shapeup-sdlc 1.6.2 → 1.7.0

package/skills/tech-lead/schemas/gate-answers.schema.json

@@ -2,7 +2,7 @@
   "$schema": "http://json-schema.org/draft-07/schema#",
   "$id": "https://github.com/nguyenvanphituoc/shapeup-sdlc-plugin/schemas/gate-answers.schema.json",
   "title": "GateAnswerSet",
-  "description": "A pre-recorded set of PO decisions, one per gate, that lets a run cross its gates without a human in the loop. This is NOT 'gates off' — every gate still emits its block and still records a decision in the ledger; the decision's SOURCE becomes this file instead of a live human. That distinction is the whole design: an unattended run with no answer set stalls at the first ⏸ and burns its wall-clock budget (measured: shapeup-sdlc DNF at 1800s on benchmark F3), while an unattended run with one produces the same audit trail an interactive run does.",
+  "description": "A pre-recorded set of PO decisions, one per gate, that lets a run cross its gates without a human in the loop. This is NOT 'gates off' — every gate still emits its block and still records a decision in the ledger; the decision's SOURCE becomes this file instead of a live human. That distinction is the whole design: an unattended run with no answer set stalls at the first ⏸ and burns its whole wall-clock budget having built nothing, while an unattended run with one produces the same audit trail an interactive run does.",
   "type": "object",
   "required": ["version", "preset", "answers"],
   "additionalProperties": false,
@@ -26,7 +26,7 @@
     "escalation": {
       "type": "object",
       "additionalProperties": false,
-      "description": "Policy for a worker's structured ESCALATE (advisor-protocol), which is a gate in all but name.",
+      "description": "RESERVED. Policy for a worker-raised question, which would be a gate in all but name. Inert today: WorkResult carries no escalates field, so no worker can raise one. Kept as a declared key because the answer-set schema forbids additional properties, and removing it would invalidate every gate-answers.json already on disk.",
       "properties": {
         "default": {
           "type": "string",

package/skills/tech-lead/schemas/work-result.schema.json

@@ -3,38 +3,76 @@
   "title": "WorkResult",
   "description": "The worker → orchestrator envelope (pure-skill architecture v1.0). Everything a worker used to write into shared files it now RETURNS as data; skills/tech-lead/scripts/ingest-result.mjs performs the writes (tick AC boxes, flip board status, append execution log, propagate unblocks, append discoveries) deterministically, in one place. Path: .shapeup/<slug>/results/r<N>-a<M>.json. Every record type is DEFINED CENTRALLY in domain.schema.json — this file only shapes the envelope.",
   "type": "object",
-  "required": ["schema_version", "order_id", "status"],
+  "required": [
+    "schema_version",
+    "order_id",
+    "status"
+  ],
   "properties": {
-    "schema_version": { "type": "integer", "enum": [1] },
-    "order_id": { "type": "string", "description": "Copied verbatim from the answered WorkOrder — the 1:1 join key." },
-    "worker": { "type": "string" },
-    "status": { "type": "string", "enum": ["done", "partial", "escalated", "failed"] },
+    "schema_version": {
+      "type": "integer",
+      "enum": [
+        1
+      ]
+    },
+    "order_id": {
+      "type": "string",
+      "description": "Copied verbatim from the answered WorkOrder — the 1:1 join key."
+    },
+    "worker": {
+      "type": "string"
+    },
+    "status": {
+      "type": "string",
+      "enum": [
+        "done",
+        "partial",
+        "escalated",
+        "failed"
+      ]
+    },
     "task_results": {
       "type": "array",
       "description": "Per-task outcome. ingest-result flips the board row, ticks GATE-verified AC boxes, and appends the Execution Log from these entries.",
-      "items": { "$ref": "domain.schema.json#/$defs/TaskResult" }
+      "items": {
+        "$ref": "domain.schema.json#/$defs/TaskResult"
+      }
     },
     "files_touched": {
       "type": "array",
-      "items": { "$ref": "domain.schema.json#/$defs/FileTouched" }
-    },
-    "escalates": {
-      "type": "array",
-      "description": "advisor-protocol ESCALATE blocks — the worker's one outward port.",
-      "items": { "$ref": "domain.schema.json#/$defs/Escalate" }
+      "items": {
+        "$ref": "domain.schema.json#/$defs/FileTouched"
+      }
     },
     "discoveries": {
       "type": "array",
       "description": "Raw discovered lines. ingest-result appends them to the discovery ledger — the worker never touches the ledger itself.",
-      "items": { "$ref": "domain.schema.json#/$defs/Discovery" }
+      "items": {
+        "$ref": "domain.schema.json#/$defs/Discovery"
+      }
+    },
+    "verdict": {
+      "$ref": "domain.schema.json#/$defs/Verdict"
     },
-    "verdict": { "$ref": "domain.schema.json#/$defs/Verdict" },
     "artifacts": {
       "type": "array",
       "description": "Domain artifacts the worker wrote inside its substrate (spec docs, orient/ files, reports).",
-      "items": { "type": "string" }
+      "items": {
+        "type": "string"
+      }
     },
-    "assumptions": { "type": "array", "items": { "type": "string" } },
-    "deviations": { "type": "array", "items": { "type": "string" } }
+    "assumptions": {
+      "type": "array",
+      "items": {
+        "type": "string"
+      }
+    },
+    "deviations": {
+      "type": "array",
+      "items": {
+        "type": "string"
+      },
+      "description": "When status is \"escalated\", the FIRST entry is the blocker: one specific, answerable question with the context needed to answer it. There is no escalates[] field, so this is the only channel a blocked worker has."
+    }
   }
 }

