@polymorphism-tech/morph-spec 8.46.0 → 8.47.0

package/framework/templates/infrastructure/github/README.md

@@ -39,7 +39,8 @@ infrastructure/github/
 - Push to container registry (GHCR or Docker Hub)
 
 ### Deploy Coolify (`deploy-coolify.yml.hbs`)
-- SSHes into the VPS and calls the local Coolify API (`localhost:8000/api/v1/deploy?uuid=...`) after Docker push
+- SSHes into the VPS and calls the local Coolify API (`POST localhost:8000/api/v1/deploy?uuid=...`) after Docker push; the step fails unless the response carries a `deployment_uuid`
+- The token is read on the VPS from `~/<token-file>` (secret `COOLIFY_TOKEN_FILE` holds the file name) and never leaves the SSH session
 - Runs health check after deployment
 - Supports staging + production environments
 

package/framework/templates/infrastructure/github/workflows/deploy-coolify.yml.hbs

@@ -25,7 +25,8 @@ jobs:
       - name: Trigger Coolify Deploy (via SSH — the Coolify API is not publicly exposed)
         run: |
           ssh -i ~/.ssh/id_ed25519 ${{{{ secrets.COOLIFY_SSH_USER }}}}@${{{{ secrets.COOLIFY_SSH_HOST }}}} \
-            'T=$(cat ~/.coolify-token); curl -s -X GET -H "Authorization: Bearer $T" "http://localhost:8000/api/v1/deploy?uuid=${{{{ secrets.COOLIFY_APPLICATION_UUID }}}}"'
+            'T=$(cat ~/${{{{ secrets.COOLIFY_TOKEN_FILE }}}}); curl -s --fail-with-body -X POST -H "Authorization: Bearer $T" "http://localhost:8000/api/v1/deploy?uuid=${{{{ secrets.COOLIFY_APPLICATION_UUID }}}}"' \
+            | grep -q deployment_uuid
 
       - name: Health Check
         run: |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@polymorphism-tech/morph-spec",
-  "version": "8.46.0",
+  "version": "8.47.0",
   "description": "MORPH-SPEC: NLH (Natural Language Harness) for spec-driven development with Claude Code",
   "keywords": [
     "claude-code",

package/src/commands/observability/telemetry.js

@@ -12,12 +12,10 @@
 import chalk from 'chalk';
 import { loadTelemetry, aggregateTelemetry } from '../../lib/telemetry/telemetry-reader.js';
 
-// The knowledge-base count reflects EXPLICIT reads only. The core standards
-// load via @-refs in rules (Layer 0/1 auto-load) — those are injected by
-// Claude Code's rules system, not via the Read tool, so no hook ever sees them.
-// A low count here means "few on-demand reads", NOT "standards barely used".
+// A rule injects its standards' digests through Claude Code's rules system,
+// not the Read tool, so no hook sees them: a low count means "few full-text reads".
 const STANDARDS_CAVEAT =
-  'Só reads explícitos (via Read) são observáveis; standards auto-carregados por @-ref nas rules (Layer 0/1) não passam por tool call e ficam invisíveis aqui.';
+  'Só reads explícitos (via Read) são observáveis; o resumo que uma rule injeta ao tocar arquivo casado por `paths:` não passa por tool call: não observável aqui.';
 
 function section(title, rows, fmt) {
   if (!rows.length) return;

package/src/commands/project/init.js

@@ -28,7 +28,7 @@ import {
   setupStitch,
   loadMcpRegistry
 } from '../../lib/installers/mcp-installer.js';
-import { setupInfra, installRulesForStack } from '../../scripts/setup-infra.js';
+import { setupInfra, installRulesForStack, installCommandsForStack } from '../../scripts/setup-infra.js';
 import { installSkills } from '../../utils/skills-installer.js';
 import { installAgents, installDomainAgents } from '../../utils/agents-installer.js';
 import { getProjectTags } from '../../lib/stack-filter.js';
@@ -263,6 +263,7 @@ export async function initCommand(options) {
             const rulesSrc = join(fwSrcDir, 'rules');
             const rulesDest = join(targetPath, '.claude', 'rules');
             installRulesForStack(rulesSrc, rulesDest, stackTags);
+            installCommandsForStack(join(fwSrcDir, 'commands'), join(targetPath, '.claude', 'commands'), stackTags);
 
