@warnyin/sdlc 0.4.0 → 0.5.0

package/CHANGELOG.md

@@ -1,5 +1,34 @@
 # Changelog
 
+## 0.5.0 (2026-08-25)
+
+- **`--auto` on every pipeline stage.** `/sdlc:auto` already ran the whole pipeline,
+  but it stopped at every escalation — so you were pulled back in three or four times
+  per change and typed each stage anyway. Now all seven stage commands take `--auto`:
+  the run gathers what it needs, confirms once, and goes to ship. The confirmation is
+  decidable item by item — scope as understood, the tier and why, every ambiguity with
+  the assumption to be acted on, and each escalation as its own refusable line, the
+  ship row naming the hard-floor surface it covers instead of hiding behind a general
+  "run without me". Nothing is written before you confirm, down to the active-change
+  pointer, so declining leaves the repository untouched. The approval covers that run
+  only — not config, not the next change, not a resume. Anything outside what you
+  confirmed still stops and asks.
+- Escalations passed unattended are journalled, counted by `/sdlc:observe` as
+  `unattended×N`, and listed in the digest: the record shows where a human would
+  normally have stood and, that run, did not.
+- **Verify and review outcomes now record how they were produced** (`mode=panel|solo`).
+  A journal that says "verify passed" hides the thing a reader most needs later —
+  whether that verdict came from independent reviewers or from the same loop that
+  wrote the code. `observe` marks such changes `self-judged`, and the digest must name
+  self-produced outcomes. Absent provenance reads as unknown, never as `panel`, so
+  older journals are not retroactively dressed up as independently reviewed; where
+  provenance is mixed, the weakest link decides.
+- Where a panel cannot run, the playbooks now say to judge in the main loop and record
+  that — not to skip the stage. A review that never happened is worse than one
+  labelled honestly.
+- The constitution gains a hard rule: human-written text SHALL NOT reach a shell as an
+  argument. It is the defect that got past two separate gates in 0.4.0.
+
 ## 0.4.0 (2026-08-25)
 
 - **New stage command `/sdlc:feedback`** — reports a bug, a rough edge, or a missing

package/README.md

@@ -31,8 +31,14 @@ Then in your coding agent:
 /sdlc:init                      # interview → constitution + harness (the one human gate)
 /sdlc:auto Add rate limiting    # AI runs new → contract → build → verify → ship
 /sdlc:auto add-rate-limiting    # already opened it with /sdlc:new? auto resumes from there
+/sdlc:new Add rate limiting --auto   # any stage takes --auto: confirm once, then run to ship
 ```
 
+`--auto` asks everything up front — scope, tier, each ambiguity, and every escalation
+it wants pre-approved as its own line you can refuse — then runs unattended. Nothing
+is written until you confirm, the approval covers that run only, and anything you did
+not pre-approve still stops and asks.
+
 ## How it works
 
