@dzhechkov/skills-feature-adr 1.3.42 → 1.3.44

package/README.md

@@ -124,6 +124,15 @@ writing code. Without this the run stalls; with `coder: 'codex-fallback'` the pi
 unavailable (limit?) — falling back to Codex auto"* and finishes the code + tests on Codex, no
 restart and no lost work.
 
+**Codex writes are out-of-band — the Step-7.5 landed barrier waits for them.** Codex applies edits via
+its own runtime, so a naive pipeline runs QE before the async write flushes and false-grades *"Step 7
+never ran"* on real code. For a Codex-coded run the pipeline polls a **bounded 120s backing-off window**
+(`1,2,2,5,5,10,10,15,20,25,25`s), preferring the code stage's *declared expected files* when known, and
+emits an explicit `changed=0 after 120s — genuinely not landed` only when the window truly expires — so
+QE distinguishes "not implemented" from "not yet flushed". A Claude-coded run is synchronous and skips
+the barrier entirely (zero added wait). Note: if Codex flushes slower than 120s, re-verify after the run
+rather than trusting the end-of-run grade.
+
 ```bash
 # Headless login on a VPS (no browser):
 codex login --device-auth                       # prints a code + URL you approve on another device
@@ -141,6 +150,13 @@ Workflow({ scriptPath: '.claude/workflows/feature-adr.js',
 Omit the Codex knobs entirely for today's all-Claude behavior. The run result reports
 `plannerUsed` / `coderUsed` / `qeReviewerUsed` / `codexModel` / `modelsUsed` so you can see who did what.
 
+**Live model visibility in `/workflows`:** each stage's agent label is decorated with its *resolved*
+model — e.g. `adr · codex:gpt-5.5:xhigh`, `plan · opus` — so you see which model actually ran a stage in
+the live progress tree, not just in the final report. This matters because a Codex stage's auto
+model-badge shows the `codex:codex-rescue` Claude wrapper (the session model), never `codex`; the label
+text is the honest signal. A Claude fallback appears as its own distinct node (never mislabeled as Codex),
+and a routing-off run adds no suffix (byte-identical to today).
+
 ### Per-stage model routing — `args.models`
 
 The three Codex knobs above are shortcuts. `args.models` is the **general dial**: an optional map that

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dzhechkov/skills-feature-adr",
-  "version": "1.3.42",
+  "version": "1.3.44",
   "description": "Adaptive Feature Development skill pack for Claude Code — 11-step pipeline with Complexity Router (S/M/L/XL), ADR-driven architecture, 15 agentic-qe skills, multi-agent fleet QE. Supports --full-qe, --full-qe-extended, --with-learning, and --knowledge-extractor modes.",
   "bin": {
     "skills-feature-adr": "./bin/cli.js"

package/templates/.claude/workflows/feature-adr.js

@@ -226,12 +226,130 @@ function modelLabel(opts) {
   return 'session'
 }
 
+// stageLabel: make resolved model participation visible in LIVE /workflows labels.
+// A session-inherited resolution is the routing-off BC path, so it stays silent.
+function stageLabel(baseLabel, opts) {
+  const m = modelLabel(opts)
+  if (!m || m === 'session') return baseLabel
+  return baseLabel + ' · ' + m
+}
+
 // needsLandedBarrier — mirror of harness-core's pure gate (feature-adr-routing.ts). TRUE only when a
 // stage resolved to Codex. A Claude stage is synchronous (artifact on disk when agent() returns), so
 // this is FALSE and the barrier below is never constructed → an all-Claude run, and a Claude-design +
 // Codex-QE run, do ZERO extra work (byte-identical to today).
