devlyn-cli 2.7.0 → 2.8.0

package/config/skills/_shared/verify-merge-findings.py

@@ -119,13 +119,19 @@ def finding_rank(finding: dict[str, Any]) -> int:
     return 0
 
 
-def read_findings(devlyn: pathlib.Path) -> tuple[list[dict[str, Any]], dict[str, str]]:
+def read_findings(devlyn: pathlib.Path) -> tuple[list[dict[str, Any]], dict[str, str | None]]:
     findings: list[dict[str, Any]] = []
-    source_verdicts = {source: "PASS" for source, _ in SOURCE_FILES}
+    source_verdicts: dict[str, str | None] = {source: "PASS" for source, _ in SOURCE_FILES}
+    # A verdict must come from a judge that ran: pair_judge stays null until
+    # spawn evidence exists (a pair findings file or pair stdout). verify.md's
+    # pair contract records null when no second agent is spawned.
+    source_verdicts["pair_judge"] = None
     for source, name in SOURCE_FILES:
         path = devlyn / name
         if not path.is_file():
             continue
+        if source_verdicts[source] is None:
+            source_verdicts[source] = "PASS"
         with path.open(encoding="utf-8") as handle:
             for line_no, line in enumerate(handle, 1):
                 raw = line.strip()
@@ -401,7 +407,7 @@ def is_command_like_backtick(value: str) -> bool:
 
 def state_pair_trigger_reasons(
     devlyn: pathlib.Path,
-    source_verdicts: dict[str, str],
+    source_verdicts: dict[str, str | None],
 ) -> list[str]:
     state_path = devlyn / "pipeline.state.json"
     if not state_path.is_file():
@@ -450,7 +456,7 @@ def state_pair_trigger_reasons(
 
 def pair_trigger_missing_contract_violation(
     devlyn: pathlib.Path,
-    source_verdicts: dict[str, str],
+    source_verdicts: dict[str, str | None],
 ) -> dict[str, Any] | None:
     if rank(source_verdicts.get("mechanical")) >= 2 or rank(source_verdicts.get("judge")) >= 2:
         return None
@@ -469,7 +475,7 @@ def pair_trigger_missing_contract_violation(
 
 def pair_trigger_skip_contract_violation(
     devlyn: pathlib.Path,
-    source_verdicts: dict[str, str],
+    source_verdicts: dict[str, str | None],
 ) -> dict[str, Any] | None:
     state_path = devlyn / "pipeline.state.json"
     if not state_path.is_file():
@@ -565,7 +571,7 @@ def pair_trigger_skip_contract_violation(
 
 def pair_trigger_reason_completeness_violation(
     devlyn: pathlib.Path,
-    source_verdicts: dict[str, str],
+    source_verdicts: dict[str, str | None],
 ) -> dict[str, Any] | None:
     if rank(source_verdicts.get("mechanical")) >= 2 or rank(source_verdicts.get("judge")) >= 2:
         return None
@@ -623,9 +629,12 @@ def pair_blocker(id_: str, message: str, file_: str | None = None) -> dict[str,
 
