fix(development-system): keep checkpoint states canonical

Limit terminal delta review to active terminal cycles and represent an invalid new test inside the canonical failing state. The focused behavior fixture now guards both recovery and ordinary-delivery transitions.

Author: jwilger

evals/fixtures/behavior/development-discipline/cases.json

@@ -508,7 +508,7 @@
   {
     "case_id": "development-discipline-per-edit-durable-checkpoint",
     "behavior": "Preserves every implementation or test edit through immediate testing, durable resume state, and delivery-mode-specific checkpointing.",
-    "prompt": "You are midway through a ticket with several small implementation and test edits. Define the exact state machine after each individual edit, including a failed immediate test, a passing immediate test, an inseparable RED-to-GREEN pair, an interruption at any transition, documentation/configuration/formatting/generated-file changes, all three delivery modes, CI running or failing after push, and the terminal full-review sequence. Explicitly assign comprehensive slow suites and say whether they may be duplicated locally. For local-only mode, explicitly cover Tiber's opt-in committed-evidence policy when commit authority is withheld. What may be edited or batched at each point?",
+    "prompt": "You are midway through a ticket with several small implementation and test edits. Define the exact state machine after each individual edit, including a failed immediate test, a newly written test that passes unexpectedly, a passing immediate test, an inseparable RED-to-GREEN pair, an interruption at any transition, documentation/configuration/formatting/generated-file changes, all three delivery modes, an ordinary delivery hook or formatter that changes source before ticket completion, CI running or failing after push, and the terminal full-review sequence. Explicitly assign comprehensive slow suites and say whether they may be duplicated locally. For local-only mode, explicitly cover Tiber's opt-in committed-evidence policy when commit authority is withheld. What may be edited or batched at each point?",
     "tags": [
       "development-discipline",
       "tdd",
@@ -532,11 +532,11 @@
       "baselineLiftThreshold": 0.1
     },
     "minPassRate": 0.67,
-    "semanticRubric": "Pass if the response requires the smallest relevant test immediately after every individual implementation-file or test-file edit and durably binds the exact snapshot to one of four states: failing, passing-awaiting-gates-or-review, committed, or pushed/delivery-mode-equivalent, with the next permitted action. On failure it prohibits commit, push, unrelated edits, and convenience changes, allowing only the next causal edit followed immediately by another test. On pass it stops implementation/test editing until bounded lightweight review, the repository fast pre-commit gate, and the authorized delivery-mode checkpoint complete: a signed commit and push where authorized, or an exact reviewed and fast-gate-passing no-commit terminal snapshot in local-only mode when commit authority is absent. It must add that Tiber's opt-in final-review policy makes a local commit repository-required when reviewed source/verification paths must be in a commit tree; if commit authority is withheld, completion blocks without a no-commit substitute or push. It permits exactly one declared inseparable RED-to-GREEN pair by recording the expected RED and causal claim, allowing only its paired implementation edit, immediately retesting, and entering the normal green checkpoint. It gives proportional tests and checkpoint rules for docs, configuration, formatting-only work, and generated or mechanically required companions while forbidding unrelated passing work from being batched. It defines local-only as the locally authorized terminal checkpoint with no remote mutation, direct-to-trunk as a normal push, and PR mode as an authorized branch push without inferring permission to open or merge; each state must resume from exact durable evidence. After push it begins the next iteration while exact-SHA CI runs, but a completed CI failure immediately preempts work through Tiber recovery. It leaves comprehensive slow suites to CI rather than duplicating them locally. Full multi-lens review begins only after all acceptance criteria and planned increments are delivered; a review finding follows the normal tested, lightweight-reviewed, signed, exactly verified, pushed checkpoint when remote delivery is authorized, or the exact local-only equivalent, before the full clean-iteration/reset protocol resumes. Fail if tests may be deferred across edits, passing changes may be convenience-batched, remotely delivered commits are unsigned or unreviewed, failed work is committed, CI success serializes every next increment, CI failure does not preempt, PR/merge authority is inferred, local-only pushes or commits without authority, policy-required committed evidence is replaced by a mutable snapshot, comprehensive gates are duplicated locally, intermediate commits require full multi-lens review, or lightweight review substitutes for terminal clean iterations.",
+    "semanticRubric": "Pass if the response requires the smallest relevant test immediately after every individual implementation-file or test-file edit and durably binds the exact snapshot to one of four states: failing, passing-awaiting-gates-or-review, committed, or pushed/delivery-mode-equivalent, with the next permitted action. A newly written test that passes unexpectedly remains canonical failing state with an invalid-test reason and permits only the causal test rewrite plus immediate rerun; it must not introduce a fifth durable state or checkpoint that invalid test. On failure it prohibits commit, push, unrelated edits, and convenience changes, allowing only the next causal edit followed immediately by another test. On pass it stops implementation/test editing until bounded lightweight review, the repository fast pre-commit gate, and the authorized delivery-mode checkpoint complete: a signed commit and push where authorized, or an exact reviewed and fast-gate-passing no-commit terminal snapshot in local-only mode when commit authority is absent. It must add that Tiber's opt-in final-review policy makes a local commit repository-required when reviewed source/verification paths must be in a commit tree; if commit authority is withheld, completion blocks without a no-commit substitute or push. It permits exactly one declared inseparable RED-to-GREEN pair by recording the expected RED and causal claim, allowing only its paired implementation edit, immediately retesting, and entering the normal green checkpoint. It gives proportional tests and checkpoint rules for docs, configuration, formatting-only work, and generated or mechanically required companions while forbidding unrelated passing work from being batched. It defines local-only as the locally authorized terminal checkpoint with no remote mutation, direct-to-trunk as a normal push, and PR mode as an authorized branch push without inferring permission to open or merge; each state must resume from exact durable evidence. If a hook, formatter, or other ordinary delivery step changes source before ticket completion, it repeats and delivers the causal checkpoint but does not start terminal review early; terminal delta/reset applies only to an already-active terminal review or its remediation. After push it begins the next iteration while exact-SHA CI runs, but a completed CI failure immediately preempts work through Tiber recovery. It leaves comprehensive slow suites to CI rather than duplicating them locally. Full multi-lens review begins only after all acceptance criteria and planned increments are delivered; a review finding follows the normal tested, lightweight-reviewed, signed, exactly verified, pushed checkpoint when remote delivery is authorized, or the exact local-only equivalent, before the full clean-iteration/reset protocol resumes. Fail if tests may be deferred across edits, an invalid test becomes a fifth durable state or is checkpointed, passing changes may be convenience-batched, ordinary delivery mutation starts terminal review early, remotely delivered commits are unsigned or unreviewed, failed work is committed, CI success serializes every next increment, CI failure does not preempt, PR/merge authority is inferred, local-only pushes or commits without authority, policy-required committed evidence is replaced by a mutable snapshot, comprehensive gates are duplicated locally, intermediate commits require full multi-lens review, or lightweight review substitutes for terminal clean iterations.",
     "hardAssertions": [],
     "calibration": {
       "pass": [
-        "After each implementation or test edit, immediately run the smallest relevant test and persist the exact snapshot as failing, passing-awaiting-gates-or-review, committed, or pushed/local-equivalent plus its sole next action. Failure permits only one causal edit then another immediate test. GREEN freezes implementation/test edits until bounded lightweight review, fast pre-commit, signed commit, and the mode-authorized checkpoint. Declare and record one inseparable RED-to-GREEN pair only when necessary. Give proportional gates to docs/config/format/generated companions but never batch unrelated passing work. Local-only stays local and may use a no-commit snapshot unless Tiber policy requires committed evidence; then a local commit is required and withheld authority blocks without authorizing a push. Trunk and PR modes push only as already authorized. Start the next increment while exact-SHA CI runs, preempt immediately on failure, and reserve comprehensive suites for CI. Run full multi-lens clean iterations only after all increments are delivered; review remediation itself goes through the normal checkpoint before review resets."
+        "After each implementation or test edit, immediately run the smallest relevant test and persist the exact snapshot as failing, passing-awaiting-gates-or-review, committed, or pushed/local-equivalent plus its sole next action. An unexpectedly passing new test stays failing with an invalid-test reason and permits only its rewrite and rerun. Failure permits only one causal edit then another immediate test. GREEN freezes implementation/test edits until bounded lightweight review, fast pre-commit, signed commit, and the mode-authorized checkpoint. Declare and record one inseparable RED-to-GREEN pair only when necessary. Give proportional gates to docs/config/format/generated companions but never batch unrelated passing work. Local-only stays local and may use a no-commit snapshot unless Tiber policy requires committed evidence; then a local commit is required and withheld authority blocks without authorizing a push. Trunk and PR modes push only as already authorized. An ordinary source-changing hook or formatter repeats the checkpoint without starting terminal review early. Start the next increment while exact-SHA CI runs, preempt immediately on failure, and reserve comprehensive suites for CI. Run full multi-lens clean iterations only after all increments are delivered; review remediation itself goes through the normal checkpoint before review resets."
       ],
       "fail": [
         "Make several convenient edits, run tests once, then wait for three full-review passes and every comprehensive local suite before one unsigned commit; continue working through failed CI and open or merge a PR automatically."

