devflow-kit 3.9.0 → 3.10.0

package/src/assets/commands/code-review.mds

@@ -10,7 +10,11 @@ output-dir: dist/commands
 @import "./_partials/_settings.mds" as settings
 # Code Review Command
 
+<!-- compliance:on -->
 Run a comprehensive code review of the current branch by spawning parallel review agents, then synthesizing results into PR comments.
+<!-- compliance:off -->
+Run a comprehensive code review of the current branch by spawning parallel review agents, then synthesizing results into a local review summary.
+<!-- compliance:end -->
 
 ## Usage
 
@@ -52,6 +56,9 @@ Keep each worktree's values for every downstream phase.
 **Produces:** EVIDENCE_POLICY, ISSUE_REQUIRED, APPLY_CONVENTIONS, REQUIRE_NON_AUTHOR_APPROVAL
 
 {{evidence_policy()}}
+<!-- compliance:off -->
+When `EVIDENCE_POLICY` is `required`, record `TRACEABILITY: DEGRADED (compliance off on this machine; the repository requires evidence)` once, for the Phase 4 report.
+<!-- compliance:end -->
 
 #### Step 0c: Per-Worktree Pre-Flight (Git Agent)
 
@@ -64,6 +71,7 @@ Discover PR description guidance from plan artifact (per worktree):
 3. Read the most recent file that carries the section, extract `## PR Description Guidance` section
 4. If no plan files exist or section not found, set `PR_DESCRIPTION_GUIDANCE` to `(none)`
 
+<!-- compliance:on -->
 Render the test-plan block (per worktree) from `/implement`'s evidence file, and from nothing else:
 1. `branch_slug` is `git -C "{worktree}" branch --show-current` with every `/` replaced by `-`.
 2. Only when `branch_slug` matches `^[A-Za-z0-9._-]{1,200}$` and the file exists, run (the path double-quoted):
@@ -74,6 +82,7 @@ node "$HOME/.devflow/scripts/verify-evidence.cjs" render --plan "{worktree}/.dev
 
 3. On `exit=0`, `PR_TEST_PLAN_BLOCK` is its stdout byte for byte without that `exit=` line; in every other case it is `(none)`. Nothing here waits on it: the Git agent pastes it only behind its own check, and only into a PR it creates.
 
