@specship/specship-win32-arm64 0.25.0 → 0.28.0

package/lib/dist/workflows/defaults/spec-implement.yaml

@@ -14,8 +14,9 @@ inputs:
 systemPromptAppend: |
   You are implementing a specific requirement. Before editing code, call
   specship_spec($INPUT.SPEC_ID) to see the spec body and any code it
-  already links to. After editing, call specship_link_assert with the
-  spec_id and the symbol you implemented BEFORE reporting done.
+  already links to. After editing, record each symbol you implemented as a
+  `path:Symbol` bullet under the requirement's `implementations:` block in
+  its spec file — links in the spec file survive any reindex.
 
   JIRA-backed specs (REQ-JIRAPUB-004): if the spec file's frontmatter
   carries a `jira_issue:` key, EVERY git commit message you write for this
@@ -41,9 +42,30 @@ nodes:
       (b) which code areas / symbols are most relevant, and (c) whether
       any code currently claims to implement it (look at linked_code).
 
+  - id: readiness
+    kind: bash
+    depends_on: [fetch_spec]
+    output_type: readiness_report
+    timeout: 120000
+    bash: |
+      # REQ-PIPETRUST-004 — implement must not start on a spec that is not
+      # ready (lint errors, no criteria, a criterion still [needs review]).
+      # Also records the run's base commit so postcheck can diff against it.
+      git rev-parse HEAD > "$(git rev-parse --git-dir)/specship-run-base" 2>/dev/null || true
+      if [ -n "$SPECSHIP_CLI_SCRIPT" ]; then ss_cli() { "$SPECSHIP_CLI_NODE" "$SPECSHIP_CLI_SCRIPT" "$@"; }; SS=ss_cli
+      elif command -v specship >/dev/null 2>&1; then SS=specship
+      elif [ -x node_modules/.bin/specship ]; then SS=node_modules/.bin/specship
+      else SS=""
+      fi
+      if [ -z "$SS" ]; then
+        echo "READY=unavailable — specship CLI not found; the readiness gate did NOT run"
+        exit 1
+      fi
+      $SS ready $INPUT.SPEC_ID --path .
+
   - id: plan
     kind: prompt
-    depends_on: [fetch_spec]
+    depends_on: [fetch_spec, readiness]
     output_type: plan
     allowed_tools:
       - mcp__specship__specship_explore
@@ -55,6 +77,17 @@ nodes:
 
       $fetch_spec.output
 
+      Readiness + evidence plan (every acceptance criterion needs a test of
+      the stated kind, written as a NAMED function passed to it() with the
+      criterion id in its title):
+      $readiness.output
+
+      Domain facts that `specship_spec` returns with the requirement are
+      constraints, not background: honour each external fact's verified
+      version, and treat every `## Enforced` rule (`<glob>` must not match
+      `/<regex>/`) as a hard constraint — `specship knowledge check` fails the
+      run on a violation (REQ-KNOW-005).
+
       The plan should list:
       - Files to create or modify (with project-relative paths)
       - Specific functions/methods/classes to add or change
@@ -63,23 +96,93 @@ nodes:
 
       Keep it tight (≤500 words). Do NOT edit code in this step.
 
+  - id: plan_scope
+    kind: bash
+    depends_on: [plan]
+    output_type: plan_scope
+    bash: |
+      # REQ-THRU-003 — opt-in auto-approval of a small, in-scope plan. Prints
+      # AUTO_APPROVE=yes only when specship.config.json opts in, the plan
+      # names only the requirement's implementation files (plus tests, its
+      # spec and CHANGELOG.md), and the requirement has few criteria.
+      PLAN=$plan.output
+      F="$(mktemp)"
+      printf '%s\n' "$PLAN" > "$F"
+      if [ -n "$SPECSHIP_CLI_SCRIPT" ]; then "$SPECSHIP_CLI_NODE" "$SPECSHIP_CLI_SCRIPT" plan-scope $INPUT.SPEC_ID --plan-file "$F" --path .
+      elif command -v specship >/dev/null 2>&1; then specship plan-scope $INPUT.SPEC_ID --plan-file "$F" --path . || echo "AUTO_APPROVE=no"
+      else echo "AUTO_APPROVE=no"; echo "- specship CLI not found"
+      fi
+      rm -f "$F"
+
   - id: approve_plan
     kind: approval
-    depends_on: [plan]
+    depends_on: [plan, plan_scope]
+    auto_approve:
+      from: plan_scope
+      marker: AUTO_APPROVE=yes
     message: |
       Plan ready for $INPUT.SPEC_ID. Review the plan output and approve
       to proceed with implementation, or reject with feedback to revise.
     capture_response: true
     on_reject:
+      # The reviewer's rejection reason is appended to this prompt
+      # automatically; the revision replaces $plan.output downstream.
       prompt: |
-        The plan was rejected with this feedback. Revise:
+        The plan was rejected (feedback follows). Revise the plan to
+        address it and output the full revised plan.
 
