@polymorphism-tech/morph-spec 8.46.0 → 9.0.0

package/src/commands/state/approve.js

@@ -1,75 +1,67 @@
 import { Command } from 'commander';
 import chalk from 'chalk';
 import { execFileSync } from 'child_process';
-import { existsSync, readFileSync } from 'fs';
+import { existsSync } from 'fs';
 import { join } from 'path';
 import { getFeature, setApprovalGate, getApprovalGate, getApprovalHistory, derivePhase } from '../../core/state/state-manager.js';
 import { unmetPrereqs } from '../../core/state/gate-order.js';
-import { evaluatorReportState, VERDICT_TOKEN } from '../../lib/evaluator-report.js';
+import { reviewReports, reviewFileName, REVIEW_ROLES, VERDICT_TOKEN, REVIEWED_SHA_TOKEN } from '../../lib/review-reports.js';
+import { shouldPauseGate } from '../../lib/risk-detector.js';
+import { collectSignals, collectReviewRequirement } from './gate-check.js';
+import { autoApprovalRefusal, printRefusal } from './auto-approval.js';
+import { readTrustFromConfig } from './gate-decision.js';
 import { assertOwnerTree, ownerTreeRefusalLines } from '../../lib/worktree/feature-truth.js';
-import { uiuxAutoApprovalBlock } from '../../lib/specs/screen-checklist.js';
 import { treeMovedSince } from '../../lib/git/evidence-staleness.js';
+import { seedDotnetBuildIgnores } from '../../lib/stack/dotnet-build-ignores.js';
+import { reportDotnetIgnores } from './advance.js';
 
-/**
- * The literal token `review-report.md` carries to declare which tree it
- * reviewed. Kept as one exported constant so the CLI parser, the warning text
- * and the `morph-review` skill can never drift apart (the A5 lesson).
- */
-export const REVIEWED_SHA_TOKEN = '**Reviewed-SHA:**';
+export { REVIEWED_SHA_TOKEN };
 
-const REVIEWED_SHA_RE = /\*\*Reviewed-SHA:\*\*\s*([0-9a-f]{7,40})/i;
+const SIGNED_OFF = { required: [], reports: {}, checks: { status: 'ok', total: 0, missing: [], notProven: [] } };
 
 /**
- * Is the feature's `review-report.md` still describing the current tree?
+ * Do the review reports still describe the current tree? Every report present
+ * is compared; the worst answer wins.
  *
- * @param {string} featureName
- * @returns {{ status: 'ok'|'stale'|'unstamped'|'skip', reviewed?: string, head?: string, ahead?: number }}
- *   `skip` covers every case where the question cannot be answered honestly:
- *   no report, no git repo, an unresolvable SHA. Never a false refusal.
+ * @param {ReturnType<typeof reviewReports>} reports
+ * @returns {{ status: 'ok'|'stale'|'unstamped'|'skip', file?: string, reviewed?: string, head?: string, ahead?: number }}
+ *   `skip`: no verifier report or no git repo. Never a false refusal.
  */
-function reviewStaleness(featureName) {
+function reviewStaleness(reports) {
+  if (reports.verifier.status === 'missing') return { status: 'skip' };
   const cwd = process.cwd();
-  const reportPath = join(cwd, '.morph', 'features', featureName, '4-review', 'review-report.md');
-  if (!existsSync(reportPath)) return { status: 'skip' };
-
   let head;
   try {
     head = execFileSync('git', ['rev-parse', 'HEAD'], { cwd, stdio: 'pipe' }).toString().trim();
-  } catch {
-    return { status: 'skip' }; // not a git repo (or no commits) — nothing to compare
-  }
-
-  let body = '';
-  try {
-    body = readFileSync(reportPath, 'utf8');
   } catch {
     return { status: 'skip' };
   }
 
