@haus-tech/haus-workflow 6.2.0 → 6.4.0

package/library/global/settings-fragments/hooks.json

@@ -22,6 +22,20 @@
       "matcher": "Bash",
       "command": "haus decisions guard --from-hook"
     },
+    {
+      "id": "hook.guard.auto-merge",
+      "gate": "keep",
+      "event": "PreToolUse",
+      "matcher": "mcp__ccd_pr__set_auto_merge",
+      "command": "haus guard auto-merge --from-hook"
+    },
+    {
+      "id": "hook.pr.after-merge",
+      "gate": "keep",
+      "event": "PostToolUse",
+      "matcher": "Bash",
+      "command": "haus pr after-merge --from-hook"
+    },
     {
       "id": "hook.decisions.suggest",
       "gate": "keep",

package/library/global/skills/haus-workflow/references/clone.md

@@ -202,6 +202,142 @@ seeds: # optional: data sources NOT owned by a manifest repo (e.g. a shared Word
         login: 'Add your SSH key to the host (ssh-add …) / request access — or skip the pull.'
 ```
 
+**Workspace, format v2: the `instance:` section (per-worktree environments, ADR-0163).**
+A workspace that runs features in parallel worktrees adds `version: 2` and an `instance:`
+section, and sets `worktree.env: true` in `haus.workspace.yaml`. Unlike the rest of this
+file, `instance:` is parsed and validated strictly by the CLI (`haus doctor`; schema
+`library/schemas/localdev.v2.schema.json`); unknown keys are errors. A v1 file simply has
+no instance support.
+
+```yaml
+version: 2
+instance:
+  ports: # name -> main-checkout port; a worktree gets <leased block> + offset, in this order
+    vendure: 3000
+    admin-ui: 4200
+  datastores: # shared engines; a worktree is isolated INSIDE them, never by its own container
+    mariadb: { engine: mariadb, compose: { project: shop-workspace, service: mariadb }, port: 3318 }
+    # compose.file: the compose file (workspace-relative) when its name is not a default one,
+    # e.g. compose: { project: shop-workspace, service: pg, file: docker-compose.local.yml }
+    redis: { engine: redis, compose: { project: shop-workspace, service: redis }, port: 6381 } # needs --databases 64
+    search:
+      {
+        engine: elasticsearch,
+        compose: { project: shop-workspace, service: es },
+        port: 9201,
+        prefix: 'vendure-',
+      }
+  databases: # one database per worktree: <name>_wt_<slug>, cloned from <name>_tpl (or <name>)
+    ecom: { on: mariadb, name: shop_ecom, perWorktree: clone } # or perWorktree: empty
+  sites: # one Herd site per worktree on a copy-on-write docroot clone
+    wordpress:
+      kind: herd
+      root: shop.se # workspace-relative docroot
+      host: '{{slug}}.shop.se' # served at http://<slug>.shop.se.test
+      share: [wp-content/uploads] # symlinked to the main docroot, not copied
+      plugins: { ecom-widgets: shop-ecom-widgets } # plugin dir -> member repo in this worktree
+      config:
+        {
+          kind: wp-config-override,
+          defines: { DB_NAME: '{{db.wp}}', WP_HOME: '{{site.wordpress.url}}' },
+        }
+      after: ['wp search-replace http://shop.se.test {{site.wordpress.url}} --skip-columns=guid']
+  processes: # what `env start <name>` runs, from that member repo, on its leased port
+    vendure: { repo: shop-ecom, start: 'yarn dev', port: vendure, health: '/health' }
+  copyLocal: # extra machine-local files copied from the main checkout (mode 600)
+    - { repo: shop-ecom, path: auth.json }
+  teardown: # shell commands `env down --destroy` / `env gc --write` run before dropping databases
+    - 'docker compose -p shop-ecom-e2e-{{slug}} down -v --remove-orphans'
+env: # the same map as v1; values may now use templates
+  - value: '{{port.vendure}}'
+    sinks: [{ repo: shop-ecom, key: API_PORT }]
+  - value: '{{db.ecom}}'
+    sinks: [{ repo: shop-ecom, key: DB_NAME }]
+  - value: '{{redis.redis.db}}'
+    sinks: [{ repo: shop-ecom, key: REDIS_DB }]
+```
+
+Templates: `{{slug}}`, `{{port.<name>}}`, `{{db.<name>}}`, `{{redis.<name>.db}}`,
+`{{search.<name>.prefix}}`, `{{site.<name>.url|host|root}}`. In the main checkout they
+resolve to today's values (the main ports and database names, Redis DB 0, the main
+prefix), so one manifest serves both; only a worktree gets new ones. Only keys fed by a
+templated entry are instance-owned; every other key in a repo's `.env` is copied as it is.