-        $approve_plan.output
+        Current plan:
+        $plan.output
+      revises: plan
       max_attempts: 3
 
+  - id: quality_baseline
+    kind: bash
+    depends_on: [approve_plan]
+    output_type: quality_report
+    timeout: 600000
+    bash: |
+      # REQ-AUTHG-008.A1 — run the project's quality command BEFORE implement
+      # edits anything, so the gate can tell errors this change introduced
+      # from errors the worktree already had (a sub-package with no built
+      # parent, known lint debt). The baseline lives under the worktree's git
+      # dir, so it never shows up in the diff. It is written ONLY when the
+      # pre-change command fails: a clean baseline means any later failure is
+      # the change's, so the gate keeps its full strictness (A5 fallback).
+      qnorm() { sed -E 's/\([0-9]+,[0-9]+\)//g; s/:[0-9]+:[0-9]+/:/g; s/:[0-9]+:/:/g' | sed -E '/^[[:space:]]*$/d' | sort -u; }
+      BASELINE="$(git rev-parse --git-dir 2>/dev/null)/specship-quality-baseline.txt"
+      rm -f "$BASELINE"
+      QUALITY_CMD=""
+      if [ -f package.json ]; then
+        if [ ! -d node_modules ]; then
+          npm ci --no-audit --no-fund >/dev/null 2>&1 || npm install --no-audit --no-fund >/dev/null 2>&1 || true
+        fi
+        if node -e 'const s=(require("./package.json").scripts)||{};process.exit(s.lint?0:1)' 2>/dev/null; then
+          QUALITY_CMD="npm run lint --if-present"
+        elif [ -f tsconfig.json ]; then
+          QUALITY_CMD="npx --no-install tsc --noEmit"
+        fi
+      elif [ -f Cargo.toml ]; then
+        if command -v cargo >/dev/null 2>&1; then QUALITY_CMD="cargo clippy --no-deps"; fi
+      elif [ -f pyproject.toml ] || [ -f requirements.txt ]; then
+        if command -v ruff >/dev/null 2>&1; then QUALITY_CMD="ruff check ."; fi
+      fi
+      if [ -z "$QUALITY_CMD" ]; then
+        echo "QUALITY_BASELINE=skipped"
+        exit 0
+      fi
+      if OUT=$($QUALITY_CMD 2>&1); then
+        echo "QUALITY_BASELINE=clean"
+      else
+        printf '%s\n' "$OUT" | qnorm > "$BASELINE"
+        echo "QUALITY_BASELINE=recorded"
+        echo "QUALITY_BASELINE_LINES=$(wc -l < "$BASELINE" | tr -d ' ')"
+      fi
+      exit 0
+
   - id: implement
     kind: prompt
-    depends_on: [approve_plan]
+    depends_on: [approve_plan, quality_baseline]
     output_type: diff
     allowed_tools:
       - Read
@@ -92,12 +195,23 @@ nodes:
     prompt: |
       Implement the approved plan. Follow it closely.
 
+      Domain facts that `specship_spec` returns with the requirement are
+      constraints, not background: honour each external fact's verified
+      version, and treat every `## Enforced` rule (`<glob>` must not match
+      `/<regex>/`) as a hard constraint — `specship knowledge check` fails the
+      run on a violation (REQ-KNOW-005).
+
       Plan:
       $plan.output
 
       Approval feedback (if any):
       $approve_plan.output
 
+      Readiness + evidence plan (every acceptance criterion needs a test of
+      the stated kind, written as a NAMED function passed to it() with the
+      criterion id in its title):
+      $readiness.output
+
       When done, output a short diff summary (which files changed and why).
 
