feat: make self-hosting the standing delivery practice (phases 6–7 + plan 25)

[darko-mijic]

Summary

Phases 6–7 and plan 25 make the Protocol usable as a delivery practice in both directions, then close the guidance debt above it:

• Phase 6 — outward adoption: ship the graph-first authoring/reader surface, package it for an adopter, and measure it on the origin project.
• Phase 7 — inward standing practice: use that same surface on the Protocol itself, turn forward work into Specs, deliberately bind current realization, add inward expected-outcome oracles, and complete one intent → readiness → implementation → verification → slimming loop.
• Plan 25 — guidance recovery and the process layer: re-home the dissolution audit's seven orphaned guidance items into their carrying Specs, and rebuild gen 1's process layer as guidance without gates — a third packaged skill, sdp-sessions, that routes delivery work shapes through the existing graph recipes.

The origin checkout was not modified during phase 7. Its phase-6 working-copy changes remain reverted and survive only in libar-ai/convex-event-sourcing#181.

Phase 6 — outward usage and adoption

• Ratifies verification posture (MD-23): authored verification mode is intent; realization remains derived.
• Generalizes and wires the records gate into the thirteen-leg repository check.
• Ships both agent skills and eleven executable sdp q recipes in the adopter package.
• Teaches the complete graph-first authoring loop and uses all four readiness rungs honestly.
• Adds the package-surface smoke proof and the first second-caller measurements.
• Records the origin adoption evidence: 57 Specs across all four rungs, zero findings, 73.1% fewer gross completion-event tokens, 38.0% fewer non-cached input-plus-output tokens, and 432.27 ms median fresh query derivation.

Phase 7 — inward self-hosting practice

• Ratifies the example realization posture (MD-24): examples normally carry verification evidence, while implemented stays direct and anchor-derived.
• Makes recipe 1 the operational backlog definition: ready ∧ kind≠example ∧ ¬implemented, with excluded-example counts and verifier-health reporting. The raw-query caveat remains explicit.
• Authors forward intent for runtime observation, impact-graph support, Markdown Pack authoring, and kind-neutral oracle eligibility at the rungs their evidence earns.
• Audits all 13 non-example backlog laws and records a named disposition for each; 20 concrete implementation anchors close them honestly.
• Re-measures and re-argues all eight implemented-but-not-stated-ready rows; each remains individually at defined.
• Adds the first inward oracle over spec:consumers.reader, consuming three existing points with three distinct expected outcomes. The technically eligible duplicate-ID target is explicitly refused as vacuous.
• Changes the shared oracle predicate from behavior-only eligibility to any Spec that owns an example space; validator and reader consumers continue to fail closed through the same predicate.
• Adds two ready executable points plus a self-referential rule-kind oracle for spec:validation.oracle-target-eligibility.
• Mutation-probes the behavior-only predicate, the reader expected branch, and the self-referential expected outcome; each targeted suite turns red before restoration.
• Captures a genuine enrichment datum across 019d063 (implementing Design), 341ead6 (implementation), and 7ae8087 (post-green slimming) without generalizing from one case.
• Ignores user-local .vscode/ state, closes the four-column friction ledger without repeated friction, marks plan 24 EXECUTED, and removes the explicitly authorized superseded phase-6 plan file.

Plan 25 — guidance recovery and the process layer (5736877)

• Audits the three dissolved concept docs and the folded DECISIONS diary against their claimed carriers (reviews/13, 113 content units traced): zero GAP-class losses; seven PARTIAL guidance items survived only in git history.
• Re-homes all seven into typed owners: the one-kind rule's split guidance (spec:model.core-model + the authoring skill), child-above-parent readiness independence (spec:validation.readiness-floor), the typed-dependency rationale (spec:model.relations), the graph(A)/graph(B) diff framing (spec:consumers.impact-graph, still idea), the named no-duplicated-intent-on-Packs ruling (spec:validation.pack-coherence), MD-1's recovered-surface gloss (spec:decisions.executable-meta-model), and the softened curation claim (docs/concept/06).
• Rebuilds gen 1's process layer as guidance without gates: the packaged sdp-sessions skill routes capture, design, implement, review, and close work shapes through the existing eleven recipes — advisory preflights only, no FSM, no scope enforcement, no new validators or reader verbs. It is owned by the new ready behavior spec:consumers.delivery-session-on-ramp (refines the authoring on-ramp) with direct implementation and verifier anchors.
• Extends sdp-authoring with the cheap idea-capture template (the idea floor is the whole shape) and the promotion-preflight habit; CONTEXT.md declares delivery session and work shape as guidance-only labels.
• Ships the third skill in the adopter tarball (package.json files + package-smoke proof) and names all three skills in the README's adopter section.
• Rewrites AGENTS.md graph-first: a "Query the graph first" section, derived-never-quoted corpus status, and the recovered gen-1 lineage lesson.

