gennady 0.8.4-next.8 → 0.8.4-next.9

package/ai/directives/sdd/audit.directive.xml

@@ -84,6 +84,19 @@
       | `INFO` | observation without mandatory action (often `INSIGHT_BACKFLOW`) |
 
       Severity does not depend on agent's mood. Closed-world drift = `BLOCKER` by default; coding-rules violation = `MAJOR`; stylistic deviation = `MINOR`.
+
+      **Overall status is computed from severities, never judged.** First matching row wins; print which row matched:
+
+      | Condition | Status |
+      |---|---|
+      | any open `BLOCKER` | `FAIL` |
+      | any open `MAJOR` without operator acknowledgement | `FAIL` |
+      | every open `BLOCKER`/`MAJOR` acknowledged + Decision Log entry | `PASS_WITH_ACKNOWLEDGED_RISKS` |
+      | only `MINOR` / `INFO`, or nothing | `PASS` |
+
+      `RULE_FILE_INCOMPLETE` and every other project-scope finding enters this table capped at `MINOR` (per `AX_FINDING_ROUTING`): shared infrastructure no task owns cannot decide that task's verdict. The `sev` field still reports the finding's own severity — the cap applies to the computation, not to the record.
+
+      This matters because the status is consumed mechanically: the orchestrator sets `[x] DONE` on PASS, runs a fix round on the first FAIL, and blocks the task on the second. An unspecified verdict here makes those transitions arbitrary.
     </Axiom>
 
     <Axiom id="AX_FINDINGS_AS_PROPOSALS">
@@ -421,7 +434,7 @@
       <Action>
         1. TRACE_HEADER (STACK `ROOT__SUMMARY`).
         2. Compile all findings: counts by severity + ordered findings table + proposed actions per `AX_FINDING_ROUTING`.
-        3. Determine overall status: PASS / PASS_WITH_ACKNOWLEDGED_RISKS / FAIL.
+        3. Compute overall status from the table in `AX_SEVERITY_TAGGING` and print the row that matched. Project-scope findings enter capped at `MINOR`.
         4. **Map findings to phases (`phases_to_fix`).** For each finding whose `route` is `code-fix` or `ticket-reopen`: read its `Location.path`; find the phase block in ticket section 3 Phases whose `Target Files:` contains that path. Collect the set of phase IDs. Empty set → orchestrator will be told «no phases to fix» (e.g., findings only on specs or trackers). Used by `sdd-execute` orchestrator for selective phase re-run.
         5. Emit ephemeral summary per `AUDIT_SESSION_SUMMARY_FORMAT` in chat — include `phases_to_fix=[P<N>, …]` in the header line.
         6. If overall status is FAIL OR any finding routes to ticket reopen (per `AX_FINDING_ROUTING`) → append an `## Audit Rounds` entry to the ticket per `TICKET_AUDIT_ROUND_FORMAT` (`AX_REOPEN_ROUNDS_IN_TICKET`). PASS audits without reopen do NOT write to the ticket.

package/ai/directives/sdd/phase-execution-protocol.xml

@@ -75,11 +75,12 @@
 
     <Axiom id="AX_PERMITTED_BASH_COMMANDS">
       Phase agent may ONLY run these bash commands:
-      - **Must run:** `<sdd-path> verify <target-files>` — MANDATORY. Auto-discovers and runs typecheck, gennady DBC lint, linter, tests, and format check for the project. Runs before §5 commands. **RUN-ALL**: every gate executes regardless of previous failures; failures accumulate. **SUPPRESS-ON-SUCCESS**: passing gates produce zero output; only failed gates dump their command, exit code, and captured output. On all-pass: single summary line. Failing gate → fix and re-run before EMIT_HANDOFF. ONE `ver` line per invocation (see `STEP_5_VERIFY`).
+      - **Must run:** `<sdd-path> verify --wip <target-files>` — MANDATORY. `--wip` is not optional: verify refuses a dirty tree, and yours always is — you just edited your Target Files, and every git command is forbidden to you, so you cannot commit or stash to satisfy it. Auto-discovers and runs typecheck, gennady DBC lint, linter, tests, and format check for the project. Runs before §5 commands. **RUN-ALL**: every gate executes regardless of previous failures; failures accumulate. **SUPPRESS-ON-SUCCESS**: passing gates produce zero output; only failed gates dump their command, exit code, and captured output. On all-pass: single summary line. Failing gate → fix and re-run before EMIT_HANDOFF. ONE `ver` line per invocation (see `STEP_5_VERIFY`).
       - **Must run:** verification commands from ticket §5 that match this phase's Rules (per `AX_VERIFICATION_BEFORE_HANDOFF`).
       - **May run:** `ls <dir>` for targeted recon (NOT `-la` or recursive); `tsc --noEmit` after code changes; `node --test <specific test file>` for test-kind phases; `date -u +%Y-%m-%dT%H:%M:%SZ` for timestamps.
       - **May run:** `<sdd-path> extract <file> <NAME>` — extract anchored section from ticket/spec.
       - **May run:** `<sdd-path> lint <file>...` — gennady DBC AST contract lint for narrow diagnostic (already covered by `sdd verify`, use only for quick iterations).
+      - **May run:** `<sdd-path> verify --wip --json <target-files>` — same gates, machine-readable. `results[]` names every gate with its command and status, passing ones included; use it when you need to state which gates ran rather than only that they all passed.
 
