shapeup-sdlc 1.6.2 → 1.7.0

package/bin/init.mjs

@@ -11,18 +11,17 @@
 //
 // The bash installers remain the stable curl-able entrypoints for existing bookmarks;
 // this is the `npx` front door. Both produce the same layout, and drift between them is
-// a bug (tests/structural keeps the shared bits honest).
+// a bug (the structural suite keeps the shared bits honest).
 //
 // Usage:
-//   npx shapeup-sdlc init [-d <dir>] [-y] [-o] [--cli claude,antigravity,codex|all]
+//   npx shapeup-sdlc init [-d <dir>] [-y] [-o]
 //
 // What it configures (identical to install-harness.sh):
 //   AGENTS.md harness block · Claude Code plugin (CLI or settings.json merge) ·
-//   Antigravity .agents/skills + subagents · Codex .codex/skills · CLAUDE.md @AGENTS.md
-//   import · .gitignore rules · shapeup/metrics/ · Tier C templates
+//   CLAUDE.md @AGENTS.md import · .gitignore rules · shapeup/metrics/ · Tier C templates
 
-import { readFileSync, writeFileSync, existsSync, mkdirSync, rmSync, cpSync, readdirSync, appendFileSync } from "node:fs";
-import { resolve, join, dirname, basename } from "node:path";
+import { readFileSync, writeFileSync, existsSync, mkdirSync, cpSync, appendFileSync } from "node:fs";
+import { resolve, join, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
 import { spawnSync } from "node:child_process";
 import { createInterface } from "node:readline";
@@ -35,31 +34,24 @@ const PKG_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
 const REPO = "nguyenvanphituoc/shapeup-sdlc-plugin";
 const MARKETPLACE_KEY = "nvptuoc-marketplace";
 const PLUGIN_KEY = "shapeup-sdlc-plugin@nvptuoc-marketplace";
-const ALL_CLIS = ["claude", "antigravity", "codex"];
 
 // ---- args -------------------------------------------------------------------
 const argv = process.argv.slice(2);
 const usage = `Usage: npx shapeup-sdlc init [options]
 Options:
   -d, --directory <path>   Target project directory (default: current directory)
-  --cli <list>             Comma-separated: claude,antigravity,codex or "all" (default: all)
   -o, --override           Overwrite existing files in target
   -y, --yes                Run unattended (answer yes to all prompts)
   -h, --help               Print this help`;
 
-let targetDir = ".", yes = false, override = false, clis = [...ALL_CLIS];
+let targetDir = ".", yes = false, override = false;
 const positional = [];
 for (let i = 0; i < argv.length; i++) {
   const a = argv[i];
   if (a === "-d" || a === "--directory") targetDir = argv[++i];
   else if (a === "-y" || a === "--yes") yes = true;
   else if (a === "-o" || a === "--override") override = true;
-  else if (a === "--cli") {
-    const v = argv[++i] || "";
-    clis = v === "all" ? [...ALL_CLIS] : v.split(",").map((s) => s.trim()).filter(Boolean);
-    const bad = clis.filter((c) => !ALL_CLIS.includes(c));
-    if (bad.length) { console.error(`Unknown CLI(s): ${bad.join(", ")}. Valid: ${ALL_CLIS.join(", ")}, all`); process.exit(1); }
-  } else if (a === "-h" || a === "--help") { console.log(usage); process.exit(0); }
+  else if (a === "-h" || a === "--help") { console.log(usage); process.exit(0); }
   else if (a.startsWith("-")) { console.error(`Unknown option: ${a}\n${usage}`); process.exit(1); }
   else positional.push(a);
 }
@@ -71,7 +63,6 @@ if (positional.length && positional[0] !== "init") {
 const target = resolve(targetDir);
 if (!existsSync(target)) { console.error(`Target directory does not exist: ${target}`); process.exit(1); }
 console.log(`Installing Shape Up SDLC Harness into: ${target}`);
-console.log(`CLIs: ${clis.join(", ")}`);
 
 // ---- confirmation -----------------------------------------------------------
 if (!yes) {
@@ -116,21 +107,16 @@ if (!existsSync(agentsSrc)) {
   }
 }
 
