@polymorphism-tech/morph-spec 8.47.0 → 9.1.0

package/src/commands/validation/verify.js

@@ -1,7 +1,7 @@
 import chalk from 'chalk';
 import { resolve } from 'path';
 import { getFeature, updateFeature } from '../../core/state/state-manager.js';
-import { runVerify, readTask, VerifyUsageError } from '../../lib/validators/verify-runner.js';
+import { runVerify, VerifyUsageError } from '../../lib/validators/verify-runner.js';
 import { resolvePrimaryRoot } from '../project/worktree.js';
 import { resolveFeatureTree } from '../../lib/worktree/feature-truth.js';
 import { canonicalPath, readMorphConfig } from '../../lib/tasks/test-runner.js';
@@ -12,43 +12,19 @@ import { treeFingerprint } from '../../lib/git/tree-fingerprint.js';
 import { HeavyBusyError } from '../../lib/heavy/gate.js';
 import { afterHeavyRun } from '../../lib/heavy/cleanup.js';
 import { readHeavyConfig } from '../../../framework/hooks/shared/heavy-config.js';
-import { runCiVerify, CiUsageError } from '../../lib/ci/ci-verify.js';
+import { runCiVerify, CiUsageError, reusableLocalStamp } from '../../lib/ci/ci-verify.js';
 
-/** ✓ pass · ✗ fail · – skip */
 function statusIcon(status) {
   if (status === 'pass') return chalk.green('✓');
   if (status === 'fail') return chalk.red('✗');
   return chalk.gray('–');
 }
 
-/**
- * One line per test run naming what the task-scope recorte did to it (#87):
- * narrowed (how many selectors, from how many test files), whole, out of scope
- * or full, each with its reason. A green `tests` line alone cannot say that the
- * task ran 12 tests instead of 3.082. Feature-scope runs carry no selection and
- * print nothing extra; `feedback[]` is untouched either way.
- *
- * @param {Array<{id: string, selection: object|null}>} [runs]
- * @returns {string[]}
- */
-function selectionLines(runs = []) {
-  return runs
-    .filter((run) => run.selection)
-    .map((run) => {
-      const { mode, reason, selectors = [], files = [] } = run.selection;
-      const detail = mode === 'narrowed'
-        ? `${selectors.length} selector(s) from ${files.length} test file(s)`
-        : (reason ?? '');
-      return chalk.gray(`      ↳ ${run.id.padEnd(10)} ${mode.padEnd(12)} ${detail}`);
-    });
-}
-
 function formatVerifyResult(result) {
   const lines = [];
-  const scopeLabel = result.scope === 'task' ? `${result.feature}/${result.task}` : result.feature;
 
   lines.push('');
-  lines.push(chalk.bold(`Verify — ${scopeLabel}`));
+  lines.push(chalk.bold(`Verify — ${result.feature}`));
   if (result.stack) lines.push(chalk.gray(`stack: ${result.stack}`));
   lines.push('');
   lines.push(result.status === 'pass' ? chalk.green.bold('✓ PASS') : chalk.red.bold('✗ FAIL'));
@@ -72,7 +48,6 @@ function formatVerifyResult(result) {
       detail = `${node.durationMs}ms`;
     }
     lines.push(`  ${icon} ${name.padEnd(11)} ${node.status.padEnd(5)} ${chalk.gray(detail)}`);
-    if (name === 'tests') lines.push(...selectionLines(node.runs));
   }
 
   if (result.feedback.length > 0) {
@@ -93,27 +68,9 @@ function formatVerifyResult(result) {
 
 const samePath = (a, b) => canonicalPath(a).replace(/\\/g, '/') === canonicalPath(b).replace(/\\/g, '/');
 
