@dzhechkov/harness-cli 0.3.236 → 0.3.237

package/.dz-manifest.json

@@ -9,15 +9,15 @@
       },
       {
         "path": "README.md",
-        "sha256": "1e36d7e9e6022d412c030975ec686b1ab91c61c64c807ef2e9ff3fa75ac8917c"
+        "sha256": "7e8b772a6fa9ca0f36364cafd5ea996abeb62dc894c2f67f50ea7704a7a8824d"
       },
       {
         "path": "coverage/coverage-final.json",
-        "sha256": "1abb00d07ab57ad413d2747baa6a68cda0876a9e0c6f75db89c205fbf4863530"
+        "sha256": "667bf610bf890a7b93480a4b1045e98dc0c765effd80b78fde4e48538f595b3e"
       },
       {
         "path": "coverage/coverage-summary.json",
-        "sha256": "42d2a98f54c2ec773b49a0a43c959a78d070c8c427724f4affbd5bafef35621d"
+        "sha256": "593705e81f851c0e65ffa9feaa9bbd396e7a3295b9b21076cfd953ee5a05b93a"
       },
       {
         "path": "dist/bin.d.ts",
@@ -41,15 +41,15 @@
       },
       {
         "path": "dist/cli.d.ts.map",
-        "sha256": "8a00bf14c3fdd437b7e482da8c4018366041755714ed1791b1c523f9dee5de6c"
+        "sha256": "cf6a3265890a8856ef31e3e7ac58026c15232c3c118ba0fcd1ce0d7590b84dd8"
       },
       {
         "path": "dist/cli.js",
-        "sha256": "dea4446db1109285c1fc5f5283d7263462cb446f12b0d9b1e1e821374d0ca57d"
+        "sha256": "b9af9be1bd31acd60e76275ff1055dd8e9b39b531b0c375467648f142b74d2c4"
       },
       {
         "path": "dist/cli.js.map",
-        "sha256": "a253625c94835ef94bbd141b1dd759578433423bd098314fd977c515f140dafe"
+        "sha256": "6a51963ede51129e43524d62f3d757255a002dfec3df2c1dfa519af6f235a667"
       },
       {
         "path": "dist/index.d.ts",
@@ -73,7 +73,7 @@
       },
       {
         "path": "package.json",
-        "sha256": "543319797d47d599a646c7d695f82aa31491ffd97579edd691b6a9cb99af76ef"
+        "sha256": "1e7ef1d6e0796144999ad64d3650aeb4a2ccc7dfc66c5c5a8b705d783a9d0801"
       },
       {
         "path": "src/bin.ts",
@@ -81,7 +81,7 @@
       },
       {
         "path": "src/cli.ts",
-        "sha256": "c5d4902f9b0c4133318b15e757d07856872177dc92752d5996440524342b7f88"
+        "sha256": "5180330ac6612542c80a74ea8e0983f5cd231e95bb3962eccdd65fbdbf6611a8"
       },
       {
         "path": "src/index.ts",
@@ -89,7 +89,7 @@
       },
       {
         "path": "test/cli.test.ts",
-        "sha256": "0538f3cfd8eb880305c08fef05a78601263003c54a6f1b44f97cd7ebd7bd37f9"
+        "sha256": "461beed08ad6cfde7bbf559701fcbc6978f622c3951c80463c4e4943c538eff5"
       },
       {
         "path": "tsconfig.json",
@@ -101,5 +101,5 @@
       }
     ]
   },
-  "signature": "0IDcNO+8RqyABrL7YXlDBQLCTiNktCk/Ktd724vSyxsJ0/rti05jjEudABZo3+ILMok7jLgQs/YRalC77RdOCA=="
+  "signature": "06gdM99WpJhmarOtUFoeMAlGAfAvCboh/QGbCEIBhMAqgLn5rnSCXAb2023QdO+hZsuxrijyGzgBh62l/L+GBQ=="
 }

package/README.md

@@ -392,13 +392,54 @@ Example (real output, trimmed):
 dz parity — codex  (capabilities: shell, skills, mcp)
   ✓ dz CLI (all commands)                    via shell command
   ◐ feature-adr pipeline                     via interactive skill (plain /feature-adr)
-  — Step-10 Delivery Gate                    not available on this target
+  ◐ Step-10 Delivery Gate                    via dz delivery-check (CLI 4-plane hand-off protocol)
   ◐ Integrity claim-check                    via dz claim-check (CLI) + publish gate
 ```
 
 **When to use:** before promising a workflow to a teammate on Cursor/Codex/Hermes; when choosing
 a target for a project; as the requirements input for porting a feature to more targets.
