shapeup-sdlc 1.6.2 → 1.7.0

package/hooks/gate-zerowork.mjs

@@ -1,10 +1,9 @@
 #!/usr/bin/env node
 // GATE Z — ZERO-WORK. Blocking Stop hook. The detector for "the harness described itself".
 //
-// WHY THIS EXISTS (measured, not theorized).
+// WHY THIS EXISTS (reproduced, not theorized).
 //
-// SDD harness benchmark, F2, Haiku 4.5, n=5, zero variance. The orchestrator was dispatched
-// with a valid spec and returned this, in full:
+// Dispatched with a valid spec, the orchestrator returned this, in full:
 //
 //     TOOL   Skill(tech-lead, "--unattended --rounds 3\n\n# F2 — category budgets…")
 //     TEXT   "The tech-lead skill is orchestrating the full Shape Up harness. It will: 1. …"
@@ -50,9 +49,9 @@
 // SECOND CONDITION (v1.5). Since `hooks/lib/decision.mjs` gives every hook a receipt, this gate
 // gains a second, independent fact it can assert at `Stop`: the orchestrator was dispatched, and
 // `decisions.jsonl` holds ZERO rows for this pid — meaning the enforcement layer itself never ran.
-// That is F-16's class, not its instance: under a symlinked install every gate was inert while
-// every gate reported success. The detector for "the gates didn't run" now stops depending on the
-// gates running.
+// That is a whole CLASS of failure, not one instance: under a symlinked install every gate can be
+// inert while every gate reports success. The detector for "the gates didn't run" therefore stops
+// depending on the gates running.
 
 import { readFileSync, readdirSync, existsSync, statSync } from "node:fs";
 import { join } from "node:path";
@@ -62,13 +61,65 @@ import { runHook, readStdin, settle, decisionsPath } from "./lib/decision.mjs";
 
 const MAX_TRANSCRIPT_BYTES = 20 * 1024 * 1024;
 
-/** Tool names that constitute doing something to the project, as opposed to looking at it. */
+/**
+ * Tool names that constitute doing something to the project, as opposed to looking at it.
+ *
+ * The census these produce is now DESCRIPTIVE ONLY — it sharpens the block message and nothing
+ * decides on it. Until v1.7.1 a count above two was a fail-open ("the session did work by other
+ * means"), and it was retired for the reason spelled out at the `work-done` note below. `Workflow` stays absent because a launch is not work — it is the work this hook is
+ * asking about — and it is a DISPATCH signal instead (`dispatchedOrchestrator`).
+ */
 const WORK_TOOLS = new Set(["Write", "Edit", "MultiEdit", "NotebookEdit", "Bash", "Task", "Agent"]);
 