-// ---- 1. per-CLI install -----------------------------------------------------
-for (const cli of clis) {
-  if (cli === "claude") installClaude();
-  else replaceSkills(cli);
-}
+// ---- 1. Claude Code install -------------------------------------------------
+installClaude();
 
-// ---- 2. wire each CLI to the root AGENTS.md ---------------------------------
-if (clis.includes("claude")) ensureAgentImport(join(target, "CLAUDE.md"), "CLAUDE.md", "claude");
-if (clis.includes("antigravity")) ensureAgentImport(join(target, ".agents", "AGENTS.md"), ".agents/AGENTS.md", "auto");
-if (clis.includes("codex")) ensureAgentImport(join(target, ".codex", "AGENTS.md"), ".codex/AGENTS.md", "auto");
+// ---- 2. wire Claude Code to the root AGENTS.md ------------------------------
+ensureAgentImport(join(target, "CLAUDE.md"), "CLAUDE.md");
 
 // ---- 3. .gitignore ----------------------------------------------------------
-// Both roots are listed, deliberately. A project may be mid-migration (0006 moves `.shapeup/`
-// to `.shapeup/`), and a run trace committed by accident during that window is exactly the mistake
-// the tier split exists to prevent. Ignoring a directory that does not exist costs nothing.
+// Both roots are listed, deliberately. A project may still be carrying the pre-ADR-0001 local root
+// alongside the current one, and a run trace committed by accident from either is exactly the
+// mistake the tier split exists to prevent. Ignoring a directory that does not exist costs nothing.
 const GITIGNORE_RULE = `# Shape Up SDLC run workspace
 ${LOCAL}/
 ${LEGACY_LOCAL}/
@@ -244,7 +230,7 @@ function installClaude() {
 /**
  * Pre-approve the harness's OWN pipeline scripts, and nothing else.
  *
- * WHY THIS EXISTS (measured, on this project's own benchmark).
+ * WHY THIS EXISTS (observed, not theorized).
  *
  * Every load-bearing step of a run is a Node script that ships with the plugin and therefore
  * lives OUTSIDE the project — `${CLAUDE_PLUGIN_ROOT}/skills/**\/scripts/*.mjs`. Under any
@@ -252,10 +238,10 @@ function installClaude() {
  * directory needs approval. In an interactive session you click once and forget it. In a headless
  * one there is nobody to click, and the run cannot take its first step.
  *
- * That is not hypothetical. On `sdd-harness-bench`, the run receipt step (`init-run.mjs`) was
+ * That is not hypothetical. Without the grant, the run receipt step (`init-run.mjs`) gets
  * attempted six different ways in a single session — direct, via a heredoc, via two hand-written
- * wrapper scripts, via a sub-agent — and every one came back "This command requires approval".
- * The agent eventually gave up on the harness and built the feature by hand. It is the failure the
+ * wrapper scripts, via a sub-agent — and every one comes back "This command requires approval".
+ * The agent then gives up on the harness and builds the feature by hand. It is the failure the
  * receipt was designed to make visible, arriving through the door the receipt itself opened.
  *
  * Scope is deliberately narrow: `node <plugin>/skills/.../scripts/*.mjs`, by prefix. This grants
@@ -270,7 +256,7 @@ function installClaude() {
  * put every call site back outside the grant — the exact mismatch this fix exists to remove. The
  * unquoted prefix stays for older prose and for anything a user has already typed.
  *
- * `tests/structural/14-invocation-paths.mjs` asserts that every documented call site is in a form
+ * The structural suite asserts that every documented call site is in a form
  * one of these prefixes actually matches, so the two can never drift apart again.
  *
  * @param {object} settings - Parsed settings.json, mutated in place.
@@ -288,42 +274,11 @@ function mergePipelinePermissions(settings) {
   settings.permissions.allow = [...allow];
 }
 
