@polymorphism-tech/morph-spec 10.7.0 → 10.8.0

package/src/lib/ci/github-ci.js

@@ -1,45 +1,8 @@
 import { execFileSync, spawnSync } from 'child_process';
-import { existsSync, mkdtempSync, readdirSync, readFileSync, rmSync } from 'fs';
-import { tmpdir } from 'os';
-import { join } from 'path';
 import { resolveGh } from '../git/gh.js';
 
-export const CI_WORKFLOW_DIR = '.github/workflows';
-export const CI_WORKFLOW_FILE = 'morph-verify.yml';
-export const CI_ARTIFACT = 'morph-verify';
-export const CI_RESULT_FILE = 'morph-verify.json';
-
-// A run that never judged the code (superseded, filtered out, quota) is no proof either way.
-const NO_VERDICT = new Set(['cancelled', 'skipped', 'startup_failure', 'stale', 'neutral']);
-
-const VERIFY_CALL = /morph-spec\S*\s+verify\b/;
-
 const git = (cwd, args) => execFileSync('git', args, { cwd, stdio: 'pipe' }).toString();
 
-function gh(cwd, args, timeout = 15000) {
-  const { bin, prefix } = resolveGh();
-  return execFileSync(bin, [...prefix, ...args], { cwd, stdio: 'pipe', timeout }).toString();
-}
-
-// Must call `morph-spec verify` AND publish its JSON: only that artifact becomes a stamp, and a green
-// lint or deploy run proves nothing about the suite.
-export function findCiWorkflow(root) {
-  const dir = join(root, CI_WORKFLOW_DIR);
-  if (!existsSync(dir)) return null;
-  const files = readdirSync(dir).filter((f) => /\.ya?ml$/i.test(f)).sort((a, b) =>
-    (a === CI_WORKFLOW_FILE ? -1 : b === CI_WORKFLOW_FILE ? 1 : a.localeCompare(b)));
-  for (const file of files) {
-    let text;
-    try {
-      text = readFileSync(join(dir, file), 'utf8');
-    } catch {
-      continue;
-    }
-    if (VERIFY_CALL.test(text) && text.includes(CI_RESULT_FILE)) return file;
-  }
-  return null;
-}
-
 export function currentBranch(root) {
   try {
     return git(root, ['rev-parse', '--abbrev-ref', 'HEAD']).trim();
@@ -56,14 +19,13 @@ function originUrl(root) {
   }
 }
 
-function ghAuthText(root) {
+function ghAuthOk(root) {
   const { bin, prefix } = resolveGh();
   const res = spawnSync(bin, [...prefix, 'auth', 'status'], { cwd: root, stdio: 'pipe', timeout: 10000 });
-  if (res.error || res.status !== 0) return null;
-  return `${res.stdout ?? ''}${res.stderr ?? ''}`;
+  return !res.error && res.status === 0;
 }
 
-/** Never throws: every "no" is a reason the caller prints before falling back to the local verify. */
+/** Never throws: every "no" is a reason the caller prints before running everything locally. */
 export function ciAvailability(root, featureName, config) {
   if (config?.project?.ci === false) return { ok: false, reason: 'project.ci = false no config.json' };
   const url = originUrl(root);
@@ -73,17 +35,8 @@ export function ciAvailability(root, featureName, config) {
   if (branch !== `morph/${featureName}`) {
     return { ok: false, reason: `branch atual "${branch}" não é morph/${featureName}` };
   }
-  const auth = ghAuthText(root);
-  if (auth === null) return { ok: false, reason: 'gh ausente ou não autenticado' };
-  const scopes = auth.match(/Token scopes:\s*(.*)/i)?.[1] ?? null;
-  return { ok: true, branch, https: /^https?:/i.test(url), scopes };
-}
-
-// Creating a workflow file over HTTPS needs the token's `workflow` scope, or GitHub rejects the whole push.
-// Unknown scopes (fine-grained token, SSH remote) are not a refusal.
-export function workflowPushProblem({ https, scopes }) {
-  if (!https || scopes === null) return null;
-  return /\bworkflow\b/.test(scopes) ? null : 'o token do gh não tem o escopo "workflow" (gh auth refresh -s workflow)';
+  if (!ghAuthOk(root)) return { ok: false, reason: 'gh ausente ou não autenticado' };
+  return { ok: true, branch };
 }
 
