@try-works/dsh-recursive-mode 0.4.8 → 0.4.9

package/lib/enforcement.d.ts

@@ -55,8 +55,14 @@ export declare const DEFAULT_ENFORCEMENT: EnforcementConfig;
  * every allow/deny/ask the guard hands back). `'none'` means no guard predicate
  * fired; `'transition'` marks a decision whose only dissenting gate was the
  * advisory transition gate (see consultTransitionGate).
+ *
+ * `'phase-order'` is the WRITE half of the ordering rule the owner states as *only
+ * one phase may be active at a time, and the phases should be sequential and the
+ * active phase must be locked before proceeding to next phase*: `'lock-order'` refuses
+ * locking ahead, `'phase-order'` refuses WRITING ahead. Two labels rather than one,
+ * because the guard log has to tell the owner which of the two the agent attempted.
  */
-export type GuardRule = 'lock-order' | 'tdd-evidence' | 'locked-write' | 'transition' | 'none';
+export type GuardRule = 'lock-order' | 'phase-order' | 'tdd-evidence' | 'locked-write' | 'transition' | 'none';
 /** T15: the transition gate's verdict as attached to a decision (advisory only). */
 export interface GuardTransition {
     passed: boolean;
@@ -108,7 +114,7 @@ export interface ToolExecLike {
  * `recursive:policy` later — can read the effective rules instead of inferring
  * them from a code path.
  */
-export declare function resolveToolPolicyForGuard(worktreeRoot: string, runId: string): ToolPolicy;
+export declare function resolveToolPolicyForGuard(worktreeRoot: string, runId: string, activePhaseArtifact?: string): ToolPolicy;
 /**
  * The artifact whose phase baseline applies: the HIGHEST-numbered phase artifact
  * present in the run (a run at phase 3 has `00`-`03` on disk). Read from the

