dsh-doublecheck 0.6.0 → 0.7.0

package/README.md

@@ -1,14 +1,15 @@
 # dsh-doublecheck
 
-> **Double-check before you ship: grill the requirements, test the implementation, prove the delivery.**
+> **The delivery quality gate for DeepSeek Harness: grill the requirements, test the implementation, prove the delivery — then gate the handoff with a deliverable/rework decision.**
 
-[![version](https://img.shields.io/badge/version-0.6.0-blue)](https://github.com/PerryLink/dsh-doublecheck/releases)
+[![version](https://img.shields.io/badge/version-0.7.0-blue)](https://github.com/PerryLink/dsh-doublecheck/releases)
 [![npm](https://img.shields.io/npm/v/dsh-doublecheck)](https://www.npmjs.com/package/dsh-doublecheck)
+[![downloads](https://img.shields.io/npm/dw/dsh-doublecheck)](https://www.npmjs.com/package/dsh-doublecheck)
 [![license](https://img.shields.io/badge/license-Apache--2.0-blue)](LICENSE)
 [![topics](https://img.shields.io/badge/topics-dsh%20%7C%20dsh--plugin-22c55e)](https://github.com/topics/dsh-plugin)
 [![CI](https://img.shields.io/github/actions/workflow/status/PerryLink/dsh-doublecheck/ci.yml?branch=main)](https://github.com/PerryLink/dsh-doublecheck/actions/workflows/ci.yml)
 
-An **engineering-discipline bundle** for [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness). Agents love to start coding; requirements hate being assumed. `dsh-doublecheck` installs a discipline loop that makes the agent **grill the requirements before the first edit, and prove the delivery instead of claiming it** — re-implemented natively on DSH's own extension points (skill registry, tool policy pipeline, approval seam, subagent and workflow seams, session log), not on borrowed prompt files. Tested against DSH `0.1.0-rc.6`.
+An **engineering-discipline bundle and delivery quality gate panel** for [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness). Agents love to start coding; requirements hate being assumed. `dsh-doublecheck` installs a discipline loop that makes the agent **grill the requirements before the first edit, and prove the delivery instead of claiming it** — and a **delivery gate panel** that aggregates requirement interrogation, test evidence, diff↔requirement consistency, and a review conclusion into one **deliverable / rework required** decision, rendered as a PR-ready markdown report. Re-implemented natively on DSH's own extension points (skill registry, tool policy pipeline, approval seam, subagent and workflow seams, commands, session projections, settings namespace, plan mode), not on borrowed prompt files. Tested against DSH `0.1.0-rc.6`.
 
 The methodology is inspired by [obra/superpowers](https://github.com/obra/superpowers) and [TimothyVang/Grill-me](https://github.com/TimothyVang/Grill-me). Every prompt, term, example, and file in this package is written from scratch — nothing is copied from either project.
 
@@ -16,6 +17,7 @@ The methodology is inspired by [obra/superpowers](https://github.com/obra/superp
 
 - Vague tasks produce wrong software. A brief request ("帮我做一个功能") hides six unsettled decisions; the agent currently guesses all of them and charges you for the guess.
 - Disciplined teams do this in humans: requirements review → failing test → passing test → self-review → delivery proof. Agents deserve the same loop, enforced by the harness, not by vibes.
+- Shipping needs a decision, not a vibe. The delivery gate turns the loop's evidence into a single **deliverable / rework required** verdict with red items and rework suggestions — the panel an evaluation platform pastes into its PR description.
 
 ## The discipline loop
 
@@ -37,23 +39,105 @@ grill ──▶ design ──▶ red ──▶ green ──▶ review ──▶
 | **review** | A forked adversary critic audits the delivery against the spec. | ✅ v0.3 |
 | **verify** | `doublecheck_report` + a per-dimension verification workflow prove the delivery. | ✅ v0.4 |
 
