@ai-dev-methodologies/rlp-desk 0.5.4 → 0.7.0

package/docs/plans/mutable-booping-corbato.md

@@ -0,0 +1,163 @@
+# Plan: rlp-desk Batch Mode + Operational Context 개선
+
+## Context
+
+실제 캠페인(`prod-local-parity`, spark:high)에서 두 가지 구조적 문제가 발견됨:
+
+1. **Batch 모드 무한 FAIL**: US 5개 이상이면 Worker가 일부만 완료 → Verifier가 전체 검증 → FAIL → 진전 무시 → CB BLOCKED. `VERIFIED_US` 추적이 per-us 모드에만 있고 batch에는 없음.
+
+2. **서버 프로젝트 지원 부재**: Worker가 코드 수정 후 서버 restart를 안 하고, 서버 포트를 모르고, health check도 없음. spark 모델 탓이 아니라 **rlp-desk가 operational context를 brainstorm/prompt에 반영하지 않는 설계 결함**.
+
+---
+
+## P0: Batch 모드 Partial Progress Tracking
+
+### 수정 대상
+- `src/scripts/run_ralph_desk.zsh`
+- `src/commands/rlp-desk.md` (agent mode ⑦c)
+
+### 변경 내용
+
+#### 1. Batch 모드에도 VERIFIED_US 추적 (run_ralph_desk.zsh)
+- PASS verdict 처리(L2423): `per-us` 조건 제거 → batch에서도 `signal_us_id`가 개별 US면 `VERIFIED_US`에 추가
+- FAIL verdict 처리(L2445): verdict JSON에서 `per_us_results` 파싱 → `met=true`인 US를 `VERIFIED_US`에 추가
+- status.json 갱신: batch 모드에서도 `verified_us` 배열 기록
+
+#### 2. Verifier Prompt에 VERIFIED_US 전달 (run_ralph_desk.zsh L1225-1232)
+- `if [[ "$VERIFY_MODE" = "per-us"` 조건 → `if [[ -n "$VERIFIED_US"` 로 변경
+- batch 모드 verifier에게도 "이미 verified된 US skip" 지시
+
+#### 3. Fix Contract Scope Narrowing (run_ralph_desk.zsh L2461-2473)
+- FAIL 시: verdict에서 pass한 US 추출 → fix contract에 "US-001~004 verified. Continue from US-005."
+- Worker prompt 조합 시 `VERIFIED_US` 참조하여 축소된 scope 전달
+
+#### 4. consecutive_failures 부분 리셋 (run_ralph_desk.zsh L2447)
+- 새로 pass된 US가 있으면 (`VERIFIED_US` 길어짐) → `CONSECUTIVE_FAILURES=0` 리셋
+- 진전 없이 같은 상태면 → 기존대로 증가
+
+#### 5. Verifier Verdict에 per_us_results 필수화
+- Verifier prompt template(init_ralph_desk.zsh L384-474)에 output format 추가:
+  ```json
+  {
+    "verdict": "fail",
+    "per_us_results": { "US-001": "pass", "US-005": "fail" },
+    "issues": [...]
+  }
+  ```
+- batch/per-us 공통으로 per_us_results 포함하도록 지시
+
+---
+
+## P1: Brainstorm Operational Context + Worker System Prompt
+
+### 수정 대상
+- `src/commands/rlp-desk.md` (brainstorm section)
+- `src/scripts/init_ralph_desk.zsh` (Worker/Verifier prompt template)
+
+### 변경 내용
+
+#### 1. Brainstorm: Operational Context 수집 (rlp-desk.md L24-93)
+현재 11개 항목 수집 중, **12번째 항목 추가**:
+
+```
+12. **Operational Context** (if applicable):
+    - Does this project require a running server/service? (y/n)
+    - Server start command (e.g., `npm run dev`, `python manage.py runserver`)
+    - Server port (e.g., 7001)
+    - Health check URL (e.g., `http://localhost:7001/health`)
+    - Other runtime dependencies (e.g., database, Redis)
+```
+
+brainstorm이 프로젝트 디렉토리에서 `package.json`의 `scripts.dev`/`scripts.start`, `Makefile`, `docker-compose.yml` 등을 자동 감지하여 추천.
+
+#### 2. Brainstorm: US 생성 시 Operational Step 포함 가이드
+US/AC 작성 가이드(rlp-desk.md L26-38)에 추가:
+
+```
+- If the project has operational context (server, DB, etc.):
+  - Each US that modifies server code MUST include AC:
+    "Given server is running, When code is modified, Then server is restarted and responds on health check URL"
+  - Do NOT assume Worker will restart server on its own — spell it out in AC
+```
+
+#### 3. Init: Worker Prompt에 Operational Rules 주입 (init_ralph_desk.zsh L285-380)
+brainstorm에서 수집한 operational context를 Worker prompt template에 주입:
+
+```markdown
+## Operational Context
+- **Server Command**: `npm run dev`
+- **Server Port**: 7001
+- **Health Check**: `http://localhost:7001/health`
+
+### Operational Rules (always apply)
+- After modifying server/application code, restart the server: `[server_cmd]`
+- Before signaling done, verify server responds: `curl -s [health_url] || fail`
+- Do NOT modify dependency files (package.json, requirements.txt, etc.) unless the AC explicitly requires it
+- Do NOT run package install commands (npm install, pip install, etc.) unless the AC explicitly requires it
+```
+
+operational context가 없는 프로젝트(코드만 수정)면 이 섹션 생략.
+
+#### 4. Init: Verifier Prompt에도 Operational Check 추가
+Verifier prompt template(init_ralph_desk.zsh L384-474)에:
+
+```markdown
+## Operational Verification (if server context provided)
+- Verify server is running on expected port before checking ACs
+- If server is down, verdict=FAIL with issue: "server not running"
+```
+
+#### 5. --server-cmd / --server-port CLI 옵션 (run_ralph_desk.zsh)
+brainstorm에서 수집한 값을 init이 prompt에 넣지만, run 시 override도 가능:
+- `--server-cmd "npm run dev"` → Worker prompt의 서버 명령어 override
+- `--server-port 7001` → Worker prompt의 포트 override
+- 런타임에 iteration 시작 시 health check (optional, `--server-health-check` flag)
+
+---
+
+## Verification Plan
+
+### P0 Tests
+```bash
+# Batch partial progress 단위 테스트
+zsh tests/test_batch_partial_progress.sh
+# 시나리오: batch FAIL verdict에 per_us_results 포함 → VERIFIED_US 추적 확인
+# 시나리오: 새 US pass 시 consecutive_failures 리셋 확인
+# 시나리오: verifier prompt에 VERIFIED_US 포함 확인 (batch 모드)
+```
+
+### P1 Tests
+```bash
+# Operational context 단위 테스트
+zsh tests/test_operational_context.sh
+# 시나리오: --server-cmd 옵션 파싱 확인
+# 시나리오: Worker prompt에 operational rules 주입 확인
+# 시나리오: operational context 없는 프로젝트에서는 섹션 생략 확인
+```
+
+### Self-Verification (CLAUDE.md 필수)
+변경된 src 파일에 대해 3개 시나리오 (LOW/MEDIUM/CRITICAL) 자체 검증 실행.
+
+### E2E
+실제 캠페인으로 테스트:
+1. batch 모드 + 10 US → partial progress 추적 확인
+2. server 프로젝트 + spark:high → 서버 restart 수행 확인
+
+---
+
+## File Map
+
+| 파일 | P0 | P1 |
+|------|----|----|
+| `src/scripts/run_ralph_desk.zsh` | VERIFIED_US batch 추적, fix contract narrowing, CF 리셋 | --server-cmd/port 옵션 |
+| `src/scripts/lib_ralph_desk.zsh` | - | - |
+| `src/scripts/init_ralph_desk.zsh` | - | Worker/Verifier prompt에 operational context 주입 |
+| `src/commands/rlp-desk.md` | agent mode ⑦c batch 로직 | brainstorm 12번 항목, US 가이드 |
+| `src/governance.md` | - | - |
+
+---
+
+## Scope / Non-Goals
+- 모델별 가드레일 (spark 전용 금지 목록) → **하지 않음**. brainstorm/prompt 구조로 해결
+- batch 모드 완전 제거 → **하지 않음**. 수정하여 사용 가능하게 함
+- auto-detect project type → brainstorm에서 사용자 확인 + 파일 기반 추천만. 완전 자동화 아님