+`teardown` (workspace file only) cleans up per-worktree resources the CLI does not track,
+such as a compose project an app's own test harness starts; keep each command idempotent.
+`after` (workspace file only) is its counterpart for `env up`: commands that run once per
+environment in the worktree root, after the `.env` files and `.haus-env.json` exist, such as
+copying the main bucket into a per-worktree one (`mc mirror local/assets
+local/assets-wt-{{slug}}`); a failed one is retried by the next `env up`.
+
+**Single-repo projects** (a plain repo with Claude Code worktrees, ADR-0167): the repo's own
+`.haus-workflow/localdev.yml` takes the whole `instance:` section, the flag is
+`"worktree": { "env": true }` in `.haus-workflow/haus.config.json`, and `repo:` in sinks,
+processes and `copyLocal` names a folder inside the repo (`.` for the root, `apps/server`
+for an app).
+
+**Other engines and site kinds.** The same section covers the other client stacks:
+
+```yaml
+instance:
+  datastores:
+    # An engine on the host (DBngin, Homebrew), not in Docker: haus never starts it and
+    # connects with the host's mysql/mariadb client. Credentials: export MYSQL_USER and
+    # MYSQL_PWD, or use ~/.my.cnf. `port` defaults to native.port. Supported for mariadb,
+    # mysql, elasticsearch and opensearch.
+    mysql: { engine: mysql, native: { host: 127.0.0.1, port: 3306 } }
+    #   native: { host: 127.0.0.1, port: 3306, client: /Users/Shared/DBngin/mysql/8.0.33/bin/mysql }
+    # SQL Server: database isolation (BACKUP / RESTORE WITH MOVE into <name>_wt_<slug>).
+    # azure-sql-edge has no sqlcmd; haus then runs mcr.microsoft.com/mssql-tools (amd64) on
+    # the engine's network. The SA password stays in the engine container's env.
+    mssql: { engine: mssql, compose: { project: vafab-workspace, service: mssql }, port: 49760 }
+  sites:
+    cms: # Bedrock: the root is a member repo, its .env gets the defines (copy: none is the default)
+      kind: herd
+      root: bad-varme.se
+      host: '{{slug}}.bad-varme.se'
+      php: '8.2'
+      share: [web/app/uploads]
+      config:
+        kind: bedrock-env
+        defines:
+          DB_NAME: '{{db.wp}}'
+          WP_HOME: '{{site.cms.url}}'
+          WP_SITEURL: '{{site.cms.url}}/wp'
+    app: # Laravel on Herd: same, with Laravel's keys
+      kind: herd
+      root: app.example.se
+      host: '{{slug}}.app.example.se'
+      secure: true
+      config:
+        kind: laravel-env
+        defines: { APP_URL: '{{site.app.url}}', DB_DATABASE: '{{db.api}}' }
+```
+
+`bedrock-env` and `laravel-env` write no PHP file and need no `patch-wp-config`: the
+defines become instance-owned keys of the member's `.env`, next to any `env:` sinks for
+that repo, and the rest of the main checkout's `.env` is copied as it is. Teardown unlinks
+the Herd site and never deletes the member repo.
+
+**How this relates to the clone flow.** This procedure sets up the **main checkout**: it
+brings the shared engines up, seeds the main databases and writes each repo's `.env`. It
+never touches `instance:`. A worktree then gets its own environment from that main
+checkout with one command, run inside the worktree:
+
+```bash
+haus workspace worktree env snapshot ecom   # once, and whenever fresh data is wanted: <name>_tpl from the main DB
+haus workspace worktree env up              # lease ports, clone DBs, Redis index, prefix, site, .env files
+haus workspace worktree env start vendure   # runs on the worktree's own port
+haus workspace worktree env status          # ports, URLs, databases
+haus workspace worktree env down --destroy  # or just `worktree remove`, which runs it first
+```
+
+`env up` copies each repo's `.env` from the main checkout (secrets included, never printed)
+and replaces only the instance-owned keys, so the main checkout's `.env` must exist first:
+that is exactly what this clone flow produces. Agents never read a `.env`; they use
+`haus workspace worktree env get <key>` or `.haus-env.json`. For a WordPress site with
+`config.kind: wp-config-override`, run `haus workspace worktree env patch-wp-config <site>`
+once in the main checkout (it backs the file up and never prints it).