+## The delivery gate (v0.7)
+
+The gate is the **productized front end of the loop**: it aggregates the session's durable evidence into a configurable four-phase checklist and outputs one binary decision. Every phase folds the session log alone (replay IS the state), so a gate run re-derives identically after resume or fork.
+
+```mermaid
+flowchart TD
+    A["/gate run"] --> B["1. Requirements interrogation"]
+    B --> C["2. Test evidence"]
+    C --> D["3. Implementation consistency"]
+    D --> E["4. Review conclusion"]
+    E --> F{"any red item?"}
+    F -- yes --> G["VERDICT: rework required"]
+    F -- no --> H["VERDICT: deliverable"]
+    G --> I["suggest plan-mode re-check + /gate run again"]
+    H --> J["paste the report into the PR description"]
+```
+
+| Phase | Checks | Evidence source | Model cost |
+|---|---|---|---|
+| **Requirements interrogation** | Configurable key-question checklist, confirmed item by item (six spec-dimension questions by default). | Committed `doublecheck_spec` + `ask_user_question` calls. | none |
+| **Test evidence** | Latest run color, failing runs after green, optional coverage threshold. | Shell test runs in the session log (`[exit code: N]`, coverage percentages). | none |
+| **Implementation consistency** | Diff ↔ requirement mapping: every edit must serve a spec dimension. | Local forked reviewer (structured findings, read-only tools). | one subagent |
+| **Review conclusion** | The delivery verdict. `engine: auto` consumes **dsh-auto-review**'s durable verdict records when present and degrades to the local reviewer otherwise; `engine: local` always uses the local reviewer. | `autoReview/verdict` / `autoReview/rejection` events, or the local forked reviewer. | one subagent (local) |
+
+- **Red lights** are failed checks: a missing spec, a failing latest test run, coverage below the minimum, an unmapped edit, a rejected engine call, blocker/major review findings. Each red item carries a rework suggestion.
+- **Warnings and skips never flip the decision**: a skipped review keeps the report honest ("not reviewed") without inventing a red light — fail-closed for claims, never for evidence.
+- **Plan mode & approvals**: a rework verdict suggests re-opening the work in plan mode (in the report banner, the `/gate status` panel, and the once-per-session turn notice). The discipline gates below keep their `warn`/`block` approval-chain enforcement; the gate itself is advisory.
+- **Audit-safe by construction**: reports record counts, ids, and verdicts only — no file contents or session text. Model-produced finding texts pass a secret redactor (cloud keys, tokens, private-key blocks, password assignments, long hex/base64 runs) before they are stored or shown. The settled state rides the durable `doublecheck/gate` session event and the workspace `gate-report.md`.
+
+### Example report
+
+`/gate run` returns this markdown — paste it into a PR description:
+
+````markdown
+# Delivery gate report
+
+> **Verdict: rework required** — 2 red item(s)
+> The gate is red. Re-open the work in plan mode to re-check the open items before delivering.
+
+## 1. Requirements interrogation — PASS
+- [✔] **What outcome must the delivery produce?** — spec dimension "goal" committed
+- [✔] **What is in scope, and what is out of scope?** — spec dimension "scope" committed
+- [✔] **Which observable checks prove the work is done?** — spec dimension "acceptanceCriteria" committed
+- [✔] **What can go wrong, and what is the correct behavior in each case?** — spec dimension "failureModes" committed
+- [✔] **What is traded when goals conflict; what is optional?** — spec dimension "priorities" committed
+- [✔] **What does the user explicitly not want?** — spec dimension "nonGoals" committed
+
+## 2. Test evidence — FAIL
+- [✔] **passing test run** — latest test run passed
+- [✔] **failing cases after green** — 0 failing run(s) after green (allowed: 0)
+- [✖] **coverage evidence** — 61% coverage below the 80% minimum — rework: raise coverage above the configured minimum
+
+## 3. Implementation consistency — WARN
+- [⚠] **[minor] src/telemetry.ts touched without a requirement** — [minor] the edit adds a metric no spec dimension covers
+
+## 4. Review conclusion — PASS
+- [✔] **dsh-auto-review conclusion** — 3 call(s) approved by dsh-auto-review (latest risk: low)
+
+## Red items
+1. **tests/coverage** — 61% coverage below the 80% minimum — *rework: raise coverage above the configured minimum*
+2. **consistency/finding-1** — [minor] the edit adds a metric no spec dimension covers — *rework: src/telemetry.ts touched without a requirement*
+
+## Audit
+- review engine: dsh-auto-review
+- generated at: 2026-08-14T12:00:00.000Z
+- counts, ids, and verdicts only: no file contents or session text are embedded, and recognized secrets are redacted.
+````
+
+### Weak dependency on dsh-auto-review
+
+The gate integrates with [dsh-auto-review](https://github.com/PerryLink/dsh-auto-review) as **"use the engine when it is there"**, never as a hard dependency:
+
+- `review.engine: auto` (default) folds the engine's durable verdict records (`autoReview/verdict` / `autoReview/rejection`) from the session log — the engine's real conclusions about this session's approval-chain reviews. Rejected or high-risk calls become red items.
+- No records (the engine is not installed, or nothing triggered it this session) → the phase degrades to the local forked reviewer and names the reason on a warning check: `dsh-auto-review is not installed` / `dsh-auto-review is installed but has no verdict records in this session`.
+- The gate **never synthesizes approval requests**: that chain may reach a human. The engine's own records are the evidence; `engine: local` skips it entirely.
+
+### Settings surface
+
+The pluggable checklist is Schema-validated config (`gate.*` in the guard row) and is additionally registered as the **`doublecheck.gate` settings namespace** (`expose: true`, `applies: restart`) when the harness settings service is mounted — so settings-capable UIs can read and edit the checklist without hand-editing a profile.
+
 ## Features
 