package/docs/superpowers/plans/2026-04-06-worker-verifier-prompt-restructure.md

@@ -0,0 +1,179 @@
+# Worker/Verifier Prompt Restructure Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Restructure Worker/Verifier prompt templates in init_ralph_desk.zsh to make TDD more prominent, reduce prompt size, and add debugging/anti-rationalization guidance.
+
+**Architecture:** Elevate TDD from procedural guidance to hard constraint box (same level as SCOPE LOCK). Compress Forbidden Shortcuts by removing items already enforced by Verifier. Add "When Stuck" debugging protocol and Verifier anti-rationalization patterns.
+
+**Tech Stack:** zsh heredoc templates in init_ralph_desk.zsh
+
+**Origin:** ralplan consensus (Architect APPROVE + Critic ACCEPT, 2026-04-06)
+
+---
+
+### Task 1: Insert TDD MANDATE and remove old Test-First Approach
+
+**Files:**
+- Modify: `src/scripts/init_ralph_desk.zsh:323-337`
+
+- [ ] **Step 1: Insert TDD MANDATE after file-reading section (L323), before SCOPE LOCK (L325)**
+
+In `src/scripts/init_ralph_desk.zsh`, find:
+```
+4. Latest Context: $DESK/context/$SLUG-latest.md → current state
+
+## SCOPE LOCK (hard constraint — violation causes verification failure)
+```
+
+Replace with:
+```
+4. Latest Context: $DESK/context/$SLUG-latest.md → current state
+
+## TDD MANDATE (hard constraint — violation = automatic FAIL)
+> Write failing tests FIRST → confirm RED (exit_code=1) → implement minimum code → confirm GREEN.
+> Every NEW AC requires: write_test → verify_red → implement → verify_green in execution_steps.
+> No exceptions. Verifier rejects missing RED evidence. For already-passing ACs, use verify_existing.
+
+## SCOPE LOCK (hard constraint — violation causes verification failure)
+```
+
+- [ ] **Step 2: Remove old Test-First Approach section (L333-337)**
+
+Find and delete these 6 lines (header + blank line + 4 items):
+```
+## Test-First Approach (read test-spec BEFORE coding)
+1. Read test-spec "Impacted Tests" — if TODO (first iteration), skip to step 2 and fill this section during your work. Otherwise, run these FIRST to confirm they pass before your changes.
+2. Read test-spec "Required New Tests" — write these. They SHOULD FAIL initially.
+3. Implement minimum code to make all tests pass.
+4. Run ALL tests (impacted + new) to confirm nothing is broken.
+```
+
+- [ ] **Step 3: Verify changes**
+
+Run: `grep -n "TDD MANDATE\|Test-First Approach\|SCOPE LOCK" src/scripts/init_ralph_desk.zsh`
+Expected: TDD MANDATE appears BEFORE SCOPE LOCK. "Test-First Approach" does NOT appear.
+
+---
+
+### Task 2: Compress Forbidden Shortcuts from 14 to 6 items
+
+**Files:**
+- Modify: `src/scripts/init_ralph_desk.zsh:339-353`
+
+- [ ] **Step 1: Replace Forbidden Shortcuts section**
+
+Find the entire `## Forbidden Shortcuts` section (14 items from L339-353) and replace with these 6 items:
+
+```
+## Forbidden Shortcuts (Verifier will check these)
+- Do not mock external services when L2 integration test is required by test-spec.
+- Do not delete or weaken existing assertions to make tests pass.
+- Do not skip boundary cases listed in the PRD.
+- Do not write code before tests — if you did, delete it and start with tests.
+- **NEVER modify rlp-desk infrastructure files** (~/.claude/ralph-desk/*, ~/.claude/commands/rlp-desk.md). If you discover a bug in rlp-desk itself, report it in done-claim.json with {"status": "blocked", "reason": "rlp-desk bug: <description>"} and signal blocked. Do NOT attempt to fix rlp-desk — it is the orchestration tool, not your project code.
+- **NEVER modify Claude Code settings** (~/.claude/settings.json, .claude/settings.local.json, or any settings files). Do NOT add permissions, change models, or alter configuration. If a permission prompt blocks you, report it as blocked — do NOT try to edit settings to bypass it.
+```
+
+Removed items and their coverage:
+- L342 "test-specific logic" → Verifier step 10 (L474) checks this
+- L344 "code inspection" → Verifier step 10½ phrase scan (L484)
+- L345 "too simple to test" → Verifier step 10½ phrase scan (L484)
+- L346 "I'll test after" → will add to Verifier step 10½ in Task 4
+- L347 "already manually tested" → Verifier step 10½ phrase scan (L484)
+- L348 "partial check is enough" → Verifier step 10½ phrase scan (L484)
+- L349 "I'm confident" → Verifier step 10½ phrase scan (L484)
+- L350 "existing code has no tests" → TDD MANDATE covers ("no exceptions")
+
+- [ ] **Step 2: Verify line count**
+
+Run: `sed -n '/^## Forbidden Shortcuts/,/^## /p' src/scripts/init_ralph_desk.zsh | head -10`
+Expected: 7 lines (1 header + 6 items)
+
+---
+
+### Task 3: Add "When Stuck" debugging guide
+
+**Files:**
+- Modify: `src/scripts/init_ralph_desk.zsh` (after Forbidden Shortcuts, before Iteration rules)
+
+- [ ] **Step 1: Insert debugging guide**
+
+Find:
+```
+- **NEVER modify Claude Code settings** (~/.claude/settings.json, .claude/settings.local.json, or any settings files). Do NOT add permissions, change models, or alter configuration. If a permission prompt blocks you, report it as blocked — do NOT try to edit settings to bypass it.
+
+## Iteration rules
+```
+
+Replace with:
+```
+- **NEVER modify Claude Code settings** (~/.claude/settings.json, .claude/settings.local.json, or any settings files). Do NOT add permissions, change models, or alter configuration. If a permission prompt blocks you, report it as blocked — do NOT try to edit settings to bypass it.
+
+## When Stuck (do NOT guess-and-fix)
+> 1. STOP and READ the error. Trace the call stack. Identify the root cause before touching code.
+> 2. Write a minimal test that reproduces the failure, then fix the root cause only.
+> 3. If 3+ fixes fail on the same issue, signal "blocked" with your diagnosis.
+
+## Iteration rules
+```
+
+- [ ] **Step 2: Verify insertion**
+
+Run: `grep -n "When Stuck" src/scripts/init_ralph_desk.zsh`
+Expected: exactly 1 match, between Forbidden Shortcuts and Iteration rules
+
+---
+
+### Task 4: Extend Verifier Anti-Rationalization + gap-close step 10½
+
+**Files:**
+- Modify: `src/scripts/init_ralph_desk.zsh:480,484`
+
+- [ ] **Step 1: Add rationalization red flags to step 10¼**
+
+Find:
+```
+   - Never issue a silent PASS — every pass verdict must cite specific evidence for each AC checked
+10½. **Worker Process Audit**:
+```
+
+Replace with:
+```
+   - Never issue a silent PASS — every pass verdict must cite specific evidence for each AC checked
+   - Rationalization red flags: "tests pass so it works" (passing ≠ correct), "Worker is confident" (confidence ≠ evidence), "changes are minimal" (scope ≠ correctness)
+10½. **Worker Process Audit**:
+```
+
+- [ ] **Step 2: Gap-close — add "I'll test after" to step 10½ phrase scan**
+
+Find:
+```
+   - Forbidden shortcuts: check done-claim claims and summary for forbidden phrases ("code inspection", "I'm confident", "too simple", "already manually tested", "partial check")
+```
+
+Replace with:
+```
+   - Forbidden shortcuts: check done-claim claims and summary for forbidden phrases ("code inspection", "I'm confident", "too simple", "I'll test after", "already manually tested", "partial check")
+```
+
+- [ ] **Step 3: Verify both changes**
+
+Run: `grep -n "Rationalization red flags\|I'll test after" src/scripts/init_ralph_desk.zsh`
+Expected: 2 matches — one in step 10¼, one in step 10½
+
+---
+
+## Token Budget Verification
+
+After all 4 tasks, verify net token reduction:
+
+```bash
+# Before: count Worker prompt lines (approximate)
+# After: should be ~10 lines fewer
+wc -l src/scripts/init_ralph_desk.zsh
+# Compare with git: lines removed vs added
+git diff --stat src/scripts/init_ralph_desk.zsh
+```
+
+Expected: net negative line count (fewer lines = less context pressure on Worker).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-dev-methodologies/rlp-desk",
-  "version": "0.5.4",
+  "version": "0.7.0",
   "description": "Fresh-context iterative loops for Claude Code — autonomous task completion with independent verification",
   "scripts": {
     "postinstall": "node scripts/postinstall.js",