 ```

package/lib/observe.mjs

@@ -1,174 +1,187 @@
-// Observability aggregation — reads journals + context files, computes the
-// numbers /sdlc:observe reports. Pure given an sdlc root; no LLM involved.
-
-import fs from 'node:fs';
-import path from 'node:path';
-import { parseFrontmatter } from './frontmatter.mjs';
-import { CAPS, countEffectiveLines } from './caps.mjs';
-
-function readJournal(dir) {
-  const p = path.join(dir, 'journal.ndjson');
-  if (!fs.existsSync(p)) return [];
-  return fs.readFileSync(p, 'utf8').split('\n').filter(Boolean).map((l) => {
-    try { return JSON.parse(l); } catch { return null; }
-  }).filter(Boolean);
-}
-
-function summarizeChange(dir, id, archived) {
-  const events = readJournal(dir);
-  const tokens = { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 };
-  let costUsd = 0;
-  let costKnown = false;
-  let sessions = 0;
-  const verify = { rounds: 0, firstPass: null };
-  let guards = 0;
-  let compacts = 0;
-
-  for (const e of events) {
-    if (e.event === 'session') {
-      sessions++;
-      for (const k of Object.keys(tokens)) tokens[k] += e.totals?.[k] ?? 0;
-      if (typeof e.costUsd === 'number') { costUsd += e.costUsd; costKnown = true; }
-    } else if (e.event === 'verify') {
-      verify.rounds++;
-      if (verify.firstPass === null) verify.firstPass = e.result === 'pass';
-    } else if (e.event === 'guard') guards++;
-    else if (e.event === 'compact') compacts++;
-  }
-
-  const first = events[0]?.ts ? Date.parse(events[0].ts) : null;
-  const shipEvent = events.find((e) => e.event === 'ship');
-  const shippedAt = shipEvent?.ts ? Date.parse(shipEvent.ts) : null;
-  const leadTimeMs = first != null && shippedAt != null ? shippedAt - first : null;
-
-  let tier = null;
-  let status = null;
-  const changePath = path.join(dir, 'change.md');
-  if (fs.existsSync(changePath)) {
-    const { data } = parseFrontmatter(fs.readFileSync(changePath, 'utf8'));
-    tier = data.tier ?? null;
-    status = data.status ?? null;
-  }
-
-  return {
-    id, archived, tier, status, sessions, tokens,
-    costUsd: costKnown ? Number(costUsd.toFixed(4)) : null,
-    verify, guards, compacts, leadTimeMs,
-    digest: archived ? fs.existsSync(path.join(dir, 'digest.md')) : null,
-  };
-}
-
-export function buildReport(sdlcRoot) {
-  const changes = [];
-
-  const changesDir = path.join(sdlcRoot, 'changes');
-  if (fs.existsSync(changesDir)) {
-    for (const d of fs.readdirSync(changesDir, { withFileTypes: true })) {
-      if (!d.isDirectory() || d.name === 'archive') continue;
-      changes.push(summarizeChange(path.join(changesDir, d.name), d.name, false));
-    }
-    const archiveDir = path.join(changesDir, 'archive');
-    if (fs.existsSync(archiveDir)) {
-      for (const d of fs.readdirSync(archiveDir, { withFileTypes: true })) {
-        if (!d.isDirectory()) continue;
-        changes.push(summarizeChange(path.join(archiveDir, d.name), d.name, true));
-      }
-    }
-  }
-
-  // Residency: constitution + always-steering effective lines vs budget.
-  let alwaysLines = 0;
-  const constitutionPath = path.join(sdlcRoot, 'context', 'constitution.md');
-  if (fs.existsSync(constitutionPath)) {
-    alwaysLines += countEffectiveLines(fs.readFileSync(constitutionPath, 'utf8'));
-  }
-  const steering = [];
-  const pointerHits = new Map();
-  for (const c of changes) {
-    const dir = c.archived
-      ? path.join(sdlcRoot, 'changes', 'archive', c.id)
-      : path.join(sdlcRoot, 'changes', c.id);
-    for (const e of readJournal(dir)) {
-      if (e.event === 'pointer' && e.steering) {
-        pointerHits.set(e.steering, (pointerHits.get(e.steering) ?? 0) + 1);
-      }
-    }
-  }
-  // Global journal (events with no active change) counts too.
-  for (const e of readJournal(path.join(sdlcRoot, '.state'))) {
-    if (e.event === 'pointer' && e.steering) {
-      pointerHits.set(e.steering, (pointerHits.get(e.steering) ?? 0) + 1);
-    }
-  }
-
-  const steeringDir = path.join(sdlcRoot, 'context', 'steering');
-  if (fs.existsSync(steeringDir)) {
-    for (const f of fs.readdirSync(steeringDir).filter((n) => n.endsWith('.md')).sort()) {
-      const raw = fs.readFileSync(path.join(steeringDir, f), 'utf8');
-      const { data } = parseFrontmatter(raw);
-      const inclusion = data.inclusion ?? 'manual';
-      if (inclusion === 'always') alwaysLines += countEffectiveLines(raw);
-      steering.push({ file: f, inclusion, pointerHits: pointerHits.get(f) ?? 0 });
-    }
-  }
-
-  // Flags — plain strings the playbook can surface with suggested fixes.
-  const flags = [];
-  if (alwaysLines > CAPS.alwaysBudget) {
-    flags.push(`residency: always-loaded is ${alwaysLines}/${CAPS.alwaysBudget} lines — distill via /sdlc:steer`);
-  }
-  const shipped = changes.filter((c) => c.archived);
-  for (const s of steering.filter((s) => s.inclusion === 'paths' && s.pointerHits === 0)) {
-    if (shipped.length >= 2) {
-      flags.push(`steering/${s.file}: zero pointer hits across ${shipped.length} shipped changes — demote or delete`);
-    }
-  }
-  for (const c of changes) {
-    if (c.compacts > 0) flags.push(`${c.id}: ${c.compacts} compact event(s) — context overflowed, find the resident artifact`);
-    if (c.verify.rounds > 3) flags.push(`${c.id}: ${c.verify.rounds} verify rounds — contract or routing needs attention`);
-  }
-  for (const c of shipped.filter((c) => c.digest === false)) {
-    flags.push(`${c.id}: archived without digest.md — ship playbook step 4 was skipped`);
-  }
-
-  const firstPassRuns = changes.filter((c) => c.verify.firstPass !== null);
-  const summary = {
-    active: changes.filter((c) => !c.archived).length,
-    shipped: shipped.length,
-    firstPassRate: firstPassRuns.length
-      ? Number((firstPassRuns.filter((c) => c.verify.firstPass).length / firstPassRuns.length).toFixed(2))
-      : null,
-  };
-
-  return {
-    summary,
-    changes,
-    residency: { alwaysLines, budget: CAPS.alwaysBudget },
-    steering,
-    flags,
-  };
-}
-
-const fmtK = (n) => (n >= 1_000_000 ? `${(n / 1_000_000).toFixed(1)}M`
-  : n >= 1_000 ? `${(n / 1_000).toFixed(1)}k` : String(n));
-
-export function renderReport(report) {
-  const lines = [];
-  const { summary, residency } = report;
-  lines.push(`changes: ${summary.active} active · ${summary.shipped} shipped`
-    + (summary.firstPassRate != null ? ` · first-pass ${(summary.firstPassRate * 100).toFixed(0)}%` : ''));
-  lines.push(`residency: ${residency.alwaysLines}/${residency.budget} always-loaded lines`);
-  for (const c of report.changes) {
-    const t = c.tokens;
-    const lead = c.leadTimeMs != null ? ` · lead ${(c.leadTimeMs / 3_600_000).toFixed(1)}h` : '';
-    lines.push(`  ${c.archived ? '✓' : '·'} ${c.id} [${c.tier ?? '?'}]`
-      + ` ${fmtK(t.input)}in/${fmtK(t.output)}out`
-      + (c.costUsd != null ? ` $${c.costUsd}` : '')
-      + ` · verify×${c.verify.rounds}${lead}`);
-  }
-  for (const s of report.steering) {
-    lines.push(`  steering/${s.file} [${s.inclusion}] hits:${s.pointerHits}`);
-  }
-  for (const f of report.flags) lines.push(`  ⚠ ${f}`);
-  return lines.join('\n');
-}
+// Observability aggregation — reads journals + context files, computes the
+// numbers /sdlc:observe reports. Pure given an sdlc root; no LLM involved.
+
+import fs from 'node:fs';
+import path from 'node:path';
+import { parseFrontmatter } from './frontmatter.mjs';
+import { CAPS, countEffectiveLines } from './caps.mjs';
+
+function readJournal(dir) {
+  const p = path.join(dir, 'journal.ndjson');
+  if (!fs.existsSync(p)) return [];
+  return fs.readFileSync(p, 'utf8').split('\n').filter(Boolean).map((l) => {