 def detect_pair_stdout_contract_violations(
     devlyn: pathlib.Path,
-    source_verdicts: dict[str, str],
+    source_verdicts: dict[str, str | None],
 ) -> list[dict[str, Any]]:
-    stdout_path = devlyn / "codex-judge.stdout"
+    # *-judge.stdout: any engine's pair-judge capture (codex-judge.stdout,
+    # claude-judge.stdout — adapters/claude.md ## Invocation). The emission
+    # contract is engine-neutral.
+    stdout_paths = sorted(devlyn.glob("*-judge.stdout"))
     flag_violation = pair_flag_contract_violation(devlyn)
     if flag_violation is not None:
         source_verdicts["pair_judge"] = "BLOCKED"
@@ -689,73 +698,76 @@ def detect_pair_stdout_contract_violations(
         ]
     if has_pair_findings(devlyn):
         return []
-    if not stdout_path.is_file():
+    if not stdout_paths:
         if required:
             source_verdicts["pair_judge"] = "BLOCKED"
             return [
                 pair_blocker(
                     "verify-pair-required-output-missing",
-                    "Pair-mode was required, but Codex pair-JUDGE produced no stdout or canonical findings file.",
-                    "codex-judge.stdout",
+                    "Pair-mode was required, but the pair-JUDGE produced no stdout or canonical findings file.",
+                    "verify.pair.findings.jsonl",
                 )
             ]
         return []
-    raw_text = stdout_path.read_text(encoding="utf-8")
-    if not raw_text.strip():
-        source_verdicts["pair_judge"] = "BLOCKED"
-        return [
-            pair_blocker(
-                "verify-pair-empty-output",
-                "Codex pair-JUDGE stdout was empty; the bounded contract requires a JSONL finding or PASS line.",
-                "codex-judge.stdout",
-            )
-        ]
-    has_jsonl_finding = False
-    has_nonpass_summary = False
-    for line in raw_text.splitlines():
-        raw = line.strip()
-        if not raw:
-            continue
-        if raw.startswith("# SUMMARY "):
+    if source_verdicts["pair_judge"] is None:
+        source_verdicts["pair_judge"] = "PASS"
+    for stdout_path in stdout_paths:
+        raw_text = stdout_path.read_text(encoding="utf-8")
+        if not raw_text.strip():
+            source_verdicts["pair_judge"] = "BLOCKED"
+            return [
+                pair_blocker(
+                    "verify-pair-empty-output",
+                    f"pair-JUDGE stdout {stdout_path.name} was empty; the bounded contract requires a JSONL finding or PASS line.",
+                    stdout_path.name,
+                )
+            ]
+        has_jsonl_finding = False
+        has_nonpass_summary = False
+        for line in raw_text.splitlines():
+            raw = line.strip()
+            if not raw:
+                continue
+            if raw.startswith("# SUMMARY "):
+                try:
+                    summary = loads_strict_json(raw.removeprefix("# SUMMARY ").strip())
+                except ValueError:
+                    continue
+                if summary.get("verdict") in {"NEEDS_WORK", "FAIL", "BLOCKED"}:
+                    has_nonpass_summary = True
+                continue
+            if raw.startswith("#"):
+                continue
             try:
-                summary = loads_strict_json(raw.removeprefix("# SUMMARY ").strip())
+                item = loads_strict_json(raw)
             except ValueError:
                 continue
-            if summary.get("verdict") in {"NEEDS_WORK", "FAIL", "BLOCKED"}:
-                has_nonpass_summary = True
-            continue
-        if raw.startswith("#"):
-            continue
-        try:
-            item = loads_strict_json(raw)
-        except ValueError:
-            continue
-        if isinstance(item, dict) and str(item.get("severity") or "").upper() in {
-            "CRITICAL",
-            "HIGH",
-            "MEDIUM",
-            "LOW",
-        }:
-            has_jsonl_finding = True
-    if not has_jsonl_finding and not has_nonpass_summary:
-        return []
-    source_verdicts["pair_judge"] = "BLOCKED"
-    return [
-        pair_blocker(
-            "verify-pair-emission-contract-violated",
-            (
-                "Codex pair-JUDGE stdout contained findings or a non-PASS summary, "
-                "but the canonical pair findings JSONL file was empty."
-            ),
-            "codex-judge.stdout",
-        )
-    ]
+            if isinstance(item, dict) and str(item.get("severity") or "").upper() in {
+                "CRITICAL",
+                "HIGH",
+                "MEDIUM",
+                "LOW",
+            }:
+                has_jsonl_finding = True
+        if has_jsonl_finding or has_nonpass_summary:
+            source_verdicts["pair_judge"] = "BLOCKED"
+            return [
+                pair_blocker(
+                    "verify-pair-emission-contract-violated",
+                    (
+                        f"pair-JUDGE stdout {stdout_path.name} contained findings or a non-PASS "
+                        "summary, but the canonical pair findings JSONL file was empty."
+                    ),
+                    stdout_path.name,
+                )
+            ]
+    return []
 