-function replaceSkills(cli) {
-  const src = join(PKG_ROOT, "skills");
-  const dest = join(target, cli === "antigravity" ? ".agents" : ".codex", "skills");
-  mkdirSync(dest, { recursive: true });
-  let n = 0;
-  for (const name of readdirSync(src)) {
-    const skillPath = join(src, name);
-    if (!existsSync(join(skillPath, "SKILL.md"))) continue; // skip empty stubs
-    rmSync(join(dest, name), { recursive: true, force: true });
-    cpSync(skillPath, join(dest, name), { recursive: true });
-    n++;
-  }
-  console.log(`  [${cli}] ${n} skills replaced in ${rel(dest)}`);
-
-  if (cli === "antigravity") {
-    const distSub = join(PKG_ROOT, "dist", "antigravity", "subagents");
-    if (existsSync(distSub)) {
-      const subDest = join(target, ".agents", "subagents");
-      mkdirSync(subDest, { recursive: true });
-      cpSync(distSub, subDest, { recursive: true });
-      const idx = join(PKG_ROOT, "dist", "antigravity", "subagents.json");
-      if (existsSync(idx)) cpSync(idx, join(target, ".agents", "subagents.json"));
-      console.log(`  [antigravity] subagent configs replaced in ${rel(subDest)}`);
-    }
-  }
-}
-
-function ensureAgentImport(file, label, mode) {
+function ensureAgentImport(file, label) {
   mkdirSync(dirname(file), { recursive: true });
   if (!existsSync(file)) writeFileSync(file, "");
-  if (mode === "claude") {
-    if (!readFileSync(file, "utf8").includes("@AGENTS.md")) {
-      appendFileSync(file, "\n@AGENTS.md\n");
-      console.log(`Appended @AGENTS.md import tag to ${label}`);
-    } else console.log(`@AGENTS.md import tag already present in ${label}`);
-  } else {
-    console.log(`${label} ready (root AGENTS.md auto-discovered)`);
-  }
+  if (!readFileSync(file, "utf8").includes("@AGENTS.md")) {
+    appendFileSync(file, "\n@AGENTS.md\n");
+    console.log(`Appended @AGENTS.md import tag to ${label}`);
+  } else console.log(`@AGENTS.md import tag already present in ${label}`);
 }

package/commands/build.md

@@ -12,3 +12,22 @@ If no task ID was given, read the board (`.shapeup/<slug>/tasks/_index.md`) and
 next `ready` task, stating which one you picked. Respect the substrate: if scope contracts
 exist, writes outside the active scope's whitelist will be denied by the sandbox hook — that is
 the harness working, not an error to route around.
+
+## Building a whole scoped feature is not this command
+
+This command builds **one task**. A full BUILD round — every scope, the per-scope attempt loop,
+T0 verification, the inner circuit breaker, then the single EVAL — is a workflow-script launch, and
+it belongs to the orchestrator:
+
+```bash
+node "${CLAUDE_PLUGIN_ROOT}/skills/tech-lead/scripts/run-workflow.mjs" \
+  "${CLAUDE_PLUGIN_ROOT}/skills/tech-lead/workflows/shapeup-run.js" \
+  --args-file .shapeup/<slug>/run-args.json --run-dir .shapeup/<slug>/workflow-run
+```
+
+Reach it through `/ship` (or the `tech-lead` skill), which opens the run properly — `init-run.mjs`
+first, so the receipt exists. Do not hand-roll the round by calling this command once per task: the
+attempt loop, the T0 ratchet and the breakers are branches in that script, not steps a caller can
+be trusted to reproduce, and a session that rebuilds them by hand is the prose lane the cutover
+replaced. On a `--tiny` run or a spec with no committed `scopes/*.md`, the prose loop in
+`skills/tech-lead/references/round-protocol.md` still applies, unchanged and by design.

package/commands/eval.md

@@ -9,7 +9,8 @@ The single judge. Two modes, chosen by the arguments:
 - `--spec <folder> --feature <slug> --single-pass` — the once-per-round verdict on the whole
   board.
 
