Release v0.11.0-dev.4: auto decision contract and coverage

.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "compound-loop",
-  "version": "0.11.0-dev.3",
+  "version": "0.11.0-dev.4",
   "description": "Cross-harness engineering lifecycle skills: design, plan, implement, review, ship, retrospect, and compound knowledge. Distilled from superpowers, compound-engineering, and release-loop.",
   "author": {
     "name": "Jaehoon You"

.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "compound-loop",
-  "version": "0.11.0-dev.3",
+  "version": "0.11.0-dev.4",
   "description": "Cross-harness engineering lifecycle skills: design, plan, implement, review, ship, retrospect, and compound knowledge. Distilled from superpowers, compound-engineering, and release-loop.",
   "license": "MIT",
   "skills": "./skills/",

.gitignore

@@ -17,4 +17,7 @@
 # local state (machine-local, never commit)
 .entirecontext/
 .omc/
+
+# generated artifacts
+/evals/results/
 __pycache__/

CHANGELOG.md

@@ -2,6 +2,20 @@
 
 All notable changes to this project are documented in this file.
 
+## [0.11.0-dev.4] - 2026-09-20
+
+### Added
+- Governed recovery for eligible legacy `archived-incomplete` runs, with pinned backup, authority audit, verified restore, and completion artifacts.
+- Legacy `.release-loop/v1` evidence now transfers, resumes after partial directory copies, rejects unsafe ownership or destination state, and archives with the run.
+- `release-loop --auto` specs and plans now record explicit assumptions, trade-offs, measured costs, and closure evidence, with standalone validators and negative-control coverage.
+
+### Changed
+- Coverage checks bind their production population and mutation denominator to the authoritative release-loop ledger, then report validator, downstream, and stacked recall separately.
+- Legacy handoff and archive contracts now preserve symlink, collision, malformed-ownership, and fixture-identity rejection evidence.
+
+### Fixed
+- CI now rejects prohibited fixture author or committer identities before merge.
+
 ## [0.11.0] - 2026-08-22
 
 ### Added

ROADMAP.md

@@ -66,7 +66,8 @@ Open items registered by retro docs (`docs/retros/`), pushed here per `retrospec
 | Post-merge fix claims retain summarized results but not publisher-owned raw failure and RED/GREEN traces | 2026-08-25 run-artifact-integrity retro (T3) | P2 | Next merged-result failure that creates a follow-up — publish bounded raw output and exact environment observations before citing root cause |
 | Two spec-declared test case names (`legacy_handoff_source_changed`, `legacy_handoff_complete_rerun`) were never implemented; add them to close the SC3/SC4 measurement gap | 2026-08-25 legacy-handoff-contract retro (T2) | P2 | Next change to legacy handoff test cases or spec measurement contract |
 | Add a mid-directory-copy fault injection (`handoff-after-copy-one-file`) to exercise partial-directory recovery directly | 2026-08-25 legacy-handoff-contract retro (T3) | P3 | Next change to handoff fault injection or recovery code |
-| Structured review events must be populated when `completeness: exact` — either use the event system or downgrade to `partial` | 2026-08-25 legacy-handoff-contract retro | P3 | Next review phase that sets `completeness: exact` |
+| ~~Structured review events must be populated when `completeness: exact` — either use the event system or downgrade to `partial`~~ **Done** | 2026-08-25 legacy-handoff-contract retro; resolved 2026-09-20 auto-plan-assumption-tradeoffs retro (T1) | P3 | Resolved: events 1–3 use publisher-owned wrappers, and the ledger explicitly retains `completeness: partial` rather than claiming exact historical coverage |
+| Review re-review verification must be executable rather than manual ledger editing | 2026-09-19 auto-plan-assumption-tradeoffs retro (T2) | P2 | Next change to reviewing or implementing review-event operations — expose a packaged `verify_re_review` path that validates source/result inventories and writes fixed dispositions atomically |
 
