@ai-dev-methodologies/rlp-desk 0.4.0 → 0.5.1

package/README.md

@@ -99,6 +99,22 @@ for iteration in 1..max_iter:
   8. Update status, report to user, continue or stop
 ```
 
+### Live PRD Update
+
+The Leader computes a hash for `prd-<slug>.md` at startup and again at each iteration using `md5`.
+
+When the hash changes, it:
+
+- Logs `prd_changed=true` with `prd_hash`, previous/new US counts, and `new_us`
+- Splits the PRD into per-US files (`prd-<slug>-US-<id>.md`)
+- Splits the test-spec into per-US files (`test-spec-<slug>-US-<id>.md`)
+- Updates the in-memory PRD US list used for per-US dispatch
+- Adds `NOTE: PRD was updated since last iteration. New/changed US may exist.` to the Worker prompt
+
+If the PRD hash is unchanged, `prd_changed=false` is logged and no re-split is triggered.
+
+If the PRD file is missing, the process degrades gracefully and continues without failing the campaign loop.
+
 ### Verification Policy (v0.3.0)
 
 RLP Desk enforces a comprehensive verification policy defined in `governance.md`:
@@ -133,15 +149,75 @@ RLP Desk enforces a comprehensive verification policy defined in `governance.md`
 | 3 consecutive failures | Architecture Escalation (§7¾) → report to user |
 | Max iterations reached | TIMEOUT |
 
-### Model Routing
+### Verification Strategy (v0.5)
+
+**Core principle: Worker and Verifier use different AI engines whenever possible.**
+
+- Per-US: lightweight verification after each user story (catches issues early)
+- Final: top-tier consensus gate before COMPLETE (quality guarantee)
+- Progressive upgrade: auto-upgrade models on consecutive failure (2-attempt windows)
+- Verifier minimum: claude sonnet (haiku cannot verify)
+
+#### 1. Claude-only (codex not installed)
+
+Verifier is always +1 tier above Worker. Same-engine shares blind spots — install codex for improved detection.
+
+| Risk | Worker | Per-US Verifier | Worker upgrade path | Verifier upgrade path |
+|------|--------|-----------------|--------------------|-----------------------|
+| LOW | haiku | sonnet | sonnet → opus | sonnet → opus |
+| MEDIUM | sonnet | sonnet | opus | sonnet → opus |
+| HIGH | sonnet | opus | opus | opus (ceiling) |
+| CRITICAL | opus | opus ⚠ | (ceiling) | (ceiling) |
+
+Final: **opus solo** ⚠ same-engine warning displayed
+
+#### 2. Cross-engine: GPT Pro (spark + 5.4)
+
+Spark is speed-optimized for coding. Use as Worker for LOW-HIGH; 5.4 for CRITICAL.
+
+| Risk | Worker (codex) | Per-US Verifier (claude) | Worker upgrade path | Verifier upgrade path |
+|------|---------------|--------------------------|--------------------|-----------------------|
+| LOW | spark medium | sonnet | spark high → xhigh | sonnet → opus |
+| MEDIUM | spark high | sonnet | spark xhigh → 5.4 medium | sonnet → opus |
+| HIGH | spark xhigh | opus | 5.4 high → 5.4 xhigh | opus (ceiling) |
+| CRITICAL | 5.4 high | opus | 5.4 xhigh | opus (ceiling) |
+
+Final: **opus + 5.4 high** (both must PASS)
+
+#### 3. Cross-engine: Non-Pro (5.4 only)
+
+| Risk | Worker (codex) | Per-US Verifier (claude) | Worker upgrade path | Verifier upgrade path |
+|------|---------------|--------------------------|--------------------|-----------------------|
+| LOW | 5.4 low | sonnet | 5.4 medium → high | sonnet → opus |
+| MEDIUM | 5.4 medium | sonnet | 5.4 high → xhigh | sonnet → opus |
+| HIGH | 5.4 high | opus | 5.4 xhigh | opus (ceiling) |
+| CRITICAL | 5.4 xhigh | opus | (ceiling) | opus (ceiling) |
+
+Final: **opus + 5.4 high** (both must PASS)
+
+#### Final Verify
+
+| Environment | Engine 1 | Engine 2 | Rule |
+|-------------|----------|----------|------|
+| Claude-only | opus | — | Solo ⚠ |
+| Cross-engine | opus | 5.4 high | Both must PASS → COMPLETE |
+
+#### Progressive Upgrade (Worker Only)
+
+Worker auto-upgrades on consecutive same-US failure. Verifier is fixed at campaign start. CB default: 6.
