qualia-framework 7.0.1 → 7.2.0

package/bin/qualia-ui.js

@@ -20,6 +20,10 @@
 //   plan-summary <path/to/plan.md>       — story-file dashboard for a plan
 //   journey-tree [path/to/JOURNEY.md]    — ladder view of all milestones, current highlighted
 //   milestone-complete <num> <name> <next> — celebration banner on milestone close
+//   spine [path/to/JOURNEY.md]           — compact horizontal "you are here" journey map (start banner)
+//   onboard <name>                       — first-run milestone mental-model card (post-install, employees)
+//   phase-complete <num> <name> [k=v…]   — per-phase celebration (tasks, mdone, mtotal, streak, next, nextname)
+//   clockout <name> [k=v…]               — end-of-day report card (phases, tasks, commits, mdone, mtotal, streak, date, erp)
 
 const fs = require("fs");
 const path = require("path");
@@ -127,6 +131,17 @@ function progressBar(phase, total) {
   return `${bar} ${DIM}${pct}%${RESET}`;
 }
 
+// Compact filled/empty tick bar (▰▱) for inline use in cards and the journey
+// spine. Scales `done` of `total` onto `width` ticks. Returns "" when total<1.
+function barTicks(done, total, width) {
+  const w = width || 5;
+  const t = Number(total) || 0;
+  if (t < 1) return "";
+  const d = Math.max(0, Math.min(t, Number(done) || 0));
+  const filled = Math.max(0, Math.min(w, Math.round((d / t) * w)));
+  return `${TEAL}${"▰".repeat(filled)}${DIM2}${"▱".repeat(w - filled)}${RESET}`;
+}
+
 function colorForStatus(s) {
   const colors = {
     setup: DIM,
@@ -410,6 +425,166 @@ function cmdMilestoneComplete(num, name, nextName) {
   console.log("");
 }
 
