@miller-tech/uap 1.218.0 → 1.219.0

package/docs/reference/CONFIGURATION_REFERENCE.md

@@ -42,24 +42,60 @@ uap config wizard               # interactive expert configurator (also: uap set
 | | |
 |---|---|
 | **Where** | `.uap.json` |
-| **Type** | enum (block \| advisory \| off) |
+| **Type** | enum (block \| advisory \| off \| escalate) |
 | **Default** | `block` |
 
-How the delivery gate treats a direct source edit outside `uap deliver`. `block` refuses it (exit 2), `advisory` warns but allows, `off` disables the gate. (The `UAP_ENFORCE_DELIVERY` env var overrides this at runtime.)
+How the delivery gate treats a direct source edit outside `uap deliver`. `block` refuses it (exit 2) and routes it to deliver; `escalate` lets direct edits land and routes to deliver only as an ESCALATION — after `delivery.escalateAfterFailures` consecutive gate failures, `delivery.escalateAfterEdits` edits to one file with no green gate, or a single change above `delivery.complexEditChars`; `advisory` warns but allows; `off` disables the gate. (The `UAP_ENFORCE_DELIVERY` env var overrides this at runtime.)
 
-**Recommendation:** `block` for hands-free/local-model work so every change is gated and verified; `advisory` when a capable human/Opus is driving and you want warnings without friction.
+**Recommendation:** `escalate` for everyday agent work: small and medium edits go straight to disk and are judged by the project's own build/test + the verify hooks, while deliver is reserved for complex multi-file work and for when direct editing is demonstrably not working. `block` only when EVERY change must pass the convergence loop (unattended hands-free runs); `advisory` when a capable human is driving.
 
 ### `delivery.localMode`
 
 | | |
 |---|---|
 | **Where** | `.uap.json` |
-| **Type** | enum (advisory \| deliver \| block) |
+| **Type** | enum (advisory \| deliver \| block \| escalate) |
 | **Default** | `advisory` |
 
-How local-model sessions are routed through delivery. `deliver` runs builds through the convergence loop; `block` forbids raw edits; `advisory` warns.
+How a local-model session resolves a `block` posture. `escalate` lets direct edits land and escalates to deliver on evidence (failed gates, churn, size); `deliver` routes every substantive edit through the convergence loop; `block` forbids raw edits; `advisory` warns.
 
-**Recommendation:** `deliver` when a local model does the writing (routes it through the verified loop); `advisory` for exploratory work.
+**Recommendation:** `escalate` when a local model does the writing — deliver becomes the escalation point instead of a tax on every small task; `deliver` only for unattended runs where each change must be converged; `advisory` for exploratory work.
+
+### `delivery.escalateAfterFailures`
+
+| | |
+|---|---|
+| **Where** | `.uap.json` |
+| **Type** | number |
+| **Default** | `2` |
+
+Escalate mode: after this many CONSECUTIVE verification failures (uap verify, the stop hook, or a build/test command observed by the hooks) since the last green gate, the next non-trivial direct source edit is refused and routed to `uap deliver` with the failure attached. 0 disables this trigger.
+
+**Recommendation:** Leave at 2: one failure is normal iteration; two in a row with no green in between is the signal that direct editing is not converging.
+
+### `delivery.escalateAfterEdits`
+
+| | |
+|---|---|
+| **Where** | `.uap.json` |
+| **Type** | number |
+| **Default** | `10` |
+
+Escalate mode: when one source file has been edited this many times with no green gate in between, the next edit to it escalates to `uap deliver` (thrashing guard). Any passing verification resets the count. 0 disables this trigger.
+
+**Recommendation:** Leave at 10 — generous enough for honest iteration, low enough to stop a model that is patching the same file line by line.
+
+### `delivery.complexEditChars`
+
+| | |
+|---|---|
+| **Where** | `.uap.json` |
+| **Type** | number |
+| **Default** | `6000` |
+
+Escalate mode: a single edit or whole-file write above this many characters (or a write that guts a substantial file) is treated as complex work and routed through `uap deliver` so it is verified rather than trusted blind. 0 disables this trigger.
+
+**Recommendation:** 6000 characters is roughly a whole module; anything that size deserves the convergence loop. Raise it for generated/vendored code, lower it for a weak executor.
 
