@warnyin/sdlc 0.3.0 → 0.5.0

package/payload/playbook/auto.md

@@ -1,31 +1,66 @@
-# /sdlc:auto <title|change-id> — the whole pipeline, one command
-
-Runs new → [design] → contract → build → verify → [review] → ship, each stage by
-its own playbook, WITHOUT pausing for the human except on the Autonomy-policy
-escalation conditions:
-
-- hard-floor surface (security, payments, data-loss, irreversible),
-- a `[NEEDS CLARIFICATION]` the agent cannot resolve alone,
-- verify failed more than 3 rounds,
-- token budget exceeded (if the user set one),
-- ship policy requires human approval (deep tier).
-
-Entry stage — resolve this first, never assume `new`:
-- Run `npx @warnyin/sdlc status`. If the argument names an active change (or one
-  is active and the argument describes it), RESUME: map its status to the entry
-  stage with `next.md` §2 and start the pipeline there.
-- Resume never rewrites an existing `change.md` — a change already triaged keeps
-  its tier, Delta and Assumptions. Re-run a stage only if its output is missing
-  or the validator rejects it.
-- Start at `new` only when the argument matches no active change.
-
-Rules:
-- Announce the plan in ≤3 lines after triage (id, tier, task count, entry stage),
-  so a resume is never silent. Then work.
-- Between stages run `npx @warnyin/sdlc validate <id>` — a red validator is a
-  hard stop for that stage, not a suggestion.
-- On escalation: stop at the exact step, state what is needed in ≤5 lines, wait.
-  When the human answers, resume from that step — never restart the pipeline.
-- On completion report one line: shipped + digest path + total cost if known.
-
-This is orchestrator mode: the human describes the outcome and walks away.
+# /sdlc:auto <title|change-id> — the whole pipeline, one command
+
+Runs new → [design] → contract → build → verify → [review] → ship, each stage by
+its own playbook, WITHOUT pausing for the human except on the Autonomy-policy
+escalation conditions — each with the choice `--auto` may pre-approve:
+
+| Condition | Pre-approvable as |
+|---|---|
+| a `[NEEDS CLARIFICATION]` the agent cannot resolve alone | assume-safe and continue · or stop and ask |
+| verify failed more than 3 rounds | keep iterating · or stop |
+| review found blockers | fix and continue · or stop for the human |
+| ship needs human approval (deep tier / hard-floor: security, payments, data-loss, irreversible) | ship · or stop before ship |
+| token budget exceeded (if the user set one) | continue · or stop |
+
+`/sdlc:auto` and any stage command given `--auto` run in unattended mode below.
+
+## Unattended mode — gather, confirm, run (in that order)
+
+1. **Gather.** Triage the tier, read `npx @warnyin/sdlc status`, resolve the entry
+   stage, and collect every question you would otherwise raise mid-run. This step
+   writes NOTHING: no `change.md`, no journal entry, no gate, no active-change
+   pointer. A run that never gets confirmed must leave the repository unchanged.
+2. **Confirm.** One message, and it must be decidable item by item:
+   - scope as you understood it, and the tier you triaged with its reason
+   - every ambiguity, each with the assumption you intend to act on
+   - one line per row of the escalation table above, each stating the choice you
+     want pre-approved, and each refusable on its own. For the ship row, name the
+     hard-floor surface it covers — never fold it into a general "run without me".
+   If the human declines or edits any item, nothing has been written yet: revise
+   the summary and ask again, or stop. Do not start work on a partial yes.
+3. **Run.** Only now write anything. Work stage by stage to ship.
+
+**Pre-authorization covers this run only.** It is never persisted to config, never
+remembered for the next change, and never inherited by a resumed run — a resume
+asks again. A condition outside the confirmed set stops the run and asks, exactly
+as if no flag had been passed; treat that as a fact, not a judgement call.
+
+Record every escalation you reach:
+`node sdlc/.hooks/journal.mjs note escalation condition=<name> preauth=<yes|no>`
+— `yes` when a pre-approval let you pass it, `no` when you stopped and asked.
+
+Entry stage — resolve this first, never assume `new`:
+- Run `npx @warnyin/sdlc status`. If the argument names an active change (or one
+  is active and the argument describes it), RESUME: map its status to the entry
+  stage with `next.md` §2 and start the pipeline there.
+- Resume never rewrites an existing `change.md` — a change already triaged keeps
+  its tier, Delta and Assumptions. Re-run a stage only if its output is missing
+  or the validator rejects it.
+- Start at `new` only when the argument matches no active change.
+- With `--auto` on a stage command: the stage still does its own work first, then
+  the pipeline continues from there. A stage typed earlier than what the change's
+  status maps to is skipped with a one-line announcement, never re-run — the
+  pipeline is a ratchet.
+
+Rules:
+- Announce the plan in ≤3 lines after triage (id, tier, task count, entry stage),
+  so a resume is never silent. Then work.
+- Between stages run `npx @warnyin/sdlc validate <id>` — a red validator is a
+  hard stop for that stage, not a suggestion.
+- On escalation NOT pre-approved for this run: stop at the exact step, state what
+  is needed in ≤5 lines, wait. When the human answers, resume from that step —
+  never restart the pipeline. One that IS pre-approved: take the approved choice,
+  journal it, and keep going without asking.
+- On completion report one line: shipped + digest path + total cost if known.
+
+This is orchestrator mode: the human describes the outcome and walks away.