 /** Uncommitted or untracked files outside `.morph/`, plus the config; null when git did not answer. */
@@ -97,68 +50,3 @@ export function uncommittedCode(root) {
   return out.split('\0').filter(Boolean).map((line) => line.slice(3))
     .filter((path) => !path.startsWith('.morph/') || path === '.morph/config/config.json');
 }
-
-export function pushBranch(root, branch) {
-  try {
-    git(root, ['push', '-u', 'origin', branch]);
-    return null;
-  } catch (err) {
-    return (err.stderr?.toString() || err.message).trim().split('\n').slice(-3).join(' ');
-  }
-}
-
-/** @returns {Array<object>|null} newest first; null = gh did not answer */
-export function listRuns(root, branch, workflow) {
-  try {
-    return JSON.parse(gh(root, ['run', 'list', '--branch', branch, '--workflow', workflow, '--limit', '20',
-      '--json', 'databaseId,status,conclusion,headSha,url,createdAt']));
-  } catch {
-    return null;
-  }
-}
-
-// `isCurrent` compares trees, not SHAs: the review agents and the archive commit only `.morph/`,
-// and the workflow does not re-run for them.
-export function pickRun(runs, isCurrent) {
-  return (runs || []).find((run) => !(run.status === 'completed' && NO_VERDICT.has(run.conclusion))
-    && run.headSha && isCurrent(run.headSha)) ?? null;
-}
-
-/** @returns {object|null} the parsed `verify --json` the run uploaded; null when absent or unreadable */
-export function downloadResult(root, runId) {
-  const dir = mkdtempSync(join(tmpdir(), 'morph-ci-'));
-  try {
-    gh(root, ['run', 'download', String(runId), '--name', CI_ARTIFACT, '--dir', dir], 120000);
-    return JSON.parse(readFileSync(join(dir, CI_RESULT_FILE), 'utf8'));
-  } catch {
-    return null;
-  } finally {
-    rmSync(dir, { recursive: true, force: true });
-  }
-}
-
-/** Never decides: the caller turns `timeout`/`no-run`/`unknown` into "no CI proof", never into red. */
-export async function waitForRun(root, { branch, workflow, isCurrent, timeoutMs, appearMs, pollMs = 15000,
-  sleep = (ms) => new Promise((r) => setTimeout(r, ms)), now = Date.now, onPending = () => {}, list = listRuns }) {
-  const start = now();
-  let seen = false;
-  let misses = 0;
-  for (;;) {
-    const runs = list(root, branch, workflow);
-    if (runs === null) {
-      if (++misses >= 3) return { state: 'unknown' };
-    } else {
-      misses = 0;
-      const run = pickRun(runs, isCurrent);
-      if (run?.status === 'completed') return { state: 'completed', run };
-      if (run) {
-        if (!seen) onPending(run);
-        seen = true;
-      }
-    }
-    const elapsed = now() - start;
-    if (!seen && elapsed >= appearMs) return { state: 'no-run' };
-    if (elapsed >= timeoutMs) return { state: 'timeout' };
-    await sleep(pollMs);
-  }
-}

package/src/lib/generators/architecture-scanner.js

@@ -417,18 +417,8 @@ export async function renderArchitectureContext(projectPath, scanResult, options
     }
   }
 
-  let morphVersion = 'unknown';
-  try {
-    const pkgPath = path.join(cliRootDir(), 'package.json');
-    if (existsSync(pkgPath)) {
-      morphVersion = JSON.parse(readFileSync(pkgPath, 'utf8')).version;
-    }
-  } catch {}
-
   const variables = {
     projectName,
-    timestamp: new Date().toISOString().replace('T', ' ').split('.')[0],
-    morphVersion,
     hasDotnet: scanResult.entities.length > 0 || scanResult.endpoints.length > 0,
     entities: scanResult.entities,
     entityCount: scanResult.entities.length,
@@ -473,8 +463,7 @@ export async function renderArchitectureContext(projectPath, scanResult, options
 
 function generateFallbackMarkdown(vars) {
   const lines = [`# ${vars.projectName} — Architecture Context\n`];
-  lines.push(`> Auto-generated by morph-spec context refresh`);
-  lines.push(`> Last updated: ${vars.timestamp}\n`);
+  lines.push('> Auto-generated by morph-spec context refresh\n');
 
   if (vars.hasDotnet) {
     lines.push('## .NET Entities\n');
@@ -550,7 +539,5 @@ function generateFallbackMarkdown(vars) {
       lines.push('');
     }
   }
-
-  lines.push(`---\n*Generated by morph-spec v${vars.morphVersion}*`);
   return lines.join('\n');
 }

package/src/lib/git/default-branch.js

@@ -28,6 +28,24 @@ export function detectDefaultBranch(cwd = process.cwd()) {
   return null;
 }
 