-/**
- * Persist only in the tree that OWNS the feature — the same predicate
- * `list`/`handoff`/the mutator guard read (`resolveFeatureTree`), asked from
- * the PRIMARY ROOT so every tree gets the same answer. Any other tree (a
- * sub-agent's `morph-task/*` tree branched from `morph/{f}`, a scratch
- * checkout) must never write feature.json: its copy is not the one the gates
- * read, and the write would merge-conflict with the owner's.
- *
- * The old rule read only the root's `worktree.path` pointer, which a feature
- * created INSIDE its worktree never has: a `worktrees/homolog-v2` on
- * `morph/chat-demo-simulacao` measured `unregistered-worktree` on 11/11 runs,
- * and `repeatOf` (computed only when persisting) never fired. Git's worktree
- * registry names that tree as the owner.
- *
- * The root is not special: with a live worktree owning the feature, the
- * root's copy is the birth-instant skeleton and a stamp there is drift —
- * `owner-tree-elsewhere`, the verify side of `assertOwnerTree`.
- *
- * @param {{ cwd: string, featureName: string, noPersist: boolean }} params
- * @returns {{ persist: boolean, reason: string|null }}
- */
+// Persists only in the tree that OWNS the feature (`resolveFeatureTree`, asked from the PRIMARY
+// ROOT so every tree agrees): another tree's copy is not what the gates read, and writing it
+// would merge-conflict with the owner's.
 function decidePersistence({ cwd, featureName, noPersist }) {
   if (noPersist) return { persist: false, reason: 'no-persist-flag' };
 
@@ -130,17 +87,8 @@ function baselineStampBlock(baseline) {
   return `record-baseline: a contagem caiu em ${fell.map((u) => `${u.id} (${u.from} → ${u.to})`).join(', ')}`;
 }
 
-/**
- * The per-node status map, in the shape `feature.schema.json` fixes for BOTH
- * writers of it — the per-scope history entry (`verifications.*`) and the
- * singular gate stamp (`verification.nodes`). One function because they were
- * two literal copies twenty-five lines apart: a fifth node meant remembering
- * both, and a stamp missing a node the history has is precisely the kind of
- * half-truth the gate reads as fact.
- *
- * @param {{ nodes: Record<string, { status: string }> }} result - runVerify() output
- * @returns {{ build: string, tests: string, validators: string, e2e: string }}
- */
+// The single writer of both node maps the schema fixes (`verification.nodes` and the history
+// entry): a stamp missing a node the history has is a half-truth the gate reads as fact.
 function nodeStatuses(result) {
   return {
     build: result.nodes.build.status,
@@ -151,25 +99,8 @@ function nodeStatuses(result) {
   };
 }
 
-/**
- * The status of the eval suites, pulled OUT of the tests rollup.
- *
- * The rollup cannot answer the question Gate 3 asks. A red eval and a red unit
- * test both arrive as `tests: 'fail'`, and — worse — an eval node that was
- * SKIPPED (task scope) leaves the rollup green, so a gate reading `tests` alone
- * cannot tell "the eval ran and passed" from "the eval never ran".
- *
- * Four values, and the distinction between the last two is the whole point:
- *   - `'pass'` / `'fail'`: every declared eval node agreed, or at least one did
- *     not. Same pessimistic rollup rule the tests node already uses;
- *   - `'skip'`: eval nodes ARE declared, but this run did not execute them;
- *   - `null`: this project declares NO eval node. Not a skip — there is nothing
- *     to skip. `risk-detector.js` pauses on the two for different reasons,
- *     because they call for different actions.
- *
- * @param {{nodes: {tests: {runs?: Array}}}} result - runVerify() output
- * @returns {'pass'|'fail'|'skip'|null}
- */
+// `'skip'` = eval nodes declared but not run; `null` = no eval node declared. A skipped eval
+// leaves the tests rollup green, so the gate needs this split to tell them apart.
 function evalsStatusOf(result) {
   const runs = (result.nodes.tests?.runs || []).filter((run) => run.runner === EVAL_RUNNER);
   if (runs.length === 0) return null;
@@ -178,10 +109,7 @@ function evalsStatusOf(result) {
   return 'skip';
 }
 
-/**
- * The options that make a FEATURE-scope run partial, each with the `reason` it
- * reports when it keeps the stamp from being written — first match wins.
- */
+// First match wins; each keeps the stamp from being written, with its `reason`.
 const PARTIAL_RUN_FLAGS = [['filter', 'filtered'], ['skipTests', 'skip-tests'], ['skipBuild', 'skip-build']];
 
 const CI_EXCLUSIVE_FLAGS = [
@@ -190,9 +118,9 @@ const CI_EXCLUSIVE_FLAGS = [
   ['noPersist', '--no-persist'],
 ];
 