+
 #### Run order
 
 1. **Discover** `.haus-workflow/localdev.yml` in the workspace root and each repo.

package/library/global/skills/request/SKILL.md

@@ -429,7 +429,11 @@ Model runs from `utvärdera` live in a tree of their own and are never pricing i
 
 1. **Source material.** A raw request pasted in, or a gid: then fetch the item via
    request-sync (the main conversation) and use `## Ursprunglig förfrågan`
-   verbatim.
+   verbatim. For a fetched item, write the fetched `## Ursprunglig förfrågan` text, byte for
+   byte, as `<katalog>/onskemal.md` in every directory the spec is archived in (step 5),
+   the same file name the experiment channel uses: `korning.mjs --post` reads it into
+   draft mode's `URSPRUNGLIG FÖRFRÅGAN:` block, so `request-designer` sees the customer's
+   own words, and without it the block says `(saknas i arkivet)` (#745).
 2. **Source manifest.** Isolated subagents cannot "look before they assume" without
    help. Build a manifest before dispatch: relevant grep hits in the repo
    (views/terms the request mentions), earlier specs for the same customer (the archive +
@@ -632,11 +636,13 @@ to the interview.
      in the customer repo.
    - Stop after the doc is written and self-reviewed. Do not invoke `writing-plans`:
      the developer does that when the customer orders.
-   - Do not commit. The task stages the file and offers the commit in its closing line.
+   - Do not commit. The task stages the file and handles the commit at its close.
    ```
 
    A brainstorming session that ends without a file records nothing: `state.json` is
-   untouched and `designa` can be rerun.
+   untouched and `designa` can be rerun. The customer repo is the main checkout or any
+   linked worktree of the same repository, anywhere on disk (`add-design` accepts a doc
+   whose `git rev-parse --git-common-dir` is the main checkout's `.git`, #747).
 
 5. **Record.** Format the doc with the repo's formatter first (`yarn prettier --write <sökväg>`
    when the repo has prettier, otherwise nothing): a format-on-commit hook must not
@@ -648,8 +654,9 @@ to the interview.
    byte-identically into the directory as `design.md`, writes `state.json.design` and
    sets status `designed`. It writes no runs row (see the `state.json` contract). Then
    run `node <skillkatalog>/scripts/precheck.mjs <katalog> --design` and show any
-   BRIST or VARNING lines. Stage the file (`git add <sökväg>`); never commit (the
-   house git rule: commit only on explicit OK).
+   BRIST or VARNING lines. Stage the file (`git add <sökväg>`); never commit in this step
+   (the house git rule: commit only on explicit OK): the commit is the design commit at
+   the close, step 6.
 
    **A refused doc with conflicts** (exit 2 on `## Spec conflicts`): copy the refused
    doc into the directory as `design-avvisad-<datum>.md` (`-2` on collision, never
@@ -669,7 +676,7 @@ to the interview.
    item's state (status `priced` or `guard_run`, a standing stop other than a design
    conflict) is not fixed in the doc: `respec`, or decide the stop first.
 
-6. **Continue into `bedöm`, or close.** When `add-design` recorded the doc, `precheck --design` wrote no BRIST and `## Spec conflicts` is `none`, run `bedöm <adress>` now, in the same turn, from its step 1 (the gate is reread from the board; the design is internal, so nothing reaches the customer before `bedöm`'s own sync rule, ADR-0153): the turn then ends with `bedöm`'s BLUF and Closing, never with a second block. If `bedöm` stops before its step 8 (its gate, a candidate, a contradiction), its Closing still carries the design doc's path and the commit offer. VARNING lines stop nothing: the chain runs. In every other case (a refused doc, a BRIST, an interview that ended without a file), **Reply BLUF:** one line per item (the design's title and path), the `## Spec conflicts` section verbatim when it is not `none`, the commit offer, then **Close per `## Closing: where the item stands`** (the table from `archive.mjs nasta-steg`, the board line, the ISÄR check), never without. For a doc refused on conflicts, the Closing's part 4 presents the conflicts as the choice (`## Avgjorda val`, `respec`, `speca <adress>`).
