great-cto 3.31.0 → 3.33.0

package/board/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "great-cto",
   "description": "You already have the agent. This is everything around it. great_cto runs Claude Code as a pipeline of 70 specialist agents \u2014 an independent model checks each stage before the next builds on it, spending caps refuse rather than warn, and three decisions stay yours: what gets built, how, and whether it ships.",
-  "version": "3.31.0",
+  "version": "3.33.0",
   "author": {
     "name": "Alexander Velikiy",
     "url": "https://hashnode.com/@Greatcto"
@@ -251,6 +251,11 @@
             "command": "PLUGIN_DIR=${CLAUDE_PLUGIN_ROOT:-$(ls -d ~/.claude/plugins/cache/*/great_cto/*/ 2>/dev/null | sort -V | tail -1 | sed 's|/$||')}; node \"${PLUGIN_DIR}/scripts/hooks/session-end.mjs\" 2>/dev/null; true",
             "timeout": 8,
             "statusMessage": "Saving session summary..."
+          },
+          {
+            "type": "command",
+            "command": "PLUGIN_DIR=${CLAUDE_PLUGIN_ROOT:-$(ls -d ~/.claude/plugins/cache/*/great_cto/*/ 2>/dev/null | sort -V | tail -1 | sed 's|/$||')}; node \"${PLUGIN_DIR}/scripts/hooks/session-status.mjs\" 2>/dev/null; true",
+            "timeout": 5
           }
         ]
       }
@@ -273,6 +278,11 @@
             "type": "command",
             "command": "[ -n \"$GREAT_CTO_CLASS_TELEMETRY\" ] && { PLUGIN_DIR=${CLAUDE_PLUGIN_ROOT:-$(ls -d ~/.claude/plugins/cache/*/great_cto/*/ 2>/dev/null | sort -V | tail -1 | sed 's|/$||')}; node \"${PLUGIN_DIR}/scripts/hooks/classify-telemetry.mjs\" 2>/dev/null; }; true",
             "timeout": 3
+          },
+          {
+            "type": "command",
+            "command": "PLUGIN_DIR=${CLAUDE_PLUGIN_ROOT:-$(ls -d ~/.claude/plugins/cache/*/great_cto/*/ 2>/dev/null | sort -V | tail -1 | sed 's|/$||')}; node \"${PLUGIN_DIR}/scripts/hooks/session-status.mjs\" 2>/dev/null; true",
+            "timeout": 5
           }
         ]
       }
@@ -309,6 +319,23 @@
             "type": "command",
             "async": true,
             "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/hooks/register-project.mjs\" 2>/dev/null || true"
+          },
+          {
+            "type": "command",
+            "command": "PLUGIN_DIR=${CLAUDE_PLUGIN_ROOT:-$(ls -d ~/.claude/plugins/cache/*/great_cto/*/ 2>/dev/null | sort -V | tail -1 | sed 's|/$||')}; node \"${PLUGIN_DIR}/scripts/hooks/session-status.mjs\" 2>/dev/null; true",
+            "timeout": 5
+          }
+        ]
+      }
+    ],
+    "Notification": [
+      {
+        "matcher": "",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "PLUGIN_DIR=${CLAUDE_PLUGIN_ROOT:-$(ls -d ~/.claude/plugins/cache/*/great_cto/*/ 2>/dev/null | sort -V | tail -1 | sed 's|/$||')}; node \"${PLUGIN_DIR}/scripts/hooks/session-status.mjs\" 2>/dev/null; true",
+            "timeout": 5
           }
         ]
       }

package/board/packages/board/lib/routes.mjs

@@ -14,6 +14,7 @@ import { autoRegisterProject, listProjects, resolveProjectCwd, resolveProjectInf
 import { readVerdictsWithHealth } from './verdicts.mjs';
 import { agentUsage, usageSnapshot } from '../../../scripts/lib/agent-usage.mjs';
 import { reviewerStatus } from '../../../scripts/lib/required-reviewers.mjs';
+import { readSessionStatus } from '../../../scripts/lib/session-status.mjs';
 import { readScores, summarizeScores } from '../../../scripts/lib/scores.mjs';
 import { status as routerKeyStatus, writeKey as writeRouterKey, verifyKey as verifyRouterKey } from '../../../scripts/lib/router-key.mjs';
 