-async function runLocalVerify(featureName, taskId, options) {
+async function runLocalVerify(featureName, options) {
   try {
-    return await runVerify(process.cwd(), featureName, taskId || null, {
+    return await runVerify(process.cwd(), featureName, {
       timeout: options.timeout,
       skipTests: options.skipTests,
       skipBuild: options.skipBuild,
@@ -203,14 +131,9 @@ async function runLocalVerify(featureName, taskId, options) {
       refreshCache: options.refreshCache,
       linux: options.linux,
       linuxImage: options.linuxImage,
-      // Task scope: switch the recorte off (#87). At feature scope nothing is
-      // ever narrowed, so the flag is a documented no-op there, not an error.
-      full: options.full,
     });
   } catch (err) {
-    // A wrong invocation is exit 2, like an unknown feature or task — never a
-    // verdict. `--filter` that selects nothing must not print green (or red):
-    // there is no verification to report, only a command to fix.
+    // Exit 2, never a verdict: a `--filter` that selects nothing must not print green or red.
     if (err instanceof VerifyUsageError) {
       console.error(chalk.red(`\n❌ ${err.message}\n`));
       process.exit(2);
@@ -231,28 +154,9 @@ async function runLocalVerify(featureName, taskId, options) {
   }
 }
 
-/**
- * `morph-spec verify <feature> [task]` — the deterministic code-before-judge
- * gate: build + tests + validators, BEFORE the LLM eval. See verify-runner.js
- * for the node cadence; this command wraps it with CLI ergonomics
- * (human/JSON output, exit codes) and context-aware persistence.
- *
- * Exit codes: 0 = pass (including all-skip) · 1 = fail (>=1 red node, or a
- * `--record-baseline` the run refused to write) · 2 = usage error.
- *
- * Exit 2 is "the command cannot mean what you typed", and there are four
- * paths to it — never a verdict, because a verdict about nothing is worse
- * than a refusal:
- *   - unknown feature, or unknown task id (the task's `group` and `outputs`
- *     decide the scope, so it is a hard usage error here);
- *   - `--filter` that matches no declared node (a filtered-to-empty run is
- *     green and proves nothing);
- *   - `--record-baseline` with nowhere to write (no `config.json`), or with a
- *     task id (a recorte de task is never a fleet baseline, #87);
- *   - `--linux` without Docker.
- * The last three arrive as `VerifyUsageError` from the runner.
- */
-export async function verifyCommand(featureName, taskId, options = {}) {
+// Exit 2 is "the command cannot mean what you typed" (unknown feature, `--filter` matching
+// nothing, `--record-baseline` without config.json, `--linux` without Docker): never a verdict.
+export async function verifyCommand(featureName, options = {}) {
   let feature;
   try {
     feature = getFeature(featureName);
@@ -265,22 +169,13 @@ export async function verifyCommand(featureName, taskId, options = {}) {
   }
 
   if (options.ci) {
-    const conflict = taskId ? `a task ${taskId} (o loop por task é local)` : CI_EXCLUSIVE_FLAGS.find(([flag]) => options[flag])?.[1];
+    const conflict = CI_EXCLUSIVE_FLAGS.find(([flag]) => options[flag])?.[1];
     if (conflict) {
       console.error(chalk.red(`\n❌ --ci roda a suíte inteira da feature no CI; não combina com ${conflict}\n`));
       process.exit(2);
     }
   }
 
