@haposoft/cafekit 0.16.7 → 0.18.1

package/src/claude/skills/specs/references/templates.md

@@ -1,14 +1,6 @@
 # Process-first plan, task, and receipt templates
 
-Use these as compact starting points. Remove unused examples and placeholders
-before C2. The primary layout is always flat:
-
-```text
-specs/<feature>/
-├── plan.md
-├── task-01-<slug>.md
-└── task-NN-<slug>.md
-```
+Use these as compact starting points. Remove unused examples and placeholders before GATE-REVIEW. The primary layout is always flat: `specs/<feature>/` holds `plan.md` beside `task-01-<slug>.md` through `task-NN-<slug>.md`, with no task subdirectory.
 
 ## `plan.md` template
 
@@ -18,7 +10,7 @@ Keep the plan short enough to scan as one index, normally under 100 lines.
 # <Feature name>
 Specs-Contract: process-first-ready-v1
 
-## Scope decision (C1 — YYYY-MM-DD)
+## Scope decision (GATE-SCOPE — YYYY-MM-DD)
 - Existing: <reusable code with path:line>
 - Minimum change: <required behavior>
 - Expansion signals: <none or evidence>
@@ -27,6 +19,11 @@ Specs-Contract: process-first-ready-v1
 ## Out of scope
 - <deliberate exclusion>
 
+## Decisions
+| ID | Chosen | Rejected | Why | Load-bearing assumption | Break signal → response |
+|---|---|---|---|---|---|
+| D-01 | <chosen path> | <rejected alternative> | <evidence-backed reason> | <assumption that must hold> | <observable signal> → <pre-decided response> |
+
 ## Coverage profile
 | ID | Outcome | Change kinds | Material surfaces | Ambiguity/action | Risk/evidence | Required proof |
 |---|---|---|---|---|---|---|
@@ -38,9 +35,9 @@ Specs-Contract: process-first-ready-v1
 | AC-01 | When <trigger>, the system shall <response>. | `<command>` |
 
 ## Tasks
-| # | Task | Criteria | Primary ownership | Dependencies | Status |
-|---|---|---|---|---|---|
-| 01 | <one outcome> | AC-01 | `src/example.ts` | - | blocked |
+| # | Task | Priority | Criteria | Primary ownership | Dependencies | Status |
+|---|---|---|---|---|---|---|
+| 01 | <one outcome> | P1 | AC-01 | `src/example.ts` | - | blocked |
 
 ## Review log
 - Round 1: <findings accepted/rejected/revised>; sweep <result>.
@@ -48,6 +45,7 @@ Specs-Contract: process-first-ready-v1
 
 Each acceptance ID must map to at least one task and one proof. A task with no
 criterion is scope drift; a criterion with no task or proof is not executable.
+`Priority`: P1 means the outcome is unusable without it, P2 is needed for acceptance, P3 improves it. Number tasks in priority order so the plan table, the filename order, and the queue agree.
 
 ## `task-NN-*.md` template
 
@@ -73,6 +71,9 @@ Status: blocked
 - Create: `test/a.test.ts`
 - Read: `src/caller.ts`
 
+## Steps
+1. <ordered action on one owned file → expected observation>
+
 ## Acceptance
 - AC-01: <task-local measurable condition>
 
@@ -87,6 +88,9 @@ Status: blocked
 - Counterexample: <material alternative behavior that must make this proof fail>
 - Artifacts: <required artifact path plus digest algorithm/comparison rule, or explicitly ephemeral with cleanup rule>
 
