devflow-kit 3.9.0 → 3.10.0

package/src/assets/agents/validate.md

@@ -36,7 +36,7 @@ Run the commands of package.json, Makefile, Cargo.toml or similar in this order,
 | 3 | Lint | `cargo clippy`, `make lint` | none |
 | 4 | Test | `npm test`, `make test` | `vitest run --reporter=dot`, `jest --silent`, `pytest -q`, `cargo test -q`, `go test` without `-v`, `gradle -q test`, `mvn -q test` |
 
-Use the quiet form where the project's command runs that tool. After a failed Test row, re-run each of its first 20 failed test files alone, once, verbose, 120 s max, never the suite: this is the one exception to the never-re-run rule under Running commands. First, run `d="${CLAUDE_CONFIG_DIR:-}"; case "$d" in /*) ;; *) d="$HOME/.claude" ;; esac; printf '%s\n' "$d/skills/devflow:agent-references/references/validate/passed-alone.md"` and Read it; re-run only a path it accepts (none if unread). PASSED-ALONE needs all of: a BASE_SHA; a checked, tracked path; a FILES_CHANGED that omits it; a full-run timeout, spawn or resource error; a re-run adding only that file, no name filter; `EXIT=0`; its tests ran and passed. Else REAL; a re-run is never BLOCKED. PASS needs PASSED-ALONE files to explain every failure; the Test row then counts as passed, also for Lint pack, in any output form. Never name labels in Failures, Parsed References or `details`.
+Use the quiet form where the project's command runs that tool. After a failed Test row, re-run each of its first 20 failed test files alone, once, verbose, never the suite: this is the one exception to the never-re-run rule under Running commands. First, run `d="${CLAUDE_CONFIG_DIR:-}"; case "$d" in /*) ;; *) d="$HOME/.claude" ;; esac; printf '%s\n' "$d/skills/devflow:agent-references/references/validate/passed-alone.md"` and Read it; re-run only a path it accepts (none if unread). PASSED-ALONE needs all of: a BASE_SHA; a checked, tracked path; a FILES_CHANGED that omits it; a test timeout, spawn or resource error; a re-run adding only that file, no name filter; `EXIT=0`; its tests ran and passed. Else REAL; a re-run is never BLOCKED. PASS needs PASSED-ALONE files to explain every failure; the Test row then counts as passed, also for Lint pack, in any output form. Never name labels in Failures, Parsed References or `details`.
 
 **Gate ownership:** Run the full suite once per HEAD. You are the only agent that does.
 
@@ -44,20 +44,20 @@ Use the quiet form where the project's command runs that tool. After a failed Te
 
 Run builds, typechecks, lints and tests in the foreground, each with an explicit Bash `timeout` above its expected run time. The ceiling is 600000 ms, or `BASH_MAX_TIMEOUT_MS` when set (`echo ${BASH_MAX_TIMEOUT_MS:-600000}`).
 
-- Capture, then tail, in one Bash call (shell state does not persist): `LOG=$(mktemp); echo "LOG=$LOG"; <command> >"$LOG" 2>&1; rc=$?; tail -n 40 "$LOG"; echo "EXIT=$rc"`. The printed `EXIT=` value is the result; never decide one from a grep count.
-- Never background a command and wait on it, and never poll across turns: no `sleep` or `true` turns, no sentinel-file checks, no Monitor.
-- Prefer the scoped command for the change (a package, a path or a test file); for the whole set, one workspace-level command over a per-package loop.
-- A run that exceeds its timeout is BLOCKED: report its duration and log path. Do not wait on it, poll it or re-run it.
-- A run expected to exceed the ceiling is split into parts, each under about 90% of it, run in sequence. If it cannot be split, report BLOCKED with the remedy `devflow flags --set bash-max-timeout-ms=<ms>`.
+- Capture, then tail, in one Bash call: `LOG=$(mktemp); echo "LOG=$LOG"; <command> >"$LOG" 2>&1; rc=$?; tail -n 40 "$LOG"; printf '\nEXIT=%s\n' "$rc"`. The last `EXIT=` line is the result; never decide one from a grep count.
+- Never background a build or test, and never poll across turns: no `sleep` or `true` turns, no sentinel-file checks, no Monitor.
+- Prefer the scoped command for the change; for the whole set, one workspace command over per-package loops.
+- A run past its timeout moves to the background: no tool call, even a Read, until its end notice, then Read the last `EXIT=` line of the file the move names, not `$LOG`; it alone sets the label, not the notice. With none read it is BLOCKED: report its duration and log path. Report only after the end notice.
+- A run expected to exceed the ceiling may be split into parts, run in sequence.
 - Never re-run a command when nothing it reads has changed.
-- Never wrap a build or test command in `sh -c`, `bash -c`, `python3 -c` or `node -e`: permission rules deny wrapped commands they would allow directly.
+- Never wrap a build or test command in `sh -c`, `bash -c`, `python3 -c` or `node -e`: permission rules deny wrapped commands they allow directly.
 - The same rules hold inside a dynamic Workflow sub-agent.
 
 ## Lint pack
 
 Only if the first `GATE_LEVEL:` line is exactly `lean`, run it last, once the table commands that exist pass; else never run it or print anything about it. The Lint row never runs it. Use the root `package.json` script `lint-pack`, else the root `Makefile` target; look nowhere else. Neither: not configured.
 
