@polymorphism-tech/morph-spec 8.47.0 → 9.0.0

package/src/commands/state/create.js

@@ -7,6 +7,8 @@ import { WORK_TYPES, DEFAULT_WORK_TYPE, POLICY_APPROVER_PREFIX, isValidWorkType,
 import { detectWorkType } from '../../lib/work-type-detector.js';
 import { runWorktreeSetup, materializeState, isGitRepo, branchExists, buildBranchName } from '../project/worktree.js';
 import { detectDefaultBranch } from '../../lib/git/default-branch.js';
+import { writePlanSkeleton } from '../../lib/plan/plan-template.js';
+import { seedDotnetBuildIgnores } from '../../lib/stack/dotnet-build-ignores.js';
 
 /**
  * Common flow (no `--worktree`): still isolate the feature on its own branch
@@ -140,7 +142,7 @@ function resolveWorkType(options, now) {
  * worktree on branch `morph/{feature}`.
  *
  * Replaces the implicit birth via the state-sync hook on the first Write —
- * the skills call this at proposal start so the authoritative state exists
+ * the skills call this at plan start so the authoritative state exists
  * with the full canonical shape before any artifact lands. Idempotent: an
  * existing feature is reported and left untouched — no re-stamping, no
  * re-scaffolding, no worktree setup.
@@ -211,6 +213,8 @@ export async function createCommand(featureName, options = {}) {
 
     let worktreeResult = null;
     let branchResult = null;
+    let planSkeleton = null;
+    let gitignoreAdded = [];
 
     if (created) {
       // Scaffold the phase folders this work type starts with.
@@ -275,6 +279,21 @@ export async function createCommand(featureName, options = {}) {
         // Commander's `--no-checkout` sets options.checkout === false.
         branchResult = branchCommonFlow(featureName, { checkout: options.checkout !== false });
       }
+
+      // protect-spec-files freezes an existing file once its approval is stamped,
+      // so a type born pre-approved must create it itself. With a worktree it goes
+      // only there: an extra file in the root copy makes `finish` refuse a dirty root.
+      if (wt.scaffold.includes('2-plan') && !wt.skippedGates.includes('plan')) {
+        const home = worktreeResult?.created && worktreeResult.path ? worktreeResult.path : process.cwd();
+        try {
+          planSkeleton = writePlanSkeleton(featureName, home);
+        } catch (err) {
+          planSkeleton = { written: false, error: err.message };
+        }
+      }
+
+      const home = worktreeResult?.created && worktreeResult.path ? worktreeResult.path : process.cwd();
+      gitignoreAdded = seedDotnetBuildIgnores(home, { featureName, configRoot: process.cwd() });
     }
 
     // `feature` is a snapshot from BEFORE the gate-stamping/worktree steps —
@@ -286,6 +305,8 @@ export async function createCommand(featureName, options = {}) {
       const out = { feature: featureName, created, ...finalFeature };
       if (worktreeResult) out.worktree = worktreeResult;
       if (branchResult) out.branch = branchResult;
+      if (planSkeleton) out.planSkeleton = planSkeleton;
+      if (gitignoreAdded.length) out.gitignoreAdded = gitignoreAdded;
       // The move of the PRIMARY checkout is never silent — under --json it goes
       // to stderr so it survives `... --json > out.json` instead of vanishing.
       if (branchResult?.movedFrom) {
@@ -300,6 +321,12 @@ export async function createCommand(featureName, options = {}) {
       console.log(chalk.gray(`   .morph/features/${featureName}/feature.json (canonical shape)`));
       console.log(chalk.gray(`   status: ${finalFeature.status} | createdAt: ${finalFeature.createdAt}`));
       console.log(chalk.gray(`   scaffolded: ${wt.scaffold.join(', ')}`));
+      if (gitignoreAdded.length) {
+        console.log(chalk.gray(`   .gitignore: ${gitignoreAdded.join(' ')} adicionados (projeto .NET)`));
+      }
+      if (planSkeleton?.written) {
+        console.log(chalk.gray(`   2-plan/plan.md: esqueleto escrito (gramática: morph-spec plan-check --help)`));
+      }
       if (wt.skippedGates.length) {
         console.log(chalk.yellow(`   gates skipped by policy:${finalFeature.workType}: ${wt.skippedGates.join(', ')}`));
       }

package/src/commands/state/delete.js

@@ -219,7 +219,7 @@ export async function deleteCommand(featureName, options = {}) {
         // Untracked (never committed) — nothing for git rm to act on.
       }
       // `git rm` only ever removes TRACKED files — a scaffolded phase folder
-      // with no artifact in it (0-proposal/ with nothing written yet) has no
+      // with no artifact in it (2-plan/ with nothing written yet) has no
       // tracked blob and survives as an empty directory on disk. This bit
       // real after --with-worktree: teardownWorktree's own registration-clear
       // commits the root's feature.json on its way through, so `git rm`

package/src/commands/state/finish.js

@@ -65,7 +65,7 @@ export function buildPrTitle(feature, fj) {
   return prefix + (raw.length <= room ? raw : `${raw.slice(0, room - 1)}…`);
 }
 
