-dist.test.ts",
"expected_red_failure": "Before complete implementation the public matrix reproduces scope/config divergence; if integration already passes, record honest inherited RED from owning task rather than invent failure.",
"green_command": "bun run --cwd apps/cli test -- src/managed-lint-contract.test.ts src/scripts/build-dist.test.ts",
"reason_not_testable": "",
"red_evidence": "/tmp/issue224-t7-build.log and T5 bundled-host RED; no invented RED for already-green integrations",
"green_evidence": "/tmp/issue224-t7-final-exits.json",
"codebase_design_notes": "Prove adapters compose through production artifact boundary",
"review_mode": "cli",
"runtime_validation": "required",
"runtime_target": "Isolated representative consumer executing installed supported Oxlint and generated local routes.",
"runtime_evidence": "Capture command/cwd/config/tool identity, diagnostics, exit result and relevant filesystem/receipt state in implementation notes.",
"runtime_cleanup": "Remove only task-owned temporary consumer directories/processes; preserve evidence paths and consumer repositories.",
"architecture_wave": "A4",
"behavior_owner": "Public integration and packaged distribution proof",
"integration_surface": "Actual generated CLI/runtime commands",
"public_seam": "Actual generated CLI/runtime commands",
"topology_delta": "Prove adapters compose through production artifact boundary",
"forbidden_ownership": "No control-plane service, no global discovery redefinition, no independent settings/policy registry, no unowned-file deletion.",
"temporary_seams": [],
"responsibility_acceptance_criteria": [
"RAC-6"
]
}T8: Reconcile operator guidance and implemented knowledge
{
"depends_on": [
"T6"
],
"location": "/home/stefan/repos/skills/skills/agnostic/cli/hi-cli/**",
"owned_paths": [
"/home/stefan/repos/skills/skills/agnostic/cli/hi-cli/**",
"docs/README.md",
"docs/runbooks/hi-cli-scaffolding.md",
"apps/wiki/content/docs/project/specs/cli/issue-224-managed-lint/meta.json",
"apps/wiki/content/docs/project/specs/cli/scaffold-lint-config-baseline/SPEC.md",
"apps/wiki/content/docs/project/specs/cli/issue-181-lint-feedback-adoption/SPEC.md",
"apps/wiki/content/docs/project/specs/cli/issue-203-scaffold-convergence/SPEC.md",
"apps/wiki/content/docs/project/specs/cli/issue-215-manifest-driven-update/PLAN.md",
"apps/wiki/content/docs/project/runbooks/hi-cli-scaffolding.md",
"apps/wiki/specs/cli/issue-181-lint-feedback-adoption/SPEC.md",
"apps/wiki/specs/cli/scaffold-lint-config-baseline/SPEC.md",
"apps/wiki/content/docs/project/specs/.source-projection.json",
"apps/cli/scripts/sync-skills-repo.mjs"
],
"read_dependencies": [
"SPEC.md: AC-035–036, AC-038–042",
"T2 public seam contract",
"producer task outputs: T6"
],
"shared_runtime_resources": "Exclusive temporary repository per task/test; read-only installed tools. Exclusive canonical skill sync; root coordinates mirror receipt. T8 sync exclusively mutates installed skill mirrors/catalog. T7 final fixture regeneration and packaging build must wait until T8 sync completes; any earlier build evidence is invalidated and rerun after sync. Authoring and isolated tests may proceed concurrently.",
"relevant_input_set": "Hash SPEC, task read dependencies, selected tool versions, fixtures and owned source before/after checks; invalidate proof if any consumed input changes.",
"wave_boundary": "W5",
"description": "Verify the resolved canonical hi-cli source path is on shared-skills main before edits, author agent scope selection/policy migration and diagnostics workflow, commit/push canonical source and sync exact receipt through authorized root coordination. Never hand-edit installed mirrors. Update implemented docs and wiki projections with proven behavior, and reconcile predecessor design contracts while preserving historical proof. Record retained provider/publication limits truthfully. Root owns final PLAN status, global evidence and release classification. Return documentation evidence to parent; parent alone updates PLAN and IMPLEMENTATION-NOTES.",
"acceptance_criteria": "AC-035–036, AC-038–042",
"validation": "bun run --cwd apps/wiki check:content",
"status": "Complete",
"log": [
"Read-only source projection preflight adds canonical legacy SPEC sources and generated projection manifest to T8 ownership; routed copies must be regenerated, not hand-edited. Parent retains active issue224 meta until finalization.",
"Sync reproducibility amendment: T8 owns only defaultRepositoryRef/defaultRepositoryCommit pin update in sync-skills-repo.mjs. Publish immutable sync/issue224-managed-lint-<sha12> source tag at pushed canonical main commit; ordinary sync must resolve and verify that exact commit. No baseline or npm release publication.",
"Internal T8 drafting may proceed against approved SPEC and frozen T1-T5 only; no mutable T6 reads, publication, sync, projection, build or implementation-complete claims. T6 dependency remains mandatory for final verification/publication and T8 gate. Parent verified write disjointness; current bounded handoff t8-draft-amendment.md.",
"Ten canonical hi-cli/docs drafts frozen in /tmp/issue224-t8-draft-handoff.md; no publish, sync, projections or final validation. Finalization follows T6.",
"T8 accepted: canonical main commit622c4b131bd4193dd3f4d1cc3cc4b10f04c4089a, immutable source tag, normal sync exact receipt/four-file byte parity,18 parent-verified hashes;16 wiki tests/content/24links pass. /tmp/issue224-t8-final-handoff.md."