+    try { return JSON.parse(l); } catch { return null; }
+  }).filter(Boolean);
+}
+
+function summarizeChange(dir, id, archived) {
+  const events = readJournal(dir);
+  const tokens = { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 };
+  let costUsd = 0;
+  let costKnown = false;
+  let sessions = 0;
+  const verify = { rounds: 0, firstPass: null };
+  // null = the journal never said; a run that predates provenance must not be
+  // read as independently judged.
+  let selfJudged = null;
+  // escalations the run passed without a human, because one was pre-approved.
+  let preauthorized = 0;
+  let guards = 0;
+  let compacts = 0;
+
+  for (const e of events) {
+    if (e.event === 'escalation' && e.preauth === 'yes') preauthorized++;
+    if (e.event === 'verify' || e.event === 'review') {
+      // the weakest link decides: one self-produced judgment marks the change.
+      if (e.mode === 'solo') selfJudged = true;
+      else if (e.mode === 'panel' && selfJudged === null) selfJudged = false;
+    }
+    if (e.event === 'session') {
+      sessions++;
+      for (const k of Object.keys(tokens)) tokens[k] += e.totals?.[k] ?? 0;
+      if (typeof e.costUsd === 'number') { costUsd += e.costUsd; costKnown = true; }
+    } else if (e.event === 'verify') {
+      verify.rounds++;
+      if (verify.firstPass === null) verify.firstPass = e.result === 'pass';
+    } else if (e.event === 'guard') guards++;
+    else if (e.event === 'compact') compacts++;
+  }
+
+  const first = events[0]?.ts ? Date.parse(events[0].ts) : null;
+  const shipEvent = events.find((e) => e.event === 'ship');
+  const shippedAt = shipEvent?.ts ? Date.parse(shipEvent.ts) : null;
+  const leadTimeMs = first != null && shippedAt != null ? shippedAt - first : null;
+
+  let tier = null;
+  let status = null;
+  const changePath = path.join(dir, 'change.md');
+  if (fs.existsSync(changePath)) {
+    const { data } = parseFrontmatter(fs.readFileSync(changePath, 'utf8'));
+    tier = data.tier ?? null;
+    status = data.status ?? null;
+  }
+
+  return {
+    id, archived, tier, status, sessions, tokens,
+    costUsd: costKnown ? Number(costUsd.toFixed(4)) : null,
+    verify, selfJudged, preauthorized, guards, compacts, leadTimeMs,
+    digest: archived ? fs.existsSync(path.join(dir, 'digest.md')) : null,
+  };
+}
+
+export function buildReport(sdlcRoot) {
+  const changes = [];
+
+  const changesDir = path.join(sdlcRoot, 'changes');
+  if (fs.existsSync(changesDir)) {
+    for (const d of fs.readdirSync(changesDir, { withFileTypes: true })) {
+      if (!d.isDirectory() || d.name === 'archive') continue;
+      changes.push(summarizeChange(path.join(changesDir, d.name), d.name, false));
+    }
+    const archiveDir = path.join(changesDir, 'archive');
+    if (fs.existsSync(archiveDir)) {
+      for (const d of fs.readdirSync(archiveDir, { withFileTypes: true })) {
+        if (!d.isDirectory()) continue;
+        changes.push(summarizeChange(path.join(archiveDir, d.name), d.name, true));
+      }
+    }
+  }
+
+  // Residency: constitution + always-steering effective lines vs budget.
+  let alwaysLines = 0;
+  const constitutionPath = path.join(sdlcRoot, 'context', 'constitution.md');
+  if (fs.existsSync(constitutionPath)) {
+    alwaysLines += countEffectiveLines(fs.readFileSync(constitutionPath, 'utf8'));
+  }
+  const steering = [];
+  const pointerHits = new Map();
+  for (const c of changes) {
+    const dir = c.archived
+      ? path.join(sdlcRoot, 'changes', 'archive', c.id)
+      : path.join(sdlcRoot, 'changes', c.id);
+    for (const e of readJournal(dir)) {
+      if (e.event === 'pointer' && e.steering) {
+        pointerHits.set(e.steering, (pointerHits.get(e.steering) ?? 0) + 1);
+      }
+    }
+  }
+  // Global journal (events with no active change) counts too.
+  for (const e of readJournal(path.join(sdlcRoot, '.state'))) {
+    if (e.event === 'pointer' && e.steering) {
+      pointerHits.set(e.steering, (pointerHits.get(e.steering) ?? 0) + 1);
+    }
+  }
+
+  const steeringDir = path.join(sdlcRoot, 'context', 'steering');
+  if (fs.existsSync(steeringDir)) {
+    for (const f of fs.readdirSync(steeringDir).filter((n) => n.endsWith('.md')).sort()) {
+      const raw = fs.readFileSync(path.join(steeringDir, f), 'utf8');
+      const { data } = parseFrontmatter(raw);
+      const inclusion = data.inclusion ?? 'manual';
+      if (inclusion === 'always') alwaysLines += countEffectiveLines(raw);
+      steering.push({ file: f, inclusion, pointerHits: pointerHits.get(f) ?? 0 });
+    }
+  }
+
+  // Flags — plain strings the playbook can surface with suggested fixes.
+  const flags = [];
+  if (alwaysLines > CAPS.alwaysBudget) {
+    flags.push(`residency: always-loaded is ${alwaysLines}/${CAPS.alwaysBudget} lines — distill via /sdlc:steer`);
+  }
+  const shipped = changes.filter((c) => c.archived);
+  for (const s of steering.filter((s) => s.inclusion === 'paths' && s.pointerHits === 0)) {
+    if (shipped.length >= 2) {
+      flags.push(`steering/${s.file}: zero pointer hits across ${shipped.length} shipped changes — demote or delete`);
+    }
+  }
+  for (const c of changes) {
+    if (c.compacts > 0) flags.push(`${c.id}: ${c.compacts} compact event(s) — context overflowed, find the resident artifact`);
+    if (c.verify.rounds > 3) flags.push(`${c.id}: ${c.verify.rounds} verify rounds — contract or routing needs attention`);
+  }
+  for (const c of shipped.filter((c) => c.digest === false)) {
+    flags.push(`${c.id}: archived without digest.md — ship playbook step 4 was skipped`);
+  }
+
+  const firstPassRuns = changes.filter((c) => c.verify.firstPass !== null);
+  const summary = {
+    active: changes.filter((c) => !c.archived).length,
+    shipped: shipped.length,
+    firstPassRate: firstPassRuns.length
+      ? Number((firstPassRuns.filter((c) => c.verify.firstPass).length / firstPassRuns.length).toFixed(2))
+      : null,
+  };
+
+  return {
+    summary,
+    changes,
+    residency: { alwaysLines, budget: CAPS.alwaysBudget },
+    steering,
+    flags,
+  };
+}
+
+const fmtK = (n) => (n >= 1_000_000 ? `${(n / 1_000_000).toFixed(1)}M`
+  : n >= 1_000 ? `${(n / 1_000).toFixed(1)}k` : String(n));
+
+export function renderReport(report) {
+  const lines = [];
+  const { summary, residency } = report;
+  lines.push(`changes: ${summary.active} active · ${summary.shipped} shipped`
+    + (summary.firstPassRate != null ? ` · first-pass ${(summary.firstPassRate * 100).toFixed(0)}%` : ''));
+  lines.push(`residency: ${residency.alwaysLines}/${residency.budget} always-loaded lines`);
+  for (const c of report.changes) {
+    const t = c.tokens;
+    const lead = c.leadTimeMs != null ? ` · lead ${(c.leadTimeMs / 3_600_000).toFixed(1)}h` : '';
+    lines.push(`  ${c.archived ? '✓' : '·'} ${c.id} [${c.tier ?? '?'}]`
+      + ` ${fmtK(t.input)}in/${fmtK(t.output)}out`
+      + (c.costUsd != null ? ` $${c.costUsd}` : '')
+      + ` · verify×${c.verify.rounds}${c.selfJudged === true ? ' · self-judged' : ''}`
+      + (c.preauthorized > 0 ? ` · unattended×${c.preauthorized}` : '')
+      + `${lead}`);
+  }
+  for (const s of report.steering) {
+    lines.push(`  steering/${s.file} [${s.inclusion}] hits:${s.pointerHits}`);
+  }
+  for (const f of report.flags) lines.push(`  ⚠ ${f}`);
+  return lines.join('\n');
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@warnyin/sdlc",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Spec-driven, AI-driven SDLC framework — token-lean specs, contract-first changes, autonomous pipeline with managed hooks. Operationalizes the Day-1 'New SDLC with Vibe Coding' work process.",
   "type": "module",
   "bin": {