 - 🔥 **`grill-requirements` skill** — a bundled Agent-Skills-format skill that interrogates the task across six dimensions (**goal, scope, acceptance criteria, failure modes, priorities, non-goals**) using DSH's native `ask_user_question` UI, refuses to write code until consensus, and records the contract.
-- 🧰 **Stage skills for the whole loop** — `red-green-tdd` (write the failing test, run red, implement, run green), `delivery-review` (adversarial self-review against the spec once green), and `delivery-proof` (consolidate the evidence into the delivery report before claiming completion) join `grill-requirements`, so all six stages have model guidance, not just the first.
+- 🧰 **Stage skills for the whole loop** — `red-green-tdd` (write the failing test, run red, implement, run green), `delivery-review` (adversarial self-review against the spec once green), and `delivery-proof` (consolidate the evidence into the delivery report and pass the delivery gate before claiming completion) join `grill-requirements`, so all six stages have model guidance, not just the first.
 - 📜 **`doublecheck_spec` tool** — commits the grilled spec to the session log and writes a markdown copy to the workspace, so the contract survives the conversation. Empty or whitespace-only dimensions are rejected at the commit (v0.6): the grill must settle all six before the spec counts.
 - 🔄 **Task-change re-grill** — a committed spec covers its own task: a new direct-user request after the latest spec commit reopens the grill gate for that follow-up instead of silently inheriting the old contract.
 - 🛡️ **Discipline guard** — a soft gate on the tool policy pipeline. Vague task + no spec + heading for `edit`/`write` → **remind**, **hold for human approval**, or **block**, depending on `intensity`.
 - 🟥🟩 **Red/green evidence gates** (`modules.tdd`) — hard checks over the session log: an implementation edit requires a **failing test run on record** since the last passing run (writing test files is always allowed — that is how the red step happens), and a turn that ends with edits but no passing run gets a green reminder injected. Custom guard tools work out of the box: the gates read both `file_path` and `path` argument keys, and a call that names no file at all is not treated as an implementation edit.
 - 👁️ **Adversary review** (`modules.adversary`) — once the delivery reaches green, a forked critic subagent (DSH's native subagent seam, default `fork` provider) audits the session against the committed spec with an adversarial stance and returns structured findings, sorted blocker-first. `remind` injects the critique; `warn`/`block` additionally steer one round to make the model answer the findings. `adversaryModel` routes the critic to a separate model; the critic's tool allowlist is read-only by default. Findings ride the durable `doublecheck-review` message source. The review re-arms after the critic settles: implementation edits after the latest review record trigger another round, and cancelling the turn aborts the in-flight critic.
-- 🌐 **Fully localized model surface** — every model-visible string the package injects or answers with (reminders, deny/ask feedback, review steering, switch notices, `/doublecheck` replies, and the critic's task prompt) honors `language: 'en' | 'zh'`; the workspace spec/report documents keep their stable English headings.
+- 🚦 **Delivery quality gate** (v0.7) — the configurable four-phase checklist above: requirements interrogation (key questions confirmed item by item), test evidence (run color, failing cases, coverage threshold), implementation consistency (diff ↔ requirement mapping by a local reviewer), and the review conclusion (dsh-auto-review verdict records with an honest local degrade). One **deliverable / rework required** decision, red items with rework suggestions, a plan-mode re-check suggestion on red, a turn-boundary red notice (short, once per session), and the PR-ready markdown report.
+- ⌨️ **`/gate` session command** — `status` renders the live checklist progress (deterministic phases fold on the spot; reviewer phases show the latest run), `run` settles the full gate and returns the report, `config` renders the effective checklist and thresholds.
+- 🌐 **Fully localized model surface** — every model-visible string the package injects or answers with (reminders, deny/ask feedback, review steering, gate notices, switch notices, `/doublecheck` and `/gate` replies, and the reviewer task prompts) honors `language: 'en' | 'zh'`; the workspace spec/report/gate documents keep their stable English headings and audit ids.
 - 📊 **Doublecheck report + verification workflow** (`doublecheck_report`, v0.4) — consolidates the session's discipline evidence (spec, red/green timeline, review findings, edits) into a delivery report with a derived verdict (`grill → draft → red → green → objections/verified → proven/challenged/unverified`), written to the workspace. With `verify`, per-dimension checkers run through DSH's workflow seam (`verifyMode: all` fans out one parallel checker per dimension; `single` runs one combined checker) and their verdicts fold into the report — `proven` requires a verdict for every dimension.
 - 🚦 **Delivery gate** — at the turn boundary, a delivery that reached green with no `doublecheck_report` on record gets a report-expected reminder before completion claims; a successful report advances the stage fold to `verify`.
-- 🔁 **Durable state** — every model-visible artifact (spec, reminders, deny feedback, review findings, the `/doublecheck on|off` switch) lands in the session log; gate decisions derive from the log alone (`tool/call` + `tool/result`, including Code Mode sub-dispatches), so resumed and forked sessions enforce identically. `remindOnce` is durable too: a session that already received a reminder never gets it twice, even after a restart. The switch fold rides an incremental snapshot, so long sessions stay O(new events) per tool call.
-- ⌨️ **`/doublecheck` session command** — `status` reports the effective switch, the configured modules, the enforcement intensity, and the folded stage facts (spec, test color, review, edit count); `report` folds the delivery report on the spot; `on|off` writes the durable `doublecheck/state` override and injects a switch notice.
+- 🔁 **Durable state** — every model-visible artifact (spec, reminders, deny feedback, review findings, gate runs, the `/doublecheck on|off` switch) lands in the session log; gate decisions derive from the log alone (`tool/call` + `tool/result`, including Code Mode sub-dispatches), so resumed and forked sessions enforce identically. `remindOnce` is durable too: a session that already received a reminder never gets it twice, even after a restart. The switch fold rides an incremental snapshot, so long sessions stay O(new events) per tool call.
+- ⌨️ **`/doublecheck` session command** — `status` reports the effective switch, the configured modules, the enforcement intensity, the folded stage facts, and the latest gate verdict; `report` folds the delivery report on the spot; `on|off` writes the durable `doublecheck/state` override and injects a switch notice.
 - 📚 **`doublecheck_skills` tool** — lists and loads the package's skills through the official skill registry seam.
-- 🔒 **Strict overlay** — `strict.patch.yml` turns every gate on at `block` intensity in one patch layer (ships with the package).
-- 🧩 **Standalone invariant companion** — the `dsh-doublecheck/invariant` row is a real subpath export: it reports package-owned write-path contradictions (spec/report/review shape) through the host `invariants` registry without loading the guard.
+- 🔒 **Strict overlay** — `strict.patch.yml` turns every gate on at `block` intensity and enables the coverage requirement (80%) in one patch layer (ships with the package).
+- 🧩 **Standalone invariant companion** — the `dsh-doublecheck/invariant` row is a real subpath export: it reports package-owned write-path contradictions (spec/report/review/gate shape and verdict consistency) through the host `invariants` registry without loading the guard.
 