+## Failure Protocol
+On a failed Step or Verification Plan run: stop; do not widen scope, change the Command, or weaken a test; record observed versus expected; repair only the cited cause; after three failed rounds, stop and ask the user.
+
 ## Receipt
 <!-- Fill only after execution; see canonical form below. -->
 ````
@@ -94,18 +98,20 @@ Status: blocked
 Trace `Command → Named probe → Reachability → Oracle`. Aggregate suites name the
 owning concrete probe. `Required proof` is a planned level set, not execution
 evidence: known but unrun proof may be `pending`; `UNKNOWN` reachability blocks
-`pending`; missing, failed, or unavailable required evidence blocks `done`/C3.
+`pending`; missing, failed, or unavailable required evidence blocks `done`/GATE-DONE.
 Levels stay separate and never promote one another. Run mutation or destructive
 negative controls only on disposable copies under a verified temporary root,
 never tracked worktree or canonical source bytes.
 For every required level in each referenced CP row, map its named probe and
 reachability here; one command may own several explicitly named level probes.
+Verification compares observed output with the Oracle; a judgment such as "looks right" is not a verification.
+Example failure: the Command exits 1 with `expected 3 files, found 2` → record observed versus expected, add the missing writer, and rerun the same Command; never delete the assertion.
 
 ## Status matrix
 
 | Status condition | Persisted state |
 |---|---|
-| C1/C2 decision open | `blocked` |
+| GATE-SCOPE/GATE-REVIEW decision open | `blocked` |
 | accepted finding open or `UNKNOWN` reachability | `blocked` |
 | every non-dependency blocker closed | `pending` |
 | named task dependency not done | keep `pending`; queue gates it |
@@ -138,16 +144,13 @@ bare PASS claim without the command output.
 
 ## EARS sentence patterns
 
-Use the narrowest pattern that describes observable behavior:
-
 1. **Ubiquitous:** `The <system> shall <response>.`
 2. **Event-driven:** `When <trigger>, the <system> shall <response>.`
 3. **State-driven:** `While <state>, the <system> shall <response>.`
 4. **Unwanted behavior:** `If <fault>, the <system> shall <response>.`
 5. **Optional feature:** `Where <feature is enabled>, the <system> shall <response>.`
 
-Avoid implementation detail unless it is a user-approved contract. Replace
-"fast", "robust", and "works" with a measurable threshold or observation.
+Use the narrowest pattern that describes observable behavior. Avoid implementation detail unless it is a user-approved contract. Replace "fast", "robust", and "works" with a measurable threshold or observation.
 
 ## Example Mapping rule
 
@@ -157,7 +160,7 @@ Classify ambiguity in every affected CP row:
 |---|---|
 | `none` | proceed |
 | `examples-needed` | add two or three examples only for an already decided rule; promote to `decision-needed` if an example changes observable behavior |
-| `decision-needed` | ask the user at C1/C2 and keep affected tasks blocked |
+| `decision-needed` | ask the user at GATE-SCOPE/GATE-REVIEW and keep affected tasks blocked |
 | `design-needed` | after user-owned decisions settle, route material competing technical designs through Brainstorm |
 
 Do not let examples choose a product outcome: retention of 30 versus 90 days is
@@ -165,7 +168,7 @@ Do not let examples choose a product outcome: retention of 30 versus 90 days is
 
 ## No-invention and conditional boundary contracts
 
-Before implementation handoff, apply the **no-invention gate**: if two implementations conform to the packet text yet can produce different externally observable output, state, error, security, or compatibility behavior, surface the missing choice as an explicit C1 or C2 question and block handoff.
+Before implementation handoff, apply the **no-invention gate**: if two implementations conform to the packet text yet can produce different externally observable output, state, error, security, or compatibility behavior, surface the missing choice as an explicit GATE-SCOPE or GATE-REVIEW question and block handoff.
 
 For a Specs route, `plan.md` owns one `## Coverage profile` row per externally observable outcome; direct and Brainstorm-only routes do not persist it. Change kinds are multi-valued (`add`, `modify`, `fix`, `refactor`, `remove`, `migrate`, `integrate`), and unfamiliar kinds or surfaces use `other:<verbatim>` rather than disappearing. Each task references its CP IDs; authoring, review, edge, and proof obligations union only inside affected rows/tasks. Rederive affected CP rows after any accepted scope, outcome, criteria, ownership, dependency, risk, or proof delta before task status.
 