+// ─── Journey Spine (compact horizontal "you are here") ───
+// One-line milestone ladder with the current milestone marked and a caret
+// beneath it. Rendered by the session-start banner so an employee sees where
+// they are in the arc the instant they open the terminal. Skips itself when
+// there is no real multi-milestone journey to map (nothing to orient against).
+function cmdSpine(journeyPath) {
+  const state = readState();
+  if (!state || !state.ok) return;
+  const current = state.milestone || 1;
+
+  // Milestone list: JOURNEY.md headers first, then state.milestones, else none.
+  let milestones = [];
+  const p = journeyPath || ".planning/JOURNEY.md";
+  try {
+    const content = fs.readFileSync(p, "utf8");
+    const re = /^## Milestone (\d+)\s*·\s*(.+?)\s*(?:\[[^\]]*\])?\r?$/gm;
+    let m;
+    while ((m = re.exec(content)) !== null) {
+      milestones.push({ num: parseInt(m[1]), name: m[2].trim() });
+    }
+  } catch {}
+  if (milestones.length === 0 && Array.isArray(state.milestones)) {
+    milestones = state.milestones
+      .map((x, i) => ({ num: x.num || i + 1, name: x.name || x.milestone_name || "" }));
+  }
+  // Nothing to orient against on a single-milestone (or unknown) project.
+  if (milestones.length < 2) return;
+  milestones.sort((a, b) => a.num - b.num);
+
+  // Build the colored spine while tracking the plain-text column of the current
+  // milestone's marker, so the caret lands exactly beneath it.
+  const SEP = "──";
+  const colored = [];
+  const plainSegs = [];
+  let caretCol = -1;
+  for (let i = 0; i < milestones.length; i++) {
+    const ms = milestones[i];
+    const isPast = ms.num < current;
+    const isCurrent = ms.num === current;
+    const marker = isPast ? `${GREEN}●${RESET}`
+      : isCurrent ? `${TEAL}${BOLD}◆${RESET}`
+      : `${DIM2}○${RESET}`;
+    const labelColor = isCurrent ? TEAL + BOLD : isPast ? DIM : WHITE;
+    const labelPlain = `M${ms.num} `;
+    if (isCurrent) {
+      const prefix = plainSegs.length ? plainSegs.join(SEP).length + SEP.length : 0;
+      caretCol = prefix + labelPlain.length; // column of the marker glyph
+    }
+    plainSegs.push(`${labelPlain}●`);
+    colored.push(`${labelColor}M${ms.num}${RESET} ${marker}`);
+  }
+
+  const LABEL_W = 10; // "Journey" label field width (2-space indent added below)
+  console.log("");
+  console.log(`  ${pad(DIM + "Journey" + RESET, LABEL_W)}${colored.join(`${DIM2}${SEP}${RESET}`)}`);
+  if (caretCol >= 0) {
+    console.log(`  ${" ".repeat(LABEL_W + caretCol)}${TEAL}↑${RESET} ${DIM}you are here${RESET}`);
+  }
+  const last = (state.last_activity || "").trim();
+  if (last && !/regenerated from increments/i.test(last)) {
+    const short = last.length > 56 ? last.slice(0, 55) + "…" : last;
+    console.log(`  ${pad(DIM + "Last" + RESET, LABEL_W)}${DIM}${short}${RESET}`);
+  }
+  console.log("");
+}
+
+// ─── Onboard (first-run mental model for a new employee) ─
+// Shown after install for non-OWNER roles: the milestone mental model + the one
+// first move. Keeps a new hire from staring at a prompt wondering what to type.
+function cmdOnboard(name) {
+  const who = name ? ` ${DIM}·${RESET} ${WHITE}welcome aboard, ${name}${RESET}` : ` ${DIM}·${RESET} ${WHITE}welcome aboard${RESET}`;
+  console.log("");
+  console.log(`  ${TEAL}${BOLD}⬢${RESET} ${WHITE}${BOLD}QUALIA${RESET}${who}`);
+  console.log(`  ${RULE_DIM}`);
+  console.log(`  ${WHITE}You build in milestones:${RESET}  ${TEAL}Plan ${DIM}→ ${TEAL}Build ${DIM}→ ${TEAL}Verify ${DIM}→ ${TEAL}Ship${RESET}`);
+  console.log(`  ${DIM}You never have to guess what's next — the statusline shows where you are,${RESET}`);
+  console.log(`  ${DIM}and ${RESET}${TEAL}/qualia${RESET}${DIM} always tells you the next command.${RESET}`);
+  console.log(`  ${RULE_DIM}`);
+  console.log(`  ${TEAL}⟶${RESET} ${WHITE}First move:${RESET}  ${TEAL}${BOLD}/qualia${RESET}`);
+  console.log("");
+}
+
+// ─── Phase Complete (per-phase celebration + next move) ──
+// Smaller sibling of milestone-complete, shown by /qualia-build (or /qualia-ship)
+// when a phase closes. Optional metrics passed as key=value (tasks, mdone,
+// mtotal, streak, next, nextname); any omitted metric is simply not rendered.
+function cmdPhaseComplete(num, name, kv) {
+  kv = kv || {};
+  console.log("");
+  const title = name ? ` ${DIM}·${RESET} ${TEAL}${name}${RESET}` : "";
+  console.log(`  ${GREEN}${BOLD}◆${RESET} ${WHITE}${BOLD}PHASE ${num} COMPLETE${RESET}${title}`);
+  console.log(`  ${RULE_DIM}`);
+  const checks = [];