-  const stamped = body.match(REVIEWED_SHA_RE)?.[1];
-  if (!stamped) return { status: 'unstamped', head };
-
-  let reviewed;
-  try {
-    reviewed = execFileSync('git', ['rev-parse', '--verify', `${stamped}^{commit}`], { cwd, stdio: 'pipe' })
-      .toString().trim();
-  } catch {
-    // A stamp git cannot resolve (rewritten history, a typo) is not evidence
-    // of staleness — say "unstamped" rather than block on a guess.
-    return { status: 'unstamped', head };
+  let unstamped = null;
+  for (const [role, report] of Object.entries(reports)) {
+    if (report.status === 'missing') continue;
+    const file = reviewFileName(role);
+    let reviewed = null;
+    try {
+      if (report.reviewedSha) {
+        reviewed = execFileSync('git', ['rev-parse', '--verify', `${report.reviewedSha}^{commit}`], { cwd, stdio: 'pipe' })
+          .toString().trim();
+      }
+    } catch {
+      reviewed = null;
+    }
+    if (!reviewed) {
+      unstamped ??= { status: 'unstamped', file, head };
+      continue;
+    }
+    if (!treeMovedSince(cwd, reviewed, head)) continue;
+    let ahead = 0;
+    try {
+      ahead = Number(execFileSync('git', ['rev-list', '--count', `${reviewed}..${head}`], { cwd, stdio: 'pipe' }).toString().trim()) || 0;
+    } catch { ahead = 0; }
+    return { status: 'stale', file, reviewed, head, ahead };
   }
-  if (!treeMovedSince(cwd, reviewed, head)) return { status: 'ok', reviewed, head };
-
-  let ahead = 0;
-  try {
-    ahead = execFileSync('git', ['rev-list', '--count', `${reviewed}..${head}`], { cwd, stdio: 'pipe' })
-      .toString().trim();
-    ahead = Number(ahead) || 0;
-  } catch { ahead = 0; }
-
-  // HEAD not descending from the reviewed commit (a rebase, a different branch)
-  // is still "not the tree that was reviewed".
-  return { status: 'stale', reviewed, head, ahead };
+  return unstamped ?? { status: 'ok', head };
 }
 
 /**
@@ -145,7 +137,7 @@ const program = new Command();
 /**
  * Valid approval gate names
  */
-const VALID_GATES = ['proposal', 'uiux', 'plan', 'review'];
+const VALID_GATES = ['plan', 'uiux', 'review'];
 
 /**
  * Approve action function - Mark a gate as approved
@@ -189,12 +181,13 @@ export async function approveCommand(featureName, gateName, options = {}) {
       // with nowhere to go. The way out already exists as `unapprove`; the
       // message just never named it. Naming it is the whole fix (no new flag).
       console.log(chalk.gray(`To approve it again, revoke it first: morph-spec unapprove ${featureName} ${gateName}\n`));
+      if (gateName === 'plan') reportDotnetIgnores(seedDotnetBuildIgnores(process.cwd(), { featureName }));
       return;
     }
 
     // Gate monotonicity: a gate may only be approved once its predecessors are
-    // approved (proposal → plan → review; uiux requires proposal). Prevents the
-    // lead-termometro shape — plan.approved with proposal pending. Policy-stamped
+    // approved (plan → review; uiux requires plan). Prevents the shape of a
+    // review approved with the plan still pending. Policy-stamped
     // gates count as approved, so chore/hotfix satisfy prereqs naturally.
     // Escape via --force for deliberate recovery.
     const unmet = unmetPrereqs(gateName, feature.approvalGates);
@@ -231,24 +224,14 @@ export async function approveCommand(featureName, gateName, options = {}) {
       approvedBy = 'auto';
     }
 
-    // Hotfix backstop: Gate 3 (review) requires a genuine HUMAN signature even
-    // in trust:auto — a work-type policy (forcedPauseGates in
-    // src/core/work-types.js, mirrored by risk-detector's
-    // FORCED_PAUSE_WORK_TYPES), enforced server-side rather than trusting the
-    // calling skill. It gates on the RESOLVED approvedBy, NOT the raw --mode
-    // string: every headless context (claude -p, CI, the Bash tool) runs
-    // without a TTY, so an omitted --mode — or any --mode ≠ 'auto' — still
-    // resolves to "auto" and would otherwise rubber-stamp the gate. A human
-    // approval is --approver <name> or an interactive TTY ($USER); anything
-    // resolving to "auto" is refused here.
-    if (gateName === 'review' && feature.workType === 'hotfix' && approvedBy === 'auto') {
-      console.error(chalk.red('\n❌ Hotfix exige aprovação humana no Gate 3 — trust:auto não se aplica.'));
-      console.error(chalk.gray('   Aprove com --approver <nome>, num terminal interativo, ou pela resposta humana "aprovado" (state-sync) ao review-report via AskUserQuestion.\n'));
+    const refusal = autoApprovalRefusal({ cwd: process.cwd(), featureName, feature, gate: gateName, approvedBy });
+    if (refusal) {
+      printRefusal(chalk, refusal);
       process.exit(1);
     }
 
