@dzhechkov/skills-feature-adr 1.3.67 → 1.5.0

package/.dz-manifest.json

@@ -5,7 +5,7 @@
     "files": [
       {
         "path": "CHANGELOG.md",
-        "sha256": "e4f50d4f757f877b54c8d25dfc1321776545be4cb814d5f17ee1128ee2320982"
+        "sha256": "59592f0b4612a14bdec61c96c20655644701cd77a0bf9d68315e1c98461900ff"
       },
       {
         "path": "LICENSE",
@@ -13,7 +13,7 @@
       },
       {
         "path": "README.md",
-        "sha256": "1d123dcb15ac44b9adfe8266cb72d2dc69d5086f54003540795296c36e06e1b2"
+        "sha256": "8df52c2c7d7c70ef29670339ac01a6c0b0b6a36bb51a0be15dcc03357097cca8"
       },
       {
         "path": "bin/cli.js",
@@ -25,7 +25,7 @@
       },
       {
         "path": "package.json",
-        "sha256": "31de034ec7534b585ee99a2dac0105bc4e43dca0c5b419076e66c43e797509d3"
+        "sha256": "0fc1ae047774c2c67c6acf77a88eef8c9532c609bfc68b9e9cb37591cb61158f"
       },
       {
         "path": "scripts/sync-templates.js",
@@ -157,7 +157,7 @@
       },
       {
         "path": "templates/.claude/skills/feature-adr/modules/06-implementation-plan.md",
-        "sha256": "c8fdd1877d8d9515ab29f52c3db49ddd9612b5797bc071e6208def860c02e6f2"
+        "sha256": "3903e2694ad47782914b35869bbf19c5f0803b6dafdcfb629df343a5ff00d1b9"
       },
       {
         "path": "templates/.claude/skills/feature-adr/modules/07-code.md",
@@ -257,7 +257,7 @@
       },
       {
         "path": "templates/.claude/skills/feature-adr/scripts/check-plan-completeness.mjs",
-        "sha256": "41d85b012a9d6cc172eaa5d7777294f2c01fb54b752ed61c7cbe2d2cd7b79b67"
+        "sha256": "2e1afeb8cbc08ce872fc8280a0809e7712ee76879d08b48caa5a0d4082cb8647"
       },
       {
         "path": "templates/.claude/skills/frontend-design/LICENSE.txt",
@@ -321,7 +321,7 @@
       },
       {
         "path": "templates/.claude/workflows/feature-adr.js",
-        "sha256": "d9cda8df501188c894d083c5c44c240c9ebe9ba7e2d418302c448d73b089e051"
+        "sha256": "3c8838c6a5107ea8a4b909cd9ccfa4d416324bb4ed9341f50b8e23f1b569d244"
       },
       {
         "path": "templates/lib/memory-protocol.md",
@@ -349,5 +349,5 @@
       }
     ]
   },
-  "signature": "ZnkOOhYGfaIEp1W5L/Gphs0uniT0FieL/yn5KPl6cZ3zQeXkZcqDjfOta9b6zmPEgztZAclspZ0yf82VnjeHBQ=="
+  "signature": "8JbfbAiP55HvylGRoFfLwEtYCoo02jM9PwfOcTiYWQXfN/Utcg+Wc7uFo08yfqPUyONXsMCcEfqB7Y5eKWIvDg=="
 }

package/CHANGELOG.md

@@ -1,5 +1,162 @@
 # Changelog
 
+## [1.5.0] - 2026-08-21
+
+### Changed — feature `qe-scoped-review`
+
+### Changed — Step-8 Codex QE is SCOPED, and every fallback names its cause
+
+Not published. Behaviour change to the Step-8 QE dispatch only; routing, the Claude belt, checkpoints
+and training-pair capture are untouched.