@@ -186,15 +189,11 @@ For every required row, name each listed choice exactly; labels such as “JSON
 
 ## Twelve edge-case dimensions
 
-For each material boundary, select relevant dimensions rather than filling a
-ceremonial matrix:
+For each material boundary, select relevant dimensions rather than filling a ceremonial matrix:
 
-- Input shape, identity, state, order: malformed/duplicate/bounds, wrong actor,
-  partial/stale state, replay/reordering.
-- Concurrency, dependency, failure, recovery: races/cancellation, version drift,
-  timeout/nonzero exit, retry/rollback/cleanup.
-- Persistence, integration, security/privacy, observability/proof: partial
-  writes, registration/reachability, traversal/secrets, artifacts/provenance.
+- Input shape, identity, state, order: malformed/duplicate/bounds, wrong actor, partial/stale state, replay/reordering.
+- Concurrency, dependency, failure, recovery: races/cancellation, version drift, timeout/nonzero exit, retry/rollback/cleanup.
+- Persistence, integration, security/privacy, observability/proof: partial writes, registration/reachability, traversal/secrets, artifacts/provenance.
 
 `Crash` means abrupt unhandled termination before the claimed catch point; a catchable failure returns/raises an error or exits nonzero. Never use them interchangeably.
 
@@ -203,17 +202,11 @@ verification probe. Do not duplicate it across all three.
 
 ## Quality and saturation checks
 
-Before C2 confirm:
+Before GATE-REVIEW confirm:
 
-- every repository fact has current evidence or `[UNVERIFIED]`;
-- every acceptance criterion maps to task and proof;
-- task ownership does not overlap within a proposed parallel wave;
-- dependencies are acyclic and refer to real task numbers;
-- commands are runnable from the named work context;
-- negative, recovery, and reachability probes exist where risk requires them;
-- every ambiguity follows its required action; examples only clarify decided rules;
-- the latest consistency sweep reports zero unresolved contradictions.
+- evidence: every repository fact has a current citation or `[UNVERIFIED]`, and the sampled citations were re-run;
+- mapping: each acceptance criterion reaches a task and a proof; ownership does not overlap inside one parallel wave; dependencies are acyclic and name real task files;
+- proof: commands run from the named work context, and negative, recovery, and reachability probes exist where risk requires them;
+- closure: each ambiguity followed its required action, examples only clarify decided rules, and the latest consistency sweep reports zero unresolved contradictions.
 
-Stop expanding when a fresh reviewer finds no new material failure with new
-evidence, the 12 dimensions yield no uncovered relevant boundary, and every
-accepted C2 finding is represented exactly once.
+Stop expanding when a fresh reviewer finds no new material failure with new evidence, the 12 dimensions yield no uncovered relevant boundary, and each accepted GATE-REVIEW finding is represented exactly once.

package/src/claude/skills/sync/SKILL.md

@@ -1,20 +1,18 @@
 ---
 name: cf:sync
-description: "Synchronize process-first task Status and inline Receipts without inventing proof; also preserves existing legacy Specs state."
+description: "Synchronize process-first task Status and inline Receipts without inventing proof."
 user-invocable: true
 when_to_use: "Invoke after implementation or verification changes a task's real state, or to audit a feature packet for drift."
 category: utilities
 keywords: [sync, state, tracking, consistency]
-argument-hint: "<feature> <task-file> <pending|in_progress|paused|blocked|done|sync-finalize> [blocker] | audit <feature>"
+argument-hint: "<feature> <task-file> <pending|in_progress|paused|blocked|done|sync-finalize> [blocker] | audit <feature> | rebind <feature> [task-file] | (none: audit all, write nothing)"
 metadata:
   author: haposoft
   version: "3.0.0"
 ---
 # Sync — file-state synchronization
 
-Synchronize only observed state. For the primary process-first layout, the
-single `Status:` field and inline `## Receipt` in each flat task file are the
-state. Never infer proof, approval, review independence, or product readiness.
+Synchronize only observed state. For the primary process-first layout, the single `Status:` field and inline `## Receipt` in each flat task file are the state. Never infer proof, approval, review independence, or product readiness.
 
 ## Commands
 
@@ -24,56 +22,29 @@ state. Never infer proof, approval, review independence, or product readiness.
 /cf:sync <feature> <task-NN-slug.md> done
 /cf:sync <feature> <task-NN-slug.md> sync-finalize
 /cf:sync audit <feature>
+/cf:sync rebind <feature> [<task-NN-slug.md>]
+/cf:sync
 ```
 
