2 Commits

Author	SHA1	Message	Date
Garry Tan	45cc95d5f4	v1.57.5.0 feat: cross-session decision memory + gbrain dream-stage call graph (#1910) ... * feat(gbrain-sync): add cycleCompleted() cycle-state probe Reads `gbrain doctor` cycle_freshness to classify whether a source has completed a full cycle (completed/never/unknown). A fail naming this source -> never; a fail naming only other sources -> completed; an absent or unparseable check -> unknown, so an unrelated doctor failure never masks a real state. Gates the automatic call-graph build on --full. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(gbrain-sync): --dream call-graph stage with lock-free gate + honest outcome guard Adds a source-scoped `gbrain dream --source <id>` stage that builds this worktree's call graph (code-callers/code-callees). Runs lock-free after the sync lock releases so it never blocks sibling worktrees; a .dream-in-progress marker dedupes concurrent dreams. --full auto-runs it only when the cycle was never built; explicit --dream always forces; --no-dream opts out. The stage parses the cycle's own output and reports the truth, not a flat "built": a WARN when the schema pack can't extract code symbols, when the embed phase failed for a missing key, or when 0 edges resolved; OK with the resolved-edge count otherwise. gbrain exits 0 even when it skips on a held cycle lock (e.g. autopilot), so that case reports SKIP, not success. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * chore: ignore gbrain .sources/ local staging dir gbrain writes per-source staging and capability-check artifacts under .sources/ in the repo root. It's machine-local runtime state, not source. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs(gbrain): honest call-graph guidance in /sync-gbrain + pin works on gbrain>=0.41.38 sync-gbrain frames the --dream offer honestly: building a call graph requires a code-aware schema pack, and the dream stage reports a WARN when it can't. The verdict's Call graph row mirrors the dream stage's real outcome instead of assuming a completed cycle means edges exist. The ## GBrain Search Guidance block written into CLAUDE.md drops the old code-callers --source caveat: gbrain >=0.41.38.0 honors the .gbrain-source pin for code-callers/code-callees. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(jsonl-store): shared audited JSONL plumbing (injection-reject + atomic append + tolerant read) Single source of truth extracted for D2A: gstack-learnings-* and the upcoming gstack-decision-* bins share one injection-pattern list, one atomic single-line appender, and one tolerant reader. No more drift between stores. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * refactor(learnings-log): use shared hasInjection from lib/jsonl-store (D2A) Replace the inline injection-pattern copy with the shared list. One audited write-path rejection across learnings + the upcoming decision store. Behavior unchanged (35/35 learnings tests green); learnings-search keeps its inline copy because a structural test pins its bash/bun shape. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(decision): event-sourced decision-memory model (lib/gstack-decision) decide/supersede/redact events on lib/jsonl-store; active set is computed (no mutable status), dangling refs tolerated. Free-text is injection-checked and redact-scanned on write (HIGH secret -> reject). Scope filter (repo/branch/issue) for relevant resurfacing. File-only + reliable; gbrain not required. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(decision): bounded active snapshot + compaction (redact expunges, supersede archives) writeSnapshot/readSnapshot/rebuildSnapshot give an O(active) bounded read for the session-start hot path (D1A). compact() rewrites the log to active, archives superseded decisions for history, and EXPUNGES redacted ones (dropped, never archived) so an accidentally-captured secret leaves the store for good. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(decision): gstack-decision-log + gstack-decision-search bins (non-interactive) Two bins mirroring gstack-learnings-* (D3A). log writes decide/--supersede/--redact/ --compact events + refreshes the bounded snapshot + enqueues for cross-machine sync; search reads the O(active) snapshot, scope-filtered to current branch, newest-first, --all to include superseded, --json for machines. Empty store returns silently (no snapshot write on an empty read). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(memory): surface active decisions at session start + capture nudge (Context Recovery) Context Recovery now shows recent scope-relevant active decisions (bounded read of decisions.active.json via gstack-decision-search) and instructs the agent to treat them as settled calls and to log durable decisions/reversals. Closes the Phase-1 capture->curate->resurface loop, reliable + file-only. Regen across all hosts folded in (squash-with-regen); parity 10/10, freshness green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test: refresh ship golden baselines for the memory-loop preamble change Context Recovery now emits the cross-session-decisions block, so ship's preamble (all hosts) changed. Golden baselines are hand-maintained copies (gen does not write them); refresh them from the fresh gen so golden-file regression passes. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs(memory): document the cross-session decision-memory loop in CLAUDE.md Adds a '## Cross-session decision memory' section: how to resurface (gstack-decision-search) and capture (gstack-decision-log) durable decisions, the supersede/redact/compact verbs, and a crisp durable-vs-trivial definition so the store stays signal. Reliable file-only path; gbrain not required. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(memory): emit durable decisions from ship/ceo/eng/spec at structured points Wires the four skills that finalize real decisions to capture them in the cross-session decision store, from their STRUCTURED outputs (never free-text scraping): - ship: the version bump (level + why) at write time - plan-ceo-review: accepted scope + verdict (branch-scoped) - plan-eng-review: the architecture verdict + key call (branch-scoped) - spec: the filed issue's core approach (issue-scoped) All emits are non-interactive, schema-correct (content in decision/rationale, source=skill, confidence 1-10), and best-effort (|| true) so a decision-log failure never blocks the workflow. Includes regen across hosts + refreshed ship golden baselines. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(memory): optional gbrain --semantic recall for decision search Adds gstack-decision-search --semantic (with --query): appends a 'Related from memory' block from gbrain semantic search, scoped to the curated-memory source. Pure enhancement, reliability-first: a new lib/gstack-decision-semantic.ts is the ONLY decision module that touches gbrain and is imported lazily only on --semantic, so the reliable file path never loads gbrain code. Every path degrades to the reliable file results when gbrain is off, unconfigured, empty, or errors (never throws, 10s timeout). Built against the verified gbrain 0.42.x surface (text output [score] slug -- snippet, NOT JSON; curated-memory source resolved by worktree path, not a gstack-brain-<user> id). Deterministic-contract tests only: parser units, degrade-to-null when gbrain absent, and a fake-gbrain shim proving scope+search end-to-end. find-contradictions deferred (no verifiable CLI surface yet + curated memory not indexed). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(gbrain-sync): self-heal stale autopilot lock (dead-pid) detectAutopilot treated a lock FILE as proof of life, so a crashed gbrain daemon left a stale lock that wedged every sync forever (observed: a dead pid refused --full indefinitely). Now read the holder pid (bare or JSON body) and check liveness via signal-0: ESRCH=dead → ignore the stale signal and keep checking; EPERM=alive (other user) → active. A stale lock never masks a live autopilot process. Pure decision function — does not delete the file; the caller may clean it. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs(review): drop stray trailing code fence in TODOS-format Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(test): align section-loading E2E testNames with their TOUCHFILES keys Pre-existing on main (v1.56.x): the two section-loading E2E tests used human-label testNames ('/ship section-loading') that don't match their slug keys ('ship-section-loading') in E2E_TOUCHFILES/E2E_TIERS. Every other E2E test uses the slug as its testName, and the TOUCHFILES completeness gate requires testName to be a registered key — so the gate was red. Align both testNames to their slug keys (also fixes tier lookup for these two periodic tests). Verified failing on a clean origin/main checkout before the fix. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix: pre-landing review fixes (datamark, DRY, compact, coverage) Addresses the pre-landing review findings (all INFORMATIONAL, no criticals): - security: datamark resurfaced decision text at the render boundary (lib/gstack-decision.ts datamark() — neutralizes code fences, --- banners, <|role|>/</system> markers, control chars, newlines). Applied in gstack-decision-search human output so stored text can't masquerade as instructions in Context Recovery (codex hardening #3 / AC #7). --json stays raw. - DRY: extract resolveSlug/gitBranch/flagValue to lib/bin-context.ts; both decision bins use it instead of duplicating the helpers. - compact(): batch the archive append (one write, not N) and shrink the mid-compact crash window; simplify the opaque branch/issue ternary. - coverage: learnings-log injection rejection (D2A wiring), search --recent/ --scope + NaN-safe --recent, datamark-applied, unparseable lock body, compact-empty, corrupt-snapshot degrade. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(security): close adversarial-review findings in decision memory Adversarial review (Claude subagent) found a CRITICAL the specialist pass missed: - F1 (CRITICAL): 'Human:'/'Assistant:' turn-prefixes bypassed BOTH the write-time denylist AND datamark(), landing verbatim in agent context inside the trusted ACTIVE DECISIONS fence. Add 'human:' (+ 'disregard previous', 'from now on') to the shared denylist, and have datamark() neutralize Human:/Assistant:/System:/User: turn-prefixes (ZWSP) at the render boundary. - F2: datamark() only stripped ASCII C0; extend to Unicode line terminators (U+0085/2028/2029) and U+007F so 'strip newlines' actually holds. - F3: validateDecide blocked only HIGH secrets; MEDIUM-tier PII (e.g. SSN) persisted silently and synced cross-machine. The store is non-interactive (no confirm path), so fail closed on MEDIUM too. - F4: compact() was a lock-free read-modify-rewrite that could clobber a concurrent append (lost decision). Add an O_EXCL compact lock + a pre-rename size recheck that aborts untouched (skipped=true) if an append landed; caller re-runs. - F7: filterByScope unknown/garbage scope fell through to 'return true' (leaked into every context); fail conservative (false). F5 (pid reuse) and F6 (pgrep over-match) are intentionally left as-is: both fail SAFE (over-refuse sync); making them precise would introduce a fail-DANGEROUS path (allowing sync during a real autopilot). True disambiguation needs gbrain to stamp the lock with a start-time, which gstack doesn't own. F8 (compact moves history to archive) is by design. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(security): close cross-model (Codex) adversarial findings Codex adversarial review found a HIGH the Claude pass missed plus 3 mediums: - C1 (HIGH): gstack-decision-search --all returned every decide and IGNORED redact events, so a redacted secret still resurfaced via --all until compact ran. --all now excludes redacted (redact = expunge from every read path), still showing superseded history. - C-med: semantic (external gbrain) slug/snippet were printed raw — datamark them too so a gbrain hit can't spoof role markers / fences into agent context. - C4: semanticRecall fell back to an UNSCOPED gbrain search when no curated-memory source resolved, pulling code/doc corpora mislabeled as 'related decisions'. Now returns null (degrade) when there's no worktree-backed memory source. - C5: validateDecide scanned only decision/rationale/alternatives; branch and issue are stored + surfaced (raw via --json), so include them in the injection+secret scan. C2 (snapshot staleness) / C3 (compact TOCTOU residual): accepted for a single-user store — atomic appends never lose the event, rebuilds self-heal, and the compact size-recheck leaves only a sub-ms window; full append-locking would break the lock-free append design. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * chore: bump version and changelog (v1.57.5.0) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-08 06:20:58 -07:00
Garry Tan	cab774cced	v1.56.0.0 Token-reduction Phase B + AUQ paranoid safety net (#1849) ... * refactor(plan-ceo-review): carve review body into on-demand section Carve the largest skill (138,838 B) into a skeleton + one on-demand section, the documented next Phase B target after /ship (v2_PLAN.md:216). - sections/review-sections.md(.tmpl): the 11-section deep review, codex/ outside-voice rules, how-to-ask, Required Outputs, registries, Completion Summary, Review Log, REVIEW_DASHBOARD, PLAN_FILE_REVIEW_REPORT, Next Steps, docs/designs promotion, Formatting Rules, and the Mode Quick Reference. - sections/manifest.json: passive registry (CM2), one entry. - SKILL.md.tmpl: {{SECTION_INDEX}} after the system audit, a single {{SECTION:review-sections}} STOP-Read after Step 0 mode selection, and a Section self-check. All of Step 0 (the scope/mode conversation) stays in the always-loaded skeleton; only EXIT_PLAN_MODE_GATE follows the section. Measured: always-loaded skeleton 138,838 -> 80,731 B (-42%, ~14.4K tokens off every invocation). Union (skeleton + section) 139,110 B, behavior held. Boundary honors Codex P1: nothing review-governing (formatting rules, mode reference, how-to-ask, required outputs) sits in the skeleton below the STOP. Housekeeping resolvers ride in the section, matching the ship precedent (adversarial.md carries LEARNINGS_LOG + GBRAIN_SAVE_RESULTS). Tests (atomic with the carve — skill-docs.yml gates gen:skill-docs freshness on every push, so source + regen + tests must land together): - parity-harness: plan-ceo flipped to sectioned, maxSkeletonBytes 90_000 (measured 80,731 + headroom); content/minBytes run against the union. - skill-size-budget: plan-ceo-review added to SECTIONS_EXTRACTED. - section-manifest-consistency: generalized to discover every carved skill, vars computed per-skill-case (Codex P2). - skill-ceo-section-ordering (new, gate): per-PR static guard — STOP after Step 0, review body absent from skeleton, report writer in the section, nothing review-governing below the STOP. - skill-e2e-plan-ceo-review-section-loading (new, periodic): refreshes the installed skill first (Codex P1), drives full Step 0, asserts the section is Read before the report. - gen-skill-docs + skill-validation: read the skeleton+sections union for carved skills so relocated prose still counts. - touchfiles: plan-ceo-section-loading registered (periodic). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * chore: bump VERSION + CHANGELOG for plan-ceo-review carve (v1.56.0.0) MINOR: carves the largest skill into skeleton + on-demand section, dropping plan-ceo-review's always-loaded cost 42% (138,838 -> 80,731 B, ~14.4K tokens off every invocation). User-facing release notes lead with the measured token win. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs(todos): file P3 follow-up — carve the shared {{PREAMBLE}} reference blocks Surfaced by /plan-eng-review on the plan-ceo-review carve: per-skill section carves stay modest because the ~40-50KB shared preamble dominates the always-loaded surface. A single preamble-reference carve would help every tier->=2 skill at once. Records the why, the cold-vs-hot split to measure, and the guards it needs. Not implemented this PR. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test(auq): Layer 0 — guarantee AUQ format spec is always-loaded Deterministic, free, per-PR keystone for the token-reduction era. For every interactive (tier>=2) skill, asserts the full AskUserQuestion decision-brief format (ELI10/Recommendation/Pros-cons/checks/Net/(recommended)/Stakes/ self-check) lives in the always-loaded SKILL.md skeleton, NOT only in an on-demand section. Plus a roster guard (a carve can't silently drop the block) and per-skill rule survival in the skeleton+sections union. 51 cases + a negative control. Fails the instant a future carve strands AUQ-governing text where it won't be loaded when a question fires. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test(auq): SDK capture engine + verbose-vs-carved no-degradation A/B Adds the reusable SDK $OUT_FILE capture engine (auq-sdk-capture.ts): drives a skill to its AUQ and captures the verbatim text the model GENERATES, cleanly (real-PTY mangles plan-mode AUQs via cursor escapes). Pins the skill to an absolute path with Read/Write-only tools so the agent can't wander to the global install. gradeAuqRecommendation normalizes a non-"because" connective before grading so substantive reasons aren't false-flagged (without touching the pinned shared judge). The A/B drives the same prompt through the carved 80KB skeleton and the pre-carve 137KB monolith and fails if carved scores worse. Result: both 7/7 format, substance 5 — proven no degradation, transcript-verified each side read its own planted SKILL.md. Periodic tier. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test(auq): consistency — same trigger N runs, stable format + substance Drives the carved /plan-ceo-review AUQ N=3 times and fails if any format element appears in one run but not another, or substance craters. Targets the "fine one run, broken the next" failure class a single snapshot can't see. Result: 3/3 stable, 7/7 + substance 5 every run. Periodic tier. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test(auq): behavioral matrix across AUQ-heavy skills Data-driven test that drives each AUQ-heavy skill (plan-eng/design/devex, office-hours, cso, spec, design-consultation) to its first AskUserQuestion and grades it to the plan-ceo bar: 7/7 decision-brief format + recommendation substance >=4. One case per skill (isolated failures), env-subsettable via AUQ_MATRIX_ONLY. Browser/design-binary skills are intentionally excluded (comparison boards, not format-AUQs; Layer 0 covers their spec). All targeted skills pass 7/7 with substance 4-5. Periodic tier. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test(codex): live recommendation-substance grade for /codex Closes the gap where /codex's synthesis recommendation was only checked statically (template grep) and via fixtures. Drives the real /codex skill over a flawed diff and grades the emitted "Recommendation: ... because ..." line with judgeRecommendation (present/commits/has_because/substance>=4). The named weak spot holds up: substance 5. Periodic tier. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test(auq): deterministic trigger for format-compliance gate A bare /plan-ceo-review against a repo whose work is already implemented makes the model improvise an off-script "what should I review?" scope question that skips the decision-brief format, which the gate test then times out waiting for. Hand it a concrete plan to review (FORCING_FLOOR_CEO) so it reaches the real Step 0 mode-selection AUQ that is the intended format check. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * refactor(office-hours): carve Phase 5+6 into on-demand section Third Phase B carve (v2_PLAN.md:216, after ship and plan-ceo-review). Moves Phase 5 (Design Doc templates) + Phase 6 (tiered relationship handoff) — the session's output + closing tail, only reached after the conversation and alternatives are done — into sections/design-and-handoff.md, behind a single STOP-Read after Phase 4.5. The live conversation (Phases 1-4.5) and the always-run Important Rules stay in the always-loaded skeleton. Measured: always-loaded skeleton 118,280 -> 88,975 B (-24.8%). Union preserved. The carved AUQ is identical to pre-carve (matrix: 7/7 format, substance 5), and Layer 0 confirms the AUQ format spec stays in the skeleton — the AUQ paranoid suite de-risked this carve end to end. Atomic with tests + regen (skill-docs.yml gates gen:skill-docs freshness on every push, so source + regen + tests land together; --host all regenerates the inlined non-Claude variants): - sections/manifest.json: passive registry, one entry. - parity-harness: office-hours flipped to sectioned, maxSkeletonBytes 96_000 (measured 88,975 + headroom); content/minBytes run against the union. - skill-size-budget: office-hours added to SECTIONS_EXTRACTED. - gen-skill-docs + skill-validation: read the skeleton+sections union for office-hours so relocated Phase 5/6 prose still counts. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * chore: bump VERSION + CHANGELOG for office-hours carve + AUQ suite (v1.57.0.0) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * refactor(preamble): carve CJK-escaping manual to on-demand doc The AskUserQuestion format block is inlined into every interactive skill (~33). It carried the full multi-paragraph non-ASCII/CJK escaping manual inline, but that rationale only matters when a question contains CJK text and the operative rule already lives in the always-loaded self-check. Moved the justification to docs/askuserquestion-cjk.md (read on demand); kept the rule + a pointer. Corpus: Claude-host SKILL.md total 3,087,499 -> 3,057,975 B (-29,524 B, ~900 B x ~33 skills). Layer 0 still passes — the core decision-brief format stays always-loaded; only the rare CJK rationale moved. Atomic with the all-host regen (skill-docs.yml freshness gate). VERSION + package.json -> 1.58.0.0. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * refactor(plan-eng-review): carve review body into on-demand section Fourth Phase B carve (v2_PLAN.md:220). Moves the 4-section review (Architecture, Code Quality, Tests, Performance), outside voice, required outputs, and review report — everything after Step 0 scope — into sections/review-sections.md behind a single STOP-Read. Step 0 (scope challenge) and EXIT_PLAN_MODE_GATE stay in the always-loaded skeleton. Measured: skeleton 106,984 -> 54,892 B (-48.7%). Union preserved. Atomic with tests + all-host regen (freshness gate): parity flipped to sectioned (maxSkeletonBytes 62K), plan-eng-review added to SECTIONS_EXTRACTED, gen-skill-docs reads the union for relocated review/TEST_COVERAGE/dashboard prose. Layer 0 green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * refactor(plan-design-review): carve review body into on-demand section Fifth Phase B carve (v2_PLAN.md:220, bundled with plan-eng). Moves the 7 design passes, required outputs, and review report — everything after Step 0 scope and the mockup/rating phase — into sections/review-sections.md behind a STOP-Read. Step 0, Step 0.5 mockups, the rating method, and EXIT_PLAN_MODE_GATE stay in the always-loaded skeleton. Measured: skeleton 112,057 -> 76,024 B (-32.2%). Union preserved. Atomic with tests + all-host regen: parity sectioned (maxSkeletonBytes 82K), added to SECTIONS_EXTRACTED, gen-skill-docs reads the union. Layer 0 green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * refactor(plan-devex-review): carve review body into on-demand section Sixth Phase B carve. Moves the 8 DX passes, required outputs, and review report — everything after the Step 0 DX investigation — into sections/review-sections.md behind a STOP-Read. All of Step 0 (persona, empathy, benchmark, journey trace, roleplay) + the rating method + EXIT_PLAN_MODE_GATE stay always-loaded. Measured: skeleton 110,621 -> 69,658 B (-37%). Union preserved. Atomic with tests + all-host regen: added to SECTIONS_EXTRACTED, gen-skill-docs reads the union. Layer 0 green. (No parity invariant entry for plan-devex-review.) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * chore: bump VERSION + CHANGELOG for plan-* family carves (v1.59.0.0) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test: refresh ship golden baselines + gbrain-detection union after carves Two follow-ups the carve commits should have carried (caught by the full suite, missed by targeted subsets): - ship golden baselines (claude/codex/factory) regenerated: the preamble CJK trim (v1.58) changed ship's always-loaded AskUserQuestion block. - gbrain-detection-override probes the office-hours skeleton+section union: GBRAIN_SAVE_RESULTS moved into sections/design-and-handoff.md when office-hours was carved, so the detection assertions now check both files. Full `bun test` green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test(auq): grade format-compliance gate from SDK capture, not