-A first `BASE_SHA:` not matching `^[0-9a-f]{40}$` is an error; else run `npm run -s lint-pack -- <BASE_SHA>` or `make -s lint-pack BASE=<BASE_SHA>` in the capture form with an explicit Bash `timeout`; Read the log. Its last `LINT_PACK:` line decides: `no-config` is not configured, `clean` is clean, `matches <n>` sets FAIL, each record into Parsed References. Any other line, none or a timeout is an error: Status stays; the pack is UNVERIFIED, never a pass. `EXIT=` never decides it; an error is never BLOCKED. Copy the `pack-changed` paths and `skipped-binary` count to the `Lint pack:` line.
+A first `BASE_SHA:` not matching `^[0-9a-f]{40}$` is an error; else run `npm run -s lint-pack -- <BASE_SHA>` or `make -s lint-pack BASE=<BASE_SHA>` in the capture form with an explicit Bash `timeout`; past it, wait for its end notice, then Read the log. Its last `LINT_PACK:` line decides: `no-config` is not configured, `clean` is clean, `matches <n>` sets FAIL, each record into Parsed References. Any other line or none is an error: Status stays; the pack is UNVERIFIED, never a pass. `EXIT=` never decides it; an error is never BLOCKED. Copy the `pack-changed` paths and `skipped-binary` count to the `Lint pack:` line.
 
 ## Output
 
@@ -72,7 +72,7 @@ HEAD: {`git rev-parse HEAD`, read before the first command}
 | Command | Status | Exit | Duration |
 |---|---|---|---|
 
-Passed alone: {paths, if any}; bound 20 files, 120 s each
+Passed alone: {paths, if any}; bound 20 files
 
 ### Failures (if FAIL)
 
@@ -98,4 +98,4 @@ Report cap: final message at most about 1,500 tokens; longer material goes to a
 
 ## Boundaries
 
-BLOCKED: no validation command found, a table command that cannot start, or missing dependencies.
+BLOCKED: no validation command found, a table command that cannot start or with no `EXIT=` line read, or missing dependencies.

package/src/assets/commands/_partials/_compliance.mds

@@ -7,9 +7,11 @@ D-COMPLIANCE-INJECT: the compliance instruction reaches an agent only through a
 prompt, and only when the resolved lens is on. No Code, Fix, Review or Design body names
 the compliance skill, so a lens-off spawn pays nothing for it. `compliance_directive()` is the
 one home of the directive text; `compliance_inject()` is how a pass-through host sets it.
-An install-time variant keyed on the machine switch would be wrong: the lens is the union of
-the machine, the default branch and the worktree (D-LENS-UNION), so a repository can turn it
-on when the machine switch is off.
+No install-time variant carries the lens: it is the union of the machine, the default
+branch and the worktree (D-LENS-UNION), so a repository can turn it on when the machine
+switch is off. The posting steps are the opposite case. They are an install-time variant
+keyed on the machine switch alone, as compliance arms in each host, and a repository key
+cannot restore one.
 
 @define compliance_frameworks():
 `COMPLIANCE_FRAMEWORKS` is the settings line's `COMPLIANCE` with `generic` written `none`: `off`, `none`, or the framework ids the machine and this repository declare.

package/src/assets/commands/_partials/_engine.mds

@@ -36,6 +36,7 @@ Gate 2 inputs are produced by `/devflow:dynamic-plan`'s plan-challenge step —
 **Test agent** (only if acceptance criteria or a test plan exist):
 - Scenario-based acceptance tests covering functionality, API contracts, performance
 - FAIL → fix-and-continue — a Fix agent applies the demanded fixes and self-verifies its own build. The recorded verdict becomes `FAIL-FIXED`; Gate 2 then proceeds. In SINGLE mode the run reports it as `UNVERIFIED`, never PASS.
+- BLOCKED (no result), or any other or missing verdict → no fix, and the run never reports PASS.
 
 **When Gate 2 inputs are absent:**
 - No plan → skip the Evaluate agent silently (note in output: "Gate 2 Evaluate agent skipped — no plan available")
@@ -142,17 +143,17 @@ This applies to both: multiple Code agents working on a single ticket AND multi-
 @define build_execution_doctrine():
 ### Build execution doctrine — the Running commands block (LOAD-BEARING)
 
-The Validate, Code and Test agents each carry this `## Running commands` block in their bodies, so each prompt in this engine names the block ("your Running commands block") instead of copying it:
+The Code, Fix, Refactor, Validate and Test agents each carry this `## Running commands` block in their bodies, so each prompt in this engine names the block ("your Running commands block") instead of copying it:
 
 Run builds, typechecks, lints and tests in the foreground, each with an explicit Bash `timeout` above its expected run time. The ceiling is 600000 ms, or `BASH_MAX_TIMEOUT_MS` when set (`echo ${BASH_MAX_TIMEOUT_MS:-600000}`).
 
