@polymorphism-tech/morph-spec 8.46.0 → 9.0.0

package/src/lib/generators/handoff-generator.js

@@ -7,67 +7,43 @@
  * fresh instance starts focused instead of inheriting a wall of stale context.
  *
  * Deterministic by construction — everything here is derived from feature.json,
- * tasks.json, decisions.md and the worktree env manifest. The document is
+ * the extracted plan checks, the slice reports and the worktree env manifest. The document is
  * therefore REGENERABLE (never hand-edited, never merged): `morph-spec handoff`
  * rebuilds it, and setup/create/advance/approve regenerate it at the moments a
  * new session is most likely to pick the feature up.
  *
- * Every section is fail-open: a missing tasks.json or a corrupt decisions.md
- * degrades that section, never the document.
+ * Every section is fail-open: missing or corrupt plan checks degrade that
+ * section, never the document.
  */
 
 import { existsSync, readFileSync, writeFileSync } from 'fs';
 import { join } from 'path';
 import { ensureCommonExclude } from '../../../framework/hooks/shared/git-exclude.js';
 import { derivePhaseForFeature, getPendingGates } from '../../../framework/hooks/shared/state-reader.js';
-
-const PHASE_DIRS = {
-  proposal: '0-proposal',
-  uiux: '1-design',
-  plan: '2-plan',
-  implement: '3-implement',
-  review: '4-review',
-};
+import { sliceProgress, readySlices } from '../../../framework/hooks/shared/slice-progress.js';
 
 /** Ordered pointer candidates — only existing paths make it into the doc. */
 const POINTER_CANDIDATES = [
-  ['0-proposal/proposal.md', 'proposta: problema, escopo e riscos'],
-  // Behaviour before solution — the same order morph-plan writes them in.
-  ['2-plan/usecases', 'use cases: comportamento e pós-condições testáveis (pasta)'],
-  ['2-plan/spec.md', 'especificação técnica'],
-  ['2-plan/tasks.json', 'DAG de tasks (status vivo)'],
-  ['decisions.md', 'decisões registradas'],
-  ['3-implement/recap.md', 'recap da implementação'],
-  ['4-review/review-report.md', 'relatório do Gate 3'],
+  ['2-plan/plan.md', 'plano: problema, cenários com prova, decisões e fatias'],
+  ['2-plan/checks.json', 'cenários e fatias extraídos pelo plan-check'],
+  ['1-design/design-system.md', 'design system da feature'],
+  ['3-implement/reports', 'relatórios das fatias (**Arquivos:**/**Standards:**): o registro da implementação'],
+  ['4-review/verifier.md', 'verificador do Gate 3: cada cenário provado'],
+  ['4-review/reviewer.md', 'revisor do Gate 3: escopo, arquitetura, regressão'],
+  ['4-review/security.md', 'segurança do Gate 3 (só com caminho sensível)'],
 ];
 
 function readJson(path) {
   return JSON.parse(readFileSync(path, 'utf8').replace(/^/, ''));
 }
 
-function taskSummary(featureDir) {
-  try {
-    const tasksPath = join(featureDir, '2-plan', 'tasks.json');
-    if (!existsSync(tasksPath)) return null;
-    const data = readJson(tasksPath);
-    if (!Array.isArray(data.tasks)) return null;
-    const done = data.tasks.filter((t) => t.status === 'done').length;
-    const doneIds = new Set(data.tasks.filter((t) => t.status === 'done').map((t) => t.id));
-    const ready = data.tasks.filter(
-      (t) => t.status === 'pending' && Array.isArray(t.dependencies) && t.dependencies.every((d) => doneIds.has(d)),
-    );
-    return { done, total: data.tasks.length, ready };
-  } catch {
-    return null;
-  }
-}
-
 function decisionTitles(featureDir, limit = 5) {
   try {
-    const path = join(featureDir, 'decisions.md');
+    const path = join(featureDir, '2-plan', 'checks.json');
     if (!existsSync(path)) return [];
-    const titles = [...readFileSync(path, 'utf8').matchAll(/^##\s+(.+)$/gm)].map((m) => m[1].trim());
-    return titles.slice(-limit);
+    const adrs = readJson(path).adrs;
+    if (!Array.isArray(adrs)) return [];
+    return adrs.map((a) => `${a.id} — ${a.title}`).slice(-limit);
   } catch {
     return [];
   }
@@ -86,34 +62,27 @@ function readWorktreeEnv(cwd) {
   }
 }
 
