v0.12.0 integration 24b3: the build loop lands and records, drain lanes, gitleaks opt-in, terminal check, record-lint edge and ADR-id rules, follow-ups

[REPPL]

Integration 24b-3 lands seventeen reviewed branches in one change, still inside the unreleased, breaking v0.12.0. For a user: a repository that opts into gitleaks gets it in every scan abcd makes; the build loop can take a lane from review to a merged pull request by itself and hands a lane back to the person after its fix rounds; abcd drain now works issues through that loop one lane at a time; record-lint catches stale and circular dependency edges between intents and two files claiming one ADR id; prompts no longer appear when stdin is /dev/null; and abcd --version says when it answers from a superseded plugin root.

gitleaks in every scan (gitleaksAug). A repository that opts into gitleaks now gets it in every scan abcd makes, not in transcript capture alone: the launch scan, the privacy lint, a lifeboat pack, and the transcript, issue-capture, memory, decision, intent, ideate, reading and release write paths all report what gitleaks finds, beside the native scanner. When the repository armed gitleaks and the binary is not installed, a release and a lifeboat pack refuse, the privacy lint reports an error, and the write paths still write on the native scanner and name the gap in their receipt. What gitleaks hands back is treated as untrusted input: capped, position-checked, forced to hard_fail, and never shown in clear.

One lock primitive for every flock (flockSites, carried by gitleaksAug). The five record stores that ran their own flock loops (ADR, intent and spec mint locks, the memory store, the history records) now go through fsutil's two lock primitives, with byte-identical lock paths, and a detector stops a sixth from appearing. The history records lock's wait is now bounded at two minutes instead of hanging, and lock descriptors are close-on-exec, so a child a holder started no longer keeps the lock.

Guard-teaching follow-ups (teachFollow). A repository's own guard lesson has its why and its successor capped at 1,024 bytes each, and a longer one refuses the guard file loudly. When the rules overflow the injection budget, the notice names the file that filled it. Under a committed guard switch-off every taught lesson says the guard is off, and when a rules override leaves out a lesson the repository's guard file teaches, the load names that lesson too.

A malformed repository route is skipped (routeNameSkip). A repository's .abcd/config.json can no longer stop abcd ahoy credential, ahoy connect and the providers board by giving a route a name that is not a plain lower-case name, or a value that is not <provider>/<model>: per ruling CD2 the route is skipped with one sanitised warning naming the file and the name, and everything else keeps working. The same mistakes in the person's own ~/.abcd/config.json still refuse.

Filing-match follow-ups (filingFollow). reverses: is a checked cross-reference field in record-lint, the promote route's ADR states its lock exactly, and dead code in the reading match is removed.

Terminal detection (ttyDetect). abcd asked install and identity questions when stdin came from /dev/null, because its terminal check treated any character device as a terminal. It now asks the kernel whether the descriptor is a terminal, so a redirected or closed stdin declines with "no terminal to ask at". A program PATH finds inside the checkout no longer counts as installed. By design, abcd update </dev/null now proceeds as it does from a pipe.

One ADR id, one file (adrIdUnique). record-lint's new adr_id_unique blocker refuses two ADR files that claim one id, and the resolver and abcd adr-N refuse such an id naming both files instead of taking whichever sorts first.

Stale intent edges relinked (recDefects). A sweep of planned and draft intents relinks or drops nine builds_on/blocked_by edges that named a superseded intent, each dropped edge saying why under the intent's Audit Notes.

Dependency-edge lint (lintEdges). record-lint warns on a planned or draft intent whose builds_on or blocked_by names a superseded intent (stale_edge), naming where the chain ends, and on a cycle through those edges (edge_cycle), naming every record on it.

Predecessor-store citations qualified (drainCitations). Intents that cite spec numbers from the retired predecessor store now say so with a "(predecessor store)" qualifier where the number also names a different live spec; citations of live specs are unchanged. Records only.

