@try-works/dsh-recursive-mode 0.1.0

package/scripts/test-recursive-mode-smoke.ts

@@ -0,0 +1,204 @@
+#!/usr/bin/env -S npx tsx
+/**
+ * dsh-recursive-mode smoke harness (R7). Exercises the Phase A completion
+ * surfaces end-to-end against a throwaway workspace on D:, workspace-scoped:
+ *   R1  workspace root resolution (never scans other workspaces)
+ *   R2  closeout scaffold
+ *   R4  /recursive command grammar + scoped execution
+ *   R5  scratch lifecycle
+ *   R6  bootstrap idempotency + Stage B
+ * Run:  npx tsx scripts/test-recursive-mode-smoke.ts
+ */
+import { mkdtempSync, rmSync, mkdirSync, writeFileSync, existsSync, readFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { tmpdir } from 'node:os'
+
+import { bootstrapScaffold, enumerateRuns, stageBWorkflowInit } from '../src/bootstrap.ts'
+import { executeRecursiveCommand, parseRecursiveCommand } from '../src/commands.ts'
+import { closeoutPhase } from '../src/closeout.ts'
+import { readScratch, writeScratch } from '../src/scratch.ts'
+import { resolveControlPlaneRoot, makeWorkspaceResolver } from '../src/workspace.ts'
+import { lockHashFromContent } from '../src/lock.ts'
+import { buildReviewBundle, contentSha256 } from '../src/review.ts'
+import { createHandoff, createChildBrief, replyPath, childScratchPath, buildDelegationPrompt } from '../src/handoff.ts'
+import { resolveRole, capabilityProbe, loadRouterPolicy } from '../src/router.ts'
+import { validateReferences, writeActionRecord, reviewOutputSchema } from '../src/delegation.ts'
+import { writeChildScratch, readParentScratch } from '../src/scratch.ts'
+import { foldRecursivePhase, validateTransition, LifecycleDriver, coupleGateBlockToGoal, type SessionEventLike, type PhaseTransitionIntent } from '../src/lifecycle.ts'
+import { runCreated, phase, phaseLocked, gateBlocked, tamper, runMerged, runState } from '../src/events.ts'
+import { foldRecursiveProjection, emptyRecursiveFoldState, recursiveProjectionUnit, isInsideWorkspace } from '../src/projection.ts'
+import { columnForRun, cardFacts, nodeKeyOf, expandPhaseRows } from '../src/client/derive.ts'
+import { evaluatePreStepGate, evaluateToolGuard, resolveEnforcementConfig, DEFAULT_ENFORCEMENT, detectTamper } from '../src/enforcement.ts'
+import { renderRecursivePolicy } from '../src/policy.ts'
+
+let failures = 0
+function check(name: string, ok: boolean, detail = '') {
+  console.log((ok ? '  [PASS] ' : '  [FAIL] ') + name + (detail ? ' — ' + detail : ''))
+  if (!ok) failures++
+}
+
+async function main() {
+  console.log('dsh-recursive-mode smoke (R7)')
+  const base = join(process.env.TEMP || tmpdir(), 'rm-smoke-' + Date.now())
+  mkdirSync(base, { recursive: true })
+  const wsA = join(base, 'ws-a')
+  const wsB = join(base, 'ws-b')
+  mkdirSync(wsA, { recursive: true })
+  mkdirSync(wsB, { recursive: true })
+
+  try {
+    // R6 bootstrap idempotency
+    const b1 = bootstrapScaffold(wsA)
+    check('R6 bootstrap creates scaffold', b1.created.length > 0, b1.created.join(','))
+    const b2 = bootstrapScaffold(wsA)
+    check('R6 bootstrap idempotent (no-op)', b2.created.length === 0, 'created=' + b2.created.length)
+    check('R6 scaffold files exist', existsSync(join(wsA, '.recursive', 'RECURSIVE.md')))
+
+    // R6 Stage B new + resume
+    mkdirSync(join(wsA, '.recursive', 'run', '10-smoke'), { recursive: true })
+    const sNew = stageBWorkflowInit({ root: wsA, source: 'new' })
+    check('R6 Stage B new bootstraps', sNew.bootstrapped === true || sNew.runs.length > 0, 'runs=' + sNew.runs.join(','))
