dsh-doublecheck 0.5.0 → 0.7.0

package/lib/guard/index.js

@@ -33,10 +33,12 @@ import { emptyDisciplineState, foldDisciplineRange } from "../domain/stages.js";
 import { isVagueTask } from "../domain/vagueness.js";
 import { runAdversaryReview, reviewInjection } from "./review.js";
 import { PROSE } from "./prose.js";
+import { gateHandler, gateInjection, GateConfigSchema, runGate, settleGate, validateGateConfig, } from "./gate.js";
+import { countRedChecks } from "../domain/gate.js";
 import { applyDoublecheckEvent, emptyDoublecheckState, viewDoublecheck, } from "../domain/projection.js";
 import { doublecheckViewSchema } from "../types.js";
 import { installInvariant, PACKAGE_NAME } from "../invariant.js";
-import { doublecheckHandler, effectiveDoublecheckEnabled, hostStampsIgnorable } from "./command.js";
+import { doublecheckHandler, hostStampsIgnorable } from "./command.js";
 export const name = 'doublecheck-guard';
 export const inject = ['commands'];
 export const Config = z.object({
@@ -59,6 +61,7 @@ export const Config = z.object({
     testToolNames: z.array(z.string()).default([...DEFAULT_TEST_TOOL_NAMES]),
     testCommandPatterns: z.array(z.string()).default([...DEFAULT_TEST_COMMAND_PATTERNS]),
     testFilePatterns: z.array(z.string()).default([...DEFAULT_TEST_FILE_PATTERNS]),
+    gate: GateConfigSchema,
 });
 /**
  * Install the guard listeners.
@@ -68,6 +71,7 @@ export const Config = z.object({
 export function apply(ctx, config) {
     assertPositiveInteger('vagueTaskMaxChars', config.vagueTaskMaxChars);
     assertGuardTools(config.guardTools);
+    validateGateConfig(config.gate);
     if (config.modules.adversary) {
         assertBoundedInteger('adversaryMaxFindings', config.adversaryMaxFindings, 20);
         assertPositiveInteger('adversaryTimeoutMs', config.adversaryTimeoutMs);
@@ -91,9 +95,14 @@ export function apply(ctx, config) {
     const pendingReminders = new WeakMap();
     /** Process-local switch overrides written by `/doublecheck on|off` on hosts that cannot store the durable event. */
     const localOverrides = new WeakMap();
-    /** The effective switch for a session: the local override first, then the durable log fold. */
+    /**
+     * The effective switch for a session: the local override first, then the
+     * durable `doublecheck/state` fold, then the configured default. The fold
+     * rides the same incremental snapshot as the discipline facts, so the read
+     * costs O(new events) instead of rescanning the log per tool call.
+     */
     function doublecheckEnabled(session) {
-        return localOverrides.get(session) ?? effectiveDoublecheckEnabled(session.events, config.enableByDefault);
+        return localOverrides.get(session) ?? snapshotOf(session).stateEnabled ?? config.enableByDefault;
     }
     const prose = PROSE[config.language];
     /**
@@ -125,6 +134,9 @@ export function apply(ctx, config) {
                     snapshot.lastReviewSeq = event.seq;
                     snapshot.editsAfterReview = 0;
                 }
+                else if (source.kind === 'doublecheck-gate') {
+                    snapshot.gateRedReminded = true;
+                }
                 else if (source.kind === 'user') {
                     const parts = [];
                     for (const block of event.data.content) {
@@ -138,6 +150,17 @@ export function apply(ctx, config) {
                     }
                 }
             }
+            else if (event.type === 'doublecheck/state') {
+                snapshot.stateEnabled = event.data.enabled;
+            }
+            else if (event.type === 'doublecheck/gate') {
+                const gate = event.data;
+                snapshot.lastGate = {
+                    seq: event.seq,
+                    verdict: gate.verdict,
+                    redCount: gate.phases === undefined ? 0 : countRedChecks(Object.values(gate.phases)),
+                };
+            }
             else if (event.type === 'tool/call' && event.seq > snapshot.lastReviewSeq) {
                 // Implementation edits after the latest review re-arm the adversary
                 // trigger for a second review round.
@@ -165,6 +188,8 @@ export function apply(ctx, config) {
             reportReminded: false,
             lastReviewSeq: -1,
             editsAfterReview: 0,
+            lastGate: null,
+            gateRedReminded: false,
         };
         foldEvents(snapshot, events, 0, events.length);
         snapshots.set(session, snapshot);
@@ -224,12 +249,71 @@ export function apply(ctx, config) {
             config,
             snapshotOf,
