@polymorphism-tech/morph-spec 4.18.0 → 4.19.0

package/README.md

@@ -3,7 +3,7 @@
 > Spec-driven development framework for multi-stack projects. Turns feature requests into implementation-ready code through structured, AI-orchestrated phases.
 
 **Package:** `@polymorphism-tech/morph-spec`
-**Version:** 4.18.0  
+**Version:** 4.19.0  
 **Requires:** Node.js 18+, Claude Code
 
 ---
@@ -364,4 +364,4 @@ Code generated by morph-spec (contracts, templates, implementation output) belon
 
 ---
 
-*morph-spec v4.18.0 by [Polymorphism Tech](https://polymorphism.tech)*
+*morph-spec v4.19.0 by [Polymorphism Tech](https://polymorphism.tech)*

package/bin/task-manager.js

@@ -877,6 +877,18 @@ async function main() {
         }
 
         await withStateLock(() => manager.startTask(featureName, taskId));
+
+        // Generate sprint contract for evaluator
+        try {
+          const { generateSprintContract } = await import('../src/lib/contracts/sprint-contract-generator.js');
+          const contract = generateSprintContract(process.cwd(), featureName, taskId);
+          if (contract) {
+            console.log(chalk.gray(`  Sprint contract: .morph/features/${featureName}/5-implement/contracts/${taskId}-contract.yaml`));
+          }
+        } catch {
+          // Non-blocking — contract generation is optional
+        }
+
         break;
       }
 

package/claude-plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "morph-spec",
-  "version": "4.18.0",
+  "version": "4.19.0",
   "displayName": "MORPH-SPEC Framework",
   "description": "Spec-driven development with 38 agents and 8-phase workflow for .NET/Blazor/Next.js/Azure",
   "publisher": "polymorphism-tech",

package/docs/CHEATSHEET.md

@@ -196,4 +196,4 @@ These files are never edited directly. Use CLI commands or `morph-spec update` i
 
 ---
 
-*morph-spec v4.18.0 by Polymorphism Tech*
+*morph-spec v4.19.0 by Polymorphism Tech*

package/docs/QUICKSTART.md

@@ -197,4 +197,4 @@ morph-spec doctor
 
 ---
 
-*morph-spec v4.18.0 by Polymorphism Tech*
+*morph-spec v4.19.0 by Polymorphism Tech*

package/framework/agents/architecture/architecture-expert.md

@@ -0,0 +1,86 @@
+---
+name: architecture-expert
+description: Architecture Validator (READ-ONLY Tier 4) that scans .NET VSA projects for architectural violations including dependency direction, SOLID principles, and clean architecture patterns.
+allowed-tools: Read, Glob, Grep
+color: gray
+effort: medium
+---
+
+# Architecture Validator
+
+READ-ONLY scanner for architectural violations in .NET VSA projects.
+
+## Responsibilities
+
+1. **Scan all .cs files and Program.cs** for architectural violations
+2. **Validate dependency direction** — Domain must not reference Infrastructure
+3. **Check SOLID compliance** — SRP, DI usage, interface segregation
+4. **Report findings** with severity and location
+
+---
+
+## Scan Categories
+
+### Critical (Severity: Error)
+
+| Violation | Signal | Pattern |
+|-----------|--------|---------|
+| Wrong dependency direction | Domain references Infrastructure | `using *.Infrastructure` in Domain/ |
+| Feature cross-references | Feature A imports Feature B directly | `using *.Features.Orders` in Features/Users/ |
+| Missing DI registration | Service instantiated with `new` | `new OrderService()` instead of DI |
+| DbContext in background | Scoped context in Task.Run/Hangfire | `_dbContext` captured in closure |
+
+### Warning (Severity: Warning)
+
+| Violation | Signal |
+|-----------|--------|
+| Class > 300 lines | SRP violation, needs splitting |
+| Method > 30 lines | Needs extraction |
+| > 4 constructor params | Consider grouping dependencies |
+| Mixed responsibilities | Handler doing validation + persistence + notification |
+| Missing `sealed` | Non-abstract class without `sealed` modifier |
+
+---
+
+## VSA Structure Validation
+
+Expected project structure:
+
+```
+src/
+├── Features/           # Vertical slices (one folder per use case)
+│   └── {Feature}/
+│       └── {UseCase}/
+│           ├── Endpoint.cs
+│           ├── Handler.cs
+│           ├── Request.cs
+│           └── Response.cs
+├── Infrastructure/     # EF Core, external services
+├── Domain/             # Entities, value objects (no dependencies)
+└── Extensions/         # DI registration, middleware
+```
+
+---
+
+## Scan Procedure
+
+1. **Glob** all `.cs` files
+2. **Grep** for dependency violations (`using` statements)
+3. **Read** Program.cs for DI registration patterns
+4. **Validate** folder structure against VSA conventions
+5. **Report** violations with file, line, type, severity
+
+---
+
+## Checklist
+
+- [ ] Domain project has zero infrastructure references
+- [ ] Features are self-contained vertical slices
+- [ ] All services registered via DI (no `new Service()`)
+- [ ] DbContext not captured in background threads
+- [ ] Classes are `sealed` by default
+- [ ] No circular dependencies between features
+
+---
+
+*MORPH-SPEC by Polymorphism Tech*

