@skitterbyte/skitterspec 22.0.0 → 22.2.0

package/README.md

@@ -18,6 +18,7 @@ demand, host dev servers on reserved ports — and everything below.
 | `/spec` | Grill to a shared understanding, then write a groomed spec |
 | `/spec-bug` | Reproduce with a failing test, then drive it red→green |
 | `/spec-hotfix` | Fix the released version: fork from a tag, land by tag + cherry-pick |
+| `/no-spec` | Work that genuinely has no spec — on its own branch all the same |
 | `/spec-review` | Re-validate a spec against the code; refresh what drifted |
 | `/spec-start` | Put a spec in flight — provision its branch, then build phase 1 |
 | `/spec-next` | Build the next phase of the spec in flight |
@@ -30,6 +31,8 @@ demand, host dev servers on reserved ports — and everything below.
 | `/spec-connect` | Point your canonical `localhost` ports at one spec's stack |
 | `/spec-live` | Check one spec out in the primary checkout, so your running server reloads it |
 | `/spec-remote-review` | Permit (or forbid) reviewing from off your network |
+| `/allow-main` | Allow writes on the base branch for this session — yours to run, never Claude's |
+| `/spec-skip` | Move on from a phase without a verdict, reason recorded — yours to run, never Claude's |
 <!-- commands:end -->
 
 The last three are **slash commands** rather than skills: each pre-executes one
@@ -184,6 +187,17 @@ All optional, in `specs/.core/env.config.json`:
 | `review.commitWith` | `"/commit"` | the skill a committing verdict hands off to |
 | `review.reader` | `"detect"` | where you are reading — `local`, `remote`, or detect it |
 | `review.servePort` | derived | the port, normally derived from the repo's path |
+| `review.reviewers` | `[]` | external code reviewers whose findings render as checks. Empty by default — adding one sends the worktree's diff to whatever the command talks to |
+
+**`review.reviewers` is a seam, not a vendor.** An entry is either
+`{ "use": "<adapter>" }` for one skitterspec bundles, or
+`{ "name": "…", "command": "…", "format": "rdjsonl" }` for anything that prints
+[rdjsonl](https://github.com/reviewdog/reviewdog) — most linters already do, so
+an adapter is a twenty-line script. Findings arrive as **checks**, which never
+block a committing verdict; reply to one on the page and the reply is a
+**comment**, which does, because now a person asked. A reviewer that could not
+run is reported as `did not run: <why>` rather than passing as clean. See
+`specs/.core/env.config.md` for the full field reference and the privacy note.
 
 `/spec-next` writes the page at the end of every phase. Nothing about it depends
 on where your shell is.

package/assets/claude-md-section.md

@@ -34,6 +34,19 @@ An accept remembers the file's content, so it lapses by itself when that file
 changes again. The marks are information — nothing gates on them; the verdict is
 the one thing you choose, once.
 
+**A second opinion, when you want one** (`review.reviewers`, empty by default).
+Point it at a code reviewer that runs from your terminal — CodeRabbit's CLI has
+a free tier and `{ "use": "coderabbit" }` is the whole setup; anything printing
+[rdjsonl](https://github.com/reviewdog/reviewdog) works too — and its findings
+land on the page beside your own notes, each badged with the tool that found it
+and linked to the line it is about. `/spec-next` runs them once per phase;
+`/spec-diff --reviewers` is the mid-phase ask. **They never block a commit** —
+reply to one and your reply does, because then a person has asked for something.
+A reviewer that could not run says `did not run — <why>` rather than passing as
+clean, because on the page you commit from those two must not look alike.
+Adding one sends your diff to whatever the command talks to, which is why the
+list starts empty and `init` never writes one.
+
 **Above the verdicts sits one line that is not a verdict.** `▶ Put it live`
 commits the phase, checks the branch out where your dev server can see it, and
 hands you back the same page with the same options — so you can judge the change

