devrites 3.0.7 → 3.2.0

package/scripts/codex-generate.sh

@@ -8,16 +8,28 @@ gen_codex_markdown_file() {
   local _src="$1" _out="$2"
   mkdir -p "$(dirname "$_out")"
   sed -E \
+    -e 's#(pack/)?\.claude/agents/devrites-\{security-auditor,performance-reviewer,simplifier-reviewer\}\.md#.codex/agents/devrites-security-auditor.toml`, `.codex/agents/devrites-performance-reviewer.toml`, or `.codex/agents/devrites-simplifier-reviewer.toml#g' \
+    -e 's#(\.\./)+agents/devrites-\{security-auditor,performance-reviewer,simplifier-reviewer\}\.md#.codex/agents/devrites-security-auditor.toml`, `.codex/agents/devrites-performance-reviewer.toml`, or `.codex/agents/devrites-simplifier-reviewer.toml#g' \
     -e 's#pack/\.claude/skills/devrites-lib/scripts/#.agents/skills/devrites-lib/scripts/#g' \
     -e 's#pack/\.claude/skills/#.agents/skills/#g' \
-    -e 's#pack/\.claude/agents/(devrites-[A-Za-z0-9_-]+)\.md#.codex/agents/\1.toml#g' \
+    -e 's#pack/\.claude/agents/([A-Za-z0-9_-]+)\.md#.codex/agents/\1.toml#g' \
     -e 's#pack/\.claude/agents/#.codex/agents/#g' \
     -e 's#\.claude/skills/devrites-lib/scripts/#.agents/skills/devrites-lib/scripts/#g' \
     -e 's#\.claude/skills/#.agents/skills/#g' \
-    -e 's#\.claude/agents/(devrites-[A-Za-z0-9_-]+)\.md#.codex/agents/\1.toml#g' \
+    -e 's#\.claude/agents/([A-Za-z0-9_-]+)\.md#.codex/agents/\1.toml#g' \
     -e 's#\.claude/agents/#.codex/agents/#g' \
-    -e 's#\.\./\.\./\.\./agents/(devrites-[A-Za-z0-9_-]+)\.md#.codex/agents/\1.toml#g' \
-    -e 's#\.\./\.\./agents/(devrites-[A-Za-z0-9_-]+)\.md#.codex/agents/\1.toml#g' \
+    -e 's#(\.\./)+agents/([A-Za-z0-9_-]+)\.md#.codex/agents/\2.toml#g' \
+    -e 's#\.codex/agents/([A-Za-z0-9_-]+)\.md#.codex/agents/\1.toml#g' \
+    -e 's#Host mapping: Claude Code uses `Agent` \(`Task` is its legacy alias\); Codex uses#Host mapping: Codex fresh-context dispatch uses#g' \
+    -e 's#`Agent` call#`spawn_agent` call#g' \
+    -e 's#Task breakdown#Work-item breakdown#g' \
+    -e 's#(^|[^A-Za-z0-9_])Task([^A-Za-z0-9_]|$)#\1spawn_agent\2#g' \
+    -e 's#dispatch `devrites-source-driven`#invoke `devrites-source-driven`#g' \
+    -e 's#Dispatch `devrites-source-driven`#Invoke `devrites-source-driven`#g' \
+    -e 's#pass-through dispatch to the matching `rite-<verb>` skill#pass-through invocation of the matching `rite-<verb>` skill#g' \
+    -e 's#verb dispatches to the matching `rite-<verb>` skill#verb invokes the matching `rite-<verb>` skill#g' \
+    -e 's#the dispatch map only#the invocation map only#g' \
+    -e 's#→ dispatch per the table above#→ invoke the matching skill per the table above#g' \
     -e 's#(^|[^A-Za-z0-9_./-])/(rite(-[a-z0-9-]+)?)([^A-Za-z0-9_-]|$)#\1$\2\4#g' \
     "$_src" > "$_out"
 }
@@ -26,11 +38,11 @@ gen_codex_skill_file() {
   _src="$1"; _out="$2"; _internal="${3:-0}"
   _tmp="$TMP_GEN_DIR/codex-skill-raw-$(basename "$(dirname "$_src")").md"
   mkdir -p "$(dirname "$_out")"
-  # Internal (explicit-only) skills: replace the frontmatter description with a short stub in the
-  # Codex mirror. Codex uses the description ONLY to build its 2% skills-list for implicit matching;
-  # an explicit-only skill is never matched, so its full description is pure budget waste. Stubbing
-  # the 12 internal skills frees that budget so the user-facing rite-* descriptions fit un-shortened
-  # and keep matching reliably. Explicit `$name` invocation and the full SKILL.md body are untouched.
+  # Give the 12 internal skills a short description in the Codex mirror. Codex
+  # uses descriptions for its 2% implicit-matching budget, but these skills are
+  # invoked by name. Shorter internal descriptions leave that budget for the
+  # public rite-* skills. Keep explicit invocation and each SKILL.md body
+  # unchanged.
   awk -v internal="$_internal" '
     BEGIN { fm = 0; inserted = 0 }
     NR == 1 && $0 == "---" { print; fm = 1; next }
@@ -47,9 +59,13 @@ gen_codex_skill_file() {
       print ""
       print "- Load DevRites engineering standards from `.agents/skills/devrites-lib/reference/standards/`. Read `.agents/skills/devrites-lib/reference/standards/core.md` before workflow work, then load the other `.agents/skills/devrites-lib/reference/standards/*.md` files exactly when this skill asks for them."
       print "- Use the installed `devrites-engine` binary as the canonical runtime helper surface for orientation, gates, and state mutation."
-      print "- When this skill asks for a DevRites specialist or writer agent, **explicitly** spawn the matching Codex custom agent from `.codex/agents/devrites-*.toml` through Codex subagents (`spawn_agent`), then wait for its result and reconcile it as the skill instructs. Do not do the review inline just because the instruction to spawn is embedded here: Codex under-fires embedded spawn/skill instructions (openai/codex #23496), so treat the spawn as required, not optional."