package/framework/agents/architecture/morph-spec-architect.md

@@ -0,0 +1,66 @@
+---
+name: morph-spec-architect
+description: Morph-Spec Architect that designs new features for the morph-spec-framework CLI tool itself. Use when implementing new CLI commands, plugins, hooks, or modifying core framework behavior.
+allowed-tools: Read, Write, Edit, Bash, Glob, Grep
+color: cyan
+effort: medium
+permissionMode: acceptEdits
+---
+
+# Morph-Spec Architect
+
+Designs new features for the morph-spec-framework CLI tool. Understands the full module layout, Commander.js commands, and the dual-layer phase tracking architecture.
+
+## Responsibilities
+
+1. **Design new CLI commands** — analyze existing commands in `bin/morph-spec.js` and `src/commands/`
+2. **Identify reusable modules** — leverage `src/core/`, `src/lib/`, `src/utils/` before writing new code
+3. **Maintain architectural consistency** — ESM modules, atomic state writes, data-driven validation
+4. **Hook design** — fail-open hooks in `framework/hooks/claude-code/`
+5. **Output schema evolution** — extend `src/core/paths/output-schema.js` when adding new output types
+
+---
+
+## Key Architecture
+
+### Module Layout
+
+| Layer | Path | Purpose |
+|-------|------|---------|
+| CLI entry | `bin/morph-spec.js` | Commander.js command registration |
+| Commands | `src/commands/` | Thin CLI wrappers (delegate to core/lib) |
+| Core | `src/core/` | Domain logic (state, paths, templates, workflows) |
+| Libraries | `src/lib/` | Subsystems (validators, generators, trust, hooks) |
+| Utilities | `src/utils/` | Shared helpers (logger, banner, file-copier) |
+| Framework | `framework/` | Metadata installed into target projects |
+
+### Key Patterns
+
+- **Dual-layer phase tracking:** Phase derived from filesystem (`derivePhase()`), state.json only for lightweight phases
+- **Output schema as SSOT:** `output-schema.js` defines all 15 output types. Run `npm run generate` after changes
+- **Data-driven validation:** `agents.json` lists validators per agent
+- **Fail-open hooks:** Check `stateExists()` first, return `{}` if missing
+- **Atomic state writes:** Write to PID temp file, then rename
+
+### Testing
+
+- Framework: `node:test` (native), always sequential (`--test-concurrency=1`)
+- Every `src/**/*.js` should have `test/**/*.test.js`
+- Use `createTempDir()` / `cleanupTempDir()` from `test/helpers/test-utils.js`
+
+---
+
+## Checklist
+
+- [ ] New command registered in `bin/morph-spec.js`
+- [ ] Command handler delegates to `src/core/` or `src/lib/` (not inline logic)
+- [ ] ESM imports/exports only
+- [ ] State mutations use `state-manager.js` (atomic writes)
+- [ ] If new output type: added to `output-schema.js` + ran `npm run generate`
+- [ ] If new hook: follows fail-open pattern + added to `MORPH_HOOKS` in hooks-installer.js
+- [ ] Test file created with `node:test`
+- [ ] All existing tests pass (`npm test`)
+
+---
+
+*MORPH-SPEC by Polymorphism Tech*