 
 def write_outputs(
     devlyn: pathlib.Path,
     findings: list[dict[str, Any]],
-    source_verdicts: dict[str, str],
+    source_verdicts: dict[str, str | None],
 ) -> dict[str, Any]:
     merged_path = devlyn / "verify-merged.findings.jsonl"
     summary_path = devlyn / "verify-merge.summary.json"
@@ -786,7 +798,18 @@ def write_state(devlyn: pathlib.Path, summary: dict[str, Any]) -> None:
         verify = {}
         phases["verify"] = verify
     verify["verdict"] = summary["verdict"]
-    sub = verify.setdefault("sub_verdicts", {})
+    sub = verify.get("sub_verdicts")
+    if sub is None:
+        # spawn (state-phase-write.py) always writes sub_verdicts: null as
+        # part of the per-round reset contract (state-schema.md#write-protocol)
+        # — legal, expected state before this function populates it.
+        # setdefault() would not replace an existing null, only an absent key.
+        sub = {}
+        verify["sub_verdicts"] = sub
+    elif not isinstance(sub, dict):
+        raise SystemExit(
+            f"error: phases.verify.sub_verdicts must be null or an object, got {type(sub).__name__}"
+        )
     for source, source_verdict in summary["source_verdicts"].items():
         if source in {"mechanical", "judge", "pair_judge"}:
             sub[source] = source_verdict
@@ -801,6 +824,68 @@ def write_state(devlyn: pathlib.Path, summary: dict[str, Any]) -> None:
 def self_test() -> int:
     with tempfile.TemporaryDirectory() as tmp:
         devlyn = pathlib.Path(tmp)
+
+        # state-phase-write.py's spawn always writes sub_verdicts: null (the
+        # per-round reset contract, state-schema.md#write-protocol) — this is
+        # the real shape write_state() sees on every VERIFY completion, not
+        # the pre-populated {} the other scenarios below seed for brevity.
+        (devlyn / "pipeline.state.json").write_text(
+            json.dumps({"phases": {"verify": {"verdict": None, "sub_verdicts": None}}}),
+            encoding="utf-8",
+        )
+        (devlyn / "verify.findings.jsonl").write_text("", encoding="utf-8")
+        findings, source_verdicts = read_findings(devlyn)
+        summary = write_outputs(devlyn, findings, source_verdicts)
+        write_state(devlyn, summary)
+        state = loads_strict_json((devlyn / "pipeline.state.json").read_text(encoding="utf-8"))
+        assert summary["verdict"] == "PASS", summary
+        assert state["phases"]["verify"]["sub_verdicts"] == {
+            "mechanical": "PASS", "judge": "PASS", "pair_judge": None,
+        }, state
+
+        # 2026-07-04 field bug (iter-0060 G1): an AUTO pair trigger skipped on
+        # OTHER-engine unavailability spawns no second judge — pair_judge must
+        # be recorded null, never a synthesized PASS.
+        (devlyn / "pipeline.state.json").write_text(
+            json.dumps({
+                "mode": "spec",
+                "phases": {
+                    "verify": {
+                        "verdict": None,
+                        "sub_verdicts": None,
+                        "pair_trigger": {
+                            "eligible": False,
+                            "reasons": [],
+                            "skipped_reason": "auto_pair_other_engine_unavailable",
+                        },
+                    }
+                },
+            }),
+            encoding="utf-8",
+        )
+        findings, source_verdicts = read_findings(devlyn)
+        summary = write_outputs(devlyn, findings, source_verdicts)
+        write_state(devlyn, summary)
+        state = loads_strict_json((devlyn / "pipeline.state.json").read_text(encoding="utf-8"))
+        assert summary["verdict"] == "PASS", summary
+        assert summary["source_verdicts"]["pair_judge"] is None, summary
+        assert state["phases"]["verify"]["sub_verdicts"]["pair_judge"] is None, state
+
+        # A non-null, non-dict sub_verdicts is corrupted state, not a legal
+        # placeholder — write_state() must fail loud, not silently coerce it.
+        (devlyn / "pipeline.state.json").write_text(
+            json.dumps({"phases": {"verify": {"verdict": None, "sub_verdicts": "corrupt"}}}),
+            encoding="utf-8",
+        )
+        findings, source_verdicts = read_findings(devlyn)
+        summary = write_outputs(devlyn, findings, source_verdicts)
+        try:
+            write_state(devlyn, summary)
+        except SystemExit as e:
+            assert "sub_verdicts must be null or an object" in str(e), e
+        else:
+            raise AssertionError("write_state() must reject non-dict, non-null sub_verdicts")
+
         (devlyn / "pipeline.state.json").write_text(
             json.dumps({
                 "phases": {
@@ -869,8 +954,24 @@ def self_test() -> int:
         state = loads_strict_json((devlyn / "pipeline.state.json").read_text(encoding="utf-8"))
         assert summary["verdict"] == "BLOCKED", summary
         assert state["phases"]["verify"]["sub_verdicts"]["pair_judge"] == "BLOCKED", state
-
         (devlyn / "codex-judge.stdout").unlink()
+
+        # Engine-neutral stdout contract (iter-0060): a Claude pair-judge
+        # capture (claude-judge.stdout, adapters/claude.md ## Invocation)
+        # binds the same emission contract as the Codex one.
+        (devlyn / "claude-judge.stdout").write_text(
+            json.dumps({"id": "clj1", "severity": "HIGH"}) + "\n",
+            encoding="utf-8",
+        )
+        findings, source_verdicts = read_findings(devlyn)
+        summary = write_outputs(devlyn, findings, source_verdicts)
+        assert summary["verdict"] == "BLOCKED", summary
+        assert any(
+            finding.get("id") == "verify-pair-emission-contract-violated"
+            and "claude-judge.stdout" in finding.get("message", "")
+            for finding in findings
+        ), findings
+        (devlyn / "claude-judge.stdout").unlink()
         (devlyn / "pipeline.state.json").write_text(
             json.dumps({
                 "phases": {
@@ -1672,6 +1773,21 @@ def self_test() -> int:
             finding.get("id") == "verify-pair-trigger-reasons-unknown"
             for finding in findings
         ), findings
+
+        # stdout-only spawn evidence: no pair findings file at all; a clean
+        # PASS stdout from a claude judge promotes pair_judge null -> PASS.
+        (devlyn / "verify.pair.findings.jsonl").unlink()
+        (devlyn / "pipeline.state.json").write_text(
+            json.dumps({"phases": {"verify": {"verdict": None, "sub_verdicts": None}}}),
+            encoding="utf-8",
+        )
+        (devlyn / "claude-judge.stdout").write_text("PASS\n", encoding="utf-8")
+        findings, source_verdicts = read_findings(devlyn)
+        summary = write_outputs(devlyn, findings, source_verdicts)
+        write_state(devlyn, summary)
+        state = loads_strict_json((devlyn / "pipeline.state.json").read_text(encoding="utf-8"))
+        assert summary["verdict"] == "PASS", summary
+        assert state["phases"]["verify"]["sub_verdicts"]["pair_judge"] == "PASS", state
     return 0
 
