The file C:\Users\decid\Documents\projects\spt-core\crates\spt\tests\translate_proof.rs has been updated successfully. (file state is current in your context — no need to Read it back)

    // Sanity: drain budget keeps the whole gate well under any wedge timeout.
    let _ = Duration::from_secs(5);
}

// [int->REQ-ADAPTER-PROOF-DIR-OVERRIDE] the `--dir`/`--manifest` override proofs a
// DEV install that is NOT registered (perri F-011: a bare-file adapter the registry
// can't resolve). Same real binary + real fixture as above, driven through the real
// `spt` command: an UNREGISTERED option fails to resolve WITHOUT the override, then
// proofs (exit 0, full EMIT stream) WITH `--dir`, and again with `--manifest`
// pinning the file directly — no extracted/registered install staged.
#[test]
fn translate_proof_dir_override_proofs_unregistered_install() {
    let spt_bin = PathBuf::from(env!("CARGO_BIN_EXE_spt"));
    let fixture = sibling_bin("translate_proof_fixture");
    assert!(
        fixture.exists(),
        "the translation-binary fixture must be built: {}",
        fixture.display()
    );

    let home = tempfile::tempdir().unwrap();

    // An on-disk DEV install dir with a manifest declaring the translation binary —
    // written, but DELIBERATELY NOT registered (no registry::register). This is the
    // bare-file shape `*-proof` could not resolve before the override.
    let devdir = home.path().join("devsrc");
    std::fs::create_dir_all(&devdir).unwrap();
    let fixture_for_toml = fixture.to_string_lossy().replace('\\', "/");
    let manifest = format!(
        "[adapter]\nname = \"dev\"\nkind = \"harness\"\nversion = \"1\"\n\
         min_spt_core_version = \"0\"\n\n\
         [message-idle-translation-binary]\npath = '{fixture_for_toml}'\n"
    );
    let manifest_file = devdir.join("manifest.toml");
    std::fs::write(&manifest_file, &manifest).unwrap();

    let event = "<EVENT type=\"msg\" to=\"{id}\" sid=\"{session_id}\"/>";
    let devdir_s = devdir.to_string_lossy().replace('\\', "/");
    let manifest_s = manifest_file.to_string_lossy().replace('\\', "/");

    // ── Control: WITHOUT the override, an unregistered option cannot resolve. ──
    let out = run_spt(
        &spt_bin,
        home.path(),
        &["adapter", "translate-proof", "dev", "--event", event],
        None,
    );
    let stderr = String::from_utf8_lossy(&out.stderr);
    assert_eq!(
        out.status.code(),
        Some(1),
        "an unregistered adapter must fail to resolve without --dir/--manifest.\nstderr:\n{stderr}"
    );
    assert!(
        stderr.contains("TRANSLATE_PROOF_FAIL:dev"),
        "the resolve-fail marker is emitted.\nstderr:\n{stderr}"
    );

    // ── --dir <install dir>: manifest defaults to <dir>/manifest.toml → proofs. ──
    let out = run_spt(
        &spt_bin,
        home.path(),
        &["adapter", "translate-proof", "dev", "--event", event, "--dir", &devdir_s],
        None,
    );
    let stdout = String::from_utf8_lossy(&out.stdout);
    let stderr = String::from_utf8_lossy(&out.stderr);
    assert!(
        out.status.success(),
        "--dir resolves the on-disk DEV install and proofs (exit 0).\nstdout:\n{stdout}\nstderr:\n{stderr}"
    );
    assert!(
        stdout.contains("XLATE_OK") && stderr.contains("TRANSLATE_PROOF_OK:dev"),
        "the override proof drives the real binary end-to-end.\nstdout:\n{stdout}\nstderr:\n{stderr}"
    );

    // ── --manifest <file>: pins the manifest directly (parent = install dir). ──
    let out = run_spt(
        &spt_bin,
        home.path(),
        &["adapter", "translate-proof", "dev", "--event", event, "--manifest", &manifest_s],
        None,
    );
    let stderr = String::from_utf8_lossy(&out.stderr);
    assert!(
        out.status.success() && stderr.contains("TRANSLATE_PROOF_OK:dev"),
        "--manifest pins the file and proofs the same install.\nstderr:\n{stderr}"
    );
}

//! End-to-end int gate for `spt adapter translate-proof` (ADR-0022,
//! REQ-ADAPTER-TRANSLATE-PROOF): the author-time EMIT-half proof for
//! `[message-idle-translation-binary]`.
//!
//! This drives the REAL `spt` binary through the REAL command, against a REAL
//! external translation binary (`translate_proof_fixture`, a sibling `[[bin]]` in
//! this crate). No mocks: `translate-proof` spawns and feeds the fixture exactly
//! as the daemon does (the `init` line then the `--event` envelope), reads back
//! its emitted keystroke-command stream, prints it, and gates on the result. The
//! fixture's choreography (`ctrl+s` / delay / `text:XLATE_OK` / enter / delay /
//! `ctrl+s` / `ctrl+q` / `commit`) is the EMIT half of the W2 idle-delivery seam.

use std::path::PathBuf;
use std::process::Command;
use std::time::Duration;

mod common;
use common::CommandNoWindowExt;

use spt_store::perch;

/// Absolute path to a sibling binary in the same target dir as the `spt` test bin.
fn sibling_bin(name: &str) -> PathBuf {
    PathBuf::from(env!("CARGO_BIN_EXE_spt"))
        .with_file_name(format!("{name}{}", std::env::consts::EXE_SUFFIX))
}

/// Run `spt <args...>` under an isolated `SPT_HOME`, bounded, capturing output.
fn run_spt(
    spt_bin: &std::path::Path,
    home: &std::path::Path,
    args: &[&str],
    fixture_mode: Option<&str>,
) -> std::process::Output {
    let mut cmd = Command::new(spt_bin);
    cmd.no_window().args(args).env("SPT_HOME", home);
    if let Some(mode) = fixture_mode {
        cmd.env("XLATE_FIXTURE_MODE", mode);
    } else {
        cmd.env_remove("XLATE_FIXTURE_MODE");
    }
    cmd.output().expect("spawn spt adapter translate-proof")
}

// [int->REQ-ADAPTER-TRANSLATE-PROOF] the real command drives the real external
// translation binary end-to-end: the committed choreography proofs (exit 0 + the
// emitted stream printed), the `nocommit` variant of the SAME binary fails (exit
// 1, NO_COMMIT), and an adapter declaring no section exits 2.
#[test]
fn translate_proof_drives_the_real_translation_binary() {
    let spt_bin = PathBuf::from(env!("CARGO_BIN_EXE_spt"));
    let fixture = sibling_bin("translate_proof_fixture");
    assert!(
        fixture.exists(),
        "the translation-binary fixture must be built: {} \
         (cargo test -p spt builds it)",
        fixture.display()
    );

    let home = tempfile::tempdir().unwrap();

    // Register a harness adapter declaring [message-idle-translation-binary] with
    // the absolute fixture path. Register via the lib API into this home's adapter
    // registry (the child `spt` reads the same SPT_HOME).
    std::env::set_var("SPT_HOME", home.path());
    let adapters = perch::adapters_dir();
    let fixture_for_toml = fixture.to_string_lossy().replace('\\', "/");
    let manifest = format!(
        "[adapter]\nname = \"cc\"\nkind = \"harness\"\nversion = \"1\"\n\
         min_spt_core_version = \"0\"\n\n\
         [message-idle-translation-binary]\npath = '{fixture_for_toml}'\n"
    );
    let src = perch::spt_home().join("srcs").join("cc");
    std::fs::create_dir_all(&src).unwrap();
    std::fs::write(src.join("manifest.toml"), &manifest).unwrap();
    spt_runtime::registry::register(&adapters, &src, 1).unwrap();

    // A second adapter with NO translation-binary section (for the exit-2 case).
    let plain = "[adapter]\nname = \"plain\"\nkind = \"harness\"\nversion = \"1\"\n\
                 min_spt_core_version = \"0\"\n";
    let psrc = perch::spt_home().join("srcs").join("plain");
    std::fs::create_dir_all(&psrc).unwrap();
    std::fs::write(psrc.join("manifest.toml"), plain).unwrap();
    spt_runtime::registry::register(&adapters, &psrc, 1).unwrap();
    std::env::remove_var("SPT_HOME");

    let event = "<EVENT type=\"msg\" to=\"{id}\" sid=\"{session_id}\"/>";

    // ── Happy path: committed choreography → exit 0, stream printed. ──
    let out = run_spt(
        &spt_bin,
        home.path(),
        &["adapter", "translate-proof", "cc", "--event", event],
        None,
    );
    let stdout = String::from_utf8_lossy(&out.stdout);
    let stderr = String::from_utf8_lossy(&out.stderr);
    assert!(
        out.status.success(),
        "committed choreography must proof (exit 0).\nstdout:\n{stdout}\nstderr:\n{stderr}"
    );
    // The EMIT half is visible: the payload text and the commit are reported.
    assert!(
        stdout.contains("XLATE_OK"),
        "the emitted payload text must be surfaced.\nstdout:\n{stdout}"
    );
    assert!(
        stdout.contains("commit: yes"),
        "a committed sequence reports commit: yes.\nstdout:\n{stdout}"
    );
    assert!(
        stderr.contains("TRANSLATE_PROOF_OK:cc"),
        "the OK marker is emitted on stderr.\nstderr:\n{stderr}"
    );

    // ── No-commit variant of the SAME binary → exit 1, NO_COMMIT. ──
    let out = run_spt(
        &spt_bin,
        home.path(),
        &["adapter", "translate-proof", "cc", "--event", event, "--session", "sessA"],
        Some("nocommit"),
    );
    let stderr = String::from_utf8_lossy(&out.stderr);
    assert_eq!(
        out.status.code(),
        Some(1),
        "a sequence with no terminating commit fails (exit 1).\nstderr:\n{stderr}"
    );
    assert!(
        stderr.contains("TRANSLATE_PROOF_NO_COMMIT:cc"),
        "the no-commit gate marker is emitted.\nstderr:\n{stderr}"
    );

    // ── No section → exit 2. ──
    let out = run_spt(
        &spt_bin,
        home.path(),
        &["adapter", "translate-proof", "plain", "--event", event],
        None,
    );
    let stderr = String::from_utf8_lossy(&out.stderr);
    assert_eq!(
        out.status.code(),
        Some(2),
        "no [message-idle-translation-binary] section → exit 2.\nstderr:\n{stderr}"
    );
    assert!(
        stderr.contains("TRANSLATE_PROOF_NO_SECTION:plain"),
        "the no-section marker is emitted.\nstderr:\n{stderr}"
    );

    // Sanity: drain budget keeps the whole gate well under any wedge timeout.
    let _ = Duration::from_secs(5);
}

+// [int->REQ-ADAPTER-PROOF-DIR-OVERRIDE] the `--dir`/`--manifest` override proofs a

+// DEV install that is NOT registered (perri F-011: a bare-file adapter the registry

+// can't resolve). Same real binary + real fixture as above, driven through the real

+// `spt` command: an UNREGISTERED option fails to resolve WITHOUT the override, then

+// proofs (exit 0, full EMIT stream) WITH `--dir`, and again with `--manifest`

+// pinning the file directly — no extracted/registered install staged.

+    let spt_bin = PathBuf::from(env!("CARGO_BIN_EXE_spt"));

+    let fixture = sibling_bin("translate_proof_fixture");

+        "the translation-binary fixture must be built: {}",

+    let home = tempfile::tempdir().unwrap();

+    // An on-disk DEV install dir with a manifest declaring the translation binary —

+    // written, but DELIBERATELY NOT registered (no registry::register). This is the

+    // bare-file shape `*-proof` could not resolve before the override.