@@ -1470,6 +1471,15 @@ async function dispatch(req, res, url, cwd) {
 
   // Domain reviewers this project's PROJECT.md requires (archetype, packs,
   // compliance), each with whether a verdict exists — the list gate:ship refuses on.
+  // Sessions in this project that wait for a person — written by the
+  // Notification / Stop / UserPromptSubmit hooks (scripts/lib/session-status.mjs).
+  if (pathname === '/api/session-status') {
+    const c = url.searchParams.get('project') ? resolveProjectCwd(url.searchParams.get('project')) : cwd;
+    res.writeHead(200, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
+    res.end(JSON.stringify({ sessions: c ? readSessionStatus(c) : [] }));
+    return true;
+  }
+
   if (pathname === '/api/required-reviewers') {
     const c = url.searchParams.get('project') ? resolveProjectCwd(url.searchParams.get('project')) : cwd;
     res.writeHead(200, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });

package/board/packages/board/mcp-server.mjs

@@ -10,6 +10,7 @@
  *   cost_summary     — LLM spend, budget burn, top features
  *   pipeline_stages  — detailed stage list with verdicts
  *   recent_verdicts  — last N agent verdicts (default 10)
+ *   wait_for_board_change — block until a verdict lands or a session is blocked
  *
  * Usage:
  *   # Start as MCP server (board must be running on --port)
@@ -31,6 +32,7 @@
  */
 
 import { createInterface } from 'node:readline';
+import { waitForChange } from '../../scripts/lib/board-watch.mjs';
 
 const PORT = parseInt(process.env.GREAT_CTO_PORT || '3141', 10);
 const BASE_URL = `http://127.0.0.1:${PORT}`;
@@ -115,6 +117,23 @@ const TOOLS = [
       },
     },
   },
+  {
+    name: 'wait_for_board_change',
+    description:
+      'Blocks until something in this project needs you — an agent wrote a verdict ' +
+      '(BLOCKED/FAIL first), or a session stopped on a permission prompt — then returns ' +
+      'only those changes. Use it instead of polling status in a loop while parallel ' +
+      'work runs: one call, not a sleep-and-list per turn. Call first with no `since` ' +
+      'to get a cursor; pass the returned `cursor` back each time so nothing between ' +
+      'calls is missed. Reads the project files directly; the board need not be running.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        since: { type: 'string', description: 'Cursor from the previous call. Omit on the first call.' },
+        timeout_s: { type: 'number', description: 'Longest wait in seconds (1–600). Default: 300.' },
+      },
+    },
+  },
 ];
 
 // ── HTTP helpers ───────────────────────────────────────────────────────────
@@ -245,6 +264,12 @@ async function callTool(name, args = {}) {
     return lines.join('\n');
   }
 
+  if (name === 'wait_for_board_change') {
+    // The MCP server runs in the project directory (codex-host starts it there).
+    const r = await waitForChange({ cwd: process.cwd(), since: args.since || null, timeoutS: args.timeout_s || 300 });
+    return JSON.stringify(r);
+  }
+
   throw new Error(`Unknown tool: ${name}`);
 }
 