             // Skills
             await installSkills(targetPath, { projectTags: stackTags });

package/src/commands/project/update.js

@@ -30,7 +30,7 @@ import { installSkills } from '../../utils/skills-installer.js';
 import { installAgents, installDomainAgents } from '../../utils/agents-installer.js';
 import { injectMorphImport } from '../../utils/claude-md-injector.js';
 import { getProjectTags } from '../../lib/stack-filter.js';
-import { updateClaudeMdAgentsBlock, installRulesForStack } from '../../scripts/setup-infra.js';
+import { updateClaudeMdAgentsBlock, installRulesForStack, installCommandsForStack } from '../../scripts/setup-infra.js';
 import { reconcileLegacyTemplatesCopy } from '../../lib/installers/templates-reconcile.js';
 import { createEffects } from '../../lib/installers/effects.js';
 import { applyEditorSettings } from '../../lib/worktree/vscode-settings.js';
@@ -84,6 +84,7 @@ export function frameworkDirsToClean(morphPath, targetPath) {
     join(morphPath, 'framework', 'standards'),
     join(morphPath, 'framework', 'hooks'),
     join(morphPath, 'framework', 'schemas'),
+    // Não é mais instalado: fica na lista para apagar o de instalações antigas.
     join(morphPath, 'framework', 'rubrics'),
     join(morphPath, 'framework', 'evals'),
     join(morphPath, 'config'),
@@ -594,10 +595,8 @@ export async function updateCommand(options = {}) {
       fx.copyFile(agentsSrc, agentsDest);
     }
 
-    // Update the remaining framework payloads (parity with setup-infra 7b/7c/8b/8c/8d) —
-    // MORPH.md, phases.json, schemas/, rubrics/, evals/. Without this, upgrades left
-    // the installed charter/rubrics/eval assets stale forever.
-    updateSpinner.text = 'Updating charter, schemas, rubrics and evals...';
+    // Paridade com setup-infra 7c/8b/8c/8d: sem isto o charter e os evals instalados ficam velhos.
+    updateSpinner.text = 'Updating charter, schemas and evals...';
     const canonicalFrameworkDir = join(__dirname, '..', '..', '..', 'framework');
     for (const file of ['MORPH.md', 'phases.json']) {
       const src = join(canonicalFrameworkDir, file);
@@ -605,7 +604,7 @@ export async function updateCommand(options = {}) {
         fx.copyFile(src, join(morphPath, 'framework', file));
       }
     }
-    for (const dir of ['schemas', 'rubrics', 'evals']) {
+    for (const dir of ['schemas', 'evals']) {
       const src = join(canonicalFrameworkDir, dir);
       if (await pathExists(src)) {
         fx.copyDir(src, join(morphPath, 'framework', dir));
@@ -644,18 +643,6 @@ export async function updateCommand(options = {}) {
     const frameworkDir = join(__dirname, '..', '..', '..', 'framework');
     const claudeDest = join(targetPath, '.claude');
 
-    let commandsCopied = false;
-
-    // Copy commands directory (slash commands): framework/commands/ → .claude/commands/
-    const commandsSrc = join(frameworkDir, 'commands');
-    const commandsDest = join(claudeDest, 'commands');
-    if (await pathExists(commandsSrc)) {
-      fx.copyDir(commandsSrc, commandsDest);
-      commandsCopied = true;
-    } else {
-      logger.warn('  ⚠ framework/commands/ source missing — commands not updated');
-    }
-
     // Compute project tags for stack-aware installation of skills, agents, and rules.
     // MUST come from the pre-clean backup: cleanFrameworkDirs() deleted .morph/config/
     // above and restoreUserConfig() only runs at the end — re-reading the file here
@@ -666,6 +653,17 @@ export async function updateCommand(options = {}) {
       if (configBackup) projectTags = getProjectTags(configBackup);
     } catch { /* ignore — malformed config */ }
 
