@dzhechkov/skills-feature-adr 1.4.0 → 1.5.1

package/.dz-manifest.json

@@ -5,7 +5,7 @@
     "files": [
       {
         "path": "CHANGELOG.md",
-        "sha256": "bbb43101a686369a8662f47fe7b7aa75073b614a188c2752cd81d9570620bb3d"
+        "sha256": "88e0389016f697b90731ee8743a35e523f0ccb079426d59861d894f33e516392"
       },
       {
         "path": "LICENSE",
@@ -13,7 +13,7 @@
       },
       {
         "path": "README.md",
-        "sha256": "469873d967c4438afd0b25ec8b013347841e07328f508f6786f90cc6aa2f09b9"
+        "sha256": "47f9402d4c3954d6d5a75ad906ec7b592010fdfd80f347d4a87dd14dd9e300ce"
       },
       {
         "path": "bin/cli.js",
@@ -25,7 +25,7 @@
       },
       {
         "path": "package.json",
-        "sha256": "c1e4d257167fd2462e0c8e09f248fc1aef332aa34fb09dddd5940bdcc30ea34b"
+        "sha256": "3fbe9ef86c9f6fa7c86bbe7760729094e80edb67577e397678b2d98dca1c2034"
       },
       {
         "path": "scripts/sync-templates.js",
@@ -157,7 +157,7 @@
       },
       {
         "path": "templates/.claude/skills/feature-adr/modules/06-implementation-plan.md",
-        "sha256": "c8fdd1877d8d9515ab29f52c3db49ddd9612b5797bc071e6208def860c02e6f2"
+        "sha256": "3903e2694ad47782914b35869bbf19c5f0803b6dafdcfb629df343a5ff00d1b9"
       },
       {
         "path": "templates/.claude/skills/feature-adr/modules/07-code.md",
@@ -165,7 +165,7 @@
       },
       {
         "path": "templates/.claude/skills/feature-adr/modules/08-qe.md",
-        "sha256": "97e9a7bc54f196b381c4ef71258cddcb2fb48f216df1ba015927c176bad57084"
+        "sha256": "bd5b5809142c12fa1378de446b68027a0c342a7a91ad17e4fb3395ca8f6a8508"
       },
       {
         "path": "templates/.claude/skills/feature-adr/modules/09-fleet-qe.md",
@@ -257,7 +257,7 @@
       },
       {
         "path": "templates/.claude/skills/feature-adr/scripts/check-plan-completeness.mjs",
-        "sha256": "41d85b012a9d6cc172eaa5d7777294f2c01fb54b752ed61c7cbe2d2cd7b79b67"
+        "sha256": "2e1afeb8cbc08ce872fc8280a0809e7712ee76879d08b48caa5a0d4082cb8647"
       },
       {
         "path": "templates/.claude/skills/frontend-design/LICENSE.txt",
@@ -321,7 +321,7 @@
       },
       {
         "path": "templates/.claude/workflows/feature-adr.js",
-        "sha256": "1be239d2f02612bc33027767d9930eae8a2d6d5afd427d1485198bbdd821a3c7"
+        "sha256": "0c74e8995d82bb986ef3233e91beebfa0e761aae4434f24554077bb05d2199e9"
       },
       {
         "path": "templates/lib/memory-protocol.md",
@@ -349,5 +349,5 @@
       }
     ]
   },
-  "signature": "gixeRY/3+gjSSS3a+DfVwn40SVlD9Gr2sCh3H8afGWd1+Dzo8R8CmD61qG0cLeDdHn2NgzRWwvICHe+0HFlYCA=="
+  "signature": "9WVoqK2D8eKSnmhhMqHPt31NedxwZCHiHyxJ5VLMxSVMecMqyXgrCJ2GQ3OOfIeiquB2D01bh7QjZW/EMVM9Aw=="
 }

package/CHANGELOG.md

@@ -1,5 +1,145 @@
 # Changelog
 
+## [1.5.1] - 2026-08-21
+
+### Changed — the Step-8 amendment gate is a COMMAND, and the durable writers are witnessed
+
+- `AMENDMENT_GATE` no longer asks the QE agent to judge whether every `AM-N` row names a real test.