package/src/commands/rlp-desk.md

@@ -69,14 +69,14 @@ Ask about these items one by one (or in small groups):
 
    | Complexity | Worker | per-US Verifier | Final Verifier | Consensus |
    |------------|--------|-----------------|----------------|-----------|
-   | LOW | spark:high | sonnet | opus | final-only |
-   | MEDIUM | spark:high | opus | opus | final-only |
+   | LOW | gpt-5.4:high | sonnet | opus | final-only |
+   | MEDIUM | gpt-5.4:high | opus | opus | final-only |
    | HIGH | gpt-5.4:high | opus | opus | all |
    | CRITICAL | gpt-5.4:high | opus | opus + human | all |
 
    **Worker model selection** (cross-engine):
-   - **spark:high** — default recommendation (Pro token pool = cost savings). PRD AC count <= 15
-   - **gpt-5.4:high** — fallback when spark 100k output limit exceeded. PRD AC count > 15
+   - **gpt-5.4:high** — default recommendation (full context window, reliable for all US sizes)
+   - **spark:high** — only when US is small enough for spark's 100k context (single-file, AC count <= 4, simple logic). Do NOT use as primary recommendation — spark context window is too small for most tasks
 
    Present complexity score with evidence to the user, e.g.: "I rate this MEDIUM because: US count=4 (MEDIUM), file scope=2 (MEDIUM), logic=conditionals (MEDIUM), deps=none (LOW), impact=modify (MEDIUM). Highest=MEDIUM."
 
@@ -85,12 +85,24 @@ Ask about these items one by one (or in small groups):
    **If codex is NOT installed** — say: "Codex is not installed. Defaulting to claude-only Worker. Note: without a second engine, your Verifier shares the same perspective as the Worker — there is a risk of blind spots where both Worker and Verifier miss the same issue. To unlock cross-engine coverage: `npm install -g @openai/codex`"
 
 8. **Batch Capacity Check** — when verify-mode is batch and PRD is large:
-   - batch + spark + AC > 10 → warn "spark 100k output limit — consider wave split or switch to gpt-5.4"
+   - batch + spark + AC > 4 → warn "spark 100k context limit — switch to gpt-5.4 or split smaller"
    - batch + gpt-5.4 + AC > 15 → warn "too many ACs for single batch — consider wave split (3-4 US per wave)"
    - per-us → no warning (US-level processing, no limit concern)
 9. **Verify Mode** — per-us (default) or batch. Ask: "Verify after each user story (per-us, recommended) or only after all stories are done (batch)?" Default recommendation: per-us for 2+ stories.
 10. **Consensus** — Ask: "Use cross-engine consensus? off (single engine), final-only (cross-engine on final verify only), or all (cross-engine on every verify). Requires codex CLI." Default: off. Recommended: final-only when codex is installed.
 11. **Max Iterations** — suggest based on story count, ask if OK.
+12. **Operational Context** — Auto-detect: scan project root for `package.json` (scripts.dev/start), `Makefile`, `docker-compose.yml`, `manage.py`. If detected, ask:
+   - "Does this project require a running server/service during development?" (y/n)
+   - If yes: "Server start command?" (pre-fill from detected scripts, e.g., `npm run dev`)
+   - "Server port?" (e.g., 7001)
+   - "Health check URL?" (e.g., `http://localhost:7001/health`) — optional
+   - Pass to init: `--server-cmd "CMD" --server-port PORT --server-health URL`
+   - If no server needed: skip. Init generates prompts without operational context.
+
+   **US generation guidance when server context is present:**
+   - Each US that modifies server/application code SHOULD include an AC or note:
+     "Given server is running, When code is modified, Then server is restarted and health check passes"
+   - Do NOT assume the Worker model will restart servers on its own — spell it out in the AC or rely on the operational rules injected by init.
 
 After all items are confirmed:
 
@@ -132,12 +144,12 @@ Tell the user:
    ```
    Available run commands (copy the one you want):
 
-   # ★ Recommended: cross-engine + final-consensus (cost savings + blind-spot coverage):
-   /rlp-desk run <actual-slug> --mode tmux --worker-model spark:high --consensus final-only --debug
-
-   # Large PRD (AC > 15, exceeds spark 100k limit):
+   # ★ Recommended: cross-engine + final-consensus (full context + blind-spot coverage):
    /rlp-desk run <actual-slug> --mode tmux --worker-model gpt-5.4:high --consensus final-only --debug
 
+   # Small tasks only (single-file, AC <= 4, simple logic — spark 100k context limit):
+   /rlp-desk run <actual-slug> --mode tmux --worker-model spark:high --consensus final-only --debug
+
    # Critical (full consensus on every verify):
    /rlp-desk run <actual-slug> --mode tmux --worker-model gpt-5.4:high --consensus all --debug
 
@@ -146,7 +158,7 @@ Tell the user:
 
    # Full options reference:
    #   --mode agent|tmux                      (default: agent)
-   #   --worker-model MODEL                   haiku|sonnet|opus or spark:high|gpt-5.4:high (default: haiku)
+   #   --worker-model MODEL                   haiku|sonnet|opus or gpt-5.4:high|spark:high (default: haiku)
    #   --lock-worker-model                    disable auto model upgrade
    #   --verifier-model MODEL                 per-US verifier (default: sonnet)
    #   --final-verifier-model MODEL           final ALL verifier (default: opus)
@@ -695,7 +707,7 @@ Example:
 
 Run options:
   --mode agent|tmux                    Execution mode (default: agent)
-  --worker-model MODEL                 Worker model: haiku|sonnet|opus or spark:high|gpt-5.4:high (default: haiku)
+  --worker-model MODEL                 Worker model: haiku|sonnet|opus or gpt-5.4:high|spark:high (default: haiku)
   --lock-worker-model                  Disable auto model upgrade on failure
   --verifier-model MODEL               per-US verifier (default: sonnet)
   --final-verifier-model MODEL         Final ALL verifier (default: opus)

package/src/model-upgrade-table.md

@@ -9,23 +9,23 @@ CB default: 6. Override: `--cb-threshold N`. Worker only — Verifier fixed at c
 - CB < table columns → BLOCKED at that column
 - CB > 6 → repeat ceiling model beyond column 6
 