     // Gate 3 staleness backstop (D1): a review reviews a TREE, and the tree
-    // moves. Observed: review-report.md written at b30ac6e, then T3 landed and
+    // moves. Observed: a review report written at b30ac6e, then T3 landed and
     // inverted the default of a business rule; the report stayed in the repo
     // claiming 976/976 tests (they were 982) and never mentioning T3. Nothing
     // detected that the review artifact had fallen behind the code it reviews.
@@ -257,93 +240,49 @@ export async function approveCommand(featureName, gateName, options = {}) {
     // A stamp that is BEHIND HEAD refuses. A MISSING stamp only warns — reports
     // written before this existed must not brick a legacy feature — but the
     // warning names the exact token to add, so it teaches instead of nagging.
+    const reports = gateName === 'review' ? reviewReports(process.cwd(), featureName) : null;
     if (gateName === 'review') {
-      const stale = reviewStaleness(featureName);
+      const stale = reviewStaleness(reports);
       if (stale.status === 'stale') {
-        console.error(chalk.red('\n❌ O `4-review/review-report.md` está desatualizado em relação ao código.'));
+        console.error(chalk.red(`\n❌ O \`4-review/${stale.file}\` está desatualizado em relação ao código.`));
         console.error(chalk.gray(`   Revisado em: ${stale.reviewed.slice(0, 8)}`));
         console.error(chalk.gray(`   HEAD atual:  ${stale.head.slice(0, 8)}${stale.ahead ? ` (${stale.ahead} commit(s) depois da revisão)` : ''}`));
         console.error(chalk.gray('   Um review revisa uma ÁRVORE, e a árvore andou. Re-rode a `morph-review`'));
-        console.error(chalk.gray('   (incluindo o avaliador independente) e atualize o `**Reviewed-SHA:**`.\n'));
+        console.error(chalk.gray(`   e atualize o \`${REVIEWED_SHA_TOKEN}\` de cada relatório.\n`));
         process.exit(1);
       }
       if (stale.status === 'unstamped') {
-        console.log(chalk.yellow('\n⚠️  O `review-report.md` não carrega `**Reviewed-SHA:**` — impossível saber se ele revisa o código atual.'));
-        console.log(chalk.gray(`   Adicione a linha \`**Reviewed-SHA:** ${stale.head}\` ao relatório para que o Gate 3 possa verificar.`));
-      }
-    }
-
-    // Skipped-pause backstop: a gate whose recorded decision demanded a human
-    // pause (gateDecisions[gate].pause === true) cannot then be stamped by a
-    // non-human signature. The detection already existed — in gate-guard.js —
-    // but that hook is registered for `Write|Edit|AskUserQuestion`, and a Bash
-    // tool call fires no hook at all. Since MORPH.md requires gate approval to
-    // go through THIS command and forbids hand-editing the state, the only path
-    // the hook could ever see was the one the charter bans. The check belongs
-    // where the stamp is applied, not beside it.
-    //
-    // Gated on the RESOLVED `approvedBy`, matching the hotfix backstop above:
-    // an omitted --mode in a headless context also resolves to "auto" and must
-    // not slip through. `--force` does NOT bypass this either — it is the
-    // out-of-order recovery flag, a different concern. The way out is a human
-    // signature, or rewriting the decision that asked for the pause.
-    const decision = feature.gateDecisions?.[gateName];
-    if (decision?.pause === true && approvedBy === 'auto') {
-      console.error(chalk.red(`\n❌ O Gate "${gateName}" registrou pause:true — auto-aprovação não se aplica.`));
-      console.error(chalk.gray(`   Sinal: ${decision.reason || 'risco detectado'}`));
-      console.error(chalk.gray('   A decisão gravada exigia pausa humana. Aprove com --approver <nome>, num'));
-      console.error(chalk.gray('   terminal interativo, ou pela resposta humana via AskUserQuestion (state-sync).'));
-      console.error(chalk.gray('   Se o sinal de risco já não vale, regrave a decisão:'));
-      console.error(chalk.gray(`   morph-spec gate-decision ${featureName} ${gateName} --pause false --reason "<motivo>"\n`));
-      process.exit(1);
-    }
-
-    // The same backstop when no gate-check ran: the pause it WOULD record for
-    // the screen checklist, by the predicate advance.js reads too. `--force`
-    // does not bypass it, for the reason above.
-    if (gateName === 'uiux' && approvedBy === 'auto') {
-      const block = uiuxAutoApprovalBlock(process.cwd(), featureName, feature);
-      if (block) {
-        console.error(chalk.red(`\n❌ O Gate "uiux" não pode ser auto-aprovado — ${block}.`));
-        console.error(chalk.gray('   Complete o checklist (ver a skill morph-uiux) e rode de novo, aprove com'));
-        console.error(chalk.gray('   --approver <nome>, ou, se a pausa já foi decidida, grave a decisão:'));
-        console.error(chalk.gray(`   morph-spec gate-decision ${featureName} uiux --pause false --reason "<motivo>"\n`));
-        process.exit(1);
+        console.log(chalk.yellow(`\n⚠️  O \`${stale.file}\` não carrega \`${REVIEWED_SHA_TOKEN}\` — impossível saber se ele revisa o código atual.`));
+        console.log(chalk.gray(`   Adicione a linha \`${REVIEWED_SHA_TOKEN} ${stale.head}\` ao relatório para que o Gate 3 possa verificar.`));
       }
     }
 