 ### `deliver.escalateModel`
 
@@ -78,7 +114,7 @@ Stronger model id for deliver escalation ladders: repair passes, the phase-5 esc
 | | |
 |---|---|
 | **Where** | shell env |
-| **Type** | enum (block \| advisory \| off) |
+| **Type** | enum (block \| advisory \| off \| escalate) |
 | **Default** | `block` |
 
 Runtime override of the delivery gate read by the hooks/enforcers from the shell env. Takes precedence over `delivery.enforcement`.
@@ -217,7 +253,7 @@ Base URL of an OpenAI-compatible, image_url-capable endpoint used for aesthetic
 | **Type** | string |
 | **Default** | `` |
 
-Model id sent to the vision endpoint for aesthetic review (e.g. qwen36-35b-a3b-iq4xs).
+Model id sent to the vision endpoint for aesthetic review (e.g. qwen3.8-27b).
 
 **Recommendation:** Set by `uap setup` to your local vision model. Required for blocking vision review under `max` fidelity.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miller-tech/uap",
-  "version": "1.218.0",
+  "version": "1.219.0",
   "description": "Autonomous AI agent memory system with CLAUDE.md protocol enforcement",
   "type": "module",
   "main": "dist/index.js",

package/src/policies/enforcers/delivery_enforcement.py

@@ -17,6 +17,24 @@ Escape hatches (always honored, even in block mode):
   - UAP_DELIVER_ACTIVE=1   set by the deliver loop for its own subprocesses
   - UAP_DELIVER_BYPASS=1   explicit operator override for a sanctioned manual edit
 
+ESCALATE mode (`delivery.enforcement: escalate`, or `delivery.localMode:
+escalate` for a local-model session under block): deliver is an ESCALATION
+POINT, not the path every edit is forced through. Ordinary source edits go
+straight to disk (the project's own build/test + the verify hooks judge them)
+and the gate routes to `uap deliver` only when the evidence says direct editing
+is not working or the change is too big to land unverified:
+
+  - failures : >= delivery.escalateAfterFailures (default 2) consecutive
+               verification failures since the last green gate
+  - churn    : one file edited >= delivery.escalateAfterEdits (default 10)
+               times with no green gate in between (thrashing)
+  - complex  : a single edit/write above delivery.complexEditChars (default
+               6000) or a whole-file rewrite that guts a substantial file
+
+The evidence lives in .uap/escalation-state.json, written by the
+escalation_tracker.py hook (uap verify / stop hook / build+test shell results)
+and cleared by any green verification or a landed deliver run.
+
 Exempt by construction: non-source files, docs/configs/scripts/policies, test
 files (deliver protects those itself), and tooling dot-dirs.
 """
@@ -277,12 +295,195 @@ def _is_local_model_session() -> bool:
 # Back-compat: UAP_DELIVER_LOCAL_ADVISORY=0 maps to "block".
 def _local_mode() -> str:
     m = os.environ.get("UAP_DELIVER_LOCAL_MODE", "").lower()
-    if m in {"advisory", "deliver", "block"}:
+    if m in {"advisory", "deliver", "block", "escalate"}:
         return m
     adv = os.environ.get("UAP_DELIVER_LOCAL_ADVISORY", "on").lower()
     return "advisory" if adv not in {"0", "off", "false", "no", ""} else "block"
 