-## GPT Pro (spark — separate token limit)
+## GPT Pro (gpt-5.3-codex-spark — separate token limit)
 
 | Complexity | 1-2 | 3-4 | 5-6 | 7+ |
 |------------|-----|-----|-----|-----|
-| LOW | spark:low | spark:medium | spark:high | BLOCKED |
-| MEDIUM | spark:medium | spark:high | spark:xhigh | BLOCKED |
-| HIGH | spark:high | spark:xhigh | spark:xhigh | BLOCKED |
-| CRITICAL | spark:xhigh | spark:xhigh | spark:xhigh | BLOCKED |
+| LOW | gpt-5.3-codex-spark:low | gpt-5.3-codex-spark:medium | gpt-5.3-codex-spark:high | BLOCKED |
+| MEDIUM | gpt-5.3-codex-spark:medium | gpt-5.3-codex-spark:high | gpt-5.3-codex-spark:xhigh | BLOCKED |
+| HIGH | gpt-5.3-codex-spark:high | gpt-5.3-codex-spark:xhigh | gpt-5.3-codex-spark:xhigh | BLOCKED |
+| CRITICAL | gpt-5.3-codex-spark:xhigh | gpt-5.3-codex-spark:xhigh | gpt-5.3-codex-spark:xhigh | BLOCKED |
 
 ## Non-Pro (gpt-5.4)
 
 | Complexity | 1-2 | 3-4 | 5-6 | 7+ |
 |------------|-----|-----|-----|-----|
-| LOW | 5.4:low | 5.4:medium | 5.4:high | BLOCKED |
-| MEDIUM | 5.4:medium | 5.4:high | 5.4:xhigh | BLOCKED |
-| HIGH | 5.4:high | 5.4:xhigh | 5.4:xhigh | BLOCKED |
-| CRITICAL | 5.4:xhigh | 5.4:xhigh | 5.4:xhigh | BLOCKED |
+| LOW | gpt-5.4:low | gpt-5.4:medium | gpt-5.4:high | BLOCKED |
+| MEDIUM | gpt-5.4:medium | gpt-5.4:high | gpt-5.4:xhigh | BLOCKED |
+| HIGH | gpt-5.4:high | gpt-5.4:xhigh | gpt-5.4:xhigh | BLOCKED |
+| CRITICAL | gpt-5.4:xhigh | gpt-5.4:xhigh | gpt-5.4:xhigh | BLOCKED |
 
 ## Claude-only
 

package/src/scripts/init_ralph_desk.zsh

@@ -11,11 +11,14 @@ set -euo pipefail
 #   ~/.claude/ralph-desk/init_ralph_desk.zsh <slug> [objective] [--mode fresh|improve]
 # =============================================================================
 
-SLUG="${1:?Usage: $0 <slug> [objective] [--mode fresh|improve]}"
+SLUG="${1:?Usage: $0 <slug> [objective] [--mode fresh|improve] [--server-cmd CMD] [--server-port PORT] [--server-health URL]}"
 MODE=""
 OBJECTIVE="TBD - fill in the objective"
+SERVER_CMD=""
+SERVER_PORT=""
+SERVER_HEALTH=""
 
-# Parse remaining arguments: --mode fresh|improve + optional positional objective
+# Parse remaining arguments
 shift
 while [[ $# -gt 0 ]]; do
   case "$1" in
@@ -27,6 +30,30 @@ while [[ $# -gt 0 ]]; do
       MODE="${1#--mode=}"
       shift
       ;;
+    --server-cmd)
+      SERVER_CMD="${2:?--server-cmd requires a command}"
+      shift 2
+      ;;
+    --server-cmd=*)
+      SERVER_CMD="${1#--server-cmd=}"
+      shift
+      ;;
+    --server-port)
+      SERVER_PORT="${2:?--server-port requires a port number}"
+      shift 2
+      ;;
+    --server-port=*)
+      SERVER_PORT="${1#--server-port=}"
+      shift
+      ;;
+    --server-health)
+      SERVER_HEALTH="${2:?--server-health requires a URL}"
+      shift 2
+      ;;
+    --server-health=*)
+      SERVER_HEALTH="${1#--server-health=}"
+      shift
+      ;;
     *)
       OBJECTIVE="$1"
       shift
@@ -176,10 +203,10 @@ print_run_presets() {
   echo "Available run commands (copy the one you want):"
   echo ""
   if [[ $codex_available -eq 1 ]]; then
-    echo "# Recommended: cross-engine + final-consensus (cost savings + blind-spot coverage):"
+    echo "# Recommended: cross-engine + final-consensus (full context + blind-spot coverage):"
     echo "/rlp-desk run $slug --worker-model gpt-5.4:high --final-consensus --debug"
     echo ""
-    echo "# Spark Pro preset (fast codex worker, lower cost):"
+    echo "# Small tasks only (single-file, AC <= 4, simple logic — spark 100k context limit):"
     echo "/rlp-desk run $slug --worker-model gpt-5.3-codex-spark:high --debug"
     echo ""
     echo "# Claude-only:"
@@ -295,6 +322,11 @@ Read these files in order:
 3. Test Spec: $DESK/plans/test-spec-$SLUG.md → verification methods
 4. Latest Context: $DESK/context/$SLUG-latest.md → current state
 
+## TDD MANDATE (hard constraint — violation = automatic FAIL)
+> Write failing tests FIRST → confirm RED (exit_code=1) → implement minimum code → confirm GREEN.
+> Every NEW AC requires: write_test → verify_red → implement → verify_green in execution_steps.
+> No exceptions. Verifier rejects missing RED evidence. For already-passing ACs, use verify_existing.
+
 ## SCOPE LOCK (hard constraint — violation causes verification failure)
 - You MUST only implement the work described in the "Next Iteration Contract" from campaign memory.
 - If the contract says "implement US-001 only", do ONLY that. Do NOT touch other stories.
@@ -303,28 +335,19 @@ Read these files in order:
 - No file creation or modification outside the project root.
 - Do not modify this prompt file or any PRD/test-spec files.
 
-## Test-First Approach (read test-spec BEFORE coding)
-1. Read test-spec "Impacted Tests" — if TODO (first iteration), skip to step 2 and fill this section during your work. Otherwise, run these FIRST to confirm they pass before your changes.
-2. Read test-spec "Required New Tests" — write these. They SHOULD FAIL initially.
-3. Implement minimum code to make all tests pass.
-4. Run ALL tests (impacted + new) to confirm nothing is broken.
-
 ## Forbidden Shortcuts (Verifier will check these)
 - Do not mock external services when L2 integration test is required by test-spec.
 - Do not delete or weaken existing assertions to make tests pass.
-- Do not add test-specific logic (code that detects it is running in a test).
 - Do not skip boundary cases listed in the PRD.
-- Do not claim "code inspection" as verification — run the actual command.
-- Do not say "too simple to test" — simple code breaks. Test takes 30 seconds.
-- Do not say "I'll test after" — tests passing immediately prove nothing.
-- Do not say "already manually tested" — ad-hoc is not systematic, no record.
-- Do not say "partial check is enough" — partial proves nothing about the whole.
-- Do not say "I'm confident" — confidence is not evidence.
-- Do not say "existing code has no tests" — you are improving it, add tests.
 - Do not write code before tests — if you did, delete it and start with tests.
 - **NEVER modify rlp-desk infrastructure files** (~/.claude/ralph-desk/*, ~/.claude/commands/rlp-desk.md). If you discover a bug in rlp-desk itself, report it in done-claim.json with {"status": "blocked", "reason": "rlp-desk bug: <description>"} and signal blocked. Do NOT attempt to fix rlp-desk — it is the orchestration tool, not your project code.
 - **NEVER modify Claude Code settings** (~/.claude/settings.json, .claude/settings.local.json, or any settings files). Do NOT add permissions, change models, or alter configuration. If a permission prompt blocks you, report it as blocked — do NOT try to edit settings to bypass it.
 
