devflow-kit 3.9.0 → 3.11.0

package/dist/curation-off/commands/implement.md

@@ -3,7 +3,7 @@ description: Execute a single task through implementation, quality gates, and PR
 ---
 # Implement Command
 
-Orchestrate a single task through implementation by spawning specialized agents.
+Orchestrate a single task by spawning agents.
 
 ## Usage
 
@@ -77,7 +77,7 @@ If `PR_DESCRIPTION_GUIDANCE` was not set above (non-plan paths: issue input or t
 
 **Empty input.** When `COMMAND_INPUT` is empty — a plan handoff arrives this way, with the plan already in the conversation — there is no argument to name the branch from, and the Git agent sees none of this conversation. Write the description yourself: one line, taken from the plan's title or, with no plan, from the conversation. Send it as the setup-task `TASK_DESCRIPTION` below.
 
-Spawn Git agent to set up the task:
+Spawn Git agent:
 
 ```
 Agent(subagent_type="Git"):
@@ -261,7 +261,7 @@ FEATURE_KNOWLEDGE: {feature_knowledge}
 
 **SEQUENTIAL_CODE_AGENTS**:
 
-Spawn Code agents one at a time. Each appends its own phase section to the handoff file, and the next reads only the section before it:
+Spawn Code agents one at a time:
 
 **Phase 1 Code agent:**
 ```
@@ -338,7 +338,7 @@ FEATURE_KNOWLEDGE: {feature_knowledge}
 - If the Read fails, or the file has no `## Phases` heading with the `| Phase | standard | lean |` header, or a row breaks its grammar, apply no row, keep `GATE_LEVEL` and say `level reference unreadable: no level rows applied`.
 - Validate, the CI gate, the evidence claims and the compliance directive run at every level. An enabled compliance lens keeps Harden.
 
-After the Code agent completes, spawn Polish agent to polish the code. The Phase 6 Validate covers its commits. `{branch_diff}` is the output of `git diff --name-only --diff-filter=d {BASE_REF}...HEAD`, run again at each spawn; a non-zero exit stops, and an empty list counts only on exit 0.
+After the Code agent completes, spawn Polish agent. `{branch_diff}` is the output of `git diff --name-only --diff-filter=d {BASE_REF}...HEAD`, run again at each spawn; a non-zero exit stops, and an empty list counts only on exit 0.
 
 ```
 Agent(subagent_type="Polish"):
@@ -354,7 +354,7 @@ Commit any improvements with a conventional-commit message."
 **Produces:** HARDEN_OUTPUT
 **Requires:** BASE_REF
 
-After Phase 3, spawn Harden agent as the quality gate:
+After Phase 3, spawn Harden agent:
 
 ```
 Agent(subagent_type="Harden"):
@@ -366,12 +366,14 @@ Evaluate 9 pillars, fix P0/P1 issues, report status"
 
 Harden agent reports `### Status: PASS | FIXED | BLOCKED`. **If BLOCKED:** report to user and halt. **If PASS or FIXED:** continue to Phase 5. A FIXED status commits fixes and starts no Validate of its own: the Phase 6 run covers them.
 
+Harden never reviews a deleted file or the old path of a rename; an empty list is no review, and Harden reports `no files reviewed`.
+
 ### Phase 5: Alignment Check
 
 **Produces:** ALIGNMENT_RESULT
 **Requires:** BASE_REF, EXECUTION_PLAN
 
-After Harden agent passes, spawn Evaluate agent to validate alignment. Evaluate agent receives `FEATURE_KNOWLEDGE_RULES` as acceptance context only; pattern and anti-pattern judgments belong to Harden agent:
+After Harden agent passes, spawn Evaluate agent:
 
 ```
 Agent(subagent_type="Evaluate"):
@@ -389,7 +391,7 @@ Validate alignment with request and plan. Report ALIGNED or MISALIGNED with deta
 1. Extract misalignment details from Evaluate agent output
 2. Increment `alignment_fix_count`
 3. If `alignment_fix_count <= 2`:
-   - Spawn Fix agent to fix misalignments:
+   - Spawn Fix agent:
    ```
    Agent(subagent_type="Fix"):
    "OPERATION: alignment-fix
@@ -407,7 +409,9 @@ Validate alignment with request and plan. Report ALIGNED or MISALIGNED with deta
 **Produces:** VALIDATION_RESULT, VALIDATED_HEAD
 **Requires:** BASE_REF, GATE_LEVEL
 
-Validate takes the one full-suite slot, after every commit it must cover: Code, Polish, Harden and the alignment fixes. After Evaluate agent passes, spawn Validate agent. `FILES_CHANGED` is the branch diff:
+Alignment-fix commits get no self-review: Phase 6 Validate and `/code-review` check them.
+
+After Evaluate agent passes, spawn Validate agent:
 