+<!-- compliance:end -->
 For each reviewable worktree, spawn Git agent:
 
 ```
@@ -81,7 +90,9 @@ Agent(subagent_type="Git", run_in_background=false):
 "OPERATION: ensure-pr-ready
 WORKTREE_PATH: {worktree_path}  (omit if cwd)
 PR_DESCRIPTION_GUIDANCE: {pr_description_guidance}
+<!-- compliance:on -->
 PR_TEST_PLAN_BLOCK: {PR_TEST_PLAN_BLOCK verbatim, or (none)}
+<!-- compliance:end -->
 APPLY_CONVENTIONS: {APPLY_CONVENTIONS}
 Validate branch, commit if needed, push, create PR if needed.
 Return: branch, base_branch, base_ref, branch-slug, PR#"
@@ -158,6 +169,7 @@ MAX_REVIEW_CYCLES = 10
 | denominator = 0 OR parsing failed | fp_ratio = 0, skip warning (degraded note on parse failure) |
 | fp_ratio > 0.7 AND CYCLE_NUMBER >= 3 | Warn in output, continue |
 
+<!-- compliance:on -->
 #### Step 0f: Resolve Publication Mode (Per Worktree)
 
 **Produces:** REVIEW_PUBLICATION
@@ -167,6 +179,7 @@ For each reviewable worktree, call:
 
 {{publication_gate()}}
 
+<!-- compliance:end -->
 ### Phase 1: Analyze Changed Files
 
 **Produces:** REVIEW_FOCUS_LIST, DIFF_CLASS, DIFF_FILES
@@ -371,12 +384,22 @@ IMPORTANT: Write report to {worktree_path}/.devflow/docs/reviews/{branch-slug}/{
 
 In multi-worktree mode, process worktrees **sequentially**: Phases 1-4 for each.
 
+<!-- compliance:on -->
 ### Phase 3: Synthesis → Review Comment (Sequential)
 
 **Produces:** REVIEW_SUMMARY, PR_COMMENT
+<!-- compliance:off -->
+### Phase 3: Synthesis → Review Summary (Sequential)
+
+**Produces:** REVIEW_SUMMARY
+<!-- compliance:end -->
 **Requires:** REVIEW_FOCUS_OUTPUTS, REVIEW_DIR, PR_INFO, GATE_LEVEL, REVIEW_FOCUS_LIST
 
+<!-- compliance:on -->
 **WAIT** for Phase 2. For each worktree, run steps 3a and 3b in sequence:
+<!-- compliance:off -->
+**WAIT** for Phase 2. For each worktree, run step 3a:
+<!-- compliance:end -->
 
 **Step 3a — Synthesize agent** per worktree:
 ```
@@ -394,6 +417,7 @@ Aggregate findings, determine merge recommendation.
 Output: {worktree_path}/.devflow/docs/reviews/{branch-slug}/{timestamp}/review-summary.md"
 ```
 
+<!-- compliance:on -->
 **Step 3b — Git agent (post-review-summary)** per worktree (after Step 3a writes review-summary.md):
 ```
 Agent(subagent_type="Git", run_in_background=false):
@@ -407,6 +431,7 @@ WORKTREE_PATH: {worktree_path}  (omit if cwd)
 Posts the consolidated review-summary comment (marker-deduped on the cycle+timestamp pair)."
 ```
 
+<!-- compliance:end -->
 ### Phase 4: Write Review Head Marker & Report
 
 **Requires:** BRANCH_INFO, REVIEW_DIR
@@ -416,9 +441,14 @@ Per worktree, after successful completion:
 2. Display results from all agents:
    - Merge recommendation (from Synthesize agent)
    - Issue counts by category (🔴 blocking / ⚠️ should-fix / ℹ️ pre-existing)
+<!-- compliance:on -->
    - Review comment status: POSTED / POSTED+TRUNCATED (body exceeded 60k after redaction) / SKIPPED (D7 dedup) / DEGRADED (from Git)
    - Publication status: FULL (private repo) | FULL (config override) | STUB (public repository) | OFF (publication disabled by config) | STUB (visibility undeterminable) | STUB (evidence policy) (from Git agent)
    - Any base `TRACEABILITY: DEGRADED` line from Step 0c, as returned
+<!-- compliance:off -->
+   - Review summary: `.devflow/docs/reviews/{branch-slug}/{timestamp}/review-summary.md` (local; not posted)
+   - Any base `TRACEABILITY: DEGRADED` line from Step 0c, as returned, and the compliance-off line of Step 0b-ii
+<!-- compliance:end -->
    - Artifact paths
 
 ## Architecture
@@ -426,7 +456,11 @@ Per worktree, after successful completion:
 ```
 /code-review
 │
+<!-- compliance:on -->
 ├─ Phase 0: Worktree Discovery & Pre-flight, Steps 0a-0f (Git agent per worktree, parallel)
+<!-- compliance:off -->
+├─ Phase 0: Worktree Discovery & Pre-flight, Steps 0a-0e (Git agent per worktree, parallel)
+<!-- compliance:end -->
 │  ├─ Step 0b: Resolve the compliance lens and gate level
 │
 ├─ Per worktree (SEQUENTIAL):
@@ -440,9 +474,14 @@ Per worktree, after successful completion:
 │  │  ├─ code: core (diff.patch), language (diff-{focus}.patch), conditional
 │  │  └─ docs-only / tests-only / lockfile-only: the reduced set (diff.patch)
 │  │
+<!-- compliance:on -->
 │  ├─ Phase 3: Synthesis → Review Comment (SEQUENTIAL within worktree)
 │  │  ├─ Step 3a: Synthesize agent (mode: review, writes review-summary.md)
 │  │  └─ Step 3b: Git agent (post-review-summary)
+<!-- compliance:off -->
+│  ├─ Phase 3: Synthesis → Review Summary (SEQUENTIAL within worktree)
+│  │  └─ Step 3a: Synthesize agent (mode: review, writes review-summary.md)
+<!-- compliance:end -->
 │  │
 │  └─ Phase 4: Write .last-review-head + display results
 ```
@@ -452,7 +491,9 @@ Per worktree, after successful completion:
 | Case | Handling |
 |------|----------|
 | `--full` in multi-worktree mode | Applies to all worktrees (global modifier). It sets the diff range, never the gate level |
+<!-- compliance:on -->
 | Review comment already posted | Git agent matches its own marker on the `{cycle, timestamp}` pair → skip silently (D7) |
+<!-- compliance:end -->
 | Docs-only diff | Its Step 1.1 set, narrowed by level |
 | Tests-only diff | Its Step 1.1 set, narrowed by level |
 | Lockfile-only diff | Its Step 1.1 set, narrowed by level |
@@ -461,7 +502,9 @@ Per worktree, after successful completion:
 | A file moved across classes | `--no-renames` lists both paths, so a code path makes the diff `code` |
 | Path listing above about 40 lines | Read in ranges (Step 1.1) |
 | Language files changed, plugin not installed | The focus is absent from the stamped line: not spawned |
+<!-- compliance:on -->