             detection,
+            effectiveEnabled: doublecheckEnabled,
             stampsIgnorable: hostStampsIgnorable,
             setLocalOverride: (session, enabled) => localOverrides.set(session, enabled),
         }),
     });
+    // The delivery gate panel: `/gate` stays available even when the gate or
+    // every discipline module is off — it is the user's inspection surface.
+    ctx.commands.register({
+        name: 'gate',
+        description: 'run the delivery quality gate and report the deliverable/rework decision',
+        input: { hint: 'status|run|config' },
+        handler: gateHandler({
+            config: config.gate,
+            detection,
+            prose,
+            runGate: (agent, signal) => runGate(ctx, config.gate, detection, agent, signal, config.language),
+            settleGate: (state, agent, signal) => settleGate(ctx, config.gate, state, agent, signal, hostStampsIgnorable()),
+            stampsIgnorable: hostStampsIgnorable,
+            planMode: ctx.get('planMode'),
+        }),
+    });
+    // The gate settings namespace: the pluggable checklist becomes editable
+    // through the harness settings surface when one is mounted (weak seam —
+    // a profile without the settings service simply has no settings page).
+    const settings = ctx.get('settings');
+    if (settings !== undefined) {
+        try {
+            settings.register('doublecheck.gate', GateConfigSchema, {
+                base: config.gate,
+                applies: 'restart',
+                expose: true,
+            });
+        }
+        catch (error) {
+            ctx.logger.warn(`dsh-doublecheck: gate settings namespace skipped: ${String(error)}`);
+        }
+    }
+    // The gate-red turn notice: once per session, a settled rework verdict
+    // suggests re-opening the work in plan mode. Installed even when every
+    // discipline module is off — the gate panel is advisory, not a gate.
+    if (config.gate.enabled) {
+        ctx.on('agent/turn-stopping', async ({ agent }) => {
+            if (!doublecheckEnabled(agent.session))
+                return;
+            const snapshot = snapshotOf(agent.session);
+            if (snapshot.gateRedReminded)
+                return;
+            const gate = snapshot.lastGate;
+            if (gate === null || gate.verdict !== 'rework')
+                return;
+            snapshot.gateRedReminded = true;
+            const text = prose.gateRedNotice(gate.redCount);
+            agent.inject(gateInjection(gate.verdict, gate.redCount, text));
+            ctx.emit('doublecheck/reminder', {
+                agent,
+                session: agent.session,
+                intensity: config.intensity,
+                gate: 'gate',
+                verdict: 'gate-red',
+                reminder: text,
+            });
+        });
+    }
     if (!config.modules.grill && !config.modules.tdd && !config.modules.adversary) {
-        ctx.logger.info('dsh-doublecheck: all discipline gates disabled; only the /doublecheck command remains active');
+        ctx.logger.info('dsh-doublecheck: all discipline gates disabled; the /doublecheck and /gate commands remain active');
         return;
     }
     // The policy gate. Observe-and-decide: the grill gate owns vague,
@@ -293,11 +377,13 @@ export function apply(ctx, config) {
             }
         }
         // Red gate: implementation edits need a failing test on record. Writing
-        // test files is the red step itself and always delegates.
+        // test files is the red step itself and always delegates, and a call that
+        // names no file at all (a custom guard tool with another argument shape)
+        // is not an implementation edit either.
         if (config.modules.tdd && snapshot.discipline.color !== 'red') {
             const args = exec.arguments;
             const path = mutationTargetPath(exec.name, args, detection);
-            if (path !== undefined && isTestFilePath(path, detection))
+            if (path === undefined || isTestFilePath(path, detection))
                 return next();
             const reminder = nextTddRedReminder(snapshot);
             if (reminder !== undefined)
@@ -445,7 +531,7 @@ export function apply(ctx, config) {
             init: emptyDoublecheckState,
             apply: (state, event) => applyDoublecheckEvent(state, event, detection),
             view: viewDoublecheck,
-            stateVersion: 1,
+            stateVersion: 2,
         });
     });
     // The invariant companion, registered from the main plugin so its checks