   - id: quality_gate
@@ -135,8 +249,26 @@ nodes:
         exit 0
       fi
       echo "QUALITY_CMD=$QUALITY_CMD"
+      qnorm() { sed -E 's/\([0-9]+,[0-9]+\)//g; s/:[0-9]+:[0-9]+/:/g; s/:[0-9]+:/:/g' | sed -E '/^[[:space:]]*$/d' | sort -u; }
+      BASELINE="$(git rev-parse --git-dir 2>/dev/null)/specship-quality-baseline.txt"
       if OUT=$($QUALITY_CMD 2>&1); then
         echo "QUALITY_GATE=passed"
+      elif [ -f "$BASELINE" ]; then
+        # REQ-AUTHG-008.A2/A3 — judge only error lines absent from the
+        # pre-change baseline; report pre-existing ones, never hide them.
+        NEW=$(printf '%s\n' "$OUT" | qnorm | comm -13 "$BASELINE" - | grep -iE 'error' || true)
+        PRE=$(printf '%s\n' "$OUT" | qnorm | comm -12 "$BASELINE" - | grep -ciE 'error' || true)
+        if [ -z "$NEW" ]; then
+          echo "QUALITY_GATE=passed"
+          echo "QUALITY_PREEXISTING=$PRE"
+          echo "Pre-existing errors (already failing before implement; not caused by this change), sample:"
+          printf '%s\n' "$OUT" | grep -iE 'error' | head -n 5
+        else
+          echo "QUALITY_GATE=failed"
+          echo "QUALITY_PREEXISTING=$PRE"
+          echo "New errors introduced by this change:"
+          printf '%s\n' "$NEW" | tail -n 80
+        fi
       else
         echo "QUALITY_GATE=failed"
         printf '%s\n' "$OUT" | tail -n 80
@@ -194,14 +326,142 @@ nodes:
         echo "QUALITY_RESULT=clean"
         exit 0
       fi
-      echo "QUALITY_RESULT=failed"
-      printf '%s\n' "$OUT" | tail -n 80
+      qnorm() { sed -E 's/\([0-9]+,[0-9]+\)//g; s/:[0-9]+:[0-9]+/:/g; s/:[0-9]+:/:/g' | sed -E '/^[[:space:]]*$/d' | sort -u; }
+      BASELINE="$(git rev-parse --git-dir 2>/dev/null)/specship-quality-baseline.txt"
+      if [ -f "$BASELINE" ]; then
+        # REQ-AUTHG-008.A2/A3 — only errors absent from the baseline halt.
+        NEW=$(printf '%s\n' "$OUT" | qnorm | comm -13 "$BASELINE" - | grep -iE 'error' || true)
+        if [ -z "$NEW" ]; then
+          echo "QUALITY_RESULT=clean"
+          echo "QUALITY_PREEXISTING=$(printf '%s\n' "$OUT" | qnorm | comm -12 "$BASELINE" - | grep -ciE 'error' || true)"
+          exit 0
+        fi
+        echo "QUALITY_RESULT=failed"
+        printf '%s\n' "$NEW" | tail -n 80
+      else
+        echo "QUALITY_RESULT=failed"
+        printf '%s\n' "$OUT" | tail -n 80
+      fi
       echo "HALT_CAUSE=lint/typecheck still fails after the fix attempt — the change is not reviewable yet"
       exit 1
 