-Resolve one regular direct-child task inside `specs/<feature>/`. Reject path
-escape, symlink, ambiguity, missing `plan.md`, duplicate Status fields, and
-unsupported status values.
+Resolve one regular direct-child task inside `specs/<feature>/`. Reject path escape, symlink, ambiguity, missing `plan.md`, duplicate Status fields, and unsupported status values.
 
 ## Task synchronization
 
-1. Read the task Outcome, Acceptance, Dependencies, Verification Plan, current
-   Status, and Receipt before editing.
-2. Starting or resuming changes only Status to `in_progress`. Update only
-   checkboxes whose implementation is real.
-3. Blocking changes Status to `blocked` and records a concrete blocker; it does
-   not create proof.
-4. Done requires a current inline Receipt with `Verification: PASS`, exact
-   Command, `Exit: 0`, runtime-bound Base/Head, non-empty fenced output, and any
-   required negative/reachability/artifact proof.
-5. Write or replace the Receipt before changing Status to `done`. Missing,
-   stale, contradictory, placeholder, failure, or zero-test evidence keeps the
-   task `in_progress` or `blocked`.
-6. Re-read the file after the surgical edit and confirm exactly one Status and
-   one Receipt section.
+- Read the task Outcome, Acceptance, Dependencies, Verification Plan, current Status, and Receipt before editing.
+- Starting or resuming changes only Status to `in_progress`. Update only checkboxes whose implementation is real.
+- Blocking changes Status to `blocked` and records a concrete blocker; it does not create proof.
+- Done requires a current inline Receipt with `Verification: PASS`, exact Command, `Exit: 0`, runtime-bound Base/Head, non-empty fenced output, and any required negative/reachability/artifact proof.
+- Write or replace the Receipt before changing Status to `done`. Missing, stale, contradictory, placeholder, failure, or zero-test evidence keeps the task `in_progress` or `blocked`.
+- Re-read the file after the surgical edit and confirm exactly one Status and one Receipt section.
 
-`sync-finalize` is the only promotion path for `FLASH_UNVERIFIED`. It requires
-fresh canonical PASS proof, revalidates Base/Head and artifacts, clears the
-flash blocker, then derives `done`. Caller-supplied promotion booleans and a
-marker alone have no authority.
+`sync-finalize` is the only promotion path for `FLASH_UNVERIFIED`. It requires fresh canonical PASS proof, revalidates Base/Head and artifacts, clears the flash blocker, then derives `done`. Caller-supplied promotion booleans and a marker alone have no authority.
 
 ## Audit
 
-Scan only `specs/<feature>/task-*.md` beside `plan.md`. Compare plan task rows,
-task filenames, dependencies, Status, acceptance mapping, and Receipts. Report
-missing files, unknown rows, cycles, duplicate fields, done-without-proof,
-proof-on-unfinished-task, and overlapping ownership.
+Scan only `specs/<feature>/task-*.md` beside `plan.md`. Compare plan task rows, task filenames, dependencies, Status, acceptance mapping, and Receipts. Report missing files, unknown rows, cycles, duplicate fields, done-without-proof, proof-on-unfinished-task, and overlapping ownership.
 
-Repair deterministic formatting drift only. A semantic conflict, missing
-evidence, or ownership decision requires user or implementation input; do not
-pick a winner. After any edit, report exact files changed and unresolved items.
-
-Read `references/sync-protocols.md` for surgical update and audit rules.
+An audit writes nothing until the user confirms the named changes; then repair deterministic formatting drift only and never pick a winner in a semantic conflict. Read `references/rebind-and-audit.md` before a rebind, a bare call, or a file report, and `references/sync-protocols.md` for surgical update and audit rules.
 
 ## Docs impact
 
-When a task becomes done, report `Docs impact: none|minor|major`. Create no docs
-work for `none`; update only affected existing docs for minor or major.
-
-## Legacy workflow compatibility
-
-If `specs/<feature>/spec.json` exists, use the legacy adapter instead: preserve
-its machine authority, `task_registry`, nested `tasks/task-R*.md`, timestamps,
-typed topology, separate receipts, `workflow_policy`, `planning_depth`, lane,
-and `execution_tier`. Keep JSON and Markdown synchronized, retain the exact
-legacy sync-finalize contract, and require its feature receipt at closeout.
+When a task becomes done, report `Docs impact: none|minor|major`. Create no docs work for `none`; update only affected existing docs for minor or major.