       **Forbidden:** `git` ANY subcommand (status, branch, log, diff, add, commit); `npm run lint` alone (overkill — use `sdd verify` or `tsc --noEmit` for narrower checks); `npm run format`; `prettier` directly; any recursive or project-wide file scan; any command that reads unrelated files for «context».
 
@@ -282,7 +283,7 @@
     <Step id="STEP_5_VERIFY">
       <Goal>Run MANDATORY sdd verify on target files, then ticket §5 commands. Log only final results.</Goal>
       <Action>
-         1. **MANDATORY — sdd verify gate:** Run `<sdd-path> verify <target-files>`. This auto-discovers and executes typecheck, gennady DBC lint, linter, tests, and format check from package.json scripts. **RUN-ALL**: every gate executes regardless of previous failures; failures accumulate. **SUPPRESS-ON-SUCCESS**: passing gates produce zero output; only failed gates dump their command, exit code, and captured output. On all-pass: single summary line. Any failure is yours to fix unless `AX_PHASE_SCOPE_LOCK` puts the file in another phase's hands — «pre-existing» and «not my file» are not available for the rest. Fix, re-run the full `sdd verify`, and do not proceed to EMIT_HANDOFF while a gate you own is red.
+         1. **MANDATORY — sdd verify gate:** Run `<sdd-path> verify --wip <target-files>`. This auto-discovers and executes typecheck, gennady DBC lint, linter, tests, and format check from package.json scripts. **RUN-ALL**: every gate executes regardless of previous failures; failures accumulate. **SUPPRESS-ON-SUCCESS**: passing gates produce zero output; only failed gates dump their command, exit code, and captured output. On all-pass: single summary line. Any failure is yours to fix unless `AX_PHASE_SCOPE_LOCK` puts the file in another phase's hands — «pre-existing» and «not my file» are not available for the rest. Fix, re-run the full `sdd verify`, and do not proceed to EMIT_HANDOFF while a gate you own is red.
 
             Log ONE `ver` line for this invocation, quoting the tool's own verdict — `sdd verify` names only the gates that FAILED, so a per-gate «pass» line reports a result it never printed. That is `fabricated-verification`, same BLOCKER class as logging a §5 command you did not run.
         2. Then run ticket §5 commands per existing logic below.

package/ai/directives/testing/node-test.xml

@@ -5,6 +5,10 @@
     Read `testing/common.xml` first. Everything about contract boundary, case flow, phase anchors, unified context, factory-over-hooks, BDD mapping, snapshot operator-confirm, file budget — lives there.
   </Mission>
 
+  <DependsOn>
+    - ai/directives/testing/common.xml
+  </DependsOn>
+
   <InheritedBaseline>
     All axioms in [`testing/common`](./common.xml) `Belief_State` apply here UNCHANGED — reader-agent treats them as binding under this directive. `BDD_Mapping_Hint`, `Definitions`, `Workflow_Outline` likewise inherited. This file only adds node:test-specific overrides and patterns.
   </InheritedBaseline>

package/ai/directives/testing/vitest-rules.xml

@@ -5,6 +5,10 @@
     Read `testing/common.xml` first. Everything about contract boundary, case flow, phase anchors, unified context, factory-over-hooks, BDD mapping, snapshot operator-confirm, file budget — lives there.
   </Mission>
 
+  <DependsOn>
+    - ai/directives/testing/common.xml
+  </DependsOn>
+
   <InheritedBaseline>
     All axioms in [`testing/common`](./common.xml) `Belief_State` apply here UNCHANGED — reader-agent treats them as binding under this directive. `BDD_Mapping_Hint`, `Definitions`, `Workflow_Outline` likewise inherited. This file only adds Vitest-specific overrides and patterns. Mechanical assertion-API substitutions when the inherited text mentions node:test assertions: `assert.throws()` → `expect(fn).toThrow(...)`; `assert.rejects()` → `await expect(promise).rejects.toThrow(...)`; `assert.match()` → `expect(str).toMatch(regex)`.
   </InheritedBaseline>

package/ai/skills/sdd-execute/SKILL.md

@@ -78,8 +78,9 @@ Pause path (distinguish from failure — skill is awaiting operator, not broken)
            SDD tooling available at: ~/Developer/gennady/ai/skills/sdd-execute/scripts/sdd
              (run "~/Developer/gennady/ai/skills/sdd-execute/scripts/sdd help" for surface; use these
               for any extraction/lint/verify operations the directive references).
-             MANDATORY before EMIT_HANDOFF: sdd verify <target-files> — auto-discovers and runs
-             typecheck, gennady lint, linter, tests, and format check for the project.
+             MANDATORY before EMIT_HANDOFF: sdd verify --wip <target-files> — auto-discovers and runs
+             typecheck, gennady lint, linter, tests, and format check for the project. --wip is
+             required: verify refuses a dirty tree, and a phase agent's tree always is.
 
