@specship/specship-win32-arm64 0.24.0 → 0.28.0

package/lib/dist/workflows/defaults/spec-implement.yaml

@@ -14,8 +14,9 @@ inputs:
 systemPromptAppend: |
   You are implementing a specific requirement. Before editing code, call
   specship_spec($INPUT.SPEC_ID) to see the spec body and any code it
-  already links to. After editing, call specship_link_assert with the
-  spec_id and the symbol you implemented BEFORE reporting done.
+  already links to. After editing, record each symbol you implemented as a
+  `path:Symbol` bullet under the requirement's `implementations:` block in
+  its spec file — links in the spec file survive any reindex.
 
   JIRA-backed specs (REQ-JIRAPUB-004): if the spec file's frontmatter
   carries a `jira_issue:` key, EVERY git commit message you write for this
@@ -41,9 +42,30 @@ nodes:
       (b) which code areas / symbols are most relevant, and (c) whether
       any code currently claims to implement it (look at linked_code).
 
+  - id: readiness
+    kind: bash
+    depends_on: [fetch_spec]
+    output_type: readiness_report
+    timeout: 120000
+    bash: |
+      # REQ-PIPETRUST-004 — implement must not start on a spec that is not
+      # ready (lint errors, no criteria, a criterion still [needs review]).
+      # Also records the run's base commit so postcheck can diff against it.
+      git rev-parse HEAD > "$(git rev-parse --git-dir)/specship-run-base" 2>/dev/null || true
+      if [ -n "$SPECSHIP_CLI_SCRIPT" ]; then ss_cli() { "$SPECSHIP_CLI_NODE" "$SPECSHIP_CLI_SCRIPT" "$@"; }; SS=ss_cli
+      elif command -v specship >/dev/null 2>&1; then SS=specship
+      elif [ -x node_modules/.bin/specship ]; then SS=node_modules/.bin/specship
+      else SS=""
+      fi
+      if [ -z "$SS" ]; then
+        echo "READY=unavailable — specship CLI not found; the readiness gate did NOT run"
+        exit 1
+      fi
+      $SS ready $INPUT.SPEC_ID --path .
+
   - id: plan
     kind: prompt
-    depends_on: [fetch_spec]
+    depends_on: [fetch_spec, readiness]
     output_type: plan
     allowed_tools:
       - mcp__specship__specship_explore
@@ -55,6 +77,17 @@ nodes:
 
       $fetch_spec.output
 
+      Readiness + evidence plan (every acceptance criterion needs a test of
+      the stated kind, written as a NAMED function passed to it() with the
+      criterion id in its title):
+      $readiness.output
+
+      Domain facts that `specship_spec` returns with the requirement are
+      constraints, not background: honour each external fact's verified
+      version, and treat every `## Enforced` rule (`<glob>` must not match
+      `/<regex>/`) as a hard constraint — `specship knowledge check` fails the
+      run on a violation (REQ-KNOW-005).
+
       The plan should list:
       - Files to create or modify (with project-relative paths)
       - Specific functions/methods/classes to add or change
@@ -63,23 +96,93 @@ nodes:
 
       Keep it tight (≤500 words). Do NOT edit code in this step.
 
+  - id: plan_scope
+    kind: bash
+    depends_on: [plan]
+    output_type: plan_scope
+    bash: |
+      # REQ-THRU-003 — opt-in auto-approval of a small, in-scope plan. Prints
+      # AUTO_APPROVE=yes only when specship.config.json opts in, the plan
+      # names only the requirement's implementation files (plus tests, its
+      # spec and CHANGELOG.md), and the requirement has few criteria.
+      PLAN=$plan.output
+      F="$(mktemp)"
+      printf '%s\n' "$PLAN" > "$F"
+      if [ -n "$SPECSHIP_CLI_SCRIPT" ]; then "$SPECSHIP_CLI_NODE" "$SPECSHIP_CLI_SCRIPT" plan-scope $INPUT.SPEC_ID --plan-file "$F" --path .
+      elif command -v specship >/dev/null 2>&1; then specship plan-scope $INPUT.SPEC_ID --plan-file "$F" --path . || echo "AUTO_APPROVE=no"
+      else echo "AUTO_APPROVE=no"; echo "- specship CLI not found"
+      fi
+      rm -f "$F"
+
   - id: approve_plan
     kind: approval
-    depends_on: [plan]
+    depends_on: [plan, plan_scope]
+    auto_approve:
+      from: plan_scope
+      marker: AUTO_APPROVE=yes
     message: |
       Plan ready for $INPUT.SPEC_ID. Review the plan output and approve
       to proceed with implementation, or reject with feedback to revise.
     capture_response: true
     on_reject:
+      # The reviewer's rejection reason is appended to this prompt
+      # automatically; the revision replaces $plan.output downstream.
       prompt: |
-        The plan was rejected with this feedback. Revise:
+        The plan was rejected (feedback follows). Revise the plan to
+        address it and output the full revised plan.
 