 

package/config/skills/devlyn:engines/SKILL.md

@@ -0,0 +1,47 @@
+---
+name: devlyn:engines
+description: Show and pin engine roles for the devlyn pipeline (executor / pair judge). Reads and writes machine-local .devlyn/engines.json with fail-closed validation. Use when the user asks which models are configured, wants to force a specific model for pipeline work ("수동모드", "engine 고정", "use codex to implement"), or wants to clear pins back to auto-detection.
+---
+
+Utility front-end for the role-resolution contract in `_shared/engine-preflight.md#role-resolution`. It adds no semantics of its own: everything it writes is exactly what `/devlyn:resolve` PHASE 0 reads.
+
+<args>
+$ARGUMENTS
+</args>
+
+<runtime_paths>
+Resolve shared scripts from this skill's installed directory, never from the project cwd, before step 2 below:
+
+```bash
+DEVLYN_SKILL_DIR="${CLAUDE_SKILL_DIR:-__DEVLYN_SKILL_DIR__}"
+if [ "$DEVLYN_SKILL_DIR" = "__DEVLYN_SKILL_DIR__" ] || [ ! -d "$DEVLYN_SKILL_DIR/../_shared" ]; then
+  echo "BLOCKED:shared-dir-unresolved: $DEVLYN_SKILL_DIR/../_shared" >&2
+  exit 1
+fi
+DEVLYN_SHARED_DIR="$(cd "$DEVLYN_SKILL_DIR/../_shared" && pwd)"
+```
+</runtime_paths>
+
+## No args — status + how to choose
+
+1. Read `cwd/.devlyn/engines.json`. Absent → report "no pins — auto-detection active".
+2. Run `bash "$DEVLYN_SHARED_DIR/engine-doctor.sh"` — read-only; never installs anything or writes `.devlyn/engines.json`. It detects, per target (`claude`, `codex`, `omp`, `pi`), whether its binary is present, whether `_shared/adapters/<name>.md` exists, and whether that makes it `pin_eligible` today. Its trailing line is either a pair-judge-diversity confirmation or a recommendation to add a second adapter-valid engine (`autoresearch/iterations/0045-model-arm-drift.md`: different model tiers hit different failure-mode blind spots, so VERIFY pair-judge/risk-probes need ≥2 to ever fire).
+3. Print the role table. Executor's "Available engines" = rows where `pin_eligible: yes` and `role` includes `executor` (i.e. not `judge-only`). Pair judge's "Available engines" = rows where `pin_eligible: yes` and `role` includes `judge` (`executor+judge` or `judge-only`):
+
+```
+Role          Resolved     Source          Available engines
+orchestrator  (this CLI)   not configurable — switch CLIs to change
+executor      claude       default         claude ✓  codex ✓
+pair judge    codex        binary rule     (pin order with: pair <name>,...)
+```
+
+4. Show the script's full detection table plus its diversity/recommendation line beneath the role table.
+5. End with one usage line per subcommand below.
+
+## Subcommands
+
+- `executor <name>` — pin the executor (PLAN/IMPLEMENT/CLEANUP + primary VERIFY judge). Refuse names with no `_shared/adapters/<name>.md`, or whose adapter's `## Role eligibility` section declares `executor: no` (judge-only backends), listing the valid names either way. If the engine's CLI is not currently available, still write the pin but warn: pins are promises — the run will stop with `BLOCKED:<name>-unavailable` until it is installed.
+- `pair <name>[,<name>...]` — set `pair_judge_priority` (ordered; first adapter-valid, pair-judge-eligible, non-primary, available entry wins at VERIFY/risk-probe time). Refuse names with no `_shared/adapters/<name>.md`, or whose adapter declares `pair_judge: no`.
+- `clear` — remove both pins; delete `.devlyn/engines.json` when nothing else remains in it.
+
+Writes preserve any unrecognized keys already in the file. After every change, re-print the resolved role table. Never modify anything outside `.devlyn/engines.json`, and never launch a pipeline from this skill.