package/board/packages/board/public/index.html

@@ -1696,6 +1696,15 @@ h1, h2, h3, h4 { font-weight: 600; font-family: var(--sans); }
 .pl-stage.pl-compact .pl-name { color: var(--text2); }
 .pl-stage.active { flex: 2; }
 /* Idle-focus all-clear card (shown when nothing needs a decision). */
+/* A session stopped on a permission prompt or an unanswered wait — the one piece
+   of session status the operator can act on, so it is styled like a decision. */
+.session-blocked {
+  padding: 6px 10px;
+  margin-bottom: 4px;
+  border-left: 3px solid var(--status-blocked);
+  background: var(--bg-elevated);
+}
+
 .inbox-allclear {
   display: flex; align-items: center; gap: 14px;
   padding: 22px 22px; margin-top: 4px;
@@ -3399,6 +3408,10 @@ h1, h2, h3, h4 { font-weight: 600; font-family: var(--sans); }
              two speaking states render into #inbox-receipt-foot at the bottom of
              this page (see refreshReceipt). -->
         <div id="inbox-receipt" style="display:none;margin:6px 0 2px;font-size:var(--fs-small)"></div>
+        <!-- Sessions stopped on the operator: a permission prompt, or idle waiting for
+             an answer (Notification hook → .great_cto/status/). The one piece of
+             status that IS a decision, so it sits above the status disclosure. -->
+        <div id="inbox-sessions" style="display:none;margin:6px 0 10px;font-size:var(--fs-small)"></div>
         <!-- Everything below is STATUS, and status is not a decision.
 
              Six of the seven blocks on this screen were read-only: a pipeline rail,
@@ -4673,7 +4686,28 @@ function renderInboxList(rootId, items, countId, opts = {}) {
   }).join('');
 }
 
+// Sessions waiting on a person (scripts/lib/session-status.mjs). `blocked` is a
+// prompt or an unanswered wait and gets a row; `waiting` (turn ended) is what every
+// open session is between turns, so it is one muted count, not a row each.
+async function refreshSessionStatus() {
+  const el = document.getElementById('inbox-sessions');
+  if (!el) return;
+  const r = await api(`/api/session-status${pqs()}`);
+  const rows = (r && Array.isArray(r.sessions)) ? r.sessions : [];
+  const blocked = rows.filter((x) => x.state === 'blocked');
+  const waiting = rows.filter((x) => x.state === 'waiting').length;
+  if (!blocked.length && !waiting) { el.style.display = 'none'; el.innerHTML = ''; return; }
+  el.style.display = '';
+  el.innerHTML = blocked.map((x) => `<div class="session-blocked">
+      <strong>⏸ session ${esc(String(x.session).slice(0, 8))} waits for you</strong>
+      <span class="muted">· ${esc(agoStr(x.since))}${x.kind ? ` · ${esc(x.kind)}` : ''}</span><br>
+      <span>${esc(x.reason || 'waiting for input')}</span>
+    </div>`).join('')
+    + (waiting ? `<div class="muted" title="these sessions finished their turn; the next message is yours">${waiting} session${waiting === 1 ? '' : 's'} finished a turn and wait for your next message</div>` : '');
+}
+
 async function refreshInbox() {
+  refreshSessionStatus();
   // Tiers first: the gate rows are rendered from this same call, and a row drawn
   // before the tiers arrive would silently claim every gate is waiting.
   await refreshGateTiers();

package/board/scripts/lib/agent-posture.mjs

@@ -134,6 +134,9 @@ const TOOL_POSTURES = Object.freeze({
   WebSearch: ['network.fetch', 'communication.external.send'],
   Agent: ['process.spawn'],
   Task: ['process.spawn'],
+  // Loads a skill's text into the agent's context. It grants no tool the agent does
+  // not already hold: the skill runs with the agent's own grants.
+  Skill: ['code.read'],
 });
 