 
+### Portable delivery gate — `dz delivery-check` (Step-10, on every shell target)
+
+The feature-adr Step-10 Delivery Gate reviews a landed feature across four orthogonal planes and
+emits a machine-checkable `ready | blocked` hand-off. On Claude-Code the ultracode workflow can run
+it as the **opt-in** Step-10 (`args.deliveryGate: true` — off by default); `dz delivery-check` is
+the **portable `manual` form** that travels to every shell
+target (Cursor/Codex/Gemini/…). The CLI runs the deterministic parts (artifact probes, fail-closed
+hand-off arithmetic, cross-validation bookkeeping) and **dispatches** the semantic review to the
+target's own agent runtime — the `dz challenge` cartridge shape. It never posts anything anywhere
+(findings-only).
+
+```bash
+dz delivery-check --slug my-feature --context-only          # print artifact probes + the 4-plane review brief
+dz delivery-check --slug my-feature --findings review.json  # classify a fed-back review → writes 10_delivery_review.md, prints ready|blocked
+dz delivery-check --slug my-feature --findings review.json --strict --json   # CI gate: exit 1 on blocked, machine-readable result
+```
+
+Example (trimmed):
+
+```
+dz delivery-check — my-feature: blocked
+  ✓ 0 BLOCKER: PASS
+  ✗ 0 HIGH: FAIL — 1 confirmed HIGH
+  ✓ planes complete: PASS
+  ✓ BLOCKER/HIGH cross-validated: PASS
+  ✓ required artifacts present: PASS
+↳ wrote features/my-feature/10_delivery_review.md
+```
+
+`ready` only off complete, cross-validated, clean evidence: a null/partial plane, a failed required
+probe (the `07_code_changes/` manifest), a confirmed BLOCKER/HIGH, or an **un-cross-validated**
+BLOCKER/HIGH (`cross-validation-incomplete`) all yield `blocked`. Classification reads only numeric
+severity counts, so instruction-like text inside a finding cannot move the verdict.
+
+**When to use:** as the final quality hand-off for a landed feature on any non-Claude-Code target;
+as a CI gate (`--strict`) that fails a merge on an unresolved BLOCKER/HIGH.
+
+For AGENTS.md-class targets, `dz feature-adr-setup --gates [--target <name>] --apply` emits a
+zero-config `architecture/gates/delivery-check.md` whose runnable-here gate list is computed from
+`dz parity` for that target (create-if-absent, never clobbered).
+
 ### Verified release — `dz release` (4 HARD gates in front of `dz publish`)
 
 `dz publish` gates on guard / claim-check / signatures / provenance / files-whitelist — none of which
@@ -508,7 +549,7 @@ Get the whole set with `dz init --target claude-code --preset meta`, or pick one
 
 > **A skill and its npx toolkit are not duplicates — they're a graduation.** Several skills (e.g. `feature-adr`, `design-thinking`) exist BOTH as a skill inside a `dz` preset AND as a standalone `npx` package. The preset's SKILL.md is **fully functional on its own** (the whole methodology — modules + references — travels with it, and it auto-activates by description), and it's the only way to compile that capability to the **non-Claude platforms** (Codex/OpenCode/Hermes/OpenClaude) via `dz`. The npx package adds **project-level runtime governance** around the same skill: a slash command, governance rules, a context shard, and (for feature-adr) reward-learning + `/harvest`. So: pick the **skill/preset** for a working capability across platforms; pick the **npx toolkit** when you want it as a governed, command-driven fixture of one project.