+/**
+ * Where a new feature branch starts: origin's default after a best-effort fetch, so a local default that
+ * was never pulled does not hand the feature an old base. Falls back to the local default.
+ */
+export function freshDefaultRef(cwd = process.cwd()) {
+  const branch = detectDefaultBranch(cwd);
+  if (!branch) return null;
+  try {
+    execFileSync('git', ['fetch', '-q', 'origin', branch], { cwd, stdio: 'pipe', timeout: 30_000 });
+  } catch { /* offline or no origin: the local default */ }
+  try {
+    execFileSync('git', ['show-ref', '--verify', '--quiet', `refs/remotes/origin/${branch}`], { cwd, stdio: 'pipe' });
+    return `origin/${branch}`;
+  } catch {
+    return branch;
+  }
+}
+
 export function hasOriginRemote(cwd = process.cwd()) {
   try {
     const url = execFileSync('git', ['remote', 'get-url', 'origin'], { cwd, stdio: 'pipe' }).toString().trim();
@@ -107,8 +125,17 @@ export function changedPathsAgainst(baseRef, cwd = process.cwd()) {
 
   let tracked;
   try {
+    // From the merge-base: what the default gained after the branch point is not this feature's.
+    // origin's copy first: a local default that was never pulled holds the merge-base back.
+    let base = baseRef;
+    for (const ref of [`origin/${baseRef}`, baseRef]) {
+      try {
+        base = execFileSync('git', ['merge-base', 'HEAD', ref], { cwd, stdio: 'pipe' }).toString().trim() || baseRef;
+        break;
+      } catch { /* next ref */ }
+    }
     tracked = splitLines(
-      execFileSync('git', ['diff', '--name-only', baseRef], { cwd, stdio: 'pipe' }).toString()
+      execFileSync('git', ['diff', '--name-only', base], { cwd, stdio: 'pipe' }).toString()
     );
   } catch {
     return [];

package/src/lib/plan/artifact-vocabulary.js

@@ -26,15 +26,19 @@ export const ARTIFACT_VOCABULARY = [
       'u',
     ),
   },
-  { term: 'glob **/',                    re: /\*\*\/|\/\*\*/ },
+  // A glob inside backticks is a value the change is about (a path a CI filters), not a claim about files.
+  { term: 'glob **/',                    re: /\*\*\/|\/\*\*/, outsideCode: true },
 ];
 
+const CODE_SPAN = /`[^`]*`/g;
+
 /** Each term at most once, in vocabulary order. */
 export function findArtifactTerms(text) {
   const s = String(text ?? '');
+  const prose = s.replace(CODE_SPAN, '');
   const found = [];
-  for (const { term, re } of ARTIFACT_VOCABULARY) {
-    if (re.test(s)) found.push(term);
+  for (const { term, re, outsideCode } of ARTIFACT_VOCABULARY) {
+    if (re.test(outsideCode ? prose : s)) found.push(term);
   }
   return found;
 }

package/src/lib/plan/critique.js

@@ -1,6 +1,7 @@
 import { existsSync, readFileSync } from 'fs';
 import { getAbsoluteOutputPath } from '../../core/paths/output-schema.js';
 import { featureGeneratesMedia } from './media.js';
+import { SENSITIVE_LINE } from '../risk/diff-risk.js';
 
 export const CRITIQUE_EXEMPT_WORK_TYPES = ['chore', 'hotfix'];
 
@@ -16,6 +17,22 @@ export function isSmallPlan(checks, planText = '') {
     && !featureGeneratesMedia(planText);
 }
 
+/**
+ * Who writes `critica.md`. By default the session, with the grep checklist of morph-plan
+ * (references/critique.md): the premises it catches are what a grep confirms. A rung, generated
+ * media or a sensitive theme (PII, permission, sending to a third party, payment) asks for the
+ * fresh-context agent, whose blind spot is not the planner's.
+ */
+export function critiqueByAgent(checks, planText = '') {
+  const reasons = [];
+  const rungs = (checks?.checks ?? []).filter((c) => c.rung).map((c) => `${c.id} (${c.rung})`);
+  if (rungs.length) reasons.push(`degrau: ${rungs.join(', ')}`);
+  if (featureGeneratesMedia(planText)) reasons.push('mídia gerada');
+  const sensitive = String(planText).split(/\r?\n/).find((line) => SENSITIVE_LINE.test(line));
+  if (sensitive) reasons.push(`tema sensível: ${sensitive.trim().slice(0, 80)}`);
+  return { agent: reasons.length > 0, reasons };
+}
+
 const PLAN_HASH_RE = /^\*\*Plan-Hash:\*\*\s*`?([0-9a-f]{64})`?\s*$/m;
 const APPLIED_RE = /^\*\*Aplicado-em:\*\*\s*`?([0-9a-f]{64})`?\s*$/gm;
 