package/payload/adapters/claude/commands/sdlc/build.md

@@ -1,5 +1,5 @@
----
-description: Implement — conductor in-session or orchestrator fan-out per [P] wave
-argument-hint: "<change-id>"
----
-Read `sdlc/.playbook/build.md` and execute it now. Arguments: $ARGUMENTS
+---
+description: Implement — conductor in-session or orchestrator fan-out per [P] wave
+argument-hint: "<change-id> [--auto]"
+---
+Read `sdlc/.playbook/build.md` and execute it now. Arguments: $ARGUMENTS

package/payload/adapters/claude/commands/sdlc/contract.md

@@ -1,5 +1,5 @@
----
-description: Write tests + evals BEFORE code, generate failing tests, adversarial check (the contract)
-argument-hint: "<change-id>"
----
-Read `sdlc/.playbook/contract.md` and execute it now. Arguments: $ARGUMENTS
+---
+description: Write tests + evals BEFORE code, generate failing tests, adversarial check (the contract)
+argument-hint: "<change-id> [--auto]"
+---
+Read `sdlc/.playbook/contract.md` and execute it now. Arguments: $ARGUMENTS

package/payload/adapters/claude/commands/sdlc/design.md

@@ -1,5 +1,5 @@
----
-description: Record design decisions & trade-offs (deep tier or on signal)
-argument-hint: "<change-id>"
----
-Read `sdlc/.playbook/design.md` and execute it now. Arguments: $ARGUMENTS
+---
+description: Record design decisions & trade-offs (deep tier or on signal)
+argument-hint: "<change-id> [--auto]"
+---
+Read `sdlc/.playbook/design.md` and execute it now. Arguments: $ARGUMENTS

package/payload/adapters/claude/commands/sdlc/new.md

@@ -1,5 +1,5 @@
----
-description: Open a change — triage tier, write Why + Delta spec + Tasks (Requirements)
-argument-hint: "<title>"
----
-Read `sdlc/.playbook/new.md` and execute it now. Arguments: $ARGUMENTS
+---
+description: Open a change — triage tier, write Why + Delta spec + Tasks (Requirements)
+argument-hint: "<title> [--auto]"
+---
+Read `sdlc/.playbook/new.md` and execute it now. Arguments: $ARGUMENTS

package/payload/adapters/claude/commands/sdlc/review.md

@@ -1,5 +1,5 @@
----
-description: Signal-triggered agent panel: architect / security / quality / ops (read-only)
-argument-hint: "<change-id>"
----
-Read `sdlc/.playbook/review.md` and execute it now. Arguments: $ARGUMENTS
+---
+description: Signal-triggered agent panel: architect / security / quality / ops (read-only)
+argument-hint: "<change-id> [--auto]"
+---
+Read `sdlc/.playbook/review.md` and execute it now. Arguments: $ARGUMENTS

package/payload/adapters/claude/commands/sdlc/ship.md

@@ -1,5 +1,5 @@
----
-description: Merge Delta into living specs, archive, run the learner, write the digest
-argument-hint: "<change-id>"
----
-Read `sdlc/.playbook/ship.md` and execute it now. Arguments: $ARGUMENTS
+---
+description: Merge Delta into living specs, archive, run the learner, write the digest
+argument-hint: "<change-id> [--auto]"
+---
+Read `sdlc/.playbook/ship.md` and execute it now. Arguments: $ARGUMENTS

package/payload/adapters/claude/commands/sdlc/verify.md

@@ -1,5 +1,5 @@
----
-description: Run the contract: full tests + eval rubric; failures route back to build (max 3 rounds)
-argument-hint: "<change-id>"
----
-Read `sdlc/.playbook/verify.md` and execute it now. Arguments: $ARGUMENTS
+---
+description: Run the contract: full tests + eval rubric; failures route back to build (max 3 rounds)
+argument-hint: "<change-id> [--auto]"
+---
+Read `sdlc/.playbook/verify.md` and execute it now. Arguments: $ARGUMENTS

package/payload/playbook/README.md

@@ -10,6 +10,7 @@ new → [design] → contract → build → verify → [review] → ship
 |---|---|---|---|---|
 | /sdlc:init | Configure harness | interview | constitution, harness.md | human approves (once) |
 | /sdlc:auto | whole loop | status (resumes an open change) | everything below | escalation only |
+| any stage `--auto` | that stage → ship | status + your answers | everything from there | one confirmation up front |
 | /sdlc:new | Requirements | specs Purpose headers | change.md | validator: delta + assumptions |
 | /sdlc:design | Architecture | change + touched specs | change.md § Design | escalate irreversible only |
 | /sdlc:contract | Contract-first | change.md | contract/*, failing tests | adversarial panel + validator |