+
+- **The measurement that forced it** (same question, same model `gpt-5.6-sol` at effort `high`,
+  2026-08-21): an UNSCOPED `codex exec` QE prompt of 19 038 chars spent 280 s, exited 124 and produced
+  416 KB of exploration with NO verdict — and did it again under a 1500 s ceiling. The same question
+  scoped to two named files answered in 41 s with `Grade: B`; `codex review --commit` answered in
+  146 s with the scope derived from the diff. The budget went on RECONNAISSANCE, so raising the
+  timeout buys more of it, and the prompt ceiling was never the binding constraint (19 038 < 24 000,
+  with ~5 000 chars of headroom). The harm was not the minutes: on timeout the dispatch returns null,
+  the belt runs a Claude reviewer, and cross-family QE is lost SILENTLY on exactly the large features
+  that need it most.
+- **Mode A — `codex review`** is now the primary Step-8 Codex pass; the diff defines the scope.
+  Default `--uncommitted`, overridable with `args.qeScope` / `args.qeScopeRef`. The builder can never
+  emit `-m` and never appends a positional prompt: MEASURED, `codex review` rejects `-m` with exit 2,
+  and EVERY scope flag (`--commit`, `--base`, `--uncommitted`) rejects `[PROMPT]` with exit 2. Either
+  mistake would present as a review that silently did not happen.
+- **Mode B — a NARROWED `codex exec`** carries our own questions over at most 3 named files and ends
+  with `Grade: <A|B|C|D>`. An unscoped mode-B dispatch is not constructible: an empty file list yields
+  `''`, and `codexExecPlan` now refuses an unscoped `qe` prompt outright.
+- **A locked decline taxonomy** — `timeout | no-verdict | tool-error | unusable-output | unavailable |
+  over-ceiling` — replaces the single generic reason. A timeout ("narrow the scope") and a broken
+  invocation ("fix the command") can no longer render the same string inside
+  `opus (cross-family QE DID NOT happen — …)`. An unknown kind throws rather than rendering something
+  plausible.
+- **A machine sentinel** (`CODEX-QE-SIGNAL exit=… elapsed=…s bytes=…`, the Step-7.5 landing-signal
+  grammar) carries the exit code past the shell agent, so a timeout is knowable without asking a model
+  to self-report its own failure. A MISSING sentinel is classified `tool-error` on the pipeline path —
+  never a pass.
+- **Zero findings is never an `A`.** Mode A cannot be asked for a letter, so its grade is derived from
+  the severities the reviewer reported and labelled `gradeSource: 'derived-from-findings'`; an empty or
+  unparseable finding set yields `null` and declines. MEASURED: `codex review` on a clean tree exits 0
+  with a well-formed, entirely empty review — the exact input that a default letter would have turned
+  into a clean bill of health.
+- **`qe` now returns `gaps` from the reviewer's actual findings**, plus `gradeSource` and
+  `qeScope {mode, ref, files}`; the review scope enters the `qe` checkpoint hash so a resume cannot
+  present a mode-B verdict as a mode-A one.
+- **`CODEX_EXEC_PROMPT_CEILING_CHARS` is retained but DEMOTED** — it is a sanity bound on an absurd
+  payload, and is no longer documented as the thing that prevents a stall. The defence is scope.
+- **Unchanged on purpose:** `resolveQeSpec` / `coderIsCodex` / `qeShouldUseCodex` (verified correct by
+  direct call), the `crossFamilyQe` label format, and the Claude belt — the pipeline still never blocks
+  on Codex.
+
+### Fixed — the K2 plan gate could not complete a run on a non-JS repository
+
+- **C2 recognises test paths in every ecosystem.** The gate demanded a `.test.(ts|mjs|js)` suffix, so
+  a Python/Go/Rust/JVM/.NET feature could never satisfy it (measured: 4/4 JS forms matched, 0/11
+  non-JS). Replaced by a two-stage predicate — a language-neutral candidate-path extractor plus one
+  `$`-anchored rule per ecosystem (JS/TS, pytest `test_*.py` + `*_test.py`, Go, Rust `tests/*.rs` +
+  `tests.rs`, JVM, .NET). Widening it to "contains the word test" was rejected: `docs/testing.md`,
+  `src/latest.rs` and prose are still refused. An unknown ecosystem stays a FAIL, never a WARN.
