diff --git a/.vscode/settings.json b/.vscode/settings.json new file mode 100644 index 00000000..afc9121c --- /dev/null +++ b/.vscode/settings.json @@ -0,0 +1,8 @@ +{ + "cSpell.words": [ + "AILOG", + "dbus", + "frontmatter", + "straymark" + ] +} \ No newline at end of file diff --git a/CHANGELOG.md b/CHANGELOG.md index 7602134c..9f68bb5a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,24 @@ and this project uses [independent versioning](README.md#versioning) for Framewo --- +## Framework 4.33.0 — 2026-07-08 + +### Fixed (Framework) + +- **`straymark-audit-execute`: the auditor identity is now operator-provided, never + self-detected.** Router CLIs (Qwen Code, Gemini CLI, …) inject a product identity by + system prompt, so auditors would write `auditor: qwen-code` even after the operator + confirmed a different backend model was selected via `/model` — corrupting attribution + and faking cross-family agreement in the review step. Step 2 was rewritten to make the + operator-provided identity authoritative (via an optional second argument + `/straymark-audit-execute ` or an in-chat statement), to + forbid substituting the CLI product name, and to add a mandatory post-write guard that + verifies the `auditor:` frontmatter and the report header match the provided slug. + Applied across all four shipped copies (`.agent` workflow + `.claude`/`.gemini`/`.codex` + skills). Self-detection remains only as a fallback when the operator provides nothing. + +--- + ## Framework 4.32.0 — 2026-06-28 Audit-prompt **v1.1**: a verification-fidelity pass on the unified audit prompt diff --git a/README.md b/README.md index 03780282..894484c0 100644 --- a/README.md +++ b/README.md @@ -277,7 +277,7 @@ StrayMark uses independent version tags for each component: | Component | Tag prefix | Example | Includes | | --- | --- | --- | --- | -| Framework | `fw-` | `fw-4.32.0` | Templates (12 types), governance, directives, Charter template + schema | +| Framework | `fw-` | `fw-4.33.0` | Templates (12 types), governance, directives, Charter template + schema | | CLI | `cli-` | `cli-3.30.0` | The `straymark` binary | | Loom (EXPERIMENTAL) | `loom-` | `loom-0.4.2` | The `straymark-loom` visualization server, downloaded on demand by `straymark loom serve` | diff --git a/cli/tests/audit_skill_test.rs b/cli/tests/audit_skill_test.rs index dc99efc1..1c822ade 100644 --- a/cli/tests/audit_skill_test.rs +++ b/cli/tests/audit_skill_test.rs @@ -397,8 +397,7 @@ fn straymark_audit_execute_three_platforms_share_core_guidance() { "skill must read the unified audit prompt" ); assert!( - body.contains("report-.md") - || body.contains("report-.md"), + body.contains("report-.md"), "skill must write the report at the keyed path" ); @@ -411,10 +410,16 @@ fn straymark_audit_execute_three_platforms_share_core_guidance() { "skill must handle the optional-argument auto-discovery case" ); - // D14: model-slug detection. + // D14: auditor identity is operator-provided (never self-detected) and slugified. assert!( - body.contains("model identifier") && body.contains("slug"), - "skill must explain how to detect and slugify the model identifier" + body.contains("operator") && body.contains("slug"), + "skill must explain the operator-provided auditor identity and how to slugify it" + ); + // The identity fix: the CLI is a router, not the model — never substitute the + // CLI product name for the operator-provided auditor id. + assert!( + body.contains("router, not the model"), + "skill must forbid substituting the CLI product name for the auditor identity" ); // The wait warning — load-bearing for parallel-CLI workflows. diff --git a/dist/.agent/workflows/straymark-audit-execute.md b/dist/.agent/workflows/straymark-audit-execute.md index c8388251..4e823384 100644 --- a/dist/.agent/workflows/straymark-audit-execute.md +++ b/dist/.agent/workflows/straymark-audit-execute.md @@ -20,46 +20,49 @@ The skill is the second step of the v1 audit cycle: ### 1. Resolve the Charter -The argument is optional. Two cases: +Two positional arguments: `` and an optional `` — e.g. `/straymark-audit-execute CHARTER-06 deepseek-v4-pro`. The second argument is the operator-provided auditor identity (see step 2); it is never inferred from the CLI you are running in. -**Case A — argument provided** (`/straymark-audit-execute CHARTER-04`): -Use the literal value. Construct the audit dir path: `.straymark/audits/CHARTER-04/`. +**Case A — Charter provided** (`/straymark-audit-execute CHARTER-04 [AUDITOR-SLUG]`): +Use the literal Charter value. Construct the audit dir path: `.straymark/audits/CHARTER-04/`. -**Case B — argument omitted** (`/straymark-audit-execute`): -Auto-discover pending prompts. Detect this auditor's model identifier (see step 2 for how) and produce its slug. Then: +**Case B — Charter omitted** (`/straymark-audit-execute`): +Auto-discover pending prompts. Resolve the auditor identity (step 2 — from the argument or the operator) and produce its slug. Then: ```bash # List all audit prompts that exist ls .straymark/audits/*/audit-prompt.md 2>/dev/null ``` -For each found `.straymark/audits//audit-prompt.md`, check whether a report from this model already exists at `.straymark/audits//report-.md`. The set of "pending" prompts is the ones WITHOUT a corresponding report. +For each found `.straymark/audits//audit-prompt.md`, check whether a report from this model