+    let commandsCopied = false;
+    const commandsSrc = join(frameworkDir, 'commands');
+    if (await pathExists(commandsSrc)) {
+      const commandsDest = join(claudeDest, 'commands');
+      fx.ensureDir(commandsDest);
+      installCommandsForStack(commandsSrc, commandsDest, projectTags, fx);
+      commandsCopied = true;
+    } else {
+      logger.warn('  ⚠ framework/commands/ source missing — commands not updated');
+    }
+
     // Sync morph skills to .claude/skills/ for native Claude Code discovery
     updateSpinner.text = 'Syncing morph skills to .claude/skills/...';
     const skillsResult = await installSkills(targetPath, { projectTags, fx });

package/src/commands/state/approve.js

@@ -6,6 +6,9 @@ import { join } from 'path';
 import { getFeature, setApprovalGate, getApprovalGate, getApprovalHistory, derivePhase } from '../../core/state/state-manager.js';
 import { unmetPrereqs } from '../../core/state/gate-order.js';
 import { evaluatorReportState, VERDICT_TOKEN } from '../../lib/evaluator-report.js';
+import { shouldPauseGate } from '../../lib/risk-detector.js';
+import { collectSignals } from './gate-check.js';
+import { readTrustFromConfig } from './gate-decision.js';
 import { assertOwnerTree, ownerTreeRefusalLines } from '../../lib/worktree/feature-truth.js';
 import { uiuxAutoApprovalBlock } from '../../lib/specs/screen-checklist.js';
 import { treeMovedSince } from '../../lib/git/evidence-staleness.js';
@@ -351,6 +354,20 @@ export async function approveCommand(featureName, gateName, options = {}) {
           selfAssessed = true;
         }
 
+        // Sem gate-check prévio não há `gateDecisions.review` para o backstop acima morder; em
+        // campo, ships passaram assim com verify vermelho ou ausente. A auto-aprovação recalcula
+        // a decisão pela MESMA régua do gate-check. --self-assessed já dispensou o veredito.
+        if (approvedBy === 'auto') {
+          const signals = collectSignals(featureName, feature, process.cwd(), 'review');
+          if (selfAssessed) signals.evaluatorVerdict = { status: 'ok', verdict: 'SHIP', blockers: 0, untyped: 0 };
+          const { pause, reason } = shouldPauseGate({ trust: readTrustFromConfig() }, signals);
+          if (pause) {
+            console.error(chalk.red(`\n❌ Gate 3 não pode ser auto-aprovado — ${reason}.`));
+            console.error(chalk.gray('   Corrija e rode de novo, ou leve a decisão ao humano (--approver <nome>).\n'));
+            process.exit(1);
+          }
+        }
+
         if (report.status === 'ok' && report.superseded.length > 0) {
           console.log(chalk.yellow(`\n⚠️  O relatório do avaliador tem ${report.superseded.length + 1} vereditos (append-only).`));
           console.log(chalk.gray(`   Vigente: ${report.verdict}, ${report.blockers.length} bloqueador(es). Superados: ${report.superseded.join(', ')}\n`));

package/src/commands/state/gate-check.js

@@ -3,7 +3,7 @@ import { existsSync, readFileSync } from 'fs';
 import { getFeature } from '../../core/state/state-manager.js';
 import { getAbsoluteOutputPath } from '../../core/paths/output-schema.js';
 import { shouldPauseGate, getRiskSignals, classifyE2eSkip } from '../../lib/risk-detector.js';
-import { evaluatorReportState, evaluatorMediaSection } from '../../lib/evaluator-report.js';
+import { evaluatorReportState, evaluatorMediaSection, verdictSignal } from '../../lib/evaluator-report.js';
 import { collectScreenChecklist } from '../../lib/specs/screen-checklist.js';
 import { persistGateDecision, VALID_GATES, readTrustFromConfig } from './gate-decision.js';
 import { minimatch } from 'minimatch';
@@ -151,7 +151,7 @@ function collectPromptModel(cwd, defaultBranch) {
  * @param {string} gateName
  * @returns {object}
  */
-function collectSignals(featureName, feature, cwd, gateName) {
+export function collectSignals(featureName, feature, cwd, gateName) {
   const tasks = readTasks(featureName);
   const defaultBranch = detectDefaultBranch(cwd);
   const sha = getHeadSha(cwd);
@@ -179,17 +179,7 @@ function collectSignals(featureName, feature, cwd, gateName) {
   }
 
   if (gateName === 'review') {
-    const report = evaluatorReportState(cwd, featureName);
-    signals.evaluatorVerdict = report.status === 'ok'
-      ? {
-        status: 'ok',
-        verdict: report.verdict,
-        blockers: report.blockers.length,
-        blockerIds: report.blockers.map((b) => b.id),
-        untyped: report.untyped.length,
-        superseded: report.superseded,
-      }
-      : { status: report.status };
+    signals.evaluatorVerdict = verdictSignal(evaluatorReportState(cwd, featureName));
     signals.mediaClaims = {
       section: evaluatorMediaSection(cwd, featureName),
       featureGeneratesMedia: featureGeneratesMedia(tasks),
@@ -269,7 +259,7 @@ export async function gateCheckCommand(featureName, gateName, options = {}) {
       process.exit(1);
     }
 