+    const sResume = stageBWorkflowInit({ root: wsA, source: 'resume', activeRunId: '10-smoke' })
+    check('R6 Stage B resume never re-bootstraps', sResume.bootstrapped === false, 'bootstrapped=' + String(sResume.bootstrapped))
+    check('R6 enumerate runs dir-names only', sResume.runs.includes('10-smoke'))
+
+    // R1 workspace scoping: wsA sees only its runs; wsB untouched
+    const registry = {
+      async resolveByPath(path: string) { return path === wsA ? { path: wsA, id: 'a' } : path === wsB ? { path: wsB, id: 'b' } : undefined },
+    }
+    const resolve = makeWorkspaceResolver(registry as never)
+    const rootA = await resolve(wsA)
+    const rootB = await resolve(wsB)
+    check('R1 resolve A', rootA === wsA)
+    check('R1 resolve B', rootB === wsB)
+    const listA = executeRecursiveCommand(rootA as string, 'list')
+    check('R1 scoped list (A has run, B does not)', listA.kind === 'success' && (listA.text ?? '').includes('10-smoke'))
+    const listB = executeRecursiveCommand(rootB as string, 'list')
+    check('R1 B sees no A runs', listB.kind === 'success' && !(listB.text ?? '').includes('10-smoke'), listB.text)
+    const rootNoWs = await resolveControlPlaneRoot({ session: { header: { cwd: join(base, 'nowhere') } } } as never, registry as never)
+    check('R1 unregistered cwd -> null (defer)', rootNoWs === null)
+
+    // R2 closeout scaffold
+    const runDir = join(wsA, '.recursive', 'run', '10-smoke')
+    const req = [
+      'Run: 10-smoke', 'Phase: 0', 'Status: \`LOCKED\`', 'Workflow version: recursive-mode-audit-v2', '',
+      '## TODO', '', '- [x] done', '', 'Coverage: PASS', 'Approval: PASS',
+      'LockedAt: \`2026-01-15T10:00:00Z\`', 'LockHash: \`PLACEHOLDER\`', '',
+    ].join('\n')
+    const hash = lockHashFromContent(req.replace('PLACEHOLDER', '0'.repeat(64)))
+    writeFileSync(join(runDir, '00-requirements.md'), req.replace('PLACEHOLDER', hash), 'utf8')
+    const co = closeoutPhase(runDir, '06', { strict: false })
+    check('R2 closeout scaffolds 06', co.created.includes('06-decisions-update.md'), co.created.join(','))
+    check('R2 closeout header', readFileSync(join(runDir, '06-decisions-update.md'), 'utf8').includes('## TODO'))
+
+    // R4 command grammar + scoped execution
+    check('R4 parse closeout', parseRecursiveCommand('closeout 10-smoke --phase 06').verb === 'closeout')
+    const cmdCloseout = executeRecursiveCommand(wsA, 'closeout 10-smoke --phase 06')
+    check('R4 closeout command success', cmdCloseout.kind === 'success')
+    const cmdUnknown = executeRecursiveCommand(wsA, 'frobnicate')
+    check('R4 unknown verb error', cmdUnknown.kind === 'error')
+
+    // R5 scratch lifecycle
+    writeScratch(runDir, 'md', '# scratch smoke')
+    check('R5 scratch write+read', readScratch(runDir, 'md').includes('scratch smoke'))
+    check('R5 scratch path', existsSync(join(runDir, 'scratch', 'scratch.md')))
+
+    // Phase B (run 04) smoke: bundle, handoff, router, delegation shape, child scratch, validation
+    writeFileSync(join(runDir, '03-implementation-summary.md'), '# impl\nStatus: `DRAFT`\n', 'utf8')
+    const bundle = buildReviewBundle({
+      root: wsA, runId: '10-smoke', phase: '03.5 Code Review', role: 'code-reviewer',
+      artifactPath: '.recursive/run/10-smoke/03-implementation-summary.md',
+      upstreamArtifacts: ['.recursive/run/10-smoke/00-requirements.md'],
+      auditQuestions: ['scoped?'], requiredOutput: 'verdict',