+    let devdir = home.path().join("devsrc");

+    std::fs::create_dir_all(&devdir).unwrap();

+    let fixture_for_toml = fixture.to_string_lossy().replace('\\', "/");

+        "[adapter]\nname = \"dev\"\nkind = \"harness\"\nversion = \"1\"\n\

+         min_spt_core_version = \"0\"\n\n\

+         [message-idle-translation-binary]\npath = '{fixture_for_toml}'\n"

+    let manifest_file = devdir.join("manifest.toml");

+    std::fs::write(&manifest_file, &manifest).unwrap();

+    let event = "<EVENT type=\"msg\" to=\"{id}\" sid=\"{session_id}\"/>";

+    let devdir_s = devdir.to_string_lossy().replace('\\', "/");

+    let manifest_s = manifest_file.to_string_lossy().replace('\\', "/");

+    // ── Control: WITHOUT the override, an unregistered option cannot resolve. ──

+        &["adapter", "translate-proof", "dev", "--event", event],

+    let stderr = String::from_utf8_lossy(&out.stderr);

+        "an unregistered adapter must fail to resolve without --dir/--manifest.\nstderr:\n{stderr}"

+        stderr.contains("TRANSLATE_PROOF_FAIL:dev"),

+        "the resolve-fail marker is emitted.\nstderr:\n{stderr}"

+    // ── --dir <install dir>: manifest defaults to <dir>/manifest.toml → proofs. ──

+        &["adapter", "translate-proof", "dev", "--event", event, "--dir", &devdir_s],

+    let stdout = String::from_utf8_lossy(&out.stdout);

+        "--dir resolves the on-disk DEV install and proofs (exit 0).\nstdout:\n{stdout}\nstderr:\n{stderr}"

+        stdout.contains("XLATE_OK") && stderr.contains("TRANSLATE_PROOF_OK:dev"),

+        "the override proof drives the real binary end-to-end.\nstdout:\n{stdout}\nstderr:\n{stderr}"

+    // ── --manifest <file>: pins the manifest directly (parent = install dir). ──

+        &["adapter", "translate-proof", "dev", "--event", event, "--manifest", &manifest_s],

+        out.status.success() && stderr.contains("TRANSLATE_PROOF_OK:dev"),

+        "--manifest pins the file and proofs the same install.\nstderr:\n{stderr}"


Now the unit test for `resolve_proof_target`. Add it after the W4 notice tests:


Edit

    #[test]
    fn adapter_update_notice_absent_when_no_message() {
        let m = manifest_with_message(None);
        assert!(
            adapter_update_notice(&m, false).is_none(),
            "a manifest with no [update].message yields no notice",
        );
    }

    #[test]
    fn adapter_update_notice_absent_when_no_message() {
        let m = manifest_with_message(None);
        assert!(
            adapter_update_notice(&m, false).is_none(),
            "a manifest with no [update].message yields no notice",
        );
    }

    // ── REQ-ADAPTER-PROOF-DIR-OVERRIDE (v0.13.2 W5): the `*-proof` `--dir`/
    // `--manifest` override resolves a DEV manifest+install-dir straight off disk,
    // bypassing the registry (perri F-011 — a bare-file adapter the registry can't
    // resolve). The end-to-end proof against a real binary is the int gate; this
    // unit pins the RESOLUTION contract.

    // [unit->REQ-ADAPTER-PROOF-DIR-OVERRIDE] `--dir` sets the install dir and
    // defaults the manifest to `<dir>/manifest.toml`; `--manifest` pins the file
    // (its parent is the install dir absent `--dir`); both → dir wins as install
    // dir. With NEITHER, an unregistered option falls through to the registry and
    // errors (the unchanged normal path).
    #[test]
    fn resolve_proof_target_override_reads_on_disk() {
        let home = crate::testutil::isolated_home();
        let _ = &home;
        let adapters = spt_store::perch::adapters_dir();

        let devdir = spt_store::perch::spt_home().join("devsrc");
        std::fs::create_dir_all(&devdir).unwrap();
        let manifest = "[adapter]\nname = \"dev\"\nkind = \"harness\"\nversion = \"1\"\n\
                        min_spt_core_version = \"0\"\n";
        let manifest_file = devdir.join("manifest.toml");
        std::fs::write(&manifest_file, manifest).unwrap();

        // --dir: install dir = dir, manifest = <dir>/manifest.toml.
        let (idir, m) =
            resolve_proof_target(&adapters, "dev", Some(devdir.to_str().unwrap()), None).unwrap();
        assert_eq!(idir, devdir, "--dir sets the install dir");
        assert_eq!(m.adapter.name, "dev", "manifest read from <dir>/manifest.toml");

        // --manifest: install dir = the file's parent.
        let (idir, m) =
            resolve_proof_target(&adapters, "dev", None, Some(manifest_file.to_str().unwrap()))
                .unwrap();
        assert_eq!(idir, devdir, "--manifest's parent is the install dir");
        assert_eq!(m.adapter.name, "dev");

        // Both: --dir wins as the install dir, --manifest pins the file.
        let other = spt_store::perch::spt_home().join("otherdir");
        std::fs::create_dir_all(&other).unwrap();
        let (idir, _) = resolve_proof_target(
            &adapters,
            "dev",
            Some(other.to_str().unwrap()),
            Some(manifest_file.to_str().unwrap()),
        )
        .unwrap();
        assert_eq!(idir, other, "with both, --dir is the install dir");

        // A bad manifest path is a clean error, not a panic.
        assert!(
            resolve_proof_target(&adapters, "dev", Some("/no/such/dir"), None).is_err(),
            "a missing on-disk manifest errors",
        );

        // Neither override → the registry path; an unregistered option errors.
        assert!(
            resolve_proof_target(&adapters, "ghost-unregistered", None, None).is_err(),
            "no override + unknown adapter falls through to the registry and errors",
        );
    }


The file C:\Users\decid\Documents\projects\spt-core\crates\spt\src\cli.rs has been updated successfully. (file state is current in your context — no need to Read it back)

    #[test]
    fn adapter_update_notice_absent_when_no_message() {
        let m = manifest_with_message(None);
        assert!(
            adapter_update_notice(&m, false).is_none(),
            "a manifest with no [update].message yields no notice",
        );
    }

    // ── REQ-ADAPTER-PROOF-DIR-OVERRIDE (v0.13.2 W5): the `*-proof` `--dir`/
    // `--manifest` override resolves a DEV manifest+install-dir straight off disk,
    // bypassing the registry (perri F-011 — a bare-file adapter the registry can't
    // resolve). The end-to-end proof against a real binary is the int gate; this
    // unit pins the RESOLUTION contract.

    // [unit->REQ-ADAPTER-PROOF-DIR-OVERRIDE] `--dir` sets the install dir and
    // defaults the manifest to `<dir>/manifest.toml`; `--manifest` pins the file
    // (its parent is the install dir absent `--dir`); both → dir wins as install
    // dir. With NEITHER, an unregistered option falls through to the registry and
    // errors (the unchanged normal path).
    #[test]
    fn resolve_proof_target_override_reads_on_disk() {
        let home = crate::testutil::isolated_home();
        let _ = &home;
        let adapters = spt_store::perch::adapters_dir();

        let devdir = spt_store::perch::spt_home().join("devsrc");
        std::fs::create_dir_all(&devdir).unwrap();
        let manifest = "[adapter]\nname = \"dev\"\nkind = \"harness\"\nversion = \"1\"\n\
                        min_spt_core_version = \"0\"\n";
        let manifest_file = devdir.join("manifest.toml");
        std::fs::write(&manifest_file, manifest).unwrap();

        // --dir: install dir = dir, manifest = <dir>/manifest.toml.
        let (idir, m) =
            resolve_proof_target(&adapters, "dev", Some(devdir.to_str().unwrap()), None).unwrap();
        assert_eq!(idir, devdir, "--dir sets the install dir");
        assert_eq!(m.adapter.name, "dev", "manifest read from <dir>/manifest.toml");

        // --manifest: install dir = the file's parent.
        let (idir, m) =
            resolve_proof_target(&adapters, "dev", None, Some(manifest_file.to_str().unwrap()))
                .unwrap();
        assert_eq!(idir, devdir, "--manifest's parent is the install dir");
        assert_eq!(m.adapter.name, "dev");

        // Both: --dir wins as the install dir, --manifest pins the file.
        let other = spt_store::perch::spt_home().join("otherdir");
        std::fs::create_dir_all(&other).unwrap();
        let (idir, _) = resolve_proof_target(
            &adapters,
            "dev",
            Some(other.to_str().unwrap()),
            Some(manifest_file.to_str().unwrap()),
        )
        .unwrap();
        assert_eq!(idir, other, "with both, --dir is the install dir");

        // A bad manifest path is a clean error, not a panic.
        assert!(
            resolve_proof_target(&adapters, "dev", Some("/no/such/dir"), None).is_err(),
            "a missing on-disk manifest errors",
        );

        // Neither override → the registry path; an unregistered option errors.
        assert!(
            resolve_proof_target(&adapters, "ghost-unregistered", None, None).is_err(),
            "no override + unknown adapter falls through to the registry and errors",
        );
    }

+    // ── REQ-ADAPTER-PROOF-DIR-OVERRIDE (v0.13.2 W5): the `*-proof` `--dir`/

+    // `--manifest` override resolves a DEV manifest+install-dir straight off disk,

+    // bypassing the registry (perri F-011 — a bare-file adapter the registry can't

+    // resolve). The end-to-end proof against a real binary is the int gate; this

+    // unit pins the RESOLUTION contract.

+    // [unit->REQ-ADAPTER-PROOF-DIR-OVERRIDE] `--dir` sets the install dir and

+    // defaults the manifest to `<dir>/manifest.toml`; `--manifest` pins the file

+    // (its parent is the install dir absent `--dir`); both → dir wins as install

+    // dir. With NEITHER, an unregistered option falls through to the registry and

+    // errors (the unchanged normal path).

+    fn resolve_proof_target_override_reads_on_disk() {

+        let home = crate::testutil::isolated_home();

+        let adapters = spt_store::perch::adapters_dir();

+        let devdir = spt_store::perch::spt_home().join("devsrc");

+        std::fs::create_dir_all(&devdir).unwrap();

+        let manifest = "[adapter]\nname = \"dev\"\nkind = \"harness\"\nversion = \"1\"\n\

+                        min_spt_core_version = \"0\"\n";

+        let manifest_file = devdir.join("manifest.toml");

+        std::fs::write(&manifest_file, manifest).unwrap();

+        // --dir: install dir = dir, manifest = <dir>/manifest.toml.

+            resolve_proof_target(&adapters, "dev", Some(devdir.to_str().unwrap()), None).unwrap();

+        assert_eq!(idir, devdir, "--dir sets the install dir");

+        assert_eq!(m.adapter.name, "dev", "manifest read from <dir>/manifest.toml");

+        // --manifest: install dir = the file's parent.

+            resolve_proof_target(&adapters, "dev", None, Some(manifest_file.to_str().unwrap()))

+        assert_eq!(idir, devdir, "--manifest's parent is the install dir");

+        assert_eq!(m.adapter.name, "dev");

+        // Both: --dir wins as the install dir, --manifest pins the file.

+        let other = spt_store::perch::spt_home().join("otherdir");

+        std::fs::create_dir_all(&other).unwrap();

+        let (idir, _) = resolve_proof_target(

+            Some(other.to_str().unwrap()),

+            Some(manifest_file.to_str().unwrap()),

+        assert_eq!(idir, other, "with both, --dir is the install dir");

+        // A bad manifest path is a clean error, not a panic.

+            resolve_proof_target(&adapters, "dev", Some("/no/such/dir"), None).is_err(),

+            "a missing on-disk manifest errors",

+        // Neither override → the registry path; an unregistered option errors.

+            resolve_proof_target(&adapters, "ghost-unregistered", None, None).is_err(),

+            "no override + unknown adapter falls through to the registry and errors",

// [unit->REQ-ADAPTER-GH-TRANSPORT] The version command is the exact `gh api`

// form that prints the latest tag, with the single `{repo}` substitution key.


/spt:send doyle a message about W4 for his gate and approval


Activate the REQ + add doc evidence. First find where proof commands are documented:


Bash

grep -rln "digest-proof\|translate-proof" docs/ docs-site/src/ CONTEXT.md 2>/dev/null

Find proof docs


docs/adr/0019-digest-adapter-declared-extractor-session-spanning.md
docs/adr/0022-spt-hosted-idle-delivery-translation-binary.md
docs/FLAKE-LEDGER.md
docs/MANIFEST.md
docs-site/src/cli/reference.md
docs-site/src/harness-contract/install-on-demand.md
docs-site/src/harness-contract/integration-checklist.md
docs-site/src/harness-contract/MANIFEST.md
docs-site/src/harness-contract/patterns.md
CONTEXT.md


1357	[[requirements]]
1358	id = "REQ-ADAPTER-PROOF-DIR-OVERRIDE"
1359	title = "The author-time proof commands (`spt adapter digest-proof`, `spt adapter translate-proof`) gain a `--dir <path>` / `--manifest <file>` override so an author proofs a DEV binary against an on-disk manifest+install dir WITHOUT staging a full extracted GhReleaseManaged install (mirrors digest-proof's `--sample` pointing straight at a file). Fixes perri F-011: a bare-file-added gh_release adapter currently can't be resolved by the *-proof commands ('manifest is not present yet at <dir>'); un-stales the bare-file digest-proof int. (perri F-011, v0.13.x DX)"
1360	required_stages = []  # additive DX; activate when built.
1361

[[requirements]]
id = "REQ-ADAPTER-PROOF-DIR-OVERRIDE"
title = "The author-time proof commands (`spt adapter digest-proof`, `spt adapter translate-proof`) gain a `--dir <path>` / `--manifest <file>` override so an author proofs a DEV binary against an on-disk manifest+install dir WITHOUT staging a full extracted GhReleaseManaged install (mirrors digest-proof's `--sample` pointing straight at a file). Fixes perri F-011: a bare-file-added gh_release adapter currently can't be resolved by the *-proof commands ('manifest is not present yet at <dir>'); un-stales the bare-file digest-proof int. (perri F-011, v0.13.x DX)"
required_stages = []  # additive DX; activate when built.