 function needsLandedBarrier(opts) { return !!(opts && opts.agentType === 'codex:codex-rescue') }
 
+const DEFAULT_CODE_LANDING_MAX_WAIT_MS = 120000
+const DEFAULT_CODE_LANDING_BACKOFF_MS = [1000, 2000, 2000, 5000, 5000, 10000, 10000, 15000, 20000, 25000, 25000]
+const CODE_LANDED_BARRIER_SLEEPS_SECONDS = DEFAULT_CODE_LANDING_BACKOFF_MS.map((ms) => ms / 1000)
+const CODE_LANDING_PIPELINE_PREFIXES = ['features/', '.dz/', '.agentic-qe/', 'roam/']
+
+function codeLandingEmptySignal(seconds) {
+  return 'changed=0 after ' + seconds + 's — genuinely not landed'
+}
+
+function needsCodeLandedBarrier(coderUsed) {
+  return coderUsed === 'codex' || coderUsed === 'codex-fallback'
+}
+
+function normalizeCodeLandingPath(path) {
+  let p = String(path || '').trim().replace(/\\/g, '/')
+  while (p.indexOf('./') === 0) p = p.slice(2)
+  p = p.replace(/\/+/g, '/')
+  if (!p) return ''
+  if (p[0] === '/') return ''
+  if (p === '..' || p.indexOf('../') === 0 || p.indexOf('/../') >= 0 || p.endsWith('/..')) return ''
+  if (/[\0\r\n\t "'\x60$;&|<>*?()[\]{}!]/.test(p)) return ''
+  if (p.endsWith('/')) return ''
+  for (let i = 0; i < CODE_LANDING_PIPELINE_PREFIXES.length; i++) {
+    const prefix = CODE_LANDING_PIPELINE_PREFIXES[i]
+    const bare = prefix.slice(0, -1)
+    if (p === bare || p.indexOf(prefix) === 0) return ''
+  }
+  return p
+}
+
+function filterPollableCodePaths(paths) {
+  const out = []
+  const seen = {}
+  for (let i = 0; i < (paths || []).length; i++) {
+    const normalized = normalizeCodeLandingPath(paths[i])
+    if (!normalized || seen[normalized]) continue
+    seen[normalized] = 1
+    out.push(normalized)
+  }
+  return out
+}
+
+function codeLandedBarrierPlan(coderUsed, expectedPaths) {
+  const enabled = needsCodeLandedBarrier(coderUsed)
+  const pollWindowSeconds = DEFAULT_CODE_LANDING_MAX_WAIT_MS / 1000
+  if (!enabled) {
+    return { enabled: false, mode: 'any-code-change', sleepsMs: [], sleepsSeconds: [], pollWindowMs: 0, pollWindowSeconds: 0, expectedPaths: [], emptySignal: '' }
+  }
+  const filteredExpectedPaths = filterPollableCodePaths(expectedPaths || [])
+  return {
+    enabled: true,
+    mode: filteredExpectedPaths.length > 0 ? 'expected-files' : 'any-code-change',
+    sleepsMs: DEFAULT_CODE_LANDING_BACKOFF_MS,
+    sleepsSeconds: CODE_LANDED_BARRIER_SLEEPS_SECONDS,
+    pollWindowMs: DEFAULT_CODE_LANDING_MAX_WAIT_MS,
+    pollWindowSeconds: pollWindowSeconds,
+    expectedPaths: filteredExpectedPaths,
+    emptySignal: codeLandingEmptySignal(pollWindowSeconds),
+  }
+}
+
+function addExpectedCodeTarget(value, out) {
+  if (value === null || value === undefined) return
+  if (Array.isArray(value)) {
+    for (let i = 0; i < value.length; i++) addExpectedCodeTarget(value[i], out)
+    return
+  }
+  if (typeof value === 'object') {
+    if (Array.isArray(value.wrote)) addExpectedCodeTarget(value.wrote, out)
+    if (Array.isArray(value.paths)) addExpectedCodeTarget(value.paths, out)
+    return
+  }
+  const lines = String(value).split(/\r?\n/)
+  for (let i = 0; i < lines.length; i++) {
+    const candidate = lines[i].replace(/^[-*]\s+/, '').replace(/^\x60+|\x60+$/g, '').trim()
+    if (candidate) out.push(candidate)
+  }
+}
+
+function extractExpectedCodeTargetsFromText(text) {
+  const out = []
+  const lines = String(text || '').split(/\r?\n/)
+  let inBlock = false
+  for (let i = 0; i < lines.length; i++) {
+    const trimmed = lines[i].trim()
+    if (/^EXPECTED_CODE_TARGETS:\s*$/i.test(trimmed)) { inBlock = true; continue }
+    if (!inBlock) continue
+    if (!trimmed) continue
+    if (/^[A-Z][A-Z0-9_ -]*:\s*$/.test(trimmed)) break
+    out.push(trimmed.replace(/^[-*]\s+/, '').replace(/^\x60+|\x60+$/g, '').trim())
+  }
+  return out
+}
+
+function extractExpectedCodeTargets(argTargets, codexText) {
+  const out = []
+  addExpectedCodeTarget(argTargets, out)
+  addExpectedCodeTarget(extractExpectedCodeTargetsFromText(codexText), out)
+  return filterPollableCodePaths(out)
+}
+
+function codeLandingShellQuote(value) {
+  return "'" + String(value).replace(/'/g, "'\"'\"'") + "'"
+}
+
+function codeLandingProbeCmd(repo, plan) {
+  const expectedList = plan.expectedPaths.length > 0 ? plan.expectedPaths.map(codeLandingShellQuote).join(' ') : "''"
+  return 'repo=' + codeLandingShellQuote(repo) + '; sleeps="' + plan.sleepsSeconds.join(' ') + '"; expected_count=' + plan.expectedPaths.length + '; elapsed=0; poll(){ paths=$(git -C "$repo" status --porcelain 2>/dev/null | sed -E "s/^...//" | sed -E "s/.* -> //" | grep -vE "^(features/|[.]dz/|[.]agentic-qe/|roam/)" | sed "/^$/d" | head -200); n=$(printf "%s\\n" "$paths" | sed "/^$/d" | wc -l | tr -d " "); if [ "$expected_count" -gt 0 ]; then matched=""; for p in ' + expectedList + '; do [ -z "$p" ] && continue; if printf "%s\\n" "$paths" | grep -Fx -- "$p" >/dev/null; then matched="$p"; break; fi; done; if [ -n "$matched" ]; then echo "CODEX-LANDING-SIGNAL status=landed changed=1 after=${elapsed}s predicate=expected-path"; echo "matched=$matched"; echo "files:"; printf "%s\\n" "$paths" | head -40; exit 0; fi; else if [ "$n" -gt 0 ]; then echo "CODEX-LANDING-SIGNAL status=landed changed=$n after=${elapsed}s predicate=any-code-change"; echo "files:"; printf "%s\\n" "$paths" | head -40; exit 0; fi; fi; }; poll; for wait in $sleeps; do sleep "$wait"; elapsed=$((elapsed + wait)); poll; done; echo "CODEX-LANDING-SIGNAL status=genuinely-not-landed ' + plan.emptySignal + '"; if [ "$expected_count" -gt 0 ]; then echo "predicate=expected-path observed=$n"; else echo "predicate=any-code-change"; fi; echo "files:"; if [ -n "$paths" ]; then printf "%s\\n" "$paths" | head -40; else echo "(none)"; fi'
+}
+
 // A Bash one-liner that waits for a Codex OUT-OF-BAND artifact write to LAND: polls up to ~40s until
 // the file exists, is non-empty, AND its size is stable across two reads (write finished). Assumes a
 // fresh feature slug (no stale same-path artifact) — true for a normal /feature-adr run.