-/** Did this session dispatch the orchestrator? Skill(tech-lead) in any of its surface spellings. */
+/**
+ * Is this block a launch of the orchestrator's own workflow script, by either surface?
+ *
+ * TWO SURFACES, ONE INVARIANT. `Workflow({scriptPath})` is the tool form. The shipped
+ * front door is a Bash call — `node "…/scripts/run-workflow.mjs" "…/workflows/shapeup-run.js"` —
+ * because the tool form cannot be granted and is denied in every headless session. A gate that
+ * knew only the tool form would go blind on the lane users actually run, which is the same
+ * "the emptier the failure, the less of it there is to detect" hole the banner above describes.
+ *
+ * Matched on the BASENAME, anchored. `CLAUDE_PLUGIN_ROOT` itself ends in `shapeup-sdlc-plugin/` on
+ * a normal install — so a substring match on the whole path would count EVERY workflow script that
+ * happens to live under the plugin root, including one a user wrote for something else. The
+ * basename is the part the skill controls and the part `SKILL.md` names.
+ *
+ * @param {object} block - A `tool_use` content block.
+ * @returns {boolean} True when the block launches a `shapeup-*` workflow.
+ */
+function launchedShapeupWorkflow(block) {
+  if (block.name === "Bash") {
+    const cmd = String(block.input?.command ?? "");
+    // Both halves required: the launcher AND an orchestrator script. `run-workflow.mjs` carrying
+    // somebody else's workflow is not a harness dispatch, and neither is a bare mention of the
+    // script in an unrelated command (`ls`, `cat`).
+    return /\brun-workflow\.mjs\b/.test(cmd) && /[\\/]shapeup-[\w.-]*\.[cm]?js\b/.test(cmd);
+  }
+  if (block.name !== "Workflow") return false;
+  const scriptPath = String(block.input?.scriptPath ?? "");
+  const base = scriptPath.split(/[\\/]/).pop().replace(/\.[cm]?js$/, "");
+  const named = String(block.input?.name ?? "");
+  return /^shapeup-/.test(base) || /^shapeup-/.test(named);
+}
+
+/**
+ * Did this session dispatch the orchestrator? Three surface spellings, all equivalent:
+ * `Skill(tech-lead)`, a leading `/ship` slash command, and — since the workflow cutover (v1.7) —
+ * a `Workflow` tool_use launching one of the orchestrator's own `shapeup-*` scripts.
+ *
+ * The third arm is a correctness repair, not a new detector. `SKILL.md`'s Step 2 makes the
+ * Workflow launch the scoped lane's front door, so a session can now reach the orchestrator
+ * without ever emitting `Skill(tech-lead)` — and before this arm existed such a session was
+ * invisible to the gate, exactly the "the emptier the failure, the less of it there is to detect"
+ * hole the banner above describes. It is a TRIGGER, never an escape: a launch that left no
+ * receipt is still a blocked stop, because a `Workflow` call that returned without starting a run
+ * is precisely the narration case wearing a tool call.
+ */
 export function dispatchedOrchestrator(events) {
   for (const ev of events) {
     for (const block of toolUses(ev)) {
+      if (launchedShapeupWorkflow(block)) return true;
       if (block.name !== "Skill") continue;
       const skill = String(block.input?.skill ?? block.input?.skill_name ?? "");
       if (skill.split(":").pop() === "tech-lead") return true;
@@ -178,13 +229,18 @@ export function buildReason({ narration, census, enforcement }) {
     `Mechanical facts: ${census.tool_calls} tool call(s), ${census.work_calls} of them work calls, ` +
     `${census.writes} file write(s), and no \`${globLocal("<slug>", "receipt.json")}\`.`,
     narration ? `The final message reads as a plan, not a result (matched: "${narration}").` : null,
+    census.work_calls > 2
+      ? `Those ${census.work_calls} work calls are why this block exists, not a reason to waive it: a busy ` +
+        "session used to switch this gate off. Work done AROUND the harness has no board, no T0 verdict and " +
+        "no receipt — a hand-built feature can pass its own oracle while the pipeline never ran."
+      : null,
     enforcement && enforcement.readable && enforcement.rows === 0
       ? "AND the enforcement layer left zero decision rows — the gates did not merely permit this run, they never ran. " +
-        "Check the plugin install (a symlinked or spaced path was the measured cause; see lib/is-main.mjs)."
+        "Check the plugin install — a symlinked or spaced path is the usual cause; see lib/is-main.mjs."
       : null,
     "",
     "A run that describes its own pipeline and stops is the exact failure this harness exists to",
-    "prevent — measured at 29% acceptance with 10 escaped defects while looking like a clean run.",
+    "prevent: it reads like a clean run and leaves escaped defects behind it.",
     "Loading the instructions is not running them.",
     "",
     "Do the work now, starting with the first step of the runbook:",
@@ -195,7 +251,14 @@ export function buildReason({ narration, census, enforcement }) {
     "       --slug <slug> --intake-file <path/to/requirement.md> \\",
     "       --auto-level <interactive|auto|unattended> [--gate-answers <preset|path>]",
     "",
-    "Then proceed through the gates, resolving each one with:",
+    "Then launch the lane itself — a BACKGROUND Bash call, never the `Workflow` tool, which cannot be",
+    "granted and is denied outright in a headless session:",
+    "",
+    "  node \"${CLAUDE_PLUGIN_ROOT}/skills/tech-lead/scripts/run-workflow.mjs\" \\",
+    "       \"${CLAUDE_PLUGIN_ROOT}/skills/tech-lead/workflows/shapeup-run.js\" \\",
+    "       --args-file <.shapeup/<slug>/run-args.json> --run-dir <.shapeup/<slug>/workflow-run>",
+    "",
+    "Resolve each gate the run pauses at with:",
     "",
     "  node \"${CLAUDE_PLUGIN_ROOT}/skills/tech-lead/scripts/gate-answers.mjs\" --resolve <gate-id> …",
     "",
@@ -238,11 +301,29 @@ async function main() {
 