Edit

id = "REQ-ADAPTER-PROOF-DIR-OVERRIDE"
title = "The author-time proof commands (`spt adapter digest-proof`, `spt adapter translate-proof`) gain a `--dir <path>` / `--manifest <file>` override so an author proofs a DEV binary against an on-disk manifest+install dir WITHOUT staging a full extracted GhReleaseManaged install (mirrors digest-proof's `--sample` pointing straight at a file). Fixes perri F-011: a bare-file-added gh_release adapter currently can't be resolved by the *-proof commands ('manifest is not present yet at <dir>'); un-stales the bare-file digest-proof int. (perri F-011, v0.13.x DX)"
required_stages = []  # additive DX; activate when built.

id = "REQ-ADAPTER-PROOF-DIR-OVERRIDE"
title = "The author-time proof commands (`spt adapter digest-proof`, `spt adapter translate-proof`) gain a `--dir <path>` / `--manifest <file>` override so an author proofs a DEV binary against an on-disk manifest+install dir WITHOUT staging a full extracted GhReleaseManaged install (mirrors digest-proof's `--sample` pointing straight at a file). Fixes perri F-011: a bare-file-added gh_release adapter currently can't be resolved by the *-proof commands ('manifest is not present yet at <dir>'); un-stales the bare-file digest-proof int. (perri F-011, v0.13.x DX)"
required_stages = ["doc", "impl", "unit", "int"]  # v0.13.2 W5. doc = harness-contract patterns + MANIFEST.md proof note. impl = resolve_proof_target + the two --dir/--manifest flags. unit = resolve_proof_target resolution contract. int = translate_proof.rs override proofs an UNregistered on-disk install (real binary).


The file C:\Users\decid\Documents\projects\spt-core\traceable-reqs.toml has been updated successfully. (file state is current in your context — no need to Read it back)

id = "REQ-ADAPTER-PROOF-DIR-OVERRIDE"
title = "The author-time proof commands (`spt adapter digest-proof`, `spt adapter translate-proof`) gain a `--dir <path>` / `--manifest <file>` override so an author proofs a DEV binary against an on-disk manifest+install dir WITHOUT staging a full extracted GhReleaseManaged install (mirrors digest-proof's `--sample` pointing straight at a file). Fixes perri F-011: a bare-file-added gh_release adapter currently can't be resolved by the *-proof commands ('manifest is not present yet at <dir>'); un-stales the bare-file digest-proof int. (perri F-011, v0.13.x DX)"
required_stages = []  # additive DX; activate when built.

id = "REQ-ADAPTER-PROOF-DIR-OVERRIDE"
title = "The author-time proof commands (`spt adapter digest-proof`, `spt adapter translate-proof`) gain a `--dir <path>` / `--manifest <file>` override so an author proofs a DEV binary against an on-disk manifest+install dir WITHOUT staging a full extracted GhReleaseManaged install (mirrors digest-proof's `--sample` pointing straight at a file). Fixes perri F-011: a bare-file-added gh_release adapter currently can't be resolved by the *-proof commands ('manifest is not present yet at <dir>'); un-stales the bare-file digest-proof int. (perri F-011, v0.13.x DX)"
required_stages = ["doc", "impl", "unit", "int"]  # v0.13.2 W5. doc = harness-contract patterns + MANIFEST.md proof note. impl = resolve_proof_target + the two --dir/--manifest flags. unit = resolve_proof_target resolution contract. int = translate_proof.rs override proofs an UNregistered on-disk install (real binary).

-required_stages = []  # additive DX; activate when built.

+required_stages = ["doc", "impl", "unit", "int"]  # v0.13.2 W5. doc = harness-contract patterns + MANIFEST.md proof note. impl = resolve_proof_target + the two --dir/--manifest flags. unit = resolve_proof_target resolution contract. int = translate_proof.rs override proofs an UNregistered on-disk install (real binary).


Find the proof pattern section in patterns.md + the MANIFEST.md proof prose:


docs-site\src\harness-contract\patterns.md:66:differs from the base value — and that diff is your proof the overlay resolved.
docs-site\src\harness-contract\patterns.md:177:  `digest-proof --sample` path).
docs-site\src\harness-contract\patterns.md:190:Prove the whole path with `spt adapter digest-proof <adapter> --sample <file>`
docs-site\src\harness-contract\patterns.md:202:broker parentage is the proof, so `api bind <id> --set-session-id <discovered>`
docs-site\src\harness-contract\patterns.md:324:  - `spt adapter digest-proof <a> --sample <file>` runs the real extractor
docs-site\src\harness-contract\patterns.md:327:    same runtime substitution keys the daemon does, so passing proof means it
docs-site\src\harness-contract\patterns.md:330:  - `spt adapter translate-proof <a> --event '<EVENT…>'` spawns and feeds your
docs-site\src\harness-contract\patterns.md:335:    the commit deadline live). The EMIT-half mirror of `digest-proof`; the


docs\MANIFEST.md:83:[Omitted long matching line]
docs\MANIFEST.md:177:Prove your extractor before shipping: `spt adapter digest-proof <adapter>
docs\MANIFEST.md:178:--sample <real-log>` runs it and prints the parsed records, the rendered digest,
docs\MANIFEST.md:263:`spt adapter digest-proof` to see exactly what dropped and why.


320	  - `spt api --adapter <a> --manifest <file> capability` reports the manifest's
321	    hostable types from the manifest alone — assert it advertises the type your
322	    bringup spawns. (A clean `add` already proves the cross-field shape, since add
323	    is manifest-first; `capability` is the lighter, non-mutating check.)
324	  - `spt adapter digest-proof <a> --sample <file>` runs the real extractor
325	    through the registry and renders the result — proving the
326	    transcript → record → render path end-to-end on a fixed sample. It fills the
327	    same runtime substitution keys the daemon does, so passing proof means it
328	    works at runtime. (Use a recent `spt` — current binaries fill the full key
329	    map.)
330	  - `spt adapter translate-proof <a> --event '<EVENT…>'` spawns and feeds your
331	    declared `[message-idle-translation-binary]` exactly as the daemon does at
332	    idle delivery, then prints the keystroke-command stream it emits
333	    (`{key}` / `{text}` / `{delay_ms}` / `{commit}`) — failing a binary that
334	    emits nothing or never sends a terminating `{commit}` (which would fault at
335	    the commit deadline live). The EMIT-half mirror of `digest-proof`; the
336	    atomic PTY apply stays covered by the daemon's integration gate.
337
338	And the meta-lesson: **observable behaviour of the public binary is itself public
339	surface.** When prose docs lag, a byte-capture against the live `api` / `adapter`
340	surface is a legitimate way to confirm a contract.
341
342	## Next
343
344	- **The full surface:** the [integration checklist](integration-checklist.md) —
345	  every contract surface grouped by necessity.
346	- **Reference:** the [manifest reference](manifest.md) and the
347	  [`spt api` surface](api.md).
348	- **Ship it:** the [install-on-demand bootstrap](install-on-demand.md).
349	- **Driven surfaces:** [Shells](../shells/overview.md) — the `kind = "shell"`

  - `spt api --adapter <a> --manifest <file> capability` reports the manifest's
    hostable types from the manifest alone — assert it advertises the type your
    bringup spawns. (A clean `add` already proves the cross-field shape, since add
    is manifest-first; `capability` is the lighter, non-mutating check.)
  - `spt adapter digest-proof <a> --sample <file>` runs the real extractor
    through the registry and renders the result — proving the
    transcript → record → render path end-to-end on a fixed sample. It fills the
    same runtime substitution keys the daemon does, so passing proof means it
    works at runtime. (Use a recent `spt` — current binaries fill the full key
    map.)
  - `spt adapter translate-proof <a> --event '<EVENT…>'` spawns and feeds your
    declared `[message-idle-translation-binary]` exactly as the daemon does at
    idle delivery, then prints the keystroke-command stream it emits
    (`{key}` / `{text}` / `{delay_ms}` / `{commit}`) — failing a binary that
    emits nothing or never sends a terminating `{commit}` (which would fault at
    the commit deadline live). The EMIT-half mirror of `digest-proof`; the
    atomic PTY apply stays covered by the daemon's integration gate.

And the meta-lesson: **observable behaviour of the public binary is itself public
surface.** When prose docs lag, a byte-capture against the live `api` / `adapter`
surface is a legitimate way to confirm a contract.

## Next

- **The full surface:** the [integration checklist](integration-checklist.md) —
  every contract surface grouped by necessity.
- **Reference:** the [manifest reference](manifest.md) and the
  [`spt api` surface](api.md).
- **Ship it:** the [install-on-demand bootstrap](install-on-demand.md).
- **Driven surfaces:** [Shells](../shells/overview.md) — the `kind = "shell"`


Add the `--dir`/`--manifest` doc note (tagged) to the patterns proof bullet:


    the commit deadline live). The EMIT-half mirror of `digest-proof`; the
    atomic PTY apply stays covered by the daemon's integration gate.

And the meta-lesson:

    the commit deadline live). The EMIT-half mirror of `digest-proof`; the
    atomic PTY apply stays covered by the daemon's integration gate.

<!-- [doc->REQ-ADAPTER-PROOF-DIR-OVERRIDE] -->
  - **Proof a DEV build off disk — `--dir` / `--manifest`.** Both `digest-proof`
    and `translate-proof` accept `--dir <install-dir>` (binaries resolve there,
    just like a registered install) or `--manifest <file>` (pins the manifest;
    its parent is the install dir) to proof an adapter that is **not registered**
    — e.g. a freshly built binary beside a hand-written `manifest.toml`, or a
    bare-file `gh_release` adapter that was never staged into a full extracted
    install. `--dir` defaults the manifest to `<dir>/manifest.toml`; with neither
    flag the command resolves the registered adapter as before. Mirrors
    `digest-proof --sample` pointing straight at a file — proof without a full
    `spt adapter add` round-trip.

And the meta-lesson:


The file C:\Users\decid\Documents\projects\spt-core\docs-site\src\harness-contract\patterns.md has been updated successfully. (file state is current in your context — no need to Read it back)

    the commit deadline live). The EMIT-half mirror of `digest-proof`; the
    atomic PTY apply stays covered by the daemon's integration gate.

And the meta-lesson:

    the commit deadline live). The EMIT-half mirror of `digest-proof`; the
    atomic PTY apply stays covered by the daemon's integration gate.

<!-- [doc->REQ-ADAPTER-PROOF-DIR-OVERRIDE] -->
  - **Proof a DEV build off disk — `--dir` / `--manifest`.** Both `digest-proof`
    and `translate-proof` accept `--dir <install-dir>` (binaries resolve there,
    just like a registered install) or `--manifest <file>` (pins the manifest;
    its parent is the install dir) to proof an adapter that is **not registered**
    — e.g. a freshly built binary beside a hand-written `manifest.toml`, or a
    bare-file `gh_release` adapter that was never staged into a full extracted
    install. `--dir` defaults the manifest to `<dir>/manifest.toml`; with neither
    flag the command resolves the registered adapter as before. Mirrors
    `digest-proof --sample` pointing straight at a file — proof without a full
    `spt adapter add` round-trip.

And the meta-lesson:

+  - **Proof a DEV build off disk — `--dir` / `--manifest`.** Both `digest-proof`

+    and `translate-proof` accept `--dir <install-dir>` (binaries resolve there,

+    just like a registered install) or `--manifest <file>` (pins the manifest;

+    its parent is the install dir) to proof an adapter that is **not registered**

+    — e.g. a freshly built binary beside a hand-written `manifest.toml`, or a

+    bare-file `gh_release` adapter that was never staged into a full extracted

+    install. `--dir` defaults the manifest to `<dir>/manifest.toml`; with neither

+    flag the command resolves the registered adapter as before. Mirrors

+    `digest-proof --sample` pointing straight at a file — proof without a full

And the meta-lesson: **observable behaviour of the public binary is itself public

surface.** When prose docs lag, a byte-capture against the live `api` / `adapter`

surface is a legitimate way to confirm a contract.


175	  fallbacks (`3` / `25` / collapse-on).
176
177	Prove your extractor before shipping: `spt adapter digest-proof <adapter>
178	--sample <real-log>` runs it and prints the parsed records, the rendered digest,
179	and **every dropped line with its reason** — no silent empty.
180
181	### `[strings]` — adapter string values (M9 / file-backed M12-W3)
182	An adapter-authored KV tree, dot-path-readable by anything on the node via `spt adapter get-string <adapter[:profile]> <key.path>` (data only — never executed; node-local). Resolves through the same leaf-replace profile overlay as the rest of the manifest. A value MAY be an inline literal **or** a file pointer — a value-position table with **exactly one** key `file`:
183	```toml
184	[strings]
185	greeting = "hello"                       # inline
186	skills.whoami = { file = "whoami.md" }   # pointer → get-string returns the file's CONTENTS

  fallbacks (`3` / `25` / collapse-on).

Prove your extractor before shipping: `spt adapter digest-proof <adapter>
--sample <real-log>` runs it and prints the parsed records, the rendered digest,
and **every dropped line with its reason** — no silent empty.