package/assets/commands/allow-main.md

@@ -0,0 +1,33 @@
+---
+description: Allow writes on the base branch for this session — bare allows it with no reason, a reason records why, `off` clears it
+argument-hint: "[<reason> | off]"
+allowed-tools: Bash({{exec}} skitterspec spec-env main allow:*)
+disable-model-invocation: true
+---
+!`{{exec}} skitterspec spec-env main allow $ARGUMENTS`
+
+Relay the engine output above verbatim. Add nothing and run nothing else.
+
+**Only you can run this, and that is the whole guard.** The main-guard hook
+refuses an `Edit` or a `Write` in the primary checkout while it sits on the base
+branch, and it names two exits: move the work with `/no-spec` or `/spec-start`,
+or have you lift the guard. Claude can take the first exit on its own and can
+never take the second — a guard the model can lift is decoration, which is the
+same line `/spec-reviewed` draws.
+
+**Give it a reason.** `/allow-main fixing the lockfile by hand` records why; bare
+records `none given`. The reason is the part a reviewer can argue with, exactly
+as with a `Gating:` header — and it is what you will read when you wonder later
+why the base branch has an uncommitted file on it.
+
+**It lapses with the session where it can.** The allow is recorded against this
+session, so it ends when the session does. Where the harness exposes no session
+id it degrades to a repo-wide allow that outlives the session and is cleared only
+by `/allow-main off`; the engine says which kind you got, so do not read a bare
+"allowed" as temporary.
+
+**It is machine-local and gitignored.** Unlike `/spec-remote-review`, this writes
+nothing anyone else pulls: it is your decision about your checkout, not the
+project's policy. The project-wide switch is `guards.mainIsLandingZone` in
+`specs/.core/env.config.json`, and turning that off is a different, committed
+decision.

package/assets/commands/spec-skip.md

@@ -0,0 +1,24 @@
+---
+description: Move on from a phase without a verdict, with the reason on the record — clears the review gate
+argument-hint: "\"<reason>\""
+allowed-tools: Bash({{exec}} skitterspec spec-env review skip:*)
+disable-model-invocation: true
+---
+!`{{exec}} skitterspec spec-env review skip "$ARGUMENTS"`
+
+Relay the engine output above verbatim. Add nothing and run nothing else.
+
+**It refuses with no reason, and that refusal is the feature.** A skip with no
+reason is indistinguishable from nobody having looked — where
+`none: additive, nothing to revert` is a decision a reviewer can argue with. If
+the engine asked for a reason, relay that and stop; do not supply one on the
+operator's behalf.
+
+**It is one of exactly two exits**, and the other is a committing verdict on the
+page. Nothing else discharges a phase's obligation — not a mid-run `Continue`,
+not an action, not a render.
+
+**Only you can run it.** Like `/allow-main`, this lifts a guard aimed at Claude,
+so Claude must not be able to lift it. `/spec-connect` and `/spec-live` are
+user-only for the milder reason that there is no judgement to apply; this one is
+user-only because of who the guard is for.

package/assets/core/env.config.json.example

@@ -45,7 +45,8 @@
     "allowNetwork": true,
     "allowRemote": false,
     "commitWith": "/commit",
-    "required": true
+    "required": true,
+    "reviewers": []
   },
   "live": {
     "migrations": []

package/assets/core/env.config.md

@@ -5,7 +5,7 @@ stack + host dev servers + a front-door proxy per in-progress spec).
 Provisioning is folded into `/spec-start`, teardown into `/spec-complete` ·
 `/spec-cancel`, traffic diversion is `/spec-connect`, and reading a spec's diff
 is `/spec-diff`; the `skitterspec spec-env
-<up|down|prune|dev|connect|integrate|hotfix|live|review|stage|status|resolve>` CLI is
+<up|nospec|main|down|prune|dev|connect|integrate|hotfix|live|review|stage|status|resolve>` CLI is
 the engine beneath them.
 
