Batched 4 strictly-strengthening quick-wins from the membrane land-friction investigation (age-pkrl); each skips no check, adds no fail-open, changes no verdict binding:
- age-jmfl: ScriptRunner injects AO_BIN=self (basename name-guard) so the gate binary is authoritative for sub-checks — kills stale-binary false provenance.chain on the release-authority path.
- age-je8h: deterministic COMMANDS.md — scrub abs paths from generate-cli-reference --help captures + cobra-tree --help-purity test.
- age-jad0: corpus-freshness structural SKIP (exit 75) when its repair tool is absent from the binary — retires the every-land AGENTOPS_CORPUS_FRESHNESS_SKIP ritual.
- age-n8dt: pawl auto-repro cds to the enclosing go.mod (cli/) — kills the wrong-cwd false-REFUTE class.
## What
One-line awk fix + 3 regression tests. Closes `soc-o73v`.
## Why
`scripts/generate-cli-reference.sh` line 60 used POSIX interval
expression `[[:space:]]{2,}`. Older mawk (Ubuntu LTS default,
pre-1.3.4-20240123) **silently rejects** intervals and produces an
empty/14-line `COMMANDS.md` instead of the full 4455-line command
reference.
CI runs on gawk → green. Local dev on Ubuntu mawk → empty file. No
signal until you actually inspected the output.
## Fix
```diff
- /^[[:space:]]{2,}[a-z0-9][a-z0-9-]*([[:space:]]+|$)/ {
+ /^[[:space:]][[:space:]]+[a-z0-9][a-z0-9-]*([[:space:]]+|$)/ {
```
Output is **byte-identical** under both awks. Validated by re-running
the script: `git diff cli/docs/COMMANDS.md` is empty.
## Test coverage
`tests/scripts/generate-cli-reference-portability.bats` (3 tests):
1. **'script does not use POSIX interval expressions ({N,} / {N,M})'** —
regex-greps the script for re-introduction
2. **'command-extraction regex matches indented commands under both
awks'** — runs gawk + mawk against the same fixture and verifies
identical output
3. **'regex does not match single-space indents or unindented lines'** —
guards the intent (≥2-space indent is the signal)
## Discovered
Harvested from `.agents/rpi/next-work.jsonl` set
`discovery-2026-05-12-ddd-hexagonal`, item #4 (low severity). Surfaced
during /evolve cycle 197 on 2026-05-18.
## Validation
- ✅ `bats tests/scripts/generate-cli-reference-portability.bats` — 3/3
PASS
- ✅ `scripts/pre-push-gate.sh --fast` — passed (1 pre-existing warn
unrelated)
- ✅ Byte-identical `COMMANDS.md` output before/after
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Codex <codex@example.invalid>
Cycle 1 of this run had to manually bump the declared count in
docs/cli-skills-map.md from 59 → 60 after regenerating COMMANDS.md.
That manual-bump churn is exactly the failure mode L62[9]
(measurement-command audit pre-push gate) was meant to prevent — the
gate fires correctly on drift, but the maintainer still has to remember
the delta.
Two surfaces:
- scripts/validate-cli-skills-map.sh now accepts --fix. When the
declared count differs from the generated count, --fix rewrites the
count line in-place and re-validates. No-op when counts already
match. Default invocation behavior is unchanged.
- scripts/generate-cli-reference.sh calls --fix after regenerating
COMMANDS.md, so a fresh regen can never leave the count gate red.
--check mode is unchanged (only the actual regen path runs --fix).
Verified:
- bash scripts/validate-cli-skills-map.sh: PASS (60 headings)
- End-to-end: temp-edit cli-skills-map.md to "77 generated", run
scripts/generate-cli-reference.sh, observe the count rewritten to
"60 generated" automatically.
- No production code (.go, hooks/, lib/) touched.
https://claude.ai/code/session_01TELU75xMCP6D2WUFUmLQ8G
Refactor CLI reference generation to recurse through Cobra help subtrees and add a conformance test that keeps cli/docs/COMMANDS.md aligned with the live command tree.