 ```
 Agent(subagent_type="Validate"):
@@ -419,10 +423,9 @@ Run build, typecheck, lint, test. Report pass/fail with failure details."
 ```
 
 **If FAIL:**
-1. Extract failure details from Validate agent output
-2. Increment `validation_retry_count`
-3. If `validation_retry_count <= 2`:
-   - Spawn Fix agent with fix context:
+1. Increment `validation_retry_count`
+2. If `validation_retry_count <= 2`:
+   - Spawn Fix agent:
    ```
    Agent(subagent_type="Fix"):
    "OPERATION: validation-fix
@@ -433,10 +436,14 @@ Run build, typecheck, lint, test. Report pass/fail with failure details."
    {COMPLIANCE_DIRECTIVE}"
    ```
    - Loop back to Phase 6 (re-validate at the new HEAD, full scope)
-4. If `validation_retry_count > 2`: Report failures to user and halt
+3. Else report failures to user and halt
+
+**If BLOCKED:** report its cause and log path, then halt.
 
 **If PASS:** append a `gate:validate` claim, run `git rev-parse HEAD` and record the result as `VALIDATED_HEAD`, then continue to Phase 7.
 
+Any other or missing Status: report and halt; never PASS.
+
 **Evidence claims** are lines appended to the `## Claims` section of `EVIDENCE_FILE` — the file's last section, created when absent. Append only: never edit or remove a claim; the last valid one per target wins. Each line takes exactly one of these shapes, where `<head>` is the 40-hex `HEAD:` the agent's report shows:
 
 ```
@@ -453,7 +460,7 @@ Run build, typecheck, lint, test. Report pass/fail with failure details."
 **Produces:** QA_RESULT
 **Requires:** BASE_REF, EXECUTION_PLAN, TEST_PLAN, VALIDATED_HEAD
 
-After Phase 6 passes, spawn Test agent for scenario-based acceptance testing:
+After Phase 6 passes, spawn Test agent:
 
 ```
 Agent(subagent_type="Test"):
@@ -462,18 +469,17 @@ EXECUTION_PLAN: {execution plan from Phase 1}
 FILES_CHANGED: {branch_diff}
 ACCEPTANCE_CRITERIA: {extracted criteria if available}
 TEST_PLAN: {the TP lines of the evidence file's ## Test Plan section, or (none)}
-Design and execute scenario-based acceptance tests. Report PASS or FAIL with evidence."
+Design and execute scenario-based acceptance tests. Report your Status with evidence."
 ```
 
-After every Test agent run — PASS or FAIL, first run or retry — append its TP claims (Phase 6's **Evidence claims**).
+After every Test agent run — whatever its Status, first run or retry — append its TP claims (Phase 6's **Evidence claims**).
 
-**If PASS:** Continue to Phase 8
+**If PASS** (first word of the Status): Continue to Phase 8
 
 **If FAIL:**
-1. Extract failure details from Test agent output
-2. Increment `qa_retry_count`
-3. If `qa_retry_count <= 2`:
-   - Spawn Fix agent to fix QA failures:
+1. Increment `qa_retry_count`
+2. If `qa_retry_count <= 2`:
+   - Spawn Fix agent:
    ```
    Agent(subagent_type="Fix"):
    "OPERATION: qa-fix
@@ -483,15 +489,17 @@ After every Test agent run — PASS or FAIL, first run or retry — append its T
    SCOPE: Fix only the listed failures, no other changes
    {COMPLIANCE_DIRECTIVE}"
    ```
-   - Loop back to Phase 7 (re-run Test agent). The fix is not validated here: Phase 8 covers it.
-4. If `qa_retry_count > 2`: Report QA failures to user for decision. The run stops at the report (Phase 12), so Phases 8 to 11 do not run.
+   - Loop back to Phase 7.
+3. If `qa_retry_count > 2`: Report QA failures to user for decision. The run stops at the report (Phase 12), so Phases 8 to 11 do not run.
+
+**If BLOCKED, or any other or missing Status:** report its cause and log path, and stop as in step 3; no Fix agent.
 
 ### Phase 8: Re-Validate (only if a qa-fix committed)
 
 **Produces:** REVALIDATION_RESULT
-**Requires:** QA_RESULT, VALIDATED_HEAD
+**Requires:** QA_RESULT, VALIDATED_HEAD, BASE_REF, GATE_LEVEL
 
-Run this phase only if a qa-fix committed (`git rev-parse HEAD` differs from `VALIDATED_HEAD`); otherwise skip it and continue to Phase 9. Spawn Validate agent over what changed since the Phase 6 run:
+Run this phase only if a qa-fix committed (`git rev-parse HEAD` differs from `VALIDATED_HEAD`); else skip to Phase 9. Spawn Validate agent:
 
 ```
 Agent(subagent_type="Validate"):
@@ -500,10 +508,16 @@ VALIDATION_SCOPE: changed-only
 Verify the qa-fix commits did not break anything."
 ```
 
+At `lean`, open the prompt with Phase 6's `GATE_LEVEL` and `BASE_SHA` lines; its `Lint pack:` line, or `Lint pack: UNVERIFIED` if it prints none, replaces Phase 6's in VALIDATION_RESULT.
+
 **If FAIL:** Report the failures to user and halt.
 