+  It runs `dz amendment-check --slug <slug> --json` and reports the parsed verdict; the old judgement
+  wording is REMOVED from both workflow copies and all four `modules/08-qe.md` copies, not
+  accompanied. MEASURED 2026-08-21: `features/qe-scoped-review` shipped with five named amendment
+  test ids of which none existed, while its plan recorded `## Amendments: None`.
+- the run-cost ledger and the training-pair capture (including backfill) stop handing a subagent a
+  pre-baked shell string carrying their payload — the shape a security classifier blocked nine times
+  in one run. Both now call `dz feature-adr-record`. The `sed` that rewrote `"date":null` / `"ts":null`
+  inside an already-serialised document is gone: the command stamps before serialising.
+- a record failure still NEVER fails the run, but now survives it: `recordFailures` is returned from
+  every exit instead of scrolling past inside one log line.
+
+Requires `@dzhechkov/harness-core >= 0.6.1`.
+
+## [1.5.0] - 2026-08-21
+
+### Changed — feature `qe-scoped-review`
+
+### Changed — Step-8 Codex QE is SCOPED, and every fallback names its cause
+
+Not published. Behaviour change to the Step-8 QE dispatch only; routing, the Claude belt, checkpoints
+and training-pair capture are untouched.
+
+- **The measurement that forced it** (same question, same model `gpt-5.6-sol` at effort `high`,
+  2026-08-21): an UNSCOPED `codex exec` QE prompt of 19 038 chars spent 280 s, exited 124 and produced
+  416 KB of exploration with NO verdict — and did it again under a 1500 s ceiling. The same question
+  scoped to two named files answered in 41 s with `Grade: B`; `codex review --commit` answered in
+  146 s with the scope derived from the diff. The budget went on RECONNAISSANCE, so raising the
+  timeout buys more of it, and the prompt ceiling was never the binding constraint (19 038 < 24 000,
+  with ~5 000 chars of headroom). The harm was not the minutes: on timeout the dispatch returns null,
+  the belt runs a Claude reviewer, and cross-family QE is lost SILENTLY on exactly the large features
+  that need it most.
+- **Mode A — `codex review`** is now the primary Step-8 Codex pass; the diff defines the scope.
+  Default `--uncommitted`, overridable with `args.qeScope` / `args.qeScopeRef`. The builder can never
+  emit `-m` and never appends a positional prompt: MEASURED, `codex review` rejects `-m` with exit 2,
+  and EVERY scope flag (`--commit`, `--base`, `--uncommitted`) rejects `[PROMPT]` with exit 2. Either
+  mistake would present as a review that silently did not happen.
+- **Mode B — a NARROWED `codex exec`** carries our own questions over at most 3 named files and ends
+  with `Grade: <A|B|C|D>`. An unscoped mode-B dispatch is not constructible: an empty file list yields
+  `''`, and `codexExecPlan` now refuses an unscoped `qe` prompt outright.
+- **A locked decline taxonomy** — `timeout | no-verdict | tool-error | unusable-output | unavailable |
+  over-ceiling` — replaces the single generic reason. A timeout ("narrow the scope") and a broken
+  invocation ("fix the command") can no longer render the same string inside
+  `opus (cross-family QE DID NOT happen — …)`. An unknown kind throws rather than rendering something
+  plausible.
+- **A machine sentinel** (`CODEX-QE-SIGNAL exit=… elapsed=…s bytes=…`, the Step-7.5 landing-signal
+  grammar) carries the exit code past the shell agent, so a timeout is knowable without asking a model
+  to self-report its own failure. A MISSING sentinel is classified `tool-error` on the pipeline path —
+  never a pass.
+- **Zero findings is never an `A`.** Mode A cannot be asked for a letter, so its grade is derived from
+  the severities the reviewer reported and labelled `gradeSource: 'derived-from-findings'`; an empty or
+  unparseable finding set yields `null` and declines. MEASURED: `codex review` on a clean tree exits 0
+  with a well-formed, entirely empty review — the exact input that a default letter would have turned
+  into a clean bill of health.