-      print "- The independence of a fresh-context subagent is the point. If Codex genuinely cannot spawn subagents in the current surface, run the documented inline fallback and **label the result an inline fallback, not an independent review**: an inline pass shares the calling context and is weaker evidence."
-      print "- Codex project hooks are installed in `.codex/hooks.json`. Review and trust them with `/hooks` before relying on hook enforcement."
+      print "- **Invocation and dispatch are different:** invoke means run a skill in this context; dispatch means start a fresh agent with `spawn_agent`, await it, and reconcile its result. Never describe inline skill work as a dispatch."
+      print "- For every DevRites specialist or writer dispatch, first call `spawn_agent` with the named `devrites-<role>` custom role. The matching project contract is `.codex/agents/devrites-<role>.toml`."
+      print "- If `spawn_agent` is callable but a named read-only role is unavailable, use generic `explorer` only when the host proves that run has a runtime-enforced read-only sandbox. Tell it to read `.codex/agents/devrites-<role>.toml`, follow its `developer_instructions`, and execute the unchanged packet. A missing read-only custom role is not evidence that spawning is unavailable."
+      print "- Never dispatch generic `worker` for `devrites-slice-wright` unless the host proves that worker run carries exact DevRites identity and the same `.wright-allowlist` enforcement as the named role. Codex reports a generic run as `agent_type=worker`, so the generated global hooks cannot prove that binding. Reject that unsafe rung and use the documented labelled inline wright path with `.reconcile-inline` plus the full reconcile gate."
+      print "- If the host cannot prove the generic explorer is runtime read-only, reject that rung too. Only when no spawn primitive exists or a higher-priority policy rejects a safe spawn may the root run the documented discipline inline. Label it `independence: fallback`, never call it independent, and apply every fallback risk gate. An unbound generic wright or unconfined generic explorer is such a safety rejection, not evidence that no agents exist."
+      print "- Wait for every required fresh-context dispatch before reconciling or advancing. A backgrounded or lost result is incomplete."
+      print "- Codex project hooks are installed in `.codex/hooks.json`; declared-leaf hooks are scoped inside `.codex/agents/devrites-*.toml`. Review and trust them with `/hooks` before relying on hook enforcement."
       print "- When this skill asks a HITL question via `AskUserQuestion`: Codex'\''s equivalent (`request_user_input`) exists only in Plan mode. Outside Plan mode, render the option set as a plain numbered list in chat and **end the turn** so the human answers: NEVER silently pick an option yourself; auto-picking is AFK'\''s contract, gated by the `.devrites/AFK` sentinel."
       print ""
       fm = 0
@@ -62,7 +78,7 @@ gen_codex_skill_file() {
         print ""
         print "## Codex compatibility"
         print ""
-        print "Load DevRites engineering standards from `.agents/skills/devrites-lib/reference/standards/`, use matching `.codex/agents/devrites-*.toml` custom agents for DevRites subagent dispatch, and trust `.codex/hooks.json` with `/hooks` before relying on hooks."
+        print "Load DevRites engineering standards from `.agents/skills/devrites-lib/reference/standards/`. Invocation runs a skill inline; dispatch starts a fresh agent with `spawn_agent` and must be awaited. Try the named `devrites-<role>` first. A missing read-only role may fall back to generic `explorer` reading `.codex/agents/devrites-<role>.toml` only when the host proves runtime-enforced read-only sandboxing. Never use generic `worker` for the wright unless exact DevRites identity and `.wright-allowlist` enforcement are proven; Codex `agent_type=worker` does not prove them, so use the labelled inline `.reconcile-inline` path with full reconciliation. Other inline fallback requires spawning itself to be unavailable or a safe spawn to be rejected by higher-priority policy. Trust `.codex/hooks.json` and the inline hooks in `.codex/agents/devrites-*.toml` with `/hooks` before relying on hooks."
       }
     }
   ' "$_src" > "$_tmp"
@@ -73,6 +89,17 @@ toml_escape() {
   printf '%s' "$1" | sed 's/\\/\\\\/g; s/"/\\"/g'
 }
 