     let selfAssessed = false;
     if (gateName === 'review') {
       if (feature.workType === 'hotfix') {
-        // Hotfix Gate 3 does NOT require the independent evaluator: `morph-hotfix`
-        // (SKILL.md §7) never dispatches `morph-evaluator` — speed over ceremony
-        // is the point of a hotfix — and instead writes `4-review/review-report.md`
-        // (diff + real test evidence) before asking the human to approve. Requiring
-        // evaluator-report.md here made the skill's own documented flow unable to
-        // clear its own Gate 3 (the only escape was --self-assessed, which stamps
-        // a degradation for a report that was never supposed to exist). The human
-        // signature is already enforced above (line ~215) — this only checks the
-        // artifact the skill actually produces.
-        const reviewReport = join(process.cwd(), '.morph', 'features', featureName, '4-review', 'review-report.md');
-        if (!existsSync(reviewReport)) {
-          console.error(chalk.red('\n❌ Gate 3 de hotfix exige `4-review/review-report.md` — não existe.'));
-          console.error(chalk.gray('   É o artefato que a `morph-hotfix` produz (diff do fix + evidência real de'));
-          console.error(chalk.gray('   teste do `morph-spec verify`), não o `evaluator-report.md` do avaliador'));
-          console.error(chalk.gray('   independente — hotfix nunca despacha o avaliador. Escreva o relatório antes'));
+        // Hotfix never dispatches: the orchestrator writes `verifier.md` itself
+        // (diff + real verify evidence); the human signature above decides.
+        if (reports.verifier.status === 'missing') {
+          console.error(chalk.red('\n❌ Gate 3 de hotfix exige `4-review/verifier.md` — não existe.'));
+          console.error(chalk.gray('   No hotfix o orquestrador o escreve (diff do fix + evidência real do'));
+          console.error(chalk.gray('   `morph-spec verify`) sem despachar ninguém. Escreva o relatório antes'));
           console.error(chalk.gray('   de aprovar; a assinatura humana já é exigida pelo backstop acima.\n'));
           process.exit(1);
         }
       } else {
-        const report = evaluatorReportState(process.cwd(), featureName);
-        if (report.status !== 'ok') {
+        const { required } = collectReviewRequirement(process.cwd(), feature);
+        const unusable = required.filter((role) => reports[role].status !== 'ok');
+        if (unusable.length) {
           if (!options.selfAssessed) {
-            if (report.status === 'missing') {
-              console.error(chalk.red('\n❌ Gate 3 exige o avaliador independente — `4-review/evaluator-report.md` não existe.'));
-            } else {
-              console.error(chalk.red(`\n❌ Gate 3: o \`4-review/evaluator-report.md\` não tem \`${VERDICT_TOKEN} SHIP|FIX\`.`));
-              console.error(chalk.gray('   Peça ao avaliador o relatório completo (morph-review §4) ou retome-o por SendMessage.'));
+            console.error(chalk.red(`\n❌ Gate 3 exige ${required.map((r) => `\`4-review/${reviewFileName(r)}\``).join(', ')}.`));
+            for (const role of unusable) {
+              const { status } = reports[role];
+              const what = status === 'missing' ? 'não existe'
+                : status === 'partial' ? 'está PARCIAL — retome o mesmo agente por SendMessage'
+                  : `não tem \`${VERDICT_TOKEN} SHIP|FIX\``;
+              console.error(chalk.gray(`   ${reviewFileName(role)} ${what}.`));
             }
-            console.error(chalk.gray('   O veredito vem do avaliador (persona `evaluator`, contexto fresco), nunca de quem implementou.'));
+            console.error(chalk.gray(`   Os relatórios vêm de ${unusable.map((r) => `\`${REVIEW_ROLES[r].persona}\``).join(', ')} em contexto fresco, nunca de quem implementou.`));
             console.error(chalk.gray('   Se o dispatch for impossível nesta sessão, aprove com --self-assessed —'));
             console.error(chalk.gray('   a degradação fica registrada no feature.json e aparece no `list`/`fleet`.\n'));
             process.exit(1);
@@ -351,9 +290,26 @@ export async function approveCommand(featureName, gateName, options = {}) {
           selfAssessed = true;
         }
 