+      codeRefs: ['src/workspace.ts'], changedFiles: ['src/workspace.ts'],
+    })
+    check('R1 bundle built', existsSync(bundle.bundlePath) && bundle.markdown.includes('## Diff Basis'))
+    check('R1 bundle hash', bundle.artifactContentHash === contentSha256(readFileSync(join(runDir, '03-implementation-summary.md'), 'utf8')))
+
+    const handoff = createHandoff({ root: wsA, runId: '10-smoke', delegationId: 'rev-1', role: 'code-reviewer', objective: 'review', runDocRefs: [], codeRefs: [], auditQuestions: [], requiredOutput: 'v', decisionBasis: 'self-audit' })
+    const brief = createChildBrief({ root: wsA, runId: '10-smoke', delegationId: 'rev-1', childId: 'c1', slice: 's' })
+    check('R2 handoff+brief', existsSync(handoff) && existsSync(brief))
+    check('R2 prompt pointers', buildDelegationPrompt({ root: wsA, runId: '10-smoke', delegationId: 'rev-1', childId: 'c1', handoffPath: handoff, briefPath: brief }).includes('reply.md'))
+
+    const decision = resolveRole('code-reviewer', loadRouterPolicy(undefined), {})
+    const probe = capabilityProbe({ providers: {}, role: 'code-reviewer', policy: loadRouterPolicy(undefined) })
+    check('R3 router -> self-audit', decision.tier === 'self-audit' && probe.available === false)
+
+    check('R4 outputSchema', (reviewOutputSchema() as { required?: string[] }).required?.includes('verdict') === true)
+
+    const childScratch = childScratchPath({ root: wsA, runId: '10-smoke', childId: 'c1' })
+    writeChildScratch(runDir, 'c1', 'child note')
+    check('R5 child scratch written', existsSync(childScratch) && readFileSync(childScratch, 'utf8').includes('child note'))
+    check('R5 parent scratch intact', readParentScratch(runDir, 'md').includes('scratch smoke'))
+
+    const vref = validateReferences(wsA, [{ path: '.recursive/run/10-smoke/03-implementation-summary.md' }])
+    check('R6 references valid', vref.ok === true)
+    const arec = writeActionRecord({ root: wsA, runId: '10-smoke', subagentId: 'c1', phase: '03.5', purpose: 'review', executionMode: 'self-audit', success: false, stopReason: 'none' })
+    check('R6 action record', existsSync(arec) && readFileSync(arec, 'utf8').includes('## Verification Handoff'))
+
+    // Phase C (run 05) smoke: lifecycle fold + transition, pre-step gate, tool guard, policy, tamper, goal coupling
+    const lifeEvents: SessionEventLike[] = [
+      { type: 'recursive/phase', data: { runId: '10-smoke', phase: '03', status: 'LOCKED' } },
+      { type: 'recursive/run-state', data: { runId: '10-smoke', state: 'active' } },
+    ]
+    const folded = foldRecursivePhase(lifeEvents)
+    check('R1 fold last-wins phase', folded?.phase === '03' && folded?.runState === 'active')
+    const gatedIntent: PhaseTransitionIntent = { runId: '10-smoke', worktreeRoot: wsA, targetArtifact: '03-implementation-summary.md', kind: 'lock' }
+    const gate = evaluatePreStepGate([{ type: 'recursive/phase-intent', data: gatedIntent }], 'advisory')
+    check('R3 pre-step advisory warns (gateBlocked)', gate.gateBlocked === true && gate.kind === 'enter')
+    const gateStrict = evaluatePreStepGate([{ type: 'recursive/phase-intent', data: gatedIntent }], 'strict')
+    check('R3 pre-step strict rejects', gateStrict.kind === 'reject' && gateStrict.gateBlocked === true)
+    check('R3 pre-step no intent enters', evaluatePreStepGate([], 'strict').kind === 'enter')
