release(v8.5.0): Advertised-Accept-Set Conformance + agnosticism codification + P0 safety hardening

.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "simple-workflow",
   "description": "The Claude Code plugin for an end-to-end AI development workflow — ticket management, multi-agent code review, security audit, and automated PR creation — built on a Harness for long-running AI agents with strict context management and cross-session learning.",
-  "version": "8.4.2",
+  "version": "8.5.0",
   "author": {
     "name": "aimsise",
     "url": "https://github.com/aimsise"

.github/workflows/ci.yml

@@ -16,7 +16,7 @@ jobs:
     steps:
       - uses: actions/checkout@v5
       - name: Run ShellCheck on hooks
-        run: shellcheck --severity=warning hooks/*.sh
+        run: shellcheck --severity=warning hooks/*.sh hooks/lib/*.sh
       - name: Run ShellCheck on tests
         run: shellcheck --severity=warning tests/*.sh tests/helpers/*.sh
 

ARCHITECTURE.md

@@ -15,7 +15,7 @@ Treats the context window as a consumable resource and systematically conserves
 
 A **Generator** writes code, independent **Evaluators** verify it, and failures trigger automatic retry with specific feedback — up to 9 rounds by default (configurable per invocation or per ticket via policy). The information firewall is asymmetric: Evaluators never see the Generator's self-assessment and judge solely from `git diff` and test results, while the Generator does receive Evaluator feedback on retry.
 
-Even though both sides run the same model, **weights × context = output** — by excluding the Generator's trial-and-error history from the Evaluator's context, sunk-cost bias is structurally eliminated rather than merely discouraged by prompt. FAIL-CRITICAL violations halt execution immediately, and after ticket completion evaluation logs feed into the Knowledge Base, closing a cross-session feedback loop.
+The two sides may run different models by policy — the Generator is always opus, while Evaluators are sonnet by default and escalate to opus for critical or exhaustive work — so independence is enforced by **context separation (the information firewall)**, not by weight uniformity: excluding the Generator's trial-and-error history from the Evaluator's context eliminates sunk-cost bias structurally rather than merely discouraging it by prompt. FAIL-CRITICAL violations halt execution immediately, and after ticket completion evaluation logs feed into the Knowledge Base, closing a cross-session feedback loop.
 