package/src/lib/review-confirmation.js

@@ -2,6 +2,7 @@ import { execFileSync } from 'child_process';
 import { basename } from 'path';
 import { treeMovedSince } from './git/evidence-staleness.js';
 import { isTestOnly, securityReviewFor } from './risk-detector.js';
+import { deltaRisk } from './risk/diff-risk.js';
 
 function resolveCommit(cwd, ref) {
   try {
@@ -38,30 +39,28 @@ function deltaIsNarrow(role, delta, cited) {
 }
 
 /**
- * After a fix, a role that shipped clean need not return when the delta stays inside what the
- * blockers named (security: when it touches no sensitive path). `moved` lists the roles behind
- * `head`; `skippable` says it holds; `confirmed` says a role that opened blockers re-judged `head`,
- * without which nothing is skippable at approval.
+ * The one oracle of "this review is stale", read by `approve` and by `report-check` alike. A delta that
+ * touches only `.morph/`, docs, config, imports or comments (`deltaRisk` trivial) moves no role. Otherwise a
+ * role that shipped clean need not return when the delta stays inside what the blockers named or in
+ * tests (security: no sensitive path), and only once a role that opened blockers re-judged `head`.
  */
 export function reviewConfirmation(cwd, reports, head) {
   const cited = citedByBlockers(reports);
-  const moved = [];
+  const behind = [];
   let confirmed = false;
 
   for (const [role, report] of Object.entries(reports)) {
     if (report.status === 'missing' || !report.reviewedSha) continue;
     const reviewed = resolveCommit(cwd, report.reviewedSha);
     if (!reviewed) continue;
-    if (!treeMovedSince(cwd, reviewed, head)) {
+    if (!treeMovedSince(cwd, reviewed, head) || deltaRisk(cwd, reviewed, head)?.trivial) {
       if (openedBlockers(report)) confirmed = true;
       continue;
     }
-    moved.push({
-      role,
-      reviewed,
-      skippable: isCleanShip(report) && deltaIsNarrow(role, changedBetween(cwd, reviewed, head), cited),
-    });
+    behind.push({ role, reviewed, narrow: isCleanShip(report) && deltaIsNarrow(role, changedBetween(cwd, reviewed, head), cited) });
   }
 
+  const anyBlockers = Object.values(reports).some(openedBlockers);
+  const moved = behind.map(({ narrow, ...m }) => ({ ...m, skippable: narrow && (confirmed || !anyBlockers) }));
   return { moved, confirmed };
 }

package/src/lib/review-reports.js

@@ -30,11 +30,16 @@ const CHECKS_SECTION_RE = sectionRe('Checks');
 const MEDIA_SECTION_RE = /^##\s+M[íi]dia\s+gerada\s*$/m;
 const SCREEN_CHECKLIST_SECTION_RE = sectionRe('Checklist\\s+de\\s+tela');
 
-/** Hotfix: só o verificador, escrito pelo orquestrador sem dispatch. Chore: só o revisor (review leve). */
-export function requiredReviewRoles({ workType, securityRequired = false } = {}) {
+/**
+ * Hotfix: só o verificador, escrito pelo orquestrador sem dispatch. Fora dele manda o `risk` do diff
+ * (`src/lib/risk/diff-risk.js`): `low`/`none` = só o revisor, escrito pela sessão com o checklist.
+ * Sem risco medido, o tipo decide (chore leve).
+ */
+export function requiredReviewRoles({ workType, securityRequired = false, risk = null } = {}) {
   // Sem `security` mesmo em caminho sensível: o humano assina todo hotfix.
   if (workType === 'hotfix') return ['verifier'];
-  const base = workType === 'chore' ? ['reviewer'] : ['verifier', 'reviewer'];
+  const light = risk ? ['low', 'none'].includes(risk) : workType === 'chore';
+  const base = light ? ['reviewer'] : ['verifier', 'reviewer'];
   return securityRequired ? [...base, 'security'] : base;
 }
 
@@ -78,12 +83,16 @@ function tableRows(body, keepHeader = () => true) {
   return rows;
 }
 