package/lib/guard/prose.d.ts

@@ -5,6 +5,12 @@
  * `green gate`) stay English: they are stable session-log ids the durable
  * once-semantics fold matches, and translating them would silently break
  * `remindOnce` after a language switch. Only the model-facing text localizes.
+ *
+ * Scope of localization: every model-visible string the package injects or
+ * answers with (gate prose, the critic task, `/doublecheck` replies, the
+ * switch notice) is localized. The workspace documents (`doublecheck-spec.md`
+ * / `doublecheck-report.md`) keep their English section headings: they are
+ * stable artifacts whose structure other tooling may match.
  * @module dsh-doublecheck/guard/prose
  */
 /** Supported prose languages for guard injections. */
@@ -29,6 +35,64 @@ export interface GuardProse {
     reviewUnavailableNoFindings: string;
     reviewFindingsHeader: (count: number) => string;
     reviewFindingsFooter: string;
+    reviewHeldBack: (held: number) => string;
+    /** The critic's task prompt (model-facing behavior of the review run). */
+    criticTask: string;
+    /** The gate-red notice injected at the turn boundary (role statement first). */
+    gateRedNotice: (redCount: number) => string;
+    /** The localized `/gate status` panel header. */
+    gateStatusHeader: string;
+    /** The localized `/gate status` usage hint. */
+    gateStatusHint: string;
+    /** The localized `/gate config` header. */
+    gateConfigHeader: string;
+    /** The localized `/gate` usage error. */
+    gateCommandUnknown: (input: string) => string;
+    /** The localized `/gate` no-agent error. */
+    gateCommandNoAgent: string;
+    switchOnDurable: string;
+    switchOnLocal: string;
+    switchOffDurable: string;
+    switchOffLocal: string;
+    commandNoAgent: string;
+    commandUnknown: (input: string) => string;
+    commandAlreadyOn: string;
+    commandAlreadyOff: string;
+    commandOnDurable: string;
+    commandOnLocal: string;
+    commandOffDurable: string;
+    commandOffLocal: string;
+    commandStatus: (facts: CommandStatusFacts) => string;
+}
+/** The folded facts the localized `/doublecheck status` reply renders. */
+export interface CommandStatusFacts {
+    /** The effective session switch. */
+    enabled: boolean;
+    /** The configured default for sessions without a state record. */
+    defaultEnabled: boolean;
+    /** Configured module switches. */
+    modules: {
+        grill: boolean;
+        tdd: boolean;
+        adversary: boolean;
+    };
+    /** Configured enforcement strength. */
+    intensity: string;
+    /** Whether reminder repetition is capped per session. */
+    remindOnce: boolean;
+    /** Whether a committed spec exists in the log. */
+    hasSpec: boolean;
+    /** The latest test-run color (`none` / `red` / `green`). */
+    color: string;
+    /** Whether an adversary review record exists in the log. */
+    reviewed: boolean;
+    /** Total implementation edits folded so far. */
+    editCount: number;
+    /** The latest durable gate run, or null before any. */
+    gate: {
+        verdict: string;
+        redCount: number;
+    } | null;
 }
 /** The localized prose tables by language. */
 export declare const PROSE: Readonly<Record<ProseLanguage, GuardProse>>;

