fix(development-system): canonicalize checkpoint records

Define one compact JSON wire format, deterministic tracked and untracked snapshot identities, state-specific fields, and the unexpected-pass recovery rule so fresh sessions can round-trip durable per-edit evidence without guessing.

Closes: 20260901-xige

Author: jwilger

evals/fixtures/behavior/development-discipline/cases.json

@@ -537,7 +537,7 @@
     "calibration": {
       "pass": [
         "After each implementation or test edit, immediately run the smallest relevant test and persist the immutable ticket-start baseline and exact snapshot as failing, passing-awaiting-gates-or-review, committed, or pushed/local-equivalent plus its sole next action. An unexpectedly passing new test stays failing with an invalid-test reason and permits only its rewrite and rerun. Failure permits only one causal edit then another immediate test. GREEN freezes implementation/test edits until bounded lightweight review, fast pre-commit, signed commit, and the mode-authorized checkpoint. Declare and record one inseparable RED-to-GREEN pair only when necessary. Give proportional gates to docs/config/format/generated companions but never batch unrelated passing work. Local-only stays local and may use a no-commit snapshot unless Tiber policy requires committed evidence; then a local commit is required and withheld authority blocks without authorizing a push. Trunk and PR modes push only as already authorized. An ordinary source-changing hook or formatter repeats the checkpoint without starting terminal review early. Start the next increment while exact-SHA CI runs, preempt immediately on failure, and reserve comprehensive suites for CI. Run full multi-lens clean iterations only after all increments are delivered; review remediation itself goes through the normal checkpoint before review resets.",
-        "Use the active Tiber task's Git-backed notes as the durable owner: append a bounded single-line checkpoint-v1 record with tiber.note.add (CLI: tiber note add) after every transition. On restart or handoff, load the latest record with tiber.show, reconcile its baseline, snapshot, test receipt, gates, delivery identity, CI references, and sole next action against Git and forge state, and stop without editing or delivery when evidence is missing, malformed, unpublished, or mismatched. Treat the record as evidence, not emulated native workflow enforcement."
+        "Use the active Tiber task's Git-backed notes as the durable owner: append the canonical checkpoint-v1 plus compact-JSON record with tiber.note.add (CLI: tiber note add) after every transition. Name the required keys, state-specific nullability, JSON escaping, and the deterministic tracked and untracked snapshot hashing byte streams; make development-workflow the sole schema owner and require Tiber guidance to reference it rather than invent another encoding. On restart or handoff, load the latest record with tiber.show, reconcile its baseline, snapshot, test receipt, gates, delivery identity, CI references, and sole next action against Git and forge state, and stop without editing or delivery when evidence is missing, malformed, unpublished, or mismatched. Treat the record as evidence, not emulated native workflow enforcement."
       ],
       "fail": [
         "Make several convenient edits, run tests once, then wait for three full-review passes and every comprehensive local suite before one unsigned commit; continue working through failed CI and open or merge a PR automatically.",

plugins/development-system/components/tiber/skills/tiber/SKILL.md

@@ -80,11 +80,11 @@ relative to this skill file and prefer that launcher before probing `PATH`.
 - When the development workflow requires a durable per-edit checkpoint, append
   a single-line `checkpoint-v1` record to the active task with `tiber.note.add`
   (CLI: `tiber note add`).
-  Record the full immutable ticket-start OID, exact content snapshot identity,
-  canonical state, focused-test command and bounded receipt reference,
-  completed gates, commit or delivery identity and CI references when present,
-  and the sole next permitted action. Never put raw logs, credentials, or
-  secrets in the note. On restart or handoff, use `tiber.show` to load the
+  Use the canonical `checkpoint-v1 ` compact-JSON wire form and deterministic
+  tracked/untracked snapshot algorithm defined by the public
+  `development-workflow` skill; that skill is the sole schema owner. Do not
+  invent alternate keys, delimiters, hashes, or state-specific nullability.
+  Never put raw logs, credentials, or secrets in the note. On restart or handoff, use `tiber.show` to load the
   latest record and reconcile it with Git and forge state before acting. Missing,
   malformed, unpublished, or mismatched evidence is a recovery hold, not
   permission to infer progress. These notes are evidence records; they do not