-Round mode is gated: a PreToolUse hook (GATE L2) will **deny** the dispatch while any task on
-the board is unfinished, naming the offenders. If that happens, the correct response is to
-route back to `/build` and finish them — do not retry the eval, do not argue with the hook, and
-do not use `--task` as a loophole to simulate a round verdict piecemeal.
+Round mode is watched: a PreToolUse hook (GATE L2) **warns** while any task on the board is
+unfinished, naming the offenders — advisory since ADR-0001, so the call proceeds, but a verdict
+taken now grades a partial board and the warning is recorded. The correct response is to route
+back to `/build` and finish them — do not shrug the warning off, and do not use `--task` as a
+loophole to simulate a round verdict piecemeal.

package/commands/scopes.md

@@ -5,10 +5,11 @@ This is step 8 (Map Scopes), which is two skills in sequence:
 
 1. Use the **ba-pitch-analyzer** skill on $ARGUMENTS — pitch → linked DDD spec tree (domain
    model → use cases → tasks) with BDD scenarios and the derived Test Surface. Pass through an
-   operation when the user names one: `analyze`, `generate-board`, `reconcile`,
-   `retrofit-surface`, or `coverage` (which writes the shared `requirements.md` registry).
-2. Then use the **scope-architect** skill to write the committed scope contracts
+   operation when the user names one: `analyze` (the default — spec tree + board), `reconcile`
+   (fold discovered-ledger items back into the board and UC invariants), `retrofit-surface`
+   (append a Test Surface to a spec written before there was one), or `coverage` (extract the
+   shared `requirements.md` registry that anchors covers-closure).
+2. Then use the **scope-architect** skill (`map-scopes`) to write the committed scope contracts
    (`scopes/*.md`) — import-graph slicing by flow, write-whitelist substrates, fixtures.
-   Operations: `map-scopes` (default), `remap`, `split-scope`.
 
 If the user asked for only one half ("just analyze", "just the contracts"), run only that half.

package/commands/shape.md

@@ -3,7 +3,7 @@ description: Shape a raw idea into a pitch (boundaries → breadboard → spike
 ---
 Use the **shapeup** skill on $ARGUMENTS.
 
-This is Phase 1 of the pipeline — it runs *before* any code and produces the `pitch.md` the
+This is Phase 1 of the pipeline — it runs *before* any code and produces the `shaping.md` and `breadboard.md` files (the pitch) that the
 Betting Table decides on. Default to the full sequence (`full`); when the user names a single
 step, pass it through as the sub-command: `shaping`, `breadboarding`, `spike`, `framing-doc`,
 `kickoff-doc`, or `breadboard-reflection`.

package/commands/ship.md

@@ -12,6 +12,39 @@ loop; do not skip gates by default.
 a session that dispatches the orchestrator and leaves no receipt is blocked at `Stop` by
 `hooks/gate-zerowork.mjs`.
 
+## How the run actually executes
+
+On a spec with committed `scopes/*.md` — the common case — `tech-lead` holds the L0 intake
+conversation, writes `project-profile.md`, then hands the whole pipeline to a single background
+launch and does not drive it turn by turn:
+
+```bash
+node "${CLAUDE_PLUGIN_ROOT}/skills/tech-lead/scripts/run-workflow.mjs" \
+  "${CLAUDE_PLUGIN_ROOT}/skills/tech-lead/workflows/shapeup-run.js" \
+  --args-file .shapeup/<slug>/run-args.json --run-dir .shapeup/<slug>/workflow-run
+```
+
+ORIENT → L1a → ANALYZE → WIRE → L1a.5 → MAP SCOPES → L1b → rounds of BUILD/L2/EVAL → QA → GATE H
+all run inside it. Three things follow, and they are the point of the cutover rather than trivia:
+
+- **A gate pause is a return value, not a stop.** The launch returns `{status: "paused", paused_at,
+  block}`; emit `block` **verbatim**, get the PO's decision, write it to
+  `.shapeup/<slug>/gate-answers.json`, and **relaunch the same call with the same args**. The
+  fast-forward re-derives position from disk and re-dispatches nothing already finished.
+- **A killed session loses nothing.** Resume state comes off disk, never from context, so a fresh
+  session picks the run up where it died — the property the whole launch shape exists to buy.
+- **Headless runs need `CLAUDE_CODE_PRINT_BG_WAIT_CEILING_MS=0` in the environment.** Without it
+  `claude -p` cuts the background wait at 600 s and **exits 0**, reporting a truncated run as a
+  clean one. Set it for any `--unattended` or CI invocation.
+- **Never launch this with the `Workflow` tool.** That call needs an interactive confirmation, so it
+  is denied in every headless session, and the only grant that unblocks it is unscoped. Left to it,
+  the script executes **zero** times and the agent improvises instead — a session can reach GATE L4
+  with a valid receipt while the pipeline never started. `run-workflow.mjs` runs the same script
+  under the path-scoped grant `npx shapeup-sdlc init` already writes.
+
+`--tiny`, and any spec with no committed `scopes/*.md` yet, take the unchanged prose lane in
+`skills/tech-lead/references/round-protocol.md` instead — non-regression, by design.
+
 Only run headless/auto if the user explicitly asks for it in their message:
 - `--auto` → advance low-risk gates automatically, still pause at L4 (Ship sign-off).
   Implies `--gate-answers guarded` unless a set is named.
@@ -22,8 +55,8 @@ Only run headless/auto if the user explicitly asks for it in their message:
   into GATE L0 in the same turn.
 