-- Capture, then tail, in one Bash call (shell state does not persist): `LOG=$(mktemp); echo "LOG=$LOG"; <command> >"$LOG" 2>&1; rc=$?; tail -n 40 "$LOG"; echo "EXIT=$rc"`. The printed `EXIT=` value is the result; never decide one from a grep count.
-- Never background a command and wait on it, and never poll across turns: no `sleep` or `true` turns, no sentinel-file checks, no Monitor.
-- Prefer the scoped command for the change (a package, a path or a test file); for the whole set, one workspace-level command over a per-package loop.
-- A run that exceeds its timeout is BLOCKED: report its duration and log path. Do not wait on it, poll it or re-run it.
-- A run expected to exceed the ceiling is split into parts, each under about 90% of it, run in sequence. If it cannot be split, report BLOCKED with the remedy `devflow flags --set bash-max-timeout-ms=<ms>`.
+- Capture, then tail, in one Bash call: `LOG=$(mktemp); echo "LOG=$LOG"; <command> >"$LOG" 2>&1; rc=$?; tail -n 40 "$LOG"; printf '\nEXIT=%s\n' "$rc"`. The last `EXIT=` line is the result; never decide one from a grep count.
+- Never background a build or test, and never poll across turns: no `sleep` or `true` turns, no sentinel-file checks, no Monitor.
+- Prefer the scoped command for the change; for the whole set, one workspace command over per-package loops.
+- A run past its timeout moves to the background: no tool call, even a Read, until its end notice, then Read the last `EXIT=` line of the file the move names, not `$LOG`; it alone sets the label, not the notice. With none read it is BLOCKED: report its duration and log path. Report only after the end notice.
+- A run expected to exceed the ceiling may be split into parts, run in sequence.
 - Never re-run a command when nothing it reads has changed.
-- Never wrap a build or test command in `sh -c`, `bash -c`, `python3 -c` or `node -e`: permission rules deny wrapped commands they would allow directly.
+- Never wrap a build or test command in `sh -c`, `bash -c`, `python3 -c` or `node -e`: permission rules deny wrapped commands they allow directly.
 - The same rules hold inside a dynamic Workflow sub-agent.
 
 **Cheapest-sufficient validation:** iterate with the fastest check that proves the change — `tsc --noEmit`, `cargo check`, `go vet`, a single test file — the ecosystem's cheapest sufficient signal. Reserve expensive full/optimized builds and whole-suite runs for the final gates only.
@@ -205,7 +206,7 @@ Each ticket engine run returns a structured result. The Synthesize agent or the
   ],
   "gate2": {
     "evaluateVerdict": "PASS | FAIL | FAIL-FIXED | SKIPPED",
-    "testVerdict": "PASS | FAIL | FAIL-FIXED | SKIPPED",
+    "testVerdict": "PASS | FAIL | FAIL-FIXED | SKIPPED | BLOCKED",
     "skipReasons": ["string — why a gate was skipped, if applicable"]
   }
 }

package/src/assets/commands/_partials/_publication.mds

@@ -3,12 +3,21 @@ A partial: the publication-value gate. D-SETTINGS-LINE: it imports nothing from
 its consumers, and this text takes `REVIEW_PUBLICATION` from the line resolved
 there for the worktree's root.
 
-@define publication_gate():
+`publication_resolve` is the two resolution steps alone. `publication_gate` is those steps plus the
+note that names the Git agent's publication gate; a host with compliance off calls only the steps,
+because the gate's reference file is not installed there.
+
+@define publication_resolve():
 **Resolve `REVIEW_PUBLICATION` per worktree:** take `REVIEW_PUBLICATION` from that worktree's settings line — the line resolved above for `{root}`, the worktree's root, by the settings block when this run has not yet resolved that root; multi-worktree repos may resolve different values per worktree. The line already caps the personal choice at the team's (D-PUBLICATION-CEILING), so it is `off`, `auto` or `full`, and `off` when the line was unresolvable.
 
 **Evidence stub:** only when `EVIDENCE_POLICY` is `required`, a resolved `off` becomes `stub`, so a counts-only record still reaches the PR. `stub` is never a config value: the settings line never carries it.
+@end
+
+@define publication_gate():
+{{publication_resolve()}}
 
 Note: `auto` is NOT fail-open — under `auto`, the Git agent probes the repository visibility and treats any error or unrecognised value as PUBLIC (mode STUB). What each value does is decided by the Git agent's publication gate (`references/publication-gate.md` step 2); this partial only resolves the value.
 @end
 
+@export publication_resolve
 @export publication_gate

package/src/assets/commands/bug-analysis.mds

@@ -9,15 +9,11 @@ output-dir: dist/commands
 @import "./_partials/_settings.mds" as settings
 # Bug Analysis Command
 
-Run a proactive bug analysis on the current branch by combining static analysis tools with parallel semantic analyzers, then synthesizing results into an actionable bug report.
+Run a proactive bug analysis on the current branch: static analysis tools and parallel semantic analyzers, synthesized into one bug report.
 
 ## Usage
 
-```
-/bug-analysis              (analyze current branch — incremental if prior analysis exists)
-/bug-analysis --full       (force full analysis, ignore incremental state)
-/bug-analysis --no-static  (skip static analysis track, semantic-only)
-```
+`/bug-analysis [--full] [--no-static]`: `--full` ignores incremental state; `--no-static` skips static analysis.
 