-const MEMORY_NOTE = 'o fechamento desta feature já está registrado no repositório (commit de archive, `decisions.md`, use cases promovidos, `git log`) — memória de sessão só para o que NENHUM deles guarda: decisão do usuário, pendência a observar em produção, custo medido.';
+const MEMORY_NOTE = 'o fechamento desta feature já está registrado no repositório (commit de archive, `plan.md` com as decisões, índice de ADRs, `git log`) — memória de sessão só para o que NENHUM deles guarda: decisão do usuário, pendência a observar em produção, custo medido.';
 
 /**
  * `morph-spec finish <feature> --pr|--merge` — the single, symmetric close of a
@@ -449,8 +449,8 @@ export async function finishCommand(feature, options = {}) {
   // ── MERGE precondition, BEFORE the archive ────────────────────────────────
   // `--merge` lands its merge commit in the PRIMARY ROOT, so the root has to be
   // clean. That check used to live inside integrateMerge — i.e. AFTER
-  // runArchive had already moved the feature to .morph/archive/, promoted its
-  // use cases and COMMITTED. A root dirtied by unrelated work therefore got a
+  // runArchive had already moved the feature to .morph/archive/, updated the
+  // ADR index and COMMITTED. A root dirtied by unrelated work therefore got a
   // refusal on a half-finished feature, and the retry then failed for a
   // different reason entirely (the feature was no longer in features/).
   //
@@ -709,7 +709,7 @@ export function finishPreflight({ feature, root, worktreePath, cwd, mode, branch
 
 async function integrateMerge({ emit, root, feature, expectedBranch, defaultBranch, isWorktreeFlow, worktreePath, options, arch, backupStamp }) {
   const mergeMsg = `morph-spec finish: merge ${expectedBranch}`;
-  const ucNote = promotedNote(arch);
+  const adrNote = adrIndexNote(arch);
 
   if (isWorktreeFlow) {
     // The root stays on the default; shed this feature's own root-side scaffold,
@@ -748,7 +748,7 @@ async function integrateMerge({ emit, root, feature, expectedBranch, defaultBran
       dropFromRootIndex(root, feature);
       emit({
         ...mergeOutput({ feature, branch: expectedBranch, defaultBranch, publish, worktreePath, shedBackup, kept: true }),
-        ...ucNote,
+        ...adrNote,
       });
       process.exit(0);
     }
@@ -766,7 +766,7 @@ async function integrateMerge({ emit, root, feature, expectedBranch, defaultBran
       ? null
       : await teardownWorktree(worktreePath, { root, feature, branch: expectedBranch, options, deleteBranch: true, stamp: backupStamp });
     dropFromRootIndex(root, feature);
-    emit({ ...mergeOutput({ feature, branch: expectedBranch, defaultBranch, publish, worktreePath, teardown, shedBackup, deferred }), ...ucNote, e2e });
+    emit({ ...mergeOutput({ feature, branch: expectedBranch, defaultBranch, publish, worktreePath, teardown, shedBackup, deferred }), ...adrNote, e2e });
     process.exit(0);
   }
 
@@ -797,7 +797,7 @@ async function integrateMerge({ emit, root, feature, expectedBranch, defaultBran
   const publish = publicationState({ root, defaultBranch, push: options.push });
   const e2e = reclaimStack(feature, { root, worktreePath: null, options });
   // The root index (gitignored) was already updated by the archive (same cwd).
-  emit({ ...mergeOutput({ feature, branch: expectedBranch, defaultBranch, publish }), ...ucNote, e2e });
+  emit({ ...mergeOutput({ feature, branch: expectedBranch, defaultBranch, publish }), ...adrNote, e2e });
   process.exit(0);
 }
 
@@ -887,7 +887,7 @@ async function integratePr({ emit, root, feature, expectedBranch, defaultBranch,
     base: defaultBranch,
     pr: { number: prNumber, url: prUrl },
     nextStep: `mergeie ${prLabel} — a feature só estará encerrada quando ${defaultBranch} receber o archive pelo merge`,
-    ...promotedNote(arch),
+    ...adrIndexNote(arch),
     ...(shedBackup ? { shedBackup } : {}),
     ...(e2e ? { e2e } : {}),
     ...(teardown
@@ -917,23 +917,11 @@ async function integratePr({ emit, root, feature, expectedBranch, defaultBranch,
 // ── output helpers ────────────────────────────────────────────────────────
 