 | `reviewPublication: off` | Git agent skips posting the review comment (OFF) — except that, only when `EVIDENCE_POLICY` is `required`, Step 0f passes `stub` and a counts-only STUB comment posts unless no public text remains |
+<!-- compliance:end -->
 
 ## Backwards Compatibility
 

package/src/assets/commands/dynamic-build.mds

@@ -43,7 +43,7 @@ This command instructs you to construct and run a Claude Code dynamic Workflow t
 Before authoring, verify:
 
 1. **Workflow tool available:** if the `Workflow` tool is not in your available tools, STOP and tell the user: "The Workflow tool is not available in this session. dynamic-build requires Claude Code's dynamic workflow runtime."
-2. **`agentType` support:** confirmed available (spike F5, 2026-06-11). If spawned agents return no results, check that devflow is installed (`devflow init` has been run).
+2. **`agentType` support:** if spawned agents return no results, check that devflow is installed (`devflow init` has been run).
 3. **Tracker paths:** an issue reference or URL in the input is read through the Git agent, which resolves the configured tracker and its access itself and reports `TRACEABILITY: DEGRADED ({reason})` when it cannot read one — then note it and fall back to the issue text the user provided. No tracker CLI is checked here.
 4. **No-remote path:** if the repo has no remote, skip the remote-dependent steps (the wave PR and its evidence) and proceed with local branch operations only; the Git agent reports DEGRADED for any tracker step it cannot reach.
 
@@ -58,6 +58,9 @@ Before you write the workflow script:
 **Produces:** EVIDENCE_POLICY, ISSUE_REQUIRED, APPLY_CONVENTIONS, REQUIRE_NON_AUTHOR_APPROVAL
 
 {{evidence_policy()}}
+<!-- compliance:off -->
+When `EVIDENCE_POLICY` is `required`, record `TRACEABILITY: DEGRADED (compliance off on this machine; the repository requires evidence)` once, for the run summary.
+<!-- compliance:end -->
 
 Author the resolved `ISSUE_REQUIRED` and `APPLY_CONVENTIONS` into the workflow script as constants — pass them as `issueRequired` and `applyConventions` when invoking the workflow — and pass both to the Git `setup-task` spawn.
 
@@ -135,7 +138,11 @@ Check, in priority order:
 
 If a number is found, record it as the command-level `ISSUE_NUMBER`:
 - **SINGLE mode:** it is the ticket's own reference. Pass it as `issueNumber: <number>` when invoking the workflow; the engine hands it to setup-task as `ISSUE_INPUT`. If none is found, pass nothing.
+<!-- compliance:on -->
 - **WAVE mode:** it is the tracking issue. Only steps 2 and 3 after the workflow use it: step 2 for the wave report, step 3 for the wave block's tracking line. It never reaches a ticket: each ticket's engine gets that ticket's own reference as `issueInput`.
+<!-- compliance:off -->
+- **WAVE mode:** it is the tracking issue. Only step 3 after the workflow uses it, for the wave block's tracking line. It never reaches a ticket: each ticket's engine gets that ticket's own reference as `issueInput`.
+<!-- compliance:end -->
 
 Never pass `ISSUE_PR_LINK` into the workflow. The engine binds each ticket's `ISSUE_NUMBER` and `ISSUE_PR_LINK` from that ticket's own setup-task Output (`### Handoff Values`), never from the token it passed in, and returns that ticket's `issuePrLink` for the wave PR's related line. No `- **PR link line**:` captured ⇒ `ISSUE_PR_LINK` is `"(none)"` and the ticket's related line carries no closing reference.
 
@@ -227,7 +234,7 @@ After implementing, commit your changes with a conventional-commit message and r
 );
 
 // Phase 3: Gate 1 #1 — post-code pipeline: Polish agent → Harden agent → Validate agent.
-// Validate runs last and unconditionally, so its one full run covers every commit the pass made (see gate1_postcode()).
+// Validate runs last and unconditionally, so its one full run covers every commit the pass made.
 const gate1 = await phase("gate1", async () => {
   await agent(`Polish and reduce complexity of recent changes on branch ${BRANCH}. Commit any improvements.`, { agentType: "Polish" });
 
@@ -288,8 +295,7 @@ Criteria: ${CRITERIA || "see plan"}
 Return: {"verdict": "PASS" | "FAIL", "rationale": "..."} — FAIL if either answer is no, naming the failing criterion or the drift.`, { agentType: "Evaluate" });
     evalVerdict = evaluation?.verdict === "PASS" ? "PASS" : "FAIL";
     if (evalVerdict === "FAIL") {
-      // fix-and-continue — no re-evaluate, no inline Gate 1. The final Gate 1 (#2)
-      // after the review pass is the build gate before the branch is handed back.
+      // fix-and-continue — no re-evaluate, no inline Gate 1.
       await agent(`OPERATION: alignment-fix
 Fix the alignment issues identified by the Evaluate agent on branch ${BRANCH}:
 ${evaluation?.rationale || "see the Evaluate agent's report"}
@@ -308,19 +314,21 @@ Self-verify your fix compiles, following your Running commands block. Commit fix
 ${CRITERIA || "(none)"}
 TEST_PLAN: ${TEST_PLAN || "(none)"}
 Follow your Running commands block for every scenario command.
-Cover: functionality, API contracts, performance, and cover every TEST_PLAN scenario. Report: PASS or FAIL per scenario.`, { agentType: "Test" });
-    testVerdict = testResult.verdict;
+Cover: functionality, API contracts, performance, and cover every TEST_PLAN scenario.
+Return: {"verdict": "PASS" | "FAIL" | "BLOCKED", "failures": "..."}`, { agentType: "Test" });
+    const word = testResult?.verdict?.split?.(/[ (]/)[0];
+    testVerdict = ["PASS", "FAIL"].includes(word) ? word : "BLOCKED";
     if (testVerdict === "FAIL") {
       // fix-and-continue — no re-test, no inline Gate 1.
       await agent(`OPERATION: qa-fix
 Fix the failing acceptance test scenarios on branch ${BRANCH}:
-${testResult.failures}
+${testResult.failures || "see the Test agent's report"}
