Require verified impact coverage for shared changes

README.md

@@ -31,7 +31,7 @@ Install all skills for any supported agent:
 
 The release inventory is the tracked `skills/assistant-*` set. `skills/unity-*` directories are local-only and ignored by git; they are not installed or validated as framework release skills.
 
-Install a single skill:
+Install one root skill with its bundled hard dependencies:
 ```bash
 ./install.sh --agent claude --skill assistant-thinking
 ```
@@ -65,7 +65,7 @@ Install the complete release inventory for one agent:
 .\install.ps1 -Agent gemini
 ```
 
-The same entry point supports a single skill and a non-mutating preview:
+The same entry point supports one root skill with its bundled hard dependencies and a non-mutating preview:
 
 ```powershell
 .\install.ps1 -Agent claude -Skill assistant-thinking
@@ -138,6 +138,17 @@ makes quality claims falsifiable with workload/budget/measurement, and travels
 through the plan, task handoff, and independent review. It does not
 add a permanent architect agent or force architecture ceremony onto local work.
 
+### Shared-change impact
+
+Behavior-bearing work records a compact local/shared/unresolved assessment before
+choosing verification scope. Triggered shared-impact work uses one installed
+Node 22 common checker and carries the same artifact identity through workflow,
+debugging, and review. Discovery may report gaps; completion also needs actual
+current verification and the existing assistant-review manifest/coverage result.
+The checker validates closure against supplied bounded evidence, not a universal
+runtime dependency graph. Shared fanout alone does not add Architecture Decision
+Pack, strict-lane, or QA requirements.
+
 For multi-slice work, Assistant Workflow uses descriptive outcome-oriented
 slice identifiers rather than ordinal-only labels, explicit dependencies, and
 native subagents only for independent packets.

docs/evals/variants/workflow-kernel-v1/manifest.json

@@ -22,14 +22,14 @@
     "raw_response_retained": false
   },
   "static_measurement": {
-    "baseline_selected_initial_words": 2183,
-    "candidate_selected_initial_words": 455,
-    "selected_initial_word_delta": -1728,
-    "baseline_total_initial_words": 2772,
-    "candidate_total_initial_words": 1044,
-    "baseline_selected_entry_words": 3788,
-    "candidate_selected_entry_words": 2060,
-    "selected_entry_word_delta": -1728,
+    "baseline_selected_initial_words": 2318,
+    "candidate_selected_initial_words": 488,
+    "selected_initial_word_delta": -1830,
+    "baseline_total_initial_words": 2907,
+    "candidate_total_initial_words": 1077,
+    "baseline_selected_entry_words": 3930,
+    "candidate_selected_entry_words": 2100,
+    "selected_entry_word_delta": -1830,
     "standing_context_growth": 0,
     "measured_with": "tools/context-budget-report.sh --skill-overlay"
   },

docs/skill-contract-design-guide.md

@@ -322,11 +322,12 @@ gates:
     checkpoint_start: "--- PHASE: NAME ---"
     checkpoint_end: "--- PHASE: NAME COMPLETE ---"
     condition: "when this phase runs"  # optional
+    entry_assertions: []  # Optional; same schema, checked before any mutation or mutation dispatch
     exit_assertions:
-      - id: XX1                        # unique ID for referencing
-        check: "what must be true"     # plain-English assertion
-        condition: "when applicable"   # optional — scopes the assertion
-        on_fail: "corrective action"   # what to do if assertion fails
+      - id: XX1                        # unique
+        check: "what must be true"
+        condition: "when applicable"   # optional
+        on_fail: "corrective action"
 
 invariants:
   - id: INV1
@@ -512,3 +513,7 @@ encode arbitrary structures.
     Recipe, typed refs, separate code-review/QA handoffs, pivot/restart
     decisions, and the max 10 terminal cap when the Process skill has
     long-running review, QA, or fix-verify loops
+15. **Shared-impact evidence** — preserve identity. Discovery reports gaps;
+    mutation requires current valid pre-build entry evidence; completion needs
+    verification/review. Missing loaded-path runtimes block. Fanout alone
+    does not escalate architecture, QA, or lane.

install.ps1

@@ -12,7 +12,7 @@ configuration is preserved while installer-owned sections are refreshed.
 Target agent: claude, codex, or gemini. Agent names are case-insensitive.
 
 .PARAMETER Skill
-Install one root assistant-* skill instead of the complete inventory.
+Install one root assistant-* skill and its bundled hard dependencies instead of the complete inventory.
 