-        $approve_plan.output
+        Current plan:
+        $plan.output
+      revises: plan
       max_attempts: 3
 
+  - id: quality_baseline
+    kind: bash
+    depends_on: [approve_plan]
+    output_type: quality_report
+    timeout: 600000
+    bash: |
+      # REQ-AUTHG-008.A1 — run the project's quality command BEFORE implement
+      # edits anything, so the gate can tell errors this change introduced
+      # from errors the worktree already had (a sub-package with no built
+      # parent, known lint debt). The baseline lives under the worktree's git
+      # dir, so it never shows up in the diff. It is written ONLY when the
+      # pre-change command fails: a clean baseline means any later failure is
+      # the change's, so the gate keeps its full strictness (A5 fallback).
+      qnorm() { sed -E 's/\([0-9]+,[0-9]+\)//g; s/:[0-9]+:[0-9]+/:/g; s/:[0-9]+:/:/g' | sed -E '/^[[:space:]]*$/d' | sort -u; }
+      BASELINE="$(git rev-parse --git-dir 2>/dev/null)/specship-quality-baseline.txt"
+      rm -f "$BASELINE"
+      QUALITY_CMD=""
+      if [ -f package.json ]; then
+        if [ ! -d node_modules ]; then
+          npm ci --no-audit --no-fund >/dev/null 2>&1 || npm install --no-audit --no-fund >/dev/null 2>&1 || true
+        fi
+        if node -e 'const s=(require("./package.json").scripts)||{};process.exit(s.lint?0:1)' 2>/dev/null; then
+          QUALITY_CMD="npm run lint --if-present"
+        elif [ -f tsconfig.json ]; then
+          QUALITY_CMD="npx --no-install tsc --noEmit"
+        fi
+      elif [ -f Cargo.toml ]; then
+        if command -v cargo >/dev/null 2>&1; then QUALITY_CMD="cargo clippy --no-deps"; fi
+      elif [ -f pyproject.toml ] || [ -f requirements.txt ]; then
+        if command -v ruff >/dev/null 2>&1; then QUALITY_CMD="ruff check ."; fi
+      fi
+      if [ -z "$QUALITY_CMD" ]; then
+        echo "QUALITY_BASELINE=skipped"
+        exit 0
+      fi
+      if OUT=$($QUALITY_CMD 2>&1); then
+        echo "QUALITY_BASELINE=clean"
+      else
+        printf '%s\n' "$OUT" | qnorm > "$BASELINE"
+        echo "QUALITY_BASELINE=recorded"
+        echo "QUALITY_BASELINE_LINES=$(wc -l < "$BASELINE" | tr -d ' ')"
+      fi
+      exit 0
+
   - id: implement
     kind: prompt
-    depends_on: [approve_plan]
+    depends_on: [approve_plan, quality_baseline]
     output_type: diff
     allowed_tools:
       - Read
@@ -92,17 +195,302 @@ nodes:
     prompt: |
       Implement the approved plan. Follow it closely.
 
+      Domain facts that `specship_spec` returns with the requirement are
+      constraints, not background: honour each external fact's verified
+      version, and treat every `## Enforced` rule (`<glob>` must not match
+      `/<regex>/`) as a hard constraint — `specship knowledge check` fails the
+      run on a violation (REQ-KNOW-005).
+
       Plan:
       $plan.output
 
       Approval feedback (if any):
       $approve_plan.output
 
+      Readiness + evidence plan (every acceptance criterion needs a test of
+      the stated kind, written as a NAMED function passed to it() with the
+      criterion id in its title):
+      $readiness.output
+
       When done, output a short diff summary (which files changed and why).
 