 ## Non-goals (re-affirmed)
 

docs/deviations/2026-09-19-auto-design-contract-correction-003.md

@@ -0,0 +1,52 @@
+# Deviation Addendum 003: Auto-design Trade-off Cost Correction
+
+_Recorded 2026-09-19 before implementation resumed._
+
+## Original contract
+
+The approved design at
+`docs/specs/2026-09-19-auto-plan-assumption-tradeoffs-design.md` defined the
+selected auto-only structured contract and its four-column trade-off table.
+
+## Discovered contradiction
+
+The first standalone validator run against the approved design found that the
+selected row's `Measured cost` cell had no numeric quantity. The artifact
+therefore failed the active auto-mode contract even though its rejected rows had
+numeric values.
+
+## Necessity
+
+The selected option must name a quantified, attributed cost. The approved
+artifact remains unchanged as historical evidence. A successor draft records
+the measured count of two standalone validator copies and the command that
+observed it at `2026-09-19T14:05:58Z`.
+
+## Observable behavior
+
+No runtime behavior changes. The successor design only repairs the evidence
+shape required before Architecture and Success Criteria. It does not widen the
+selected scope, interactive gates, migration boundary, or publication boundary.
+
+## Safety and consent boundaries
+
+The correction is local and reversible. It changes no protected branch, ledger
+authority, credential, network target, or external service. The successor must
+receive a fresh human Design approval before planning continues.
+
+## Verification changes
+
+- The successor design passes `validate-auto-artifact.py --mode auto`.
+- Its selected and rejected trade-off rows contain numeric measured costs.
+- The focused harness continues to require numeric costs in every trade-off row.
+- The original approved design remains a historical artifact and is not used as
+the implementation origin after the successor approval.
+
+## Traceability
+
+- Original approved design: commit `44ae6f2c938624bd29ba1c92ef5b2322bd5b1df6`.
+- Finding: first standalone validator run on 2026-09-19.
+- Successor draft: `docs/specs/2026-09-19-auto-plan-assumption-tradeoffs-correction-design.md`.
+- Evidence command: validator-copy count at `2026-09-19T14:05:58Z`.
+- Authority for this artifact shape:
+`docs/solutions/workflow-issues/review-introduced-state-machine-deviation.md`.

docs/deviations/2026-09-19-auto-plan-assumption-inventory-001.md

@@ -0,0 +1,65 @@
+# Deviation Addendum 001: Auto-plan Inventory Recheck
+
+_Recorded 2026-09-19 during Plan preparation._
+
+## Original contract
+
+The approved design at
+`docs/specs/2026-09-19-auto-plan-assumption-tradeoffs-design.md`
+records a live assumption that the repository contains `27` tracked spec files
+and `29` tracked plan files. The evidence command counts both glob sets with
+`git ls-files`.
+
+## Discovered contradiction
+
+The planning Assumption Recheck reran that command exactly at
+`2026-09-19T13:50:38Z`. It returned `spec_count=28` and `plan_count=29`.
+The additional spec is the approved origin artifact itself, which this release
+loop committed after the design measurement. The approved count was a
+pre-feature inventory, while the identical command now includes the new spec.
+
+A bounded follow-up command at `2026-09-19T13:51:10Z` returned
+`tracked_spec_count=28; excluding_origin=27`, using the exact origin path as the
+only exclusion. The pre-feature claim therefore remains reproducible, but the
+unqualified recheck command is no longer a stable comparison after artifact
+creation.
+
+## Necessity
+
+Planning cannot mark the retained claim as an unqualified match after the
+identical command changes. The approved spec must remain unchanged, and the
+plan must preserve the contradiction rather than silently reinterpret the
+measurement. The addendum records the artifact-count lifecycle and supplies a
+bounded comparison for this plan.
+
+## Observable behavior
+
+No product, skill, validator, terminal-output, or compatibility behavior
+changes. The planning record gains one explicit contradiction classification and
+one origin-aware evidence command. Historical specs and plans remain untouched.
+
+## Safety and consent boundaries
+
+The commands read tracked paths only. They perform no network access, file
+mutation, credential access, or outward action. The design approval and the
+implementation-deferred stop condition remain unchanged.
+
+## Verification changes
+
+- The plan's Assumption Recheck records the original command as `contradiction`
+and links this addendum.
+- The plan records the origin-aware count as planning evidence, not as a rewrite
+of the approved design measurement.
+- The focused contract harness must continue to reject missing, blank, and
+unquantified auto-artifact sections; this addendum does not weaken those checks.
+- Repository validation remains required before the draft plan commit.
+
+## Traceability
+
+- Approved spec: commit `44ae6f2c938624bd29ba1c92ef5b2322bd5b1df6`.
+- Contradictory retained command: Assumptions and Preconditions row 2 in the
+approved spec.
+- Planning recheck: first-hand run at `2026-09-19T13:50:38Z`.
+- Corrected bounded evidence: origin-aware count at `2026-09-19T13:51:10Z`.
+- Authority for this artifact shape:
+`docs/solutions/workflow-issues/review-introduced-state-machine-deviation.md`.