+6. **Continue into `bedöm`, or close.** **The design commit**, here and wherever this skill names it, means: commit the design doc and any tracked setup files not committed yet (the board connection and what `haus apply` wrote) per the user's commit rule. With a standing authorization (the user's own instructions let the agent commit and push without asking), commit them, push the branch within that rule's limits and report the commit; without one, it is the commit offer: name the files and ask. The request archive is never part of it: specs, analyses and scores stay in the local archive, which is kept out of git on purpose. When the turn continues into `bedöm`, the design commit runs after `bedom.mjs` has exited, never while it runs (`bedöm`: commit nothing in `--repo-rot` while the process runs). When `add-design` recorded the doc, `precheck --design` wrote no BRIST and `## Spec conflicts` is `none`, run `bedöm <adress>` now, in the same turn, from its step 1 (the gate is reread from the board; the design is internal, so nothing reaches the customer before `bedöm`'s own sync rule, ADR-0153): the turn then ends with `bedöm`'s BLUF and Closing, never with a second block. If `bedöm` stops before its step 8 (its gate, a candidate, a contradiction), its Closing still carries the design doc's path and the design commit. VARNING lines stop nothing: the chain runs. In every other case (a refused doc, a BRIST, an interview that ended without a file), **Reply BLUF:** one line per item (the design's title and path), the `## Spec conflicts` section verbatim when it is not `none`, the design commit, then **Close per `## Closing: where the item stands`** (the table from `archive.mjs nasta-steg`, the board line, the ISÄR check), never without. For a doc refused on conflicts, the Closing's part 4 presents the conflicts as the choice (`## Avgjorda val`, `respec`, `speca <adress>`).
 
 ## Task: `bedöm`
 
@@ -762,7 +769,7 @@ before the analysis (ADR-0156); the verdict is a judgment and is never redispatc
 routes to `designa <adress>`, the interview. Commit nothing in `--repo-rot` while
 the process runs: the impact row records the `HEAD` the assessor read (`repo_sha`).
 
-3. **Analysis.** If `impact.md` is missing, or precheck rejects it on
+3. **Analysis (machine step: `korning.mjs` runs steps 3 and 4 in one process).** If `impact.md` is missing, or precheck rejects it on
    source-material provenance (the analysis was made against another spec or another design): this requires a repo in
    the session (otherwise stop: a guessed analysis is forbidden by the skill itself).
    Dispatch `request-assessor` per the prompt template: the spec's reviewer block
@@ -803,7 +810,7 @@ the process runs: the impact row records the `HEAD` the assessor read (`repo_sha
    the rejected draft a receipt exactly as in speca step 6: archive it as
    `impact-avvisad-<datum>.md` and stamp a runs row of its own with the check's
    error lines in `--note` (ADR-0099).
-4. **Pricing.** Dispatch `request-scorer` per the prompt template.
+4. **Pricing (machine step, the same process as step 3).** Dispatch `request-scorer` per the prompt template.
    No price list, no repo, no other items' documents in the prompt.
 5. **Anchor resolution and contract check.** Write the agent's whole reply text (JSON
    plus tail lines) to a file and run
@@ -884,7 +891,8 @@ the process runs: the impact row records the `HEAD` the assessor read (`repo_sha
      quoting the source text where it decides. It was the evidence that decided the
      ruling in every measured genuine disagreement. Never paste the diff rows:
      the diff rows go into run 1's runs row `--note`, so `detaljer <item> state` shows
-     them. Then refer to `döm <item>` and STOP: no rerun, no escalation, no choice
+     them (`korning.mjs` writes them there too; an archive it wrote before #754 carries
+     them on run 2's row, so read both rows). Then refer to `döm <item>` and STOP: no rerun, no escalation, no choice
      of run.
    - **LIKA_TOLERANS** (a score difference ≤ 0.5 with the same outcome, regardless of
      confidence, a confidence difference alone never rejects a pair within
@@ -949,7 +957,7 @@ ref-hash.mjs på request-score/references/poangskala.md>
    handwritten. Under the table, one plain sentence per deviation
    worth seeing (an escalation, a split, missing input, something the scorer
    flagged), per `## Reply wording`. The JSON is not shown in the chat:
-   `detaljer <item>` does that. When `bedöm` was entered from `designa` (designa step 6), the BLUF also carries the design doc's path and the commit offer `designa` would have printed. Writing back to the board happens via request-sync
+   `detaljer <item>` does that. When `bedöm` was entered from `designa` (designa step 6), the BLUF also carries the design doc's path and the design commit (designa step 6), run now that `bedom.mjs` has exited: with a standing authorization, the files committed and pushed and the commit reported; otherwise the commit offer `designa` would have printed. Writing back to the board happens via request-sync
    in the main conversation, only on explicit request, and it is that move
    that takes the item ✅ Spec ok → ⚖️ Poängsättning redo för granskning per
    the sync's rules. Then record the write: `node <skillkatalog>/scripts/archive.mjs synced <katalog> --offer-status "<the status request-sync set>"` (not on a split part, whose receipt is `set-split-gid`; on the split root, in the run that moves the parent). **Close per `## Closing: where the item stands`**
@@ -1066,6 +1074,22 @@ get wrong:
   (🔍 Spec redo för granskning, ⚖️ Poängsättning redo för granskning). If
   the item stands anywhere else: show the status and stop instead of guessing.