package/lib/index.js

@@ -1512,11 +1512,91 @@ function lockedWriteRule(target, worktreeRoot) {
 	};
 }
 /**
+* The file name when `abs` is a DIRECT CHILD of `runDir`, and `null` otherwise.
+*
+* ⚠ THE DIRECT-CHILD TEST IS NOT TIDINESS — IT IS WHAT KEEPS THE RULE OFF THE SUPPORT
+* FILES. `phaseNumberForArtifact` reads the leading digits of a NAME, so
+* `<run>/evidence/01-as-is.md` or `<run>/subagents/child/03-brief.md` would look like
+* phase 1 and phase 3 artifacts if the name were all that was examined. A phase artifact
+* is a file the run tree holds DIRECTLY beside the others (`recursive_init` writes all
+* twelve into `<run>/` itself), so the parent directory is part of the definition.
+*
+* The comparison normalizes separators and case: the same run directory reached through
+* a Windows spelling that differs in case is the same directory, and the rule must not
+* abstain on one spelling and fire on the other.
+*/
+function directChildName(abs, runDir) {
+	const normalize = (path) => resolve(path).replace(/\\/g, "/").replace(/\/+$/, "").toLowerCase();
+	if (normalize(dirname(abs)) !== normalize(runDir)) return null;
+	return basename(abs);
+}
+/**
+* PHASE-ORDER rule: a denial when the target is a LATER phase's artifact than the phase
+* currently active, `null` when it is not.
+*
+* ⚠ THE HOLE THIS CLOSES. The monotonic rule was enforced on `recursive_lock` ONLY. An
+* agent could therefore write `08-memory-impact.md` while the run sat at phase 0 — and a
+* live run did exactly that: twelve artifacts, not one of them locked, written out of
+* order, with a single line in `operations/operations.jsonl`. Ordering that only binds
+* the lock tool is not ordering; the model's ordinary `write` is the path that mattered.
+*
+* The owner's rule, verbatim: *only one phase may be active at a time, and the phases
+* should be sequential and the active phase must be locked before proceeding to next
+* phase*. The ACTIVE phase is the one the selector names (`ctx.activePhaseArtifact`), so:
+*
+*   - the target is the ACTIVE artifact, or shares its phase number (`00-requirements.md`
+*     and `00-worktree.md` are both phase 0; `01-as-is.md` and `01.5-root-cause.md` are
+*     both phase 1) -> ABSTAIN, the write is allowed;
+*   - the target is an EARLIER phase -> ABSTAIN. Such an artifact is LOCKED by
+*     construction (the active phase is the lowest UNLOCKED one), so the locked-artifact
+*     rule above decides it, and its rule label is preserved;
+*   - the target is a LATER phase -> DENY: working ahead.
+*
+* ⚠ THE ALLOW HALF IS LOAD-BEARING. An enforcement rule in this exact area was once the
+* bug: strict enforcement denied the run's OWN artifacts in every phase and made the
+* workflow unusable (see `resolveFrom` and `currentPhaseArtifact`). "The active artifact
+* stays writable at every phase" is therefore asserted by walking every phase, not by
+* one case — `tests/strict-run-tree.spec.ts` (d).
+*
+* WHAT IT ABSTAINS ON, deliberately:
+*   - no `activePhaseArtifact` (a caller with no run context, or a run with no phase
+*     artifacts yet) -> abstain, never guess a phase;
+*   - a target outside the active run's own directory -> abstain. The rule is about THIS
+*     run's sequence; another run's tree is a different question and denying it here
+*     would be a false positive;
+*   - a support file (anything not a direct child) -> abstain: `evidence/`, `scratch/`,
+*     `addenda/`, `subagents/`, `operations/` and a plain `<run>/notes.md` are not phases.
+*
+* The predicate adds only the per-call particular — which artifact, which phase, which is
+* active; the rule keeps the static, auditable sentence.
+*/
+function phaseOrderRule(target, ctx) {
+	const active = ctx.activePhaseArtifact;
+	if (!target || !ctx.runDir || !ctx.worktreeRoot) return null;
+	if (typeof active !== "string" || active === "") return null;
+	const activePhaseText = phaseNumberForArtifact(active);
+	if (!activePhaseText) return null;
+	const normalized = target.replace(/\\/g, "/");
+	if (!normalized.endsWith(".md")) return null;
+	const abs = resolveFrom(ctx.worktreeRoot, normalized);
+	if (!abs) return null;
+	const name = directChildName(abs, ctx.runDir);
+	if (name === null) return null;
+	const phaseText = phaseNumberForArtifact(name);