 
-## All Commands (56)
+## All Commands (57)
 
 ```
 dz setup             --target <name> [--preset <name>] [--select id,id,...] [--skills-dir <dir>] [--memory agentdb] [--no-memory] [--no-hooks] [--install-driver] [--force]
@@ -563,6 +604,7 @@ dz challenge --plan <plan.md> [--json] [--context-only] [--author <model>]   # a
 dz routing [--stage <s>] [--json]   # inspect the learned cost-optimal routing store: what `args.models.<stage>='auto-cost'` believes per (stage, complexity-tier, model) — gated attempts/successes/rate (feeds feature-adr model selection)
 dz bto-optimize --split|--plan|--select|--scope-check|--diff [--json]   # deterministic engine behind /bto-optimize: hold-out split + hard-capped budget + no-regress-on-holdout winner selection (defeats judge-gaming); prose-only, diff-confirmed, never auto-writes
 dz discrimination-check --test <f[,f]> [--base <ref>] [--name <filter>] [--runner <cmd>] [--json]   # §42 test-discrimination gate for feature-adr Step-8: run the ADR's property test in an isolated git worktree at pre-feature base — it MUST go red without the fix; a green is a false green (HIGH finding, advisory, never auto-aborts)
+dz delivery-check --slug <slug> [--context-only] [--findings <f.json>] [--strict] [--author <model>] [--json]   # portable Step-10 Delivery Gate: the `manual` form that travels to every shell target — prints the 4-plane review brief (regressions ‖ security ‖ code-quality ‖ product-honesty) + artifact probes; --findings classifies a fed-back review into a fail-closed ready|blocked hand-off (only cross-validated BLOCKER/HIGH count) and writes features/<slug>/10_delivery_review.md; --strict exits 1 on blocked
 dz sign --init --out <path>  |  --pack <dir> --key <path>   # --init: generate the Ed25519 keypair (private OUTSIDE the repo, prints the public key for keys/dz.pub); else sign a pack's manifest + CycloneDX SBOM
 dz sbom --pack <dir> [--out <file>]   # emit the CycloneDX 1.5 SBOM for a pack standalone (file-level bill of materials); print to stdout or write to a file
 dz guard check --op <publish|teach|consolidate|reindex> [--text <s>] [--json] [--force <reason>]   # declarative constraint layer before self-mutating ops: HARD violation → block (exit 1), SOFT → warn; zero-config defaults, .dz/guard.json to customise; dz guard --init | dz guard log (append-only audit). dz publish runs it automatically (--no-guard "<reason>" = logged escape hatch)

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAgQH,2EAA2E;AAC3E,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,iBAAiB,CAAC;CAC5C;AAED,yFAAyF;AACzF,MAAM,MAAM,iBAAiB,GAAG,CAC9B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,KACvD;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAs0K9E,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,GAAE,KAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAgJ5E"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAuQH,2EAA2E;AAC3E,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,iBAAiB,CAAC;CAC5C;AAED,yFAAyF;AACzF,MAAM,MAAM,iBAAiB,GAAG,CAC9B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,KACvD;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAo9K9E,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,GAAE,KAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAkJ5E"}

package/dist/cli.js

@@ -9,7 +9,7 @@ import { fileURLToPath } from 'node:url';
 import { execSync } from 'node:child_process';
 import { homedir, tmpdir } from 'node:os';
 import { createRequire } from 'node:module';