### `[strings]` — adapter string values (M9 / file-backed M12-W3)
An adapter-authored KV tree, dot-path-readable by anything on the node via `spt adapter get-string <adapter[:profile]> <key.path>` (data only — never executed; node-local). Resolves through the same leaf-replace profile overlay as the rest of the manifest. A value MAY be an inline literal **or** a file pointer — a value-position table with **exactly one** key `file`:
```toml
[strings]
greeting = "hello"                       # inline
skills.whoami = { file = "whoami.md" }   # pointer → get-string returns the file's CONTENTS


Prove your extractor before shipping: `spt adapter digest-proof <adapter>
--sample <real-log>` runs it and prints the parsed records, the rendered digest,
and **every dropped line with its reason** — no silent empty.

Prove your extractor before shipping: `spt adapter digest-proof <adapter>
--sample <real-log>` runs it and prints the parsed records, the rendered digest,
and **every dropped line with its reason** — no silent empty.

<!-- [doc->REQ-ADAPTER-PROOF-DIR-OVERRIDE] -->
To proof a **DEV build that is not registered** (a freshly built binary beside a
hand-written `manifest.toml`, or a bare-file `gh_release` adapter never staged
into an extracted install), pass `--dir <install-dir>` (binaries resolve there;
manifest defaults to `<dir>/manifest.toml`) or `--manifest <file>` (pins the
manifest; its parent is the install dir) to either `digest-proof` or
`translate-proof`. With neither, the command resolves the registered adapter.


The file C:\Users\decid\Documents\projects\spt-core\docs\MANIFEST.md has been updated successfully. (file state is current in your context — no need to Read it back)

Prove your extractor before shipping: `spt adapter digest-proof <adapter>
--sample <real-log>` runs it and prints the parsed records, the rendered digest,
and **every dropped line with its reason** — no silent empty.

<!-- [doc->REQ-ADAPTER-PROOF-DIR-OVERRIDE] -->
To proof a **DEV build that is not registered** (a freshly built binary beside a
hand-written `manifest.toml`, or a bare-file `gh_release` adapter never staged
into an extracted install), pass `--dir <install-dir>` (binaries resolve there;
manifest defaults to `<dir>/manifest.toml`) or `--manifest <file>` (pins the
manifest; its parent is the install dir) to either `digest-proof` or
`translate-proof`. With neither, the command resolves the registered adapter.

+To proof a **DEV build that is not registered** (a freshly built binary beside a

+hand-written `manifest.toml`, or a bare-file `gh_release` adapter never staged

+into an extracted install), pass `--dir <install-dir>` (binaries resolve there;

+manifest defaults to `<dir>/manifest.toml`) or `--manifest <file>` (pins the

+manifest; its parent is the install dir) to either `digest-proof` or

+`translate-proof`. With neither, the command resolves the registered adapter.

### `[strings]` — adapter string values (M9 / file-backed M12-W3)

An adapter-authored KV tree, dot-path-readable by anything on the node via `spt adapter get-string <adapter[:profile]> <key.path>` (data only — never executed; node-local). Resolves through the same leaf-replace profile overlay as the rest of the manifest. A value MAY be an inline literal **or** a file pointer — a value-position table with **exactly one** key `file`:


Gates. First regenerate the CLI reference (new flags → drift) + run the unit tests:


PowerShell

cargo run -p xtask -- gen 2>&1 | Select-Object -Last 8; "GEN_EXIT=$LASTEXITCODE"

Regenerate CLI reference doc


   Compiling spt-daemon v0.13.1 (C:\Users\decid\Documents\projects\spt-core\crates\spt-daemon)
   Compiling xtask v0.13.1 (C:\Users\decid\Documents\projects\spt-core\crates\xtask)
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 12.71s
     Running `target\debug\xtask.exe gen`
xtask gen: wrote C:\Users\decid\Documents\projects\spt-core\docs-site/src/cli/reference.md
GEN_EXIT=0


cargo test -p spt --bin spt resolve_proof_target 2>&1 | Select-Object -Last 12; "---PARSE---"; cargo test -p spt --bin spt adapter_parsing 2>&1 | Select-String -Pattern "test result|DigestProof|TranslateProof|FAILED|error\[" | Select-Object -Last 8

Run resolve_proof_target unit + adapter parse tests


   Compiling iroh v0.98.2
   Compiling spt-net v0.13.1 (C:\Users\decid\Documents\projects\spt-core\crates\spt-net)
   Compiling spt-daemon v0.13.1 (C:\Users\decid\Documents\projects\spt-core\crates\spt-daemon)
   Compiling spt v0.13.1 (C:\Users\decid\Documents\projects\spt-core\crates\spt)
    Finished `test` profile [unoptimized + debuginfo] target(s) in 29.18s
     Running unittests src\main.rs (target\debug\deps\spt-6f1a15e62d04e408.exe)

running 1 test
test cli::tests::resolve_proof_target_override_reads_on_disk ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 226 filtered out; finished in 0.01s

---PARSE---

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 227 filtered out; finished in 0.00s


resolve_proof_target passes. Run the adapter-parse test (find its name) + the int:


Bash

grep -n "fn adapter.*parse\|fn .*proof.*parse\|fn parse.*adapter\|DigestProof { option, sample" crates/spt/src/cli.rs | head

Find parse test fn name


6019:        AdapterCmd::DigestProof { option, sample, session, dir, manifest } => {
8309:    fn adapter_add_transport_flags_parse() {
9427:    fn adapter_subcommands_parse() {
9514:                action: AdapterCmd::DigestProof { option, sample, session, dir, manifest },
9637:    fn adapter_translate_proof_parses() {


PowerShell

cargo test -p spt --bin spt "adapter_subcommands_parse" 2>&1 | Select-String -Pattern "test result|FAILED|panic"; "---"; cargo test -p spt --bin spt "adapter_translate_proof_parses" 2>&1 | Select-String -Pattern "test result|FAILED|panic"

Run the two proof parse tests


test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 226 filtered out; finished in 0.01s
---
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 226 filtered out; finished in 0.00s


Both parse tests pass. Now the int (builds the fixture, runs real binary):


cargo test -p spt --test translate_proof 2>&1 | Select-String -Pattern "test result|FAILED|panic|TRANSLATE_PROOF|error\[|assert" | Select-Object -Last 15

Run translate_proof int suite (incl new override test)


     Running tests\translate_proof.rs (target\debug\deps\translate_proof-8c8c5d51a8f4181b.exe)
test translate_proof_dir_override_proofs_unregistered_install ... ok
test translate_proof_drives_the_real_translation_binary ... ok
test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 5.88s


Int passes (new override + original). Now traceable-reqs check, clippy, xtask drift check:


traceable-reqs check 2>&1 | Select-String -Pattern "ADAPTER-PROOF-DIR-OVERRIDE"; "TRACE_EXIT=$LASTEXITCODE"; "---XTASK---"; cargo run -p xtask -- check 2>&1 | Select-String -Pattern "drift|OK|FAIL|error|dead|Finished" | Select-Object -Last 10; "XTASK_EXIT=$LASTEXITCODE"

traceable-reqs + xtask drift check


cargo clippy --workspace --all-targets -- -D warnings 2>&1 | Select-String -Pattern "warning|error|Finished" | Select-Object -Last 15; "CLIPPY_EXIT=$LASTEXITCODE"

Workspace clippy CI form


  [OK] REQ-ADAPTER-PROOF-DIR-OVERRIDE  required: [doc, impl, unit, int]  stages: +doc +impl +unit +int
TRACE_EXIT=0
---XTASK---
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 0.49s
xtask check: OK
XTASK_EXIT=0


    Finished `dev` profile [unoptimized + debuginfo] target(s) in 3.15s
CLIPPY_EXIT=0


All green: traceable EXIT=0 (REQ +doc +impl +unit +int), xtask check OK, clippy EXIT=0. Stage + commit W5:


Bash

cd "C:/Users/decid/Documents/projects/spt-core" && git status --short

Confirm changed file set


 M crates/spt/src/cli.rs
 M crates/spt/tests/translate_proof.rs
 M docs-site/src/cli/reference.md
 M docs-site/src/harness-contract/patterns.md
 M docs/MANIFEST.md
 M traceable-reqs.toml


cd "C:/Users/decid/Documents/projects/spt-core" && git add -A && git commit -q -F - <<'EOF'
feat(cli): W5 *-proof --dir/--manifest override (REQ-ADAPTER-PROOF-DIR-OVERRIDE)

`spt adapter digest-proof` / `translate-proof` gain `--dir <path>` and
`--manifest <file>` so an author proofs a DEV binary against an on-disk
manifest+install dir WITHOUT staging a full extracted install. Fixes perri
F-011: a bare-file-added gh_release adapter the registry can't resolve
('manifest is not present yet at <dir>') is now proofable. Mirrors
`digest-proof --sample` pointing straight at a file.

- cli.rs: resolve_proof_target() — no override → registry::resolve_option
  (unchanged path); `--dir` sets the install dir + defaults manifest to
  `<dir>/manifest.toml`; `--manifest` pins the file (parent = install dir).
  Both proof commands route through it; flags added to both clap variants.
- int (translate_proof.rs): the override proofs an UNREGISTERED on-disk install
  end-to-end against the real translation-binary fixture — control (no override
  → resolve FAIL), then `--dir` and `--manifest` each proof (exit 0, full EMIT
  stream). No mocks.
- unit: resolve_proof_target resolution contract (dir/manifest/both/bad-path/
  registry-fallback).
- docs: harness-contract patterns + docs/MANIFEST.md proof note [doc] evidence;
  CLI reference regenerated (xtask gen); xtask drift check OK.
- traceable: REQ-ADAPTER-PROOF-DIR-OVERRIDE activated [doc, impl, unit, int].

Gates: 1 unit + 2 parse unit + 2 int tests pass; traceable-reqs check exit 0
(REQ +doc +impl +unit +int); xtask check OK; clippy --workspace --all-targets
-D warnings clean.

Co-authored by: todlando
EOF
git log --oneline -1

Commit W5


warning: in the working copy of 'docs-site/src/cli/reference.md', LF will be replaced by CRLF the next time Git touches it
acf2387 feat(cli): W5 *-proof --dir/--manifest override (REQ-ADAPTER-PROOF-DIR-OVERRIDE)


W5 committed @acf2387. Ping doyle for the gate.


$OWL send doyle <<'EOF'
W5 ready for your gate — REQ-ADAPTER-PROOF-DIR-OVERRIDE @acf2387 (branch v0.13.2-adapter-packaging). Closes perri F-011.

WHAT: `spt adapter digest-proof` / `translate-proof` gain `--dir <path>` + `--manifest <file>` → proof a DEV binary against an on-disk manifest+install dir WITHOUT staging a full extracted install. Fixes F-011 (bare-file gh_release adapter the registry can't resolve). Mirrors `digest-proof --sample`.

IMPL:
- cli.rs resolve_proof_target(): NEITHER flag → registry::resolve_option (unchanged normal path); --dir → install_dir=dir, manifest=<dir>/manifest.toml; --manifest → pins file, parent=install_dir; both → dir wins. Both proof cmds route through it; flags on both clap variants.

GATES (all green, ran them):
- unit resolve_proof_target_override_reads_on_disk: dir / manifest / both / bad-path-errs / registry-fallback-errs.
- 2 parse unit tests updated+pass (DigestProof/TranslateProof destructures).
- INT translate_proof.rs (real spt bin + real translation fixture, NO mocks): control = unregistered "dev" FAILS to resolve without override (TRANSLATE_PROOF_FAIL); then --dir proofs exit 0 full EMIT stream (XLATE_OK + TRANSLATE_PROOF_OK:dev); then --manifest proofs same. This IS the F-011 un-stale.
- traceable-reqs check EXIT=0, REQ = +doc +impl +unit +int.
- xtask check OK (CLI reference regenerated via xtask gen — new flags; no drift).
- clippy --workspace --all-targets -D warnings EXIT=0.

NON-VACUITY: the int's control case (resolve FAIL without override, OK with) is the load-bearing assertion — proves the override is what enables the bare-file proof, not incidental registration. digest-proof shares resolve_proof_target verbatim (unit-covered); int exercises translate-proof's real-binary path.

This is the last build wave before W6 (operator-added). Holding for your W5 verdict. After W6 → deployah cuts v0.13.2; perri drops the F-014 stopgap on W1 publish + F-011 closes here.
EOF

Send W5 gate request to doyle


➜ SENT:doyle


**W5 done + committed @acf2387.** Gate request SENT to doyle.

Summary:
- **REQ-ADAPTER-PROOF-DIR-OVERRIDE** — `--dir`/`--manifest` on both proof commands via shared `resolve_proof_target()` (no override → unchanged registry path; closes perri F-011)
- **int** (real spt bin + real fixture, no mocks): control = unregistered fails without override → proofs with `--dir` and `--manifest` (exit 0, full EMIT stream)
- **unit** resolution contract + 2 parse tests updated
- **docs**: patterns + MANIFEST.md `[doc]` evidence; CLI reference regenerated (xtask gen)
- REQ activated `[doc, impl, unit, int]`

Gates: 1 unit + 2 parse + 2 int pass; traceable EXIT=0 (+doc +impl +unit +int); xtask check OK; clippy clean.

Holding for doyle's W5 verdict. Next per build order: **W6** (operator-added — not yet specified in the JIT plan I have). When W5 clears, I'll need the W6 scope from the operator before proceeding, then deployah cuts v0.13.2.


<task-notification>
<task-id>bsp4y8a8u</task-id>
Monitor event: "« spt event »"
<event><EVENT-PART seq="1/7" id="ccf9d914" type="msg" from="doyle">W5 GATE — HOLD (one fix), everything else GREEN. REQ-ADAPTER-PROOF-DIR-OVERRIDE @acf2387.

GREEN (re-ran all myself): unit resolve_proof_target 1/1, parse 2/2, int translate_proof 2/2 (the new override test drives the REAL fixture binary 5.86s, control case non-vacuous — resolve FAIL w/o override → OK with),</EVENT-PART>
<EVENT-PART seq="2/7" id="ccf9d914"> traceable EXIT=0 (+doc+impl+unit+int), clippy clean. resolve_proof_target seam is correct: neither→registry (unchanged), --dir→&lt;dir&gt;/manifest.toml, --manifest→pins file/parent=install dir, both→dir wins. Routed through both proof cmds. int IS the F-011 un-stale. Solid work.

BLOCKER — public --help leaks internal tracker</EVENT-PART>
<EVENT-PART seq="3/7" id="ccf9d914"> codes. The 4 new clap `///` doc-comments (--dir + --manifest, on BOTH digest-proof and translate-proof) contain &quot;(F-011)&quot; and &quot;(REQ-INSTALL-11)&quot;. `///` IS the public --help → regenerated into docs-site/src/cli/reference.md → ships to GH-Pages on release. Two conventions violated: no REQ/tracker codes in public --help (</EVENT-PART>
<EVENT-PART seq="4/7" id="ccf9d914">it's user-facing), and published docs never carry internal milestone/tracker codes. F-011 is perri's private gap code — meaningless to a public adapter author reading --help.

Why it slipped: xtask check only proves generated==source (no drift); it does NOT scan for forbidden tokens, so a leak that's faithfully regenerated passes. Real</EVENT-PART>
<EVENT-PART seq="5/7" id="ccf9d914"> green-units≠green-public.

FIX (yours, fast):
1. Scrub &quot;(F-011)&quot; and &quot;(REQ-INSTALL-11)&quot; from the 4 `///` flag docs. Keep the substance — e.g. &quot;...resolve in this dir before PATH (the same resolution the daemon uses)...&quot; instead of &quot;(REQ-INSTALL-11)&quot;, and drop &quot;(F-011)&quot; entirely.<b</EVENT-PART>
<EVENT-PART seq="6/7" id="ccf9d914">r>2. The `// [impl-&gt;REQ-ADAPTER-PROOF-DIR-OVERRIDE]` LINE comments stay — those are `//` not `///`, not public, correct as traceable evidence.
3. xtask gen to regen reference.md, xtask check to confirm no drift, re-push.

NON-BLOCKING follow-on idea for W6/later: add a forbidden-token scan (REQ-*/M#-W#/F-### ) over the generated </EVENT-PART>
<EVENT-PART seq="7/7" id="ccf9d914">reference.md to the docs gate so this class can't recur — your call whether it fits W6.

Re-ping when scrubbed; this is the only thing between W5 and PASS.</EVENT-PART></event>
</task-notification>


<owl_reachability_notice>
You have an active owl perch. When spawning subagents or doing work, use run_in_background: true so you stay reachable for incoming messages.
</owl_reachability_notice>


CAVEMAN MODE ACTIVE (full). Drop articles/filler/pleasantries/hedging. Fragments OK. Code/commits/security: write normal.


doyle: W5 HOLD — one fix. The two `--dir` `///` docs leak "(F-011)" + "(REQ-INSTALL-11)" into public `--help` → ships to GH-Pages. Correct catch. Scrub the tracker codes, keep substance. (The `--manifest` docs + `//` impl tags are clean — leave them.)


Edit

        /// Proof against an on-disk install **dir** instead of the registered
        /// adapter (F-011): binaries resolve here (REQ-INSTALL-11) and the
        /// manifest defaults to `<dir>/manifest.toml`. No full extracted install
        /// needed — proof a DEV binary straight from its build dir.
        #[arg(long)]
        dir: Option<String>,
        /// Pin the manifest **file** for the proof (overrides `<dir>/manifest.toml`;
        /// absent `--dir`, its parent dir is the install dir). Lets a bare-file
        /// `gh_release` adapter proof without staging an extracted install.
        #[arg(long)]
        manifest: Option<String>,
    },
    /// Prove an adapter's `[message-idle-translation-binary]` against an inbound

        /// Proof against an on-disk install **dir** instead of the registered
        /// adapter: binaries resolve in this dir before PATH (the same resolution
        /// the daemon uses) and the manifest defaults to `<dir>/manifest.toml`. No
        /// full extracted install needed — proof a DEV binary from its build dir.
        #[arg(long)]
        dir: Option<String>,
        /// Pin the manifest **file** for the proof (overrides `<dir>/manifest.toml`;
        /// absent `--dir`, its parent dir is the install dir). Lets a bare-file
        /// `gh_release` adapter proof without staging an extracted install.
        #[arg(long)]
        manifest: Option<String>,
    },
    /// Prove an adapter's `[message-idle-translation-binary]` against an inbound


The file C:\Users\decid\Documents\projects\spt-core\crates\spt\src\cli.rs has been updated successfully. (file state is current in your context — no need to Read it back)

        /// Proof against an on-disk install **dir** instead of the registered
        /// adapter (F-011): binaries resolve here (REQ-INSTALL-11) and the
        /// manifest defaults to `<dir>/manifest.toml`. No full extracted install
        /// needed — proof a DEV binary straight from its build dir.
        #[arg(long)]
        dir: Option<String>,
        /// Pin the manifest **file** for the proof (overrides `<dir>/manifest.toml`;
        /// absent `--dir`, its parent dir is the install dir). Lets a bare-file