already exists at `.straymark/audits//report-.md`. The set of "pending" prompts is the ones WITHOUT a corresponding report. - **Exactly one pending** → proceed with that CHARTER-ID, announcing the choice to the operator. - **Multiple pending** → list them numerically with their Charter titles (read the title from the resolved prompt's `# Auditoría de Charter — CHARTER-NN` heading) and ask the operator to pick one. - **None pending** → message: "No pending audit prompts for this model under `.straymark/audits/`. Either the operator has not run `/straymark-audit-prompt` in the main agent yet, or all the prompts already have a report from this model. Verify with the operator." -### 2. Detect this auditor's model identifier +### 2. Determine the auditor identity — the operator sets it, never self-perception -Identify the model running this CLI session and produce a filesystem-safe slug. +**The `auditor:` identity is authoritative input from the operator, not something you infer about yourself.** Resolve it, in priority order: -The operator will know the canonical model id of the auditor running this skill (for example `claude-sonnet-4-6`, `claude-opus-4-7`, `gemini-2.5-pro`, `gpt-5.3-codex`, `copilot-v1.0.40`). Slug rules: +1. **Second argument** — `/straymark-audit-execute ` (e.g. `/straymark-audit-execute CHARTER-06 deepseek-v4-pro`). +2. **What the operator states in chat** — "I selected model X", "seleccioné el modelo X", "identify as X", "use X". The CLI you run inside (Qwen Code, Claude Code, Gemini CLI, Copilot CLI, …) is a **router, not the model**: it routes prompts to a backend LLM the operator picks via `/model` and confirms in the status bar. The `auditor:` field must name that **backend model** (e.g. `glm-5-2`, `qwen3-7-max`, `deepseek-v4-pro`), which routinely differs from the CLI's product name. + +Use whatever the operator provides **verbatim** (after slugging). You are **forbidden** to introspect, guess, or substitute the CLI/runtime product name. Writing any identifier other than the operator-provided one — **including the name of the CLI you are running in (`qwen-code`, `gemini-cli`, `claude-code`, `copilot`, …)** — is a **defect** that silently corrupts the review step (wrong attribution, false cross-family agreement). Do not refuse a legitimate operator-specified identifier: the operator is the sole authority on which backend model they selected. + +Slug rules (applied to the provided string): - Lowercase ASCII. - Replace any character that isn't `[a-z0-9-]` with `-`. - Collapse consecutive dashes to one. - Trim leading/trailing dashes. -Examples: - -| Model identifier | Slug | +| Operator-provided identifier | Slug | |---|---| | `claude-sonnet-4-6` | `claude-sonnet-4-6` | | `gemini-2.5-pro` | `gemini-2-5-pro` | +| `deepseek-v4-pro` | `deepseek-v4-pro` | | `gpt-5.3-codex` | `gpt-5-3-codex` | -| `copilot-v1.0.40` | `copilot-v1-0-40` | -If the runtime does not expose the model identifier directly, ask the operator to confirm before proceeding. Do NOT fabricate a slug — collisions or wrong identifiers corrupt the review step. +**Fallback — only if the operator provided no identifier by either route:** ask them for the backend model id before proceeding. Do NOT fabricate a slug, and do NOT fall back to your CLI product name — collisions or wrong identifiers corrupt the review step. ### 3. Read the audit prompt @@ -85,7 +88,7 @@ Track how many `path:line` citations you accumulate — it goes in the report fr Output path: ``` -.straymark/audits//report-.md +.straymark/audits//report-.md ``` If a report at that exact path already exists (re-run on the same Charter with the same model), warn the operator before overwriting. The default is to overwrite — re-runs replace stale reports rather than coexist with them. @@ -97,7 +100,7 @@ The report frontmatter MUST conform to `audit-output.schema.v0.json`: ```yaml --- audit_role: auditor -auditor: # e.g., claude-sonnet-4-6 +auditor: # operator-provided model id — NEVER the CLI product name (qwen-code, gemini-cli, …) charter_id: git_range: "" prompt_used: audit-prompt.md @@ -115,12 +118,14 @@ audit_quality: high | medium | low # (body following the format declared in the prompt's "Formato de salida" section) ``` +**Guard — verify the identity before you finish (mandatory).** Re-open the file you just wrote and confirm that BOTH the frontmatter `auditor:` field AND the report's `# Auditoría: por ` header equal the operator-provided slug exactly. If either shows anything else — especially the CLI product name you are running in (`qwen-code`, `gemini-cli`, …) — rewrite them. The filename `report-.md`, the `auditor:` field, and the header must all carry the same operator-provided slug. + ### 6. Notify the operator — with the wait warning After writing the report, print this message verbatim (substituting ``, ``, and the finding count): ``` -Audit complete for (this auditor: ). +Audit complete for (this auditor: ). Report: .straymark/audits//report-.md Findings: total () diff --git a/dist/.claude/skills/straymark-audit-execute/SKILL.md b/dist/.claude/skills/straymark-audit-execute/SKILL.md index 5c660004..ca26242c 100644 --- a/dist/.claude/skills/straymark-audit-execute/SKILL.md +++ b/dist/.claude/skills/straymark-audit-execute/SKILL.md @@ -2,7 +2,7 @@ name: straymark-audit-execute description: Execute an external audit of a Charter inside an