@@ -245,7 +363,7 @@ function landedProbeCmd(f) {
 // codex-rescue returns finalMessage text, not StructuredOutput; success is proven by the file landing —
 // (b) add a FOREGROUND hint so the codex runtime blocks until the write completes, (c) poll the
 // artifact, and (d) fall back to a Claude agent if it never lands (never blocks the pipeline).
-async function designStage(promptText, opts, artifactPath) {
+async function designStage(promptText, opts, artifactPath, baseLabel) {
   if (!needsLandedBarrier(opts)) return await agent(promptText, opts)
   const codexOpts = {}
   for (const k in opts) if (k !== 'schema') codexOpts[k] = opts[k]
@@ -253,7 +371,8 @@ async function designStage(promptText, opts, artifactPath) {
   const probe = await agent('Confirm a Codex OUT-OF-BAND artifact write has LANDED before the next stage reads it. Run EXACTLY this via Bash and return its stdout verbatim, nothing else:\n' + landedProbeCmd(artifactPath), { label: 'design:confirm-landed', phase: 'Design', effort: 'low' })
   if (res && probe && /landed=/.test(String(probe))) return { wrote: [artifactPath], summary: String(res).slice(0, 300) }
   log('design artifact did not land on codex (' + artifactPath + ') — falling back to Claude')
-  return await agent(promptText, mergeOpts({ label: (opts.label || 'design') + ':claude-fb', phase: 'Design', schema: ARTIFACT }, {}))
+  const fallbackOpts = {}
+  return await agent(promptText, mergeOpts({ label: stageLabel((baseLabel || 'design') + ':claude-fb', fallbackOpts), phase: 'Design', schema: ARTIFACT }, fallbackOpts))
 }
 
 const ROUTER = { type: 'object', additionalProperties: false, required: ['tier', 'activeSteps', 'rationale'], properties: { tier: { type: 'string', enum: ['S', 'M', 'L', 'XL'] }, activeSteps: { type: 'array', items: { type: 'number' } }, rationale: { type: 'string' } } }
@@ -266,7 +385,8 @@ const ADR_FITNESS_CHECKLIST = 'ADR fitness checklist for Step 8: read every ' +
 phase('Router')
 await usageProbe('Router')
 const routerPrompt = 'You are Step 0 (Complexity Router) of the /feature-adr pipeline. TWO jobs. (1) MANDATORY SELF-LEARNING RECALL (never skip — run BOTH Bash commands VERBATIM, do not summarize instead of running them): the learned patterns live in the CANONICAL BRAIN store at `' + BRAIN + '` — pin every recall to it. Via your Bash tool run EXACTLY `' + DZ_RECALL('<the key domain terms of this feature>') + '` (and `' + DZ_RECALL('<the key domain terms of this feature>') + ' --all` if narrow) to load relevant LEARNED PATTERNS from the brain. Preserve recalled pattern TEXT, reward, domain, and any visible id in the rationale as a concrete list so Step 8 can compare candidate lessons against it. Then run `dz statusline --fa-record --slug ' + SLUG + ' --step "Step 0 recall" --recalled <count> --mode ' + MODE + ' --project ' + REPO + '`. Summarize the top 3 applicable patterns in the rationale. (2) Classify S/M/L/XL + active steps. Feature: "' + DESC + '". Code: ' + CODE_HINT + '. S=1-3 files (0,1,6,7,8; if an ADR is explicitly forced, use Nygard as the lightweight fallback); M=4-10 (0,1,3,3.5,5,6,7,8; Nygard/ITD-light ADR); L=11-30 (all+9; MADR+Confirmation ADRs); XL=30+ (full+9; MADR+Confirmation ADRs). ADR template-weight rule: S/M -> Nygard/ITD-light; L/XL -> MADR + NHS Wales Confirmation, while every generated ADR still carries the invariant core. Return {tier, activeSteps, rationale} with the recalled patterns folded into rationale.'
