Merge main into bridge-seam-inbox-events (PR 435)

Bring PR 435 up to date with main (65 commits), reconciling the bridge-seam
work with two paradigm shifts main introduced:

- Contract gate: main replaced the integer contract with minor-version
  coupling (#468). plugin.json now carries the frozen D4 tombstone
  requires-contract ">=3,<4" alongside the branch's "hooks" registration.

- FO Startup collapse: main collapsed the FO Startup recipe to <=4 steps
  ("boot identifies, engage converges") and caps first-officer-shared-core.md
  at 26755 bytes. Rewove PR 435's boot additions onto that spine:
    * launch-branch pin -> a sub-bullet of the boot-identify step
    * before-greet Bridge liveness heartbeat -> step 2b (non-counting),
      an explicit carve-out from main's "boot writes nothing" rule
    * gate drain-before-present kept in «gate.assemble-verdict»
  To fit the byte cap while preserving the opt-in fleet feature, relocated
  the Fleet Mode section to a deferred references/fo-fleet.md (idiomatic to
  main's defer-non-common-prose philosophy), rewritten against the new
  boot-identify + engage paradigm, and repointed fo-dispatch-core + SKILL.md.

.gitignore: kept the _bridge/ block, dropped main's duplicate /spacedock.

All contractlint + bridge/fleet integration tests pass; full suite green
except the pre-existing agentsview TestSurveyCodexPresenceThroughSync
(fails identically on clean main — local binary quirk).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: gcko

.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "spacedock",
-  "version": "0.23.0",
+  "version": "0.24.0",
   "description": "Turn directories of markdown files into structured workflows operated by AI agents",
   "author": {
     "name": "CL Kao"
@@ -17,7 +17,7 @@
   ],
   "skills": "./skills/",
   "hooks": "./hooks/hooks.json",
-  "requires-contract": ">=2,<3",
+  "requires-contract": ">=3,<4",
   "interface": {
     "displayName": "Spacedock",
     "shortDescription": "Plain text workflows for AI agents",

.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "spacedock",
-  "version": "0.23.0",
+  "version": "0.24.0",
   "description": "Turn directories of markdown files into structured workflows operated by AI agents",
   "author": {
     "name": "CL Kao"
@@ -16,7 +16,7 @@
     "automation"
   ],
   "skills": "./skills/",
-  "requires-contract": ">=2,<3",
+  "requires-contract": ">=3,<4",
   "interface": {
     "displayName": "Spacedock",
     "shortDescription": "Plain text workflows for AI agents",