+## When Stuck (do NOT guess-and-fix)
+> 1. STOP and READ the error. Trace the call stack. Identify the root cause before touching code.
+> 2. Write a minimal test that reproduces the failure, then fix the root cause only.
+> 3. If 3+ fixes fail on the same issue, signal "blocked" with your diagnosis.
+
 ## Iteration rules
 - Use fresh context only; do NOT depend on prior chat history.
 - Execute exactly the work specified in the Next Iteration Contract.
@@ -378,6 +401,24 @@ execution_steps MUST be a JSON array of objects (not a dict with string keys). E
 ## Objective
 $OBJECTIVE
 EOF
+
+  # Inject operational context if server options provided
+  if [[ -n "$SERVER_CMD" || -n "$SERVER_PORT" ]]; then
+    cat >> "$F" <<OPCTX
+
+## Operational Context
+$([ -n "$SERVER_CMD" ] && echo "- **Server Start Command**: \`$SERVER_CMD\`")
+$([ -n "$SERVER_PORT" ] && echo "- **Server Port**: $SERVER_PORT")
+$([ -n "$SERVER_HEALTH" ] && echo "- **Health Check URL**: $SERVER_HEALTH")
+
+### Operational Rules (always apply when server context is present)
+- After modifying server/application code, restart the server$([ -n "$SERVER_CMD" ] && echo ": \`$SERVER_CMD\`")
+- Before signaling done, verify the server responds$([ -n "$SERVER_HEALTH" ] && echo ": \`curl -sf $SERVER_HEALTH\`" || [ -n "$SERVER_PORT" ] && echo ": \`curl -sf http://localhost:$SERVER_PORT/\`")
+- Do NOT modify dependency files (package.json, requirements.txt, etc.) unless the AC explicitly requires it
+- Do NOT run package install commands (npm install, pip install, etc.) unless the AC explicitly requires it
+OPCTX
+  fi
+
   echo "  + $F"
 else echo "  · $F"; fi
 
@@ -433,10 +474,11 @@ Check the iter-signal.json "us_id" field:
    - If your verdict history shows a 100% pass rate, re-examine your last verdict with increased scrutiny — a 100% pass rate is a red flag for insufficient rigor
    - When issuing PASS with explicit warning: note any concerning patterns (e.g., low test diversity, marginal coverage) even if technically passing
    - Never issue a silent PASS — every pass verdict must cite specific evidence for each AC checked
+   - Rationalization red flags: "tests pass so it works" (passing ≠ correct), "Worker is confident" (confidence ≠ evidence), "changes are minimal" (scope ≠ correctness)
 10½. **Worker Process Audit**:
    - Test-first compliance: done-claim execution_steps must show write_test step before implement step for each AC
    - RED phase evidence: at least one verify_red step with exit_code=1 per AC (proves tests were written before passing)
-   - Forbidden shortcuts: check done-claim claims and summary for forbidden phrases ("code inspection", "I'm confident", "too simple", "already manually tested", "partial check")
+   - Forbidden shortcuts: check done-claim claims and summary for forbidden phrases ("code inspection", "I'm confident", "too simple", "I'll test after", "already manually tested", "partial check")
    - Step completeness: each AC should have write_test → verify_red → implement → verify_green sequence in execution_steps
 11. **Reproducibility check**: verify lock file committed, clean install succeeds, security scan passes, env vars documented (per test-spec Reproducibility Gate). Skip if test-spec says "N/A."
 12. Write verdict JSON to: $DESK/memos/$SLUG-verify-verdict.json
@@ -447,6 +489,7 @@ Verdict JSON:
   "us_id": "US-NNN or ALL (matches the scope you verified)",
   "verified_at_utc": "ISO timestamp",
   "summary": "...",
+  "per_us_results": {"US-001": "pass|fail|not_started", "US-002": "pass|fail|not_started"},
   "criteria_results": [{"criterion":"...","met":true/false,"evidence":"..."}],
   "missing_evidence": [],
   "issues": [{"id":"...","severity":"critical|major|minor","description":"...","fix_hint":"(suggestion, non-authoritative)"}],
@@ -471,7 +514,20 @@ Rules:
 - Deterministic checks (type hints, linting, security) delegate to test-spec tools; focus on AC verification + semantic review + smoke test.
 - Do NOT modify code or write sentinel files.
 - If Worker claims "inspection" or "review" for an AC that requires an automated command, verdict = FAIL.
+- **ALWAYS include per_us_results** in verdict JSON — map each US to "pass", "fail", or "not_started". This is required for partial progress tracking in both batch and per-us modes.
 EOF
+
+  # Inject operational verification if server options provided
+  if [[ -n "$SERVER_CMD" || -n "$SERVER_PORT" ]]; then
+    cat >> "$F" <<OPVER
+
+## Operational Verification (server context present)
+- Before verifying ACs, check that the server is running$([ -n "$SERVER_PORT" ] && echo " on port $SERVER_PORT")$([ -n "$SERVER_HEALTH" ] && echo ": \`curl -sf $SERVER_HEALTH\`")
+- If the server is not running, verdict = FAIL with issue: "server not running on expected port"
+- If Worker modified server code but did not restart the server, verdict = FAIL with issue: "server not restarted after code change"
+OPVER
+  fi
+
   echo "  + $F"
 else echo "  · $F"; fi
 

package/src/scripts/lib_ralph_desk.zsh

@@ -29,9 +29,36 @@ log_error() {
   echo "[$(date '+%Y-%m-%d %H:%M:%S')] ERROR: $*" >&2
 }
 
+# build_claude_cmd() — centralized claude CLI command builder
+# Single source of truth for all claude invocation flags (--no-mcp, DISABLE_OMC, etc.)
+# Inspired by codex-plugin-cc companion pattern: CLI abstraction in one place.
+# Args: $1=mode (tui|print)  $2=model  $3=prompt_file (print mode only)  $4=output_log (print mode only)
+# Output: complete command string on stdout
+# Globals read: CLAUDE_BIN
+build_claude_cmd() {
+  local mode="$1"
+  local model="$2"
+  local prompt_file="${3:-}"
+  local output_log="${4:-}"
+
+  local base="DISABLE_OMC=1 $CLAUDE_BIN --model $model --no-mcp --dangerously-skip-permissions"
+  case "$mode" in
+    tui)
+      echo "$base"
+      ;;
+    print)
+      echo "$base -p \"\$(cat $prompt_file)\" --output-format text 2>&1 | tee $output_log"
+      ;;
+    *)
+      echo "ERROR: build_claude_cmd unknown mode '$mode'" >&2
+      return 1
+      ;;
+  esac
+}
+
 # parse_model_flag() — parse unified --worker-model / --verifier-model value
 # Colon format (model:reasoning) → codex engine; plain name → claude engine.
-# Spark alias: any model name containing "spark" is normalized to "spark".
+# Spark alias: bare "spark" is expanded to full model ID "gpt-5.3-codex-spark".
 # Usage:  parse_model_flag <value> <role>
 # Output (stdout): "engine model [reasoning]"  e.g. "codex gpt-5.4 medium" | "claude sonnet"
 # Returns: 0 on success, 1 on invalid format (error written to stderr)
@@ -47,8 +74,8 @@ parse_model_flag() {
   if (( colon_count == 1 )); then
     local model="${value%%:*}"
     local reasoning="${value##*:}"
-    if [[ "$model" == *"spark"* ]]; then
-      model="spark"
+    if [[ "$model" == "spark" ]]; then
+      model="gpt-5.3-codex-spark"
     fi
     echo "codex $model $reasoning"
   else
@@ -76,7 +103,7 @@ get_model_string() {
 # get_next_model() — return next model in Worker upgrade path, or empty at ceiling
 # Usage: get_next_model <model_str>
 #   claude: "haiku"|"sonnet"|"opus"
-#   codex:  "gpt-5.4:medium"|"gpt-5.4:high"|"gpt-5.4:xhigh"|"spark:medium"|...
+#   codex:  "gpt-5.4:medium"|"gpt-5.4:high"|"gpt-5.4:xhigh"|"gpt-5.3-codex-spark:medium"|...
 # Output: next model string, or empty string if at ceiling
 get_next_model() {
   local current="$1"
@@ -85,16 +112,11 @@ get_next_model() {
     haiku)          echo "sonnet"         ;;
     sonnet)         echo "opus"           ;;
     opus)           echo ""               ;;
-    # Codex GPT Pro upgrade path (short aliases)
-    spark:low)      echo "spark:medium"   ;;
-    spark:medium)   echo "spark:high"     ;;
-    spark:high)     echo "spark:xhigh"    ;;
-    spark:xhigh)    echo ""               ;;  # spark ceiling
-    # Codex GPT Pro upgrade path (full model names)
+    # Codex GPT Pro (spark) upgrade path
     gpt-5.3-codex-spark:low)    echo "gpt-5.3-codex-spark:medium" ;;
     gpt-5.3-codex-spark:medium) echo "gpt-5.3-codex-spark:high"   ;;
     gpt-5.3-codex-spark:high)   echo "gpt-5.3-codex-spark:xhigh"  ;;
-    gpt-5.3-codex-spark:xhigh)  echo ""                           ;;  # spark ceiling (full name)
+    gpt-5.3-codex-spark:xhigh)  echo ""                           ;;  # spark ceiling
     # Codex Non-Pro upgrade path
     gpt-5.4:low)    echo "gpt-5.4:medium" ;;
     gpt-5.4:medium) echo "gpt-5.4:high"   ;;