   const census = workCensus(events);
 
-  // Fail open when the session clearly did work by other means. A user may have run the harness
-  // steps by hand, or be on a pre-receipt version of the plugin. Real narration has ~zero work
-  // calls; this threshold keeps the hook off everything else.
-  if (census.work_calls > 2) defer(`${census.work_calls} work calls — the session did work by other means`, "work-done");
-
+  // ── The `work-done` fail-open is GONE, and its removal is the point.
+  //
+  // WHAT IT USED TO DO: `if (census.work_calls > 2) defer("the session did work by other means")`.
+  // The stated rationale was that a user may have run the harness steps by hand, or be on a
+  // pre-receipt version of the plugin.
+  //
+  // WHAT IT ACTUALLY DID, observed. `Skill(tech-lead)` was dispatched, the lane could not start,
+  // the agent hand-built the whole feature, and the hook ALLOWED the Stop on `"37 work calls — the
+  // session did work by other means"`. That session passed its own oracle and read like a clean
+  // run, with no board, no T0, no verdict and no receipt. A busy session was the one thing that
+  // could switch this gate off — so the harder the agent worked around the harness, the safer it
+  // was from the gate watching for exactly that.
+  //
+  // BOTH HALVES OF THE RATIONALE FAIL ON INSPECTION. Running the harness steps by hand starts with
+  // `init-run.mjs`, which writes the receipt — such a session already deferred at `receipt-present`
+  // two lines up and never reached here. And a pre-receipt plugin cannot be the one executing this
+  // hook: `init-run.mjs` ships in the same install, beside the `lib/` this file imports from.
+  // Neither case needs an escape, so no replacement escape is added — an escape that cannot fire
+  // is the "row that cannot fail" this project keeps catching.
+  //
+  // WHAT KEEPS THIS SAFE is not a threshold, it is the loop guard: `stop_hook_active` defers
+  // unconditionally, so a session that genuinely did the work outside the harness costs one extra
+  // turn and then stops. One nudge, never a hang. That is the trade this gate is worth.
   const message = typeof p.last_assistant_message === "string" ? p.last_assistant_message : "";
   const narration = detectNarration(message);
   const enforcement = enforcementCensus(cwd);