 /**
- * Report what the archive did to the acervo: use cases promoted into
- * `.morph/specs/usecases/`, any REFUSED for a numbering collision
- * (`ucCollisions` — see `usecase-promoter.js`'s reservation-backed guard), the
- * promoted copies that stayed superseded because the acervo said so
- * (`keptSuperseded`), the ones the feature's spec.md revoked
- * (`supersededUseCases`), the ADR index files it moved (`adrIndex`) and the
- * revocations it could not apply
- * (`revocationProblems`). Every key is absent when there is nothing to report,
- * so a feature that touches no acervo keeps the exact output shape it had
- * before any of them existed.
+ * What the archive did to the ADR index (`adrIndex`) and the revocations it
+ * could not apply (`revocationProblems`); both absent when there is nothing to report.
  */
-function promotedNote(arch) {
+function adrIndexNote(arch) {
   return {
-    ...(arch?.promotedUseCases?.length ? { promotedUseCases: arch.promotedUseCases } : {}),
-    ...(arch?.refusedUseCases?.length ? { ucCollisions: arch.refusedUseCases } : {}),
-    ...(arch?.keptSuperseded?.length ? { keptSuperseded: arch.keptSuperseded } : {}),
-    ...(arch?.supersededUseCases?.length ? { supersededUseCases: arch.supersededUseCases } : {}),
     ...(arch?.adrIndex ? { adrIndex: arch.adrIndex } : {}),
     ...(arch?.revocationProblems?.length ? { revocationProblems: arch.revocationProblems } : {}),
   };

package/src/commands/state/gate-check.js

@@ -1,21 +1,19 @@
 import chalk from 'chalk';
-import { existsSync, readFileSync } from 'fs';
 import { getFeature } from '../../core/state/state-manager.js';
-import { getAbsoluteOutputPath } from '../../core/paths/output-schema.js';
-import { shouldPauseGate, getRiskSignals, classifyE2eSkip } from '../../lib/risk-detector.js';
-import { evaluatorReportState, evaluatorMediaSection, verdictSignal } from '../../lib/evaluator-report.js';
+import { shouldPauseGate, getRiskSignals, classifyE2eSkip, planChecksPause, securityReviewFor } from '../../lib/risk-detector.js';
+import { reviewReports, reviewSignal, requiredReviewRoles, verifierMediaSection } from '../../lib/review-reports.js';
 import { collectScreenChecklist } from '../../lib/specs/screen-checklist.js';
 import { persistGateDecision, VALID_GATES, readTrustFromConfig } from './gate-decision.js';
 import { minimatch } from 'minimatch';
 import { detectDefaultBranch, getHeadSha, getDiffStat, changedPathsAgainst } from '../../lib/git/default-branch.js';
 import { treeMovedSince } from '../../lib/git/evidence-staleness.js';
 import { readMorphConfig } from '../../lib/tasks/test-runner.js';
-import { oversizedTasks } from '../../lib/tasks/tasks-json-parser.js';
+import { readPlanChecks } from '../../lib/plan/checks.js';
 import { assertOwnerTree, ownerTreeRefusalLines } from '../../lib/worktree/feature-truth.js';
 
 /**
  * `--signals` on `gate-check` is NOT a general override like `gate-decision`'s
- * — everything else here is read straight off disk (workType, taskCount, sha,
+ * — everything else here is read straight off disk (workType, sliceCount, sha,
  * diffstat, verification), and letting a caller override those would let a
  * careless/hostile `--signals` silently defeat the policy this command exists
  * to make deterministic (e.g. overriding `workType` away from "hotfix" would
@@ -28,67 +26,39 @@ import { assertOwnerTree, ownerTreeRefusalLines } from '../../lib/worktree/featu
 const OVERRIDABLE_SIGNAL_KEYS = ['standardsViolations', 'designSystemDivergence'];
 