+gen_codex_leaf_hook_toml() {
+  local _active_agent="$1" _required_var="$2" _subcommand="$3" _status="$4" _command
+  _command="cd \"\$(git rev-parse --show-toplevel 2>/dev/null || pwd)\" 2>/dev/null || { printf '%s\\n' 'DevRites: cannot resolve the project root for a declared Codex leaf. (devrites-codex-leaf-guard)' >&2; exit 2; }; DEVRITES_AGENT_RUN=1 DEVRITES_ACTIVE_AGENT=${_active_agent} ${_required_var}=1 devrites-engine hook ${_subcommand} --harness=codex; rc=\$?; case \"\$rc\" in 0) exit 0 ;; 2) exit 2 ;; *) printf '%s\\n' 'DevRites: declared Codex leaf guard unavailable or crashed; install or repair devrites-engine. (devrites-codex-leaf-guard)' >&2; exit 2 ;; esac"
+  printf '\n[[hooks.PreToolUse]]\n'
+  printf 'matcher = "Bash|Shell|sh|exec_command|run_command|Edit|Write|MultiEdit|NotebookEdit|apply_patch|exec|js|python|computer|computer_use|write_stdin|run_code|Agent|Task|spawn_agent|delegate|dispatch_agent|create_agent"\n\n'
+  printf '[[hooks.PreToolUse.hooks]]\n'
+  printf 'type = "command"\n'
+  printf "command = '''%s'''\n" "$_command"
+  printf 'statusMessage = "%s"\n' "$_status"
+}
+
 # Generate a Codex custom-agent TOML file from a Claude Code markdown agent.
 # Codex does not consume .claude/agents/*.md directly; it loads project agents
 # from .codex/agents/*.toml.
@@ -106,6 +133,22 @@ gen_codex_agent() {
     gen_codex_markdown_file "$_body_tmp" "$_body_codex"
     cat "$_body_codex"
     printf "\n%s\n" "'''"
+    case "$_name" in
+      devrites-slice-wright)
+        gen_codex_leaf_hook_toml \
+          "$_name" \
+          "DEVRITES_WRIGHT_AGENT_REQUIRED" \
+          "wright-scope" \
+          "DevRites: checking slice-wright boundary"
+        ;;
+      *)
+        gen_codex_leaf_hook_toml \
+          "$_name" \
+          "DEVRITES_REVIEWER_AGENT_REQUIRED" \
+          "reviewer-readonly" \
+          "DevRites: checking reviewer read-only boundary"
+        ;;
+    esac
   } > "$_out"
 }
 
