@mstar-harness/dsh 3.10.2 → 3.10.3

package/dist/index.js

@@ -1477,7 +1477,7 @@ function validatePlanProgress(value, what = "coordination.progress") {
   }
   return violations;
 }
-function validatePlanHandoff(value, what = "coordination.handoff") {
+function validatePlanHandoff(value, what = "coordination.handoff", route = "integration") {
   if (!isPlainObject2(value))
     return [invalid("coordination.row.handoff-shape", `${what} must be an object`)];
   const allowed = [
@@ -1617,7 +1617,25 @@ function validatePlanHandoff(value, what = "coordination.handoff") {
     }
   }
   if ((value.state === "integrating" || value.state === "merged" || value.state === "completed") && value.integration === undefined) {
-    violations.push(invalid("coordination.row.handoff-field", `${what}.state ${String(value.state)} requires integration`));
+    if (route === "standalone-development" && value.state === "completed") {
+      if (value.completed_at === undefined) {
+        violations.push(invalid("coordination.row.handoff-field", `${what}.state completed requires completed_at for a standalone handoff`));
+      }
+      if (!isNonEmptyString(value.accepted_at)) {
+        violations.push(invalid("coordination.row.handoff-field", `${what}.accepted_at is required for a standalone completed handoff`));
+      }
+      if (!isNonEmptyString(value.accepted_by)) {
+        violations.push(invalid("coordination.row.handoff-field", `${what}.accepted_by is required for a standalone completed handoff`));
+      }
+      if (value.qc === undefined) {
+        violations.push(invalid("coordination.row.handoff-field", `${what}.qc is required for a standalone completed handoff`));
+      }
+      if (value.qa === undefined) {
+        violations.push(invalid("coordination.row.handoff-field", `${what}.qa is required for a standalone completed handoff`));
+      }
+    } else {
+      violations.push(invalid("coordination.row.handoff-field", `${what}.state ${String(value.state)} requires integration`));
+    }
   }
   return violations;
 }
@@ -1653,7 +1671,7 @@ function validatePreparedCoordination(value, what = "coordination.prepared") {
   }
   return violations;
 }
-function validateRowCoordination(value, what = "coordination") {
+function validateRowCoordination(value, what = "coordination", route = "integration") {
   if (!isPlainObject2(value))
     return [invalid("coordination.row.shape", `${what} must be an object`)];
   const allowed = ["revision", "prepared", "session", "progress", "handoff"];
@@ -1672,7 +1690,7 @@ function validateRowCoordination(value, what = "coordination") {
   if (value.progress !== undefined)
     violations.push(...validatePlanProgress(value.progress, `${what}.progress`));
   if (value.handoff !== undefined)
-    violations.push(...validatePlanHandoff(value.handoff, `${what}.handoff`));
+    violations.push(...validatePlanHandoff(value.handoff, `${what}.handoff`, route));
   if (value.handoff !== undefined && value.session === undefined) {
     violations.push(invalid("coordination.row.handoff-field", `${what}.handoff requires a bound plan session`));
   }
@@ -1974,6 +1992,45 @@ var WORKFLOW_TERMINAL_STATUSES = ["completed", "failed", "stopped"];
 var WORKFLOW_LIFECYCLE_TYPES = ["plan", "iteration"];
 var WORKFLOW_DELIVERY_KINDS = ["development", "verification/report-only"];
 var WORKFLOW_COMPOUND_OUTCOMES = ["created", "updated", "skipped"];
+function isStandaloneDevelopmentWorkflow(snapshot) {
+  return snapshot.type === "plan" && snapshot.delivery_kind === "development" && Array.isArray(snapshot.plans) && snapshot.plans.length === 1;
+}
+function rowValidationRoute(snapshot, row) {
+  if (isStandaloneDevelopmentWorkflow(snapshot) && snapshot.plans[0]?.id === row.id) {
+    return "standalone-development";
+  }
+  return "integration";
+}
+function validateStandaloneCompletedCoherence(snapshot, row) {
+  const violations = [];
+  if (!isStandaloneDevelopmentWorkflow(snapshot) || row.id !== snapshot.plans[0]?.id)
+    return violations;
+  const coordination = row.coordination;
+  if (!isPlainObject2(coordination) || !isPlainObject2(coordination.handoff))
+    return violations;
+  const handoff = coordination.handoff;
+  if (handoff.state !== "completed" || handoff.integration !== undefined)
+    return violations;
+  if (row.status !== "Done") {
+    violations.push(violation3("high", "coordination.row.handoff-field", `standalone completed handoff requires row ${String(row.id)} to be Done`));
+  }
+  if (row.execution_lease !== undefined) {
+    violations.push(violation3("high", "coordination.row.handoff-field", `standalone completed handoff requires no execution lease on row ${String(row.id)}`));
+  }
+  if (snapshot.integration_merge_lease !== undefined) {
+    violations.push(violation3("high", "coordination.row.handoff-field", "standalone completed handoff requires no integration_merge_lease on the snapshot"));
+  }
+  const source = snapshot.branch?.source;
+  const target = snapshot.branch?.target;
+  if (!isNonEmptyString(source) || !isNonEmptyString(target)) {
+    violations.push(violation3("high", "coordination.row.handoff-field", "standalone completed handoff requires nonblank branch.source and branch.target"));
+  } else {
+    if (handoff.source_branch !== source) {
+      violations.push(violation3("high", "coordination.row.handoff-field", `standalone completed handoff source_branch ${String(handoff.source_branch)} must equal branch.source ${source}`));
+    }
+  }
+  return violations;
+}
 function violation3(severity, code, message, fix) {
   return { ok: false, severity, code, message, fix };
 }
@@ -2084,13 +2141,17 @@ function validateWorkflowSnapshot(doc) {
   } else if (!Array.isArray(doc.plans)) {
     violations.push(violation3("high", "workflow.snapshot.invalid-plans", "plans must be an array of legacy plan rows"));
   } else {
+    const snapshotDoc = doc;
     for (const row of doc.plans) {
       violations.push(...validatePlanRow(row).violations);
       if (isPlainObject2(row) && row.execution_lease !== undefined) {
         violations.push(...validateExecutionLease(row.execution_lease).violations);
       }
       if (isPlainObject2(row) && row.coordination !== undefined) {
-        violations.push(...validateRowCoordination(row.coordination, `plans[${String(row.id)}].coordination`));
+        const planRow = row;
+        const route = rowValidationRoute(snapshotDoc, planRow);
+        violations.push(...validateRowCoordination(row.coordination, `plans[${String(row.id)}].coordination`, route));
+        violations.push(...validateStandaloneCompletedCoherence(snapshotDoc, planRow));
       }
     }
   }