+**If BLOCKED:** as in Phase 6.
+
 **If PASS:** append a `gate:validate` claim (Phase 6's **Evidence claims**), then continue to Phase 9.
 
+Any other or missing Status: report and halt; never PASS.
+
 ### Phase 9: Open PR
 
 **Produces:** PR_NUMBER
@@ -546,13 +560,13 @@ git push origin HEAD; echo "exit=$?"
 `exit=0` continues to the gate. Any other result, a rejected non-fast-forward push included, records `TRACEABILITY: DEGRADED (ci push failed)` for the Phase 12 report, reports "CI status unknown — verify manually before merging" and proceeds to Phase 11 without waiting.
 
 <!-- PATTERN: ci-status-gate -->
-1. Wait: run `cd {worktree} && HEAD_SHA=$(git rev-parse HEAD) && node "$HOME/.devflow/scripts/ci-wait.cjs" --pr {PR_NUMBER} --head "$HEAD_SHA"` through the Bash tool with `timeout: 600000`. Each run is one wait of at most 570 seconds and prints one line, `CI <STATUS> pr=… head=… failing=… pending=… waited=…` (INDETERMINATE adds `reason=…`). A missing or unparseable line, a status outside the six below, or a non-zero exit is INDETERMINATE.
+1. Wait: run `cd {worktree} && HEAD_SHA=$(git rev-parse HEAD) && node "$HOME/.devflow/scripts/ci-wait.cjs" --pr {PR_NUMBER} --head "$HEAD_SHA"` through the Bash tool with `timeout: 600000`. Each run waits at most 570 seconds and prints one line, `CI <STATUS> pr=… head=… failing=… pending=… waited=…` (INDETERMINATE adds `reason=…`). A missing or unparseable line, an unknown status or a non-zero exit is INDETERMINATE.
 2. **If PASSING** → proceed to Phase 11.
 3. **If NO_PR or NO_CI** → skip: "No PR/CI configured, skipping CI validation." Proceed to Phase 11.
-4. **If PENDING** and fewer than 3 waits have run → wait again (step 1). After the third wait → report "CI still running — verify manually before merging" and proceed.
-5. **If INDETERMINATE** and fewer than 3 waits have run → wait again (step 1). After the third wait → report "CI status unknown — verify manually before merging" and proceed.
+4. **If PENDING** and fewer than 3 waits have run → wait again. Otherwise → report "CI still running — verify manually before merging" and proceed.
+5. **If INDETERMINATE** and fewer than 3 waits have run → wait again, unless `waited=570` with `reason=head-mismatch` or `no-workflow-check`. Otherwise → report "CI status unknown — verify manually before merging" and proceed.
 6. **If FAILING** and fewer than 2 fixes have run → report the failing checks from the line. Spawn `Agent(subagent_type="Fix")` whose prompt opens with `OPERATION: ci-fix`, with `COMPLIANCE_DIRECTIVE` (when it is not empty), `CI_FAILURES` and `PUSH: false`; `CI_FAILURES` holds the failing-check names from the line and nothing else, because the Fix agent fetches the full names and reads the logs itself and this command reads none. After a fix, push with the command above and, if a wait remains, wait again (step 1); a failed push records `TRACEABILITY: DEGRADED (ci push failed)`, reports "CI status unknown — verify manually before merging" and stops waiting. After the second fix still FAILING → report the failing checks and proceed.
-7. **Budget**: at most 3 waits and 2 fixes in all. When one is spent, report the current status and proceed.
+7. **Budget**: at most 3 waits and 2 fixes in all. When one is spent, report the status and proceed.
 <!-- /PATTERN: ci-status-gate -->
 
 ### Phase 11: Evidence
@@ -582,7 +596,7 @@ Drop the `--evidence` pair when that file does not exist or its path does not ma
 
 **Requires:** VALIDATION_RESULT, ALIGNMENT_RESULT, QA_RESULT, PR_NUMBER, EVIDENCE_RESULT, GATE_LEVEL
 
-Display completion summary with phase status, `Gate level: {GATE_LEVEL}` with any level note, Validate's `Lint pack:` line if any, PR info, and next steps.
+Display completion summary with phase status, `Gate level: {GATE_LEVEL}` with any level note, Harden's `no files reviewed` line if any, Validate's `Lint pack:` line if any, PR info, and next steps.
 
 Show the test plan's evidence from Phase 11: `Test plan: {VERIFIED-CI + ATTESTED-LOCAL}/{total} verified (VERIFIED-CI {n}, ATTESTED-LOCAL {n})`, read from the `EVIDENCE` line and never inferred, then its `**Body**:` / `**Comment**:` line verbatim. Without an `EVIDENCE` line, show `Test plan: evidence unavailable`; with no test plan, `Test plan: missing`.
 