package/skills/tech-lead/scripts/aegis-digest.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// AEGIS digester (design spec v1.1 §3.4/§4.5, PA6 countermeasure).
+// AEGIS digester — compresses a failed verification into the triples the next attempt reads.
 //
 // Distills raw build/test/Playwright logs into {file, line, core_message} triples so a
 // task-executor's next attempt gets a few lines of signal instead of a full stack-trace dump.

package/skills/tech-lead/scripts/budget-check.mjs

@@ -1,21 +1,15 @@
 #!/usr/bin/env node
 // THE THIRD BREAKER — wall clock. Derived, never claimed; checked at every round boundary.
 //
-// WHY THIS EXISTS (measured, and it corrects an earlier diagnosis).
+// WHY THIS EXISTS (and it corrects an earlier diagnosis).
 //
-// SDD harness benchmark, F3 (wiring trap, Sonnet 5): this harness was killed at the declared
-// 1800 s cap and published as a DNF. The obvious reading — the one the first write-up implied —
-// was that it had stalled at a gate with no human to sign off.
+// A run killed at an external time cap produces nothing scoreable, and the obvious reading is that
+// it stalled at a gate with no human to sign off.
 //
-// Re-reading the retained transcript with transcript-level metrics says otherwise, and the
-// numbers are not close:
-//
-//     327 assistant turns · 262 tool calls · 130 work calls · 37 file writes
-//     19 gate markers, last gate reached L3 · narration_ratio 0.047 · stall_signals 0
-//
-// It was not waiting. It was the LEAST talkative shapeup run in the whole matrix and one of the
-// busiest rows in the dataset, and it got killed mid-loop at GATE L3 — Verdict & Loop. It ran
-// out of clock while genuinely working.
+// Reading the transcript with transcript-level metrics often says otherwise, and not narrowly:
+// steady turns, steady tool calls, steady file writes, gate markers advancing, a low narration
+// ratio and zero stall signals — a run killed mid-loop at GATE L3, Verdict & Loop. It was not
+// waiting. It ran out of clock while genuinely working.
 //
 // That makes the defect specific: **both existing breakers count events, not time.**
 // `round_budget` decrements once per round; `attempt_budget` decrements once per T0 attempt.

package/skills/tech-lead/scripts/compile-order.mjs

@@ -4,7 +4,7 @@
 // The orchestrator's pipeline sub-layer: assembles the structured input envelope a worker is
 // dispatched with. Replaces tech-lead's hand-assembled `isolated_brief()` prose step and every
 // worker's GATE A/B plumbing (path resolution, run-state parse, board glob-matching, dependency
-// reads, mode detection). Deterministic, zero LLM tokens (DD-7).
+// reads, mode detection). Deterministic, zero LLM tokens.
 //
 // A worker depends on its ORDER, never on filesystem topology — moving a directory again
 // (the v3.2 lesson) touches this script, zero skills.
@@ -39,6 +39,7 @@ import {
   relShared, globLocal, globShared, relKnowledgeBase,
 } from "./lib/paths.mjs";
 import { readContract, SCOPE_CONTRACT } from "./lib/contract-md.mjs";
+import { writeActiveOrder } from "./resume-state.mjs";
 
 const HERE = dirname(fileURLToPath(import.meta.url));
 const ORDER_SCHEMA = JSON.parse(readFileSync(resolve(HERE, "../schemas/work-order.schema.json"), "utf8"));
@@ -145,9 +146,9 @@ export function ledgerDecisions(ledgerText, scopeId) {
 