 
+def _effective_mode() -> str:
+    """The gate posture for THIS operation: block | advisory | off | escalate.
+
+    `UAP_ENFORCE_DELIVERY` (config-authoritative via the policy gate) wins. A
+    local-model session under `block` is then resolved through
+    `UAP_DELIVER_LOCAL_MODE`: advisory -> advisory, escalate -> escalate,
+    deliver/block -> block (keep the route-through-deliver block).
+    """
+    mode = os.environ.get("UAP_ENFORCE_DELIVERY", "block").lower()
+    if mode == "block" and _is_local_model_session():
+        lm = _local_mode()
+        if lm in {"advisory", "escalate"}:
+            return lm
+    return mode
+
+
+# ── ESCALATE mode: evidence-driven routing ───────────────────────────────────
+ESCALATION_STATE_FILE = ".uap/escalation-state.json"
+
+
+def _delivery_cfg_int(root: Path, key: str, env: str, default: int) -> int:
+    """An integer budget from the environment, else `.uap.json` delivery.<key>."""
+    raw = os.environ.get(env)
+    if raw is not None:
+        try:
+            return max(0, int(raw))
+        except ValueError:
+            pass
+    try:
+        import json as _json
+        cfg_root = Path(os.environ.get("UAP_MAIN_ROOT") or root)
+        cfg = _json.loads((cfg_root / ".uap.json").read_text(encoding="utf-8"))
+        value = (cfg.get("delivery") or {}).get(key)
+        if isinstance(value, bool):
+            return default
+        if isinstance(value, (int, float)):
+            return max(0, int(value))
+    except Exception:
+        pass
+    return default
+
+
+def _escalation_state(root: Path) -> dict:
+    """The tracker's evidence, or an empty record. Evidence older than
+    UAP_DELIVER_ESCALATION_TTL_SEC (default 6h) is ignored: yesterday's red
+    build must not gate today's first edit."""
+    import json as _json
+    import time as _time
+    empty = {"failures": 0, "edits_since_green": {}, "last_failure": None}
+    try:
+        st = _json.loads((root / ESCALATION_STATE_FILE).read_text(encoding="utf-8"))
+        if not isinstance(st, dict):
+            return empty
+    except Exception:
+        return empty
+    try:
+        ttl = int(os.environ.get("UAP_DELIVER_ESCALATION_TTL_SEC", "21600"))
+    except ValueError:
+        ttl = 21600
+    # Age the FAILURE evidence by when it was recorded, not by the last edit:
+    # `updated` moves on every direct edit, which would keep a two-day-old red
+    # gate alive for as long as the agent keeps typing.
+    lf = st.get("last_failure") if isinstance(st.get("last_failure"), dict) else None
+    anchor = int((lf or {}).get("ts") or st.get("updated") or 0)
+    if ttl > 0 and int(_time.time()) - anchor > ttl:
+        return empty
+    st.setdefault("failures", 0)
+    st.setdefault("edits_since_green", {})
+    return st
+
+
+def _record_escalation_edit(root: Path, rel: str) -> None:
+    """Count a direct edit against the file's churn budget (best-effort)."""
+    import json as _json
+    import time as _time
+    path = root / ESCALATION_STATE_FILE
+    try:
+        st = _json.loads(path.read_text(encoding="utf-8")) if path.exists() else {}
+        if not isinstance(st, dict):
+            st = {}
+    except Exception:
+        st = {}
+    edits = st.get("edits_since_green") if isinstance(st.get("edits_since_green"), dict) else {}
+    edits[rel] = int(edits.get(rel, 0)) + 1
+    st["edits_since_green"] = edits
+    st.setdefault("failures", 0)
+    st["updated"] = int(_time.time())
+    try:
+        path.parent.mkdir(parents=True, exist_ok=True)
+        tmp = path.with_suffix(".tmp")
+        tmp.write_text(_json.dumps(st, indent=1), encoding="utf-8")
+        os.replace(tmp, path)
+    except Exception:
+        pass
+
+
+def _escalation_trigger(root: Path, rel: str, changed: "int | None", *, size_known: bool = True):
+    """(kind, human detail) when this edit must escalate to deliver, else None.
+
+    Order matters: a failing build is the strongest evidence, then thrashing on
+    one file, then sheer size. `changed is None` with size_known means a
+    whole-file rewrite the cost model refused (gutting) -> complex."""
+    st = _escalation_state(root)
+    n_fail = int(st.get("failures") or 0)
+    fail_budget = _delivery_cfg_int(root, "escalateAfterFailures", "UAP_DELIVER_ESCALATE_FAILURES", 2)
+    if fail_budget > 0 and n_fail >= fail_budget:
+        lf = st.get("last_failure") or {}
+        detail = str(lf.get("detail") or "").strip().replace("\n", " | ")[:400]
+        src = str(lf.get("source") or "gate")
+        return ("failures", f"{n_fail} consecutive verification failure(s) since the last green gate (last: {src}: {detail or 'no detail'})")
+    edits = st.get("edits_since_green") or {}
+    n_edits = int(edits.get(rel, 0)) if isinstance(edits, dict) else 0
+    churn_budget = _delivery_cfg_int(root, "escalateAfterEdits", "UAP_DELIVER_ESCALATE_EDITS", 10)
+    if churn_budget > 0 and n_edits >= churn_budget:
+        return ("churn", f"'{rel}' has been edited {n_edits} times with no green gate in between")
+    if size_known:
+        big = _delivery_cfg_int(root, "complexEditChars", "UAP_DELIVER_COMPLEX_EDIT_CHARS", 6000)
+        if changed is None:
+            return ("complex", "a whole-file rewrite that replaces most of a substantial file")
+        if big > 0 and changed > big:
+            return ("complex", f"a {changed}-character change (budget {big}) — a whole module's worth")
+    return None
+
+
+def _escalation_block(rel: str, kind: str, detail: str, args: dict) -> None:
+    """Refuse the direct edit and hand the agent the deliver escalation, with
+    the evidence that triggered it. Terse and imperative on purpose (weak local
+    models retry or hallucinate completion on passive prose)."""
+    if kind == "failures":
+        msg = (
+            f"ESCALATE: {detail}. Direct edits are paused: editing '{rel}' again would repeat "
+            "what is not working. Call the `deliver` tool NOW with a one-line task that names the "
+            "failing gate and the fix (or run: uap deliver \"fix: <the failure>\"). Deliver "
+            "converges the change against the real gates; direct edits resume once it lands or "
+            "the gates go green. Do NOT retry this edit."
+        )
+        hint = f"fix the failing verification and make the gates green: {detail[:240]}"
+        intent = None
+    elif kind == "churn":
+        msg = (
+            f"ESCALATE: {detail} — you are thrashing. Stop patching it line by line. Call the "
+            "`deliver` tool with a one-line description of the INTENDED END STATE of this file "
+            "(what it must do, which tests must pass). Direct edits to it resume after a green "
+            "gate. Do NOT retry this edit."
+        )
+        hint = f"bring {rel} to a working state that passes the project gates"
+        intent = None
+    else:
+        msg = (
+            f"ESCALATE: this is {detail}. A change this size must land through the `deliver` "
+            "tool (or: uap deliver \"<one-line description>\") so it is verified against the "
+            "gates, not trusted blind. Your content is recorded as a replayable intent. Do NOT "
+            "retry this edit directly."
+        )
+        hint = f"implement the intended change to {rel}"
+        intent = {
+            k: v
+            for k, v in (
+                ("old_string", args.get("old_string", args.get("oldString"))),
+                ("new_string", args.get("new_string", args.get("newString"))),
+                ("content", args.get("content")),
+            )
+            if isinstance(v, str)
+        } or None
+    emit(False, msg, route="deliver", deliverHint=hint, editIntent=intent, escalation=kind)
+
+
+def _handle_escalate_edit(args: dict, rel: str, root: Path, changed: "int | None") -> None:
+    trig = _escalation_trigger(root, rel, changed)
+    if trig is not None:
+        _escalation_block(rel, trig[0], trig[1], args)
+        return
+    _record_escalation_edit(root, rel)
+    print(
+        f"[delivery-enforcement] escalate mode: direct edit to '{rel}' allowed "
+        f"({'whole-file' if changed is None else changed} chars). Verify with the project's "
+        "build/test; deliver is the escalation point after repeated gate failures or for "
+        "large multi-file work.",
+        file=sys.stderr,
+    )
+    emit(True, "escalate mode: direct edit allowed; deliver is the escalation point")
+
+
 BASH_OPS = {"Bash", "bash", "run_bash", "shell"}
 