+	if (!phaseText) return null;
+	if (Number(phaseText) <= Number(activePhaseText)) return null;
+	return {
+		verdict: "deny",
+		detail: name + " is phase " + phaseText + " but the ACTIVE phase is " + active + " (phase " + activePhaseText + ") - the active phase must be locked before writing a later phase"
+	};
+}
+/**
 * The BUILT-IN default rule list — the pre-T16 guard behaviour expressed as
 * data:
 *
 *   `recursive_lock*`  -> the monotonic lock-order denial;
 *   the write-tool ids -> the locked-artifact write denial;
+*   the write-tool ids -> the phase-order (write-ahead) denial;
 *   `*`                -> allow, so an ordinary tool is not turned into an `ask`.
 *
 * Every `deny` precedes the `allow`, which is what makes "deny wins over allow" a
@@ -1543,6 +1623,13 @@ function builtInToolPolicyRules() {
 		label: "locked-write",
 		predicate: (id, args, ctx) => WRITE_TOOL_NAMES.has(id) ? lockedWriteRule(policyTargetPath(args), ctx.worktreeRoot) : null
 	});
+	for (const name of WRITE_TOOL_NAMES) rules.push({
+		pattern: name,
+		verdict: "deny",
+		reason: "phase order: only one phase may be active at a time - the active phase must be locked before a later phase artifact is written",
+		label: "phase-order",
+		predicate: (id, args, ctx) => WRITE_TOOL_NAMES.has(id) ? phaseOrderRule(policyTargetPath(args), ctx) : null
+	});
 	rules.push({
 		pattern: "*",
 		verdict: "allow",
@@ -1581,6 +1668,10 @@ function attachPolicyPredicate(rule) {
 		...rule,
 		predicate: (id, args, ctx) => LOCK_TOOL_NAMES.has(id) ? lockOrderRule(args.artifact, ctx.runDir) : null
 	};
+	if (rule.label === "phase-order") return {
+		...rule,
+		predicate: (id, args, ctx) => WRITE_TOOL_NAMES.has(id) ? phaseOrderRule(policyTargetPath(args), ctx) : null
+	};
 	if (WRITE_TOOL_NAMES.has(rule.pattern)) return {
 		...rule,
 		predicate: (id, args, ctx) => WRITE_TOOL_NAMES.has(id) ? lockedWriteRule(policyTargetPath(args), ctx.worktreeRoot) : null
@@ -7784,8 +7875,8 @@ const DEFAULT_ENFORCEMENT = {
 * `recursive:policy` later — can read the effective rules instead of inferring
 * them from a code path.
 */
-function resolveToolPolicyForGuard(worktreeRoot, runId) {
-	return withPhaseBaseline(loadToolPolicyFile(worktreeRoot).policy, currentPhaseArtifact(worktreeRoot, runId));
+function resolveToolPolicyForGuard(worktreeRoot, runId, activePhaseArtifact) {
+	return withPhaseBaseline(loadToolPolicyFile(worktreeRoot).policy, activePhaseArtifact ?? currentPhaseArtifact(worktreeRoot, runId));
 }
 /**
 * The artifact whose phase baseline applies: the HIGHEST-numbered phase artifact
@@ -7835,11 +7926,13 @@ function evaluateToolGuard(exec, worktreeRoot, activeRunId, mode = "advisory") {
 	const runId = typeof activeRunId === "string" ? activeRunId.trim() : "";
 	const runDir = join(worktreeRoot, ".recursive", "run", runId);
 	const transition = consultTransitionGate(name, args, worktreeRoot, runId);
-	return advisory(verdictFor(mode, evaluateToolPolicy(resolveToolPolicyForGuard(worktreeRoot, runId), name, args, {
+	const activePhaseArtifact = currentPhaseArtifact(worktreeRoot, runId);
+	return advisory(verdictFor(mode, evaluateToolPolicy(resolveToolPolicyForGuard(worktreeRoot, runId, activePhaseArtifact), name, args, {
 		args,
 		runDir,
 		runId,
-		worktreeRoot
+		worktreeRoot,
+		activePhaseArtifact
 	})), transition);
 }
 /**
@@ -8086,6 +8179,7 @@ function renderStableContract(config = DEFAULT_ENFORCEMENT) {
 		"- Gates in force: pre-step " + config.preStep + ", tool guards " + config.toolGuards + ", tamper detection " + config.tamper + ".",
 		"- A transition that fails its gates is BLOCKED (strict) or warns (advisory); no rejected transition proceeds silently.",
 		"- Writes to a Status: LOCKED phase doc are denied/asked; reopen explicitly to edit.",
+		"- Phase order binds WRITES as well as locks: only the ACTIVE phase (the lowest-numbered artifact not yet LOCKED) may be written; a write to a LATER phase artifact is denied/asked. Run support files (evidence/, scratch/, addenda/, subagents/, operations/) are not phases.",
 		"- Phase 3 lock requires TDD evidence (strict) or rationale (pragmatic); Phase 5 requires QA evidence.",
 		"- The control-plane root is resolved STRICTLY from this session workspace (never scanned from another)."
 	].join("\n");