package/hooks/lib/decision.mjs

@@ -15,34 +15,42 @@
 //     validate-envelope  exit=0   stdout_len=0
 //
 // exit 0 + silence = allow. But that is ALSO what "inspected the board and deferred" looks like,
-// and what "no rule matched" looks like, and what a thrown exception looks like, and what F-16
-// looked like — a hook whose entire body silently never ran. Four states, one signature. No test,
-// orchestrator or auditor could tell them apart, which is how 26 enforcement points sat inert
-// behind 610 green checks while every one of them reported success.
+// and what "no rule matched" looks like, and what a thrown exception looks like, and what an inert
+// hook looks like — one whose entire body silently never ran. Four states, one signature. No test,
+// orchestrator or auditor can tell them apart, which is how a whole enforcement layer can sit
+// inert while every one of its checks reports success.
 //
 // FAIL-OPEN IS RETAINED, DELIBERATELY. `gate-l2.mjs` argues for it correctly in its own header: a
 // gate that breaks legitimate or standalone runs just gets disabled, and a disabled gate enforces
 // nothing. The defect was never the direction. It is that `allow` carried NO EVIDENCE.
 //
-// THE PREDICATE IS ALREADY INVENTED IN THIS REPO. `tests/structural/11-is-main.mjs` calls its
-// helper `spoke()` — did the script produce output? That is exactly the right question. It existed
-// only in the test harness, applied to entry points. This promotes it to runtime and applies it to
-// hooks, which closes F-16's whole CLASS rather than its instance:
+// THE PREDICATE IS ALREADY INVENTED IN THIS REPO. The structural suite calls its helper `spoke()`
+// — did the script produce output? That is exactly the right question. It existed only in the test
+// harness, applied to entry points. This promotes it to runtime and applies it to
+// hooks, which closes the whole CLASS rather than one instance of it:
 //
 //     inspected-and-permitted · no-rule-matched · threw · never ran
 //
-// all four become distinguishable facts in `.shapeup-sdlc/decisions.jsonl`.
+// all four become distinguishable facts in the decisions ledger.
 //
 // TIER: LOCAL, and checkout-wide rather than per-slug — hooks fire outside any run, so there is
 // frequently no `<slug>` to file under. Pure run-trace; the durable cross-machine record is the
 // committed metrics shard, which `stats --hooks` aggregates into.
 //
+// THE PATH IS RESOLVED, NEVER SPELLED. It comes from `lib/paths.mjs` — the same resolver
+// `stats.mjs --hooks` reads through. This file used to hardcode the pre-ADR-0001 root, so every
+// hook wrote its receipts to `.shapeup-sdlc/` while the only reader looked in `.shapeup/`:
+// `stats --hooks` reported zero hook activity on every project, which is indistinguishable from
+// the inert-enforcement-layer failure this file exists to make visible. A telemetry channel with
+// a hardcoded root is a telemetry channel with a silent disconnect in it.
+//
 // THE RECEIPT IS BEST-EFFORT BY DESIGN. An unwritable `decisions.jsonl` must never turn into a
 // failed tool call: a receipt that can break a run would get the whole layer disabled, which is
 // the exact outcome this file exists to prevent. Every write here is inside a try/catch.
 
 import { appendFileSync, mkdirSync } from "node:fs";
-import { join, dirname } from "node:path";
+import { dirname } from "node:path";
+import { decisions } from "../../skills/tech-lead/scripts/lib/paths.mjs";
 
 /**
  * Where the receipts land.
@@ -54,11 +62,11 @@ import { join, dirname } from "node:path";
  * contaminates is not an instrument.
  *
  * @param {string} [cwd] - Project root; defaults to the process cwd.
- * @returns {string} The ledger path — `SHAPEUP_DECISIONS_PATH` when set, else
- *   `<cwd>/.shapeup-sdlc/decisions.jsonl`.
+ * @returns {string} The ledger path — `SHAPEUP_DECISIONS_PATH` when set, else the LOCAL root's
+ *   `decisions.jsonl`, resolved through `lib/paths.mjs`.
  */
 export function decisionsPath(cwd) {
-  return process.env.SHAPEUP_DECISIONS_PATH || join(cwd || process.cwd(), ".shapeup-sdlc", "decisions.jsonl");
+  return process.env.SHAPEUP_DECISIONS_PATH || decisions(cwd || process.cwd());
 }
 
 /**

package/hooks/safety-spine.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// Safety spine — PreToolUse hook (v1.2, absorb-audit P1).
+// Safety spine — PreToolUse hook (v1.2).
 //
 // The three older hooks guard the PIPELINE (gate order, envelopes, substrates); this one
 // guards the MACHINE and the git remote — the substrate everything else sits on. It denies