 ## Demo
 
@@ -69,6 +153,7 @@ dsh --profile demo headless "把这个项目里最慢的代码直接改快，别
 3. Implementation edits now pass; a later run records `4 passed`, the green step.
 4. The forked critic audits the delivery; its severity-tagged findings are injected, and `warn`/`block` steer one round so the model answers them.
 5. `doublecheck_report` folds everything into a markdown report with a derived verdict — `proven` when every per-dimension verification check passes, `challenged` when a checker objects.
+6. **`/gate run`** settles the four-phase checklist into the **deliverable / rework required** decision; a red verdict lists the red items with rework suggestions and suggests a plan-mode re-check.
 
 ## Install
 
@@ -81,16 +166,16 @@ Both plugin rows activate automatically with the profile. Tarball installs work
 
 ```sh
 pnpm pack
-dsh plugin --profile <name> add ./dsh-doublecheck-0.6.0.tgz
+dsh plugin --profile <name> add ./dsh-doublecheck-0.7.0.tgz
 ```
 
 Git installs need no npm:
 
 ```sh
-dsh plugin --profile <name> add "github:PerryLink/dsh-doublecheck#v0.6.0"
+dsh plugin --profile <name> add "github:PerryLink/dsh-doublecheck#v0.7.0"
 ```
 