-  // The runner's own reader (one reader of tasks.json for verify, #87): null
-  // means tasks.json or the task is missing, and both are this usage error.
-  if (taskId) {
-    if (!readTask(process.cwd(), featureName, taskId)) {
-      console.error(chalk.red(`\n❌ Task "${taskId}" not found in tasks.json for feature "${featureName}"\n`));
-      process.exit(2);
-    }
-  }
-
   let ci = null;
   if (options.ci) {
     try {
@@ -294,6 +189,17 @@ export async function verifyCommand(featureName, taskId, options = {}) {
         console.error(chalk.yellow(`\n⏳ ${outcome.reason}. Não é vermelho e não há stamp: não repita em laço — siga e deixe o gate-check decidir.\n`));
         process.exit(3);
       } else {
+        const reused = reusableLocalStamp(process.cwd(), feature.verification);
+        if (reused) {
+          console.error(chalk.green(`\n↪ CI indisponível (${outcome.reason}) — stamp fresco reaproveitado (sha ${reused.sha.slice(0, 8)}, ${reused.ts}): nada mudou fora de .morph/ desde aquela rodada verde.\n`));
+          if (options.json) {
+            console.log(JSON.stringify({
+              feature: featureName, status: reused.status, nodes: reused.nodes, e2eReason: reused.e2eReason ?? null,
+              reused: { sha: reused.sha, ts: reused.ts, source: reused.source ?? 'local' }, persisted: false, reason: 'stamp-reused',
+            }, null, 2));
+          }
+          process.exit(0);
+        }
         console.error(chalk.yellow(`\n↪ CI indisponível (${outcome.reason}) — verify local.\n`));
       }
     } catch (err) {
@@ -308,31 +214,27 @@ export async function verifyCommand(featureName, taskId, options = {}) {
   // Taken before the run: it is the tree the run is about to read.
   const fingerprint = treeFingerprint(process.cwd());
 
-  const result = ci ? ci.result : await runLocalVerify(featureName, taskId, options);
+  const result = ci ? ci.result : await runLocalVerify(featureName, options);
 
   const cleanup = ci ? { status: 'skipped', reason: 'ci' } : afterHeavyRun({
     projectPath: process.cwd(),
     config: readHeavyConfig(process.cwd()),
-    scope: taskId ? 'task' : 'feature',
   });
 
-  const scopeKey = taskId ? `taskVerifications.${taskId}` : 'verifications.feature';
+  const historyKey = 'verifications.feature';
   // A run that measured only part of the suite must not stand in for the proof a gate asks for:
-  // --filter and --skip-* at feature scope, or a --record-baseline that recorded nothing. Task scope
-  // is unaffected (its stamp already says scope 'task:{id}'); --no-persist keeps its own reason.
-  const partialFeatureRun = (!options.noPersist && !taskId)
-    ? PARTIAL_RUN_FLAGS.find(([flag]) => options[flag])?.[1] ?? null
-    : null;
+  // --filter and --skip-*, or a --record-baseline that recorded nothing; --no-persist keeps its own reason.
+  const partialRun = options.noPersist ? null : PARTIAL_RUN_FLAGS.find(([flag]) => options[flag])?.[1] ?? null;
   const baselineBlock = options.recordBaseline ? baselineStampBlock(result.baseline) : null;
   const { persist, reason } = baselineBlock
     ? { persist: false, reason: baselineBlock }
-    : partialFeatureRun
-      ? { persist: false, reason: partialFeatureRun }
+    : partialRun
+      ? { persist: false, reason: partialRun }
       : decidePersistence({ cwd: process.cwd(), featureName, noPersist: options.noPersist });
 
   let compact = null;
   if (persist) {
-    const prevEntry = taskId ? feature.taskVerifications?.[taskId] : feature.verifications?.feature;
+    const prevEntry = feature.verifications?.feature;
     const now = new Date().toISOString();
     compact = {
       status: result.status,
@@ -340,42 +242,28 @@ export async function verifyCommand(featureName, taskId, options = {}) {
       attempts: (prevEntry?.attempts ?? 0) + 1,
       updatedAt: now,
     };
-    await updateFeature(featureName, scopeKey, compact);
+    await updateFeature(featureName, historyKey, compact);
 