package/hooks/sandbox-guard.mjs

@@ -1,26 +1,42 @@
 #!/usr/bin/env node
-// Sandbox guard — PreToolUse hook (design spec v1.1 §4.5/Blueprint E, PA3 countermeasure).
+// Sandbox guard — PreToolUse hook (the PA3 countermeasure: writes outside the order's substrate).
 //
-// Blocks Edit/Write/MultiEdit calls that touch a file outside the active scope's
-// `allowed_file_substrate` (+ declared `shared_substrate`). Turns "generator only edits its
-// own scope" from prose into a precondition the model cannot talk past — the same pattern as
-// hooks/gate-l2.mjs for GATE L2.
+// Blocks Edit/Write/MultiEdit calls that the ACTIVE ORDER's own `substrate` block does not
+// permit. Turns "a worker only writes what its order authorised" from prose into a precondition
+// the model cannot talk past.
+//
+// IT ENFORCES THE ORDER, NOT THE SCOPE CONTRACT, and that is the whole design. `compile-order.mjs`
+// already stamps a write contract onto every order from `substrateFor(operation)` — allowed,
+// shared, append_only, frozen. Resolving the scope contract instead covered exactly one operation,
+// the build, because only build orders carry a scope; every other dispatch (`analyze`, `wire`,
+// `evaluate`, `hunt`, `coach` …) ran unfenced, and the `frozen`/`append_only` surfaces the
+// compiler emits had no enforcer at all. Reading the order makes the contract the compiler writes
+// and the contract the hook enforces the same object, for every operation, with no per-operation
+// code here.
+//
+// It finds the order through `.shapeup/active-order`, which `compile-order.mjs` publishes as it
+// writes the order (and the workflow script re-points explicitly before each dispatch). Both
+// authors matter: the compiler's write is what fences the lanes that never reach the workflow —
+// `--tiny`, the prose round loop, a standalone `/build`.
 //
 // Design (deliberately conservative, mirrors gate-l2.mjs):
-//   • Fail-OPEN whenever there is nothing to enforce: no active-scope pointer (not running
-//     inside a scoped harness round), pointer names a scope contract that doesn't exist or is
-//     unparsable, or the tool call carries no resolvable file path. A guard that breaks
-//     legitimate non-harness edits would just get disabled.
-//   • Fail-CLOSED the moment an active scope IS declared and the target path matches none of
-//     its globs — deny, naming the substrate so the model can self-correct.
+//   • Fail-OPEN whenever there is nothing to enforce: no active-order pointer (not running inside
+//     a harness dispatch), pointer names an order that doesn't exist or is unparsable, the order
+//     declares no boundaries at all, or the tool call carries no resolvable file path. A guard
+//     that breaks legitimate non-harness edits would just get disabled.
+//   • Fail-CLOSED the moment an order IS live and the target is outside what it permits — deny,
+//     naming the reason so the model can self-correct. `frozen` outranks everything, including
+//     an `allowed` glob that would otherwise match; `append_only` permits Edit and denies Write,
+//     because Write overwrites what the append was supposed to preserve.
 //   • Run-trace carve-out — writes under the ACTIVE feature's LOCAL gitignored root
 //     (`.shapeup/<slug>/`) are always allowed: that root is harness bookkeeping the doer
 //     is REQUIRED to write (task-executor P3 status/AC ticks + tasks/_index.md, run-state,
 //     execution logs, the P3.7 discovery ledger). Substrate globs whitelist product code and
-//     never list the run-trace, so without the carve-out every scoped round strands its own
-//     board (island-escape shipped 16/20 task files stale this way). Deliberately narrow:
-//     only the active slug's root — `.shapeup/active-scope` (this guard's own pointer)
-//     and other features' roots remain subject to the substrate whitelist.
+//     never list the run-trace, so without the carve-out a scoped round leaves its own task files
+//     stale. Deliberately narrow: only the active slug's root. The pointers at the `.shapeup/`
+//     root — `active-order` (this guard's own) and `active-scope` — sit OUTSIDE the carve-out by
+//     construction, so a worker cannot widen its own sandbox by rewriting the thing that defines
+//     it.
 //   • Every denial is also appended to the metrics pathology log (telemetry, not just defense).
 //
 // Contract: PreToolUse stdin JSON { tool_name, tool_input:{file_path | edits[].file_path}, cwd }.
@@ -29,8 +45,7 @@
 import { readFileSync, existsSync, appendFileSync, mkdirSync } from "node:fs";
 import { resolve, join, relative, dirname, sep } from "node:path";
 import { isMain } from "../skills/tech-lead/scripts/lib/is-main.mjs";
-import { LOCAL, activeScope, scopeContract, metricsShard } from "../skills/tech-lead/scripts/lib/paths.mjs";
-import { readContract, SCOPE_CONTRACT } from "../skills/tech-lead/scripts/lib/contract-md.mjs";
+import { LOCAL, activeOrder, metricsShard } from "../skills/tech-lead/scripts/lib/paths.mjs";
 import { runHook, readStdin, settle } from "./lib/decision.mjs";
 