 ## Phases
 
@@ -28,7 +24,11 @@ Run a proactive bug analysis on the current branch by combining static analysis
 {{evidence_policy()}}
 
 {{docs_root()}}
+<!-- compliance:off -->
+When `EVIDENCE_POLICY` is `required`, record `TRACEABILITY: DEGRADED (compliance off on this machine; the repository requires evidence)` once, for the Phase 7 report.
+<!-- compliance:end -->
 
+<!-- compliance:on -->
 Render the test-plan block from `/implement`'s evidence file, and from nothing else:
 1. `branch_slug` is `git -C "{worktree}" branch --show-current` with every `/` replaced by `-`.
 2. Only when `branch_slug` matches `^[A-Za-z0-9._-]{1,200}$` and the file exists, run (the path double-quoted):
@@ -39,12 +39,15 @@ node "$HOME/.devflow/scripts/verify-evidence.cjs" render --plan "{worktree}/.dev
 
 3. On `exit=0`, `PR_TEST_PLAN_BLOCK` is its stdout byte for byte without that `exit=` line; in every other case it is `(none)`. Nothing here waits on it: the Git agent pastes it only behind its own check, and only into a PR it creates.
 
+<!-- compliance:end -->
 Spawn Git agent:
 
 ```
 Agent(subagent_type="Git", run_in_background=false):
 "OPERATION: ensure-pr-ready
+<!-- compliance:on -->
 PR_TEST_PLAN_BLOCK: {PR_TEST_PLAN_BLOCK verbatim, or (none)}
+<!-- compliance:end -->
 APPLY_CONVENTIONS: {APPLY_CONVENTIONS}
 Validate branch, commit if needed, push, create PR if needed.
 Return: branch, base_branch, base_ref, branch-slug, PR#"
@@ -88,7 +91,7 @@ If `pr_number` is absent, set `PR_DESCRIPTION` to `(none)`.
 CHANGED_FILES=$(git diff --name-only {DIFF_RANGE})
 ```
 
-Store as `CHANGED_FILES`; Steps 2d and Phase 4 read it. A non-zero diff exit stops.
+Store as `CHANGED_FILES`; Phase 4 reads it. A non-zero diff exit stops.
 
 If output is empty → "No changes to analyze." Stop.
 
@@ -96,75 +99,81 @@ If output is empty → "No changes to analyze." Stop.
 
 **Produces:** STATIC_TOOL_STATUS
 
-Skip if `--no-static` flag provided.
+If `--no-static` is set: set `STATIC_FINDINGS` to "Static analysis skipped (--no-static)." and `STATIC_STATUS` to "skipped (--no-static): static analysis did not cover these commits". Skip the rest of Phase 2.
 
 ```bash
-SEMGREP_AVAILABLE=$(which semgrep 2>/dev/null && echo "yes" || echo "no")
-SNYK_AVAILABLE=$(which snyk 2>/dev/null && echo "yes" || echo "no")
-CODEQL_AVAILABLE=$(which codeql 2>/dev/null && echo "yes" || echo "no")
+for t in semgrep snyk codeql jq; do printf '%s=%s\n' "$t" "$(command -v "$t" || echo no)"; done
+set -o pipefail; export LC_ALL=C; git -C "{worktree}" diff --name-only -z --diff-filter=d {DIFF_RANGE} | tr '\0\n' '\n?' | sed -n 's/.*\.\([^./]*\)$/\1/p' | sort -u || echo "extension list failed"
 ```
 
-If all are `no`: warn user "No static analysis tools found. Proceeding with semantic analysis only. To enable static analysis, install semgrep (`pip install semgrep`) or snyk (`npm install -g snyk`)." Set `STATIC_FINDINGS` to `(none)`.
+Its second line lists the extensions of the changed files. `{lang}` is the first of javascript-typescript (js jsx mjs cjs ts tsx), python (py), ruby (rb) whose extension is listed; no other value reaches the command. With none, CodeQL does not run and its status is `no supported language`; `extension list failed` means it did not complete.
+
+If all three scanners print `no`: warn user "No static analysis tools found. Install semgrep or snyk." Set `STATIC_FINDINGS` to "Static analysis did not run: no scanner is installed." and `STATIC_STATUS` to `not installed` for each tool.
+
+If a scanner is installed but `jq` prints `no`: set `STATIC_FINDINGS` to "Static analysis did not complete: jq is not installed." and `STATIC_STATUS` to `did not complete (jq is not installed)` for an installed tool, else `not installed`.
 
 If some are available: note which tools will run.
 
 #### Step 2d: Tiered Static Analysis
 
-**Produces:** STATIC_FINDINGS
+**Produces:** STATIC_FINDINGS, STATIC_STATUS
 **Requires:** STATIC_TOOL_STATUS, DIFF_RANGE, ANALYSIS_DIR
 
-Skip if `--no-static` flag provided or all tools unavailable.
-
-Run available tools on the changed files (from `CHANGED_FILES` computed in Step 2b).
+Skip if Step 2c set `STATIC_STATUS`.
 
-**Semgrep and Snyk run in parallel** — launch both in the background, then wait for both before proceeding to CodeQL. CodeQL is conditional and sequential.
+Run each available tool in this order, each in its own foreground Bash call with the Bash `timeout` at the ceiling: 600000 ms, or `BASH_MAX_TIMEOUT_MS` when set. Past it, make no tool call, even a Read, until its end notice, then Read the last `exit=` line of the output file that notice names, never a scanner file; the notice sets nothing. File names reach a scanner only through `-z`, `xargs -0` and after `--`.
 