 /**
- * Os paths de standard que fazem uma feature ser "de midia".
- *
- * Escritos aqui, uma vez, e lidos do campo `standards[]` das tasks — que o Gate
- * 2 congelou. Nao ha julgamento envolvido: ou a task pinou o standard, ou nao
- * pinou. Um sinal derivado de opiniao seria sobrescrivivel na pratica ainda que
- * nao estivesse em OVERRIDABLE_SIGNAL_KEYS.
- *
- * A forma dos valores e a de `tasks.json` (`standards/...`), nao a do disco
- * (`framework/standards/...`): e o vocabulario que o plano usa.
+ * Os standards que fazem uma feature ser "de mídia", como os ids de
+ * STANDARDS.json. Fato do plano congelado: ou uma fatia pinou o standard em
+ * `standards:`, ou não pinou.
  */
-export const MEDIA_STANDARD_PATHS = [
-  'standards/ai-agents/modalities-image-gen.md',
-  'standards/ai-agents/media-video.md',
-  'standards/ai-agents/media-pipeline.md',
+export const MEDIA_STANDARD_IDS = [
+  'ai-agents-modalities-image-gen',
+  'ai-agents-media-video',
+  'ai-agents-media-pipeline',
 ];
 
 /**
- * Uma feature "gera midia" quando ALGUMA task pinou um dos tres standards de
- * midia no seu array `standards[]`.
- *
- * Isto e uma FUNCAO EXPORTADA, e nao uma expressao dentro de `collectSignals`,
- * porque um predicado que decide se um guardrail arma tem de ser testavel
- * sozinho — o irmao `productionCode` tem quatro casos, e este nao tinha nenhum.
- * Um predicado que sempre devolve `false` desarma a clausula em silencio, e
- * silencio e o defeito que esta epic catalogou sete vezes.
- *
- * **O prefixo `framework/` e normalizado, e essa e a razao de existir da
- * funcao.** O vocabulario do plano e `standards/...` (o exemplo do
- * `tasks.schema.json`, e a unica forma medida hoje nos `standards[]` desta
- * arvore), mas o disco e `framework/standards/...` — e a mesma prosa das skills
- * cita as duas formas. Um plano que escrevesse a forma do disco desarmaria o
- * guardrail sem erro nenhum: `standards --find`, `validate` e o proprio Gate 3
- * continuariam verdes. Aceitar as duas grafias custa uma linha; recusar uma
- * delas em silencio custa o gate.
- *
- * Fail-open por AUSENCIA (nao por opiniao): lista vazia, `standards` ausente ou
- * de tipo errado ⇒ `false` ⇒ nao pausa. Sem plano legivel nao ha como AFIRMAR
- * que a feature gera midia, e uma regra nova nao trava feature legada.
- *
- * @param {Array<object>} tasks - `tasks.json` → `tasks[]` (qualquer coisa nao-array vira []).
- * @returns {boolean} true se ao menos uma task pinou um standard de midia.
+ * O plano escreve o standard pelo id ou pelo caminho (`ai-agents/media-video.md`,
+ * com ou sem `framework/` ou `standards/` na frente): as duas grafias viram o id.
  */
-export function featureGeneratesMedia(tasks) {
-  if (!Array.isArray(tasks)) return false;
-
-  return tasks.some((t) =>
-    Array.isArray(t?.standards) &&
-    t.standards.some((s) =>
-      typeof s === 'string' &&
-      MEDIA_STANDARD_PATHS.includes(s.replace(/^framework\//, ''))));
+export function standardIdOf(value) {
+  return String(value ?? '').trim().replace(/\\/g, '/')
+    .replace(/^(\.morph\/)?(framework\/)?(standards\/)?/, '')
+    .replace(/\.md$/, '')
+    .replace(/\//g, '-');
 }
 
-/** Read tasks.json's task list for a feature; [] if missing/corrupt. Mirrors verify.js's readTasks(). */
-function readTasks(featureName) {
-  try {
-    const tasksPath = getAbsoluteOutputPath(process.cwd(), featureName, 'tasks');
-    if (!existsSync(tasksPath)) return [];
-    return JSON.parse(readFileSync(tasksPath, 'utf8')).tasks || [];
-  } catch {
-    return [];
-  }
+/**
+ * Uma feature "gera mídia" quando alguma fatia extraída pinou um dos
+ * standards de mídia. Predicado exportado porque decide se um guardrail arma:
+ * um que sempre devolve `false` desarma a pausa de mídia da review e a rota opus em
+ * silêncio.
+ *
+ * @param {{ standards?: string[] }[]|null|undefined} slices
+ */
+export function featureGeneratesMedia(slices) {
+  if (!Array.isArray(slices)) return false;
+  return slices.some((s) => Array.isArray(s?.standards)
+    && s.standards.some((id) => MEDIA_STANDARD_IDS.includes(standardIdOf(id))));
 }
 
 /**
@@ -126,6 +96,37 @@ function collectPromptModel(cwd, defaultBranch) {
   };
 }
 