 - **`godkänn <nr|gid>`:** 🔍 → ✅ Spec ok, and ⚖️ → 📤 Klar – till kund respectively.
+  **After a 🔍 → ✅ Spec ok move** that request-sync reports done, on an item with an
+  archive directory and no design yet (`state.json.design` is `null`), the next leg starts
+  in the same turn, chosen by `design_mode` in `.haus-workflow/request.json` in the main
+  checkout (ADR-0156):
+  - `draft`: continue into `bedöm <item>` from its step 1, as designa step 6 does (the gate
+    is reread from the board and recorded there, and `bedom.mjs` drafts and reviews the
+    design). The turn ends with `bedöm`'s BLUF and Closing, once.
+  - `interview`, or the key absent: start `designa <item>` from its step 1 and ask the
+    brainstorming's first question in the same turn. The turn ends with that question; the
+    Closing comes with the turn that ends `designa` (or the `bedöm` it continues into). A
+    `designa` that stops before the brainstorming closes in this turn, per its step 6.
+  - Either way, nothing here publishes a score: the ⚖️ sync still waits for `synka`
+    (bedöm step 8). `godkänn 2 och 4` stays two calls: in draft mode each continues into
+    its own `bedöm`, in interview mode only the first starts its interview in the turn and
+    the other waits for `designa <item>`. The ⚖️ → 📤 move and the manual approval below
+    continue into nothing.
 - **`underkänn <nr|gid> <reason>`:** the reason is mandatory: without a reason, ask
   for it. request-sync adds the reason as a comment on the item, raises
   the iteration counter and moves the status backward per its backward-move rules.
@@ -1082,7 +1106,8 @@ get wrong:
 - **Close per `## Closing: where the item stands`** when the item has an
   archive directory: the table from `archive.mjs nasta-steg` plus the board line, so
   the move is visible together with what it opens up for (`designa`, customer, nothing),
-  and the wrap-up lines at a resting point.
+  and the wrap-up lines at a resting point. A move that continues into `bedöm` or
+  `designa` (above) leaves the block to the turn that ends the continued task.
 
 ## Task: `döm`
 
@@ -1187,7 +1212,8 @@ facts in the analysis above.
 ## Task: `detaljer`
 
 `detaljer <gid|slug|nr> [del-N] [step]`: print archived files for the item: without
-a step, a list of what exists; with a step (`spec`, `granskarblock`, `design`,
+a step, a list of what exists (the listing names `onskemal.md`, the customer's original
+request from `speca` step 1, when present); with a step (`spec`, `granskarblock`, `design`,
 `granskning`, `analys`, `poäng`, `state`) the file's content raw (`design` prints `design.md`,
 `granskning` prints `design-review.md` when present);
 `klass` reads older archives'
@@ -1707,7 +1733,7 @@ them failed an automatic check and was redone once; the redo agreed with the oth
 ## Closing: where the item stands
 
 The tasks `speca`, `designa`, `bedöm`, `godkänn`, `underkänn`, `döm` and `byt titel` ALWAYS end
-with this block (#530). A `designa` that continues into `bedöm` (designa step 6) ends the turn with `bedöm`'s block, once: the block is per turn, never per task. A reply that ends without it leaves
+with this block (#530). A `designa` that continues into `bedöm` (designa step 6) ends the turn with `bedöm`'s block, once, and so does a `godkänn` that continues into `bedöm` in draft mode: the block is per turn, never per task. A `godkänn` that starts the `designa` interview ends its turn with the interview's first question, and the block comes with the turn that ends `designa` (or the `bedöm` it continues into). A reply that ends without it leaves
 the user to guess where the item stands, what they should do and which command
 runs on, and the archive and the board can then drift apart silently (`spec_draft`
 locally, empty Offer status on the board). The block consists of five parts, in order:
@@ -1782,8 +1808,10 @@ locally, empty Offer status on the board). The block consists of five parts, in
    terms or archive file names):
    - Commit the design document and the setup files (the board connection and what
      `haus apply` wrote), if they are not committed yet; in a temporary workspace, get
-     them onto the main branch before the workspace is removed. This line replaces the
-     separate design commit offer in the same turn.