 **Semgrep** (if available):
 ```bash
-# tr '\n' '\0' + xargs -0 is portable across GNU and BSD xargs (macOS ships BSD xargs, which lacks -d)
-echo "$CHANGED_FILES" | tr '\n' '\0' | xargs -0 timeout 300 semgrep scan --config auto --sarif --quiet 2>/dev/null
+cd "{worktree}" || exit
+set -o pipefail; git diff --name-only -z --diff-filter=d {DIFF_RANGE} | xargs -0 -r semgrep scan --config auto --sarif --quiet -- >"{ANALYSIS_DIR}/semgrep.part" 2>/dev/null; E=$?
+mv "{ANALYSIS_DIR}"/semgrep.{part,sarif}
+printf '\nexit=%s\n' "$E"
 ```
-Parse SARIF output → extract findings.
 
 **Snyk Code** (if available):
 ```bash
-# One project-level scan (a per-file xargs run would invoke snyk O(n) times; --file is for dependency scans).
-SNYK_SARIF=$(timeout 300 snyk code test --sarif 2>/dev/null)
-# Programmatic filter: keep only results whose file path is in CHANGED_FILES — defense-in-depth, before the LLM agent sees any output.
-SNYK_FILTERED=$(echo "$SNYK_SARIF" | jq --argjson files "$(echo "$CHANGED_FILES" | jq -R . | jq -s .)" \
-  '.runs[].results |= map(select(.locations[].physicalLocation.artifactLocation.uri as $uri | $files | index($uri) != null))' \
-  2>/dev/null || echo "$SNYK_SARIF")
+cd "{worktree}" || exit
+snyk code test --sarif >"{ANALYSIS_DIR}/snyk-all.json" 2>/dev/null; E=$?
+git diff --name-only -z {DIFF_RANGE} >"{ANALYSIS_DIR}/changed.z" && jq --rawfile n "{ANALYSIS_DIR}/changed.z" \
+  '($n|split("\u0000")) as $f|.runs[]?.results|=[.[]?|select([.locations[]?.physicalLocation.artifactLocation.uri//empty] as $u|($u|length)==0 or any($u[];IN($f[])))]' \
+  "{ANALYSIS_DIR}/snyk-all.json" >"{ANALYSIS_DIR}/snyk.sarif" \
+  && jq -nr '[inputs|[.runs[]?.results[]?]|length]|"total=\(.[0]) kept=\(.[1])"' "{ANALYSIS_DIR}/snyk-all.json" "{ANALYSIS_DIR}/snyk.sarif" \
+  || { echo "Snyk scope filter failed: unfiltered"; cp "{ANALYSIS_DIR}/snyk-all.json" "{ANALYSIS_DIR}/snyk.sarif"; }
+printf '\nexit=%s\n' "$E"
 ```
-Parse `SNYK_FILTERED` SARIF → extract findings. If `jq` is unavailable, fall back to the raw `SNYK_SARIF` and note the limitation.
+
+**Counts and table** (after Snyk with `{tools}` = `semgrep snyk`; after CodeQL with `codeql`):
+```bash
+cd "{ANALYSIS_DIR}" || exit
+L='def L($r):.ruleId as $i|.level//([$r.tool|.driver,.extensions[]?|.rules[]?|select(.id==$i)]|.[0].defaultConfiguration.level)//"warning";'
+for t in {tools}; do [ -f $t.sarif ] || continue
+  jq -rs --arg t $t "$L"'[.[].runs[]?|. as $r|.results[]?|L($r)] as $l|def c(k):[$l[]|select(.==k)]|length;"\($t) docs=\(length) results=\($l|length) error=\(c("error")) warning=\(c("warning")) note=\(c("note"))"' $t.sarif || echo "$t sarif=unreadable"
+  jq -r --arg t $t "$L"'.runs[]?|. as $r|.results[]?|[$t,(.locations[0].physicalLocation|.artifactLocation.uri,.region.startLine),L($r),(.ruleId//"—"),((.message.text//"")[:200])]|@tsv' $t.sarif >findings-$t.tsv || echo "findings table incomplete: $t"
+done
+cat findings-{semgrep,snyk,codeql}.tsv >findings.tsv 2>/dev/null
+jq -Rrs 'split("\n")|map(select(.!=""))|sort_by(split("\t")[3]|{error:0,warning:1}[.]//2)|.[:50][]' findings.tsv >findings-top.tsv || echo "findings table incomplete: top"
+```
+Read `error` as HIGH, `warning` as MEDIUM, `note` as LOW.
 