* chore: preserve harvest praxis worktree state
* Release v2.39.0
* fix(tests): align next-work schema test with widened type enum
Commit ed35c47f added `docs` and `chore` to the script's VALID_TYPES,
but tests/scripts/check-next-work-schema-rows.bats:42 still used
`type:"docs"` as its supposed-to-be-rejected example, so the test
now passes through the validator — `bats-tests` has been red on
main since.
Switch the rejected-type example to `finding`, which is still
outside the enum and is also the canonical example cited in the
script's own header comment ("type=finding ... caught at push time").
Local: 11/11 in tests/scripts/check-next-work-schema-rows.bats pass.
* docs: capture finding generator postmortem (#157)
* fix(rpi): sort verdicts deterministically in context and status helpers (#158)
BuildPhaseContext and JoinVerdicts iterated the verdicts map directly,
producing non-deterministic output across runs. Sort keys before
rendering so prompt injection and status logs are reproducible.
Closes council finding W-7 (context-orchestration-leverage batch). The
related buildHandoffContext path was already fixed to delegate to
FormatVerdicts (which sorts); this completes the remaining helpers.
- cli/internal/rpi/status.go: sort keys in JoinVerdicts
- cli/internal/rpi/phased_context.go: sort keys in BuildPhaseContext
- tests: replace "ordering not deterministic" waivers with exact-order
asserts and add a 50-run stability check
https://claude.ai/code/session_01Qw4bZvXUNuLs8Rp1j1homB
Co-authored-by: Claude <noreply@anthropic.com>
* fix(codex): audit noisy hook injections (#159)
* docs: add competitive radar (#160)
* feat(agents): harden operator control plane (#161)
* docs(discovery): plan agents control plane hardening
* feat(agents): harden operator control plane
* Release v2.39.0
* fix(tests): align next-work schema test with widened type enum
Commit ed35c47f added `docs` and `chore` to the script's VALID_TYPES,
but tests/scripts/check-next-work-schema-rows.bats:42 still used
`type:"docs"` as its supposed-to-be-rejected example, so the test
now passes through the validator — `bats-tests` has been red on
main since.
Switch the rejected-type example to `finding`, which is still
outside the enum and is also the canonical example cited in the
script's own header comment ("type=finding ... caught at push time").
Local: 11/11 in tests/scripts/check-next-work-schema-rows.bats pass.
* docs: capture finding generator postmortem (#157)
* fix(rpi): sort verdicts deterministically in context and status helpers (#158)
BuildPhaseContext and JoinVerdicts iterated the verdicts map directly,
producing non-deterministic output across runs. Sort keys before
rendering so prompt injection and status logs are reproducible.
Closes council finding W-7 (context-orchestration-leverage batch). The
related buildHandoffContext path was already fixed to delegate to
FormatVerdicts (which sorts); this completes the remaining helpers.
- cli/internal/rpi/status.go: sort keys in JoinVerdicts
- cli/internal/rpi/phased_context.go: sort keys in BuildPhaseContext
- tests: replace "ordering not deterministic" waivers with exact-order
asserts and add a 50-run stability check
https://claude.ai/code/session_01Qw4bZvXUNuLs8Rp1j1homB
Co-authored-by: Claude <noreply@anthropic.com>
* fix(codex): audit noisy hook injections (#159)
* docs: add competitive radar (#160)
* fix(merge): drop unused AgentsDoctorError ref and prune allowlist entries without production refs
---------
Co-authored-by: Claude <noreply@anthropic.com>
* refactor(cli): go cli quality discovery batch (gc-bridge, json contracts, leaf-help smoke) (#162)
* docs: add go cli quality discovery plan
* fix(cli): harden gc bridge version parsing
* docs(go): align complexity policy with gates
* docs(cli): classify command surface
* fix(cli): enforce json output contracts
* feat(cli): expand completion coverage
* refactor(cli): pilot badge options writer
* refactor(cli): inject contradict output writer
* refactor(cli): inject notebook update writer
* fix(cli): enable gc runtime smoke coverage
* fix(cli): align gc bridge with gascity v1
* Release v2.39.0
* fix(tests): align next-work schema test with widened type enum
Commit ed35c47f added `docs` and `chore` to the script's VALID_TYPES,
but tests/scripts/check-next-work-schema-rows.bats:42 still used
`type:"docs"` as its supposed-to-be-rejected example, so the test
now passes through the validator — `bats-tests` has been red on
main since.