auditor-side CLI (gemini-cli, claude-cli, copilot-cli, codex-cli). Reads the resolved audit prompt from the canonical location, audits with tool use, writes the report. Operator invokes one instance per CLI. allowed-tools: Read, Write, Glob, Grep, Bash(go vet *, go build *, go test *, cargo check *, cargo clippy *, cargo test --no-run, npm run lint, npm run typecheck, npm test --, pytest --co, mypy *, ruff check *, ls *, find *, wc *, git log *, git diff *, git status *) -argument-hint: "CHARTER-NN (optional — auto-discovers pending prompts)" +argument-hint: "CHARTER-NN [AUDITOR-SLUG] (auditor id is operator-provided, never self-detected)" --- # StrayMark Audit Execute Skill @@ -23,46 +23,49 @@ The skill is the second step of the v1 audit cycle: ### 1. Resolve the Charter -The argument is optional. Two cases: +Two positional arguments: `` and an optional `` — e.g. `/straymark-audit-execute CHARTER-06 deepseek-v4-pro`. The second argument is the operator-provided auditor identity (see step 2); it is never inferred from the CLI you are running in. -**Case A — argument provided** (`/straymark-audit-execute CHARTER-04`): -Use the literal value. Construct the audit dir path: `.straymark/audits/CHARTER-04/`. +**Case A — Charter provided** (`/straymark-audit-execute CHARTER-04 [AUDITOR-SLUG]`): +Use the literal Charter value. Construct the audit dir path: `.straymark/audits/CHARTER-04/`. -**Case B — argument omitted** (`/straymark-audit-execute`): -Auto-discover pending prompts. Detect this auditor's model identifier (see step 2 for how) and produce its slug. Then: +**Case B — Charter omitted** (`/straymark-audit-execute`): +Auto-discover pending prompts. Resolve the auditor identity (step 2 — from the argument or the operator) and produce its slug. Then: ```bash # List all audit prompts that exist ls .straymark/audits/*/audit-prompt.md 2>/dev/null ``` -For each found `.straymark/audits//audit-prompt.md`, check whether a report from this model already exists at `.straymark/audits//report-.md`. The set of "pending" prompts is the ones WITHOUT a corresponding report. +For each found `.straymark/audits//audit-prompt.md`, check whether a report from this model already exists at `.straymark/audits//report-.md`. The set of "pending" prompts is the ones WITHOUT a corresponding report. - **Exactly one pending** → proceed with that CHARTER-ID, announcing the choice to the operator. - **Multiple pending** → list them numerically with their Charter titles (read the title from the resolved prompt's `# Auditoría de Charter — CHARTER-NN` heading) and ask the operator to pick one. - **None pending** → message: "No pending audit prompts for this model under `.straymark/audits/`. Either the operator has not run `/straymark-audit-prompt` in the main agent yet, or all the prompts already have a report from this model. Verify with the operator." -### 2. Detect this auditor's model identifier +### 2. Determine the auditor identity — the operator sets it, never self-perception -Identify the model running this CLI session and produce a filesystem-safe slug. +**The `auditor:` identity is authoritative input from the operator, not something you infer about yourself.** Resolve it, in priority order: -The operator will know the canonical model id of the auditor running this skill (for example `claude-sonnet-4-6`, `claude-opus-4-7`, `gemini-2.5-pro`, `gpt-5.3-codex`, `copilot-v1.0.40`). Slug rules: +1. **Second argument** — `/straymark-audit-execute ` (e.g. `/straymark-audit-execute CHARTER-06 deepseek-v4-pro`). +2. **What the operator states in chat** — "I selected model X", "seleccioné el modelo X", "identify as X", "use X". The CLI you run inside (Qwen Code, Claude Code, Gemini CLI, Copilot CLI, …) is a **router, not the model**: it routes prompts to a backend LLM the operator picks via `/model` and confirms in the status bar. The `auditor:` field must name that **backend model** (e.g. `glm-5-2`, `qwen3-7-max`, `deepseek-v4-pro`), which routinely differs from the CLI's product name. + +Use whatever the operator provides **verbatim** (after slugging). You are **forbidden** to introspect, guess, or substitute the CLI/runtime product name. Writing any identifier other than the operator-provided one — **including the name of the CLI you are running in (`qwen-code`, `gemini-cli`, `claude-code`, `copilot`, …)** — is a **defect** that silently corrupts the review step (wrong attribution, false cross-family agreement). Do not refuse a legitimate operator-specified identifier: the operator is the sole authority on which backend model they selected. + +Slug rules (applied to the provided string): - Lowercase ASCII. - Replace any character that isn't `[a-z0-9-]` with `-`. - Collapse consecutive dashes to one. - Trim leading/trailing dashes. -Examples: - -| Model identifier | Slug | +| Operator-provided identifier | Slug | |---|---| | `claude-sonnet-4-6` | `claude-sonnet-4-6` | | `gemini-2.5-pro` | `gemini-2-5-pro` | +| `deepseek-v4-pro` | `deepseek-v4-pro` | | `gpt-5.3-codex` | `gpt-5-3-codex` | -| `copilot-v1.0.40` | `copilot-v1-0-40` | -If the runtime does not expose the model identifier directly, ask the operator to confirm before proceeding. Do NOT fabricate a slug — collisions or wrong identifiers corrupt the review step. +**Fallback — only if the operator provided no identifier by either route:** ask them for the backend model id