@opengsd/gsd-path 1.6.1 → 1.6.2

package/CHANGELOG.md

@@ -11,6 +11,19 @@ app and the daemon have their own file,
 [daemon/app/CHANGELOG.md](daemon/app/CHANGELOG.md). Release bookkeeping and
 test-only changes are not listed; the Git history has them.
 
+## [1.6.2] - 2026-10-17
+
+### Changed
+- record 1.6.2 live host release evidence
+- prepare 1.6.2 patch candidate
+- Document README What's new heading in RELEASE.md
+- update release notes for v1.6.1
+
+### Fixed
+- keep the README What's new section current from release notes
+- read quoted STATE values in the ship checkpoint guard
+- refuse a build checkpoint while STATE is ship/active
+- keep evidence-line citations when final review reuses a wave
 ## [1.6.1] - 2026-10-16
 
 ### Added

package/QUICK.md

@@ -14,7 +14,7 @@ One router skill drives a gated pipeline: inspect → define → research → de
 plan → build → ship. Every handoff lives in `.project/` so any session can resume from disk.
 
 **Hosts:** Codex, Claude Code, Grok, OpenCode, Antigravity, Cursor, and Kimi
-Code have a passing live milestone for release 1.6.1. Copilot CLI, Qwen, Zed,
+Code have a passing live milestone for release 1.6.2. Copilot CLI, Qwen, Zed,
 Kiro, and Muse Code install, but have no live milestone for that release. See
 [host tiers](README.md).
 

package/README.md

@@ -9,11 +9,11 @@ milestone loop. While a milestone builds, the next one can be planned in
 parallel under `.project/next/` (lookahead); a building milestone can also be
 abandoned on an explicit ruling, archiving its partial work for a re-slice.
 
-**Hosts with a passing full live milestone for release 1.6.1:** Codex, Claude
+**Hosts with a passing full live milestone for release 1.6.2:** Codex, Claude
 Code, Grok, OpenCode, Antigravity CLI, Cursor, and Kimi Code.
 
 **Hosts with an installer and a dispatch contract, but no live milestone for
-release 1.6.1:** GitHub Copilot CLI (account quota exhausted), Qwen Code, Zed,
+release 1.6.2:** GitHub Copilot CLI (account quota exhausted), Qwen Code, Zed,
 and Kiro (API credits), and Muse Code (no live release evidence recorded yet).
 These hosts are excluded from the release evaluation. Exclusion is not a pass.
 
@@ -24,14 +24,16 @@ The [host trust matrix](https://github.com/open-gsd/gsd-path/blob/main/docs/trus
 is the source of truth for live milestone proof and each host's guard tier.
 
 <!-- release-docs -->
-**Latest npm release:** [@opengsd/gsd-path@1.6.1](https://www.npmjs.com/package/@opengsd/gsd-path/v/1.6.1) — [release notes](CHANGELOG.md#161---2026-10-16)
+## What's new in 1.6.2 — 2026-10-17
+
+**Latest npm release:** [@opengsd/gsd-path@1.6.2](https://www.npmjs.com/package/@opengsd/gsd-path/v/1.6.2) — [release notes](CHANGELOG.md#162---2026-10-17)
 
 **Recent highlights**
-- accept GitHub rebase merges in pull-request integration
-- run dispatch_driver subprocess helpers from the selected runtime
-- refuse a relative model_policy --record and check release before locking
-- let promote-next replace a DOCS-AUDIT carry-forward the lookahead keeps
-- let the owner authorize one exact pre-ship push to a task branch
+- keep the README What's new section current from release notes
+- read quoted STATE values in the ship checkpoint guard
+- refuse a build checkpoint while STATE is ship/active
+- keep evidence-line citations when final review reuses a wave
+- record 1.6.2 live host release evidence
 
 <!-- /release-docs -->
 
@@ -55,25 +57,6 @@ is the source of truth for live milestone proof and each host's guard tier.
 | [RELEASE.md](RELEASE.md) | Maintainer CI and npm release cycle |
 | [GUIDE.md](GUIDE.md) | Pointer to the guides above |
 