package/payload/playbook/build.md

@@ -1,23 +1,26 @@
-# /sdlc:build <id> — implement (Run the harness)
-
-Precondition: status ≥ contracted (vibe tier is exempt from contracts).
-Set `status: building`.
-
-Mode by size:
-- **Conductor** (≤2 tasks): implement in this session, task by task.
-- **Orchestrator** (>2 tasks): fan out one `sdlc-builder` subagent per task in a
-  `[P]` wave; serialize between dependent waves. Each builder receives ONLY:
-  its task line, `contract/tests.md`, the touched capability's spec, and steering
-  matching its file area — never the whole change history.
-
-Rules for whoever implements:
-- Follow steering pointers the moment the PostToolUse hook emits them.
-- Never edit `sdlc/specs/**`, archive, journals, or lint/test configs to go
-  green — hooks deny the first two; the rest is the config-protection rule.
-- Per-task self-check = that task's tests + lint only; the full test run belongs
-  to /sdlc:verify (moved, not removed).
-- Tick `- [x]` in `## Tasks` as each task lands; note surprises in one line max.
-- Honor `[tier:x]` markers when delegating (see routing.md).
-
-Done when all tasks are ticked and the code compiles/lints.
-`node sdlc/.hooks/journal.mjs note build tasks=<n>` then → /sdlc:verify.
+# /sdlc:build <id> — implement (Run the harness)
+
+Precondition: status ≥ contracted (vibe tier is exempt from contracts).
+Set `status: building`.
+
+Mode by size:
+- **Conductor** (≤2 tasks): implement in this session, task by task.
+- **Orchestrator** (>2 tasks): fan out one `sdlc-builder` subagent per task in a
+  `[P]` wave; serialize between dependent waves. Each builder receives ONLY:
+  its task line, `contract/tests.md`, the touched capability's spec, and steering
+  matching its file area — never the whole change history.
+
+Rules for whoever implements:
+- Follow steering pointers the moment the PostToolUse hook emits them.
+- Never edit `sdlc/specs/**`, archive, journals, or lint/test configs to go
+  green — hooks deny the first two; the rest is the config-protection rule.
+- Per-task self-check = that task's tests + lint only; the full test run belongs
+  to /sdlc:verify (moved, not removed).
+- Tick `- [x]` in `## Tasks` as each task lands; note surprises in one line max.
+- Honor `[tier:x]` markers when delegating (see routing.md).
+
+Done when all tasks are ticked and the code compiles/lints.
+`node sdlc/.hooks/journal.mjs note build tasks=<n>` then → /sdlc:verify.
+
+`--auto`: do this stage, then continue to ship under `auto.md`'s unattended
+mode — gather, confirm once, run. The stage still does its own work first.