.github/workflows/release.yml

@@ -646,3 +646,84 @@ jobs:
             live-artifacts/pi/**
             live-artifacts/journey-metrics/**
           if-no-files-found: warn
+
+  # AC-3: posts a per-PR delta of this run's journey-cost observations against
+  # the latest published release ledger, as a single sticky-updating PR comment
+  # (`gh pr comment --edit-last`, so repeated pushes update ONE comment instead
+  # of appending a new one). PR-only — a workflow_dispatch run has no PR to
+  # comment on. needs: claude-live with no explicit `if:` on that edge means
+  # this job runs only once claude-live's matrix completed successfully;
+  # shallow-boot-window (like every scenario this comments on) is Claude-only.
+  # A job-level permissions block grants pull-requests: write beyond the
+  # workflow-level contents: read default; specifying any job-level permissions
+  # replaces (not merges with) the workflow default, so contents/actions read
+  # are restated here for checkout and cross-job artifact download.
+  journey-delta-comment:
+    needs: claude-live
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      actions: read
+      pull-requests: write
+    steps:
+      - uses: actions/checkout@v5
+
+      - uses: actions/setup-go@v6
+        with:
+          go-version: "1.22"
+
+      - name: Download this run's Claude journey metrics
+        uses: actions/download-artifact@v5
+        with:
+          pattern: runtime-live-e2e-claude-live-*
+          path: ${{ runner.temp }}/current-run-artifacts
+          merge-multiple: true
+
+      # Best-effort: no previously published release (or one with no
+      # journey-costs asset) means no baseline to diff against. `|| true` /
+      # explicit exit-0 branches degrade either gap to a non-fatal skip so a
+      # missing baseline never REDs the PR.
+      - name: Download the latest published release's journey-cost ledger
+        id: download_previous_ledger
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          previous_tag="$(gh release list --limit 1 --json tagName --jq '.[0].tagName' || true)"
+          if [ -z "$previous_tag" ] || [ "$previous_tag" = "null" ]; then
+            echo "::warning::no published release found; skipping journey-cost delta comment" >&2
+            echo "found=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          if ! gh release download "$previous_tag" -p 'journey-costs-*.json' -O "$RUNNER_TEMP/previous-journey-costs.json"; then
+            echo "::warning::published release $previous_tag has no journey-costs asset; skipping journey-cost delta comment" >&2
+            echo "found=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          echo "found=true" >> "$GITHUB_OUTPUT"
+
+      # download-artifact's merge-multiple flat-copies every matched artifact's
+      # files into current-run-artifacts, but PRESERVES each artifact's own
+      # internal path prefix (verified against a real run's downloaded zip:
+      # the journey-metrics JSON lands several directories deep, not directly
+      # under "live-artifacts/journey-metrics/"). A hardcoded exact subpath is
+      # brittle to that prefix; find + cp (release.yml's own pattern for the
+      # same class of problem) is layout-agnostic — it locates the metrics
+      # files wherever they actually landed.
+      - name: Locate this run's journey metrics
+        if: steps.download_previous_ledger.outputs.found == 'true'
+        run: |
+          set -euo pipefail
+          mkdir -p "$RUNNER_TEMP/current-run-metrics"
+          find "$RUNNER_TEMP/current-run-artifacts" -path '*/journey-metrics/*.json' -type f -exec cp {} "$RUNNER_TEMP/current-run-metrics/" \;
+
+      - name: Post the journey-cost delta PR comment
+        if: steps.download_previous_ledger.outputs.found == 'true'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          go run ./cmd/spacedock-release journey-delta "$RUNNER_TEMP/previous-journey-costs.json" \
+            --metrics-dir "$RUNNER_TEMP/current-run-metrics" \
+            --pr "${{ github.event.pull_request.number }}"

.github/workflows/runtime-live-e2e.yml

@@ -0,0 +1,70 @@
+package main
+
+import (
+	"io"
+	"os"
+	"strings"
+	"testing"
+)
+
+// TestDevPreversionCommandPrintsComputedVersion — the subcommand prints exactly
+// the post-release dev pre-version (X.(Y+1).0-pre1) to stdout, so release.yml's
+// `DEV_VERSION="$(... dev-preversion "$RELEASE_VERSION")"` capture stamps `next`
+// PAST the just-released stable version rather than re-stamping it.
+func TestDevPreversionCommandPrintsComputedVersion(t *testing.T) {
+	out, code := captureStdout(t, func() int { return devPreversion([]string{"0.24.0"}) })
+	if code != 0 {
+		t.Fatalf("dev-preversion exit = %d, want 0 on a bare stable semver", code)
+	}
+	if got := strings.TrimSpace(out); got != "0.25.0-pre1" {
+		t.Fatalf("dev-preversion stdout = %q, want 0.25.0-pre1", got)
+	}
+}
+
+// TestDevPreversionCommandRejectsMissingArg — with no version argument the
+// subcommand exits with a usage error and prints nothing consumable.
+func TestDevPreversionCommandRejectsMissingArg(t *testing.T) {
+	if code := devPreversion(nil); code == 0 {
+		t.Fatalf("dev-preversion exit = 0 with no argument; want non-zero")
+	}
+}
+
+// TestDevPreversionCommandRejectsExtraArg — the subcommand takes exactly one
+// version; a second argument is a usage error, so a release.yml miswiring fails
+// loud rather than silently ignoring the extra token.
+func TestDevPreversionCommandRejectsExtraArg(t *testing.T) {
+	if code := devPreversion([]string{"0.24.0", "0.25.0"}); code == 0 {
+		t.Fatalf("dev-preversion exit = 0 with two arguments; want non-zero")
+	}
+}
+
+// TestDevPreversionCommandRejectsHyphenatedInput — a pre-release (hyphenated)
+// input is malformed for this subcommand (it runs only on the stable branch),
+// so it exits non-zero instead of emitting a doubly-suffixed version.
+func TestDevPreversionCommandRejectsHyphenatedInput(t *testing.T) {
+	if code := devPreversion([]string{"0.24.0-pre1"}); code == 0 {
+		t.Fatalf("dev-preversion exit = 0 on a hyphenated input; want non-zero")
+	}
+}
+
+// captureStdout runs fn with os.Stdout redirected to a pipe and returns what fn
+// printed plus fn's return code, so a subcommand whose contract IS its stdout
+// (release.yml captures it via $()) is verified on the real bytes it emits.
+func captureStdout(t *testing.T, fn func() int) (string, int) {
+	t.Helper()
+	r, w, err := os.Pipe()
+	if err != nil {
+		t.Fatalf("os.Pipe: %v", err)
+	}
+	orig := os.Stdout
+	os.Stdout = w
+	defer func() { os.Stdout = orig }()
+
+	code := fn()
+	w.Close()
+	data, err := io.ReadAll(r)
+	if err != nil {
+		t.Fatalf("read captured stdout: %v", err)
+	}
+	return string(data), code
+}