-    // Owner-tree guard: gate-check reads workType/tasks/scores/git off cwd
+    // Owner-tree guard: gate-check reads workType/tasks/verdict/git off cwd
     // AND writes the resulting decision through persistGateDecision — both
     // halves are wrong from a tree that isn't this feature's own, so refuse
     // rather than compute a decision from stale reads and then fail to save it.

package/src/commands/validation/verify.js

@@ -43,18 +43,13 @@ function selectionLines(runs = []) {
     });
 }
 
-/**
- * Human-readable rendering of a runVerify() result — mirrors the
- * ✓/✗-per-node + feedback-list style of formatScoreBreakdown() in
- * score-aggregator.js, adapted to verify's build/tests/validators nodes.
- */
 function formatVerifyResult(result) {
   const lines = [];
   const scopeLabel = result.scope === 'task' ? `${result.feature}/${result.task}` : result.feature;
 
   lines.push('');
   lines.push(chalk.bold(`Verify — ${scopeLabel}`));
-  lines.push(chalk.gray(`rubric: ${result.rubric}${result.stack ? ` | stack: ${result.stack}` : ''}`));
+  if (result.stack) lines.push(chalk.gray(`stack: ${result.stack}`));
   lines.push('');
   lines.push(result.status === 'pass' ? chalk.green.bold('✓ PASS') : chalk.red.bold('✗ FAIL'));
   lines.push('');
@@ -69,8 +64,6 @@ function formatVerifyResult(result) {
     let detail;
     if (node.status === 'skip') {
       detail = node.reason || '';
-    } else if (name === 'validators' && node.score != null) {
-      detail = `score ${node.score}/10`;
     } else if (node.reason) {
       // A green e2e still carries meaning worth showing: smoke-only vs specs,
       // warm reuse vs rebuild. Without it, "pass" hides how much was proven.
@@ -200,7 +193,6 @@ const CI_EXCLUSIVE_FLAGS = [
 async function runLocalVerify(featureName, taskId, options) {
   try {
     return await runVerify(process.cwd(), featureName, taskId || null, {
-      rubric: options.rubric,
       timeout: options.timeout,
       skipTests: options.skipTests,
       skipBuild: options.skipBuild,
@@ -251,8 +243,8 @@ async function runLocalVerify(featureName, taskId, options) {
  * Exit 2 is "the command cannot mean what you typed", and there are four
  * paths to it — never a verdict, because a verdict about nothing is worse
  * than a refusal:
- *   - unknown feature, or unknown task id (the task's `group` decides the
- *     rubric, so it is a hard usage error here);
+ *   - unknown feature, or unknown task id (the task's `group` and `outputs`
+ *     decide the scope, so it is a hard usage error here);
  *   - `--filter` that matches no declared node (a filtered-to-empty run is
  *     green and proves nothing);
  *   - `--record-baseline` with nowhere to write (no `config.json`), or with a
@@ -345,7 +337,6 @@ export async function verifyCommand(featureName, taskId, options = {}) {
     compact = {
       status: result.status,
       nodes: nodeStatuses(result),
-      score: result.nodes.validators.score ?? null,
       attempts: (prevEntry?.attempts ?? 0) + 1,
       updatedAt: now,
     };

package/src/core/paths/output-schema.js

@@ -74,7 +74,7 @@ export const OUTPUT_SCHEMA = {
   // (morph-plan §5). Runtime evidence: input, model, output, verdict — pointing
   // at the `runner: "evals"` node when the stack declares one. CONDITIONAL by
   // construction: never in phases.json requiredOutputs. Readers: morph-review
-  // dispatch prompt, proof rubric eval-de-modelo, test-coverage Q7.
+  // dispatch prompt.
   evidencias:     { dirname: 'evidencias', filenamePattern: '^T\\d+\\.md$', displayFilename: '{taskId}.md',
                     phaseDir: '3-implement', phase: 'implement', protected: false, multi: true },
 

package/src/dashboard/app/App.jsx

@@ -14,7 +14,6 @@ import SkillsLibrary from './pages/SkillsLibrary.jsx';
 import RulesMap from './pages/RulesMap.jsx';
 import Standards from './pages/Standards.jsx';
 import Guide from './pages/Guide.jsx';
-import Rubrics from './pages/Rubrics.jsx';
 import { useNow } from './hooks/usePref.js';
 import { useProjects, useCurrentProject, projectHref } from './lib/project.js';
 