package/lib/guard/prose.js

@@ -5,6 +5,12 @@
  * `green gate`) stay English: they are stable session-log ids the durable
  * once-semantics fold matches, and translating them would silently break
  * `remindOnce` after a language switch. Only the model-facing text localizes.
+ *
+ * Scope of localization: every model-visible string the package injects or
+ * answers with (gate prose, the critic task, `/doublecheck` replies, the
+ * switch notice) is localized. The workspace documents (`doublecheck-spec.md`
+ * / `doublecheck-report.md`) keep their English section headings: they are
+ * stable artifacts whose structure other tooling may match.
  * @module dsh-doublecheck/guard/prose
  */
 const EN = {
@@ -55,6 +61,45 @@ const EN = {
     reviewUnavailableNoFindings: 'Adversary review returned no structured findings.',
     reviewFindingsHeader: count => `Adversary review found ${count} objection(s) the delivery must answer:`,
     reviewFindingsFooter: 'Answer each: fix what is real, and state plainly what is false.',
+    reviewHeldBack: held => `… ${held} further objection(s) held back by adversaryMaxFindings`,
+    criticTask: 'You are the delivery reviewer for this software-engineering session. The '
+        + 'conversation you inherited contains a requirements spec recorded with the '
+        + 'doublecheck_spec tool (six dimensions: goal, scope, acceptance criteria, '
+        + 'failure modes, priorities, non-goals), followed by the implementation '
+        + 'work and its test evidence. Assume the delivery FAILS its own spec. Hunt '
+        + 'for the strongest objections you can actually support from this session: '
+        + 'dimensions the work did not meet, acceptance criteria with no evidence, '
+        + 'scope or non-goal violations, failure modes left unhandled. Answer '
+        + 'through the required structured output, one entry per objection, citing '
+        + 'what in the session supports it. If — and only if — the evidence '
+        + 'genuinely satisfies every dimension, return an empty findings list. Do '
+        + 'not invent objections; the empty answer is correct when nothing is wrong.',
+    gateRedNotice: redCount => `You are the delivery gate panel for this session. The latest gate run is RED with ${redCount} red item(s). Re-open the work in plan mode to re-check, or run /gate run for the full checklist.`,
+    gateStatusHeader: 'Delivery gate panel — checklist progress for this session:',
+    gateStatusHint: 'Deterministic phases fold live; the reviewer phases show the latest /gate run. Run /gate run to settle everything; /gate config shows the checklist.',
+    gateConfigHeader: 'Delivery gate configuration for this session:',
+    gateCommandUnknown: input => `Unknown /gate argument "${input}". Usage: /gate status|run|config`,