cmd/spacedock-release/dev_preversion_test.go

@@ -15,14 +15,19 @@ import (
 // without a live gh.
 type runListFunc func(commit string) ([]byte, error)
 
-// ghRunListForCommit queries the green Runtime Live E2E runs whose head commit is
-// the release commit. `--status success` excludes parked/waiting runs (the spike
-// proved a parked run is never success), and `-c <commit>` binds the query to the
-// exact tagged commit so a green run on some other line cannot satisfy the gate.
+// ghRunListForCommit queries the Runtime Live E2E runs whose head commit is the
+// release commit; `-c <commit>` binds the query to the exact tagged commit so a
+// green run on some other line cannot satisfy the gate. The query deliberately
+// omits `--status success`: gh's `--status` filter can lag a run's `conclusion`
+// right after a re-run flips it to green (observed at the v0.23.0 cut — the
+// filtered query returned `[]` while the same query without `--status` already
+// saw the success), so the pre-filter costs genuine re-run-to-green cuts and
+// buys nothing. Excluding parked/waiting runs is EvaluateE2EGate's job: its
+// predicate requires conclusion == "success", so an empty-conclusion parked run
+// never qualifies regardless of what this query returns.
 func ghRunListForCommit(commit string) ([]byte, error) {
 	cmd := exec.Command("gh", "run", "list",
 		"--workflow", "Runtime Live E2E",
-		"--status", "success",
 		"-c", commit,
 		"--json", "databaseId,headSha,conclusion,status",
 	)

cmd/spacedock-release/e2e_gate.go

@@ -3,6 +3,7 @@ package main
 import (
 	"os"
 	"path/filepath"
+	"runtime"
 	"strings"
 	"testing"
 )
@@ -82,6 +83,109 @@ func TestE2EGateCommandRejectsMissingCommit(t *testing.T) {
 	}
 }
 