 **Once this file is present, isolation is the default policy:** `/spec-start` gives
@@ -80,6 +80,12 @@ through to a documented conservative default; see the field notes below.
     // worktree-only. false = every spec is worktree-only and the escalation is
     // hidden. (Was "always provision Docker" in the pre-Stack engine.)
     "enabled": true,
+    // Passed as `-f` to `docker compose` on up and down, but ONLY when the file
+    // is actually there — a project whose file has a name docker finds by
+    // itself keeps working untouched. It is also the signal that lets a spec
+    // with no `Stack:` header inherit `enabled` above: the switch is a
+    // project-wide default, the file is evidence there is a stack to bring up.
+    // An explicit header is checked first and never consults it.
     "composeFile": "docker-compose.yml",
     "projectNamePattern": "{repoSlug}_{slug}", // → COMPOSE_PROJECT_NAME
     "portBase": 3000,          // first port of slot 0's block
@@ -104,6 +110,10 @@ through to a documented conservative default; see the field notes below.
   //          worktree). The main checkout is resolved robustly at run time via
   //          `git rev-parse --git-common-dir` — no hardcoded repo name or path.
   // Shorthand: `"seedFiles": [".env", …]` == `{ "mode": "symlink", "files": […] }`.
+  // `.env` is an ILLUSTRATION, not an expectation — skitterspec never reads any
+  // of these files, it only links or copies them. Name whatever your stack keeps
+  // out of git: `appsettings.Development.json` or a user-secrets file, `.envrc`,
+  // `local.settings.json`, `config/local.yml`.
   // Seeded files are gitignored, so they never make the worktree "dirty" and
   // never block teardown; they vanish with the worktree at `spec-env down`.
   // [] (or absent) = seed nothing (current behaviour).
@@ -364,12 +374,83 @@ through to a documented conservative default; see the field notes below.
   //            turns the whole thing off.
   // Only a literal `false` opts out: a typo leaves a check that REFUSES in
   // place rather than quietly disabling it. Default: true.
+  //
+  // `reviewers` lists EXTERNAL CODE REVIEWERS whose findings render on the page
+  // as CHECKS, beside (or instead of) a written review. Empty by default, and
+  // `init` never writes one.
+  //
+  //   READ THIS BEFORE ADDING ONE. A reviewer is a command run in the spec's
+  //   worktree, and every hosted one sends that worktree's diff to a third
+  //   party. Nothing else in skitterspec leaves your machine — the page is a
+  //   local file, the server binds your own network, and the diff never reaches
+  //   a model. Configuring a reviewer changes that, deliberately and only
+  //   because you asked. Every finding on the page is badged with the reviewer
+  //   that produced it, so it stays visible where the code went.
+  //
+  // Two entry shapes, told apart by which key is present:
+  //   { "use": "<adapter>" }
+  //       A bundled adapter. The engine owns its command line and its parser,
+  //       so this is the whole configuration. One ships today: "coderabbit",
+  //       which drives `cr review --agent` (a free tier, rate-limited per
+  //       hour; `cr auth login` first). A `use` this build does not have is
+  //       reported on stderr and does not run.
+  //       Its adapter also does the one thing a shell script cannot: it tells
+  //       ITS OWN refusals — not authenticated, rate limited, no network —
+  //       apart from a review that ran and found nothing.
+  //   { "name": "<label>", "command": "<shell>", "format": "rdjsonl" }
+  //       Bring your own. `name` is what the page badges findings with, and
+  //       `command` is a shell line run with the worktree as its cwd.
+  // Both take an optional `timeout` in seconds (default 180).
+  //
+  // `format` is the output contract, and today there is one: `rdjsonl` — one
+  // JSON object per line, reviewdog's diagnostic shape:
+  //   {"path":"src/a.js","range":{"start":{"line":12}},"severity":"ERROR","message":"…"}
+  // A flat `"line": 12` is read too. Most linters already emit this, so a