+/**
+ * Quais relatórios o ship exige: a regra única que gate-check, approve e
+ * `report-check --before-eval` leem. Coleta do git, nunca decide.
+ *
+ * @returns {{ required: string[], security: { required: boolean, reasons: string[] } }}
+ */
+export function collectReviewRequirement(cwd, feature) {
+  let changed = [];
+  try { changed = changedPathsAgainst(detectDefaultBranch(cwd), cwd); } catch { changed = []; }
+  const security = securityReviewFor(changed);
+  return { required: requiredReviewRoles({ workType: feature?.workType, securityRequired: security.required }), security };
+}
+
+/** O sinal `reviewReports` do ship, lido do disco. */
+export function collectReviewSignal(cwd, featureName, feature, planChecks = readPlanChecks(cwd, featureName)) {
+  const { required } = collectReviewRequirement(cwd, feature);
+  const checkIds = Array.isArray(planChecks.checks?.checks) ? planChecks.checks.checks.map((c) => c.id) : null;
+  return reviewSignal(reviewReports(cwd, featureName), { required, checkIds });
+}
+
+/**
+ * Why an automatic signature may not close the plan gate — the same rule that
+ * makes gate-check pause it, read here by approve and advance.
+ *
+ * @returns {string|null}
+ */
+export function planAutoApprovalBlock(cwd, featureName) {
+  const reason = planChecksPause(readPlanChecks(cwd, featureName).status);
+  return reason ? reason.replace('{feature}', featureName) : null;
+}
+
 /**
  * Collect every signal `shouldPauseGate()` (risk-detector.js) is documented
  * to consume, straight off disk — the deterministic call site risk-detector
@@ -139,9 +140,8 @@ function collectPromptModel(cwd, defaultBranch) {
  * alimentam a regra da dispensa de e2e (também só no ship): um nó e2e que
  * PULOU não reprova o rollup, logo `verificationStatus` sai 'pass' e a razão
  * literal é o único fato que distingue dispensa legítima de ausência de prova.
- * `verificationScope` é o quarto sinal da mesma regra: um `verify {f} {task}`
- * carimba `scope: 'task:{id}'` e o e2e dele pula com a razão do GRUPO daquela
- * task, que risk-detector.js recusa como dispensa da feature.
+ * `planChecks` (só no gate do plano) é o estado dos checks extraídos contra o
+ * plano; `sliceCount` e as `standards` das fatias saem da mesma extração.
  * `verification` completo, `e2eSkipClass`, diffstat e sha seguem como contexto
  * de auditoria persistido, sem regra própria.
  *
@@ -152,7 +152,8 @@ function collectPromptModel(cwd, defaultBranch) {
  * @returns {object}
  */
 export function collectSignals(featureName, feature, cwd, gateName) {
-  const tasks = readTasks(featureName);
+  const planChecks = readPlanChecks(cwd, featureName);
+  const slices = planChecks.checks?.slices ?? null;
   const defaultBranch = detectDefaultBranch(cwd);
   const sha = getHeadSha(cwd);
   const verification = feature.verification || null;
@@ -163,14 +164,12 @@ export function collectSignals(featureName, feature, cwd, gateName) {
     // anti-spoof rationale as workType (hotfix's forced pause).
     gate: gateName,
     workType: feature.workType || 'feature',
-    taskCount: tasks.length,
+    sliceCount: slices ? slices.length : null,
     standardsViolations: [],
     designSystemDivergence: false,
   };
 
-  // Fato de disco, fora de OVERRIDABLE_SIGNAL_KEYS: task que não cabe num
-  // dispatch se fatia no plano, não depois de um sub-agent bater no teto.
-  if (gateName === 'plan') signals.oversizedTasks = oversizedTasks({ tasks });
+  if (gateName === 'plan') signals.planChecks = planChecks.status;
 
   // Só onde o checklist decide algo: no fecho do design e no ship. Fato de
   // disco, fora de OVERRIDABLE_SIGNAL_KEYS.
@@ -179,10 +178,10 @@ export function collectSignals(featureName, feature, cwd, gateName) {
   }
 
   if (gateName === 'review') {
-    signals.evaluatorVerdict = verdictSignal(evaluatorReportState(cwd, featureName));
+    signals.reviewReports = collectReviewSignal(cwd, featureName, feature, planChecks);
     signals.mediaClaims = {
-      section: evaluatorMediaSection(cwd, featureName),
-      featureGeneratesMedia: featureGeneratesMedia(tasks),
+      section: verifierMediaSection(cwd, featureName),
+      featureGeneratesMedia: featureGeneratesMedia(slices),
     };
   }
 