           Follow the directive. This ONE phase only. Do not invoke audit.
         ```

package/ai/skills/sdd-execute/scripts/check.sh

@@ -323,19 +323,19 @@ while IFS= read -r f; do
             for (i in r) retired[r[i]] = 1
             # Blocker lifecycle markers are their own shape, not action tokens.
             valid["🛑"] = 1; valid["✅"] = 1
-            round = "-"; inlog = 0; inclose = 0; closelines = 0; closebad = 0
+            round = "-"; inlog = 0; inclose = 0; closelines = 0; closebad = 0; roundwork = 0
         }
         /^## 7\. Execution Log/ { inlog = 1; next }
         /^## [0-9]+\./       { if (inlog) inlog = 0 }
         inlog == 0           { next }
         /^### Round /        {
-            if (inclose && closelines != 1 && closebad == 0)
+            if (inclose && closelines != 1 && closebad == 0 && roundwork == 1)
                 printf "%s\t%s\t%d\tbad-round-close\t-\texpected exactly one DONE line, found %d\n", ticket, round, closeline, closelines
-            round = $3; inclose = 0; closelines = 0; closebad = 0; next
+            round = $3; inclose = 0; closelines = 0; closebad = 0; roundwork = 0; next
         }
         /^#### Round close/  { inclose = 1; closelines = 0; closebad = 0; closeline = NR; next }
         /^#### /             {
-            if (inclose && closelines != 1 && closebad == 0)
+            if (inclose && closelines != 1 && closebad == 0 && roundwork == 1)
                 printf "%s\t%s\t%d\tbad-round-close\t-\texpected exactly one DONE line, found %d\n", ticket, round, closeline, closelines
             inclose = 0; closebad = 0; next
         }
@@ -345,6 +345,7 @@ while IFS= read -r f; do
             split(rest, w, " "); tok = w[1]
             sub(/:$/, "", tok)   # a trailing colon is cosmetic, not a different token
             if (inclose) { if (tok == "DONE") closelines++ }
+            else if ($0 ~ /^- \[x\]/) roundwork = 1
             if (tok in valid) next
             # Every real token is lowercase except BLOCKED / DONE. A capitalised first word is a
             # sentence from the pre-consolidation prose plan ("Implementation file:", "Tracker
@@ -367,13 +368,15 @@ while IFS= read -r f; do
             if ($0 ~ /\[x\]/ && $0 ~ /DONE/) {
                 printf "%s\t%s\t%d\tround-close-no-timestamp\tDONE\tclosed, but the `<ts>` is missing\n", ticket, round, NR
                 closelines++
-            } else {
+            } else if (roundwork == 1) {
+                # Only a round that actually ran can be "not closed". An untouched round is the
+                # pre-filled skeleton of a [ ] TODO ticket, which is its normal state.
                 printf "%s\t%s\t%d\tunclosed-round\t-\tRound close carries no ticked DONE: %s\n", ticket, round, NR, substr($0, 1, 40)
                 closebad = 1
             }
         }
         END {
-            if (inclose && closelines != 1 && closebad == 0)
+            if (inclose && closelines != 1 && closebad == 0 && roundwork == 1)
                 printf "%s\t%s\t%d\tbad-round-close\t-\texpected exactly one DONE line, found %d\n", ticket, round, closeline, closelines
         }
     ' "$f" >> "$LOG_TMP"

package/ai/skills/sdd-execute/scripts/verify.sh

@@ -12,7 +12,9 @@
 #            as a fallback for environments where gennady itself is not runnable.
 #
 # Usage:
-#   verify.sh <file1> [<file2> ...]
+#   verify.sh [--wip] [--json] [--only=...] <file1> [<file2> ...]
+#     Flags pass through to `gennady verify`. Phase agents need --wip: verify refuses a dirty
+#     tree, and a phase agent has uncommitted work by definition.
 #
 # Exit codes:
 #   0  — all gates PASS
@@ -38,11 +40,18 @@ EOF
   exit 4
 fi
 
-for file in "$@"; do
-  if [[ ! -f "$file" ]]; then
-    echo "[$PROG] FILE_NOT_FOUND: $file"
+# Flags are forwarded to `gennady verify` untouched; only positional targets are checked here.
+# `--wip` is the one a phase agent always needs: it has uncommitted work by definition.
+FILE_ARGS=()
+for arg in "$@"; do
+  case "$arg" in
+    -*) continue ;;
+  esac
+  if [[ ! -f "$arg" ]]; then
+    echo "[$PROG] FILE_NOT_FOUND: $arg"
     exit 4
   fi
+  FILE_ARGS+=("$arg")
 done
 