package/lib/policy-globs.d.ts

@@ -21,6 +21,18 @@ export interface ToolPolicyContext {
     runDir?: string;
     runId?: string;
     worktreeRoot?: string;
+    /**
+     * The ACTIVE phase artifact of the run — the LOWEST-numbered phase artifact that is not
+     * LOCKED, falling back to the highest when every one of them is locked.
+     *
+     * ⚠ THIS IS NOT A SECOND SELECTOR. It is the answer `currentPhaseArtifact` in
+     * `enforcement.ts` produced for this call, carried here so a rule in THIS module can
+     * compare against it. `policy-globs.ts` cannot import that function (enforcement.ts
+     * imports this module, and the repo has already paid once for a value-level import
+     * cycle), so the value is passed in rather than recomputed. A caller that omits it
+     * gets NO phase-order verdict — the rule abstains rather than guessing a phase.
+     */
+    activePhaseArtifact?: string;
 }
 /**
  * What a rule predicate returns when the condition it guards DOES apply:
@@ -152,6 +164,7 @@ export declare const LOCK_TOOL_NAMES: Set<string>;
  *
  *   `recursive_lock*`  -> the monotonic lock-order denial;
  *   the write-tool ids -> the locked-artifact write denial;
+ *   the write-tool ids -> the phase-order (write-ahead) denial;
  *   `*`                -> allow, so an ordinary tool is not turned into an `ask`.
  *
  * Every `deny` precedes the `allow`, which is what makes "deny wins over allow" a

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@try-works/dsh-recursive-mode",
   "description": "recursive-mode workflow as a DeepSeek Harness bundle: RecursiveRuntime service + 13 recursive_* tools (recursive_status, recursive_init, recursive_lock, recursive_lint, recursive_closeout, recursive_scratch, recursive_worktree, recursive_phase, recursive_audit_team, recursive_review, recursive_delegate, recursive_ask, recursive_preview)",
-  "version": "0.4.8",
+  "version": "0.4.9",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",

package/src/enforcement.ts

@@ -129,8 +129,14 @@ export const DEFAULT_ENFORCEMENT: EnforcementConfig = {
  * every allow/deny/ask the guard hands back). `'none'` means no guard predicate
  * fired; `'transition'` marks a decision whose only dissenting gate was the
  * advisory transition gate (see consultTransitionGate).
+ *
+ * `'phase-order'` is the WRITE half of the ordering rule the owner states as *only
+ * one phase may be active at a time, and the phases should be sequential and the
+ * active phase must be locked before proceeding to next phase*: `'lock-order'` refuses
+ * locking ahead, `'phase-order'` refuses WRITING ahead. Two labels rather than one,
+ * because the guard log has to tell the owner which of the two the agent attempted.
  */
-export type GuardRule = 'lock-order' | 'tdd-evidence' | 'locked-write' | 'transition' | 'none'
+export type GuardRule = 'lock-order' | 'phase-order' | 'tdd-evidence' | 'locked-write' | 'transition' | 'none'
 
 /** T15: the transition gate's verdict as attached to a decision (advisory only). */
 export interface GuardTransition {
@@ -179,9 +185,12 @@ export interface ToolExecLike {
  * `recursive:policy` later — can read the effective rules instead of inferring
  * them from a code path.
  */
-export function resolveToolPolicyForGuard(worktreeRoot: string, runId: string): ToolPolicy {
+export function resolveToolPolicyForGuard(worktreeRoot: string, runId: string, activePhaseArtifact?: string): ToolPolicy {
   const loaded = loadToolPolicyFile(worktreeRoot)
-  return withPhaseBaseline(loaded.policy, currentPhaseArtifact(worktreeRoot, runId))
+  // A caller that already asked `currentPhaseArtifact` for this call passes the answer in,
+  // so one guard call reads the run tree's lock statuses ONCE rather than twice. The
+  // no-cache discipline is unchanged: an omitted argument still reads the filesystem here.
+  return withPhaseBaseline(loaded.policy, activePhaseArtifact ?? currentPhaseArtifact(worktreeRoot, runId))
 }
 