-  - id: verify
+  - id: quality_gate
     kind: bash
     depends_on: [implement]
+    output_type: quality_report
+    timeout: 600000
+    bash: |
+      # REQ-AUTHG-005.A1 — the project's own lint/typecheck, run in the
+      # worktree right after implement. The QUALITY_GATE marker is the
+      # contract the remediation node routes on: a project with neither a lint
+      # script nor a typecheck config says so explicitly, so "nothing ran" can
+      # never be mistaken for "clean" (same doctrine as VERIFY_RESULT=skipped).
+      QUALITY_CMD=""
+      if [ -f package.json ]; then
+        # The worktree may not have dependencies yet (verify installs them
+        # later) and lint needs them — bootstrap quietly, and treat a failed
+        # install as "no gate" rather than as a lint failure.
+        if [ ! -d node_modules ]; then
+          npm ci --no-audit --no-fund >/dev/null 2>&1 || npm install --no-audit --no-fund >/dev/null 2>&1 || true
+        fi
+        if node -e 'const s=(require("./package.json").scripts)||{};process.exit(s.lint?0:1)' 2>/dev/null; then
+          QUALITY_CMD="npm run lint --if-present"
+        elif [ -f tsconfig.json ]; then
+          QUALITY_CMD="npx --no-install tsc --noEmit"
+        fi
+      elif [ -f Cargo.toml ]; then
+        if command -v cargo >/dev/null 2>&1; then QUALITY_CMD="cargo clippy --no-deps"; fi
+      elif [ -f pyproject.toml ] || [ -f requirements.txt ]; then
+        if command -v ruff >/dev/null 2>&1; then QUALITY_CMD="ruff check ."; fi
+      fi
+      if [ -z "$QUALITY_CMD" ]; then
+        echo "QUALITY_GATE=skipped"
+        echo "QUALITY_REASON=no lint script and no typecheck configuration in this project"
+        exit 0
+      fi
+      echo "QUALITY_CMD=$QUALITY_CMD"
+      qnorm() { sed -E 's/\([0-9]+,[0-9]+\)//g; s/:[0-9]+:[0-9]+/:/g; s/:[0-9]+:/:/g' | sed -E '/^[[:space:]]*$/d' | sort -u; }
+      BASELINE="$(git rev-parse --git-dir 2>/dev/null)/specship-quality-baseline.txt"
+      if OUT=$($QUALITY_CMD 2>&1); then
+        echo "QUALITY_GATE=passed"
+      elif [ -f "$BASELINE" ]; then
+        # REQ-AUTHG-008.A2/A3 — judge only error lines absent from the
+        # pre-change baseline; report pre-existing ones, never hide them.
+        NEW=$(printf '%s\n' "$OUT" | qnorm | comm -13 "$BASELINE" - | grep -iE 'error' || true)
+        PRE=$(printf '%s\n' "$OUT" | qnorm | comm -12 "$BASELINE" - | grep -ciE 'error' || true)
+        if [ -z "$NEW" ]; then
+          echo "QUALITY_GATE=passed"
+          echo "QUALITY_PREEXISTING=$PRE"
+          echo "Pre-existing errors (already failing before implement; not caused by this change), sample:"
+          printf '%s\n' "$OUT" | grep -iE 'error' | head -n 5
+        else
+          echo "QUALITY_GATE=failed"
+          echo "QUALITY_PREEXISTING=$PRE"
+          echo "New errors introduced by this change:"
+          printf '%s\n' "$NEW" | tail -n 80
+        fi
+      else
+        echo "QUALITY_GATE=failed"
+        printf '%s\n' "$OUT" | tail -n 80
+      fi
+      # Exiting 0 on a lint failure is deliberate: the marker — not this node's
+      # exit code — drives the revise loop. quality_recheck is what halts.
+
+  - id: fix_quality
+    kind: prompt
+    depends_on: [quality_gate]
+    output_type: quality_fix
+    allowed_tools:
+      - Read
+      - Edit
+      - Write
+      - Bash
+      - mcp__specship__specship_explore
+      - mcp__specship__specship_node
+    prompt: |
+      Lint / typecheck result for the code you just wrote:
+
+      $quality_gate.output
+
+      Route on the QUALITY_GATE marker — do not re-judge the raw output:
+
+      - QUALITY_GATE=passed or QUALITY_GATE=skipped → change NOTHING. Output
+        exactly `FIX_QUALITY=not-needed` and stop.
+      - QUALITY_GATE=failed → fix every reported error, then re-run the
+        QUALITY_CMD shown above to confirm. Fix the code, never the lint
+        configuration; never silence or disable a rule to make it pass.
+
+      Output `FIX_QUALITY=fixed` (clean re-run) or `FIX_QUALITY=still-failing`
+      followed by the errors that remain.
+
+  - id: quality_recheck
+    kind: bash
+    depends_on: [fix_quality]
+    output_type: quality_result
+    timeout: 600000
+    bash: |
+      # REQ-AUTHG-005.A1 — the authoritative half of the gate. The fix node is
+      # a prompt, so its "FIX_QUALITY=fixed" claim is a claim, not evidence:
+      # this node re-runs the same command and halts the run while it still
+      # fails, so failing lint/typecheck never reaches verify, the link node,
+      # or the human gate.
+      GATE_OUT=$quality_gate.output
+      MARKER=$(printf '%s' "$GATE_OUT" | grep -oE 'QUALITY_GATE=[a-z-]+' | tail -n 1 | cut -d= -f2)
+      CMD=$(printf '%s' "$GATE_OUT" | grep -E '^QUALITY_CMD=' | tail -n 1 | cut -d= -f2-)
+      if [ "$MARKER" = "skipped" ] || [ -z "$CMD" ]; then
+        echo "QUALITY_RESULT=skipped"