+- **New opt-in `testPathRules`** in the existing `architecture/project-skills.json`: additive rules,
+  each anchored by wrapping so an alternation cannot leak, capped at 200 characters, and FATAL when
+  malformed (`NOT-ESTABLISHED`, exit 3) rather than silently falling back to the built-ins.
+- **The gate script is resolved from the WORKSPACE first.** The command `cd`s into the target repo,
+  so the repo-relative path died with `Cannot find module` on any repo without its own feature-adr
+  install. Order: `args.gateScript` (new, absolute, validated) → workspace copy → repo copy, with
+  `K2_GATE_SCRIPT=` / `K2_GATE_TRIED=` echoed for audit. Nothing found ⇒ reason `tooling-missing`
+  (a NOT-ESTABLISHED, never a skip), and the operator note now says the gate could not be RUN and
+  that this is not a plan defect — it no longer tells you to fix a plan that is fine.
+- **A relative `args.dzBin` is pinned to the workspace root once**, before any `cd`, so the six
+  commands that splice it stop resolving against three different bases (a null usage probe was being
+  read upstream as "the Claude limit was hit").
+
+### Changed — `EXPECTED_CODE_TARGETS` admissibility (C3)
+
+- Dotfile targets (`.claude/…`, `.github/workflows/ci.yml`, `.gitignore`, `.env.example`) are
+  admissible — previously feature-adr could not name its own files or any CI config, in any language.
+- Directory-shaped targets are now REJECTED (`trailing slash — names a directory, not a file`): a bare
+  directory gives plan-vs-diff matching nothing concrete to verify.
+- Every refusal names its own defect instead of one catch-all: `path traversal ('..' segment)`,
+  `degenerate path segment`, `empty path segment`, `path segment ends with '.'`,
+  `illegal character '<c>'`, `empty stem after the leading dot`. The traversal check is a SEGMENT
+  test now, so the ordinary filename `foo..bar.ts` is no longer called a path traversal.
+
+### Requires
+
+- Nothing new at runtime: the workflow INLINES the gate command builder and its parser (the sandbox
+  cannot import), so this release is self-contained. The pure halves it mirrors live in
+  `@dzhechkov/harness-core` (`planCompletenessGateCmd` gained an optional 4th argument;
+  `refusalNoteFor` and `normalizeDzBin` are new) and a drift test pins the two copies together.
+
+
+### Fixed — Step 0 wrote nothing down, so the tier was unreadable and the acid check had no input
+
+- **Step 0 now WRITES `00_complexity_assessment.md`** before returning: the tier with its decisive
+  criterion, the active steps, the recalled patterns, and an acid-case table whose rows are pinned to
+  the exact `| A<n> | <bad input> | <what must happen> |` shape the K2 gate parses. MEASURED
+  2026-08-21: 66 of 199 features carried that file and the last four in a row did not. Two silent
+  consequences — the tier was recorded NOWHERE while a run was alive (the checkpoint lands at phase
+  end, the result object only at the very end), and the C4 acid check quietly switched itself off,
+  including for the features that introduced it. An honest no-acid-cases run still writes prose and
+  no table; the gate now tells an ABSENT file from a deliberate skip.
+- **A caller-forced tier is the tier of record.** `tier = args.tier || router.tier` means the run
+  executes the override while Step 0 wrote down its own classification. The artifact now carries
+  `Effective tier: <forced> (forced by the caller)` alongside the router's own recommendation, and
+  sizes the acid table for the effective tier. With no override the prompt is byte-identical.
+- **A pre-contract router checkpoint no longer resumes into the new contract** — the resume gate only
+  asks whether the artifact is PRESENT, and any of the 66 features with a tableless file satisfied it.
