fix: complete native multi-plan lifecycle and setup discovery (Factory-038)

[PatrickSys]

Problem and resulting behavior

Factory-037 installed consumers exposed two lifecycle correctness gaps: PLAN02 failed with stale_state while PLAN01 remained the recorded authority, and an amended verification report left an outdated gaps_found state. Setup also failed to expose a root AGENTS.md workflow map. This stacked draft provides a guarded second-PLAN handoff, accurate per-plan routing/status and safe workflow discovery.

Stacked on PR #127 (factory/036-real-run@d93dd81c). Factory-038 commits are isolated on pushed factory/038@9963bf9. Neither PR was merged to default branch or published to npm.

Delivered source fixes

• FIX1 fd4b560 + c938733: explicit phase plan --start-new preserves existing history only if the prior approved plan, SHA/path/identity, authority and completed summary agree. The new PLAN requires fresh owner approval; exact chainKey routing detects an unverified PLAN02 despite a previous PLAN01 verification. Refreshed fix_gaps outcomes are reflected in native state. Regressions: 6/9→9/9 lifecycle, 102/103→103/103 router; independent code review GO after corrective pass.
• FIX6 7ad1537 (from isolated 1f5bb37): normal setup installs a compact root AGENTS.md guidance block alongside the portable work-* skills, preserves unrelated existing governance and honors explicit --no-agents.
• FIX6 hardening 9963bf9 (from independent branch commit 00dfa8b): preflight legacy helper collision before migration, and do not rewrite fake AGENTS markers inside fenced Markdown samples. Targeted RED→8/8 GREEN; independent review defects resolved.

Final HEAD verification: node tests/run-all.cjs 34/34 test files GREEN. Package from this exact commit built with Node24/npm11, version retained 0.35.0, 122 files, SHA256 1FDE384488B6CBBDFD1602F6BB57E7D54DA693288087D5E95790FD091ACD2995. Fresh source-free install setup --yes exit0 / health --json exit0; 25-line root AGENTS.md and portable work-plan skill present. Exact receipts: %TEMP%/factory-038/logs/final-head/, logs/pack-final-9963/, install-smoke-final-9963/.

Honest installed consumer result (REVISE)

T3 ran earlier integrated commit 7ad1537 package SHA256 98AF33C248807FE0181151F66B2751E1076849BA4D48AB268A7607285197FE91 on fresh angular-spotify@7af8b43. Two application writers overlapped and produced both feature slices; 31.8m, 15.38M top-level tokens, 17 scoped tests and default/production builds GREEN. Native documentation led the agent to ONE brownfield CHANGE with two tasks. It self-approved that one plan (not Patrick), closed it through verify/audit transition, and next correctly said brownfield_change_closed. It did not exercise two independently routed PLAN01 and PLAN02 lifecycles.

Independent native reviewer: REVISE for requested two-plan acceptance; GO only for truthful single-chain closeout. Separate blind app reviewer scored 12/12 feature criteria but REVISE, merge NO, because frozen host comparison caught ten new no-explicit-any warnings in consumer test specs (9 playback.service.spec.ts, 1 track-notification.service.spec.ts), over the existing lint-store circular-dependency baseline error. Host build + eight relevant library tests GREEN, app test/lint app old baseline failures unchanged. Strict collector status REGRESSION is correct; do not waive it. No live Spotify account or native OS notification proof. The consumer findings concern the disposable trial code and do not imply an additional Workspine-source regression.

Source code fixes remain GREEN. The final-HEAD packed smoke is real, but T3 was not repeated against 9963bf9 after hardening. Conditional standalone T2 rerun did not trigger because T3 failed. See PR #127 "Real tasks (038)" for the 037-comparable table, frozen controls, timing and evidence paths.

Evidence, authorization, rollback

• Independent native and app reviews preserved at %TEMP%/factory-038/logs/par-native-review/CHATGPT-INDEPENDENT-REVIEW.md and logs/par-review/final.md; host verifier status, consumer diff and native evidence in logs/par. Original Factory-037 controls untouched.
• Ordinary non-force Git pushes only. Undo product code with targeted git revert of the relevant commits on factory/038, then ordinary push. The isolated discovery branch is also backed up at origin/factory/038-discovery@00dfa8b5. No force-push, default merge, tag or npm publication.
• S1–S6 owner stops: none. Damaged local Node22 npm10 was handled with a temporary npm11-on-Node22 CLI shim in the disposable test, not a global configuration change. Codex full-access only for isolated product worktrees and disposable consumer. Draft PR description edited to record evidence; no author comments or messages.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
workspine	Ready	Preview	Oct 16, 2026 6:56pm UTC