+// A confirmation round that relists a blocker in the typed table to close it ("**Fechado.** …").
+const CLOSED_ROW_RE = /^(fechado|resolvido|closed|resolved)\b/;
+
 // `| id | tipo | onde | evidência |`; `untyped` = tipo fora de BLOCKER_TYPES.
 function parseBlockers(body) {
   const blockers = [];
   const untyped = [];
   for (const cells of tableRows(body, (header) => !isStatusHeader(header))) {
     const row = { id: cleanId(cells[0]), type: normalize(cells[1]), where: cells[2] ?? '', evidence: cells[3] ?? '' };
+    if (CLOSED_ROW_RE.test(normalize(row.evidence.replace(/[*_`]/g, '')))) continue;
     (BLOCKER_TYPES.includes(row.type) ? blockers : untyped).push(row);
   }
   return { blockers, untyped };

package/src/lib/risk/diff-risk.js

@@ -0,0 +1,116 @@
+import { execFileSync } from 'child_process';
+import { isTestPath } from '../graph/sanitize.js';
+import { contractsTouched, migrationsTouched, securityReviewFor } from '../risk-detector.js';
+
+const DOC_PATH = /(^|\/)docs\/|\.(md|mdx|txt|rst|adoc|png|jpe?g|gif|svg|webp|ico)$/i;
+const CONFIG_PATH = /\.(json|jsonc|ya?ml|toml|ini|xml|editorconfig|env\.example)$|(^|\/)\.(gitignore|gitattributes|npmrc|nvmrc|prettierrc|eslintignore)$/i;
+// Resolves or compiles everything: a change here reaches code the diff does not name.
+const WIDE_PATH = /(^|\/)(package(-lock)?\.json|pnpm-lock\.yaml|yarn\.lock|global\.json|Directory\.(Build|Packages)\.(props|targets)|tsconfig[^/]*\.json|[^/]+\.(csproj|sln|slnx|props|targets))$/i;
+const TRIVIAL_LINE = /^\s*(|\/\/.*|#(?!include).*|\/\*.*|\*.*|\*\/|--.*|(import|using|export\s+\*\s+from|#include)\b.*|.*\brequire\(['"][^'"]+['"]\);?\s*)$/;
+// PII, permission, sending to a third party, payment, contract: what turns a diff into a security review.
+export const SENSITIVE_LINE = /\b(pii|lgpd|gdpr|cpf|cnpj|redact\w*|anonimi\w*|opt.?out|dnd|consent\w*|permiss\w*|authoriz\w*|autoriza\w*|requirerole|isadmin|password|senha|secret|apikey|api_key|whatsapp|sendmessage|sendtemplate|sms|webhook|smtp|sendemail|payment|pagamento|cobran\w*|invoice|fatura|checkout|refund|estorno|stripe|asaas|contrato)\b/i;
+
+const camelSplit = (path) => path.replace(/([a-z0-9])([A-Z])/g, '$1-$2');
+
+function git(cwd, args) {
+  return execFileSync('git', args, { cwd, stdio: 'pipe', maxBuffer: 256 * 1024 * 1024 }).toString();
+}
+
+export function fileClass(path) {
+  if (path.startsWith('.morph/')) return 'state';
+  if (DOC_PATH.test(path)) return 'doc';
+  if (CONFIG_PATH.test(path) && !WIDE_PATH.test(path)) return 'config';
+  return isTestPath(path) || /(^|\/)e2e\//.test(path) ? 'test' : 'code';
+}
+
+/** Per file: `added`/`removed` lines and `deleted` (the whole file went away). */
+export function diffLines(cwd, from, to = null) {
+  const range = to ? [from, to] : [from];
+  const text = git(cwd, ['-c', 'core.quotepath=off', 'diff', '-U0', '--no-color', '--no-ext-diff', '--no-renames', ...range, '--', '.']);
+  const files = new Map();
+  let current = null;
+  for (const line of text.split('\n')) {
+    if (line.startsWith('diff --git ')) {
+      const path = line.split(' b/').pop();
+      current = { path, added: [], removed: [], deleted: false };
+      files.set(path, current);
+    } else if (!current) {
+      continue;
+    } else if (line.startsWith('deleted file mode')) {
+      current.deleted = true;
+    } else if (line.startsWith('+') && !line.startsWith('+++')) {
+      current.added.push(line.slice(1));
+    } else if (line.startsWith('-') && !line.startsWith('---')) {
+      current.removed.push(line.slice(1));
+    }
+  }
+  if (!to) {
+    for (const path of git(cwd, ['ls-files', '--others', '--exclude-standard']).split('\n').filter(Boolean)) {
+      files.set(path, { path, added: [''], removed: [], deleted: false, untracked: true });
+    }
+  }
+  return [...files.values()];
+}
+
+/** `trivial` = only imports, comments, blank lines; `removal` = logic only taken out; `logic` = logic added. */
+export function changeKind(file) {
+  if (file.deleted) return 'removal';
+  if (file.untracked) return 'logic';
+  if (file.added.some((l) => !TRIVIAL_LINE.test(l))) return 'logic';
+  return file.removed.some((l) => !TRIVIAL_LINE.test(l)) ? 'removal' : 'trivial';
+}
+
+/** `low`: docs, `.morph/`, config, removals, imports. `normal`: logic in code or tests. `security` rides on either. */
+export function classifyFiles(files) {
+  const reasons = [];
+  const relevant = files.filter((f) => fileClass(f.path) !== 'state');
+  const logic = relevant.filter((f) => ['code', 'test'].includes(fileClass(f.path)) && changeKind(f) === 'logic');
+  const wide = relevant.filter((f) => WIDE_PATH.test(f.path));
+  const paths = relevant.map((f) => f.path);
+  if (logic.length) reasons.push(`lógica em ${logic.slice(0, 3).map((f) => f.path).join(', ')}${logic.length > 3 ? ` (+${logic.length - 3})` : ''}`);
+  if (wide.length) reasons.push(`arquivo que alcança o projeto inteiro: ${wide[0].path}`);
+  const migration = migrationsTouched(paths);
+  const contract = contractsTouched(paths);
+  if (migration.length) reasons.push(`migration: ${migration[0]}`);
+
+  const securityReasons = [...securityReviewFor(paths.map(camelSplit)).reasons];
+  if (contract.length) securityReasons.push(`contrato: ${contract[0]}`);
+  const sensitive = relevant.find((f) => fileClass(f.path) === 'code' && f.added.some((l) => SENSITIVE_LINE.test(l)));
+  if (sensitive) {
+    const line = sensitive.added.find((l) => SENSITIVE_LINE.test(l)).trim();
+    securityReasons.push(`linha sensível em ${sensitive.path}: ${line.slice(0, 80)}`);
+  }
+
+  const level = relevant.length === 0 ? 'none' : reasons.length || securityReasons.length ? 'normal' : 'low';
+  const trivial = level !== 'normal' && relevant.every((f) => !['code', 'test'].includes(fileClass(f.path)) || changeKind(f) === 'trivial');
+  return { level, trivial, reasons, security: { required: securityReasons.length > 0, reasons: securityReasons } };
+}
+
+function mergeBase(cwd, defaultBranch) {
+  for (const ref of [`origin/${defaultBranch}`, defaultBranch]) {
+    try {
+      return git(cwd, ['merge-base', 'HEAD', ref]).trim() || null;
+    } catch { /* next ref */ }
+  }
+  return null;
+}
+
+/** The feature's diff from the merge-base with the default, working tree included; null when git cannot tell. */
+export function featureDiffRisk(cwd, defaultBranch) {
+  const base = defaultBranch ? mergeBase(cwd, defaultBranch) : null;
+  if (!base) return null;
+  try {
+    return { base, ...classifyFiles(diffLines(cwd, base)) };
+  } catch {
+    return null;
+  }
+}
+
+/** The delta between two commits; `trivial` (no logic added or removed) never asks for a second review. */
+export function deltaRisk(cwd, from, to) {
+  try {
+    return classifyFiles(diffLines(cwd, from, to));
+  } catch {
+    return null;
+  }
+}