package/payload/playbook/auto.md

@@ -1,31 +1,66 @@
-# /sdlc:auto <title|change-id> — the whole pipeline, one command
-
-Runs new → [design] → contract → build → verify → [review] → ship, each stage by
-its own playbook, WITHOUT pausing for the human except on the Autonomy-policy
-escalation conditions:
-
-- hard-floor surface (security, payments, data-loss, irreversible),
-- a `[NEEDS CLARIFICATION]` the agent cannot resolve alone,
-- verify failed more than 3 rounds,
-- token budget exceeded (if the user set one),
-- ship policy requires human approval (deep tier).
-
-Entry stage — resolve this first, never assume `new`:
-- Run `npx @warnyin/sdlc status`. If the argument names an active change (or one
-  is active and the argument describes it), RESUME: map its status to the entry
-  stage with `next.md` §2 and start the pipeline there.
-- Resume never rewrites an existing `change.md` — a change already triaged keeps
-  its tier, Delta and Assumptions. Re-run a stage only if its output is missing
-  or the validator rejects it.
-- Start at `new` only when the argument matches no active change.
-
-Rules:
-- Announce the plan in ≤3 lines after triage (id, tier, task count, entry stage),
-  so a resume is never silent. Then work.
-- Between stages run `npx @warnyin/sdlc validate <id>` — a red validator is a
-  hard stop for that stage, not a suggestion.
-- On escalation: stop at the exact step, state what is needed in ≤5 lines, wait.
-  When the human answers, resume from that step — never restart the pipeline.
-- On completion report one line: shipped + digest path + total cost if known.
-
-This is orchestrator mode: the human describes the outcome and walks away.
+# /sdlc:auto <title|change-id> — the whole pipeline, one command
+
+Runs new → [design] → contract → build → verify → [review] → ship, each stage by
+its own playbook, WITHOUT pausing for the human except on the Autonomy-policy
+escalation conditions — each with the choice `--auto` may pre-approve:
+
+| Condition | Pre-approvable as |
+|---|---|
+| a `[NEEDS CLARIFICATION]` the agent cannot resolve alone | assume-safe and continue · or stop and ask |
+| verify failed more than 3 rounds | keep iterating · or stop |
+| review found blockers | fix and continue · or stop for the human |
+| ship needs human approval (deep tier / hard-floor: security, payments, data-loss, irreversible) | ship · or stop before ship |
+| token budget exceeded (if the user set one) | continue · or stop |
+
+`/sdlc:auto` and any stage command given `--auto` run in unattended mode below.
+
+## Unattended mode — gather, confirm, run (in that order)
+
+1. **Gather.** Triage the tier, read `npx @warnyin/sdlc status`, resolve the entry
+   stage, and collect every question you would otherwise raise mid-run. This step
+   writes NOTHING: no `change.md`, no journal entry, no gate, no active-change
+   pointer. A run that never gets confirmed must leave the repository unchanged.
+2. **Confirm.** One message, and it must be decidable item by item:
+   - scope as you understood it, and the tier you triaged with its reason
+   - every ambiguity, each with the assumption you intend to act on
+   - one line per row of the escalation table above, each stating the choice you
+     want pre-approved, and each refusable on its own. For the ship row, name the
+     hard-floor surface it covers — never fold it into a general "run without me".
+   If the human declines or edits any item, nothing has been written yet: revise
+   the summary and ask again, or stop. Do not start work on a partial yes.
+3. **Run.** Only now write anything. Work stage by stage to ship.
+
+**Pre-authorization covers this run only.** It is never persisted to config, never
+remembered for the next change, and never inherited by a resumed run — a resume
+asks again. A condition outside the confirmed set stops the run and asks, exactly
+as if no flag had been passed; treat that as a fact, not a judgement call.
+
+Record every escalation you reach:
+`node sdlc/.hooks/journal.mjs note escalation condition=<name> preauth=<yes|no>`
+— `yes` when a pre-approval let you pass it, `no` when you stopped and asked.
+
+Entry stage — resolve this first, never assume `new`:
+- Run `npx @warnyin/sdlc status`. If the argument names an active change (or one
+  is active and the argument describes it), RESUME: map its status to the entry
+  stage with `next.md` §2 and start the pipeline there.
+- Resume never rewrites an existing `change.md` — a change already triaged keeps
+  its tier, Delta and Assumptions. Re-run a stage only if its output is missing
+  or the validator rejects it.
+- Start at `new` only when the argument matches no active change.
+- With `--auto` on a stage command: the stage still does its own work first, then
+  the pipeline continues from there. A stage typed earlier than what the change's
+  status maps to is skipped with a one-line announcement, never re-run — the
+  pipeline is a ratchet.
+
+Rules:
+- Announce the plan in ≤3 lines after triage (id, tier, task count, entry stage),
+  so a resume is never silent. Then work.
+- Between stages run `npx @warnyin/sdlc validate <id>` — a red validator is a
+  hard stop for that stage, not a suggestion.
+- On escalation NOT pre-approved for this run: stop at the exact step, state what
+  is needed in ≤5 lines, wait. When the human answers, resume from that step —
+  never restart the pipeline. One that IS pre-approved: take the approved choice,
+  journal it, and keep going without asking.
+- On completion report one line: shipped + digest path + total cost if known.
+
+This is orchestrator mode: the human describes the outcome and walks away.

package/payload/playbook/build.md

@@ -1,23 +1,26 @@
-# /sdlc:build <id> — implement (Run the harness)
-
-Precondition: status ≥ contracted (vibe tier is exempt from contracts).
-Set `status: building`.
-
-Mode by size:
-- **Conductor** (≤2 tasks): implement in this session, task by task.
-- **Orchestrator** (>2 tasks): fan out one `sdlc-builder` subagent per task in a
-  `[P]` wave; serialize between dependent waves. Each builder receives ONLY:
-  its task line, `contract/tests.md`, the touched capability's spec, and steering
-  matching its file area — never the whole change history.
-
-Rules for whoever implements:
-- Follow steering pointers the moment the PostToolUse hook emits them.
-- Never edit `sdlc/specs/**`, archive, journals, or lint/test configs to go
-  green — hooks deny the first two; the rest is the config-protection rule.
-- Per-task self-check = that task's tests + lint only; the full test run belongs
-  to /sdlc:verify (moved, not removed).
-- Tick `- [x]` in `## Tasks` as each task lands; note surprises in one line max.
-- Honor `[tier:x]` markers when delegating (see routing.md).
-
-Done when all tasks are ticked and the code compiles/lints.
-`node sdlc/.hooks/journal.mjs note build tasks=<n>` then → /sdlc:verify.
+# /sdlc:build <id> — implement (Run the harness)
+
+Precondition: status ≥ contracted (vibe tier is exempt from contracts).
+Set `status: building`.
+
+Mode by size:
+- **Conductor** (≤2 tasks): implement in this session, task by task.
+- **Orchestrator** (>2 tasks): fan out one `sdlc-builder` subagent per task in a
+  `[P]` wave; serialize between dependent waves. Each builder receives ONLY:
+  its task line, `contract/tests.md`, the touched capability's spec, and steering
+  matching its file area — never the whole change history.
+
+Rules for whoever implements:
+- Follow steering pointers the moment the PostToolUse hook emits them.
+- Never edit `sdlc/specs/**`, archive, journals, or lint/test configs to go
+  green — hooks deny the first two; the rest is the config-protection rule.
+- Per-task self-check = that task's tests + lint only; the full test run belongs
+  to /sdlc:verify (moved, not removed).
+- Tick `- [x]` in `## Tasks` as each task lands; note surprises in one line max.
+- Honor `[tier:x]` markers when delegating (see routing.md).
+
+Done when all tasks are ticked and the code compiles/lints.
+`node sdlc/.hooks/journal.mjs note build tasks=<n>` then → /sdlc:verify.
+
+`--auto`: do this stage, then continue to ship under `auto.md`'s unattended
+mode — gather, confirm once, run. The stage still does its own work first.