@@ -126,13 +169,16 @@ This project has DevRites installed for both Claude Code and Codex.
 - DevRites runtime helpers run through the installed `devrites-engine` binary.
 - Before using any DevRites workflow skill, read `.agents/skills/devrites-lib/reference/standards/core.md`. Load other `.agents/skills/devrites-lib/reference/standards/*.md` files when the skill or rule index asks for them. These are DevRites engineering standards, not Codex exec-policy `.rules` files.
 - Custom Codex subagents generated from the DevRites review agents live in `.codex/agents`.
-- When DevRites skill prose asks for a DevRites specialist or writer agent, use the matching Codex custom agent from `.codex/agents/devrites-*.toml` through Codex subagents. If Codex subagents are unavailable in the current surface, run the skill's documented inline fallback and say that the result was not an independent subagent review.
+- In DevRites guidance, **invoke** means run a skill inline in the current context; **dispatch** means start a fresh agent with `spawn_agent`, wait for it, and reconcile its result.
+- For a DevRites dispatch, first use the named `devrites-<role>` custom role. If a read-only role is unavailable but `spawn_agent` still works, use generic `explorer` only when the host proves runtime-enforced read-only sandboxing; tell it to read `.codex/agents/devrites-<role>.toml` before executing the unchanged packet.
+- Do not use generic `worker` for the wright unless exact DevRites identity and `.wright-allowlist` enforcement are proven. Codex exposes that fallback as `agent_type=worker`, which the generated leaf hooks intentionally do not treat as a declared DevRites run. Reject the unsafe worker rung and use the documented labelled inline `.reconcile-inline` path with full reconciliation.
+- Other inline work is allowed only when no spawn primitive exists or higher-priority policy rejects a safe spawn; label it `independence: fallback`, never independent. A missing read-only custom role alone is not such a rejection, but an unconfined generic explorer is.
 - Claude Code agent hook metadata is not active in Codex. The generated Codex agents preserve read-only intent with Codex sandbox settings where possible; still follow DevRites' scope and no-mutation rules explicitly.
 
 ## Workflow contract
 
 - Keep all feature state in `.devrites/work/<slug>/` and preserve `.devrites/ACTIVE`.
-- Follow the DevRites lifecycle: frame -> spec -> temper -> define -> plan -> vet -> build -> converge -> prove -> polish -> review -> seal -> ship -> done.
+- Follow the DevRites lifecycle: frame -> spec -> clarify -> temper -> define -> plan -> vet -> build -> converge -> prove -> polish -> review -> seal -> ship -> done.
 - Claims of completion need recorded evidence in the feature workspace, not confidence alone.
 <!-- END DEVRITES CODEX -->
 EOF
@@ -145,18 +191,13 @@ gen_codex_hooks_json() {
   "hooks": {
     "PreToolUse": [
       {
-        "matcher": "Bash",
+        "matcher": "Bash|Shell|sh|exec_command|run_command",
         "hooks": [
           {
             "type": "command",
-            "command": "command -v devrites-engine >/dev/null 2>&1 || exit 0; cd \"$(git rev-parse --show-toplevel 2>/dev/null || pwd)\" 2>/dev/null || exit 0; exec env DEVRITES_REVIEWER_AGENT_REQUIRED=1 devrites-engine hook reviewer-readonly --harness=codex",
-            "statusMessage": "DevRites: checking reviewer read-only boundary"
-          }
-        ]
-      },
-      {
-        "matcher": "Bash",
-        "hooks": [
+            "command": "command -v devrites-engine >/dev/null 2>&1 || exit 0; cd \"$(git rev-parse --show-toplevel 2>/dev/null || pwd)\" 2>/dev/null || exit 0; exec devrites-engine hook git-guard --harness=codex",
+            "statusMessage": "DevRites: checking destructive Git authority"
+          },
           {
             "type": "command",
             "command": "command -v devrites-engine >/dev/null 2>&1 || exit 0; cd \"$(git rev-parse --show-toplevel 2>/dev/null || pwd)\" 2>/dev/null || exit 0; exec devrites-engine hook allow --harness=codex",
@@ -171,11 +212,6 @@ gen_codex_hooks_json() {
             "type": "command",
             "command": "command -v devrites-engine >/dev/null 2>&1 || exit 0; cd \"$(git rev-parse --show-toplevel 2>/dev/null || pwd)\" 2>/dev/null || exit 0; exec devrites-engine hook a1-guard --harness=codex",
             "statusMessage": "DevRites: checking build write boundary"
-          },
-          {
-            "type": "command",
-            "command": "command -v devrites-engine >/dev/null 2>&1 || exit 0; cd \"$(git rev-parse --show-toplevel 2>/dev/null || pwd)\" 2>/dev/null || exit 0; exec env DEVRITES_WRIGHT_AGENT_REQUIRED=1 devrites-engine hook wright-scope --harness=codex",
-            "statusMessage": "DevRites: checking slice file scope"
           }
         ]
       }
@@ -293,8 +329,8 @@ gen_codex_hooks_json() {
   }
 }
 EOF
-# NOTE: no SessionEnd entry: Codex does not emit a SessionEnd hook event (its lifecycle events
-# are SessionStart/SubagentStart/PreToolUse/PermissionRequest/PostToolUse/PreCompact/PostCompact/
-# UserPromptSubmit/SubagentStop/Stop). The `hook event session-end` trace is Claude-only; re-add
-# here if Codex ever ships the event.
+# Codex has no SessionEnd hook event. Its lifecycle events are
+# SessionStart/SubagentStart/PreToolUse/PermissionRequest/PostToolUse/PreCompact/
+# PostCompact/UserPromptSubmit/SubagentStop/Stop. The `hook event session-end`
+# trace remains Claude-only until Codex adds that event.
 }