 # The delivery gate's own state. The pending log is the replay queue for
@@ -295,7 +496,7 @@ BASH_OPS = {"Bash", "bash", "run_bash", "shell"}
 # match any destructive verb (or a truncating redirect) against any path under
 # `.uap/` that names deliver state — including the directory itself and globs.
 _DELIVER_STATE_PATH = (
-    r"(?:pending-deliver\.jsonl|deliver\.lock|deliver\.heartbeat"
+    r"(?:pending-deliver\.jsonl|deliver\.lock|deliver\.heartbeat|escalation-state\.json"
     r"|pending-[^\s'\"|;&]*|deliver\.[^\s'\"|;&]*|\*[^\s'\"|;&]*)"
 )
 _DELIVER_STATE_RM_RE = re.compile(
@@ -515,9 +716,17 @@ def _handle_bash(args: dict) -> None:
     m = _BASH_WRITE_RE.search(cmd)
     if m:
         target = m.group(1)
-        mode = os.environ.get("UAP_ENFORCE_DELIVERY", "block").lower()
-        if mode == "block" and _is_local_model_session() and _local_mode() == "advisory":
-            mode = "advisory"
+        mode = _effective_mode()
+        if mode == "escalate":
+            # Size is unknowable for a shell write; failures/churn still decide.
+            root = repo_root()
+            trig = _escalation_trigger(root, target, None, size_known=False)
+            if trig is not None:
+                _escalation_block(target, trig[0], trig[1], {})
+                return
+            _record_escalation_edit(root, target)
+            emit(True, "escalate mode: shell source write allowed; deliver is the escalation point")
+            return
         msg = (
             f"BLOCKED: do not write source via the shell ('{target}'). Writing files with "
             "a redirect/heredoc/sed/tee bypasses the delivery gate. To create or change "
@@ -604,7 +813,7 @@ def main() -> None:
     # testing the same code underneath it — tell it to WAIT. route:wait so the
     # autoroute stands down instead of enqueuing a duplicate.
     holder = _deliver_lock_holder(root)
-    if holder is not None and os.environ.get("UAP_ENFORCE_DELIVERY", "block").lower() == "block":
+    if holder is not None and os.environ.get("UAP_ENFORCE_DELIVERY", "block").lower() in {"block", "escalate"}:
         emit(
             False,
             f"WAIT: a `uap deliver` run (pid {holder}) is ALREADY in progress for this project and is "
@@ -618,6 +827,15 @@ def main() -> None:
         )
         return
 