+        echo "This project has no lint or typecheck gate — nothing was checked."
+        exit 0
+      fi
+      if OUT=$($CMD 2>&1); then
+        echo "QUALITY_RESULT=clean"
+        exit 0
+      fi
+      qnorm() { sed -E 's/\([0-9]+,[0-9]+\)//g; s/:[0-9]+:[0-9]+/:/g; s/:[0-9]+:/:/g' | sed -E '/^[[:space:]]*$/d' | sort -u; }
+      BASELINE="$(git rev-parse --git-dir 2>/dev/null)/specship-quality-baseline.txt"
+      if [ -f "$BASELINE" ]; then
+        # REQ-AUTHG-008.A2/A3 — only errors absent from the baseline halt.
+        NEW=$(printf '%s\n' "$OUT" | qnorm | comm -13 "$BASELINE" - | grep -iE 'error' || true)
+        if [ -z "$NEW" ]; then
+          echo "QUALITY_RESULT=clean"
+          echo "QUALITY_PREEXISTING=$(printf '%s\n' "$OUT" | qnorm | comm -12 "$BASELINE" - | grep -ciE 'error' || true)"
+          exit 0
+        fi
+        echo "QUALITY_RESULT=failed"
+        printf '%s\n' "$NEW" | tail -n 80
+      else
+        echo "QUALITY_RESULT=failed"
+        printf '%s\n' "$OUT" | tail -n 80
+      fi
+      echo "HALT_CAUSE=lint/typecheck still fails after the fix attempt — the change is not reviewable yet"
+      exit 1
+
+  - id: postcheck
+    kind: bash
+    depends_on: [quality_recheck]
+    output_type: postcheck_report
+    timeout: 600000
+    bash: |
+      # REQ-PIPETRUST-005 — check the agent's work mechanically: verifies
+      # bullets are real named test symbols covering every criterion, a src
+      # change has a CHANGELOG entry, and project-configured checks pass
+      # (their fix commands run first). Exit 0 always: the POSTCHECK marker
+      # routes the fix step; postcheck_recheck is what halts.
+      if [ -n "$SPECSHIP_CLI_SCRIPT" ]; then ss_cli() { "$SPECSHIP_CLI_NODE" "$SPECSHIP_CLI_SCRIPT" "$@"; }; SS=ss_cli
+      elif command -v specship >/dev/null 2>&1; then SS=specship
+      elif [ -x node_modules/.bin/specship ]; then SS=node_modules/.bin/specship
+      else SS=""
+      fi
+      if [ -z "$SS" ]; then
+        echo "POSTCHECK=failed"
+        echo "specship CLI not found — postcheck did NOT run"
+        exit 0
+      fi
+      $SS postcheck $INPUT.SPEC_ID --path . --fix || true
+
+  - id: fix_postcheck
+    kind: prompt
+    depends_on: [postcheck]
+    output_type: postcheck_fix
+    allowed_tools:
+      - Read
+      - Edit
+      - Write
+      - Bash
+      - mcp__specship__specship_spec
+    prompt: |
+      Mechanical post-implement check for $INPUT.SPEC_ID:
+
+      $postcheck.output
+
+      Route on the POSTCHECK marker — do not re-judge:
+
+      - POSTCHECK=passed → change NOTHING. Output exactly
+        `FIX_POSTCHECK=not-needed` and stop.
+      - POSTCHECK=failed → fix every ✗ finding:
+        - [verifies] — every acceptance criterion needs a test written as a
+          NAMED function passed to it(), with the criterion id in the it()
+          title, listed under the requirement's `verifies:` block in its spec
+          file as `path:FunctionName` (never an it() title string).
+        - [changelog] — add a plain-sentence, user-facing entry under
+          `## [Unreleased]` in CHANGELOG.md (no internal paths or symbols).
+        - [command] — make the named check pass by fixing the cause.
+        A bash step re-runs postcheck after you; any finding left halts the run.
+
+      Output `FIX_POSTCHECK=fixed` or `FIX_POSTCHECK=still-failing` followed
+      by what remains.
+
+  - id: postcheck_recheck
+    kind: bash
+    depends_on: [fix_postcheck]
+    output_type: postcheck_result
+    timeout: 600000
+    bash: |
+      # REQ-PIPETRUST-005.A5 — the authoritative half: re-run and halt while
+      # anything still fails, so an unlinked or undocumented change never
+      # reaches verify or the human gate.
+      if [ -n "$SPECSHIP_CLI_SCRIPT" ]; then ss_cli() { "$SPECSHIP_CLI_NODE" "$SPECSHIP_CLI_SCRIPT" "$@"; }; SS=ss_cli
+      elif command -v specship >/dev/null 2>&1; then SS=specship
+      elif [ -x node_modules/.bin/specship ]; then SS=node_modules/.bin/specship
+      else SS=""
+      fi
+      if [ -z "$SS" ]; then
+        echo "POSTCHECK_RESULT=failed"
+        echo "HALT_CAUSE=specship CLI not found — postcheck did NOT run"
+        exit 1
+      fi
+      if OUT=$($SS postcheck $INPUT.SPEC_ID --path . 2>&1); then
+        echo "POSTCHECK_RESULT=clean"
+        printf '%s\n' "$OUT"
+        exit 0
+      fi
+      echo "POSTCHECK_RESULT=failed"
+      printf '%s\n' "$OUT"
+      echo "HALT_CAUSE=postcheck still fails after the fix attempt — the change is not reviewable yet"
+      exit 1
+
+  - id: suppression_gate
+    kind: bash
+    depends_on: [postcheck_recheck]
+    output_type: suppression_report
+    bash: |
+      # REQ-QGATE-004.A3 — deterministic scan for lint/type suppression
+      # comments the change introduces (noqa, eslint-disable, @ts-ignore, …).
+      # The fix_quality prompt forbids silencing rules; this node enforces it