package/src/claude/skills/sync/references/rebind-and-audit.md

@@ -0,0 +1,59 @@
+# Rebind, bare call, and the changed-files report
+
+Read this before a rebind, a call without arguments, or any report of files
+changed. Every rule here exists because a past sync run broke it.
+
+## Snapshot first
+
+Before the first edit, record `git status --porcelain -uall` and the sha256 of
+every path it lists. A file that was already modified is not yours to claim.
+
+## Rebind
+
+`/cf:sync rebind <feature> [<task-NN-slug.md>]` refreshes the Receipt of tasks
+that are already `done`. Any other Status is reported and not written.
+
+1. Take each task's Command exactly as the validator does: the last top-level
+   `- Command:` of its Verification Plan before the first `###` sub-heading,
+   or, when there is none at top level, the last `- Command:` under the
+   sub-headings. That one Command is the one you run and write.
+2. Run every selected Command verbatim, each once as one shell, so stdout,
+   stderr and the exit code cover the whole command. Never pipe it through
+   `| tail`, never redirect only its last `&&` link to a log, never edit it.
+3. A Command that exits non-zero, prints a failure marker, or runs zero
+   required tests never yields PASS. Set `Status: blocked` and, right under
+   the `Status:` line, add one line
+   `Blocker: rebind <date>: <Command> exited <code> (<failing test line>)`;
+   keep the old Receipt, and put this line directly under its `## Receipt`
+   heading:
+   `Not current proof: the rebind run of this Command exited <code>; the record below is historical.`
+4. After all Commands have run, run the provenance command once, exactly as
+   Develop names it:
+   `node .claude/scripts/provenance.cjs --project-root . --specs-root specs --spec-file <task file> --feature-name <feature> --session <any label> --json`
+   Copy its `Base` and `Head` fields into each passing Receipt. Never type,
+   compute, shorten, or `sed`-edit Base or Head, and never write a Receipt
+   from output that a run in this call did not print.
+5. Run the provenance command again. If Head moved, say so and do not claim
+   the receipts current.
+6. Re-read each edited task: exactly one `Status:` and one `## Receipt`.
+
+## Never silence the gate
+
+A Stop-gate block is answered with fresh evidence or with a reported blocker.
+Never archive, move, rename, or delete a packet, change the specs root, or edit
+`.claude/` (including `runtime.json`) or any hook so the gate goes quiet.
+
+## Bare call
+
+`/cf:sync` without arguments audits every process-first packet under the specs
+root and writes nothing. Report archived packets, and packet directories without
+`plan.md` that CafeKit no longer reads, without touching them. End by asking with `AskUserQuestion` when the host has
+it, otherwise ask in text and stop. Only a reply that arrives after the report
+and names the changes counts as confirmation; an instruction given before the
+report, such as "close everything", does not.
+
+## Report files from git
+
+After the last edit, take the snapshot again and report every path whose
+status line or sha256 changed. List changes that were already there before the
+first edit apart from your own. Never write "no files changed" from memory.

package/src/claude/skills/sync/references/sync-protocols.md

@@ -40,23 +40,14 @@ provenance, and path or artifact mismatch.
 
 - Plan row without task file: report missing; do not synthesize scope.
 - Task file without plan row: report unknown; do not silently adopt it.
-- Done without valid Receipt: downgrade only when the repair is deterministic,
-  otherwise block and request direction.
+- Done without valid Receipt: after the user confirms, downgrade when the repair is deterministic,
+  otherwise report and request direction.
 - Receipt on unfinished task: preserve it only if it is clearly historical;
   otherwise report the conflict.
-- Missing or cyclic dependency: block affected tasks.
-- Overlapping write ownership in one proposed wave: serialize or request an
+- Missing or cyclic dependency: report; block affected tasks only after the user confirms.
+- Overlapping write ownership in one proposed wave: report and request an
   ownership decision.
 - Acceptance ID not mapped both ways: report traceability drift.
 
 After a repair, re-read every changed file and print a concise mismatch/fix/
 unresolved summary. Never claim execution proof from the audit itself.
-
-## Legacy workflow compatibility
-
-For `spec.json` packets, resolve exact `task_registry` paths and synchronize
-registry timestamps plus nested task Markdown. Validate the canonical separate
-receipt (with legacy inline Evidence only as the supported fallback), reject
-conflicting proof identities, preserve classified minimum and planning_depth,
-and use the installed legacy policy for lane, execution_tier, Flash promotion,
-and final feature closeout.

package/src/claude/skills/test/SKILL.md

@@ -12,57 +12,36 @@ metadata:
 ---
 # Test — execution proof owner
 
-`cf:test` executes the smallest adequate real verification and owns the
-canonical execution result. For process-first work it returns one typed proof
-handoff to the controller; it never writes task state or the inline Receipt.
-Review consumes validated proof and never invents or duplicates execution.
+`cf:test` executes the smallest adequate real verification and owns the canonical execution result. For process-first work it returns one typed proof handoff to the controller; it never writes task state or the inline Receipt. Review consumes validated proof and never invents or duplicates execution.
 