+    # ESCALATE: direct edits land unless the evidence (failed gates, churn,
+    # size) says this change needs the convergence loop.
+    if _effective_mode() == "escalate":
+        changed = _changed_chars(args)
+        if changed is None:
+            changed = _write_cost(args, root)
+        _handle_escalate_edit(args, rel_posix, root, changed)
+        return
+
     # #3-F: terse, imperative, model-parseable. Weak local models otherwise
     # retry the blocked edit or hallucinate completion ("the files exist") when
     # the message is a passive explanation. State the exact next action.
@@ -649,8 +867,8 @@ def main() -> None:
         intent_payload = {
             k: v
             for k, v in (
-                ("old_string", args.get("old_string")),
-                ("new_string", args.get("new_string")),
+                ("old_string", args.get("old_string", args.get("oldString"))),
+                ("new_string", args.get("new_string", args.get("newString"))),
                 ("content", args.get("content")),
             )
             if isinstance(v, str)

package/templates/hooks/deliver_autoroute.py

@@ -120,8 +120,8 @@ def decide(out: dict, tool: str, args: dict, autoroute_on: bool, seen_files: set
     edit_intent = out.get("editIntent") or {
         k: v
         for k, v in (
-            ("old_string", args.get("old_string")),
-            ("new_string", args.get("new_string")),
+            ("old_string", args.get("old_string", args.get("oldString"))),
+            ("new_string", args.get("new_string", args.get("newString"))),
             ("content", args.get("content")),
         )
         if isinstance(v, str)