+  // project gets non-AI checks on the same page for free, and an adapter for
+  // anything else is a twenty-line script that prints rdjsonl.
+  //
+  // `command` may carry `${scope}` (`working` | `branch`), `${base}`,
+  // `${spec}` and `${worktree}`. `scope` matches the render's own two modes —
+  // a phase-end render is `working` (uncommitted + untracked in the worktree)
+  // and `--branch` is the whole spec against its base — so what the page shows
+  // is what was reviewed. An unknown `${…}` is left verbatim rather than
+  // blanked, so a typo shows up in the command that failed instead of silently
+  // becoming an empty argument.
+  //
+  // `severity` maps to the page's levels: `ERROR` → `flag`, everything else →
+  // `confirm`. Never `good` — that means "I read this and it is right", which
+  // is a thing a person says.
+  //
+  // FINDINGS NEVER GATE A COMMIT. They are checks, and `judgeVerdict` refuses a
+  // committing verdict only while a COMMENT is unresolved. A comment is
+  // something a person asked for; twelve machine findings are not. Reply to one
+  // on the page and that reply IS a comment — which does gate, because now
+  // someone asked. There is deliberately no severity threshold that blocks:
+  // that is the counting gate this whole design exists against, and it makes a
+  // reviewer's bad day into a wall.
+  //
+  // A REVIEWER THAT COULD NOT RUN SAYS SO, rather than staying silent — the one
+  // place `.claude/rules/negative-checks.md` inverts. Silence is normally the
+  // safe branch; here a rate-limited or unauthenticated reviewer would render
+  // identically to one that read the diff and found nothing, on the page a
+  // commit decision is made from. So every configured reviewer gets a line:
+  // `12 findings` · `clean` · `cached` · `did not run — <why>`. Nothing exits
+  // non-zero and nothing refuses — a reviewer that could not run never blocks a
+  // render, a verdict or a commit.
+  //
+  // They run in SEQUENCE, at the end of a phase and on demand (`/spec-diff
+  // --reviewers`), and the results are cached against a hash of the diff — so
+  // re-rendering unchanged work reuses them rather than spending another review
+  // against an hourly limit. An entry that is neither shape is dropped and
+  // REPORTED on stderr; it cannot be caught by the unknown-key check, because
+  // this default is an array. Default: [].
   "review": {
     "reader": "detect",
     "servePort": "auto",
     "serve": "always",
     "commitWith": "/commit",
-    "required": true
+    "required": true,
+    "reviewers": []
   }
 }
 ```

package/assets/hooks/main-guard.cjs

@@ -0,0 +1,145 @@
+#!/usr/bin/env node
+'use strict'
+
+/**
+ * Main guard — the harness half.
+ *
+ * `main` is where work **lands**, not where it happens. The skills say so, and
+ * a skill is prose: it can be chained past, typed around, or simply not read.
+ * So the rule is also enforced one level down, where an `Edit` or a `Write` is
+ * a tool call the harness has to ask about first.
+ *
+ * IT REFUSES THE FIRST WRITE, NOT THE COMMIT, and that is the whole reason it
+ * is a different hook from `review-gate.cjs` rather than another branch inside
+ * it. Nothing has been written when this fires, so the fix costs one command —
+ * `/no-spec <name>` and carry on. A commit-time gate fires once the work
+ * already exists in the primary checkout, and in worktree mode moving it is the
+ * genuinely painful part: the primary checkout cannot `switch -c` out from
+ * under the other worktrees.
+ *
+ * THIS SCRIPT DECIDES NOTHING. It reads the tool call, hands the directory to
+ * `spec-env main check`, and turns one exit status into an answer. Every
+ * judgement — is isolation configured, is this the primary checkout, is HEAD
+ * the base branch, is an allow in force — lives in the engine, where it is unit
+ * tested. A hook with its own opinions is a second implementation that nothing
+ * can test and nobody remembers to update.
+ *
+ * IT FAILS OPEN, EVERYWHERE, for the same reasons `review-gate.cjs` does and
+ * with more at stake, because this one fires far more often. No engine, an