package/src/scripts/run_ralph_desk.zsh

@@ -66,7 +66,7 @@ _auto_detect_engine() {
   if [[ "$model_val" == *:* ]]; then
     local model_part="${model_val%%:*}"
     local reasoning_part="${model_val##*:}"
-    [[ "$model_part" == *spark* ]] && model_part="spark"
+    [[ "$model_part" == "spark" ]] && model_part="gpt-5.3-codex-spark"
     eval "$engine_var=codex"
     eval "$model_var=$model_part"
     [[ -n "$codex_model_var" ]] && eval "$codex_model_var=$model_part"
@@ -211,19 +211,55 @@ check_dead_pane() {
   return 1  # alive
 }
 
-# launch_worker_codex() — launch codex Worker via trigger script (non-interactive exec)
-# Args: $1=pane_id  $2=trigger_file  $3=iteration
-# Returns: 0 always (codex failures detected by poll_for_signal)
+# launch_worker_codex() — launch codex Worker TUI, send instruction, verify submission
+# Matches launch_worker_claude() pattern for consistent tmux-visible execution.
+# Args: $1=pane_id  $2=prompt_file  $3=iteration  $4=worker_launch_cmd
+# Returns: 0 on success, 1 on fatal failure
 launch_worker_codex() {
   local pane_id="$1"
-  local trigger_file="$2"
+  local prompt_file="$2"
   local iter="$3"
+  local worker_launch="$4"
+
+  log "  Launching Worker codex TUI in pane $pane_id..."
+  paste_to_pane "$pane_id" "$worker_launch"
+  tmux send-keys -t "$pane_id" C-m
+
+  # Wait for codex TUI to be ready
+  if ! wait_for_pane_ready "$pane_id" 30; then
+    log_error "Worker codex failed to start"
+    return 1
+  fi
 
-  log "  Launching Worker codex via trigger script in pane $pane_id..."
-  paste_to_pane "$pane_id" "bash $trigger_file"
+  # Send instruction to codex TUI
+  sleep 3
+  local worker_instruction="Read and execute the instructions in $prompt_file"
+  paste_to_pane "$pane_id" "$worker_instruction"
   tmux send-keys -t "$pane_id" C-m
-  log_debug "Worker codex trigger sent: $trigger_file"
-  sleep 3  # brief wait for codex to start
+  log_debug "Worker codex instruction sent (${#worker_instruction} chars)"
+
+  # Submit loop — verify codex started working
+  local submit_attempts=0
+  while (( submit_attempts < 15 )); do
+    sleep 2
+    local pane_check
+    pane_check=$(tmux capture-pane -t "$pane_id" -p 2>/dev/null)
+    if echo "$pane_check" | grep -qi "working\|thinking\|Exploring\|Running\|reading\|searching\|editing\|writing" 2>/dev/null; then
+      log_debug "Worker codex started working after $((submit_attempts + 1)) checks"
+      break
+    fi
+    if (( submit_attempts == 8 )); then
+      log_debug "Adaptive instruction retry: clearing line and re-typing"
+      tmux send-keys -t "$pane_id" C-u 2>/dev/null
+      sleep 0.1
+      paste_to_pane "$pane_id" "$worker_instruction"
+      tmux send-keys -t "$pane_id" C-m
+    fi
+    tmux send-keys -t "$pane_id" C-m 2>/dev/null
+    sleep 0.3
+    tmux send-keys -t "$pane_id" C-m 2>/dev/null
+    (( submit_attempts++ ))
+  done
   return 0
 }
 
@@ -308,19 +344,53 @@ launch_worker_claude() {
   return 0
 }
 
-# launch_verifier_codex() — launch codex Verifier in pane (non-interactive)
+# launch_verifier_codex() — launch codex Verifier TUI, send instruction, verify submission
+# Matches launch_verifier_claude() pattern for consistent tmux-visible execution.
 # Args: $1=pane_id  $2=prompt_file  $3=iteration  $4=launch_cmd
-# Returns: 0 always
+# Returns: 0 on success
 launch_verifier_codex() {
   local pane_id="$1"
   local prompt_file="$2"
   local iter="$3"
   local verifier_launch="$4"
 
-  log "  Launching Verifier codex in pane $pane_id..."
+  log "  Launching Verifier codex TUI in pane $pane_id..."
   paste_to_pane "$pane_id" "$verifier_launch"
   tmux send-keys -t "$pane_id" C-m
+
+  if ! wait_for_pane_ready "$pane_id" 30; then
+    log_error "Verifier codex failed to start"
+    return 1
+  fi
+
   sleep 3
+  local verifier_instruction="Read and execute the instructions in $prompt_file"
+  paste_to_pane "$pane_id" "$verifier_instruction"
+  tmux send-keys -t "$pane_id" C-m
+  log_debug "Verifier codex instruction sent"
+
+  # Submit loop — verify codex started working
+  local submit_attempts=0
+  while (( submit_attempts < 15 )); do
+    sleep 2
+    local vs_check
+    vs_check=$(tmux capture-pane -t "$pane_id" -p 2>/dev/null)
+    if echo "$vs_check" | grep -qi "working\|thinking\|Exploring\|Running\|reading\|searching\|editing\|writing" 2>/dev/null; then
+      log_debug "Verifier codex started working after $((submit_attempts + 1)) checks"
+      break
+    fi
+    if (( submit_attempts == 8 )); then
+      log_debug "Adaptive instruction retry: clearing line and re-typing"
+      tmux send-keys -t "$pane_id" C-u 2>/dev/null
+      sleep 0.1
+      paste_to_pane "$pane_id" "$verifier_instruction"
+      tmux send-keys -t "$pane_id" C-m
+    fi
+    tmux send-keys -t "$pane_id" C-m 2>/dev/null
+    sleep 0.3
+    tmux send-keys -t "$pane_id" C-m 2>/dev/null
+    (( submit_attempts++ ))
+  done
   return 0
 }
 