-## What's new — October 2, 2026
-
-These changes are merged into the source checkout; npm installs use the latest
-published release.
-
-- **Desktop app (pre-release):** one app for macOS, Windows, and Linux shows
-  your projects, manages skills in each coding agent, and updates itself. See
-  [Desktop app](#desktop-app).
-- **Skills from the published release:** the monitor installs skills from the
-  npm release, checks the download against the registry's sha512, and refuses
-  one that does not match. A release picker lets you stay on an older version.
-- **Safer monitor writes:** a monitor started by the app accepts changes only
-  with the app's local token, so another web page cannot change your setup.
-- **Environment editor:** edit a project's `.env` files with values masked and
-  a diff before each save.
-- **Usage charts:** tokens and cost per day, time per phase, tasks per wave,
-  and verify history. Missing data shows as missing, never as zero.
-- **Muse Code** is a supported host.
-
 ## Install from npm
 
 Requires **Node.js 18.17+** for the npm installer and **Python 3.9+** for

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengsd/gsd-path",
-  "version": "1.6.1",
+  "version": "1.6.2",
   "description": "Disk-backed AI agent pipeline. Docs: DOCS.md (start here), QUICK.md, FULL.md, UPDATE.md",
   "license": "MIT",
   "repository": {

package/scripts/isolation.py

@@ -4502,6 +4502,20 @@ def attest(
     }
 
 
+def _committed_ship_active(repo: Path) -> bool:
+    """True when the STATE.md committed at HEAD is ship/active."""
+
+    result = run_git(repo, "show", "HEAD:.project/STATE.md")
+    if result.returncode != 0:
+        return False
+    frontmatter = result.stdout.split("\n---", 1)[0]
+    fields = {
+        key: _unquote(value)
+        for key, value in re.findall(r"(?m)^(phase|status):(.*)$", frontmatter)
+    }
+    return fields.get("phase") == "ship" and fields.get("status") == "active"
+
+
 def checkpoint(
     repo: Path,
     expected_head: str,
@@ -4551,6 +4565,12 @@ def checkpoint(
                 "subject": subject.strip(),
             }
         raise IsolationError("primary HEAD differs from --expected-head")
+    if subject.strip().startswith("build:") and _committed_ship_active(repo):
+        raise IsolationError(
+            "STATE is ship/active: final review creates no pre-ship commit; leave its "
+            "outputs uncommitted for archive_milestone.py, and send findings through "
+            "the patch plan (see SHIP.md)"
+        )
     pending = uncommitted_paths(repo)
     forced: Set[str] = set()
     # Build only: an approval undo resets to a parent without the ledger and would drop it.

package/scripts/lean_verification.py

@@ -108,10 +108,14 @@ def _final_view(relative, text, criteria, reviewed, head, surfaces=None):
                 fields[field] = contracts._raw_source_field(block, field, relative)
         if "Surface" in fields and not {"Check", "Observed"}.issubset(fields):
             raise contracts.HandoffError(f"{criterion} lacks its recorded surface walkthrough")
+        reference = f"{relative} — {criterion}"
+        if "Observed" in fields and evidence:
+            # The reviewer may cite held-out and judgment ids on the evidence line.
+            reference += f"; evidence: {evidence}"
         lines += [f"### {criterion} — {title}", "", "- **Verdict**: met",
                   f"- **Check**: {fields.get('Check', 'none')}",
                   f"- **Observed**: {fields.get('Observed', evidence)}",
-                  f"- **Reference**: {relative} — {criterion}",
+                  f"- **Reference**: {reference}",
                   "- **Finding**: none", "- **Fix direction**: none"]
         if "Surface" in fields:
             expected = (surfaces or {}).get(criterion)

package/skills/gsd-path/BUILD.md

@@ -130,7 +130,9 @@ STATE.md-only "finalize" checkpoint for work already checkpointed. The helper
 refuses a `build:` checkpoint that deletes or renames a `.project/tasks/`
 brief unless the canonical `build: abandon milestone <slug>` checkpoint moves
 that same brief into `.project/archive/`; build adds fix tasks and repairs
-briefs, it never replans.
+briefs, it never replans. It also refuses a `build:` checkpoint while the
+committed STATE is `ship/active`: final-review outputs stay uncommitted until
+the ship commit.
 