package/scripts/grade-feature.sh

@@ -1,27 +1,25 @@
 #!/usr/bin/env bash
-# Deterministic OUTCOME grader for a finished DevRites feature workspace.
+# Deterministic outcome grader for a completed DevRites feature workspace.
 #
-# The trigger evals (evals/*.json) test whether the right SKILL *fires*. This
-# grades whether a finished run reached a *shippable* state: the
-# product claim DevRites sells ("won't claim done without proof"). It reads only
-# committed Markdown artifacts (no API key, no Claude Code harness), so it runs
-# in CI against a golden fixture and is the kind of deterministic grader
-# Anthropic's eval guidance recommends for coding agents.
+# Trigger evals in evals/*.json check skill selection. This script checks
+# whether a completed run is shippable and has proof. It reads only committed
+# Markdown artifacts, so CI can grade a golden fixture without an API key or
+# model harness.
 #
-# Live evidence-freshness (mtime: does proof post-date code?) is NOT graded here
-#: git fixtures don't preserve mtimes; that gate is enforced on a live
-# workspace by the `devrites-engine evidence-fresh` engine gate.
+# Git fixtures do not preserve the mtimes needed to compare proof with code.
+# The `devrites-engine evidence-fresh` gate performs that check in a live
+# workspace.
 #
-# Usage: grade-feature.sh <workspace-dir>
+# Usage: grade-feature.sh [--json] <workspace-dir>
 #   e.g. evals/golden/shippable-feature | .devrites/work/<slug> | .devrites/archive/<slug>
 #
-# Invariants (from rite-seal/reference/{seal-template,go-no-go,final-evidence}.md):
+# Checks from rite-seal/reference/{seal-template,go-no-go,final-evidence}.md:
 #   1. seal.md present with "Verdict: GO" (not NO-GO)
 #   2. seal.md "## Acceptance Criteria" has no unchecked "- [ ]" item
 #   3. seal.md "## Blockers" is empty / "none"
 #   4. evidence.md present and non-empty
 #   5. review.md present
-#   6. questions.md has no entry with gate: validating + status: open (NO-GO by definition)
+#   6. questions.md has no open question (later lifecycle phases block them)
 #   7. state.md Phase in {seal, ship, done}; Status not awaiting_human / blocked
 #
 # Exit codes: 0 shippable; 1 one or more invariants failed; 2 bad usage.
@@ -29,24 +27,41 @@
 set -euo pipefail
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+json=0
+if [ "${1:-}" = "--json" ]; then
+  json=1
+  shift
+fi
 ws="${1:-}"
-if [ -z "$ws" ] || [ ! -d "$ws" ]; then
-  printf 'usage: grade-feature.sh <workspace-dir>\n' >&2
+if [ "$#" -ne 1 ] || [ ! -d "$ws" ]; then
+  printf 'usage: grade-feature.sh [--json] <workspace-dir>\n' >&2
   exit 2
 fi
 
 seal="$ws/seal.md"; ev="$ws/evidence.md"; rev="$ws/review.md"
 q="$ws/questions.md"; st="$ws/state.md"
 problems=()
+rules=()
+unchecked=0
+acceptance_ready=0
+
+add_problem() {
+  rules+=("$1")
+  problems+=("$2")
+}
 