-  - id: diff
+  - id: postcheck
     kind: bash
     depends_on: [quality_recheck]
+    output_type: postcheck_report
+    timeout: 600000
+    bash: |
+      # REQ-PIPETRUST-005 — check the agent's work mechanically: verifies
+      # bullets are real named test symbols covering every criterion, a src
+      # change has a CHANGELOG entry, and project-configured checks pass
+      # (their fix commands run first). Exit 0 always: the POSTCHECK marker
+      # routes the fix step; postcheck_recheck is what halts.
+      if [ -n "$SPECSHIP_CLI_SCRIPT" ]; then ss_cli() { "$SPECSHIP_CLI_NODE" "$SPECSHIP_CLI_SCRIPT" "$@"; }; SS=ss_cli
+      elif command -v specship >/dev/null 2>&1; then SS=specship
+      elif [ -x node_modules/.bin/specship ]; then SS=node_modules/.bin/specship
+      else SS=""
+      fi
+      if [ -z "$SS" ]; then
+        echo "POSTCHECK=failed"
+        echo "specship CLI not found — postcheck did NOT run"
+        exit 0
+      fi
+      $SS postcheck $INPUT.SPEC_ID --path . --fix || true
+
+  - id: fix_postcheck
+    kind: prompt
+    depends_on: [postcheck]
+    output_type: postcheck_fix
+    allowed_tools:
+      - Read
+      - Edit
+      - Write
+      - Bash
+      - mcp__specship__specship_spec
+    prompt: |
+      Mechanical post-implement check for $INPUT.SPEC_ID:
+
+      $postcheck.output
+
+      Route on the POSTCHECK marker — do not re-judge:
+
+      - POSTCHECK=passed → change NOTHING. Output exactly
+        `FIX_POSTCHECK=not-needed` and stop.
+      - POSTCHECK=failed → fix every ✗ finding:
+        - [verifies] — every acceptance criterion needs a test written as a
+          NAMED function passed to it(), with the criterion id in the it()
+          title, listed under the requirement's `verifies:` block in its spec
+          file as `path:FunctionName` (never an it() title string).
+        - [changelog] — add a plain-sentence, user-facing entry under
+          `## [Unreleased]` in CHANGELOG.md (no internal paths or symbols).
+        - [command] — make the named check pass by fixing the cause.
+        A bash step re-runs postcheck after you; any finding left halts the run.
+
+      Output `FIX_POSTCHECK=fixed` or `FIX_POSTCHECK=still-failing` followed
+      by what remains.
+
+  - id: postcheck_recheck
+    kind: bash
+    depends_on: [fix_postcheck]
+    output_type: postcheck_result
+    timeout: 600000
+    bash: |
+      # REQ-PIPETRUST-005.A5 — the authoritative half: re-run and halt while
+      # anything still fails, so an unlinked or undocumented change never
+      # reaches verify or the human gate.
+      if [ -n "$SPECSHIP_CLI_SCRIPT" ]; then ss_cli() { "$SPECSHIP_CLI_NODE" "$SPECSHIP_CLI_SCRIPT" "$@"; }; SS=ss_cli
+      elif command -v specship >/dev/null 2>&1; then SS=specship
+      elif [ -x node_modules/.bin/specship ]; then SS=node_modules/.bin/specship
+      else SS=""
+      fi
+      if [ -z "$SS" ]; then
+        echo "POSTCHECK_RESULT=failed"
+        echo "HALT_CAUSE=specship CLI not found — postcheck did NOT run"
+        exit 1
+      fi
+      if OUT=$($SS postcheck $INPUT.SPEC_ID --path . 2>&1); then
+        echo "POSTCHECK_RESULT=clean"
+        printf '%s\n' "$OUT"
+        exit 0
+      fi
+      echo "POSTCHECK_RESULT=failed"
+      printf '%s\n' "$OUT"
+      echo "HALT_CAUSE=postcheck still fails after the fix attempt — the change is not reviewable yet"
+      exit 1
+
+  - id: suppression_gate
+    kind: bash
+    depends_on: [postcheck_recheck]
+    output_type: suppression_report
+    bash: |
+      # REQ-QGATE-004.A3 — deterministic scan for lint/type suppression
+      # comments the change introduces (noqa, eslint-disable, @ts-ignore, …).
+      # The fix_quality prompt forbids silencing rules; this node enforces it
+      # in code. SUPPRESSION_GATE is the marker contract: a scan that could
+      # not run is `skipped`, never `clean`.
+      # REQ-PIPETRUST-006.A4 — prefer the CLI running this workflow over any
+      # (possibly older) `specship` on PATH.
+      if [ -n "$SPECSHIP_CLI_SCRIPT" ]; then ss_cli() { "$SPECSHIP_CLI_NODE" "$SPECSHIP_CLI_SCRIPT" "$@"; }; SS=ss_cli
+      elif command -v specship >/dev/null 2>&1; then SS=specship
+      elif [ -x node_modules/.bin/specship ]; then SS=node_modules/.bin/specship
+      elif [ -x dist/bin/specship.js ]; then SS="node dist/bin/specship.js"
+      else SS=""; fi
+      if [ -z "$SS" ]; then
+        echo "SUPPRESSION_GATE=skipped"
+        echo "SUPPRESSION_REASON=specship CLI not found — suppression scan did NOT run"