 /**
  * Resolve the write-contract (sandbox substrate) for an operation — one whitelist template per
- * operation, so mode/flag differences are enforced by the sandbox hook, not trusted to prose.
- * @param {string} operation - The order's operation (execute|analyze|generate-board|reconcile|
- *   retrofit-surface|coverage|map-scopes|remap|split-scope|wire|evaluate|hunt|recheck|orient|…).
+ * operation, so mode/flag differences are enforced by the sandbox hook reading the order's substrate, not trusted to prose.
+ * @param {string} operation - The order's operation (execute|fix|spike|analyze|reconcile|
+ *   retrofit-surface|coverage|map-scopes|wire|evaluate|orient|hunt|translate|hammer|coach).
  * @param {{slug?:string, specDir?:string, scope?:object}} [ctx] - slug (names LOCAL/SHARED roots),
  *   specDir (overrides the default spec path), scope (contract supplying allowed/shared substrates).
  * @returns {{allowed:string[], shared?:string[], frozen?:string[], append_only?:string[]}} The
@@ -171,11 +172,7 @@ export function substrateFor(operation, { slug, specDir, scope } = {}) {
       };
     case "analyze":
       return { allowed: [`${spec}/**`, `${local}/**`], frozen: [] };
-    case "generate-board":
-      return {
-        allowed: [`${local}/tasks/**`, `${spec}/scope-summary.md`, `${working}/**`],
-        frozen: [...FROZEN_SPEC_CORE, `${scopesDir}/**`],
-      };
+
     case "reconcile":
       return {
         allowed: [`${local}/tasks/**`, `${spec}/scope-summary.md`, `${working}/**`],
@@ -184,14 +181,14 @@ export function substrateFor(operation, { slug, specDir, scope } = {}) {
       };
     case "retrofit-surface":
       return { allowed: [], append_only: [`${spec}/usecases/*.md#Test Surface`], frozen: FROZEN_SPEC_CORE };
+
     case "coverage":
-      // ba-pitch-analyzer writes the SHARED requirement registry only — the REQ source and the
-      // spec core stay frozen (the registry is a separate derived file, never an edit of the source).
-      return {
-        allowed: [globShared(slug, "requirements.md")],
-        frozen: [...FROZEN_SPEC_CORE, `${scopesDir}/**`, `${local}/tasks/**`],
-      };
-    case "map-scopes": case "remap": case "split-scope":
+      // The covers-closure input truth. Writes ONLY the derived registry: the REQ source it
+      // extracts from is frozen alongside the spec core, because a planner that may edit the
+      // requirements it is being measured against is not measuring anything.
+      return { allowed: [globShared(slug, "requirements.md")], frozen: FROZEN_SPEC_CORE };
+
+    case "map-scopes":
       return {
         allowed: [`${scopesDir}/*.md`, globShared(slug, "scope-board.md")],
         frozen: [...FROZEN_SPEC_CORE, `${local}/tasks/**`],
@@ -205,10 +202,16 @@ export function substrateFor(operation, { slug, specDir, scope } = {}) {
       };
     case "evaluate":
       return { allowed: [`${local}/evaluation/**`], frozen: [`${spec}/**`, `${local}/tasks/**`] };
-    case "hunt": case "recheck":
+    case "hunt":
       return { allowed: [`${local}/qa/**`], frozen: [`${spec}/**`, `${local}/tasks/**`] };
     case "orient":
       return { allowed: [`${local}/orient/**`], frozen: [`${spec}/**`] };
+    case "translate":
+      return { allowed: [globShared(slug, "shaping/*.md"), globShared(slug, "glossary.md")] };
+    case "hammer":
+      return { allowed: [globShared(slug, "REPORT.md"), `${local}/reports/**`] };
+    case "coach":
+      return { allowed: [relKnowledgeBase("*")] };
     default:
       return { allowed: [`${local}/**`] };
   }
@@ -325,7 +328,28 @@ export function compileOrder({
   slug, worker, mode = "orchestrated", operation, round, attempt,
   scope, tasks, decisions, digestedErrors, trialHistory, testCmd, payloadExtra, specDir, interaction,
 }) {
-  const suffix = round && attempt ? `r${round}-a${attempt}` : round ? `${operation}-r${round}` : operation;
+  // A build order's id carries its SCOPE. Without it, `r<round>-a<attempt>` is the same name for
+  // every scope in a round, so scope 2's order file overwrites scope 1's the moment it is compiled
+  // — measured on the kill/resume probe, where it made `orders/ minus results/` read EMPTY on a run
+  // that was re-dispatching a completed phase. The contract row watching that property therefore
+  // passed on the exact failure it exists to catch. `t0-verify.mjs`'s verdict artifacts have always
+  // been self-identifying this way (`r<R>-a<A>-t<T>.json`, `wx`-created); orders now match, so
+  // `orders/` is an audit trail of dispatches rather than a rolling buffer of the last one.
+  //
+  // The shape stays `<slug>/<suffix>`: every consumer splits on the FIRST "/" (ingest-result.mjs
+  // reads [0] as the slug and [1] as the file stem), and a scope id is already filename-safe
+  // because it is a scope contract's own basename.
+  // `scope` arrives as the PARSED contract object (the CLI reads the .md and embeds it), so the id
+  // comes from its own `scope_id` field; a caller that passes a path instead still works. The id is
+  // lowercased and stripped to the character class `work-order.schema.json` allows after the "/" —
+  // an order that cannot pass its own schema is refused before it is written, and a naming
+  // improvement must not be able to cause that.
+  const rawScopeId = scope && typeof scope === "object"
+    ? scope.scope_id
+    : (scope ? String(scope).split("/").pop().replace(/\.(md|json)$/, "") : null);
+  const scopeId = String(rawScopeId || "").toLowerCase().replace(/[^a-z0-9.-]/g, "-").replace(/^[^a-z0-9]+/, "");
+  const buildSuffix = round && attempt ? (scopeId ? `${scopeId}-r${round}-a${attempt}` : `r${round}-a${attempt}`) : null;
+  const suffix = buildSuffix || (round ? `${operation}-r${round}` : operation);
   const order = {
     schema_version: 1,
     order_id: `${slug}/${suffix}`,
@@ -412,12 +436,12 @@ if (isMainModule) {
   // Operation → owning worker (mirrors domain.schema.json $defs/Operation ownership). Lets a
   // non-build dispatch resolve its worker from the operation alone, without a redundant --worker.
   const OP_OWNER = {
-    analyze: "ba-pitch-analyzer", "generate-board": "ba-pitch-analyzer", reconcile: "ba-pitch-analyzer",
+    analyze: "ba-pitch-analyzer", reconcile: "ba-pitch-analyzer",
     "retrofit-surface": "ba-pitch-analyzer", coverage: "ba-pitch-analyzer",
-    "map-scopes": "scope-architect", remap: "scope-architect", "split-scope": "scope-architect",
+    "map-scopes": "scope-architect",
     wire: "solution-architect", evaluate: "spec-evaluator", orient: "orient",
-    hunt: "qa-edge-hunter", recheck: "qa-edge-hunter", translate: "translator",
-    hammer: "scope-hammer", coach: "coach", adjudicate: "advisor-protocol",
+    hunt: "qa-edge-hunter", translate: "translator",
+    hammer: "scope-hammer", coach: "coach",
   };
   let operation = flag("operation") || (scopePath || flag("task") || has("next") ? "execute" : null);
   const worker = flag("worker")
@@ -501,6 +525,29 @@ if (isMainModule) {
   writeFileSync(outPath, JSON.stringify(order, null, 2) + "\n");
   console.log(outPath);
 