Closing graph

• 129 Specs · 1 Pack · 118 anchors → 248 nodes · 466 edges
• Readiness: ready 87 / defined 37 / scoped 1 / idea 4
• Delivery facts: implemented 42 / has-verifier 88 / observed 0
• Operational backlog: 0
• Excluded ready examples: 53, none missing a verifier
• Drift rows: 8, all freshly argued
• Inward models edges: 2
• Validation: 0 errors / 0 warnings

Verification

• Full thirteen-leg npm run check passes in the normal tree and independently at committed checkpoints in a detached clean worktree.
• Vitest 2→4 is isolated in f8a50bb: installed Vitest 4.1.10, replaced removed singleFork with forks + one worker + isolation disabled, and migrated five deprecated matcher aliases without changing assertions.
• Vitest 4 results: 48 files / 606 tests, followed by the dedicated 55-test CLI pass.
• Dependency advisories moved from 8 (3 moderate / 4 high / 1 critical) to 3 (1 low / 2 high / 0 critical).
• Both derived graph hashes are byte-identical before and after the Vitest migration:
  • self-hosting: de3589892d25f40fe38af3b6be638514bc1d9f263b15811853e9770c86168232
  • checkout example: 17a03acf584ebebdf20051f75ed774a1deac5ba3b7f578c3d59bba9ffa7aa790

Deliberate boundaries

• No graph-schema or exported TypeScript API change.
• No Markdown Pack syntax ruling or implementation.
• No runtime-observation producer or impact graph implementation.
• No batch promotion of the eight drift rows.
• No phase-7 work in the origin checkout and no reapplication of its reverted changes.
• No gen-1-style process gates: every sdp-sessions preflight informs; none authorizes, blocks, scopes, or advances work.

Post-review follow-up (454e9e9, 4079825)

A full review pass over the branch diff (engine changes read directly; test, spec, doc, and gate
surfaces swept independently) confirmed the kind-neutral oracle predicate is correct and
fail-closed and found four issues, all fixed:

• Recipe portability (the outstanding review finding): recipes 3, 4, 6, and 9 open with a
  subject const naming this repository's corpus. The catalog intro now states the
  parameterization contract explicitly, and recipe 9 names its id line as the parameter — every
  body still runs verbatim here, and an absent id returns { found: false } rather than failing.
• Tautological skill test: the "no colliding global binary" check collected only
  pnpm-prefixed lines and then asserted the pnpm prefix — true by construction. It now scans
  every shell-fenced line and fails on any bare sdp / npx sdp invocation.
• Latent false alarm in the recipe 10 check: its completeness expectation used
  verifiers.length > 0 while the recipe emits rows only for example-declared or enabled
  bindings; the predicates now mirror each other exactly.
• Gate plan selector: zero-padded primary plans (01-–09-) silently never entered the
  highest-primary-plan selection; they now do, while letter-suffixed plans stay excluded.

A second polish pass (4079825) closed the remaining low-severity items and a real usability
failure: the source checkout now has a working full-CLI entry (pnpm --silent sdp --help via a
new sdp package script) and the README documents the exact pnpm exec sdp failure signature on
macOS (Apple's unrelated /usr/bin/sdp demands Xcode); the temporal guard anchors its sweep to
its own directory instead of the caller's cwd, and skips tracked file symlinks whose canonical
file is independently enumerated — CLAUDE.md → AGENTS.md was being swept twice on every run.

Plan-25 review pass (c945d80, 9922cd6, 6e76af5)

A third review pass over the whole diff against main — the plan-25 batch read line-by-line, the
engine and test surfaces and the docs/specs/skills surfaces each swept by an independent
reviewer, and every plan-25 close-record claim re-derived from the tree — verified all seven
audit items landed faithfully and found one real defect plus four hardening items, all fixed:

• A silently wrong oracle outcome: the reader entry-map oracle stated
  matchedField: "sections.behavior.rules" — an outcome the reader never emits and the authored
  concept-entry example contradicts ("sections.behavior") — and stayed green, because both
  oracle suites compared the oracle to literals hand-copied from the oracle itself. The suites
  now assert every expected outcome against the contract-recorded Then parameters, so oracle
  drift from authored intent turns red; both suites were mutation-probed red and restored green.
• The gate test's plan-selector regex now matches the guard's zero-padded form, so the two
  selectors cannot silently disagree again.
• The semantic-surface check now bans the general shape of plan-status wording on
  CONTEXT.md/DECISIONS.md, not just three frozen historical strings.
• The temporal guard's symlink dedup normalizes to git's forward-slash paths, so the
  double-sweep exemption also holds off-darwin.
• Docs polish: the README names the three shipped skills for adopters; the audit's disposition
  pointer, a born-ready phrasing tension in plan 25, and the new skill's quote style were
  aligned.
• Gate honesty on macOS: re-running the gate with an unmasked exit code exposed two
  environment races a piped tail had hidden — Finder's .DS_Store files inside generated/
  read as content drift (now skipped as OS metadata and git-ignored repo-wide), and the
  preflight's scratch-tree removal crashed on a transient ENOTEMPTY when Spotlight touched the
  tree mid-delete (now retried).

Full thirteen-leg npm run check re-run green (true exit 0, preflight clean) after the fixes.

[greptile-apps]

Want your agent to iterate on Greptile's feedback? Try greploops.

[greptile-apps]

Greptile has paused reviews on this repository — it used its 100 free open-source review credits for this billing period. Reviews resume automatically on August 12. To continue before then, an organization admin can keep reviews running past the free credits — those bill as normal usage.