-function nextAction(feature, phase, tasks, featureName) {
+function nextAction(feature, phase, slices, featureName) {
   const gates = feature.approvals || feature.approvalGates || {};
   const approved = (g) => gates[g]?.approved === true;
 
   switch (phase) {
-    case 'proposal':
-      // An approved Gate 1 with no plan artifact yet means "plan work is open":
-      // the derived phase only flips when 2-plan/spec.md lands (derivePhase is
-      // artifact-first). Pointing back at the proposal here would be wrong.
-      return approved('proposal')
-        ? `Gate 1 aprovado — produza \`2-plan/spec.md\` + \`tasks.json\` (a fase avança com o primeiro artefato; Gate 2 em seguida).`
-        : `Complete \`0-proposal/proposal.md\` e aprove o Gate 1 (\`morph-spec advance ${featureName}\`). Skill: /morph-proposal ${featureName}.`;
+    case 'plan':
+      return `Escreva \`2-plan/plan.md\`, rode \`morph-spec plan-check ${featureName}\` até zero erro e aprove o gate do plano (\`morph-spec advance ${featureName}\`). Skill: /morph-proposal ${featureName}.`;
     case 'uiux':
       return approved('uiux')
-        ? `Gate de uiux aprovado — produza \`2-plan/spec.md\` + \`tasks.json\` (Gate 2 em seguida).`
+        ? `Gate de uiux aprovado — implemente as fatias do plano via /morph-apply ${featureName}.`
         : `Complete \`1-design/design-system.md\` e aprove o gate de uiux (\`morph-spec advance ${featureName}\`).`;
-    case 'plan':
-      return `Produza \`2-plan/spec.md\` + \`tasks.json\` e aprove o Gate 2 (\`morph-spec advance ${featureName}\`).`;
     case 'implement': {
-      const ready = tasks?.ready?.map((t) => `${t.id} "${t.title}"`).join(', ');
+      const ready = readySlices(slices).map((s) => `${s.id} "${s.title}"`).join(', ');
       return ready
-        ? `Execute as tasks ready — ${ready} — via /morph-apply ${featureName} (task fecha com verify verde e critérios provados).`
-        : `Todas as tasks concluídas ou bloqueadas — rode \`morph-spec advance ${featureName}\` para escancarar a review, ou destrave dependências. Skill: /morph-apply ${featureName}.`;
+        ? `Implemente as fatias prontas — ${ready} — via /morph-apply ${featureName} (cada fatia grava 3-implement/reports/{id}.md).`
+        : `Todas as fatias têm relatório final — rode \`morph-spec verify ${featureName}\` e siga para a review. Skill: /morph-apply ${featureName}.`;
     }
     case 'review':
       return approved('review')
         ? `Gate 3 aprovado — feche: \`morph-spec finish ${featureName} --pr\` (abre PR) ou \`--merge\` (merge local na default). Arquiva + integra num passo.`
-        : `Produza \`4-review/review-report.md\` (avaliador independente) e aprove o Gate 3; depois \`morph-spec finish ${featureName} --pr|--merge\`.`;
+        : `Rode /morph-review ${featureName} (verificador ∥ revisor, segurança se exigida) e aprove o Gate 3; depois \`morph-spec finish ${featureName} --pr|--merge\`.`;
     default:
       return `Rode \`morph-spec status ${featureName}\` para orientar o próximo passo.`;
   }
@@ -131,7 +100,7 @@ function nextAction(feature, phase, tasks, featureName) {
  *   copy at birth (create.js) — a handoff built FROM the worktree's own copy
  *   would otherwise always say "no worktree registered", even while sitting
  *   inside one. Pass `undefined` (the default) to fall back to `feature.worktree`.
- * @returns {{ markdown: string, meta: { generatedAt: string, phase: string, tasksDone: number, tasksTotal: number } } | null}
+ * @returns {{ markdown: string, meta: { generatedAt: string, phase: string, slicesDone: number, slicesTotal: number } } | null}
  */
 export function buildHandoff(featureName, cwd = process.cwd(), opts = {}) {
   const featureDir = join(cwd, '.morph', 'features', featureName);
@@ -144,15 +113,15 @@ export function buildHandoff(featureName, cwd = process.cwd(), opts = {}) {
     return null;
   }
 