        /// `gh_release` adapter proof without staging an extracted install.
        #[arg(long)]
        manifest: Option<String>,
    },
    /// Prove an adapter's `[message-idle-translation-binary]` against an inbound

        /// Proof against an on-disk install **dir** instead of the registered
        /// adapter: binaries resolve in this dir before PATH (the same resolution
        /// the daemon uses) and the manifest defaults to `<dir>/manifest.toml`. No
        /// full extracted install needed — proof a DEV binary from its build dir.
        #[arg(long)]
        dir: Option<String>,
        /// Pin the manifest **file** for the proof (overrides `<dir>/manifest.toml`;
        /// absent `--dir`, its parent dir is the install dir). Lets a bare-file
        /// `gh_release` adapter proof without staging an extracted install.
        #[arg(long)]
        manifest: Option<String>,
    },
    /// Prove an adapter's `[message-idle-translation-binary]` against an inbound

-        /// adapter (F-011): binaries resolve here (REQ-INSTALL-11) and the

-        /// manifest defaults to `<dir>/manifest.toml`. No full extracted install

-        /// needed — proof a DEV binary straight from its build dir.

+        /// adapter: binaries resolve in this dir before PATH (the same resolution

+        /// the daemon uses) and the manifest defaults to `<dir>/manifest.toml`. No

+        /// full extracted install needed — proof a DEV binary from its build dir.


        /// Proof against an on-disk install **dir** instead of the registered
        /// adapter (F-011): the translation binary resolves here (REQ-INSTALL-11)
        /// and the manifest defaults to `<dir>/manifest.toml`. No full extracted
        /// install needed — proof a DEV binary straight from its build dir.
        #[arg(long)]
        dir: Option<String>,
        /// Pin the manifest **file** for the proof (overrides `<dir>/manifest.toml`;
        /// absent `--dir`, its parent dir is the install dir). Lets a bare-file
        /// `gh_release` adapter proof without staging an extracted install.
        #[arg(long)]
        manifest: Option<String>,
    },
    /// Set a `[strings]` dot-path on a **local** profile (`<adapter>:<profile>`).

        /// Proof against an on-disk install **dir** instead of the registered
        /// adapter: the translation binary resolves in this dir before PATH (the
        /// same resolution the daemon uses) and the manifest defaults to
        /// `<dir>/manifest.toml`. No full extracted install needed — proof a DEV
        /// binary from its build dir.
        #[arg(long)]
        dir: Option<String>,
        /// Pin the manifest **file** for the proof (overrides `<dir>/manifest.toml`;
        /// absent `--dir`, its parent dir is the install dir). Lets a bare-file
        /// `gh_release` adapter proof without staging an extracted install.
        #[arg(long)]
        manifest: Option<String>,
    },
    /// Set a `[strings]` dot-path on a **local** profile (`<adapter>:<profile>`).


        /// Proof against an on-disk install **dir** instead of the registered
        /// adapter (F-011): the translation binary resolves here (REQ-INSTALL-11)
        /// and the manifest defaults to `<dir>/manifest.toml`. No full extracted
        /// install needed — proof a DEV binary straight from its build dir.
        #[arg(long)]
        dir: Option<String>,
        /// Pin the manifest **file** for the proof (overrides `<dir>/manifest.toml`;
        /// absent `--dir`, its parent dir is the install dir). Lets a bare-file
        /// `gh_release` adapter proof without staging an extracted install.
        #[arg(long)]
        manifest: Option<String>,
    },
    /// Set a `[strings]` dot-path on a **local** profile (`<adapter>:<profile>`).

        /// Proof against an on-disk install **dir** instead of the registered
        /// adapter: the translation binary resolves in this dir before PATH (the
        /// same resolution the daemon uses) and the manifest defaults to
        /// `<dir>/manifest.toml`. No full extracted install needed — proof a DEV
        /// binary from its build dir.
        #[arg(long)]
        dir: Option<String>,
        /// Pin the manifest **file** for the proof (overrides `<dir>/manifest.toml`;
        /// absent `--dir`, its parent dir is the install dir). Lets a bare-file
        /// `gh_release` adapter proof without staging an extracted install.
        #[arg(long)]
        manifest: Option<String>,
    },
    /// Set a `[strings]` dot-path on a **local** profile (`<adapter>:<profile>`).

-        /// adapter (F-011): the translation binary resolves here (REQ-INSTALL-11)

-        /// and the manifest defaults to `<dir>/manifest.toml`. No full extracted

-        /// install needed — proof a DEV binary straight from its build dir.

+        /// adapter: the translation binary resolves in this dir before PATH (the

+        /// same resolution the daemon uses) and the manifest defaults to

+        /// `<dir>/manifest.toml`. No full extracted install needed — proof a DEV


Scrubbed both `--dir` docs. Regenerate reference + verify the leak is gone:


PowerShell

cargo run -p xtask -- gen 2>&1 | Select-Object -Last 2; "---scan generated reference for tracker leaks near proof flags---"; Select-String -Path docs-site/src/cli/reference.md -Pattern "F-011|REQ-INSTALL-11" | ForEach-Object { $_.LineNumber.ToString() + ': ' + $_.Line }; "SCAN_DONE"

Regen reference + scan for leaked tracker codes


     Running `target\debug\xtask.exe gen`
xtask gen: wrote C:\Users\decid\Documents\projects\spt-core\docs-site/src/cli/reference.md
---scan generated reference for tracker leaks near proof flags---
SCAN_DONE


Leak gone. Broader scan of generated reference for the whole forbidden-token class:


Select-String -Path docs-site/src/cli/reference.md -Pattern "REQ-[A-Z]|F-\d{3}|\bM\d+-W\d+|ADR-\d" | ForEach-Object { $_.LineNumber.ToString() + ': ' + $_.Line }; "SCAN_DONE exit=$LASTEXITCODE"

Scan whole reference for tracker-code class


72:   digest-proof     Prove an adapter's [digest] extractor against a real log sample (ADR-0019).
78:                    (ADR-0022). Spawns and feeds the declared translation binary exactly as the
223: Prove an adapter's [digest] extractor against a real log sample (ADR-0019). Runs the declared
253: Prove an adapter's [message-idle-translation-binary] against an inbound event (ADR-0022). Spawns
268:       --event <EVENT>        The inbound <EVENT…> envelope to feed (ADR-0020). {id} and
555:           Take control: kick the current controller (a loud notice to them) and drive (REQ-KICK-1).
892:                   projection (ADR-0008 amendment, REQ-TERM-4)
920:           adapter_name — the calling harness adapter. Optional (ADR-0021): an explicit
981:                                        (REQ-EP-1/REQ-EP-6). A revive keeps the prior type unless
1193: appended to the perch's digest store, tailed by the session-digest projection (ADR-0008 amendment,
1194: REQ-TERM-4)
1755:                              an agent-family sender is re-stamped to plain msg (REQ-MSG-5)
SCAN_DONE exit=


Those remaining codes (ADR-*, REQ-KICK-1, REQ-TERM-4…) are pre-existing in other commands' help, not my change — out of W5 scope (that's doyle's deferred forbidden-token-scan idea). My leak (F-011, REQ-INSTALL-11) is gone. Confirm no drift + commit the fix:


cargo run -p xtask -- check 2>&1 | Select-String -Pattern "OK|FAIL|drift|dead"; "XTASK_EXIT=$LASTEXITCODE"

xtask drift check after scrub+regen


xtask check: OK
XTASK_EXIT=0


Bash

cd "C:/Users/decid/Documents/projects/spt-core" && git add -A && git status --short && git commit -q -F - <<'EOF'
fix(cli): scrub internal tracker codes from public *-proof --help (W5)

The two new `--dir` clap `///` doc-comments (digest-proof + translate-proof)
leaked "(F-011)" and "(REQ-INSTALL-11)" into public `--help`, which xtask gen
regenerates into docs-site/src/cli/reference.md and ships to GH-Pages — both a
user-facing-help convention (no REQ/tracker codes) and a published-docs
convention violation. F-011 is a private tracker code, meaningless to a public
adapter author.

Substance kept ("binaries resolve in this dir before PATH — the same resolution
the daemon uses"); the `// [impl->REQ-ADAPTER-PROOF-DIR-OVERRIDE]` line comments
(non-public `//`, traceable evidence) are unchanged. CLI reference regenerated;
xtask check OK (no drift, leak gone). doyle W5 gate fix.

Co-authored by: todlando
EOF
git log --oneline -1

Commit the help-leak scrub


warning: in the working copy of 'docs-site/src/cli/reference.md', LF will be replaced by CRLF the next time Git touches it
M  crates/spt/src/cli.rs
M  docs-site/src/cli/reference.md
ce179a1 fix(cli): scrub internal tracker codes from public *-proof --help (W5)


Scrubbed + committed @ce179a1. Re-ping doyle:


$OWL send doyle <<'EOF'
W5 SCRUBBED — re-ping for PASS. @ce179a1 (on top of acf2387).

FIX: removed "(F-011)" and "(REQ-INSTALL-11)" from the 2 new `--dir` `///` doc-comments (digest-proof + translate-proof). Substance kept — now reads "binaries resolve in this dir before PATH (the same resolution the daemon uses) and the manifest defaults to <dir>/manifest.toml". The `--manifest` docs had no tracker codes (untouched). The `// [impl->REQ-ADAPTER-PROOF-DIR-OVERRIDE]` LINE comments stay (//, non-public, traceable evidence) — confirmed correct, per your note.

VERIFIED:
- xtask gen → reference.md regenerated; grep of reference.md for F-011 / REQ-INSTALL-11 = ZERO hits.
- xtask check OK (no drift, leak gone).

SCOPE NOTE on your forbidden-token idea: I scanned the FULL generated reference.md for the class (REQ-*/F-###/M#-W#/ADR-*). Found PRE-EXISTING codes in OTHER commands' help — REQ-KICK-1, REQ-TERM-4, REQ-EP-1/6, REQ-MSG-5, plus several ADR-#### refs — all on main, none mine. Left them: out of W5 scope, and they're exactly what your deferred forbidden-token-scan gate would sweep. Flagging so it's on record: a real scan would flag ~8 sites today, so the gate has teeth (and pre-existing cleanup, your call on W6 fit).

W5 substance unchanged from the gate you already greenlit (units/int/traceable/clippy all still green — doc-comment-text-only change). Re-ping for verdict.
EOF

Re-ping doyle W5 scrubbed


Scrubbed-fix re-ping SENT to doyle.

**Status:**
- W4 @311b2dc — doyle PASS
- W5 @acf2387 + scrub @ce179a1 — re-ping sent (only the help-leak blocked it; substance already greenlit)

**Holding on two things:**
1. doyle's W5 verdict (re-ping out)
2. **W6 scope** — operator-added after W5 in the build order, but the JIT plan I have (`V0.13.2-ADAPTER-PACKAGING-JIT.md`) only specs W1–W5. Need W6's REQ/scope from the operator before I can build it.

After W6 → deployah cuts v0.13.2 (perri then drops F-014 stopgap on W1 publish; F-011 closed by W5).

Flagged doyle's forbidden-token-scan idea on record: a real scan finds ~8 pre-existing leak sites in `reference.md` today (REQ-KICK-1, REQ-TERM-4, ADR-* refs, etc.) — has teeth, candidate for W6.

What's W6?


<task-notification>
<task-id>bsp4y8a8u</task-id>
Monitor event: "« spt event »"
<event><EVENT-PART seq="1/5" id="ef878224" type="msg" from="doyle">W5 GATE PASS. @ce179a1. REQ-ADAPTER-PROOF-DIR-OVERRIDE fully gated.

Verified the scrub myself: reference.md grep for F-011 / REQ-INSTALL-11 = ZERO. The 3 remaining cli.rs `///` hits (2856 extract_release_archive, 6484/6486 resolve_proof_target) are rustdoc on private FNs, never rendered to --help — correct to l</EVENT-PART>
<EVENT-PART seq="2/5" id="ef878224">eave, that's where REQ cross-refs belong. xtask check OK (no drift, generated==source). Functional gates hold from the pre-scrub greenlight (doc-comment-text-only change): unit 1/1, parse 2/2, int 2/2 (real-binary override, non-vacuous control), traceable +doc+impl+unit+int, clippy clean.

The clap-`///` (public --help) vs fn-`///` (rust</EVENT-PART>
<EVENT-PART seq="3/5" id="ef878224">doc) distinction is exactly right — you scrubbed the right 2, left the right 3. Clean fix.

ON YOUR PRE-EXISTING LEAK NOTE: confirmed, ~5+ sites in reference.md TODAY on main (REQ-KICK-1, REQ-TERM-4, REQ-EP-1/6, REQ-MSG-5, + ADR-#### refs). NOT your regression — they've shipped public since those commands landed. So: NOT a v0.13.2 bl</EVENT-PART>
<EVENT-PART seq="4/5" id="ef878224">ocker, NOT in W5/W6 scope unless the operator says so. The forbidden-token-scan gate + the pre-existing sweep are one follow-on item — I'll surface it to the operator as a post-v0.13.2 cleanup decision, not hold the release on it. Good catch keeping it on record.

W5 DONE. Proceed to W6 (operator-added). Ping me when it's ready to gate</EVENT-PART>
<EVENT-PART seq="5/5" id="ef878224">. After W6 → deployah cuts v0.13.2; F-011 closes here, perri drops the F-014 stopgap on W1 publish.</EVENT-PART></event>
</task-notification>


doyle: **W5 GATE PASS** @ce179a1. Confirmed scrub (reference.md zero F-011/REQ-INSTALL-11); the 3 remaining `///` hits are rustdoc on private fns (not `--help`) — correct to leave. Forbidden-token-scan + pre-existing sweep → he'll route to operator as post-v0.13.2 cleanup, not a release blocker.

**W4 ✅ W5 ✅ — both fully gated.** Next is W6, but I'm blocked on scope.

The JIT plan (`V0.13.2-ADAPTER-PACKAGING-JIT.md`) only specs W1–W5. The commune said the operator **added W6 after W5** but its scope never landed in the plan or my context. I can't build it blind.

**Need from you: what is W6?** Once I have a REQ/scope I'll mint it in `traceable-reqs.toml` (rule 3), build, gate with doyle, then deployah cuts v0.13.2.

If W6 *is* the forbidden-token-scan gate doyle just flagged (public `reference.md` leaks: F-011 was mine/fixed, but ~5+ pre-existing — REQ-KICK-1, REQ-TERM-4, REQ-EP-1/6, REQ-MSG-5, ADR-* — ship public today), say so and I'll scope it: a docs-gate scan + the pre-existing sweep. Otherwise, give me the W6 intent.


<task-notification>
<task-id>bsp4y8a8u</task-id>
Monitor event: "« spt event »"
<event><EVENT-PART seq="1/7" id="37777a6c" type="msg" from="doyle">W6 SCOPE ADD (operator-directed) — fold the public-docs token sweep + a forbidden-token gate into W6. Operator ruling: BAN ALL internal codes incl ADR from public CLI --help / reference.md.

MINT FIRST (rule 3, in your W6 commit before satisfying):
  id = &quot;REQ-DOCS-NO-INTERNAL-CODES&quot;
  title: Pub</EVENT-PART>
<EVENT-PART seq="2/7" id="37777a6c">lic CLI --help (the clap `///` doc-comments) and the generated docs-site/src/cli/reference.md MUST NOT contain internal tracker/decision codes — REQ-*, F-###, M#-W#, ADR-#### — they are meaningless to an end user reading --help and ship to GH-Pages. A CI-gated scan (the xtask docs gate) fails on any such token in the GENERATED reference.md</EVENT-PART>
<EVENT-PART seq="3/7" id="37777a6c"> (which by construction contains only clap help, so rustdoc `///` on fns/structs is out of scope and keeps its REQ/ADR cross-refs). Substance is kept; codes are rewritten to plain language. (v0.13.2 W6)
  required_stages = [&quot;doc&quot;,&quot;impl&quot;,&quot;unit&quot;]
  - doc: a DOCS-STRATEGY.md line stating the public-help no-inte</EVENT-PART>
<EVENT-PART seq="4/7" id="37777a6c">rnal-codes rule.
  - impl: (a) the scan added to `xtask check` (CI both runners) over reference.md; (b) the sweep of all existing sites.
  - unit: xtask test — a planted forbidden token FAILS the scan (non-vacuous), a clean reference PASSES.

SWEEP INVENTORY — 14 occurrences / 12 lines in reference.md today (grep the code in cl</EVENT-PART>
<EVENT-PART seq="5/7" id="37777a6c">i.rs to find each clap `///`; rewrite to plain language, keep meaning):
  REQ: REQ-KICK-1, REQ-TERM-4 (x2), REQ-EP-1, REQ-EP-6, REQ-MSG-5
  ADR: ADR-0019 (x2, digest-proof), ADR-0022 (x2, translate-proof), ADR-0020 (translate --event), ADR-0008 (x2), ADR-0021
  All pre-existing on main, NOT v0.13.2 regressions — but operator wants t</EVENT-PART>
<EVENT-PART seq="6/7" id="37777a6c">hem gone this release.

CRITICAL on the gate: scan the GENERATED reference.md, not source. That structurally scopes to public help only (rustdoc fn/struct `///` like resolve_proof_target / extract_release_archive keep their REQ/ADR refs — correct, they're not public). And remember: regen alone keeps drift==0 but leaves a leak (that's e</EVENT-PART>
<EVENT-PART seq="7/7" id="37777a6c">xactly how W5's slipped) — the NEW scan is what gives xtask check teeth.

AFTER W6 green → ping me to gate (I'll re-run: xtask check w/ the new scan, the planted-token unit, full reference.md grep = zero, traceable, clippy). Then deployah cuts v0.13.2.

This is the last scope. Build it and ping.</EVENT-PART></event>
</task-notification>


W6 scope received (operator-directed): **REQ-DOCS-NO-INTERNAL-CODES** — ban REQ-*/F-###/M#-W#/ADR-#### from public `--help` + generated `reference.md`; sweep all sites; add a CI-gated scan over the GENERATED reference.md (gives `xtask check` teeth — regen alone leaves leaks); unit-test it. Last scope.

Locate every clap `///` in cli.rs producing those tokens:


crates\spt\src\cli.rs:76:        /// CLI); an agent-family sender is re-stamped to plain `msg` (REQ-MSG-5).
crates\spt\src\cli.rs:155:        /// drive (REQ-KICK-1). Use on an endpoint another node controls.
crates\spt\src\cli.rs:222:/// `spt endpoint <action>` subcommands (M8 decisions 1–2, 25 — REQ-CLI-1).
crates\spt\src\cli.rs:433:/// `spt daemon <action>` subcommands (M8 decisions 5, 23, 25b — REQ-CLI-2).
crates\spt\src\cli.rs:441:        /// Hidden (REQ-HAZARD-WMI-DAEMON-WINDOW): set by the auto-start LADDER on
crates\spt\src\cli.rs:458:    /// Hidden (ADR-0018 D1): the brain child process. The broker (`daemon run`)
crates\spt\src\cli.rs:462:    /// The broker stamps `--generation`/`--start-reason` at spawn (ADR-0018 V2
crates\spt\src\cli.rs:479:/// `spt access <action>` subcommands (REQ-SEC-1).
crates\spt\src\cli.rs:498:/// `spt adapter <action>` subcommands (REQ-INSTALL-4).
crates\spt\src\cli.rs:582:    /// (ADR-0019). Runs the declared extractor over `--sample <log>` (or the
crates\spt\src\cli.rs:612:    /// event (ADR-0022). Spawns and feeds the declared translation binary exactly
crates\spt\src\cli.rs:625:        /// The inbound `<EVENT…>` envelope to feed (ADR-0020). `{id}` and