 ## Knowledge Base (Cross-Session Learning)
 

CHANGELOG.md

@@ -5,6 +5,34 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [8.5.0] — 2026-06-20
+
+**TL;DR.** Adds **Advertised-Accept-Set Conformance (AASC)** — a product-/language-/domain-agnostic meet-or-beat upgrade to verification. When a boundary advertises **strict / canonical / lossless / limit** (or shares an input class with a sibling), the `ac-evaluator` now **EXECUTES** a generative grammar-complement sweep in scratch and diffs the unit's accept-set against an **independent hand-coded oracle** — catching parse-accepted overflow, input-alphabet leaks (incl. astral Unicode digits), non-canonical accepts, and structural-key / prototype-pollution injection **by construction for all inputs**, instead of by recalling a product-specific keyword cue. A new recognition-independent PostToolUse hook (`hooks/accept-set-verify.sh`) deterministically gates the persisted sweep and **enforces by default**. This release also codifies the product/language/domain-**agnosticism** rules (the (A)/(B) substrate line + the meet-or-beat principle + the `CT-DECONTAM-1` product-instance recidivism guard) and lands the P0 safety / state-machinery hardening batch. Validated across dogfood43→53: a deliberately leak-inviting strict subject produced correct strict artifacts on every historically-failing trap, and a live `decision:block` de-risk confirmed the enforce path. Additive + kill-switched: `constraints.accept_set_conformance: off` or `SW_ACCEPT_SET_CONFORMANCE_MODE=off` reverts byte-for-byte to the pre-v8.5.0 read-only strictness reasoning.
+
+### Added
+
+- **Advertised-Accept-Set Conformance — the executed accept-set sweep.** For an AC whose boundary advertises strict / canonical / lossless / limit OR belongs to a `shared_input_boundary` sibling family, the `ac-evaluator` derives a per-boundary **Grammar Card** (`A` alphabet / `U` unicode-transform / `W` canonical-writer / `K` keyed-structure) and EXECUTES four machine-generated metamorphic relations black-box in `.simple-workflow/scratch/` against an independent hand-coded spec oracle: **MR-FINITE** (parse-accepted overflow), **MR-ALPHABET** (the Unicode decimal-digit-property complement across the BMP **and** astral planes — generator names no script/codepoint), **MR-CANONICAL** (non-canonical accept), **MR-KEYFAITH** (a reserved/accessor/private-slot key derived by reflection over the type/prototype — generator names no key literal). A divergence is force-FAILed only under a two-tier oracle-authoritative gate (otherwise advisory `[MEDIUM]`, fail-open where no runnable artifact exists). One unconditional `## Accept-set sweep` line per inspected boundary is persisted to `eval-round-{n}.md` (`boundary= triggered= ran= astral= corpus-size= divergences= authoritative= caveat=`). A worked copyable shape lives in `skills/impl/references/accept-set-conformance-harness.md`; committed proof prototypes in `design-oracles/aasc-accept-set/` and `design-oracles/aasc-keyfaith/` (verified `node` + `python3`). Guarded by **CT-AASC-1..14**.
+- **Per-AC deterministic AASC trigger + `constraints.accept_set_conformance` kill switch.** `/impl` Step 15 computes, per AC, whether the boundary advertises strict/canonical/lossless/limit (lexical) OR is a shared-input sibling (a keyed-structure-from-untrusted-input always triggers the K axis), inlines `Accept-set conformance: {auto|off} triggered-on={ids}` into the evaluator spawn, and emits `[ACCEPT-SET-TRIGGER]` — so the evaluator never re-decides whether to run the sweep (removing the run-to-run recognition variance). The per-brief `constraints.accept_set_conformance` field is documented symmetrically across all three spawner surfaces (`policy-template.md`, `autopilot-policy-reference.md`, `ac-evaluator-orchestration.md`); **CT-AASC-14**.
+- **AASC determinism hook (`hooks/accept-set-verify.sh`).** A recognition-independent `PostToolUse(Write|Edit)` gate that reads the persisted `## Accept-set sweep` line and applies the lens's own self-incrimination rule with zero model recall: a triggered boundary not run (P1), an A/U-axis sweep that skipped the astral complement (P2), or an authoritative divergence not driven to FAIL (P4) emits a `decision:block`; a thin A/U corpus (P3) is advisory-only. Fail-OPEN (exit code always 0; jq-missing / non-eval path / skeleton / `n/a` all pass). Env knobs `SW_ACCEPT_SET_CONFORMANCE_MODE` + `SW_AASC_CORPUS_FLOOR`. Verified by `tests/test-accept-set-verify.sh` (**32/32**) and registered via **CT-AASC-13**.
+- **Product/language/domain agnosticism codification.** `CLAUDE.md` gains the **(A) user-product / (B) harness-own substrate line**, the *agnosticism must never lower quality* (meet-or-beat) rule, and the HARD-LINE-vs-JUDGMENT enforcement boundary. **CT-DECONTAM-1** is a product-instance recidivism guard over the 14-file normative set (denylist = product instances only; abstract failure-class names + bare domain vocabulary are deliberately kept), and the normative content was de-contaminated of product-specific cues.