@@ -647,9 +661,9 @@ When the Knowledge agent reports `KB_COMMIT: skipped (detached HEAD)`, the files
 ├─ Phase 6: Validate (the one full-suite slot)
 ├─ Phase 7: QA Testing
 ├─ Phase 8: Re-Validate (only if a qa-fix committed)
-├─ Phase 9: Open PR (every strategy, outside the strategy branches)
+├─ Phase 9: Open PR (every strategy)
 ├─ Phase 10: CI Status Gate (every strategy)
-├─ Phase 11: Evidence (every strategy)
+├─ Phase 11: Evidence
 ├─ Phase 12: Report
 │
 └─ Feature Knowledge Write-Back (Conditional)

package/dist/curation-off/commands/release.md

@@ -304,7 +304,7 @@ On completion:
 
 ## Error Handling
 
-- Validate agent fails (build/test): halt, report failures, do not proceed
+- Validate agent reports no PASS: halt, report failures, do not proceed
 - User declines release plan: halt gracefully
 - User halts at the traceability question: stop — nothing has been committed, tagged or published
 - Git agent reports DEGRADED while gathering, back-linking or associating: warn and continue — never halt the release

package/dist/curation-off/commands/resolve.md

@@ -29,7 +29,7 @@ Process issues from code review reports: triage every issue through the blast-ra
    - Additional filter: must have unresolved reviews (latest review directory has no `resolution-summary.md`)
 2. **If `--path` flag provided:** use only that worktree, skip discovery
    **`--path` validation**: Before proceeding, verify the path exists as a directory and appears in `git worktree list` output. If not: report error and stop.
-3. **If only 1 resolvable worktree** (the common case): proceed as single-worktree flow — zero behavior change
+3. **If only 1 resolvable worktree:** proceed as single-worktree flow
 4. **If multiple resolvable worktrees:** report "Found N worktrees with unresolved reviews: {list}" and proceed with multi-worktree flow
 
 #### Step 0b: Per-Worktree Pre-Flight (Git Agent)
@@ -59,7 +59,7 @@ PR_DESCRIPTION=$(gh pr view {pr_number} --json body --jq '.body' 2>/dev/null ||
 ```
 If `pr_number` is absent or the command fails, set `PR_DESCRIPTION` to `(none)`.
 
-**DIFF_FILES** is extracted from the `### Diff Scope` block in the Git agent validate-branch output. Set to empty string `""` if the block is absent (bug-analysis mode edge case).
+**DIFF_FILES** is the `### Diff Scope` block of the validate-branch output, or `""` when the block is absent.
 
 #### Step 0c: Target Review Directory
 
@@ -70,13 +70,13 @@ For each worktree:
 
 1. List directories in `{worktree}/.devflow/docs/reviews/{branch-slug}/`
 2. **If `--review {timestamp}` provided:** use that specific directory (not supported in multi-worktree mode)
-3. **Otherwise:** sort directories by name descending (timestamps are naturally sortable), scan the 10 most recent directories only. Select the first that contains `review-summary.md` (complete review)
+3. **Otherwise:** sort directories by name descending, scan the 10 most recent directories only. Select the first that contains `review-summary.md` (complete review)
 4. **If latest directory already has `resolution-summary.md`:** the review is resolved — check bug-analysis fallback (step 5b).
 5. **Legacy fallback:** if no timestamped subdirectories exist but flat `*.md` files do in `{worktree}/.devflow/docs/reviews/{branch-slug}/`, read them directly.
 
 **5b. Bug analysis fallback** — if no qualifying review directory found (no reviews exist, or all resolved):
 - List directories in `{worktree}/.devflow/docs/bug-analysis/{branch-slug}/`
-- Sort by name descending (timestamps are naturally sortable), scan the 10 most recent directories only. Select the latest that:
+- Sort by name descending, scan the 10 most recent directories only. Select the latest that:
   - Contains at least one focus report (`security.md`, `functional.md`, `integration.md`, or `usability.md`)
   - Does NOT contain a `resolution-summary.md`
 - If found: set `TARGET_DIR` to that path. Reviews take priority — bug analysis is only used when no qualifying review exists.
@@ -196,9 +196,9 @@ Read review reports from `{TARGET_DIR}/*.md` and extract:
 
 **Exclude from issue extraction:**
 - `review-summary.md` (Synthesize agent output, not individual findings)
-- `resolution-summary.md` (if it exists from a previous partial run)
+- `resolution-summary.md` (from a previous partial run)
 - `bug-analysis-summary.md` (Synthesize agent output for bug-analysis runs)
-- `static-findings.md` (raw static analysis tool output, not individual findings)
+- `static-findings.md` (raw tool output, not individual findings)
 
 **Include:** ALL issues from all categories and severities, including Suggestions.
 
@@ -252,7 +252,7 @@ Triage every issue: collapse duplicates first, then apply the blast-radius dispo
 Follow devflow:apply-feature-knowledge for FEATURE_KNOWLEDGE."
 ```
 
-Wait for Triage agent to complete before proceeding. Parse verdict ledger from Triage agent output:
+When the Triage agent completes, parse its verdict ledger:
 - **ESCALATED**: Security issues requiring human escalation
 - **FIX_NOW**: Valid issues assigned to Code agents (with risk tier: Standard | Careful | `Standard, prose only: edit text alone; agent instructions count as logic; if this issue needs a logic change, leave it unedited and name it`; any other value counts as Careful). SCOPE gives one `{id}: {tier}` line per issue.
 - **FALSE_POSITIVE**: Issues the Review agent got wrong (with cited evidence)
@@ -278,7 +278,7 @@ A ledger `### Summary` line `- Tiers: not applied (…)` is the level note.
 