@@ -386,7 +456,7 @@ handle_worker_exit_codex() {
     local dc_us_id
     dc_us_id=$(jq -r '.us_id // "unknown"' "$DONE_CLAIM_FILE" 2>/dev/null)
     log "  Codex worker completed with done-claim (us_id=$dc_us_id). Auto-generating signal."
-    echo '{"iteration":'"$iter"',"status":"verify","us_id":"'"$dc_us_id"'","summary":"auto-generated after codex exec exit","timestamp":"'"$(date -u +%Y-%m-%dT%H:%M:%SZ)"'"}' > "$signal_file"
+    echo '{"iteration":'"$iter"',"status":"verify","us_id":"'"$dc_us_id"'","summary":"auto-generated after codex exit","timestamp":"'"$(date -u +%Y-%m-%dT%H:%M:%SZ)"'"}' > "$signal_file"
   else
     log "  WARNING: Codex worker exited without done-claim. Generating verify signal for current US."
     local current_us
@@ -394,7 +464,7 @@ handle_worker_exit_codex() {
     local mem_us
     mem_us=$(sed -n 's/.*Next.*US-\([0-9]*\).*/US-\1/p' "$DESK/memos/${SLUG}-memory.md" 2>/dev/null | head -1)
     [[ -n "$mem_us" ]] && current_us="$mem_us"
-    echo '{"iteration":'"$iter"',"status":"verify","us_id":"'"$current_us"'","summary":"auto-generated after codex exec exit (no done-claim)","timestamp":"'"$(date -u +%Y-%m-%dT%H:%M:%SZ)"'"}' > "$signal_file"
+    echo '{"iteration":'"$iter"',"status":"verify","us_id":"'"$current_us"'","summary":"auto-generated after codex exit (no done-claim)","timestamp":"'"$(date -u +%Y-%m-%dT%H:%M:%SZ)"'"}' > "$signal_file"
   fi
   return 0
 }
@@ -952,7 +1022,7 @@ restart_worker() {
   if [[ "$WORKER_ENGINE" = "codex" ]]; then
     safe_send_keys "$pane_id" "${CODEX_BIN:-codex} -m $WORKER_CODEX_MODEL -c model_reasoning_effort=\"$WORKER_CODEX_REASONING\" --dangerously-bypass-approvals-and-sandbox"
   else
-    safe_send_keys "$pane_id" "$CLAUDE_BIN --model $WORKER_MODEL --dangerously-skip-permissions"
+    safe_send_keys "$pane_id" "$(build_claude_cmd tui "$WORKER_MODEL")"
   fi
   WORKER_RESTARTS[$iter]=$((restart_count + 1))
   return 0
@@ -1068,30 +1138,35 @@ write_worker_trigger() {
     elif [[ "$VERIFY_MODE" = "batch" ]]; then
       echo ""
       echo "---"
-      echo "## BATCH MODE OVERRIDE"
-      echo "Ignore any per-US signal instructions above. In batch mode:"
-      echo "- Implement ALL user stories in this iteration"
-      echo '- Signal verify with us_id="ALL" only when ALL stories are complete'
-      echo "- Do NOT signal verify after individual stories"
+      if [[ -n "$VERIFIED_US" ]]; then
+        echo "## BATCH MODE — CONTINUE FROM PARTIAL PROGRESS"
+        echo "The following US have already been verified: **$VERIFIED_US**"
+        echo "- Do NOT re-implement these — they are done."
+        echo "- Focus ONLY on the remaining unverified user stories."
+        echo '- Signal verify with us_id="ALL" when the remaining stories are complete.'
+      else
+        echo "## BATCH MODE OVERRIDE"
+        echo "Ignore any per-US signal instructions above. In batch mode:"
+        echo "- Implement ALL user stories in this iteration"
+        echo '- Signal verify with us_id="ALL" only when ALL stories are complete'
+        echo "- Do NOT signal verify after individual stories"
+      fi
     fi
   } | atomic_write "$prompt_file"
 
   # Write trigger script (DO NOT use exec -- breaks heartbeat cleanup)
   # Engine-specific launch command (expanded at write time)
   if [[ "$WORKER_ENGINE" = "codex" ]]; then
-    local engine_cmd="${CODEX_BIN:-codex} exec \\
+    local engine_cmd="${CODEX_BIN:-codex} \\
   -m $WORKER_CODEX_MODEL \\
   -c model_reasoning_effort=\"$WORKER_CODEX_REASONING\" \\
   --dangerously-bypass-approvals-and-sandbox \\
   \"\$(cat $prompt_file)\""
-    local engine_comment="# Run codex exec with fresh context (no pipe — codex requires terminal)"
+    local engine_comment="# Run codex with fresh context (fallback trigger — TUI primary launch via launch_worker_codex)"
   else
-    local engine_cmd="$CLAUDE_BIN -p \"\$(cat $prompt_file)\" \\
-  --model $WORKER_MODEL \\
-  --dangerously-skip-permissions \\
-  --output-format text \\
-  2>&1 | tee $output_log"
-    local engine_comment="# Run claude with fresh context (governance.md s7 step 5)"
+    local engine_cmd
+    engine_cmd=$(build_claude_cmd print "$WORKER_MODEL" "$prompt_file" "$output_log")
+    local engine_comment="# Run claude with fresh context, no MCP/skills (governance.md s7 step 5)"
   fi
 
   {
@@ -1152,13 +1227,15 @@ write_verifier_trigger() {
     echo "- **Iteration**: $iter"
     echo "- **Done Claim**: $DONE_CLAIM_FILE"
     echo "- **Verify Mode**: $VERIFY_MODE"
-    if [[ "$VERIFY_MODE" = "per-us" && -n "$us_id" ]]; then
+    if [[ -n "$us_id" ]]; then
       if [[ "$us_id" = "ALL" ]]; then
-        echo "- **Scope**: FINAL FULL VERIFY — check ALL acceptance criteria from the PRD"
-        echo "- **Previously verified US**: $VERIFIED_US"
+        echo "- **Scope**: FULL VERIFY — check ALL acceptance criteria from the PRD"
       else
         echo "- **Scope**: Verify ONLY the acceptance criteria for **${us_id}**"
+      fi
+      if [[ -n "$VERIFIED_US" ]]; then
         echo "- **Previously verified US**: $VERIFIED_US"
+        echo "- **Note**: Skip re-verifying the above US. Focus on unverified stories."
       fi
     fi
   } | atomic_write "$prompt_file"
@@ -1173,12 +1250,9 @@ write_verifier_trigger() {
   2>&1 | tee $output_log"
     local engine_comment="# Run codex with fresh context (governance.md s7 step 7)"
   else
-    local engine_cmd="$CLAUDE_BIN -p \"\$(cat $prompt_file)\" \\
-  --model $verifier_model \\
-  --dangerously-skip-permissions \\
-  --output-format text \\
-  2>&1 | tee $output_log"
-    local engine_comment="# Run claude with fresh context (governance.md s7 step 7)"
+    local engine_cmd
+    engine_cmd=$(build_claude_cmd print "$verifier_model" "$prompt_file" "$output_log")
+    local engine_comment="# Run claude with fresh context, no MCP/skills (governance.md s7 step 7)"
   fi
 