Reach baseline shrunk (drainReach). In eighteen packages, exported core functions nothing outside their package calls are made package-private or marked as test seams. Nothing is deleted and no behaviour changes.

Superseded plugin root named (supersededRoot). abcd --version (and update --check) and bare abcd ahoy add a superseded_root note when the running binary sits in a plugin root other than the one this session resolves, so an old binary a pinned command page still runs no longer answers confidently with a version that is false of this machine.

Pinned-action bump intent filed (iss209). A draft intent records the automation ruling M3 asked for: a dependabot bump of an action in a scaffolded workflow syncs its template and lands re-authored. Nothing is built; it waits on its planning interview.

Undecided audits reopen the work; fix rounds are capped (fixLoop, carrying fidelityOnce). When the build loop's fidelity audit cannot decide whether a criterion is met, the work goes back to a fresh implementer as it does for a not-met criterion; it never lands on an undecided audit (ruling DQ1a). A lane takes at most the run's fix rounds (3 unless --fix-rounds or pace.fix_rounds says otherwise, ruling DR1); past that it is handed back to the person as unachievable with the last round's findings, and the run starts nothing further for it.

The loop lands its own lanes (loopLanding). Once a lane's reviewers pass, abcd implement step closes the spec, resolves the captures the lane fixed, commits those records with the repository's hooks running and an Assisted-by: naming the model the lane's receipts reported, waits for the preflight receipt, pushes, opens the pull request, arms the merge as the ruleset says, and cleans up only after the commit is on the default branch. abcd implement record shows what the run did and captures its transcripts into the history store.

The drain works issues through the loop (drainLoop). abcd drain hands each open issue that needs no decision to the implement loop, one lane at a time, and hands every other issue back to a person by kind; abcd build <iss-N> starts an issue-keyed lane whose brief is the issue and its remedy. The drain stops at the end of its working window and at --max.

A stale tag no longer lapses a deferral (anchorStale). A checkout that has not fetched the newest release tag no longer reads a record deferred past that tag as lapsed: the record is handed back as "anchor stale", naming the tag and git fetch --tags, with no remote call. The drain's rule is no longer read through a linked decision store.

Integration follow-ups. A handed-back run names the way out: every later step's refusal and build next's exclusion now name the run's directory under the local run tier as the thing to remove once the intent is replanned (fl1). abcd implement record --transcript now carries a transcript's scan gap on the run record, as history capture does, when gitleaks is armed and not installed. reclassify --by adr-N resolves the ADR through the record-id seam, so an id two files claim refuses there too, and the start check's two-file case now asserts that refusal. stale_edge follows supersession chains through the build's own blocked check, so a chain settled by an accepted decision or a discipline says "settled by ...: drop the edge" (rulings CF1, CF2). Drafts itd-22 and itd-33 drop their settled edges on itd-2, so record-lint shows only the three cycle warnings. The reading windows are recalibrated at the tip. Six decision-log entries appear twice because two histories held them in opposite order; an appended entry says so. The reflect command (itd-24) is not in this change: its review returned FIX FIRST.

Resolves: iss-129
Resolves: iss-2608291814575788
Resolves: iss-2609020113012227
Resolves: iss-2609300025372991
Resolves: iss-2609300032219282
Resolves: iss-2609300109005165
Resolves: iss-2609300841407812
Resolves: iss-2609300841466575
Resolves: iss-2609300903497125
Resolves: iss-2609300905174086
Resolves: iss-2609300905225841
Resolves: iss-2609300916451435
Resolves: iss-2609300916459279
Resolves: iss-2609300916465620
Resolves: iss-2609300929557796
Resolves: iss-2609301000153822
Resolves: iss-2609301002043276
Resolves: iss-2609301046433372
Resolves: iss-2609301128211767
Resolves: iss-2609301128253254
Resolves: iss-2609301303434847
Resolves: iss-2609301307566557

Assisted-by: Claude:claude-opus-5-5