+    const tddContent = 'Run: 10-smoke\nPhase: 3\nStatus: DRAFT\nTDD Mode: strict\nRED: evidence/logs/red/tdd-red.md\nGREEN: evidence/logs/green/tdd-green.md\n'
+    writeFileSync(join(runDir, '03-implementation-summary.md'), tddContent, 'utf8')
+    const lockGuard = evaluateToolGuard({ name: 'recursive_lock', arguments: { artifact: '03-implementation-summary.md' } }, wsA, '10-smoke', 'strict')
+    check('R4 tool guard allows in-order lock', lockGuard.kind === 'allow')
+    const outOfOrder = evaluateToolGuard({ name: 'recursive_lock', arguments: { artifact: '05-manual-qa.md' } }, wsA, '10-smoke', 'strict')
+    check('R4 tool guard denies out-of-order lock', outOfOrder.kind === 'deny' && (outOfOrder as { reason: string }).reason.includes('monotonic'))
+    check('R7 config default advisory', JSON.stringify(resolveEnforcementConfig(undefined)) === JSON.stringify(DEFAULT_ENFORCEMENT))
+    let configError = ''
+    try { resolveEnforcementConfig({ bogus: 1 }) } catch (err) { configError = (err as Error).message }
+    check('R7 unknown config key fails', configError.includes('unknown key'))
+    const policyText = renderRecursivePolicy({ worktreeRoot: wsA, runId: '10-smoke', folded: null })
+    check('R5 policy renders contract', policyText.includes('recursive-mode session') && policyText.includes('Current phase'))
+    check('R8 tamper clean', detectTamper(join(runDir, '03-implementation-summary.md'), wsA, '10-smoke') === null)
+    check('R6 goal coupling no-op', coupleGateBlockToGoal(null, {}, { id: 'g' }, { code: 'G', message: 'x' }) === false)
+
+
+    // ---- Phase D checks (run 06 R10) ----
+    const pEvents: { type: string; data: unknown }[] = [
+      { type: 'recursive/run-created', data: runCreated({ runId: '10-smoke', worktreeRoot: wsA, template: 't', repo: 'r' }) },
+      { type: 'recursive/phase', data: phase({ runId: '10-smoke', worktreeRoot: wsA, phase: '03-implementation-summary.md', status: 'DRAFT' }) },
+      { type: 'recursive/phase-locked', data: phaseLocked({ runId: '10-smoke', worktreeRoot: wsA, phase: '03-implementation-summary.md', lockedAt: '2026-08-16T00:00:00Z', lockHash: 'h' }) },
+      { type: 'recursive/gate-blocked', data: gateBlocked({ runId: '10-smoke', worktreeRoot: wsA, phase: '04', failures: ['f'], kind: 'pre-step' }) },
+      { type: 'recursive/tamper', data: tamper({ runId: '10-smoke', worktreeRoot: wsA, path: 'p.md', reason: 'hash' }) },
+      { type: 'recursive/run-state', data: runState({ runId: '10-smoke', worktreeRoot: wsA, state: 'blocked' }) },
+    ]
+    let fold = emptyRecursiveFoldState(wsA)
+    for (const e of pEvents) fold = foldRecursiveProjection(fold, e as never)
+    check('R2 projection fold groups by worktreeRoot', Object.keys(fold.byWorktree).length === 1 && fold.byWorktree[wsA] !== undefined)
+    const card = fold.byWorktree[wsA]['10-smoke']
+    check('R2/R9 projection card facts', card !== undefined && card.phases['03-implementation-summary.md'].status === 'LOCKED' && card.state === 'blocked' && card.tampers['p.md'].reason === 'hash')
+    // R9 worktree-scope reject: fold an event whose worktreeRoot is outside wsA
+    const before = fold
+    fold = foldRecursiveProjection(fold, { type: 'recursive/run-created', data: runCreated({ runId: 'x', worktreeRoot: 'C:' + String.fromCharCode(92) + 'elsewhere' }) } as never)
+    check('R9 out-of-workspace event rejected (same ref)', fold === before)
+    // R5/R6 derive
+    check('R5 columnForRun maps to implementation lane', columnForRun(card) === '3/3.5')
+    const facts = cardFacts(card)