+ * unreadable payload, a repo with no isolation, a crash of its own — all of
+ * them allow the write. Being wrong the permissive way costs one edit on a rule
+ * the skills also carry; being wrong the other way costs someone their work
+ * with no idea why (`.claude/rules/negative-checks.md`).
+ */
+
+const fs = require('node:fs')
+const path = require('node:path')
+const { spawnSync } = require('node:child_process')
+
+// Let the call through, saying nothing. Exit 0 with no JSON is "no opinion" —
+// the tool proceeds exactly as if this hook did not exist, which is what the
+// overwhelming majority of invocations must do.
+function allow() {
+  process.exit(0)
+}
+
+/**
+ * Refuse, and say what to do instead.
+ *
+ * The JSON route rather than exit-2, because the reason reaches **Claude** —
+ * which is who has to act on it, by moving the work rather than by asking the
+ * user to switch the guard off. The exits are named in the refusal itself.
+ */
+function deny(reason) {
+  process.stdout.write(
+    JSON.stringify({
+      hookSpecificOutput: {
+        hookEventName: 'PreToolUse',
+        permissionDecision: 'deny',
+        permissionDecisionReason: reason,
+      },
+    }) + '\n',
+  )
+  process.exit(0)
+}
+
+function readPayload() {
+  try {
+    const raw = fs.readFileSync(0, 'utf8')
+    const parsed = JSON.parse(raw)
+    return parsed && typeof parsed === 'object' ? parsed : null
+  } catch {
+    // Unreadable or unparseable stdin is the cannot-tell case, not evidence.
+    return null
+  }
+}
+
+/**
+ * Where the engine is, in the order most likely to be right. Pure but for the
+ * existence check. Identical to `review-gate.cjs`'s, deliberately: a hook
+ * process does not inherit a package manager's `node_modules/.bin` on PATH, so
+ * the local install is looked for by path first — walking up from the project,
+ * because a git worktree's checkout has its own `node_modules`.
+ */
+function findEngine(projectDir) {
+  if (process.env.SKITTERSPEC_BIN) return process.env.SKITTERSPEC_BIN
+  let at = projectDir
+  for (let i = 0; i < 6 && at; i++) {
+    for (const name of ['skitterspec', 'skitterspec-linear']) {
+      const candidate = path.join(at, 'node_modules', '.bin', name)
+      if (fs.existsSync(candidate)) return candidate
+    }
+    const up = path.dirname(at)
+    if (up === at) break
+    at = up
+  }
+  return 'skitterspec'
+}
+
+// The tools that write a file. A matcher is configured too, but a hook that is
+// reached some other way must still be inert rather than guessing.
+//
+// WHAT WOULD FOOL THIS: a write that does not go through a write TOOL — a shell
+// heredoc, `sed -i`, an editor outside the session. Those are left unguarded on
+// purpose. Covering them would mean parsing arbitrary shell for filesystem
+// effects, which cannot be done reliably, and the failure mode of getting it
+// wrong is refusing a command that has nothing to do with writing files. The
+// skills carry the rule for everything this matcher cannot see.
+const WRITE_TOOLS = new Set(['Edit', 'Write', 'NotebookEdit', 'MultiEdit'])
+
+function main() {
+  const payload = readPayload()
+  if (!payload) allow()
+
+  if (!WRITE_TOOLS.has(payload.tool_name)) allow()
+
+  // The write's own directory decides the answer — a worktree is its own
+  // checkout, and only the primary one is this guard's business.
+  const cwd = typeof payload.cwd === 'string' && payload.cwd ? payload.cwd : process.cwd()
+  const session = typeof payload.session_id === 'string' ? payload.session_id : ''
+
+  const argv = ['spec-env', 'main', 'check', '--dir', cwd]
+  if (session) argv.push('--session', session)
+
+  const result = spawnSync(findEngine(cwd), argv, { cwd, encoding: 'utf8', timeout: 8000 })
+
+  // No engine, a crash, a timeout — all cannot-tell. `status` is null when the
+  // process never ran or was killed, and neither is a refusal.
+  if (result.error || result.status === null) allow()
+  if (result.status !== 1) allow()
+
+  deny((result.stdout || '').trim())
+}
+
+// Guarded so the pieces above can be required and tested without the script
+// reading stdin and exiting.
+if (require.main === module) {