 /**
@@ -258,8 +267,14 @@ export function evaluateToolGuard(
   // T16: the verdict comes from the ordered policy, not from branches here. The
   // policy file is re-read per call on purpose: a policy a human just edited
   // must take effect on the next tool call, not after a restart.
-  const policy = resolveToolPolicyForGuard(worktreeRoot, runId)
-  const context: ToolPolicyContext = { args, runDir, runId, worktreeRoot }
+  //
+  // The ACTIVE phase is resolved ONCE, by the ONE selector, and is used twice: it
+  // selects the phase baseline (narrowing rules) and it is carried into the context so
+  // the phase-order rule can refuse a WRITE that is ahead of the active phase. Both
+  // halves of the ordering rule therefore read the same answer for the same call.
+  const activePhaseArtifact = currentPhaseArtifact(worktreeRoot, runId)
+  const policy = resolveToolPolicyForGuard(worktreeRoot, runId, activePhaseArtifact)
+  const context: ToolPolicyContext = { args, runDir, runId, worktreeRoot, activePhaseArtifact }
   const decision = evaluateToolPolicy(policy, name, args, context)
   return advisory(verdictFor(mode, decision), transition)
 }

package/src/policy-globs.ts

@@ -40,10 +40,10 @@
  * just wrote and believes is in force.
  */
 import { existsSync, readFileSync } from 'node:fs'
-import { join } from 'node:path'
+import { basename, dirname, join, resolve } from 'node:path'
 import { getLockStatus, getPrerequisiteBlockers } from './lock.ts'
 import { getMdFieldValue } from './status.ts'
-import { policyTargetPath, resolveFrom } from './phase-rules.ts'
+import { phaseNumberForArtifact, policyTargetPath, resolveFrom } from './phase-rules.ts'
 
 /** The three verdicts a rule may carry. */
 export type Verdict = 'allow' | 'deny' | 'ask'
@@ -70,6 +70,18 @@ export interface ToolPolicyContext {
   runDir?: string
   runId?: string
   worktreeRoot?: string
+  /**
+   * The ACTIVE phase artifact of the run — the LOWEST-numbered phase artifact that is not
+   * LOCKED, falling back to the highest when every one of them is locked.
+   *
+   * ⚠ THIS IS NOT A SECOND SELECTOR. It is the answer `currentPhaseArtifact` in
+   * `enforcement.ts` produced for this call, carried here so a rule in THIS module can
+   * compare against it. `policy-globs.ts` cannot import that function (enforcement.ts
+   * imports this module, and the repo has already paid once for a value-level import
+   * cycle), so the value is passed in rather than recomputed. A caller that omits it
+   * gets NO phase-order verdict — the rule abstains rather than guessing a phase.
+   */
+  activePhaseArtifact?: string
 }
 
 /**
@@ -452,12 +464,95 @@ function lockedWriteRule(target: string | null, worktreeRoot: string | undefined
   return { verdict: 'deny', detail: normalized + ' carries Status: LOCKED (reopen explicitly to edit)' }
 }
 