],
"files edited/created": [],
"task_identity_mode": "planning-only",
"backlog_item_id": "not_applicable",
"backlog_item_url": "not_applicable",
"relation_mode": "unprojected",
"backlog_sync_skip_reason": "Remote spec retention/provider projection pending publication hooks; parent explicitly directs authorized reversible implementation first.",
"assigned_skills": [
"writing-for-agents"
],
"implementation_skill_guidance": [
{
"skill": "writing-for-agents",
"applicable_behavior": "Preserve canonical terms, explicit completion evidence and correct source-of-truth pointers."
}
],
"tdd_status": "not_applicable",
"tdd_target": "Operator instructions and predecessor contract reconciliations describe verified scopes/policy/adoption without claiming unrun proof.",
"red_command": "not_applicable",
"expected_red_failure": "not_applicable: documentation and source-guidance reconciliation has no independent product runtime assertion.",
"green_command": "bun run --cwd apps/wiki check:content",
"reason_not_testable": "Docs/guidance-only task; runtime proof belongs to T1–T7.",
"red_evidence": "not_applicable: T8 is docs/guidance-only; T1-T7 own runtime RED/GREEN. Content validation is a GREEN-only document check.",
"green_evidence": "/tmp/issue224-t8-final-content.log: check:content passed; /tmp/issue224-t8-wiki-contracts.log:16 tests passed; /tmp/issue224-t8-final-link-check.log:24 links passed; /tmp/issue224-t8-final-hashes.json:18 parent-verified source hashes. Exact canonical source622c4b131bd4193dd3f4d1cc3cc4b10f04c4089a matches the normal sync receipt and four bundled hi-cli files. Parent final check:content and16 wiki tests also passed.",
"codebase_design_notes": "Keep durable knowledge linked to real runtime authority",
"review_mode": "cli",
"runtime_validation": "not_required",
"runtime_target": "not_applicable",
"runtime_evidence": "not_applicable",
"runtime_cleanup": "not_applicable",
"architecture_wave": "A4",
"behavior_owner": "Canonical operator guidance and implemented knowledge",
"integration_surface": "Agent workflow / docs handoff",
"public_seam": "Agent workflow / docs handoff",
"topology_delta": "Keep durable knowledge linked to real runtime authority",
"forbidden_ownership": "No control-plane service, no global discovery redefinition, no independent settings/policy registry, no unowned-file deletion.",
"temporary_seams": [],
"responsibility_acceptance_criteria": [
"RAC-7"
]
}Final validation and closeout gates
- Task-local RED/GREEN, scope diff and exact relevant-input evidence are complete; T7 proves actual generated parity rather than only matching config bytes.
- Narrow owning CLI lint/types checks and public behavior suite pass. The parent resolves exact repository script commands from package.json; no unknown command or inherited failure is represented as passing. Validate package build/public output only after source stabilizes; repeat only after relevant changes.
- A1–A4 RAC evidence is current, migration entries removed with proof, no residual alternate managed authority, and all AC-001–042 have evidence or an explicit blocking finding. OUT-024 closure does not waive a failing product criterion.
- Wiki content and public contract checks pass; canonical skill SHA/sync receipt, changed-path release classification and docs reconciliation are recorded.
- Root completes prescribed review passes and PR225 retention/stack readback; remaining hook/publication blockers are resolved safely or surfaced for exact final authorization. The earlier one-time documentation bypass is not reused.