+  if (kv.tasks) checks.push(`${GREEN}✓${RESET} ${WHITE}${kv.tasks} tasks${RESET}`);
+  checks.push(`${GREEN}✓${RESET} ${WHITE}verified${RESET}`);
+  checks.push(`${GREEN}✓${RESET} ${WHITE}shipped${RESET}`);
+  console.log(`  ${checks.join("   ")}`);
+  if (kv.mdone && kv.mtotal) {
+    const d = parseInt(kv.mdone, 10), t = parseInt(kv.mtotal, 10);
+    const remaining = t - d;
+    const tail = remaining <= 0 ? `${GREEN}milestone ready to close${RESET}`
+      : remaining === 1 ? `${DIM}one more to close the milestone${RESET}`
+      : `${DIM}${remaining} phases left in this milestone${RESET}`;
+    console.log(`  ${pad(DIM + "Milestone" + RESET, 11)}${barTicks(d, t)} ${DIM}${d}/${t} phases · ${RESET}${tail}`);
+  }
+  if (kv.streak && parseInt(kv.streak, 10) > 1) {
+    console.log(`  ${YELLOW}🔥 ${kv.streak} phases shipped today${RESET}`);
+  }
+  console.log(`  ${RULE_DIM}`);
+  if (kv.next) {
+    const nn = kv.nextname ? `   ${DIM}(${kv.nextname})${RESET}` : "";
+    console.log(`  ${TEAL}⟶${RESET} ${WHITE}Next:${RESET}  ${TEAL}${BOLD}${kv.next}${RESET}${nn}`);
+  }
+  console.log("");
+}
+
+// ─── Clock Out (end-of-day report card) ──────────────────
+// Rendered by /qualia-report at shift close. Metrics passed as key=value
+// (phases, tasks, commits, mdone, mtotal, streak, date, erp=ok|queued).
+function cmdClockout(name, kv) {
+  kv = kv || {};
+  console.log("");
+  const who = name ? ` ${DIM}·${RESET} ${WHITE}${name}${RESET}` : "";
+  const date = kv.date ? ` ${DIM}·${RESET} ${DIM}${kv.date}${RESET}` : "";
+  console.log(`  ${TEAL}${BOLD}▤${RESET} ${WHITE}${BOLD}CLOCK OUT${RESET}${who}${date}`);
+  console.log(`  ${RULE_DIM}`);
+  const shipped = [];
+  if (kv.phases) shipped.push(`${WHITE}${kv.phases} phases${RESET}`);
+  if (kv.tasks) shipped.push(`${WHITE}${kv.tasks} tasks${RESET}`);
+  if (kv.commits) shipped.push(`${WHITE}${kv.commits} commits${RESET}`);
+  if (shipped.length) {
+    console.log(`  ${pad(DIM + "Shipped" + RESET, 12)}${shipped.join(`  ${DIM}·${RESET}  `)}`);
+  }
+  if (kv.mdone && kv.mtotal) {
+    const d = parseInt(kv.mdone, 10), t = parseInt(kv.mtotal, 10);
+    const pct = t > 0 ? Math.round((d / t) * 100) : 0;
+    console.log(`  ${pad(DIM + "Milestone" + RESET, 12)}${barTicks(d, t)} ${DIM}${pct}%${RESET}`);
+  }
+  if (kv.streak && parseInt(kv.streak, 10) >= 1) {
+    console.log(`  ${pad(DIM + "Streak" + RESET, 12)}${YELLOW}${kv.streak} days${RESET}`);
+  }
+  console.log(`  ${RULE_DIM}`);
+  const tail = kv.erp === "ok" ? `${GREEN}Report uploaded to ERP ✓${RESET}`
+    : kv.erp === "queued" ? `${YELLOW}Report queued — uploads next session${RESET}`
+    : `${DIM}Session report saved${RESET}`;
+  console.log(`  ${tail}   ${DIM}See you tomorrow.${RESET}`);
+  console.log("");
+}
+
+// Parse trailing `key=value` CLI args into an object (used by the lifecycle
+// cards so optional metrics are positional-order-independent).
+function parseKV(args) {
+  const o = {};
+  for (const a of args || []) {
+    const i = a.indexOf("=");
+    if (i > 0) o[a.slice(0, i)] = a.slice(i + 1);
+  }
+  return o;
+}
+
 // ─── Plan Summary (story-file dashboard) ─────────────────
 // Renders a polished overview of a plan file: phase goal, tasks grouped by wave,
 // persona chips, dependency lines, AC count, validation count. Called by
@@ -733,6 +908,12 @@ module.exports = {
   divider,
   section,
   sectionClose,
+  // Lifecycle cards (called in-process by install.js / reused by skills)
+  onboard: cmdOnboard,
+  phaseComplete: cmdPhaseComplete,
+  clockout: cmdClockout,
+  spine: cmdSpine,
+  barTicks,
   // Existing helpers (kept exposed for reuse)
   pad,
   visibleLength,
@@ -776,9 +957,13 @@ switch (cmd) {
   case "plan-summary": cmdPlanSummary(rest[0]); break;
   case "journey-tree": cmdJourneyTree(rest[0]); break;
   case "milestone-complete": cmdMilestoneComplete(rest[0], rest[1], rest.slice(2).join(" ")); break;
+  case "spine":    cmdSpine(rest[0]); break;
+  case "onboard":  cmdOnboard(rest.join(" ")); break;
+  case "phase-complete": cmdPhaseComplete(rest[0], rest[1] || "", parseKV(rest.slice(2))); break;
+  case "clockout": cmdClockout(rest[0] || "", parseKV(rest.slice(1))); break;
   default:
     console.error(
-      `Usage: qualia-ui.js <banner|context|divider|ok|fail|warn|info|spawn|wave|task|done|next|end|update|plan-summary|journey-tree|milestone-complete> [args]`
+      `Usage: qualia-ui.js <banner|context|divider|ok|fail|warn|info|spawn|wave|task|done|next|end|update|plan-summary|journey-tree|milestone-complete|spine|onboard|phase-complete|clockout> [args]`
     );
     process.exit(1);
 }