 ## Execute from runtime receipts
 

package/skills/gsd-path/SHIP.md

@@ -69,7 +69,8 @@ so the position is unchanged. Then:
    task logs prove it is the immediately preceding `ship/blocked` finding
    set, the approved patch tasks copied every finding verbatim, and those tasks
    are now done; otherwise it blocks. Git history preserves the superseded
-   finding, while final review itself still creates no pre-ship commit.
+   finding, while final review itself still creates no pre-ship commit
+   (`isolation.py checkpoint` refuses a `build:` checkpoint at `ship/active`).
 2. Derive a stable numbered list of cross-wave integration risks from
    interfaces and flows that span waves. List only genuine risks that could
    plausibly fail; never pad the list. Include PLAN.md's project Verify as

package/skills/gsd-path/scripts/isolation.py

@@ -4502,6 +4502,20 @@ def attest(
     }
 
 
+def _committed_ship_active(repo: Path) -> bool:
+    """True when the STATE.md committed at HEAD is ship/active."""
+
+    result = run_git(repo, "show", "HEAD:.project/STATE.md")
+    if result.returncode != 0:
+        return False
+    frontmatter = result.stdout.split("\n---", 1)[0]
+    fields = {
+        key: _unquote(value)
+        for key, value in re.findall(r"(?m)^(phase|status):(.*)$", frontmatter)
+    }
+    return fields.get("phase") == "ship" and fields.get("status") == "active"
+
+
 def checkpoint(
     repo: Path,
     expected_head: str,
@@ -4551,6 +4565,12 @@ def checkpoint(
                 "subject": subject.strip(),
             }
         raise IsolationError("primary HEAD differs from --expected-head")
+    if subject.strip().startswith("build:") and _committed_ship_active(repo):
+        raise IsolationError(
+            "STATE is ship/active: final review creates no pre-ship commit; leave its "
+            "outputs uncommitted for archive_milestone.py, and send findings through "
+            "the patch plan (see SHIP.md)"
+        )
     pending = uncommitted_paths(repo)
     forced: Set[str] = set()
     # Build only: an approval undo resets to a parent without the ledger and would drop it.

package/skills/gsd-path/scripts/lean_verification.py

@@ -108,10 +108,14 @@ def _final_view(relative, text, criteria, reviewed, head, surfaces=None):
                 fields[field] = contracts._raw_source_field(block, field, relative)
         if "Surface" in fields and not {"Check", "Observed"}.issubset(fields):
             raise contracts.HandoffError(f"{criterion} lacks its recorded surface walkthrough")
+        reference = f"{relative} — {criterion}"
+        if "Observed" in fields and evidence:
+            # The reviewer may cite held-out and judgment ids on the evidence line.
+            reference += f"; evidence: {evidence}"
         lines += [f"### {criterion} — {title}", "", "- **Verdict**: met",
                   f"- **Check**: {fields.get('Check', 'none')}",
                   f"- **Observed**: {fields.get('Observed', evidence)}",
-                  f"- **Reference**: {relative} — {criterion}",
+                  f"- **Reference**: {reference}",
                   "- **Finding**: none", "- **Fix direction**: none"]
         if "Surface" in fields:
             expected = (surfaces or {}).get(criterion)

package/skills/gsd-path-build/SKILL.md

@@ -130,7 +130,9 @@ STATE.md-only "finalize" checkpoint for work already checkpointed. The helper
 refuses a `build:` checkpoint that deletes or renames a `.project/tasks/`
 brief unless the canonical `build: abandon milestone <slug>` checkpoint moves
 that same brief into `.project/archive/`; build adds fix tasks and repairs
-briefs, it never replans.
+briefs, it never replans. It also refuses a `build:` checkpoint while the
+committed STATE is `ship/active`: final-review outputs stay uncommitted until
+the ship commit.
 
 ## Execute from runtime receipts
 

package/skills/gsd-path-build/scripts/isolation.py

@@ -4502,6 +4502,20 @@ def attest(
     }
 
 
+def _committed_ship_active(repo: Path) -> bool:
+    """True when the STATE.md committed at HEAD is ship/active."""
+
+    result = run_git(repo, "show", "HEAD:.project/STATE.md")
+    if result.returncode != 0:
+        return False
+    frontmatter = result.stdout.split("\n---", 1)[0]
+    fields = {
+        key: _unquote(value)
+        for key, value in re.findall(r"(?m)^(phase|status):(.*)$", frontmatter)
+    }
+    return fields.get("phase") == "ship" and fields.get("status") == "active"
+
+
 def checkpoint(
     repo: Path,
     expected_head: str,
@@ -4551,6 +4565,12 @@ def checkpoint(
                 "subject": subject.strip(),
             }
         raise IsolationError("primary HEAD differs from --expected-head")
+    if subject.strip().startswith("build:") and _committed_ship_active(repo):
+        raise IsolationError(
+            "STATE is ship/active: final review creates no pre-ship commit; leave its "
+            "outputs uncommitted for archive_milestone.py, and send findings through "
+            "the patch plan (see SHIP.md)"
+        )
     pending = uncommitted_paths(repo)
     forced: Set[str] = set()
     # Build only: an approval undo resets to a parent without the ledger and would drop it.