+
+```
+fail 1-2: keep current model (2-attempt window)
+fail 3-4: upgrade 1 step (e.g., haiku → sonnet)
+fail 5-6: upgrade 2 steps (e.g., haiku → opus)
+fail 7+:  ceiling reached → BLOCKED
+```
 
-| Scenario | Model |
-|----------|-------|
-| Simple, single-file changes | `haiku` |
-| Standard work (default) | `sonnet` |
-| Architecture changes, multi-file, prior failure | `opus` |
-| Verification (default) | `opus` |
-| Lightweight verification | `sonnet` |
+See `src/model-upgrade-table.md` for full upgrade paths per engine and complexity level.
+
+#### Sequential Final Verify
+
+When all US pass individually, the final ALL verify runs **sequentially per-US** instead of one big check. This prevents verifier timeout on large PRDs. After all per-US checks pass, the project's test suite runs once as a cross-US integration check.
 
 ## Commands
 
@@ -159,18 +235,29 @@ RLP Desk enforces a comprehensive verification policy defined in `governance.md`
 | Flag | Default | Description |
 |------|---------|-------------|
 | `--max-iter N` | 100 | Maximum iterations before timeout |
-| `--worker-model MODEL` | sonnet | Worker model (haiku/sonnet/opus) |
-| `--verifier-model MODEL` | opus | Verifier model (haiku/sonnet/opus) |
 | `--mode agent\|tmux` | agent | Execution mode (see below) |
-| `--worker-engine claude\|codex` | claude | Engine for Worker (claude uses Agent(), codex uses Bash CLI) |
-| `--verifier-engine claude\|codex` | claude | Engine for Verifier |
-| `--codex-model MODEL` | gpt-5.4 | Model passed to the Codex CLI (when engine=codex) |
-| `--codex-reasoning low\|medium\|high` | high | Reasoning effort for Codex |
+| `--worker-model MODEL` | sonnet | Claude worker model (haiku/sonnet/opus) |
+| `--worker-engine claude\|codex` | claude | Worker engine |
+| `--verifier-model MODEL` | auto | Auto-selected: +1 tier (same-engine) or cross-engine |
+| `--verifier-engine claude\|codex` | auto | Opposite of worker engine if codex available |
+| `--codex-model MODEL` | gpt-5.4 | Codex model (spark requires GPT Pro) |
+| `--codex-reasoning LEVEL` | medium | low/medium/high/xhigh |
 | `--verify-mode per-us\|batch` | per-us | Verification strategy (see below) |
-| `--verify-consensus` | off | Cross-engine consensus verification (see below) |
+| `--lock-worker-model` | off | Disable progressive model upgrade on failure |
 | `--debug` | off | Debug logging to `logs/<slug>/debug.log` |
 | `--with-self-verification` | off | Campaign-level post-loop analysis report |
 
+### Init Presets
+
+After `brainstorm`, `init` detects your environment and presents run command presets:
+
+- **Codex detected** → recommends cross-engine mode (`--worker-model gpt-5.4:high --verify-consensus`)
+- **GPT Pro (spark)** → offers spark preset (`--worker-model gpt-5.3-codex-spark:high`)
+- **Claude-only** → defaults to `--worker-model sonnet` with opus verifier
+- **Basic** → minimal flags for quick iteration
+
+The brainstorm phase evaluates complexity (US count, file scope, logic, dependencies, code impact) and recommends a starting model. You can override any recommendation.