+  try {
+    main()
+  } catch {
+    // Even a bug in this file lets the write through.
+    allow()
+  }
+}
+
+module.exports = { findEngine, WRITE_TOOLS }

package/assets/hooks/review-gate.cjs

@@ -121,9 +121,14 @@ function main() {
 
   deny(
     (result.stdout || '').trim() +
-      '\n\nThis phase is waiting on a verdict. Read the page and send one, ' +
-      'type /spec-reviewed if a pass is already waiting, or record why you are ' +
-      'moving on:\n  skitterspec spec-env review skip "<reason>"',
+      '\n\nThis phase is waiting on a verdict. Relay these to the operator ' +
+      'rather than choosing one: press a verdict on the page, /spec-reviewed if ' +
+      'a pass is already waiting, or /spec-skip "<reason>" to move on with the ' +
+      'reason recorded.\n\nAll three are theirs to type. /spec-skip is the same ' +
+      'exit as \'skitterspec spec-env review skip "<reason>"\' — a command ' +
+      'rather than an incantation, because the long form is what nobody retypes ' +
+      'and a gate with an unreachable exit gets switched off wholesale instead ' +
+      'of answered.',
   )
 }
 

package/assets/review/page.html

@@ -322,8 +322,63 @@ tr.band button { font-size: .72rem; padding: .1rem .5rem; margin-right: .3rem; }
   font-size: .78rem;
   color: var(--muted);
   overflow-wrap: anywhere;
+  /* A button, because it jumps to the code — but it must keep reading as the
+     quiet path label it has always been, not gain a control's chrome. */
+  background: none;
+  border: 0;
+  padding: 0;
+  text-align: left;
+  cursor: pointer;
+  text-decoration: underline;
+  text-decoration-style: dotted;
+  text-underline-offset: 2px;
+}
+.check-file:hover { color: inherit; }
+/* WHO SAID IT. Absent on a written review's checks, which is why it is a
+   separate span rather than a prefix on the note: a page with one author looks
+   exactly as it always did. */
+.check-src {
+  grid-column: 2;
+  font-size: .68rem;
+  text-transform: uppercase;
+  letter-spacing: .04em;
+  font-weight: 700;
+  color: var(--muted);
+  margin-right: .4rem;
 }
+.check-src + .check-file { grid-column: 2; }
 .check-note { grid-column: 2; }
+
+/* --- the reviewer strip --------------------------------------------------
+   One line per configured reviewer, present even when every one found nothing.
+   A reviewer that was rate-limited and one that read the diff and approved are
+   the same page without it, and the reader is about to decide whether to
+   commit. */
+.reviewers { list-style: none; margin: 0 0 .8rem; padding: 0; display: grid; gap: .25rem; }
+.reviewer {
+  display: flex;
+  flex-wrap: wrap;
+  gap: .5rem;
+  align-items: baseline;
+  font-size: .8rem;
+  color: var(--muted);
+}
+.reviewer-name {
+  font-family: ui-monospace, SFMono-Regular, Menlo, monospace;
+  font-weight: 700;
+  color: var(--fg);
+}
+.reviewer-name::after { content: ' —'; color: var(--muted); font-weight: 400; }
+/* A reviewer that could not run is marked, not hidden — the distinction between
+   "clean" and "never answered" is the whole reason this strip exists. */
+.reviewer.failed .reviewer-said,
+.reviewer.missing .reviewer-said,
+.reviewer.timeout .reviewer-said { color: var(--flag-fg); }
+.reviewer.findings .reviewer-said { color: var(--fg); }
+
+/* A line a check pointed at, so a jump lands somewhere visible rather than
+   leaving the reader to find the row themselves. */
+tr.goto-hit > td { background: var(--confirm-bg); }
 .check.flag { background: var(--flag-bg); }
 .check.flag .check-level { color: var(--flag-fg); }
 .check.confirm { background: var(--confirm-bg); }
@@ -634,10 +689,12 @@ a.ticket:hover { border-color: var(--accent); }
    exactly this pair. */
 .cmd-row[data-verdict="commit"],
 .cmd-row[data-verdict="commit-start"],
+.cmd-row[data-verdict="commit-land"],
 .cmd-row[data-verdict="commit-continue"],
 .cmd-row[data-verdict="continue"] { border-left: 3px solid var(--good-fg); }
 .cmd-row[data-verdict="commit"] .cmd-label,
 .cmd-row[data-verdict="commit-start"] .cmd-label,
+.cmd-row[data-verdict="commit-land"] .cmd-label,
 .cmd-row[data-verdict="commit-continue"] .cmd-label,