-import { createSkill, getSkillInfo, getWorkflow, isTargetName, listSkills, runDoctor, runInit, benchmarkSkill, benchmarkSkills, scanMcp, reconcileCapabilities, RECONCILE_BANNER, buildRegistry, discoverSkillPackDirs, checkUpstream, compareSkills, checkAllUpstream, sweepSkillDrift, syncCanonicalSkill, checkUpgrades, discoverPackages, discoverSourcePackages, fetchAllDownloads, filterByCategory, pretrain, recommend, generatePlugin, publishPackages, runSetup, runMigrate, searchRegistry, runSync, runVerify, runInitAgentsMd, runInitGeminiMd, TARGET_NAMES, buildParityMatrix, TARGET_CAPABILITIES, TARGET_SHORT_LABELS, WORKFLOW_NAMES, importEcc, recordPattern, resolveLearningBackend, storeStats, consolidateSessions, pruneNoisePatterns, lessonDeltaReport, removePatternsByIds, snapshotStore, recallHybrid, teachGuard, mirrorPatternsToVector, vectorMirrorEnabled, vectorTierStatus, resolveVectorEngine, reindexVectorStore, harmonizeVectorStore, importRvfCheckpoint, statuslineData, writeFeatureAdrState, computeUsage, deriveUsageCalibration, normalizeClaudeUsageModelKey, readUsageLimits, claimCheck, summarize, queryBookKnowledge, loadStorePatternsSync, patternRecordId, loadStoreRecords, recordToPattern, bundleSkills, brainHome, listBrain, promoteProjectToBrain, updateBrainSource, queryBrain, groundPrompt, expandKu, reindexBrainVectors, buildPrimer, exportBrainSlice, importBrainSlice, registerKusToBrain, RECALL_USAGE_LOG_RELATIVE, RECALL_USAGE_LOG_MAX_BYTES, parseRecallUsageLog, buildRecallUsageReport, buildManifest, buildSbom, resolveTrustRoot, decideVerifyPolicy, generateSigningKeypair, evaluateGuard, resolveRules, auditRecord, guardExitCode, DEFAULT_RULES, decideProvenance, isInsideTree, signManifest, verifyManifest, listSignablePackFiles, assertKeyOutsideTree, decidePublishGate, collectPackageFacts, planReleaseGates, selectAffectedPackages, classifyGateExecutions, buildFailureIssue, buildReleaseNotes, releaseTagName, firstOutputLine, formatPublishError, MANIFEST_NAME, SBOM_NAME, buildArchitectureMap, renderMapHuman, findArchitectureDrift, renderDriftReport, scanWorkspacePackages, loadSubsystemManifest, loadProductVision, checkFeatureAgainstArchitecture, renderArchCheck, planProjectSkills, guidanceForStage, renderInjectionReport, analyzeCorpus, renderRakeReport, renderCriticSection, rakeAsLesson, rakeReward, DEFAULT_RAKE_THRESHOLDS, streamSessionEvents, findLatestTranscript, detectProcessRakes, buildRetro, renderRetro, retroLessonText, PROCESS_SIGNATURES, RETRO_DOMAIN, scanForSetup, buildSetupPlan, scaffoldFromSpec, renderScaffoldPreview, readExistingForScaffold, assembleChallengeContext, buildChallengeBrief, planDiscriminationCheck, classifyDiscrimination, pickAdversaryModel, CHALLENGE_QUESTIONS, loadOutcomes, renderOutcomes, statsForKey, selectAutoCost, recordProvisional, finalizeOutcome, COST_LADDER, splitScenarios, budgetPlan, selectWinner, proseScopeOk, renderProseDiff, readScenarioIds, DEFAULT_MAX_JUDGE_RUNS, } from '@dzhechkov/harness-core';
+import { createSkill, getSkillInfo, getWorkflow, isTargetName, listSkills, runDoctor, runInit, benchmarkSkill, benchmarkSkills, scanMcp, reconcileCapabilities, RECONCILE_BANNER, buildRegistry, discoverSkillPackDirs, checkUpstream, compareSkills, checkAllUpstream, sweepSkillDrift, syncCanonicalSkill, checkUpgrades, discoverPackages, discoverSourcePackages, fetchAllDownloads, filterByCategory, pretrain, recommend, generatePlugin, publishPackages, runSetup, runMigrate, searchRegistry, runSync, runVerify, runInitAgentsMd, runInitGeminiMd, TARGET_NAMES, buildParityMatrix, TARGET_CAPABILITIES, TARGET