+  // POINT THE SANDBOX AT THIS ORDER, HERE, because this is the only place every lane passes
+  // through.
+  //
+  // `hooks/sandbox-guard.mjs` enforces the order's own `substrate` block — allowed/shared,
+  // append_only, frozen — and it finds the order through `.shapeup/active-order`. Until this
+  // write existed the pointer had exactly one author, the workflow script, so the guard fenced
+  // the workflow lane and DEFERRED everywhere else: `--tiny`, the prose round loop, and a
+  // standalone `/build` all compiled an order carrying a write contract that nothing enforced.
+  // A substrate that is only enforced on the lane that also happens to be the most supervised
+  // one is the wrong way round.
+  //
+  // Compiling an order is the moment the write contract comes into existence, so it is the
+  // correct moment to publish it. The workflow script still sets the pointer explicitly before
+  // dispatch (it interleaves phases and must be exact about which order is live); this write
+  // makes the SAME mechanism cover callers that never reach that code.
+  //
+  // Best-effort, on stderr, and never fatal: a compiled order that cannot publish its pointer is
+  // still a valid order, and stdout belongs to the order path the caller consumes. The guard
+  // fails open on a missing pointer by design, so the failure mode is "unfenced", which is
+  // exactly what a warning is for.
+  const ptr = writeActiveOrder(cwd, slug, outPath);
+  if (!ptr.ok) console.error(`compile-order: warning — ${ptr.reason} (this order's substrate will not be enforced)`);
+
   // The stagnation breaker reports on stderr, never on stdout: stdout is the order path the
   // orchestrator consumes, and a breaker that corrupts the pipeline's own output would be worse
   // than the flailing it detects. It advises; the orchestrator queues the GATE H proposal.