Switch the rejected-type example to `finding`, which is still
outside the enum and is also the canonical example cited in the
script's own header comment ("type=finding ... caught at push time").
Local: 11/11 in tests/scripts/check-next-work-schema-rows.bats pass.
* docs: capture finding generator postmortem (#157)
* fix(rpi): sort verdicts deterministically in context and status helpers (#158)
BuildPhaseContext and JoinVerdicts iterated the verdicts map directly,
producing non-deterministic output across runs. Sort keys before
rendering so prompt injection and status logs are reproducible.
Closes council finding W-7 (context-orchestration-leverage batch). The
related buildHandoffContext path was already fixed to delegate to
FormatVerdicts (which sorts); this completes the remaining helpers.
- cli/internal/rpi/status.go: sort keys in JoinVerdicts
- cli/internal/rpi/phased_context.go: sort keys in BuildPhaseContext
- tests: replace "ordering not deterministic" waivers with exact-order
asserts and add a 50-run stability check
https://claude.ai/code/session_01Qw4bZvXUNuLs8Rp1j1homB
Co-authored-by: Claude <noreply@anthropic.com>
* fix(codex): audit noisy hook injections (#159)
* docs: add competitive radar (#160)
* feat(agents): harden operator control plane (#161)
* docs(discovery): plan agents control plane hardening
* feat(agents): harden operator control plane
* Release v2.39.0
* fix(tests): align next-work schema test with widened type enum
Commit ed35c47f added `docs` and `chore` to the script's VALID_TYPES,
but tests/scripts/check-next-work-schema-rows.bats:42 still used
`type:"docs"` as its supposed-to-be-rejected example, so the test
now passes through the validator — `bats-tests` has been red on
main since.
Switch the rejected-type example to `finding`, which is still
outside the enum and is also the canonical example cited in the
script's own header comment ("type=finding ... caught at push time").
Local: 11/11 in tests/scripts/check-next-work-schema-rows.bats pass.
* docs: capture finding generator postmortem (#157)
* fix(rpi): sort verdicts deterministically in context and status helpers (#158)
BuildPhaseContext and JoinVerdicts iterated the verdicts map directly,
producing non-deterministic output across runs. Sort keys before
rendering so prompt injection and status logs are reproducible.
Closes council finding W-7 (context-orchestration-leverage batch). The
related buildHandoffContext path was already fixed to delegate to
FormatVerdicts (which sorts); this completes the remaining helpers.
- cli/internal/rpi/status.go: sort keys in JoinVerdicts
- cli/internal/rpi/phased_context.go: sort keys in BuildPhaseContext
- tests: replace "ordering not deterministic" waivers with exact-order
asserts and add a 50-run stability check
https://claude.ai/code/session_01Qw4bZvXUNuLs8Rp1j1homB
Co-authored-by: Claude <noreply@anthropic.com>
* fix(codex): audit noisy hook injections (#159)
* docs: add competitive radar (#160)
* fix(merge): drop unused AgentsDoctorError ref and prune allowlist entries without production refs
---------
Co-authored-by: Claude <noreply@anthropic.com>
* fix(merge): resolve conflicts by taking PR's refactored contradict/codex_runtime, main's overnight test schema
---------
Co-authored-by: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
boshu