 <!-- curation:on -->
 DECISIONS_CONTEXT: ${DECISIONS_CONTEXT}
 <!-- curation:end -->
 ${COMPLIANCE_DIRECTIVE}
 Self-verify your fix compiles and the scenarios pass, following your Running commands block. Commit fixes.`, { agentType: "Fix" });
-      testVerdict = "FAIL-FIXED";  // issues found, fixes applied, not re-evaluated by design
+      testVerdict = "FAIL-FIXED";
     }
   }
 
@@ -468,8 +476,6 @@ Return: {"status": "fixed"|"blocked", "commitShas": ["<sha>"], "unresolved": ["<
 });
 
 // Phase 5.5: Gate 1 #2 — FINAL post-fix gate (Polish agent → Harden agent → full Validate agent, Validate last and unconditional).
-// Runs ONCE, after the review pass. Inside the pass the Code agent self-verified its own fixes;
-// this is the build gate before the branch is handed back. See gate1_postcode() cadence.
 const gate1Final = await phase("gate1-final", async () => {
   await agent(`Polish and reduce complexity of recent changes on branch ${BRANCH}. Commit any improvements.`, { agentType: "Polish" });
 
@@ -506,9 +512,9 @@ Return: {"verdict": "PASS" | "FAIL", "details": "..."}`, { agentType: "Validate"
 });
 
 // PASS requires survivingFindings.length === 0 && coverageGaps.length === 0 && gate1Final.verdict !== "ESCALATED"
-// and no FAIL-FIXED Gate 2 verdict: fixes applied but never re-run report UNVERIFIED, never PASS
+// and every Gate 2 verdict PASS or SKIPPED; any other reports UNVERIFIED, never PASS
 const coverageGaps = reviewResult.coverageGaps || [];
-const gate2Unverified = [gate2.evaluateVerdict, gate2.testVerdict].includes("FAIL-FIXED");
+const gate2Unverified = ![gate2.evaluateVerdict, gate2.testVerdict].every(v => v === "PASS" || v === "SKIPPED");
 const overallVerdict = (reviewResult.survivingFindings?.length || 0) === 0 && coverageGaps.length === 0 && gate1Final.verdict !== "ESCALATED" ? (gate2Unverified ? "UNVERIFIED" : "PASS") : "PARTIAL";
 
 // Phase 6: Report — the phase returns the engine result (engine_output_schema); its verdict is overallVerdict
@@ -681,6 +687,7 @@ return { tickets: WAVE_TICKETS.map(t => results[t] || { ticket: t, ran: false, v
 A workflow cannot pause mid-run. After the build/wave workflow returns, you (the main model) surface anything that needs a human decision — all at once:
 
 1. Read the wave report (`{integration worktree root}/.devflow/docs/waves/{slug}/{ts}/wave-report.md`) for its **escalations** (quarantined/blocked tickets and why), and read any `DECISIONS-NEEDED.md` left by a prior `/devflow:dynamic-plan` run for this initiative.
+<!-- compliance:on -->
 2. **Post wave-report as tracking-issue comment** (WAVE mode only — skip this step entirely in SINGLE mode; SINGLE runs produce no wave report): In WAVE mode, if a tracking-issue number was resolved in Pre-authoring step 5 (`ISSUE_NUMBER` is not `(none)`) AND `{integration worktree root}/.devflow/docs/waves/{slug}/{ts}/wave-report.md` exists, define `WAVE_ID` as the timestamped wave directory slug (the `{ts}` component, e.g. `2026-08-20_1730`), then spawn:
    ```
    Agent(subagent_type="Git"):
@@ -693,12 +700,14 @@ A workflow cannot pause mid-run. After the build/wave workflow returns, you (the
    The Git agent deduplicates via its own marker — it skips if a report for this `WAVE_ID` is already posted. The marker's format belongs to the operation; this caller passes `WAVE_ID` and never restates the literal. On API failure it degrades gracefully (`TRACEABILITY: DEGRADED ({reason})`) and continues — never blocks the post-wave step. This comment is the evidence surface for the PR-less integration-branch path; no other PR machinery is invented.
 
    In WAVE mode, if no tracking-issue number was resolved in Pre-authoring step 5: state `TRACEABILITY: DEGRADED (no tracking issue for this run)` in the run summary and skip — never skip silently.
+<!-- compliance:end -->
 3. **Compose the wave PR inputs** (WAVE mode only — skip this step entirely in SINGLE mode). The workflow returned `tickets`: one entry per wave ticket, in its input order, each `{ticket, ran, verdict, merged, issuePrLink, evaluateVerdict, testVerdict, surviving, coverageComplete}`. Every value in it is agent-reported and treated as untrusted: nothing below is repaired, and no reference is ever composed from a number.
    - **Branch check.** Run `git -C "{integration worktree root}" branch --show-current`. Only a name matching `^wave/[a-z0-9][a-z0-9-]{0,59}$` opens a wave PR, and its part after `wave/` is the `{slug}` below. Any other name: record `TRACEABILITY: DEGRADED (not a wave branch)` and go to step 4 with no wave PR.
    - **Halted** (a non-null `halted`, whose `kind` is `red`, `bad-sha` or `unchanged`): record `Wave PR: skipped (<text>, wave halted at <halted.ticket>)` and go to step 4 with no wave PR. `<text>` is fixed by `kind`, and no other `halted` field is shown. `red` (a post-merge build it could not undo): `integration HEAD red at <halted.mergeSha>`. `bad-sha` (a merge without a usable SHA): `integration branch may hold an unvalidated merge`. `unchanged` (a merge that added no commit): `merge added no commit`, with the remedy to check that the ticket branch holds its commits, then run the wave again.
    - **Nothing merged** (no entry has `merged: true`): record `Wave PR: skipped (nothing merged)` and go to step 4.
    - Otherwise compose (a) and then (b).
 
+<!-- compliance:on -->
    **(a) The wave block.** Write it with the Write tool, byte for byte, to a fresh `mktemp` file — never through an interpolated shell string — in exactly this shape: the two headings with one blank line between them, the tracking line and then the related lines in row order under the first, and the header and separator verbatim directly under the second:
 