package/payload/playbook/contract.md

@@ -1,23 +1,26 @@
-# /sdlc:contract <id> — tests + evals before code
-
-The contract IS the handshake. Nothing in `## Tasks` may be implemented while
-status is `new`.
-
-1. From the Delta scenarios, write `contract/tests.md` (≤60 lines): one row per
-   behavior — Given/When/Then, kind, mapped requirement. List what is explicitly
-   out of scope and why.
-2. Deep tier (standard optional): write `contract/evals.md` (≤40 lines) — the
-   trajectory + quality rubric the sdlc-evaluator will score.
-3. Generate failing tests: delegate to the `sdlc-contractor` agent (cheap tier)
-   with ONLY tests.md + the delta + the project's test conventions. Run the test
-   command from `sdlc/harness.md` — every new test must FAIL (red) now; a test
-   that passes before implementation tests nothing.
-4. Adversarial check instead of human approval: ask the `sdlc-quality` agent to
-   attack the contract — uncovered scenarios, untestable rows, missing edge
-   cases vs the delta. Fix findings; one round is usually enough, two max.
-5. `npx @warnyin/sdlc validate <id>` clean → set frontmatter `status: contracted`
-   and `node sdlc/.hooks/journal.mjs note contract tests=<n>`.
-
-Escalate only if the delta itself turns out ambiguous (back to /sdlc:new step 5).
-
-Next: /sdlc:build.
+# /sdlc:contract <id> — tests + evals before code
+
+The contract IS the handshake. Nothing in `## Tasks` may be implemented while
+status is `new`.
+
+1. From the Delta scenarios, write `contract/tests.md` (≤60 lines): one row per
+   behavior — Given/When/Then, kind, mapped requirement. List what is explicitly
+   out of scope and why.
+2. Deep tier (standard optional): write `contract/evals.md` (≤40 lines) — the
+   trajectory + quality rubric the sdlc-evaluator will score.
+3. Generate failing tests: delegate to the `sdlc-contractor` agent (cheap tier)
+   with ONLY tests.md + the delta + the project's test conventions. Run the test
+   command from `sdlc/harness.md` — every new test must FAIL (red) now; a test
+   that passes before implementation tests nothing.
+4. Adversarial check instead of human approval: ask the `sdlc-quality` agent to
+   attack the contract — uncovered scenarios, untestable rows, missing edge
+   cases vs the delta. Fix findings; one round is usually enough, two max.
+5. `npx @warnyin/sdlc validate <id>` clean → set frontmatter `status: contracted`
+   and `node sdlc/.hooks/journal.mjs note contract tests=<n>`.
+
+Escalate only if the delta itself turns out ambiguous (back to /sdlc:new step 5).
+
+Next: /sdlc:build.
+
+`--auto`: do this stage, then continue to ship under `auto.md`'s unattended
+mode — gather, confirm once, run. The stage still does its own work first.

package/payload/playbook/design.md

@@ -1,20 +1,23 @@
-# /sdlc:design <id> — decisions & trade-offs (deep tier, or on signal)
-
-Run only when: tier is deep, OR the change needs an architectural decision
-(new dependency, schema change, cross-capability contract). Otherwise skip —
-an empty Design section is garbage.
-
-1. Read `change.md`, the full spec of every touched capability, and any steering
-   whose scope matches. Nothing else by default.
-2. Gather in parallel, judge serially: fan out read-only subagents for research
-   (one per question: prior art in this repo, external constraint, data shape).
-   The DECISION is made in the main loop — never delegated, never parallel.
-3. Fill `## Design` with decision lines only:
-   `- decision: <what> · alternatives: <a/b> · because: <why>`
-   Never restate the delta. Respect the tier cap (deep total ≤150).
-4. Escalate to the human ONLY for decisions listed in
-   `sdlc/harness.md § Autonomy policy` (irreversible or hard-floor). Everything
-   else: decide, record, move on.
-5. `npx @warnyin/sdlc validate <id>`.
-
-Next: /sdlc:contract.
+# /sdlc:design <id> — decisions & trade-offs (deep tier, or on signal)
+
+Run only when: tier is deep, OR the change needs an architectural decision
+(new dependency, schema change, cross-capability contract). Otherwise skip —
+an empty Design section is garbage.
+
+1. Read `change.md`, the full spec of every touched capability, and any steering
+   whose scope matches. Nothing else by default.
+2. Gather in parallel, judge serially: fan out read-only subagents for research
+   (one per question: prior art in this repo, external constraint, data shape).
+   The DECISION is made in the main loop — never delegated, never parallel.
+3. Fill `## Design` with decision lines only:
+   `- decision: <what> · alternatives: <a/b> · because: <why>`
+   Never restate the delta. Respect the tier cap (deep total ≤150).
+4. Escalate to the human ONLY for decisions listed in
+   `sdlc/harness.md § Autonomy policy` (irreversible or hard-floor). Everything
+   else: decide, record, move on.
+5. `npx @warnyin/sdlc validate <id>`.
+
+Next: /sdlc:contract.
+
+`--auto`: do this stage, then continue to ship under `auto.md`'s unattended
+mode — gather, confirm once, run. The stage still does its own work first.