-const routerOpts = mergeOpts({ label: 'router+recall', phase: 'Router', schema: ROUTER, effort: 'low' }, resolveStageModel('router'))
+const routerModel = resolveStageModel('router')
+const routerOpts = mergeOpts({ label: stageLabel('router+recall', routerModel), phase: 'Router', schema: ROUTER, effort: 'low' }, routerModel)
 modelsUsed.router = modelLabel(routerOpts)
 const router = await agent(routerPrompt, routerOpts)
 let tier = A.tier || (router ? router.tier : 'M')
@@ -287,22 +407,26 @@ const designThunks = []
 const reqExtra = isLplus ? ' Also write ' + FDIR + '/02_research.md (codebase patterns + external analogues; read the repo for the closest existing implementation to mirror).' : ''
 // Resolve per-stage model opts up-front (parser-safe: no inline resolveStageModel inside the thunk arrays).
 // research folds into requirements, ddd folds into architecture (single shared call) — recorded for reporting.
-const reqOpts = mergeOpts({ label: 'requirements', phase: 'Design', schema: ARTIFACT }, resolveStageModel('requirements'))
-const adrOpts = mergeOpts({ label: 'adr', phase: 'Design', schema: ARTIFACT }, resolveStageModel('adr'))
-const qcsdOpts = mergeOpts({ label: 'qcsd', phase: 'Design', schema: ARTIFACT }, resolveStageModel('ideation'))
-const archOpts = mergeOpts({ label: 'architecture', phase: 'Design', schema: ARTIFACT }, resolveStageModel('architecture'))
+const reqModel = resolveStageModel('requirements')
+const adrModel = resolveStageModel('adr')
+const qcsdModel = resolveStageModel('ideation')
+const archModel = resolveStageModel('architecture')
+const reqOpts = mergeOpts({ label: stageLabel('requirements', reqModel), phase: 'Design', schema: ARTIFACT }, reqModel)
+const adrOpts = mergeOpts({ label: stageLabel('adr', adrModel), phase: 'Design', schema: ARTIFACT }, adrModel)
+const qcsdOpts = mergeOpts({ label: stageLabel('qcsd', qcsdModel), phase: 'Design', schema: ARTIFACT }, qcsdModel)
+const archOpts = mergeOpts({ label: stageLabel('architecture', archModel), phase: 'Design', schema: ARTIFACT }, archModel)
 modelsUsed.requirements = modelLabel(reqOpts)
 modelsUsed.research = modelLabel(reqOpts)
 modelsUsed.adr = modelLabel(adrOpts)
 modelsUsed.ideation = modelLabel(qcsdOpts)
 modelsUsed.architecture = modelLabel(archOpts)
 modelsUsed.ddd = modelLabel(archOpts)
-designThunks.push(() => designStage('Step 1 (Requirements)' + (isLplus ? ' + Step 2 (Research)' : '') + ' of /feature-adr for "' + DESC + '" (tier ' + tier + ', slug ' + SLUG + '). Code: ' + CODE_HINT + '. APPLY these Step-0 recalled LEARNED PATTERNS (fold the applicable ones into requirements/constraints - the loop paying off): ' + LEARNED + '. Write ' + FDIR + '/01_requirements.md (functional + non-functional requirements, acceptance criteria, constraints, and an "Applied learned patterns" note).' + reqExtra + ' Return wrote[] + a 1-line summary.', reqOpts, FDIR + '/01_requirements.md'))
+designThunks.push(() => designStage('Step 1 (Requirements)' + (isLplus ? ' + Step 2 (Research)' : '') + ' of /feature-adr for "' + DESC + '" (tier ' + tier + ', slug ' + SLUG + '). Code: ' + CODE_HINT + '. APPLY these Step-0 recalled LEARNED PATTERNS (fold the applicable ones into requirements/constraints - the loop paying off): ' + LEARNED + '. Write ' + FDIR + '/01_requirements.md (functional + non-functional requirements, acceptance criteria, constraints, and an "Applied learned patterns" note).' + reqExtra + ' Return wrote[] + a 1-line summary.', reqOpts, FDIR + '/01_requirements.md', 'requirements'))
 if (isMplus) {
-  designThunks.push(() => designStage('Step 3 (ADR + shift-left testability) of /feature-adr for "' + DESC + '" (' + SLUG + '). READ the actual code (' + CODE_HINT + ') to ground it. ' + ADR_TEMPLATE_GUIDE + ' Write ' + FDIR + '/03_adr/001-' + SLUG + '.md as a MADR-structured ADR that PASSES the Step-8 ADR fitness checklist (do NOT emit the legacy shape). Emit ALL of these sections, in order: a decision-shaped # Title (present-tense imperative verb — the auto-filename tracks the feature slug, so the IMPERATIVE signal lives in the title); ## Status (proposed/accepted/rejected/deprecated/superseded + a reversibility/revisit clause); ## Context (neutral, problem-first, BEFORE the Decision); ## Decision Drivers (ranked/weighted D1, D2, …); ## Considered Options (frame the CHOSEN