package/bin/report-payload.js

@@ -113,7 +113,10 @@ function buildPayload(options = {}) {
       ? { assignment_deadline: workPacket.deadline_date }
       : {}),
     client: tracking.client || "",
-    client_report_id: env.CLIENT_REPORT_ID || "",
+    // ERP validates client_report_id as either a QS-REPORT-NN form or ABSENT.
+    // An empty string is rejected (422). Omit when unset so the server assigns
+    // a UUID, per docs/erp-contract.md (optional field).
+    ...(env.CLIENT_REPORT_ID ? { client_report_id: env.CLIENT_REPORT_ID } : {}),
     framework_version: config.version || "",
     milestone: tracking.milestone || 1,
     milestone_name: tracking.milestone_name || "",

package/bin/runtime-manifest.js

@@ -27,6 +27,7 @@ const RUNTIME_BIN_SCRIPTS = [
   { file: "last-report.js", label: "last-report.js (router surfacing — newest session-report digest at session start)" },
   { file: "agent-runs.js", label: "agent-runs.js (agent telemetry writer)" },
   { file: "slop-detect.mjs", label: "slop-detect.mjs (anti-pattern scanner — runs pre-commit on frontend builds)" },
+  { file: "dep-verify.mjs", label: "dep-verify.mjs (hallucinated/slopsquatted dependency scanner — verify + ship gate)" },
   { file: "erp-retry.js", label: "erp-retry.js (ERP report retry queue — drained by session-start hook and erp-flush CLI)" },
   { file: "erp-event.js", label: "erp-event.js (signed lifecycle-event emitter → ERP /api/v1/events, R14 client)" },
   { file: "work-packet.js", label: "work-packet.js (ERP mission/work packet pull + local reader)" },

package/bin/state.js

@@ -655,7 +655,9 @@ function cmdTransitionIncrement(opts, target) {
   const t = ensureLifetime(readTracking() || {});
   inc.status = target;
   if (target === "planned") {
-    if (prevStatus === "verified") inc.gap_cycles = (inc.gap_cycles || 0) + 1;
+    // A5 sets status "failed" on a failed verify (vs the legacy path which keeps
+    // "verified" + verification="fail"); count a gap cycle for either.
+    if (prevStatus === "verified" || prevStatus === "failed") inc.gap_cycles = (inc.gap_cycles || 0) + 1;
   } else if (target === "built") {
     inc.tasks_done = parseInt(opts.tasks_done) || 0;
     inc.tasks_total = parseInt(opts.tasks_total) || 0;
@@ -956,7 +958,7 @@ Resume: ${s.resume || "—"}
 
 // ─── Precondition Checks ─────────────────────────────────
 const VALID_FROM = {
-  planned: ["setup", "verified"], // verified(fail) → planned = gap closure
+  planned: ["setup", "verified", "failed"], // verified(fail) [legacy] or failed [A5] → planned = gap closure
   built: ["planned"],
   verified: ["built"],
   polished: ["verified"],
@@ -1073,8 +1075,9 @@ function checkPreconditions(current, target, opts) {
     }
   }
 
-  // Gap-closure circuit breaker (configurable limit)
-  if (target === "planned" && current.status === "verified") {
+  // Gap-closure circuit breaker (configurable limit). Fires from either the
+  // legacy "verified"(+fail) status or the A5 "failed" status.
+  if (target === "planned" && (current.status === "verified" || current.status === "failed")) {
     const t = readTracking() || {};
     const cycles = (t.gap_cycles || {})[String(phase)] || 0;
     const limit = getGapCycleLimit();
@@ -1148,6 +1151,10 @@ function nextCommand(status, phase, totalPhases, verification, lifecycle) {
       if (verification === "fail") return `/qualia-plan ${phase} --gaps`;
       if (phase < totalPhases) return `/qualia-plan ${phase + 1}`;
       return operate ? "/qualia-update" : "/qualia-polish";
+    // A5 increments set status "failed" on a failed verify (legacy keeps
+    // "verified"+fail). Route both to gap closure instead of dead-ending at /qualia.
+    case "failed":
+      return `/qualia-plan ${phase} --gaps`;
     case "polished":
       return "/qualia-ship";
     case "shipped":

package/bin/statusline.js

@@ -205,7 +205,13 @@ try {
       parts.push(mStr);
     }
 
-    if (total > 0) parts.push(`P${phase}/${total}`);
+    if (total > 0) {
+      // Always-visible forward-motion bar: phase of total, scaled to 5 ticks.
+      const w = 5;
+      const filled = Math.max(0, Math.min(w, Math.round((phase / total) * w)));
+      const ticks = "▰".repeat(filled) + "▱".repeat(w - filled);
+      parts.push(`P${phase}/${total} ${ticks}`);
+    }
     if (tasksTotal > 0) parts.push(`T${tasksDone}/${tasksTotal}`);
     if (status) parts.push(status);
 

package/bin/trust-score.js

@@ -27,7 +27,7 @@ const REQUIRED_HOOKS = [
   "session-start.js", "auto-update.js", "branch-guard.js", "pre-push.js",
   "pre-deploy-gate.js", "migration-guard.js", "git-guardrails.js",
   "stop-session-log.js", "fawzi-approval-guard.js", "vercel-account-guard.js", "env-empty-guard.js",
-  "supabase-destructive-guard.js",
+  "supabase-destructive-guard.js", "secret-guard.js",
 ];
 