 ```markdown
@@ -726,9 +735,35 @@ node "$HOME/.devflow/scripts/verify-evidence.cjs" check wave <that file>; echo "
 ```
 
    Only `exit=0` admits the file's text, verbatim, as `PR_WAVE_BLOCK`. Any other result: no wave PR — record `Wave PR: not opened (wave block refused: <the code on stderr>)` and go to step 4.
+<!-- compliance:off -->
+   **(a) The wave block.** Number the `tickets` entries `T1` … `Tn` in order. Write the block with the Write tool, byte for byte, to a fresh `mktemp` file — never through an interpolated shell string — in exactly this shape: the heading, then the tracking line and the related lines in entry order under it. It has no verdict table and no evidence section:
 
+```markdown
+## Related Issues
+Refs {tracking ref}
+{one related line per entry that has one}
+```
+
+   **Related line.** An entry's captured `issuePrLink` is the only source of a reference. When it is not `(none)` and the reference it names (its text after `Closes ` or `Refs `) is, as a whole, a `#N` or `KEY-N` reference, the related line is `Refs ` and that reference. Any other entry has no related line. No line is `Closes`: the block holds no verdict, so it closes no issue.
+
+   **Tracking line** — only when Pre-authoring step 5 resolved a tracking issue whose token is, as a whole, a `#N` or `KEY-N` reference: `Refs ` and that token, verbatim, as the first line under `## Related Issues`. Any other token (a bare number, a URL), or none ⇒ no tracking line: nothing is composed from a number.
+
+   With no line under the heading, `PR_WAVE_BLOCK` is `(none)` and nothing is checked. Otherwise check the file:
+
+```bash
+node "$HOME/.devflow/scripts/verify-evidence.cjs" check wave --links-only <that file>; echo "exit=$?"
+```
+
+   Only `exit=0` admits the file's text, verbatim, as `PR_WAVE_BLOCK`. Any other result: no wave PR — record `Wave PR: not opened (wave block refused: <the code on stderr>)` and go to step 4.
+<!-- compliance:end -->
+
+<!-- compliance:on -->
    **Required link** — only when `EVIDENCE_POLICY` is `required`: a `PASS` or `UNVERIFIED` row whose Ticket is `(none)` — a merged ticket whose setup-task captured an Issue ID but no link line, so the wave PR would close nothing for it — ⇒ `Wave PR: BLOCKED (no ticket link for T<k>, …)`, with no wave PR question and the remedy "link or create those tickets' issues, then re-run"; there is no exception. Under `standard` such a row stays as the Ticket rule above renders it.
+<!-- compliance:off -->
+   **Required link** — only when `EVIDENCE_POLICY` is `required`: a merged entry (`merged: true` with `verdict` `PASS` or `UNVERIFIED`) whose `issuePrLink` is `(none)` — a merged ticket whose setup-task captured an Issue ID but no link line — ⇒ `Wave PR: BLOCKED (no ticket link for T<k>, …)`, with no wave PR question and the remedy "link or create those tickets' issues, then re-run"; there is no exception. Under `standard` such an entry only has no related line.
+<!-- compliance:end -->
 
+<!-- compliance:on -->
    **(b) The wave test plan.** Take the checked TP lines each merged row's ticket was given in Pre-authoring step 4, in row order; renumber them `TP-1`, `TP-2`, … and prefix each scenario with its row's `T<k>: `. A line is never shortened or reworded: one whose prefixed scenario would pass 200 characters leaves its ticket with no usable test plan. Write `## Test Plan` and those lines, and nothing else, to `"{integration worktree root}/.devflow/docs/evidence-wave-{slug}.md"` with the Write tool, then run (the path double-quoted; one rewrite from the same lines after a refusal, never a second):
 