+/**
+ * The file name when `abs` is a DIRECT CHILD of `runDir`, and `null` otherwise.
+ *
+ * ⚠ THE DIRECT-CHILD TEST IS NOT TIDINESS — IT IS WHAT KEEPS THE RULE OFF THE SUPPORT
+ * FILES. `phaseNumberForArtifact` reads the leading digits of a NAME, so
+ * `<run>/evidence/01-as-is.md` or `<run>/subagents/child/03-brief.md` would look like
+ * phase 1 and phase 3 artifacts if the name were all that was examined. A phase artifact
+ * is a file the run tree holds DIRECTLY beside the others (`recursive_init` writes all
+ * twelve into `<run>/` itself), so the parent directory is part of the definition.
+ *
+ * The comparison normalizes separators and case: the same run directory reached through
+ * a Windows spelling that differs in case is the same directory, and the rule must not
+ * abstain on one spelling and fire on the other.
+ */
+function directChildName(abs: string, runDir: string): string | null {
+  const normalize = (path: string) => resolve(path).replace(/\\/g, '/').replace(/\/+$/, '').toLowerCase()
+  if (normalize(dirname(abs)) !== normalize(runDir)) return null
+  return basename(abs)
+}
+
+/**
+ * PHASE-ORDER rule: a denial when the target is a LATER phase's artifact than the phase
+ * currently active, `null` when it is not.
+ *
+ * ⚠ THE HOLE THIS CLOSES. The monotonic rule was enforced on `recursive_lock` ONLY. An
+ * agent could therefore write `08-memory-impact.md` while the run sat at phase 0 — and a
+ * live run did exactly that: twelve artifacts, not one of them locked, written out of
+ * order, with a single line in `operations/operations.jsonl`. Ordering that only binds
+ * the lock tool is not ordering; the model's ordinary `write` is the path that mattered.
+ *
+ * The owner's rule, verbatim: *only one phase may be active at a time, and the phases
+ * should be sequential and the active phase must be locked before proceeding to next
+ * phase*. The ACTIVE phase is the one the selector names (`ctx.activePhaseArtifact`), so:
+ *
+ *   - the target is the ACTIVE artifact, or shares its phase number (`00-requirements.md`
+ *     and `00-worktree.md` are both phase 0; `01-as-is.md` and `01.5-root-cause.md` are
+ *     both phase 1) -> ABSTAIN, the write is allowed;
+ *   - the target is an EARLIER phase -> ABSTAIN. Such an artifact is LOCKED by
+ *     construction (the active phase is the lowest UNLOCKED one), so the locked-artifact
+ *     rule above decides it, and its rule label is preserved;
+ *   - the target is a LATER phase -> DENY: working ahead.
+ *
+ * ⚠ THE ALLOW HALF IS LOAD-BEARING. An enforcement rule in this exact area was once the
+ * bug: strict enforcement denied the run's OWN artifacts in every phase and made the
+ * workflow unusable (see `resolveFrom` and `currentPhaseArtifact`). "The active artifact
+ * stays writable at every phase" is therefore asserted by walking every phase, not by
+ * one case — `tests/strict-run-tree.spec.ts` (d).
+ *
+ * WHAT IT ABSTAINS ON, deliberately:
+ *   - no `activePhaseArtifact` (a caller with no run context, or a run with no phase
+ *     artifacts yet) -> abstain, never guess a phase;
+ *   - a target outside the active run's own directory -> abstain. The rule is about THIS
+ *     run's sequence; another run's tree is a different question and denying it here
+ *     would be a false positive;
+ *   - a support file (anything not a direct child) -> abstain: `evidence/`, `scratch/`,
+ *     `addenda/`, `subagents/`, `operations/` and a plain `<run>/notes.md` are not phases.
+ *
+ * The predicate adds only the per-call particular — which artifact, which phase, which is
+ * active; the rule keeps the static, auditable sentence.
+ */
+function phaseOrderRule(target: string | null, ctx: ToolPolicyContext): ToolPolicyPredicateMatch | null {
+  const active = ctx.activePhaseArtifact
+  if (!target || !ctx.runDir || !ctx.worktreeRoot) return null
+  if (typeof active !== 'string' || active === '') return null
+  const activePhaseText = phaseNumberForArtifact(active)
+  if (!activePhaseText) return null
+  const normalized = target.replace(/\\/g, '/')
+  if (!normalized.endsWith('.md')) return null
+  const abs = resolveFrom(ctx.worktreeRoot, normalized)
+  if (!abs) return null
+  const name = directChildName(abs, ctx.runDir)
+  if (name === null) return null