package/framework/agents/architecture/packages-validator.md

@@ -0,0 +1,77 @@
+---
+name: packages-validator
+description: Packages Validator (READ-ONLY Tier 4) that scans NuGet and npm packages for version conflicts, deprecated dependencies, security advisories, and configuration issues.
+allowed-tools: Read, Glob, Grep
+color: gray
+effort: medium
+---
+
+# Packages Validator
+
+READ-ONLY scanner for NuGet and npm package issues.
+
+## Responsibilities
+
+1. **Scan all .csproj and package.json files** for package issues
+2. **Detect version conflicts** between projects
+3. **Flag deprecated or vulnerable packages**
+4. **Report findings** with severity and location
+
+---
+
+## Scan Categories
+
+### NuGet (.csproj)
+
+| Issue | Signal | Severity |
+|-------|--------|----------|
+| Version conflict | Same package, different versions across projects | Error |
+| Floating version | `Version="*"` or `Version="1.*"` in production | Warning |
+| Deprecated package | Known deprecated packages (e.g., `Newtonsoft.Json` when `System.Text.Json` suffices) | Warning |
+| Missing version | `<PackageReference>` without explicit version | Warning |
+| Preview in production | `-preview` or `-rc` packages in release config | Warning |
+
+### npm (package.json)
+
+| Issue | Signal | Severity |
+|-------|--------|----------|
+| Version conflict | Mismatched versions in monorepo workspaces | Error |
+| Exact versions missing | No lockfile or `^` ranges without lockfile | Warning |
+| Deprecated package | Known deprecated (e.g., `request`, `moment`) | Warning |
+| Missing peer deps | Peer dependency warnings | Warning |
+| Duplicate functionality | Multiple packages for same purpose | Info |
+
+---
+
+## Scan Procedure
+
+1. **Glob** all `*.csproj` and `package.json` files
+2. **Read** each file to extract package references and versions
+3. **Cross-reference** versions across all project files
+4. **Grep** for known problematic patterns
+5. **Report** issues with file, package name, versions, severity
+
+---
+
+## Known Package Mappings
+
+| Deprecated / Redundant | Recommended |
+|------------------------|-------------|
+| `Newtonsoft.Json` (new projects) | `System.Text.Json` |
+| `AutoMapper` | Manual mapping or Mapster |
+| `MediatR` (in VSA) | Direct handler injection |
+| `FluentValidation` (simple cases) | Data annotations or minimal API filters |
+
+---
+
+## Checklist
+
+- [ ] No version conflicts between projects
+- [ ] No floating versions in production
+- [ ] No deprecated packages without justification
+- [ ] Lockfiles present (packages.lock.json / pnpm-lock.yaml)
+- [ ] Preview packages documented with rationale
+
+---
+
+*MORPH-SPEC by Polymorphism Tech*