+     them onto the main branch before the workspace is removed. This line is the turn's
+     design commit (designa step 6) and replaces a separate one: with a standing
+     authorization, commit and push the files first and let the line report the commit
+     (what went in, on which branch) instead of asking; without one, it stays the offer.
    - Keep the specs, analyses and scores out of the customer's history: they stay in the
      local request archive, which is kept out of git on purpose.
    - When the customer orders, planning starts from the saved design document; if the
@@ -2031,14 +2059,17 @@ reference files whose rules it mirrors and WARNS when a catalog bump has changed
   `bedom.mjs` takes `--design-mode draft|intervju` and passes it to every `korning.mjs` it
   starts; without the flag the value is `request.json`'s `design_mode` (`interview` is read
   as `intervju`), and without that key `intervju` (ADR-0156).
-- `scripts/korning.mjs --katalog <abs k<N>> --exp <abs experimentkatalog> --repo-rot <abs> --request-id <gid eller slug> --modell <modell|default> [--claude <kommando>] [--delar-parallellt 2] [--effort <low|medium|high|xhigh|max|default>] [--sprak <svenska|engelska>]`:
+- `scripts/korning.mjs --katalog <abs k<N>> --exp <abs experimentkatalog> --repo-rot <abs> --request-id <gid eller slug> --modell <modell|default> [--claude <kommando>] [--delar-parallellt 2] [--steg-timeout 1800000] [--effort <low|medium|high|xhigh|max|default>] [--sprak <svenska|engelska>]`:
   utvärdera's inner process (see `utvärdera` step 4), a script without
   model turns. In production (`bedom.mjs`) `--post <abs postkatalog>` replaces `--exp`
   plus `--request-id` (giving `--request-id` with `--post` is a usage error, the id comes
   from the item's `state.json`) and runs `bedöm` steps 3 to 7 on the item directory,
   printing `STATUS: <priced|assessed|stopp|väntar på dom|ofärdig>` on stdout (ADR-0155).
   `--startare <pid>` (production only, a usage error with `--exp`) is the starter's pid,
-  checked every 30 s: a dead starter aborts the run like SIGTERM (exit 130).
+  checked every 30 s: a dead starter aborts the run like SIGTERM (exit 130). A signal
+  abort in production prints `STATUS: ofärdig` before it exits.
+  `--steg-timeout <ms>` is the wall-clock cap on every agent step (default 1800000, 30
+  minutes): a step that hangs without replying is killed and counts as a failed step.
   `--sprak` overrides the language in both modes; in production it otherwise comes from
   `SPRÅK:` in `kallmanifest.md`, and a missing language is exit 2. In utvärdera it builds
   the prompts from `onskemal.md`, `kallmanifest.md` and `experiment.json`, where `sprak` is MANDATORY: if it is missing, an
@@ -2062,7 +2093,8 @@ reference files whose rules it mirrors and WARNS when a catalog bump has changed
   with `add-design` (in utvärdera written as the part's `design.md` and checked with
   `precheck --design-utkast`), then `request-design-reviewer`, whose reply is recorded with
   `add-design-review` (in utvärdera copied as the part's `design-review.md`).
-  `INTERVJU KRÄVS:` gives `stopp` with `intervju krävs: <reason>` and writes nothing, a
+  `INTERVJU KRÄVS:` gives `stopp` with `intervju krävs: <reason>` and writes nothing (in
+  production an empty reason is a script-proven breach, redispatched ONCE, then `ofärdig`), a
   refusal on `## Spec conflicts` gives the receipt and the stop of `designa` step 5, any other
   refusal, BRIST or symbol hit gives `ofärdig`, and `VERDICT: stopp` gives `stopp` with
   `designgranskning: <first finding>`. A reviewer reply without a `VERDICT:` first line is a

package/library/global/skills/request/scripts/archive.mjs

@@ -1898,6 +1898,7 @@ if (cmd === 'add-run') {
   const lockPath = acquireLock()
   let skrivet = false
   let ersatter = false
+  let orsakIfylld = false
   try {
     const state = readStateOrThrow()
     const befintlig = state.stopp ?? null
@@ -1914,7 +1915,7 @@ if (cmd === 'add-run') {
     } else if (befintlig !== null) {
       // Write-once på utfall+kalla; datumet och orsaken ingår inte, ett
       // identiskt omanrop en annan dag (eller med en annan orsakstext) är en
-      // no-op.