@@ -207,15 +206,9 @@ export function collectSignals(featureName, feature, cwd, gateName) {
   signals.e2eStatus = verification?.nodes?.e2e ?? null;
   signals.e2eReason = verification?.e2eReason ?? null;
   signals.e2eSkipClass = signals.e2eStatus === 'skip' ? classifyE2eSkip(signals.e2eReason) : null;
-  // De QUEM é o carimbo. `verify {f} {task}` grava 'task:{id}'; só 'feature'
-  // responde pela app inteira, e é por isso que este sinal existe: a razão
-  // 'task group "docs" does not touch runtime' é dispensa legítima do que
-  // AQUELA task verificou, e sem o escopo ela dispensaria o Gate 3 da feature.
-  // Fato de disco como os outros três — jamais sobrescrevível por --signals.
-  signals.verificationScope = verification?.scope ?? null;
 
   // O nó de eval, separado do rollup pela mesma razão que o e2e: um eval que
-  // PULOU (escopo de task) não avermelha `verification.status`, então o gate
+  // PULOU não avermelha `verification.status`, então o gate
   // leria 'pass' tanto para "o eval rodou e passou" quanto para "o eval nunca
   // rodou". `null` aqui é "este projeto não declara nó de eval" — DISTINTO de
   // 'skip', que é "declara, e esta corrida não o executou".
@@ -242,8 +235,8 @@ export function collectSignals(featureName, feature, cwd, gateName) {
  * Golden rule: this command does NOT change gate policy. It is a faithful
  * caller of risk-detector.js's existing, already-tested rules — nothing here
  * adds a new pause condition. Where the skills' natural-language risk tables
- * (morph-brainstorming/morph-plan/morph-review/morph-apply) diverge from
- * risk-detector.js, risk-detector.js wins (see the R4 report for the full list).
+ * (morph-plan/morph-review/morph-apply) diverge from risk-detector.js,
+ * risk-detector.js wins.
  */
 export async function gateCheckCommand(featureName, gateName, options = {}) {
   try {
@@ -259,7 +252,7 @@ export async function gateCheckCommand(featureName, gateName, options = {}) {
       process.exit(1);
     }
 
-    // Owner-tree guard: gate-check reads workType/tasks/verdict/git off cwd
+    // Owner-tree guard: gate-check reads workType/checks/verdict/git off cwd
     // AND writes the resulting decision through persistGateDecision — both
     // halves are wrong from a tree that isn't this feature's own, so refuse
     // rather than compute a decision from stale reads and then fail to save it.
@@ -289,7 +282,7 @@ export async function gateCheckCommand(featureName, gateName, options = {}) {
       if (rejected.length > 0) {
         console.error(chalk.yellow(
           `\n⚠️  --signals ignored for keys not derived from disk-facts you may safely override: ${rejected.join(', ')}\n` +
-          `   Only ${OVERRIDABLE_SIGNAL_KEYS.join(', ')} may be overridden here — everything else is read from feature.json/tasks.json/git.\n` +
+          `   Only ${OVERRIDABLE_SIGNAL_KEYS.join(', ')} may be overridden here — everything else is read from feature.json/checks.json/git.\n` +
           `   Use \`morph-spec gate-decision\` directly for a fully manual decision.\n`
         ));
       }
@@ -303,9 +296,14 @@ export async function gateCheckCommand(featureName, gateName, options = {}) {
     const signals = { ...collectSignals(featureName, feature, cwd, gateName), ...overrides };
 
     const trust = options.trust || readTrustFromConfig();
-    const { pause, reason } = shouldPauseGate({ trust }, signals);
+    const computed = shouldPauseGate({ trust }, signals);
+    const manual = feature.gateDecisions?.[gateName];
+    const manualPause = manual?.source === 'manual' && manual.pause === true;
+    const { pause, reason } = manualPause ? { pause: true, reason: manual.reason } : computed;
 
-    const entry = await persistGateDecision(featureName, gateName, { pause, reason, signals, trust, cwd });
+    const entry = await persistGateDecision(featureName, gateName, {
+      pause, reason, signals, trust, cwd, source: manualPause ? 'manual' : 'gate-check',
+    });
 
     if (options.json) {
       console.log(JSON.stringify({ feature: featureName, gate: gateName, ...entry }, null, 2));
@@ -317,6 +315,9 @@ export async function gateCheckCommand(featureName, gateName, options = {}) {
       ? chalk.yellow(`\n⏸️  Gate "${gateName}" — PAUSE (${featureName})`)
       : chalk.green(`\n▶️  Gate "${gateName}" — auto-pass (${featureName})`));
     console.log(chalk.gray(`   reason: ${entry.reason} | trust: ${entry.trust} | decidedAt: ${entry.decidedAt}`));
+    if (manualPause) {
+      console.log(chalk.gray(`   pausa manual mantida (sinais calculados: ${computed.reason}); só \`morph-spec gate-decision ${featureName} ${gateName} --pause false\` a libera`));
+    }
     if (allSignals.length > 0) {
       console.log(chalk.gray(`   risk signals present: ${allSignals.join('; ')}`));
     }

package/src/commands/state/gate-decision.js

@@ -5,7 +5,7 @@ import { getFeature, updateFeature } from '../../core/state/state-manager.js';
 import { assertOwnerTree, ownerTreeRefusalLines } from '../../lib/worktree/feature-truth.js';
 import { mockupsHash } from '../../lib/specs/screen-checklist.js';
 