+
 ## Execution Modes
 
 RLP Desk supports two execution modes. Both honor the same governance protocol.
@@ -277,28 +364,18 @@ Uses the `codex` CLI via `Bash()` (agent mode) or as an interactive TUI (tmux mo
 
 ## Verification Modes
 
-RLP Desk supports two verification strategies. **Per-US is the default.**
-
 ### Per-US Verification (default)
 
-```
-/rlp-desk run calculator
-/rlp-desk run calculator --verify-mode per-us
-```
-
-Each user story is verified independently after completion, then a final full verification runs after all stories pass:
+Each user story is verified independently, then a final full verification runs:
 
 ```
-Worker: US-001 → Verifier: US-001 AC only → pass
-Worker: US-002 → Verifier: US-002 AC only → pass
-Worker: US-003 → Verifier: US-003 AC only → pass
-Final full verify: ALL AC → pass → COMPLETE
+Worker: US-001 → Verifier(per-US): US-001 only → pass
+Worker: US-002 → Verifier(per-US): US-002 only → pass
+...
+Final Verify: opus + 5.4 high → both pass → COMPLETE
 ```
 
-Benefits:
-- Catch issues early, before later stories build on broken foundations
-- Smaller verification scope = faster, more accurate checks
-- Failed verification retries only the specific US
+Per-US catches issues early before later stories build on broken foundations.
 
 ### Batch Verification
 
@@ -306,30 +383,7 @@ Benefits:
 /rlp-desk run calculator --verify-mode batch
 ```
 
-Legacy behavior: Worker completes all stories, then a single verification checks all acceptance criteria at once.
-
-### Cross-Engine Consensus Verification
-
-```
-/rlp-desk run calculator --verify-consensus
-```
-
-When enabled, **both claude and codex verify independently**. Both must pass for verification to succeed.
-
-```
-Worker completes US → Claude verifies → Codex verifies
-  Both pass → proceed
-  Either fails → combined fix contract → Worker retry
-  3 rounds without consensus → BLOCKED
-```
-
-Consensus can be combined with per-US mode for maximum rigor:
-
-```
-/rlp-desk run calculator --verify-mode per-us --verify-consensus
-```
-
-Prerequisites: Both `claude` and `codex` CLIs must be installed.
+Worker completes all stories, then a single verification checks all AC at once. Final verify still applies.
 
 ## Project Structure
 
@@ -337,20 +391,42 @@ After `init`, your project gets this scaffold:
 
 ```
 your-project/
-└── .claude/ralph-desk/
-    ├── prompts/
-    │   ├── <slug>.worker.prompt.md
-    │   └── <slug>.verifier.prompt.md
-    ├── context/
-    │   └── <slug>-latest.md
-    ├── memos/
-    │   └── <slug>-memory.md
-    ├── plans/
-    │   ├── prd-<slug>.md
-    │   └── test-spec-<slug>.md
-    └── logs/<slug>/
-        └── status.json
-```
+├── .claude/
+│   ├── settings.local.json          # rlp-desk permissions (auto-added by init)
+│   └── ralph-desk/
+│       ├── prompts/
+│       │   ├── <slug>.worker.prompt.md
+│       │   └── <slug>.verifier.prompt.md
+│       ├── context/
+│       │   └── <slug>-latest.md
+│       ├── memos/
+│       │   └── <slug>-memory.md
+│       ├── plans/
+│       │   ├── prd-<slug>.md
+│       │   └── test-spec-<slug>.md
+│       └── logs/<slug>/
+│           └── status.json
+```
+
+### Local Settings
+
+`init` automatically adds the following permissions to `.claude/settings.local.json`:
+
+```json
+{
+  "permissions": {
+    "allow": [
+      "Read(.claude/ralph-desk/**)",
+      "Edit(.claude/ralph-desk/**)",
+      "Write(.claude/ralph-desk/**)"
+    ]
+  }
+}
+```
+
+**Why:** Claude Code treats `.claude/` files as sensitive and prompts for confirmation on each access, even with `--dangerously-skip-permissions`. Without these permissions, Worker and Verifier agents are blocked by interactive prompts during automated loop execution.