+    gateCommandNoAgent: '/gate needs an agent session to inspect.',
+    switchOnDurable: 'Double-check discipline was switched ON for this session (changed by the user): the requirements grill, the red/green gates, and the delivery review are active again.',
+    switchOnLocal: 'Double-check discipline was switched ON for this process only (changed by the user; this harness build predates the ignorable append surface, so the switch is not durable): the requirements grill, the red/green gates, and the delivery review are active again.',
+    switchOffDurable: 'Double-check discipline was switched OFF for this session (changed by the user): the discipline gates defer to the human approval chain until switched back on.',
+    switchOffLocal: 'Double-check discipline was switched OFF for this process only (changed by the user; this harness build predates the ignorable append surface, so the switch is not durable): the discipline gates defer to the human approval chain until switched back on.',
+    commandNoAgent: '/doublecheck needs an agent session to inspect.',
+    commandUnknown: input => `Unknown /doublecheck argument "${input}". Usage: /doublecheck status|report|on|off`,
+    commandAlreadyOn: 'Double-check discipline is already ON for this session.',
+    commandAlreadyOff: 'Double-check discipline is already OFF for this session.',
+    commandOnDurable: 'Double-check discipline ON for this session.',
+    commandOnLocal: 'Double-check discipline ON for this process only (not durable on this harness).',
+    commandOffDurable: 'Double-check discipline OFF for this session.',
+    commandOffLocal: 'Double-check discipline OFF for this process only (not durable on this harness).',
+    commandStatus: facts => [
+        `Double-check discipline is ${facts.enabled ? 'ON' : 'OFF'} for this session. (/doublecheck on|off)`,
+        `Modules: grill=${facts.modules.grill ? 'on' : 'off'}, tdd=${facts.modules.tdd ? 'on' : 'off'}, adversary=${facts.modules.adversary ? 'on' : 'off'} (cordis.yml).`,
+        `Intensity: ${facts.intensity}. Default switch: ${facts.defaultEnabled ? 'on' : 'off'}. remindOnce: ${facts.remindOnce ? 'on' : 'off'}.`,
+        `Stage: spec=${facts.hasSpec ? 'committed' : 'missing'}, tests=${facts.color}, review=${facts.reviewed ? 'on record' : 'not run'}, edits=${facts.editCount}.`,
+        `Gate: ${facts.gate === null ? 'not run' : `${facts.gate.verdict} (${facts.gate.redCount} red item(s))`} (/gate status|run|config).`,
+        `Usage: /doublecheck status|report|on|off`,
+    ].join('\n'),
 };
 const ZH = {
     grillReminder: '交付前三查：这个任务描述很简短，本会话还没有记录 doublecheck spec。先停下编辑，把六个需求维度确认清楚——目标、范围、验收标准、失败模式、优先级、非目标。按 grill-requirements 技能执行：用 ask_user_question 向用户提问直到达成共识，用 doublecheck_spec 记录结果，然后再继续编辑。',