@@ -77,7 +76,6 @@ export default function App() {
             <Route path="/p/:project/activity" element={<Activity />} />
             <Route path="/guide" element={<Guide />} />
             <Route path="/guide/:doc" element={<Guide />} />
-            <Route path="/rubrics" element={<Rubrics />} />
             <Route path="/agents" element={<AgentMap />} />
             <Route path="/phases" element={<PhasePipeline />} />
             <Route path="/hooks" element={<HookInspector />} />

package/src/dashboard/app/components/CommandPalette.jsx

@@ -9,12 +9,12 @@ import { apiBase, projectHref, featureHref } from '../lib/project.js';
 
 const KIND_LABEL = {
   page: 'Página', project: 'Projeto', feature: 'Feature', task: 'Task', skill: 'Skill', persona: 'Persona',
-  standard: 'Standard', rule: 'Rule', hook: 'Hook', guide: 'Guia', rubric: 'Rubrica',
+  standard: 'Standard', rule: 'Rule', hook: 'Hook', guide: 'Guia',
 };
 
 const PAGES = [
   ['Portfólio', '/'], ['Guia', '/guide'], ['Fases', '/phases'], ['Skills', '/skills'],
-  ['Personas', '/agents'], ['Standards', '/standards'], ['Rules', '/rules'], ['Hooks', '/hooks'], ['Rubricas', '/rubrics'],
+  ['Personas', '/agents'], ['Standards', '/standards'], ['Rules', '/rules'], ['Hooks', '/hooks'],
 ];
 
 /** Everything the framework knows that has a page — built once. */
@@ -35,7 +35,6 @@ function knowledgeIndex() {
       out.push({ kind: 'guide', title: h.text, hint: d.title, to: `/guide/${d.id}#${h.slug}`, hay: `${h.text} ${d.title}` });
     }
   }
-  for (const r of morphData.docs?.rubrics || []) out.push({ kind: 'rubric', title: r.title, to: `/rubrics?sel=${encodeURIComponent(`dim:${r.id}`)}`, hay: r.title });
   return out;
 }
 

package/src/dashboard/app/components/EntityLink.jsx

@@ -16,7 +16,6 @@ export function entityHref(kind, id) {
     case 'hook': return q('hooks');
     case 'phase': return q('phases');
     case 'guide': return `/guide/${encodeURIComponent(id)}`;
-    case 'rubric': return q('rubrics');
     default: return '#';
   }
 }

package/src/dashboard/app/components/Markdown.jsx

@@ -7,7 +7,7 @@ const REMARK = [remarkGfm];
 const REHYPE = [rehypeSlug];
 
 /** Frontmatter keys worth showing, in the order a reader wants them. */
-const META_ORDER = ['name', 'description', 'when-to-invoke', 'user-invokable', 'stacks', 'version', 'cliVersion'];
+const META_ORDER = ['name', 'description', 'when_to_use', 'user-invocable', 'stacks', 'version', 'cliVersion'];
 
 function MetaBlock({ meta }) {
   const keys = Object.keys(meta).sort((a, b) => {

package/src/dashboard/app/components/Sidebar.jsx

@@ -1,6 +1,6 @@
 import { NavLink, useLocation, useNavigate } from 'react-router-dom';
 import {
-  MagnifyingGlass, SquaresFour, Kanban, Pulse, BookOpen, FlowArrow, PuzzlePiece, UsersThree, Books, Ruler, Plug, Scales,
+  MagnifyingGlass, SquaresFour, Kanban, Pulse, BookOpen, FlowArrow, PuzzlePiece, UsersThree, Books, Ruler, Plug,
 } from '@phosphor-icons/react';
 import { projectHref } from '../lib/project.js';
 