+      // no-op, utom när stoppet saknar orsak (#753, nedan).
       const begart = { utfall, kalla }
       const skiljer = Object.keys(begart).filter((k) => befintlig[k] !== begart[k])
       if (skiljer.length > 0) {
@@ -1923,6 +1924,15 @@ if (cmd === 'add-run') {
             `från ${utfall} ur ${kalla} (${skiljer.join(', ')}); arkivet är append-only, kör respec för att nolla`,
         )
       }
+      // #753: ett stopp skrivet utan orsak får den när omanropet bär en (ur
+      // filen eller flaggan). Bara orsaken fylls i; utfall, källa och datum
+      // står kvar, och ett stopp som redan har en orsak rörs aldrig.
+      if (!befintlig.orsak && orsak) {
+        state.stopp = { ...befintlig, orsak }
+        writeStateOrThrow(state)
+        skrivet = true
+        orsakIfylld = true
+      }
     } else {
       state.stopp = { utfall, kalla, date: today(), ...(orsak ? { orsak } : {}) }
       // impact.md: posten gick genom bedöm och är analyserad. spec.md,
@@ -1945,9 +1955,11 @@ if (cmd === 'add-run') {
   console.log(
     ersatter
       ? `OK: stopp ${utfall} ur ${kalla} (ersätter designkonflikten ur impact.md)`
-      : skrivet
-        ? `OK: stopp ${utfall} ur ${kalla}`
-        : `OK: stopp ${utfall} ur ${kalla} oförändrat`,
+      : orsakIfylld
+        ? `OK: stopp ${utfall} ur ${kalla} oförändrat, orsak ifylld`
+        : skrivet
+          ? `OK: stopp ${utfall} ur ${kalla}`
+          : `OK: stopp ${utfall} ur ${kalla} oförändrat`,
   )
 } else if (cmd === 'respec') {
   // Speca steg 5 som kommando: en ny spec över befintlig katalog invaliderar
@@ -2255,6 +2267,27 @@ if (cmd === 'add-run') {
   }
   const pid = Number(pidTxt)
   const katalogKorning = flag('katalog-korning')
+  // #748: kvittots katalog är bedom.mjs:s körningskatalog, redan skapad.
+  if (katalogKorning !== null) {
+    if (!path.isAbsolute(katalogKorning)) {
+      console.error(
+        `korning-start: --katalog-korning måste vara en absolut sökväg (${katalogKorning})`,
+      )
+      process.exit(2)
+    }
+    let arKatalog = false
+    try {
+      arKatalog = statSync(katalogKorning).isDirectory()
+    } catch {
+      arKatalog = false
+    }
+    if (!arKatalog) {
+      console.error(
+        `korning-start: --katalog-korning är ingen katalog som finns (${katalogKorning}); skapa körningskatalogen först`,
+      )
+      process.exit(2)
+    }
+  }
   const lockPath = acquireLock()
   let varning = null
   try {
@@ -2290,7 +2323,8 @@ if (cmd === 'add-run') {
   try {
     const state = readStateOrThrow()
     if (state.experiment === true) throw new ArkivFel('korning-slut vägrar: experimentkatalog')
-    if (state.korning !== null) writeStateOrThrow({ ...state, korning: null })
+    // #748: inget kvitto (null eller frånvarande) är ingen skrivning.
+    if (state.korning != null) writeStateOrThrow({ ...state, korning: null })
   } catch (e) {
     releaseLock(lockPath)
     if (e instanceof ArkivFel) {
@@ -2665,6 +2699,39 @@ function repoRotFor(d) {
  *  en analys lades undan och varningarna (ADR-0156 beslut 4: utkastsektioner
  *  på ett intervjudokument, en symbolkontroll som inte kunde köras), som
  *  anroparen skriver på stderr. */
+/** #747: katalogens git-common-dir som realpath, eller null när den inte
+ *  kan prövas (ingen git, inget repo). Miljöns GIT_DIR, GIT_WORK_TREE och
+ *  GIT_COMMON_DIR tas bort: inne i en git-hook pekar de på hookens repo, och
+ *  svaret ska gälla katalogen, aldrig det repot (granskning Minor 1). */
+function gitCommonDirReal(dir) {
+  const env = { ...process.env }
+  for (const k of ['GIT_DIR', 'GIT_WORK_TREE', 'GIT_COMMON_DIR']) delete env[k]
+  const r = spawnSync('git', ['-C', dir, 'rev-parse', '--git-common-dir'], {
+    encoding: 'utf8',
+    timeout: 5000,
+    env,
+  })
+  if (r.error || r.status !== 0) return null
+  const ut = r.stdout.trim()
+  if (ut === '') return null
+  try {
+    return realpathSync(path.resolve(dir, ut))
+  } catch {
+    return null
+  }
+}
+
+/** #747: ligger filen i en länkad worktree av samma repo, var som helst på
+ *  disken? Sant när filens katalog och huvudutcheckningen har samma
+ *  git-common-dir, löst likadant på båda sidor, så en `.git` som är en gitfil
+ *  (en submodul, --separate-git-dir) också fungerar (granskning Minor 2).
