Checkwright

Checkwright v0.25.0

2026-08-23

Checkwright is the verification layer under agent orchestration, and this release removes the builder’s home path from the published gate binary and closes the leak guard that could not see it. If you installed a prebuilt binary from v0.24.0, this one asks you to replace it.

In brief

  • The prebuilt gate binary no longer carries the machine that built it. Until now, every published artifact embedded two absolute paths from the build machine’s package cache, and init commits that binary into your repository — so those paths were sitting in your tracked tree.
  • You should re-run init after upgrading. Replacing the binary is the one manual step this release asks for, and the battery will tell you if you skip it.
  • The leak guard that was supposed to catch exactly that now reads binary files correctly. It never did before, so it had been reporting clean on a class of file it was never actually checking.
  • More of the battery moved onto the compiled binary, which leaves no gate on the shell substrate that is ready to move without a prerequisite landing first.
  • Amendments, held declarations and vendored template copies each got a stricter check; all three are dormant unless your tree uses the surface they hold.

Tightened gates

  • check-tree-terms — the leak guard now sees inside tracked binary files. GNU grep from 3.5 writes its binary-match record to standard error, and the shell form read standard output only, so a banned pattern inside a tracked binary reported clean and exited 0. The compiled form reads the record and reds. This is the gate that catches the artifact leak below, and it is the one most likely to red on your first battery after upgrading.
  • check-gate-substrate-parity — gains assertion H: a gate declaration that holds a port back with # port-until: must point, through its own # spec: field, at the section that states the ground. Two of the five live holds failed it when it landed.
  • check-amendment-update-target — every entry under an amendment’s ## Existing sections updated must cite a delta the same amendment defines under ## What changes. An update target no delta claims now stops at the gate instead of reaching a build that adopts it on its own authority.
  • check-unmarked-claim — a paragraph matching a declared claim class must carry a measured: marker, binding a claim that must not go stale to an oracle rather than to authorial memory.
  • check-template-copy-parity — a kit template and its vendored consumer copy must agree on their declared contract surface, with copy-side additions declared rather than merely present.

Renamed knobs

None. Five knobs were added this cycle, and none was renamed or removed, so no own-config residue is owed.

Behavior changes

  • gate-sdk/bin/build-native.sh — the release build now passes --remap-path-prefix for both CARGO_HOME and HOME, then verifies its own output against the consumer’s resolved banned-pattern set before it finishes. The remap flag was chosen over cargo’s trim-paths, which would have raised the crate’s minimum supported Rust version. Nothing is asked of you here: it changes what a build emits, and the artifact you install is already remapped.
  • scripts/checkwright-gates (the placed gate binary) — the artifact published with v0.24.0 embeds two absolute paths from the build machine. The file is tracked and committed in your tree, so upgrading the kits alone does not replace it. Re-run init at the new version. Note that your git history will still contain the old binary; that is expected and is not something this release rewrites.
  • guard-kit/lib/guard.sh — a new generic rule grants the mandated append-to-a-gitignored-target, and the rules that followed it are renumbered from 17–21 to 18–22. If your own prose or configuration cites a guard rule by number, re-read those citations: the numbers moved and nothing checks a citation outside the kit.
  • delegation-kit/templates/agent-execution.md — the in-turn wait rule now states the loop’s polarity as well as its ordering. A liveness wait takes while kill -0 "$pid", never until; written inverted, the loop exits immediately while the producer is still running. This was measured rather than reasoned, and it is behavior-folded: if you copied this template out, your copy teaches the failing form.
  • gate-sdk/bin/run-gates.sh — gains --only <name>… to run named registry members and --for <path>… to select by coupling, exactly as the generated hook would.

Upgrading

Replace the vendored kit directories wholesale at v0.25.0, then re-run init so the placed gate binary is replaced with the remapped one — this step is specific to this release and is what clears the leak-guard red below. Regenerate your generated artifacts; each one’s freshness gate names its own regen command when it reds. Then run the full battery.

The allowed reds. Each is a gate named above, and each clears differently:

  • check-tree-terms — if it names your tracked gate binary, you have the v0.24.0 artifact still in place. Re-run init at this version and re-run the battery. If it names anything else, that is a real finding this gate could not previously see inside a binary.
  • check-gate-substrate-parity — reds on your own # port-until: declaration whose # spec: pointer does not name the field. Point it at the section that states the ground.
  • check-amendment-update-target — reds only on an amendment under composition carrying an update target no delta claims. Cite the delta, or drop the target.
  • check-template-copy-parity — reds on a vendored template copy that has diverged from its kit original. Declare the copy-side addition, or re-sync.
  • check-unmarked-claim — dormant unless you declare claim classes; with none declared it skips clean and cannot red.

One gate tightened this cycle and is deliberately declared nowhere above: check-gate-assertions ended its own exemption from the criterion it applies to every sibling, and now audits its own declaration. It is not an allowed red and not a tightened-gates bullet, because the declaration it newly reaches ships inside the kit and passes — it reaches nothing a consumer authored.

The behavior changes above are declared for reading, not a mechanical scan. If a gate reds that this note does not name, the upgrade smoke was supposed to catch it first — open an issue, because that is a defect in the release rather than work for you.