-        if (report.status === 'ok' && report.superseded.length > 0) {
-          console.log(chalk.yellow(`\n⚠️  O relatório do avaliador tem ${report.superseded.length + 1} vereditos (append-only).`));
-          console.log(chalk.gray(`   Vigente: ${report.verdict}, ${report.blockers.length} bloqueador(es). Superados: ${report.superseded.join(', ')}\n`));
+        // Sem gate-check prévio não há `gateDecisions.review` para o backstop acima morder; em
+        // campo, ships passaram assim com verify vermelho ou ausente. A auto-aprovação recalcula
+        // a decisão pela MESMA régua do gate-check. --self-assessed já dispensou os relatórios.
+        if (approvedBy === 'auto') {
+          const signals = collectSignals(featureName, feature, process.cwd(), 'review');
+          if (selfAssessed) signals.reviewReports = SIGNED_OFF;
+          const { pause, reason } = shouldPauseGate({ trust: readTrustFromConfig() }, signals);
+          if (pause) {
+            console.error(chalk.red(`\n❌ Gate 3 não pode ser auto-aprovado — ${reason}.`));
+            console.error(chalk.gray('   Corrija e rode de novo, ou leve a decisão ao humano (--approver <nome>).\n'));
+            process.exit(1);
+          }
+        }
+
+        for (const role of required) {
+          const r = reports[role];
+          if (r.status === 'ok' && r.superseded.length > 0) {
+            console.log(chalk.yellow(`\n⚠️  ${reviewFileName(role)} tem ${r.superseded.length + 1} vereditos (append-only).`));
+            console.log(chalk.gray(`   Vigente: ${r.verdict}, ${r.blockers.length} bloqueador(es). Superados: ${r.superseded.join(', ')}\n`));
+          }
         }
       }
     }
@@ -367,7 +323,7 @@ export async function approveCommand(featureName, gateName, options = {}) {
 
     // Fleet handoff (mirrors advance.js): approving a gate is exactly when a
     // feature hands over between sessions too — `approve` is the real path
-    // Gate 2 took in the field (`approve <f> plan --mode auto`), not just
+    // the plan gate took in the field (`approve <f> plan --mode auto`), not just
     // `advance`, so a handoff.md left stale after approve was the common
     // case, not the edge case. Same helper, same fail-open contract: a
     // regeneration failure must never fail the approval itself.
@@ -377,11 +333,12 @@ export async function approveCommand(featureName, gateName, options = {}) {
     } catch { /* fail-open */ }
 
     if (selfAssessed) {
-      console.log(chalk.yellow('\n⚠️  Gate 3 aprovado SEM avaliador independente (--self-assessed).'));
+      console.log(chalk.yellow('\n⚠️  Gate 3 aprovado SEM os relatórios de review independentes (--self-assessed).'));
       console.log(chalk.gray('   Registrado em feature.json → approvalGates.review.selfAssessed.'));
     }
 
     console.log(chalk.green(`\n✅ Gate "${gateName}" approved for feature: ${featureName}`));
+    if (gateName === 'plan') reportDotnetIgnores(seedDotnetBuildIgnores(process.cwd(), { featureName }));
     console.log(chalk.gray(`Workflow can now proceed past ${gateName} phase\n`));
 