the TUI The real-PTY version grepped the stripAnsi'd interactive AUQ picker. Verified directly that this cannot work: plan-mode AUQs render as a cursor picker whose cursor-positioning escapes stripAnsi can't flatten — the picker renders fine for a human (cursorSeen=45) but the flattened text drops ELI10:/(recommended) and parseNumberedOptions returns 0. The test was grading a lossy projection and failed by construction. Rewritten to drive /plan-ceo-review via the SDK $OUT_FILE capture (the agent writes the verbatim question it would have shown — clean text, no rendering loss) and grade 7/7 format + kind-note + recommendation substance >=4. Same property, reliable, environment-independent; shares the engine with the periodic A/B and matrix evals. Result: 7/7 format, substance 5. Touchfiles key renamed ask-user-question-format-pty -> auq-format-gate (no longer a PTY test). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test: fix carve-broken CI evals (union reads + section fixtures) Two CI eval jobs failed on the carved plan-* skills because they read content that moved into sections/: - llm-judge (skill-llm-eval): runWorkflowJudge sliced SKILL.md between markers like "## Review Sections" / "## CRITICAL RULE" that now live in sections/review-sections.md. The markers vanished from the skeleton, so the judge scored empty/wrong content. Fix: read the skeleton+sections union. Verified: plan-ceo modes / plan-eng sections / plan-design passes all PASS (25/25). - e2e-plan (skill-e2e-plan): setupPlanDir copied only <skill>/SKILL.md into the fixture, not sections/. The carved skill's STOP pointed at a section file that was absent, so the model improvised a compressed report table instead of the canonical "| Review | Trigger | Why | Runs | Status | Findings |". Fix: copy sections/ alongside SKILL.md in all 6 setup sites. Verified: report test PASS, canonical table emitted. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test: copy carved sections into all e2e fixtures (prevent more carve-blind CI fails) Proactive sweep beyond the two CI logs: every e2e test that copies a carved skill's SKILL.md into a temp fixture must also copy its sections/, or the model hits a STOP pointing at a missing section file and improvises/degrades. - skill-e2e.test.ts: plan-ceo/plan-eng/plan-design/office-hours copies across planDir/reviewDir/ohDir/benefitsDir dests now copy sections/. - skill-e2e-plan.test.ts: the office-hours copy + the 4-skill codex-offering loop now copy sections/. - skill-e2e-design.test.ts: plan-design-review copy now copies sections/. - skill-e2e-office-hours.test.ts: both office-hours copies now copy sections/. - skill-e2e-office-hours-brain-writeback.test.ts: GBRAIN_SAVE_RESULTS moved into the section, so check the regenerated skeleton+section UNION for the gbrain put block, ship both into the workdir, and restore both (the section regen was also leaking into the working tree — finally now restores it). ship copies (single-file Step-0 slices) and review/retro (not carved) untouched. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test: migrate section-loading E2E to lossless SDK tool-stream detection The /ship and /plan-ceo-review section-loading tests drove a real PTY and scraped the ANSI screen buffer for sections/<file>.md paths. That silently saw nothing in a Conductor PTY (cursor-positioned tool renders and an unanswered Step 0 question loop both defeat the regex), so both reported read: [] even when the agent did the work. They now run the skill through claude -p (the same SDK path the AUQ matrix uses) and detect section reads from the tool-use stream — Read calls whose file_path contains sections/<file>.md — with no rendering layer to mangle. The run is also hermetic: the freshly-generated worktree skeleton + sections are copied into a throwaway fixture with the absolute path pinned, so the test validates this branch's carve without mutating the user's ~/.claude install. Validated EVALS_TIER=periodic: both pass (plan-ceo Reads review-sections.md; ship Reads review-army.md + changelog.md), ~6.5 min for both vs ~23 min combined on the old PTY path where both were failing. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * chore: consolidate branch to v1.56.0.0 (single MINOR above main) The branch bumped VERSION several times during development (1.56 → 1.57 → 1.58 → 1.59), but none of those landed on main (main is at 1.55.1.0). Per the "never orphan branch-internal versions" discipline, collapse all four into a single 1.56.0.0 entry — one MINOR release covering the whole branch: five skills carved (plan-ceo, office-hours, plan-eng, plan-design, plan-devex), the shared AskUserQuestion preamble CJK trim, and the paranoid AUQ no-degradation test suite + lossless section-loading tests. VERSION and package.json set to 1.56.0.0; main's 1.55.1.0 entry preserved below the consolidated entry. No SKILL.md drift (VERSION is not embedded in generated bodies). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-04 11:14:43 -07:00