 If FIX_NOW list is empty: skip to Phase 5, then run Phases 9, 9b, 9c and 10.
 
-Otherwise, batch FIX_NOW issues for Code agent execution. **DUPLICATE issues are never dispatched** — they inherit the primary's outcome:
+Otherwise, batch FIX_NOW issues. **DUPLICATE issues are never dispatched** — they inherit the primary's outcome:
 - **Same-file issues** → one batch (one Code agent per file)
 - **Distinct-file issues** → parallel Code agents
 - **Max 5 issues per batch** — chunk large sets
@@ -317,7 +317,7 @@ Collect from each Code agent:
 **Produces:** RESOLUTION_FILE (early write for compaction safety)
 **Requires:** TRIAGE_RESULTS, CODE_AGENT_RESULTS, TARGET_DIR, TARGET_DIR_REL, BRANCH_INFO, RESOLUTION_TS, GATE_LEVEL
 
-**Immediately write `resolution-summary.md`** to `{TARGET_DIR}` using the Write tool.
+**Immediately write `resolution-summary.md`** to `{TARGET_DIR}`.
 
 Set `Tracked` for FIX_SEPARATE and TECH_DEBT items to `(pending)` — to be backfilled after Phase 9 manage-debt (or `TRACEABILITY: DEGRADED ({reason})` if manage-debt degrades).
 
@@ -332,7 +332,7 @@ Use the template from the Output Artifact section below. Put text not for public
 **Produces:** POLISH_RESULT
 **Requires:** CODE_AGENT_RESULTS, GATE_LEVEL
 
-If any fixes were made, spawn Polish agent to refine the changed code:
+If any fixes were made, spawn Polish agent:
 
 ```
 Agent(subagent_type="Polish", run_in_background=false):
@@ -345,7 +345,7 @@ Commit any improvements with a conventional-commit message."
 
 ### Phase 7: Verification Gate
 
-**Produces:** VERIFICATION_STATUS
+**Produces:** VERIFICATION_STATUS, VERIFICATION_BLOCKER
 **Requires:** CODE_AGENT_RESULTS, BRANCH_INFO
 
 If no fixes were made (CODE_AGENT_RESULTS contains 0 commits) → set VERIFICATION_STATUS = SKIPPED, skip: "No fixes applied — skipping Verification Gate."
@@ -362,10 +362,9 @@ Run build, typecheck, lint, test. Report pass/fail with failure details."
 `validation_retry_count = 0`
 
 **If FAIL:**
-1. Extract failure details from Validate agent output
-2. Increment `validation_retry_count`
-3. If `validation_retry_count <= 2`:
-   - Spawn Fix agent with fix context:
+1. Increment `validation_retry_count`
+2. If `validation_retry_count <= 2`:
+   - Spawn Fix agent:
    ```
    Agent(subagent_type="Fix"):
    "OPERATION: validation-fix
@@ -377,12 +376,16 @@ Run build, typecheck, lint, test. Report pass/fail with failure details."
    {COMPLIANCE_DIRECTIVE}"
    ```
    - Loop back to re-validate
-4. If `validation_retry_count > 2`: set VERIFICATION_STATUS = FAILED and exit the validation loop — record a blocking callout in the `## Verification` section (never a silent pass).
+3. If `validation_retry_count > 2`: set VERIFICATION_STATUS = FAILED, Final gate `FAILED after N attempts`; exit the validation loop.
 
-**If PASS:** set VERIFICATION_STATUS = PASS and exit the validation loop.
+**If BLOCKED:** FAILED, Final gate `FAILED (Validate blocked)`, no Fix agent, exit the loop; VERIFICATION_BLOCKER = its cause and log path, for the Phase 10 report only, never resolution-summary.md.
+
+**If PASS:** set VERIFICATION_STATUS = PASS, Final gate `PASS`; exit the validation loop.
+
+Any other or missing Status: FAILED, Final gate `FAILED (no Validate status)`, exit the loop; never PASS.
 
 Record `## Verification` outcome in resolution-summary.md (runs unconditionally after the validation loop exits):
-- Rewrite the `## Verification` section with | Command | Result | table + `Final gate: PASS | FAILED after N attempts`
+- Rewrite the `## Verification` section with | Command | Result | table + `Final gate: {value above}`; a FAILED gate gets a blocking callout (never a silent pass)
 
 Push all commits to remote once (Code and Fix agents ran with PUSH: false — runs whether the gate PASSED or FAILED, so the branch is always visible before Phase 9 or CI runs):
 ```bash
@@ -398,9 +401,7 @@ git -C {worktree} push
 **Produces:** CI_STATUS
 **Requires:** CODE_AGENT_RESULTS, VERIFICATION_STATUS, BRANCH_INFO
 
-If no issues were fixed (CODE_AGENT_RESULTS contains 0 fixes) → skip: "No fixes applied — skipping CI validation."
-
-If Verification Gate FAILED → skip CI gate (validation failures already reported).
+If VERIFICATION_STATUS is not PASS → skip CI gate.
 