 .PARAMETER DryRun
 Validate and report the planned work without changing the filesystem.
@@ -84,7 +84,7 @@ function Show-Usage {
 Usage: .\install.ps1 -Agent <claude|codex|gemini> [options]
 
 Options:
-  -Skill <name>             Install one assistant-* skill
+  -Skill <name>             Install one root assistant-* skill plus bundled hard dependencies
   -DryRun                   Validate and show work without changing files
   -NoHooks                  Deprecated no-op; installs are hookless
   -Help                     Show this help
@@ -1839,28 +1839,63 @@ function Install-Skills {
     }
 }
 
+function Get-CanonicalSkillRequirements {
+    param([string]$SkillFile)
+    $inFrontmatter = $false
+    $inRequires = $false
+    foreach ($line in Get-Content -LiteralPath $SkillFile) {
+        if ($line -eq '---') {
+            if ($inFrontmatter) { break }
+            $inFrontmatter = $true
+            continue
+        }
+        if (-not $inFrontmatter) { continue }
+        if ($line -eq 'requires:') { $inRequires = $true; continue }
+        if ($inRequires -and $line -match '^\s*-\s*(.+?)\s*$') {
+            $Matches[1]
+            continue
+        }
+        $inRequires = $false
+    }
+}
+
+function Resolve-BundledSkillClosure {
+    param(
+        [string[]]$RootSkills,
+        [string[]]$Inventory,
+        [string]$SourceRoot,
+        [string]$TargetRoot
+    )
+    $pending = New-Object 'System.Collections.Generic.List[string]'
+    $selected = New-Object 'System.Collections.Generic.List[string]'
+    $preflighted = New-Object 'System.Collections.Generic.List[string]'
+    $seen = New-Object 'System.Collections.Generic.HashSet[string]' ([System.StringComparer]::Ordinal)
+    foreach ($rootSkill in $RootSkills) { $pending.Add($rootSkill) }
+
+    for ($index = 0; $index -lt $pending.Count; $index += 1) {
+        $skillName = $pending[$index]
+        if (-not $seen.Add($skillName)) { continue }
+        $source = Join-Path $SourceRoot $skillName
+        $target = Join-Path $TargetRoot $skillName
+        [void](Assert-ManagedDirectoryCopySafe -Source $source -Target $target -ManagedRoot $TargetRoot -Label $skillName)
+        $preflighted.Add($skillName)
+        $selected.Add($skillName)
+        foreach ($dependency in @(Get-CanonicalSkillRequirements -SkillFile (Join-Path $source 'SKILL.md'))) {
+            if (($Inventory -ccontains $dependency) -and -not $seen.Contains($dependency) -and -not $pending.Contains($dependency)) {
+                $pending.Add($dependency)
+            }
+        }
+    }
+    return (New-Object PSObject -Property @{ SkillNames = @($selected); PreflightedNames = @($preflighted) })
+}
+
 function Write-DependencyNotes {
     param([string[]]$SkillNames, [string]$SourceRoot, [string]$TargetRoot)
     foreach ($skillName in $SkillNames) {
         $skillFile = Join-Path (Join-Path $SourceRoot $skillName) 'SKILL.md'
-        $inFrontmatter = $false
-        $inRequires = $false
-        foreach ($line in Get-Content -LiteralPath $skillFile) {
-            if ($line -eq '---') {
-                if ($inFrontmatter) { break }
-                $inFrontmatter = $true
-                continue
-            }
-            if (-not $inFrontmatter) { continue }
-            if ($line -eq 'requires:') { $inRequires = $true; continue }
-            if ($inRequires -and $line -match '^\s*-\s*(.+?)\s*$') {
-                $dependency = $Matches[1]
-                if (($SkillNames -notcontains $dependency) -and -not (Test-Path -LiteralPath (Join-Path $TargetRoot $dependency) -PathType Container)) {
-                    Write-Info "NOTE: $skillName requires '$dependency', which is not selected or installed."
-                }
-            }
-            elseif ($inRequires) {
-                $inRequires = $false
+        foreach ($dependency in @(Get-CanonicalSkillRequirements -SkillFile $skillFile)) {
+            if (($SkillNames -notcontains $dependency) -and -not (Test-Path -LiteralPath (Join-Path $TargetRoot $dependency) -PathType Container)) {
+                Write-Info "NOTE: $skillName requires '$dependency', which is not selected or installed."
             }
         }
     }
@@ -2223,7 +2258,7 @@ function Invoke-AssistantFrameworkInstall {
     $selectedSkills = @($inventory)
     if (-not [string]::IsNullOrWhiteSpace($Skill)) {
         if ($inventory -notcontains $Skill) { throw "Unknown skill '$Skill'. Available: $($inventory -join ', ')" }
-        $selectedSkills = @($Skill)
+        $selectedSkills = @($inventory | Where-Object { $_ -ieq $Skill })
     }
 