Risks, mitigations and unresolved work
- JSONC/extends/plugin-relative paths and typed lint can diverge after copying: T3 preserves input context and executes real Oxlint; unsafe composition conflicts.
- Temporary edit paths can break overrides: T2 models logical path separately, T5 validates real supported CLI semantics instead of guessing stdin behavior.
- Known custom shell cannot be safely inferred: preserve it and report exact unresolved authority, never claim all arbitrary commands converge.
- Broad guidance and local lint evidence have different purposes: T4 changes lint applicability only, leaving packsForScope guidance intact.
- Excluded outputs can reappear through independent wiki/update producers: T4 and T6 reconcile them and T7 tests repeat convergence.
- T8 canonical path is resolved before custody; shared-skills must be on main. Missing path or non-main is a concrete blocker, not permission to edit mirrors.
- Root may amend exact owned test paths when existing suite placement demands it; record scope changes before dispatch and preserve disjoint custody.
- No open product question or parked branch. Actual consumer Mac/CI reproduction, remote retention and provider projection remain evidence/access work, not an invitation to weaken acceptance. Parent performs independent plan review before releasing the first frontier; this document does not claim that review happened.
Planning skill and rule evidence
Create-plan, swarm-planner, grilling (closed frontier), TDD, codebase-design, show-me (persisted topology/graph/waves), wait-what (plain canonical terms), and writing-for-agents shaped this plan. Scoped CLI/source/data tables inspected; implementation-applicable named skills are carried per task. Parallel-research was considered and existing bounded reports reused. Required external tool semantics are pinned to installed-version runtime/source checks in T3/T5.
HI-WIKI-001/003: PLAN uses the existing spec route; root owns meta registration and content validation after this isolated authoring wave. HI-DOCS-001: implemented operations remain T8 proof-dependent. CLI source/managed-asset/shared-skill rules are execution obligations at their owning tasks, not falsely passed by planning.
Plan review
Readonly plan-reviewer accepted T1/T2 and downstream behavior coverage. Amendments added TypeScript/Effect guidance, retained parent-only notes custody, required rootless adoption proof, and serialized final packaging evidence after canonical skill sync. No product frontier reopened.
Plan review amendment: T5 owns the separate package/root runner and its subprocess tests; T4 depends on T5 to consume stable packaged runtime bytes and materializes both runtime files even with Commit Gate disabled. The resolver remains free of execution side effects. This adds no product scope or graph cycle.
Final T7 package validation found a bounded T5 entrypoint-guard regression: import.meta.filename identifies the host after bundling, accidentally executing standalone lint argument parsing. T5 owns only managed-lint-runner.mjs and its tests for repair; T7 owns rematerialization/build/package proof after frozen handoff. /tmp/issue224-t5-bundle-main-repair.md is the dispatch and /tmp/issue224-t7-build.log is RED. No architecture or product contract changes are authorized.
Architecture Conformance Evidence
Historical checkpoints follow. Their completion statements describe the recorded inputs. The current CI repair frontier now closes local T7/final A4 on frozen repaired inputs while delivery/provider publication remains pending. No accepted architecture or AC is changed.
Final A4 passes with zero ownership/dependency drift. Settings owns saved intent (RAC-1); the neutral resolver owns eligibility/commands without process execution (RAC-2); CLI policy/generation composes project policy and emits derived routes (RAC-3); the shared runner serves adapters while edit publication remains hook-owned (RAC-4); existing update reconciliation owns candidate validation, exact receipts, retirement and read-only health (RAC-5). T7 proves real generated and installed entrypoints (RAC-6), and T8 publishes exact canonical operator guidance (RAC-7). Public seams and optional verified receipt input match the declared topology; no API/control-plane/shared-schema responsibility moved. The final bundle guard changes only standalone activation, not any public execution contract.
A1/A2 proof: T1 settings32, T2 resolver16, T3 policy20, T4 owning generation137, final T5 adapters104. A3 proof: exhaustive340-case lifecycle gate with exact test identities and frozen source hashes. A4 proof: T7 normal build/integration5/installed tarball/types/lint/format, T8 canonical622c4b131bd4193dd3f4d1cc3cc4b10f04c4089a sync and16 wiki tests/content/24links. M1/M2 are removed with A3 exact retirement/recovery/repeat evidence; active migration ledger is empty. Final shared acceptance audit covers all42 criteria. Review and Git publication remain delivery-phase closeout work.