 If `fork_no_push` is set → skip: "Cannot push to fork — skipping CI validation."
 
@@ -414,16 +415,16 @@ Otherwise, for each worktree with fixes:
 git -C {worktree} push; echo "exit=$?"
 ```
 
-Phase 7 has pushed already, so this is a no-op unless the head moved since. `exit=0` continues to the gate. Any other result records `TRACEABILITY: DEGRADED (ci push failed)`, reports "CI status unknown — verify manually before merging" and skips the wait for this worktree. Pass `WORKTREE_PATH: {worktree_path}` on the fix spawn below.
+`exit=0` continues to the gate. Any other result records `TRACEABILITY: DEGRADED (ci push failed)`, reports "CI status unknown — verify manually before merging" and skips the wait for this worktree. Pass `WORKTREE_PATH: {worktree_path}` on the fix spawn below.
 
 <!-- PATTERN: ci-status-gate -->
-1. Wait: run `cd {worktree} && HEAD_SHA=$(git rev-parse HEAD) && node "$HOME/.devflow/scripts/ci-wait.cjs" --pr {PR_NUMBER} --head "$HEAD_SHA"` through the Bash tool with `timeout: 600000`. Each run is one wait of at most 570 seconds and prints one line, `CI <STATUS> pr=… head=… failing=… pending=… waited=…` (INDETERMINATE adds `reason=…`). A missing or unparseable line, a status outside the six below, or a non-zero exit is INDETERMINATE.
+1. Wait: run `cd {worktree} && HEAD_SHA=$(git rev-parse HEAD) && node "$HOME/.devflow/scripts/ci-wait.cjs" --pr {PR_NUMBER} --head "$HEAD_SHA"` through the Bash tool with `timeout: 600000`. Each run waits at most 570 seconds and prints one line, `CI <STATUS> pr=… head=… failing=… pending=… waited=…` (INDETERMINATE adds `reason=…`). A missing or unparseable line, an unknown status or a non-zero exit is INDETERMINATE.
 2. **If PASSING** → proceed to next phase.
 3. **If NO_PR or NO_CI** → skip: "No PR/CI configured, skipping CI validation." Proceed to next phase.
-4. **If PENDING** and fewer than 3 waits have run → wait again (step 1). After the third wait → report "CI still running — verify manually before merging" and proceed.
-5. **If INDETERMINATE** and fewer than 3 waits have run → wait again (step 1). After the third wait → report "CI status unknown — verify manually before merging" and proceed.
-6. **If FAILING** and fewer than 2 fixes have run → report the failing checks from the line. Spawn `Agent(subagent_type="Fix")` whose prompt opens with `OPERATION: ci-fix`, with `COMPLIANCE_DIRECTIVE` (when it is not empty), `CI_FAILURES` and `PUSH: false`; `CI_FAILURES` holds the failing-check names from the line and nothing else, because the Fix agent fetches the full names and reads the logs itself and this command reads none. After a fix, push with the command above and, if a wait remains, wait again (step 1); a failed push records `TRACEABILITY: DEGRADED (ci push failed)`, reports "CI status unknown — verify manually before merging" and stops waiting. After the second fix still FAILING → report the failing checks and proceed.
-7. **Budget**: at most 3 waits and 2 fixes in all, per worktree. When one is spent, report the current status and proceed.
+4. **If PENDING** and fewer than 3 waits have run → wait again. Otherwise → report "CI still running — verify manually before merging" and proceed.
+5. **If INDETERMINATE** and fewer than 3 waits have run → wait again, unless `waited=570` with `reason=head-mismatch` or `no-workflow-check`. Otherwise → report "CI status unknown — verify manually before merging" and proceed.
+6. **If FAILING** and fewer than 2 fixes have run → report the failing checks from the line. Spawn `Agent(subagent_type="Fix")` whose prompt opens with `OPERATION: ci-fix`, with `COMPLIANCE_DIRECTIVE` (when it is not empty), `CI_FAILURES` and `PUSH: false`; `CI_FAILURES` holds only the failing-check names from the line: the Fix agent fetches the full names and reads the logs itself. After a fix, push with the command above and, if a wait remains, wait again (step 1); a failed push records `TRACEABILITY: DEGRADED (ci push failed)`, reports "CI status unknown — verify manually before merging" and stops waiting. After the second fix still FAILING → report the failing checks and proceed.
+7. **Budget**: at most 3 waits and 2 fixes in all, per worktree. When one is spent, report the status and proceed.
 <!-- /PATTERN: ci-status-gate -->
 
 ### Phase 9: Manage Debt (Sequential)
@@ -482,6 +483,8 @@ Append one claim per `### Test Plan Evidence` row whose TP is in the stale file
 
 The line ends at `by:test` when the row's Exit is not a number from 0 to 255; append nothing when the report's `HEAD:` is not one 40-hex SHA. Record `Test plan: {n} stale, {m} re-verified` under `## Verification` in resolution-summary.md now, before 9b-2 posts it, and set `STALE_REVERIFICATION` to that line.
 
+A Test Status whose first word is not PASS or FAIL still gets its claims, but `Test plan: DEGRADED (Test run blocked)` replaces that line. `{m}` counts PASS rows only.
+
 **Step 9b-1: Resolve external threads**
 
 Run this step only when `EVIDENCE_POLICY` is `required` and THREAD_MAP is non-empty; otherwise skip it and record `THREAD_RESOLUTION_RESULT` as `SKIPPED ({reason})`.
@@ -561,7 +564,7 @@ If the script prints a `TRACEABILITY: DEGRADED` line: warn, proceed to Phase 10.
 
 ### Phase 10: Report
 
-**Requires:** BRANCH_INFO, TARGET_DIR, PR_COMMENT, THREAD_RESOLUTION_RESULT, GATE_LEVEL
+**Requires:** BRANCH_INFO, TARGET_DIR, PR_COMMENT, THREAD_RESOLUTION_RESULT, GATE_LEVEL, VERIFICATION_BLOCKER
 
 The resolution summary was already written to `{TARGET_DIR}/resolution-summary.md` in Phase 5 (updated by Phase 7, Phase 9 and Phase 9b-1). Display results to the user:
 
@@ -585,7 +588,8 @@ The resolution summary was already written to `{TARGET_DIR}/resolution-summary.m
 | Duplicates Collapsed | {n} |
 
 ### Verification
-Final gate: {PASS | FAILED after N attempts}
+Final gate: {the value Phase 7 recorded}
+{VERIFICATION_BLOCKER, if any}
 
 ### Commits Created
 - {sha} {message}
@@ -707,7 +711,7 @@ When the Knowledge agent reports `KB_COMMIT: skipped (detached HEAD)`, the files
 
 ## Output Artifact
 
-Written in Phase 5 (Collect Results) to `{TARGET_DIR}/resolution-summary.md`:
+Written in Phase 5 to `{TARGET_DIR}/resolution-summary.md`:
 