 **CodeQL** (if available AND (`--full` OR Semgrep/Snyk found HIGH/CRITICAL findings)):
 ```bash
-# Use a unique temp directory per run to prevent symlink attacks and concurrent-process clobbering
-CODEQL_TMP=$(mktemp -d)
-# Register cleanup trap immediately after mktemp — ensures rm -rf runs on EXIT, SIGTERM, and SIGINT
-# even if the session is interrupted before reaching the explicit rm -rf below
+CODEQL_TMP=$(mktemp -d) || exit
 trap 'rm -rf "${CODEQL_TMP}"' EXIT INT TERM
-timeout 600 codeql database create "${CODEQL_TMP}/db" --language={detected-language} --source-root=. 2>/dev/null && \
-timeout 600 codeql database analyze "${CODEQL_TMP}/db" --format=sarif-latest --output="${CODEQL_TMP}/results.sarif" 2>/dev/null
-# Capture exit status before cleanup so cleanup doesn't mask failures
+{ codeql database create "${CODEQL_TMP}/db" --language={lang} --source-root="{worktree}" && \
+codeql database analyze "${CODEQL_TMP}/db" --format=sarif-latest --output="{ANALYSIS_DIR}/codeql.sarif"; } >"{ANALYSIS_DIR}/codeql.log" 2>&1
 CODEQL_EXIT=$?
-# Parse SARIF output BEFORE cleanup — rm -rf destroys results.sarif
-CODEQL_SARIF=$(cat "${CODEQL_TMP}/results.sarif" 2>/dev/null || echo "")
-# Explicit cleanup (trap also covers this path; explicit rm is belt-and-suspenders)
+printf '\nexit=%s\n' "$CODEQL_EXIT"
 rm -rf "${CODEQL_TMP}"
 trap - EXIT INT TERM
 ```
-Parse `CODEQL_SARIF` → extract findings. If database creation fails, `CODEQL_EXIT` is non-zero — skip CodeQL findings and note it. The `trap` guarantees cleanup on SIGTERM/SIGINT/EXIT so orphaned temp directories do not accumulate across interrupted sessions.
+A tool's status is its last line, `exit={n}`; a tool that ran completed only on Semgrep 0, Snyk 0 or 1 (1 = issues, only with SARIF output), CodeQL 0. Snyk 3 (no supported file) is `no supported language`: its counts are not checked. Any other status, or no such line, means it did not complete (126-127: scanner did not start; else failed. Semgrep via xargs: number only). A call with no `exit=` line read did not complete. A tool that ran also did not complete when the counts fence prints no `{tool} docs=` line for it, `sarif=unreadable` or `findings table incomplete` for it (`: top` counts for every tool), or `docs=0` (Semgrep exit 0 with `docs=0`: no file to scan, completed).
 
-**Normalize** all findings to unified table, cap at top 50 by severity. Truncate each Description entry to 200 characters maximum:
+`findings.tsv` keeps every finding. Read only `findings-top.tsv` (top 50 by level: tool, file, line, level, rule, message cut to 200 chars), set `STATIC_FINDINGS` to the column names and its rows, and write them with the status lines to `{ANALYSIS_DIR}/static-findings.md`.
 
-| Tool | File:Line | CWE | Severity | Title | Description |
-|------|-----------|-----|----------|-------|-------------|
-| {tool} | {file}:{line} | {CWE or —} | {CRITICAL/HIGH/MEDIUM/LOW} | {title} | {description truncated to 200 chars} |
+`STATIC_FINDINGS` is `(none)` only when every tool that was to run completed, at least one did, and none found anything; when no tool was to run, it is "Static analysis did not run: no tool ran." For each tool that did not complete, add under any rows the line "Static analysis did not complete: {tool}: " plus "exit {n} ({meaning}).", "no exit status.", "no counts line." or "SARIF not read." A Snyk call (not Snyk 3) that printed "Snyk scope filter failed: unfiltered" adds that line too.
 
-Write ALL raw findings to `{ANALYSIS_DIR}/static-findings.md`. Set `STATIC_FINDINGS` to the top-50 table.
-
-If no tool produced findings: set `STATIC_FINDINGS` to `(none)`.
+Set `STATIC_STATUS` to one `{tool}: {value}` per tool: `completed`, `not installed`, `not needed` (CodeQL, not triggered) or `no supported language` (CodeQL with no table row, or Snyk 3), all covered, or `did not complete ({why})`, not covered. A covered tool other than `completed` was not to run.
 
 ### Phase 3: Context Loading
 
@@ -188,23 +197,22 @@ If no tool produced findings: set `STATIC_FINDINGS` to `(none)`.
 #### Plan Artifact
 
 1. List the design plans: `{worktree}/.devflow/docs/design/*.md` (a `/plan` artifact) and `{worktree}/.devflow/docs/design/*/*/*-plan.md` (a `/dynamic-plan` per-ticket plan). Sort by timestamp, newest first, and scan the 10 most recent. A `/plan` artifact's timestamp is the `YYYY-MM-DD_HHMM` before its `.md`; a per-ticket plan's is the name of its parent directory. Never sort by file name, which starts with an issue ID or a ticket slug. A per-ticket plan counts only when its `{ticket-slug}` (its file name without `-plan.md`) appears in the worktree's branch name
-2. Read the most recent file that carries an `## Acceptance Criteria` section
-3. Extract `## Acceptance Criteria` section → parse into table: `| ID | Criterion | Type | Testable Condition |`
-4. Set `PLAN_CONTEXT` to plan summary; `ACCEPTANCE_RULES` to the table
-5. If no plan files exist or section not found: `PLAN_CONTEXT=(none)`, `ACCEPTANCE_RULES=(none)`
+2. Read the most recent file that carries an `## Acceptance Criteria` section; parse it into the table `| ID | Criterion | Type | Testable Condition |`
+3. Set `PLAN_CONTEXT` to plan summary; `ACCEPTANCE_RULES` to the table
+4. If no plan files exist or section not found: `PLAN_CONTEXT=(none)`, `ACCEPTANCE_RULES=(none)`
 
 ### Phase 4: File Analysis
 
 **Produces:** ACTIVE_FOCUSES
 **Requires:** DIFF_RANGE
 
-Determine which focus analyzers to run using `CHANGED_FILES` (already computed in Step 2b — do not re-run `git diff`):
+Pick the focus analyzers from `CHANGED_FILES` (Step 2b; do not re-run `git diff`):
 
 | Focus | Condition |
 |-------|-----------|
 | `security` | Always |
 | `functional` | Always |
-| `integration` | 2+ distinct directories changed (`dirname` unique count ≥ 2) |
+| `integration` | 2+ distinct directories changed |
 | `usability` | Any `.tsx`, `.jsx`, `.html`, or `.css` file changed |
 