   } catch (error) {

package/src/commands/state/archive.js

@@ -2,9 +2,7 @@ import chalk from 'chalk';
 import { existsSync, renameSync, mkdirSync, readFileSync, writeFileSync } from 'fs';
 import { join, resolve, sep } from 'path';
 import { execFileSync } from 'child_process';
-import { promoteUseCases, SPECS_USECASES_PATHSPEC } from '../../lib/specs/usecase-promoter.js';
-import { applySpecRevocations } from '../../lib/specs/acervo-lifecycle.js';
-import { ADR_INDEX_PATHSPEC } from '../../lib/specs/adr-index.js';
+import { ADR_INDEX_PATHSPEC, updateAdrIndex } from '../../lib/specs/adr-index.js';
 import { isValidFeatureName } from '../project/worktree.js';
 
 /** Refuse a move whose resolved target escapes `scopeDir`. */
@@ -65,10 +63,7 @@ function readReviewApproved(fjPath) {
  * @param {string} feature
  * @param {{ cwd?: string, force?: boolean, git?: boolean }} [opts]
  * @returns {{ ok: boolean, error?: string, archived?: boolean, alreadyArchived?: boolean,
- *   committed?: boolean, staged?: boolean, archivePath?: string, promotedUseCases?: string[],
- *   refusedUseCases?: Array<{id: string, incoming: string, existing: string, existingFeature: string, message: string}>,
- *   keptSuperseded?: Array<{id: string, file: string, supersededBy: string|null, scope?: string}>,
- *   supersededUseCases?: Array<{id: string, file: string, supersededBy: string, scope?: string}>,
+ *   committed?: boolean, staged?: boolean, archivePath?: string,
  *   revocationProblems?: Array<{id: string|null, reason: string, message: string}>,
  *   adrIndex?: {added: string[], revoked: string[], narrowed: string[]}|null }}
  */
@@ -94,15 +89,8 @@ export function runArchive(feature, opts = {}) {
   const archivePathspec = join('.morph', 'archive', feature);
 
   // Idempotent short-circuit: already archived here. Checked FIRST so a re-run
-  // after a partial finish reports "already done", never "not found".
-  //
-  // Consequence, deliberate: this short-circuits BEFORE the use-case promotion
-  // below, so a promotion that degraded fail-open is NOT retried by re-running
-  // `finish`. That is the price of "closing a feature never fails" — an archived
-  // feature stays archived, and the only signal is an absent `promotedUseCases`
-  // in the output. Recovering means copying the UCs into `.morph/specs/usecases/`
-  // by hand; making this retry would mean re-entering the archive path for an
-  // already-closed feature, which is a worse trade.
+  // after a partial finish reports "already done", never "not found"; an ADR
+  // index update that degraded fail-open is therefore not retried.
   if (existsSync(archivePath)) {
     return { ok: true, alreadyArchived: true, archived: false, archivePath };
   }
@@ -156,63 +144,29 @@ export function runArchive(feature, opts = {}) {
     } catch { /* non-fatal — the move is what matters */ }
   }
 
-  // 3) Promote the feature's use cases into the project's permanent archive
-  //    (.morph/specs/usecases/). Read from the ALREADY-MOVED folder so there is
-  //    a single source path, and land inside the SAME scoped commit below — the
-  //    archive travels with the integration, exactly like the archived state
-  //    (MORPH.md §2.2). Fail-open: any failure degrades to "promoted nothing",
-  //    never to a refused close.
-  let promotedUseCases = [];
-  let refusedUseCases = [];
-  let keptSuperseded = [];
+  // 3) The closing plan's project-wide ADRs enter the index and the ones it
+  //    revokes leave it, in the same scoped commit below. Fail-open: the index
+  //    must never block archiving.
+  let adrIndex = { changed: false, added: [], revoked: [], narrowed: [], problems: [] };
   try {
-    const { promoted, refused, keptSuperseded: kept } = promoteUseCases(cwd, archivePath);
-    promotedUseCases = promoted;
-    refusedUseCases = refused;
-    keptSuperseded = kept;
-    if (promoted.length && useGit && staged) {
-      // This staging exists for the NEW files: promoted use cases are untracked,
-      // and the scoped `commit -- <pathspec>` below only knows paths git already
-      // tracks. The replaced-by-ID deletions are tracked, so that same commit
-      // would carry them even without this line (verified by mutating it away) —
-      // `-A` is belt-and-braces, but dropping the `git add` entirely would
-      // silently promote nothing on a first delivery.
-      try { execFileSync('git', ['add', '-A', '--', SPECS_USECASES_PATHSPEC], { cwd, stdio: 'pipe' }); } catch { /* non-fatal */ }
-    }
-  } catch { /* promotion must never block archiving */ }
-
-  // 3b) Apply what the feature's spec.md declared it revokes: acervo use cases
-  //     turn `superseded`, and the ADR index gains/loses files. After the
-  //     promotion, so a substitute promoted just now is already in place (and
-  //     one it refused is known not to be); same commit, same fail-open contract.
-  let lifecycle = { superseded: [], adrIndex: null, problems: [] };
-  try {
-    lifecycle = applySpecRevocations(cwd, archivePath, { refused: refusedUseCases });
-  } catch { /* revocation must never block archiving */ }
-  const acervoChanged = promotedUseCases.length > 0 || lifecycle.superseded.length > 0;
-  const adrIndexChanged = lifecycle.adrIndex?.changed === true;
-  if (useGit && staged) {
-    if (lifecycle.superseded.length) {
-      try { execFileSync('git', ['add', '-A', '--', SPECS_USECASES_PATHSPEC], { cwd, stdio: 'pipe' }); } catch { /* non-fatal */ }
-    }
-    if (adrIndexChanged) {
-      try { execFileSync('git', ['add', '-A', '--', ADR_INDEX_PATHSPEC], { cwd, stdio: 'pipe' }); } catch { /* non-fatal */ }
-    }
+    adrIndex = updateAdrIndex(cwd, archivePath);
+  } catch { /* fail-open */ }
+  if (useGit && staged && adrIndex.changed) {
+    try { execFileSync('git', ['add', '-A', '--', ADR_INDEX_PATHSPEC], { cwd, stdio: 'pipe' }); } catch { /* non-fatal */ }
   }
 
