Transplant reqdrive's prompt discipline into the engine (W2)

[adbarc92]

The engine ran on two-to-three sentence prompts — steps.rs was 116 lines. The convergence plan called W2 "the single highest-leverage de-risk of the 0%-proven live path" and W2 + W4 together "the whole thesis." W4 landed in July; W2 never did. So the engine advances on real evidence while being driven by the stubs the plan set out to replace.

What ported — the discipline, not the text

Step	Now says
oracle	must fail against the current tree — a test that already passes defines nothing; assert observable behaviour, not names it is about to invent; ordinary case + a boundary + an implied failure; record ambiguity in a comment. It is hashed and frozen the moment it finishes, so a vague oracle isn't a weak test — it's a wrong definition of done nothing downstream can correct
build	one thing, smallest change, findings first, run the real test command rather than claim success, never edit a frozen test — and, unlike reqdrive, do NOT commit: this harness owns version control, and an agent that commits corrupts the diff review and merge read
review	reqdrive's four named criteria (security, correctness, scope, quality) instead of "correctness and quality", plus the reminder that a green suite is not evidence — the tests predate the code

What did not port, and why it matters

reqdrive's prompts are welded to its own artifacts — prd.json, progress.txt, .reqdrive/runs/, per-story ids, the iteration-summary block. This harness has none of them and no story concept at all.

So W2 as the plan worded it depends on W6, which the plan schedules later. That dependency was never stated. The transferable half is here; the story-shaped half waits on a story model.

Prompt-invariant tests

A prompt is the least reviewable thing in the engine — no type, no compiler — so the rules that make it safe are asserted rather than trusted. They pin the discipline, not the wording. Each driven red:

no-commit rule removed       →  builder test FAILED
BLOCKERS contract removed    →  review  test FAILED
oracle told tests may pass   →  oracle  test FAILED

Found and documented, deliberately not fixed

parse_blockers treats an absent marker as zero. A reviewer that crashed, ran out of budget mid-sentence, or wrote prose scores clean and satisfies the review gate — stronger than allowing the turn, it actively passes it.

Under I1 as amended these are two different failures — a check that ran and found nothing versus one that could not report — and they must not share an outcome. The fix is Option<u32> with None → NeedsHuman: a state-machine change that doesn't belong in a prompt commit. It's asserted as a named known gap so it's a decision rather than a surprise, and the prompt half of the mitigation is in place.

fleetd 87 → 92 tests. Workspace check clean. Touches different files from #68, so they merge in either order.

🤖 Generated with Claude Code