+
+### Fixed — the Step-8 QE stage measured the wrong thing in four different ways
+
+- the change set is the run's DELTA (pre-code baseline vs after), not the working tree's current dirt;
+- a finding whose location cannot be parsed is `unlocatable` and stays in the graded set — it used to
+  be filed as someone else's dirt, i.e. unknown counted as clean;
+- mode B refuses a scope built from unlanded code, an unmeasured change set or an empty intersection;
+- the QE scribe is WITNESSED: the report is re-hashed before and after, so an existing file from an
+  earlier run can no longer stand in for one this run never wrote.
+
+### Fixed — durable state is written by a command, not by hand
+
+- checkpoint lines now go through `dz feature-adr-checkpoint`. The subagent RUNS a command instead of
+  hand-writing state into a file: a security classifier blocked NINE consecutive checkpoint writes in
+  one run, `.fa-state/checkpoints.jsonl` was never created, resume was silently dead, and the run
+  reported success.
+
+## [1.4.0] - 2026-08-20
+
+### Changed — the composite design checkpoint
+
+- The Step 1–5 design fan is checkpointed **per sibling** instead of as one composite entry, so one
+  dead agent no longer discards three finished siblings. Each sibling's resume key carries its own
+  steering inputs, including its prompt text: fixing one step's instructions invalidates that step
+  and nothing else.
+- An incomplete fan is **refused** at the Step-5/6 boundary (`phase: 'design-incomplete'`) instead of
+  being handed to the planner. Previously the completeness verdict was computed and only logged, and
+  Step 6 planned off a null design. The refusal captures training pairs and appends a cost-ledger row
+  on the way out, so a stopped run is neither silent nor invisible to cost analysis.
+- Three named reasons with distinct repairs — `substage-missing`, `artifact-missing`,
+  `probe-not-established`. Under `resume:'force'` the artifact-missing repair says `resume:'never'`,
+  because force skips artifact probes and a plain re-invoke would loop forever.
+- The artifact check no longer lists a directory: it runs `[ -f <exact path> ]` per required
+  artifact. A listing is a list of filenames, and a file whose NAME ends in a newline was measured
+  satisfying the requirement for the real file.
+- The probe transcript is validated strictly rather than scanned. It is relayed by an agent, not read
+  from a pipe, and an agent that narrates the expected output emits the token byte-identically —
+  which produced a false pass on a missing artifact before this release. Inconclusive is never a pass.
+
+### Requires
+
+- `@dzhechkov/harness-core >= 0.5.4`. The checkpoint schema is now `fa-ckpt-3`: every existing
+  `.fa-state/checkpoints.jsonl` reads as no checkpoint, so each in-flight feature re-runs
+  router+design+plan once.
+
+### Verification
+
+Eight cross-family review rounds (Codex `gpt-5.6-sol` at xhigh, each pinned to a sha256 of the
+reviewed files): D → D → D → B → C → C → D → **A**, the last with no new defects. Full ladder in
+`features/feature-adr-hardening/composite-design-checkpoint.md`.
+
+
 ### Follow-up (QE LOW gaps closed before publish)
 - **Upstream deletions**: `update` now removes files the template dropped (manifest-tracked orphans only; user-created untracked files are never touched) — previously `diff.missing` was computed but ignored. Shown in the summary + `--dry-run` (`- DEL`). Tests: Case G/H.
 - Removed a dead `unchanged` branch in the directory update path (unreachable — `diff.modified` guarantees bytes differ).

package/README.md

@@ -106,6 +106,138 @@ ARCHITECTURE → IMPLEMENTATION →  CODE   →   QE    →  FLEET QE
 # Full protocols + 6 extra skills, up to 7 fleet QE agents
 ```
 
+### The K2 plan gate runs on ANY repo, not just JS/TS ones (v1.5.0)
+
+Between Step 6 and Step 7 the pipeline runs a machine plan-completeness gate (K2). Until v1.5.0 it
+could not finish a run on a non-JS repository — three separate defects, all closed here.