package/skills/tech-lead/scripts/fit-check.mjs

@@ -1,19 +1,19 @@
 #!/usr/bin/env node
 // GATE L0.3 — FIT CHECK. Which lane does this change belong in? Decided by measurement.
 //
-// WHY THIS EXISTS (measured, and it is the root cause the other three fixes did not touch).
+// WHY THIS EXISTS (and it is the root cause the other three fixes did not touch).
 //
-// On the SDD harness benchmark, F3 ("add a `summary` command" to a six-file CLI — one new module
-// plus one dispatcher wiring) was run through the full eleven-gate pipeline and never finished.
-// Not once, across four attempts. It was killed at the 1800s cap mid-build; then, with a
-// wall-clock breaker fitted, it reached ship-triage and was killed there; then it produced an
-// honest report saying its two must-haves were 0% started.
+// A change of the size "add a `summary` command to a six-file CLI" — one new module plus one
+// dispatcher wiring — run through the full eleven-gate pipeline does not finish. Not once, across
+// repeated attempts: killed at the time cap mid-build; then, with a wall-clock breaker fitted,
+// killed at ship-triage; then producing an honest report saying its two must-haves were 0%
+// started.
 //
 // Every one of those fixes made the FAILURE better. None of them made the RUN finish, because
 // none addressed why a three-file change was consuming half an hour: **the ceremony was not
 // sized to the change.**
 //
-// The harness already knew. In the pilot transcripts, tech-lead identified F1 at GATE L0 as
+// The harness already knew. In those transcripts tech-lead identified the change at GATE L0 as
 // "about as small as they come… squarely inside the --tiny lane" — and then ran the full pipeline
 // anyway, because the lane was a judgment the model was free to talk itself out of. That is the
 // same class of defect as narration and as prose consent: an invariant living somewhere a model
@@ -121,7 +121,7 @@ export function decideLane({ intake, files }) {
   };
 
   // CONJUNCTIVE, and it must be. The first version asked "is there evidence this is BIG?" and
-  // defaulted to tiny when it found none — which classified all three benchmark features as tiny,
+  // defaulted to tiny when it found none — which classified every trial feature as tiny,
   // including the five-seam one that genuinely needs the pipeline and used two evaluation rounds
   // to pass. A router that confident and that wrong is worse than no router: it would skip review
   // on exactly the change that needed it.
@@ -152,7 +152,7 @@ export function decideLane({ intake, files }) {
     // Say it on every invocation rather than burying it in a doc. These thresholds are calibrated
     // against THREE features. That is enough to stop the router being obviously wrong and nowhere
     // near enough to trust it silently, so it recommends and never denies.
-    calibration: "advisory — thresholds fitted on 3 benchmark features (n=3); `full` is the default and the PO may override with --lane",
+    calibration: "advisory — thresholds are coarse and `full` is the default; the PO may override with --lane",
   };
 }
 
@@ -186,7 +186,7 @@ export function main() {
     ...result,
     // The sentence the orchestrator must act on, so the decision is not re-derived from the JSON.
     action: result.lane === "tiny"
-      ? "TINY LANE. Run: orient (light) → single-task board → build → T0 → ⏸ L4. Skip WIRE, scope contracts, spec tree, EVAL and QA. The full pipeline on a change this size is the measured cause of a benchmark run that never finished, four attempts running."
+      ? "TINY LANE. Run: orient (light) → single-task board → build → T0 → ⏸ L4. Skip WIRE, scope contracts, spec tree, EVAL and QA. The full pipeline on a change this size is why a run burns its whole clock without finishing."
       : "FULL LANE. Run the complete pipeline: ORIENT → WIRE → MAP SCOPES → BUILD → EVAL → QA → GATE H → L4.",
   }, null, 2));
 }