+
+**Note:** `settings.local.json` is local to your machine and is not committed to git. If the file already exists, permissions are merged without overwriting your existing settings.
 
 ## Example: Calculator
 

package/docs/plans/cozy-gliding-trinket.md

@@ -0,0 +1,53 @@
+# Plan: 리팩토링 실행 검증 + v05-remaining 재시작
+
+## Context
+Engine path refactoring Phase 0~7 완료 (38 TDD 구조적 테스트 pass).
+하지만 **실제 tmux 실행 검증**을 안 했음. 리팩토링이 실제 캠페인에서 정상 동작하는지 확인 필요.
+
+## 검증 순서
+
+### Step 1: 좀비 runner + sentinel 정리
+```bash
+ps aux | grep run_ralph_desk | grep -v grep | awk '{print $2}' | xargs kill 2>/dev/null
+for p in $(tmux list-panes -F '#{pane_id}' | grep -v '%360'); do tmux kill-pane -t "$p" 2>/dev/null; done
+rm -f .claude/ralph-desk/memos/v05-remaining-blocked.md
+rm -f .claude/ralph-desk/memos/v05-remaining-complete.md
+rm -f .claude/ralph-desk/memos/v05-remaining-done-claim.json
+rm -f .claude/ralph-desk/memos/v05-remaining-verify-verdict.json
+rm -f .claude/ralph-desk/memos/v05-remaining-iter-signal.json
+rm -f .claude/ralph-desk/logs/v05-remaining/session-config.json
+```
+
+### Step 2: v05-remaining 캠페인 실행 (spark worker)
+```bash
+LOOP_NAME="v05-remaining" ROOT="$PWD" MAX_ITER=15 \
+WORKER_MODEL=gpt-5.3-codex-spark WORKER_ENGINE=codex \
+WORKER_CODEX_MODEL=gpt-5.3-codex-spark WORKER_CODEX_REASONING=medium \
+VERIFIER_MODEL=sonnet VERIFIER_ENGINE=claude \
+VERIFY_MODE=per-us VERIFY_CONSENSUS=0 CB_THRESHOLD=6 \
+ITER_TIMEOUT=600 DEBUG=1 WITH_SELF_VERIFICATION=1 \
+  zsh ~/.claude/ralph-desk/run_ralph_desk.zsh
+```
+(run_in_background=true)
+
+### Step 3: 검증 체크리스트
+- [ ] Pane 3개 생성됨 (leader + worker + verifier)
+- [ ] Worker pane에서 codex exec 실행됨 (bash trigger, dead pane 오판 없음)
+- [ ] Worker 완료 후 heartbeat exited → signal auto-generate
+- [ ] Verifier(sonnet) 정상 시작 + verdict 작성
+- [ ] US-002 이상 진행 (이전 US-001은 이미 verified)
+- [ ] 좀비 runner 없음 (ps 확인)
+
+### Step 4: 실패 시 대응
+- codex worker 시작 실패 → trigger script 내용 확인 + 수동 실행 테스트
+- verifier timeout → runner log tail + pane 상태 확인
+- BLOCKED → sentinel 원인 분석 + 수정 후 재시도
+
+### Step 5: 성공 시
+- 캠페인 진행 모니터링 (status 확인)
+- 완료 대기 또는 다음 세션 handoff
+
+## 파일
+- `src/scripts/run_ralph_desk.zsh` — 리팩토링된 runner
+- `~/.claude/ralph-desk/run_ralph_desk.zsh` — 로컬 동기화된 사본
+- `.claude/ralph-desk/logs/v05-remaining/` — 캠페인 아티팩트

package/docs/plans/keen-sauteeing-snowflake.md

@@ -0,0 +1,245 @@
+# CB 정합성 수정 + 분석 로그 항상 생성
+
+## Context
+
+1. CB_THRESHOLD=3에서 모델 업그레이드 경로(3~4단계) 작동 불가 — 설계 결함