package/harness-agents/code-reviewer.md

@@ -48,6 +48,31 @@ permission:
     "cloc*": allow
     "scc*": allow
     "tokei*": allow
+    # Morning Star read-only validators (skills require machine-checked gates)
+    "mstar qc validate-report": allow
+    "mstar qc validate-report *": allow
+    "mstar-harness qc validate-report": allow
+    "mstar-harness qc validate-report *": allow
+    "mstar lint": allow
+    "mstar lint *": allow
+    "mstar-harness lint": allow
+    "mstar-harness lint *": allow
+    "mstar dispatch validate": allow
+    "mstar dispatch validate *": allow
+    "mstar-harness dispatch validate": allow
+    "mstar-harness dispatch validate *": allow
+    "mstar worktree qc-alignment": allow
+    "mstar worktree qc-alignment *": allow
+    "mstar-harness worktree qc-alignment": allow
+    "mstar-harness worktree qc-alignment *": allow
+    "mstar status validate": allow
+    "mstar status validate *": allow
+    "mstar-harness status validate": allow
+    "mstar-harness status validate *": allow
+    "mstar lease verify": allow
+    "mstar lease verify *": allow
+    "mstar-harness lease verify": allow
+    "mstar-harness lease verify *": allow
     # Audit read-only checks (matches mstar-audit Hard Rule 2)
     # Deny mutating variants before the exact read-only allows
     "npm audit fix*": deny

package/harness-agents/qc-specialist-2.md

@@ -36,6 +36,31 @@ permission:
     "cloc*": allow
     "scc*": allow
     "tokei*": allow
+    # Morning Star read-only validators (skills require machine-checked gates)
+    "mstar qc validate-report": allow
+    "mstar qc validate-report *": allow
+    "mstar-harness qc validate-report": allow
+    "mstar-harness qc validate-report *": allow
+    "mstar lint": allow
+    "mstar lint *": allow
+    "mstar-harness lint": allow
+    "mstar-harness lint *": allow
+    "mstar dispatch validate": allow
+    "mstar dispatch validate *": allow
+    "mstar-harness dispatch validate": allow
+    "mstar-harness dispatch validate *": allow
+    "mstar worktree qc-alignment": allow
+    "mstar worktree qc-alignment *": allow
+    "mstar-harness worktree qc-alignment": allow
+    "mstar-harness worktree qc-alignment *": allow
+    "mstar status validate": allow
+    "mstar status validate *": allow
+    "mstar-harness status validate": allow
+    "mstar-harness status validate *": allow
+    "mstar lease verify": allow
+    "mstar lease verify *": allow
+    "mstar-harness lease verify": allow
+    "mstar-harness lease verify *": allow
   task:
     "*": deny
     explore: allow

package/harness-agents/qc-specialist-3.md

@@ -36,6 +36,31 @@ permission:
     "cloc*": allow
     "scc*": allow
     "tokei*": allow
+    # Morning Star read-only validators (skills require machine-checked gates)
+    "mstar qc validate-report": allow
+    "mstar qc validate-report *": allow
+    "mstar-harness qc validate-report": allow
+    "mstar-harness qc validate-report *": allow
+    "mstar lint": allow
+    "mstar lint *": allow
+    "mstar-harness lint": allow
+    "mstar-harness lint *": allow
+    "mstar dispatch validate": allow
+    "mstar dispatch validate *": allow
+    "mstar-harness dispatch validate": allow
+    "mstar-harness dispatch validate *": allow
+    "mstar worktree qc-alignment": allow
+    "mstar worktree qc-alignment *": allow
+    "mstar-harness worktree qc-alignment": allow
+    "mstar-harness worktree qc-alignment *": allow
+    "mstar status validate": allow
+    "mstar status validate *": allow
+    "mstar-harness status validate": allow
+    "mstar-harness status validate *": allow
+    "mstar lease verify": allow
+    "mstar lease verify *": allow
+    "mstar-harness lease verify": allow
+    "mstar-harness lease verify *": allow
   task:
     "*": deny
     explore: allow

package/harness-agents/qc-specialist.md

@@ -36,6 +36,31 @@ permission:
     "cloc*": allow
     "scc*": allow
     "tokei*": allow
+    # Morning Star read-only validators (skills require machine-checked gates)
+    "mstar qc validate-report": allow
+    "mstar qc validate-report *": allow
+    "mstar-harness qc validate-report": allow
+    "mstar-harness qc validate-report *": allow
+    "mstar lint": allow
+    "mstar lint *": allow
+    "mstar-harness lint": allow
+    "mstar-harness lint *": allow
+    "mstar dispatch validate": allow
+    "mstar dispatch validate *": allow
+    "mstar-harness dispatch validate": allow
+    "mstar-harness dispatch validate *": allow
+    "mstar worktree qc-alignment": allow
+    "mstar worktree qc-alignment *": allow
+    "mstar-harness worktree qc-alignment": allow
+    "mstar-harness worktree qc-alignment *": allow
+    "mstar status validate": allow
+    "mstar status validate *": allow
+    "mstar-harness status validate": allow
+    "mstar-harness status validate *": allow
+    "mstar lease verify": allow
+    "mstar lease verify *": allow
+    "mstar-harness lease verify": allow
+    "mstar-harness lease verify *": allow
   task:
     "*": deny
     explore: allow

package/harness-skills/mstar-artifacts/SKILL.md

@@ -39,7 +39,7 @@ description: "Morning Star plan harness artifacts — `{PLAN_DIR}` main plans an
 
 - **`{WORKFLOW_DIR}/<id>/notes.jsonl`**: per-workflow append-only notes ledger (runtime); snapshot plan-row `notes` is the legacy verbatim copy. **Tech-debt rollup**: `mstar status tech-debt <project-dir>` over the project registers — **`references/status-and-residuals.md`**.
 - **Iteration Phase 2 leases** (snapshot: `integration_worktree_path`, `plans[].execution_lease`, top-level `integration_merge_lease`): field semantics → **`references/status-and-residuals.md`** (“Iteration execution leases”); Phase 2 execution checklist → **`mstar-iteration`** `references/phase-2-worktree-lease.md`; full protocol prose (single copy) → **`mstar-engine-legacy`** `references/lease-protocol.md`.
-- **Plan-scoped coordination is a domain-call surface**: plan-row `coordination` block (`prepared` / `revision` / `duplicate-holder`), session JSON, handoff record, and `--expect <revision>` semantics have their **single runtime home** in **`references/status-and-residuals.md`**; flag shapes and exit codes → `docs/cli.md`; route semantics → **`mstar-iteration`** `references/plan-scoped-pm.md`. Every plan-row mutation goes through the verbs (`mstar plan bind | show | prepare | progress | residual-add | residual-close | handoff | accept | return | integration-start | integration-accept | complete | reconcile`) — hand-editing snapshot rows or the register outside those verbs is **not** an authorized path.
+- **Plan-scoped coordination is a domain-call surface**: plan-row `coordination` block (`prepared` / `revision` / `duplicate-holder`), session JSON, handoff record, and `--expect <revision>` semantics have their **single runtime home** in **`references/status-and-residuals.md`**; flag shapes and exit codes → **`mstar-use-cli`**; route semantics → **`mstar-iteration`** `references/plan-scoped-pm.md`. Every plan-row mutation goes through the verbs (`mstar plan bind | show | prepare | progress | residual-add | residual-close | handoff | accept | return | integration-start | integration-accept | complete | reconcile`) — hand-editing snapshot rows or the register outside those verbs is **not** an authorized path.
 