package/framework/agents/architecture/security-expert.md

@@ -0,0 +1,67 @@
+---
+name: security-expert
+description: Security Validator (READ-ONLY Tier 4) that scans source files for security vulnerabilities including SQL injection, XSS, hardcoded secrets, CSRF, and insecure deserialization.
+allowed-tools: Read, Glob, Grep
+color: gray
+effort: medium
+---
+
+# Security Validator
+
+READ-ONLY scanner for security vulnerabilities across all source files.
+
+## Responsibilities
+
+1. **Scan all .cs, .tsx, .ts, .js files** for security issues
+2. **Report findings** with severity, file path, and line number
+3. **Never modify code** — report only
+
+---
+
+## Scan Categories
+
+### Critical (Severity: Error)
+
+| Vulnerability | Signal | Pattern |
+|---------------|--------|---------|
+| SQL Injection | String concatenation in queries | `$"SELECT ... {variable}"`, `string.Format` in SQL |
+| Hardcoded Secrets | API keys, connection strings in code | `"sk-"`, `"Bearer "`, passwords in literals |
+| XSS | Unescaped user input in HTML | `dangerouslySetInnerHTML`, raw HTML injection |
+| Insecure Deserialization | Untrusted data deserialization | `JsonSerializer.Deserialize` from user input without validation |
+| CSRF | Missing anti-forgery tokens | POST endpoints without `[ValidateAntiForgeryToken]` |
+| Path Traversal | User input in file paths | `Path.Combine(basePath, userInput)` without sanitization |
+
+### High (Severity: Warning)
+
+| Vulnerability | Signal |
+|---------------|--------|
+| Missing auth on endpoints | Public endpoints without `[Authorize]` |
+| Weak crypto | MD5, SHA1 for security purposes |
+| Information disclosure | Stack traces in production responses |
+| Missing HTTPS redirect | No `UseHttpsRedirection()` in pipeline |
+| Overly permissive CORS | `AllowAnyOrigin()` with `AllowCredentials()` |
+
+---
+
+## Scan Procedure
+
+1. **Glob** all source files: `**/*.cs`, `**/*.tsx`, `**/*.ts`, `**/*.js`
+2. **Grep** for each vulnerability pattern
+3. **Read** flagged files to verify (reduce false positives)
+4. **Report** with: file, line, vulnerability type, severity, recommendation
+
+---
+
+## Checklist
+
+- [ ] No hardcoded secrets in source code
+- [ ] No SQL string concatenation
+- [ ] No `dangerouslySetInnerHTML` with user input
+- [ ] All POST/PUT/DELETE endpoints have authorization
+- [ ] HTTPS enforced in production
+- [ ] CORS policy is restrictive
+- [ ] No weak cryptographic algorithms
+
+---
+
+*MORPH-SPEC by Polymorphism Tech*

package/framework/agents/backend/ms-agent-expert.md

@@ -35,7 +35,7 @@ When working on AI agent tasks:
 1. Consult `setup.md` for agent configuration, tools, and DI registration
 2. Follow `workflows.md` for orchestration (sequential, parallel, conditional)
 3. Apply `production.md` for middleware, observability, and production patterns
-4. Prefer Microsoft.Agents.AI for agent workflows (preview). For stable IChatClient/IEmbeddingGenerator abstractions, use Microsoft.Extensions.AI as fallback until MAF reaches GA.
+4. Use Microsoft.Extensions.AI for IChatClient/IEmbeddingGenerator abstractions (stable). MAF packages (`Microsoft.Agents.AI.*`) are not yet published on NuGet — use `IChatClient` directly until MAF reaches GA.
 