crates\spt\src\cli.rs:685:/// `spt grant <action>` subcommands (REQ-CONSENT-1).
crates\spt\src\cli.rs:715:/// `spt shell <action>` subcommands (M5-D3, REQ-EP-5). Owner-scoped: every
crates\spt\src\cli.rs:823:/// `spt notif <action>` subcommands (ADR-0007).
crates\spt\src\cli.rs:839:/// `spt update <action>` subcommands (REQ-UPD-4).
crates\spt\src\cli.rs:857:/// `spt subnet <action>` subcommands (REQ-SUBNET-1). Noun namespace with
crates\spt\src\cli.rs:1246:/// (REQ-TERM-4 / ADR-0008 amendment). Ensures the daemon is up, then pulls a
crates\spt\src\cli.rs:1305:/// Map the `rc` terminal-action flags to an attach intent (REQ-RCVIEW-1 /
crates\spt\src\cli.rs:1306:/// REQ-KICK-1): `--view` → Viewer, `--take` → Take, neither → Control. `clap`
crates\spt\src\cli.rs:1319:/// `spt endpoint run` brings up an spt-hosted harness endpoint (M12-W1).
crates\spt\src\cli.rs:1474:/// endpoint to come ONLINE before attaching (REQ-HAZARD-RC-ATTACH-ONLINE-RACE).
crates\spt\src\cli.rs:1518:/// (REQ-INST-15, ADR-0010). Order of operations is refusal-first: every gate
crates\spt\src\cli.rs:1635:/// (D9-4, REQ-INST-14). `set`/`show` operate the LOCAL endpoint's authored
crates\spt\src\cli.rs:1639:/// appears (ADR-0006 §6, exclusion by construction).
crates\spt\src\cli.rs:1774:/// REQ-CLI-1): every member subnet's VISIBLE endpoints grouped by subnet
crates\spt\src\cli.rs:1780:/// trailing section (REQ-ENDPOINT-LIST-MERGE-LOCAL): the subnet view is the WAN
crates\spt\src\cli.rs:1857:/// Render one subnet's resource rows as an ALIGNED table (REQ-PICKER-5): the
crates\spt\src\cli.rs:1904:/// (REQ-INST-3): apply the event against the local endpoint's durable record
crates\spt\src\cli.rs:1908:/// REQ-INST-6): resolve the peer from the registry snapshots, dial, and let
crates\spt\src\cli.rs:2010:/// unelevated by contract (REQ-DAEMON-7): this process IS the daemon, blocking
crates\spt\src\cli.rs:2063:/// Run the brain child (`spt daemon brain`, hidden — ADR-0018 D1). The broker
crates\spt\src\cli.rs:2067:/// `start_reason` are the broker's spawn-time stamp (ADR-0018 V2), defaulted so
crates\spt\src\cli.rs:2080:/// `spt daemon start` (REQ-DAEMON-6) — ensure the daemon is up in the
crates\spt\src\cli.rs:2105:/// `spt daemon stop` — graceful, service-aware shutdown (REQ-DAEMON-6, M8
crates\spt\src\cli.rs:2106:/// decision 5 / REQ-CLI-2): a managed service is stopped through its manager
crates\spt\src\cli.rs:2132:/// The connection + peer-pump status lines (REQ-DAEMON-5/-9). Pure for tests.
crates\spt\src\cli.rs:2168:/// REQ-CLI-2): daemon state (running/stopped + the peer-pump heartbeat —
crates\spt\src\cli.rs:2331:/// `spt subnet notify` — agent-issued subnet notif (ADR-0007, REQ-NOTIF-2;
crates\spt\src\cli.rs:2483:/// Render the friendly post-apply message (REQ-UPD-8). With a semver
crates\spt\src\cli.rs:2565:/// platform-safe origin fetch anchor (REQ-UPD-8). Pure.
crates\spt\src\cli.rs:2634:/// exits 0 only when a host is logged in. Bounded (REQ-HAZARD-SUBPROCESS-TIMEOUT);
crates\spt\src\cli.rs:2663:/// Pure — the caller runs it bounded. (REQ-ADAPTER-GH-TRANSPORT)
crates\spt\src\cli.rs:2729:/// `NoArtifactForPlatform` is the typed multi-platform rejection (ADR-0024,
crates\spt\src\cli.rs:2730:/// mirrors ADR-0016's `RejectReason`) — a fat archive that carries other
crates\spt\src\cli.rs:2755:/// How a `.spt` archive's root is laid out (ADR-0024).
crates\spt\src\cli.rs:2788:/// (REQ-HAZARD-SUBPROCESS-TIMEOUT). `.spt` is a tar; `tar -xf` auto-detects an
crates\spt\src\cli.rs:2850:/// Extract a `.spt` adapter archive into `dest`, applying ADR-0024
crates\spt\src\cli.rs:2856:/// flat `<install_dir>/<program>` resolution (REQ-INSTALL-11) is unchanged. A
crates\spt\src\cli.rs:2970:/// `spt update fetch` (REQ-UPD-7, platform-safed by REQ-UPD-8) — pull the
crates\spt\src\cli.rs:3136:/// (REQ-MSG-5). The subject is the **session-proven** self id (callers pass
crates\spt\src\cli.rs:3181:/// NO `api listen` relay (REQ-SEND-SPT-HOSTED): it is online, it is
crates\spt\src\cli.rs:3201:/// envelope into its broker-held PTY (REQ-SEND-SPT-HOSTED, fix A). The bytes are
crates\spt\src\cli.rs:3202:/// the SAME whole `<EVENT>` every arriving-message surface emits (ADR-0020, via
crates\spt\src\cli.rs:3416:/// Run the listener loop (REQ-MSG-3 lifecycle, driven from the CLI). Blocks
crates\spt\src\cli.rs:3479:/// `endpoint list` (REQ-ENDPOINT-LIST-MERGE-LOCAL — replaces the removed
crates\spt\src\cli.rs:3542:/// carries a `psyche_host_error` (v0.8.1, REQ-HAZARD-LIVEHOST-BOOT-RACE) — an
crates\spt\src\cli.rs:3549:/// [impl->REQ-WHOAMI-1]
crates\spt\src\cli.rs:3573:/// `spt whoami` — a thin ALIAS for `spt endpoint list` (REQ-WHOAMI-1): the full
crates\spt\src\cli.rs:3577:/// [impl->REQ-WHOAMI-1]
crates\spt\src\cli.rs:3684:/// full re-provisioning material (grill 2026-06-06 point 2 — this is how ADR-0005's
crates\spt\src\cli.rs:3814:/// (REQ-INST-15): a fresh subnet on a previously-unpaired node homes every
crates\spt\src\cli.rs:3879:/// [impl->REQ-HAZARD-SELF-ELEVATE]
crates\spt\src\cli.rs:3916:/// passed straight to the OS — never a shell string (REQ-HAZARD-SELF-ELEVATE).
crates\spt\src\cli.rs:3931:/// [impl->REQ-ELEVATE-1] [impl->REQ-HAZARD-SELF-ELEVATE]
crates\spt\src\cli.rs:3967:/// The cross-platform self-elevating re-launch (REQ-ELEVATE-1). When a gated
crates\spt\src\cli.rs:3976:/// [impl->REQ-ELEVATE-1] [impl->REQ-HAZARD-SELF-ELEVATE]
crates\spt\src\cli.rs:4038:/// [impl->REQ-ELEVATE-1]
crates\spt\src\cli.rs:4065:/// behind the OS-elevation gate (REQ-PAIR-3/6; ported off `spt pair show-totp` (renamed show-code), M7
crates\spt\src\cli.rs:4084:/// seed-holder) and print its joining material (REQ-SUBNET-1; the verb-as-flag
crates\spt\src\cli.rs:4235:/// The peer-pump stall warning (M8 decision 23 / REQ-SUBNET-8): rendered in
crates\spt\src\cli.rs:4256:/// The daemon-offline caveat for the POPULATED status views (REQ-SUBNET-8): a
crates\spt\src\cli.rs:4272:/// The Windows blocked-inbound hint (M8 root cause 3, REQ-INSTALL-7's
crates\spt\src\cli.rs:4358:/// A node's render form for the `--nodes` table (REQ-SUBNET-3): the advertised
crates\spt\src\cli.rs:4521:/// (`probe_node_serving`, wansend.rs) is subnet-scoped per REQ-SUBNET-5: dial
crates\spt\src\cli.rs:4525:/// In-flight cap for the concurrent `--nodes` probe fan-out (REQ-MESH-6): a
crates\spt\src\cli.rs:4535:/// loop cost `offline_count × ceiling`; this fans it out (REQ-MESH-6). `probe`
crates\spt\src\cli.rs:4672:/// `spt subnet [status [NAME] [--nodes]]` — the membership view (REQ-SUBNET-1,
crates\spt\src\cli.rs:4831:/// The leave/prune elevation verdict (REQ-SUBNET-6): both verbs mutate
crates\spt\src\cli.rs:4845:/// `spt subnet leave <NAME>` — membership exit (M8 decision 6, REQ-SUBNET-6):
crates\spt\src\cli.rs:4850:/// (REQ-HAZARD-PAIR-SEED-ROTATION), not something leave can do from here.
crates\spt\src\cli.rs:4900:/// The prune target resolution (pure, REQ-SUBNET-6): distinct member
crates\spt\src\cli.rs:4920:/// membership + clear its registry snapshot rows (M8 decision 7, REQ-SUBNET-6).
crates\spt\src\cli.rs:5011:/// The coalescing-window length (Mesh-D7, REQ-MESH-4): a revoke schedules its
crates\spt\src\cli.rs:5017:/// with a timeboxed seed rotation (Mesh-D7, REQ-MESH-4). Distinct from `prune`
crates\spt\src\cli.rs:5169:/// flip (M8 decision 6, REQ-SUBNET-5). Ungated: a serve-state toggle
crates\spt\src\cli.rs:5213:/// (REQ-SUBNET-4): joining enrolls the MACHINE into a subnet's trust
crates\spt\src\cli.rs:5247:/// decision 10, REQ-SUBNET-2): elevation gate → prompt the missing inputs →
crates\spt\src\cli.rs:5568:/// per M7 plan decision 12; `subnet` added M11-W5, `live` added in the post-M11
crates\spt\src\cli.rs:5569:/// docs follow-on (REQ-DOCS-6, closes perri's F-007) — high-value first-run flows
crates\spt\src\cli.rs:5595:/// (REQ-DOCS-6). Single source = this binary: the docs-site points here and
crates\spt\src\cli.rs:5646:/// `spt rename <old> <new>` — the on-disk rename ripple (REQ-INST-11). Validates
crates\spt\src\cli.rs:5652:/// (`identity/trust/access.json`, ADR-0009). The daemon's gate re-reads the
crates\spt\src\cli.rs:5752:/// (REQ-INSTALL-4) over `spt_runtime::registry`. `add` is manifest-first
crates\spt\src\cli.rs:5767:    /// every subprocess gets a timeout (REQ-HAZARD-SUBPROCESS-TIMEOUT).
crates\spt\src\cli.rs:6096:/// **content-hash swap** (W3d, ADR-0025): extract to a temp tree, then replace in
crates\spt\src\cli.rs:6185:/// `spt adapter update [name]` (REQ-UPD-9) — the **CLI-side** gh_release update
crates\spt\src\cli.rs:6192:/// **Why here and not the daemon ripple:** REQ-UPD-7 deliberately keeps HTTP
crates\spt\src\cli.rs:6196:/// `Skipped(GhReleaseManaged)` for this avenue), reusing the REQ-INSTALL-9
crates\spt\src\cli.rs:6371:/// --jq .tag_name` (the private-repo path). (REQ-UPD-9, REQ-ADAPTER-GH-TRANSPORT)
crates\spt\src\cli.rs:6409:/// an unparseable tag never triggers an unrequested update). (REQ-UPD-9)
crates\spt\src\cli.rs:6432:/// CLI (private-repo path). (REQ-UPD-9, REQ-ADAPTER-GH-TRANSPORT)
crates\spt\src\cli.rs:6458:/// (REQ-UPD-9, REQ-ADAPTER-GH-TRANSPORT)
crates\spt\src\cli.rs:6484:/// as a full extracted install (perri F-011 — a bare-file `gh_release` adapter
crates\spt\src\cli.rs:6486:/// there, REQ-INSTALL-11) and defaults the manifest to `<dir>/manifest.toml`;
crates\spt\src\cli.rs:6525:/// over a sample and surface what it produced and what it dropped (ADR-0019
crates\spt\src\cli.rs:6526:/// §diagnostics, REQ-TERM-5). The author-time half of the shared skip-diagnostic
crates\spt\src\cli.rs:6532:/// without staging an extracted install (REQ-ADAPTER-PROOF-DIR-OVERRIDE).
crates\spt\src\cli.rs:6641:/// (ADR-0022), symmetric to [`cmd_adapter_digest_proof`]. Spawns and feeds the
crates\spt\src\cli.rs:6811:/// surface (M5-D3a, REQ-EP-5). Spawn **mints** identity (`<adapter>-<n>` +
crates\spt\src\cli.rs:7705:/// REQ-CONSENT-3 — the per-capability act-gate). Mirrors [`escalate_spawn`]:
crates\spt\src\cli.rs:7792:/// (`identity/trust/grants.json`, REQ-CONSENT-1). Rows are scoped to **this
crates\spt\src\cli.rs:7959:/// keyed on it (REQ-ENDPOINT-PURGE): the perch dir tree, the registry address, the
crates\spt\src\cli.rs:7965:/// (REQ-HAZARD-REGISTRY-DECAY). Generalizes `fork --delete-source` (recursive perch


Several occurrences are split-line (my single-line regex missed them). Locate the exact clap sources for the inventory tokens (REQ-TERM-4, REQ-EP-1/6, ADR-0008, ADR-0021, ADR-0020):


Grep

REQ-TERM-4|REQ-EP-1|REQ-EP-6|ADR-0021|ADR-0008|ADR-0020|ADR-0019|ADR-0022|REQ-KICK-1|REQ-MSG-5|session-digest projection|calling harness adapter|revive keeps the prior


C:\Users\decid\Documents\projects\spt-core\crates\spt\src\cli.rs-75-        /// a user-backed origin (a Gateway endpoint, or the local user's own
crates\spt\src\cli.rs:76:        /// CLI); an agent-family sender is re-stamped to plain `msg` (REQ-MSG-5).
--
crates\spt\src\cli.rs-154-        \ Take control: kick the current controller (a loud notice to them) and
crates\spt\src\cli.rs:155:        /// drive (REQ-KICK-1). Use on an endpoint another node controls.
--
C:\Users\decid\Documents\projects\spt-core\crates\spt\src\cli.rs-581-    /// Prove an adapter's `[digest]` extractor against a real log sample
crates\spt\src\cli.rs:582:    /// (ADR-0019). Runs the declared extractor over `--sample <log>` (or the
--
C:\Users\decid\Documents\projects\spt-core\crates\spt\src\cli.rs-611-    /// Prove an adapter's `[message-idle-translation-binary]` against an inbound
crates\spt\src\cli.rs:612:    /// event (ADR-0022). Spawns and feeds the declared translation binary exactly
--
crates\spt\src\cli.rs-624-        option: String,
crates\spt\src\cli.rs:625:        /// The inbound `<EVENT…>` envelope to feed (ADR-0020). `{id}` and
--
C:\Users\decid\Documents\projects\spt-core\crates\spt\src\cli.rs-1245-/// `spt endpoint digest <id>` — show a session's live activity buffer
crates\spt\src\cli.rs:1246:/// (REQ-TERM-4 / ADR-0008 amendment). Ensures the daemon is up, then pulls a
--
crates\spt\src\cli.rs-1249-\ only: a qualified `[subnet:]id@node` form is refused (cross-node is later).
crates\spt\src\cli.rs:1250:// [impl->REQ-TERM-4]
--
C:\Users\decid\Documents\projects\spt-core\crates\spt\src\cli.rs-1305-/// Map the `rc` terminal-action flags to an attach intent (REQ-RCVIEW-1 /
crates\spt\src\cli.rs:1306:/// REQ-KICK-1): `--view` → Viewer, `--take` → Take, neither → Control. `clap`
--
C:\Users\decid\Documents\projects\spt-core\crates\spt\src\cli.rs-3135-/// Classify the LOCAL message origin for the user-msg identity gate
crates\spt\src\cli.rs:3136:/// (REQ-MSG-5). The subject is the **session-proven** self id (callers pass
--
C:\Users\decid\Documents\projects\spt-core\crates\spt\src\cli.rs-3160-/// never reported as re-stamped.
crates\spt\src\cli.rs:3161:// [impl->REQ-MSG-5]
--
C:\Users\decid\Documents\projects\spt-core\crates\spt\src\cli.rs-3201-/// envelope into its broker-held PTY (REQ-SEND-SPT-HOSTED, fix A). The bytes are
crates\spt\src\cli.rs:3202:/// the SAME whole `<EVENT>` every arriving-message surface emits (ADR-0020, via
--
C:\Users\decid\Documents\projects\spt-core\crates\spt\src\cli.rs-3245-
crates\spt\src\cli.rs:3246:    // user-msg identity gate (REQ-MSG-5): the requested type is honored only
--
C:\Users\decid\Documents\projects\spt-core\crates\spt\src\cli.rs-6524-/// [--dir <path>] [--manifest <file>]` — run the adapter's `[digest]` extractor
crates\spt\src\cli.rs:6525:/// over a sample and surface what it produced and what it dropped (ADR-0019
--
C:\Users\decid\Documents\projects\spt-core\crates\spt\src\cli.rs-6640-/// the author-time EMIT-half proof for `[message-idle-translation-binary]`
crates\spt\src\cli.rs:6641:/// (ADR-0022), symmetric to [`cmd_adapter_digest_proof`]. Spawns and feeds the
--
C:\Users\decid\Documents\projects\spt-core\crates\spt\src\cli.rs-8681-
crates\spt\src\cli.rs:8682:    // [unit->REQ-MSG-5] the LOCAL origination gate: a bare CLI (no agent
--
C:\Users\decid\Documents\projects\spt-core\crates\spt\src\cli.rs-10955-
crates\spt\src\cli.rs:10956:    // [unit->REQ-TERM-4] digest defaults: a one-shot, human-rendered snapshot.


The 5 clap sources for ADR-0019/0022/0020/REQ-KICK-1/REQ-MSG-5 are clear. The other inventory tokens (REQ-TERM-4×2, REQ-EP-1/6, ADR-0008×2, ADR-0021) aren't matching as clap `///` — trace them via reference.md context:


Bash

Read reference.md around the cited leak lines


<owl_messages>
<owl_message from="doyle" priority="high">W6 BASE SCOPE — you lost the original W6 ref (the JIT plan only specs W1-W5). W6 = TWO REQs now: the base (below) + the docs-token gate I just sent. Build both, gate together.

W6 BASE = REQ-ADAPTER-VERSION-CMD (traced from my corrected spec, 679315a6). MINT it too — not in traceable yet.
  id = "REQ-ADAPTER-VERSION-CMD"
  title: `spt adapter version <name>` — a new `AdapterCmd::Version{option}` in cli.rs adapter subcommands → `resolve_option(&adapters, &option)` → print `manifest.adapter.version` (the EXISTING mandatory [adapter] manifest field — manifest.rs already requires it; NOT a [strings].version, NOT get-string, no second version field). Unresolvable-option errors handled like the sibling adapter subcommands. (v0.13.2 W6)
  required_stages = ["doc","impl","unit"]   # unit-only test surface; doc = harness-contract/docs-site adapter cmd; impl = the Version arm + resolve_option print.

KEY HISTORY so you don't redo the wrong thing: my FIRST W6 msg said `[strings].version` — operator SUPERSEDED it: surface the EXISTING `[adapter].version`, simpler, no new field. Build the corrected form only.

NOTE: this base cmd's clap `///` help must ALSO follow the no-internal-codes rule (concise, no REQ/M#/W#/ADR) — which is exactly what REQ-DOCS-NO-INTERNAL-CODES (the other half) now gates mechanically. So the two halves reinforce: build `adapter version` clean, sweep the pre-existing leaks, add the scan that keeps all of it clean.

FULL W6 =
  1. REQ-ADAPTER-VERSION-CMD (base): `spt adapter version <name>` → print [adapter].version. unit-only.
  2. REQ-DOCS-NO-INTERNAL-CODES (added): sweep 14 reference.md leak sites + the xtask forbidden-token scan (ban REQ-*/F-###/M#-W#/ADR-####). doc+impl+unit.
Both small/additive, same cli.rs AdapterCmd region. Ping me when both are green; I gate together → deployah cuts v0.13.2.</owl_message>
</owl_messages>

[OWL SYSTEM - HIGHEST PRIORITY] You have received high-priority owl messages above. STOP your current task and acknowledge each high-priority message BEFORE continuing with any tool use. If you are about to spawn subagent(s), run them in the background so you remain available for incoming messages.


  driven-by       Report which node (if any) is remote-driving this endpoint
  history-log     Append normalized history (body on stdin) to the native history store
  digest-entry    Push one digest-record (the published contract JSON line, on stdin) for a log-less
                  adapter — appended to the perch's digest store, tailed by the session-digest
                  projection (ADR-0008 amendment, REQ-TERM-4)
  emit            Emit a Shell sensory payload to the owner's live session. REST-only by
                  definition: never spooled, dropped with a diagnostic when the owner isn't live.
Options:
      --adapter <ADAPTER>
          adapter_name — the calling harness adapter. Optional (ADR-0021): an explicit
          name[:profile] override for adapter dev/iteration. Omitted, listen resolves the owning
          adapter/profile at bind from the seed's parent pid (host_binaries → active-profile pointer
                                       live_agent (the agent host); a non-agent endpoint — e.g. a
                                       gateway — binds with its own open-type tag
                                       (REQ-EP-1/REQ-EP-6). A revive keeps the prior type unless
                                       this overrides it [default: live_agent]
      --token <TOKEN>                  Capability token proving association to the target perch
```text
Push one digest-record (the published contract JSON line, on stdin) for a log-less adapter —
appended to the perch's digest store, tailed by the session-digest projection (ADR-0008 amendment,
REQ-TERM-4)