package/skills/gsd-path-decide/scripts/isolation.py

@@ -4502,6 +4502,20 @@ def attest(
     }
 
 
+def _committed_ship_active(repo: Path) -> bool:
+    """True when the STATE.md committed at HEAD is ship/active."""
+
+    result = run_git(repo, "show", "HEAD:.project/STATE.md")
+    if result.returncode != 0:
+        return False
+    frontmatter = result.stdout.split("\n---", 1)[0]
+    fields = {
+        key: _unquote(value)
+        for key, value in re.findall(r"(?m)^(phase|status):(.*)$", frontmatter)
+    }
+    return fields.get("phase") == "ship" and fields.get("status") == "active"
+
+
 def checkpoint(
     repo: Path,
     expected_head: str,
@@ -4551,6 +4565,12 @@ def checkpoint(
                 "subject": subject.strip(),
             }
         raise IsolationError("primary HEAD differs from --expected-head")
+    if subject.strip().startswith("build:") and _committed_ship_active(repo):
+        raise IsolationError(
+            "STATE is ship/active: final review creates no pre-ship commit; leave its "
+            "outputs uncommitted for archive_milestone.py, and send findings through "
+            "the patch plan (see SHIP.md)"
+        )
     pending = uncommitted_paths(repo)
     forced: Set[str] = set()
     # Build only: an approval undo resets to a parent without the ledger and would drop it.

package/skills/gsd-path-define/scripts/isolation.py

@@ -4502,6 +4502,20 @@ def attest(
     }
 
 
+def _committed_ship_active(repo: Path) -> bool:
+    """True when the STATE.md committed at HEAD is ship/active."""
+
+    result = run_git(repo, "show", "HEAD:.project/STATE.md")
+    if result.returncode != 0:
+        return False
+    frontmatter = result.stdout.split("\n---", 1)[0]
+    fields = {
+        key: _unquote(value)
+        for key, value in re.findall(r"(?m)^(phase|status):(.*)$", frontmatter)
+    }
+    return fields.get("phase") == "ship" and fields.get("status") == "active"
+
+
 def checkpoint(
     repo: Path,
     expected_head: str,
@@ -4551,6 +4565,12 @@ def checkpoint(
                 "subject": subject.strip(),
             }
         raise IsolationError("primary HEAD differs from --expected-head")
+    if subject.strip().startswith("build:") and _committed_ship_active(repo):
+        raise IsolationError(
+            "STATE is ship/active: final review creates no pre-ship commit; leave its "
+            "outputs uncommitted for archive_milestone.py, and send findings through "
+            "the patch plan (see SHIP.md)"
+        )
     pending = uncommitted_paths(repo)
     forced: Set[str] = set()
     # Build only: an approval undo resets to a parent without the ledger and would drop it.

package/skills/gsd-path-docs-audit/scripts/isolation.py

@@ -4502,6 +4502,20 @@ def attest(
     }
 
 
+def _committed_ship_active(repo: Path) -> bool:
+    """True when the STATE.md committed at HEAD is ship/active."""
+
+    result = run_git(repo, "show", "HEAD:.project/STATE.md")
+    if result.returncode != 0:
+        return False
+    frontmatter = result.stdout.split("\n---", 1)[0]
+    fields = {
+        key: _unquote(value)
+        for key, value in re.findall(r"(?m)^(phase|status):(.*)$", frontmatter)
+    }
+    return fields.get("phase") == "ship" and fields.get("status") == "active"
+
+
 def checkpoint(
     repo: Path,
     expected_head: str,
@@ -4551,6 +4565,12 @@ def checkpoint(
                 "subject": subject.strip(),
             }
         raise IsolationError("primary HEAD differs from --expected-head")
+    if subject.strip().startswith("build:") and _committed_ship_active(repo):
+        raise IsolationError(
+            "STATE is ship/active: final review creates no pre-ship commit; leave its "
+            "outputs uncommitted for archive_milestone.py, and send findings through "
+            "the patch plan (see SHIP.md)"
+        )
     pending = uncommitted_paths(repo)
     forced: Set[str] = set()
     # Build only: an approval undo resets to a parent without the ledger and would drop it.