package/config/skills/devlyn:ideate/SKILL.md

@@ -27,6 +27,25 @@ The user does not know context engineering. They will under-specify and over-ass
 Read `_shared/runtime-principles.md` (Subtractive-first / Goal-locked / No-workaround / Evidence). The principles bind the spec content as well as your conversation. A spec that says "for future flexibility" is a Subtractive-first violation. A spec that asks for `try { ... } catch { return null }` is a No-workaround violation. AI flags these in elicitation, not after `/devlyn:resolve` has built them.
 </harness_principles>
 
+<runtime_paths>
+Resolve shared scripts from this skill's installed directory, never from the project cwd:
+
+```bash
+DEVLYN_SKILL_DIR="${CLAUDE_SKILL_DIR:-__DEVLYN_SKILL_DIR__}"
+if [ "$DEVLYN_SKILL_DIR" = "__DEVLYN_SKILL_DIR__" ] || [ ! -d "$DEVLYN_SKILL_DIR/../_shared" ]; then
+  echo "BLOCKED:shared-dir-unresolved: $DEVLYN_SKILL_DIR/../_shared" >&2
+  exit 1
+fi
+DEVLYN_SHARED_DIR="$(cd "$DEVLYN_SKILL_DIR/../_shared" && pwd)"
+if [ ! -f "$DEVLYN_SHARED_DIR/spec-verify-check.py" ]; then
+  echo "BLOCKED:shared-dir-unresolved: $DEVLYN_SHARED_DIR/spec-verify-check.py" >&2
+  exit 1
+fi
+```
+
+Use `python3 "$DEVLYN_SHARED_DIR/spec-verify-check.py"` for all spec validation commands. Claude Code supplies `CLAUDE_SKILL_DIR` by native render substitution; Codex/oh-my-pi installs receive an absolute copy-time stamp in the default branch. If the resolved skill directory is still the placeholder or `../_shared` is absent, stop with `BLOCKED:shared-dir-unresolved`.
+</runtime_paths>
+
 <engine_routing>
 Default engine: Claude. The per-engine adapter from `_shared/adapters/<engine>.md` is prepended to the elicitation prompt so the model honors its own official prompt-engineering guidance during the Q&A.
 </engine_routing>
@@ -86,13 +105,13 @@ Structural lint (inline check, no script needed):
 - `## Context` non-empty (≥ 1 sentence).
 - `## Requirements` has ≥ 1 `- [ ]` bullet.
 - `## Out of Scope` present (may list "none" if truly nothing).
-- `## Verification` has either ≥ 1 named command OR an explicit "all Requirements are pure-design" note.
+- `## Verification` is preceded by a `<!-- devlyn:verification -->` sentinel and has either ≥ 1 named command OR sibling `spec.expected.json` declares `"pure_design": true`.
 