 ```bash
@@ -737,10 +772,27 @@ node "$HOME/.devflow/scripts/verify-evidence.cjs" render --plan "{integration wo
 ```
 
    Only when both exit 0 is `PR_TEST_PLAN_BLOCK` the render's stdout, byte for byte without its `exit=` line; in every other case it is `(none)`.
+<!-- compliance:off -->
+   **(b) The wave test plan.** Take the checked TP lines each merged entry's ticket was given in Pre-authoring step 4, in entry order; renumber them `TP-1`, `TP-2`, … and prefix each scenario with its entry's `T<k>: `. A line is never shortened or reworded: one whose prefixed scenario would pass 200 characters leaves its ticket with no usable test plan. Write `## Test Plan` and those lines, and nothing else, to `"{integration worktree root}/.devflow/docs/evidence-wave-{slug}.md"` with the Write tool, then run (the path double-quoted; one rewrite from the same lines after a refusal, never a second):
 
+```bash
+node "$HOME/.devflow/scripts/verify-evidence.cjs" check tp "{integration worktree root}/.devflow/docs/evidence-wave-{slug}.md"; echo "exit=$?"
+```
+
+   Only `exit=0` leaves a usable wave test plan; in every other case none remains.
+<!-- compliance:end -->
+
+<!-- compliance:on -->
    **Required plan** — only when `EVIDENCE_POLICY` is `required`: a merged ticket with no usable test plan ⇒ `Wave PR: BLOCKED (no test plan for T<k>, …)`, more than 200 lines in all ⇒ `Wave PR: BLOCKED (test plan over 200 lines)`, and a plan that did not check and render ⇒ `Wave PR: BLOCKED (test plan malformed)` — each with no wave PR question and the remedy "run `/devflow:dynamic-plan` for those tickets and re-run, or ship them through `/implement`"; no exception is offered here. Otherwise the block is optional: a ticket with no usable test plan is left out of it and named in the summary, and `(none)` is passed when no line remains.
+<!-- compliance:off -->
+   **Required plan** — only when `EVIDENCE_POLICY` is `required`: a merged ticket with no usable test plan ⇒ `Wave PR: BLOCKED (no test plan for T<k>, …)`, more than 200 lines in all ⇒ `Wave PR: BLOCKED (test plan over 200 lines)`, and a plan that did not check ⇒ `Wave PR: BLOCKED (test plan malformed)` — each with no wave PR question and the remedy "run `/devflow:dynamic-plan` for those tickets and re-run, or ship them through `/implement`"; no exception is offered here. Otherwise the plan is optional: a ticket with no usable test plan is left out of it and named in the summary, and step 7 skips its evidence when no line remains.
+<!-- compliance:end -->
 4. Surface ALL of them — escalations AND open decisions — to the user in ONE batched `AskUserQuestion` (never one-at-a-time). `_wave.mds`'s escalation model already quarantines-and-continues; this batches the surfacing so the user answers everything in a single pass.
+<!-- compliance:on -->
    - **The wave PR question.** Only when step 3 composed `PR_WAVE_BLOCK`, the batch gains exactly one question: "Open the wave PR from wave/{slug}? It links {n} merged tickets ({u} UNVERIFIED) and references {q} quarantined." It has exactly two options: open it, or don't. The counts come from the checked block's rows: `{n}` PASS and UNVERIFIED, `{u}` UNVERIFIED, `{q}` QUARANTINED.
+<!-- compliance:off -->
+   - **The wave PR question.** Only when step 3 set `PR_WAVE_BLOCK`, to its admitted text or to `(none)`, the batch gains exactly one question: "Open the wave PR from wave/{slug}? It references {n} linked tickets." It has exactly two options: open it, or don't. `{n}` is the number of related lines in the checked block, the tracking line aside, and 0 when `PR_WAVE_BLOCK` is `(none)`.
+<!-- compliance:end -->
    - A `ticket-link-missing` escalation carries its remedy: link or create that ticket's issue, then re-run. There is no per-ticket exception.
    - **Headless** — `AskUserQuestion` is unavailable, or no answer comes — is a decline: nothing is created and nothing is pushed.
 5. If `~/.devflow/preference-profile.md` was absent, note in your summary: "no preference profile found — N decisions surfaced that a profile might have auto-resolved; consider `/devflow:dynamic-profile`."
@@ -749,18 +801,38 @@ node "$HOME/.devflow/scripts/verify-evidence.cjs" render --plan "{integration wo
    Agent(subagent_type="Git"):
    "OPERATION: ensure-pr-ready
    WORKTREE_PATH: {integration worktree root}
+<!-- compliance:on -->
    PR_DESCRIPTION_GUIDANCE: {counts only — the wave slug and the merged, quarantined and blocked counts; never an issue title or body}
+<!-- compliance:off -->
+   PR_DESCRIPTION_GUIDANCE: {counts only — the wave slug and the count of linked issues; never an issue title or body}
+<!-- compliance:end -->
    APPLY_CONVENTIONS: {APPLY_CONVENTIONS}
+<!-- compliance:on -->
    PR_WAVE_BLOCK: {PR_WAVE_BLOCK verbatim}
    PR_TEST_PLAN_BLOCK: {PR_TEST_PLAN_BLOCK verbatim, or (none)}"
+<!-- compliance:off -->
+   PR_WAVE_BLOCK: {PR_WAVE_BLOCK verbatim, or (none)}"
+<!-- compliance:end -->
    ```
+<!-- compliance:on -->
    The Git agent pastes each block only behind its own check. Report its `**PR**` line and any `TRACEABILITY: DEGRADED ({reason})` lines. The wave PR is opened here and nowhere else; it is never merged, and main is never touched — the user merges.
+<!-- compliance:off -->
+   The Git agent pastes the block only behind its own check. Report its `**PR**` line and any `TRACEABILITY: DEGRADED ({reason})` lines. The wave PR is opened here and nowhere else; it is never merged, and main is never touched — the user merges.
+<!-- compliance:end -->
 
 Do NOT ask questions mid-workflow — that is impossible (F4). The workflow only WRITES the report; you read it and ask.
 
+<!-- compliance:on -->
 7. **Wave PR evidence** — only when step 6 reported the wave PR, after it; it never blocks, and every outcome below goes into the run summary. Take `{n}` from step 6's `- **PR**: #{n}` line when `{n}` matches `^[1-9][0-9]{0,9}$` as a whole; no such line ⇒ record `TRACEABILITY: DEGRADED (wave PR number not captured)` and skip this step. `PR_TEST_PLAN_BLOCK` `(none)` ⇒ record `Wave evidence: skipped (no wave test plan)` and skip it.
+<!-- compliance:off -->
+7. **Wave PR evidence** — only when step 6 reported the wave PR, after it; it never blocks, and every outcome below goes into the run summary. Take `{n}` from step 6's `- **PR**: #{n}` line when `{n}` matches `^[1-9][0-9]{0,9}$` as a whole; no such line ⇒ record `TRACEABILITY: DEGRADED (wave PR number not captured)` and skip this step. No wave test plan line ⇒ record `Wave evidence: skipped (no wave test plan)` and skip (a)-(d).
+<!-- compliance:end -->
 
+<!-- compliance:on -->
    **Changed files.** Take `{base_ref}` from step 6's `- **Base ref**:` line; only when it is 40 or 64 lowercase hex, run `git -C "{integration worktree root}" diff --name-only --diff-filter=d {base_ref}...HEAD; echo "exit=$?"`. Unless it ran and printed `exit=0`, record `TRACEABILITY: DEGRADED (wave base unusable)` and skip this step.
+<!-- compliance:off -->
+   **Changed files.** Take `{base_ref}` from step 6's `- **Base ref**:` line; only when it is 40 or 64 lowercase hex, run `git -C "{integration worktree root}" diff --name-only --diff-filter=d {base_ref}...HEAD; echo "exit=$?"`. Unless it ran and printed `exit=0`, record `TRACEABILITY: DEGRADED (wave base unusable)` and skip (a)-(d).
+<!-- compliance:end -->
 
    **(a) Test the wave.** Spawn one Test agent on the integration worktree with the wave test plan — the TP lines of the `## Test Plan` section step 3(b) wrote to `{integration worktree root}/.devflow/docs/evidence-wave-{slug}.md`:
 
@@ -770,12 +842,12 @@ Agent(subagent_type="Test"):
 FILES_CHANGED: {the file list that diff printed}
 TEST_PLAN: {the TP lines of the wave evidence file's ## Test Plan section}
 WORKTREE_PATH: {integration worktree root}
-Cover every TEST_PLAN line on the integration branch as it stands. Report PASS or FAIL with evidence."
+Cover every TEST_PLAN line on the integration branch as it stands. Report your Status with evidence."
 ```
 