-# 1 / 2 / 3: seal verdict, acceptance, blockers
+# Checks 1 through 3: seal verdict, acceptance, and blockers.
 if [ ! -f "$seal" ]; then
-  problems+=("seal.md missing: feature never sealed")
+  add_problem "final.seal.missing" "seal.md missing: feature never sealed"
 else
   grep -qiE '^[[:space:]]*Verdict:[[:space:]]*GO[[:space:]]*$' "$seal" \
-    || problems+=("seal.md Verdict is not GO")
+    || add_problem "final.verdict.not-go" "seal.md Verdict is not GO"
   unchecked=$(awk '/^## /{insec=($0 ~ /^## Acceptance Criteria/)} insec && /^- \[ \]/{c++} END{print c+0}' "$seal")
-  [ "${unchecked:-0}" -gt 0 ] && problems+=("seal.md has ${unchecked} unchecked acceptance criterion(s)")
+  if [ "${unchecked:-0}" -gt 0 ]; then
+    add_problem "final.acceptance.unchecked" "seal.md has ${unchecked} unchecked acceptance criterion(s)"
+  else
+    acceptance_ready=1
+  fi
   if awk '
       /^## /{ insec=($0 ~ /^## Blockers/); next }
       insec { l=$0; gsub(/^[[:space:]]+|[[:space:]]+$/,"",l)
@@ -54,40 +69,75 @@ else
               ll=tolower(l); if (ll ~ /^-?[[:space:]]*(none|n\/a)$/) next
               nz=1 }
       END { exit(nz?0:1) }' "$seal"; then
-    problems+=("seal.md lists unresolved blockers")
+    add_problem "final.blockers.unresolved" "seal.md lists unresolved blockers"
   fi
 fi
 
-# 4: evidence
-{ [ -f "$ev" ] && [ -s "$ev" ]; } || problems+=("evidence.md missing or empty: acceptance unproven")
+# Check 4: evidence.
+{ [ -f "$ev" ] && [ -s "$ev" ]; } \
+  || add_problem "final.evidence.missing-or-empty" "evidence.md missing or empty: acceptance unproven"
 
-# 5: review
-[ -f "$rev" ] || problems+=("review.md missing: feature not reviewed")
+# Check 5: review.
+[ -f "$rev" ] || add_problem "final.review.missing" "review.md missing: feature not reviewed"
 
-# 6: open validating gate (merge-blocking by definition)
+# Check 6: open questions block sealing.
 if [ -f "$q" ]; then
-  if awk '
-      /^## q-/{ if(inq && s=="open" && g=="validating") bad=1; inq=1; s=""; g=""; next }
-      inq && /^status:/{ v=$0; sub(/^status:[[:space:]]*/,"",v); s=v }
-      inq && /^gate:/  { v=$0; sub(/^gate:[[:space:]]*/,"",v);   g=v }
-      END{ if(inq && s=="open" && g=="validating") bad=1; exit(bad?0:1) }' "$q"; then
-    problems+=("open 'gate: validating' question: merge-blocking by definition (NO-GO)")
+  if python3 - "$q" <<'PY'
+from pathlib import Path
+import sys
+
+lines = Path(sys.argv[1]).read_text().splitlines()
+in_question = False
+status = ""
+for line in lines:
+    stripped = line.strip()
+    if stripped.startswith("## "):
+        if in_question and status.lower() == "open":
+            raise SystemExit(0)
+        in_question = stripped[3:].lower().startswith("q-")
+        status = ""
+    elif in_question and stripped.lower().startswith("status:"):
+        status = stripped.split(":", 1)[1].strip()
+if in_question and status.lower() == "open":
+    raise SystemExit(0)
+
+status_index = None
+for line in lines:
+    stripped = line.strip()
+    if not (stripped.startswith("|") and stripped.endswith("|")):
+        status_index = None
+        continue
+    cells = [cell.strip() for cell in stripped.strip("|").split("|")]
+    lowered = [cell.lower() for cell in cells]
+    if status_index is None:
+        status_index = lowered.index("status") if "status" in lowered else None
+        continue
+    if status_index < len(cells) and cells[status_index].lower() == "open":
+        raise SystemExit(0)
+raise SystemExit(1)
+PY
+  then
+    add_problem "final.questions.open" "questions.md contains an open question"
   fi
 fi
 