package/payload/playbook/new.md

@@ -1,22 +1,25 @@
-# /sdlc:new <title> — open a change (Requirements)
-
-1. Triage the tier with `sdlc/harness.md § Tier triage`. Hard-floor surface
-   (security, payments, data-loss, irreversible) forces `deep` — no override
-   without an explicit user instruction (record it in Assumptions).
-2. Create `sdlc/changes/<kebab-id>/change.md` from the tier's template at
-   `sdlc/.playbook/templates/change-{vibe|standard|deep}.md` — copy the
-   structure exactly, respect the cap comment.
-3. Ground the delta: grep `## Purpose` of every `sdlc/specs/*/spec.md`; open the
-   FULL spec only for capabilities this change touches. Name each `## Delta:`
-   after an existing capability, or a new kebab-case capability.
-4. Write Why (≤5 lines, no solutioning) and the Delta requirements
-   (`ADDED/MODIFIED/REMOVED Requirement` + WHEN/THEN scenarios — grammar in the
-   delta-spec-format skill). Then Tasks with `[P]` and `[tier:x]` markers.
-5. Ambiguity policy (AI-driven): make the safest assumption and record it under
-   `## Assumptions` with why it is safe. Use `[NEEDS CLARIFICATION: q]` ONLY for
-   facts you cannot obtain or safely assume — then ask the user those questions
-   now, in one batch, and resolve every marker.
-6. `node sdlc/.hooks/journal.mjs set-active <id>` then
-   `npx @warnyin/sdlc validate <id>` — fix errors. Status stays `new`.
-
-Next: deep tier or risky decision → /sdlc:design; otherwise /sdlc:contract.
+# /sdlc:new <title> — open a change (Requirements)
+
+1. Triage the tier with `sdlc/harness.md § Tier triage`. Hard-floor surface
+   (security, payments, data-loss, irreversible) forces `deep` — no override
+   without an explicit user instruction (record it in Assumptions).
+2. Create `sdlc/changes/<kebab-id>/change.md` from the tier's template at
+   `sdlc/.playbook/templates/change-{vibe|standard|deep}.md` — copy the
+   structure exactly, respect the cap comment.
+3. Ground the delta: grep `## Purpose` of every `sdlc/specs/*/spec.md`; open the
+   FULL spec only for capabilities this change touches. Name each `## Delta:`
+   after an existing capability, or a new kebab-case capability.
+4. Write Why (≤5 lines, no solutioning) and the Delta requirements
+   (`ADDED/MODIFIED/REMOVED Requirement` + WHEN/THEN scenarios — grammar in the
+   delta-spec-format skill). Then Tasks with `[P]` and `[tier:x]` markers.
+5. Ambiguity policy (AI-driven): make the safest assumption and record it under
+   `## Assumptions` with why it is safe. Use `[NEEDS CLARIFICATION: q]` ONLY for
+   facts you cannot obtain or safely assume — then ask the user those questions
+   now, in one batch, and resolve every marker.
+6. `node sdlc/.hooks/journal.mjs set-active <id>` then
+   `npx @warnyin/sdlc validate <id>` — fix errors. Status stays `new`.
+
+Next: deep tier or risky decision → /sdlc:design; otherwise /sdlc:contract.
+
+`--auto`: do this stage, then continue to ship under `auto.md`'s unattended
+mode — gather, confirm once, run. The stage still does its own work first.

package/payload/playbook/next.md

@@ -1,12 +1,14 @@
-# /sdlc:next — where am I, what now (read-only)
-
-1. Run `npx @warnyin/sdlc status`.
-2. For each active change map status → next command:
-   - `new` + markers unresolved → resolve questions (playbook new.md §5)
-   - `new` (clean) → /sdlc:design (deep/signal) or /sdlc:contract
-   - `contracted` → /sdlc:build
-   - `building` → /sdlc:build (finish open tasks)
-   - `verified` → /sdlc:review (if signals) or /sdlc:ship
-3. If nothing is active: suggest /sdlc:new, or /sdlc:observe if archived changes
-   have unread digests.
-4. Answer in ≤5 lines. Create or modify nothing.
+# /sdlc:next — where am I, what now (read-only)
+
+1. Run `npx @warnyin/sdlc status`.
+2. For each active change map status → next command:
+   - `new` + markers unresolved → resolve questions (playbook new.md §5)
+   - `new` (clean) → /sdlc:design (deep/signal) or /sdlc:contract
+   - `contracted` → /sdlc:build
+   - `building` → /sdlc:build (finish open tasks)
+   - `verified` → /sdlc:review (if signals) or /sdlc:ship
+3. If nothing is active: suggest /sdlc:new, or /sdlc:observe if archived changes
+   have unread digests.
+4. Answer in ≤5 lines. Create or modify nothing.
+5. When the remaining path is more than one stage, add one line: the same command
+   with `--auto` confirms once and runs to ship.

package/payload/playbook/review.md

@@ -1,17 +1,26 @@
-# /sdlc:review <id> — agent panel (signal-triggered)
-
-Run when: tier deep, OR the diff touches auth/payments/data handling, OR >10
-files changed. Otherwise skip silently — a ceremonial review is garbage.
-
-1. Fan out in parallel, all read-only, each with the diff + change.md only:
-   - `sdlc-architect` (deepest): design integrity, coupling, contract drift.
-   - `sdlc-security` (balanced): injection, authz, secrets, unsafe deps.
-   - `sdlc-quality` (cheap): contract coverage gaps, edge cases, dead code.
-   - `sdlc-ops` (cheap): config, migrations, rollback, observability impact.
-2. Merge findings in the main loop. Classify: blocker | improvement | note.
-3. Blockers → append as fix tasks and route back to /sdlc:build (counts toward
-   the same 3-round budget as verify). Improvements: apply if ≤5 min each,
-   otherwise record one line in the change for the digest.
-4. `node sdlc/.hooks/journal.mjs note review blockers=<n>`.
-
-Pass condition: zero open blockers. Next: /sdlc:ship.
+# /sdlc:review <id> — agent panel (signal-triggered)
+
+Run when: tier deep, OR the diff touches auth/payments/data handling, OR >10
+files changed. Otherwise skip silently — a ceremonial review is garbage.
+
+1. Fan out in parallel, all read-only, each with the diff + change.md only:
+   - `sdlc-architect` (deepest): design integrity, coupling, contract drift.
+   - `sdlc-security` (balanced): injection, authz, secrets, unsafe deps.
+   - `sdlc-quality` (cheap): contract coverage gaps, edge cases, dead code.
+   - `sdlc-ops` (cheap): config, migrations, rollback, observability impact.
+2. Merge findings in the main loop. Classify: blocker | improvement | note.
+3. Blockers → append as fix tasks and route back to /sdlc:build (counts toward
+   the same 3-round budget as verify). Improvements: apply if ≤5 min each,
+   otherwise record one line in the change for the digest.
+4. `node sdlc/.hooks/journal.mjs note review blockers=<n> mode=<panel|solo>`.
+   `mode=panel` when the four agents produced the findings; `mode=solo` when the
+   panel cannot run — subagents unavailable or disallowed — and the main loop
+   reviewed its own work through those four lenses instead. Run it that way
+   rather than skipping the review, and say so in the note: a self-review that
+   is recorded as a panel is worse than no review, because it reads as
+   independent evidence months later.
+
+Pass condition: zero open blockers. Next: /sdlc:ship.
+
+`--auto`: do this stage, then continue to ship under `auto.md`'s unattended
+mode — gather, confirm once, run. The stage still does its own work first.