package/payload/playbook/contract.md

@@ -1,23 +1,26 @@
-# /sdlc:contract <id> — tests + evals before code
-
-The contract IS the handshake. Nothing in `## Tasks` may be implemented while
-status is `new`.
-
-1. From the Delta scenarios, write `contract/tests.md` (≤60 lines): one row per
-   behavior — Given/When/Then, kind, mapped requirement. List what is explicitly
-   out of scope and why.
-2. Deep tier (standard optional): write `contract/evals.md` (≤40 lines) — the
-   trajectory + quality rubric the sdlc-evaluator will score.
-3. Generate failing tests: delegate to the `sdlc-contractor` agent (cheap tier)
-   with ONLY tests.md + the delta + the project's test conventions. Run the test
-   command from `sdlc/harness.md` — every new test must FAIL (red) now; a test
-   that passes before implementation tests nothing.
-4. Adversarial check instead of human approval: ask the `sdlc-quality` agent to
-   attack the contract — uncovered scenarios, untestable rows, missing edge
-   cases vs the delta. Fix findings; one round is usually enough, two max.
-5. `npx @warnyin/sdlc validate <id>` clean → set frontmatter `status: contracted`
-   and `node sdlc/.hooks/journal.mjs note contract tests=<n>`.
-
-Escalate only if the delta itself turns out ambiguous (back to /sdlc:new step 5).
-
-Next: /sdlc:build.
+# /sdlc:contract <id> — tests + evals before code
+
+The contract IS the handshake. Nothing in `## Tasks` may be implemented while
+status is `new`.
+
+1. From the Delta scenarios, write `contract/tests.md` (≤60 lines): one row per
+   behavior — Given/When/Then, kind, mapped requirement. List what is explicitly
+   out of scope and why.
+2. Deep tier (standard optional): write `contract/evals.md` (≤40 lines) — the
+   trajectory + quality rubric the sdlc-evaluator will score.
+3. Generate failing tests: delegate to the `sdlc-contractor` agent (cheap tier)
+   with ONLY tests.md + the delta + the project's test conventions. Run the test
+   command from `sdlc/harness.md` — every new test must FAIL (red) now; a test
+   that passes before implementation tests nothing.
+4. Adversarial check instead of human approval: ask the `sdlc-quality` agent to
+   attack the contract — uncovered scenarios, untestable rows, missing edge
+   cases vs the delta. Fix findings; one round is usually enough, two max.
+5. `npx @warnyin/sdlc validate <id>` clean → set frontmatter `status: contracted`
+   and `node sdlc/.hooks/journal.mjs note contract tests=<n>`.
+
+Escalate only if the delta itself turns out ambiguous (back to /sdlc:new step 5).
+
+Next: /sdlc:build.
+
+`--auto`: do this stage, then continue to ship under `auto.md`'s unattended
+mode — gather, confirm once, run. The stage still does its own work first.