+2. campaign.jsonl, metadata.json이 `--debug` 전용 — 기본 실행에서 분석 데이터 없음
+3. campaign.jsonl에 분석에 필요한 필드 부족 (consecutive_failures, model_upgraded 등)
+
+---
+
+## 변경 1: CB_THRESHOLD 기본값 3 → 6
+
+**파일**: `src/scripts/run_ralph_desk.zsh:75`
+
+```diff
+- CB_THRESHOLD="${CB_THRESHOLD:-3}"
++ CB_THRESHOLD="${CB_THRESHOLD:-6}"
+```
+
+**파일**: `src/governance.md` §8 — CB 기본값 6 반영
+
+---
+
+## 변경 2: campaign.jsonl, metadata.json 항상 생성 (debug 게이팅 제거)
+
+### 2a. analytics 디렉토리 항상 생성
+
+**파일**: `src/scripts/run_ralph_desk.zsh` (~L1890)
+
+```diff
+- # --- Analytics directory: create only when --debug or --with-self-verification ---
+- if (( DEBUG )) || (( WITH_SELF_VERIFICATION )); then
+-   mkdir -p "$ANALYTICS_DIR" 2>/dev/null
+- fi
++ # --- Analytics directory: always create (campaign.jsonl + metadata.json are always-on) ---
++ mkdir -p "$ANALYTICS_DIR" 2>/dev/null
+```
+
+### 2b. metadata.json 항상 작성
+
+**파일**: `src/scripts/run_ralph_desk.zsh` (~L1915-1940)
+
+```diff
+- # --- metadata.json: write at campaign start ---
+- if (( DEBUG )) || (( WITH_SELF_VERIFICATION )); then
+-   jq -n \
+-     ...
+- fi
++ # --- metadata.json: always write at campaign start (cross-project identification) ---
++ jq -n \
++   ...
++   --arg project_name "$(basename "$ROOT")" \
++   ...
+```
+
+metadata.json에 `project_name` 필드 추가 (basename of ROOT).
+
+### 2c. write_campaign_jsonl() debug 게이팅 제거
+
+**파일**: `src/scripts/lib_ralph_desk.zsh:356`
+
+```diff
+- write_campaign_jsonl() {
+-   if (( ! DEBUG )) && (( ! WITH_SELF_VERIFICATION )); then return 0; fi
++ write_campaign_jsonl() {
+```
+
+### 2d. campaign.jsonl 레코드에 분석 필드 추가
+
+**파일**: `src/scripts/lib_ralph_desk.zsh` write_campaign_jsonl()
+
+추가 필드:
+- `consecutive_failures`: 현재 연속 실패 카운트
+- `model_upgraded`: 이 iteration에서 모델 업그레이드 발생 여부 (0/1)
+- `fix_contract`: 이전 iteration의 fix contract 존재 여부 (0/1)
+
+```diff
+  '{iter: $iter, us_id: $us_id, worker_model: $worker_model, ...}'
++ 에 --argjson consecutive_failures "$CONSECUTIVE_FAILURES"
++    --argjson model_upgraded "$_MODEL_UPGRADED"
+```
+
+### 2e. campaign.jsonl 버전 관리도 항상 적용
+
+**파일**: `src/scripts/run_ralph_desk.zsh` (~L1904-1913)
+
+```diff
+- # --- campaign.jsonl versioning (in analytics dir, after mkdir) ---
+- if (( DEBUG )) || (( WITH_SELF_VERIFICATION )); then
+-   if [[ -f "$CAMPAIGN_JSONL" ]]; then
++ # --- campaign.jsonl versioning (always-on) ---
++ if [[ -f "$CAMPAIGN_JSONL" ]]; then
+```
+
+debug.log 버전 관리는 `--debug` 게이팅 유지 (debug.log 자체가 debug 전용이므로).