plugins/development-system/skills/development-workflow/SKILL.md

@@ -49,11 +49,27 @@ checkpoint and into terminal review:
 The available persistence owner is the active Tiber task's Git-backed notes,
 not the unavailable native workflow scheduler. After every state transition,
 append one single-line `checkpoint-v1` record with `tiber.note.add` (CLI:
-`tiber note add`); include the
-full ticket-start OID, an exact content snapshot identity, state, focused-test
-command and receipt reference, completed gates, commit or delivery identity when
-present, CI references when present, and the sole next permitted action. Store
-bounded references rather than raw logs or secrets. At session start, restart,
+`tiber note add`). The canonical wire form is the literal prefix
+`checkpoint-v1 ` followed by one compact JSON object (no Markdown) with these
+required keys: `baseline_oid`, `snapshot`, `state`, `test`, `gates`,
+`delivery`, `ci`, and `next_action`. Use strings for scalar values, arrays of
+strings for `gates` and `ci`, and `null` only for an inapplicable `test` or
+`delivery`. `snapshot` must contain the full current `HEAD` OID plus
+`tracked_sha256` and `untracked_sha256`:
+
+- `tracked_sha256` is SHA-256 of the exact byte stream from
+  `git diff --binary --full-index HEAD --`.
+- `untracked_sha256` is SHA-256 of the byte stream produced by iterating
+  `git ls-files --others --exclude-standard -z` in its emitted order and, for
+  each path, appending the path bytes, one NUL byte, the file's
+  `git hash-object -- <path>` OID, and one newline byte. The empty stream has
+  the standard SHA-256 empty digest.
+
+`test` contains the focused command plus a bounded receipt reference.
+`delivery` contains the signed commit OID, pushed OID, or local-only snapshot
+identity required by the current state. State-specific absent values remain
+`null` or empty arrays; never omit or rename keys. JSON escaping is the only
+escaping. Store bounded references rather than raw logs or secrets. At session start, restart,
 or handoff, read the task with `tiber.show`, select its latest `checkpoint-v1`
 record, and reconcile every identity with current Git and forge state before
 acting. A malformed, missing, unpublished, or mismatched record is a fail-closed
@@ -63,16 +79,21 @@ emulate or claim native `workflow.*` enforcement.
 
 - `failing`: commit and push are prohibited. Permit only the next causal edit
   needed to address that failure, reject unrelated or convenience changes, and
-  immediately test again.
+  immediately test again. `test` is required and `delivery` is `null`.
+  A newly written test that passes unexpectedly is still `failing`, with an
+  `invalid-test` reason and only the causal test rewrite as `next_action`; do
+  not checkpoint that test as passing or introduce a fifth state.
 - `passing-awaiting-gates-or-review`: freeze further implementation and test
   edits. Run the bounded lightweight review and repository fast pre-commit
   gate; any remediation is a new causal edit and therefore triggers another
-  immediate focused test.
+  immediate focused test. `test` is required and `delivery` is `null`.
 - `committed`: record the signed commit OID and whether the next action is the
-  delivery-mode checkpoint or a locally complete checkpoint.
+  delivery-mode checkpoint or a locally complete checkpoint; `delivery` is
+  required and its commit OID must equal `snapshot.head`.
 - `pushed-or-delivery-mode-equivalent`: record the exact pushed OID and CI runs,
   or the exact local-only terminal snapshot and the fact that remote mutation
-  is unauthorized. When Tiber's opt-in final-review policy requires reviewed
+  is unauthorized; `delivery` is required and must identify the exact
+  state-appropriate commit or snapshot. When Tiber's opt-in final-review policy requires reviewed
   source and verification paths in a commit tree, the local equivalent is a
   required local commit; if commit authority is explicitly withheld, completion
   blocks without authorizing a push.