package/src/lib/risk-detector.js

@@ -214,7 +214,7 @@ const PLAN_CRITIQUE_REASONS = {
 // Regra única do gate-check (pausa) e do approve/advance automáticos do plano (recusa).
 export function planCritiquePause(status) {
   const what = PLAN_CRITIQUE_REASONS[status];
-  return what ? `${what} — despache a crítica em contexto fresco (morph-plan, references/critique.md) antes do gate do plano` : null;
+  return what ? `${what} — escreva a crítica antes do gate do plano: a sessão com o checklist de grep, ou o sub-agent quando o plan-check pedir (morph-plan, references/critique.md)` : null;
 }
 
 // Pauses the session clears by doing the work the reason names; the rest wait for the human.

package/src/lib/validators/code-budget/code-budget-validator.js

@@ -6,6 +6,7 @@ import { join } from 'path';
 import { addedLinesAgainst, detectDefaultBranch } from '../../git/default-branch.js';
 import { resolveBaseRef } from '../../git/branch-classifier.js';
 import { isTestFile } from '../reuse/symbol-scanner.js';
+import { readPlanChecks } from '../../plan/checks.js';
 import { isGenerated, isProjectSource } from '../../../../framework/hooks/shared/source-files.js';
 import { citesProcess, commentLines } from '../../../../framework/hooks/shared/comment-scanner.js';
 