+
+---
+
+## 변경 3: `--with-self-verification` SV report 경로 버그 수정
+
+**현재 버그:** SV report 경로 불일치
+- **쓰기** (`lib_ralph_desk.zsh:553-556`): `$LOGS_DIR/self-verification-report-NNN.md` (프로젝트 로컬)
+- **읽기** (`lib_ralph_desk.zsh:434`): `$ANALYTICS_DIR/self-verification-report-*.md` (홈)
+- 쓰는 곳과 읽는 곳이 다르므로 campaign-report.md에서 SV report 참조 실패
+
+**수정:** 읽기 경로를 `$LOGS_DIR`로 통일 (프로젝트 로컬이 맞음 — iteration 아티팩트를 분석한 결과물)
+
+**파일**: `src/scripts/lib_ralph_desk.zsh:434`
+
+```diff
+-     sv_report=$(ls -t "$ANALYTICS_DIR"/self-verification-report-*.md 2>/dev/null | head -1)
++     sv_report=$(ls -t "$LOGS_DIR"/self-verification-report-*.md 2>/dev/null | head -1)
+```
+
+**governance §6 문서에서도 정리:**
+- `self-verification-report-NNN.md` → 프로젝트 로컬 `logs/<slug>/` 에 명시
+- `self-verification-data.json` → 코드에서 생성 안 함 (governance §6에만 명시, agent-mode 전용). 문서에서 "(agent-mode only)" 주석 추가
+
+### `--with-self-verification` 파일 위치 정리
+
+| 파일 | 위치 | 생성 조건 | 용도 |
+|------|------|-----------|------|
+| `self-verification-report-NNN.md` | 프로젝트 로컬 `logs/<slug>/` | `--with-self-verification` | claude CLI로 iteration 아티팩트 분석한 서술형 리포트 |
+| `self-verification-data.json` | 홈 `analytics/<slug>--<hash>/` | agent-mode + `--with-self-verification` | 구조화된 SV 데이터 (tmux 모드에서는 생성 안 됨) |
+
+---
+
+## 변경하지 않는 것
+
+| 항목 | 위치 | 이유 |
+|------|------|------|
+| `iter-NNN.*` 전체 | 프로젝트 로컬 | 프로젝트 코드/git과 직접 연결 |
+| `campaign-report.md` | 프로젝트 로컬 | git diff stat 참조 |
+| `cost-log.jsonl` | 프로젝트 로컬 | campaign-report가 참조 |
+| `runtime/` | 프로젝트 로컬 | 실시간 운영 데이터 |
+| `baseline.log` | 프로젝트 로컬 | 프로젝트 기준점 |
+| `SV report` | 프로젝트 로컬 | iteration 아티팩트 분석 결과물 |
+| `debug.log` | 홈, `--debug` 전용 | verbose, 필요할 때만 |
+
+---
+
+## 수정 대상 파일
+
+| 파일 | 변경 |
+|------|------|
+| `src/scripts/run_ralph_desk.zsh` | CB default 6, analytics dir 항상 생성, metadata.json 항상 쓰기 + project_name, campaign.jsonl 버전 관리 항상 적용 |
+| `src/scripts/lib_ralph_desk.zsh` | write_campaign_jsonl() debug 게이팅 제거 + 필드 추가, SV report 읽기 경로 수정 |
+| `src/governance.md` | §8 CB 기본값 6, §6 파일 구조 + SV 위치 정리 |
+
+---
+
+## Verification (TDD)
+
+모든 변경은 **테스트 먼저 작성 → RED 확인 → 구현 → GREEN 확인** 순서로 진행.