package/skills/gsd-path-inspect/scripts/isolation.py

@@ -4502,6 +4502,20 @@ def attest(
     }
 
 
+def _committed_ship_active(repo: Path) -> bool:
+    """True when the STATE.md committed at HEAD is ship/active."""
+
+    result = run_git(repo, "show", "HEAD:.project/STATE.md")
+    if result.returncode != 0:
+        return False
+    frontmatter = result.stdout.split("\n---", 1)[0]
+    fields = {
+        key: _unquote(value)
+        for key, value in re.findall(r"(?m)^(phase|status):(.*)$", frontmatter)
+    }
+    return fields.get("phase") == "ship" and fields.get("status") == "active"
+
+
 def checkpoint(
     repo: Path,
     expected_head: str,
@@ -4551,6 +4565,12 @@ def checkpoint(
                 "subject": subject.strip(),
             }
         raise IsolationError("primary HEAD differs from --expected-head")
+    if subject.strip().startswith("build:") and _committed_ship_active(repo):
+        raise IsolationError(
+            "STATE is ship/active: final review creates no pre-ship commit; leave its "
+            "outputs uncommitted for archive_milestone.py, and send findings through "
+            "the patch plan (see SHIP.md)"
+        )
     pending = uncommitted_paths(repo)
     forced: Set[str] = set()
     # Build only: an approval undo resets to a parent without the ledger and would drop it.

package/skills/gsd-path-plan/scripts/isolation.py

@@ -4502,6 +4502,20 @@ def attest(
     }
 
 
+def _committed_ship_active(repo: Path) -> bool:
+    """True when the STATE.md committed at HEAD is ship/active."""
+
+    result = run_git(repo, "show", "HEAD:.project/STATE.md")
+    if result.returncode != 0:
+        return False
+    frontmatter = result.stdout.split("\n---", 1)[0]
+    fields = {
+        key: _unquote(value)
+        for key, value in re.findall(r"(?m)^(phase|status):(.*)$", frontmatter)
+    }
+    return fields.get("phase") == "ship" and fields.get("status") == "active"
+
+
 def checkpoint(
     repo: Path,
     expected_head: str,
@@ -4551,6 +4565,12 @@ def checkpoint(
                 "subject": subject.strip(),
             }
         raise IsolationError("primary HEAD differs from --expected-head")
+    if subject.strip().startswith("build:") and _committed_ship_active(repo):
+        raise IsolationError(
+            "STATE is ship/active: final review creates no pre-ship commit; leave its "
+            "outputs uncommitted for archive_milestone.py, and send findings through "
+            "the patch plan (see SHIP.md)"
+        )
     pending = uncommitted_paths(repo)
     forced: Set[str] = set()
     # Build only: an approval undo resets to a parent without the ledger and would drop it.

package/skills/gsd-path-research/scripts/isolation.py

@@ -4502,6 +4502,20 @@ def attest(
     }
 
 
+def _committed_ship_active(repo: Path) -> bool:
+    """True when the STATE.md committed at HEAD is ship/active."""
+
+    result = run_git(repo, "show", "HEAD:.project/STATE.md")
+    if result.returncode != 0:
+        return False
+    frontmatter = result.stdout.split("\n---", 1)[0]
+    fields = {
+        key: _unquote(value)
+        for key, value in re.findall(r"(?m)^(phase|status):(.*)$", frontmatter)
+    }
+    return fields.get("phase") == "ship" and fields.get("status") == "active"
+
+
 def checkpoint(
     repo: Path,
     expected_head: str,
@@ -4551,6 +4565,12 @@ def checkpoint(
                 "subject": subject.strip(),
             }
         raise IsolationError("primary HEAD differs from --expected-head")
+    if subject.strip().startswith("build:") and _committed_ship_active(repo):
+        raise IsolationError(
+            "STATE is ship/active: final review creates no pre-ship commit; leave its "
+            "outputs uncommitted for archive_milestone.py, and send findings through "
+            "the patch plan (see SHIP.md)"
+        )
     pending = uncommitted_paths(repo)
     forced: Set[str] = set()
     # Build only: an approval undo resets to a parent without the ledger and would drop it.