@@ -75,6 +120,40 @@ const ZH = {
     reviewUnavailableNoFindings: '对抗式审查没有返回结构化发现。',
     reviewFindingsHeader: count => `对抗式审查发现 ${count} 条反对意见，交付必须回应：`,
     reviewFindingsFooter: '逐条回应：属实的修掉，不属实的明确说明。',
+    reviewHeldBack: held => `… 另有 ${held} 条反对意见因 adversaryMaxFindings 上限被保留`,
+    criticTask: '你是本次软件工程会话的交付审查者。你继承的会话里包含一份通过 '
+        + 'doublecheck_spec 工具记录的需求 spec（六个维度：目标、范围、验收标准、'
+        + '失败模式、优先级、非目标），其后是实现工作和测试证据。假设交付不满足自己的 '
+        + 'spec。寻找你能从本会话证据中真正支撑的最强反对意见：未达到的维度、没有证据的'
+        + '验收标准、范围或非目标被违反、未处理的失败模式。通过要求的结构化输出作答，'
+        + '每条反对意见占一项，并引用会话中支撑它的内容。当且仅当证据确实满足每一个维度时，'
+        + '才返回空的 findings 列表。不要编造反对意见；没有问题时空答案才是正确的。',
+    gateRedNotice: redCount => `你是本会话的交付门禁面板。最近一次门禁结论为红灯，共 ${redCount} 项红灯。建议转 plan mode 复查，或运行 /gate run 查看完整检查单。`,
+    gateStatusHeader: '交付门禁面板 — 本会话的检查单进度：',
+    gateStatusHint: '确定性阶段实时折叠；评审类阶段显示最近一次 /gate run 的结果。运行 /gate run 结算全部检查；/gate config 查看检查单配置。',
+    gateConfigHeader: '本会话的交付门禁配置：',
+    gateCommandUnknown: input => `未知的 /gate 参数 "${input}"。用法：/gate status|run|config`,
+    gateCommandNoAgent: '/gate 需要代理会话才能查看。',
+    switchOnDurable: 'Double-check 纪律已对本会话开启（由用户切换）：需求盘问、红绿门和交付审查恢复生效。',
+    switchOnLocal: 'Double-check 纪律已对本进程开启（由用户切换；此 harness 版本早于 ignorable 追加接口，切换不持久）：需求盘问、红绿门和交付审查恢复生效。',
+    switchOffDurable: 'Double-check 纪律已对本会话关闭（由用户切换）：在重新开启之前，纪律门让位于人工审批链。',
+    switchOffLocal: 'Double-check 纪律已对本进程关闭（由用户切换；此 harness 版本早于 ignorable 追加接口，切换不持久）：在重新开启之前，纪律门让位于人工审批链。',
+    commandNoAgent: '/doublecheck 需要代理会话才能查看。',
+    commandUnknown: input => `未知的 /doublecheck 参数 "${input}"。用法：/doublecheck status|report|on|off`,
+    commandAlreadyOn: '本会话的 Double-check 纪律已经是开启状态。',
+    commandAlreadyOff: '本会话的 Double-check 纪律已经是关闭状态。',
+    commandOnDurable: 'Double-check 纪律已对本会话开启。',
+    commandOnLocal: 'Double-check 纪律已对本进程开启（此 harness 上不持久）。',
+    commandOffDurable: 'Double-check 纪律已对本会话关闭。',
+    commandOffLocal: 'Double-check 纪律已对本进程关闭（此 harness 上不持久）。',
+    commandStatus: facts => [
+        `本会话的 Double-check 纪律：${facts.enabled ? '已开启' : '已关闭'}。(/doublecheck on|off)`,
+        `模块：grill=${facts.modules.grill ? '开' : '关'}, tdd=${facts.modules.tdd ? '开' : '关'}, adversary=${facts.modules.adversary ? '开' : '关'}（cordis.yml）。`,
+        `强度：${facts.intensity}。默认开关：${facts.defaultEnabled ? '开' : '关'}。remindOnce：${facts.remindOnce ? '开' : '关'}。`,
+        `阶段：spec=${facts.hasSpec ? '已提交' : '缺失'}, tests=${facts.color}, review=${facts.reviewed ? '有记录' : '未运行'}, edits=${facts.editCount}。`,
+        `门禁：${facts.gate === null ? '未运行' : `${facts.gate.verdict}（${facts.gate.redCount} 项红灯）`}（/gate status|run|config）。`,
+        '用法：/doublecheck status|report|on|off',
+    ].join('\n'),
 };
 /** The localized prose tables by language. */
 export const PROSE = { en: EN, zh: ZH };