 ## Usage
-
 ```text
-/cf:test
-/cf:test --full
+/cf:test [--full]
 /cf:test <scope-or-path>
 /cf:test <feature-name>
-/cf:test specs/<feature>
-/cf:test specs/<feature>/task-NN-<slug>.md
-/cf:test --ui <url>
-/cf:test --ui-auth <url>
-/cf:test --ui-flow <url>
+/cf:test specs/<feature>[/task-NN-<slug>.md]
+/cf:test --ui|--ui-auth|--ui-flow <url>
 ```
-
 ## Hard gates
-
 - Never claim a pass without executing the exact relevant command.
 - Never mock, weaken, delete, or skip a failing assertion to obtain green.
-- Missing tooling, a missing command, nonzero exit, or zero executed tests is
-  never `PASS`. Do not auto-install project-local tooling during proof.
-- Preserve exact commands, counts, output, reachability, proof level, Base,
-  Head, artifact hashes, and redaction labels.
-- Source, installed, and live proof are distinct. Live adherence is
-  `[UNVERIFIED]` without a host invocation.
-- Use only `PASS | PASS_WITH_WARNINGS | FAIL | BLOCKED`. Unknown, malformed,
-  partial, contradictory, duplicate, skipped, or stale proof fails closed.
-
+- Missing tooling, a missing command, nonzero exit, or zero executed tests is never `PASS`. Do not auto-install project-local tooling during proof.
+- Preserve exact commands, counts, output, reachability, proof level, Base, Head, artifact hashes, and redaction labels.
+- Source, installed, and live proof are distinct. Live adherence is `[UNVERIFIED]` without a host invocation.
+- Use only `PASS | PASS_WITH_WARNINGS | FAIL | BLOCKED`. Unknown, malformed, partial, contradictory, duplicate, skipped, or stale proof fails closed.
 ## Target routing
-
-Classify current filesystem bytes before selecting tests. Use `lstat` so broken
-links count as markers. Never migrate or repair packet state while testing.
+Classify current filesystem bytes before selecting tests. Use `lstat` so broken links count as markers. Never migrate or repair packet state while testing.
 
 | Observed state | Route |
 |---|---|
-| Valid regular `plan.md` with `Specs-Contract: process-first-ready-v1`, one or more valid regular flat `task-NN-*.md`, and no legacy marker | Process-first |
-| Any flat marker that is orphaned, malformed, duplicated, symlinked, nonregular, or mixed with a legacy marker | `BLOCKED` |
-| Valid regular legacy root resolving every nested task and separate receipt, with no flat marker | Legacy adapter |
-| Orphan, malformed, symlinked, nonregular, identity-conflicting, or mixed legacy state | `BLOCKED` |
-| No flat or legacy marker | Ordinary non-Spec testing |
+| Valid regular `plan.md` with `Specs-Contract: process-first-ready-v1` and one or more valid regular flat `task-NN-*.md` | Process-first |
+| Any flat marker that is orphaned, malformed, duplicated, symlinked, or nonregular | `BLOCKED` |
+| A packet directory with no `plan.md` that holds the old JSON planning state | `BLOCKED`: CafeKit no longer reads it; move the work to a `plan.md` packet |
+| No flat marker | Ordinary non-Spec testing |
 
-A flat marker is a direct-child `plan.md` or `task-NN-*.md`. A legacy marker is
-`spec.json`, a nested legacy task, or a separate legacy receipt. See
-`references/execution-strategy.md` for the complete validation truth table.
+A flat marker is a direct-child `plan.md` or `task-NN-*.md`. See `references/execution-strategy.md` for the complete validation truth table.
 