   > Why this is spelled out: asking for confirmation here made `--unattended` unusable for the
-  > only job it has. In a non-interactive invocation (`claude -p …`, a CI step, a benchmark probe)
-  > there is no second turn in which to answer, so the run spent its turn requesting permission and
+  > only job it has. In a non-interactive invocation (`claude -p …`, a CI step) there is no second
+  > turn in which to answer, so the run spent its turn requesting permission and
   > exited having written nothing. A headless flag that cannot complete a headless run is a defect,
   > not a safety feature — and the warning, which is the part that carries the safety value, is
   > still printed. `--auto` remains the middle setting that pauses at L4.
@@ -39,9 +72,9 @@ Additional flags, pass through to `tech-lead` only when the user names them:
   decision's **source** becomes the answer set instead of a live human, and the ledger says so.
   Generate one with `gate-answers.mjs --init --preset ci --by "<name>"`. This is what makes a
   headless lane finish: without it an unattended run waits at the first ⏸ until the wall-clock
-  budget expires (measured: a benchmark DNF at 1800s on a feature the control finished in 51s).
+  budget expires, having built nothing.
 - `--wall-clock-budget <seconds>` → arm the deadline breaker. Off by default. Set it in any lane
-  with a hard clock (CI, a benchmark, an overnight run) and set it *below* the external kill, so
+  with a hard clock (CI, an overnight run) and set it *below* the external kill, so
   the harness trips its own breaker first: past the deadline `hooks/gate-deadline.mjs` denies new
   `task-executor` work and routes to GATE H, where scope-hammer ships whatever is green. A run
   killed from outside ships nothing — including the scopes that already passed T0.

package/hooks/anti-rationalization.mjs

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
-// Anti-rationalization — advisory Stop hook (v1.2, absorb-audit P2).
+// Anti-rationalization — advisory Stop hook (v1.2).
 //
 // When the session's final message claims completion ("done", "all tests pass", "ready to
 // ship") while the harness's own mechanical facts disagree (unfinished board tasks, a red T0
-// verdict, unanswered escalates), this hook says so — to the user, out loud, with the facts.
+// verdict), this hook says so — to the user, out loud, with the facts.
 //
 // ADVISORY ONLY, by architectural invariant: "QA is a level-up, not a gate." This hook exits
 // 0 always and emits at most { systemMessage } — never { decision: "block" }, never exit 2.
@@ -59,9 +59,9 @@ export function activeSlug(cwd) {
 /**
  * Does the text claim the work is finished — or promise that it is about to be?
  *
- * The past-tense half is the original detector. The future-tense half was added after the SDD
- * harness benchmark produced a transcript this hook should have caught and structurally could
- * not: the session ended on "The tech-lead skill is orchestrating the full harness. It will: 1…".
+ * The past-tense half is the original detector. The future-tense half was added after a transcript
+ * this hook should have caught and structurally could not: the session ended on "The tech-lead
+ * skill is orchestrating the full harness. It will: 1…".
  * A promise at the END of a session is a completion claim wearing different grammar — the run is
  * over, and the thing it says it will do is never going to happen. Matching only past tense meant
  * the emptiest failures were the least detectable, which is backwards.
@@ -93,7 +93,7 @@ export function isFutureClaim(claim) {
 /** Read-only mechanical facts about the run — the evidence the claim is checked against. */
 export function gatherFacts(cwd, slug) {
   const root = localRoot(cwd, slug);
-  const facts = { unfinished: [], red_t0: null, open_escalates: 0, run_status: null, final_verdict: null };
+  const facts = { unfinished: [], red_t0: null, run_status: null, final_verdict: null };
 