package/lib/guard/review.d.ts

@@ -42,6 +42,14 @@ export interface ReviewOutcome {
 export declare const REVIEW_OUTPUT_SCHEMA: ObjectJsonSchema;
 /** Injected when the critic found nothing supportable (English contract text). */
 export declare const CLEAN_TEXT: string;
+/**
+ * Sort findings blocker-first, keeping the critic's original order within a
+ * severity. A deterministic order means the most threatening objection leads
+ * both the injected prose and the durable record.
+ * @param findings - the structured findings as produced by the critic.
+ * @returns the same findings, severity-ordered.
+ */
+export declare function sortFindings(findings: readonly ReviewFinding[]): ReviewFinding[];
 /** Render structured findings as the model-facing review text. */
 export declare function renderFindings(findings: readonly ReviewFinding[], prose?: GuardProse, totalCount?: number): string;
 /**

package/lib/guard/review.js

@@ -41,25 +41,25 @@ export const REVIEW_OUTPUT_SCHEMA = {
         },
     },
 };
-/**
- * The critic's task, delivered as the forked child's user message. The child
- * already holds the parent history; this prompt only sets the adversarial
- * stance and the answer discipline.
- */
-const CRITIC_TASK = 'You are the delivery reviewer for this software-engineering session. The '
-    + 'conversation you inherited contains a requirements spec recorded with the '
-    + 'doublecheck_spec tool (six dimensions: goal, scope, acceptance criteria, '
-    + 'failure modes, priorities, non-goals), followed by the implementation '
-    + 'work and its test evidence. Assume the delivery FAILS its own spec. Hunt '
-    + 'for the strongest objections you can actually support from this session: '
-    + 'dimensions the work did not meet, acceptance criteria with no evidence, '
-    + 'scope or non-goal violations, failure modes left unhandled. Answer '
-    + 'through the required structured output, one entry per objection, citing '
-    + 'what in the session supports it. If — and only if — the evidence '
-    + 'genuinely satisfies every dimension, return an empty findings list. Do '
-    + 'not invent objections; the empty answer is correct when nothing is wrong.';
 /** Injected when the critic found nothing supportable (English contract text). */
 export const CLEAN_TEXT = PROSE.en.reviewClean;
+/** Severity ranks for a deterministic, blocker-first findings order. */
+const SEVERITY_RANK = {
+    blocker: 0,
+    major: 1,
+    minor: 2,
+    info: 3,
+};
+/**
+ * Sort findings blocker-first, keeping the critic's original order within a
+ * severity. A deterministic order means the most threatening objection leads
+ * both the injected prose and the durable record.
+ * @param findings - the structured findings as produced by the critic.
+ * @returns the same findings, severity-ordered.
+ */
+export function sortFindings(findings) {
+    return [...findings].sort((a, b) => SEVERITY_RANK[a.severity] - SEVERITY_RANK[b.severity]);
+}
 /** Render structured findings as the model-facing review text. */
 export function renderFindings(findings, prose = PROSE.en, totalCount = findings.length) {
     const lines = [
@@ -71,7 +71,7 @@ export function renderFindings(findings, prose = PROSE.en, totalCount = findings
         lines.push(`  ${finding.detail}`);
     }
     if (totalCount > findings.length) {
-        lines.push(`… ${totalCount - findings.length} further objection(s) held back by adversaryMaxFindings`);
+        lines.push(prose.reviewHeldBack(totalCount - findings.length));
     }
     lines.push('', prose.reviewFindingsFooter);
     return lines.join('\n');
@@ -101,7 +101,7 @@ export async function runAdversaryReview(ctx, config, agent, turnSignal) {
     try {
         run = await subagents.start(config.adversaryProvider, {
             label: 'doublecheck-adversary',
-            prompt: [{ type: 'text', text: CRITIC_TASK }],
+            prompt: [{ type: 'text', text: prose.criticTask }],
             parent: agent,
             signal,
             ...config.adversaryModel !== null ? { agentOptions: { model: config.adversaryModel } } : {},
@@ -149,7 +149,7 @@ async function settleResult(run, signal, prose, maxFindings) {
     if (!Array.isArray(raw)) {
         return { verdict: 'unavailable', findings: [], text: outputText(result.output, prose.reviewUnavailableNoFindings) };
     }
-    const findings = raw.slice(0, maxFindings);
+    const findings = sortFindings(raw).slice(0, maxFindings);
     if (findings.length === 0)
         return { verdict: 'clean', findings: [], text: prose.reviewClean };
     return { verdict: 'findings', findings, text: renderFindings(findings, prose, raw.length) };

package/lib/index.d.ts

@@ -12,6 +12,7 @@ export * from './domain/evidence.ts';
 export * from './domain/vagueness.ts';
 export * from './domain/vocabulary.ts';
 export * from './domain/report.ts';
+export * from './domain/gate.ts';
 export { renderSpecMarkdown } from './grill/index.ts';
 export { BundledSkillProvider, parseSkillAsset, PROVIDER_NAME } from './grill/provider.ts';
 export type * from './types.ts';

package/lib/index.js

@@ -11,5 +11,6 @@ export * from "./domain/evidence.js";
 export * from "./domain/vagueness.js";
 export * from "./domain/vocabulary.js";
 export * from "./domain/report.js";
+export * from "./domain/gate.js";
 export { renderSpecMarkdown } from "./grill/index.js";
 export { BundledSkillProvider, parseSkillAsset, PROVIDER_NAME } from "./grill/provider.js";

package/lib/invariant.d.ts

@@ -14,6 +14,8 @@
  *    the tool result, not this event, so equality is not checkable there).
  * 3. Every `doublecheck/review` announcement's findings satisfy the
  *    structured finding shape (severity enum, non-empty title and detail).
+ * 4. Every `doublecheck/gate` announcement's verdict matches the re-derivation
+ *    from its own phase results, and all four phases are present.
  *
  * The guard registers a facts-bearing installer from its own context; the
  * `./invariant` export is the standalone companion usable through a separate