before proceeding. Do NOT fabricate a slug, and do NOT fall back to your CLI product name — collisions or wrong identifiers corrupt the review step. ### 3. Read the audit prompt @@ -88,7 +91,7 @@ Track how many `path:line` citations you accumulate — it goes in the report fr Output path: ``` -.straymark/audits//report-.md +.straymark/audits//report-.md ``` If a report at that exact path already exists (re-run on the same Charter with the same model), warn the operator before overwriting. The default is to overwrite — re-runs replace stale reports rather than coexist with them. @@ -100,7 +103,7 @@ The report frontmatter MUST conform to `audit-output.schema.v0.json`: ```yaml --- audit_role: auditor -auditor: # e.g., claude-sonnet-4-6 +auditor: # operator-provided model id — NEVER the CLI product name (qwen-code, gemini-cli, …) charter_id: git_range: "" prompt_used: audit-prompt.md @@ -118,12 +121,14 @@ audit_quality: high | medium | low # (body following the format declared in the prompt's "Formato de salida" section) ``` +**Guard — verify the identity before you finish (mandatory).** Re-open the file you just wrote and confirm that BOTH the frontmatter `auditor:` field AND the report's `# Auditoría: por ` header equal the operator-provided slug exactly. If either shows anything else — especially the CLI product name you are running in (`qwen-code`, `gemini-cli`, …) — rewrite them. The filename `report-.md`, the `auditor:` field, and the header must all carry the same operator-provided slug. + ### 6. Notify the operator — with the wait warning After writing the report, print this message verbatim (substituting ``, ``, and the finding count): ``` -Audit complete for (this auditor: ). +Audit complete for (this auditor: ). Report: .straymark/audits//report-.md Findings: total () diff --git a/dist/.codex/skills/straymark-audit-execute/SKILL.md b/dist/.codex/skills/straymark-audit-execute/SKILL.md index e135d0b1..cdd665d6 100644 --- a/dist/.codex/skills/straymark-audit-execute/SKILL.md +++ b/dist/.codex/skills/straymark-audit-execute/SKILL.md @@ -21,46 +21,49 @@ The skill is the second step of the v1 audit cycle: ### 1. Resolve the Charter -The argument is optional. Two cases: +Two positional arguments: `` and an optional `` — e.g. `/straymark-audit-execute CHARTER-06 deepseek-v4-pro`. The second argument is the operator-provided auditor identity (see step 2); it is never inferred from the CLI you are running in. -**Case A — argument provided** (`/straymark-audit-execute CHARTER-04`): -Use the literal value. Construct the audit dir path: `.straymark/audits/CHARTER-04/`. +**Case A — Charter provided** (`/straymark-audit-execute CHARTER-04 [AUDITOR-SLUG]`): +Use the literal Charter value. Construct the audit dir path: `.straymark/audits/CHARTER-04/`. -**Case B — argument omitted** (`/straymark-audit-execute`): -Auto-discover pending prompts. Detect this auditor's model identifier (see step 2 for how) and produce its slug. Then: +**Case B — Charter omitted** (`/straymark-audit-execute`): +Auto-discover pending prompts. Resolve the auditor identity (step 2 — from the argument or the operator) and produce its slug. Then: ```bash # List all audit prompts that exist ls .straymark/audits/*/audit-prompt.md 2>/dev/null ``` -For each found `.straymark/audits//audit-prompt.md`, check whether a report from this model already exists at `.straymark/audits//report-.md`. The set of "pending" prompts is the ones WITHOUT a corresponding report. +For each found `.straymark/audits//audit-prompt.md`, check whether a report from this model already exists at `.straymark/audits//report-.md`. The set of "pending" prompts is the ones WITHOUT a corresponding report. - **Exactly one pending** → proceed with that CHARTER-ID, announcing the choice to the operator. - **Multiple pending** → list them numerically with their Charter titles (read the title from the resolved prompt's `# Auditoría de Charter — CHARTER-NN` heading) and ask the operator to pick one. - **None pending** → message: "No pending audit prompts for this model under `.straymark/audits/`. Either the operator has not run `/straymark-audit-prompt` in the main agent yet, or all the prompts already have a report from this model. Verify with the operator." -### 2. Detect this auditor's model identifier +### 2. Determine the auditor identity — the operator sets it, never self-perception -Identify the model running this CLI session and produce a filesystem-safe slug. +**The `auditor:` identity is authoritative input from the operator, not something you infer about yourself.** Resolve it, in priority order: -The operator will know the canonical model id of the auditor running this skill (for example `claude-sonnet-4-6`, `claude-opus-4-7`, `gemini-2.5-pro`, `gpt-5.3-codex`, `copilot-v1.0.40`). Slug rules: +1. **Second argument** — `/straymark-audit-execute ` (e.g. `/straymark-audit-execute CHARTER-06 deepseek-v4-pro`). +2. **What the operator states in chat** — "I selected model X", "seleccioné el modelo X", "identify as X", "use X". The CLI you run inside (Qwen Code, Claude Code, Gemini CLI, Copilot CLI, …) is a **router, not the model**: it routes prompts to a backend LLM the operator picks via `/model` and confirms in the status bar. The `auditor:` field must name that **backend model** (e.g. `glm-5-2`, `qwen3-7-max`, `deepseek-v4-pro`), which routinely differs from