 # -----------------------------------------------------------
@@ -145,7 +154,7 @@ fi
 total=0
 passed=0
 failures=""
-FILES=("$@")  # save original file args for file-specific commands
+FILES=("${FILE_ARGS[@]}")  # positional targets only; flags never reach a file-specific command
 
 run_cmd() {
   local label="$1"

package/dist/ai/directives/sdd/audit.directive.xml

@@ -84,6 +84,19 @@
       | `INFO` | observation without mandatory action (often `INSIGHT_BACKFLOW`) |
 
       Severity does not depend on agent's mood. Closed-world drift = `BLOCKER` by default; coding-rules violation = `MAJOR`; stylistic deviation = `MINOR`.
+
+      **Overall status is computed from severities, never judged.** First matching row wins; print which row matched:
+
+      | Condition | Status |
+      |---|---|
+      | any open `BLOCKER` | `FAIL` |
+      | any open `MAJOR` without operator acknowledgement | `FAIL` |
+      | every open `BLOCKER`/`MAJOR` acknowledged + Decision Log entry | `PASS_WITH_ACKNOWLEDGED_RISKS` |
+      | only `MINOR` / `INFO`, or nothing | `PASS` |
+
+      `RULE_FILE_INCOMPLETE` and every other project-scope finding enters this table capped at `MINOR` (per `AX_FINDING_ROUTING`): shared infrastructure no task owns cannot decide that task's verdict. The `sev` field still reports the finding's own severity — the cap applies to the computation, not to the record.
+
+      This matters because the status is consumed mechanically: the orchestrator sets `[x] DONE` on PASS, runs a fix round on the first FAIL, and blocks the task on the second. An unspecified verdict here makes those transitions arbitrary.
     </Axiom>
 
     <Axiom id="AX_FINDINGS_AS_PROPOSALS">
@@ -421,7 +434,7 @@
       <Action>
         1. TRACE_HEADER (STACK `ROOT__SUMMARY`).
         2. Compile all findings: counts by severity + ordered findings table + proposed actions per `AX_FINDING_ROUTING`.
-        3. Determine overall status: PASS / PASS_WITH_ACKNOWLEDGED_RISKS / FAIL.
+        3. Compute overall status from the table in `AX_SEVERITY_TAGGING` and print the row that matched. Project-scope findings enter capped at `MINOR`.
         4. **Map findings to phases (`phases_to_fix`).** For each finding whose `route` is `code-fix` or `ticket-reopen`: read its `Location.path`; find the phase block in ticket section 3 Phases whose `Target Files:` contains that path. Collect the set of phase IDs. Empty set → orchestrator will be told «no phases to fix» (e.g., findings only on specs or trackers). Used by `sdd-execute` orchestrator for selective phase re-run.
         5. Emit ephemeral summary per `AUDIT_SESSION_SUMMARY_FORMAT` in chat — include `phases_to_fix=[P<N>, …]` in the header line.
         6. If overall status is FAIL OR any finding routes to ticket reopen (per `AX_FINDING_ROUTING`) → append an `## Audit Rounds` entry to the ticket per `TICKET_AUDIT_ROUND_FORMAT` (`AX_REOPEN_ROUNDS_IN_TICKET`). PASS audits without reopen do NOT write to the ticket.

package/dist/ai/directives/sdd/phase-execution-protocol.xml

@@ -75,11 +75,12 @@
 
     <Axiom id="AX_PERMITTED_BASH_COMMANDS">
       Phase agent may ONLY run these bash commands:
-      - **Must run:** `<sdd-path> verify <target-files>` — MANDATORY. Auto-discovers and runs typecheck, gennady DBC lint, linter, tests, and format check for the project. Runs before §5 commands. **RUN-ALL**: every gate executes regardless of previous failures; failures accumulate. **SUPPRESS-ON-SUCCESS**: passing gates produce zero output; only failed gates dump their command, exit code, and captured output. On all-pass: single summary line. Failing gate → fix and re-run before EMIT_HANDOFF. ONE `ver` line per invocation (see `STEP_5_VERIFY`).
+      - **Must run:** `<sdd-path> verify --wip <target-files>` — MANDATORY. `--wip` is not optional: verify refuses a dirty tree, and yours always is — you just edited your Target Files, and every git command is forbidden to you, so you cannot commit or stash to satisfy it. Auto-discovers and runs typecheck, gennady DBC lint, linter, tests, and format check for the project. Runs before §5 commands. **RUN-ALL**: every gate executes regardless of previous failures; failures accumulate. **SUPPRESS-ON-SUCCESS**: passing gates produce zero output; only failed gates dump their command, exit code, and captured output. On all-pass: single summary line. Failing gate → fix and re-run before EMIT_HANDOFF. ONE `ver` line per invocation (see `STEP_5_VERIFY`).
       - **Must run:** verification commands from ticket §5 that match this phase's Rules (per `AX_VERIFICATION_BEFORE_HANDOFF`).
       - **May run:** `ls <dir>` for targeted recon (NOT `-la` or recursive); `tsc --noEmit` after code changes; `node --test <specific test file>` for test-kind phases; `date -u +%Y-%m-%dT%H:%M:%SZ` for timestamps.
       - **May run:** `<sdd-path> extract <file> <NAME>` — extract anchored section from ticket/spec.
       - **May run:** `<sdd-path> lint <file>...` — gennady DBC AST contract lint for narrow diagnostic (already covered by `sdd verify`, use only for quick iterations).
+      - **May run:** `<sdd-path> verify --wip --json <target-files>` — same gates, machine-readable. `results[]` names every gate with its command and status, passing ones included; use it when you need to state which gates ran rather than only that they all passed.
 