-    // Singular, scope-agnostic "latest stamp" — distinct from the
-    // verifications/taskVerifications history above. `sha` is what lets a
-    // consumer (morph-spec gate-check) correlate this pass/fail with the
-    // EXACT commit it covers, the same way review-report.md's
-    // `**Reviewed-SHA:**` token lets approve.js detect a stale review. null
-    // in a non-git checkout (or before the first commit) — fail-open, never
-    // blocks persistence.
-    //
-    // `nodes` + `e2eReason` são acréscimo de campo, não mudança de forma: o
-    // rollup `status` continua onde estava. Existem porque um nó e2e que PULA
-    // não reprova o rollup — sem o status do nó e a razão LITERAL do skip, o
-    // gate-check lê 'pass' tanto quando o e2e rodou e passou quanto quando ele
-    // nunca rodou, e não tem como separar dispensa legítima ("o projeto não
-    // containeriza") de ausência de prova ("docker indisponível"). `e2eReason`
-    // é null quando o nó não pulou — e um null NUM SKIP é lido como dispensa
-    // sem motivo, que risk-detector.js recusa.
+    // `sha` ties the stamp to the exact commit (null without git: fail-open). `nodes` and `e2eReason`
+    // exist because a skipped e2e does not fail the rollup; a null reason ON A SKIP reads as a
+    // waiver without motive, which risk-detector.js refuses.
     const stamp = {
       status: result.status,
       nodes: nodeStatuses(result),
       e2eReason: result.nodes.e2e.status === 'skip' ? (result.nodes.e2e.reason ?? null) : null,
       sha: ci ? ci.run.headSha : getHeadSha(process.cwd()),
       ts: now,
-      scope: taskId ? `task:${taskId}` : 'feature',
       ...(ci ? { source: 'ci', ciRun: ci.run.url } : {}),
     };
     await updateFeature(featureName, 'verification', stamp);
   }
 
-  // A feature-scope run over the exact tree of the previous one proves nothing
+  // A run over the exact tree of the previous one proves nothing
   // new. Advisory only: the stamp and the exit code are the same either way.
   let repeatOf = null;
   try {
     const cwd = process.cwd();
-    if (!taskId && persist && !ci) repeatOf = findRepeatedVerify(cwd, { feature: featureName, task: null, scope: result.scope, fingerprint });
+    if (persist && !ci) repeatOf = findRepeatedVerify(cwd, { feature: featureName, fingerprint });
     const tree = resolve(cwd).replace(/\\/g, '/') === resolvePrimaryRoot(cwd) ? 'root' : 'worktree';
     recordVerifyEvent(cwd, buildVerifyEvent(result, { sha: ci ? ci.run.headSha : getHeadSha(cwd), tree, persisted: persist, reason, fingerprint, source: ci ? 'ci' : 'local' }));
   } catch { /* telemetry never changes the verdict */ }
@@ -406,7 +294,7 @@ export async function verifyCommand(featureName, taskId, options = {}) {
       console.log(chalk.gray(`${mark} dotnet build-server shutdown: ${cleanup.status}${cleanup.reason ? ` (${cleanup.reason})` : ''}\n`));
     }
     if (repeatOf) {
-      console.log(chalk.yellow(`⚠️  Mesma árvore do verify de feature de ${repeatOf.ts} (${repeatOf.status}): nada mudou fora de .morph/ desde então. `
+      console.log(chalk.yellow(`⚠️  Mesma árvore do verify de ${repeatOf.ts} (${repeatOf.status}): nada mudou fora de .morph/ desde então. `
         + 'Esta rodada não prova nada novo — reuse o resultado anterior, a menos que o ambiente (Docker, banco, serviço externo) tenha mudado.\n'));
     }
     if (result.baseline?.recorded) {
@@ -417,16 +305,13 @@ export async function verifyCommand(featureName, taskId, options = {}) {
 `));
     }
     if (persist) {
-      console.log(chalk.gray(`Persisted: ${scopeKey} (attempts: ${compact.attempts})\n`));
+      console.log(chalk.gray(`Persisted: ${historyKey} (attempts: ${compact.attempts})\n`));
     } else {
       console.log(chalk.yellow(`⚠️  Not persisted (${reason})\n`));
     }
   }
 
-  // A recording the user asked for and did not get is a failure of the
-  // invocation even when the run itself was green (a filtered run is green and
-  // unrecordable): exiting 0 there would report success for something that did
-  // not happen.
+  // A recording asked for and not made fails the invocation, even when the run was green.
   const baselineRefused = Boolean(result.baseline && !result.baseline.recorded);
   process.exit(result.status === 'pass' && !baselineRefused ? 0 : 1);
 }

package/src/core/paths/output-schema.js

@@ -1,115 +1,27 @@
-/**
- * Output Schema — Single Source of Truth (v5)
- *
- * ALL output type definitions live here. Edit ONLY this file to add, rename,
- * or relocate output types.
- */
-
 import { join } from 'path';
 