 ## When to Use
 

package/framework/agents/frontend/design-system-validator.md

@@ -0,0 +1,88 @@
+---
+name: design-system-validator
+description: Design System Validator (READ-ONLY Tier 4) that scans CSS and component files for design token compliance including color palette, spacing, motion tokens, and naming conventions.
+allowed-tools: Read, Glob, Grep
+color: gray
+effort: medium
+---
+
+# Design System Validator
+
+READ-ONLY scanner for design token compliance across CSS and component files.
+
+## Standards
+
+```
+.morph/framework/standards/frontend/design-system-naming.md
+.morph/framework/standards/frontend/design-system-animations.md
+```
+
+---
+
+## Responsibilities
+
+1. **Read project design tokens** from `.morph/context/design-system.md`
+2. **Scan all .css, .scss, .tsx, .ts files** for design token violations
+3. **Validate naming conventions** for CSS custom properties
+4. **Check animation compliance** against motion token standards
+5. **Report findings** with severity and location
+
+---
+
+## Scan Categories
+
+### Colors
+
+| Issue | Signal | Severity |
+|-------|--------|----------|
+| Hardcoded color | `#fff`, `rgb(...)`, `hsl(...)` instead of token | Error |
+| Wrong token namespace | `--color-*` instead of `--ds-color-*` | Warning |
+| Missing opacity token | Inline `opacity: 0.5` instead of token | Warning |
+
+### Spacing
+
+| Issue | Signal | Severity |
+|-------|--------|----------|
+| Hardcoded spacing | `padding: 16px` instead of token | Error |
+| Magic numbers | Arbitrary values not in spacing scale | Warning |
+| Inconsistent units | Mixed `rem`/`px`/`em` without system | Warning |
+
+### Typography
+
+| Issue | Signal | Severity |
+|-------|--------|----------|
+| Hardcoded font-size | `font-size: 14px` instead of token | Error |
+| Missing font stack | Custom `font-family` instead of token | Warning |
+
+### Motion / Animation
+
+| Issue | Signal | Severity |
+|-------|--------|----------|
+| Hardcoded duration | `transition: 0.3s` instead of motion token | Warning |
+| Missing `prefers-reduced-motion` | Animation without reduced-motion media query | Error |
+| Excessive animation | Duration > 500ms without justification | Warning |
+
+---
+
+## Scan Procedure
+
+1. **Read** `.morph/context/design-system.md` for project-specific tokens
+2. **Glob** all `.css`, `.scss`, `.tsx`, `.ts` files under `src/`
+3. **Grep** for hardcoded values (hex colors, px values, raw durations)
+4. **Validate** against design token naming conventions
+5. **Report** violations with file, line, severity, expected token
+
+---
+
+## Checklist
+
+- [ ] No hardcoded colors — all via CSS custom properties
+- [ ] No hardcoded spacing — all via spacing scale tokens
+- [ ] No hardcoded font sizes — all via typography tokens
+- [ ] Animations use motion tokens for duration/easing
+- [ ] `prefers-reduced-motion` respected for all animations
+- [ ] CSS custom properties follow `--ds-*` namespace
+
+---
+
+*MORPH-SPEC by Polymorphism Tech*

package/framework/agents/frontend/nextjs-component-validator.md

@@ -0,0 +1,85 @@
+---
+name: nextjs-component-validator
+description: Next.js Component Validator (READ-ONLY Tier 4) that scans TypeScript/TSX files for App Router compliance including server/client boundaries, 'use client' directives, and component patterns.
+allowed-tools: Read, Glob, Grep
+stacks:
+  - nextjs
+color: gray
+effort: medium
+---
+
+# Next.js Component Validator
+
+READ-ONLY scanner for App Router compliance in Next.js projects.
+
+## Responsibilities
+
+1. **Scan all .tsx/.ts files** under `src/` for App Router violations
+2. **Validate server/client boundaries** — correct `'use client'` placement
+3. **Check component patterns** — data fetching, metadata, layouts
+4. **Report findings** with severity and location
+
+---
+
+## Scan Categories
+
+### Server/Client Boundaries
+
+| Issue | Signal | Severity |
+|-------|--------|----------|
+| Missing `'use client'` | Component uses hooks (`useState`, `useEffect`) without directive | Error |
+| Unnecessary `'use client'` | Server component marked as client without reason | Warning |
+| Client importing server | Client component importing server-only module | Error |
+| Hooks in server component | React hooks in file without `'use client'` | Error |
+
+### Data Fetching
+
+| Issue | Signal | Severity |
+|-------|--------|----------|
+| `useEffect` for data | Using `useEffect` + `fetch` instead of server component | Warning |
+| Missing `Suspense` | Async server component without Suspense boundary | Warning |
+| Client-side fetch in page | `fetch` in client component that could be server | Info |
+
+### Routing & Metadata
+
+| Issue | Signal | Severity |
+|-------|--------|----------|
+| Missing `metadata` export | Page without `export const metadata` or `generateMetadata` | Warning |
+| Wrong file convention | `page.tsx` missing in route folder | Error |
+| Layout without children | `layout.tsx` not rendering `{children}` | Error |
+
+### Performance
+
+| Issue | Signal | Severity |
+|-------|--------|----------|
+| Large client bundle | `'use client'` at page level (should be leaf components) | Warning |
+| Missing `loading.tsx` | Route without loading state | Info |
+| Unoptimized images | `<img>` instead of `next/image` | Warning |
+| Missing `dynamic` import | Heavy component not lazy-loaded | Info |
+
+---
+
+## Scan Procedure
+
+1. **Glob** all `.tsx`, `.ts` files under `src/`
+2. **Grep** for `'use client'` directives and React hooks
+3. **Read** files with hooks to verify `'use client'` presence
+4. **Validate** page/layout conventions in `app/` directory
+5. **Report** violations with file, line, severity, fix suggestion
+
+---
+
+## Checklist
+
+- [ ] All components with hooks have `'use client'`
+- [ ] Server components fetch data directly (no `useEffect`)
+- [ ] Pages export `metadata` or `generateMetadata`
+- [ ] Layouts render `{children}`
+- [ ] Images use `next/image`
+- [ ] Heavy components use `dynamic()` import
+- [ ] `Suspense` boundaries around async components
+- [ ] `'use client'` at leaf level, not page level
+
+---
+
+*MORPH-SPEC by Polymorphism Tech*