 After lint passes:
 1. Write `<spec-dir>/<id>-<slug>/spec.md` (the spec).
 2. Generate `<spec-dir>/<id>-<slug>/spec.expected.json` from the spec's `## Verification` block + any `forbidden_patterns` / `required_files` / `forbidden_files` / `max_deps_added` the conversation surfaced.
-3. Run `python3 .claude/skills/_shared/spec-verify-check.py --check <spec-path>` to validate the verification carrier shape, supported `complexity` frontmatter, and any present actionable solo-headroom hypothesis; if the spec uses a legacy inline `## Verification` JSON carrier, any solo-headroom hypothesis command must match that carrier's `verification_commands[].cmd`. If exit 2, fix the carrier/frontmatter/hypothesis and re-run.
-4. Run `python3 .claude/skills/_shared/spec-verify-check.py --check-expected <expected-path>` to validate sibling `spec.expected.json` against `_shared/expected.schema.json` plus sibling spec `complexity` frontmatter and any present actionable solo-headroom hypothesis; if the spec has a solo-headroom hypothesis, its observable command must match `spec.expected.json.verification_commands[].cmd`. If exit 2, fix the JSON/frontmatter/hypothesis and re-run.
+3. Run `python3 "$DEVLYN_SHARED_DIR/spec-verify-check.py" --check <spec-path>` to validate the verification carrier shape, supported `complexity` frontmatter, and any present actionable solo-headroom hypothesis; if the spec uses a legacy inline `## Verification` JSON carrier, any solo-headroom hypothesis command must match that carrier's `verification_commands[].cmd`. If exit 2, fix the carrier/frontmatter/hypothesis and re-run.
+4. Run `python3 "$DEVLYN_SHARED_DIR/spec-verify-check.py" --check-expected <expected-path>` to validate sibling `spec.expected.json` against `_shared/expected.schema.json` plus sibling spec `complexity` frontmatter and any present actionable solo-headroom hypothesis; if the spec has a solo-headroom hypothesis, its observable command must match `spec.expected.json.verification_commands[].cmd`. If exit 2, fix the JSON/frontmatter/hypothesis and re-run.
 5. Print: `spec ready — /devlyn:resolve --spec <spec-path>`.
 
 ## PHASE 1Q: QUICK MODE

package/config/skills/devlyn:ideate/references/elicitation.md

@@ -94,8 +94,8 @@ Before declaring the spec ready, verify structurally:
 If the lint fails, fix the missing piece (ask one focused question if needed) before announcing.
 
 After lint passes, run both mechanical checks:
-1. `python3 .claude/skills/_shared/spec-verify-check.py --check <spec-path>` validates the spec's verification carrier shape, supported `complexity` frontmatter, and any present actionable solo-headroom hypothesis; if the spec uses a legacy inline `## Verification` JSON carrier, any solo-headroom hypothesis command must match that carrier's `verification_commands[].cmd`.
-2. `python3 .claude/skills/_shared/spec-verify-check.py --check-expected <expected-path>` validates sibling `spec.expected.json` against `_shared/expected.schema.json` plus sibling spec `complexity` frontmatter and any present actionable solo-headroom hypothesis; if the spec has a solo-headroom hypothesis, its observable command must match `spec.expected.json.verification_commands[].cmd`.
+1. `python3 "$DEVLYN_SHARED_DIR/spec-verify-check.py" --check <spec-path>` validates the spec's verification carrier shape, supported `complexity` frontmatter, and any present actionable solo-headroom hypothesis; if the spec uses a legacy inline `## Verification` JSON carrier, any solo-headroom hypothesis command must match that carrier's `verification_commands[].cmd`.
+2. `python3 "$DEVLYN_SHARED_DIR/spec-verify-check.py" --check-expected <expected-path>` validates sibling `spec.expected.json` against `_shared/expected.schema.json` plus sibling spec `complexity` frontmatter and any present actionable solo-headroom hypothesis; if the spec has a solo-headroom hypothesis, its observable command must match `spec.expected.json.verification_commands[].cmd`.
 
 If either exits 2: read the stderr message, fix the malformed carrier or JSON, and re-run the failed command. Both commands must exit 0 before ready.
 </lint>

package/config/skills/devlyn:ideate/references/from-spec-mode.md

@@ -37,8 +37,8 @@ You must NOT:
 3. For each missing/malformed piece: apply the smallest allowed fix.
 4. Write the normalized spec. Default location: `<spec-dir>/<id>-<slug>/spec.md`. With `--in-place` flag: write to `<path>` directly (overwrites the original).
 5. Generate or fix `spec.expected.json` per the rules above. Same dir as the spec.
-6. Run `python3 .claude/skills/_shared/spec-verify-check.py --check <spec-path>` to validate the spec carrier and supported `complexity` frontmatter; if the spec uses a legacy inline `## Verification` JSON carrier, any solo-headroom hypothesis command must match that carrier's `verification_commands[].cmd`.
-7. Run `python3 .claude/skills/_shared/spec-verify-check.py --check-expected <expected-path>` to validate sibling `spec.expected.json` plus sibling spec `complexity` frontmatter and any present solo-headroom hypothesis command against `spec.expected.json.verification_commands[].cmd`.
+6. Run `python3 "$DEVLYN_SHARED_DIR/spec-verify-check.py" --check <spec-path>` to validate the spec carrier and supported `complexity` frontmatter; if the spec uses a legacy inline `## Verification` JSON carrier, any solo-headroom hypothesis command must match that carrier's `verification_commands[].cmd`.
+7. Run `python3 "$DEVLYN_SHARED_DIR/spec-verify-check.py" --check-expected <expected-path>` to validate sibling `spec.expected.json` plus sibling spec `complexity` frontmatter and any present solo-headroom hypothesis command against `spec.expected.json.verification_commands[].cmd`.
 8. If lint still fails after allowed fixes (e.g. Requirements section is empty in the source), surface the issue and exit non-zero — do NOT invent Requirements.
 9. If the preserved Requirements combine state mutation with ordering/priority,
    idempotency, auth/error priority, or exact output shape but the Verification