 /** MCP and beta tools, matched by prefix — the list of these grows monthly. */

package/board/scripts/lib/board-watch.mjs

@@ -0,0 +1,91 @@
+#!/usr/bin/env node
+/**
+ * board-watch — wait until something in this project needs the caller, then say
+ * what. One blocking call instead of a polling loop.
+ *
+ * Why this exists
+ * ---------------
+ * An orchestrator waiting on parallel work (coordinator, codex-host) has no way to
+ * wait: it sleeps, lists, sleeps, lists, and every round trip is a turn. On the
+ * projects measured on 2026-09-21, 69 agent runs ended at their turn cap.
+ * fynnfluegge/agtx (Apache-2.0) counted the same cost in one 14-task run — 73
+ * sleeps and 96 listings — and replaced it with `wait_for_board_change`: block,
+ * and return only the changes that need the caller. Written here, from files the
+ * project already has, so it needs no board process:
+ *
+ *   verdict   an agent wrote a new verdict (its value and kind: negative first)
+ *   blocked   a session stopped on a permission prompt or an unanswered wait
+ *
+ * The cursor is the snapshot the caller last saw, so a change that happens between
+ * two calls is never missed: pass back the `cursor` from the previous answer.
+ *
+ * Usage:
+ *   node scripts/lib/board-watch.mjs [--since <cursor>] [--timeout 300] [--cwd DIR]
+ *   → one JSON line: { cursor, changes: [...], timedOut }
+ *   With no --since it answers at once with the current cursor and nothing else.
+ */
+import { fileURLToPath } from 'node:url';
+import { latestVerdicts } from './ship-evidence.mjs';
+import { readSessionStatus } from './session-status.mjs';
+
+export const MAX_TIMEOUT_S = 600;
+
+/** What the caller could need to react to, reduced to comparable keys. */
+export function snapshot(cwd, { now = Date.now() } = {}) {
+  const verdicts = {};
+  for (const [agent, v] of latestVerdicts(cwd)) verdicts[agent] = { verdict: v.verdict, ts: v.ts, kind: v.kind };
+  const blocked = {};
+  for (const s of readSessionStatus(cwd, { now })) {
+    if (s.state === 'blocked') blocked[s.session] = { since: s.since, reason: s.reason || '' };
+  }
+  return { verdicts, blocked };
+}
+
+/** Changes from `prev` to `next` that need the caller, most urgent first. */
+export function diffSnapshots(prev, next) {
+  const out = [];
+  for (const [agent, v] of Object.entries(next.verdicts || {})) {
+    const p = prev.verdicts?.[agent];
+    if (!p || p.ts !== v.ts || p.verdict !== v.verdict) out.push({ type: 'verdict', agent, verdict: v.verdict, kind: v.kind, ts: v.ts });
+  }
+  for (const [session, b] of Object.entries(next.blocked || {})) {
+    const p = prev.blocked?.[session];
+    if (!p || p.since !== b.since) out.push({ type: 'blocked', session, reason: b.reason, since: b.since });
+  }
+  const rank = (c) => (c.type === 'blocked' ? 0 : c.kind === 'negative' ? 1 : 2);
+  return out.sort((a, b) => rank(a) - rank(b));
+}
+
+export const encodeCursor = (snap) => Buffer.from(JSON.stringify(snap)).toString('base64url');
+export function decodeCursor(c) {
+  try { return JSON.parse(Buffer.from(String(c), 'base64url').toString('utf8')); } catch { return null; }
+}
+
+/**
+ * Block until a change needs the caller, or the timeout passes.
+ * @returns {Promise<{cursor:string, changes:object[], timedOut:boolean, note?:string}>}
+ */
+export async function waitForChange({ cwd = process.cwd(), since = null, timeoutS = 300, pollMs = 2000, sleep = (ms) => new Promise((r) => setTimeout(r, ms)) } = {}) {
+  const first = snapshot(cwd);
+  const prev = since ? decodeCursor(since) : null;
+  if (!prev) {
+    return { cursor: encodeCursor(first), changes: [], timedOut: false, note: since ? 'unreadable cursor — here is a fresh one' : 'first call — pass this cursor back to wait' };
+  }
+  const deadline = Date.now() + Math.min(MAX_TIMEOUT_S, Math.max(1, timeoutS)) * 1000;
+  let snap = first;
+  for (;;) {
+    const changes = diffSnapshots(prev, snap);
+    if (changes.length) return { cursor: encodeCursor(snap), changes, timedOut: false };
+    if (Date.now() >= deadline) return { cursor: encodeCursor(snap), changes: [], timedOut: true };
+    await sleep(Math.min(pollMs, Math.max(0, deadline - Date.now())));
+    snap = snapshot(cwd);
+  }
+}
+
+const isMain = process.argv[1] && fileURLToPath(import.meta.url) === process.argv[1];
+if (isMain) {
+  const a = process.argv.slice(2);
+  const opt = (k, d) => { const i = a.indexOf(k); return i >= 0 ? a[i + 1] : d; };
+  const r = await waitForChange({ cwd: opt('--cwd', process.cwd()), since: opt('--since', null), timeoutS: Number(opt('--timeout', 300)) });
+  process.stdout.write(`${JSON.stringify(r)}\n`);
+}