 ### Phase 5: Parallel Bug Analysis
@@ -226,7 +234,7 @@ FOCUS: {focus}
 DIFF_COMMAND: git diff {DIFF_RANGE}
 ACCEPTANCE_RULES: {ACCEPTANCE_RULES filtered to this focus type, or (none)}
 PLAN_CONTEXT: {PLAN_CONTEXT}
-STATIC_FINDINGS: {STATIC_FINDINGS if focus == security, else (none)}
+STATIC_FINDINGS: <static-findings>{STATIC_FINDINGS if focus == security, else (none)}</static-findings>
 <!-- curation:on -->
 DECISIONS_CONTEXT: {DECISIONS_CONTEXT}
 <!-- curation:end -->
@@ -237,18 +245,13 @@ OUTPUT_PATH: {ANALYSIS_DIR}/{focus}.md
 Follow devflow:apply-decisions to Read full ADR/PF bodies on demand.
 <!-- curation:end -->
 Follow devflow:apply-feature-knowledge for FEATURE_KNOWLEDGE.
-IMPORTANT: Write report to {ANALYSIS_DIR}/{focus}.md using Write tool"
+IMPORTANT: Write the report to OUTPUT_PATH using the Write tool"
 ```
 
-Notes:
-- Security analyzer receives full `STATIC_FINDINGS`; all others receive `(none)`
-- Filter `ACCEPTANCE_RULES` by the `Type` column matching each focus: security criteria → security analyzer, functional criteria → functional analyzer, etc. Pass the filtered subset only
-- Spawn all in a single message for true parallel execution
-
 ### Phase 6: Synthesis
 
 **Produces:** BUG_ANALYSIS_SUMMARY
-**Requires:** ANALYZER_OUTPUTS, ANALYSIS_DIR, BRANCH_INFO
+**Requires:** ANALYZER_OUTPUTS, ANALYSIS_DIR, BRANCH_INFO, STATIC_STATUS
 
 Spawn Synthesize agent:
 
@@ -258,42 +261,43 @@ Agent(subagent_type="Synthesize", run_in_background=false):
 ANALYSIS_BASE_DIR: {ANALYSIS_DIR}
 BRANCH: {branch} -> {base_branch}
 TIMESTAMP: {timestamp}
+STATIC_STATUS: {STATIC_STATUS}
 Output: {ANALYSIS_DIR}/bug-analysis-summary.md"
 ```
 
 ### Phase 7: Finalize
 
-**Requires:** BRANCH_INFO, ANALYSIS_DIR
+**Requires:** BRANCH_INFO, ANALYSIS_DIR, STATIC_STATUS
 