-// ============================================================================
-// Schema Definition
-// ============================================================================
-
-/**
- * Schema for output types produced by morph-spec NLH phases.
- *
- * Fields:
- *   filename     - The file's basename (e.g. 'spec.md'). Single-file types only.
- *   phaseDir     - Subdirectory within .morph/features/{feature}/
- *   phase        - The morph-spec phase that produces this output
- *   protected    - Whether the file requires an approval gate before editing
- *   approvalGate - (optional) Which gate protects this file
- *   mutableFields- (optional) For protected JSON files: top-level array-item
- *                  field names that MAY still change after the gate is approved.
- *                  Lets the implement phase update task progress without
- *                  unfreezing the plan contract. When present, the protect
- *                  hook does a semantic diff instead of a blanket block.
- *
- * Multi-file types (`multi: true`) hold N files in a directory instead of one
- * fixed basename. They carry `dirname` + `filenamePattern` + `displayFilename`
- * INSTEAD of `filename`, and every derivation keyed by basename
- * (FILENAME_TO_OUTPUT, PROTECTED_SPEC_FILES, MUTABLE_SPEC_FIELDS) skips them —
- * there is no single basename to key on. `getOutputPath` returns the DIRECTORY
- * for these types.
- */
 export const OUTPUT_SCHEMA = {
-  // 0-proposal/
-  proposal:       { filename: 'proposal.md',           phaseDir: '0-proposal',  phase: 'proposal',  protected: false },
-  stackScan:      { filename: 'stack-scan.md',         phaseDir: '0-proposal',  phase: 'proposal',  protected: false },
+  plan:           { filename: 'plan.md',               phaseDir: '2-plan',      phase: 'plan',      protected: true,  approvalGate: 'plan' },
+  checks:         { filename: 'checks.json',           phaseDir: '2-plan',      phase: 'plan',      protected: true,  approvalGate: 'plan' },
 
-  // 1-design/ (optional)
   uiDesignSystem: { filename: 'design-system.md',      phaseDir: '1-design',    phase: 'uiux',      protected: true,  approvalGate: 'uiux' },
   uiMockups:      { filename: 'mockups.md',            phaseDir: '1-design',    phase: 'uiux',      protected: true,  approvalGate: 'uiux' },
   uiComponents:   { filename: 'components.md',         phaseDir: '1-design',    phase: 'uiux',      protected: true,  approvalGate: 'uiux' },
   uiFlows:        { filename: 'flows.md',              phaseDir: '1-design',    phase: 'uiux',      protected: true,  approvalGate: 'uiux' },
 
-  // 2-plan/
-  spec:           { filename: 'spec.md',               phaseDir: '2-plan',      phase: 'plan',      protected: true,  approvalGate: 'plan' },
-  tasks:          { filename: 'tasks.json',            phaseDir: '2-plan',      phase: 'plan',      protected: true,  approvalGate: 'plan', mutableFields: ['status', 'outputs', 'notes'] },
-  decisions:      { filename: 'decisions.md',          phaseDir: '2-plan',      phase: 'plan',      protected: false },
-  // Veredito REUSAR/ESTENDER/CRIAR por conceito que a feature introduz, com a
-  // justificativa de cada CRIAR. É o ARTEFATO do ciclo de reuso (a prosa está
-  // em morph-plan §2b, a cobrança em src/lib/validators/reuse/). NÃO protegido,
-  // como decisions.md: é registro vivo — o implementador que descobre um alvo
-  // melhor no meio da task precisa poder anotar, e congelá-lo transformaria a
-  // correção num bloqueio de gate.
-  // N files, one per system use case — the behaviour layer the plan distils
-  // BEFORE spec.md/tasks.json. Deliberately NOT protected: editing a use case
-  // after Gate 2 is the supported way to change behaviour and re-run implement;
-  // the audit trail lives in git.
-  usecases:       {
-    dirname: 'usecases',
-    filenamePattern: '^UC-\\d+-[a-z0-9-]+\\.md$',
-    displayFilename: 'UC-{nn}-{slug}.md',
-    phaseDir: '2-plan',
-    phase: 'plan',
-    protected: false,
-    multi: true,
-  },
-
-  // 3-implement/
-  recap:          { filename: 'recap.md',              phaseDir: '3-implement', phase: 'implement', protected: false },
-  // N files, one per task whose doneCriteria judges what a MODEL answers
-  // (morph-plan §5). Runtime evidence: input, model, output, verdict — pointing
-  // at the `runner: "evals"` node when the stack declares one. CONDITIONAL by
-  // construction: never in phases.json requiredOutputs. Readers: morph-review
-  // dispatch prompt.
-  evidencias:     { dirname: 'evidencias', filenamePattern: '^T\\d+\\.md$', displayFilename: '{taskId}.md',
+  evidencias:     { dirname: 'evidencias', filenamePattern: '^C\\d+\\.md$', displayFilename: '{Cn}.md',
                     phaseDir: '3-implement', phase: 'implement', protected: false, multi: true },
 