-For a zero-configuration strict mode (every gate on, `block` intensity), apply the shipped overlay on top of the bundle patch:
+For a zero-configuration strict mode (every gate on, `block` intensity, gate coverage required), apply the shipped overlay on top of the bundle patch:
 
 ```sh
 dsh --profile <name> --patch ./node_modules/dsh-doublecheck/strict.patch.yml
@@ -107,14 +192,16 @@ To keep the package installed but disable one row, override it by id with `disab
 ## Compatibility
 
 - Verified against the `0.1.0-rc.6` peers (`@deepseek-ai/cordis ^4.0.1`); last verified 2026-08-14 on Windows with Node 22.
-- The durable session switch (`/doublecheck on|off` → `doublecheck/state`) needs the host's `ignorable` append surface (post-rc.6 harness): on rc.6 hosts the options bag is ignored and the event stays required-on-read, so prefer in-memory switching there until the harness is upgraded.
+- The durable session writes (`/doublecheck on|off` → `doublecheck/state`, `/gate run` → `doublecheck/gate`) need the host's `ignorable` append surface (post-rc.6 harness): on rc.6 hosts the options bag is ignored and the event stays required-on-read, so the switch stays in-memory and the gate record lives in the command result + workspace file only, until the harness is upgraded.
+- The `doublecheck.gate` settings namespace registers only when the harness settings service is mounted; profiles without it simply have no settings surface.
+- The `plan mode:` line of `/gate status` reads the optional `ctx.planMode` service; profiles without it show `unknown`.
 
 ## Permissions & data
 
-- **Reads**: the session log (`tool/call` / `tool/result` / `tool/code-dispatch` and injected `user/message` sources) in-process only.
-- **Writes**: `doublecheck-spec.md` and `doublecheck-report.md` in the session workspace (paths configurable), through the `ctx.fs` seam.
-- **Model calls**: only the optional adversary review (`modules.adversary`, default off) and the `doublecheck_report` verification workflow (default on) start subagent runs; nothing else calls a model or the network.
-- **Never touched**: credentials, environment variables, or any file outside the session workspace.
+- **Reads**: the session log (`tool/call` / `tool/result` / `tool/code-dispatch`, injected `user/message` sources, and the foreign `autoReview/*` verdict records) in-process only; the optional plan-mode service state.
+- **Writes**: `doublecheck-spec.md`, `doublecheck-report.md`, and `gate-report.md` in the session workspace (paths configurable), through the `ctx.fs` seam; the durable `doublecheck/state` and `doublecheck/gate` session events.
+- **Model calls**: the gate's consistency and local-review phases (one subagent each per `/gate run`), the optional adversary review (`modules.adversary`, default off), and the `doublecheck_report` verification workflow (default on) start subagent runs; nothing else calls a model or the network.
+- **Never touched**: credentials, environment variables, or any file outside the session workspace. Gate reports contain counts, ids, and verdicts only; recognized secrets in reviewer texts are redacted before storage or display.
 
 ## Troubleshooting
 
@@ -125,6 +212,10 @@ To keep the package installed but disable one row, override it by id with `disab
 | "Adversary review did not run: the subagents seam is not mounted" | This profile composition provides no subagent provider — mount one (spine compositions do) or disable `modules.adversary`. |
 | `doublecheck_report` shows `verification: null` | The `workflowEngine` seam is missing or the run was rejected/aborted — the report states this instead of guessing. |
 | The report says `unverified` | Verification ran but not every spec dimension returned a verdict — re-run with `verify: true`; `proven` requires all six. |
+| `/gate run` shows `Review conclusion — WARN: dsh-auto-review is not installed` | Expected degrade: the engine row is not in this profile. Install `dsh-auto-review`, or set `gate.review.engine: local` to skip the detection. |
+| `/gate run` shows `Implementation consistency — SKIP` | The `subagents` seam is missing (or the run timed out) — mount a subagent provider; the gate never fakes a verdict. |
+| `/gate status` shows `plan mode: unknown` | The profile has no plan-mode service mounted; the suggestion still appears in the report and the turn notice. |
+| The gate record is not in the session log | This rc.6 host does not stamp the `ignorable` marker — the record lives in the command result and `gate-report.md` only. |
 
 ## Configure
 
@@ -172,9 +263,46 @@ Override any row **by id** in the profile's `cordis.patch.yml`. A patch replaces
     testFilePatterns:
       - '(^|[\\/])(tests?|__tests__|specs?)([\\/]|$)'
       - '\\.(test|spec)\\.[A-Za-z0-9]+$'
+    gate:
+      enabled: true
+      planSuggestion: true
+      reportFile: 'gate-report.md'
+      requirements:
+        enabled: true
+        checklist:
+          - { id: goal, question: 'What outcome must the delivery produce?', specDimension: goal, required: true }
+          - { id: scope, question: 'What is in scope, and what is out of scope?', specDimension: scope, required: true }
+          - { id: acceptance, question: 'Which observable checks prove the work is done?', specDimension: acceptanceCriteria, required: true }
+          - { id: failureModes, question: 'What can go wrong, and what is the correct behavior in each case?', specDimension: failureModes, required: true }
+          - { id: priorities, question: 'What is traded when goals conflict; what is optional?', specDimension: priorities, required: true }
+          - { id: nonGoals, question: 'What does the user explicitly not want?', specDimension: nonGoals, required: true }
+        minConfirmed: 6
+        interrogateTool: 'ask_user_question'
+      tests:
+        enabled: true
+        requirePassingRun: true
+        allowFailingRuns: 0
+        requireCoverage: false
+        minCoveragePct: 80
+        coveragePattern: 'coverage[^\d]{0,40}(\d+(?:\.\d+)?)\s*%'
+      consistency:
+        enabled: true
+        provider: fork
+        model: null
+        tools: ['read', 'glob', 'grep']
+        timeoutMs: 120000
+        maxFindings: 5
+      review:
+        enabled: true
+        engine: auto          # auto = dsh-auto-review verdict records, else local
+        provider: fork
+        model: null
+        tools: ['read', 'glob', 'grep']
+        timeoutMs: 120000
+        maxFindings: 5
 ```
 
-The shipped `strict.patch.yml` is exactly this guard row at `intensity: block` with every module on — apply it as a patch layer after the bundle patch for strict mode without hand-editing a profile.
+The shipped `strict.patch.yml` is exactly this guard row at `intensity: block` with every module on and the gate coverage requirement enabled — apply it as a patch layer after the bundle patch for strict mode without hand-editing a profile.
 