 const REQUIRED_DESIGN_FILES = [

package/hooks/pre-deploy-gate.js

@@ -346,20 +346,71 @@ if (fs.existsSync(slopScript)) {
       encoding: "utf8",
       timeout: 60000,
     });
-    if (r.status === 1) {
-      console.error("BLOCKED: anti-slop scan found CRITICAL design tells. Fix before deploying.");
+    // Fail CLOSED (same contract as the dep-verify gate below): only a clean
+    // exit 0 passes; a CRITICAL finding (1) or a crash/timeout blocks.
+    if (r.status !== 0) {
+      console.error(
+        r.status === 1
+          ? "BLOCKED: anti-slop scan found CRITICAL design tells. Fix before deploying."
+          : `BLOCKED: anti-slop scan did not complete (${r.error ? r.error.message : "exit " + r.status}). Treating as FAIL.`
+      );
       const output = `${r.stdout || ""}${r.stderr || ""}`.trim();
       if (output) {
         const lines = output.split(/\r?\n/).filter(Boolean).slice(-20);
         for (const line of lines) console.error(`  ${line}`);
       }
-      _trace("pre-deploy-gate", "block", { gate: "slop", status: r.status });
+      _trace("pre-deploy-gate", "block", { gate: "slop", status: r.status, error: r.error ? r.error.message : undefined });
       process.exit(2);
     }
     console.log("  ✓ Anti-slop");
   }
 }
 
+// Dependency verification: zero-token, zero-network scan for imports of
+// packages that are BOTH undeclared in package.json AND absent from
+// node_modules — the signature of an AI-hallucinated or slopsquatted
+// dependency (the #1 named AI-generated-code security failure mode). The
+// correctness/security companion to the design-focused anti-slop scan above.
+// Skipped silently when the scanner isn't installed (brownfield / older
+// installs). OWNER-only escape hatch mirrors QUALIA_SKIP_SLOP.
+const depScript = path.join(QUALIA_HOME, "bin", "dep-verify.mjs");
+if (fs.existsSync(depScript)) {
+  const skipDep = process.env.QUALIA_SKIP_DEPCHECK === "1";
+  if (skipDep) {
+    const depRole = String(readConfig().role || "").toUpperCase();
+    if (depRole !== "OWNER") {
+      const depState = readState();
+      blockDeploy("QUALIA_SKIP_DEPCHECK is OWNER-only.", (depState && depState.next_command) || "/qualia");
+    }
+    console.log("  ⚠ Dependency check skipped (QUALIA_SKIP_DEPCHECK=1)");
+    _trace("pre-deploy-gate", "skip-depcheck", { reason: "QUALIA_SKIP_DEPCHECK=1" });
+  } else {
+    const r = spawnSync(process.execPath, [depScript, "--severity=critical"], {
+      stdio: ["ignore", "pipe", "pipe"],
+      encoding: "utf8",
+      timeout: 60000,
+    });
+    // Fail CLOSED: only a clean exit 0 passes. Findings (1), invocation
+    // errors (2), or a crash/timeout (status null + r.error) all block — a
+    // security gate that silently passes when it cannot run is not a gate.
+    if (r.status !== 0) {
+      console.error(
+        r.status === 1
+          ? "BLOCKED: hallucinated/slopsquatted imports found. Fix before deploying."
+          : `BLOCKED: dep-verify did not complete (${r.error ? r.error.message : "exit " + r.status}). Treating as FAIL.`
+      );
+      const output = `${r.stdout || ""}${r.stderr || ""}`.trim();
+      if (output) {
+        const lines = output.split(/\r?\n/).filter(Boolean).slice(-20);
+        for (const line of lines) console.error(`  ${line}`);
+      }
+      _trace("pre-deploy-gate", "block", { gate: "dep-verify", status: r.status, error: r.error ? r.error.message : undefined });
+      process.exit(2);
+    }
+    console.log("  ✓ Dependencies");
+  }
+}
+
 console.log("⬢ All gates passed.");
 
 _trace("pre-deploy-gate", "allow");