   const tasksDir = join(root, "tasks");
   if (existsSync(tasksDir)) {
@@ -123,11 +123,6 @@ export function gatherFacts(cwd, slug) {
     }
   }
 
-  const escDir = join(root, "escalates");
-  if (existsSync(escDir)) {
-    facts.open_escalates = readdirSync(escDir).filter((f) => f.endsWith(".json")).length;
-  }
-
   const runPath = join(root, "harness-run.md");
   if (existsSync(runPath)) {
     try {
@@ -143,7 +138,7 @@ export function gatherFacts(cwd, slug) {
  * The facts that contradict a claim, as human-readable fragments.
  *
  * TENSE DECIDES WHICH FACTS COUNT, and getting this wrong is what makes a hook get disabled.
- * An unfinished board, a red T0 and unanswered escalates all contradict "it is done". NONE of
+ * An unfinished board and a red T0 both contradict "it is done". NEITHER of
  * them contradict "I am about to run the evaluator" — they are that sentence's PREMISE. Checking
  * a promise against them meant every healthy build round ended with the hook announcing that the
  * turn's own plan "disagrees with the facts", naming as evidence the very work the plan exists to
@@ -175,7 +170,6 @@ export function contradictions(claim, facts) {
     out.push(`${facts.unfinished.length} board task(s) not done (${named}${facts.unfinished.length > 5 ? ", …" : ""})`);
   }
   if (facts.red_t0) out.push(`latest T0 verdict ${facts.red_t0} is red`);
-  if (facts.open_escalates > 0) out.push(`${facts.open_escalates} escalate(s) unanswered`);
   if (facts.final_verdict === "fail") out.push("harness-run records final_verdict: fail");
   if (/ship/i.test(claim || "") && MID_RUN.has(facts.run_status)) out.push(`run status is still "${facts.run_status}"`);
   return out;

package/hooks/compact-snapshot.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// Compact snapshot — PreCompact hook (v1.2, absorb-audit P4).
+// Compact snapshot — PreCompact hook (v1.2).
 //
 // PreCompact provably CANNOT inject context (no additionalContext/systemMessage channel), so
 // this hook is a pure side effect: when a harness run is mid-flight, freeze a RunSnapshot to
@@ -11,10 +11,10 @@
 //
 // Contract: PreCompact stdin JSON { cwd, trigger: "manual"|"auto" }.
 
-// RECEIPTS (v1.5). This hook is the sharpest case for `hooks/lib/decision.mjs`: across 1.2M
-// benchmark tokens it was scored `Unfired` — 0 `PreCompact` events observed — and that score was
-// UNOBTAINABLE, because "never had to fire" and "never ran" produced identical evidence (exit 0,
-// no output). With a decision row per invocation the two become separable facts.
+// RECEIPTS (v1.5). This hook is the sharpest case for `hooks/lib/decision.mjs`: it is routinely
+// scored `Unfired` — 0 `PreCompact` events observed — and that score is UNOBTAINABLE, because
+// "never had to fire" and "never ran" produce identical evidence (exit 0, no output). With a
+// decision row per invocation the two become separable facts.
 