+
+**1. Test paths in every ecosystem.** C2 checks that each ADR's Confirmation names a test file and
+that the plan names the same path. It used to demand a `.test.(ts|mjs|js)` suffix, so on a Python,
+Go, Rust, JVM or .NET repo it found nothing and failed the plan (measured: 4/4 JS forms matched,
+0/11 non-JS forms did). It now uses a two-stage predicate — candidate paths are extracted from the
+Confirmation text, then matched against one anchored rule per ecosystem:
+
+| Ecosystem | Recognised |
+|---|---|
+| JS/TS | `*.test.*` / `*.spec.*` (`ts tsx mts cts mjs cjs js jsx`) |
+| pytest | `test_*.py` **and** `*_test.py` |
+| Go | `*_test.go` |
+| Rust | `tests/*.rs` **and** `tests.rs` |
+| JVM | `*Test|Tests|IT|Spec.(java kt kts scala groovy)` |
+| .NET | `*Test|Tests.(cs fs vb)` |
+
+Deliberately NOT "any path containing the word test": `docs/testing.md`, `src/latest.rs`,
+`contests/results.py` and a sentence like *"the staleness test will verify this"* are all refused. A
+gate that passes prose is worse than one that fails Python. An unknown ecosystem is still a FAIL,
+never a warning — the message names the recognised set and points at the override below.
+
+**Extending the vocabulary — `testPathRules`.** Add rules to the manifest the pipeline already
+reads, `architecture/project-skills.json` (no second dotfile):
+
+```json
+{
+  "testPathRules": [
+    { "ecosystem": "elixir", "pattern": "(?:^|/)test/[^/]+_test\\.exs" }
+  ]
+}
+```
+
+Rules are ADDED to the built-ins, never replace them, and each pattern is anchored by wrapping
+(`(?:<pattern>)$`) so every branch of an alternation is anchored. A malformed `testPathRules`
+(bad JSON, not an array, missing `ecosystem`/`pattern`, an invalid regex, over 200 characters, or a
+nested quantifier) is **NOT-ESTABLISHED, exit 3** — never a quiet fall-back to the built-ins.
+
+**2. The gate script is found where it is installed — `args.gateScript`.** The skill lives in your
+WORKSPACE; the gate command `cd`s into the TARGET repo, so a repo-relative lookup died with
+`Cannot find module` on every repo that is not itself a feature-adr install. The resolution order is
+now:
+
+1. `args.gateScript` — an explicit ABSOLUTE path (validated: absolute, no `..`, or the run fails loudly);
+2. the WORKSPACE copy (`$WS/.claude/skills/feature-adr/scripts/check-plan-completeness.mjs`);
+3. the target-repo copy.
+
+Workspace before repo on purpose: the verdict contract is defined by the parser inside the running
+workflow, so only that installation's own copy is known to speak it. Every run echoes
+`K2_GATE_SCRIPT=` (which copy ran) and `K2_GATE_TRIED=` (all candidates) for audit. If none exists
+the run refuses with reason `tooling-missing` — a NOT-ESTABLISHED, never a skip — and the operator
+message says the gate could not be RUN and that this is **not** a plan defect.
+
+**3. Dotfile targets are admissible; directory-shaped ones are not.** `EXPECTED_CODE_TARGETS` may
+now name `.claude/…`, `.github/workflows/ci.yml`, `.gitignore`, `.env.example`. What is refused is
+refused BY NAME: `path traversal ('..' segment)`, `degenerate path segment`, `empty path segment`,
+`trailing slash — names a directory, not a file`, `path segment ends with '.'`,
+`illegal character '<c>'`, `empty stem after the leading dot`. The old substring traversal test also
+rejected the ordinary filename `foo..bar.ts`; it is a segment test now.