 ```markdown
 # Resolution Summary
@@ -739,7 +743,7 @@ _(Note: `Deferred` = `## Fix Separately` count + `## Deferred to Tech Debt` coun
 
 Regression tests added: {n}
 
-Final gate: PASS | FAILED after {n} attempts
+Final gate: {the value Phase 7 recorded}
 
 ## Fixed Issues
 | Issue | File:Line | Commit |

package/dist/curation-off/commands/self-review.md

@@ -131,7 +131,7 @@ Follow devflow:apply-feature-knowledge for FEATURE_KNOWLEDGE. Skip if (none)."
 
 If STATUS is BLOCKED, skip this phase: the report (Phase 4) names the blocker.
 
-Run this phase only if HEAD moved — `git rev-parse HEAD` differs from `HEAD_BEFORE`, meaning Polish or Harden committed (Polish alone counts, whatever Harden's STATUS is). Otherwise skip it. Its scope is changed-only over what the two agents changed:
+Run this phase only if HEAD moved — `git rev-parse HEAD` differs from `HEAD_BEFORE`, meaning Polish or Harden committed (Polish alone counts, whatever Harden's STATUS is). Otherwise skip it.
 
 Agent(subagent_type="Validate", run_in_background=false):
 "FILES_CHANGED: {output of `git diff --name-only HEAD_BEFORE..HEAD`}
@@ -140,6 +140,7 @@ Run build, typecheck, lint, test on modified files"
 
 **If FAIL:** Report validation failures to user and halt
 **If PASS:** Continue to report
+**Any other or missing Status** (BLOCKED included): report the status or "none", its cause and log path if any, then halt.
 
 ### Phase 4: Report
 
@@ -230,7 +231,7 @@ When the Knowledge agent reports `KB_COMMIT: skipped (detached HEAD)`, the files
 │  └─ 9-pillar quality gate (may fix and commit)
 │
 ├─ Phase 3: Validate agent (conditional)
-│  └─ If HEAD moved since HEAD_BEFORE (Polish or Harden committed), changed-only Validate over HEAD_BEFORE..HEAD
+│  └─ If HEAD moved: changed-only over HEAD_BEFORE..HEAD
 │
 └─ Phase 4: Report
    └─ Display summary with pillar status
@@ -242,13 +243,13 @@ When the Knowledge agent reports `KB_COMMIT: skipped (detached HEAD)`, the files
 | No changes | Report "No changes to review" and exit |
 | Polish agent finds nothing | Normal, continue to Harden agent |
 | Harden agent BLOCKED | Report blocking issue, halt workflow |
-| Validation fails | Report failures, halt (don't create broken state) |
+| Validation fails | Report failures, halt |
+| Validate not PASS or FAIL | Report status and cause, halt |
 | Not in git repo | Report error, suggest running in git repo |
 