package/skills/tech-lead/scripts/gate-answers.mjs

@@ -1,21 +1,20 @@
 #!/usr/bin/env node
 // GATE ANSWER SET — cross a gate with a pre-recorded decision instead of a live human.
 //
-// WHY THIS EXISTS (measured, not theorized).
+// WHY THIS EXISTS (observed, not theorized).
 //
 // This harness pauses at every ⏸ gate for PO sign-off by default. That is the point of it. But
-// on the SDD harness benchmark it produced two distinct failures, both of which look like the
-// harness being slow or broken rather than the harness being safe:
+// unattended it produces two distinct failures, both of which look like the harness being slow or
+// broken rather than the harness being safe:
 //
-//   1. STALL → TIMEOUT. F3 (Sonnet 5): the run was killed at the declared 1800s cap having
-//      produced nothing scoreable, while the no-harness control finished the same feature in
-//      51 seconds. A run with no human at the keyboard sitting at a gate does not fail — it
-//      waits, and a wait is indistinguishable from work until the budget runs out.
+//   1. STALL → TIMEOUT. The run is killed at its time cap having produced nothing scoreable,
+//      on a feature that takes minutes to build by hand. A run with no human at the keyboard
+//      sitting at a gate does not fail — it waits, and a wait is indistinguishable from work
+//      until the budget runs out.
 //   2. CONSENT-BY-PROSE. The workaround was a paragraph of English in the prompt ("treat this
-//      message as advance sign-off for every gate"). On Sonnet that worked. On Haiku 4.5 the
-//      model read the paragraph, read the 450-line gate list, and narrated the pipeline instead
-//      of running it — 29% acceptance, n=5, zero variance. Consent carried in prose is consent
-//      that can be re-summarized instead of acted on.
+//      message as advance sign-off for every gate"). Some models act on it. Others read the
+//      paragraph, read the gate list, and narrate the pipeline instead of running it. Consent
+//      carried in prose is consent that can be re-summarized instead of acted on.
 //
 // The organising rule of this project is that every invariant that matters lives in the runtime,
 // not in a prompt. Gate sign-off was the last big one still living in a prompt. So it becomes a
@@ -79,7 +78,7 @@ export const VALID_BY_GATE = {
 const CI_NOTE = "Pre-approved for a headless lane. No human is present; the decision is recorded here so the ledger still names a source.";
 
 export const PRESETS = {
-  // Everything pre-approved. The lane a CI step or a benchmark runs in.
+  // Everything pre-approved. The lane a CI step runs in.
   ci: {
     version: 1,
     preset: "ci",