 import { deriveSnapshot, writeSnapshot } from "../skills/tech-lead/scripts/run-snapshot.mjs";
 import { isMain } from "../skills/tech-lead/scripts/lib/is-main.mjs";

package/hooks/gate-deadline.mjs

@@ -1,27 +1,23 @@
 #!/usr/bin/env node
 // GATE D — DEADLINE. PreToolUse hook. The wall-clock breaker, enforced rather than requested.
 //
-// WHY THIS EXISTS (measured, and it corrects an earlier diagnosis).
+// WHY THIS EXISTS (and it corrects an earlier diagnosis).
 //
-// SDD harness benchmark, F3 (Sonnet 5): this harness was killed at the declared 1800 s cap and
-// published as a DNF — no acceptance, no cost, no turns, a dash in every column. The natural
-// reading was "it stalled at a gate". Re-reading the retained transcript says the opposite:
+// A run killed at an external time cap looks exactly like a stall from outside: no acceptance, no
+// verdict, nothing to show. The natural reading is "it hung at a gate". Often the opposite is
+// true — the run was working, steadily, and was still working when the clock ran out.
 //
-//     327 assistant turns · 262 tool calls · 130 work calls · 37 file writes
-//     19 gate markers, last gate L3 · narration_ratio 0.047 · stall_signals 0
+// Both existing breakers count EVENTS (`round_budget` per round, `attempt_budget` per T0
+// attempt), so neither can observe that a single round has been running for half an hour. A run
+// can burn its whole budget with both breakers untouched.
 //
-// It was working — the least talkative shapeup run in the matrix — and it was still working when
-// the clock ran out. Both existing breakers count EVENTS (`round_budget` per round,
-// `attempt_budget` per T0 attempt), so neither can observe that a single round has been running
-// for twenty-nine minutes. The run burned its whole budget with both breakers untouched.
-//
-// The cost of that is not the DNF row. It is that an externally killed run ships NOTHING, not
+// The cost of that is not the missing verdict. It is that an externally killed run ships NOTHING, not
 // even the scopes that were already green. A breaker that trips from the inside routes to GATE H
 // instead: census, baseline comparison, ship the part that works. Same clock, different ending.
 //
 // WHAT IT DENIES, AND WHAT IT DELIBERATELY DOES NOT. Past the deadline this denies dispatches
-// that START NEW WORK — `task-executor`. It never denies `spec-evaluator`, `scope-hammer`,
-// `qa-edge-hunter` or `advisor-protocol`, because a run past its deadline must still be able to
+// that START NEW WORK — `task-executor`. It never denies `spec-evaluator`, `scope-hammer` or
+// `qa-edge-hunter`, because a run past its deadline must still be able to
 // judge, hammer and close. A breaker that also blocked the exit would strand the run with green
 // scopes it could not ship, which is the failure it exists to prevent.
 //
@@ -132,8 +128,8 @@ const reason = [
   "against the ideal), and produces a cut list. Ship what is green; the rest becomes a raw idea for",
   "the next Betting Table.",
   "",
-  "spec-evaluator, scope-hammer, qa-edge-hunter and advisor-protocol are all still permitted — a run",
-  "past its deadline must still be able to judge, hammer, and close.",
+  "spec-evaluator, scope-hammer and qa-edge-hunter are all still permitted — a run past its",
+  "deadline must still be able to judge, hammer, and close.",
   ...repeat,
 ].join("\n");
 

package/hooks/gate-intake.mjs

@@ -3,16 +3,14 @@
 //
 // Denies a `tech-lead` dispatch that carries no pitch, no spec folder, and no requirement text.
 //
-// WHY THIS EXISTS (measured, not theorized). On the SDD harness benchmark
-// (`sdd-harness-bench`, feature F2, Haiku 4.5, n=3, zero variance) the orchestrator was reached as
+// WHY THIS EXISTS (reproduced, not theorized). The orchestrator was reached as
 //
 //     Skill(tech-lead, args: "--unattended")
 //
 // — the flag survived the hand-off, the requirement text did not. With nothing to orchestrate,
-// the run printed eleven gate names, a confident plan, and wrote no code, scoring 29% against a
-// hidden acceptance suite while *looking* like a successful run. The same harness invoked with
-// --pitch/--spec scored 100%, n=3. A stronger model happened to inline the text and recover; a
-// cheaper one did not, three times out of three.
+// the run printed the gate names, a confident plan, and wrote no code, while *looking* like a
+// successful run. The same harness invoked with --pitch/--spec built the feature. Whether a model
+// happens to inline the text and recover is a property of the model, not of the harness.
 //
 // That is the "agent claims done" failure this project exists to prevent, happening at the
 // project's own front door. Every other invariant that matters here lives in the runtime; this one
@@ -29,10 +27,10 @@
 // Contract: PreToolUse stdin JSON { tool_name, tool_input:{skill_name|skill, skill_args|args}, ... }
 // Deny via { hookSpecificOutput: { hookEventName, permissionDecision:"deny", permissionDecisionReason } }.
 