+        exit 0
+      fi
+      if OUT=$($SS suppressions 2>&1); then
+        printf '%s\n' "$OUT"
+      else
+        printf '%s\n' "$OUT"
+        echo "HALT_CAUSE=the change introduces lint/type suppression comments — fix the code instead of silencing the rule"
+        exit 1
+      fi
+
+  - id: diff
+    kind: bash
+    depends_on: [suppression_gate]
     output_type: diff
     bash: |
       # REQ-AUTHG-004.A1 — the full diff, from git, into a run artifact. The
@@ -252,7 +512,16 @@ nodes:
           fi
         fi
         if ! npm run build --if-present; then echo "VERIFY_RESULT=build-failed"; exit 1; fi
-        if npm test; then echo "VERIFY_RESULT=ran-and-passed"; else echo "VERIFY_RESULT=ran-and-failed"; exit 1; fi
+        # REQ-PIPETRUST-006.A3 — a vitest project also leaves a JSON report in
+        # the run's artifacts, ingestible with `specship verify --report`.
+        TEST_ARGS=""
+        if [ -n "$SPECSHIP_ARTIFACTS_DIR" ] && node -e 'const s=((require("./package.json").scripts)||{}).test||"";process.exit(/^\s*vitest\b/.test(s)?0:1)' 2>/dev/null; then
+          mkdir -p "$SPECSHIP_ARTIFACTS_DIR"
+          REPORT="$SPECSHIP_ARTIFACTS_DIR/test-report.json"
+          TEST_ARGS="-- --reporter=default --reporter=json --outputFile.json=$REPORT"
+          echo "VERIFY_REPORT=$REPORT (ingest after merge: specship verify --report $REPORT)"
+        fi
+        if npm test $TEST_ARGS; then echo "VERIFY_RESULT=ran-and-passed"; else echo "VERIFY_RESULT=ran-and-failed"; exit 1; fi
       elif [ -f Cargo.toml ]; then
         if ! cargo build; then echo "VERIFY_RESULT=build-failed"; exit 1; fi
         if cargo test; then echo "VERIFY_RESULT=ran-and-passed"; else echo "VERIFY_RESULT=ran-and-failed"; exit 1; fi
@@ -302,49 +571,47 @@ nodes:
     depends_on: [route_verify]
     output_type: link_summary
     allowed_tools:
-      - mcp__specship__specship_link_assert
-      - mcp__specship__specship_link_verify
+      - Read
+      - Edit
       - mcp__specship__specship_spec
     prompt: |
-      Assert spec→code links for the changes made in the implement step.
-      For each symbol that implements $INPUT.SPEC_ID (or its child
-      requirements), call specship_link_assert with the spec_id, the
-      file path, and the qualified symbol name.
-
-      You MUST NOT assert a `tests`-kind link (REQ-REVINT-005.A1). Every
-      specship_link_assert call here is an implementation link — leave `kind`
-      at its default and never pass kind: 'tests'. Test evidence is
-      file-derived only: it comes from the spec's `verifies:` block or an
-      `@verifies` comment on the test symbol, never from this node. A workflow
-      that minted its own test evidence would be promoting itself past the
-      gate that exists to check it.
-
-      Then act on LINK_ACTION, which a bash node already computed from the
-      VERIFY_RESULT marker (REQ-VSTATE-005.A1). Do NOT re-derive it from the
-      test log — read it:
+      Record spec→code links for the changes made in the implement step —
+      durably, in the spec file (REQ-PIPETRUST-006). Do NOT call
+      specship_link_assert or specship_link_verify: runtime links vanish on a
+      full reindex, and a headless run cannot be granted them.
+
+      Open the spec file that declares $INPUT.SPEC_ID. Under the requirement:
+      - `implementations:` — one `path:Symbol` bullet per symbol that
+        implements it (qualified `Class.method` for methods). Add any that
+        are missing; never duplicate an existing bullet.
+      - `verifies:` — leave as the postcheck step left it (named test
+        functions only). Never add an it() title string.
+
+      You MUST NOT assert a `tests`-kind link (REQ-REVINT-005.A1) —
+      never pass kind: 'tests', and never mint test evidence: it comes only
+      from the spec's `verifies:` block or an `@verifies` comment on a test
+      symbol.
+
+      Verification state is not yours to set, so you
+      do NOT call specship_link_verify, whatever LINK_ACTION says. On
+      LINK_ACTION=assert-and-verify-pass, LINK_ACTION=assert-and-verify-fail
+      or LINK_ACTION=assert-only alike, record the implementations bullets
+      only: tests that ran are in the run's JSON test report (see the verify
+      output) and are ingested with `specship verify --report` after the
+      branch merges; tests that did not run are never reported as passing.
+
+      Routing context (computed by a bash node from VERIFY_RESULT):
 