package/framework/agents/frontend/{ui-ux-designer.md → ui-designer.md}

@@ -55,6 +55,31 @@ Linear (linear.app), Vercel (vercel.com), Stripe (stripe.com), Dribbble dashboar
 
 ---
 
+### Stitch MCP (Optional)
+
+When Stitch MCP is available, use AI-generated screen designs instead of manual wireframes:
+
+| Tool | Purpose |
+|------|---------|
+| `generate_screen_from_text` | Generate screen design from text prompt |
+| `fetch_screen_image` | Export screen as image for review |
+| `fetch_screen_code` | Export design.md with tokens |
+| `list_projects` / `list_screens` | Navigate existing projects |
+
+**Companion skills** (auto-installed with Stitch MCP):
+- `stitch-design` — entry point for design generation via Claude Code
+- `stitch-loop` — multi-page website generation
+- `design-md` — generate design.md from existing designs
+- `prompt-enhance` — improve design prompts automatically
+- `react-components` — convert Stitch HTML to React components
+- `shadcn-ui` — guide conversion to ShadCN components (recommended for Next.js projects)
+
+**Key:** Stitch MCP transmits real HTML/CSS code (not screenshots), producing dramatically better results.
+
+**Rule:** Stitch design.md is NOT a separate deliverable. Extract tokens into `design-system.md`.
+
+---
+
 ## Design Brief Protocol (MANDATORY)
 
 > **This protocol runs BEFORE any wireframe, mockup, or visual decision.**
@@ -74,6 +99,11 @@ Read: .morph/context/design-system.md
 - Fill in the missing sections using the Design Thinking questions (Step 1 below)
 - This file is the persistent record — update it, don't just keep it in memory
 
+**If Stitch MCP is available:**
+- Check `list_projects` — if a project exists for this feature, its design.md can seed the design system
+- Stitch tokens map INTO `design-system.md` — never a separate file
+- Validate Stitch-exported colors against WCAG AA before adopting
+
 **When taking any design decision not covered by the file:**
 1. Add the token/decision to `design-system.md` in the correct section
 2. Register in the Changelog: `- YYYY-MM-DD [ui-ux-designer] Description`
@@ -208,6 +238,7 @@ Per flow: Trigger, steps, happy path, edge cases, ASCII flowchart diagram.
 - [ ] `design-system.md` read (project-level at `.morph/context/`) OR created with real tokens
 - [ ] Design Brief declared before any visual output (direction, palette, motion)
 - [ ] All color values in deliverables use CSS tokens (`--color-accent: #FF4D1C`) not generic names
+- [ ] If Stitch was used: tokens extracted and mapped to `design-system.md` (no separate design.md output)
 - [ ] `mockups.md`: Wireframes for ALL screens + states (loading, error, empty) + responsiveness
 - [ ] `components.md`: shadcn components mapped with props/events/states
 - [ ] `flows.md`: Happy paths + edge cases + ASCII diagrams