@@ -14,6 +15,9 @@ export const MAX_TEST_RATIO = 1;
 /** Abaixo disto a razão não é julgada: a regressão de um bug de 2 linhas cabe aqui. */
 export const MIN_TEST_LINES = 40;
 
+/** Linhas de teste que cada cenário com `prova: teste` (sempre com `risco:`) pode pedir além da razão. */
+export const REQUIRED_TEST_ALLOWANCE = 40;
+
 export const MAX_COMMENT_RATIO = 0.1;
 
 /** Abaixo disto a densidade não é julgada: um comentário legítimo num arquivo pequeno já passaria da razão. */
@@ -48,7 +52,7 @@ export function measureCodeBudget(files) {
   return measured;
 }
 
-export function budgetIssues(measured) {
+export function budgetIssues(measured, { requiredTests = 0 } = {}) {
   const issues = [];
   const { commentLines: comments, processLines, testLines, productionLines, commentsByFile = {} } = measured;
 
@@ -68,13 +72,15 @@ export function budgetIssues(measured) {
     });
   }
 
-  if (testLines > MIN_TEST_LINES && testLines > MAX_TEST_RATIO * productionLines) {
+  const allowance = REQUIRED_TEST_ALLOWANCE * requiredTests;
+  if (testLines > MIN_TEST_LINES && testLines > MAX_TEST_RATIO * productionLines + allowance) {
     const ratio = productionLines > 0 ? ` (${decimal(testLines / productionLines)}×)` : '';
+    const required = requiredTests > 0 ? `, já descontadas ${allowance} de ${requiredTests} cenário(s) com prova: teste` : '';
     issues.push({
       level: 'warning',
       message:
         `linhas de teste adicionadas passam de ${decimal(MAX_TEST_RATIO)}× as de produção: ` +
-        `${testLines} de teste para ${productionLines} de produção${ratio}`,
+        `${testLines} de teste para ${productionLines} de produção${ratio}${required}`,
       solution:
         'Orçamento por task: um teste por pós-condição + um de regressão por bug, cenários do mesmo ' +
         'comportamento numa tabela, nenhum teste que só fixa texto. Excesso justificado fica escrito na task.',
@@ -103,6 +109,12 @@ export function budgetIssues(measured) {
   return issues;
 }
 
+function requiredTestCount(projectPath, featureName) {
+  if (!featureName) return 0;
+  const checks = readPlanChecks(projectPath, featureName).checks?.checks ?? [];
+  return checks.filter((c) => c.proof === 'teste').length;
+}
+
 export async function validateCodeBudget(projectPath, featureName = null, options = {}) {
   const result = { errors: 0, warnings: 0, issues: [] };
 
@@ -138,7 +150,7 @@ export async function validateCodeBudget(projectPath, featureName = null, option
       return result;
     }
 
-    result.issues = budgetIssues(measured);
+    result.issues = budgetIssues(measured, { requiredTests: requiredTestCount(projectPath, featureName) });
     if (unreadable.length > 0) {
       result.issues.push({
         level: 'warning',

package/src/lib/validators/verify-runner.js

@@ -60,14 +60,32 @@ export function withCpuShare(node, share) {
   return { ...node, command: `${node.command} --maxWorkers=${share}` };
 }
 
+// The complete run still runs each suite whole; it only leaves out a suite the feature diff cannot reach.
+// The same selection `--affected` uses, so what escalates it (migration, contract, shared code) keeps all.
+function outOfDiffSuites(projectPath, options) {
+  if (options.filter || options.recordBaseline || options.refreshCache || options.linux || options.skipTests) return options;
+  const nodes = resolveTestNodes(projectPath).nodes;
+  const selection = selectAffected({ projectPath, nodes, deps: options._affectedDeps });
+  if (selection.scope !== 'affected') return options;
+  // A suite rooted at the project root reaches everything: only a suite with its own `cwd` is a slice.
+  const kept = new Set(nodes.filter((n) => n.e2e || n.evals || n.runner === EVAL_RUNNER || !n.cwd || n.cwd === '.').map((n) => n.id));
+  const outOfDiff = selection.skipped.filter((id) => !kept.has(id));
+  return outOfDiff.length ? { ...options, outOfDiff } : options;
+}
+
 function applyAffectedScope(projectPath, options) {
-  if (!options.affected) return options;
+  if (!options.affected) return outOfDiffSuites(projectPath, options);
   const conflict = [['filter', '--filter'], ['recordBaseline', '--record-baseline'], ['refreshCache', '--refresh-cache'], ['linux', '--linux']]
     .find(([key]) => options[key]);
   if (conflict) throw new VerifyUsageError(`--affected escolhe os testes sozinho; não combina com ${conflict[1]}`);
 