       $route_verify.output
 
-      - LINK_ACTION=assert-and-verify-pass → after each assert, call
-        specship_link_verify with result="pass".
-      - LINK_ACTION=assert-and-verify-fail → call specship_link_verify with
-        result="fail" and the failing test name as the reason.
-      - LINK_ACTION=assert-only → do NOT call specship_link_verify at all;
-        the links stay in the `implemented` state. Tests that did not run
-        are never reported as passing.
-
-      A run whose environment or build broke never reaches this node — the
-      routing step halts it first (REQ-VSTATE-005.A3).
-
       Implementation diff summary:
       $implement.output
 
       Test results:
       $verify.output
 
-      Output: a short list of "spec_id → file:symbol [verified|implemented]"
-      lines, ending with one line stating whether verification ran or was
-      skipped.
+      Output: a short list of "spec_id → file:symbol" lines you recorded,
+      ending with the VERIFY_REPORT line from the verify output if present.
 
   - id: coverage
     kind: bash
@@ -356,7 +623,10 @@ nodes:
       # `getSpecCoverage` report the MCP tool and the dashboard read, so the
       # number on the approval gate cannot disagree with them. It used to be
       # counted by a prompt.
-      if command -v specship >/dev/null 2>&1; then SS=specship
+      # REQ-PIPETRUST-006.A4 — prefer the CLI running this workflow over any
+      # (possibly older) `specship` on PATH.
+      if [ -n "$SPECSHIP_CLI_SCRIPT" ]; then ss_cli() { "$SPECSHIP_CLI_NODE" "$SPECSHIP_CLI_SCRIPT" "$@"; }; SS=ss_cli
+      elif command -v specship >/dev/null 2>&1; then SS=specship
       elif [ -x node_modules/.bin/specship ]; then SS=node_modules/.bin/specship
       elif [ -x dist/bin/specship.js ]; then SS="node dist/bin/specship.js"
       else SS=""; fi
@@ -409,9 +679,144 @@ nodes:
       3. `Verdict:` one line — the most serious gap a reviewer should look at
          first, or `no gaps found`.
 