 ### `intensity`
 
@@ -192,7 +320,7 @@ The shipped `strict.patch.yml` is exactly this guard row at `intensity: block` w
 | `modules.tdd` | `true` | On enables the red/green evidence gates (v0.2); enabled by default since v0.5. |
 | `modules.adversary` | `false` | On enables the forked critic review at green (v0.3); uses the `ctx.subagents` seam — a missing seam settles as an "unavailable" notice. |
 | `enableByDefault` | `true` | Master switch for sessions without a `/doublecheck on|off` record. |
-| `language` | `'en'` | Injected reminder/deny/review prose language (`en` / `zh`). |
+| `language` | `'en'` | Injected reminder/deny/review/gate prose language (`en` / `zh`). |
 | `guardTools` | `['edit', 'write']` | Mutation tool names both gates watch. |
 | `vagueTaskMaxChars` | `200` | Longer tasks are never treated as vague. Brief tasks naming a file, path, URL, an underscore keyword, or a hyphenated keyword are concrete. |
 | `remindOnce` | `true` | Inject each gate's reminder at most once per session — durable across restarts (folded from the log). |
@@ -220,6 +348,31 @@ Misconfiguration fails loud: an invalid regex, an empty/duplicated name list, or
 
 The report's classification knobs are independent of the guard's: gate enforcement and report folding can be tuned separately without one silently changing the other. Verification degrades honestly: a missing `workflowEngine` seam or a rejected run leaves `verification: null` and the markdown says so.
 
+### Gate knobs (guard row)
+
+| Key | Default | Meaning |
+|---|---|---|
+| `gate.enabled` | `true` | Master switch for the gate panel and the turn-boundary red notice. |
+| `gate.planSuggestion` | `true` | Append the plan-mode re-check suggestion to red reports and panels. |
+| `gate.reportFile` | `'gate-report.md'` | Workspace file receiving the gate report. |
+| `gate.requirements.enabled` | `true` | Off skips the requirements phase. |
+| `gate.requirements.checklist` | *(six spec-dimension questions)* | The pluggable key-question checklist: `{ id, question, specDimension, required }`. `specDimension: null` renders as a manual-confirm warning; failed optional questions are warnings, not red lights. |
+| `gate.requirements.minConfirmed` | `6` | Minimum required questions that must pass (1..required count). |
+| `gate.requirements.interrogateTool` | `'ask_user_question'` | Tool name whose calls count as interrogation evidence. |
+| `gate.tests.enabled` | `true` | Off skips the test-evidence phase. |
+| `gate.tests.requirePassingRun` | `true` | A non-passing (or missing) latest test run is a red light. |
+| `gate.tests.allowFailingRuns` | `0` | Failing runs after the latest green allowed before red. |
+| `gate.tests.requireCoverage` | `false` | On requires coverage evidence in the test output. |
+| `gate.tests.minCoveragePct` | `80` | Minimum coverage percentage (0–100). |
+| `gate.tests.coveragePattern` | `coverage…(\d+…)%` | Regex with one capture group parsing the coverage percentage (compiled case-insensitively). |
+| `gate.consistency.enabled` | `true` | Off skips the diff ↔ requirement mapping phase. |
+| `gate.consistency.provider` / `.model` / `.tools` / `.timeoutMs` / `.maxFindings` | `fork` / `null` / `read,glob,grep` / `120000` / `5` | The local consistency reviewer's knobs (model `null` = main model). |
+| `gate.review.enabled` | `true` | Off skips the review conclusion. |
+| `gate.review.engine` | `'auto'` | `auto` = dsh-auto-review verdict records when present, else the local reviewer; `local` = always the local reviewer. |
+| `gate.review.provider` / `.model` / `.tools` / `.timeoutMs` / `.maxFindings` | *(same as consistency)* | The local review reviewer's knobs. |
+
+Gate configuration is validated fail-loud at load (duplicate ids, unknown spec dimensions, out-of-range thresholds, invalid regexes, empty tool lists throw), and the checklist is exposed through the `doublecheck.gate` settings namespace when the settings service is mounted. The gate never synthesizes approval requests; the local reviewers are read-only by default.
+
 ## How it works (extension points)
 