 > **Engine check (when available):** run `mstar lease verify --workflow <id> [--plan <plan-id>]` or `mstar lease verify-integration --workflow <id>` (or import `validateExecutionLease` / `validateIntegrationMergeLease` from `@mstar-harness/engine` in a host hook) to validate the iteration leases above on the workflow snapshot (execution_lease / integration_merge_lease). On `fail` -> do not proceed; fix and re-run. Skill text below remains authoritative when the runtime is absent.
 

package/harness-skills/mstar-artifacts/references/plan-files-and-reports.md

@@ -20,7 +20,12 @@ QC/QA 原始过程报告默认是 **ephemeral review bundle**，置于 `{SDD_DIR
 | QC 单席报告（**`inline` / hotfix 例外**） | `qc.md` |
 | QC 汇总结论（tri 模式） | `qc-consolidated.md` |
 | QA 验收报告（`QA gate: mandatory`） | `qa.md`（或 Assignment 指定的同目录 basename） |
+| L2 task review 报告（**`Execution mode: sdd`，每个已完成 task**） | `../task-N-review.md` |
+| Implementer 报告（**`Execution mode: sdd`**） | `../task-N-report.md` |
 
+后两行的 `../` 是**必需**前缀：这两份 artifact 落在 `{SDD_DIR}` 根，**不在** review bundle 内。按上表表头解析，`../task-N-review.md` = **`{SDD_DIR}/task-N-review.md`**，`../task-N-report.md` = **`{SDD_DIR}/task-N-report.md`**；漏掉该前缀（即让它们落在 `{SDD_DIR}/review/` 下）就是错误解析。两者由不同角色写、互不覆盖：implementer 始终写 `task-N-report.md` —— 它是 L2 的**输入**，永不被 L2 覆盖，也不能充当独立审查；fresh L2 task reviewer 始终写 `task-N-review.md`（`Execution mode: sdd` 下每个已完成 task 都必有，不是可选、也不是只留在对话里）。**不存在**接受任一 basename 的 fallback。
+
+Mandatory QA always writes `${SDD_DIR}/review/qa.md` (or the Assignment's explicit same-directory basename) with its AC → evidence → result mapping; report-only is a mode, not a condition for mandatory report landing.
 
 ## SDD 运行时（不入 reports）
 
@@ -41,10 +46,12 @@ Raw bundle files may disappear after the working context is gone. Before Done, P
   - `Review range / Diff basis`
   - `Review bundle`: `{SDD_DIR}/review/`
   - `QC inputs`: `qc1.md` / `qc2.md` / `qc3.md` or `qc.md`
+  - `Task reviews`: compact per completed task — task number + review range + earned `Task quality` + report pointer (`task-N-review.md` → `{SDD_DIR}/task-N-review.md`); required for handoff once `{SDD_DIR}` is unavailable. The L2 report file lives at the SDD root (outside `{SDD_DIR}/review/`); bundle cleanup removes only the ephemeral `review/` artifacts. The pointer names the L2 report, never the implementer's `task-N-report.md`
   - `Blocking result`: fixed / none / deferred with reason
   - `Residual findings`: each open R# — id + short title + severity + tracking location (register `entries[<plan-id>]`) + owner/target + blocker-defer flag (`N/A — none open` when none)
 - Main plan `## QA Gate Summary` when QA applies:
   - `QA gate` / `QA mode`
+  - acceptance trace: compact AC → evidence → result mapping + coverage/gap disclosure + exact report pointer (`qa.md` → `{SDD_DIR}/review/qa.md`)
   - evidence reused vs newly run checks
   - related R# closure recommendations
 - `{PROJECT_DIR}/<id>/residuals.json` (default `{HARNESS_DIR}/projects/<id>/`): open R# machine SSOT — `entries[<plan-id>]`.

package/harness-skills/mstar-artifacts/references/plan-workflow-lifecycle-contract.md

@@ -113,3 +113,10 @@ The direction and reason columns record the reasoning behind each answer; the an
 - No silent completion anywhere. Every stage transition records its evidence; failure renders the workflow blocked/active, never implicitly done.
 - No cleanup authorization is implied by lifecycle completion: worktree/branch deletion stays explicit and ownership/merge-guarded, exactly as the existing post-merge-close contract requires.
 - Close never releases leases, and terminal `failed`/`stopped` states are never rewritten as `completed` (§5).
+
+> Amendment 2026-09-17 (recorded at PM lock): **legacy delivery-source correction.**
+>
+> Legacy source correction is a distinct coordinator-owned domain operation for a running, single-row standalone development workflow whose registered source erroneously equals its target. It derives the replacement source only from that row's already-accepted, evidence-pinned handoff and verifies the source Git ref/commit. Under the existing snapshot lock and expected row revision it may replace only `branch.source`, advance that row's coordination revision and update snapshot `updated_at`. All PR/merge evidence, statuses, leases, timestamps other than `updated_at`, target and handoff pins remain unchanged. It cannot record Done, delivery success or remote merge. Missing proof, foreign authority, terminal state, a nonmatching legacy shape, or a repeat after correction refuses without writes. Future registrations must name the true delivery source; this is not their normal lifecycle step.
+>
+> This extends §4a (registration is an authorized domain operation) with a bounded repair for pre-existing snapshots only, and leaves §5 (failure and abandonment) and the Binding negatives above untouched.
+

package/harness-skills/mstar-artifacts/references/status-and-residuals.md

@@ -375,7 +375,7 @@ These are **full-protocol prose** — the single canonical copy lives in **`msta
 
 ## Plan-scoped coordination (bind / revision / session / handoff) — sole runtime field home
 
-The scoped route（`/iteration-drive --assignment | --workflow <id> --plan <id> | --resume <session.json>` → `mstar plan …`）keeps **one process authority**: the same workflow snapshot (`workflows/<id>/snapshot.json`) and the same root `status.json` — no per-plan snapshot clone, database, daemon or second status copy. This section is the **single runtime home** for the coordination / session / handoff / revision fields; command flags and exit codes → `docs/cli.md`; route semantics → **`mstar-iteration`** `references/plan-scoped-pm.md`; engine API shapes → `packages/engine/src/coordination.ts`.
+The scoped route（`/iteration-drive --assignment | --workflow <id> --plan <id> | --resume <session.json>` → `mstar plan …`）keeps **one process authority**: the same workflow snapshot (`workflows/<id>/snapshot.json`) and the same root `status.json` — no per-plan snapshot clone, database, daemon or second status copy. This section is the **single runtime home** for the coordination / session / handoff / revision fields; command flags and exit codes → **`mstar-use-cli`**; route semantics → **`mstar-iteration`** `references/plan-scoped-pm.md`; engine API shapes → `packages/engine/src/coordination.ts`.
 