package/hooks/secret-guard.js

@@ -0,0 +1,162 @@
+#!/usr/bin/env node
+// ~/.claude/hooks/secret-guard.js — block commits that stage secrets.
+//
+// Constitution non-negotiables: the service_role key is server-only and must
+// never be committed; .env files must never be committed. Those were prose-only
+// until now. This is the deterministic gate: a PreToolUse hook on
+// `git commit*` that scans STAGED content (git diff --cached) for high-signal
+// secret patterns and a staged `.env` file, and BLOCKS the commit (exit 2) if
+// any are found.
+//
+// Design mirrors pre-deploy-gate.js: self-filter on the command, fail-CLOSED on
+// a real match, OWNER-only escape (QUALIA_SECRET_SKIP=1), trace every decision.
+// It NEVER prints the matched secret value — only the pattern name and file.
+//
+// Exits 2 to BLOCK. Exits 0 to allow. Cross-platform. No external deps.
+
+const fs = require("fs");
+const path = require("path");
+const os = require("os");
+const { spawnSync } = require("child_process");
+
+const _traceStart = Date.now();
+
+function qualiaHome() {
+  if (process.env.QUALIA_HOME) return process.env.QUALIA_HOME;
+  const parent = path.basename(path.dirname(__dirname));
+  if (parent === ".codex" || parent === ".claude") return path.dirname(__dirname);
+  return path.join(os.homedir(), ".claude");
+}
+
+const QUALIA_HOME = qualiaHome();
+const CONFIG = path.join(QUALIA_HOME, ".qualia-config.json");
+const SHELL = process.platform === "win32";
+let HOOK_COMMAND = null;
+
+// Self-filter: only act on `git commit`. Direct invocation (no stdin) runs the
+// full scan so the test suite and manual runs work.
+(function selfFilter() {
+  if (process.stdin.isTTY) return;
+  let command = null;
+  try {
+    const raw = fs.readFileSync(0, "utf8");
+    if (raw) {
+      const payload = JSON.parse(raw);
+      command = (payload && payload.tool_input && payload.tool_input.command) || "";
+    }
+  } catch {}
+  if (command === null) return; // no/!malformed stdin — run full scan
+  HOOK_COMMAND = command;
+  if (!/\bgit\s+commit\b/.test(command)) process.exit(0);
+})();
+
+function readConfig() {
+  try {
+    return JSON.parse(fs.readFileSync(CONFIG, "utf8"));
+  } catch {
+    return {};
+  }
+}
+
+function _trace(result, extra) {
+  try {
+    const traceDir = path.join(QUALIA_HOME, ".qualia-traces");
+    if (!fs.existsSync(traceDir)) fs.mkdirSync(traceDir, { recursive: true });
+    const entry = { hook: "secret-guard", result, timestamp: new Date().toISOString(), duration_ms: Date.now() - _traceStart, ...extra };
+    fs.appendFileSync(path.join(traceDir, `${new Date().toISOString().split("T")[0]}.jsonl`), JSON.stringify(entry) + "\n");
+  } catch {}
+}
+
+// High-signal secret patterns. Narrow on purpose — false positives on a commit
+// gate are expensive, so each pattern targets a real credential shape.
+const SECRET_PATTERNS = [
+  { name: "private key block", re: /-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY-----/ },
+  { name: "AWS access key id", re: /\bAKIA[0-9A-Z]{16}\b/ },
+  { name: "OpenAI/Anthropic-style secret key", re: /\bsk-[A-Za-z0-9_-]{20,}\b/ },
+  { name: "GitHub token", re: /\bgh[pousr]_[A-Za-z0-9]{30,}\b/ },
+  { name: "Supabase service_role key assignment", re: /SUPABASE_SERVICE_ROLE_KEY\s*[:=]\s*['"]?[A-Za-z0-9._-]{20,}/ },
+  { name: "service_role JWT", re: /eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}[\s\S]{0,400}service_role/ },
+];
+
+// A staged .env file (real env, not an example/template) is a leak by itself.
+function stagedEnvFiles(names) {
+  return names.filter((f) => {
+    const base = path.basename(f);
+    if (!/^\.env(\.|$)/.test(base)) return false;
+    return !/\.(example|sample|template|dist)$/.test(base) && base !== ".env.example";
+  });
+}
+
+function git(args) {
+  return spawnSync("git", args, { encoding: "utf8", timeout: 8000, shell: SHELL });
+}
+
+function scan() {
+  // Staged file names.
+  const nameRes = git(["diff", "--cached", "--name-only"]);
+  if (nameRes.status !== 0) return { skipped: "not-a-repo-or-git-error" };
+  const names = (nameRes.stdout || "").split(/\r?\n/).filter(Boolean);
+  if (names.length === 0) return { clean: true, reason: "nothing-staged" };
+
+  const findings = [];
+
+  for (const env of stagedEnvFiles(names)) {
+    findings.push({ file: env, pattern: "staged .env file (never commit secrets)" });
+  }
+
+  // Added lines only (the `+` side of the staged diff).
+  const diffRes = git(["diff", "--cached", "--unified=0"]);
+  const diff = diffRes.stdout || "";
+  let currentFile = "?";
+  for (const line of diff.split(/\r?\n/)) {
+    if (line.startsWith("+++ b/")) { currentFile = line.slice(6); continue; }
+    if (!line.startsWith("+") || line.startsWith("+++")) continue;
+    for (const p of SECRET_PATTERNS) {
+      if (p.re.test(line)) findings.push({ file: currentFile, pattern: p.name });
+    }
+  }
+  return { findings };
+}
+
+function blockAllowedByOwner() {
+  if (process.env.QUALIA_SECRET_SKIP !== "1" && !/\bQUALIA_SECRET_SKIP=1\b/.test(HOOK_COMMAND || "")) return false;
+  const role = String(readConfig().role || "").toUpperCase();
+  if (role === "OWNER") return true;
+  console.error("BLOCKED: QUALIA_SECRET_SKIP is OWNER-only.");
+  _trace("block", { reason: "skip-non-owner" });
+  process.exit(2);
+}
+
+let result;
+try {
+  result = scan();
+} catch (e) {
+  // Fail OPEN on a scan error — a commit gate that errors must not brick every
+  // commit. A real match (below) still blocks.
+  console.error(`⚠ secret-guard: scan error (${e.message}). Commit proceeding.`);
+  _trace("warn", { error: e.message });
+  process.exit(0);
+}
+
+if (result && result.findings && result.findings.length > 0) {
+  if (blockAllowedByOwner()) {
+    console.error("⚠ secret-guard: findings present but QUALIA_SECRET_SKIP=1 (OWNER). Commit proceeding.");
+    _trace("allow", { skipped_owner: true, count: result.findings.length });
+    process.exit(0);
+  }
+  console.error("BLOCKED: secret(s) detected in staged content. Unstage and remove before committing.");
+  // Dedupe file+pattern; never print the matched value.
+  const seen = new Set();
+  for (const f of result.findings) {
+    const key = `${f.file}::${f.pattern}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    console.error(`  ✗ ${f.file} — ${f.pattern}`);
+  }
+  console.error("  Fix: move the secret to an env var / secrets manager; add the file to .gitignore.");
+  _trace("block", { count: seen.size });
+  process.exit(2);
+}
+
+_trace("allow", result || {});
+process.exit(0);