-export const VALID_GATES = ['proposal', 'uiux', 'plan', 'review'];
+export const VALID_GATES = ['plan', 'uiux', 'review'];
 
 function parsePauseValue(raw) {
   const v = String(raw).toLowerCase();
@@ -43,13 +43,13 @@ export function readTrustFromConfig() {
  *
  * @param {string} featureName
  * @param {string} gateName
- * @param {{ pause: boolean, reason?: string, signals?: object, trust?: string, cwd?: string }} decision
+ * @param {{ pause: boolean, reason?: string, signals?: object, trust?: string, cwd?: string, source: 'manual'|'gate-check' }} decision
  * @returns {Promise<{ pause: boolean, reason: string, signals: object, trust: string, decidedAt: string, mockupsHash?: string|null }>}
  *   the exact entry written (decidedAt is server-side, generated here). A uiux
  *   decision also carries the hash of the mockup it saw: it answers that
  *   mockup's pause, not the next one's.
  */
-export async function persistGateDecision(featureName, gateName, { pause, reason, signals = {}, trust, cwd = process.cwd() } = {}) {
+export async function persistGateDecision(featureName, gateName, { pause, reason, signals = {}, trust, cwd = process.cwd(), source } = {}) {
   const entry = {
     pause,
     reason: reason || (pause ? 'risco detectado' : 'nenhum sinal de risco'),
@@ -57,6 +57,7 @@ export async function persistGateDecision(featureName, gateName, { pause, reason
     trust: trust || readTrustFromConfig(),
     decidedAt: new Date().toISOString(),
     ...(gateName === 'uiux' ? { mockupsHash: mockupsHash(cwd, featureName) } : {}),
+    source,
   };
 
   await updateFeature(featureName, `gateDecisions.${gateName}`, entry);
@@ -118,7 +119,7 @@ export async function gateDecisionCommand(featureName, gateName, options = {}) {
         process.exit(1);
       }
       if (!signals || typeof signals !== 'object' || Array.isArray(signals)) {
-        console.error(chalk.red('\n❌ Invalid --signals: expected a JSON object, e.g. \'{"taskCount":12}\'\n'));
+        console.error(chalk.red('\n❌ Invalid --signals: expected a JSON object, e.g. \'{"standardsViolations":[]}\'\n'));
         process.exit(1);
       }
     }
@@ -128,6 +129,7 @@ export async function gateDecisionCommand(featureName, gateName, options = {}) {
       reason: options.reason,
       signals,
       trust: options.trust,
+      source: 'manual',
     });
 
     if (options.json) {

package/src/commands/state/handoff.js

@@ -87,6 +87,6 @@ export function handoffCommand(featureName, options = {}) {
   if (tree !== cwd) {
     console.log(chalk.yellow(`   resolvido para ${tree} — a cópia da raiz é esqueleto de nascimento, não a verdade.`));
   }
-  console.log(chalk.gray(`   fase ${result.meta.phase} · tasks ${result.meta.tasksDone}/${result.meta.tasksTotal} · ${result.meta.generatedAt}`));
+  console.log(chalk.gray(`   fase ${result.meta.phase} · fatias ${result.meta.slicesDone}/${result.meta.slicesTotal} · ${result.meta.generatedAt}`));
   console.log(chalk.gray('   A próxima sessão lê este documento antes de continuar (ponteiros, não cópias).\n'));
 }

package/src/commands/state/list.js

@@ -4,7 +4,7 @@ import { basename, join } from 'path';
 import { derivePhase } from '../../core/state/state-manager.js';
 import { gateOrderViolations } from '../../core/state/gate-order.js';
 import { missingIdentity } from '../../core/state/feature-identity.js';
-import { derivePhaseFrom } from '../../../framework/hooks/shared/state-reader.js';
+import { derivePhaseFrom, fileSetArtifactProbe } from '../../../framework/hooks/shared/state-reader.js';
 import { isGitRepo } from '../project/worktree.js';
 import { morphBranches, currentBranch, branchView } from '../../lib/worktree/feature-truth.js';
 import { buildPrIndex } from '../../lib/git/pr-index.js';
@@ -13,7 +13,7 @@ import { pendingPrFeatures, prForFeature } from '../../lib/git/pending-prs.js';
 /**
  * `morph-spec list [--all] [--json] [--no-branch]` — the feature audit board.
  *
- * One row per feature: slug × workType × status × phase × gates (G1/G2/G3) ×
+ * One row per feature: slug × workType × status × phase × gates (G1/Gd/G3) ×
  * description, plus a flags column for anomalies (missing description, gate
  * order, dangling worktree pointer). Complements `delete`: see what's dead
  * before removing it. Replaces the ad-hoc "loop over every feature.json in
@@ -37,7 +37,7 @@ import { pendingPrFeatures, prForFeature } from '../../lib/git/pending-prs.js';
  * `morph-spec fleet`'s job, not this one's.
  */
 