-// RECEIPTS (v1.5). This gate was scored `No effect` — built, verified on 10 cases, and the
-// benchmark re-run still 4/14 — because the hook CORRECTLY never fired and the cause was elsewhere.
-// That distinction was unprovable from a hook that answers "inspected and permitted" and "never
-// ran" with the same silence. Every decision below is now recorded (hooks/lib/decision.mjs).
+// RECEIPTS (v1.5). This gate has been scored `No effect` on a re-run where the acceptance rate did
+// not move — because the hook CORRECTLY never fired and the cause was elsewhere. That distinction
+// is unprovable from a hook that answers "inspected and permitted" and "never ran" with the same
+// silence. Every decision below is now recorded (hooks/lib/decision.mjs).
 
 import { runHook, readStdin, settle } from "./lib/decision.mjs";
 
@@ -68,10 +66,11 @@ const hasResume = /--from\s+\S/.test(args); // resuming an existing run has its
 // Free text = anything left once flags and their values are removed.
 // Every flag that TAKES A VALUE must be listed here. A flag whose value is not stripped reads as
 // free requirement text, and the gate then defers on an empty intake — the exact dispatch it
-// exists to deny. This is a live failure mode, not a hypothetical: adding `--gate-answers ci` and
-// `--wall-clock-budget 2400` silently blinded the gate, and the very next benchmark run reached
-// tech-lead as `args:"--unattended --gate-answers ci --wall-clock-budget 2400"` — no requirement
-// text at all — and was waved straight through, because "ci" and "2400" counted as the spec.
+// exists to deny. This is a live failure mode, not a hypothetical: adding `--gate-answers` and
+// `--wall-clock-budget` without listing them here silently blinded the gate, and the very next run
+// reached tech-lead as `args:"--unattended --gate-answers ci --wall-clock-budget 2400"` — no
+// requirement text at all — and was waved straight through, because "ci" and "2400" counted as
+// the spec.
 // Adding a valued flag anywhere in the harness means adding it here, and structural test §39
 // enforces exactly that against commands/ship.md.
 const VALUED_FLAGS = /--(pitch|spec|from|lens|rounds|attempts|orch-model|exec-model|eval-model|qa-model|feature|task|gate-answers|wall-clock-budget|slug|auto-level|max-rounds|intake-file|intake-text|spec-folder|cwd|out|by|preset|file|order)\s+\S+/g;

package/hooks/gate-l2.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// GATE L2 — board-green check on the once-per-round EVAL. PreToolUse hook (audit Stage E1).
+// GATE L2 — board-green check on the once-per-round EVAL. PreToolUse hook.
 //
 // ADVISORY SINCE ADR-0001, and the downgrade was a deliberate product decision rather than a
 // retreat. This hook used to hard-DENY the EVAL delegation (tech-lead → spec-evaluator) while the
@@ -82,8 +82,8 @@ if (!roundMode) defer(hasTask ? "per-task eval — the board-green rule is about
 
 // 4. Locate the board. Since v0.4.0 (Local Tasks Architecture) it lives under the LOCAL
 //    gitignored root `.shapeup/<slug>/tasks/`, NOT the committed spec dir — resolving only
-//    `<spec>/tasks/` made this hook silently fail-open on every v0.4.0+ run (the island-escape
-//    hole: EVAL proceeded with 16/20 task files still `status: ready`).
+//    `<spec>/tasks/` made this hook silently fail-open on every v0.4.0+ run — EVAL proceeded with
+//    most of the board still `status: ready`.
 //    <slug> comes from --feature (the round invocation always carries it: tech-lead's eval plan
 //    is `--spec <path> --feature <slug> --single-pass`), falling back to the spec-path
 //    convention shapeup/<slug>/spec → parent dir name. `<spec>/tasks/` is kept as the