       **Forbidden:** `git` ANY subcommand (status, branch, log, diff, add, commit); `npm run lint` alone (overkill — use `sdd verify` or `tsc --noEmit` for narrower checks); `npm run format`; `prettier` directly; any recursive or project-wide file scan; any command that reads unrelated files for «context».
 
@@ -282,7 +283,7 @@
     <Step id="STEP_5_VERIFY">
       <Goal>Run MANDATORY sdd verify on target files, then ticket §5 commands. Log only final results.</Goal>
       <Action>
-         1. **MANDATORY — sdd verify gate:** Run `<sdd-path> verify <target-files>`. This auto-discovers and executes typecheck, gennady DBC lint, linter, tests, and format check from package.json scripts. **RUN-ALL**: every gate executes regardless of previous failures; failures accumulate. **SUPPRESS-ON-SUCCESS**: passing gates produce zero output; only failed gates dump their command, exit code, and captured output. On all-pass: single summary line. Any failure is yours to fix unless `AX_PHASE_SCOPE_LOCK` puts the file in another phase's hands — «pre-existing» and «not my file» are not available for the rest. Fix, re-run the full `sdd verify`, and do not proceed to EMIT_HANDOFF while a gate you own is red.
+         1. **MANDATORY — sdd verify gate:** Run `<sdd-path> verify --wip <target-files>`. This auto-discovers and executes typecheck, gennady DBC lint, linter, tests, and format check from package.json scripts. **RUN-ALL**: every gate executes regardless of previous failures; failures accumulate. **SUPPRESS-ON-SUCCESS**: passing gates produce zero output; only failed gates dump their command, exit code, and captured output. On all-pass: single summary line. Any failure is yours to fix unless `AX_PHASE_SCOPE_LOCK` puts the file in another phase's hands — «pre-existing» and «not my file» are not available for the rest. Fix, re-run the full `sdd verify`, and do not proceed to EMIT_HANDOFF while a gate you own is red.
 
             Log ONE `ver` line for this invocation, quoting the tool's own verdict — `sdd verify` names only the gates that FAILED, so a per-gate «pass» line reports a result it never printed. That is `fabricated-verification`, same BLOCKER class as logging a §5 command you did not run.
         2. Then run ticket §5 commands per existing logic below.

package/dist/ai/directives/testing/node-test.xml

@@ -5,6 +5,10 @@
     Read `testing/common.xml` first. Everything about contract boundary, case flow, phase anchors, unified context, factory-over-hooks, BDD mapping, snapshot operator-confirm, file budget — lives there.
   </Mission>
 
+  <DependsOn>
+    - ai/directives/testing/common.xml
+  </DependsOn>
+
   <InheritedBaseline>
     All axioms in [`testing/common`](./common.xml) `Belief_State` apply here UNCHANGED — reader-agent treats them as binding under this directive. `BDD_Mapping_Hint`, `Definitions`, `Workflow_Outline` likewise inherited. This file only adds node:test-specific overrides and patterns.
   </InheritedBaseline>

package/dist/ai/directives/testing/vitest-rules.xml

@@ -5,6 +5,10 @@
     Read `testing/common.xml` first. Everything about contract boundary, case flow, phase anchors, unified context, factory-over-hooks, BDD mapping, snapshot operator-confirm, file budget — lives there.
   </Mission>
 
+  <DependsOn>
+    - ai/directives/testing/common.xml
+  </DependsOn>
+
   <InheritedBaseline>
     All axioms in [`testing/common`](./common.xml) `Belief_State` apply here UNCHANGED — reader-agent treats them as binding under this directive. `BDD_Mapping_Hint`, `Definitions`, `Workflow_Outline` likewise inherited. This file only adds Vitest-specific overrides and patterns. Mechanical assertion-API substitutions when the inherited text mentions node:test assertions: `assert.throws()` → `expect(fn).toThrow(...)`; `assert.rejects()` → `await expect(promise).rejects.toThrow(...)`; `assert.match()` → `expect(str).toMatch(regex)`.
   </InheritedBaseline>

package/dist/ai/skills/sdd-execute/SKILL.md

@@ -78,8 +78,9 @@ Pause path (distinguish from failure — skill is awaiting operator, not broken)
            SDD tooling available at: ~/Developer/gennady/ai/skills/sdd-execute/scripts/sdd
              (run "~/Developer/gennady/ai/skills/sdd-execute/scripts/sdd help" for surface; use these
               for any extraction/lint/verify operations the directive references).
-             MANDATORY before EMIT_HANDOFF: sdd verify <target-files> — auto-discovers and runs
-             typecheck, gennady lint, linter, tests, and format check for the project.
+             MANDATORY before EMIT_HANDOFF: sdd verify --wip <target-files> — auto-discovers and runs
+             typecheck, gennady lint, linter, tests, and format check for the project. --wip is
+             required: verify refuses a dirty tree, and a phase agent's tree always is.
 