-   Nothing is fixed here, PASS or FAIL: the wave is done and its PR is open. Report the Test agent's Status.
+   Nothing is fixed here, whatever the Status: the wave is done and its PR is open. Report the Test agent's Status.
 
-   **(b) Claims.** Append its TP claims, PASS or FAIL alike, to the `## Claims` section of `"{integration worktree root}/.devflow/docs/evidence-wave-{slug}.md"` — the file's last section, created when absent. Append only: never edit or remove a claim. Each line is `/implement`'s TP claim, keyed to the 40-hex `HEAD:` the Test agent's report shows:
+   **(b) Claims.** Append its TP claims, whatever its Status, to the `## Claims` section of `"{integration worktree root}/.devflow/docs/evidence-wave-{slug}.md"` — the file's last section, created when absent. Append only: never edit or remove a claim. Each line is `/implement`'s TP claim, keyed to the 40-hex `HEAD:` the Test agent's report shows:
 
 ```
 - TP-<n> <PASS|FAIL|SKIP> sha:<head> by:test exit:<0-255>
@@ -789,8 +861,13 @@ Cover every TEST_PLAN line on the integration branch as it stands. Report PASS o
 git -C "{integration worktree root}" push origin HEAD; echo "exit=$?"
 ```
 
+<!-- compliance:on -->
    Any result but `exit=0`, a rejected non-fast-forward push included ⇒ record `TRACEABILITY: DEGRADED (evidence push failed)` and refresh anyway.
+<!-- compliance:off -->
+   Any result but `exit=0`, a rejected non-fast-forward push included ⇒ record `TRACEABILITY: DEGRADED (evidence push failed)` and verify anyway.
+<!-- compliance:end -->
 
+<!-- compliance:on -->
    **(d) Refresh.** Resolve the publication value for the integration worktree:
 