package/templates/hooks/escalation_tracker.py

@@ -0,0 +1,252 @@
+#!/usr/bin/env python3
+"""escalation-tracker: the evidence store behind the `escalate` delivery mode.
+
+Under `delivery.enforcement: escalate` (or `delivery.localMode: escalate`) a
+coding agent makes ordinary source edits DIRECTLY and `uap deliver` becomes an
+ESCALATION POINT instead of the path every edit is forced through. The gate
+(delivery_enforcement.py) decides *when* to escalate from the state kept here:
+
+  .uap/escalation-state.json
+    failures           consecutive verification failures since the last green
+    last_failure       {ts, source, detail}  — what failed, shown to the agent
+    last_green         ts of the last passing verification
+    edits_since_green  {relpath: n}  — per-file churn with no green in between
+    updated            ts of the last write
+
+Writers (all best-effort, never block):
+  escalation_tracker.py fail  --source verify|bash|stop --detail "<text>"
+  escalation_tracker.py pass  --source verify|bash|stop
+  escalation_tracker.py edit  --file <path>          (the gate records this itself)
+  escalation_tracker.py reset                        (after a deliver run lands)
+  escalation_tracker.py status [--json]
+  escalation_tracker.py classify-bash --command "<cmd>" --output "<text>"
+      -> prints pass|fail|none for a build/test command's output, and records it
+
+The project root is UAP_MAIN_ROOT (the checkout holding .uap/), else cwd.
+"""
+from __future__ import annotations
+
+import argparse
+import json
+import os
+import re
+import sys
+import time
+from pathlib import Path
+
+STATE_FILE = "escalation-state.json"
+DETAIL_MAX = 1200
+
+# A shell command that exercises the project's real gates. Only these commands'
+# outcomes count as verification evidence — `ls` failing is not a gate failure.
+_BUILD_TEST_RE = re.compile(
+    r"(?:^|[;&|]\s*)(?:"
+    r"cargo\s+(?:build|check|test|clippy)"
+    r"|npm\s+(?:run\s+)?(?:build|test|lint|typecheck|check)"
+    r"|(?:pnpm|yarn|bun)\s+(?:run\s+)?(?:build|test|lint|typecheck|check)"
+    r"|(?:npx\s+)?(?:tsc|vitest|jest|mocha|eslint)\b"
+    r"|(?:python3?\s+-m\s+)?pytest\b"
+    r"|go\s+(?:build|test|vet)"
+    r"|make(?:\s+(?:test|build|check|all))?\s*(?:$|[;&|])"
+    r"|mvn\s+(?:test|package|verify|compile)"
+    r"|gradle(?:w)?\s+(?:test|build|check)"
+    r"|dotnet\s+(?:build|test)"
+    r"|uap\s+verify\b"
+    r")",
+    re.IGNORECASE,
+)
+_FAIL_MARKERS = (
+    "error[e",                     # rustc
+    "could not compile",
+    "test result: failed",
+    "failed to compile",
+    "npm err!",
+    "error ts",                    # tsc: error TS2345
+    "assertionerror",
+    "traceback (most recent call last)",
+    "build failed",
+    "fatal error",
+    "compilation failed",
+    "panicked at",
+    "exit status 1",
+    "exit code 1",
+)
+_PASS_MARKERS = (
+    "test result: ok",
+    "finished `dev`", "finished `release`", "finished dev", "finished release",
+    "tests passed", "passed", "all tests passed",
+    "compiled successfully", "build succeeded", "build successful",
+    "0 errors", "no errors", "ok\n", " ok ",
+    "runtime gate: pass", "all gates pass", "verify: pass",
+)
+
+
+def root_dir() -> Path:
+    """The MAIN checkout's root — the same anchor the policy gate uses.
+
+    The gate resolves MAIN_ROOT by stripping `/.worktrees/NNN-slug` and points
+    the enforcer there, so evidence written from a session that runs INSIDE a
+    worktree must land in the same place or the trigger never fires."""
+    p = str(Path(os.environ.get("UAP_MAIN_ROOT") or ".").resolve())
+    if "/.worktrees/" in p:
+        p = p.split("/.worktrees/", 1)[0]
+    return Path(p)
+
+
+def state_path(root: Path | None = None) -> Path:
+    return (root or root_dir()) / ".uap" / STATE_FILE
+
+
+def load_state(root: Path | None = None) -> dict:
+    try:
+        data = json.loads(state_path(root).read_text(encoding="utf-8"))
+        if isinstance(data, dict):
+            data.setdefault("failures", 0)
+            data.setdefault("edits_since_green", {})
+            return data
+    except Exception:
+        pass
+    return {"failures": 0, "edits_since_green": {}, "last_failure": None,
+            "last_green": None, "updated": 0}
+
+
+def save_state(state: dict, root: Path | None = None) -> None:
+    p = state_path(root)
+    try:
+        p.parent.mkdir(parents=True, exist_ok=True)
+        state["updated"] = int(time.time())
+        tmp = p.with_suffix(".tmp")
+        tmp.write_text(json.dumps(state, indent=1), encoding="utf-8")
+        os.replace(tmp, p)
+    except Exception:
+        pass  # evidence is best-effort; never wedge the hook that records it
+
+
+def record_fail(source: str, detail: str, root: Path | None = None) -> dict:
+    st = load_state(root)
+    st["failures"] = int(st.get("failures") or 0) + 1
+    st["last_failure"] = {