-# 7: state phase / status
+# Check 7: state phase and status.
 if [ -f "$st" ]; then
   ph="$(python3 "$ROOT/scripts/workflow_schema.py" field "$st" phase 2>/dev/null || true)"
   stt="$(python3 "$ROOT/scripts/workflow_schema.py" field "$st" status 2>/dev/null || true)"
-  if ! python3 "$ROOT/scripts/workflow_schema.py" phase-property "$ph" shippable; then
-    problems+=("state.md Phase='${ph}' (expected a shippable phase)")
+  if ! python3 "$ROOT/scripts/workflow_schema.py" phase-property "$ph" shippable >/dev/null; then
+    add_problem "final.state.phase" "state.md Phase='${ph}' (expected a shippable phase)"
   fi
-  case "$stt" in awaiting_human|blocked) problems+=("state.md Status='${stt}' (not shippable)") ;; esac
+  case "$stt" in
+    awaiting_human|blocked)
+      add_problem "final.state.status" "state.md Status='${stt}' (not shippable)"
+      ;;
+  esac
 else
-  problems+=("state.md missing")
+  add_problem "final.state.missing" "state.md missing"
 fi
 
-# 8: executable acceptance criteria: every spec [ACn] proven + checked in seal
+# Check 8: every spec [ACn] is proven and checked in the seal.
 run_acceptance_check() {
   if [ -n "${DEVRITES_CLI:-}" ]; then
     "$DEVRITES_CLI" check-acceptance "$ws"
@@ -109,13 +159,44 @@ run_acceptance_check() {
   return 127
 }
 
-if ! acout=$(run_acceptance_check 2>&1); then
-  problems+=("acceptance: $(printf '%s' "$acout" | tail -1 | sed 's/^check-acceptance: //')")
+if [ "$acceptance_ready" -eq 1 ] && ! acout=$(run_acceptance_check 2>&1); then
+  add_problem "final.acceptance.ids" \
+    "acceptance: $(printf '%s' "$acout" | tail -1 | sed 's/^check-acceptance: //')"
 fi
 
 slug="$(basename "$ws")"
+if [ "$json" -eq 1 ]; then
+  status="GO"
+  [ "${#problems[@]}" -gt 0 ] && status="NO-GO"
+  pairs=()
+  for ((i = 0; i < ${#problems[@]}; i++)); do
+    pairs+=("${rules[$i]}" "${problems[$i]}")
+  done
+  python3 - "$slug" "$status" "${pairs[@]}" <<'PY'
+import json
+import sys
+
+slug, status, *pairs = sys.argv[1:]
+items = [
+    {"rule_id": pairs[i], "message": pairs[i + 1]}
+    for i in range(0, len(pairs), 2)
+]
+print(json.dumps({
+    "schema": "devrites-outcome-grade/v1",
+    "workspace": slug,
+    "status": status,
+    "rule_ids": [item["rule_id"] for item in items],
+    "problems": items,
+}, separators=(",", ":")))
+PY
+  if [ "${#problems[@]}" -eq 0 ]; then
+    exit 0
+  fi
+  exit 1
+fi
+
 if [ "${#problems[@]}" -eq 0 ]; then
-  printf 'GO    %s: shippable: sealed GO, acceptance proven, no blockers, no open validating gate.\n' "$slug"
+  printf 'GO    %s: shippable: sealed GO, acceptance proven, no blockers, no open question.\n' "$slug"
   exit 0
 fi
 printf 'NO-GO %s: %d blocker(s):\n' "$slug" "${#problems[@]}"