+ *  Allt som inte kan prövas är falskt: vägran står kvar. */
+function iLankadWorktree(real, rotReal) {
+  const dok = gitCommonDirReal(path.dirname(real))
+  if (dok === null) return false
+  return dok === gitCommonDirReal(rotReal)
+}
+
 function laggTillDesign(state, fil) {
   const rot = repoRotFor(katalog)
   if (rot === null)
@@ -2678,7 +2745,7 @@ function laggTillDesign(state, fil) {
     throw new ArkivFel(`kan inte läsa ${fil}: ${e.message}`)
   }
   const rotReal = realpathSync(rot)
-  if (!real.startsWith(rotReal + path.sep))
+  if (!real.startsWith(rotReal + path.sep) && !iLankadWorktree(real, rotReal))
     throw new ArkivFel(`${real} ligger utanför repo-roten ${rotReal}`)
   // Slutgranskning M3: arkivet är aldrig designdokumentets hem. Arkivets egen
   // design.md som --file hade lagts undan av laggUndan innan kopian, som då
@@ -2955,7 +3022,13 @@ function delKlar(state, d) {
 function nastaStegFor(state, { post, antalDelar, scorerUtfall, delning = null }) {
   const status = state.status
   const gid = state.request_id ?? '<gid>'
-  const adress = state.request_id ?? post
+  // #752: en produktionsdel (split.parent satt, request_id null) nås som
+  // <förälderns gid>/del-N; mappnamnet ensamt löser inte. Experiment- och
+  // buntdelar bär sitt eget id och behåller sin form.
+  const produktionsdel =
+    state.request_id == null && state.split?.parent != null && state.experiment !== true
+  const delAdress = produktionsdel ? `${state.split.parent}/${path.basename(post)}` : null
+  const adress = state.request_id ?? delAdress ?? post
   const stopp = state.stopp ?? null
   const runs = state.runs ?? []
   const nScore = maxN(runs, 'score')
@@ -3017,7 +3090,7 @@ function nastaStegFor(state, { post, antalDelar, scorerUtfall, delning = null })
   if (antalDelar > 0) return rad('se delarna', 'se delarna', `bunt (${antalDelar} delar)`)
   if (korningLever)
     return rad('processen', 'vänta; bedöm igen när bedom.mjs är klar', `pågår (pid ${korningPid})`)
-  if (vantarDom) return rad('dom (döm)', `döm ${post}`)
+  if (vantarDom) return rad('dom (döm)', `döm ${delAdress ?? post}`)
   if (stopp) {
     const val = stopp.orsak ?? stopp.kalla
     if (stopp.utfall === 'KONCEPT' || stopp.utfall === 'DIAGNOS') return kunddialog()

package/library/global/skills/request/scripts/bedom.mjs

@@ -44,7 +44,7 @@
  * matning.json med signalen, rensar varje kvitto med korning-slut och avslutar
  * med 130. Ett oväntat kast i huvudloopen skrivs på stderr och ger exit 2.
  */
-import { existsSync, mkdirSync, readFileSync, readdirSync, rmdirSync, realpathSync } from 'node:fs'
+import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, realpathSync } from 'node:fs'
 import { spawnSync } from 'node:child_process'
 import path from 'node:path'
 import { fileURLToPath } from 'node:url'
@@ -408,12 +408,12 @@ async function korPost(post, ctx) {
   const runDir = korningsKatalog(dir, ctx.now ? ctx.now() : new Date())
   const start = startaKorning(dir, ctx.pid ?? process.pid, runDir, { arkivKor })
   if (start.pagar) {
-    rmdirSync(runDir)
+    rmSync(runDir, { recursive: true, force: false })
     ut(`PÅGÅR ${post} (pid ${start.pid})`)
     return rad('pågår', { orsak: `pid ${start.pid}` })
   }
   if (start.fel) {
-    rmdirSync(runDir)
+    rmSync(runDir, { recursive: true, force: false })
     ut(`KLAR ${post} ofärdig`)
     return rad('ofärdig', { orsak: start.fel })
   }