+- **`qe` now returns `gaps` from the reviewer's actual findings**, plus `gradeSource` and
+  `qeScope {mode, ref, files}`; the review scope enters the `qe` checkpoint hash so a resume cannot
+  present a mode-B verdict as a mode-A one.
+- **`CODEX_EXEC_PROMPT_CEILING_CHARS` is retained but DEMOTED** — it is a sanity bound on an absurd
+  payload, and is no longer documented as the thing that prevents a stall. The defence is scope.
+- **Unchanged on purpose:** `resolveQeSpec` / `coderIsCodex` / `qeShouldUseCodex` (verified correct by
+  direct call), the `crossFamilyQe` label format, and the Claude belt — the pipeline still never blocks
+  on Codex.
+
+### Fixed — the K2 plan gate could not complete a run on a non-JS repository
+
+- **C2 recognises test paths in every ecosystem.** The gate demanded a `.test.(ts|mjs|js)` suffix, so
+  a Python/Go/Rust/JVM/.NET feature could never satisfy it (measured: 4/4 JS forms matched, 0/11
+  non-JS). Replaced by a two-stage predicate — a language-neutral candidate-path extractor plus one
+  `$`-anchored rule per ecosystem (JS/TS, pytest `test_*.py` + `*_test.py`, Go, Rust `tests/*.rs` +
+  `tests.rs`, JVM, .NET). Widening it to "contains the word test" was rejected: `docs/testing.md`,
+  `src/latest.rs` and prose are still refused. An unknown ecosystem stays a FAIL, never a WARN.
+- **New opt-in `testPathRules`** in the existing `architecture/project-skills.json`: additive rules,
+  each anchored by wrapping so an alternation cannot leak, capped at 200 characters, and FATAL when
+  malformed (`NOT-ESTABLISHED`, exit 3) rather than silently falling back to the built-ins.
+- **The gate script is resolved from the WORKSPACE first.** The command `cd`s into the target repo,
+  so the repo-relative path died with `Cannot find module` on any repo without its own feature-adr
+  install. Order: `args.gateScript` (new, absolute, validated) → workspace copy → repo copy, with
+  `K2_GATE_SCRIPT=` / `K2_GATE_TRIED=` echoed for audit. Nothing found ⇒ reason `tooling-missing`
+  (a NOT-ESTABLISHED, never a skip), and the operator note now says the gate could not be RUN and
+  that this is not a plan defect — it no longer tells you to fix a plan that is fine.
+- **A relative `args.dzBin` is pinned to the workspace root once**, before any `cd`, so the six
+  commands that splice it stop resolving against three different bases (a null usage probe was being
+  read upstream as "the Claude limit was hit").
+
+### Changed — `EXPECTED_CODE_TARGETS` admissibility (C3)
+
+- Dotfile targets (`.claude/…`, `.github/workflows/ci.yml`, `.gitignore`, `.env.example`) are
+  admissible — previously feature-adr could not name its own files or any CI config, in any language.
+- Directory-shaped targets are now REJECTED (`trailing slash — names a directory, not a file`): a bare
+  directory gives plan-vs-diff matching nothing concrete to verify.
+- Every refusal names its own defect instead of one catch-all: `path traversal ('..' segment)`,
+  `degenerate path segment`, `empty path segment`, `path segment ends with '.'`,
+  `illegal character '<c>'`, `empty stem after the leading dot`. The traversal check is a SEGMENT
+  test now, so the ordinary filename `foo..bar.ts` is no longer called a path traversal.
+
+### Requires
+
+- Nothing new at runtime: the workflow INLINES the gate command builder and its parser (the sandbox
+  cannot import), so this release is self-contained. The pure halves it mirrors live in
+  `@dzhechkov/harness-core` (`planCompletenessGateCmd` gained an optional 4th argument;
+  `refusalNoteFor` and `normalizeDzBin` are new) and a drift test pins the two copies together.