package/skills/tech-lead/scripts/hill-derive.mjs

@@ -0,0 +1,133 @@
+#!/usr/bin/env node
+// Hill Phase Derivation — phases are derived from facts, never authored
+// Mechanical derivation of a scope's hill position based on facts (T0 verdicts, T1 evaluation, and discovery ledger).
+// Writes to shapeup/<slug>/hill/<scope-id>.yml
+
+import { readFileSync, writeFileSync, existsSync, readdirSync, mkdirSync } from "node:fs";
+import { resolve, join } from "node:path";
+import { isMain } from "./lib/is-main.mjs";
+import { runArgs } from "./lib/argv.mjs";
+import { scopesDir, hillDir, verdictsDir, evaluationDir, discoveryLedger } from "./lib/paths.mjs";
+import { readAllContracts, SCOPE_CONTRACT } from "./lib/contract-md.mjs";
+
+/**
+ * Derive and write the hill phase for all scopes mechanically based on T0, T1, and ledger facts.
+ * 
+ * The derived phase follows these progression rules (facts move dots, not authors):
+ * - UPHILL_UNKNOWN: open unknowns > 0 in the ledger for this scope
+ * - UPHILL_SOLVED: unknowns 0, no T0-green yet
+ * - DOWNHILL_EXECUTION: ≥1 T0-green; T1/seesaw pending
+ * - FINISHED: T1 PASS ∧ seesaw green
+ *
+ * @param {string} cwd - The project root directory.
+ * @param {string} slug - The feature slug being built.
+ * @returns {Array<{scope_id: string, phase: string, changed: boolean}>} A report of all scopes processed, their derived phase, and whether the hill shard on disk was modified.
+ *   Side effects: writes to `shapeup/<slug>/hill/<scope-id>.yml` for each scope.
+ */
+export function deriveHill(cwd, slug) {
+  const scopes = readAllContracts(scopesDir(cwd, slug), SCOPE_CONTRACT).map((x) => x.contract);
+  const vDir = verdictsDir(cwd, slug);
+  const evalDir = evaluationDir(cwd, slug);
+  const ledgerPath = discoveryLedger(cwd, slug);
+  const hDir = hillDir(cwd, slug);
+  
+  if (!existsSync(hDir)) mkdirSync(hDir, { recursive: true });
+  
+  // 1. Check if T1 Evaluation passed (spec-conformance === PASS for the most recent run)
+  let t1Pass = false;
+  const evalFile = join(evalDir, ".verdicts-run.jsonl");
+  if (existsSync(evalFile)) {
+    const lines = readFileSync(evalFile, "utf8").trim().split(/\n/).filter(Boolean);
+    let maxRun = 0;
+    for (const line of lines) {
+      try {
+        const parsed = JSON.parse(line);
+        if (parsed.run >= maxRun) {
+          maxRun = parsed.run;
+          if (parsed.dimension === "spec-conformance") {
+            t1Pass = (parsed.verdict === "PASS");
+          }
+        }
+      } catch (e) {
+        // ignore parse errors
+      }
+    }
+  }
+
+  // 2. T0 facts per scope: has it achieved a green overall verdict? was seesaw also green?
+  const t0Facts = {};
+  if (existsSync(vDir)) {
+    for (const f of readdirSync(vDir)) {
+      if (!f.endsWith(".json")) continue;
+      try {
+        const b = JSON.parse(readFileSync(join(vDir, f), "utf8"));
+        if (!t0Facts[b.scope_id]) t0Facts[b.scope_id] = { hasGreen: false, seesawGreen: false };
+        if (b.overall === "green") {
+          t0Facts[b.scope_id].hasGreen = true;
+          // If regression is false on a green T0, it means seesaw was also green
+          if (b.regression === false) {
+            t0Facts[b.scope_id].seesawGreen = true;
+          }
+        }
+      } catch (e) {
+        // ignore parse errors
+      }
+    }
+  }
+  
+  // 3. Ledger unknowns per scope
+  const scopeUnknowns = {};
+  if (existsSync(ledgerPath)) {
+    const lines = readFileSync(ledgerPath, "utf8").split("\n");
+    let currentScope = null;
+    for (const line of lines) {
+      const m = line.match(/^## Discovered — .*?:([\w.-]+)-a\d+/);
+      if (m) {
+        currentScope = m[1];
+      }
+      if (currentScope && line.startsWith("~ ")) {
+        scopeUnknowns[currentScope] = (scopeUnknowns[currentScope] || 0) + 1;
+      }
+    }
+  }
+  
+  const report = [];
+  for (const s of scopes) {
+    const id = s.scope_id;
+    const t0 = t0Facts[id] || { hasGreen: false, seesawGreen: false };
+    const unknowns = scopeUnknowns[id] || 0;
+    
+    let phase = "UPHILL_UNKNOWN";
+    if (t1Pass && t0.hasGreen && t0.seesawGreen) {
+      phase = "FINISHED";
+    } else if (t0.hasGreen) {
+      phase = "DOWNHILL_EXECUTION";
+    } else if (unknowns === 0) {
+      phase = "UPHILL_SOLVED";
+    }
+    
+    const yaml = `scope_id: ${id}\nphase: ${phase}\n`;
+    const out = join(hDir, `${id}.yml`);
+    let changed = false;
+    if (!existsSync(out) || readFileSync(out, "utf8") !== yaml) {
+      writeFileSync(out, yaml);
+      changed = true;
+    }
+    report.push({ scope_id: id, phase, changed });
+  }
+  return report;
+}
+
+export const ARGV_SPEC = {
+  usage: "hill-derive.mjs --slug <slug> [--cwd <dir>]",
+  _: { arity: 0, max: 0, name: "(no positional operands)" },
+  slug: { type: "str", required: true },
+  cwd: { type: "path" },
+};
+
+if (isMain(import.meta.url)) {
+  const args = runArgs(ARGV_SPEC);
+  const cwd = resolve(args.cwd || process.cwd());
+  const report = deriveHill(cwd, args.slug);
+  console.log(JSON.stringify(report, null, 2));
+}