-1. In one Bash call run `M="$(git -C "{worktree}" rev-parse --absolute-git-dir)/devflow/bug-analysis/{branch-slug}" && mkdir -p "$M" && git -C "{worktree}" rev-parse HEAD > "$M/.last-analysis-head"`. A failed or refused write never stops the run and is not retried another way.
+1. Run the write below only when every tool that was to run completed, or `--no-static` is set, also with `--full`. Else keep the marker; the report names the way out (fix the tool, or run with `--no-static`). In one Bash call run `M="$(git -C "{worktree}" rev-parse --absolute-git-dir)/devflow/bug-analysis/{branch-slug}" && mkdir -p "$M" && git -C "{worktree}" rev-parse HEAD > "$M/.last-analysis-head"`. A failed or refused write never stops the run and is not retried another way.
 2. Report to user:
 
 ```
 ## Bug Analysis Complete
 
 **Branch**: {branch} -> {base_branch}
+<!-- compliance:on -->
 {any base `TRACEABILITY: DEGRADED` line from Phase 1, as returned}
+<!-- compliance:off -->
+{any base `TRACEABILITY: DEGRADED` line from Phase 1, as returned, and the compliance-off line of Phase 1}
+<!-- compliance:end -->
 **Analysis**: {ANALYSIS_DIR}
+**Static analysis**: {STATIC_STATUS per tool; if a tool did not complete: "marker kept" and the way out; any Snyk filter note}
 
 ### Risk Assessment: {risk_level}
 
 {brief_reasoning}
 
 ### Bug Counts
-| Category | CRITICAL | HIGH | MEDIUM | LOW | Total |
-|----------|----------|------|--------|-----|-------|
-| Security | {n} | {n} | {n} | {n} | {n} |
-| Functional | {n} | {n} | {n} | {n} | {n} |
-| Integration | {n} | {n} | {n} | {n} | {n} |
-| Usability | {n} | {n} | {n} | {n} | {n} |
+{The summary's Bug Summary table: Security, Functional, Integration and Usability rows by CRITICAL, HIGH, MEDIUM, LOW and Total}
 
 ### Top Findings
-{List top 3-5 bugs by severity and confidence}
+{Top 3-5 bugs by severity and confidence}
 
 ### Artifacts
 - Bug report: {ANALYSIS_DIR}/bug-analysis-summary.md
-- Per-focus reports: {ANALYSIS_DIR}/{security|functional|integration|usability}.md
-- Static findings: {ANALYSIS_DIR}/static-findings.md (if static analysis ran)
+- Per-focus reports: {ANALYSIS_DIR}/{focus}.md
+- Static findings: {ANALYSIS_DIR}/static-findings.md (if it ran)
 
 {if any CRITICAL or HIGH bugs found:}
 Run `/resolve` to process and fix these findings.
@@ -301,76 +305,26 @@ Run `/resolve` to process and fix these findings.
 
 ## Architecture
 
-```
-/bug-analysis (orchestrator — spawns agents only)
-│
-├─ Phase 1: Pre-flight
-│  └─ Git agent (ensure-pr-ready)
-│
-├─ Phase 2: Static Analysis
-│  └─ 2a incremental range, 2b changed files (stop if none), 2c tools, 2d semgrep → snyk → codeql
-│
-├─ Phase 3: Context Loading
-<!-- curation:on -->
-│  ├─ index.md (pre-rendered) → DECISIONS_CONTEXT
-<!-- curation:end -->
-│  ├─ Feature knowledge load → FEATURE_KNOWLEDGE
-│  └─ {worktree}/.devflow/docs/design/*.md → PLAN_CONTEXT + ACCEPTANCE_RULES
-│
-├─ Phase 4: File Analysis
-│  └─ Detect active focuses (security + functional always; integration + usability conditional)
-│
-├─ Phase 5: Bug Analysis (PARALLEL)
-│  └─ Debug agent per active focus (security also reads STATIC_FINDINGS)
-│
-├─ Phase 6: Synthesis
-│  └─ Synthesize agent (mode: bug-analysis)
-│
-└─ Phase 7: Finalize
-   ├─ Write .last-analysis-head
-   └─ Display results + suggest /resolve if blocking bugs found
-```
+Seven phases: Phase 1 to Phase 7.
 
 ## Edge Cases
 
 | Case | Handling |
 |------|----------|
-| No new commits since last analysis | Stop: "No new commits since last analysis. Use --full for a full re-analysis." |
 | Rebase invalidates `.last-analysis-head` SHA | `git cat-file -t` check fails → fallback to full diff |
 | Zero changed files in DIFF_RANGE with exit 0 | Stop: "No changes to analyze." |
-| Same-minute analysis collision | `mkdir` with seconds suffix (`YYYY-MM-DD_HHMMSS`) |
-| All static tools unavailable | Warn, proceed with semantic-only analysis |
-| `--no-static` flag | Skip Phase 2c and 2d entirely; `STATIC_FINDINGS=(none)` |
 | `--full` flag | Bypass incremental detection (Step 2a), run full diff from base |
-| CodeQL database creation fails | Skip CodeQL, note in output, continue with other tools |
+| A scanner did not run or did not complete | Name the tool and why in `STATIC_FINDINGS`, not `(none)`; a tool that did not complete keeps the marker |
 
 ## Resolve Compatibility
 
-Run `/resolve` after `/bug-analysis` to fix identified bugs. `/resolve` automatically detects and uses bug analysis reports when no code review report exists.
+`/resolve` detects and uses bug analysis reports when no code review report exists.
 
 ## Principles
 
-1. **Orchestration only** — Command spawns agents, doesn't do analysis work itself
-2. **Parallel, not background** — Analyzers spawn in one message with `run_in_background=false`
-3. **Static + semantic** — Two complementary tracks, each validates the other
-4. **Incremental by default** — Only analyze new changes unless `--full` specified
-5. **Verify before reporting** — Debug agents self-verify every finding
-6. **Honest reporting** — Display risk level and counts directly from synthesis
+1. **Orchestration only** — the command spawns agents and does no analysis itself
+2. **Incremental by default** — only new changes, unless `--full`
 
 ## Phase Completion Checklist
 
-Before reporting results, verify every phase was executed:
-
-- [ ] Phase 1: Pre-flight → BRANCH_INFO captured, PR_DESCRIPTION fetched (or `(none)`)
-- [ ] Phase 2: Static Analysis → STATIC_FINDINGS captured (or `(none)` if skipped/no tools/no findings); ANALYSIS_DIR created; CHANGED_FILES populated
-<!-- curation:on -->
-- [ ] Phase 3: Context Loading → DECISIONS_CONTEXT captured, FEATURE_KNOWLEDGE loaded (or `(none)`), PLAN_CONTEXT and ACCEPTANCE_RULES captured (or `(none)`)
-<!-- curation:off -->
-- [ ] Phase 3: Context Loading → FEATURE_KNOWLEDGE loaded (or `(none)`), PLAN_CONTEXT and ACCEPTANCE_RULES captured (or `(none)`)
-<!-- curation:end -->
-- [ ] Phase 4: File Analysis → ACTIVE_FOCUSES determined (security + functional always present)
-- [ ] Phase 5: Parallel Bug Analysis → ANALYZER_OUTPUTS captured per active focus; all reports written to ANALYSIS_DIR
-- [ ] Phase 6: Synthesis → BUG_ANALYSIS_SUMMARY written to `{ANALYSIS_DIR}/bug-analysis-summary.md`
-- [ ] Phase 7: Finalize → `.last-analysis-head` updated; results displayed to user
-
-If any phase is unchecked, execute it before proceeding.
+Before reporting results, verify that every phase ran and that each variable it produces is captured, with STATIC_FINDINGS (`(none)` only if every tool that was to run completed clean), the report files in ANALYSIS_DIR present and `.last-analysis-head` written only if Phase 7's gate allows; run any missing phase first.