package/hooks/session-start.js

@@ -225,6 +225,7 @@ try {
     fallbackText();
   } else if (fs.existsSync(STATE_FILE)) {
     runUi("banner", "router");
+    runUi("spine"); // horizontal "you are here" journey map (self-skips if <2 milestones)
     renderWorkPacketContext();
     const next = getNextCommand();
     if (next) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "qualia-framework",
-  "version": "7.0.1",
+  "version": "7.2.0",
   "description": "Claude Code and Codex workflow framework by Qualia Solutions. Plan, build, verify, ship.",
   "bin": {
     "qualia-framework": "./bin/cli.js"
@@ -30,6 +30,9 @@
     "test:lib": "bash tests/lib.test.sh",
     "test:skills": "bash tests/skills.test.sh",
     "test:slop-detect": "bash tests/slop-detect.test.sh",
+    "test:dep-verify": "bash tests/dep-verify.test.sh",
+    "test:runtime-parity": "bash tests/runtime-parity.test.sh",
+    "test:secret-guard": "bash tests/secret-guard.test.sh",
     "test:statusline": "bash tests/statusline.test.sh",
     "test:refs": "bash tests/refs.test.sh",
     "test:published-install": "bash tests/published-install-smoke.test.sh",

package/skills/qualia-build/SKILL.md

@@ -172,11 +172,18 @@ Status protocol (machine-readable fan-in — do this, do not skip):
   (use BLOCKED or PARTIAL with `--note \"why\"` instead of DONE if you could not finish)
 
 Execute. Commit. Write your DONE/BLOCKED/PARTIAL status. Return DONE/BLOCKED/PARTIAL.
-", subagent_type="qualia-builder", description="Task {N}: {title}")
+", subagent_type="qualia-builder", model="{tier}", description="Task {N}: {title}")
 ```
 
 **Cache ordering:** Role + grounding FIRST, phase_context SECOND, task_context LAST. Stable prefix ~2-5k tokens → 92% cache hit. Pre-inline eliminates 3-5 Read calls per builder.
 
+**Model routing (intelligent model routing — the OpEx lever).** Most builders are *implementers*, not architects: they follow a precise task contract (files, AC, validation) within established patterns. That is exactly the deterministic, low-ambiguity work that belongs on a cheaper, faster model — reserving the frontier model for the judgment-heavy steps (planning, verification, skeptic adjudication). Per task, pass `model=`:
+- **`sonnet`** (default for builders) — single-/few-file tasks against established patterns, CRUD, wiring, styling, test scaffolding. The bulk of every phase.
+- **frontier (omit `model=` → inherits the session model)** — tasks the contract marks high-complexity, the `architect` persona, novel algorithms, or anything touching auth/payments/migrations where a wrong-but-plausible implementation is expensive.
+- **`haiku`** — pure mechanical edits (rename sweeps, import fixes, format-only changes); pairs naturally with `/qualia-build --batch`.
+
+When unsure, default to `sonnet`; escalate only when the task carries real ambiguity or correctness risk. This routes the high-volume mechanical work off the frontier model without weakening the steps where model strength actually changes the outcome.
+
 **After each task:**
 - Verify commit: `git log --oneline -1`
 - Show:

package/skills/qualia-report/SKILL.md

@@ -155,6 +155,17 @@ fi
 node ${QUALIA_BIN}/qualia-ui.js divider
 node ${QUALIA_BIN}/qualia-ui.js ok "Report $CLIENT_REPORT_ID complete."
 node ${QUALIA_BIN}/qualia-ui.js info "Shift report submitted. You can clock out now."
+
+# End-of-day report card. Name from config; commits = $COUNT; milestone
+# progress from state. erp=ok when the upload confirmed, erp=queued when it was
+# enqueued for retry. Every metric self-omits if its variable is empty.
+EMP_NAME=$(node -pe 'try{JSON.parse(require("fs").readFileSync(process.env.HOME+"/.claude/.qualia-config.json","utf8")).installed_by||""}catch{""}' 2>/dev/null)
+MDONE=$(node ${QUALIA_BIN}/state.js check 2>/dev/null | node -pe 'try{JSON.parse(require("fs").readFileSync(0)).phase||""}catch{""}')
+MTOTAL=$(node ${QUALIA_BIN}/state.js check 2>/dev/null | node -pe 'try{JSON.parse(require("fs").readFileSync(0)).total_phases||""}catch{""}')
+node ${QUALIA_BIN}/qualia-ui.js clockout "$EMP_NAME" date="{YYYY-MM-DD}" \
+  ${COUNT:+commits=$COUNT} \
+  ${MDONE:+mdone=$MDONE} ${MTOTAL:+mtotal=$MTOTAL} \
+  ${ERP_RESULT:+erp=$ERP_RESULT}
 ```
 
