Rigor for the unit. Continuity for the work.

The problem

Skills alone are advice, and advice decays.

A model's attention to your standards fades across a long session and dies outright at context compaction. Nothing pushes back. The work still looks finished — tests that were never seen failing, a claim nobody tried to break, a gate quietly skipped because the session was long and the change looked small.

Hooks fight that with per-turn injection, but hooks are host-specific and don't travel. This bundle takes the other route: it moves the discipline into two places that don't decay — the host's own instructions file, which remains in session context and reloads at host-defined boundaries, and a file on disk, which survives compaction and session death.

The result is portable. The same workflow runs in Codex, Claude Code, and Antigravity, with no hooks, daemon, or host-specific runtime to maintain. Python 3 is required for the bundled CLI.

The loop

Routine work should not pay the Critical-work tax.

Micro work is inspect, change, one check and a receipt. Standard is the default for ordinary bugs and features, with RED/GREEN where applicable and focused review. Named risks — auth, money, persisted data, security, concurrency, installers, irreversible work and broad public contracts — select Critical and its full independent proof path.

Each gate is also a standalone entry point, so you can run one without the others.

Version 0.7.0 adds a deterministic verification-integrity receipt: when tampercheck is present, the Standard and Critical verification reports and the merge gate run it against the unit's diff and cite its verbatim output — exit 0 receipts that the change did not weaken the tests themselves; findings are fixed or justified in-diff, and an absent tool is disclosed rather than implied green. The skills remain hook-free and fully functional without it.

Version 0.6.0 added optional, text-first BRAINSTORM discovery before PLAN when the product problem or a consequential design choice is genuinely unresolved. Explicit invocation always activates BRAINSTORM, even when the brief is decision-complete. Without explicit invocation, a decision-complete brief skips it, and its approval authorizes planning—not building.

• "Wrote it" is not "ran it" is not "checked it's correct."
• A test never seen failing is not a test.
• A check that fails twice gets reported, not silently retried.
• Passing a gate proves readiness — it never grants permission to merge or publish.

Evidence contracts

Evidence that names exactly what was tested.

Each stage emits or consumes structured artifacts, so a handoff can't quietly lose what it was proven against. Schema 1.1 records whether the tree was clean, a hash and artifact for any uncommitted delta, dependency lockfile hashes, and the seeds of randomized runs.

A receiving stage verifies that identity and refuses stale or mismatched evidence. It may add evidence; it may not rewrite the record upstream of it.

This run-manifest schema 1.1 identifies stage evidence; it is separate from ./.rigor/goals.json plan schema 2, which stores engagement mode and queue state. Legacy plan schema 1 migrates once to a conservative finite program; unknown schemas or modes are refused. CLI tests and the bundle validator exercise those transitions. Worker-local DONE and coordinator reconcile behavior remain advisory scenario contracts because Lite has no host-level behavior harness.

The stack also consumes a deterministic-detector harness when a repository carries one — proportionally, so a typo doesn't summon a mutation run — and cites tampercheck receipts when that tool is on PATH. Everything here operates alone, or installs together with both — pinned, never mixed — as layer 1 of rigor-suite.

{
  "schema_version": "1.1",
  "stage": "build",
  "commit": "609f413…",
  "worktree_state": "clean",
  "dirty_diff_sha256": null,
  "dirty_diff_evidence": null,
  "lockfiles": [
    { "path": "…", "sha256": "…" }
  ],
  "seeds": [
    { "context": "randomized-suite",
      "seed": "…", "evidence": "…" }
  ]
}

Existing 1.0 manifests stay valid — 1.1 is additive, and old evidence is never upgraded by inference.

Shipped in v0.5.0

A green merge is a checkpoint, not an exit.

The per-unit loop ends at MERGE. A continuing engagement does not. Version 0.5.0 records the engagement mode separately, so green CI, a passing suite, a finished worker, and a merged pull request complete at most one unit.

rigor-goals persists that mode, the terminal predicate, the queue, the selected next unit, and attributable evidence receipts. In continuous and release modes, an empty known queue stays visibly active. The coordinator must reconcile accepted scope, findings, workers, pull requests, and waits before selecting the next authorized unit or naming a valid stop.

This behavior shipped through PR #20. The tagged source and its 39-test goals suite passed CI on Windows, macOS, and Linux.

# for finite_program and continuous_development
MERGE(unit)
  → RECONCILE      queue, workers, waits, findings
  → SELECT NEXT    next authorized unit
  → PLAN … MERGE   the loop continues

valid stops   owner pause · owner/external blocker
              · NEEDS_SCOPE (awaiting direction)
never a stop  merged PR · green CI · passing suite
              · finished worker · polished receipt

• single_unit — one bounded deliverable; may complete when accepted.
• finite_program — a declared sequence; completes when every outcome reconciles.
• continuous_development — "take over, keep going"; only the owner ends it.
• release_workflow — candidate/publish intent, governed by the release overlay.