package/config/skills/devlyn:ideate/references/project-mode.md

@@ -82,7 +82,7 @@ Anything binding all features (e.g. "no new top-level dependencies", "all CLI ou
 - `<spec-dir>/<id-N>/spec.md` for each feature (per `references/spec-template.md`).
 - `<spec-dir>/<id-N>/spec.expected.json` for each feature (per `_shared/expected.schema.json`).
 
-Each per-feature spec is structurally lint-validated using `python3 .claude/skills/_shared/spec-verify-check.py --check <spec-path>`, including supported `complexity` frontmatter and any present actionable solo-headroom hypothesis, and each sibling expected contract plus sibling spec `complexity` frontmatter and any present actionable solo-headroom hypothesis is validated using `python3 .claude/skills/_shared/spec-verify-check.py --check-expected <expected-path>`; if the spec has a solo-headroom hypothesis, its observable command must match `spec.expected.json.verification_commands[].cmd`.
+Each per-feature spec is structurally lint-validated using `python3 "$DEVLYN_SHARED_DIR/spec-verify-check.py" --check <spec-path>`, including supported `complexity` frontmatter and any present actionable solo-headroom hypothesis, and each sibling expected contract plus sibling spec `complexity` frontmatter and any present actionable solo-headroom hypothesis is validated using `python3 "$DEVLYN_SHARED_DIR/spec-verify-check.py" --check-expected <expected-path>`; if the spec has a solo-headroom hypothesis, its observable command must match `spec.expected.json.verification_commands[].cmd`.
 
 Final announcement: `project ready — N specs at <spec-dir>/. Start with /devlyn:resolve --spec <first-spec-path>`.
 </output>

package/config/skills/devlyn:ideate/references/spec-template.md

@@ -64,9 +64,19 @@ If the spec is small enough that nothing meaningful is out of scope, write `- (n
 
 ## `## Verification`
 
+Immediately precede the heading with a `<!-- devlyn:verification -->` sentinel
+comment on its own line, directly above `## Verification` (no blank line
+between them). This is the machine locator `spec-verify-check.py` uses to
+find the section — it is language-neutral: the heading text after the
+sentinel may be any human language (`## Verification`, `## 검증`, etc.); only
+the sentinel itself is fixed ASCII and must never be translated.
+
 Concrete commands or tests whose expected behavior names the success condition:
 
 ```markdown
+<!-- devlyn:verification -->
+## Verification
+
 - `node bin/cli.js doctor` exits 0; output contains `doctor:`.
 - `HOME=/nonexistent node bin/cli.js doctor` exits 1; output mentions `/nonexistent`.
 - `node --test tests/cli.test.js` passes.
@@ -75,14 +85,14 @@ Concrete commands or tests whose expected behavior names the success condition:
 
 The body of the section reads humanely; the machine-readable contract lives in `spec.expected.json` (sibling file). Each command in this section maps to one entry in `spec.expected.json.verification_commands`.
 
-If all Requirements are pure-design (no observable runtime check), the body of this section is a single line: `- (all Requirements are pure-design; no runtime verification commands)`.
+If all Requirements are pure-design (no observable runtime check), the body of this section is a single descriptive line (e.g. `- No runtime verification commands.`) and sibling `spec.expected.json` declares `"pure_design": true` instead of listing `verification_commands`.
 
 ## Sibling file: `spec.expected.json`
 
-Schema: `_shared/expected.schema.json`. Required when Requirements have observable checks; optional when all Requirements are pure-design. Validate before announcing ready:
+Schema: `_shared/expected.schema.json`. Required when Requirements have observable checks; optional when all Requirements are pure-design (declare `"pure_design": true` in that case — contradictory, and rejected, alongside a non-empty `verification_commands`). Validate before announcing ready:
 