+
+
+### Fixed — Step 0 wrote nothing down, so the tier was unreadable and the acid check had no input
+
+- **Step 0 now WRITES `00_complexity_assessment.md`** before returning: the tier with its decisive
+  criterion, the active steps, the recalled patterns, and an acid-case table whose rows are pinned to
+  the exact `| A<n> | <bad input> | <what must happen> |` shape the K2 gate parses. MEASURED
+  2026-08-21: 66 of 199 features carried that file and the last four in a row did not. Two silent
+  consequences — the tier was recorded NOWHERE while a run was alive (the checkpoint lands at phase
+  end, the result object only at the very end), and the C4 acid check quietly switched itself off,
+  including for the features that introduced it. An honest no-acid-cases run still writes prose and
+  no table; the gate now tells an ABSENT file from a deliberate skip.
+- **A caller-forced tier is the tier of record.** `tier = args.tier || router.tier` means the run
+  executes the override while Step 0 wrote down its own classification. The artifact now carries
+  `Effective tier: <forced> (forced by the caller)` alongside the router's own recommendation, and
+  sizes the acid table for the effective tier. With no override the prompt is byte-identical.
+- **A pre-contract router checkpoint no longer resumes into the new contract** — the resume gate only
+  asks whether the artifact is PRESENT, and any of the 66 features with a tableless file satisfied it.
+
+### Fixed — the Step-8 QE stage measured the wrong thing in four different ways
+
+- the change set is the run's DELTA (pre-code baseline vs after), not the working tree's current dirt;
+- a finding whose location cannot be parsed is `unlocatable` and stays in the graded set — it used to
+  be filed as someone else's dirt, i.e. unknown counted as clean;
+- mode B refuses a scope built from unlanded code, an unmeasured change set or an empty intersection;
+- the QE scribe is WITNESSED: the report is re-hashed before and after, so an existing file from an
+  earlier run can no longer stand in for one this run never wrote.
+
+### Fixed — durable state is written by a command, not by hand
+
+- checkpoint lines now go through `dz feature-adr-checkpoint`. The subagent RUNS a command instead of
+  hand-writing state into a file: a security classifier blocked NINE consecutive checkpoint writes in
+  one run, `.fa-state/checkpoints.jsonl` was never created, resume was silently dead, and the run
+  reported success.
+
 ## [1.4.0] - 2026-08-20
 
 ### Changed — the composite design checkpoint

package/README.md

@@ -106,6 +106,127 @@ ARCHITECTURE → IMPLEMENTATION →  CODE   →   QE    →  FLEET QE
 # Full protocols + 6 extra skills, up to 7 fleet QE agents
 ```
 
+### The K2 plan gate runs on ANY repo, not just JS/TS ones (v1.5.0)
+
+Between Step 6 and Step 7 the pipeline runs a machine plan-completeness gate (K2). Until v1.5.0 it
+could not finish a run on a non-JS repository — three separate defects, all closed here.
+
+**1. Test paths in every ecosystem.** C2 checks that each ADR's Confirmation names a test file and
+that the plan names the same path. It used to demand a `.test.(ts|mjs|js)` suffix, so on a Python,
+Go, Rust, JVM or .NET repo it found nothing and failed the plan (measured: 4/4 JS forms matched,
+0/11 non-JS forms did). It now uses a two-stage predicate — candidate paths are extracted from the
+Confirmation text, then matched against one anchored rule per ecosystem:
+
+| Ecosystem | Recognised |
+|---|---|
+| JS/TS | `*.test.*` / `*.spec.*` (`ts tsx mts cts mjs cjs js jsx`) |
+| pytest | `test_*.py` **and** `*_test.py` |
+| Go | `*_test.go` |
+| Rust | `tests/*.rs` **and** `tests.rs` |
+| JVM | `*Test|Tests|IT|Spec.(java kt kts scala groovy)` |
+| .NET | `*Test|Tests.(cs fs vb)` |
+
+Deliberately NOT "any path containing the word test": `docs/testing.md`, `src/latest.rs`,
+`contests/results.py` and a sentence like *"the staleness test will verify this"* are all refused. A
+gate that passes prose is worse than one that fails Python. An unknown ecosystem is still a FAIL,
+never a warning — the message names the recognised set and points at the override below.