package/skills/tech-lead/scripts/ingest-result.mjs

@@ -10,7 +10,6 @@
 //   discoveries[]       → append to .shapeup/<slug>/discovery/ledger.md (old P3.7 / QA H.3)
 //   verdict.criteria[]  → append evaluation/.verdicts-<target>.jsonl (old evaluator B.0)
 //   verdict.refuted[]   → un-tick refuted AC boxes + set eval_verdict frontmatter (old B.2/B.2b)
-//   escalates[]         → queue .shapeup/<slug>/escalates/<order>.json for the orchestrator
 //
 // Zero dependencies, zero network, schema-validated input (a malformed result never mutates
 // the board). Single-writer becomes mechanically true, not aspirational.
@@ -108,21 +107,18 @@ export function updateBoardRow(indexBody, taskId, done) {
 /**
  * Apply one validated WorkResult to the working tree — the single-writer step (D6): ticks AC
  * boxes, flips task status, appends the Execution Log, propagates unblocks, appends discoveries,
- * writes the verdict ledger + un-ticks refuted boxes, and queues escalates.
- * @param {object} result - A schema-valid WorkResult (order_id, task_results[], discoveries[],
- *   verdict{criteria[],refuted[]}, escalates[]).
+ * writes the verdict ledger + un-ticks refuted boxes.
+ *   verdict{criteria[],refuted[]}).
  * @param {{cwd:string}} opts - cwd: working-directory root every LOCAL path resolves against.
  * @returns {{slug:string, tasks_updated:string[], acs_ticked:number, unblocked:string[],
- *   discoveries_appended:number, refuted_unticked:number, verdict_lines:number,
- *   escalates_queued:number}} A summary of every write performed.
+ *   discoveries_appended:number, refuted_unticked:number, verdict_lines:number}} A summary of every write performed.
  * @throws {Error} If a task/board/ledger file it must write is not writable (fs error propagates).
- *   Side effects: writes task files, `tasks/_index.md`, `discovery/ledger.md`,
- *   `evaluation/.verdicts-*.jsonl`, and `escalates/*.json` under `.shapeup/<slug>/`.
+ *   `evaluation/.verdicts-*.jsonl` under `.shapeup/<slug>/`.
  */
 export function applyResult(result, { cwd }) {
   const slug = result.order_id.split("/")[0];
   const local = localRoot(cwd, slug);
-  const summary = { slug, tasks_updated: [], acs_ticked: 0, unblocked: [], discoveries_appended: 0, refuted_unticked: 0, verdict_lines: 0, escalates_queued: 0 };
+  const summary = { slug, tasks_updated: [], acs_ticked: 0, unblocked: [], discoveries_appended: 0, refuted_unticked: 0, verdict_lines: 0 };
 
   // 1. Task results → task files + board (old task-executor P3.1/P3.2/P3.6).
   const boardIndex = join(local, "tasks", "_index.md");
@@ -228,14 +224,7 @@ export function applyResult(result, { cwd }) {
     }
   }
 
-  // 5. Escalates → a queue file the orchestrator adjudicates via advisor-protocol.
-  if (result.escalates?.length) {
-    const escDir = join(local, "escalates");
-    mkdirSync(escDir, { recursive: true });
-    const out = join(escDir, `${result.order_id.split("/")[1] || "run"}.json`);
-    writeFileSync(out, JSON.stringify(result.escalates, null, 2) + "\n");
-    summary.escalates_queued = result.escalates.length;
-  }
+
 
   return summary;
 }
@@ -265,6 +254,5 @@ if (isMainModule) {
     process.exit(1);
   }
   const s = applyResult(result, { cwd });
-  console.log(`✅ ingested ${result.order_id} — tasks: [${s.tasks_updated.join(", ")}] · ACs ticked: ${s.acs_ticked} · unblocked: [${s.unblocked.join(", ")}] · discoveries: ${s.discoveries_appended} · verdict lines: ${s.verdict_lines} · refuted un-ticked: ${s.refuted_unticked} · escalates queued: ${s.escalates_queued}`);
-  if (s.escalates_queued) process.exitCode = 0; // escalates are data, not failure
+  console.log(`✅ ingested ${result.order_id} — tasks: [${s.tasks_updated.join(", ")}] · ACs ticked: ${s.acs_ticked} · unblocked: [${s.unblocked.join(", ")}] · discoveries: ${s.discoveries_appended} · verdict lines: ${s.verdict_lines} · refuted un-ticked: ${s.refuted_unticked}`);
 }