-  let phase = 'proposal';
+  let phase = 'plan';
   let pendingGates = [];
   try {
-    phase = derivePhaseForFeature(featureName, cwd) || 'proposal';
+    phase = derivePhaseForFeature(featureName, cwd) || 'plan';
     pendingGates = getPendingGates(featureName, cwd) || [];
-  } catch { /* fail-open — proposal defaults keep the doc useful */ }
+  } catch { /* fail-open — plan defaults keep the doc useful */ }
 
   const generatedAt = new Date().toISOString();
-  const tasks = taskSummary(featureDir);
+  const slices = sliceProgress(featureDir);
   const env = readWorktreeEnv(cwd);
   const decisions = decisionTitles(featureDir);
   const worktree = opts.worktree !== undefined ? opts.worktree : (feature.worktree || null);
@@ -187,9 +156,9 @@ export function buildHandoff(featureName, cwd = process.cwd(), opts = {}) {
     '## Estado',
     '',
     `- Gates: ${gateLine}`,
-    tasks
-      ? `- Tasks: ${tasks.done}/${tasks.total} done · ready agora: ${tasks.ready.length ? tasks.ready.map((t) => `**${t.id}** "${t.title}"`).join(', ') : 'nenhuma'}`
-      : '- Tasks: sem tasks.json ainda (fase de planejamento não concluída)',
+    slices
+      ? `- Fatias: ${slices.done}/${slices.total} feitas${slices.partial ? ` · ${slices.partial} parcial(is)` : ''} · prontas agora: ${readySlices(slices).map((s) => `**${s.id}** "${s.title}"`).join(', ') || 'nenhuma'}`
+      : '- Fatias: sem checks.json ainda (rode plan-check)',
     pendingGates.length ? `- Gates pendentes: ${pendingGates.join(', ')}` : null,
     '',
     '## Leia nesta ordem (ponteiros — nada copiado)',
@@ -200,7 +169,7 @@ export function buildHandoff(featureName, cwd = process.cwd(), opts = {}) {
     '',
     '## Próxima ação',
     '',
-    nextAction(feature, phase, tasks, featureName),
+    nextAction(feature, phase, slices, featureName),
     '',
     '## Retomar',
     '',
@@ -214,8 +183,8 @@ export function buildHandoff(featureName, cwd = process.cwd(), opts = {}) {
     meta: {
       generatedAt,
       phase,
-      tasksDone: tasks?.done ?? 0,
-      tasksTotal: tasks?.total ?? 0,
+      slicesDone: slices?.done ?? 0,
+      slicesTotal: slices?.total ?? 0,
     },
   };
 }

package/src/lib/generators/settings-generator.js

@@ -23,25 +23,12 @@ export async function generateSettings(targetPath, detectedConfig, morphConfig =
   const claudeDir = join(targetPath, '.claude');
   const settingsPath = join(claudeDir, 'settings.local.json');
 