           Follow the directive. This ONE phase only. Do not invoke audit.
         ```

package/dist/ai/skills/sdd-execute/scripts/check.sh

@@ -323,19 +323,19 @@ while IFS= read -r f; do
             for (i in r) retired[r[i]] = 1
             # Blocker lifecycle markers are their own shape, not action tokens.
             valid["🛑"] = 1; valid["✅"] = 1
-            round = "-"; inlog = 0; inclose = 0; closelines = 0; closebad = 0
+            round = "-"; inlog = 0; inclose = 0; closelines = 0; closebad = 0; roundwork = 0
         }
         /^## 7\. Execution Log/ { inlog = 1; next }
         /^## [0-9]+\./       { if (inlog) inlog = 0 }
         inlog == 0           { next }
         /^### Round /        {
-            if (inclose && closelines != 1 && closebad == 0)
+            if (inclose && closelines != 1 && closebad == 0 && roundwork == 1)
                 printf "%s\t%s\t%d\tbad-round-close\t-\texpected exactly one DONE line, found %d\n", ticket, round, closeline, closelines
-            round = $3; inclose = 0; closelines = 0; closebad = 0; next
+            round = $3; inclose = 0; closelines = 0; closebad = 0; roundwork = 0; next
         }
         /^#### Round close/  { inclose = 1; closelines = 0; closebad = 0; closeline = NR; next }
         /^#### /             {
-            if (inclose && closelines != 1 && closebad == 0)
+            if (inclose && closelines != 1 && closebad == 0 && roundwork == 1)
                 printf "%s\t%s\t%d\tbad-round-close\t-\texpected exactly one DONE line, found %d\n", ticket, round, closeline, closelines
             inclose = 0; closebad = 0; next
         }
@@ -345,6 +345,7 @@ while IFS= read -r f; do
             split(rest, w, " "); tok = w[1]
             sub(/:$/, "", tok)   # a trailing colon is cosmetic, not a different token
             if (inclose) { if (tok == "DONE") closelines++ }
+            else if ($0 ~ /^- \[x\]/) roundwork = 1
             if (tok in valid) next
             # Every real token is lowercase except BLOCKED / DONE. A capitalised first word is a
             # sentence from the pre-consolidation prose plan ("Implementation file:", "Tracker
@@ -367,13 +368,15 @@ while IFS= read -r f; do
             if ($0 ~ /\[x\]/ && $0 ~ /DONE/) {
                 printf "%s\t%s\t%d\tround-close-no-timestamp\tDONE\tclosed, but the `<ts>` is missing\n", ticket, round, NR
                 closelines++
-            } else {
+            } else if (roundwork == 1) {
+                # Only a round that actually ran can be "not closed". An untouched round is the
+                # pre-filled skeleton of a [ ] TODO ticket, which is its normal state.
                 printf "%s\t%s\t%d\tunclosed-round\t-\tRound close carries no ticked DONE: %s\n", ticket, round, NR, substr($0, 1, 40)
                 closebad = 1
             }
         }
         END {
-            if (inclose && closelines != 1 && closebad == 0)
+            if (inclose && closelines != 1 && closebad == 0 && roundwork == 1)
                 printf "%s\t%s\t%d\tbad-round-close\t-\texpected exactly one DONE line, found %d\n", ticket, round, closeline, closelines
         }
     ' "$f" >> "$LOG_TMP"

package/dist/ai/skills/sdd-execute/scripts/verify.sh

@@ -12,7 +12,9 @@
 #            as a fallback for environments where gennady itself is not runnable.
 #
 # Usage:
-#   verify.sh <file1> [<file2> ...]
+#   verify.sh [--wip] [--json] [--only=...] <file1> [<file2> ...]
+#     Flags pass through to `gennady verify`. Phase agents need --wip: verify refuses a dirty
+#     tree, and a phase agent has uncommitted work by definition.
 #
 # Exit codes:
 #   0  — all gates PASS
@@ -38,11 +40,18 @@ EOF
   exit 4
 fi
 
-for file in "$@"; do
-  if [[ ! -f "$file" ]]; then
-    echo "[$PROG] FILE_NOT_FOUND: $file"
+# Flags are forwarded to `gennady verify` untouched; only positional targets are checked here.
+# `--wip` is the one a phase agent always needs: it has uncommitted work by definition.
+FILE_ARGS=()
+for arg in "$@"; do
+  case "$arg" in
+    -*) continue ;;
+  esac
+  if [[ ! -f "$arg" ]]; then
+    echo "[$PROG] FILE_NOT_FOUND: $arg"
     exit 4
   fi
+  FILE_ARGS+=("$arg")
 done
 