package/payload/playbook/ship.md

@@ -1,24 +1,33 @@
-# /sdlc:ship <id> — merge, archive, learn, digest
-
-Precondition: `status: verified` (+ review passed when it ran).
-
-1. **Policy check** (`sdlc/harness.md § Autonomy policy`): if this change is NOT
-   auto-shippable (deep/hard-floor), show the human a 5-line summary (why, delta
-   heads, verify result, cost so far) and wait for approval. Otherwise proceed.
-2. Open the gate and archive mechanically:
-   `node sdlc/.hooks/journal.mjs open-ship <id>`
-   `npx @warnyin/sdlc archive <id>`
-   (validates --strict, merges every Delta into `sdlc/specs/`, promotes evals,
-   stamps `status: shipped`, moves the folder to `changes/archive/<date>-<id>/`).
-3. **Learn** — delegate to `sdlc-learner` (cheap) with the archived change.md +
-   its journal.ndjson. It proposes ≤3 items: add-rule (with evidence pointer) /
-   expire-or-demote (rule or steering that never fired) / harness tweak.
-   Apply reductions and demotions immediately (they always save tokens).
-   Additions to always-loaded context are NOT applied — list them in the digest.
-4. **Digest** — write `sdlc/changes/archive/<date>-<id>/digest.md` (≤15 lines):
-   what shipped, spec deltas merged, assumptions made, verify rounds, tokens/cost
-   (from journal `session` events), learner proposals awaiting the human.
-5. Close the gate: `node sdlc/.hooks/journal.mjs close`. Tell the user in one
-   line: shipped + where the digest is.
-
-The digest is the async human touchpoint — reviewable and revertible later.
+# /sdlc:ship <id> — merge, archive, learn, digest
+
+Precondition: `status: verified` (+ review passed when it ran).
+
+1. **Policy check** (`sdlc/harness.md § Autonomy policy`): if this change is NOT
+   auto-shippable (deep/hard-floor), show the human a 5-line summary (why, delta
+   heads, verify result, cost so far) and wait for approval. Otherwise proceed.
+2. Open the gate and archive mechanically:
+   `node sdlc/.hooks/journal.mjs open-ship <id>`
+   `npx @warnyin/sdlc archive <id>`
+   (validates --strict, merges every Delta into `sdlc/specs/`, promotes evals,
+   stamps `status: shipped`, moves the folder to `changes/archive/<date>-<id>/`).
+3. **Learn** — delegate to `sdlc-learner` (cheap) with the archived change.md +
+   its journal.ndjson. It proposes ≤3 items: add-rule (with evidence pointer) /
+   expire-or-demote (rule or steering that never fired) / harness tweak.
+   Apply reductions and demotions immediately (they always save tokens).
+   Additions to always-loaded context are NOT applied — list them in the digest.
+4. **Digest** — write `sdlc/changes/archive/<date>-<id>/digest.md` (≤15 lines):
+   what shipped, spec deltas merged, assumptions made, verify rounds, tokens/cost
+   (from journal `session` events), learner proposals awaiting the human.
+   When any verify or review note carries `mode=solo`, the digest SHALL say which
+   outcomes were self-produced. A reader months from now cannot otherwise tell a
+   panel's verdict from the author's own.
+   When any `escalation` event carries `preauth=yes`, the digest SHALL list those
+   pre-authorized escalations by condition — the points where a human would normally
+   have stood and, this run, did not.
+5. Close the gate: `node sdlc/.hooks/journal.mjs close`. Tell the user in one
+   line: shipped + where the digest is.
+
+The digest is the async human touchpoint — reviewable and revertible later.
+
+`--auto`: do this stage, then continue to ship under `auto.md`'s unattended
+mode — gather, confirm once, run. The stage still does its own work first.

package/payload/playbook/verify.md

@@ -1,24 +1,37 @@
-# /sdlc:verify <id> — the feedback loop
-
-Two halves, both must pass. Verification is against the CONTRACT, not vibes.
-
-1. **Tests (deterministic)**: run the full test command from `sdlc/harness.md`.
-   Every row of `contract/tests.md` must be covered by a passing test.
-2. **Evals (non-deterministic)** — when `contract/evals.md` exists: delegate to
-   the `sdlc-evaluator` agent (cheap) with the rubric + the diff + the task log;
-   it returns a score per rubric line. Pass bar is written in the file.
-
-On failure:
-- Cluster failures by root cause (one line each) and append the cluster note to
-  the change's `## Tasks` area as unchecked fix tasks.
-- `node sdlc/.hooks/journal.mjs note verify result=fail round=<n>`
-- Route back to /sdlc:build. Maximum 3 rounds total; on the 4th failure STOP and
-  escalate to the human with the cluster history (Autonomy policy condition).
-- Never lower the bar: do not edit tests/evals to pass unless the contract
-  itself was wrong — changing the contract reopens the adversarial check.
-
-On pass: set `status: verified`,
-`node sdlc/.hooks/journal.mjs note verify result=pass round=<n>`.
-
-Next: review signals present (deep tier, security-touching diff, >10 files)
-→ /sdlc:review; otherwise → /sdlc:ship.
+# /sdlc:verify <id> — the feedback loop
+
+Two halves, both must pass. Verification is against the CONTRACT, not vibes.
+
+1. **Tests (deterministic)**: run the full test command from `sdlc/harness.md`.
+   Every row of `contract/tests.md` must be covered by a passing test.
+2. **Evals (non-deterministic)** — when `contract/evals.md` exists: delegate to
+   the `sdlc-evaluator` agent (cheap) with the rubric + the diff + the task log;
+   it returns a score per rubric line. Pass bar is written in the file.
+   If the evaluator cannot run — subagents unavailable or disallowed in this
+   session — score in the main loop instead and record that. A panel that could
+   not run is a fact to write down, never a reason to stop the pipeline; but a
+   run that judged its own work is weaker evidence and must not read as if a
+   panel had agreed.
+
+On failure:
+- Cluster failures by root cause (one line each) and append the cluster note to
+  the change's `## Tasks` area as unchecked fix tasks.
+- `node sdlc/.hooks/journal.mjs note verify result=fail round=<n> mode=<panel|solo>`
+- Route back to /sdlc:build. Maximum 3 rounds total; on the 4th failure STOP and
+  escalate to the human with the cluster history (Autonomy policy condition).
+- Never lower the bar: do not edit tests/evals to pass unless the contract
+  itself was wrong — changing the contract reopens the adversarial check.
+
+On pass: set `status: verified`,
+`node sdlc/.hooks/journal.mjs note verify result=pass round=<n> mode=<panel|solo>`.
+
+`mode=panel` only when independent agents produced the judgment; `mode=solo` when
+the main loop judged its own work. Every verify note carries it, pass or fail —
+`/sdlc:observe` reports a change as self-judged from this field, and omitting it
+leaves the record silently indistinguishable from an independent one.
+
+Next: review signals present (deep tier, security-touching diff, >10 files)
+→ /sdlc:review; otherwise → /sdlc:ship.
+
+`--auto`: do this stage, then continue to ship under `auto.md`'s unattended
+mode — gather, confirm once, run. The stage still does its own work first.