-  // Read existing settings
-  const existing = await readSettingsSafe(settingsPath);
-
-  // Build stack-based permissions
-  const stack = morphConfig?.project?.architecture || 'unknown';
-  const permissions = buildPermissions(stack, detectedConfig);
-
-  // Build generated settings
+  const existing = withoutLegacyPermissions(await readSettingsSafe(settingsPath));
   const generated = {};
 
-  if (permissions.length > 0) {
-    generated.permissions = permissions;
-  }
-
-  // Track what we manage
   const managed = {
-    permissions_added: permissions,
     mcps_detected: detectedConfig.mcpServers.map(s => s.name),
-    plugins_detected: detectedConfig.plugins.map(p => p.name),
+    plugins_detected: detectedConfig.plugins.map(p => (typeof p === 'string' ? p : p?.name)),
     generated_at: new Date().toISOString()
   };
 
@@ -58,44 +45,10 @@ export async function generateSettings(targetPath, detectedConfig, morphConfig =
 
   return {
     settingsPath,
-    permissionsAdded: permissions.length,
     managed
   };
 }
 
-/**
- * Build permission rules based on detected stack
- * @param {string} stack - Detected project stack
- * @param {Object} detectedConfig - Detected Claude config
- * @returns {Array<string>} Permission patterns
- */
-export function buildPermissions(stack, detectedConfig = {}) {
-  const permissions = [];
-
-  // Stack-based permissions
-  const stackPermissions = {
-    nodejs: ['Bash(node:*)', 'Bash(npm:*)', 'Bash(npx:*)'],
-    typescript: ['Bash(node:*)', 'Bash(npm:*)', 'Bash(npx:*)', 'Bash(tsc:*)'],
-    nextjs: ['Bash(node:*)', 'Bash(npm:*)', 'Bash(npx:*)'],
-    react: ['Bash(node:*)', 'Bash(npm:*)', 'Bash(npx:*)'],
-    vue: ['Bash(node:*)', 'Bash(npm:*)', 'Bash(npx:*)'],
-    dotnet: ['Bash(dotnet:*)', 'Bash(nuget:*)'],
-    python: ['Bash(python:*)', 'Bash(pip:*)', 'Bash(pytest:*)'],
-    go: ['Bash(go:*)']
-  };
-
-  if (stackPermissions[stack]) {
-    permissions.push(...stackPermissions[stack]);
-  }
-
-  // morph-spec CLI always needs node/npx
-  if (!permissions.includes('Bash(npx:*)')) {
-    permissions.push('Bash(npx:*)');
-  }
-
-  return permissions;
-}
-
 /**
  * Deep merge settings without overwriting user entries
  * @param {Object} existing - Current settings.local.json
@@ -127,46 +80,6 @@ export function mergeSettings(existing, generated) {
   return result;
 }
 
-/**
- * Remove only morph-spec managed entries from settings
- * @param {string} settingsPath - Path to settings.local.json
- * @returns {Promise<Object>} Summary of what was removed
- */
-export async function resetMorphSettings(settingsPath) {
-  if (!existsSync(settingsPath)) {
-    return { removed: false, reason: 'file not found' };
-  }
-
-  const settings = await readSettingsSafe(settingsPath);
-  const managed = settings[MORPH_MANAGED_KEY];
-
-  if (!managed) {
-    return { removed: false, reason: 'no _morph_managed section found' };
-  }
-
-  // Remove managed permissions
-  if (managed.permissions_added && Array.isArray(settings.permissions)) {
-    settings.permissions = settings.permissions.filter(
-      p => !managed.permissions_added.includes(p)
-    );
-    if (settings.permissions.length === 0) {
-      delete settings.permissions;
-    }
-  }
-
-  // Remove the managed marker itself
-  delete settings[MORPH_MANAGED_KEY];
-
-  // Write back
-  await writeFile(settingsPath, JSON.stringify(settings, null, 2) + '\n', 'utf-8');
-
-  return {
-    removed: true,
-    permissionsRemoved: managed.permissions_added || [],
-    previouslyGenerated: managed.generated_at
-  };
-}
-
 /**
  * Save integrations.json with detected config
  * @param {string} targetPath - Project root directory
@@ -198,6 +111,15 @@ export async function saveIntegrations(targetPath, detectedConfig) {
 // Helpers
 // ============================================================================
 