Final review repair conformance: issue224-r1 aligned runtime nested pyproject.toml boundary detection with generation under the existing T2 API. T2 public RED/GREEN14 and refreshed104 adapters passed before T7 build/package execution. T7's5 integration cases now carry the nested Python fixture through package/root/CI, staged gate and all5 provider previews while preserving both source inputs. All8 T7 final gates pass. A1/A4 remain conformant; no new seam, requirement, task owner or migration entry was introduced.
Final issue224-r2/r3 conformance: T5 narrowed only excluded-source failure applicability, preserving raw dependency inputs and authority-bearing configuration. Public RED2/GREEN48 plus109 adapter tests pass; T7 checks8/integration5 include20 generated-provider exclusion cases with missing/stale selection, and final installed-package proof passes. T6 RED/GREEN task fields now point to the original retained evidence and340-case gate. All task and architecture gates are complete; no requirement or public seam changed.
Final settings/runtime review repair wave: T1 (reassigned to the existing CLI worker) owns only project-settings/model.ts, service.ts and service.test.ts to make saved exclusion patterns compatible with the existing normalized runtime contract. T2 owns only managed-lint.mjs and its test to verify the runtime treatment of an owner replaced with a contained wiki/duplicate alias after initial selection. The two write scopes are disjoint. Both use public RED/GREEN and existing types/lint/format gates; no supported-context/source-content requirement is invented. T7 final build/package proof waits for both frozen receipts; parent owns evidence/adjudication reconciliation. Existing canonical-root aliases stay supported; selected child-owner aliases must not bypass hard wiki or duplicate-owner boundaries.
Final T1/T2 repair wave closed: settings15 focused/public saved-byte proof; resolver16; parent shared adapters109; T7 all8 command gates/integration5/installed-package source-byte proof. Canonical root aliases remain supported, child/source aliases cannot bypass exclusions, and saved exclusion syntax matches runtime. No new manager/source eligibility requirement, public seam or active migration entry was added. All task and architecture gates pass at bundled digest8894decd4b0a3baf113c09f078f63367598ea724d58287c6a81e342cbd086db3.
Final policy/alias repair wave: T3 owns managed-lint-policy/index.ts and index.test.ts to preserve native Oxlint inherited JavaScript-plugin semantics and expose the existing script inventory as an internal CLI seam. T4 owns scaffold/managed-lint-generation.ts and its existing generation tests to consume that same inventory for an unselected root, reporting named conflicts for known noncanonical lint aliases without mutating custom commands or creating a root Software Scope. T4 test preparation is disjoint; source integration/checks await T3's frozen seam. Parent native differential proof is /tmp/issue224-native-plugin-proof.json; root alias materialization RED is /tmp/issue224-root-alias-probe.log. Native same-name plugin collision behavior must be measured, not invented. Shared module ownership remains T3 policy/commands and T4 generation; no second shell parser or policy registry is authorized. T7 package proof waits for the completed producer gates.
Final T3/T4 repair wave closed: policy32 with native inherited-plugin differential proof; generation44 with exact root-alias conflict preservation, canonical/legacy delegation and rootless behavior; full producer-refreshed lifecycle340; T7 checks8/integration5/installed-package proof. T3/T4 remain the existing composer/inventory and generation owners; no second parser or root Software Scope was added. All seven accepted findings, T1–T8, A1–A4 and all42 ACs are closed. Final digest 8894decd4b0a3baf113c09f078f63367598ea724d58287c6a81e342cbd086db3. Current proof and skill/rule reconciliation are in IMPLEMENTATION-NOTES.md, section “Final native-policy and root-alias acceptance”.
Completed-review focused repair issue224-r8: T4 retains ownership of context-planning/managed-lint-ci-evidence.ts and scaffold/managed-lint-generation.test.ts. Existing CI matcher now recognizes version-qualified invocations; public RED7/GREEN51 plus current T7 build/integration5/installed-package/types/lint/format proof close AC-027. Prepared in an isolated checkout to preserve the immutable reviewed snapshot, then applied after report retention. No architecture, authorization, public contract, runtime topology or accepted-scope change triggers another full review. All42 ACs, T1–T8 and A1–A4 remain passed; see final focused-repair evidence in IMPLEMENTATION-NOTES.md.