 # -----------------------------------------------------------
@@ -145,7 +154,7 @@ fi
 total=0
 passed=0
 failures=""
-FILES=("$@")  # save original file args for file-specific commands
+FILES=("${FILE_ARGS[@]}")  # positional targets only; flags never reach a file-specific command
 
 run_cmd() {
   local label="$1"

package/dist/chunks/{classify-mr-stage.logic-C9nlmo7G.js → classify-mr-stage.logic-Dnd980CN.js}

@@ -1,5 +1,5 @@
-import { a as c } from "./shared-DbIfVgIg.js";
-import { V as h } from "./services-q8rLnybu.js";
+import { a as c } from "./shared-CKWIgYym.js";
+import { V as h } from "./services-BD0-3T2K.js";
 function f(s) {
   const e = s?.trim().replace(/^https?:\/\//, "").replace(/\/+$/, "");
   if (e) return e;

package/dist/chunks/{help-B02LDQzW.js → help-B_ASr0VC.js}

@@ -1,4 +1,4 @@
-import { B as n } from "./services-q8rLnybu.js";
+import { B as n } from "./services-BD0-3T2K.js";
 function t() {
   console.info("gennady verify — stack-agnostic verification gates (one command for every stack)"), console.info(""), console.info("Usage:"), console.info("  npx gennady verify [path...] [options]"), console.info(""), console.info("Stacks (auto-detected by root marker file; all detected stacks run together):");
   for (const o of n)
@@ -7,7 +7,7 @@ function t() {
     "  --changed             Changed vs origin/HEAD, falling back to main|master (default)"
   ), console.info(""), console.info("Options:"), console.info(
     "  --plan, --dry-run     Print detection, diagnostics, config provenance and the plan; run nothing"
-  ), console.info("  --json                Machine-readable detection + plan + results"), console.info("  --full-output         Do not truncate gate output in --json results"), console.info(
+  ), console.info("  --json                Machine-readable detection + plan + results"), console.info("  --wip                 Verify uncommitted work: no clean-tree precondition, no"), console.info("                        drift detection, never resets. Waits for a held lock."), console.info("  --full-output         Do not truncate gate output in --json results"), console.info(
     "  --only=<a,b>          Run only these gates: `stack:gate` or bare `gate` (all stacks)"
   ), console.info("  --skip=<a,b>          Drop these gates from the plan (same notation)"), console.info("  --stack=<id>          One-shot stack.use (anystack | golang | node)"), console.info("  --root=<path>         Repository root (default: cwd)"), console.info("  --help, -h            Show this help"), console.info(""), console.info("Timeouts: every gate runs under a per-gate timeout — a plugin default, 10m for"), console.info("  a config gate that omits one, or the `timeout` you set. No global timeout — the"), console.info("  run upper bound is the sum of the plan; timeouts are shown in --plan."), console.info(""), console.info("Repo config — gennady.yaml (committable) deep-merged with personal .gennadyrc"), console.info('(repo, then $HOME); per-key winner shown in --plan. Section "stack":'), console.info("  stack:"), console.info("    use: [golang]"), console.info("    golang:"), console.info("      skipGates: [lint]"), console.info("      overrideGates:"), console.info("        test: { argv: [make, test], timeout: 15m }"), console.info('        build: { env: { GOPROXY: "https://goproxy.example.com/" } }'), console.info("      extraGates:"), console.info("        - { id: tidy-drift, argv: [go, mod, tidy, -diff], timeout: 5m }"), console.info("  Invalid config (unknown key, wrong type, bad duration) stops verify: exit 4."), console.info(""), console.info("Contract:"), console.info("  RUN-ALL             every gate runs; failures accumulate in one report"), console.info("  SUPPRESS-ON-SUCCESS passing gates print nothing"), console.info(
     "  gates never mutate  gofmt -l / prettier --check; mutating ops belong to `gennady fix`"

package/dist/chunks/{help-CjeiaUQ_.js → help-CS6ySEQr.js}

@@ -1,4 +1,4 @@
-import { s as o } from "./shared-DbIfVgIg.js";
+import { s as o } from "./shared-CKWIgYym.js";
 function n() {
   console.info(o.bold("gennady inbox-context — атомарный сбор контекста MR")), console.info(""), console.info("  gennady inbox-context --ref <group/project!iid> [флаги]"), console.info(""), console.info(o.bold("Флаги:")), console.info("  --ref <ref>              MR ref (обязателен)"), console.info("  --vcs-host=<host>      GitLab host (автодетект из origin)"), console.info("  --skip-worktree          Без клона — changeset и worktree пусты"), console.info("  --skip-threads           Без обсуждений — threads/stage пусты"), console.info("  --repos-base=<dir>       База поиска клонов (default ~/Developer)"), console.info("  --state-dir=<dir>        Директория состояния (default ~/.gennady)"), console.info("  --json                   Вывод в JSON (по умолчанию)"), console.info(""), console.info(o.bold("Вывод (JSON):")), console.info("  ref, title, webUrl — идентификация MR"), console.info("  worktree — path, base, diffRefs, repoLayout"), console.info("  changeset — files [{path, status, plus, minus}], totals, byCategory"), console.info("  stage — review_needed | reply_needed | awaiting_reply | idle"), console.info("  openQuestions, lastAuthor — из обсуждений"), console.info("  threads — { all, drafts } — полные треды и черновики"), console.info("  package — role, author, reviewers, description, approvedBy");
 }