package/payload/playbook/design.md

@@ -1,20 +1,23 @@
-# /sdlc:design <id> — decisions & trade-offs (deep tier, or on signal)
-
-Run only when: tier is deep, OR the change needs an architectural decision
-(new dependency, schema change, cross-capability contract). Otherwise skip —
-an empty Design section is garbage.
-
-1. Read `change.md`, the full spec of every touched capability, and any steering
-   whose scope matches. Nothing else by default.
-2. Gather in parallel, judge serially: fan out read-only subagents for research
-   (one per question: prior art in this repo, external constraint, data shape).
-   The DECISION is made in the main loop — never delegated, never parallel.
-3. Fill `## Design` with decision lines only:
-   `- decision: <what> · alternatives: <a/b> · because: <why>`
-   Never restate the delta. Respect the tier cap (deep total ≤150).
-4. Escalate to the human ONLY for decisions listed in
-   `sdlc/harness.md § Autonomy policy` (irreversible or hard-floor). Everything
-   else: decide, record, move on.
-5. `npx @warnyin/sdlc validate <id>`.
-
-Next: /sdlc:contract.
+# /sdlc:design <id> — decisions & trade-offs (deep tier, or on signal)
+
+Run only when: tier is deep, OR the change needs an architectural decision
+(new dependency, schema change, cross-capability contract). Otherwise skip —
+an empty Design section is garbage.
+
+1. Read `change.md`, the full spec of every touched capability, and any steering
+   whose scope matches. Nothing else by default.
+2. Gather in parallel, judge serially: fan out read-only subagents for research
+   (one per question: prior art in this repo, external constraint, data shape).
+   The DECISION is made in the main loop — never delegated, never parallel.
+3. Fill `## Design` with decision lines only:
+   `- decision: <what> · alternatives: <a/b> · because: <why>`
+   Never restate the delta. Respect the tier cap (deep total ≤150).
+4. Escalate to the human ONLY for decisions listed in
+   `sdlc/harness.md § Autonomy policy` (irreversible or hard-floor). Everything
+   else: decide, record, move on.
+5. `npx @warnyin/sdlc validate <id>`.
+
+Next: /sdlc:contract.
+
+`--auto`: do this stage, then continue to ship under `auto.md`'s unattended
+mode — gather, confirm once, run. The stage still does its own work first.

package/payload/playbook/feedback.md

@@ -0,0 +1,69 @@
+# /sdlc:feedback [bug|idea] <one line> — file an issue upstream
+
+Reports a bug, a rough edge, or a missing feature in the **framework itself** to
+`warnyin/warnyin-sdlc`. Bugs in the project you are working on belong in that
+project's own tracker — say so and stop.
+
+1. Collect context in one shot; never interrogate the human for it:
+   - version: `npx @warnyin/sdlc version` · node: `node --version` · OS and arch
+   - tool adapter: `tools:` in `sdlc/config.yaml`
+   - active change id + status: `npx @warnyin/sdlc status --json`
+   Any field you cannot read is `unknown` — continue, and never guess a value.
+2. If the invocation carried no description, ask once, in one message: what you
+   did, what you expected, what happened instead.
+3. Look for it first, when `gh` is available:
+   `gh issue list --repo warnyin/warnyin-sdlc --search "<keywords>" --state all --limit 5`.
+   Choose `<keywords>` yourself — two to four plain words, letters/digits/hyphen
+   only — never the reporter's raw sentence: it reaches the shell as an argument
+   exactly like the title does. If an existing thread matches, show it and ask
+   whether to comment there rather than open a duplicate.
+4. Redact before the draft is shown to anyone or sent anywhere:
+   - absolute paths → project-relative paths (a home directory or host name in a
+     path identifies the reporter's machine and employer)
+   - token-, key-, password- and connection-string-shaped values → `<redacted>`,
+     and tell the human which values you removed
+   - never copy the contents of `sdlc/context/constitution.md`, steering files,
+     `.env` files, credential files, journals, or diffs into the report
+   - this is a rule list, not a guarantee: the human reading the draft is the
+     real control, so never claim the report has been fully scrubbed
+5. Show the full draft — destination repo, title, labels, complete body — and ask
+   for approval. No network call happens before that approval. On anything other
+   than approval: revise the draft and ask again.
+6. Submit, once approved:
+   - `gh auth status` must report an authenticated **github.com** account; an
+     enterprise-only login goes to step 7 instead of publishing to the wrong host
+   - `gh issue create --repo warnyin/warnyin-sdlc --title "<title>"
+     --label <bug|enhancement> --body-file -`, body on stdin
+   - never pass the body as an inline `--body` argument: report text carries
+     backticks, quotes and newlines — inline it breaks on PowerShell and is a
+     shell-injection path straight from human-written text
+   - the title is human text on a command line too: write it yourself as a plain
+     summary (≤80 chars, no newline, no `` ` ``, `$`, `"`, `\`, `|`, `;`, `&`),
+     never paste the reporter's words in raw. If a needed character is not
+     allowed, reword the title — do not escape your way around it
+   - report the resulting issue URL back
+7. Fallback when `gh` is absent, logged out, or not on github.com — a normal
+   path, not an error: hand over a prefilled link
+   `https://github.com/warnyin/warnyin-sdlc/issues/new?labels=<label>&title=<t>&body=<b>`
+   with `<t>` and `<b>` URL-encoded. If the encoded link exceeds ~6000 characters,
+   truncate the body it carries and tell the human to paste the rest from the
+   draft shown above.
+
+Body shape (keep it this short — a maintainer triages it in one screen):
+
+```
+### What happened
+<one paragraph, redacted>
+
+### Expected
+<one line>
+
+### Steps
+1. <command or stage>
+
+### Environment
+sdlc <version> · node <version> · <os> · adapter <tool> · change <id> [<status>]
+```
+
+Labels: `bug` for something broken, `enhancement` for an idea or a request.
+Nothing else is attached — no logs, no journal, no diff.