@@ -12,7 +12,6 @@ const KNOWLEDGE = [
   { to: '/standards', label: 'Standards', icon: Books },
   { to: '/rules', label: 'Rules', icon: Ruler },
   { to: '/hooks', label: 'Hooks', icon: Plug },
-  { to: '/rubrics', label: 'Rubricas', icon: Scales },
 ];
 
 function Badge({ pulse }) {

package/src/dashboard/app/pages/RulesMap.jsx

@@ -15,7 +15,7 @@ const NODE_W = 260;
 // ─── Standard resolution ──────────────────────────────────────────────────────
 
 /**
- * A rule's @-import → the standard it names in the registry. `id` is what the
+ * A rule's route → the standard it names in the registry. `id` is what the
  * Standards page selects by; with no registry match the path itself is passed,
  * so the link still says which file the rule meant.
  */
@@ -196,7 +196,7 @@ function RuleDetail({ rule, byPath }) {
         )}
       </Section>
 
-      <Section title="Standards importados">
+      <Section title="Standards roteados (resumo)">
         {rule.standardRefs.length > 0 ? (
           <div className="flex flex-wrap gap-1.5">
             {rule.standardRefs.map((ref) => {
@@ -209,7 +209,7 @@ function RuleDetail({ rule, byPath }) {
             })}
           </div>
         ) : (
-          <p className="text-xs">Esta regra não importa nenhum standard.</p>
+          <p className="text-xs">Esta regra não roteia nenhum standard.</p>
         )}
       </Section>
 

package/src/dashboard/app/pages/SkillsLibrary.jsx

@@ -315,10 +315,10 @@ export function SkillDetail({ skill, phases = morphData.phases?.list || [] }) {
       {skill.description && <p className="leading-relaxed text-[var(--color-fg)]">{skill.description}</p>}
 
       <dl className="grid grid-cols-[max-content_1fr] gap-x-4 gap-y-2 rounded-xl bg-white/[0.03] px-4 py-3 shadow-[inset_0_0_0_1px_var(--color-hair)]">
-        {skill.whenToInvoke && (
+        {skill.whenToUse && (
           <>
             <dt className="text-xs leading-6 text-[var(--color-faint)]">Quando usar</dt>
-            <dd className="leading-6">{skill.whenToInvoke}</dd>
+            <dd className="leading-6">{skill.whenToUse}</dd>
           </>
         )}
         <dt className="text-xs leading-6 text-[var(--color-faint)]">Fase</dt>
@@ -389,7 +389,7 @@ export default function SkillsLibrary() {
   const isMatch = useCallback((s) => {
     const q = search.trim().toLowerCase();
     if (q) {
-      const hay = [s.id, s.name, s.description, s.whenToInvoke].filter(Boolean).join(' ').toLowerCase();
+      const hay = [s.id, s.name, s.description, s.whenToUse].filter(Boolean).join(' ').toLowerCase();
       if (!hay.includes(q)) return false;
     }
     if (phaseFilter) {

package/src/dashboard/scanner/activity-scanner.js

@@ -18,7 +18,7 @@ import { isFailedToolCall } from '../../../framework/hooks/shared/telemetry-logg
 export const DEFAULT_KINDS = ['prompt', 'question', 'skill', 'dispatch', 'handback', 'task', 'verify', 'gate', 'failure'];
 export const ALL_KINDS = [...DEFAULT_KINDS, 'write', 'read', 'command', 'tool'];
 
-const GATE_COMMAND = /\bmorph-spec\s+(approve|gate-check|gate-decision|advance|score|finish)\b/;
+const GATE_COMMAND = /\bmorph-spec\s+(approve|gate-check|gate-decision|advance|finish)\b/;
 const MORPH_PERSONA = /^morph-(.+)$/;
 const SHELL_TOOLS = new Set(['Bash', 'PowerShell']);
 const SILENT_EVENTS = new Set(['ToolBatch', 'SessionUsage', 'AgentUsage']);

package/src/dashboard/scanner/docs-scanner.js

@@ -1,9 +1,9 @@
 /**
  * The reading material of the framework — the charter, the runtime
- * instructions, the CLI reference and the rubrics the evaluator scores with —
- * for the dashboard's Guide and Rubrics pages.
+ * instructions, the CLI reference and the Gate 3 evaluator checklist — for the
+ * dashboard's Guide page.
  */
-import { readFileSync, readdirSync, existsSync } from 'fs';
+import { readFileSync } from 'fs';
 import { join } from 'path';
 
 function read(path) {
@@ -23,26 +23,11 @@ export function headingsOf(content) {
   return out;
 }
 