 ## Spec-Aware Mode
-
 <SCOPE-GATE>
 For a feature target, test only current accepted scope, the active task's exact
 Verification Plan, and reachable runtime surfaces. Missing or orphaned
@@ -70,28 +49,19 @@ reachability fails even when a command exits successfully.
 </SCOPE-GATE>
 
 For a process-first feature:
-
-1. Read current `plan.md` and flat task bytes. Select only a contained regular
-   task whose dependencies allow proof.
-2. Use the task's exact `Command`, exact unique `Named probes`, `Reachability`,
-   `Oracle`, `Counterexample`, required proof level, and artifact declaration.
-3. Run the smallest adequate proof. `--full` expands scope but cannot weaken
-   the Verification Plan or substitute unrelated green tests.
-4. Return exactly one canonical `test-proof-v1` object. Do not edit `plan.md`,
-   `Status:`, the task's `## Receipt`, or any sibling task.
-5. The Develop controller validates the payload, recomputes its digest, checks
-   current provenance, and alone writes process-first Status and inline Receipt.
-
+- Read current `plan.md` and flat task bytes. Select only a contained regular task whose dependencies allow proof.
+- Use the task's exact `Command`, exact unique `Named probes`, `Reachability`, `Oracle`, `Counterexample`, required proof level, and artifact declaration.
+- Run the smallest adequate proof. `--full` expands scope but cannot weaken the Verification Plan or substitute unrelated green tests.
+- Return exactly one canonical `test-proof-v1` object. Do not edit `plan.md`, `Status:`, the task's `## Receipt`, or any sibling task.
+- The Develop controller validates the payload, recomputes its digest, checks current provenance, and alone writes process-first Status and inline Receipt.
 ## Execution
-
-1. Detect commands from task and repository files; never invent them.
-2. Run a cheap compile or typecheck precheck when the project provides one.
-3. Execute the exact task command and all named probes with real counts.
-4. Inspect negative paths, runtime reachability, and declared artifacts.
-5. Capture tracked, untracked, and ignored project-command drift separately
-   from runtime Head. Never silently clean or hide project changes.
-6. Redact sensitive material, validate the complete proof object, then return a
-   concise human report separately from the machine handoff.
+- Detect commands from task and repository files; never invent them.
+- Run a cheap compile or typecheck precheck when the project provides one.
+- Execute the exact task command and all named probes with real counts.
+- For Ordinary non-Spec testing, before any `PASS` or `PASS_WITH_WARNINGS`, read the tests that cover the target or changed code (every test file when the suite is small). When an assertion or its pass condition depends on a nondeterministic source — the clock, randomness, the network, shared filesystem state or test order — the verdict is `FAIL`, naming the source, even when every run passes. When only setup depends on one, rerun just the suspect tests at least twice more; any differing outcome is `FAIL` as flaky. A single green run of such a test is not `PASS`. This step does not apply to process-first Named probes, which run exactly once.
+- Inspect negative paths, runtime reachability, and declared artifacts.
+- Capture tracked, untracked, and ignored project-command drift separately from runtime Head. Never silently clean or hide project changes.
+- Redact sensitive material, validate the complete proof object, then return a concise human report separately from the machine handoff.
 
 Required proof follows the behavior:
 
@@ -104,45 +74,23 @@ Required proof follows the behavior:
 | layout, focus, labels, keyboard | viewport/visual/accessibility check |
 | regression | reproduction before fix plus passing regression |
 | security/performance | only when requirement, risk, or boundary requires it |
-
 ## Process-first proof handoff
-
 The machine payload is canonical UTF-8 JSON with exact top-level keys:
-
 ```text
-schema_version, target, verdict, command, exit, counts, provenance,
-proof_level, expected, observed, reachability, artifacts, branches,
-raw_output, redactions, payload_sha256
+schema_version, target, verdict, command, exit, counts, provenance, proof_level, expected, observed, reachability, artifacts, branches, raw_output, redactions, payload_sha256
 ```
 
-`schema_version` is exactly `test-proof-v1`; unknown keys block. Branch IDs map
-one-to-one to exact unique Named probes. The digest is lowercase SHA-256 of
-stable JSON excluding only `payload_sha256`. Exact field shapes, nullable
-pre-execution `BLOCKED` rules, and aggregation live in
-`references/execution-strategy.md`.
-
-Only all required branches passing with exact command, exit 0, executed > 0,
-failed/skipped 0, matching Base/Head, `reachability.status: PASS`, valid artifact
-hashes, and safe redaction can aggregate `PASS`. Aggregate in this order:
-`FAIL` > `BLOCKED` > `PASS_WITH_WARNINGS` > `PASS`.
+`schema_version` is exactly `test-proof-v1`; unknown keys block. Branch IDs map one-to-one to exact unique Named probes. The digest is lowercase SHA-256 of stable JSON excluding only `payload_sha256`. Exact field shapes, nullable pre-execution `BLOCKED` rules, and aggregation live in `references/execution-strategy.md`.
 