+      # in code. SUPPRESSION_GATE is the marker contract: a scan that could
+      # not run is `skipped`, never `clean`.
+      # REQ-PIPETRUST-006.A4 — prefer the CLI running this workflow over any
+      # (possibly older) `specship` on PATH.
+      if [ -n "$SPECSHIP_CLI_SCRIPT" ]; then ss_cli() { "$SPECSHIP_CLI_NODE" "$SPECSHIP_CLI_SCRIPT" "$@"; }; SS=ss_cli
+      elif command -v specship >/dev/null 2>&1; then SS=specship
+      elif [ -x node_modules/.bin/specship ]; then SS=node_modules/.bin/specship
+      elif [ -x dist/bin/specship.js ]; then SS="node dist/bin/specship.js"
+      else SS=""; fi
+      if [ -z "$SS" ]; then
+        echo "SUPPRESSION_GATE=skipped"
+        echo "SUPPRESSION_REASON=specship CLI not found — suppression scan did NOT run"
+        exit 0
+      fi
+      if OUT=$($SS suppressions 2>&1); then
+        printf '%s\n' "$OUT"
+      else
+        printf '%s\n' "$OUT"
+        echo "HALT_CAUSE=the change introduces lint/type suppression comments — fix the code instead of silencing the rule"
+        exit 1
+      fi
+
+  - id: diff
+    kind: bash
+    depends_on: [suppression_gate]
+    output_type: diff
+    bash: |
+      # REQ-AUTHG-004.A1 — the full diff, from git, into a run artifact. The
+      # human gate and the adversarial reviewer read THIS; the implement node's
+      # prose about what it believes it changed is not the change.
+      # `git add -A -N` registers new files as intent-to-add so untracked work
+      # appears in `git diff HEAD` without staging any content.
+      git add -A -N >/dev/null 2>&1 || true
+      echo "DIFF_BEGIN"
+      git --no-pager diff HEAD | head -c 400000
+      echo
+      echo "DIFF_END"
+
+  - id: diff_stat
+    kind: bash
+    depends_on: [diff]
+    output_type: diff_stat
+    bash: |
+      # REQ-AUTHG-004.A2 — the stat block the final gate shows: file names and
+      # insertions/deletions counted by git. Its own small node so the approval
+      # message carries the summary while the full diff stays in the `diff`
+      # artifact.
+      echo "DIFF_STAT_BEGIN"
+      git --no-pager diff HEAD --stat
+      echo "DIFF_STAT_END"
+
+  - id: verify
+    kind: bash
+    depends_on: [diff_stat]
     output_type: test_results
     timeout: 600000
     bash: |
@@ -111,43 +499,110 @@ nodes:
       # The VERIFY_RESULT marker is the machine-readable contract the link
       # node routes on (REQ-IMPLINT-001.A1): a skipped run must never be
       # mistaken for a passing one.
+      # Install and build failures fail fast with their own markers
+      # (REQ-REVINT-006.A1) — a broken environment or a build break is NOT a
+      # test failure, and must never be attributed to one.
       if [ -f package.json ]; then
         # A fresh worktree has no node_modules/ or build output — a verify
         # failure must mean the tests failed, not that the environment was
         # missing (WF-REJECT-DOC, REQ-WFREJ-005).
-        if [ ! -d node_modules ]; then npm ci --no-audit --no-fund || npm install --no-audit --no-fund; fi
-        npm run build --if-present
-        if npm test; then echo "VERIFY_RESULT=ran-and-passed"; else echo "VERIFY_RESULT=ran-and-failed"; exit 1; fi
+        if [ ! -d node_modules ]; then
+          if ! { npm ci --no-audit --no-fund || npm install --no-audit --no-fund; }; then
+            echo "VERIFY_RESULT=env-failed"; exit 1
+          fi
+        fi
+        if ! npm run build --if-present; then echo "VERIFY_RESULT=build-failed"; exit 1; fi
+        # REQ-PIPETRUST-006.A3 — a vitest project also leaves a JSON report in
+        # the run's artifacts, ingestible with `specship verify --report`.
+        TEST_ARGS=""
+        if [ -n "$SPECSHIP_ARTIFACTS_DIR" ] && node -e 'const s=((require("./package.json").scripts)||{}).test||"";process.exit(/^\s*vitest\b/.test(s)?0:1)' 2>/dev/null; then
+          mkdir -p "$SPECSHIP_ARTIFACTS_DIR"
+          REPORT="$SPECSHIP_ARTIFACTS_DIR/test-report.json"
+          TEST_ARGS="-- --reporter=default --reporter=json --outputFile.json=$REPORT"
+          echo "VERIFY_REPORT=$REPORT (ingest after merge: specship verify --report $REPORT)"
+        fi
+        if npm test $TEST_ARGS; then echo "VERIFY_RESULT=ran-and-passed"; else echo "VERIFY_RESULT=ran-and-failed"; exit 1; fi
       elif [ -f Cargo.toml ]; then
+        if ! cargo build; then echo "VERIFY_RESULT=build-failed"; exit 1; fi
         if cargo test; then echo "VERIFY_RESULT=ran-and-passed"; else echo "VERIFY_RESULT=ran-and-failed"; exit 1; fi
       elif [ -f pyproject.toml ] || [ -f requirements.txt ]; then
+        if ! python -c 'import pytest' 2>/dev/null; then echo "VERIFY_RESULT=env-failed"; exit 1; fi
         if python -m pytest; then echo "VERIFY_RESULT=ran-and-passed"; else echo "VERIFY_RESULT=ran-and-failed"; exit 1; fi
       else
         echo "no recognised test framework; tests did NOT run"
         echo "VERIFY_RESULT=skipped"
       fi
 