package/skills/gsd-path-roadmap/scripts/isolation.py

@@ -4502,6 +4502,20 @@ def attest(
     }
 
 
+def _committed_ship_active(repo: Path) -> bool:
+    """True when the STATE.md committed at HEAD is ship/active."""
+
+    result = run_git(repo, "show", "HEAD:.project/STATE.md")
+    if result.returncode != 0:
+        return False
+    frontmatter = result.stdout.split("\n---", 1)[0]
+    fields = {
+        key: _unquote(value)
+        for key, value in re.findall(r"(?m)^(phase|status):(.*)$", frontmatter)
+    }
+    return fields.get("phase") == "ship" and fields.get("status") == "active"
+
+
 def checkpoint(
     repo: Path,
     expected_head: str,
@@ -4551,6 +4565,12 @@ def checkpoint(
                 "subject": subject.strip(),
             }
         raise IsolationError("primary HEAD differs from --expected-head")
+    if subject.strip().startswith("build:") and _committed_ship_active(repo):
+        raise IsolationError(
+            "STATE is ship/active: final review creates no pre-ship commit; leave its "
+            "outputs uncommitted for archive_milestone.py, and send findings through "
+            "the patch plan (see SHIP.md)"
+        )
     pending = uncommitted_paths(repo)
     forced: Set[str] = set()
     # Build only: an approval undo resets to a parent without the ledger and would drop it.

package/skills/gsd-path-ship/SKILL.md

@@ -69,7 +69,8 @@ so the position is unchanged. Then:
    task logs prove it is the immediately preceding `ship/blocked` finding
    set, the approved patch tasks copied every finding verbatim, and those tasks
    are now done; otherwise it blocks. Git history preserves the superseded
-   finding, while final review itself still creates no pre-ship commit.
+   finding, while final review itself still creates no pre-ship commit
+   (`isolation.py checkpoint` refuses a `build:` checkpoint at `ship/active`).
 2. Derive a stable numbered list of cross-wave integration risks from
    interfaces and flows that span waves. List only genuine risks that could
    plausibly fail; never pad the list. Include PLAN.md's project Verify as

package/skills/gsd-path-ship/scripts/isolation.py

@@ -4502,6 +4502,20 @@ def attest(
     }
 
 
+def _committed_ship_active(repo: Path) -> bool:
+    """True when the STATE.md committed at HEAD is ship/active."""
+
+    result = run_git(repo, "show", "HEAD:.project/STATE.md")
+    if result.returncode != 0:
+        return False
+    frontmatter = result.stdout.split("\n---", 1)[0]
+    fields = {
+        key: _unquote(value)
+        for key, value in re.findall(r"(?m)^(phase|status):(.*)$", frontmatter)
+    }
+    return fields.get("phase") == "ship" and fields.get("status") == "active"
+
+
 def checkpoint(
     repo: Path,
     expected_head: str,
@@ -4551,6 +4565,12 @@ def checkpoint(
                 "subject": subject.strip(),
             }
         raise IsolationError("primary HEAD differs from --expected-head")
+    if subject.strip().startswith("build:") and _committed_ship_active(repo):
+        raise IsolationError(
+            "STATE is ship/active: final review creates no pre-ship commit; leave its "
+            "outputs uncommitted for archive_milestone.py, and send findings through "
+            "the patch plan (see SHIP.md)"
+        )
     pending = uncommitted_paths(repo)
     forced: Set[str] = set()
     # Build only: an approval undo resets to a parent without the ledger and would drop it.