+// Claude Code reads only `permissions: { allow, deny }`; a bare array (older generator) is ignored.
+// Versões antigas gravavam regras curinga (node:*, npm:*, npx:*…) como array, forma que o
+// Claude Code ignora: nunca valeram. Converter para { allow } as ligaria em silêncio.
+function withoutLegacyPermissions(settings) {
+  if (!Array.isArray(settings.permissions)) return settings;
+  const { permissions, ...rest } = settings;
+  return rest;
+}
+
 async function readSettingsSafe(settingsPath) {
   try {
     if (!existsSync(settingsPath)) return {};

package/src/lib/git/evidence-staleness.js

@@ -7,7 +7,7 @@ const CONFIG_PATH = '.morph/config/config.json';
 
 const gitOut = (cwd, args) => execFileSync('git', args, { cwd, stdio: 'pipe', maxBuffer: 64 * 1024 * 1024 }).toString();
 
-function withoutBaseline(text) {
+export function withoutBaseline(text) {
   const config = JSON.parse(text);
   if (Array.isArray(config?.project?.tests)) {
     for (const node of config.project.tests) delete node?.expectedCount;

package/src/lib/git/tree-fingerprint.js

@@ -1,15 +1,15 @@
 /**
- * A hash of what a verify run reads: the commit, the uncommitted changes and
- * the untracked files, plus the project's `config.json` (it names the test
- * commands). Everything else under `.morph/` stays out — verify itself writes
- * feature.json and the logs on every run, and counting that would make two
- * runs over the same code look different.
+ * A hash of what a verify run reads: the committed tree, the uncommitted changes and the
+ * untracked files, plus `config.json` without `expectedCount` (it names the test commands).
+ * The rest of `.morph/` stays out, as in `treeMovedSince`: committing verify's own
+ * bookkeeping must not make the same code look different.
  */
 
 import { execFileSync } from 'child_process';
 import { createHash } from 'crypto';
 import { existsSync, readFileSync, statSync } from 'fs';
 import { join } from 'path';
+import { withoutBaseline } from './evidence-staleness.js';
 
 /** Pathspec for "the project minus its `.morph/` bookkeeping". */
 export const OUTSIDE_MORPH = ['--', '.', ':(exclude).morph'];
@@ -31,7 +31,11 @@ export function treeFingerprint(projectPath) {
     const hash = createHash('sha256');
     let head = null;
     try { head = git(projectPath, ['rev-parse', 'HEAD']).toString().trim(); } catch { /* no commit yet */ }
-    hash.update(`head\0${head ?? 'no-commit'}\0`);
+    // Tree ids are content-addressed: the top-level entries minus .morph change only with code.
+    const tree = head
+      ? git(projectPath, ['ls-tree', '-z', 'HEAD']).toString().split('\0').filter((e) => e && e.split('\t')[1] !== '.morph')
+      : ['no-commit'];
+    hash.update(`tree\0${tree.join('\0')}\0`);
     // Before the first commit there is no HEAD to diff against: every file is
     // untracked, and the listing below covers them.
     if (head) hash.update(git(projectPath, ['diff', 'HEAD', '--binary', ...OUTSIDE_MORPH]));
@@ -50,9 +54,17 @@ export function treeFingerprint(projectPath) {
     }
     const config = join(projectPath, '.morph', 'config', 'config.json');
     hash.update('\0config\0');
-    if (existsSync(config)) hash.update(readFileSync(config));
+    if (existsSync(config)) hash.update(normalizedConfig(readFileSync(config, 'utf8')));
     return hash.digest('hex');
   } catch {
     return null;
   }
 }
+
+function normalizedConfig(text) {
+  try {
+    return JSON.stringify(withoutBaseline(text));
+  } catch {
+    return text;
+  }
+}

package/src/lib/git/tree-state.js

@@ -11,7 +11,7 @@ import { OUTSIDE_MORPH, treeFingerprint, git as gitBuffer } from './tree-fingerp
 import { detectDefaultBranch } from './default-branch.js';
 import { resolveBaseRef } from './branch-classifier.js';
 