-  // 4-review/
-  reviewReport:   { filename: 'review-report.md',      phaseDir: '4-review',    phase: 'review',    protected: false },
-  // Durable report the dispatched morph-evaluator sub-agent writes itself
-  // (MORPH.md §6) — the orchestrator reads it and synthesizes reviewReport
-  // from it; the two never collide because one is raw sub-agent output and
-  // the other is the orchestrator's curated Gate 3 presentation.
-  evaluatorReport:{ filename: 'evaluator-report.md',   phaseDir: '4-review',    phase: 'review',    protected: false },
+  verifierReport: { filename: 'verifier.md',           phaseDir: '4-review',    phase: 'review',    protected: false },
+  reviewerReport: { filename: 'reviewer.md',           phaseDir: '4-review',    phase: 'review',    protected: false },
+  securityReport: { filename: 'security.md',           phaseDir: '4-review',    phase: 'review',    protected: false },
 };
 
-// ============================================================================
-// Builder Functions (Windows-safe via path.join)
-// ============================================================================
-
-/**
- * Leaf segment of a schema entry: the basename for single-file types, the
- * directory name for multi-file ones. Keeps every path builder from having to
- * know about `multi` on its own.
- */
 function leafSegment(entry) {
   return entry.multi ? entry.dirname : entry.filename;
 }
 
-/**
- * Get the morph-relative path for a specific output type of a feature.
- *
- * For `multi` types this is the DIRECTORY holding the N files
- * (".morph/features/my-feature/2-plan/usecases"), not a single file.
- *
- * @param {string} featureName
- * @param {string} outputType  - camelCase output type key from OUTPUT_SCHEMA
- * @returns {string} e.g. ".morph/features/my-feature/2-plan/spec.md"
- */
+/** For `multi` types this is the directory holding the N files. */
 export function getOutputPath(featureName, outputType) {
   const entry = OUTPUT_SCHEMA[outputType];
   if (!entry) {
@@ -119,10 +31,6 @@ export function getOutputPath(featureName, outputType) {
     .replace(/\\/g, '/');
 }
 
-/**
- * Get the absolute filesystem path for a specific output type.
- * For `multi` types this is the directory — see {@link getOutputPath}.
- */
 export function getAbsoluteOutputPath(projectRoot, featureName, outputType) {
   const entry = OUTPUT_SCHEMA[outputType];
   if (!entry) {
@@ -131,42 +39,20 @@ export function getAbsoluteOutputPath(projectRoot, featureName, outputType) {
   return join(projectRoot, '.morph', 'features', featureName, entry.phaseDir, leafSegment(entry));
 }
 
-/**
- * Get the feature base directory (morph-relative, forward slashes).
- */
 export function getFeatureDir(featureName) {
   return join('.morph', 'features', featureName).replace(/\\/g, '/');
 }
 
-/**
- * Per-task sub-agent report — the durable "return value" channel for a
- * dispatched implementation task (MORPH.md §6). A sub-agent's final text
- * message may never reach the orchestrator (idle_notification with no text
- * is an observed failure mode); the file it writes here always does. Doesn't
- * fit OUTPUT_SCHEMA's one-fixed-filename-per-type model since the filename
- * is parameterized by taskId, so it's a sibling helper instead of a schema
- * entry.
- *
- * @param {string} featureName
- * @param {string} taskId - e.g. "T7"
- * @returns {string} morph-relative, forward-slash path
- */
 export function getTaskReportPath(featureName, taskId) {
   return join('.morph', 'features', featureName, '3-implement', 'reports', `${taskId}.md`)
     .replace(/\\/g, '/');
 }
 