+
+### Step 0 writes the assessment down, and the acid check gets its input back (v1.5.0)
+
+Step 0 classifies the feature and now **writes `00_complexity_assessment.md` before it returns** — the
+tier with the criterion that decided it, the active steps, the recalled patterns, and an acid-case
+table. MEASURED 2026-08-21: 66 of 199 features carried that file and the last four in a row did not,
+with two silent consequences. The tier was recorded NOWHERE while a run was alive (the router
+checkpoint lands at phase end and the result object only at the very end), so mid-run it had to be
+guessed from which artifacts happened to exist. And the K2 gate reads its acid corpus from that file,
+so the C4 check quietly switched itself off — including for the features that introduced it.
+
+Acid rows are pinned to the exact shape the gate parses, `| A<n> | <the bad input> | <what must
+happen> |`; a loose shape disables the check just as silently as a missing file. A feature with no
+acid cases still says so in prose and writes no table — the gate now tells an ABSENT file (a warning
+that names the missing artifact) from a deliberate skip.
+
+Two ways the tier could still go unrecorded, both closed here:
+
+- a **pre-contract router checkpoint** used to resume into the new contract. The resume gate only asks
+  whether the artifact is PRESENT, and any of the 66 features carrying a tableless file satisfied it,
+  so Step 0 never re-ran. A router-scoped hash token now makes those entries re-run — once, and only
+  the router, rather than every in-flight stage.
+- a **caller-forced `args.tier`** is now the tier of record. The run executes the override, so the
+  file carries `Effective tier: <forced> (forced by the caller)` alongside the router's own
+  recommendation, and sizes the acid table for the effective tier. With no override the prompt is
+  byte-identical to before.
+
+Requires `@dzhechkov/harness-core >= 0.6.0`.
+
+### The Step-8 QE stage measures the run, not the room (v1.5.0)
+
+Four separate ways the QE stage graded the wrong thing, all closed: the change set is this run's DELTA
+(a pre-code baseline against the state after) instead of the working tree's current dirt, so an
+unrelated dirty file can no longer grade your feature; a finding whose location cannot be parsed is
+`unlocatable` and stays in the graded set, where it used to be filed as someone else's dirt — unknown
+counted as clean, inside the function whose job is honest attribution; mode B refuses a scope built
+from unlanded code, an unmeasured change set, or an empty intersection; and the QE scribe is
+WITNESSED — the report is re-hashed before and after, so a file left by an earlier run can no longer
+stand in for one this run never wrote.
+
+### The design fan resumes per sibling, and an incomplete design is REFUSED (v1.4.0)
+
+Step 1–5 run as one parallel fan — requirements, ADR, QCSD, architecture. Until v1.4.0 the whole fan
+was ONE checkpoint entry, so a single dead agent discarded three finished siblings and the next
+invocation paid for all four again. Each sibling is now checkpointed on its own
+(`design:requirements` / `design:adr` / `design:qcsd` / `design:architecture`), keyed on what steers
+**it** — its own prompt text included, so correcting one step's instructions re-runs that step and
+leaves the others alone.
+
+The other half is what the pipeline is allowed to CONSUME. An incomplete fan no longer flows into
+Step 6: the run stops at the Step-5/6 boundary and returns `phase: 'design-incomplete'` rather than
+producing a plan with no ADR behind it. Three distinct reasons, each with its own repair:
+
+| Reason | What happened | Repair printed |
+|---|---|---|
+| `substage-missing` | a sibling agent died (often a Claude limit) | re-invoke — the finished siblings resume free; or route that stage to Codex |
+| `artifact-missing` | every sibling reported success, but a required file is not on disk | under `resume:'force'` it says use `resume:'never'` — force skips artifact probes, so re-invoking would loop |
+| `probe-not-established` | the check could not be trusted at all | inconclusive is never a pass — refuse, then re-run |
+
+The artifact check never lists a directory. It asks `[ -f <exact path> ]` per required artifact,
+because a listing is a list of filenames and the data can impersonate the frame: measured, a file
+whose NAME ends in a newline satisfied the requirement for the real file. And since the check is
+relayed by an agent rather than read from a pipe, the whole transcript is validated — an agent that
+merely *narrates* the expected output emits the token byte-identically, and that produced a false
+pass before this release.