package/board/scripts/lib/session-status.mjs

@@ -0,0 +1,91 @@
+/**
+ * session-status — which sessions in this project are waiting for a person.
+ *
+ * Nothing showed it. On the projects measured on 2026-09-21 the operator was the
+ * approval loop (1,181 "делай" in 5,126 messages), and the board could not say
+ * which session was sitting on a permission prompt or had finished its turn and
+ * was waiting for an answer. Idea from fynnfluegge/agtx (Apache-2.0), which drives
+ * its board from the same hook events; the code here is written for this project.
+ *
+ * Three hook events write one small file per session, `.great_cto/status/<id>.json`:
+ *
+ *   Notification      → blocked  (a permission prompt, or idle waiting for input;
+ *                                 the notification's own message is the reason)
+ *   Stop              → waiting  (the turn ended; the next move is the operator's)
+ *   UserPromptSubmit  → working
+ *   SessionEnd        → the file is removed
+ *
+ * A hook only fires on the transitions it is told about, so a state can go stale:
+ * a permission granted fires no event. The reader therefore checks the session's
+ * transcript — if it was written after the blocked/waiting moment, the session has
+ * moved on and is reported as working. A `working` with a silent transcript for
+ * five minutes is `unknown`, not working (agtx uses the same bound).
+ */
+import { mkdirSync, writeFileSync, readFileSync, readdirSync, statSync, rmSync, renameSync } from 'node:fs';
+import { join } from 'node:path';
+
+export const STALE_WORKING_MS = 5 * 60 * 1000;
+export const MOVED_ON_SLACK_MS = 2000;
+export const DROP_AFTER_MS = 24 * 60 * 60 * 1000;
+
+const EVENT_STATE = { Notification: 'blocked', Stop: 'waiting', UserPromptSubmit: 'working' };
+
+const safeId = (id) => String(id || '').replace(/[^A-Za-z0-9_-]/g, '').slice(0, 64);
+
+/** Apply one hook payload. Returns what was written, or null when nothing applies. */
+export function recordHookEvent(payload, { now = Date.now() } = {}) {
+  const cwd = payload?.cwd || process.cwd();
+  const id = safeId(payload?.session_id);
+  if (!id) return null;
+  const dir = join(cwd, '.great_cto', 'status');
+  const file = join(dir, `${id}.json`);
+  const event = payload?.hook_event_name;
+  if (event === 'SessionEnd') { rmSync(file, { force: true }); return { removed: true }; }
+  const state = EVENT_STATE[event];
+  if (!state) return null;
+  try { statSync(join(cwd, '.great_cto')); } catch { return null; } // not a great_cto project
+  const rec = {
+    session: id,
+    state,
+    since: new Date(now).toISOString(),
+    transcript: payload.transcript_path || null,
+  };
+  if (state === 'blocked') {
+    rec.reason = String(payload.message || 'waiting for you').slice(0, 300);
+    if (payload.notification_type) rec.kind = String(payload.notification_type).slice(0, 40);
+  }
+  mkdirSync(dir, { recursive: true });
+  const tmp = `${file}.${process.pid}.tmp`;
+  writeFileSync(tmp, JSON.stringify(rec));
+  renameSync(tmp, file);
+  return rec;
+}
+
+/**
+ * The effective state of every session with a status file.
+ * @returns {{session:string, state:'blocked'|'waiting'|'working'|'unknown', reason?:string, kind?:string, since:string}[]}
+ */
+export function readSessionStatus(projectDir, { now = Date.now() } = {}) {
+  const dir = join(projectDir, '.great_cto', 'status');
+  let files = [];
+  try { files = readdirSync(dir).filter((f) => f.endsWith('.json')); } catch { return []; }
+  const out = [];
+  for (const f of files) {
+    let rec;
+    try { rec = JSON.parse(readFileSync(join(dir, f), 'utf8')); } catch { continue; }
+    const since = Date.parse(rec.since);
+    if (!Number.isFinite(since) || now - since > DROP_AFTER_MS) continue;
+    let moved = null;
+    if (rec.transcript) {
+      try { moved = statSync(rec.transcript).mtimeMs; } catch { moved = null; }
+    }
+    let state = rec.state;
+    if ((state === 'blocked' || state === 'waiting') && moved !== null && moved > since + MOVED_ON_SLACK_MS) state = 'working';
+    if (state === 'working' && now - Math.max(since, moved || 0) > STALE_WORKING_MS) state = 'unknown';
+    const row = { session: rec.session, state, since: rec.since };
+    if (state === 'blocked') { row.reason = rec.reason; if (rec.kind) row.kind = rec.kind; }
+    out.push(row);
+  }
+  const rank = { blocked: 0, waiting: 1, working: 2, unknown: 3 };
+  return out.sort((a, b) => rank[a.state] - rank[b.state] || (a.since < b.since ? -1 : 1));
+}