package/dist/chunks/{index-CrpSPpC-.js → index-B0QEFQp0.js}

@@ -1,5 +1,5 @@
-import { p as $, V as w, r as y } from "./shared-DbIfVgIg.js";
-import { l as n, a as f, V as h } from "./services-q8rLnybu.js";
+import { p as $, V as w, r as y } from "./shared-CKWIgYym.js";
+import { l as n, a as f, V as h } from "./services-BD0-3T2K.js";
 function b() {
   return {
     resolveVcsContext: y,

package/dist/chunks/{index-Y-juM436.js → index-BBXM3lsU.js}

@@ -1,5 +1,5 @@
-import { s as i } from "./shared-DbIfVgIg.js";
-import { b as E, f as B, c as L, l as C, a as _ } from "./classify-mr-stage.logic-C9nlmo7G.js";
+import { s as i } from "./shared-CKWIgYym.js";
+import { b as E, f as B, c as L, l as C, a as _ } from "./classify-mr-stage.logic-Dnd980CN.js";
 import { existsSync as U, rmSync as k, readFileSync as F, mkdirSync as J, writeFileSync as Q, renameSync as V } from "node:fs";
 import { dirname as z } from "node:path";
 import { r as G, f as D, o as T, d as K, w as Y } from "./worktree-ops.logic-BmJ0w0WS.js";

package/dist/chunks/{index-BMWZFp4U.js → index-BDLu3R0J.js}

@@ -1,6 +1,6 @@
-import { p as D, r as N, s as o } from "./shared-DbIfVgIg.js";
+import { p as D, r as N, s as o } from "./shared-CKWIgYym.js";
 import R from "node:fs";
-import { a as j, V as A } from "./services-q8rLnybu.js";
+import { a as j, V as A } from "./services-BD0-3T2K.js";
 function _(s, r) {
   const t = r?.above ?? 0, y = r?.below ?? 0;
   return ["```suggestion:-", t, "+", y, `

package/dist/chunks/{index-BGgXGXg-.js → index-BEFk5tEp.js}

@@ -1,5 +1,5 @@
 import { parseArgs as c } from "node:util";
-import { l as d, r as l, A as p } from "./services-q8rLnybu.js";
+import { l as d, r as l, A as p } from "./services-BD0-3T2K.js";
 function f(i) {
   const { positionals: e, values: n } = c({
     args: i.slice(3),

package/dist/chunks/{index-C-y9uwFd.js → index-BFpKNrY5.js}

@@ -1,4 +1,4 @@
-import { p as e, r } from "./run-review-command.logic-C08f3D9C.js";
+import { p as e, r } from "./run-review-command.logic-C7b7XU2K.js";
 const s = e(process.argv), o = await r({
   mode: "verify",
   args: s

package/dist/chunks/{index-9Bkdk7RL.js → index-BHK0Porr.js}

@@ -7,8 +7,8 @@ import { promisify as h } from "node:util";
 import z from "node:os";
 import g from "node:fs";
 import { Buffer as X } from "node:buffer";
-import { p as G } from "./shared-DbIfVgIg.js";
-import { v as K } from "./services-q8rLnybu.js";
+import { p as G } from "./shared-CKWIgYym.js";
+import { s as K } from "./services-BD0-3T2K.js";
 let F;
 function q() {
   try {

package/dist/chunks/{index-Bd51QuVH.js → index-BI_YHCD-.js}

@@ -1,5 +1,5 @@
-import { p as y, f as j, V as x, r as C } from "./shared-DbIfVgIg.js";
-import { l as i, a as $, V as w } from "./services-q8rLnybu.js";
+import { p as y, f as j, V as x, r as C } from "./shared-CKWIgYym.js";
+import { l as i, a as $, V as w } from "./services-BD0-3T2K.js";
 function M() {
   return {
     resolveVcsContext: C,

package/dist/chunks/{index-BK1NwQr1.js → index-BSJjwB2R.js}

@@ -1,5 +1,5 @@
-import { p as N, V as A, r as C } from "./shared-DbIfVgIg.js";
-import { l as M, a as q, V as L } from "./services-q8rLnybu.js";
+import { p as N, V as A, r as C } from "./shared-CKWIgYym.js";
+import { l as M, a as q, V as L } from "./services-BD0-3T2K.js";
 function U() {
   return {
     resolveVcsContext: C,

package/dist/chunks/{index-C_Cz5D_b.js → index-Bd-zIMib.js}

@@ -1,5 +1,5 @@
-import { p as R, V as _, r as C } from "./shared-DbIfVgIg.js";
-import { l as S, a as D, V as U } from "./services-q8rLnybu.js";
+import { p as R, V as _, r as C } from "./shared-CKWIgYym.js";
+import { l as S, a as D, V as U } from "./services-BD0-3T2K.js";
 function q() {
   return {
     resolveVcsContext: C,