doyle high-priority msg received + acknowledged: **W6 = TWO REQs** — (1) REQ-ADAPTER-VERSION-CMD base (`spt adapter version <name>` → print existing `[adapter].version`, NOT `[strings].version` — the superseded form), (2) REQ-DOCS-NO-INTERNAL-CODES (sweep 14 leaks + xtask scan). Mint both, build both, gate together.

Ack doyle + locate the remaining leak sources in parallel:


$OWL send doyle <<'EOF'
ACK W6 — both REQs, corrected scope locked:
1. REQ-ADAPTER-VERSION-CMD (base, 679315a6): AdapterCmd::Version{option} → resolve_option → print manifest.adapter.version (EXISTING mandatory [adapter] field; NOT [strings].version, NOT get-string, no new field). unit-only. Building the corrected form only — ignoring your superseded first msg.
2. REQ-DOCS-NO-INTERNAL-CODES: sweep 14 reference.md leak sites (REQ-KICK-1, REQ-TERM-4 x2, REQ-EP-1/6, REQ-MSG-5, ADR-0019/0022/0020/0008 x2/0021) → plain language, keep substance; + xtask forbidden-token scan over GENERATED reference.md (REQ-*/F-###/M#-W#/ADR-####), planted-token unit. New `adapter version` help written clean from the start.