 ### Snapshot fields
 
@@ -407,12 +407,16 @@ The scoped route（`/iteration-drive --assignment | --workflow <id> --plan <id>
 
 | Actor | May write |
 | --- | --- |
-| coordinator — `mstar plan prepare · accept · return · integration-start · integration-accept · complete · reconcile` | selected row `coordination.prepared` and handoff transitions, `status`, both coordination leases, `Done` |
+| coordinator — `mstar plan prepare · accept · return · integration-start · integration-accept · complete · repair-delivery-source · reconcile` | selected row `coordination.prepared` and handoff transitions, `status`, coordination leases, `Done` (route-specific) |
 | plan session — `mstar plan progress · residual-add · residual-close · handoff` | its own row `status` + `coordination.progress`, `metadata.track_branches`, its `entries[<planId>]` register bucket, and the handoff record |
 | anyone else | nothing scoped — sibling rows, lifecycle anchors, root register, `execution_policy`, `compass_ref`, shared indexes, the iteration PR and Phase 3–6 stay on the coordinator / global route |
 
-- **State machine:** `Todo → InProgress` (bind) → `InReview` (handoff; lease kept) → `accepted` → `integrating` → `merged` → `completed` ⇒ `Done`. `progress` allows only `InProgress → InProgress | InReview | Blocked`, `Blocked → Blocked | InProgress`, and `InReview → InReview | InProgress | Blocked` **before** handoff — never `Todo` / `Done` / lease removal. After handoff, all scoped progress/residual mutations are rejected until `return`.
-- **`complete` is the one atomic write** that sets `Done` (with verified Git proof and the findings gate), retains row `metadata.working_branch` / `metadata.worktree_path` and existing `track_branches`, and deletes the row `execution_lease` plus the coordinator's `integration_merge_lease`. `accept` is ownership transfer only — no merge, no `Done`; `integration-accept` keeps both leases and `InReview` until `complete`.
+- **State machine:** `Todo → InProgress` (bind) → `InReview` (handoff; lease kept) → `accepted` → (`integrating` → `merged` on the **iteration route only`) → `completed` ⇒ `Done`. `progress` allows only `InProgress → InProgress | InReview | Blocked`, `Blocked → Blocked | InProgress`, and `InReview → InReview | InProgress | Blocked` **before** handoff — never `Todo` / `Done` / lease removal. After handoff, all scoped progress/residual mutations are rejected until `return`.
+- **Two completion routes (engine-selected):**
+  - **Iteration** (`type: iteration`, or any workflow that is not standalone development): after `accept`, `integration-start` → coordinator merge → `integration-accept` → `complete`. `complete` is the one atomic write that sets `Done`, completes the handoff, and deletes the row `execution_lease` plus the coordinator's `integration_merge_lease`. `accept` is ownership transfer only — no merge, no `Done`; `integration-accept` keeps both leases and `InReview` until `complete`.
+  - **Standalone development** (`type: plan`, `delivery_kind: development`, exactly one owned row): after `accept`, `complete` directly from the accepted handoff with no integration record or merge lease. `complete` sets `Done`, completes the handoff, retains cleanup metadata, deletes only the row `execution_lease`, and leaves the workflow `running` until ordinary delivery evidence and terminal close. Integration verbs refuse this route; missing integration anchors never select it.
+  - **Legacy delivery-source repair:** `repair-delivery-source` is coordinator-only, not a normal lifecycle step, and applies only to the pre-fix legacy shape `branch.source === branch.target` with an accepted handoff naming a different source. Under the row revision lock it may replace only `branch.source` (derived from the sealed handoff), advance `coordination.revision`, and update snapshot `updated_at`. It never records `Done`, changes delivery/merge evidence, statuses, leases, or handoff pins, and refuses a second application once aligned. Future registrations must record the true delivery source; `workflow evidence --declare-kind --branch-source` cannot amend an already-registered anchor.
+  - **Reconcile:** iteration route observes Git in the recorded integration checkout (`completed` / `retry-ready` / `already-completed`); standalone route only replays an already-completed row as byte-identical `already-completed` — it never manufactures `Done` from Git truth alone.
 - **Legacy helpers refuse coordinated keys:** `appendProjectRegisterEntries` / `closeProjectRegisterEntry` / backlog next-free-key and `persist` replacements reject an existing coordinated plan bucket with `coordination.scoped-writer-required` (directing the caller to `residual-add` / `residual-close`), and hand writes to protected snapshot / register / root targets are refused with `coordination.direct-write-refused`. Root and global lifecycle operations stay on the existing coordinator route and are never `mutatePlanCoordination` targets.
 - Read-only validators (`mstar lease verify`, `mstar lease verify-integration`, `mstar worktree check`, `mstar status validate`) remain **checks** — never mutation substitutes.
 
@@ -432,7 +436,7 @@ Reconciliation observes **Git ancestry / HEAD facts** in the recorded repository
 
 **Both byte tokens, always.** The amendment carries the current raw-byte SHA-256 of the **snapshot bytes** and of the workflow's reviewed **compass Markdown bytes** (`sha256:<64 lowercase hex>`, read from the read-only `show-prepare`); both are required even on the first amendment, and neither is a per-plan `coordination.revision`. The compass token binds the reviewed declaration: the resulting plan-id **set** must equal the compass `plans:` list exactly, and its `spec_integration_branch` / `integration_worktree_path` declarations must agree with what the call would leave recorded. The compass is re-read immediately before the single atomic commit.
 
-**Refusals are mutation-free.** `coordination.prepare-amendment.{stale, invalid-patch, not-prepare, execution-started, duplicate-plan, invalid-plan, compass-mismatch, invalid-worktree}` (`coordination-write.ts`), plus the existing auth/scope errors; when each fires, the exact exit code and payload → `docs/cli.md` § `mstar-harness workflow`. The protected snapshot, root register, other workflows and the compass stay byte-identical.
+**Refusals are mutation-free.** `coordination.prepare-amendment.{stale, invalid-patch, not-prepare, execution-started, duplicate-plan, invalid-plan, compass-mismatch, invalid-worktree}` (`coordination-write.ts`), plus the existing auth/scope errors; when each fires, the exact exit code and payload → **`mstar-use-cli`** `references/plan-and-workflow.md`. The protected snapshot, root register, other workflows and the compass stay byte-identical.
 
 **Prepare-only, no force.** Recovery from a `stale` token is re-read `show-prepare` → review again → retry with the fresh tokens. There is no force, no replacement snapshot, no reset and no hand-editing workaround for a workflow that has left Prepare or already owns execution.
 

package/harness-skills/mstar-harness-core/SKILL.md

@@ -43,8 +43,8 @@ description: Morning Star (启明星) harness **生命周期 / 授权语义权
 | 角色 | 始终 | 按任务追加（典型） |
 |------|------|-------------------|
 | **全部** | 加载选择 → **`mstar-roles`**（hub § Load Order；本 skill = 生命周期/授权权威，`mstar-roles` hub bootstrap 是 core-first 的唯一例外） | — |
-| **`@project-manager`** | 本 skill | `mstar-dispatch-gates`、`mstar-phase-gates`、`mstar-conventions`、`mstar-roles`；implement 波次 `mstar-sdd`；派 QC 前 `mstar-review-qc`；并行/审查 `mstar-branch-worktree`；plan/status/review bundle `mstar-artifacts`；UI 类 plan Prepare 阶段 `mstar-design-md`（DESIGN.md 门禁）；新建/大改 skill 时 `mstar-skill-authoring`；迭代管理 `mstar-iteration`（Phase 1–5）；战略性工作 `mstar-strategy`；`audit` 类请求 `mstar-audit`（执行归 `@code-reviewer`）。**不**读 `mstar-coding-behavior` |
-| **实现/审查/运维** | 本 skill + `mstar-coding-behavior` + 角色 ref | 有 git 写：`mstar-branch-worktree`；有 plan 路径：`mstar-conventions`；**PM** 派 QC 前：`mstar-review-qc`；**`qc-specialist*`**：`mstar-roles` → `references/qc-specialist/`；`qa-engineer`：`references/qa-engineer/`；改 status/residual：`mstar-artifacts`；UI：`mstar-design-md`；知识库：`mstar-compound`（PM） |
+| **`@project-manager`** | 本 skill | `mstar-dispatch-gates`、`mstar-phase-gates`、`mstar-conventions`、`mstar-roles`；implement 波次 `mstar-sdd`；派 QC 前 `mstar-review-qc`；并行/审查 `mstar-branch-worktree`；plan/status/review bundle `mstar-artifacts`；UI 类 plan Prepare 阶段 `mstar-design-md`（DESIGN.md 门禁）；新建/大改 skill 时 `mstar-skill-authoring`；迭代管理 `mstar-iteration`（Phase 1–5）；战略性工作 `mstar-strategy`；`audit` 类请求 `mstar-audit`（执行归 `@code-reviewer`）；跑/解读 CLI 命令时 `mstar-use-cli`。**不**读 `mstar-coding-behavior` |
+| **实现/审查/运维** | 本 skill + `mstar-coding-behavior` + 角色 ref | 有 git 写：`mstar-branch-worktree`；有 plan 路径：`mstar-conventions`；**PM** 派 QC 前：`mstar-review-qc`；**`qc-specialist*`**：`mstar-roles` → `references/qc-specialist/`；`qa-engineer`：`references/qa-engineer/`；改 status/residual：`mstar-artifacts`；UI：`mstar-design-md`；知识库：`mstar-compound`（PM）；跑/解读 CLI 命令时（各 leaf 角色按任务）：`mstar-use-cli` |
 | **leaf 承接方** | 上栏 + **`mstar-dispatch-gates`**（反递归节） | — |
 