 ## Principles
 
 1. **Orchestration only** - Command spawns agents, doesn't do the work
-2. **Sequential execution** - Polish agent must complete before Harden agent
-3. **Validation gate** - If Polish agent or Harden agent committed, the changes must pass validation
-4. **Honest reporting** - Display actual agent outputs
-5. **Fail fast** - Stop on BLOCKED or validation failure
+2. **Validation gate** - If Polish agent or Harden agent committed, the changes must pass validation
+3. **Honest reporting** - Display actual agent outputs
+4. **Fail fast** - Stop on BLOCKED or a Validate status other than PASS

package/dist/skills/git/references/pr/resolve-review-threads.md

@@ -41,7 +41,7 @@ Each `THREAD_MAP` entry carries one verdict:
 
 ### Process
 
-Rate limits: this op fans out, so read the remaining-budget rungs in `references/github-api.md` before the first iteration.
+Rate limits: this op fans out, so read the remaining-budget rungs in `references/github-api.md` before the first iteration. The thread-reply and `resolveReviewThread` recipes are in `references/github-posting.md`.
 
 For each `ext-{N}` in THREAD_MAP (sequentially, ≤50, 1s between operations). `fetch-review-threads`
 returns up to 100 threads, so a busy PR can exceed this bound: process the first 50 in THREAD_MAP

package/dist/targets/claude-code/behavior-install.js

@@ -22,6 +22,7 @@
 import { promises as fs } from 'fs';
 import * as path from 'path';
 import { installRuleFile } from './installer.js';
+import { newLinkReport, refuseUnrealFolder, warnLinkReport } from './linked-folder.js';
 // ── Types ──────────────────────────────────────────────────────────────────
 export const BEHAVIOR_RULE_NAME = 'behavior';
 // ── Path helpers ───────────────────────────────────────────────────────────
@@ -47,46 +48,59 @@ async function pathExists(p) {
  *   enabled + !rulesEnabled  → rule file removed
  *   !enabled                 → rule file removed
  *
+ * `rules/devflow` that is a link, or not a folder, is refused: the rule is neither written nor
+ * removed there, and the folder is named in `refusedFolders` and in a warning. A rule file that is a
+ * link is replaced by a real file, or unlinked on removal, and never written through.
+ *
  * Never throws. A relative `claudeDir` is refused with a warning rather than resolved
  * against the working directory, because the removal arm deletes a path.
  */
 export async function convergeBehaviorRule(opts) {
     const { claudeDir, devflowDir, enabled, rulesEnabled, warn } = opts;
+    const links = newLinkReport();
+    const finish = (state) => {
+        warnLinkReport(links, warn);
+        return { ...state, replacedLinks: links.replacedLinks, refusedFolders: links.refusedFolders };
+    };
     if (!path.isAbsolute(claudeDir)) {
         warn(`behavior: claudeDir is not an absolute path ("${claudeDir}") — skipping convergence`);
-        return { installed: false, removed: false, converged: false };
+        return finish({ installed: false, removed: false, converged: false });
     }
     const target = behaviorRulePath(claudeDir);
+    // A link at the folder sends the write and the removal into another place, so the folder is proven first.
+    if (await refuseUnrealFolder(links, path.dirname(target))) {
+        return finish({ installed: await pathExists(target), removed: false, converged: false });
+    }
     if (enabled && rulesEnabled) {
         try {
             await fs.mkdir(path.dirname(target), { recursive: true });
-            const outcome = await installRuleFile(BEHAVIOR_RULE_NAME, devflowDir, path.dirname(target));
+            const outcome = await installRuleFile(BEHAVIOR_RULE_NAME, devflowDir, path.dirname(target), links);
             if (outcome === 'skipped') {
                 warn('behavior: rule install failed — the file could not be copied');
-                return { installed: false, removed: false, converged: false };
+                return finish({ installed: false, removed: false, converged: false });
             }
             if (outcome === 'source-invalid-shadow:empty-shadow-file' || outcome === 'source-invalid-shadow:not-a-file') {
                 warn("behavior: the shadow is invalid — Devflow's version was installed");
-                return { installed: true, removed: false, converged: false };
+                return finish({ installed: true, removed: false, converged: false });
             }
-            return { installed: true, removed: false, converged: true };
+            return finish({ installed: true, removed: false, converged: true });
         }
         catch (err) {
             warn(`behavior: rule install failed — ${String(err)}`);
-            return { installed: false, removed: false, converged: false };
+            return finish({ installed: false, removed: false, converged: false });
         }
     }
     // Off, or rules off: no rule. Probe first so the caller can report a removal;
     // absence is already the desired end state.
     if (!(await pathExists(target)))
-        return { installed: false, removed: false, converged: true };
+        return finish({ installed: false, removed: false, converged: true });
     try {
         await fs.rm(target, { force: true });
-        return { installed: false, removed: true, converged: true };
+        return finish({ installed: false, removed: true, converged: true });
     }
     catch (err) {
         warn(`behavior: failed to remove rule — ${String(err)}`);
-        return { installed: true, removed: false, converged: false };
+        return finish({ installed: true, removed: false, converged: false });
     }
 }
 // ── Manifest-slice wrapper ─────────────────────────────────────────────────