the CLI's product name. + +Use whatever the operator provides **verbatim** (after slugging). You are **forbidden** to introspect, guess, or substitute the CLI/runtime product name. Writing any identifier other than the operator-provided one — **including the name of the CLI you are running in (`qwen-code`, `gemini-cli`, `claude-code`, `copilot`, …)** — is a **defect** that silently corrupts the review step (wrong attribution, false cross-family agreement). Do not refuse a legitimate operator-specified identifier: the operator is the sole authority on which backend model they selected. + +Slug rules (applied to the provided string): - Lowercase ASCII. - Replace any character that isn't `[a-z0-9-]` with `-`. - Collapse consecutive dashes to one. - Trim leading/trailing dashes. -Examples: - -| Model identifier | Slug | +| Operator-provided identifier | Slug | |---|---| | `claude-sonnet-4-6` | `claude-sonnet-4-6` | | `gemini-2.5-pro` | `gemini-2-5-pro` | +| `deepseek-v4-pro` | `deepseek-v4-pro` | | `gpt-5.3-codex` | `gpt-5-3-codex` | -| `copilot-v1.0.40` | `copilot-v1-0-40` | -If the runtime does not expose the model identifier directly, ask the operator to confirm before proceeding. Do NOT fabricate a slug — collisions or wrong identifiers corrupt the review step. +**Fallback — only if the operator provided no identifier by either route:** ask them for the backend model id before proceeding. Do NOT fabricate a slug, and do NOT fall back to your CLI product name — collisions or wrong identifiers corrupt the review step. ### 3. Read the audit prompt @@ -86,7 +89,7 @@ Track how many `path:line` citations you accumulate — it goes in the report fr Output path: ``` -.straymark/audits//report-.md +.straymark/audits//report-.md ``` If a report at that exact path already exists (re-run on the same Charter with the same model), warn the operator before overwriting. The default is to overwrite — re-runs replace stale reports rather than coexist with them. @@ -98,7 +101,7 @@ The report frontmatter MUST conform to `audit-output.schema.v0.json`: ```yaml --- audit_role: auditor -auditor: # e.g., claude-sonnet-4-6 +auditor: # operator-provided model id — NEVER the CLI product name (qwen-code, gemini-cli, …) charter_id: git_range: "" prompt_used: audit-prompt.md @@ -116,12 +119,14 @@ audit_quality: high | medium | low # (body following the format declared in the prompt's "Formato de salida" section) ``` +**Guard — verify the identity before you finish (mandatory).** Re-open the file you just wrote and confirm that BOTH the frontmatter `auditor:` field AND the report's `# Auditoría: por ` header equal the operator-provided slug exactly. If either shows anything else — especially the CLI product name you are running in (`qwen-code`, `gemini-cli`, …) — rewrite them. The filename `report-.md`, the `auditor:` field, and the header must all carry the same operator-provided slug. + ### 6. Notify the operator — with the wait warning After writing the report, print this message verbatim (substituting ``, ``, and the finding count): ``` -Audit complete for (this auditor: ). +Audit complete for (this auditor: ). Report: .straymark/audits//report-.md Findings: total () diff --git a/dist/.gemini/skills/straymark-audit-execute/SKILL.md b/dist/.gemini/skills/straymark-audit-execute/SKILL.md index e135d0b1..cdd665d6 100644 --- a/dist/.gemini/skills/straymark-audit-execute/SKILL.md +++ b/dist/.gemini/skills/straymark-audit-execute/SKILL.md @@ -21,46 +21,49 @@ The skill is the second step of the v1 audit cycle: ### 1. Resolve the Charter -The argument is optional. Two cases: +Two positional arguments: `` and an optional `` — e.g. `/straymark-audit-execute CHARTER-06 deepseek-v4-pro`. The second argument is the operator-provided auditor identity (see step 2); it is never inferred from the CLI you are running in. -**Case A — argument provided** (`/straymark-audit-execute CHARTER-04`): -Use the literal value. Construct the audit dir path: `.straymark/audits/CHARTER-04/`. +**Case A — Charter provided** (`/straymark-audit-execute CHARTER-04 [AUDITOR-SLUG]`): +Use the literal Charter value. Construct the audit dir path: `.straymark/audits/CHARTER-04/`. -**Case B — argument omitted** (`/straymark-audit-execute`): -Auto-discover pending prompts. Detect this auditor's model identifier (see step 2 for how) and produce its slug. Then: +**Case B — Charter omitted** (`/straymark-audit-execute`): +Auto-discover pending prompts. Resolve the auditor identity (step 2 — from the argument or the operator) and produce its slug. Then: ```bash # List all audit prompts that exist ls .straymark/audits/*/audit-prompt.md 2>/dev/null ``` -For each found `.straymark/audits//audit-prompt.md`, check whether a report from this model already exists at `.straymark/audits//report-.md`. The set of "pending" prompts is the ones WITHOUT a corresponding report. +For each found `.straymark/audits//audit-prompt.md`, check whether a report from this model already exists at `.straymark/audits//report-.md`. The set of "pending" prompts is the ones WITHOUT a corresponding report. - **Exactly one pending** → proceed with that CHARTER-ID, announcing the choice to the operator. - **Multiple pending** → list them numerically with their Charter titles (read the title from the resolved prompt's `# Auditoría de Charter — CHARTER-NN` heading) and ask the operator to pick one. - **None pending** → message: "No pending audit prompts for this model under `.straymark/audits/`. Either the operator has not run `/straymark-audit-prompt` in the main agent yet, or all the prompts already have a report from this model. Verify with the operator." -### 2. Detect this auditor's model identifier +### 2. Determine the auditor identity — the operator sets it, never self-perception -Identify the model running this CLI session and produce a filesystem-safe slug. +**The `auditor:` identity is authoritative input from the operator, not something you infer about yourself.