   const selection = selectAffected({ projectPath, nodes: resolveTestNodes(projectPath).nodes, deps: options._affectedDeps });
   if (selection.scope === 'full') return { ...options, escalatedBecause: selection.reason };
+  // Every suite selected and none narrowed is the complete run: stamp it once, so the gate's run reuses it.
+  const all = resolveTestNodes(projectPath).nodes;
+  const whole = selection.skipped.length === 0 && selection.nodes.length === all.length
+    && selection.nodes.every((n, i) => n.command === all[i].command);
+  if (whole) return outOfDiffSuites(projectPath, { ...options, escalatedBecause: 'a seleção afetada já é a suíte inteira' });
   return {
     ...options,
     selection,
@@ -106,8 +124,9 @@ async function runVerifyGated(projectPath, featureName, options, gate) {
   // is the worst ordering, and a refusal after the cache was touched leaves a half-rewritten tree.
   const resolvedPlan = resolveTestNodes(projectPath);
   const excluded = new Set(options.excludeNodes ?? []);
+  const outOfDiff = new Set(options.outOfDiff ?? []);
   const scopedNodes = options.selection ? options.selection.nodes : resolvedPlan.nodes;
-  const testPlan = { ...resolvedPlan, nodes: scopedNodes.filter((node) => !excluded.has(node.id)) };
+  const testPlan = { ...resolvedPlan, nodes: scopedNodes.filter((node) => !excluded.has(node.id) && !outOfDiff.has(node.id)) };
   const filter = parseTestFilter(options.filter);
   if (filter && !testPlan.nodes.some((node) => nodeMatchesFilter(node, filter))) {
     const declared = testPlan.nodes.map((node) => node.id).join(', ') || '(none)';
@@ -153,6 +172,7 @@ async function runVerifyGated(projectPath, featureName, options, gate) {
     feedback.push(`[verify] rodada afetada, suítes: ${kept}; a completa roda uma vez antes da aprovação`);
   }
   if (excluded.size > 0) feedback.push(`[verify] provadas pelo CI da PR no finish: ${[...excluded].join(', ')}`);
+  if (outOfDiff.size > 0) feedback.push(`[verify] suítes fora do diff da feature: ${[...outOfDiff].join(', ')}`);
 
   // Only a complete run feeds or reads the cache: a partial one proves nothing about the nodes it left out.
   const cacheDir = fingerprint && !filter && !skipTests && !skipBuild && !skipE2e && !recordBaseline
@@ -266,6 +286,7 @@ function flakyNames(nodes, retried) {
     ...(nodes.tests.runs || []).filter((run) => run.status === 'pass' && retried.has(run.id)).map((run) => `tests/${run.id}`),
     ...(nodes.e2e.status === 'pass' && retried.has('e2e') ? ['e2e'] : []),
     ...(nodes.e2e.flakySpecs || []).map((spec) => `e2e: ${spec}`),
+    ...(nodes.e2e.quarantinedSpecs || []).map((spec) => `e2e (quarentena): ${spec}`),
   ];
 }
 
@@ -871,6 +892,7 @@ async function runE2eNode({
       count: Number.isInteger(result.count) ? result.count : null,
       warnings: Array.isArray(result.warnings) ? result.warnings : [],
       flakySpecs: result.flakySpecs ?? [],
+      quarantinedSpecs: result.quarantinedSpecs ?? [],
     },
     stackEnv: { COMPOSE_PROJECT_NAME: composeProjectName(featureName), ...env },
   };

package/src/lib/verify/affected.js

@@ -100,7 +100,9 @@ function selectNode(node, { changed, base, cwd, git, read }) {
     const relevant = inside.filter((p) => DOTNET_SOURCE.test(p));
     return relevant.length ? selectDotnet(node, relevant, cwd, git, read) : { skip: true };
   }
-  const relevant = inside.filter((p) => SCRIPT_SOURCE.test(p));
+  // A generic runner (`none`, a script) tests whatever the project says it does: any code in its cwd reaches it.
+  const generic = !node.runner || node.runner === 'none';
+  const relevant = generic ? inside : inside.filter((p) => SCRIPT_SOURCE.test(p));
   if (relevant.length === 0) return { skip: true };
   return node.runner === 'vitest' ? selectVitest(node, base) : { node };
 }