package/payload/playbook/new.md

@@ -1,22 +1,25 @@
-# /sdlc:new <title> — open a change (Requirements)
-
-1. Triage the tier with `sdlc/harness.md § Tier triage`. Hard-floor surface
-   (security, payments, data-loss, irreversible) forces `deep` — no override
-   without an explicit user instruction (record it in Assumptions).
-2. Create `sdlc/changes/<kebab-id>/change.md` from the tier's template at
-   `sdlc/.playbook/templates/change-{vibe|standard|deep}.md` — copy the
-   structure exactly, respect the cap comment.
-3. Ground the delta: grep `## Purpose` of every `sdlc/specs/*/spec.md`; open the
-   FULL spec only for capabilities this change touches. Name each `## Delta:`
-   after an existing capability, or a new kebab-case capability.
-4. Write Why (≤5 lines, no solutioning) and the Delta requirements
-   (`ADDED/MODIFIED/REMOVED Requirement` + WHEN/THEN scenarios — grammar in the
-   delta-spec-format skill). Then Tasks with `[P]` and `[tier:x]` markers.
-5. Ambiguity policy (AI-driven): make the safest assumption and record it under
-   `## Assumptions` with why it is safe. Use `[NEEDS CLARIFICATION: q]` ONLY for
-   facts you cannot obtain or safely assume — then ask the user those questions
-   now, in one batch, and resolve every marker.
-6. `node sdlc/.hooks/journal.mjs set-active <id>` then
-   `npx @warnyin/sdlc validate <id>` — fix errors. Status stays `new`.
-
-Next: deep tier or risky decision → /sdlc:design; otherwise /sdlc:contract.
+# /sdlc:new <title> — open a change (Requirements)
+
+1. Triage the tier with `sdlc/harness.md § Tier triage`. Hard-floor surface
+   (security, payments, data-loss, irreversible) forces `deep` — no override
+   without an explicit user instruction (record it in Assumptions).
+2. Create `sdlc/changes/<kebab-id>/change.md` from the tier's template at
+   `sdlc/.playbook/templates/change-{vibe|standard|deep}.md` — copy the
+   structure exactly, respect the cap comment.
+3. Ground the delta: grep `## Purpose` of every `sdlc/specs/*/spec.md`; open the
+   FULL spec only for capabilities this change touches. Name each `## Delta:`
+   after an existing capability, or a new kebab-case capability.
+4. Write Why (≤5 lines, no solutioning) and the Delta requirements
+   (`ADDED/MODIFIED/REMOVED Requirement` + WHEN/THEN scenarios — grammar in the
+   delta-spec-format skill). Then Tasks with `[P]` and `[tier:x]` markers.
+5. Ambiguity policy (AI-driven): make the safest assumption and record it under
+   `## Assumptions` with why it is safe. Use `[NEEDS CLARIFICATION: q]` ONLY for
+   facts you cannot obtain or safely assume — then ask the user those questions
+   now, in one batch, and resolve every marker.
+6. `node sdlc/.hooks/journal.mjs set-active <id>` then
+   `npx @warnyin/sdlc validate <id>` — fix errors. Status stays `new`.
+
+Next: deep tier or risky decision → /sdlc:design; otherwise /sdlc:contract.
+
+`--auto`: do this stage, then continue to ship under `auto.md`'s unattended
+mode — gather, confirm once, run. The stage still does its own work first.