 ## Common errors (read this when something goes wrong)

package/skills/qualia-ship/SKILL.md

@@ -66,9 +66,10 @@ if node -e "const p=require('./package.json');process.exit(p.scripts&&p.scripts.
 if node -e "const p=require('./package.json');process.exit(p.scripts&&p.scripts.test?0:1)"; then npm test; fi
 npm run build             # Build — must succeed
 node ${QUALIA_BIN}/slop-detect.mjs --severity=critical   # Anti-slop — CRITICAL design tells block ship
+node ${QUALIA_BIN}/dep-verify.mjs --severity=critical     # Hallucinated/slopsquatted imports block ship
 ```
 
-The `pre-deploy-gate.js` hook re-runs the anti-slop scan at `vercel --prod` time as the hard, non-bypassable gate (OWNER-only `QUALIA_SKIP_SLOP=1` escape). This step surfaces failures early so they're fixed before the deploy command.
+`dep-verify` blocks ship when any import references a package that is neither declared in `package.json` nor installed in `node_modules` — catching AI-invented or typosquatted dependencies before they reach production. The `pre-deploy-gate.js` hook re-runs **both** scans at `vercel --prod` time as the hard, non-bypassable gate — anti-slop (OWNER-only `QUALIA_SKIP_SLOP=1` escape) and dep-verify (OWNER-only `QUALIA_SKIP_DEPCHECK=1` escape, for the rare known-good import not yet in `package.json`). Both gates fail **closed**: a crash or timeout in either scanner blocks the deploy rather than passing silently. This step surfaces failures early so they're fixed before the deploy command.
 
 On failure:
 1. Summarize what failed in plain language
@@ -221,6 +222,21 @@ fi
 ```
 Do NOT manually edit STATE.md or tracking.json — state.js handles both.
 
+```bash
+# Per-phase celebration card. Reads the freshly-updated state so the phase
+# number, name, and milestone progress bar are accurate. Streak = phases this
+# employee shipped today (from the trace log); omitted if unavailable. Every
+# metric self-omits when missing, so this never fabricates.
+PHASE_NUM=$(node ${QUALIA_BIN}/state.js check 2>/dev/null | node -pe 'try{JSON.parse(require("fs").readFileSync(0)).phase||""}catch{""}')
+PHASE_NAME=$(node ${QUALIA_BIN}/state.js check 2>/dev/null | node -pe 'try{JSON.parse(require("fs").readFileSync(0)).phase_name||""}catch{""}')
+TOTAL_PHASES=$(node ${QUALIA_BIN}/state.js check 2>/dev/null | node -pe 'try{JSON.parse(require("fs").readFileSync(0)).total_phases||""}catch{""}')
+node ${QUALIA_BIN}/qualia-ui.js phase-complete "${PHASE_NUM:-?}" "$PHASE_NAME" \
+  ${TASKS_DONE:+tasks=$TASKS_DONE} \
+  ${PHASE_NUM:+mdone=$PHASE_NUM} ${TOTAL_PHASES:+mtotal=$TOTAL_PHASES} \
+  ${STREAK:+streak=$STREAK} \
+  next=/qualia-handoff
+```
+
 ```bash
 node ${QUALIA_BIN}/qualia-ui.js end "SHIPPED" "/qualia-handoff"
 ```