 // --- tiny glob matcher: supports *, **, ? — enough for substrate globs, zero dependencies ---
@@ -97,46 +112,67 @@ async function main() {
   }
 
   const cwd = p.cwd || process.cwd();
-  const activeScopePath = activeScope(cwd);
-  // no harness round in progress → don't enforce
-  if (!existsSync(activeScopePath)) defer("no active-scope pointer — no harness round in progress", "no-round");
-
-  const active = readJSON(activeScopePath);
-  if (!active?.slug || !active?.scope_id) defer("active-scope pointer is unreadable or incomplete", "bad-pointer");
-
-  // Markdown first, legacy JSON second (ADR-0001) — a project mid-migration must stay sandboxed.
-  let found = null;
-  try { found = readContract(scopeContract(cwd, active.slug, active.scope_id), SCOPE_CONTRACT); }
-  catch (e) { defer(`scope contract is unparseable (${e.message})`, "bad-contract"); }
-  // pointer stale / contract not committed yet → don't break the run
-  if (!found) defer(`no contract for ${active.scope_id} — pointer stale or not committed yet`, "no-contract");
-  const contract = found.contract;
-  if (!contract) defer("scope contract is unparseable", "bad-contract");
-
-  const allowed = [...(contract.allowed_file_substrate || []), ...(contract.shared_substrate || [])];
-  // no whitelist declared → nothing to enforce
-  if (allowed.length === 0) defer(`scope ${active.scope_id} declares no write whitelist`, "no-whitelist");
+  const activeOrderPath = activeOrder(cwd);
+  if (!existsSync(activeOrderPath)) defer("no active-order pointer — no tracked task running", "no-round");
+
+  const active = readJSON(activeOrderPath);
+  if (!active?.slug || !active?.order_path) defer("active-order pointer is unreadable or incomplete", "bad-pointer");
+
+  const orderPathAbs = resolve(cwd, active.order_path);
+  if (!existsSync(orderPathAbs)) defer(`no order found at ${active.order_path}`, "no-order");
+
+  const order = readJSON(orderPathAbs);
+  if (!order?.substrate) defer("active order has no substrate block", "no-substrate");
+
+  const contract = order.substrate;
+  const allowed = [...(contract.allowed || []), ...(contract.shared || [])];
+  const appendOnly = contract.append_only || [];
+  const frozen = contract.frozen || [];
+
+  if (allowed.length === 0 && appendOnly.length === 0 && frozen.length === 0) {
+    defer(`order declares no write/append/frozen boundaries`, "no-whitelist");
+  }
 
   const targetPaths = extractPaths(p.tool_input);
   if (targetPaths.length === 0) defer("no writable path in the tool input", "no-target");
 
   const metricsPath = metricsShard(cwd);
-  // Run-trace carve-out (see header): the active feature's LOCAL root only. The prefix ends
-  // with a separator so a sibling `<local>/<slug>-other/` can't ride along, and the active-scope
-  // pointer sits outside it by construction.
   const runTracePrefix = join(LOCAL, active.slug) + sep;
   const violations = [];
+  const blockReasons = [];
+
   for (const raw of targetPaths) {
     const abs = resolve(cwd, raw);
     const rel = relative(cwd, abs);
     if (rel.startsWith(runTracePrefix)) continue;
-    if (!matchesAny(rel, allowed)) violations.push(rel);
+    
+    // frozen takes absolute precedence
+    if (matchesAny(rel, frozen)) {
+      violations.push(rel);
+      blockReasons.push(`${rel} is frozen`);
+      continue;
+    }
+
+    if (matchesAny(rel, allowed)) {
+      continue; // OK
+    }
+
+    if (matchesAny(rel, appendOnly)) {
+      if (p.tool_name === "Write") {
+        violations.push(rel);
+        blockReasons.push(`${rel} is append-only (Write overwrites, use Edit)`);
+      }
+      continue;
+    }
+
+    violations.push(rel);
+    blockReasons.push(`${rel} is outside allowed scopes`);
   }
 