 Routing eval（宿主插件内回归用，**非**运行时必读）→ `.cursor/skills/mstar-routing-eval/`。
@@ -91,6 +91,7 @@ PM 在 Assignment 写 **`Task category`**（主类 + 可选 `secondary`）：
 | Skill | 职责 |
 |-------|------|
 | `mstar-harness-core` | 本文件：入口、状态机、Task category、explore、索引、护栏 |
+| `mstar-use-cli` | CLI 契约（agent 面向）：任务→命令族索引、前置条件阶梯、两条协议序列、退出码 0 / 1 / 2 与稳定拒绝码读法；flags 一律以命令自身 `--help` 为准 |
 | `mstar-phase-gates` | per-plan 双阶段门禁：Prepare/Execute、意图门禁、hotfix、可验证编辑 |
 | `mstar-iteration` | 迭代管理：Phase 1–5（start / Autonomous Execute / iteration-close / PR delivery / PR merge-ready loop） |
 | `mstar-dispatch-gates` | 派发、Delegation、反递归、依赖与隔离驱动并行、SDD 路径 plan QC 强制 tri |

package/harness-skills/mstar-iteration/references/phase-1-prepare.md

@@ -124,7 +124,7 @@ iteration 正式全流程**必须**登记 `{HARNESS_DIR}/status.json`（v2 根
 
 compass frontmatter 的 `iteration_base_branch` / `target_branch` **必须与** snapshot `branch` 一致；若仅写在 compass 而 snapshot 缺失，Phase 2 §2.3 同轮 backfill。
 
-**中途增减范围（已存在且仍在 Prepare 的 workflow）**：用户/产品批准的范围扩张**不得**手改受保护状态。先以 `mstar plan bind --coordinator --workflow <id>` 建立该 workflow 的 coordinator 会话，再经受守卫入口 `mstar workflow show-prepare` 读取快照与 compass 两个字节版本，并以 `mstar workflow amend-prepare` 追加已批准的 Todo 行、登记已 review 的 integration checkout 与 `plan_parallelism`（仅 Prepare 且无执行所有权时可用；无 force/replace/init 通道）。守卫与字段权威 → **`mstar-artifacts`** `references/status-and-residuals.md`「Prepare workflow amendment」；forms / exit codes → `docs/cli.md` § `mstar-harness workflow`。
+**中途增减范围（已存在且仍在 Prepare 的 workflow）**：用户/产品批准的范围扩张**不得**手改受保护状态。先以 `mstar plan bind --coordinator --workflow <id>` 建立该 workflow 的 coordinator 会话，再经受守卫入口 `mstar workflow show-prepare` 读取快照与 compass 两个字节版本，并以 `mstar workflow amend-prepare` 追加已批准的 Todo 行、登记已 review 的 integration checkout 与 `plan_parallelism`（仅 Prepare 且无执行所有权时可用；无 force/replace/init 通道）。守卫与字段权威 → **`mstar-artifacts`** `references/status-and-residuals.md`「Prepare workflow amendment」；forms / exit codes → **`mstar-use-cli`** `references/plan-and-workflow.md`。
 
 <!-- host-hook: iteration-entry -->
 > Execute the active host reference's `## Host hooks` declaration for `iteration-entry`; this file defines no host action.

package/harness-skills/mstar-iteration/references/plan-scoped-pm.md

@@ -3,7 +3,7 @@
 **Single home for the scoped route.** This file owns: accepted addressing forms, scoped boot, the plan-local driving loop, the scoped stop, and the coordinator command sequence. It does **not** own field/schema tables, executable flag syntax, or Assignment header templates.
 
 - Command frontmatter/argument surface → **`commands/iteration-drive.md`**
-- Executable flags, exit codes, JSON envelopes → **`docs/cli.md`**（CLI owner）
+- Executable flags, exit codes, JSON envelopes → **`mstar-use-cli`**（CLI owner）
 - `coordination` / session / handoff / revision fields and row/register ownership → **`mstar-artifacts/references/status-and-residuals.md`**（sole runtime schema home）
 - Portable primary Assignment header → **`mstar-roles/references/project-manager/dispatch-and-assignment.md`**
 - Dispatch mechanics, isolation gates → **`mstar-dispatch-gates`**, **`mstar-sdd`**, **`mstar-branch-worktree`**

package/harness-skills/mstar-roles/SKILL.md

@@ -43,14 +43,15 @@ PM-owned activation; the omission / `none` / named-preset / resume / unknown-pre
 