   // 4) Commit the move — SCOPED to this feature's pathspec, NEVER `commit -a`
   //    (same anti-sweep discipline as `finish`'s worktree teardown). This is what
   //    lets the archived state travel with the branch on `finish` (archive-before-merge).
-  //    The acervo pathspecs join only when something under them changed: git
-  //    refuses a pathspec that matches nothing, and that refusal would leave the
-  //    tree dirty and break the checkout/merge that follows.
+  //    The ADR index joins only when it changed: git refuses a pathspec that
+  //    matches nothing, and that refusal would leave the tree dirty and break
+  //    the checkout/merge that follows.
   let committed = false;
   if (useGit && staged) {
     const pathspecs = [
       featPathspec,
       archivePathspec,
-      ...(acervoChanged ? [SPECS_USECASES_PATHSPEC] : []),
-      ...(adrIndexChanged ? [ADR_INDEX_PATHSPEC] : []),
+      ...(adrIndex.changed ? [ADR_INDEX_PATHSPEC] : []),
     ];
     try {
       execFileSync('git', ['commit', '-m', `morph-spec archive: ${feature}`, '--', ...pathspecs], { cwd, stdio: 'pipe' });
@@ -236,13 +190,10 @@ export function runArchive(feature, opts = {}) {
     } catch { /* index is derivable — non-fatal */ }
   }
 
-  const adr = lifecycle.adrIndex;
   return {
-    ok: true, archived: true, committed, staged, archivePath, promotedUseCases, refusedUseCases,
-    keptSuperseded,
-    supersededUseCases: lifecycle.superseded,
-    revocationProblems: lifecycle.problems,
-    adrIndex: adrIndexChanged ? { added: adr.added, revoked: adr.revoked, narrowed: adr.narrowed } : null,
+    ok: true, archived: true, committed, staged, archivePath,
+    revocationProblems: adrIndex.problems,
+    adrIndex: adrIndex.changed ? { added: adrIndex.added, revoked: adrIndex.revoked, narrowed: adrIndex.narrowed } : null,
   };
 }
 
@@ -281,27 +232,12 @@ export async function archiveCommand(featureName, options = {}) {
 