 .cmd-row[data-verdict="continue"] .cmd-label { color: var(--good-fg); }
 .cmd-row[data-verdict="changes"] { border-left: 3px solid var(--flag-fg); }
@@ -795,6 +852,13 @@ a.ticket:hover { border-color: var(--accent); }
              spec and puts it IN FLIGHT, which is the `commit && /spec-start`
              that was typed by hand until now. -->
         <button id="verdict-commit-start" class="v-commit" type="button" hidden>&#10003; Commit &amp; Start</button>
+        <!-- THE /no-spec VERDICT, hidden unless the render asked for it. Work with
+             no spec has no next phase and nothing to put in flight, so neither
+             committing verb above fits: this one commits, fast-forwards the base
+             branch, and tears the worktree down. Its own word rather than a
+             context-dependent reading of "Commit", because one of those two
+             readings destroys a worktree. -->
+        <button id="verdict-commit-land" class="v-commit" type="button" hidden>&#10003; Commit &amp; Land</button>
         <button id="verdict-changes" class="v-changes" type="button">↺ Request changes</button>
         <button id="verdict-discuss" type="button">… Discuss first</button>
         <span class="verdict-count" id="verdict-count" aria-live="polite"></span>
@@ -1064,6 +1128,10 @@ a.ticket:hover { border-color: var(--accent); }
       } else {
         tr.appendChild(gutter(row, st, i))
         tr.appendChild(el('td', 'src', row.text === '' ? ' ' : row.text))
+        // The line number, so a check can point at this row. Set here rather
+        // than derived on demand because the file re-renders on every expand,
+        // and a lookup built once would go stale the first time a band opened.
+        if (row.n != null) tr.setAttribute('data-n', String(row.n))
       }
       body.appendChild(tr)
       // Anything said about this line sits directly beneath it — a note you
@@ -1310,6 +1378,54 @@ a.ticket:hover { border-color: var(--accent); }
     d.scrollIntoView({ block: 'start' })
   }
 
+  /**
+   * Jump to a file, and to one line inside it when a check named one.
+   *
+   * THREE STATES, AND ONLY ONE OF THEM IS A JUMP. A file that is not in this
+   * diff, and a line that is not in that file's patch, both do nothing beyond
+   * revealing what IS there — a reviewer's finding can name a line that has
+   * since moved, and a page that scrolled somewhere arbitrary would be worse
+   * than one that scrolled nowhere.
+   */
+  function gotoLine(path, line) {
+    var st = null
+    state.forEach(function (s) { if (s.file.path === path) st = s })
+    if (!st) return
+    reveal(st.file)
+    if (line == null) return
+    // A collapsed band hides the row, so drop any band covering it first. The
+    // file re-renders anyway; this just decides what is on screen when it does.
+    var idx = -1
+    for (var i = 0; i < st.rows.length; i++) {
+      if (st.rows[i].n === line) { idx = i; break }
+    }
+    if (idx < 0) return
+    st.bands = st.bands.filter(function (b) { return !(idx >= b.from && idx < b.to) })
+    renderFile(st)
+    if (!st.el) return
+    // Attribute-only, no tag prefix: within one file's element nothing but a
+    // code row carries `data-n`, and the narrower selector buys nothing.
+    var tr = st.el.querySelector('[data-n="' + line + '"]')
+    if (!tr) return
+    var prev = document.querySelector('.goto-hit')
+    if (prev) prev.className = prev.className.replace(/ ?goto-hit/, '')
+    tr.className += ' goto-hit'
+    tr.scrollIntoView({ block: 'center' })
+  }
+
+  // Wired per button rather than delegated from `document`. The review block is
+  // spliced in as markup by the engine, so it is all present by the time this
+  // runs — and a listener on each element is what the rest of this page does.
+  function wireGotos() {
+    var btns = document.querySelectorAll('[data-goto]')
+    Array.prototype.forEach.call(btns, function (btn) {
+      btn.addEventListener('click', function () {
+        var n = btn.getAttribute('data-goto-line')
+        gotoLine(btn.getAttribute('data-goto'), n == null ? null : parseInt(n, 10))