** Resolve it, in priority order: -The operator will know the canonical model id of the auditor running this skill (for example `claude-sonnet-4-6`, `claude-opus-4-7`, `gemini-2.5-pro`, `gpt-5.3-codex`, `copilot-v1.0.40`). Slug rules: +1. **Second argument** — `/straymark-audit-execute ` (e.g. `/straymark-audit-execute CHARTER-06 deepseek-v4-pro`). +2. **What the operator states in chat** — "I selected model X", "seleccioné el modelo X", "identify as X", "use X". The CLI you run inside (Qwen Code, Claude Code, Gemini CLI, Copilot CLI, …) is a **router, not the model**: it routes prompts to a backend LLM the operator picks via `/model` and confirms in the status bar. The `auditor:` field must name that **backend model** (e.g. `glm-5-2`, `qwen3-7-max`, `deepseek-v4-pro`), which routinely differs from the CLI's product name. + +Use whatever the operator provides **verbatim** (after slugging). You are **forbidden** to introspect, guess, or substitute the CLI/runtime product name. Writing any identifier other than the operator-provided one — **including the name of the CLI you are running in (`qwen-code`, `gemini-cli`, `claude-code`, `copilot`, …)** — is a **defect** that silently corrupts the review step (wrong attribution, false cross-family agreement). Do not refuse a legitimate operator-specified identifier: the operator is the sole authority on which backend model they selected. + +Slug rules (applied to the provided string): - Lowercase ASCII. - Replace any character that isn't `[a-z0-9-]` with `-`. - Collapse consecutive dashes to one. - Trim leading/trailing dashes. -Examples: - -| Model identifier | Slug | +| Operator-provided identifier | Slug | |---|---| | `claude-sonnet-4-6` | `claude-sonnet-4-6` | | `gemini-2.5-pro` | `gemini-2-5-pro` | +| `deepseek-v4-pro` | `deepseek-v4-pro` | | `gpt-5.3-codex` | `gpt-5-3-codex` | -| `copilot-v1.0.40` | `copilot-v1-0-40` | -If the runtime does not expose the model identifier directly, ask the operator to confirm before proceeding. Do NOT fabricate a slug — collisions or wrong identifiers corrupt the review step. +**Fallback — only if the operator provided no identifier by either route:** ask them for the backend model id before proceeding. Do NOT fabricate a slug, and do NOT fall back to your CLI product name — collisions or wrong identifiers corrupt the review step. ### 3. Read the audit prompt @@ -86,7 +89,7 @@ Track how many `path:line` citations you accumulate — it goes in the report fr Output path: ``` -.straymark/audits//report-.md +.straymark/audits//report-.md ``` If a report at that exact path already exists (re-run on the same Charter with the same model), warn the operator before overwriting. The default is to overwrite — re-runs replace stale reports rather than coexist with them. @@ -98,7 +101,7 @@ The report frontmatter MUST conform to `audit-output.schema.v0.json`: ```yaml --- audit_role: auditor -auditor: # e.g., claude-sonnet-4-6 +auditor: # operator-provided model id — NEVER the CLI product name (qwen-code, gemini-cli, …) charter_id: git_range: "" prompt_used: audit-prompt.md @@ -116,12 +119,14 @@ audit_quality: high | medium | low # (body following the format declared in the prompt's "Formato de salida" section) ``` +**Guard — verify the identity before you finish (mandatory).** Re-open the file you just wrote and confirm that BOTH the frontmatter `auditor:` field AND the report's `# Auditoría: por ` header equal the operator-provided slug exactly. If either shows anything else — especially the CLI product name you are running in (`qwen-code`, `gemini-cli`, …) — rewrite them. The filename `report-.md`, the `auditor:` field, and the header must all carry the same operator-provided slug. + ### 6. Notify the operator — with the wait warning After writing the report, print this message verbatim (substituting ``, ``, and the finding count): ``` -Audit complete for (this auditor: ). +Audit complete for (this auditor: ). Report: .straymark/audits//report-.md Findings: total () diff --git a/dist/.straymark/00-governance/AGENT-RULES.md b/dist/.straymark/00-governance/AGENT-RULES.md index 0a91a67b..cd6a8281 100644 --- a/dist/.straymark/00-governance/AGENT-RULES.md +++ b/dist/.straymark/00-governance/AGENT-RULES.md @@ -412,4 +412,4 @@ When a project accumulates a high volume of AILOGs across multiple Charters and --- -*StrayMark fw-4.32.0 | [Strange Days Tech](https://strangedays.tech)* +*StrayMark fw-4.33.0 | [Strange Days Tech](https://strangedays.tech)* diff --git a/dist/.straymark/00-governance/C4-DIAGRAM-GUIDE.md b/dist/.straymark/00-governance/C4-DIAGRAM-GUIDE.md index eb525c2e..6563f68e 100644 --- a/dist/.straymark/00-governance/C4-DIAGRAM-GUIDE.md +++ b/dist/.straymark/00-governance/C4-DIAGRAM-GUIDE.md @@ -234,4 +234,4 @@ Use a Level 1 (Context) diagram to