+    check('R5 cardFacts progress + tampered + gateBlocked', facts.lockedCount === 1 && facts.tampered === true && facts.gateBlocked === true)
+    // R7 node key
+    check('R7 nodeKeyOf includes worktreeRoot', nodeKeyOf('10-smoke', wsA).includes(wsA))
+    check('R6 expandPhaseRows always shows 3.5', expandPhaseRows(card).some(r => r.phase === '03.5'))
+    // R2 unit validity
+    check('R2 projection unit key + stateVersion', recursiveProjectionUnit.key === 'recursive' && recursiveProjectionUnit.stateVersion === 1 && recursiveProjectionUnit.schema.safeParse(fold.byWorktree).success)
+    check('R9 isInsideWorkspace normalization', isInsideWorkspace('D:' + String.fromCharCode(92) + 'DEV' + String.fromCharCode(92) + 'x', 'D:/DEV/x') === true)
+
+    console.log(failures === 0 ? 'SMOKE PASS' : 'SMOKE FAIL (' + failures + ' failures)')
+    process.exitCode = failures === 0 ? 0 : 1
+  } finally {
+    rmSync(base, { recursive: true, force: true })
+  }
+}
+
+void main()

package/scripts/verify-locks.py

@@ -0,0 +1,353 @@
+#!/usr/bin/env python3
+"""
+Verify recursive-mode artifact lock integrity.
+
+Python equivalent to scripts/verify-locks.ps1.
+"""
+
+from __future__ import annotations
+
+import argparse
+import hashlib
+import importlib.util
+import re
+from dataclasses import dataclass
+from datetime import datetime, timezone
+from pathlib import Path
+
+
+def load_phase_rules_module():
+    module_path = Path(__file__).with_name("recursive_phase_rules.py")
+    spec = importlib.util.spec_from_file_location("recursive_phase_rules", module_path)
+    if spec is None or spec.loader is None:
+        raise RuntimeError(f"Unable to load phase rules module from {module_path}")
+    module = importlib.util.module_from_spec(spec)
+    try:
+        spec.loader.exec_module(module)
+    except FileNotFoundError:
+        raise RuntimeError(f"Phase rules module not found: {module_path}")
+    return module
+
+
+STATUS_RE = re.compile(r'(?m)^[ \t]*Status:\s*(?:`|")?(\w+)(?:`|")?\s*$')
+LOCK_HASH_RE = re.compile(r'(?m)^[ \t]*LockHash:\s*(?:`|")?([a-fA-F0-9]{64})(?:`|")?\s*$')
+LOCKED_AT_RE = re.compile(r'(?m)^[ \t]*LockedAt:\s*(?:`|")?([^`"\r\n]+)(?:`|")?\s*$')
+LOCK_HASH_LINE_RE = re.compile(r'(?m)^[ \t]*LockHash:.*(?:\n|$)')
+WORKFLOW_VERSION_RE = re.compile(r'(?m)^[ \t]*Workflow version:\s*(?:`|")?([^`"\r\n]+)(?:`|")?\s*$')
+CURRENT_WORKFLOW_PROFILE = "recursive-mode-audit-v2"
+STRICT_WORKFLOW_PROFILE = "recursive-mode-audit-v1"
+COMPAT_WORKFLOW_PROFILE = "memory-phase8"
+STRICT_WORKFLOW_PROFILES = {CURRENT_WORKFLOW_PROFILE, STRICT_WORKFLOW_PROFILE}
+AUDITED_PHASE_FILES = {
+    "01-as-is.md",
+    "01.5-root-cause.md",
+    "02-to-be-plan.md",
+    "03-implementation-summary.md",
+    "03.5-code-review.md",
+    "04-test-summary.md",
+    "06-decisions-update.md",
+    "07-state-update.md",
+    "08-memory-impact.md",
+}
+
+
+@dataclass
+class LockResult:
+    valid: bool
+    error: str | None = None
+    stored_hash: str | None = None
+    actual_hash: str | None = None
+    locked_at: str | None = None
+    fixed: bool = False
+    new_locked_at: str | None = None
+    new_hash: str | None = None
+
+
+def write_status(status: str, message: str) -> None:
+    print(f"[{status}] {message}")
+
+
+def normalize_for_lock_hash(content: str) -> str:
+    normalized = content.replace("\r\n", "\n").replace("\r", "\n")
+    normalized = LOCK_HASH_LINE_RE.sub("", normalized)
+    return normalized
+
+