_SHORT_LABELS, WORKFLOW_NAMES, importEcc, recordPattern, resolveLearningBackend, storeStats, consolidateSessions, pruneNoisePatterns, lessonDeltaReport, removePatternsByIds, snapshotStore, recallHybrid, teachGuard, mirrorPatternsToVector, vectorMirrorEnabled, vectorTierStatus, resolveVectorEngine, reindexVectorStore, harmonizeVectorStore, importRvfCheckpoint, statuslineData, writeFeatureAdrState, computeUsage, deriveUsageCalibration, normalizeClaudeUsageModelKey, readUsageLimits, claimCheck, summarize, queryBookKnowledge, loadStorePatternsSync, patternRecordId, loadStoreRecords, recordToPattern, bundleSkills, brainHome, listBrain, promoteProjectToBrain, updateBrainSource, queryBrain, groundPrompt, expandKu, reindexBrainVectors, buildPrimer, exportBrainSlice, importBrainSlice, registerKusToBrain, RECALL_USAGE_LOG_RELATIVE, RECALL_USAGE_LOG_MAX_BYTES, parseRecallUsageLog, buildRecallUsageReport, buildManifest, buildSbom, resolveTrustRoot, decideVerifyPolicy, generateSigningKeypair, evaluateGuard, resolveRules, auditRecord, guardExitCode, DEFAULT_RULES, decideProvenance, isInsideTree, signManifest, verifyManifest, listSignablePackFiles, assertKeyOutsideTree, decidePublishGate, collectPackageFacts, planReleaseGates, selectAffectedPackages, classifyGateExecutions, buildFailureIssue, buildReleaseNotes, releaseTagName, firstOutputLine, formatPublishError, MANIFEST_NAME, SBOM_NAME, buildArchitectureMap, renderMapHuman, findArchitectureDrift, renderDriftReport, scanWorkspacePackages, loadSubsystemManifest, loadProductVision, checkFeatureAgainstArchitecture, renderArchCheck, planProjectSkills, guidanceForStage, renderInjectionReport, analyzeCorpus, renderRakeReport, renderCriticSection, rakeAsLesson, rakeReward, DEFAULT_RAKE_THRESHOLDS, streamSessionEvents, findLatestTranscript, detectProcessRakes, buildRetro, renderRetro, retroLessonText, PROCESS_SIGNATURES, RETRO_DOMAIN, scanForSetup, buildSetupPlan, scaffoldFromSpec, renderScaffoldPreview, readExistingForScaffold, assembleChallengeContext, buildChallengeBrief, planDiscriminationCheck, classifyDiscrimination, pickAdversaryModel, CHALLENGE_QUESTIONS, loadOutcomes, renderOutcomes, statsForKey, selectAutoCost, recordProvisional, finalizeOutcome, COST_LADDER, splitScenarios, budgetPlan, selectWinner, proseScopeOk, renderProseDiff, readScenarioIds, DEFAULT_MAX_JUDGE_RUNS, collectDeliveryFacts, planDeliveryCheck, renderDeliveryBrief, classifyDelivery, isUsablePlaneResult, renderDeliveryReview, } from '@dzhechkov/harness-core';
 import { getPreset, PRESET_NAMES } from '@dzhechkov/harness-presets';
 import { scanGitHub, analyzeRepo, generateReport, deepAnalyze, scanAllSources, ScoutMemory } from '@dzhechkov/scout';
 const USAGE = `dz - DZ cross-platform harness CLI
@@ -34,6 +34,7 @@ Usage:
   dz publish [--filter <name>] [--bump-only] [--claim-check <off|warn|error>] [--require-signing] [--provenance|--no-provenance]   (dry-run by default; pass --yes/--confirm/--no-dry-run to go live; claim-check gate default warn — surfaces README claim findings, never blocks; error fails an offending package)
   dz release [--filter <name>] [--tag] [--publish] [--json] [--dry-run] [--no-issue]   (VERIFIED release: 4 HARD gates in FRONT of dz publish — full package test suites, audit >=high, node --check of every dist/bin file, bin smoke-boot via "node <bin> --help" — any red gate STOPS the release (exit 1) + best-effort gh issue; all green ⇒ re-sign reminder, then prints the ready dz publish command (or chains with --publish); never duplicates publish's own gates)