+
+**Extending the vocabulary — `testPathRules`.** Add rules to the manifest the pipeline already
+reads, `architecture/project-skills.json` (no second dotfile):
+
+```json
+{
+  "testPathRules": [
+    { "ecosystem": "elixir", "pattern": "(?:^|/)test/[^/]+_test\\.exs" }
+  ]
+}
+```
+
+Rules are ADDED to the built-ins, never replace them, and each pattern is anchored by wrapping
+(`(?:<pattern>)$`) so every branch of an alternation is anchored. A malformed `testPathRules`
+(bad JSON, not an array, missing `ecosystem`/`pattern`, an invalid regex, over 200 characters, or a
+nested quantifier) is **NOT-ESTABLISHED, exit 3** — never a quiet fall-back to the built-ins.
+
+**2. The gate script is found where it is installed — `args.gateScript`.** The skill lives in your
+WORKSPACE; the gate command `cd`s into the TARGET repo, so a repo-relative lookup died with
+`Cannot find module` on every repo that is not itself a feature-adr install. The resolution order is
+now:
+
+1. `args.gateScript` — an explicit ABSOLUTE path (validated: absolute, no `..`, or the run fails loudly);
+2. the WORKSPACE copy (`$WS/.claude/skills/feature-adr/scripts/check-plan-completeness.mjs`);
+3. the target-repo copy.
+
+Workspace before repo on purpose: the verdict contract is defined by the parser inside the running
+workflow, so only that installation's own copy is known to speak it. Every run echoes
+`K2_GATE_SCRIPT=` (which copy ran) and `K2_GATE_TRIED=` (all candidates) for audit. If none exists
+the run refuses with reason `tooling-missing` — a NOT-ESTABLISHED, never a skip — and the operator
+message says the gate could not be RUN and that this is **not** a plan defect.
+
+**3. Dotfile targets are admissible; directory-shaped ones are not.** `EXPECTED_CODE_TARGETS` may
+now name `.claude/…`, `.github/workflows/ci.yml`, `.gitignore`, `.env.example`. What is refused is
+refused BY NAME: `path traversal ('..' segment)`, `degenerate path segment`, `empty path segment`,
+`trailing slash — names a directory, not a file`, `path segment ends with '.'`,
+`illegal character '<c>'`, `empty stem after the leading dot`. The old substring traversal test also
+rejected the ordinary filename `foo..bar.ts`; it is a segment test now.
+
+### The Step-8 amendment gate runs a command instead of judging (v1.5.1)
+
+Every `AM-N` row must resolve to a test found INSIDE the file the row names, and the check is
+`dz amendment-check --slug <slug> --json` rather than a paragraph asking the reviewer to confirm it.
+MEASURED 2026-08-21: `features/qe-scoped-review` shipped with five named amendment test ids of which
+none existed, while its plan recorded `## Amendments: None`. The gate did not fail — a prompt cannot.
+
+The PLAN is authoritative when it carries rows (Step 6 owes "carry AM-N into the plan verbatim"), and
+the rule that keeps that honest is coverage: an amendment the plan drops — or rewords under the same
+id — is a failure. Renaming the TEST stays legitimate; tests are named later than ideation guesses.
+
+The durable writers were migrated in the same release: the run-cost ledger and the training-pair
+capture no longer hand a subagent a pre-baked shell string with their payload baked in — the shape a
+security classifier blocked nine times in one run. Both call `dz feature-adr-record`, which refuses
+before writing and verifies the append by re-reading the tail. A record failure still never fails the
+run; it now survives it in `recordFailures`.
+
+Requires `@dzhechkov/harness-core >= 0.6.1`.
+
+### Step 0 writes the assessment down, and the acid check gets its input back (v1.5.0)
+
+Step 0 classifies the feature and now **writes `00_complexity_assessment.md` before it returns** — the
+tier with the criterion that decided it, the active steps, the recalled patterns, and an acid-case
+table. MEASURED 2026-08-21: 66 of 199 features carried that file and the last four in a row did not,
+with two silent consequences. The tier was recorded NOWHERE while a run was alive (the router
+checkpoint lands at phase end and the result object only at the very end), so mid-run it had to be
+guessed from which artifacts happened to exist. And the K2 gate reads its acid corpus from that file,
+so the C4 check quietly switched itself off — including for the features that introduced it.