 ```bash
-python3 .claude/skills/_shared/spec-verify-check.py --check-expected <expected-path>
+python3 "$DEVLYN_SHARED_DIR/spec-verify-check.py" --check-expected <expected-path>
 ```
 
 Generated by ideate from the conversation:
@@ -90,6 +100,7 @@ Generated by ideate from the conversation:
 - `forbidden_patterns` ← from Constraints that mention specific anti-patterns ("no silent catches", "no any types").
 - `required_files` / `forbidden_files` ← from Out of Scope and Requirements.
 - `max_deps_added` ← from Constraints (default 0 unless the spec licenses a new dep).
+- `required_risk_probe_requirements` ← for specs where a Requirement combines ordering/priority, rollback, idempotency, auth/signature, concurrency, atomic-batch, or exact output shape, declare the risk categories PHASE 1.5 risk-probe derivation must cover directly, e.g. `[{"tag": "rollback_state", "derived_from": "<exact ## Verification bullet>"}]`. This replaces guessing the required categories from prose — declare them explicitly so the check works in any language. `tag` must be one of the risk-probe tags in `_shared/spec-verify-check.py:RISK_PROBE_TAGS`; `derived_from` must be an exact substring of `## Verification`. Omit entirely when the spec has no ordering/rollback/idempotency/auth/concurrency/atomic-batch/exact-shape risk.
 
 ## Quality bar (lint enforces structurally; ideate enforces substantively)
 
@@ -97,7 +108,7 @@ Structural (lint):
 - Frontmatter valid + required fields present.
 - All five H2 sections present.
 - Requirements has ≥ 1 bullet.
-- Verification has either commands or the pure-design escape phrase.
+- Verification has either commands or `spec.expected.json` declares `"pure_design": true`.
 
 Substantive (ideate's job during elicitation):
 - Each Requirement is independently verifiable.

package/config/skills/devlyn:queue/SKILL.md

@@ -0,0 +1,26 @@
+---
+name: devlyn:queue
+description: Manage and drain the intent queue (docs/specs/queue.md) — the backlog the loop-engineering contract runs on. Use when the user wants to stack work for later ("큐에 넣어줘", "queue this"), see what is queued, or start an unattended serial drain ("큐 드레인 시작", "밤새 돌려줘", "drain the queue") that takes each item through spec → /devlyn:resolve → verified done.
+---
+
+Utility front-end for the intent-queue contract in the project instructions ("Intent queue" in CLAUDE.md / AGENTS.md — whichever this CLI loads). It adds no semantics of its own: the queue file is the API, and the drain loop follows the documented contract exactly — a runner (this skill, a long session, or a future devlyn-os daemon) is a replaceable driver over the same file.
+
+<args>
+$ARGUMENTS
+</args>
+
+## No args — status
+
+Read `docs/specs/queue.md` (absent → report "queue empty — nothing staged" and how to add). Print pending `[ ]`, done `[x]`, and blocked `[F]` counts, the next item up, and one usage line per subcommand.
+
+## Subcommands
+
+- `add <intent text>` — append `- [ ] <intent>` to `docs/specs/queue.md` (create the file with its header if missing). If the intent came out of a conversation that already produced a spec, link it: `- [ ] (spec: docs/specs/<id>/spec.md) <intent>`.
+- `drain` — serial drain per the project-instructions contract. For each pending item, in order:
+  1. Spec it if unspecced (the queue entry is the user's go-ahead). Unattended assumptions may only take scope-narrowing, reversible, non-user-visible defaults; material ambiguity (user-visible behavior, data/state semantics, new files/scripts/flags, implementation surface) → mark `[F] needs-review: <question>` and continue to the next item.
+  2. Run `/devlyn:resolve --spec <path>` hands-free.
+  3. Outer loop on the terminal verdict: PASS → mark `[x]`. Findings-backed verdicts (NEEDS_WORK, verify/build-gate exhaustion) → amend the spec (recorded in the spec file), re-run — at most 3 outer iterations. Infrastructure / invalid-input / engine-availability / implement-empty BLOCKED verdicts are not spec-amendable → mark `[F] <verdict>` immediately.
+  4. A blocked item never halts the queue; continue.
+  5. When the queue is drained (or the session must stop), emit the drain report: per-item verdict, every logged assumption, and the commit range produced.
+
+Strictly SERIAL — one `/devlyn:resolve` run at a time, never parallel. Never invent queue items, never reorder them, and never delete an item — only mark `[x]` / `[F]`.