   dz parity [--target <name>] [--json]   (the honest feature×target map, COMPUTED from the capability model — which harness feature is full / manual / absent on each of the ${TARGET_NAMES.length} targets, and via which form)
+  dz delivery-check --slug <slug> [--context-only] [--findings <f.json>] [--strict] [--author <model>] [--json]   (portable Step-10 Delivery Gate: prints the 4-plane review brief + artifact probes; --findings classifies a fed-back review into a fail-closed ready|blocked hand-off and writes features/<slug>/10_delivery_review.md; --strict exits 1 on blocked)
   dz setup --target <name> [--preset <name>] [--select id,id,...] [--skills-dir <dir>] [--project <dir>] [--memory agentdb] [--no-memory] [--no-hooks] [--install-driver] [--force] [--enrich]
   dz teach "<pattern>" [--reward <0-1>] [--domain <name>] [--type rule|success-pattern|lesson-learned] [--project <dir>] [--no-mirror]   (--project pins the learned store to <dir>/.dz, not the cwd — pin to a canonical brain)
   dz teach --from-json <file> [--project <dir>] [--no-mirror]   (bulk-import a 'dz recall --all --json' export — share a learned store across machines)
@@ -4905,8 +4906,17 @@ function cmdFeatureAdrSetup(options, flags, cwd, write) {
         write('dz feature-adr-setup: --loc-cap must be a positive finite number');
         return 1;
     }
+    // portable-gates (direction b): --gates scaffolds the zero-config architecture/gates/delivery-check.md.
+    // Its "runnable here" list is computed for --target (default agents-md, the AGENTS.md-class target class).
+    const wantGates = flags.has('gates');
+    const targetOpt = options.get('target');
+    if (targetOpt !== undefined && !isTargetName(targetOpt)) {
+        write(`dz feature-adr-setup: --target must be one of: ${TARGET_NAMES.join(', ')}`);
+        return 1;
+    }
+    const gatesTarget = isTargetName(targetOpt ?? '') ? targetOpt : 'agents-md';
     const specPath = options.get('from-spec');
-    if (specPath === undefined && !wantGuards) {
+    if (specPath === undefined && !wantGuards && !wantGates) {
         // default + --plan: the read-only "which documents, and where?" answer.
         const plan = buildSetupPlan(scanForSetup(repoRoot));
         if (flags.has('json')) {
@@ -4944,7 +4954,9 @@ function cmdFeatureAdrSetup(options, flags, cwd, write) {
     }
     if (wantGuards)
         spec = { ...spec, guards: locCap !== undefined ? { locCap } : true };
-    const result = scaffoldFromSpec(spec, readExistingForScaffold(repoRoot));
+    if (wantGates)
+        spec = { ...spec, gates: true };
+    const result = scaffoldFromSpec(spec, readExistingForScaffold(repoRoot), gatesTarget);
     if (flags.has('json') && !flags.has('apply')) {
         write(JSON.stringify(result, null, 2));
         return 0;
@@ -5182,6 +5194,149 @@ function cmdDiscriminationCheck(options, flags, cwd, write) {
 function nameFor(t, outcome) {
     return t.name !== undefined ? { file: t.file, name: t.name, outcome } : { file: t.file, outcome };
 }
+/**
+ * `dz delivery-check` — the portable Step-10 Delivery Gate (feature portable-gates). The `manual` form that
+ * travels to every `shell` target: the deterministic parts (artifact probes, hand-off arithmetic,
+ * cross-validation bookkeeping) run IN the CLI; the semantic 4-plane review is DISPATCHED to the caller's own
+ * agent runtime — the `dz challenge` cartridge shape. All logic lives in harness-core's pure engine; this is
+ * the executor. Advisory exit codes (0 by default; `--strict` ⇒ 1 on `blocked`).