     if ($agentName -eq 'codex' -and -not [string]::IsNullOrWhiteSpace($env:CODEX_HOME)) {
@@ -2251,13 +2286,18 @@ function Invoke-AssistantFrameworkInstall {
     if ($agentName -eq 'codex') {
         $agentsRoot = Get-FullPath -LiteralPath (Join-Path $script:UserHome '.agents')
         $skillsTarget = Join-Path $agentsRoot 'skills'
+        $codexCommonToolsTarget = Join-Path $agentsRoot 'tools'
         [void](Assert-SafeManagedChild -LiteralPath $skillsTarget -ManagedRoot $agentsRoot -Purpose 'Codex skills root')
+        [void](Assert-SafeManagedChild -LiteralPath $codexCommonToolsTarget -ManagedRoot $agentsRoot -Purpose 'Codex common tools root')
         Assert-NoSourceTargetOverlap -Source $agentHome -Target $skillsTarget -Purpose 'Codex agent home and shared skills root'
     }
     else {
         $skillsTarget = Join-Path $agentHome 'skills'
         [void](Assert-SafeManagedChild -LiteralPath $skillsTarget -ManagedRoot $agentHome -Purpose "$agentName skills root")
     }
+    $skillSelection = Resolve-BundledSkillClosure -RootSkills $selectedSkills -Inventory $inventory -SourceRoot $skillsSource -TargetRoot $skillsTarget
+    $selectedSkills = @($skillSelection.SkillNames)
+    $preflightedSkills = @($skillSelection.PreflightedNames)
     $toolsTarget = Join-Path $agentHome 'tools'
     $evalDocsTarget = Join-Path (Join-Path $agentHome 'docs') 'evals'
     $hooksRoot = Join-Path $agentHome 'hooks'
@@ -2282,6 +2322,7 @@ function Invoke-AssistantFrameworkInstall {
     Write-Info "Skills target: $skillsTarget"
 
     $toolsSource = Join-Path $script:FrameworkDir 'tools'
+    $changeImpactToolsSource = Join-Path $toolsSource 'change-impact'
     $toolExclusions = @('.DS_Store', '.publish', 'bin', 'obj')
     $evalDocsSource = Join-Path (Join-Path $script:FrameworkDir 'docs') 'evals'
     $sourceOnlyFiles = @(
@@ -2309,11 +2350,16 @@ function Invoke-AssistantFrameworkInstall {
     Assert-JsonFilePropertyIdentitySafe -LiteralPath $legacySettings
 
     foreach ($skillName in $selectedSkills) {
-        [void](Assert-ManagedDirectoryCopySafe -Source (Join-Path $skillsSource $skillName) -Target (Join-Path $skillsTarget $skillName) -ManagedRoot $skillsTarget -Label $skillName)
+        if ($preflightedSkills -notcontains $skillName) {
+            [void](Assert-ManagedDirectoryCopySafe -Source (Join-Path $skillsSource $skillName) -Target (Join-Path $skillsTarget $skillName) -ManagedRoot $skillsTarget -Label $skillName)
+        }
     }
     if (Test-Path -LiteralPath $toolsSource -PathType Container) {
         Assert-ManagedTopLevelEntriesSafe -Source $toolsSource -Target $toolsTarget -ManagedRoot $agentHome -ExcludedNames $toolExclusions -ExcludedExactPaths $sourceOnly -Label 'Tools'
     }
+    if ($agentName -eq 'codex' -and (Test-Path -LiteralPath $changeImpactToolsSource -PathType Container)) {
+        [void](Assert-ManagedDirectoryCopySafe -Source $changeImpactToolsSource -Target (Join-Path $codexCommonToolsTarget 'change-impact') -ManagedRoot $agentsRoot -Label 'Codex common change-impact checker')
+    }
     if (Test-Path -LiteralPath $evalDocsSource -PathType Container) {
         Assert-ManagedTopLevelEntriesSafe -Source $evalDocsSource -Target $evalDocsTarget -ManagedRoot $agentHome -Label 'Eval docs'
     }
@@ -2341,6 +2387,9 @@ function Invoke-AssistantFrameworkInstall {
         if (Test-Path -LiteralPath $toolsSource -PathType Container) {
             Sync-ManagedTopLevelEntries -Source $toolsSource -Target $toolsTarget -ManagedRoot $agentHome -ExcludedNames $toolExclusions -ExcludedExactPaths $sourceOnly -Label 'Tools'
         }
+        if ($agentName -eq 'codex' -and (Test-Path -LiteralPath $changeImpactToolsSource -PathType Container)) {
+            Sync-ManagedDirectory -Source $changeImpactToolsSource -Target (Join-Path $codexCommonToolsTarget 'change-impact') -ManagedRoot $agentsRoot -Label 'Codex common change-impact checker'
+        }
         if (Test-Path -LiteralPath $evalDocsSource -PathType Container) {
             Sync-ManagedTopLevelEntries -Source $evalDocsSource -Target $evalDocsTarget -ManagedRoot $agentHome -Label 'Eval docs'
         }