+        "ts": int(time.time()),
+        "source": source or "unknown",
+        "detail": (detail or "")[-DETAIL_MAX:],
+    }
+    save_state(st, root)
+    return st
+
+
+def record_pass(source: str, root: Path | None = None) -> dict:
+    st = load_state(root)
+    st["failures"] = 0
+    st["edits_since_green"] = {}
+    st["last_green"] = {"ts": int(time.time()), "source": source or "unknown"}
+    st["last_failure"] = None
+    save_state(st, root)
+    return st
+
+
+def record_edit(rel: str, root: Path | None = None) -> dict:
+    st = load_state(root)
+    edits = st.get("edits_since_green") or {}
+    edits[rel] = int(edits.get(rel, 0)) + 1
+    st["edits_since_green"] = edits
+    save_state(st, root)
+    return st
+
+
+def reset(root: Path | None = None) -> dict:
+    st = {"failures": 0, "edits_since_green": {}, "last_failure": None,
+          "last_green": {"ts": int(time.time()), "source": "reset"}, "updated": 0}
+    save_state(st, root)
+    return st
+
+
+def is_gate_command(command: str) -> bool:
+    return bool(command) and bool(_BUILD_TEST_RE.search(command))
+
+
+def classify_output(command: str, output: str, exit_code: int | None = None) -> str:
+    """pass | fail | none for a shell command's outcome.
+
+    The exit code is authoritative when the harness supplies one. Without it
+    (opencode's after-hook exposes text only) fall back to markers, and to
+    `none` when the text says nothing either way — silence is not evidence.
+    """
+    if not is_gate_command(command):
+        return "none"
+    if exit_code is not None:
+        return "pass" if exit_code == 0 else "fail"
+    low = (output or "").lower()
+    if not low.strip():
+        return "none"
+    # A non-zero failure COUNT ("2 failed", "1 failures", "3 errors") or a
+    # specific failure marker. A bare "failed" substring is deliberately NOT a
+    # marker: `test_failed_login PASSED` and `--- PASS: TestFailedAuth` are green.
+    if any(m in low for m in _FAIL_MARKERS) or re.search(r"\b[1-9]\d* (?:failed|failures?|errors?)\b", low):
+        return "fail"
+    if any(m in low for m in _PASS_MARKERS) or re.search(r"(?m)^ok\b|--- pass:|\b\d+ passed\b", low):
+        return "pass"
+    return "none"
+
+
+def main(argv: list[str] | None = None) -> int:
+    ap = argparse.ArgumentParser(prog="escalation_tracker.py")
+    sub = ap.add_subparsers(dest="cmd", required=True)
+    f = sub.add_parser("fail"); f.add_argument("--source", default="verify"); f.add_argument("--detail", default="")
+    p = sub.add_parser("pass"); p.add_argument("--source", default="verify"); p.add_argument("--detail", default="")
+    e = sub.add_parser("edit"); e.add_argument("--file", required=True)
+    sub.add_parser("reset")
+    s = sub.add_parser("status"); s.add_argument("--json", action="store_true")
+    c = sub.add_parser("classify-bash")
+    c.add_argument("--command", required=True); c.add_argument("--output", default="")
+    c.add_argument("--exit-code", type=int, default=None); c.add_argument("--dry-run", action="store_true")
+    raw = list(sys.argv[1:] if argv is None else argv)
+    folded: list[str] = []
+    k = 0
+    while k < len(raw):
+        tok = raw[k]
+        if tok in ("--detail", "--output", "--command") and k + 1 < len(raw):
+            folded.append(f"{tok}={raw[k + 1]}")
+            k += 2
+            continue
+        folded.append(tok)
+        k += 1
+    a = ap.parse_args(folded)
+
+    if a.cmd == "fail":
+        detail = a.detail
+        if detail == "-":
+            detail = sys.stdin.read()
+        st = record_fail(a.source, detail)
+        print(f"escalation: {st['failures']} consecutive failure(s) recorded ({a.source})")
+    elif a.cmd == "pass":
+        record_pass(a.source)
+        print(f"escalation: green ({a.source}) — counters reset")
+    elif a.cmd == "edit":
+        record_edit(a.file)
+    elif a.cmd == "reset":
+        reset()
+        print("escalation: state reset")
+    elif a.cmd == "status":
+        st = load_state()
+        if a.json:
+            print(json.dumps(st))
+        else:
+            lf = st.get("last_failure") or {}
+            print(f"failures={st.get('failures', 0)} files_churning={len(st.get('edits_since_green') or {})}"
+                  + (f" last_failure=({lf.get('source')}) {str(lf.get('detail',''))[:120]!r}" if lf else ""))
+    elif a.cmd == "classify-bash":
+        output = a.output
+        if output == "-":
+            output = sys.stdin.read()
+        verdict = classify_output(a.command, output, a.exit_code)
+        if not a.dry_run:
+            if verdict == "fail":
+                record_fail("bash", f"$ {a.command[:200]}\n{output[-DETAIL_MAX:]}")
+            elif verdict == "pass":
+                record_pass("bash")
+        print(verdict)
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/templates/hooks/stop.sh