+ *
+ *   --slug <slug>            the feature under features/<slug> (required; featureDir derived internally)
+ *   --context-only           default mode: print artifact probes + the 4-plane review brief (no verdict)
+ *   --findings <f.json>      classify a fed-back findings array → write 10_delivery_review.md + print ready/blocked
+ *   --strict                 with --findings: exit 1 iff handoff === 'blocked' (CI gate)
+ *   --author <model>         cosmetic: the reviewer to dispatch, printed alongside the brief
+ *   --json                   machine contract { planesChecked, planesSkipped, findings, handoff, artifact }
+ */
+function cmdDeliveryCheck(options, flags, cwd, write) {
+    let repoRoot = cwd;
+    try {
+        repoRoot = execSync('git rev-parse --show-toplevel', { cwd, encoding: 'utf-8', stdio: ['ignore', 'pipe', 'ignore'] }).trim() || cwd;
+    }
+    catch { /* not git */ }
+    const json = flags.has('json');
+    const errOut = (error) => {
+        if (json)
+            write(JSON.stringify({ error, planesChecked: [], planesSkipped: [], findings: [], handoff: null, artifact: 'not-written' }, null, 2));
+        else {
+            write(`dz delivery-check: ${error}`);
+            write('  allowed: --slug <slug>, --findings <f.json>, --author <model>, --context-only, --strict, --json');
+        }
+        return 1;
+    };
+    // Strict allowlist (delivery finding: a typo'd --findings silently downgraded the --strict CI
+    // gate to a vacuous exit-0 pass — a mistyped option must be an ERROR, never a mode change).
+    const allowedFlags = new Set(['context-only', 'strict', 'json', 'help']);
+    const allowedOptions = new Set(['slug', 'findings', 'author']);
+    for (const flag of flags)
+        if (!allowedFlags.has(flag))
+            return errOut(`unknown option --${flag}`);
+    for (const key of options.keys()) {
+        if (key.startsWith('_positional_'))
+            return errOut(`unexpected argument "${options.get(key)}"`);
+        if (!allowedOptions.has(key))
+            return errOut(`unknown option --${key}`);
+    }
+    const slug = options.get('slug');
+    if (slug === undefined || slug.trim() === '')
+        return errOut('pass --slug <slug> (the feature under features/<slug>)');
+    // Slug convention is a SECURITY boundary here (delivery finding, CONFIRMED traversal reproducer:
+    // --slug '../../outside/evil' wrote 10_delivery_review.md outside the repo). kebab-case Latin,
+    // <=40 chars — the repo's own slug rule as a layer-1 three-line check.
+    const slugTrimmed = slug.trim();
+    if (!/^[a-z0-9]+(-[a-z0-9]+)*$/.test(slugTrimmed) || slugTrimmed.length > 40) {
+        return errOut(`invalid --slug "${slugTrimmed}" — kebab-case Latin, max 40 chars (a path-like slug would redirect the report write)`);
+    }
+    const featureDir = join(repoRoot, 'features', slugTrimmed);
+    // --context-only is a real mode flag, not decoration: combining it with --findings contradicts
+    // itself (delivery finding — the flag was accepted and silently ignored).
+    if (flags.has('context-only') && options.get('findings') !== undefined) {
+        return errOut('--context-only and --findings are mutually exclusive (context-only prints the brief; findings classifies the verdict)');
+    }
+    // git status --porcelain — CLI layer only (the `no child_process in core` contract); a non-git target
+    // degrades to an empty list, which is honest (AM-10: changed-files is informational, never a required gate).
+    let changedFiles = [];
+    try {
+        const out = execSync('git status --porcelain', { cwd: repoRoot, encoding: 'utf-8', stdio: ['ignore', 'pipe', 'ignore'] });
+        changedFiles = out.split('\n').map((l) => l.slice(3).trim()).filter((s) => s.length > 0);
+    }
+    catch { /* non-git / unavailable → empty (honest) */ }
+    const facts = collectDeliveryFacts(featureDir, { changedFiles, repoRoot });
+    const plan = planDeliveryCheck(facts);
+    const author = options.get('author');
+    const findingsPath = options.get('findings');
+    if (findingsPath === undefined) {
+        // Default / --context-only: emit the led protocol (probes + brief). No verdict — the CLI has no model.