 | Contribution | DSH mechanism |
@@ -234,9 +387,16 @@ The report's classification knobs are independent of the guard's: gate enforceme
 | Adversary review | `ctx.subagents.start()` — forked critic with structured findings schema, injected at green; `warn`/`block` steer one round |
 | Delivery report | `doublecheck_report` tool — session-log fold + workspace markdown |
 | Verification workflow | `ctx.workflowEngine.start()` — one parallel checker per spec dimension, structured checks |
-| Durable state | session log fold over `tool/call` + `tool/result` + `tool/code-dispatch` + injected structured sources; model-visible ⟺ logged |
+| Gate deterministic phases | pure session-log folds — key-question checklist vs the committed spec; test-run/coverage evidence |
+| Gate reviewer phases | `ctx.subagents.start()` — consistency mapper + local reviewer, structured findings, read-only tools |
+| Engine review | durable `autoReview/verdict` / `autoReview/rejection` folds + `ctx.commands.list()` presence probe (weak dependency, no import) |
+| Plan-mode suggestion | report/panel prose + once-per-session turn notice; `ctx.planMode` read for the status line (optional) |
+| `/gate` command | `ctx.commands.register()` — `status|run|config`; `run` writes the durable `doublecheck/gate` event + `gate-report.md` |
+| Settings surface | `ctx.settings.register('doublecheck.gate', schema, { expose: true, applies: 'restart' })` when mounted |
+| Durable state | session log fold over `tool/call` + `tool/result` + `tool/code-dispatch` + injected structured sources + `doublecheck/state` + `doublecheck/gate`; model-visible ⟺ logged |
 | Session command | `ctx.commands.register()` — `/doublecheck status|report|on|off`; `on|off` writes the durable `doublecheck/state` session event |
-| Internal events | `doublecheck/spec`, `doublecheck/reminder`, `doublecheck/review`, `doublecheck/report` (typed via declaration merging, `@mode emit`) |
+| Session projection | `sessionProjections` registry — `doublecheck` view now carries `gateVerdict` + `gateRedCount` (stateVersion 2) |
+| Internal events | `doublecheck/spec`, `doublecheck/reminder`, `doublecheck/review`, `doublecheck/report`, `doublecheck/gate` (typed via declaration merging, `@mode emit`) |
 
 No agent-loop changes. Every registration is a reversible `ctx.effect` / `ctx.on` / service `register()`.
 
@@ -247,23 +407,28 @@ No agent-loop changes. Every registration is a reversible `ctx.effect` / `ctx.on
 - Reminders arrive as `{kind:'plugin'}` context, so transcript UIs present them as injection metadata.
 - The adversary critique arrives the same way after the critic settles, with severity-tagged findings; under `warn`/`block` the loop is steered one round so the model answers them.
 - `doublecheck_report` returns the consolidated report as a tool result (spec, test timeline, review, verification, verdict), so "prove the delivery" is one call away.
-- `/doublecheck` answers in the transcript directly: `status` shows the switch, modules, intensity, and stage facts, `report` prints the folded report, `on|off` flips the session switch.
+- The gate-red turn notice arrives as `{kind:'doublecheck-gate'}` context — one short role-statement sentence plus the red count and the plan-mode suggestion.
+- `/doublecheck` and `/gate` answer in the transcript directly: `status` shows the switch, modules, intensity, stage facts, and the latest gate verdict; `report` prints the folded report; `on|off` flips the session switch; `/gate run` returns the PR-ready gate report.
 
-## Session command
+## Session commands
 
 ```
 /doublecheck status|report|on|off
+/gate status|run|config
 ```
 
-- `status` — effective switch (durable override beats the config default), configured modules, enforcement intensity, and the folded stage facts (spec committed, red/green color, review on record, edit count).
-- `report` — folds the delivery report from the session log on the spot (no verification workflow; `doublecheck_report` owns that path).
-- `on` / `off` — writes the durable `doublecheck/state` event (survives restart, resume, and fork — replay IS the state) and injects a model-visible switch notice.
+- `/doublecheck status` — effective switch (durable override beats the config default), configured modules, enforcement intensity, the folded stage facts (spec committed, red/green color, review on record, edit count), and the latest gate verdict.
+- `/doublecheck report` — folds the delivery report from the session log on the spot (no verification workflow; `doublecheck_report` owns that path).
+- `/doublecheck on|off` — writes the durable `doublecheck/state` event (survives restart, resume, and fork — replay IS the state) and injects a model-visible switch notice.
+- `/gate status` — the live checklist progress: deterministic phases fold on the spot, reviewer phases and the verdict show the latest `doublecheck/gate` run, plus the plan-mode state.
+- `/gate run` — settles the full four-phase checklist (deterministic folds + two local reviewer forks in parallel; the engine's verdict records when present), writes the durable `doublecheck/gate` event and `gate-report.md`, and returns the report markdown.
+- `/gate config` — renders the effective checklist, thresholds, and reviewer knobs.
 
-All command replies honor the guard row's `language` setting.
+All command replies honor the guard row's `language` setting; the report documents keep their stable English headings and audit ids.
 