+def lock_hash_from_content(content: str) -> str:
+    normalized = normalize_for_lock_hash(content)
+    return hashlib.sha256(normalized.encode("utf-8")).hexdigest()
+
+
+def get_workflow_profile(run_dir: Path) -> str:
+    requirements_path = run_dir / "00-requirements.md"
+    if requirements_path.exists():
+        content = requirements_path.read_text(encoding="utf-8")
+        match = WORKFLOW_VERSION_RE.search(content)
+        if match:
+            workflow_version = match.group(1).strip()
+            if workflow_version == CURRENT_WORKFLOW_PROFILE:
+                return CURRENT_WORKFLOW_PROFILE
+            if workflow_version == STRICT_WORKFLOW_PROFILE:
+                return STRICT_WORKFLOW_PROFILE
+            if workflow_version == COMPAT_WORKFLOW_PROFILE:
+                return COMPAT_WORKFLOW_PROFILE
+
+    for artifact in ("06-decisions-update.md", "07-state-update.md", "08-memory-impact.md"):
+        if (run_dir / artifact).exists():
+            return COMPAT_WORKFLOW_PROFILE
+
+    return "legacy"
+
+
+def test_lock_valid(artifact_path: Path, fix: bool = False) -> LockResult:
+    if not artifact_path.exists():
+        return LockResult(valid=False, error="File not found")
+
+    content = artifact_path.read_text(encoding="utf-8")
+
+    status_match = STATUS_RE.search(content)
+    if not status_match:
+        return LockResult(valid=False, error="No Status field found")
+    status = status_match.group(1)
+    if status != "LOCKED":
+        return LockResult(valid=False, error=f"Status is '{status}', expected 'LOCKED'")
+
+    hash_match = LOCK_HASH_RE.search(content)
+    if not hash_match:
+        return LockResult(valid=False, error="No LockHash field found")
+    stored_hash = hash_match.group(1).lower()
+
+    locked_at_match = LOCKED_AT_RE.search(content)
+    if not locked_at_match:
+        return LockResult(valid=False, error="No LockedAt field found")
+    locked_at = locked_at_match.group(1)
+
+    actual_hash = lock_hash_from_content(content)
+    if stored_hash == actual_hash:
+        return LockResult(valid=True, locked_at=locked_at, stored_hash=stored_hash)
+
+    result = LockResult(
+        valid=False,
+        error="Hash mismatch",
+        stored_hash=stored_hash,
+        actual_hash=actual_hash,
+        locked_at=locked_at,
+    )
+
+    if fix:
+        new_locked_at = datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
+        content_with_new_locked_at = re.sub(
+            r"(?m)^[ \t]*LockedAt:.*$",
+            f"LockedAt: `{new_locked_at}`",
+            content,
+        )
+        new_hash = lock_hash_from_content(content_with_new_locked_at)
+        new_content = re.sub(
+            r"(?m)^[ \t]*LockHash:.*$",
+            f"LockHash: `{new_hash}`",
+            content_with_new_locked_at,
+        )
+        artifact_path.write_text(new_content, encoding="utf-8", newline="")
+
+        result.fixed = True
+        result.new_locked_at = new_locked_at
+        result.new_hash = new_hash
+
+    return result
+
+
+def test_gate(content: str, name: str) -> tuple[bool, str | None]:
+    pass_re = re.compile(rf"{name}:\s*PASS")
+    fail_re = re.compile(rf"{name}:\s*FAIL")
+    if pass_re.search(content):
+        return True, None
+    if fail_re.search(content):
+        return False, f"{name} gate shows FAIL"
+    return False, f"No {name} gate result found"
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description="Verify recursive-mode artifact lock integrity.")