approach as one option ALONGSIDE the rejected ones, each with symmetric Pros:/Cons:); ## Decision (concrete/testable — exact names, versions, paths, commands); ## Rationale (map each point to a driver Dn + why the losers lost); ## Consequences (Positive + Negative/Accepted Downsides + Follow-up ADRs + After-action Review with owner + date); a REQUIRED ## Confirmation stanza with Method:, Monitoring:, Success metric:, Owner:, Load-bearing property:, and Required automated check: `<test file>` NAMING the load-bearing property that MUST have a Step-8 test (the recurring lesson: the key safety property is often the untested one); and a ## Links traceability block (requirements, driving use case, related ADRs). Add a one-line provenance note (model-generated, edited for clarity) and, for a long ADR, a top-of-file table of contents. Do NOT use an "Alternatives considered" or "Testability/shift-left" heading in place of Considered Options / Confirmation. When creating ADDITIONAL ADRs, name them 03_adr/NNN-{decision-slug}.md with a lowercase-kebab, present-tense imperative, dateless, ticketless slug. Return wrote[] + summary.', adrOpts, FDIR + '/03_adr/001-' + SLUG + '.md'))
-  designThunks.push(() => designStage('Step 3.5 (QCSD ideation swarm - HTSM quality criteria + SFDIPOT risk) of /feature-adr for "' + DESC + '" (' + SLUG + '). Assess quality criteria + product-factors risk. Write ' + FDIR + '/03.5_ideation_report.md with a GO/CONDITIONAL/NO-GO verdict + top quality risks for QE. Return wrote[] + summary.', qcsdOpts, FDIR + '/03.5_ideation_report.md'))
+  designThunks.push(() => designStage('Step 3 (ADR + shift-left testability) of /feature-adr for "' + DESC + '" (' + SLUG + '). READ the actual code (' + CODE_HINT + ') to ground it. ' + ADR_TEMPLATE_GUIDE + ' Write ' + FDIR + '/03_adr/001-' + SLUG + '.md as a MADR-structured ADR that PASSES the Step-8 ADR fitness checklist (do NOT emit the legacy shape). Emit ALL of these sections, in order: a decision-shaped # Title (present-tense imperative verb — the auto-filename tracks the feature slug, so the IMPERATIVE signal lives in the title); ## Status (proposed/accepted/rejected/deprecated/superseded + a reversibility/revisit clause); ## Context (neutral, problem-first, BEFORE the Decision); ## Decision Drivers (ranked/weighted D1, D2, …); ## Considered Options (frame the CHOSEN approach as one option ALONGSIDE the rejected ones, each with symmetric Pros:/Cons:); ## Decision (concrete/testable — exact names, versions, paths, commands); ## Rationale (map each point to a driver Dn + why the losers lost); ## Consequences (Positive + Negative/Accepted Downsides + Follow-up ADRs + After-action Review with owner + date); a REQUIRED ## Confirmation stanza with Method:, Monitoring:, Success metric:, Owner:, Load-bearing property:, and Required automated check: `<test file>` NAMING the load-bearing property that MUST have a Step-8 test (the recurring lesson: the key safety property is often the untested one); and a ## Links traceability block (requirements, driving use case, related ADRs). Add a one-line provenance note (model-generated, edited for clarity) and, for a long ADR, a top-of-file table of contents. Do NOT use an "Alternatives considered" or "Testability/shift-left" heading in place of Considered Options / Confirmation. When creating ADDITIONAL ADRs, name them 03_adr/NNN-{decision-slug}.md with a lowercase-kebab, present-tense imperative, dateless, ticketless slug. Return wrote[] + summary.', adrOpts, FDIR + '/03_adr/001-' + SLUG + '.md', 'adr'))
+  designThunks.push(() => designStage('Step 3.5 (QCSD ideation swarm - HTSM quality criteria + SFDIPOT risk) of /feature-adr for "' + DESC + '" (' + SLUG + '). Assess quality criteria + product-factors risk. Write ' + FDIR + '/03.5_ideation_report.md with a GO/CONDITIONAL/NO-GO verdict + top quality risks for QE. Return wrote[] + summary.', qcsdOpts, FDIR + '/03.5_ideation_report.md', 'qcsd'))
   const archExtra = isLplus ? ' Also ' + FDIR + '/04_domain_model.md (DDD).' : ''
-  designThunks.push(() => designStage((isLplus ? 'Step 4 (DDD) + ' : '') + 'Step 5 (Architecture) of /feature-adr for "' + DESC + '" (' + SLUG + '). READ the code. Write ' + FDIR + '/05_architecture.md (components, data flow, integration points, the emit/merge/wiring shape).' + archExtra + ' Return wrote[] + summary.', archOpts, FDIR + '/05_architecture.md'))