package/lib/invariant.js

@@ -14,13 +14,17 @@
  *    the tool result, not this event, so equality is not checkable there).
  * 3. Every `doublecheck/review` announcement's findings satisfy the
  *    structured finding shape (severity enum, non-empty title and detail).
+ * 4. Every `doublecheck/gate` announcement's verdict matches the re-derivation
+ *    from its own phase results, and all four phases are present.
  *
  * The guard registers a facts-bearing installer from its own context; the
  * `./invariant` export is the standalone companion usable through a separate
  * profile row.
  * @module dsh-doublecheck/invariant
  */
+import { SPEC_FIELD_NAMES } from "./domain/vocabulary.js";
 import { deriveReportVerdict, foldReportFacts } from "./domain/report.js";
+import { deriveGateVerdict, GATE_PHASES } from "./domain/gate.js";
 /** Full npm package name owning the reported failures. */
 export const PACKAGE_NAME = 'dsh-doublecheck';
 /** Cordis companion plugin name. */
@@ -28,9 +32,7 @@ export const name = 'dsh-doublecheck-invariant';
 /** Service required before the companion can reserve package ownership. */
 export const inject = ['invariants'];
 /** All six spec fields, in declaration order. */
-const SPEC_FIELDS = [
-    'goal', 'scope', 'acceptanceCriteria', 'failureModes', 'priorities', 'nonGoals',
-];
+const SPEC_FIELDS = SPEC_FIELD_NAMES;
 /**
  * Build the installer over a facts source. The standalone companion and the
  * main plugin share this body; only the facts differ.
@@ -81,6 +83,18 @@ export function installInvariant(facts) {
                 }
             }
         });
+        ctx.on('doublecheck/gate', (payload) => {
+            const state = payload.state;
+            const derived = deriveGateVerdict(GATE_PHASES.map(phase => state.phases[phase]).filter(phase => phase !== undefined));
+            if (derived !== state.verdict) {
+                fail(`doublecheck/gate announces verdict "${state.verdict}" but its phases derive "${derived}"`);
+            }
+            for (const phase of GATE_PHASES) {
+                if (state.phases[phase] === undefined) {
+                    fail(`doublecheck/gate carries no "${phase}" phase result`);
+                }
+            }
+        });
     };
 }
 /**

package/lib/types.d.ts

@@ -8,6 +8,7 @@
  */
 import { z as zod } from 'zod';
 import type { DisciplineStage, TestColor } from './domain/stages.ts';
+import type { GateVerdict } from './domain/gate.ts';
 /** The whole wire value of the `doublecheck` session projection. */
 export interface DoublecheckView {
     /** The last discipline stage reached on durable evidence. */
@@ -22,6 +23,10 @@ export interface DoublecheckView {
     reviewed: boolean;
     /** Total implementation edits folded so far. */
     editCount: number;
+    /** The latest delivery-gate verdict, or 'none' before any gate run. */
+    gateVerdict: 'none' | GateVerdict;
+    /** Red-light (failing) checks of the latest gate run. */
+    gateRedCount: number;
 }
 /** Validates the `doublecheck` projection's wire payload before it leaves the host. */
 export declare const doublecheckViewSchema: zod.ZodObject<{
@@ -31,6 +36,8 @@ export declare const doublecheckViewSchema: zod.ZodObject<{
     specGoal: zod.ZodString;
     reviewed: zod.ZodBoolean;
     editCount: zod.ZodNumber;
+    gateVerdict: zod.ZodUnion<readonly [zod.ZodLiteral<"none">, zod.ZodLiteral<"deliverable">, zod.ZodLiteral<"rework">]>;
+    gateRedCount: zod.ZodNumber;
 }, zod.core.$strip>;
 declare module '@deepseek-ai/dsh-session-projection/types' {
     interface SessionProjectionMap {

package/lib/types.js

@@ -15,4 +15,6 @@ export const doublecheckViewSchema = zod.object({
     specGoal: zod.string(),
     reviewed: zod.boolean(),
     editCount: zod.number(),
+    gateVerdict: zod.union([zod.literal('none'), zod.literal('deliverable'), zod.literal('rework')]),
+    gateRedCount: zod.number(),
 });