package/scripts/live-hosts/agent-result.schema.json

@@ -0,0 +1,230 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "result_version",
+    "run_id",
+    "cell_id",
+    "host",
+    "role",
+    "status",
+    "baseline_id",
+    "scope_id",
+    "budget",
+    "side_effects",
+    "payload_type",
+    "execution",
+    "signals",
+    "usage",
+    "dispatch_reason_id",
+    "result_reason_id",
+    "outcome",
+    "terminal_sentinel",
+    "host_version",
+    "model"
+  ],
+  "properties": {
+    "result_version": {
+      "const": "agent-result/v1"
+    },
+    "run_id": {
+      "type": "string",
+      "pattern": "^drv-run-v1:[0-9a-f]{32}$"
+    },
+    "cell_id": {
+      "type": "string"
+    },
+    "host": {
+      "enum": [
+        "claude",
+        "codex"
+      ]
+    },
+    "role": {
+      "type": "string"
+    },
+    "status": {
+      "enum": [
+        "complete",
+        "partial",
+        "blocked",
+        "failed"
+      ]
+    },
+    "baseline_id": {
+      "type": "string"
+    },
+    "scope_id": {
+      "type": "string",
+      "pattern": "^[0-9a-f]{64}$"
+    },
+    "budget": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "files_used",
+        "loaded_lines_used",
+        "result_lines_used"
+      ],
+      "properties": {
+        "files_used": {
+          "type": "integer",
+          "minimum": 0
+        },
+        "loaded_lines_used": {
+          "type": "integer",
+          "minimum": 0
+        },
+        "result_lines_used": {
+          "type": "integer",
+          "minimum": 0
+        }
+      }
+    },
+    "side_effects": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "repo_writes",
+        "scratch_write_count"
+      ],
+      "properties": {
+        "repo_writes": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+              "path",
+              "kind",
+              "sha256"
+            ],
+            "properties": {
+              "path": {
+                "type": "string"
+              },
+              "kind": {
+                "enum": [
+                  "file",
+                  "symlink",
+                  "deleted"
+                ]
+              },
+              "sha256": {
+                "type": "string",
+                "pattern": "^[0-9a-f]{64}$"
+              }
+            }
+          }
+        },
+        "scratch_write_count": {
+          "type": "integer",
+          "minimum": 0
+        }
+      }
+    },
+    "payload_type": {
+      "enum": [
+        "review-findings",
+        "wright-report"
+      ]
+    },
+    "execution": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "mode",
+        "guard_strength",
+        "independence"
+      ],
+      "properties": {
+        "mode": {
+          "enum": [
+            "named",
+            "generic",
+            "inline"
+          ]
+        },
+        "guard_strength": {
+          "enum": [
+            "enforced",
+            "observed",
+            "unavailable",
+            "bypassed"
+          ]
+        },
+        "independence": {
+          "type": "boolean"
+        }
+      }
+    },
+    "signals": {
+      "type": "array",
+      "items": {
+        "type": "string"
+      },
+      "uniqueItems": true
+    },
+    "usage": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "input_tokens",
+        "output_tokens",
+        "cost_usd",
+        "cost_provenance"
+      ],
+      "properties": {
+        "input_tokens": {
+          "type": "integer",
+          "minimum": 0
+        },
+        "output_tokens": {
+          "type": "integer",
+          "minimum": 0
+        },
+        "cost_usd": {
+          "type": [
+            "string",
+            "null"
+          ],
+          "pattern": "^[0-9]+(\\.[0-9]+)?$"
+        },
+        "cost_provenance": {
+          "enum": [
+            "provider-reported",
+            "unavailable"
+          ]
+        }
+      }
+    },
+    "dispatch_reason_id": {
+      "type": "string",
+      "pattern": "^DRV-[A-Z0-9-]+$"
+    },
+    "result_reason_id": {
+      "type": "string",
+      "pattern": "^DRV-[A-Z0-9-]+$"
+    },
+    "outcome": {
+      "enum": [
+        "passed",
+        "denied",
+        "unavailable"
+      ]
+    },
+    "terminal_sentinel": {
+      "enum": [
+        "complete",
+        "interrupted"
+      ]
+    },
+    "host_version": {
+      "type": "string"
+    },
+    "model": {
+      "type": "string"
+    }
+  }
+}