 {{pub.publication_gate()}}
@@ -802,6 +879,23 @@ cd "{integration worktree root}" && node "$HOME/.devflow/scripts/verify-evidence
 ```
 
    `{n}` is the number admitted above, and the publication value is `auto`, `full`, `off` or `stub`. `publish` decides what each publication value means for the evidence comment. Report its `## PR Evidence` block — its `EVIDENCE` line and its `**Body**:` / `**Comment**:` line — with any `TRACEABILITY: DEGRADED ({reason})` lines after it, or its `TRACEABILITY: DEGRADED (evidence unavailable)` line; empty stdout or any other exit ⇒ `TRACEABILITY: DEGRADED (evidence refresh failed)`. Whatever it returns, the run ends here.
+<!-- compliance:off -->
+   **(d) Verify locally.** Run the script inline, with no Git agent spawn. It reads the PR and the wave evidence file and writes the local result file; it writes nothing to GitHub:
+
+```bash
+cd "{integration worktree root}" && node "$HOME/.devflow/scripts/verify-evidence.cjs" verify --pr {n} --evidence ".devflow/docs/evidence-wave-{slug}.md" --comment-out ".devflow/docs/evidence-result-wave-{slug}.md"; echo "exit=$?"
+```
+
+   `{n}` is the number admitted above. Report its one `EVIDENCE` line, then `Evidence result: .devflow/docs/evidence-result-wave-{slug}.md (local; not posted)`. Empty stdout or any other exit ⇒ `TRACEABILITY: DEGRADED (evidence unavailable)`. It never blocks.
+
+   **(e) Readiness.** Run the local merge check, once, the same way:
+
+```bash
+cd "{integration worktree root}" && node "$HOME/.devflow/scripts/verify-evidence.cjs" readiness --pr {n} --require-non-author-approval {REQUIRE_NON_AUTHOR_APPROVAL} --evidence ".devflow/docs/evidence-wave-{slug}.md" --out ".devflow/docs/readiness-wave-{slug}.md"; echo "exit=$?"
+```
+
+   Pass `--require-non-author-approval` the value of `REQUIRE_NON_AUTHOR_APPROVAL`, `true` or `false`. Drop the `--evidence` pair when (a)-(d) were skipped. Its stdout is the `## Merge Readiness` block (exit 0), or the same block with `**Status**: DEGRADED ({reason})` and a `TRACEABILITY: DEGRADED ({reason})` line after it (exit 2). Report its verdict (READY, NOT_READY or DEGRADED) and its `- Test plan:` detail line, then `Readiness: .devflow/docs/readiness-wave-{slug}.md (local; not posted)`. Empty stdout or any other exit ⇒ `TRACEABILITY: DEGRADED (readiness unavailable)`. Whatever it returns, the run ends here.
+<!-- compliance:end -->
 
 ---
 

package/src/assets/commands/dynamic-tickets.mds

@@ -56,6 +56,9 @@ Before you write the workflow script:
 **Produces:** EVIDENCE_POLICY, ISSUE_REQUIRED, APPLY_CONVENTIONS, REQUIRE_NON_AUTHOR_APPROVAL
 
 {{evidence_policy()}}
+<!-- compliance:off -->
+When `EVIDENCE_POLICY` is `required`, record `TRACEABILITY: DEGRADED (compliance off on this machine; the repository requires evidence)` once, for the filing report.
+<!-- compliance:end -->
 
 {{docs_root()}}
 
@@ -223,7 +226,9 @@ Agent(subagent_type="Git"):
 "OPERATION: ensure-traceable-issue
 TASK_DESCRIPTION: {the ticket's title, or the tracking issue's H1}
 REQUIREMENTS: {the ticket's **Wave:** and **Depends on:** lines, then its ## Summary paragraph; or the tracking issue's ## Context}
+<!-- compliance:on -->
 PLAN_ARTIFACT_PATH: {the ticket or tracking-issue file path, relative to {worktree}}
+<!-- compliance:end -->
 WORKTREE_PATH: {worktree}"
 ```
 
@@ -231,9 +236,17 @@ WORKTREE_PATH: {worktree}"
    - `CREATED` or `ENRICHED`, with a reference that matches `^(#[1-9][0-9]{0,8}|[A-Z][A-Z0-9_]{0,9}-[1-9][0-9]{0,8})$` as a whole ⇒ insert `**Issue:** {ISSUE_REF}` with the Edit tool: in a ticket file as the line directly after its `**Depends on:**` line, in `tracking-issue.md` as the line directly after its H1. Change nothing else in the file.
    - A reference of any other shape ⇒ `TRACEABILITY: DEGRADED (issue reference "{ref}" does not match any tracker reference grammar)`, and no line.
    - `DEGRADED (rate limited)` ⇒ stop filing: this file and every file after it are reported `not filed`. Any other DEGRADED ⇒ that file gets no line; report it and go on to the next.
+<!-- compliance:on -->
 4. **Report** each file's `**Issue:**` reference, or `not filed` and why, with every `TRACEABILITY: DEGRADED` line step 2 and the spawns produced.
+<!-- compliance:off -->
+4. **Report** each file's `**Issue:**` reference, or `not filed` and why, with the compliance-off line of Pre-authoring step 0 and every `TRACEABILITY: DEGRADED` line step 2 and the spawns produced.
+<!-- compliance:end -->
 
+<!-- compliance:on -->
 `/devflow:dynamic-build` reads these lines: the tracking issue's for its wave report, and each ticket's as that ticket's own reference.
+<!-- compliance:off -->
+`/devflow:dynamic-build` reads these lines: the tracking issue's for its wave block's tracking line, and each ticket's as that ticket's own reference.
+<!-- compliance:end -->
 
 ---