+
+Acid rows are pinned to the exact shape the gate parses, `| A<n> | <the bad input> | <what must
+happen> |`; a loose shape disables the check just as silently as a missing file. A feature with no
+acid cases still says so in prose and writes no table — the gate now tells an ABSENT file (a warning
+that names the missing artifact) from a deliberate skip.
+
+Two ways the tier could still go unrecorded, both closed here:
+
+- a **pre-contract router checkpoint** used to resume into the new contract. The resume gate only asks
+  whether the artifact is PRESENT, and any of the 66 features carrying a tableless file satisfied it,
+  so Step 0 never re-ran. A router-scoped hash token now makes those entries re-run — once, and only
+  the router, rather than every in-flight stage.
+- a **caller-forced `args.tier`** is now the tier of record. The run executes the override, so the
+  file carries `Effective tier: <forced> (forced by the caller)` alongside the router's own
+  recommendation, and sizes the acid table for the effective tier. With no override the prompt is
+  byte-identical to before.
+
+Requires `@dzhechkov/harness-core >= 0.6.0`.
+
+### The Step-8 QE stage measures the run, not the room (v1.5.0)
+
+Four separate ways the QE stage graded the wrong thing, all closed: the change set is this run's DELTA
+(a pre-code baseline against the state after) instead of the working tree's current dirt, so an
+unrelated dirty file can no longer grade your feature; a finding whose location cannot be parsed is
+`unlocatable` and stays in the graded set, where it used to be filed as someone else's dirt — unknown
+counted as clean, inside the function whose job is honest attribution; mode B refuses a scope built
+from unlanded code, an unmeasured change set, or an empty intersection; and the QE scribe is
+WITNESSED — the report is re-hashed before and after, so a file left by an earlier run can no longer
+stand in for one this run never wrote.
+
 ### The design fan resumes per sibling, and an incomplete design is REFUSED (v1.4.0)
 
 Step 1–5 run as one parallel fan — requirements, ADR, QCSD, architecture. Until v1.4.0 the whole fan
@@ -237,6 +358,49 @@ family than the coder** — a model that writes code must not also self-QE; inde
 catches what self-review misses. coder=Codex ⇒ QE=Claude (`opus`); coder=Claude ⇒ QE=Codex
 (`codex:<top>:high`), or a Claude reviewer if Codex is unavailable (never blocks).
 
+### Step 8 on Codex is SCOPED — two modes, and every fallback names its cause
+
+When QE routes to Codex, Step 8 no longer hands it one unscoped `codex exec` prompt. Why, MEASURED
+2026-08-21 — same question, same model (`gpt-5.6-sol`, effort `high`), three dispatches:
+
+| dispatch | prompt | wall time | exit | verdict? |
+|---|---|---|---|---|
+| `codex exec`, unscoped | 19 038 chars | 280 s (and again under a 1500 s ceiling) | 124 | **none** — 416 KB of exploration |
+| `codex exec`, scoped (*"read ONLY these two files"*) | 1 461 chars | 41 s | 0 | `Grade: B` + findings |
+| `codex review --commit <SHA>` | scope from the diff | 146 s | 0 | verdict + findings |
+
+The unscoped run spent its budget on **reconnaissance of the tree**, not on reasoning about the change.
+So raising the timeout does not help, and the prompt-length ceiling was never the binding constraint
+(19 038 sat under `CODEX_EXEC_PROMPT_CEILING_CHARS` = 24 000 with ~5 000 to spare). The cost is not the
+wasted minutes: on timeout the dispatch returns `null`, the belt runs a Claude reviewer, and
+cross-family QE is silently lost — on exactly the big features that need it most.
+
+- **Mode A (primary): `codex review`.** The scope comes from the DIFF, so Codex computes for free the
+  thing we were paying a model to do badly. Default scope `--uncommitted`; override with
+  `args.qeScope: 'commit' | 'base'` + `args.qeScopeRef`. Two CLI facts are encoded as refusals, both
+  measured: `codex review` rejects `-m` (exit 2 — the model goes through `-c model=`), and **every**
+  scope flag rejects a positional prompt (`--commit`, `--base` and `--uncommitted` alike, exit 2). So
+  mode A runs on Codex's built-in review instructions and cannot be asked our questions.