@@ -221,6 +221,16 @@ if [ "$CODE_CHANGED" = "true" ] && [ "${UAP_VERIFY_ON_STOP:-1}" != "0" ] && comm
     fi
     VERIFY_OUT="$(cd "$PROJECT_DIR" && $TIMEOUT_WRAP uap verify --runtime-only $UV_AUTO $ACC_AUTO --dir "$PROJECT_DIR" 2>&1)"
     VERIFY_RC=$?
+    # Evidence for the `escalate` delivery mode: a red verify counts toward the
+    # "escalate to deliver" threshold, a green one clears it. Best-effort.
+    TRACKER="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/escalation_tracker.py"
+    if [ -f "$TRACKER" ]; then
+      if [ "$VERIFY_RC" = "1" ]; then
+        (cd "$PROJECT_DIR" && UAP_MAIN_ROOT="$PROJECT_DIR" python3 "$TRACKER" fail --source stop --detail "$(printf '%s' "$VERIFY_OUT" | tail -c 1200)" >/dev/null 2>&1) || true
+      elif [ "$VERIFY_RC" = "0" ]; then
+        (cd "$PROJECT_DIR" && UAP_MAIN_ROOT="$PROJECT_DIR" python3 "$TRACKER" pass --source stop >/dev/null 2>&1) || true
+      fi
+    fi
   fi
   set -e
   # RC 1 = a REAL gate failure (code is broken) → block. Everything else fails