package/board/scripts/lib/ship-evidence.mjs

@@ -0,0 +1,115 @@
+/**
+ * ship-evidence — what the verdict logs say about whether gate:ship may pass.
+ *
+ * Read across the 16 projects with verdicts on the measuring machine (2026-09-21):
+ *
+ *  - a healthcare-reviewer BLOCKED was never followed by a later verdict of its
+ *    own, and the task it blocked was closed an hour later;
+ *  - 11 of the 16 had no qa-engineer verdict at all;
+ *  - great_cto's own last QA verdict was three weeks older than its last ship.
+ *
+ * gate-check read Beads task states and required domain reviewers; it read no
+ * verdict's VALUE. This does, three rules:
+ *
+ *  1. An agent whose LATEST verdict is negative (BLOCKED, FAIL, REJECTED, REWORK)
+ *     has an open finding. A later positive verdict from the same agent closes it.
+ *  2. qa-engineer and security-officer must each have a positive latest verdict.
+ *  3. Both must be newer than the last commit that changed code — a verdict from
+ *     before the change it is supposed to cover is not evidence about it.
+ *
+ * Agent names are read from the log's file name and normalised: the same agent
+ * was found logged as `code-reviewer`, `great-cto:code-reviewer`,
+ * `great_cto:code-reviewer`, and QA as both `qa` and `qa-engineer`.
+ */
+import { readdirSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { parseVerdictLog } from './verdict-record.mjs';
+
+export const MANDATORY_FOR_SHIP = ['qa-engineer', 'security-officer'];
+
+const ALIASES = { qa: 'qa-engineer', security: 'security-officer', sec: 'security-officer' };
+
+/** `great-cto:qa`, `great_cto:qa-engineer`, `qa` → `qa-engineer`. */
+export function canonicalAgent(name) {
+  const bare = String(name || '').trim().toLowerCase().replace(/^.*:/, '').replace(/\.log$/, '');
+  return ALIASES[bare] || bare;
+}
+
+/** negative | positive | neutral, from a verdict value in any dialect written so far. */
+export function verdictKind(v) {
+  const s = String(v || '').toUpperCase();
+  if (/^(BLOCKED|FAIL|FAILED|REJECTED|REWORK)\b/.test(s)) return 'negative';
+  // `APPROVED_WITH_DEFERRED_CRITICALS` and friends are approvals that name open
+  // criticals; they are not a clean pass and are read as negative.
+  if (/^APPROVED.*(DEFERRED|CRITICAL)/.test(s)) return 'negative';
+  if (/^(APPROVED|PASS|PASSED|DONE|OK)\b/.test(s)) return 'positive';
+  return 'neutral';
+}
+
+const tsOf = (ts) => { const t = Date.parse(ts); return Number.isFinite(t) ? t : null; };
+
+/**
+ * The latest verdict per agent in `<dir>/.great_cto/verdicts/`.
+ * `gate:*.log` files record gate decisions, not an agent's verdict, and are skipped.
+ * @returns {Map<string, {verdict:string, ts:string, kind:string}>}
+ */
+export function latestVerdicts(projectDir) {
+  const dir = join(projectDir, '.great_cto', 'verdicts');
+  const out = new Map();
+  let files = [];
+  try { files = readdirSync(dir).filter((f) => f.endsWith('.log') && !f.startsWith('gate')); } catch { return out; }