     console.log(chalk.green(`\n📦 Archived "${featureName}" → .morph/archive/${featureName}/`));
     console.log(chalk.gray(`   status: completed, archivedAt stamped in feature.json.`));
-    if (result.promotedUseCases?.length) {
-      console.log(chalk.gray(`   ${result.promotedUseCases.length} use case(s) promoted → .morph/specs/usecases/ (status: implemented).`));
-    }
-    if (result.refusedUseCases?.length) {
-      console.log(chalk.yellow(`\n⚠️  ${result.refusedUseCases.length} use case(s) NOT promoted — numbering collision:`));
-      for (const r of result.refusedUseCases) {
-        console.log(chalk.yellow(`   ${r.message}`));
-      }
-    }
-    for (const k of result.keptSuperseded ?? []) {
-      console.log(chalk.yellow(`   ${k.id} continua superseded (superseded_by: ${k.supersededBy ?? '?'}) — a cópia promovida não trazia o status, e o acervo o manteve.`));
-    }
-    for (const s of result.supersededUseCases ?? []) {
-      console.log(chalk.gray(`   ${s.id} → status: superseded (superseded_by: ${s.supersededBy}${s.scope ? `; ainda vale em: ${s.scope}` : ''}).`));
-    }
     if (result.adrIndex) {
       const { added, revoked, narrowed } = result.adrIndex;
       console.log(chalk.gray(`   ADR index (.morph/specs/adrs/): +${added.length} −${revoked.length} ~${narrowed.length}.`));
     }
     if (result.revocationProblems?.length) {
-      console.log(chalk.yellow(`\n⚠️  ${result.revocationProblems.length} revogação(ões) do spec.md NÃO aplicada(s):`));
+      console.log(chalk.yellow(`\n⚠️  ${result.revocationProblems.length} revogação(ões) do plan.md NÃO aplicada(s):`));
       for (const p of result.revocationProblems) {
         console.log(chalk.yellow(`   ${p.message}`));
       }

package/src/commands/state/auto-approval.js

@@ -0,0 +1,68 @@
+import { planAutoApprovalBlock } from './gate-check.js';
+import { uiuxAutoApprovalBlock } from '../../lib/specs/screen-checklist.js';
+
+/**
+ * Why an "auto" signature may not stamp `gate`, or null when it may. The ONE
+ * rule `approve` and `advance` both apply: they write the same
+ * `approvalGates` entry, so they must refuse the same inputs.
+ *
+ * @returns {{ title: string, hints: string[] } | null}
+ */
+export function autoApprovalRefusal({ cwd, featureName, feature, gate, approvedBy }) {
+  if (approvedBy !== 'auto' || !gate) return null;
+
+  if (gate === 'review' && feature.workType === 'hotfix') {
+    return {
+      title: 'Hotfix exige aprovação humana no Gate 3 — trust:auto não se aplica.',
+      hints: ['Aprove com --approver <nome>, num terminal interativo, ou pela resposta humana "aprovado" (state-sync) via AskUserQuestion.'],
+    };
+  }
+
+  const decision = feature.gateDecisions?.[gate];
+  if (decision?.pause === true) {
+    return {
+      title: `O Gate "${gate}" registrou pause:true — auto-aprovação não se aplica.`,
+      hints: [
+        `Sinal: ${decision.reason || 'risco detectado'}`,
+        'A decisão gravada exigia pausa humana. Aprove com --approver <nome>, num',
+        'terminal interativo, ou pela resposta humana via AskUserQuestion (state-sync).',
+        'Se o sinal de risco já não vale, regrave a decisão:',
+        `morph-spec gate-decision ${featureName} ${gate} --pause false --reason "<motivo>"`,
+      ],
+    };
+  }
+
+  if (gate === 'plan') {
+    const block = planAutoApprovalBlock(cwd, featureName);
+    if (block) {
+      return {
+        title: `O gate "plan" não pode ser auto-aprovado — ${block}.`,
+        hints: ['Com plan-check verde, rode de novo; ou aprove com --approver <nome>. O --force não dispensa o checks.json.'],
+      };
+    }
+  }
+
+  if (gate === 'uiux') {
+    const block = uiuxAutoApprovalBlock(cwd, featureName, feature);
+    if (block) {
+      return {
+        title: `O Gate "uiux" não pode ser auto-aprovado — ${block}.`,
+        hints: [
+          'Complete o checklist (ver a skill morph-uiux) e rode de novo, aprove com',
+          '--approver <nome>, ou, se a pausa já foi decidida, grave a decisão:',
+          `morph-spec gate-decision ${featureName} uiux --pause false --reason "<motivo>"`,
+          'O --force não dispensa o checklist.',
+        ],
+      };
+    }
+  }
+
+  return null;
+}
+
+export function printRefusal(chalk, refusal) {
+  console.error(chalk.red(`\n❌ ${refusal.title}`));
+  refusal.hints.forEach((line, i) => {
+    console.error(chalk.gray(`   ${line}${i === refusal.hints.length - 1 ? '\n' : ''}`));
+  });
+}