+  - id: route_verify
+    kind: bash
+    depends_on: [verify]
+    output_type: verify_route
+    bash: |
+      # Deterministic verify routing (REQ-VSTATE-005.A1): the VERIFY_RESULT
+      # marker is parsed HERE, in code, and turned into a LINK_ACTION the link
+      # node obeys. It used to be a prompt reading a test log — the one decision
+      # that governs whether links may be promoted was hallucinable.
+      VERIFY_OUT=$verify.output
+      MARKER=$(printf '%s' "$VERIFY_OUT" | grep -oE 'VERIFY_RESULT=[a-z-]+' | tail -n 1 | cut -d= -f2)
+      [ -n "$MARKER" ] || MARKER=missing
+      echo "VERIFY_RESULT=$MARKER"
+      # env-failed / build-failed halt BEFORE any link mutation, naming the
+      # environment cause (REQ-VSTATE-005.A3) — neither is a test failure.
+      case "$MARKER" in
+        ran-and-passed)
+          echo "LINK_ACTION=assert-and-verify-pass" ;;
+        ran-and-failed)
+          echo "LINK_ACTION=assert-and-verify-fail" ;;
+        skipped)
+          echo "LINK_ACTION=assert-only" ;;
+        env-failed)
+          echo "HALT_CAUSE=environment setup failed (dependency install) — nothing is known about the tests"
+          exit 1 ;;
+        build-failed)
+          echo "HALT_CAUSE=build failed — nothing is known about the tests"
+          exit 1 ;;
+        *)
+          echo "HALT_CAUSE=no VERIFY_RESULT marker found in the verify output — an unknown result is never a pass"
+          exit 1 ;;
+      esac
+
   - id: link
     kind: prompt
-    depends_on: [verify]
+    depends_on: [route_verify]
     output_type: link_summary
     allowed_tools:
-      - mcp__specship__specship_link_assert
-      - mcp__specship__specship_link_verify
+      - Read
+      - Edit
       - mcp__specship__specship_spec
     prompt: |
-      Assert spec→code links for the changes made in the implement step.
-      For each symbol that implements $INPUT.SPEC_ID (or its child
-      requirements), call specship_link_assert with the spec_id, the
-      file path, and the qualified symbol name.
-
-      Then route on the VERIFY_RESULT marker in the test results below
-      (REQ-IMPLINT-001):
-      - VERIFY_RESULT=ran-and-passed → after each assert, call
-        specship_link_verify with result="pass".
-      - VERIFY_RESULT=skipped → do NOT call specship_link_verify at all;
-        the links stay in the `implemented` state. Tests that did not run
-        are never reported as passing.
+      Record spec→code links for the changes made in the implement step —
+      durably, in the spec file (REQ-PIPETRUST-006). Do NOT call
+      specship_link_assert or specship_link_verify: runtime links vanish on a
+      full reindex, and a headless run cannot be granted them.
+
+      Open the spec file that declares $INPUT.SPEC_ID. Under the requirement:
+      - `implementations:` — one `path:Symbol` bullet per symbol that
+        implements it (qualified `Class.method` for methods). Add any that
+        are missing; never duplicate an existing bullet.
+      - `verifies:` — leave as the postcheck step left it (named test
+        functions only). Never add an it() title string.
+
+      You MUST NOT assert a `tests`-kind link (REQ-REVINT-005.A1) —
+      never pass kind: 'tests', and never mint test evidence: it comes only
+      from the spec's `verifies:` block or an `@verifies` comment on a test
+      symbol.
+
+      Verification state is not yours to set, so you
+      do NOT call specship_link_verify, whatever LINK_ACTION says. On
+      LINK_ACTION=assert-and-verify-pass, LINK_ACTION=assert-and-verify-fail
+      or LINK_ACTION=assert-only alike, record the implementations bullets
+      only: tests that ran are in the run's JSON test report (see the verify
+      output) and are ingested with `specship verify --report` after the
+      branch merges; tests that did not run are never reported as passing.
+
+      Routing context (computed by a bash node from VERIFY_RESULT):
+
+      $route_verify.output
 