package/payload/playbook/next.md

@@ -1,12 +1,14 @@
-# /sdlc:next — where am I, what now (read-only)
-
-1. Run `npx @warnyin/sdlc status`.
-2. For each active change map status → next command:
-   - `new` + markers unresolved → resolve questions (playbook new.md §5)
-   - `new` (clean) → /sdlc:design (deep/signal) or /sdlc:contract
-   - `contracted` → /sdlc:build
-   - `building` → /sdlc:build (finish open tasks)
-   - `verified` → /sdlc:review (if signals) or /sdlc:ship
-3. If nothing is active: suggest /sdlc:new, or /sdlc:observe if archived changes
-   have unread digests.
-4. Answer in ≤5 lines. Create or modify nothing.
+# /sdlc:next — where am I, what now (read-only)
+
+1. Run `npx @warnyin/sdlc status`.
+2. For each active change map status → next command:
+   - `new` + markers unresolved → resolve questions (playbook new.md §5)
+   - `new` (clean) → /sdlc:design (deep/signal) or /sdlc:contract
+   - `contracted` → /sdlc:build
+   - `building` → /sdlc:build (finish open tasks)
+   - `verified` → /sdlc:review (if signals) or /sdlc:ship
+3. If nothing is active: suggest /sdlc:new, or /sdlc:observe if archived changes
+   have unread digests.
+4. Answer in ≤5 lines. Create or modify nothing.
+5. When the remaining path is more than one stage, add one line: the same command
+   with `--auto` confirms once and runs to ship.

package/payload/playbook/review.md

@@ -1,17 +1,26 @@
-# /sdlc:review <id> — agent panel (signal-triggered)
-
-Run when: tier deep, OR the diff touches auth/payments/data handling, OR >10
-files changed. Otherwise skip silently — a ceremonial review is garbage.
-
-1. Fan out in parallel, all read-only, each with the diff + change.md only:
-   - `sdlc-architect` (deepest): design integrity, coupling, contract drift.
-   - `sdlc-security` (balanced): injection, authz, secrets, unsafe deps.
-   - `sdlc-quality` (cheap): contract coverage gaps, edge cases, dead code.
-   - `sdlc-ops` (cheap): config, migrations, rollback, observability impact.
-2. Merge findings in the main loop. Classify: blocker | improvement | note.
-3. Blockers → append as fix tasks and route back to /sdlc:build (counts toward
-   the same 3-round budget as verify). Improvements: apply if ≤5 min each,
-   otherwise record one line in the change for the digest.
-4. `node sdlc/.hooks/journal.mjs note review blockers=<n>`.
-
-Pass condition: zero open blockers. Next: /sdlc:ship.
+# /sdlc:review <id> — agent panel (signal-triggered)
+
+Run when: tier deep, OR the diff touches auth/payments/data handling, OR >10
+files changed. Otherwise skip silently — a ceremonial review is garbage.
+
+1. Fan out in parallel, all read-only, each with the diff + change.md only:
+   - `sdlc-architect` (deepest): design integrity, coupling, contract drift.
+   - `sdlc-security` (balanced): injection, authz, secrets, unsafe deps.
+   - `sdlc-quality` (cheap): contract coverage gaps, edge cases, dead code.
+   - `sdlc-ops` (cheap): config, migrations, rollback, observability impact.
+2. Merge findings in the main loop. Classify: blocker | improvement | note.
+3. Blockers → append as fix tasks and route back to /sdlc:build (counts toward
+   the same 3-round budget as verify). Improvements: apply if ≤5 min each,
+   otherwise record one line in the change for the digest.
+4. `node sdlc/.hooks/journal.mjs note review blockers=<n> mode=<panel|solo>`.
+   `mode=panel` when the four agents produced the findings; `mode=solo` when the
+   panel cannot run — subagents unavailable or disallowed — and the main loop
+   reviewed its own work through those four lenses instead. Run it that way
+   rather than skipping the review, and say so in the note: a self-review that
+   is recorded as a panel is worse than no review, because it reads as
+   independent evidence months later.
+
+Pass condition: zero open blockers. Next: /sdlc:ship.
+
+`--auto`: do this stage, then continue to ship under `auto.md`'s unattended
+mode — gather, confirm once, run. The stage still does its own work first.