User-requested real-repository validation wave
The user authorized local consumer testing after approving the final hook exception. C1 owns only .devpunks/delivery/issue224/consumer-repos/ci-app and its sibling ci-app-evidence directory; C2 owns only the devpunks-intelligence clone and devpunks-intelligence-evidence directory. Both consume the same frozen built CLI and bundled baseline, depend on the completed r8 repair/build, and may execute concurrently because their write scopes and local dependency caches are disjoint. They record original repository commits, initial missing-selection/conflict behavior, deliberate test scopes, actual adoption/entrypoint/exclusion proof, repeat-update/read-only checks, and exact failures. Clone-local settings/migration experiments are authorized; no consumer remotes, secrets, services, or global tools may be changed. Product-source repairs, if demonstrated necessary, return to the owning implementation task; C1/C2 do not edit producer source. Parent owns acceptance, docs, third/final commit and the single approved push. These are planning-only verification tasks with no provider Task projection.
C1 exposed an AC-020 defect after supported scaffold in a real repository with unresolved migration: explicit wiki-only input returned a stale-selection error before empty-work detection. Root reproduced it. T5 reopens only the managed runner and its public tests for runtime-evidenced repair; shared resolver changes require explicit custody expansion. Raw policy/settings/selection triggers, eligible requests, explicit scope validation and whole-owner health checks remain protected. C2 concurrently owns bounded diagnosis of its separate candidate preparation failure within its clone/evidence. Final package and consumer reruns depend on frozen producer bytes; the parent retains final notes and publication custody. This focused repair preserves accepted requirements and the retained review ordinal.
C1 repair custody expansion: T5 also owns managed-lint.mjs, its declaration and tests for one shared preflight using the existing settings/path/exclusion/dependency authority. No alternate registry is permitted. Only proven irrelevant explicit file work can bypass unrelated selection health; raw authority edits and explicit scope requests retain fail-closed validation.
C2 runtime tracing proved a second bounded defect: 38 planned dependency retirements across eight unselected former owners fail because their valid live manifests are absent from the validation candidate. C2 evidence debug-candidate.ndjson binds each operation to a candidate ENOENT. T6 consumer repair owns features/scaffold-update/validation-plan.ts and its tests, runtime/scripts.ts and its tests, runtime/validation-candidate.ts and its tests, and update/run.ts and its tests as needed to carry complete planned mutation inputs into existing confined candidate preparation. This runs alongside T5 because the file scopes are disjoint. Preserve sparse lint ownership, input confinement, live-tree preservation and fail-closed adoption; no consumer-policy migration or broad source enrollment is authorized. Source freeze, package proof and real C1/C2 reruns wait for both repairs.
C1 rebuilt-consumer authority control exposed one follow-up within the same repair: an unselected root policy named by current migration-conflict evidence was treated as unrelated because adopted routes were empty. T5 reopens its same resolver/runner test scope to preserve known migration-policy input applicability; no new policy inference registry or producer scope is authorized. C2 continues its already-started independent rerun. Final package proof and C1 rerun must consume the subsequent frozen resolver.
T5 follow-up custody includes format-edited-file.mjs and its tests: the hook's old exclusion-specific failure suppression became redundant after shared resolver no-work handling and could hide a known excluded migration-policy failure. Remove that redundant exception using the same shared result; preserve Python and unrelated non-JavaScript independence. No separate hook dependency registry is permitted.
C2's first successful real adoption revealed candidate/live diagnostic disagreement (candidate clean, identical live root/owner routes231 findings on unchanged source). The runtime source worker owns bounded diagnosis and, only after proof, a same-module candidate-input repair in runtime/scripts and validation-candidate plus tests. Hypotheses include missing selected source under a pnpm-only workspace, differing config/tool inputs, or diagnostic loss. T5 hook repair and this runtime investigation have disjoint write scopes. No final adoption-parity claim is made until the same real command is rerun.
Integrated runtime checks found a loader-boundary regression: absent settings and explicit JSON null shared a sentinel, so missing-file selection guidance became a malformed-object message. A disjoint data-loader task owns only managed-lint-runner.mjs and its test to distinguish ENOENT fallback while preserving malformed-null rejection. The existing runtime assertion remains unchanged.
Final consumer frontier closed:141 shared resolver/runner/hook/gate cases,183 runtime/candidate/validation-plan cases, preserved retirement lifecycle witness, five integration/build cases, installed tarball proof, types/scoped lint/format, root static34 and wiki16/content checks pass. Final C1 has28 expected entrypoint results and159 preserved originals. Final C2 candidate/root/owner each report231 findings, single-file edit parity passes, and all5,580 file/link hashes are restored. All focused follow-ups are complete; no new scope, public product contract, architecture drift or migration ledger item remains. Parent proceeds to the already approved third path-limited commit and one push, exact-commit classification and PR readback.