 | Role | Preset menu |
 | --- | --- |
-| `project-manager` | `mstar-dispatch-gates`, `mstar-phase-gates`, `mstar-conventions`, `mstar-roles` ref; + `references/project-manager/qa-trigger-matrix.md` for QA gate tiers; + `mstar-review-qc` before QC; + `mstar-branch-worktree` / `mstar-artifacts` as the round requires; + `mstar-skill-authoring` for skill work; + `mstar-iteration` for iteration lifecycle (start/drive/close); + `mstar-strategy` for strategic alignment; + `mstar-compound` / `mstar-compound-refresh` pre-loaded by `mstar-iteration` § iteration-close |
-| `fullstack-dev*`, `frontend-dev` | `mstar-coding-behavior`, `mstar-dispatch-gates`, `mstar-branch-worktree` (if repo writes); plan path symbols from `mstar-conventions` (minimal); `mstar-design-md` when implementing styled UI |
-| `qc-specialist*` | Presets: `mstar-branch-worktree`, `mstar-artifacts` (review bundle paths); `mstar-design-md` when reviewing UI. Role-owned (never gated): `references/qc-specialist/` workflow/checklist/template (+ lenses on demand) |
-| `qa-engineer` | Presets: `mstar-branch-worktree`, `mstar-artifacts` (closing R#); `mstar-design-md` when verifying visual output. Role-owned (never gated): `references/qa-engineer/acceptance-gate.md` |
-| `architect`, `product-manager` | `mstar-phase-gates` (Prepare), `mstar-artifacts` (knowledge/specs); `mstar-design-md` (creator + design intent); `mstar-strategy` (STRATEGY.md creation/maintenance) |
-| `code-reviewer` | `mstar-sdd` (per-task review mode); `mstar-audit` (audit mode: full workflow); `mstar-conventions` (paths); `mstar-artifacts` (plan-quality-bar for audit plans) |
-| `ops-engineer` | `mstar-coding-behavior`, `mstar-branch-worktree` |
-| `prompt-engineer` | All topic skills when editing harness text |
+| `project-manager` | `mstar-dispatch-gates`, `mstar-phase-gates`, `mstar-conventions`, `mstar-roles` ref; + `references/project-manager/qa-trigger-matrix.md` for QA gate tiers; + `mstar-review-qc` before QC; + `mstar-branch-worktree` / `mstar-artifacts` as the round requires; + `mstar-skill-authoring` for skill work; + `mstar-iteration` for iteration lifecycle (start/drive/close); + `mstar-strategy` for strategic alignment; + `mstar-use-cli` when the round runs or interprets CLI commands; + `mstar-compound` / `mstar-compound-refresh` pre-loaded by `mstar-iteration` § iteration-close |
+| `fullstack-dev*`, `frontend-dev` | `mstar-coding-behavior`, `mstar-dispatch-gates`, `mstar-branch-worktree` (if repo writes); plan path symbols from `mstar-conventions` (minimal); `mstar-design-md` when implementing styled UI; `mstar-use-cli` when the round runs or interprets CLI commands |
+| `qc-specialist*` | Presets: `mstar-branch-worktree`, `mstar-artifacts` (review bundle paths); `mstar-design-md` when reviewing UI; `mstar-use-cli` when the round runs or interprets CLI commands. Role-owned (never gated): `references/qc-specialist/` workflow/checklist/template (+ lenses on demand) |
+| `qa-engineer` | Presets: `mstar-branch-worktree`, `mstar-artifacts` (closing R#); `mstar-design-md` when verifying visual output; `mstar-use-cli` when the round runs or interprets CLI commands. Role-owned (never gated): `references/qa-engineer/acceptance-gate.md` |
+| `architect` | `mstar-phase-gates` (Prepare), `mstar-artifacts` (knowledge/specs); `mstar-design-md` (creator + design intent); `mstar-strategy` (STRATEGY.md creation/maintenance); `mstar-use-cli` when the round runs or interprets CLI commands |
+| `product-manager` | `mstar-phase-gates` (Prepare), `mstar-artifacts` (knowledge/specs); `mstar-design-md` (creator + design intent); `mstar-strategy` (STRATEGY.md creation/maintenance) |
+| `code-reviewer` | `mstar-sdd` (per-task review mode); `mstar-audit` (audit mode: full workflow); `mstar-conventions` (paths); `mstar-artifacts` (plan-quality-bar for audit plans); `mstar-use-cli` when the round runs or interprets CLI commands |
+| `ops-engineer` | `mstar-coding-behavior`, `mstar-branch-worktree`; `mstar-use-cli` when the round runs or interprets CLI commands |
+| `prompt-engineer` | All topic skills when editing harness text; `mstar-use-cli` when the round runs or interprets CLI commands |
 
 Use skill names (not absolute filesystem paths) in role references.
 

package/harness-skills/mstar-roles/references/architect.md

@@ -97,7 +97,7 @@ Topic skills below are **presets activated by PM**, not unconditional role depen
 
 1. `mstar-harness-core` → `mstar-dispatch-gates` → `mstar-phase-gates` (Prepare: specify/clarify/plan) → `mstar-conventions` (`{PLAN_DIR}`, plan-writing path)
 2. Typically: `mstar-artifacts` (specs, **`{ITERATION_DIR}/<id>/` package**); `mstar-coding-behavior`. Boundaries → **`mstar-iteration/references/iteration-artifact-boundaries.md`**
-3. On demand: `mstar-branch-worktree` (committing architecture docs to the business repo); `mstar-design-md` (plan involves UI work / design tokens — read DESIGN.md for design specs)
+3. On demand: `mstar-branch-worktree` (committing architecture docs to the business repo); `mstar-design-md` (plan involves UI work / design tokens — read DESIGN.md for design specs); `mstar-use-cli` (round runs or interprets CLI commands — resolving a plan path, validating a coordination document)
 4. Host: `mstar-host` (detect; `references/opencode.md` | `cursor.md` | `codex.md`)
 
 ## Completion Report

package/harness-skills/mstar-roles/references/code-reviewer.md

@@ -23,13 +23,19 @@ Layering anchor: `mstar-review-qc/references/review-responsibility-boundaries.md
 ## Mode A — SDD Task Reviewer (default)
 
 - **Inputs:** task brief path, implementer report path, task diff file path, Global Constraints (verbatim).
+- **Output:** `REPORT_FILE` = `${SDD_DIR}/task-N-review.md` — always written for a completed task under `Execution mode: sdd`, and the only file this mode writes. The implementer's `task-N-report.md` is an input you read and never write; this output is L2 only, never formal QC (`{SDD_DIR}/review/qcN.md`) or QA.
 - **Behavior:** diff-first. Spec compliance first, then code quality. Read the diff once; do not re-run git; do not mutate the checkout; do not re-run the full test suite.
 - **Discipline:** fresh per task (no sticky resume); never pre-judge the verdict.
 - **Template SSOT:** `skills/mstar-sdd/references/task-reviewer-prompt.md`.
 
 ### Output (Mode A)
 
+Written to `REPORT_FILE` (`${SDD_DIR}/task-N-review.md`):
+
 ```
+## Scope                            # only when a bound actually stopped expansion; a complete review omits this section and its label
+- `- Truncated coverage: <budget reached; specific interfaces/files left unexamined>`
+
 ### Spec Compliance
 - ✅ Spec compliant | ❌ Issues found (file:line)
 - ⚠️ Cannot verify from diff: [items for PM to check]
@@ -43,7 +49,7 @@ Layering anchor: `mstar-review-qc/references/review-responsibility-boundaries.md
 **Task quality:** Approved | Needs fixes
 ```
 
-`⚠️ Cannot verify from diff` items do not block other findings — PM resolves them before marking the task complete.
+`⚠️ Cannot verify from diff` items do not block other findings — PM resolves them before marking the task complete. A budget stop keeps the `Task quality` earned for reviewed scope and is never relabelled `Unconfirmed`; PM reads this report and cannot mark the whole task complete while the assigned review scope remains uncovered.
 