docs/deviations/2026-09-19-auto-plan-contract-correction-002.md

@@ -0,0 +1,58 @@
+# Deviation Addendum 002: Auto-plan Assumption Contract Correction
+
+_Recorded 2026-09-19 before implementation resumed._
+
+## Original contract
+
+The approved plan at
+`docs/plans/2026-09-19-001-feat-auto-plan-assumption-tradeoffs-plan.md`
+was intended to carry the approved auto artifact contract into four
+implementation units. Its `Trade-offs` section has the required four-column
+table, and its `Assumption Recheck` section records planning outcomes.
+
+## Discovered contradiction
+
+A pre-implementation contract review found that the approved plan's
+`Assumptions and Preconditions` section used the three-column planning
+`Assumption Recheck` shape instead of the required five-field evidence table:
+claim, exact rerunnable command, observation timestamp, concise result, and
+evidence source. The active auto-mode requirement applies to plans as well as
+specs, so the plan did not satisfy its own front-loaded assumption contract.
+
+## Necessity
+
+Implementation cannot start from an approved plan that fails the active
+artifact contract. The plan body must gain the missing five-field table while
+retaining the separate three-column `Assumption Recheck` authority required by
+`plan/v1`. The plan is corrected and re-sealed before any implementation file
+changes.
+
+## Observable behavior
+
+No runtime or interactive behavior changes. The correction changes only the
+planning artifact's evidence structure and adds no implementation unit,
+validator rule, dependency, or outward action.
+
+## Safety and consent boundaries
+
+The correction is local and reversible. It changes no skill, script, release
+ledger authority, credential, network target, or protected branch. Auto plan
+approval remains bounded by the validator, body seal, and exact progress ledger.
+
+## Verification changes
+
+- The corrected plan contains a five-field `Assumptions and Preconditions`
+table before Architecture notes.
+- The corrected plan retains a separate `Assumption Recheck` section with one
+outcome per retained claim.
+- `validate-plan-frontmatter.py` recomputes the corrected body seal.
+- The implementation harness must validate the same five-field requirement for
+auto specs and plans and must fail when any field is blank or missing.
+
+## Traceability
+
+- Original approved plan: commit `d17ee7e59f9a7e95fc8e24de62c47b420d71195c`.
+- Finding: pre-implementation contract review on 2026-09-19.
+- Affected artifact: `docs/plans/2026-09-19-001-feat-auto-plan-assumption-tradeoffs-plan.md`.
+- Authority for this artifact shape:
+`docs/solutions/workflow-issues/review-introduced-state-machine-deviation.md`.

docs/deviations/2026-09-19-auto-plan-sections-correction-004.md

@@ -0,0 +1,57 @@
+---
+schema: deviation/v1
+title: Auto plan closure sections correction
+date: 2026-09-19
+status: accepted
+---
+
+# Auto plan closure sections correction
+
+## Original contract
+
+The active auto-authoring rule requires every spec and plan to state assumptions,
+trade-offs, non-goals, residual risks, and measurable success criteria. Each
+numeric claim must carry rerunnable command evidence.
+
+## Discovered contradiction
+
+Approved plan `2026-09-19-003-feat-auto-plan-assumption-tradeoffs-final-plan.md`
+contained the required assumptions and trade-offs tables, but it did not contain
+explicit `Non-goals`, `Residual Risks`, or `Success Criteria` sections. Its
+`Deferred to Follow-Up Work`, `Open unknowns`, and scenario tables did not satisfy
+the active section contract.
+
+## Necessity
+
+The plan is an implementation authority. Leaving the omission would allow the
+implementation to pass a weaker contract than the one the user requested.
+The approved body remains immutable, so a successor plan is required.
+
+## Observable behavior
+
+Plan `2026-09-19-003-feat-auto-plan-assumption-tradeoffs-final-plan.md` is marked
+`superseded`. Successor plan
+`2026-09-19-004-feat-auto-plan-assumption-tradeoffs-contract-plan.md` carries
+`mode: auto`, the same approved origin, explicit closure sections, and the same
+implementation units.
+
+## Safety and consent
+
+This correction changes no runtime behavior and modifies no historical artifact.
+It only makes the implementation authority satisfy the active authoring contract.
+The successor plan receives the automatic plan gate because the ledger invocation
+is `--auto`; no outward publish, push, or merge is authorized by this addendum.
+
+## Verification changes
+
+The validator now rejects an auto artifact missing any closure section. The
+focused harness adds negative controls for missing closure sections and empty
+selected or rejected status names. It also rejects duplicate mode entries and
+unsupported validator modes.
+
+## Traceability
+
+- Superseded plan: `docs/plans/2026-09-19-003-feat-auto-plan-assumption-tradeoffs-final-plan.md`
+- Successor plan: `docs/plans/2026-09-19-004-feat-auto-plan-assumption-tradeoffs-contract-plan.md`
+- Implementation contract: `skills/designing/scripts/validate-auto-artifact.py`
+- Regression harness: `scripts/test-auto-artifact-contract.sh`