-/** What an evaluator writes next to a mutation it has not reverted yet. */
+/** What the verifier writes next to a mutation it has not reverted yet. */
 export const MUTATION_MARKER = 'MUTACAO';
 const MAX_LISTED = 50;
 const MAX_COMMITS = 10;
@@ -50,7 +50,7 @@ function commitBlobs(cwd, commit, paths) {
 
 /**
  * What the tree is before a dispatch whose work must leave it unchanged (the
- * evaluator mutates and reverts): HEAD plus the blob of every file that
+ * verifier mutates and reverts): HEAD plus the blob of every file that
  * differs from it. Kept on disk, so a session that resumes after the agent
  * died compares against the tree before the dispatch, not its own start.
  * @returns {{ at: string, head: string|null, files: Object<string, string|null> }|null}

package/src/lib/heavy/cleanup.js

@@ -6,7 +6,6 @@ import { heavyDir, runExclusive } from '../../../framework/hooks/shared/heavy-sl
 
 const DOTNET_ACTIVE = /\bdotnet(?:\.exe)?["']?\s+(?:build|test|publish|pack|msbuild|restore|run|watch|vstest)\b/i;
 const IDLE_WORKER = /\/nodemode:\d|vbcscompiler|razorserver/i;
-const SHUTDOWN_SCOPES = new Set(['feature', 'e2e-down', 'prune']);
 const SHUTDOWN_TIMEOUT_MS = 30_000;
 const TAIL_CHARS = 400;
 
@@ -33,16 +32,13 @@ export function dotnetBusy(procs) {
   });
 }
 
-export function afterHeavyRun({ projectPath, config, scope, env = process.env, deps = {} }) {
+export function afterHeavyRun({ projectPath, config, env = process.env, deps = {} }) {
   const {
     exec = defaultProcExec, list = listProcesses, dotnet = hasDotnet, exclusive = runExclusive,
   } = deps;
 
   if (!config.enabled) return { status: 'skipped', reason: 'semáforo desligado: sem ele nada prova que outra sessão não está compilando' };
   if (!config.shutdownBuildServer) return { status: 'skipped', reason: 'desligado em heavy.shutdownBuildServer' };
-  if (!SHUTDOWN_SCOPES.has(scope)) {
-    return { status: 'skipped', reason: 'escopo de task: o servidor de compilação segue quente para a próxima task' };
-  }
   if (!dotnet(projectPath)) return { status: 'skipped', reason: 'projeto sem .NET' };
 
   const guarded = exclusive({

package/src/lib/installers/memory-installer.js

@@ -41,8 +41,7 @@ metadata:
 - \`.morph/framework/MORPH.md\` — NLH charter (read once per session)
 - \`.morph/framework/agents.json\` — 8 agents: 7 domain personas + 1 stage persona (\`scout\`, read-only)
 - \`.morph/framework/standards/STANDARDS.json\` — standards index (load on demand)
-- \`.morph/framework/schemas/tasks.schema.json\` — JSON Schema for tasks.json
-- \`.morph/features/{feature}/\` — feature artifacts: 0-proposal / 1-design / 2-plan / 3-implement / 4-review
+- \`.morph/features/{feature}/\` — feature artifacts: 2-plan / 1-design / 3-implement / 4-review
 - \`.morph/context/\` — long-lived architectural context (design-system, decisions)
 - \`.morph/state.json\` — feature state (managed by state-sync hook; Edit fallback allowed)
 