       Implementation diff summary:
       $implement.output
@@ -155,39 +610,244 @@ nodes:
       Test results:
       $verify.output
 
-      Output: a short list of "spec_id → file:symbol [verified|implemented]"
-      lines, ending with one line stating whether verification ran or was
-      skipped.
+      Output: a short list of "spec_id → file:symbol" lines you recorded,
+      ending with the VERIFY_REPORT line from the verify output if present.
 
   - id: coverage
-    kind: prompt
+    kind: bash
     depends_on: [link]
     output_type: coverage_summary
+    bash: |
+      # The acceptance-criteria coverage line is computed FROM THE DB
+      # (REQ-VSTATE-005.A2) — `specship coverage --line` renders the same
+      # `getSpecCoverage` report the MCP tool and the dashboard read, so the
+      # number on the approval gate cannot disagree with them. It used to be
+      # counted by a prompt.
+      # REQ-PIPETRUST-006.A4 — prefer the CLI running this workflow over any
+      # (possibly older) `specship` on PATH.
+      if [ -n "$SPECSHIP_CLI_SCRIPT" ]; then ss_cli() { "$SPECSHIP_CLI_NODE" "$SPECSHIP_CLI_SCRIPT" "$@"; }; SS=ss_cli
+      elif command -v specship >/dev/null 2>&1; then SS=specship
+      elif [ -x node_modules/.bin/specship ]; then SS=node_modules/.bin/specship
+      elif [ -x dist/bin/specship.js ]; then SS="node dist/bin/specship.js"
+      else SS=""; fi
+      if [ -z "$SS" ]; then
+        echo "COVERAGE_UNAVAILABLE=specship CLI not found — acceptance-criteria coverage was NOT computed"
+        exit 0
+      fi
+      LINE=$($SS coverage $INPUT.SPEC_ID --line) || {
+        echo "COVERAGE_UNAVAILABLE=specship coverage failed — coverage was NOT computed"
+        exit 0
+      }
+      echo "$LINE"
+      N=$(printf '%s' "$LINE" | awk '{print $1}')
+      M=$(printf '%s' "$LINE" | awk '{print $3}')
+      if [ "$N" != "$M" ]; then
+        echo "Close the gap with /specship:spec behaviour $INPUT.SPEC_ID."
+      fi
+
+  - id: adversarial_review
+    kind: prompt
+    depends_on: [coverage]
+    output_type: adversarial_review
+    allowed_tools:
+      - Read
+      - Grep
+      - mcp__specship__specship_spec
+      - mcp__specship__specship_explore
+      - mcp__specship__specship_node
+      - mcp__specship__specship_search
+    prompt: |
+      Adversarial review (REQ-AUTHG-005.A3). You are NOT the implementer — your
+      job is to find what the implementation missed. This node is read-only:
+      you have no Edit, Write or Bash tool and must not try to fix anything.
+
+      Call specship_spec($INPUT.SPEC_ID) and read the spec body, including
+      every acceptance criterion.
+
+      The change under review (from git, not from the implementer's summary):
+
+      $diff.output
+
+      Report this and nothing else:
+
+      1. One line per acceptance criterion:
+         `<AC id>: satisfied | partial | unaddressed — <one sentence, grounded
+         in the diff>`. Judge from the diff and the code you read; "the
+         implementer said so" is not evidence.
+      2. `Untested new code paths:` the branches/functions this diff adds that
+         no test in the diff exercises (`none` if there are none).
+      3. `Verdict:` one line — the most serious gap a reviewer should look at
+         first, or `no gaps found`.
+
+  - id: probe_baseline
+    kind: bash
+    depends_on: [adversarial_review]
+    output_type: probe_baseline
+    bash: |
+      # REQ-THRU-008 — fingerprint every tracked change before the probe step,
+      # so the guard can prove the probes touched nothing tracked.
+      git add -A -N >/dev/null 2>&1 || true
+      git --no-pager diff HEAD | git hash-object --stdin > "$(git rev-parse --git-dir)/specship-probe-baseline"
+      echo "PROBE_BASELINE=recorded"
+
+  - id: review_probes
+    kind: prompt
+    depends_on: [probe_baseline]
+    output_type: review_probes
     allowed_tools:
+      - Read
+      - Write
+      - Bash
       - mcp__specship__specship_spec
     prompt: |
-      Report acceptance-criteria test coverage for $INPUT.SPEC_ID
-      (REQ-IMPLINT-002). Call specship_spec with the spec_id, count its
-      acceptance criteria (the .A<N> children; if the spec has none,
-      treat the requirement itself as one criterion), and count how many
-      of them carry a `tests`-kind link.
+      Try to BREAK the change for $INPUT.SPEC_ID (REQ-THRU-008). You are not
+      the implementer. For EACH acceptance criterion write at least one small
+      probe test that would fail if the criterion were not really met — an
+      edge case, a boundary, a negative case — ONLY under
+      `.specship/review-probes/` (create it). NEVER edit any tracked file: a
+      guard step fails the run if you do.
+
+      Run each probe with the project's test runner. Report one line per
+      criterion: `<AC id>: held | broke | unrun — <probe file> — <one
+      sentence>`. `unrun` means the probe could not be executed (say why);
+      never report a probe you did not run as held.
+
+      The read-only review already found:
+      $adversarial_review.output
+
+      The change (from git):
+      $diff.output
+
+  - id: review_guard
+    kind: bash
+    depends_on: [review_probes]
+    output_type: review_guard
+    bash: |
+      # REQ-THRU-008.A2 — the probe step may not change tracked files.
+      git add -A -N >/dev/null 2>&1 || true
+      NOW=$(git --no-pager diff HEAD | git hash-object --stdin)
+      BEFORE=$(cat "$(git rev-parse --git-dir)/specship-probe-baseline" 2>/dev/null)
+      if [ -n "$BEFORE" ] && [ "$NOW" != "$BEFORE" ]; then
+        echo "REVIEW_GUARD=failed"
+        echo "HALT_CAUSE=the probe step changed tracked files — probes belong under .specship/review-probes/"
+        git --no-pager diff --stat HEAD
+        exit 1
+      fi
+      echo "REVIEW_GUARD=clean"
+
+  - id: knowledge_proposals
+    kind: prompt
+    depends_on: [review_guard]
+    output_type: knowledge_proposals
+    allowed_tools:
+      - Read
+      - Write
+      - mcp__specship__specship_spec
+      - mcp__specship__specship_explore
+    prompt: |
+      Propose knowledge this change relied on, for a HUMAN to confirm
+      (REQ-KNOW-004). Domain knowledge is human-confirmed, never
+      auto-extracted (DOM-SPECSHIP-003): you only PROPOSE.
 