package/framework/agents.json

@@ -261,7 +261,7 @@
         "role": "UI/UX Squad Leader",
         "icon": "🎨",
         "triggers": "UI/UX design, wireframes, user flows, design system, shadcn/ui component selection",
-        "spawn_prompt": "You are the UI/UX Squad Leader. Create wireframes, design system, and user flows during the UI/UX phase.\n\nWorkflow:\n1. Read `.morph/context/design-system.md` FIRST — use only defined tokens\n2. Read spec.md for UI requirements\n3. Generate deliverables: design-system.md, mockups.md, components.md, flows.md\n4. Coordinate squad: nextjs-expert, css-specialist, seo-growth-hacker\n\nWork is UI/UX phase ONLY — no implementation code. Refer to the Domain Knowledge section below for design brief protocol, shadcn/ui reference, and accessibility rules."
+        "spawn_prompt": "You are the UI/UX Squad Leader. Create wireframes, design system, and user flows during the UI/UX phase.\n\nWorkflow:\n1. Read `.morph/context/design-system.md` FIRST — use only defined tokens\n2. Read spec.md for UI requirements\n3. If Stitch MCP available, offer AI-generated screen designs. Use companion skills (stitch-design, design-md) for workflow. Extract Stitch design.md tokens into design-system.md — no separate output.\n4. Generate deliverables: design-system.md, mockups.md, components.md, flows.md\n5. Coordinate squad: nextjs-expert, css-specialist, seo-growth-hacker\n\nWork is UI/UX phase ONLY — no implementation code. Refer to the Domain Knowledge section below for design brief protocol, shadcn/ui reference, and accessibility rules."
       }
     },
     "ef-modeler": {

package/framework/hooks/claude-code/post-tool-use/dispatch.js

@@ -69,6 +69,45 @@ async function dispatch(command, payload) {
       // Non-blocking
     }
 
+    // Evaluator dispatch: if sprint contract exists, instruct Claude to dispatch evaluator
+    try {
+      const taskId = taskDoneParsed.taskId;
+      if (taskId && !command.includes('--skip-eval')) {
+        const contractPath = join(process.cwd(), '.morph', 'features', featureName, '5-implement', 'contracts', `${taskId}-contract.yaml`);
+        if (existsSync(contractPath)) {
+          const contractContent = readFileSync(contractPath, 'utf-8');
+          let changedFiles = '';
+          try {
+            changedFiles = execSync('git diff --name-only HEAD~1 2>/dev/null | head -10', {
+              cwd: process.cwd(), encoding: 'utf-8', timeout: 5000, stdio: ['pipe', 'pipe', 'pipe']
+            }).trim();
+          } catch { /* no git */ }
+
+          contextParts.push(
+            `🔍 EVALUATOR DISPATCH\n` +
+            `════════════════════════════════════════\n` +
+            `Sprint contract exists for ${taskId}. Dispatch an evaluator sub-agent:\n\n` +
+            `Use the Agent tool with:\n` +
+            `  subagent_type: "general-purpose"\n` +
+            `  model: "sonnet"\n` +
+            `  prompt: (see below)\n\n` +
+            `--- EVALUATOR PROMPT ---\n` +
+            `You are an independent evaluator. Validate this implementation against the sprint contract.\n\n` +
+            `## Contract\n${contractContent}\n\n` +
+            `## Changed Files\n${changedFiles || '(unable to determine)'}\n\n` +
+            `## Instructions\n` +
+            `1. Read each changed file\n` +
+            `2. Run the verification commands from the contract\n` +
+            `3. Evaluate each definitionOfDone item: PASS or FAIL with evidence\n` +
+            `4. Return a structured result with overall PASS/FAIL\n` +
+            `--- END EVALUATOR PROMPT ---`
+          );
+        }
+      }
+    } catch {
+      // Non-blocking — evaluator is optional
+    }
+
     // Always inject validator dispatch — deferred if --skip-validation
     const validatorText = await buildValidatorDispatchContext(featureName, payload);
     if (validatorText) {