+  - id: probe_baseline
+    kind: bash
+    depends_on: [adversarial_review]
+    output_type: probe_baseline
+    bash: |
+      # REQ-THRU-008 — fingerprint every tracked change before the probe step,
+      # so the guard can prove the probes touched nothing tracked.
+      git add -A -N >/dev/null 2>&1 || true
+      git --no-pager diff HEAD | git hash-object --stdin > "$(git rev-parse --git-dir)/specship-probe-baseline"
+      echo "PROBE_BASELINE=recorded"
+
+  - id: review_probes
+    kind: prompt
+    depends_on: [probe_baseline]
+    output_type: review_probes
+    allowed_tools:
+      - Read
+      - Write
+      - Bash
+      - mcp__specship__specship_spec
+    prompt: |
+      Try to BREAK the change for $INPUT.SPEC_ID (REQ-THRU-008). You are not
+      the implementer. For EACH acceptance criterion write at least one small
+      probe test that would fail if the criterion were not really met — an
+      edge case, a boundary, a negative case — ONLY under
+      `.specship/review-probes/` (create it). NEVER edit any tracked file: a
+      guard step fails the run if you do.
+
+      Run each probe with the project's test runner. Report one line per
+      criterion: `<AC id>: held | broke | unrun — <probe file> — <one
+      sentence>`. `unrun` means the probe could not be executed (say why);
+      never report a probe you did not run as held.
+
+      The read-only review already found:
+      $adversarial_review.output
+
+      The change (from git):
+      $diff.output
+
+  - id: review_guard
+    kind: bash
+    depends_on: [review_probes]
+    output_type: review_guard
+    bash: |
+      # REQ-THRU-008.A2 — the probe step may not change tracked files.
+      git add -A -N >/dev/null 2>&1 || true
+      NOW=$(git --no-pager diff HEAD | git hash-object --stdin)
+      BEFORE=$(cat "$(git rev-parse --git-dir)/specship-probe-baseline" 2>/dev/null)
+      if [ -n "$BEFORE" ] && [ "$NOW" != "$BEFORE" ]; then
+        echo "REVIEW_GUARD=failed"
+        echo "HALT_CAUSE=the probe step changed tracked files — probes belong under .specship/review-probes/"
+        git --no-pager diff --stat HEAD
+        exit 1
+      fi
+      echo "REVIEW_GUARD=clean"
+
+  - id: knowledge_proposals
+    kind: prompt
+    depends_on: [review_guard]
+    output_type: knowledge_proposals
+    allowed_tools:
+      - Read
+      - Write
+      - mcp__specship__specship_spec
+      - mcp__specship__specship_explore
+    prompt: |
+      Propose knowledge this change relied on, for a HUMAN to confirm
+      (REQ-KNOW-004). Domain knowledge is human-confirmed, never
+      auto-extracted (DOM-SPECSHIP-003): you only PROPOSE.
+
+      Write 0–5 proposal files, one fact each, ONLY under
+      `.specship/knowledge/proposals/` (create the directory). NEVER edit
+      `specs/domain/` or any tracked file. Each file is a domain fact:
+
+      ---
+      title: <short name>
+      type: term | rule | decision | constraint | external
+      area: <AREA, e.g. the prefix used by existing DOM-<AREA>-NNN facts>
+      depends_on: $INPUT.SPEC_ID
+      # external facts ONLY — verified from the installed dependency, not memory:
+      dependency: <package or tool name>
+      version: <installed version you verified against>
+      source: <file and symbol in that dependency>
+      ---
+
+      # <title>
+
+      <one paragraph: the fact, stated plainly>
+
+      ## Enforced            (optional — only for a mechanically checkable rule)
+      - `<glob>` must not match `/<regex>/`
+
+      Propose only what this change actually depended on and a future change
+      would otherwise rediscover — especially facts about third-party tools.
+      If there is nothing worth keeping, write no files.
+
+      Implementation diff summary:
+      $implement.output
+
+      Output one line per proposal file you wrote, or `NO_PROPOSALS`.
+
+  - id: knowledge_publish
+    kind: bash
+    depends_on: [knowledge_proposals]
+    output_type: knowledge_report
+    bash: |
+      # REQ-KNOW-004.A1 — the proposal step may write ONLY proposals. Any
+      # change under specs/domain/ halts the run. Proposals are then copied to
+      # the main project's .specship/knowledge/proposals/ (a run worktree's
+      # .specship/ is gitignored and would vanish), where
+      # `specship knowledge proposals` / `apply` / `reject` find them.
+      if [ -n "$(git status --porcelain -- specs/domain 2>/dev/null)" ]; then
+        echo "KNOWLEDGE_PROPOSALS=refused"
+        echo "HALT_CAUSE=the knowledge step changed specs/domain/ — only a human applies knowledge"
+        git status --porcelain -- specs/domain
+        exit 1
+      fi
+      SRC=".specship/knowledge/proposals"
+      N=0
+      if [ -d "$SRC" ]; then N=$(ls "$SRC"/*.md 2>/dev/null | wc -l | tr -d ' '); fi
+      echo "KNOWLEDGE_PROPOSALS=$N"
+      if [ "$N" -gt 0 ] && [ -n "$SPECSHIP_ARTIFACTS_DIR" ]; then
+        DEST="$(cd "$SPECSHIP_ARTIFACTS_DIR/../../.." 2>/dev/null && pwd)/knowledge/proposals"
+        mkdir -p "$DEST"
+        for f in "$SRC"/*.md; do
+          base=$(basename "$f")
+          target="$DEST/$base"
+          i=2
+          while [ -e "$target" ]; do target="$DEST/${base%.md}-$i.md"; i=$((i+1)); done
+          cp "$f" "$target"
+          echo "- $(basename "$target") ($(sed -n 's/^title: //p' "$f" | head -1))"
+        done
+        echo "Review with: specship knowledge proposals · apply <id> · reject <id>"
+      fi
+
   - id: final_review
     kind: approval
-    depends_on: [adversarial_review]
+    depends_on: [adversarial_review, knowledge_publish]
     message: |
       Implementation complete for $INPUT.SPEC_ID.
 