+
+Requires `@dzhechkov/harness-core >= 0.5.4`. **One-time cost:** the checkpoint schema moved to
+`fa-ckpt-3`, so every existing `.fa-state/checkpoints.jsonl` reads as no checkpoint and each
+in-flight feature re-runs router+design+plan once.
+
 ### Durable checkpoints + resume (v1.3.64)
 
 Every expensive stage (router / design / plan / code / qe / fleet) checkpoints its result into
@@ -207,6 +339,49 @@ family than the coder** — a model that writes code must not also self-QE; inde
 catches what self-review misses. coder=Codex ⇒ QE=Claude (`opus`); coder=Claude ⇒ QE=Codex
 (`codex:<top>:high`), or a Claude reviewer if Codex is unavailable (never blocks).
 
+### Step 8 on Codex is SCOPED — two modes, and every fallback names its cause
+
+When QE routes to Codex, Step 8 no longer hands it one unscoped `codex exec` prompt. Why, MEASURED
+2026-08-21 — same question, same model (`gpt-5.6-sol`, effort `high`), three dispatches:
+
+| dispatch | prompt | wall time | exit | verdict? |
+|---|---|---|---|---|
+| `codex exec`, unscoped | 19 038 chars | 280 s (and again under a 1500 s ceiling) | 124 | **none** — 416 KB of exploration |
+| `codex exec`, scoped (*"read ONLY these two files"*) | 1 461 chars | 41 s | 0 | `Grade: B` + findings |
+| `codex review --commit <SHA>` | scope from the diff | 146 s | 0 | verdict + findings |
+
+The unscoped run spent its budget on **reconnaissance of the tree**, not on reasoning about the change.
+So raising the timeout does not help, and the prompt-length ceiling was never the binding constraint
+(19 038 sat under `CODEX_EXEC_PROMPT_CEILING_CHARS` = 24 000 with ~5 000 to spare). The cost is not the
+wasted minutes: on timeout the dispatch returns `null`, the belt runs a Claude reviewer, and
+cross-family QE is silently lost — on exactly the big features that need it most.
+
+- **Mode A (primary): `codex review`.** The scope comes from the DIFF, so Codex computes for free the
+  thing we were paying a model to do badly. Default scope `--uncommitted`; override with
+  `args.qeScope: 'commit' | 'base'` + `args.qeScopeRef`. Two CLI facts are encoded as refusals, both
+  measured: `codex review` rejects `-m` (exit 2 — the model goes through `-c model=`), and **every**
+  scope flag rejects a positional prompt (`--commit`, `--base` and `--uncommitted` alike, exit 2). So
+  mode A runs on Codex's built-in review instructions and cannot be asked our questions.
+- **Mode B (follow-up): a NARROWED `codex exec`.** Carries our own questions over at most 3 named
+  files with the load-bearing clause *"read ONLY these files, do not explore the repository"*, and
+  ends with `Grade: <A|B|C|D>`. An unscoped mode-B prompt is not constructible: an empty file list
+  returns `''` and `codexExecPlan` refuses an unscoped `qe` prompt outright.
+- **The verdict is parsed, never synthesised.** A `Grade: D` is a SUCCESSFUL cross-family review; a
+  review with no grade is a FAILED one. Mode A cannot state a letter, so its grade is DERIVED from the
+  severities it reported and labelled `gradeSource: 'derived-from-findings'` — and **zero findings
+  yields `null`, never `A`** (measured: `codex review` on a clean tree exits 0 with a polite, entirely
+  empty review; calling that an `A` would be a review of nothing reported as a pass).
+- **Every fallback names its cause.** The reason carried into
+  `opus (cross-family QE DID NOT happen — …)` comes from a locked taxonomy —
+  `timeout` (narrow the scope) · `no-verdict` · `tool-error` (fix the invocation) · `unusable-output` ·
+  `unavailable` (fix the account/model) · `over-ceiling`. A timeout and an unusable output can never
+  render the same string, because the operator's next move differs.