   // Inside the substrate — the "inspected and permitted" row. Previously byte-identical to
   // "this hook never ran", which is how 26 enforcement points sat inert behind 610 green checks.
   if (violations.length === 0) {
-    defer(`${targetPaths.length} path(s) inside scope ${active.scope_id} substrate — permitted`, "in-substrate");
+    defer(`${targetPaths.length} path(s) inside order substrate — permitted`, "in-substrate");
   }
 
   logPathology(metricsPath, {
@@ -144,23 +180,23 @@ async function main() {
     at: new Date().toISOString(),
     kind: "pathology",
     pathology: "PA3",
-    scope_id: active.scope_id,
+    order: active.order_path,
     slug: active.slug,
     blocked_paths: violations,
   });
 
   return {
-    verdict: "deny", event: "PreToolUse", tool: p.tool_name, subject: active.scope_id, cwd,
+    verdict: "deny", event: "PreToolUse", tool: p.tool_name, subject: active.order_path, cwd,
     rule: "outside-substrate",
-    reason: `${violations.length} write(s) outside the scope substrate: ${violations.join(", ")}`,
+    reason: `${violations.length} write(s) rejected by substrate boundaries: ${blockReasons.join("; ")}`,
     payload: {
       hookSpecificOutput: {
         hookEventName: "PreToolUse",
         permissionDecision: "deny",
         permissionDecisionReason:
-          `Sandbox guard (PA3) — scope "${active.scope_id}" may only write ${JSON.stringify(allowed)}. ` +
-          `Blocked: ${violations.join(", ")}. If this write legitimately crosses scopes, add the path to ` +
-          `the contract's shared_substrate (via ba --remap) rather than editing outside the substrate.`,
+          `Sandbox guard (PA3) — active order substrate blocked these writes:\n` +
+          `${blockReasons.join("\n")}\n` +
+          `If this write legitimately crosses scopes, the order's substrate needs to be expanded (e.g. via ba --remap).`,
       },
     },
   };

package/hooks/session-rehydrate.mjs

@@ -16,13 +16,12 @@
 // `SessionStart:startup`, and the reflex whose entire purpose is "trust the files, not your
 // memory" did not fire in the one case where there IS no memory to distrust.
 //
-// The SDD harness benchmark measured the cost. Its F4 handoff design is exactly this scenario — a
-// fresh `claude -p` in a workspace where a prior session was cut mid-build — and across three
-// Sonnet rows every one recorded `hooks_fired: ["SessionStart:startup"]` (the plugin's load echo,
-// not this hook). With no pointer to the run in flight, the orchestrator re-entered at phase 1:
-// 82–120 turns before its first write, $4.57–$10.36 for the session, and **0/3 of the gap closed**
-// while the run receipt and board sat on disk the whole time. One row reached GATE L4 — ship
-// sign-off — having advanced the deliverable by zero criteria.
+// The cost is concrete. A fresh session in a workspace where a prior one was cut mid-build sees
+// only `SessionStart:startup` — the plugin's load echo, not this hook. With no pointer to the run
+// in flight, the orchestrator re-enters at phase 1 and spends its whole budget rebuilding a
+// pipeline that is already on disk, closing none of the gap, while the run receipt and board sit
+// there the entire time. A session can reach GATE L4 — ship sign-off — having advanced the
+// deliverable by zero criteria.
 //
 // Firing on `startup` is free when there is nothing to say: `findRun` returns a run only for an
 // `active-scope` pointer or a `harness-run.md` whose status is mid-run, so an ordinary session in a
@@ -50,8 +49,8 @@ import { activeScope } from "../skills/tech-lead/scripts/lib/paths.mjs";
 //
 //   compact / resume — the risk is acting on a lossy summary of work you remember doing.
 //   startup / clear  — the risk is not knowing the run exists, and OPENING IT AGAIN. That is the
-//                      failure the benchmark measured: a fresh session re-entered at phase 1 and
-//                      spent 82–120 turns rebuilding a pipeline that was already on disk.
+//                      failure that actually happens: a fresh session re-enters at phase 1 and
+//                      spends its budget rebuilding a pipeline that was already on disk.
 //
 // Naming the right failure is the whole value of the injection. A generic pointer to the files is
 // what a competent agent finds anyway; "there is a run open, do not re-open it" is not.