-function titleOf(content, fallback) {
-  const h = headingsOf(content || '').find((x) => x.depth === 1);
-  return h?.text || fallback;
-}
-
-function mdDir(dir) {
-  if (!existsSync(dir)) return [];
-  return readdirSync(dir)
-    .filter((f) => f.endsWith('.md'))
-    .sort()
-    .map((f) => {
-      const content = read(join(dir, f)) || '';
-      return { id: f.replace(/\.md$/, ''), file: f, title: titleOf(content, f.replace(/\.md$/, '')), content };
-    });
-}
-
 const GUIDE = [
   { id: 'morph', path: 'MORPH.md', title: 'Carta do harness (MORPH.md)', summary: 'Como o Claude trabalha: papéis, fases, gates, sub-agents. É a fonte única do comportamento.' },
   { id: 'runtime', path: 'CLAUDE.md', title: 'Instruções de runtime (CLAUDE.md)', summary: 'O que é injetado no CLAUDE.md do projeto: como começar cada sessão, regras críticas, comandos.' },
   { id: 'cli', path: 'docs/CLI.md', title: 'Referência do CLI', summary: 'Todos os comandos morph-spec: gates, verify, worktrees, grafo, telemetria.' },
+  { id: 'review-checklist', path: 'evals/review-checklist.md', title: 'Checklist do avaliador (Gate 3)', summary: 'O que o avaliador independente procura antes do ship: veredito SHIP/FIX e bloqueador com evidência.' },
 ];
 
 export function scanDocs(frameworkDir) {
@@ -51,8 +36,5 @@ export function scanDocs(frameworkDir) {
     return { ...g, content, headings: headingsOf(content).filter((h) => h.depth <= 3) };
   }).filter((g) => g.content);
 
-  return {
-    guide,
-    rubrics: mdDir(join(frameworkDir, 'evals')).filter((d) => d.id === 'review-checklist'),
-  };
+  return { guide };
 }

package/src/dashboard/scanner/features-scanner.js

@@ -310,7 +310,7 @@ export function scanFeatures(projectDir, { resolveTree = resolveFeatureTree } =
 }
 
 /**
- * One feature in full: summary + tasks with their verify/score, the gate
+ * One feature in full: summary + tasks with their verify, the gate
  * decisions, the verify nodes and the document tree.
  */
 export function readFeatureDetail(projectDir, name, { resolveTree = resolveFeatureTree, known } = {}) {

package/src/dashboard/scanner/index.js

@@ -4,7 +4,6 @@ import { scanHooks } from './hooks-scanner.js';
 import { scanSkills } from './skills-scanner.js';
 import { scanStandards } from './standards-scanner.js';
 import { scanRules } from './rules-scanner.js';
-import { scanRubrics } from './rubrics-scanner.js';
 import { scanDocs } from './docs-scanner.js';
 
 /**
@@ -21,7 +20,6 @@ export function scanAll(frameworkDir) {
     skills: scanSkills(frameworkDir, phases.list),
     standards: scanStandards(frameworkDir, agents.list),
     rules: scanRules(frameworkDir),
-    rubrics: scanRubrics(frameworkDir),
     docs: scanDocs(frameworkDir),
   };
 }

package/src/dashboard/scanner/rules-scanner.js

@@ -18,17 +18,22 @@ function parseFrontmatter(content) {
   return { paths, stacks };
 }
 
-/**
- * Standards a rule imports, each once. RulesMap keys an edge per ref, so a
- * rule that imports the same standard twice (infrastructure-standards.md did,
- * up to 8.38.0) drew two edges under one React key.
- */
+const ROUTE_LINE = /^- \*\*([a-z0-9-]+)\*\* \(`([^`]+\.md)`\)/;
+
+// Bullet form: - **<id>** (`<path under standards/>`) — <digest>. An `@path`
+// import inside .claude/rules resolves relative to the rule file and never loads.
+export function parseStandardRoutes(content) {
+  const routes = [];
+  for (const line of content.split(/\r?\n/)) {
+    const m = ROUTE_LINE.exec(line);
+    if (m) routes.push({ id: m[1], path: m[2] });
+  }
+  return routes;
+}
+
+// RulesMap keys one edge per ref, so a repeated path would collide.
 export function extractStandardRefs(content) {
-  const refs = new Set();
-  const regex = /@\.morph\/framework\/standards\/(.+\.md)/g;
-  let m;
-  while ((m = regex.exec(content)) !== null) refs.add(m[1]);
-  return [...refs];
+  return [...new Set(parseStandardRoutes(content).map((r) => r.path))];
 }
 