+      })
+    })
+  }
+
   // ONE FLAT LIST, indented by per-row padding rather than by nesting <ul>s.
   //
   // That is not a tidy-up: the change counts are `position: sticky; right: 0`,
@@ -1478,6 +1594,7 @@ a.ticket:hover { border-color: var(--accent); }
     commit: document.getElementById('verdict-commit'),
     'commit-continue': document.getElementById('verdict-commit-continue'),
     'commit-start': document.getElementById('verdict-commit-start'),
+    'commit-land': document.getElementById('verdict-commit-land'),
     continue: document.getElementById('verdict-continue'),
     changes: document.getElementById('verdict-changes'),
     discuss: document.getElementById('verdict-discuss'),
@@ -1485,7 +1602,7 @@ a.ticket:hover { border-color: var(--accent); }
   // The committing pair, named once. A fifth verdict that commits is added
   // here, and the shared block below follows for free — the same reason the
   // engine keeps a `COMMITTING` list rather than a second condition.
-  var COMMITTERS = ['commit', 'commit-continue', 'commit-start']
+  var COMMITTERS = ['commit', 'commit-continue', 'commit-start', 'commit-land']
 
   /*
    * WHICH BUTTONS THIS PAGE OFFERS, and it comes from the render rather than
@@ -1506,6 +1623,7 @@ a.ticket:hover { border-color: var(--accent); }
     midrun: ['continue', 'changes', 'discuss'],
     authoring: ['commit-start', 'commit', 'changes', 'discuss'],
     refresh: ['commit', 'changes', 'discuss'],
+    nospec: ['commit-land', 'commit', 'changes', 'discuss'],
     committing: ['commit', 'commit-continue', 'changes', 'discuss'],
   }
   var OFFERED = OFFERS[data.buttons] || OFFERS.committing
@@ -1522,6 +1640,7 @@ a.ticket:hover { border-color: var(--accent); }
     commit: '✓ Commit',
     'commit-continue': '✓ Commit & Continue',
     'commit-start': '✓ Commit & Start',
+    'commit-land': '✓ Commit & Land',
     continue: '→ Continue',
     changes: '↺ Request changes',
     discuss: '… Discuss first',
@@ -1534,6 +1653,10 @@ a.ticket:hover { border-color: var(--accent); }
     // Says what it WILL do, because this is the one verdict that provisions:
     // a worktree appears and phase 1 starts.
     'commit-start': 'Commit this spec, then put it in flight and build phase 1',
+    // Says what it WILL do, and every destructive part of it: this is the only
+    // verdict that removes a worktree, so the reader must not learn that from
+    // the outcome afterwards.
+    'commit-land': 'Commit this, fast-forward the base branch to it, and remove the worktree',
     // Says what it will NOT do, for the same reason: nothing is committed by
     // this, so the work it resumes is still uncommitted afterwards.
     continue: 'You have read it — carry on with the run; nothing is committed',
@@ -1751,6 +1874,7 @@ a.ticket:hover { border-color: var(--accent); }
     commit: 'committed',
     'commit-continue': 'committed, then carried on',
     'commit-start': 'committed, then put in flight',
+    'commit-land': 'committed, landed, and torn down',
     continue: 'read it and carried on',
     changes: 'changes requested',
     discuss: 'discussed',
@@ -2492,7 +2616,12 @@ a.ticket:hover { border-color: var(--accent); }
    * never offers a disable and this renders whatever it is given.
    */
   var ACTION_LABEL = {
-    'live-on': '▶ Put it live',
+    // NAMES THE COMMIT IT PERFORMS. `live take` refuses a dirty worktree, so
+    // the action commits the phase before taking the instance — and a press
+    // that commits behind a label reading only "put it live" is a side effect
+    // nobody agreed to. The reader has still approved nothing: this is a
+    // precondition of the thing they asked for, not a verdict on the diff.
+    'live-on': '▶ Commit & put it live',
     'allow-network': '▶ Allow network',
     'allow-remote': '▶ Allow remote',
   }
@@ -2684,6 +2813,7 @@ a.ticket:hover { border-color: var(--accent); }
   drawLog()
   drawDecided()
   wireChecks()
+  wireGotos()
   state.forEach(function (st) {
     var btn = st.details && st.details.querySelector('.accept')
     if (btn) btn.setAttribute('aria-pressed', String(st.accept))