-      Output exactly one or two lines:
-      - "N of M acceptance criteria for $INPUT.SPEC_ID have linked tests."
-      - If N < M, add: "Close the gap with /specship:spec behaviour
-        $INPUT.SPEC_ID."
+      Write 0–5 proposal files, one fact each, ONLY under
+      `.specship/knowledge/proposals/` (create the directory). NEVER edit
+      `specs/domain/` or any tracked file. Each file is a domain fact:
+
+      ---
+      title: <short name>
+      type: term | rule | decision | constraint | external
+      area: <AREA, e.g. the prefix used by existing DOM-<AREA>-NNN facts>
+      depends_on: $INPUT.SPEC_ID
+      # external facts ONLY — verified from the installed dependency, not memory:
+      dependency: <package or tool name>
+      version: <installed version you verified against>
+      source: <file and symbol in that dependency>
+      ---
+
+      # <title>
+
+      <one paragraph: the fact, stated plainly>
+
+      ## Enforced            (optional — only for a mechanically checkable rule)
+      - `<glob>` must not match `/<regex>/`
+
+      Propose only what this change actually depended on and a future change
+      would otherwise rediscover — especially facts about third-party tools.
+      If there is nothing worth keeping, write no files.
+
+      Implementation diff summary:
+      $implement.output
+
+      Output one line per proposal file you wrote, or `NO_PROPOSALS`.
+
+  - id: knowledge_publish
+    kind: bash
+    depends_on: [knowledge_proposals]
+    output_type: knowledge_report
+    bash: |
+      # REQ-KNOW-004.A1 — the proposal step may write ONLY proposals. Any
+      # change under specs/domain/ halts the run. Proposals are then copied to
+      # the main project's .specship/knowledge/proposals/ (a run worktree's
+      # .specship/ is gitignored and would vanish), where
+      # `specship knowledge proposals` / `apply` / `reject` find them.
+      if [ -n "$(git status --porcelain -- specs/domain 2>/dev/null)" ]; then
+        echo "KNOWLEDGE_PROPOSALS=refused"
+        echo "HALT_CAUSE=the knowledge step changed specs/domain/ — only a human applies knowledge"
+        git status --porcelain -- specs/domain
+        exit 1
+      fi
+      SRC=".specship/knowledge/proposals"
+      N=0
+      if [ -d "$SRC" ]; then N=$(ls "$SRC"/*.md 2>/dev/null | wc -l | tr -d ' '); fi
+      echo "KNOWLEDGE_PROPOSALS=$N"
+      if [ "$N" -gt 0 ] && [ -n "$SPECSHIP_ARTIFACTS_DIR" ]; then
+        DEST="$(cd "$SPECSHIP_ARTIFACTS_DIR/../../.." 2>/dev/null && pwd)/knowledge/proposals"
+        mkdir -p "$DEST"
+        for f in "$SRC"/*.md; do
+          base=$(basename "$f")
+          target="$DEST/$base"
+          i=2
+          while [ -e "$target" ]; do target="$DEST/${base%.md}-$i.md"; i=$((i+1)); done
+          cp "$f" "$target"
+          echo "- $(basename "$target") ($(sed -n 's/^title: //p' "$f" | head -1))"
+        done
+        echo "Review with: specship knowledge proposals · apply <id> · reject <id>"
+      fi
 
   - id: final_review
     kind: approval
-    depends_on: [coverage]
+    depends_on: [adversarial_review, knowledge_publish]
     message: |
       Implementation complete for $INPUT.SPEC_ID.
 
-      Links asserted:
+      Changes (git diff --stat — measured, not summarized):
+      $diff_stat.output
+
+      Lint / typecheck:
+      $quality_recheck.output
+
+      Mechanical postcheck (verifies symbols, CHANGELOG, project checks):
+      $postcheck_recheck.output
+
+      Suppression scan (new noqa / eslint-disable / @ts-ignore):
+      $suppression_gate.output
+
+      Links recorded in the spec (ingest the test report after merge with the
+      `specship verify --report` command named here):
       $link.output
 
       Acceptance-criteria test coverage:
       $coverage.output
 
+      Adversarial review:
+      $adversarial_review.output
+
+      Review probes (held | broke | unrun per criterion):
+      $review_probes.output
+
+      Knowledge proposals (nothing is applied until you run
+      `specship knowledge apply <id>`):
+      $knowledge_publish.output
+
       Approve to finalize the run (worktree is left for you to inspect
       and merge), or reject to abandon.