 ## Roadmap
 
-The six-stage discipline loop is complete: **grill → design → red → green → review → verify** all ship in this package (v0.1 → v0.6). Real-transcript regression fixtures pin the durable event shapes (`tests/fixtures/`). Future work: richer report formatting, a Web-UI discipline-status badge, and cross-session spec seeding from the workspace file.
+The discipline loop and the delivery gate both ship: **grill → design → red → green → review → verify** (v0.1 → v0.6) plus the **four-phase quality gate with the deliverable/rework decision** (v0.7). Real-transcript regression fixtures pin the durable event shapes (`tests/fixtures/`). Future work: a Web-UI settings tab and gate badge for the `doublecheck` projection, richer report formatting, and cross-session spec seeding from the workspace file.
 
 ## Develop
 
@@ -279,6 +444,34 @@ pnpm run build
 
 Methodology inspired by [obra/superpowers](https://github.com/obra/superpowers) (TDD-style engineering discipline) and [TimothyVang/Grill-me](https://github.com/TimothyVang/Grill-me) (interrogating requirements before implementation). This package is an original implementation: no text, prompt, or file from either project is copied.
 
+## Contributors
+
+- [PerryLink](https://github.com/PerryLink) — author & maintainer: the v0.1 → v0.7 discipline loop and delivery gate, the five-language docs, the CI/release pipeline, and the ecosystem submissions ([awesome-dsh-plugin#451](https://github.com/awesome-dsh-plugin/awesome-dsh-plugin/pull/451), [awesome-dsh-plugins#147](https://github.com/AdamPlatin123/awesome-dsh-plugins/pull/147), [awesome-deepseek-harness#179](https://github.com/0xsline/awesome-deepseek-harness/pull/179), [bruc3van/awesome-dsh-plugin#36](https://github.com/bruc3van/awesome-dsh-plugin/pull/36), [dsh-hub-workshop#13](https://github.com/omdsh-dev/dsh-hub-workshop/issues/13)/[#19](https://github.com/omdsh-dev/dsh-hub-workshop/pull/19)).
+
+Issues, pull requests, and Discussions are all welcome — entry points are at the top of this document.
+
+## PerryLink DSH Plugin Family
+
+This project is one of the [15 DeepSeek Harness plugins](https://github.com/PerryLink) maintained by [PerryLink](https://github.com/PerryLink). If this one helps you, the others likely will too:
+
+| Plugin | One-liner |
+|---|---|
+| [dsh-mcp-panel](https://github.com/PerryLink/dsh-mcp-panel) | Read-only MCP runtime panel: /mcp command + Settings tab with status, tools and errors |
+| **[dsh-doublecheck](https://github.com/PerryLink/dsh-doublecheck)** | Engineering-discipline guard + delivery quality gate: requirements grill, test gates, adversary review, /gate deliverable/rework panel |
+| [dsh-background-agents](https://github.com/PerryLink/dsh-background-agents) | Durable background child agents with a Web UI sidebar, messaging and interrupt |
+| [dsh-lsp-actions](https://github.com/PerryLink/dsh-lsp-actions) | LSP diagnostics, formatting, completion, code actions and rename over language servers |
+| [dsh-output-styles](https://github.com/PerryLink/dsh-output-styles) | Claude Code outputStyles-equivalent runtime style switching |
+| [dsh-checkpoint-rewind](https://github.com/PerryLink/dsh-checkpoint-rewind) | Claude Code /rewind-equivalent: snapshots, session forks, one-shot restore |
+| [dsh-permission-rules](https://github.com/PerryLink/dsh-permission-rules) | Claude Code-style declarative allow/deny/ask permission rules with audit |
+| [dsh-auto-review](https://github.com/PerryLink/dsh-auto-review) | Second-model auto-review on the approval chain, fail-closed by default |
+| [dsh-memento](https://github.com/PerryLink/dsh-memento) | Approval-gated cross-session memory: ctx.memory seam + SQLite + memory tool |
+| [dsh-skill-pack-security](https://github.com/PerryLink/dsh-skill-pack-security) | Security-audit skill pack: secret scan, dependency and supply-chain review |
+| [dsh-session-pin](https://github.com/PerryLink/dsh-session-pin) | Pin sessions in the Web sidebar with durable ordering |
+| [dsh-composer-history](https://github.com/PerryLink/dsh-composer-history) | Terminal-style input history for the web composer: arrows, Ctrl+R search |
+| [dsh-github](https://github.com/PerryLink/dsh-github) | GitHub PR/issues integration for DSH, every write gated by approval |
+| [dsh-plugin-guide](https://github.com/PerryLink/dsh-plugin-guide) | Plugin-development knowledge base as an on-demand agent skill |
+| [dsh-claude-move](https://github.com/PerryLink/dsh-claude-move) | Migrate Claude Code sessions, memory, skills and CLAUDE.md into DSH |
+
 ## License
 
 [Apache-2.0](LICENSE)