@@ -50,8 +49,8 @@ metadata:
 
 | Command | Skill invoked |
 |---------|---------------|
-| \`/morph-proposal {feature}\` | \`Skill(morph-proposal)\` — brainstorming → Gate 1 → plan → Gate 2 |
-| \`/morph-apply {feature}\` | \`Skill(morph-apply)\` — DAG-adaptive implement loop → review → Gate 3 |
+| \`/morph-proposal {feature}\` | \`Skill(morph-plan)\` — entrevista → plan.md → plan-check → gate do plano |
+| \`/morph-apply {feature}\` | \`Skill(morph-apply)\` — fatias do plano → verify → review → Gate 3 |
 | \`/morph-status [feature]\` | inspect state.json |
 | \`/morph-archive {feature}\` | move completed feature to .morph/archive/ |
 | \`/morph-preflight\` | pre-deploy validation |
@@ -59,13 +58,13 @@ metadata:
 
 ## Core skills
 
-\`morph-proposal\`, \`morph-apply\`, \`morph-brainstorming\`, \`morph-plan\`, \`morph-implement\`, \`morph-review\`, \`morph-stack-scan\`, \`morph-standards\`
+\`morph-plan\`, \`morph-apply\`, \`morph-uiux\`, \`morph-review\`, \`morph-hotfix\`, \`morph-standards\`
 
 **Why:** This project is managed by morph-spec — spec-driven autonomous development with trust-aware gates.
 
 **How to apply:**
 - When user mentions a feature, check \`.morph/features/\` first.
-- When user types \`/morph-proposal\`, invoke \`Skill(morph-proposal)\` directly.
+- When user types \`/morph-proposal\`, invoke \`Skill(morph-plan)\` directly.
 - In \`trust: "auto"\`, gates auto-pass; only AskUserQuestion on risk signals.
 `;
 }
@@ -83,10 +82,9 @@ metadata:
 - \`.morph/context/design-system.md\` — design tokens and components (source of truth)
 - \`.morph/framework/MORPH.md\` — NLH charter, Trust Mode rules, gates, skills table
 - \`.morph/framework/standards/STANDARDS.json\` — index; load specific standard via \`path\` field
-- \`.morph/framework/schemas/tasks.schema.json\` — tasks.json schema reference
 - \`.morph/framework/phases.json\` — phase folder mapping and skill associations
 - \`.morph/framework/agents.json\` — domain persona definitions (dotnet-senior, ef-modeler, etc.)
-- \`.morph/framework/evals/review-checklist.md\` — what the Gate 3 evaluator checks (verdict SHIP/FIX + evidence-typed blockers)
+- \`.morph/framework/evals/review-checklist.md\` — what the Gate 3 verifier, reviewer and security check (verdict SHIP/FIX + evidence-typed blockers)
 `;
 
 /**

package/src/lib/mutation/commands.js

@@ -1,4 +1,5 @@
-import { dotnetBuildCommandFor, resolveTestBuildTargets } from '../tasks/test-runner.js';
+import { resolve } from 'node:path';
+import { discoverDotnetBuildTargets, dotnetBuildCommandFor } from '../tasks/test-runner.js';
 
 const FILTER = /--filter(?:[ =:])(?:"([^"]*)"|'([^']*)'|(\S+))/;
 const quote = (s) => `"${String(s).replace(/"/g, '\\"')}"`;
@@ -32,7 +33,7 @@ const VERBOSITY = /\s(?:-v|--verbosity)[ =:]?\S+/g;
 export function dotnetBuildCommands(node, projectPath) {
   const configuration = CONFIGURATION.exec(node.command ?? '');
   const flag = configuration ? ` -c ${configuration[1] ?? configuration[2]}` : '';
-  return resolveTestBuildTargets(node)
+  return discoverDotnetBuildTargets(node, resolve(projectPath || '.', node.cwd || '.'))
     .map((target) => dotnetBuildCommandFor(target, projectPath))
     .filter(Boolean)
     .map((command) => `${command.replace(VERBOSITY, '')} -v m${flag}`);