+  designThunks.push(() => designStage((isLplus ? 'Step 4 (DDD) + ' : '') + 'Step 5 (Architecture) of /feature-adr for "' + DESC + '" (' + SLUG + '). READ the code. Write ' + FDIR + '/05_architecture.md (components, data flow, integration points, the emit/merge/wiring shape).' + archExtra + ' Return wrote[] + summary.', archOpts, FDIR + '/05_architecture.md', 'architecture'))
 }
 const design = await parallel(designThunks)
 
@@ -319,8 +443,9 @@ const planModel = resolveStageModel('plan')
 const planIsCodex = (planModel.agentType === 'codex:codex-rescue') || (MODELS.plan === undefined && PLANNER === 'codex')
 let plan = null
 if (planIsCodex) {
-  modelsUsed.plan = (planModel.agentType === 'codex:codex-rescue') ? modelLabel(planModel) : ('codex:' + CODEX_MODEL + ':high')
-  const codexPlanOpts = mergeOpts({ label: 'plan:codex', phase: 'Plan', agentType: 'codex:codex-rescue' }, planModel.agentType ? planModel : {})
+  const planCodexLabelOpts = (planModel.agentType === 'codex:codex-rescue') ? planModel : specToOpts('codex:' + CODEX_MODEL + ':high')
+  modelsUsed.plan = modelLabel(planCodexLabelOpts)
+  const codexPlanOpts = mergeOpts({ label: stageLabel('plan:codex', planCodexLabelOpts), phase: 'Plan', agentType: 'codex:codex-rescue' }, planModel.agentType ? planModel : {})
   const codexPlan = await agent(planPrompt + ' IMPORTANT: run the Codex task in FOREGROUND (synchronous — do NOT pass --background) so this call blocks until 06_implementation_plan.md is fully written to disk.', codexPlanOpts)
   // Codex-landed barrier for the plan artifact: a stub return is NOT proof the file was written
   // (codex writes out-of-band). Require the artifact to LAND; otherwise fall through to the Claude planner.
@@ -334,7 +459,8 @@ if (planIsCodex) {
 }
 if (plan === null && planIsCodex) reactiveBelt('Plan')
 if (plan === null) {
-  const claudePlanOpts = mergeOpts({ label: 'plan', phase: 'Plan', schema: ARTIFACT }, planIsCodex ? {} : planModel)
+  const claudePlanModel = planIsCodex ? {} : planModel
+  const claudePlanOpts = mergeOpts({ label: stageLabel(planIsCodex ? 'plan:claude-fb' : 'plan', claudePlanModel), phase: 'Plan', schema: ARTIFACT }, claudePlanModel)
   modelsUsed.plan = planIsCodex ? 'claude-fallback' : modelLabel(claudePlanOpts)
   const claudePlan = await agent(planPrompt, claudePlanOpts)
   plan = claudePlan ? { wrote: claudePlan.wrote, summary: claudePlan.summary, planner: planIsCodex ? 'claude-fallback' : 'claude' } : null
@@ -363,9 +489,11 @@ const codePrompt = 'Step 7 (Code) of /feature-adr for "' + DESC + '" (' + SLUG +
 // under the BC omit-path it is {} (byte-identical).
 const codeModel = resolveStageModel('code')
 const codeIsCodexFirst = (MODELS.code !== undefined) ? (codeModel.agentType === 'codex:codex-rescue') : (CODER === 'codex')
-const codeClaudeOpts = mergeOpts({ label: 'code', phase: 'Code', schema: ARTIFACT, effort: 'high' }, codeIsCodexFirst ? {} : (codeModel.agentType ? {} : codeModel))
+const codeClaudeModel = codeIsCodexFirst ? {} : (codeModel.agentType ? {} : codeModel)
+const codeClaudeOpts = mergeOpts({ label: stageLabel('code', codeClaudeModel), phase: 'Code', schema: ARTIFACT, effort: 'high' }, codeClaudeModel)
 let code = null
 let coderUsed = 'claude'
+let codexCodeText = ''
 if (!codeIsCodexFirst) {
   code = await agent(codePrompt, codeClaudeOpts)
   if (code) { coderUsed = 'claude'; modelsUsed.code = modelLabel(codeClaudeOpts) }
@@ -373,21 +501,24 @@ if (!codeIsCodexFirst) {
 if (code === null && !codeIsCodexFirst) reactiveBelt('Code')
 if (code === null && (codeIsCodexFirst || CODER === 'codex-fallback')) {
   if (CODER === 'codex-fallback' && !codeIsCodexFirst) log('Code: Claude unavailable (limit?) — falling back to Codex ' + CODEX_MODEL)
-  const codeCodexOpts = mergeOpts({ label: 'code:codex', phase: 'Code', agentType: 'codex:codex-rescue' }, codeModel.agentType ? codeModel : {})
-  const codexCode = await agent(codePrompt + CODEX_HINT, codeCodexOpts)
-  if (codexCode) { code = { wrote: [FDIR + '/07_code_changes/change_manifest.md'], summary: String(codexCode).slice(0, 500) }; coderUsed = codeIsCodexFirst ? 'codex' : 'codex-fallback'; modelsUsed.code = modelLabel(codeCodexOpts) }
+  const codeCodexLabelOpts = codeModel.agentType ? codeModel : specToOpts('codex:' + CODEX_MODEL + ':high')