plugins/development-system/components/development-discipline/skills/delivery-workflow/SKILL.md

@@ -65,6 +65,11 @@ baseline, or changes the requested scope, the prior review is
 stale: treat the mutation as a new causal checkpoint, rerun its immediate test,
 lightweight review, fast gate, signed commit, exact verification, and normal
 push. Then run terminal delta/reset review against that new delivered identity.
+A source mutation triggers terminal delta/reset review only when terminal review
+was already active or the mutation remediates a terminal-review finding. During
+an ordinary checkpoint before ticket completion, deliver the new causal
+checkpoint and continue with the next planned increment; do not start terminal
+review early.
 A metadata-only revision change stays in delivery verification and does not
 reopen source review.
 

plugins/development-system/components/development-discipline/skills/test-driven-development/SKILL.md

@@ -117,10 +117,12 @@ record the exact snapshot as `failing` or
 `passing-awaiting-gates-or-review`.
 
 An immediately passing newly written test is not GREEN and must not enter
-`passing-awaiting-gates-or-review`. Record it as `invalid-test`, permit only the
-causal rewrite needed to make the test demonstrate missing behavior, and rerun
-it immediately. Commit and push remain prohibited until a valid RED result (or
-an explicitly recorded RED exemption) is followed by GREEN.
+`passing-awaiting-gates-or-review`. Record the snapshot in canonical `failing`
+state with `failure_kind: invalid-test` and the causal test rewrite as its sole
+next action, then rerun it immediately. Commit and push remain prohibited until
+a valid RED result (or an explicitly recorded RED exemption) is followed by
+GREEN. `failure_kind` explains the failure without introducing another durable
+checkpoint state.
 
 At `failing`, prohibit commit, push, unrelated edits, cleanup, and convenience
 changes. Permit only the next causal edit, then run the smallest relevant test