+- **Cross-ticket `shared_input_boundary` sibling-guard (P-A).** The planner / ticket-evaluator forward a shared-input-class signal so a delegating sibling's boundary is recognized (it triggers the accept-set sweep even with no lexical strict/canonical word present).
+- **Safety / state-machinery hardening (P0 batch).** New `hooks/pre-bash-contract-guard.sh` (Bash-mediated state-mutation guard, `SW_BASH_STATE_GUARD_MODE`); jq-missing (`SW_SAFETY_JQ_MISSING_MODE`) and HOOK_OWNED_FIELDS (`SW_STATE_FIELD_GUARD_MODE`) guards across `pre-bash`/`pre-write`/`pre-edit-safety`; `hooks/lib/parse-state-file.sh` element-scoped state parsers; `autopilot-continue` loop-guard de-pollution + `post-ship-state-auto-compact` Gate 5.5 integrity self-heal (`SW_POST_SHIP_INTEGRITY`). New suites `tests/test-pre-bash-contract-guard.sh`, `tests/test-state-parsers.sh`, `tests/test-autopilot-continue.sh` + safety-guard additions.
+
+### Changed
+
+- **AASC determinism hook promoted to enforce (`on`) by default.** After dogfood51/52 (14 real conformant eval reports → 0 false-trips) + a live `decision:block` de-risk (dogfood53: the block surfaced cleanly, the model handled it gracefully without thrash and was not pressured into fabricating a conformant line), the `SW_ACCEPT_SET_CONFORMANCE_MODE` default flipped `metric-only` → `on`. Set `metric-only` to observe-only or `off` to disable. Non-breaking: this is the initial default of a new feature with a kill switch, not a change to any prior released behaviour.
+
+### Fixed
+
+- **AASC hook robustness (dogfood51/52 confirmation + pre-release audit).** The `## Accept-set sweep` header is now matched at any hash depth (`#{1,6}`) and case-insensitively (was `## `-only / case-sensitive, which let a mis-leveled / mis-cased header skip a whole report); fields parse whitespace-bounded (tab-separated lines no longer dodge); the line selector is order-independent; an off-grammar boundary label emits a stderr WARN (not a block). The **P3 corpus floor was demoted from blocking to advisory** — corpus-size is a weak depth proxy and flooring it false-tripped legitimately-thin-but-conformant sweeps; the astral check (P2) is the real A/U depth gate.
+- **EC-taxonomy uniformity.** `evidence-channels.md` no longer carries the stale "MR-KEYFAITH is ASSUMED / advisory-only" posture (folded into the same two-tier oracle-authoritative FAIL gate as the other relations, matching the `ac-evaluator` twins + harness doc); **CT-AASC-10** now also scans `evidence-channels.md` so the sibling-artifact uniformity rule is mechanized.
+
+### Verification
+
+- `bash tests/test-skill-contracts.sh` **852/852** (+ **CT-AASC-1..14**, **CT-DECONTAM-1**, **CT-EV-PANEL-ROBUST**, twin byte-identity **CT-EV-MODEL-1**); `bash tests/test-accept-set-verify.sh` **32/32**; `bash tests/test-path-consistency.sh` **144/144**; `shellcheck --severity=warning` clean on the new hook + tests; `ac-evaluator` / `ac-evaluator-hi` bodies byte-identical sans `name:` / `model:`. `plugin.json` `8.5.0` == newest CHANGELOG `[8.5.0]` (CT-MODE-14), real ISO date (CT-MODE-13).
+- **Dogfood evidence.** dogfood52 (a leak-inviting strict-numeric + keyed + canonical/delegating subject built on the exact historically-failing traps) → the harness produced correct strict artifacts on every trap (impl explicitly avoided the `\d`-without-`re.ASCII` Unicode-digit trap), the AASC chain fired on all 3 tickets with genuinely-executed astral-inclusive sweeps and zero stand-downs, and an independent re-probe found 0 leaks; dogfood53 → a live `decision:block` on a fault-injected non-conformant report, handled gracefully.
+- **Additive + kill-switched.** `constraints.accept_set_conformance: off` (or `SW_ACCEPT_SET_CONFORMANCE_MODE=off`) reverts byte-for-byte to the pre-v8.5.0 read-only strictness reasoning; the determinism hook is fail-OPEN (exit code always 0) and structurally cannot remove a catch the prior harness had. The safety/state hardening guards ship at their documented defaults with `SW_*_MODE` kill switches.
+
 ## [8.4.2] — 2026-06-11
 
 **TL;DR.** Fixes a manual-mode dead-end on the `/autopilot` path. A brief created with `chain: off` (manual mode) intentionally never receives a per-ticket `autopilot-policy.yaml` (Step W-8 skips propagation), yet `/autopilot` Phase 1 step 3 used to `[WARN] ... only brief-level policy is in effect` and continue — after which the three per-ticket Policy guards (which have no brief-level fallback) aborted every ticket. `/autopilot` on a manual brief now hard-stops once at the entry with an actionable re-propagation directive, and `/brief`'s manual-flow guidance names the prerequisite before advertising the autopilot switch. Surfaced by the follow-up #2 live `/autopilot` validation; the original "`/create-ticket` policy-copy is broken" framing was a non-bug (W-8's manual skip is spec-correct and `[POLICY-PROPAGATION] skipped: brief mode=manual`-pinned) — the real defect was the downstream WARN-and-continue that stranded the run.