+  const codeCodexOpts = mergeOpts({ label: stageLabel('code:codex', codeCodexLabelOpts), phase: 'Code', agentType: 'codex:codex-rescue' }, codeModel.agentType ? codeModel : {})
+  const codexExpectedTargetsHint = '\n\nBecause this is running on Codex, include a final EXPECTED_CODE_TARGETS: block listing the repo-relative production/test files you expect to create or modify. List only real code/test/config/docs targets outside features/, .dz/, .agentic-qe/, and roam/. Example:\nEXPECTED_CODE_TARGETS:\n- packages/example/src/file.ts\n- packages/example/test/file.test.ts'
+  const codexCode = await agent(codePrompt + CODEX_HINT + codexExpectedTargetsHint, codeCodexOpts)
+  if (codexCode) { codexCodeText = String(codexCode); code = { wrote: [FDIR + '/07_code_changes/change_manifest.md'], summary: codexCodeText.slice(0, 500) }; coderUsed = codeIsCodexFirst ? 'codex' : 'codex-fallback'; modelsUsed.code = modelLabel(codeCodexLabelOpts) }
 }
 
 // Step 7.5: Codex-landed barrier. Codex applies edits OUT-OF-BAND via its own runtime; without this,
-// Step-8 QE reads the tree before the async write flushes and false-grades "Step 7 never ran" (grade D
-// on real, landed code — observed on the goap-ed25519 crypto fix). Poll git status (excluding pipeline
-// artifacts) up to ~30s until real code changes appear, and hand the confirmed file list to QE so it
-// reviews the ACTUAL landed changes. Claude-coded runs are synchronous → this barrier is skipped.
+// Step-8 QE can read the tree before the async write flushes and false-grade "Step 7 never ran" on real
+// completed code. Poll a bounded 120s backing-off window, preferring declared expected code targets when
+// known. Claude-coded runs are synchronous → this barrier is skipped with zero target parsing/probe work.
 let landedNote = ''
-if (coderUsed === 'codex' || coderUsed === 'codex-fallback') {
-  const barrierCmd = 'for i in 1 2 3 4 5 6; do n=$(git -C ' + REPO + ' status --porcelain 2>/dev/null | grep -vE "features/|[.]dz/|[.]agentic-qe/|roam/" | wc -l); [ "$n" -gt 0 ] && break; sleep 5; done; echo "changed=$n"; git -C ' + REPO + ' status --porcelain 2>/dev/null | grep -vE "features/|[.]dz/|[.]agentic-qe/|roam/" | head -40'
-  const probe = await agent('Confirm the Codex Step-7 edits have LANDED in the working tree BEFORE QE runs (Codex writes out-of-band). Run EXACTLY this via Bash and return its stdout verbatim, nothing else:\n' + barrierCmd, { label: 'code:confirm-landed', phase: 'Code' })
-  landedNote = '\n\nCODEX-CODED (out-of-band): review the CONFIRMED landed working-tree changes below — do NOT report "Step 7 never ran" if files are listed. If changed=0 the implementation genuinely did not land, then grade accordingly.\n' + String(probe || '(landed-probe failed)').slice(0, 1500)
+if (needsCodeLandedBarrier(coderUsed)) {
+  const expectedCodeTargets = extractExpectedCodeTargets(A.expectedCodeTargets, codexCodeText)
+  const barrierPlan = codeLandedBarrierPlan(coderUsed, expectedCodeTargets)
+  const barrierCmd = codeLandingProbeCmd(REPO, barrierPlan)
+  const probe = await agent('Confirm the Codex Step-7 edits have LANDED in the working tree BEFORE QE runs (Codex writes out-of-band). Expected-file mode must be satisfied by one of the declared expected paths; unrelated dirty files do not count in that mode. Run EXACTLY this via Bash and return its stdout verbatim, nothing else:\n' + barrierCmd, { label: 'code:confirm-landed', phase: 'Code' })
+  landedNote = '\n\nCODEX-CODED (out-of-band): Step 7.5 landing barrier used mode=' + barrierPlan.mode + ', window=' + barrierPlan.pollWindowSeconds + 's. Review the signal below. If status=landed, read the listed files and do NOT report "Step 7 never ran". Only status=genuinely-not-landed with "' + barrierPlan.emptySignal + '" means the bounded barrier found no intended code after the full window.\nExpected code targets: ' + (barrierPlan.expectedPaths.length ? barrierPlan.expectedPaths.join(', ') : '(none declared; fallback accepts any non-pipeline code change)') + '\n' + String(probe || '(landed-probe failed)').slice(0, 1500)
 }
 
 // Step 8: QE (brutal-honesty, agentic-qe) + MANDATORY teach
@@ -404,7 +535,8 @@ const qeModel = resolveStageModel('qe')
 // the legacy qeReviewer='codex' knob used to re-route QE back to codex even when the CODER was codex.