+- **The pipeline still never blocks on Codex.** Both modes fail into the same Claude belt as before.
+
+After a Codex verdict a cheap Claude agent transcribes it into `08_qe_report.md` (mode A takes no
+prompt, so the reviewer cannot be asked to write anything). It is a scribe, not a second reviewer: the
+grade is Codex's and is stated as final.
+
 **Precedence:** `args.models[stage]` wins; the legacy `planner`/`coder`/`qeReviewer`/`codexModel` knobs
 fill only unspecified stages. `codexModel` seeds the id for a bare `'codex'` spec. gpt-5.6-ready: a new
 Codex id is a data-only allowlist edit.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dzhechkov/skills-feature-adr",
-  "version": "1.3.67",
+  "version": "1.5.0",
   "description": "Adaptive Feature Development skill pack for Claude Code — 11-step pipeline with Complexity Router (S/M/L/XL), ADR-driven architecture, 15 agentic-qe skills, multi-agent fleet QE. Supports --full-qe, --full-qe-extended, --with-learning, and --knowledge-extractor modes.",
   "bin": {
     "skills-feature-adr": "./bin/cli.js"

package/sbom.json

@@ -15,7 +15,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "e4f50d4f757f877b54c8d25dfc1321776545be4cb814d5f17ee1128ee2320982"
+          "content": "59592f0b4612a14bdec61c96c20655644701cd77a0bf9d68315e1c98461900ff"
         }
       ]
     },
@@ -35,7 +35,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "1d123dcb15ac44b9adfe8266cb72d2dc69d5086f54003540795296c36e06e1b2"
+          "content": "8df52c2c7d7c70ef29670339ac01a6c0b0b6a36bb51a0be15dcc03357097cca8"
         }
       ]
     },
@@ -65,7 +65,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "31de034ec7534b585ee99a2dac0105bc4e43dca0c5b419076e66c43e797509d3"
+          "content": "0fc1ae047774c2c67c6acf77a88eef8c9532c609bfc68b9e9cb37591cb61158f"
         }
       ]
     },
@@ -395,7 +395,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "c8fdd1877d8d9515ab29f52c3db49ddd9612b5797bc071e6208def860c02e6f2"
+          "content": "3903e2694ad47782914b35869bbf19c5f0803b6dafdcfb629df343a5ff00d1b9"
         }
       ]
     },
@@ -645,7 +645,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "41d85b012a9d6cc172eaa5d7777294f2c01fb54b752ed61c7cbe2d2cd7b79b67"
+          "content": "2e1afeb8cbc08ce872fc8280a0809e7712ee76879d08b48caa5a0d4082cb8647"
         }
       ]
     },
@@ -805,7 +805,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "d9cda8df501188c894d083c5c44c240c9ebe9ba7e2d418302c448d73b089e051"
+          "content": "3c8838c6a5107ea8a4b909cd9ccfa4d416324bb4ed9341f50b8e23f1b569d244"
         }
       ]
     },

package/templates/.claude/skills/feature-adr/modules/06-implementation-plan.md

@@ -198,6 +198,13 @@ After the plan is written, run the gate. It is a script, not a judgement call:
 node .claude/skills/feature-adr/scripts/check-plan-completeness.mjs features/<slug>
 ```
 
+The path above is relative to the workspace the skill is INSTALLED in. Working inside a target repo
+that has no feature-adr install of its own? Pass the absolute path to the script instead — the
+ultracode workflow does this for you (it tries `args.gateScript`, then the workspace copy, then the
+target-repo copy, and refuses with `tooling-missing` if none exists). The gate is language-neutral:
+C2 recognises JS/TS, pytest, Go, Rust, JVM and .NET test paths, extensible per project with
+`testPathRules` in `architecture/project-skills.json`.
+
 | Exit | Verdict | What you do |
 |------|---------|-------------|
 | `0` | PASS | proceed to Step 7 |