+    parser.add_argument("--run-id", default="", help="Run ID to verify. If omitted, scans all runs.")
+    parser.add_argument("--repo-root", default=".", help="Repository root path.")
+    parser.add_argument("--fix", action="store_true", help="Fix incorrect lock hashes (updates LockedAt + LockHash).")
+    parser.add_argument("--show-hashes", action="store_true", help="Show valid lock hashes in output.")
+    args = parser.parse_args()
+
+    resolved_repo_root = Path(args.repo_root).resolve()
+    print("\nRecursive Lock Verification")
+    print("=====================\n")
+    print(f"Repository: {resolved_repo_root}")
+    print(f"Run ID: {args.run_id if args.run_id else '(scanning all runs)'}\n")
+
+    run_base_dir = resolved_repo_root / ".recursive" / "run"
+    if not run_base_dir.exists():
+        write_status("FAIL", f"recursive run directory not found: {run_base_dir}")
+        return 1
+
+    if args.run_id:
+        runs = [args.run_id]
+    else:
+        runs = sorted([d.name for d in run_base_dir.iterdir() if d.is_dir()])
+
+    artifacts = [
+        {"file": "00-requirements.md", "name": "Requirements", "optional": False},
+        {"file": "00-worktree.md", "name": "Worktree Setup", "optional": False},
+        {"file": "01-as-is.md", "name": "AS-IS Analysis", "optional": True},
+        {"file": "01.5-root-cause.md", "name": "Root Cause", "optional": True},
+        {"file": "02-to-be-plan.md", "name": "TO-BE Plan", "optional": True},
+        {"file": "03-implementation-summary.md", "name": "Implementation", "optional": True},
+        {"file": "03.5-code-review.md", "name": "Code Review", "optional": True},
+        {"file": "04-test-summary.md", "name": "Test Summary", "optional": True},
+        {"file": "05-manual-qa.md", "name": "Manual QA", "optional": True},
+        {"file": "06-decisions-update.md", "name": "Decisions Update", "optional": False},
+        {"file": "07-state-update.md", "name": "State Update", "optional": False},
+        {"file": "08-memory-impact.md", "name": "Memory Impact", "optional": False},
+    ]
+
+    total_runs = 0
+    valid_runs = 0
+    fixed_runs = 0
+    failed_runs = 0
+    stale_chain_runs = 0
+
+    phase_rules = load_phase_rules_module()
+
+    for run in runs:
+        total_runs += 1
+        run_dir = run_base_dir / run
+        workflow_profile = get_workflow_profile(run_dir)
+        print(f"Checking run: {run}")
+        print("-" * 50)
+        print(f"Workflow profile: {workflow_profile}")
+
+        run_valid = True
+        run_fixed = False
+
+        for artifact in artifacts:
+            artifact_path = run_dir / artifact["file"]
+            is_required = not artifact["optional"]
+            if workflow_profile == "legacy" and artifact["file"] in {"06-decisions-update.md", "07-state-update.md", "08-memory-impact.md"}:
+                is_required = False
+            if not artifact_path.exists():
+                if not is_required:
+                    write_status("INFO", f"{artifact['name']}: Not found (optional)")
+                else:
+                    write_status("FAIL", f"{artifact['name']}: Missing (required)")
+                    run_valid = False
+                continue
+
+            content = artifact_path.read_text(encoding="utf-8")
+            if not re.search(r'(?m)^[ \t]*Status:\s*(?:`|")?LOCKED(?:`|")?\s*$', content):
+                write_status("WARN", f"{artifact['name']}: Not locked (DRAFT)")
+                run_valid = False
+                continue
+
+            result = test_lock_valid(artifact_path, fix=args.fix)
+            if result.valid:
+                write_status("PASS", f"{artifact['name']}: Valid (locked at {result.locked_at})")
+                if args.show_hashes and result.stored_hash:
+                    print(f"         Hash: {result.stored_hash}")
+            else:
+                if result.fixed:
+                    write_status("WARN", f"{artifact['name']}: Fixed hash mismatch (was tampered)")
+                    if result.stored_hash:
+                        print(f"         Old hash: {result.stored_hash}")
+                    if result.new_hash:
+                        print(f"         New hash: {result.new_hash}")
+                    if result.new_locked_at:
+                        print(f"         Updated at: {result.new_locked_at}")
+                    run_fixed = True
+                else:
+                    write_status("FAIL", f"{artifact['name']}: {result.error}")
+                    if result.stored_hash and result.actual_hash:
+                        print(f"         Stored: {result.stored_hash}")
+                        print(f"         Actual: {result.actual_hash}")
+                    run_valid = False
+
+            # Gate checks
+            updated_content = artifact_path.read_text(encoding="utf-8")
+            coverage_ok, coverage_reason = test_gate(updated_content, "Coverage")
+            approval_ok, approval_reason = test_gate(updated_content, "Approval")
+            audit_required = workflow_profile in STRICT_WORKFLOW_PROFILES and artifact["file"] in AUDITED_PHASE_FILES
+            audit_ok = True
+            audit_reason = None
+            if audit_required:
+                audit_ok, audit_reason = test_gate(updated_content, "Audit")
+            if not coverage_ok:
+                write_status("FAIL", f"{artifact['name']}: Coverage gate - {coverage_reason}")
+                run_valid = False
+            if not approval_ok:
+                write_status("FAIL", f"{artifact['name']}: Approval gate - {approval_reason}")
+                run_valid = False
+            if not audit_ok:
+                write_status("FAIL", f"{artifact['name']}: Audit gate - {audit_reason}")
+                run_valid = False
+
+        addenda_dir = run_dir / "addenda"
+        if addenda_dir.exists():
+            addenda_files = sorted(addenda_dir.glob("*.md"))
+            if addenda_files:
+                print("\nAddenda:")
+                for addendum in addenda_files:
+                    result = test_lock_valid(addendum, fix=args.fix)
+                    if result.valid:
+                        write_status("PASS", f"  {addendum.name}: Valid")
+                    elif result.fixed:
+                        write_status("WARN", f"  {addendum.name}: Fixed")
+                        run_fixed = True
+                    else:
+                        write_status("FAIL", f"  {addendum.name}: {result.error}")
+                        run_valid = False
+
+        # Stale-chain detection: check whether any prerequisite hash in a receipt
+        # no longer matches the current artifact content.
+        stale_entries = phase_rules.get_all_stale_receipts(run_dir)
+        run_stale = False
+        if stale_entries:
+            print("\nStale lock-chain receipts:")
+            for entry in stale_entries:
+                write_status("WARN", f"  {entry['artifact']}: {entry['reason']}")
+                run_stale = True
+
+        print()
+        if run_stale:
+            stale_chain_runs += 1
+            run_valid = False
+            write_status("WARN", f"Run '{run}': Stale lock-chain receipts detected (re-lock in phase order)")
+        elif run_valid and not run_fixed:
+            valid_runs += 1
+            write_status("PASS", f"Run '{run}': All locks valid")
+        elif run_fixed:
+            fixed_runs += 1
+            write_status("WARN", f"Run '{run}': Locks fixed (tampering detected)")
+        else:
+            failed_runs += 1
+            write_status("FAIL", f"Run '{run}': Lock verification failed")
+        print()
+
+    print("=====================")
+    print("Summary")
+    print("=====================\n")
+    print(f"Total runs checked: {total_runs}")
+    write_status("PASS", f"Valid runs: {valid_runs}")
+    if stale_chain_runs > 0:
+        write_status("WARN", f"Stale-chain runs: {stale_chain_runs}")
+    if fixed_runs > 0:
+        write_status("WARN", f"Fixed runs (tampered): {fixed_runs}")
+    if failed_runs > 0:
+        write_status("FAIL", f"Failed runs: {failed_runs}")
+    print()
+
+    if failed_runs == 0 and stale_chain_runs == 0:
+        write_status("PASS", "All locks verified successfully")
+        return 0
+    if failed_runs == 0:
+        write_status("WARN", "Lock hashes valid but stale-chain receipts detected")
+        return 1
+    write_status("FAIL", "Some locks failed verification")
+    return 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())