+Only all required branches passing with exact command, exit 0, executed > 0, failed/skipped 0, matching Base/Head, `reachability.status: PASS`, valid artifact hashes, and safe redaction can aggregate `PASS`. Aggregate in this order: `FAIL` > `BLOCKED` > `PASS_WITH_WARNINGS` > `PASS`.
 ## Persistent-write and authentication boundary
-
-- `.hapo/test-memory.json` is optional read-only context. Hash absent/present
-  bytes before and after; never create, merge, or update it during proof.
-- Put only Test-owned temporary files outside the project and clean them.
-  Never create Test-owned reports, caches, lazy installs, or auth state.
-- For authenticated UI proof, prefer the project's own auth helper. Otherwise
-  use only an explicitly selected user-controlled profile bound to a confirmed
-  HTTPS or localhost origin, identity, permissions, and action scope.
-- Block cross-origin redirects and destructive production actions without fresh
-  consent. Never ask for, export, paste, or persist cookies or tokens.
-- Redact Authorization, Cookie, Set-Cookie, session tokens, credentials, and
-  scoped PII from commands, headers/bodies, logs, screenshots, and reports.
-  If safe proof is impossible, return `BLOCKED`.
+- `.hapo/test-memory.json` is optional read-only context. Hash absent/present bytes before and after; never create, merge, or update it during proof.
+- Put only Test-owned temporary files outside the project and clean them. Never create Test-owned reports, caches, lazy installs, or auth state.
+- For authenticated UI proof, prefer the project's own auth helper. Otherwise use only an explicitly selected user-controlled profile bound to a confirmed HTTPS or localhost origin, identity, permissions, and action scope.
+- Block cross-origin redirects and destructive production actions without fresh consent. Never ask for, export, paste, or persist cookies or tokens.
+- Redact Authorization, Cookie, Set-Cookie, session tokens, credentials, and scoped PII from commands, headers/bodies, logs, screenshots, and reports. If safe proof is impossible, return `BLOCKED`.
 
 ## Verdict and report
-
 ```markdown
 ## Test Verdict
 
@@ -161,25 +109,12 @@ hashes, and safe redaction can aggregate `PASS`. Aggregate in this order:
 - [controller handoff, exact failure, or changed prerequisite]
 ```
 
-Do not place the full JSON payload, secrets, verbose raw logs, or screenshots in
-the concise report. `PASS_WITH_WARNINGS` remains unfinished; only literal
-validated `PASS` may be synchronized by the controller.
-
-## Legacy workflow compatibility
-
-A valid legacy packet keeps the v2.1 adapter, legacy task resolution, and its
-separate receipt path. Do not write process-first inline proof into it. If
-legacy proof identities conflict or the packet is mixed/malformed, return
-`BLOCKED`; never choose one source or migrate it during unrelated testing.
-
-Flash legacy behavior remains proof-only: testing may make a current
-`FLASH_UNVERIFIED` task eligible for trusted sync-finalize, but never promotes
-state or unblocks dependents itself. Only explicit trusted sync-finalize may
-promote it.
+Do not place the full JSON payload, secrets, verbose raw logs, or screenshots in the concise report. `PASS_WITH_WARNINGS` remains unfinished; only literal validated `PASS` may be synchronized by the controller.
 
+When the target's task can be read — a process-first packet, or a packet `BLOCKED` while it is classified that still holds exactly one regular flat task with a readable `Command` and `Named probes` — end the final message with the concise report, then a `### Machine handoff (test-proof-v1)` heading and exactly one fenced `json` block holding the validated payload. The handoff block follows the report and is not part of it. No further fenced block follows it. A pre-execution `BLOCKED` takes the same placement; its shape is in `references/execution-strategy.md` §4. For any other target, end with the report and the line `No payload: target not identifiable.`
+## Flash proof
+Flash behavior remains proof-only: testing may make a current `FLASH_UNVERIFIED` task eligible for trusted sync-finalize, but never promotes state or unblocks dependents itself. Only explicit trusted sync-finalize may promote it.
 ## References
-
-- `references/execution-strategy.md` — routing, payload schema, aggregation,
-  blast radius, UI safety, and report separation.
+- `references/execution-strategy.md` — routing, payload schema, aggregation, blast radius, UI safety, and report separation.
 - `references/failure-triage.md` — failure classification and four verdicts.
 - `references/test-memory.md` — optional read-only historical context.