+  for (const f of files) {
+    const agent = canonicalAgent(f);
+    let text = '';
+    try { text = readFileSync(join(dir, f), 'utf8'); } catch { continue; }
+    for (const rec of parseVerdictLog(text, { agent }).records) {
+      const t = tsOf(rec.ts);
+      if (t === null) continue;
+      const prev = out.get(agent);
+      if (!prev || t >= tsOf(prev.ts)) out.set(agent, { verdict: rec.verdict, ts: rec.ts, kind: verdictKind(rec.verdict) });
+    }
+  }
+  return out;
+}
+
+/** ISO time of the last commit that changed something other than docs and pipeline records. */
+export function lastCodeChange(projectDir) {
+  const r = spawnSync('git', ['log', '-1', '--format=%cI', '--', '.',
+    ':(exclude).great_cto', ':(exclude)docs', ':(exclude)*.md', ':(exclude).beads'],
+  { cwd: projectDir, encoding: 'utf8', timeout: 10_000 });
+  return r.status === 0 && r.stdout.trim() ? r.stdout.trim() : null;
+}
+
+/**
+ * @param {Map} latest            from latestVerdicts()
+ * @param {string|null} lastChange from lastCodeChange()
+ * @param {{as?: string}} opts    `as`: the agent running this check about its own
+ *                                verdict — its own latest is not held against it.
+ * @returns {{agent:string, why:string}[]} what blocks gate:ship, each with its reason
+ */
+export function shipBlockers(latest, lastChange, { as } = {}) {
+  const self = as ? canonicalAgent(as) : null;
+  const out = [];
+  for (const [agent, v] of latest) {
+    if (agent === self || v.kind !== 'negative') continue;
+    out.push({ agent, why: `latest verdict ${v.verdict} (${v.ts}) — no later verdict from ${agent} closes it` });
+  }
+  for (const agent of MANDATORY_FOR_SHIP) {
+    if (agent === self) continue;
+    const v = latest.get(agent);
+    if (!v) { out.push({ agent, why: 'no verdict in this project' }); continue; }
+    if (v.kind === 'neutral') out.push({ agent, why: `latest verdict ${v.verdict} is not a pass` });
+  }
+  // A verdict counts for the code it saw. Both post-implementation checks must be
+  // newer than the last code change; agtx (fynnfluegge/agtx) applies the same rule
+  // to a phase artifact — only one written after the phase began counts.
+  for (const agent of MANDATORY_FOR_SHIP) {
+    if (agent === self) continue;
+    const v = latest.get(agent);
+    if (v && v.kind === 'positive' && lastChange && tsOf(v.ts) !== null && tsOf(v.ts) < tsOf(lastChange)) {
+      out.push({ agent, why: `verdict ${v.ts} predates the last code change ${lastChange} — re-run ${agent} on what ships` });
+    }
+  }
+  return out;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "great-cto",
-  "version": "3.31.0",
+  "version": "3.33.0",
   "description": "One command install for the great_cto Claude Code plugin. Auto-detects your stack, picks the right archetype, bootstraps PROJECT.md.",
   "keywords": [
     "claude-code",