docs/deviations/2026-09-20-auto-coverage-authority-correction-006.md

@@ -0,0 +1,49 @@
+---
+schema: deviation/v1
+title: Auto coverage authority successor correction
+date: 2026-09-20
+status: accepted
+---
+
+# Auto coverage authority successor correction
+
+## Original contract
+
+The approved coverage design and sealed successor plan must remain immutable
+once the plan approval seal exists. The release ledger must point to the
+approved pair used by Ship.
+
+## Discovered contradiction
+
+A review found that the approved coverage design received a post-plan-seal
+change to assert the ledger's `--auto` flag. That change made the old plan and
+its design origin non-authoritative for exact-head review.
+
+## Necessity
+
+The change must not mutate an approved design after its plan is sealed. The
+immutable authority successor preserves the final command, fixed mutation
+inventory, and ledger population assertion while replacing both predecessor
+artifacts through explicit successor pointers.
+
+## Measurement
+
+The successor design's exact Population and Coverage command ran at
+`2026-09-20T02:51:37Z`. It read the two paths from the ledger, asserted
+`flags == ['[--auto]']`, validated both artifacts, and compared the fixed 17
+mutation labels. It returned 17/17 validator detection, 17/17 harness
+observation, validator recall `1.000`, harness incremental recall `0.000`, and
+stacked recall `1.000`.
+
+## Safety and consent
+
+This correction changes no runtime behavior. It adds no migration requirement.
+The successor remains at the Design gate until fresh user approval, followed by
+a new sealed plan approval and exact-head review.
+
+## Traceability
+
+- Superseded design: `docs/specs/2026-09-20-auto-plan-assumption-tradeoffs-coverage-design.md`
+- Successor design: `docs/specs/2026-09-20-auto-plan-assumption-tradeoffs-coverage-authority-design.md`
+- Superseded plan: `docs/plans/2026-09-20-005-feat-auto-plan-assumption-tradeoffs-coverage-plan.md`
+- Successor plan: `docs/plans/2026-09-20-006-feat-auto-plan-assumption-tradeoffs-coverage-authority-plan.md`

docs/deviations/2026-09-20-auto-goal-coverage-correction-005.md

@@ -0,0 +1,50 @@
+---
+schema: deviation/v1
+title: Auto artifact goal coverage correction
+date: 2026-09-20
+status: accepted
+---
+
+# Auto artifact goal coverage correction
+
+## Original contract
+
+The approved successor design requires executable assumptions, trade-offs,
+closure sections, and negative controls for artifacts written by `--auto`.
+
+## Discovered contradiction
+
+The success criteria proved individual fields and mutations, but they did not
+state the population covered by the goal or require a recall floor. A green
+field-level harness could therefore leave broad artifact coverage unmeasured.
+
+## Necessity
+
+The goal covers every spec and plan produced by the two auto-authoring skills.
+A design that lacks a population and measured coverage cannot prove that its
+implementation attains that goal. The approved design remains immutable, so a
+successor design records the coverage contract and the measured sample.
+
+## Measurement
+
+The rerunnable Population and Coverage command in the successor design ran at
+`2026-09-20T02:38:06Z`. It validated the two artifacts named by the
+authoritative ledger. It tested 17 fixed malformed mutations: the standalone
+validators detected 17/17, the downstream harness observed 17/17, validator
+recall was `1.000`, harness incremental recall was `0.000`, and stacked recall
+was `1.000`. The harness is downstream, so zero incremental recall is expected
+and is not presented as complementary coverage.
+
+## Safety and consent
+
+This correction changes no runtime behavior. It adds no migration requirement
+and does not weaken the auto-only scope. The successor design was approved at
+the Design gate after the measured coverage was reviewed.
+
+## Traceability
+
+- Superseded design: `docs/specs/2026-09-19-auto-plan-assumption-tradeoffs-correction-design.md`
+- Successor design: `docs/specs/2026-09-20-auto-plan-assumption-tradeoffs-coverage-design.md`
+- Measurement command: `bash scripts/test-auto-artifact-contract.sh`
+- Implementation contract: `skills/designing/scripts/validate-auto-artifact.py`
+- Regression harness: `scripts/test-auto-artifact-contract.sh`