+- **Mode B (follow-up): a NARROWED `codex exec`.** Carries our own questions over at most 3 named
+  files with the load-bearing clause *"read ONLY these files, do not explore the repository"*, and
+  ends with `Grade: <A|B|C|D>`. An unscoped mode-B prompt is not constructible: an empty file list
+  returns `''` and `codexExecPlan` refuses an unscoped `qe` prompt outright.
+- **The verdict is parsed, never synthesised.** A `Grade: D` is a SUCCESSFUL cross-family review; a
+  review with no grade is a FAILED one. Mode A cannot state a letter, so its grade is DERIVED from the
+  severities it reported and labelled `gradeSource: 'derived-from-findings'` — and **zero findings
+  yields `null`, never `A`** (measured: `codex review` on a clean tree exits 0 with a polite, entirely
+  empty review; calling that an `A` would be a review of nothing reported as a pass).
+- **Every fallback names its cause.** The reason carried into
+  `opus (cross-family QE DID NOT happen — …)` comes from a locked taxonomy —
+  `timeout` (narrow the scope) · `no-verdict` · `tool-error` (fix the invocation) · `unusable-output` ·
+  `unavailable` (fix the account/model) · `over-ceiling`. A timeout and an unusable output can never
+  render the same string, because the operator's next move differs.
+- **The pipeline still never blocks on Codex.** Both modes fail into the same Claude belt as before.
+
+After a Codex verdict a cheap Claude agent transcribes it into `08_qe_report.md` (mode A takes no
+prompt, so the reviewer cannot be asked to write anything). It is a scribe, not a second reviewer: the
+grade is Codex's and is stated as final.
+
 **Precedence:** `args.models[stage]` wins; the legacy `planner`/`coder`/`qeReviewer`/`codexModel` knobs
 fill only unspecified stages. `codexModel` seeds the id for a bare `'codex'` spec. gpt-5.6-ready: a new
 Codex id is a data-only allowlist edit.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dzhechkov/skills-feature-adr",
-  "version": "1.4.0",
+  "version": "1.5.1",
   "description": "Adaptive Feature Development skill pack for Claude Code — 11-step pipeline with Complexity Router (S/M/L/XL), ADR-driven architecture, 15 agentic-qe skills, multi-agent fleet QE. Supports --full-qe, --full-qe-extended, --with-learning, and --knowledge-extractor modes.",
   "bin": {
     "skills-feature-adr": "./bin/cli.js"

package/sbom.json

@@ -15,7 +15,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "bbb43101a686369a8662f47fe7b7aa75073b614a188c2752cd81d9570620bb3d"
+          "content": "88e0389016f697b90731ee8743a35e523f0ccb079426d59861d894f33e516392"
         }
       ]
     },
@@ -35,7 +35,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "469873d967c4438afd0b25ec8b013347841e07328f508f6786f90cc6aa2f09b9"
+          "content": "47f9402d4c3954d6d5a75ad906ec7b592010fdfd80f347d4a87dd14dd9e300ce"
         }
       ]
     },
@@ -65,7 +65,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "c1e4d257167fd2462e0c8e09f248fc1aef332aa34fb09dddd5940bdcc30ea34b"
+          "content": "3fbe9ef86c9f6fa7c86bbe7760729094e80edb67577e397678b2d98dca1c2034"
         }
       ]
     },
@@ -395,7 +395,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "c8fdd1877d8d9515ab29f52c3db49ddd9612b5797bc071e6208def860c02e6f2"
+          "content": "3903e2694ad47782914b35869bbf19c5f0803b6dafdcfb629df343a5ff00d1b9"
         }
       ]
     },
@@ -415,7 +415,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "97e9a7bc54f196b381c4ef71258cddcb2fb48f216df1ba015927c176bad57084"
+          "content": "bd5b5809142c12fa1378de446b68027a0c342a7a91ad17e4fb3395ca8f6a8508"
         }
       ]
     },
@@ -645,7 +645,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "41d85b012a9d6cc172eaa5d7777294f2c01fb54b752ed61c7cbe2d2cd7b79b67"
+          "content": "2e1afeb8cbc08ce872fc8280a0809e7712ee76879d08b48caa5a0d4082cb8647"
         }
       ]
     },