Minting both in traceable FIRST (rule 3), same commit. Will ping when both green. Building now.
EOF

Ack W6 scope to doyle


➜ SENT:doyle


Grep

digest-record \(the published contract|calling harness adapter|A revive keeps the prior type|Optional \(ADR-0021\)|REQ-EP-1/REQ-EP-6|session-digest\s*\n?\s*projection|digest-entry


crates\spt\src\api\startup.rs:211:    // system, REQ-EP-1/REQ-EP-6) binds with its own tag via `api bind --type`.
crates\spt\src\api\startup.rs:215:    // reads it back verbatim. A revive keeps the prior type unless overridden.
crates\spt\src\api\reporting.rs:15://! - **digest-entry** (REQ-TERM-4) — the log-less-adapter push door: append a
crates\spt\src\api\reporting.rs:17://!   source the session-digest projection tails (ADR-0008 amendment).
crates\spt\src\api\reporting.rs:276:/// `api digest-entry <id>` — the **log-less-adapter push door** (ADR-0008
crates\spt\src\api\reporting.rs:298:        eprintln!("EMPTY_RECORD: digest-entry read nothing on stdin");
crates\spt\src\api\reporting.rs:885:    #[test] // [unit->REQ-TERM-4] the digest-entry door validates against the
crates\spt\src\api\mod.rs:39:    /// adapter_name — the calling harness adapter. **Optional** (ADR-0021): an
crates\spt\src\api\mod.rs:88:        /// with its own open-type tag (REQ-EP-1/REQ-EP-6). A revive keeps the
crates\spt\src\api\mod.rs:192:    /// Push one digest-record (the published contract JSON line, on stdin) for a
crates\spt\src\api\mod.rs:194:    /// session-digest projection (ADR-0008 amendment, REQ-TERM-4).
crates\spt\src\api\mod.rs:801:        assert!(parse(&["spt", "--adapter", "m", "digest-entry", "alice"]).is_ok());


Remaining leak sources are clap `///` in `api/mod.rs` (lines 39, 88, 192–194) + cli.rs (76, 155, 582, 612, 625). Read all contexts:


70	        reply_to: Option<String>,
71	        /// Spool only (deferred / hook channel) — no live wake.
72	        #[arg(long)]
73	        deferred: bool,
74	        /// Request the `user-msg` type (the user's authority). Honored only from
75	        /// a user-backed origin (a Gateway endpoint, or the local user's own
76	        /// CLI); an agent-family sender is re-stamped to plain `msg` (REQ-MSG-5).
77	        #[arg(long = "user-msg")]
78	        user_msg: bool,
79	    },
80	    /// Send and block for a reply (body read from stdin).
81	    ///

        reply_to: Option<String>,
        /// Spool only (deferred / hook channel) — no live wake.
        #[arg(long)]
        deferred: bool,
        /// Request the `user-msg` type (the user's authority). Honored only from
        /// a user-backed origin (a Gateway endpoint, or the local user's own
        /// CLI); an agent-family sender is re-stamped to plain `msg` (REQ-MSG-5).
        #[arg(long = "user-msg")]
        user_msg: bool,
    },
    /// Send and block for a reply (body read from stdin).
    ///


150	        id: String,
151	        /// Read-only: render output, forward no input.
152	        #[arg(long, conflicts_with = "take")]
153	        view: bool,
154	        /// Take control: kick the current controller (a loud notice to them) and
155	        /// drive (REQ-KICK-1). Use on an endpoint another node controls.
156	        #[arg(long)]
157	        take: bool,
158	    },
159	    /// Consent grant store: gated capabilities held on this node.

        id: String,
        /// Read-only: render output, forward no input.
        #[arg(long, conflicts_with = "take")]
        view: bool,
        /// Take control: kick the current controller (a loud notice to them) and
        /// drive (REQ-KICK-1). Use on an endpoint another node controls.
        #[arg(long)]
        take: bool,
    },
    /// Consent grant store: gated capabilities held on this node.