package/payload/playbook/ship.md

@@ -1,24 +1,33 @@
-# /sdlc:ship <id> — merge, archive, learn, digest
-
-Precondition: `status: verified` (+ review passed when it ran).
-
-1. **Policy check** (`sdlc/harness.md § Autonomy policy`): if this change is NOT
-   auto-shippable (deep/hard-floor), show the human a 5-line summary (why, delta
-   heads, verify result, cost so far) and wait for approval. Otherwise proceed.
-2. Open the gate and archive mechanically:
-   `node sdlc/.hooks/journal.mjs open-ship <id>`
-   `npx @warnyin/sdlc archive <id>`
-   (validates --strict, merges every Delta into `sdlc/specs/`, promotes evals,
-   stamps `status: shipped`, moves the folder to `changes/archive/<date>-<id>/`).
-3. **Learn** — delegate to `sdlc-learner` (cheap) with the archived change.md +
-   its journal.ndjson. It proposes ≤3 items: add-rule (with evidence pointer) /
-   expire-or-demote (rule or steering that never fired) / harness tweak.
-   Apply reductions and demotions immediately (they always save tokens).
-   Additions to always-loaded context are NOT applied — list them in the digest.
-4. **Digest** — write `sdlc/changes/archive/<date>-<id>/digest.md` (≤15 lines):
-   what shipped, spec deltas merged, assumptions made, verify rounds, tokens/cost
-   (from journal `session` events), learner proposals awaiting the human.
-5. Close the gate: `node sdlc/.hooks/journal.mjs close`. Tell the user in one
-   line: shipped + where the digest is.
-
-The digest is the async human touchpoint — reviewable and revertible later.
+# /sdlc:ship <id> — merge, archive, learn, digest
+
+Precondition: `status: verified` (+ review passed when it ran).
+
+1. **Policy check** (`sdlc/harness.md § Autonomy policy`): if this change is NOT
+   auto-shippable (deep/hard-floor), show the human a 5-line summary (why, delta
+   heads, verify result, cost so far) and wait for approval. Otherwise proceed.
+2. Open the gate and archive mechanically:
+   `node sdlc/.hooks/journal.mjs open-ship <id>`
+   `npx @warnyin/sdlc archive <id>`
+   (validates --strict, merges every Delta into `sdlc/specs/`, promotes evals,
+   stamps `status: shipped`, moves the folder to `changes/archive/<date>-<id>/`).
+3. **Learn** — delegate to `sdlc-learner` (cheap) with the archived change.md +
+   its journal.ndjson. It proposes ≤3 items: add-rule (with evidence pointer) /
+   expire-or-demote (rule or steering that never fired) / harness tweak.
+   Apply reductions and demotions immediately (they always save tokens).
+   Additions to always-loaded context are NOT applied — list them in the digest.
+4. **Digest** — write `sdlc/changes/archive/<date>-<id>/digest.md` (≤15 lines):
+   what shipped, spec deltas merged, assumptions made, verify rounds, tokens/cost
+   (from journal `session` events), learner proposals awaiting the human.
+   When any verify or review note carries `mode=solo`, the digest SHALL say which
+   outcomes were self-produced. A reader months from now cannot otherwise tell a
+   panel's verdict from the author's own.
+   When any `escalation` event carries `preauth=yes`, the digest SHALL list those
+   pre-authorized escalations by condition — the points where a human would normally
+   have stood and, this run, did not.
+5. Close the gate: `node sdlc/.hooks/journal.mjs close`. Tell the user in one
+   line: shipped + where the digest is.
+
+The digest is the async human touchpoint — reviewable and revertible later.
+
+`--auto`: do this stage, then continue to ship under `auto.md`'s unattended
+mode — gather, confirm once, run. The stage still does its own work first.