package/hooks/slop-cleaner.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// Slop cleaner — advisory Stop hook (v1.2, absorb-audit P2).
+// Slop cleaner — advisory Stop hook (v1.2).
 //
 // Scans what actually changed this session (git diff of the working tree; fallback: the
 // newest WorkResult's files_touched) for the classic leftovers — TODO/FIXME markers,

package/oracles/_shared.mjs

@@ -1,4 +1,4 @@
-// Shared helpers for evaluation-contract oracle runners (Stage G of the audit).
+// Shared helpers for evaluation-contract oracle runners.
 //
 // The `process` oracle (step 1–3) inlined these; the test/snapshot/http oracles (steps 4–5)
 // import them so the matching grammar is identical across the registry. Keeping one definition

package/oracles/http-oracle.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// `http` oracle for the evaluation contract (Stage G, step 5 of the audit).
+// `http` oracle for the evaluation contract.
 //
 // Deliverable: a service / API. The oracle starts the server, waits until it is reachable,
 // sends each criterion's request, and grades the OBSERVED response (status + body) — never the

package/oracles/index.mjs

@@ -1,4 +1,4 @@
-// Oracle registry for the evaluation contract (Stage G of the audit).
+// Oracle registry for the evaluation contract.
 //
 // The single entry point `spec-evaluator` dispatches through when a criterion / Test-Surface row
 // carries an `oracle:` tag. Adding a new oracle type = registering one runner here (the spec's

package/oracles/process-oracle.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// Shared `process` oracle for the evaluation contract (Stage G of the audit).
+// Shared `process` oracle for the evaluation contract.
 //
 // This is the promoted, parameterized form of the todo-cli prototype: instead of hard-coding
 // criteria, it reads a *declarative contract* (a list of criteria, each with a `probe` and an

package/oracles/snapshot-oracle.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// `snapshot` oracle for the evaluation contract (Stage G, step 4b of the audit).
+// `snapshot` oracle for the evaluation contract.
 //
 // Deliverable: a generator or a pure refactor — something whose acceptance is "produces exactly
 // this output". The oracle runs the deliverable, captures its stdout, and diffs it against a

package/oracles/test-oracle.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// `test` oracle for the evaluation contract (Stage G, step 4a of the audit).
+// `test` oracle for the evaluation contract.
 //
 // Deliverable: a library / module whose acceptance is "its own test suite is green".
 // The oracle runs the project's test command and grades the OBSERVED suite result —

package/package.json

@@ -1,14 +1,13 @@
 {
   "name": "shapeup-sdlc",
-  "version": "1.6.2",
-  "description": "Shape Up for coding agents — with gates the agent can't talk its way past. Harness for Claude Code, compiled to Cursor, Antigravity and Codex.",
+  "version": "1.7.0",
+  "description": "Shape Up for coding agents \u2014 with gates the agent can't talk its way past. Harness for Claude Code.",
   "bin": {
     "shapeup-sdlc": "bin/init.mjs"
   },
   "files": [
     "bin/",
     "skills/",
-    "!skills/**/evals/**",
     "hooks/",
     "commands/",
     "oracles/",
@@ -34,14 +33,11 @@
   },
   "scripts": {
     "test": "node tests/structural.mjs",
-    "demo": "node tools/demo/record-demo.mjs",
-    "distribute": "node tools/distribute.js"
+    "demo": "node tools/demo/record-demo.mjs"
   },
   "keywords": [
     "shapeup",
     "sdlc",
-    "cursor",
-    "antigravity",
     "claude-code"
   ],
   "author": "Liberty Nguyen",