+// writeGhStatusLagShim writes a `gh` shim that reproduces the v0.23.0 gate-time
+// filter-consistency lag: when argv carries a bare `--status` flag it prints
+// `[]` (the observed behavior of `--status success` right after a re-run flips
+// a run to green), and otherwise it prints fixtureJSON (the unfiltered query,
+// which already saw the success). This drives the REAL ghRunListForCommit
+// end-to-end — the fakeRunLister seam above bypasses the args entirely and
+// cannot see the bug.
+//
+// It also pins the query's ONLY binding to the live matrix: `--workflow
+// "Runtime Live E2E"` is not among the fetched `--json` fields, so nothing else
+// in the predicate distinguishes a Runtime Live E2E run from an unrelated green
+// run on the release commit (e.g. ordinary push CI). The shim prints `[]`
+// unless argv carries that exact `--workflow "Runtime Live E2E"` pair, so
+// dropping the token from ghRunListForCommit fails the gate closed here — a
+// regression that dropped it would otherwise fail OPEN (any green run on the
+// commit would satisfy the gate).
+func writeGhStatusLagShim(t *testing.T, fixtureJSON string) string {
+	t.Helper()
+	if runtime.GOOS == "windows" {
+		t.Skip("gh stub shim is a POSIX shell script")
+	}
+	dir := t.TempDir()
+	// echo, not cat: the stub PATH contains only this shim, so an external `cat`
+	// would itself fail to resolve. echo is a shell builtin.
+	script := `#!/bin/sh
+have_workflow=0
+prev=""
+for arg in "$@"; do
+  if [ "$prev" = "--workflow" ] && [ "$arg" = "Runtime Live E2E" ]; then
+    have_workflow=1
+  fi
+  if [ "$arg" = "--status" ]; then
+    echo '[]'
+    exit 0
+  fi
+  prev="$arg"
+done
+if [ "$have_workflow" != "1" ]; then
+  echo '[]'
+  exit 0
+fi
+echo '` + fixtureJSON + `'
+`
+	path := filepath.Join(dir, "gh")
+	if err := os.WriteFile(path, []byte(script), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	return dir
+}
+
+// rerunToGreenJSON pins the 2026-06-30 gate-time observation: the only success
+// entry for the release commit is a run that was re-run to green (attempt 2).
+const rerunToGreenJSON = `[
+  {"databaseId": 28429490220, "headSha": "deadbeefdeadbeefdeadbeefdeadbeefdeadbeef", "conclusion": "success", "status": "completed", "attempt": 2}
+]`
+
+// parkedOnlyJSON has no success entry at all — only a parked/waiting run.
+const parkedOnlyJSON = `[
+  {"databaseId": 28400000000, "headSha": "deadbeefdeadbeefdeadbeefdeadbeefdeadbeef", "conclusion": "", "status": "waiting"}
+]`
+
+// TestE2EGateCommandPassesOnRerunToGreenLiveRun is T1 (AC-1): drives the REAL
+// ghRunListForCommit against the gh shim. RED under today's query shape (argv
+// carries `--status success`, so the shim replays the filter-consistency lag
+// and returns `[]`, blocking a genuinely green cut); GREEN once
+// ghRunListForCommit drops `--status success` (the shim then sees no bare
+// `--status` arg and returns the fixture, so the gate matches the run).
+func TestE2EGateCommandPassesOnRerunToGreenLiveRun(t *testing.T) {
+	stubDir := writeGhStatusLagShim(t, rerunToGreenJSON)
+	t.Setenv("PATH", stubDir)
+
+	summary := newSummaryFile(t)
+	t.Setenv("GITHUB_STEP_SUMMARY", summary)
+	t.Setenv("SPACEDOCK_E2E_GATE_WAIVER", "")
+
+	code := runE2EGate([]string{gateCommit}, ghRunListForCommit)
+	if code != 0 {
+		t.Fatalf("e2e-gate exit = %d, want 0 for a re-run-to-green Runtime Live E2E run (AC-1)", code)
+	}
+	if got := readFile(t, summary); !strings.Contains(got, "28429490220") {
+		t.Errorf("step summary did not cite the matched re-run-to-green run:\n%s", got)
+	}
+}
+
+// TestE2EGateCommandBlocksParkedOnlyRunViaLiveQuery is T2 (AC-2): a
+// parked-only fixture still blocks the cut under the new (unfiltered) query
+// shape. The parked-run defense lives in EvaluateE2EGate's predicate (empty
+// conclusion never matches), not in the dropped `--status` flag, so removing
+// the flag must not regress this.
+func TestE2EGateCommandBlocksParkedOnlyRunViaLiveQuery(t *testing.T) {
+	stubDir := writeGhStatusLagShim(t, parkedOnlyJSON)
+	t.Setenv("PATH", stubDir)
+
+	summary := newSummaryFile(t)
+	t.Setenv("GITHUB_STEP_SUMMARY", summary)
+	t.Setenv("SPACEDOCK_E2E_GATE_WAIVER", "")
+
+	code := runE2EGate([]string{gateCommit}, ghRunListForCommit)
+	if code == 0 {
+		t.Fatalf("e2e-gate exit = 0 on a parked-only run list; want non-zero (cut blocked, AC-2)")
+	}
+}
+
 func newSummaryFile(t *testing.T) string {
 	t.Helper()
 	path := filepath.Join(t.TempDir(), "step_summary")