   {
@@ -1577,11 +1651,11 @@ run_single_verifier() {
   # Launch verifier — dispatch to engine-specific function
   local verifier_launch
   if [[ "$engine" = "codex" ]]; then
-    verifier_launch="${CODEX_BIN:-codex} exec \"\$(cat $prompt_file)\" -m $VERIFIER_CODEX_MODEL -c model_reasoning_effort=\"$VERIFIER_CODEX_REASONING\" --dangerously-bypass-approvals-and-sandbox"
+    verifier_launch="${CODEX_BIN:-codex} -m $VERIFIER_CODEX_MODEL -c model_reasoning_effort=\"$VERIFIER_CODEX_REASONING\" --dangerously-bypass-approvals-and-sandbox"
     launch_verifier_codex "$VERIFIER_PANE" "$prompt_file" "$iter" "$verifier_launch"
-    log_debug "Verifier$suffix codex exec dispatched"
+    log_debug "Verifier$suffix codex TUI dispatched"
   else
-    verifier_launch="$CLAUDE_BIN --model $model --dangerously-skip-permissions"
+    verifier_launch="$(build_claude_cmd tui "$model")"
     if ! launch_verifier_claude "$VERIFIER_PANE" "$prompt_file" "$iter" "$verifier_launch"; then
       log_error "Verifier$suffix failed to start"
       return 1
@@ -1592,7 +1666,7 @@ run_single_verifier() {
   # Poll for verdict
   if [[ "$engine" = "codex" ]]; then
     # Codex exec: simple file poll (non-interactive, no heartbeat/nudge needed)
-    log "  Polling for verify-verdict.json ($suffix, codex exec)..."
+    log "  Polling for verify-verdict.json ($suffix, codex TUI)..."
     local codex_poll_start
     codex_poll_start=$(date +%s)
     while true; do
@@ -1666,7 +1740,7 @@ run_sequential_final_verify() {
       verifier_launch="${CODEX_BIN:-codex} -m $VERIFIER_CODEX_MODEL -c model_reasoning_effort=\"$VERIFIER_CODEX_REASONING\" --dangerously-bypass-approvals-and-sandbox"
       launch_verifier_codex "$VERIFIER_PANE" "$verifier_prompt" "$iter" "$verifier_launch"
     else
-      verifier_launch="$CLAUDE_BIN --model $VERIFIER_MODEL --dangerously-skip-permissions"
+      verifier_launch="$(build_claude_cmd tui "$VERIFIER_MODEL")"
       launch_verifier_claude "$VERIFIER_PANE" "$verifier_prompt" "$iter" "$verifier_launch" || {
         log_error "Failed to launch verifier for $us"
         FAILED_US="$us"
@@ -1936,7 +2010,7 @@ main() {
     --arg verifier_model "$VERIFIER_MODEL" \
     --argjson debug "$DEBUG" \
     --argjson with_sv "$WITH_SELF_VERIFICATION" \
-    --argjson consensus "$VERIFY_CONSENSUS" \
+    --argjson consensus "${VERIFY_CONSENSUS:-0}" \
     '{slug: $slug, project_root: $project_root, project_name: $project_name, campaign_status: $campaign_status, start_time: $start_time, end_time: $end_time, worker_model: $worker_model, verifier_model: $verifier_model, debug: $debug, with_self_verification: $with_sv, consensus: $consensus}' \
     > "$METADATA_FILE"
 
@@ -1980,7 +2054,7 @@ main() {
       log_debug "[OPTION] expected_flow=worker(all)->verify(ALL)->COMPLETE"
     fi
 
-    if [[ "$VERIFY_CONSENSUS" = "1" ]]; then
+    if [[ "${VERIFY_CONSENSUS:-0}" = "1" ]]; then
       log_debug "[OPTION] consensus_flow=each_verify_runs_claude+codex_both_must_pass"
     fi
   fi
@@ -2104,11 +2178,14 @@ main() {
 
     local worker_launch
     if [[ "$WORKER_ENGINE" = "codex" ]]; then
-      local worker_trigger="$LOGS_DIR/iter-$(printf '%03d' $ITERATION).worker-trigger.sh"
-      worker_launch="bash $worker_trigger"
-      launch_worker_codex "$WORKER_PANE" "$worker_trigger" "$ITERATION"
+      worker_launch="${CODEX_BIN:-codex} -m $WORKER_CODEX_MODEL -c model_reasoning_effort=\"$WORKER_CODEX_REASONING\" --dangerously-bypass-approvals-and-sandbox"
+      if ! launch_worker_codex "$WORKER_PANE" "$worker_prompt" "$ITERATION" "$worker_launch"; then
+        write_blocked_sentinel "Worker codex failed to start in pane"
+        update_status "blocked" "worker_start_failed"
+        return 1
+      fi
     else
-      worker_launch="$CLAUDE_BIN --model $WORKER_MODEL --dangerously-skip-permissions"
+      worker_launch="$(build_claude_cmd tui "$WORKER_MODEL")"
       if ! launch_worker_claude "$WORKER_PANE" "$worker_prompt" "$ITERATION" "$worker_launch"; then
         write_blocked_sentinel "Worker claude failed to start in pane"
         update_status "blocked" "worker_start_failed"
@@ -2285,7 +2362,7 @@ main() {
           if [[ "$VERIFIER_ENGINE" = "codex" ]]; then
             verifier_launch="${CODEX_BIN:-codex} -m $VERIFIER_CODEX_MODEL -c model_reasoning_effort=\"$VERIFIER_CODEX_REASONING\" --dangerously-bypass-approvals-and-sandbox"
           else
-            verifier_launch="$CLAUDE_BIN --model $VERIFIER_MODEL --dangerously-skip-permissions"
+            verifier_launch="$(build_claude_cmd tui "$VERIFIER_MODEL")"
           fi
           log_debug "[FLOW] iter=$ITERATION phase=verifier engine=$VERIFIER_ENGINE model=$VERIFIER_MODEL scope=${signal_us_id:-all} dispatched=true"
 
@@ -2346,8 +2423,8 @@ main() {
               _MODEL_UPGRADED=0
             fi
 
-            # --- Per-US tracking ---
-            if [[ "$VERIFY_MODE" = "per-us" && -n "$signal_us_id" && "$signal_us_id" != "ALL" ]]; then
+            # --- Verified US tracking (both per-us and batch modes) ---
+            if [[ -n "$signal_us_id" && "$signal_us_id" != "ALL" ]]; then
               # Add this US to verified list
               if [[ -n "$VERIFIED_US" ]]; then
                 VERIFIED_US="${VERIFIED_US},${signal_us_id}"
@@ -2371,6 +2448,32 @@ main() {
             ;;
           fail)
             # --- governance.md s7½: Fix Loop (adapted for tmux lean mode) ---
+
+            # Parse per_us_results from verdict to track partial progress (batch + per-us)
+            local _prev_verified="$VERIFIED_US"
+            if jq -e '.per_us_results' "$VERDICT_FILE" &>/dev/null; then
+              local _newly_passed
+              _newly_passed=$(jq -r '.per_us_results | to_entries[] | select(.value == "pass") | .key' "$VERDICT_FILE" 2>/dev/null)
+              for _pus in $(echo "$_newly_passed"); do
+                if ! echo ",$VERIFIED_US," | grep -q ",$_pus,"; then
+                  if [[ -n "$VERIFIED_US" ]]; then
+                    VERIFIED_US="${VERIFIED_US},${_pus}"
+                  else
+                    VERIFIED_US="$_pus"
+                  fi
+                  log "  Partial progress: $_pus passed (overall FAIL). Verified so far: $VERIFIED_US"
+                fi
+              done
+              log_debug "[FLOW] iter=$ITERATION partial_progress prev=$_prev_verified now=$VERIFIED_US"
+            fi
+
+            # Partial progress resets consecutive failures (progress was made)
+            if [[ "$VERIFIED_US" != "$_prev_verified" ]]; then
+              CONSECUTIVE_FAILURES=0
+              log "  Progress detected — consecutive_failures reset to 0"
+              log_debug "[GOV] iter=$ITERATION consecutive_failures_reset=partial_progress"
+            fi
+
             (( CONSECUTIVE_FAILURES++ ))
             record_us_failure "${signal_us_id:-unknown}"
             check_model_upgrade "${signal_us_id:-unknown}"
@@ -2389,6 +2492,13 @@ main() {
             {
               echo "# Fix Contract (from Verifier iteration $ITERATION)"
               echo ""
+              if [[ -n "$VERIFIED_US" ]]; then
+                echo "## Verified US (do NOT re-implement these)"
+                echo "$VERIFIED_US" | tr ',' '\n' | sed 's/^/- /'
+                echo ""
+                echo "**Focus ONLY on unverified user stories. The above are already verified.**"
+                echo ""
+              fi
               echo "## Summary"
               echo "$verdict_summary_fail"
               echo ""