package/skills/gsd-path-ship/scripts/lean_verification.py

@@ -108,10 +108,14 @@ def _final_view(relative, text, criteria, reviewed, head, surfaces=None):
                 fields[field] = contracts._raw_source_field(block, field, relative)
         if "Surface" in fields and not {"Check", "Observed"}.issubset(fields):
             raise contracts.HandoffError(f"{criterion} lacks its recorded surface walkthrough")
+        reference = f"{relative} — {criterion}"
+        if "Observed" in fields and evidence:
+            # The reviewer may cite held-out and judgment ids on the evidence line.
+            reference += f"; evidence: {evidence}"
         lines += [f"### {criterion} — {title}", "", "- **Verdict**: met",
                   f"- **Check**: {fields.get('Check', 'none')}",
                   f"- **Observed**: {fields.get('Observed', evidence)}",
-                  f"- **Reference**: {relative} — {criterion}",
+                  f"- **Reference**: {reference}",
                   "- **Finding**: none", "- **Fix direction**: none"]
         if "Surface" in fields:
             expected = (surfaces or {}).get(criterion)

package/skills/path/BUILD.md

@@ -130,7 +130,9 @@ STATE.md-only "finalize" checkpoint for work already checkpointed. The helper
 refuses a `build:` checkpoint that deletes or renames a `.project/tasks/`
 brief unless the canonical `build: abandon milestone <slug>` checkpoint moves
 that same brief into `.project/archive/`; build adds fix tasks and repairs
-briefs, it never replans.
+briefs, it never replans. It also refuses a `build:` checkpoint while the
+committed STATE is `ship/active`: final-review outputs stay uncommitted until
+the ship commit.
 
 ## Execute from runtime receipts
 

package/skills/path/SHIP.md

@@ -69,7 +69,8 @@ so the position is unchanged. Then:
    task logs prove it is the immediately preceding `ship/blocked` finding
    set, the approved patch tasks copied every finding verbatim, and those tasks
    are now done; otherwise it blocks. Git history preserves the superseded
-   finding, while final review itself still creates no pre-ship commit.
+   finding, while final review itself still creates no pre-ship commit
+   (`isolation.py checkpoint` refuses a `build:` checkpoint at `ship/active`).
 2. Derive a stable numbered list of cross-wave integration risks from
    interfaces and flows that span waves. List only genuine risks that could
    plausibly fail; never pad the list. Include PLAN.md's project Verify as

package/skills/path/scripts/isolation.py

@@ -4502,6 +4502,20 @@ def attest(
     }
 
 
+def _committed_ship_active(repo: Path) -> bool:
+    """True when the STATE.md committed at HEAD is ship/active."""
+
+    result = run_git(repo, "show", "HEAD:.project/STATE.md")
+    if result.returncode != 0:
+        return False
+    frontmatter = result.stdout.split("\n---", 1)[0]
+    fields = {
+        key: _unquote(value)
+        for key, value in re.findall(r"(?m)^(phase|status):(.*)$", frontmatter)
+    }
+    return fields.get("phase") == "ship" and fields.get("status") == "active"
+
+
 def checkpoint(
     repo: Path,
     expected_head: str,
@@ -4551,6 +4565,12 @@ def checkpoint(
                 "subject": subject.strip(),
             }
         raise IsolationError("primary HEAD differs from --expected-head")
+    if subject.strip().startswith("build:") and _committed_ship_active(repo):
+        raise IsolationError(
+            "STATE is ship/active: final review creates no pre-ship commit; leave its "
+            "outputs uncommitted for archive_milestone.py, and send findings through "
+            "the patch plan (see SHIP.md)"
+        )
     pending = uncommitted_paths(repo)
     forced: Set[str] = set()
     # Build only: an approval undo resets to a parent without the ledger and would drop it.

package/skills/path/scripts/lean_verification.py

@@ -108,10 +108,14 @@ def _final_view(relative, text, criteria, reviewed, head, surfaces=None):
                 fields[field] = contracts._raw_source_field(block, field, relative)
         if "Surface" in fields and not {"Check", "Observed"}.issubset(fields):
             raise contracts.HandoffError(f"{criterion} lacks its recorded surface walkthrough")
+        reference = f"{relative} — {criterion}"
+        if "Observed" in fields and evidence:
+            # The reviewer may cite held-out and judgment ids on the evidence line.
+            reference += f"; evidence: {evidence}"
         lines += [f"### {criterion} — {title}", "", "- **Verdict**: met",
                   f"- **Check**: {fields.get('Check', 'none')}",
                   f"- **Observed**: {fields.get('Observed', evidence)}",
-                  f"- **Reference**: {relative} — {criterion}",
+                  f"- **Reference**: {reference}",
                   "- **Finding**: none", "- **Fix direction**: none"]
         if "Surface" in fields:
             expected = (surfaces or {}).get(criterion)