 export function scanRules(frameworkDir) {

package/src/dashboard/scanner/skills-scanner.js

@@ -84,13 +84,12 @@ export function scanSkills(frameworkDir, phases = []) {
       if (!existsSync(skillPath)) continue;
       const content = readFileSync(skillPath, 'utf8');
       const fm = parseFrontmatter(content);
-      // The framework spells it `user-invokable`; the Claude Code docs say `user-invocable`.
-      const invocable = fm['user-invokable'] ?? fm['user-invocable'];
+      const invocable = fm['user-invocable'];
       skills.push({
         id: skillDir.name,
         name: fm.name || skillDir.name,
         description: fm.description || '',
-        whenToInvoke: fm['when-to-invoke'] || '',
+        whenToUse: fm.when_to_use || '',
         level: levelDir.name,
         userInvocable: invocable === true || invocable === 'true',
         stacks: typeof fm.stacks === 'string' ? fm.stacks.replace(/[[\]]/g, '').split(',').map((s) => s.trim()).filter(Boolean) : [],

package/src/lib/evaluator-report.js

@@ -79,6 +79,19 @@ export function evaluatorReportState(cwd, featureName) {
   return { status: 'ok', path, ...parsed };
 }
 
+/** O sinal `evaluatorVerdict` que `verdictPause` (risk-detector) lê — gate-check e approve leem o mesmo. */
+export function verdictSignal(report) {
+  if (report.status !== 'ok') return { status: report.status };
+  return {
+    status: 'ok',
+    verdict: report.verdict,
+    blockers: report.blockers.length,
+    blockerIds: report.blockers.map((b) => b.id),
+    untyped: report.untyped.length,
+    superseded: report.superseded,
+  };
+}
+
 export function evaluatorMediaSection(cwd, featureName) {
   const text = readReport(cwd, featureName);
   return text !== null && MEDIA_SECTION_RE.test(text);

package/src/lib/risk-detector.js

@@ -244,6 +244,14 @@ export function shouldPauseGate(config, signals) {
     };
   }
 
+  // No ship, ausência de stamp não é "verde": uma feature foi aprovada em campo sem verify nenhum.
+  if (signals.gate === 'review' && !signals.verificationStatus) {
+    return {
+      pause: true,
+      reason: 'nenhum `morph-spec verify` carimbado nesta feature — rode `morph-spec verify {feature}` antes do ship',
+    };
+  }
+
   // No gate de SHIP: um `verification` PRESENTE cujo escopo não é o da feature
   // é um recorte parcial — de UMA task, nunca da app inteira. O stamp é
   // SINGULAR, sobrescrito por qualquer verify de qualquer escopo, e vale

package/src/lib/stack/stack-profile.js

@@ -19,7 +19,7 @@ const NO_VALIDATOR_STACKS = new Set(['nodejs-cli', 'node-cli', 'cli']);
 const PROFILES = {
   dotnet: {
     isDotnet: true, isNextjs: false,
-    defaultValidators: ['architecture', 'packages'],
+    defaultValidators: ['packages'],
     buildCommand: 'dotnet build --no-restore',
   },
   nextjs: {

package/src/lib/validators/reuse/reuse-validator.js

@@ -1,15 +1,14 @@
 /**
  * Reuse Validator — símbolo novo cujo nome já existe no codebase.
  *
- * A terceira camada do ciclo de reuso, no molde do `design-system-validator`:
+ * A terceira camada do ciclo de reuso:
  *
  *   PROSA (morph-plan, personas)  ──►  ARTEFATO (`reuse` em tasks.json)
  *   ──►  COBRANÇA (este arquivo)
  *
  * Prosa sozinha não segura — `morph-brainstorming/SKILL.md:39` já manda olhar
  * o que existe, e o ProspectPRO redefiniu `SimpleBuilding` em cinco arquivos da
- * MESMA pasta assim mesmo. O único ciclo que funciona no framework (design
- * tokens) tem verificação em código; este é o equivalente para código.
+ * MESMA pasta assim mesmo: só a verificação em código segura o ciclo.
  *
  * Regras, na ordem em que reduzem ruído:
  *