-const G = ['proposal', 'uiux', 'plan', 'review'];
+const G = ['plan', 'uiux', 'review'];
 
 function readFeaturesIn(baseDir, subdir, location) {
   const root = join(baseDir, '.morph', subdir);
@@ -76,7 +76,7 @@ function shapeRow(name, fj, location, phase, { corruptDisk = false, worktree = n
   const gates = {};
   for (const g of G) gates[g] = fj.approvalGates?.[g]?.approved === true;
 
-  // Gate 3 approved WITHOUT the independent evaluator (`approve --self-assessed`).
+  // Gate 3 approved WITHOUT the independent review reports (`approve --self-assessed`).
   // A recorded degradation is only worth recording if it is visible — this is
   // the surface that makes it so (D2).
   const selfAssessed = fj.approvalGates?.review?.selfAssessed === true;
@@ -150,7 +150,7 @@ function resolveBranchTruth(cwd, rows) {
     if (head === featureBranch) continue; // cwd IS the checkout — disk is freshest, never go backwards
     const view = branchView(cwd, row.feature, featureBranch);
     if (!view?.fj) continue;
-    const phase = derivePhaseFrom(view.fj, (rel) => view.files.has(rel));
+    const phase = derivePhaseFrom(view.fj, fileSetArtifactProbe(view.files));
     rows[i] = shapeRow(row.feature, view.fj, row.location, phase, {
       corruptDisk: row.flags.includes('corrupt'),
       worktree: row.worktree, // root-owned — never trust the branch copy for this
@@ -193,7 +193,7 @@ function pendingRow(p) {
     workType: null,
     status: 'in_progress',
     phase: 'aguardando-merge',
-    gates: { proposal: false, uiux: false, plan: false, review: false },
+    gates: { plan: false, uiux: false, review: false },
     selfAssessed: false,
     flags: ['pr-pending'],
     location: 'pr-pending',
@@ -281,7 +281,7 @@ export function listCommand(options = {}) {
   const warnFlags = (r) => r.flags.filter((f) => f !== 'pr-pending');
   console.log(chalk.white.bold(
     col('FEATURE', 22) + col('TYPE', 9) + col('STATUS', 13) + col('PHASE', 17) + col('WHERE', 22) + (showPr ? col('PR', 12) : '')
-    + col('G1', 4) + col('G2', 4) + col('G3', 4) + col('', 3) + 'DESCRIPTION',
+    + col('G1', 4) + col('Gd', 4) + col('G3', 4) + col('', 3) + 'DESCRIPTION',
   ));
   for (const r of rows) {
     const flag = warnFlags(r).length ? chalk.yellow('⚠') : ' ';
@@ -292,7 +292,7 @@ export function listCommand(options = {}) {
     // padEnd counts the invisible color codes; pad the plain marks manually.
     console.log(
       col(r.feature, 22) + col(r.workType, 9) + col(r.status, 13) + col(r.phase, 17) + col(whereLabel(r), 22) + (showPr ? col(prCell(r.pr), 12) : '')
-      + mark(r.gates.proposal) + '   ' + mark(r.gates.plan) + '   ' + mark(r.gates.review) + '   '
+      + mark(r.gates.plan) + '   ' + mark(r.gates.uiux) + '   ' + mark(r.gates.review) + '   '
       + flag + ' ' + desc,
     );
   }
@@ -300,6 +300,6 @@ export function listCommand(options = {}) {
   if (flagged.length) {
     console.log(chalk.gray(`\n⚠ ${flagged.length} com inconsistência — rode 'morph-spec doctor' para detalhes.`));
   }
-  console.log(chalk.gray(`\nG1=proposal · G2=plan · G3=review${options.all || options.archived ? ' · inclui arquivadas' : ''}`));
+  console.log(chalk.gray(`\nG1=plan · Gd=uiux (design) · G3=review${options.all || options.archived ? ' · inclui arquivadas' : ''}`));
   process.exit(0);
 }