-/** Absolute filesystem variant of {@link getTaskReportPath}. */
 export function getAbsoluteTaskReportPath(projectRoot, featureName, taskId) {
   return join(projectRoot, '.morph', 'features', featureName, '3-implement', 'reports', `${taskId}.md`);
 }
 
-/**
- * Get all output paths for a feature, ready for state.json `outputs` block.
- *
- * Multi-file types contribute their DIRECTORY, so `created` for them means
- * "the folder exists" — the state index tracks presence, not file count.
- */
+/** `multi` types contribute their directory, so `created` means "the folder exists". */
 export function getAllOutputPaths(featureName) {
   const outputs = {};
   for (const [key] of Object.entries(OUTPUT_SCHEMA)) {
@@ -178,14 +64,6 @@ export function getAllOutputPaths(featureName) {
   return outputs;
 }
 
-// ============================================================================
-// Derived Constants
-// ============================================================================
-
-/**
- * filename → output type. Multi-file types are absent by construction: they
- * have N basenames, so there is nothing to key on.
- */
 export const FILENAME_TO_OUTPUT = Object.fromEntries(
   Object.entries(OUTPUT_SCHEMA)
     .filter(([, entry]) => !entry.multi)
@@ -196,36 +74,12 @@ export const OUTPUT_PHASE_MAP = Object.fromEntries(
   Object.entries(OUTPUT_SCHEMA).map(([key, entry]) => [key, entry.phase])
 );
 
-/**
- * Protected spec files and the approval gate that locks them.
- */
 export const PROTECTED_SPEC_FILES = Object.fromEntries(
   Object.entries(OUTPUT_SCHEMA)
     .filter(([, entry]) => entry.protected && entry.approvalGate && !entry.multi)
     .map(([, entry]) => [entry.filename, entry.approvalGate])
 );
 
-/**
- * For protected files that carry mutable progress fields: filename → the
- * top-level array-item fields that may change after the gate is approved.
- * The protect-spec-files hook uses this to allow progress updates (e.g.
- * task status) while still freezing the plan contract.
- */
-export const MUTABLE_SPEC_FIELDS = Object.fromEntries(
-  Object.entries(OUTPUT_SCHEMA)
-    .filter(([, entry]) => entry.protected && entry.approvalGate && entry.mutableFields && !entry.multi)
-    .map(([, entry]) => [entry.filename, entry.mutableFields])
-);
-
-// ============================================================================
-// Backwards-compat shim (will be removed in v5.1)
-// ============================================================================
-
-/**
- * v4 had separate contracts.cs / contracts.ts / contracts-vsa.cs output types.
- * In v5 contracts live inside spec.md (or in source files for VSA). This
- * function keeps callers happy until they're updated.
- */
 export function resolveContractsOutputType() {
-  return 'spec';
+  return 'plan';
 }

package/src/core/state/feature-identity.js

@@ -1,32 +1,8 @@
-/**
- * Feature identity — the fields that keep a feature.json from being an
- * anonymous shell (the {status, updatedAt}-only scaffolds nobody could later
- * identify). name/createdAt/workType are auto-stamped at birth (explicit
- * `morph-spec create` or the state-sync hook's implicit registration);
- * `description` is the one field a human must supply.
- *
- * `missingIdentity` powers the audit surfaces (`list`, `doctor`) that flag
- * pre-existing anonymous features LENIENTLY (warn, never invalidate old
- * feature.json). `create` enforces `description` HARD at birth — the two-tier
- * split the schema's `required` array can't express (adding fields there would
- * invalidate every feature.json that predates this).
- *
- * Pure module — no filesystem/CLI side effects.
- */
-
 export const IDENTITY_FIELDS = ['name', 'description', 'workType', 'createdAt'];
 
 const blank = (v) => v === undefined || v === null || String(v).trim() === '';
 
-/**
- * Identity fields absent from a feature.json (empty array = fully identified).
- * `description` leads because its absence is the real anonymity signal.
- * `workType` is intentionally excluded — absent workType defaults to 'feature',
- * so it is never a marker of an anonymous shell.
- *
- * @param {object} feature - feature.json contents
- * @returns {string[]} missing identity field names
- */
+// `workType` is excluded on purpose: absent, it defaults to `feature`.
 export function missingIdentity(feature) {
   const missing = [];
   if (blank(feature?.description)) missing.push('description');