package/payload/playbook/verify.md

@@ -1,24 +1,37 @@
-# /sdlc:verify <id> — the feedback loop
-
-Two halves, both must pass. Verification is against the CONTRACT, not vibes.
-
-1. **Tests (deterministic)**: run the full test command from `sdlc/harness.md`.
-   Every row of `contract/tests.md` must be covered by a passing test.
-2. **Evals (non-deterministic)** — when `contract/evals.md` exists: delegate to
-   the `sdlc-evaluator` agent (cheap) with the rubric + the diff + the task log;
-   it returns a score per rubric line. Pass bar is written in the file.
-
-On failure:
-- Cluster failures by root cause (one line each) and append the cluster note to
-  the change's `## Tasks` area as unchecked fix tasks.
-- `node sdlc/.hooks/journal.mjs note verify result=fail round=<n>`
-- Route back to /sdlc:build. Maximum 3 rounds total; on the 4th failure STOP and
-  escalate to the human with the cluster history (Autonomy policy condition).
-- Never lower the bar: do not edit tests/evals to pass unless the contract
-  itself was wrong — changing the contract reopens the adversarial check.
-
-On pass: set `status: verified`,
-`node sdlc/.hooks/journal.mjs note verify result=pass round=<n>`.
-
-Next: review signals present (deep tier, security-touching diff, >10 files)
-→ /sdlc:review; otherwise → /sdlc:ship.
+# /sdlc:verify <id> — the feedback loop
+
+Two halves, both must pass. Verification is against the CONTRACT, not vibes.
+
+1. **Tests (deterministic)**: run the full test command from `sdlc/harness.md`.
+   Every row of `contract/tests.md` must be covered by a passing test.
+2. **Evals (non-deterministic)** — when `contract/evals.md` exists: delegate to
+   the `sdlc-evaluator` agent (cheap) with the rubric + the diff + the task log;
+   it returns a score per rubric line. Pass bar is written in the file.
+   If the evaluator cannot run — subagents unavailable or disallowed in this
+   session — score in the main loop instead and record that. A panel that could
+   not run is a fact to write down, never a reason to stop the pipeline; but a
+   run that judged its own work is weaker evidence and must not read as if a
+   panel had agreed.
+
+On failure:
+- Cluster failures by root cause (one line each) and append the cluster note to
+  the change's `## Tasks` area as unchecked fix tasks.
+- `node sdlc/.hooks/journal.mjs note verify result=fail round=<n> mode=<panel|solo>`
+- Route back to /sdlc:build. Maximum 3 rounds total; on the 4th failure STOP and
+  escalate to the human with the cluster history (Autonomy policy condition).
+- Never lower the bar: do not edit tests/evals to pass unless the contract
+  itself was wrong — changing the contract reopens the adversarial check.
+
+On pass: set `status: verified`,
+`node sdlc/.hooks/journal.mjs note verify result=pass round=<n> mode=<panel|solo>`.
+
+`mode=panel` only when independent agents produced the judgment; `mode=solo` when
+the main loop judged its own work. Every verify note carries it, pass or fail —
+`/sdlc:observe` reports a change as self-judged from this field, and omitting it
+leaves the record silently indistinguishable from an independent one.
+
+Next: review signals present (deep tier, security-touching diff, >10 files)
+→ /sdlc:review; otherwise → /sdlc:ship.
+
+`--auto`: do this stage, then continue to ship under `auto.md`'s unattended
+mode — gather, confirm once, run. The stage still does its own work first.