@@ -805,7 +805,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "1be239d2f02612bc33027767d9930eae8a2d6d5afd427d1485198bbdd821a3c7"
+          "content": "0c74e8995d82bb986ef3233e91beebfa0e761aae4434f24554077bb05d2199e9"
         }
       ]
     },

package/templates/.claude/skills/feature-adr/modules/06-implementation-plan.md

@@ -198,6 +198,13 @@ After the plan is written, run the gate. It is a script, not a judgement call:
 node .claude/skills/feature-adr/scripts/check-plan-completeness.mjs features/<slug>
 ```
 
+The path above is relative to the workspace the skill is INSTALLED in. Working inside a target repo
+that has no feature-adr install of its own? Pass the absolute path to the script instead — the
+ultracode workflow does this for you (it tries `args.gateScript`, then the workspace copy, then the
+target-repo copy, and refuses with `tooling-missing` if none exists). The gate is language-neutral:
+C2 recognises JS/TS, pytest, Go, Rust, JVM and .NET test paths, extensible per project with
+`testPathRules` in `architecture/project-skills.json`.
+
 | Exit | Verdict | What you do |
 |------|---------|-------------|
 | `0` | PASS | proceed to Step 7 |

package/templates/.claude/skills/feature-adr/modules/08-qe.md

@@ -160,18 +160,32 @@ The Confirmation-to-test link is load-bearing. If absent, grade no better than C
 
 ### 3b. Amendment Gate (P2 — amendments inherit the Confirmation discipline)
 
-Read the `## Amendments` sections of `03.5_ideation_report.md` and `06_implementation_plan.md` (skip
-silently if absent). For EVERY `AM-N` row verify:
-1. the row contains a `→ test ` token naming a real test (the fixed shape);
-2. the named test **exists** in the suite;
-3. it is **non-vacuous** — include the amendment test files in the SAME
-   `dz discrimination-check --test <f1,f2,...> --base HEAD --json` run as the ADR property test. An
-   amendment test that stays green at pre-feature base proves nothing about its amendment;
-4. a **safeguard** amendment's test proves the safeguard FIRES on a real input (a structurally-dead
-   safeguard passes an existence test and never fires in production).
-
-A missing, unnamed, or vacuous amendment test is a HIGH gap. This closes the distance between "we caught
-the design flaw" (challenge-panel/QCSD) and "we proved the fix works".
+**Do not judge this yourself — RUN the check.** Resolution of every `AM-N` row to a real test is a
+deterministic question, and a deterministic question must not live in prose (cost-of-detection ladder).
+It used to live here, and `features/qe-scoped-review` shipped with five named amendment test ids of
+which none existed, while its plan recorded `## Amendments: None`.
+
+```bash
+dz amendment-check --slug <feature-slug> --json      # or --feature-dir <abs path>
+```
+
+| Outcome | Exit | What it means for the gate |
+|---|---|---|
+| `pass` | 0 | every row resolves to a test found inside the file the row names |
+| `skip` | 0 | no `## Amendments` section — an absence, stated, never a silent pass |
+| `fail` | 1 | a HIGH gap: quote every reason verbatim into the QE report |
+| `not-established` | 3 | the grammar matched nothing, or the inputs were unreadable — **never a pass** |
+
+Empty stdout, a crash, or a missing `dz` is `not-established`, not a clean gate.
+
+**What the command does NOT prove:** that a resolved test discriminates. Vacuity stays yours, in the
+SAME `dz discrimination-check --test <f1,f2,...> --base HEAD --json` run as the ADR property test — an
+amendment test that stays green at pre-feature base proves nothing about its amendment. A **safeguard**
+amendment additionally needs its test to prove the safeguard FIRES on a real input: a structurally-dead
+safeguard passes an existence check and never fires in production.
+
+This closes the distance between "we caught the design flaw" (challenge-panel/QCSD) and "we proved the
+fix works".
 
 ### 3c. I/O-on-pure-path + fixture-swap hunt (P5)