illustrate: --- -*StrayMark fw-4.32.0 | [Strange Days Tech](https://strangedays.tech)* +*StrayMark fw-4.33.0 | [Strange Days Tech](https://strangedays.tech)* diff --git a/dist/.straymark/00-governance/DOCUMENTATION-POLICY.md b/dist/.straymark/00-governance/DOCUMENTATION-POLICY.md index c43dbe67..e19a011f 100644 --- a/dist/.straymark/00-governance/DOCUMENTATION-POLICY.md +++ b/dist/.straymark/00-governance/DOCUMENTATION-POLICY.md @@ -319,4 +319,4 @@ See also [ADR-2025-01-20-001] for architectural context. --- -*StrayMark fw-4.32.0 | [Strange Days Tech](https://strangedays.tech)* +*StrayMark fw-4.33.0 | [Strange Days Tech](https://strangedays.tech)* diff --git a/dist/.straymark/00-governance/FOLLOW-UPS-BACKLOG-PATTERN.md b/dist/.straymark/00-governance/FOLLOW-UPS-BACKLOG-PATTERN.md index 745a4869..d22c74f7 100644 --- a/dist/.straymark/00-governance/FOLLOW-UPS-BACKLOG-PATTERN.md +++ b/dist/.straymark/00-governance/FOLLOW-UPS-BACKLOG-PATTERN.md @@ -316,4 +316,4 @@ Contributed via [issue #111](https://github.com/StrangeDaysTech/straymark/issues --- -*StrayMark fw-4.32.0 | [Strange Days Tech](https://strangedays.tech)* +*StrayMark fw-4.33.0 | [Strange Days Tech](https://strangedays.tech)* diff --git a/dist/.straymark/00-governance/QUICK-REFERENCE.md b/dist/.straymark/00-governance/QUICK-REFERENCE.md index ac834647..da4eb16d 100644 --- a/dist/.straymark/00-governance/QUICK-REFERENCE.md +++ b/dist/.straymark/00-governance/QUICK-REFERENCE.md @@ -262,4 +262,4 @@ Mark `review_required: true` when: --- -*StrayMark fw-4.32.0 | [Strange Days Tech](https://strangedays.tech)* +*StrayMark fw-4.33.0 | [Strange Days Tech](https://strangedays.tech)* diff --git a/dist/.straymark/00-governance/i18n/es/AGENT-RULES.md b/dist/.straymark/00-governance/i18n/es/AGENT-RULES.md index 742e75f2..1ae281c2 100644 --- a/dist/.straymark/00-governance/i18n/es/AGENT-RULES.md +++ b/dist/.straymark/00-governance/i18n/es/AGENT-RULES.md @@ -412,4 +412,4 @@ Cuando un proyecto acumula un volumen alto de AILOGs a lo largo de múltiples Ch --- -*StrayMark fw-4.32.0 | [Strange Days Tech](https://strangedays.tech)* +*StrayMark fw-4.33.0 | [Strange Days Tech](https://strangedays.tech)* diff --git a/dist/.straymark/00-governance/i18n/es/C4-DIAGRAM-GUIDE.md b/dist/.straymark/00-governance/i18n/es/C4-DIAGRAM-GUIDE.md index ed831ad0..7b105d2e 100644 --- a/dist/.straymark/00-governance/i18n/es/C4-DIAGRAM-GUIDE.md +++ b/dist/.straymark/00-governance/i18n/es/C4-DIAGRAM-GUIDE.md @@ -234,4 +234,4 @@ Usar un diagrama de Nivel 1 (Contexto) para ilustrar: --- -*StrayMark fw-4.32.0 | [Strange Days Tech](https://strangedays.tech)* +*StrayMark fw-4.33.0 | [Strange Days Tech](https://strangedays.tech)* diff --git a/dist/.straymark/00-governance/i18n/es/DOCUMENTATION-POLICY.md b/dist/.straymark/00-governance/i18n/es/DOCUMENTATION-POLICY.md index a16a198c..ae4ca4d5 100644 --- a/dist/.straymark/00-governance/i18n/es/DOCUMENTATION-POLICY.md +++ b/dist/.straymark/00-governance/i18n/es/DOCUMENTATION-POLICY.md @@ -312,4 +312,4 @@ Ver también [ADR-2025-01-20-001] para contexto arquitectónico. --- -*StrayMark fw-4.32.0 | [Strange Days Tech](https://strangedays.tech)* +*StrayMark fw-4.33.0 | [Strange Days Tech](https://strangedays.tech)* diff --git a/dist/.straymark/00-governance/i18n/es/FOLLOW-UPS-BACKLOG-PATTERN.md b/dist/.straymark/00-governance/i18n/es/FOLLOW-UPS-BACKLOG-PATTERN.md index 2aa9b25b..f1633936 100644 --- a/dist/.straymark/00-governance/i18n/es/FOLLOW-UPS-BACKLOG-PATTERN.md +++ b/dist/.straymark/00-governance/i18n/es/FOLLOW-UPS-BACKLOG-PATTERN.md @@ -316,4 +316,4 @@ Contribuido vía [issue #111](https://github.com/StrangeDaysTech/straymark/issue --- -*StrayMark fw-4.32.0 | [Strange Days Tech](https://strangedays.tech)* +*StrayMark fw-4.33.0 | [Strange Days Tech](https://strangedays.tech)* diff --git a/dist/.straymark/00-governance/i18n/es/QUICK-REFERENCE.md b/dist/.straymark/00-governance/i18n/es/QUICK-REFERENCE.md index 347d61f1..e66cb690 100644 --- a/dist/.straymark/00-governance/i18n/es/QUICK-REFERENCE.md +++ b/dist/.straymark/00-governance/i18n/es/QUICK-REFERENCE.md @@ -234,4 +234,4 @@ Marcar `review_required: true` cuando: --- -*StrayMark fw-4.32.0 | [Strange Days Tech](https://strangedays.tech)* +*StrayMark fw-4.33.0 | [Strange Days Tech](https://strangedays.tech)* diff --git a/dist/.straymark/00-governance/i18n/zh-CN/AGENT-RULES.md b/dist/.straymark/00-governance/i18n/zh-CN/AGENT-RULES.md index fad3d432..44ee91f6 100644 --- a/dist/.straymark/00-governance/i18n/zh-CN/AGENT-RULES.md +++ b/dist/.straymark/00-governance/i18n/zh-CN/AGENT-RULES.md @@ -407,4 +407,4 @@ confidence: high | medium | low --- -*StrayMark fw-4.32.0 | [Strange Days Tech](https://strangedays.tech)* +*StrayMark fw-4.33.0 | [Strange Days Tech](https://strangedays.tech)* diff --git a/dist/.straymark/00-governance/i18n/zh-CN/C4-DIAGRAM-GUIDE.md b/dist/.straymark/00-governance/i18n/zh-CN/C4-DIAGRAM-GUIDE.md index c4ee9cec..862f1aa6 100644 --- a/dist/.straymark/00-governance/i18n/zh-CN/C4-DIAGRAM-GUIDE.md +++ b/dist/.straymark/00-governance/i18n/zh-CN/C4-DIAGRAM-GUIDE.md @@ -234,4 +234,4 @@ Rel(api, db, "Reads/Writes", "SQL") --- -*StrayMark fw-4.32.0 | [Strange Days Tech](https://strangedays.tech)* +*StrayMark fw-4.33.0 | [Strange Days Tech](https://strangedays.tech)* diff --git a/dist/.straymark/00-governance/i18n/zh-CN/DOCUMENTATION-POLICY.md b/dist/.straymark/00-governance/i18n/zh-CN/DOCUMENTATION-POLICY.md