+        if (json) {
+            write(JSON.stringify({
+                planesChecked: [],
+                planesSkipped: plan.planes.map((p) => p.id),
+                findings: [],
+                handoff: null,
+                artifact: 'not-written',
+                probes: plan.probes,
+            }, null, 2));
+            return 0;
+        }
+        write(`dz delivery-check — ${slug} (portable 4-plane hand-off protocol; you drive the review)`);
+        for (const p of plan.probes) {
+            const mark = p.passed === true ? '✓' : p.passed === false ? '✗' : '○';
+            write(`  ${mark} ${p.description}${p.required ? ' [required]' : ' [informational]'}`);
+        }
+        write('');
+        write(renderDeliveryBrief(plan, facts));
+        // The hand-off criterion the verdict will be judged by, shown UP FRONT (this also makes
+        // plan.criterionTemplate a consumed surface, not dead product code — delivery finding).
+        write('\n── hand-off criterion (all must PASS for ready) ──');
+        for (const c of plan.criterionTemplate)
+            write(`  ○ ${c.label}`);
+        if (author !== undefined && author.trim() !== '')
+            write(`\n── reviewer to dispatch ──\n${author.trim()}`);
+        write('\n(next: run the four planes, then `dz delivery-check --slug ' + slug + ' --findings findings.json` for the verdict)');
+        return 0;
+    }
+    // --findings mode: parse (malformed/missing ⇒ [], a failed-plane input — fail-closed, never a throw).
+    let reviewResults = [];
+    try {
+        const parsed = JSON.parse(readFileSync(resolve(cwd, findingsPath), 'utf-8'));
+        if (Array.isArray(parsed))
+            reviewResults = parsed;
+        else if (parsed !== null && typeof parsed === 'object' && Array.isArray(parsed.planes))
+            reviewResults = parsed.planes;
+        else
+            reviewResults = [];
+    }
+    catch {
+        reviewResults = [];
+    }
+    const verdict = classifyDelivery(plan, reviewResults);
+    // The SAME predicate as the fail-closed verdict (core-exported) — a local copy was a drift channel.
+    const planesChecked = plan.planes.filter((_, i) => isUsablePlaneResult(reviewResults[i])).map((p) => p.id);
+    const planesSkipped = plan.planes.filter((_, i) => !isUsablePlaneResult(reviewResults[i])).map((p) => p.id);
+    // Write the regenerable report (NOT augment-never-clobber — deliberately overwritten each run).
+    let artifact = 'not-written';
+    try {
+        const reviewPath = join(featureDir, '10_delivery_review.md');
+        mkdirSync(dirname(reviewPath), { recursive: true });
+        writeFileSync(reviewPath, renderDeliveryReview(verdict, facts));
+        artifact = 'written';
+    }
+    catch { /* best-effort — the verdict is still returned */ }
+    if (json) {
+        write(JSON.stringify({ planesChecked, planesSkipped, findings: verdict.findings, handoff: verdict.handoff, artifact }, null, 2));
+    }
+    else {
+        write(`dz delivery-check — ${slug}: ${verdict.handoff}`);
+        for (const c of verdict.criterion) {
+            const mark = c.status === 'PASS' ? '✓' : c.status === 'FAIL' ? '✗' : '○';
+            write(`  ${mark} ${c.label}: ${c.status}${c.detail ? ` — ${c.detail}` : ''}`);
+        }
+        write(artifact === 'written' ? `\n↳ wrote features/${slug}/10_delivery_review.md` : '\n↳ 10_delivery_review.md NOT written (verdict above is authoritative)');
+    }
+    if (flags.has('strict') && verdict.handoff === 'blocked')
+        return 1;
+    return 0;
+}
 /**
  * `dz routing` — inspect the learned cost-optimal routing outcome store (feature learned-cost-routing). Shows
  * what `args.models[stage]='auto-cost'` currently believes per (stage, complexity-tier, model): gated
@@ -5619,6 +5774,8 @@ export async function runCli(argv, io = {}) {
                 return cmdChallenge(options, flags, cwd, write);
             case 'discrimination-check':
                 return cmdDiscriminationCheck(options, flags, cwd, write);
+            case 'delivery-check':
+                return cmdDeliveryCheck(options, flags, cwd, write);
             case 'routing':
                 return cmdRouting(options, flags, cwd, write);
             case 'bto-optimize':