+
+테스트 파일: `tests/test_cb_and_analytics.sh`
+
+### 테스트 목록 (RED → GREEN 순서대로)
+
+**변경 1: CB_THRESHOLD**
+```bash
+# T1: CB 기본값이 6인지 확인
+test_cb_default_is_6() {
+  source src/scripts/run_ralph_desk.zsh --dry-run 2>/dev/null  # 또는 grep
+  assert CB_THRESHOLD == 6
+}
+
+# T2: consensus 모드에서 effective CB가 12(6*2)인지 확인
+test_cb_consensus_doubles_to_12() {
+  VERIFY_CONSENSUS=1 source ...
+  assert EFFECTIVE_CB_THRESHOLD == 12
+}
+```
+
+**변경 2: campaign.jsonl 항상 생성**
+```bash
+# T3: --debug 없이 analytics 디렉토리 생성 확인
+test_analytics_dir_created_without_debug() {
+  DEBUG=0 WITH_SELF_VERIFICATION=0
+  # run init section → assert mkdir -p "$ANALYTICS_DIR" called
+  assert -d "$ANALYTICS_DIR"
+}
+
+# T4: --debug 없이 metadata.json 생성 확인
+test_metadata_written_without_debug() {
+  DEBUG=0 WITH_SELF_VERIFICATION=0
+  # run metadata write section
+  assert -f "$METADATA_FILE"
+}
+
+# T5: metadata.json에 project_name 필드 존재
+test_metadata_has_project_name() {
+  assert jq -r '.project_name' "$METADATA_FILE" != "null"
+}
+
+# T6: write_campaign_jsonl()이 --debug 없이 쓰는지 확인
+test_campaign_jsonl_written_without_debug() {
+  DEBUG=0 WITH_SELF_VERIFICATION=0
+  write_campaign_jsonl 1 "US-001" "pass"
+  assert -f "$CAMPAIGN_JSONL"
+}
+
+# T7: campaign.jsonl 레코드에 consecutive_failures 필드 존재
+test_campaign_jsonl_has_consecutive_failures() {
+  CONSECUTIVE_FAILURES=2
+  write_campaign_jsonl 1 "US-001" "fail"
+  assert jq -r '.consecutive_failures' last_line == 2
+}
+
+# T8: campaign.jsonl 레코드에 model_upgraded 필드 존재
+test_campaign_jsonl_has_model_upgraded() {
+  _MODEL_UPGRADED=1
+  write_campaign_jsonl 1 "US-001" "fail"
+  assert jq -r '.model_upgraded' last_line == 1
+}
+
+# T9: campaign.jsonl 재실행 시 버전 관리 (--debug 없이)
+test_campaign_jsonl_versioned_without_debug() {
+  echo '{}' > "$CAMPAIGN_JSONL"
+  # run versioning section
+  assert -f "${CAMPAIGN_JSONL%.jsonl}-v1.jsonl"
+}
+```
+
+**변경 3: SV report 경로 수정**
+```bash
+# T10: generate_campaign_report()가 $LOGS_DIR에서 SV report 찾는지 확인
+test_sv_report_read_from_logs_dir() {
+  WITH_SELF_VERIFICATION=1
+  touch "$LOGS_DIR/self-verification-report-001.md"
+  # generate_campaign_report 호출
+  # campaign-report.md 안에 $LOGS_DIR 경로의 SV report 참조 확인
+  assert grep "self-verification-report" "$LOGS_DIR/campaign-report.md"
+}
+```
+
+### 실행 순서
+
+1. 테스트 파일 작성 (`tests/test_cb_and_analytics.sh`)
+2. 전체 RED 확인 (모든 테스트 fail)
+3. 변경 1 구현 → T1, T2 GREEN
+4. 변경 2 구현 → T3~T9 GREEN
+5. 변경 3 구현 → T10 GREEN
+6. governance 문서 업데이트
+7. 기존 테스트 회귀 확인: `bash tests/test_us005_tmux_docs.sh`