index efe5c777..bdb55e0a 100644 --- a/dist/.straymark/00-governance/i18n/zh-CN/DOCUMENTATION-POLICY.md +++ b/dist/.straymark/00-governance/i18n/zh-CN/DOCUMENTATION-POLICY.md @@ -311,4 +311,4 @@ review_outcome: approved # approved | revisions_requested | rejec --- -*StrayMark fw-4.32.0 | [Strange Days Tech](https://strangedays.tech)* +*StrayMark fw-4.33.0 | [Strange Days Tech](https://strangedays.tech)* diff --git a/dist/.straymark/00-governance/i18n/zh-CN/FOLLOW-UPS-BACKLOG-PATTERN.md b/dist/.straymark/00-governance/i18n/zh-CN/FOLLOW-UPS-BACKLOG-PATTERN.md index 7820fab4..b0c84853 100644 --- a/dist/.straymark/00-governance/i18n/zh-CN/FOLLOW-UPS-BACKLOG-PATTERN.md +++ b/dist/.straymark/00-governance/i18n/zh-CN/FOLLOW-UPS-BACKLOG-PATTERN.md @@ -316,4 +316,4 @@ straymark followups promote FU-NNN # 自动化 FU → TDE 提升(见上 --- -*StrayMark fw-4.32.0 | [Strange Days Tech](https://strangedays.tech)* +*StrayMark fw-4.33.0 | [Strange Days Tech](https://strangedays.tech)* diff --git a/dist/.straymark/00-governance/i18n/zh-CN/QUICK-REFERENCE.md b/dist/.straymark/00-governance/i18n/zh-CN/QUICK-REFERENCE.md index f4417f26..7a5a83c0 100644 --- a/dist/.straymark/00-governance/i18n/zh-CN/QUICK-REFERENCE.md +++ b/dist/.straymark/00-governance/i18n/zh-CN/QUICK-REFERENCE.md @@ -234,4 +234,4 @@ risk_level: low | medium | high | critical --- -*StrayMark fw-4.32.0 | [Strange Days Tech](https://strangedays.tech)* +*StrayMark fw-4.33.0 | [Strange Days Tech](https://strangedays.tech)* diff --git a/dist/dist-manifest.yml b/dist/dist-manifest.yml index 6c374c76..171d0a94 100644 --- a/dist/dist-manifest.yml +++ b/dist/dist-manifest.yml @@ -1,4 +1,4 @@ -version: "4.32.0" +version: "4.33.0" description: "StrayMark distribution manifest" repository: "https://github.com/StrangeDaysTech/straymark" diff --git a/docs/adopters/CLI-REFERENCE.md b/docs/adopters/CLI-REFERENCE.md index 9a3fea21..4c9843e4 100644 --- a/docs/adopters/CLI-REFERENCE.md +++ b/docs/adopters/CLI-REFERENCE.md @@ -45,7 +45,7 @@ StrayMark uses **independent version tags** for each component: | Component | Tag prefix | Example | What it includes | |-----------|-----------|---------|------------------| -| Framework | `fw-` | `fw-4.32.0` | Templates (12 types), governance docs, directives, Charter template + schema | +| Framework | `fw-` | `fw-4.33.0` | Templates (12 types), governance docs, directives, Charter template + schema | | CLI | `cli-` | `cli-3.30.0` | The `straymark` binary | | Loom (EXPERIMENTAL) | `loom-` | `loom-0.4.2` | The `straymark-loom` visualization server, downloaded on demand by `straymark loom serve` | diff --git a/docs/i18n/es/README.md b/docs/i18n/es/README.md index 6c4ef60d..44ac1f3f 100644 --- a/docs/i18n/es/README.md +++ b/docs/i18n/es/README.md @@ -240,7 +240,7 @@ StrayMark usa tags de versión independientes para cada componente: | Componente | Prefijo de tag | Ejemplo | Incluye | |------------|---------------|---------|---------| -| Framework | `fw-` | `fw-4.32.0` | Plantillas (12 tipos), gobernanza, directivas, plantilla + schema de Charter | +| Framework | `fw-` | `fw-4.33.0` | Plantillas (12 tipos), gobernanza, directivas, plantilla + schema de Charter | | CLI | `cli-` | `cli-3.30.0` | El binario `straymark` | | Loom (EXPERIMENTAL) | `loom-` | `loom-0.4.2` | El servidor de visualización `straymark-loom`, descargado bajo demanda por `straymark loom serve` | diff --git a/docs/i18n/es/adopters/CLI-REFERENCE.md b/docs/i18n/es/adopters/CLI-REFERENCE.md index d9f33f63..bd4a0816 100644 --- a/docs/i18n/es/adopters/CLI-REFERENCE.md +++ b/docs/i18n/es/adopters/CLI-REFERENCE.md @@ -45,7 +45,7 @@ StrayMark usa **tags de versión independientes** para cada componente: | Componente | Prefijo de tag | Ejemplo | Qué incluye | |------------|---------------|---------|-------------| -| Framework | `fw-` | `fw-4.32.0` | Plantillas (12 tipos), docs de gobernanza, directivas | +| Framework | `fw-` | `fw-4.33.0` | Plantillas (12 tipos), docs de gobernanza, directivas | | CLI | `cli-` | `cli-3.30.0` | El binario `straymark` | | Loom (EXPERIMENTAL) | `loom-` | `loom-0.4.2` | El servidor de visualización `straymark-loom`, descargado bajo demanda por `straymark loom serve` | diff --git a/docs/i18n/zh-CN/README.md b/docs/i18n/zh-CN/README.md index e7a0ff20..25ca7f6c 100644 --- a/docs/i18n/zh-CN/README.md +++ b/docs/i18n/zh-CN/README.md @@ -258,7 +258,7 @@ StrayMark 为每个组件使用独立的版本标签： | 组件 | 标签前缀 | 示例 | 包含内容 | |------|----------|------|----------| -| Framework | `fw-` | `fw-4.32.0` | 模板（12 种类型）、治理文档、指令、Charter 模板 + schema | +| Framework | `fw-` | `fw-4.33.0` | 模板（12 种类型）、治理文档、指令、Charter 模板 + schema | | CLI | `cli-` | `cli-3.30.0` | `straymark` 二进制文件 | | Loom（实验性） | `loom-` | `loom-0.4.2` | `straymark-loom` 可视化服务器，由 `straymark loom serve` 按需下载 | diff --git a/docs/i18n/zh-CN/adopters/CLI-REFERENCE.md b/docs/i18n/zh-CN/adopters/CLI-REFERENCE.md index 507ae964..250dfd69 100644 --- a/docs/i18n/zh-CN/adopters/CLI-REFERENCE.md +++ b/docs/i18n/zh-CN/adopters/CLI-REFERENCE.md @@ -45,7 +45,7 @@ StrayMark 为每个组件使用**独立的版本标签**： | 组件 | 标签前缀 | 示例 | 包含内容 | |------|----------|------|----------| -| Framework | `fw-` | `fw-4.32.0` | 模板（12 种类型）、治理文档、指令 | +| Framework | `fw-` | `fw-4.33.0` | 模板（12 种类型）、治理文档、指令 | | CLI | `cli-` | `cli-3.30.0` | `straymark` 二进制文件 | | Loom（实验性） | `loom-` | `loom-0.4.2` | `straymark-loom` 可视化服务器，由 `straymark loom serve` 按需下载 |