 ### Issue severity (Mode A)
 
@@ -99,7 +105,7 @@ Follow the `pr` variant output shape in **`references/pr-review.md`** § Output
 
 If any item below matches, **stop** and return `Blocked` to `project-manager` instead of improvising:
 
-- **NEVER** modify product code — report issues, do not fix them. The only files you create are review reports under `{SDD_DIR}` (Mode A), plans under `{PLAN_DIR}/audit-<date>/` (Mode B), or **evidence files under `{PROJECT_DIR}/<project-id>/reports/pr-review/`** (Mode C — path SSOT `references/pr-review.md` § Local report archive; gitignored, never the reviewed worktree).
+- **NEVER** modify product code — report issues, do not fix them. The only files you create are review reports at `${SDD_DIR}/task-N-review.md` (Mode A), plans under `{PLAN_DIR}/audit-<date>/` (Mode B), or **evidence files under `{PROJECT_DIR}/<project-id>/reports/pr-review/`** (Mode C — path SSOT `references/pr-review.md` § Local report archive; gitignored, never the reviewed worktree).
 - **NEVER** execute tests or builds (no test running, no re-runs) — trust implementer evidence; missing runtime evidence is a ⚠️ (`Cannot verify`) item for PM/QA to resolve, never executed by the reviewer.
 - **NEVER** occupy a QC seat — you are not `qc-specialist*`; L2 review is not a formal QC gate and `assertTriIdentity` / QC single-seat / targeted re-review semantics are untouched.
 - Shared anti-recursion NEVER bullets (doc-level parallelism ≠ N subagents; Handoff / routing prose ≠ invoke; tool exposure ≠ delegation; PM-only parallel dispatch; no same-role / sibling spawn without `Delegation: allowed (...)`): **`references/_shared/leaf-executor-core.md`**「Shared anti-recursion NEVER」.
@@ -128,7 +134,7 @@ Topic skills below are **presets activated by PM**, not unconditional role depen
    - Mode A (SDD task reviewer): `mstar-sdd` → `references/task-reviewer-prompt.md`, `references/file-handoffs.md`
    - Mode B (audit executor): `mstar-audit` SKILL.md (common core) + `references/codebase-audit.md`
    - Mode C (PR review): `mstar-audit` SKILL.md + `references/pr-review.md` + `mstar-branch-worktree` (worktree isolation)
-3. Paths: `mstar-conventions`; add `mstar-artifacts` (plan-quality-bar) when writing audit plans
+3. Paths: `mstar-conventions`; add `mstar-artifacts` (plan-quality-bar) when writing audit plans; add `mstar-use-cli` when the round runs or interprets CLI commands (audit plan scaffold/promote, PR-review helpers, reading a refusal code)
 4. Host: `mstar-host` (detect; active host reference)
 
 ## Completion Report

package/harness-skills/mstar-roles/references/frontend-dev.md

@@ -58,7 +58,7 @@ Topic skills below are **presets activated by PM**, not unconditional role depen
 
 1. `mstar-harness-core` → `mstar-coding-behavior` → `mstar-dispatch-gates`
 2. Typically: `mstar-conventions` (paths + spec metadata)
-3. On demand: `mstar-branch-worktree` (repo writes); `mstar-phase-gates` (Execute / hotfix when referenced in assignment); `mstar-design-md` (styled UI — read DESIGN.md tokens before writing components)
+3. On demand: `mstar-branch-worktree` (repo writes); `mstar-phase-gates` (Execute / hotfix when referenced in assignment); `mstar-design-md` (styled UI — read DESIGN.md tokens before writing components); `mstar-use-cli` (task must run or interpret CLI commands — path resolution, a verification command, reading a refusal or exit code)
 4. Host: `mstar-host` (detect; `references/opencode.md` | `cursor.md` | `codex.md`)
 
 ## Completion Report

package/harness-skills/mstar-roles/references/fullstack-dev-shared.md

@@ -77,7 +77,7 @@ Topic skills below are **presets activated by PM**, not unconditional role depen
 
 1. `mstar-harness-core` → `mstar-coding-behavior` → `mstar-dispatch-gates` (leaf anti-recursion before any Task/subagent)
 2. Typically: `mstar-conventions` (path symbols + `metadata.primary_spec` / `spec_refs`)
-3. On demand: `mstar-branch-worktree` (repo writes, `Working branch`); `mstar-phase-gates` (Execute / hotfix sections when gate fields are in the assignment); `mstar-design-md` (task includes UI implementation — read DESIGN.md for design tokens)
+3. On demand: `mstar-branch-worktree` (repo writes, `Working branch`); `mstar-phase-gates` (Execute / hotfix sections when gate fields are in the assignment); `mstar-design-md` (task includes UI implementation — read DESIGN.md for design tokens); `mstar-use-cli` (task must run or interpret CLI commands — SDD evidence capture, path resolution, reading a refusal or exit code)
 4. Host: `mstar-host` (detect; `references/opencode.md` | `cursor.md` | `codex.md`)
 
 ## Completion Report

package/harness-skills/mstar-roles/references/ops-engineer.md

@@ -63,7 +63,7 @@ Topic skills below are **presets activated by PM**, not unconditional role depen
 
 1. `mstar-harness-core` → `mstar-coding-behavior` → `mstar-dispatch-gates` → `mstar-branch-worktree` (repo writes, production-touching branches)
 2. Typically: `mstar-conventions` (paths)
-3. On demand: `mstar-phase-gates` (hotfix compressed path when assignment says hotfix)
+3. On demand: `mstar-phase-gates` (hotfix compressed path when assignment says hotfix); `mstar-use-cli` (round runs or interprets CLI commands — worktree/lease checks, reading a refusal code)
 4. Host: `mstar-host` (detect; `references/opencode.md` | `cursor.md` | `codex.md`)
 