@@ -421,7 +826,14 @@ nodes:
       Lint / typecheck:
       $quality_recheck.output
 
-      Links asserted:
+      Mechanical postcheck (verifies symbols, CHANGELOG, project checks):
+      $postcheck_recheck.output
+
+      Suppression scan (new noqa / eslint-disable / @ts-ignore):
+      $suppression_gate.output
+
+      Links recorded in the spec (ingest the test report after merge with the
+      `specship verify --report` command named here):
       $link.output
 
       Acceptance-criteria test coverage:
@@ -430,5 +842,12 @@ nodes:
       Adversarial review:
       $adversarial_review.output
 
+      Review probes (held | broke | unrun per criterion):
+      $review_probes.output
+
+      Knowledge proposals (nothing is applied until you run
+      `specship knowledge apply <id>`):
+      $knowledge_publish.output
+
       Approve to finalize the run (worktree is left for you to inspect
       and merge), or reject to abandon.

package/lib/dist/workflows/discovery.d.ts

@@ -43,4 +43,17 @@ export declare function discoverWorkflows(projectRoot: string): WorkflowLoadResu
  * Returns null if no workflow with that name exists in any scope.
  */
 export declare function loadWorkflowByName(projectRoot: string, name: string): WorkflowWithSource | null;
+/**
+ * Resolve `extends: <workflow>` + `node_overrides` (THROUGHPUT-DOC,
+ * REQ-THRU-004): the result is the base workflow's raw definition with the
+ * extending file's top-level fields on top and each named node's fields
+ * shallow-merged from `node_overrides`. One source for shared nodes — a
+ * variant like spec-implement-mixed only states what differs. Chains resolve
+ * recursively; a cycle, an unknown base, or an override naming no base node
+ * is an error.
+ */
+export declare function resolveExtends(raw: Record<string, unknown>, getBase: (name: string) => Record<string, unknown> | undefined, seen?: Set<string>): {
+    value?: Record<string, unknown>;
+    errors: ValidationError[];
+};
 //# sourceMappingURL=discovery.d.ts.map

package/lib/dist/workflows/discovery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"discovery.d.ts","sourceRoot":"","sources":["../../src/workflows/discovery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAMH,OAAO,EACL,kBAAkB,EAElB,eAAe,EAChB,MAAM,oBAAoB,CAAC;AAG5B,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;AAE7D,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,KAAK,EAAE,aAAa,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,aAAa,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,eAAe,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,kBAAkB;IACjC,yDAAyD;IACzD,SAAS,EAAE,kBAAkB,EAAE,CAAC;IAChC,uCAAuC;IACvC,MAAM,EAAE,iBAAiB,EAAE,CAAC;CAC7B;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,kBAAkB,CAoCzE;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,GACX,kBAAkB,GAAG,IAAI,CAG3B"}
+{"version":3,"file":"discovery.d.ts","sourceRoot":"","sources":["../../src/workflows/discovery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAMH,OAAO,EACL,kBAAkB,EAElB,eAAe,EAChB,MAAM,oBAAoB,CAAC;AAG5B,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;AAE7D,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,KAAK,EAAE,aAAa,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,aAAa,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,eAAe,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,kBAAkB;IACjC,yDAAyD;IACzD,SAAS,EAAE,kBAAkB,EAAE,CAAC;IAChC,uCAAuC;IACvC,MAAM,EAAE,iBAAiB,EAAE,CAAC;CAC7B;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,kBAAkB,CA4CzE;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,GACX,kBAAkB,GAAG,IAAI,CAG3B;AAuFD;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAC9D,IAAI,GAAE,GAAG,CAAC,MAAM,CAAa,GAC5B;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,MAAM,EAAE,eAAe,EAAE,CAAA;CAAE,CAiChE"}