+  const phaseText = phaseNumberForArtifact(name)
+  if (!phaseText) return null
+  if (Number(phaseText) <= Number(activePhaseText)) return null
+  return {
+    verdict: 'deny',
+    detail: name + ' is phase ' + phaseText + ' but the ACTIVE phase is ' + active
+      + ' (phase ' + activePhaseText + ') - the active phase must be locked before writing a later phase',
+  }
+}
+
 /**
  * The BUILT-IN default rule list — the pre-T16 guard behaviour expressed as
  * data:
  *
  *   `recursive_lock*`  -> the monotonic lock-order denial;
  *   the write-tool ids -> the locked-artifact write denial;
+ *   the write-tool ids -> the phase-order (write-ahead) denial;
  *   `*`                -> allow, so an ordinary tool is not turned into an `ask`.
  *
  * Every `deny` precedes the `allow`, which is what makes "deny wins over allow" a
@@ -488,6 +583,20 @@ export function builtInToolPolicyRules(): ToolPolicyRule[] {
       predicate: (id, args, ctx) => (WRITE_TOOL_NAMES.has(id) ? lockedWriteRule(policyTargetPath(args), ctx.worktreeRoot) : null),
     })
   }
+  // The SAME write-tool ids get a SECOND conditional deny, the phase-order rule. Two rules
+  // share one pattern on purpose: the engine's predicates ABSTAIN (`null`) when their
+  // condition does not apply, so a clean write falls through both to the catch-all allow,
+  // and a target that is BOTH locked and a later phase is reported by the locked rule
+  // first (file order within a specificity tier), which is the pre-existing wording.
+  for (const name of WRITE_TOOL_NAMES) {
+    rules.push({
+      pattern: name,
+      verdict: 'deny',
+      reason: 'phase order: only one phase may be active at a time - the active phase must be locked before a later phase artifact is written',
+      label: 'phase-order',
+      predicate: (id, args, ctx) => (WRITE_TOOL_NAMES.has(id) ? phaseOrderRule(policyTargetPath(args), ctx) : null),
+    })
+  }
   rules.push({
     pattern: '*',
     verdict: 'allow',
@@ -523,6 +632,18 @@ export function attachPolicyPredicate(rule: ToolPolicyRule): ToolPolicyRule {
   if (rule.pattern === 'recursive_lock*') {
     return { ...rule, predicate: (id, args, ctx) => (LOCK_TOOL_NAMES.has(id) ? lockOrderRule(args.artifact, ctx.runDir) : null) }
   }
+  // ⚠ THE LABEL IS CONSULTED BEFORE THE PATTERN, because the phase-order rule and the
+  // locked-artifact rule share EVERY write-tool pattern (see `builtInToolPolicyRules`).
+  // Selecting by pattern alone would give BOTH rules the locked-artifact condition — the
+  // second would then deny a locked target with the wrong reason and the phase-order
+  // condition would never be attached at all, so the hole would stay open in every repo
+  // that ships a policy file. The `label` is already the rule's machine-readable identity
+  // (`firstPolicyDefect` admits it, `decide` surfaces it as the decision's `rule`), so the
+  // label is what names the condition. A rule with NO label keeps the pattern's condition,
+  // exactly as before.
+  if (rule.label === 'phase-order') {
+    return { ...rule, predicate: (id, args, ctx) => (WRITE_TOOL_NAMES.has(id) ? phaseOrderRule(policyTargetPath(args), ctx) : null) }
+  }
   if (WRITE_TOOL_NAMES.has(rule.pattern)) {
     return { ...rule, predicate: (id, args, ctx) => (WRITE_TOOL_NAMES.has(id) ? lockedWriteRule(policyTargetPath(args), ctx.worktreeRoot) : null) }
   }

package/src/policy.ts

@@ -111,6 +111,7 @@ export function renderStableContract(config: EnforcementConfig = DEFAULT_ENFORCE
       + ', tamper detection ' + config.tamper + '.',
     '- A transition that fails its gates is BLOCKED (strict) or warns (advisory); no rejected transition proceeds silently.',
     '- Writes to a Status: LOCKED phase doc are denied/asked; reopen explicitly to edit.',
+    '- Phase order binds WRITES as well as locks: only the ACTIVE phase (the lowest-numbered artifact not yet LOCKED) may be written; a write to a LATER phase artifact is denied/asked. Run support files (evidence/, scratch/, addenda/, subagents/, operations/) are not phases.',
     '- Phase 3 lock requires TDD evidence (strict) or rationale (pragmatic); Phase 5 requires QA evidence.',
     '- The control-plane root is resolved STRICTLY from this session workspace (never scanned from another).',
   ].join('\n')