 if (MODELS.qe === undefined && QE_REVIEWER === 'codex' && coderIsCodex()) log('QE: coder is codex — enforcing cross-model Claude QE (ignoring qeReviewer=codex to avoid self-review)')
 const qeIsCodex = qeShouldUseCodex()
-const qeClaudeOpts = mergeOpts({ label: 'qe:brutal', phase: 'QE', agentType: 'qe-code-reviewer', schema: QE }, qeIsCodex ? {} : qeModel)
+const qeClaudeModel = qeIsCodex ? {} : qeModel
+const qeClaudeOpts = mergeOpts({ label: stageLabel('qe:brutal', qeClaudeModel), phase: 'QE', agentType: 'qe-code-reviewer', schema: QE }, qeClaudeModel)
 let qe = null
 let qeReviewerUsed = 'claude'
 if (!qeIsCodex) {
@@ -414,14 +546,16 @@ if (!qeIsCodex) {
 if (qe === null && !qeIsCodex) reactiveBelt('QE')
 if (qe === null && (qeIsCodex || QE_REVIEWER === 'codex-fallback')) {
   if (QE_REVIEWER === 'codex-fallback' && !qeIsCodex) log('QE: Claude unavailable (limit?) — falling back to Codex ' + CODEX_MODEL)
-  const qeCodexOpts = mergeOpts({ label: 'qe:codex', phase: 'QE', agentType: 'codex:codex-rescue' }, qeModel.agentType ? qeModel : {})
+  const qeCodexLabelOpts = qeModel.agentType ? qeModel : specToOpts('codex:' + CODEX_MODEL + ':high')
+  const qeCodexOpts = mergeOpts({ label: stageLabel('qe:codex', qeCodexLabelOpts), phase: 'QE', agentType: 'codex:codex-rescue' }, qeModel.agentType ? qeModel : {})
   const codexQe = await agent(qePrompt + CODEX_HINT, qeCodexOpts)
-  if (codexQe) { qe = { grade: 'codex-review', gaps: [], codeTestsAdequate: null, docTestsPresent: null, summary: String(codexQe).slice(0, 500) }; qeReviewerUsed = qeIsCodex ? 'codex' : 'codex-fallback'; modelsUsed.qe = modelLabel(qeCodexOpts) }
+  if (codexQe) { qe = { grade: 'codex-review', gaps: [], codeTestsAdequate: null, docTestsPresent: null, summary: String(codexQe).slice(0, 500) }; qeReviewerUsed = qeIsCodex ? 'codex' : 'codex-fallback'; modelsUsed.qe = modelLabel(qeCodexLabelOpts) }
 }
 // Belt: if a codex-first QE returned null (codex unavailable), fall back to a Claude reviewer — never block.
 if (qe === null && qeIsCodex) {
   log('QE: Codex unavailable — falling back to a Claude reviewer (cross-model belt)')
-  const qeBeltOpts = mergeOpts({ label: 'qe:brutal', phase: 'QE', agentType: 'qe-code-reviewer', schema: QE }, routingRequested ? { model: 'opus' } : {})
+  const qeBeltModel = routingRequested ? { model: 'opus' } : {}
+  const qeBeltOpts = mergeOpts({ label: stageLabel('qe:brutal:claude-fb', qeBeltModel), phase: 'QE', agentType: 'qe-code-reviewer', schema: QE }, qeBeltModel)
   qe = await agent(qePrompt, qeBeltOpts)
   if (qe) { qeReviewerUsed = 'claude'; modelsUsed.qe = modelLabel(qeBeltOpts) }
 }
@@ -433,8 +567,8 @@ if (isLplus) {
   await usageProbe('FleetQE')
   const fleetModel = resolveStageModel('fleet')
   modelsUsed.fleet = modelLabel(mergeOpts({}, fleetModel))
-  const fleetTraceOpts = mergeOpts({ label: 'fleet:trace', phase: 'FleetQE', agentType: 'qe-requirements-validator' }, fleetModel)
-  const fleetCovOpts = mergeOpts({ label: 'fleet:cov', phase: 'FleetQE', agentType: 'qe-coverage-specialist' }, fleetModel)
+  const fleetTraceOpts = mergeOpts({ label: stageLabel('fleet:trace', fleetModel), phase: 'FleetQE', agentType: 'qe-requirements-validator' }, fleetModel)
+  const fleetCovOpts = mergeOpts({ label: stageLabel('fleet:cov', fleetModel), phase: 'FleetQE', agentType: 'qe-coverage-specialist' }, fleetModel)
   const fleetThunks = [
     () => agent('Step 9 fleet-QE (requirements traceability + risk) for ' + SLUG + ': map ADR decisions to code to tests; flag orphans + high risk. Write ' + FDIR + '/09_fleet_qe_assessment.md.', fleetTraceOpts),
     () => agent('Step 9 fleet-QE (coverage + regression) for ' + SLUG + ': risk-weighted coverage gaps + regression selection for the changed files. Append to ' + FDIR + '/09_fleet_qe_assessment.md.', fleetCovOpts),