 ## Completion Report

package/harness-skills/mstar-roles/references/project-manager/plan-management.md

@@ -53,6 +53,11 @@ If legacy plan directories already exist, reuse them; avoid dual-structure dupli
     [--branch-source <branch> --branch-target <branch> | --completion-policy <text>] [--session <path>]
   ```
   The declaration is one-time (a second one, even with the same kind, is refused) and refuses a terminal snapshot; a supplied `--branch-source`/`--branch-target` fills a MISSING anchor or restates the registered one — a value conflicting with an anchor the snapshot already carries is refused (the registered anchor is the delivery identity, never overwritten); delivery evidence itself is recorded with `mstar workflow evidence --workflow <id> --file <payload.json>` (PR identity recorded once; `head`/`target` must be the registered `branch.source`/`branch.target`).
+- **Row completion routes (engine-selected):** after `accept`, the coordinator follows one of two routes — never inferred from missing integration anchors.
+  - **Iteration** (`type: iteration`, or any non-standalone workflow): `integration-start` → coordinator merge in the recorded integration checkout → `integration-accept` → `complete`. `complete` sets the row `Done`, completes the handoff, and releases the row `execution_lease` and the workflow `integration_merge_lease`.
+  - **Standalone development** (`type: plan`, `delivery_kind: development`, exactly one owned row): `complete` directly from the accepted handoff with no integration verbs. `complete` sets `Done`, completes the handoff, retains cleanup metadata, releases only the row `execution_lease`, and leaves the workflow `running` until the delivery tail and `status workflow-close`.
+- **Legacy delivery-source repair (not a normal step):** `mstar plan repair-delivery-source` applies only when a pre-fix snapshot registered `branch.source === branch.target` while the accepted handoff names the true feature branch. It replaces only `branch.source` under the row revision lock, derived from the sealed handoff — no user-supplied branch, no `Done`, no delivery-evidence rewrite. Continue with ordinary `complete` after repair. Future registrations must record the true delivery source at `workflow register` time; `workflow evidence --declare-kind --branch-source` cannot amend an already-registered anchor (one-time kind declaration only).
+
 - Delivery tail (standalone `development` plans, after Done): compound disposition (`created` / `updated` / reasoned `skipped`; review → **`mstar-compound`**) on the delivery branch before the PR head is finalized → submit PR with its identity (repo / head / target) recorded → merge-ready declared (resumable milestone; workflow stays registered) → PM-verified merge (provider evidence; never the close verb) → common close reusing the post-merge-close ordering (`mstar-iteration/references/phase-6-post-merge-close.md`). Stage semantics and failure behavior → frozen contract `mstar-artifacts/references/plan-workflow-lifecycle-contract.md`.
 - **Merge-ready precondition — standalone `development` plans only.** Before merge-ready is declared, run the read-only close-state gate and record its output with the milestone (`mstar iteration gate --phase 6 --workflow <id> [--harness <absolute-path>]`; same implementation as the close's delivery-evidence consultation, no `--compass`). Pre-merge the snapshot is still `running`, so `PHASE6_NOT_TERMINAL` / `PHASE6_ROOT_ENTRY_PRESENT` are the expected readings and the recorded note says so; any other code (`PHASE6_INVALID_SNAPSHOT`, `PHASE6_INVALID_ROOT`) is a real defect to clear before merge-ready. Iteration workflows are unaffected — they keep their own Phase 4/5 exit checklist (`mstar-iteration/references/phase-4-5-pr-delivery.md` §5.2).
 

package/harness-skills/mstar-roles/references/prompt-engineer.md

@@ -53,7 +53,7 @@ Topic skills below are **presets activated by PM**, not unconditional role depen
 1. `mstar-harness-core` → `mstar-dispatch-gates`
 2. Harness-text editing trigger (activation implies): read **all** topic skills you touch — at minimum `mstar-phase-gates`, `mstar-conventions`, `mstar-artifacts`, `mstar-branch-worktree`, `mstar-review-qc`, `mstar-coding-behavior`, plus host adapters — so prompts stay aligned with SSOT and do not re-duplicate rules
 3. New skill / major skill rewrite / trigger-description change (activation implies): MUST read `mstar-skill-authoring` before editing
-4. Typically: `mstar-conventions` (path symbols in examples)
+4. Typically: `mstar-conventions` (path symbols in examples); `mstar-use-cli` (round runs or interprets CLI commands — the roles / skill lints this role invokes, reading a validator's exit code)
 5. Host: `mstar-host` (detect; `references/opencode.md` | `cursor.md` | `codex.md`)
 
 ## Completion Report

package/harness-skills/mstar-roles/references/qa-engineer/acceptance-gate.md

@@ -34,10 +34,7 @@ When **`QA mode: acceptance-only`**:
 
 ### Captured evidence mapping (`sdd evidence`)
 
-Retained `sdd evidence` bundles are consumed read-only: QA integrity-checks and maps the evidence — it never repeats the captured child command (exact command shapes and exit meanings → `mstar-sdd/references/file-handoffs.md` § Verification evidence). Map every AC with all columns:
-
-| AC | run/manual reference | original input identity | integrity | outcome | target applicability and reason | coverage judgment | targeted gap |
-| --- | --- | --- | --- | --- | --- | --- | --- |
+Retained `sdd evidence` bundles are consumed read-only: QA integrity-checks and maps the evidence — it never repeats the captured child command (exact command shapes, exit meanings and the four separate `verify` outputs → `mstar-sdd/references/file-handoffs.md` § Verification evidence). Map every AC with all columns of the report's AC table (**`references/qa-engineer.md`** § QA Report Landing and Template); for a retained bundle each column carries:
 
 - **Run/manual reference**: `{SDD_DIR}/evidence/<run-uuid>/` with the record and raw `stdout.log`/`stderr.log` paths — or the manual report/CI citation with provenance.
 - **Original input identity**: the recorded run's Git HEAD plus declared-input digest from `record.json` — the basis any target comparison reuses.
@@ -56,6 +53,28 @@ Scope authority → `mstar-harness-core` § 定向执行与验证边界. All QA
 - Missing screenshot or other real-environment evidence: record the unverified behavior and a pending independent E2E request for PM. Never launch a browser/device/E2E, change roles, or block/reopen routine iteration QA solely for that separate workflow. Unit acceptance cannot claim real-environment acceptance.
 - User-authorized local full-suite execution belongs to a separate implementer/ops action; QA may consume its result but has no `full` mode. Refer the authorization scope to PM instead of executing it here.
 
+## Budget stop and coverage readback
+
+Ceiling and scope authority → **`mstar-harness-core`** § 定向执行与验证边界; the role wording is in `references/qa-engineer.md` § Budget and Stopping. Honour the Assignment **`Budget`** / **`Return shape`** and never widen the core default. A bound stop keeps the AC outcomes and findings already verified and never invents elapsed time or file counts.
+
+- **Label only a real cut.** Emit `- Truncated coverage: <budget reached; specific ACs/interfaces not covered>` in the report `## Scope` only when a bound actually stopped expansion, naming the required ACs/interfaces left unchecked, and record those ACs as unverified. Omit the line on a complete run — a negation value is still a line, and consumers read the label's presence, not its wording.
+- **Exhaustion is not a channel failure.** A cap stop never rewrites an observed result, never becomes `Unconfirmed`, and never invents new QA vocabulary. A required evidence channel that is unavailable is a verification gap, handled by the existing `Blocked` result.
+- **Coverage readback, per assigned AC.** A checked AC keeps its observed `outcome` and its `run/manual reference`, including a witnessed failure; a required AC left without supported evidence is recorded as unverified and is not a pass.
+
+| Readback | Required coverage | Result |
+| --- | --- | --- |
+| Every assigned AC has supported evidence | covered | ordinary acceptance may proceed |
+| A required AC has no supported evidence (unverified, or its channel unavailable) | uncovered | return the existing **`Blocked`**; name the uncovered ACs and hand PM the targeted remaining scope |
+| An assigned AC failed with witnessed evidence | covered — the finding is retained | report the observed failure with its evidence; coverage ending never turns it into a coverage-only conclusion |
+
+A clean checked subset with `findings: []` is compatible with `unverified` ACs: `findings: []` describes the checked scope only and is never presented as full mandatory acceptance or `Done`.
+
+## Durable acceptance mapping (before Done)
+
+The landed report is the raw record; its landing obligation is defined once in `references/qa-engineer.md` § QA Report Landing and Template and is unchanged when the Assignment names no output path. Before `Done`, the report's compact AC → evidence → result mapping is preserved in the existing durable main-plan **`## QA Gate Summary`** (`mstar-artifacts/references/plan-files-and-reports.md`) — per-AC result, evidence reference, coverage/gap disclosure and the exact report pointer — which QA supplies from its report.
+
+Reuse that existing summary: no second archive, manifest or report format is created. Retain the raw report while the gate is active, so a later permitted bundle cleanup never leaves the only AC mapping in a deleted file.
+
 ## Unchanged hard duties
 
 Before sign-off or Done recommendation:
@@ -69,6 +88,8 @@ Before sign-off or Done recommendation:
 
 Use template in `references/qa-engineer.md`. May skip QC tri only when no implementation/test/config artifacts were committed.
 
+`report-only` is a mode, not the landing condition: the mandatory landing, scope/truncation disclosure and coverage readback above are unchanged, and an advisory report acquires no acceptance authority from its filename.
+
 ## Related
 
 - PM trigger matrix: `references/project-manager/qa-trigger-matrix.md`