shapeup-sdlc 1.6.2

package/hooks/anti-rationalization.mjs

@@ -0,0 +1,244 @@
+#!/usr/bin/env node
+// Anti-rationalization — advisory Stop hook (v1.2, absorb-audit P2).
+//
+// When the session's final message claims completion ("done", "all tests pass", "ready to
+// ship") while the harness's own mechanical facts disagree (unfinished board tasks, a red T0
+// verdict, unanswered escalates), this hook says so — to the user, out loud, with the facts.
+//
+// ADVISORY ONLY, by architectural invariant: "QA is a level-up, not a gate." This hook exits
+// 0 always and emits at most { systemMessage } — never { decision: "block" }, never exit 2.
+// A blocking Stop hook would be a second gate behind the single judge (spec-evaluator).
+//
+// Harness-scoped: fires only when a run is actually active (.shapeup/active-scope
+// exists, or some .shapeup/*/harness-run.md is mid-build). An always-on nag on
+// non-harness work is exactly the annoyance that gets hooks disabled.
+//
+// Contract: Stop stdin JSON { cwd, stop_hook_active, last_assistant_message, transcript_path }.
+
+import { readFileSync, readdirSync, existsSync, statSync } from "node:fs";
+import { join } from "node:path";
+import { isMain } from "../skills/tech-lead/scripts/lib/is-main.mjs";
+import { localDir, localRoot, activeScope } from "../skills/tech-lead/scripts/lib/paths.mjs";
+
+import { runHook, readStdin, settle } from "./lib/decision.mjs";
+
+function readJSON(p) {
+  try { return JSON.parse(readFileSync(p, "utf8")); } catch { return null; }
+}
+
+function frontmatter(text) {
+  const m = /^---\n([\s\S]*?)\n---/.exec(text || "");
+  if (!m) return {};
+  const fm = {};
+  for (const line of m[1].split("\n")) {
+    const kv = /^([A-Za-z_][\w-]*):\s*(.*)$/.exec(line.trim());
+    if (kv) fm[kv[1]] = kv[2].replace(/^['"]|['"]$/g, "");
+  }
+  return fm;
+}
+
+const MID_RUN = new Set(["orienting", "mapping", "building", "evaluating"]);
+
+/** The active harness slug, or null when no run is in progress. */
+export function activeSlug(cwd) {
+  const pointer = readJSON(activeScope(cwd));
+  if (pointer?.slug) return pointer.slug;
+  const root = localDir(cwd);
+  if (!existsSync(root)) return null;
+  for (const entry of readdirSync(root)) {
+    const runPath = join(root, entry, "harness-run.md");
+    if (!existsSync(runPath)) continue;
+    try {
+      const fm = frontmatter(readFileSync(runPath, "utf8"));
+      if (MID_RUN.has(fm.status)) return entry;
+    } catch { /* unreadable run file → not this one */ }
+  }
+  return null;
+}
+
+/**
+ * Does the text claim the work is finished — or promise that it is about to be?
+ *
+ * The past-tense half is the original detector. The future-tense half was added after the SDD
+ * harness benchmark produced a transcript this hook should have caught and structurally could
+ * not: the session ended on "The tech-lead skill is orchestrating the full harness. It will: 1…".
+ * A promise at the END of a session is a completion claim wearing different grammar — the run is
+ * over, and the thing it says it will do is never going to happen. Matching only past tense meant
+ * the emptiest failures were the least detectable, which is backwards.
+ *
+ * (The zero-work case — dispatched and never started — belongs to `gate-zerowork.mjs`, which
+ * blocks on a mechanical absence rather than on phrasing. This one covers narration INSIDE a run
+ * that did start.)
+ */
+const FUTURE_CLAIM = /\b(will (?:now )?(?:run|orchestrate|execute|proceed|begin|start)|is orchestrating|I'?ll (?:now )?(?:run|start|begin|orchestrate)|going to (?:run|orchestrate|execute))\b/i;
+
+export function detectClaim(text) {
+  if (!text || typeof text !== "string") return null;
+  const past = /\b(done|complete(?:d)?|finished|shipped|ready to ship|all (?:tests|tasks) pass(?:ing|ed)?|everything works)\b/i.exec(text);
+  if (past) return past[1];
+  const future = FUTURE_CLAIM.exec(text);
+  return future ? future[0] : null;
+}
+
+/**
+ * Is this claim a promise about work still to come, rather than an assertion that work is done?
+ * The two are checked against DIFFERENT facts — see contradictions().
+ * @param {string} claim - The matched claim fragment from detectClaim().
+ * @returns {boolean} True for a future-tense promise.
+ */
+export function isFutureClaim(claim) {
+  return typeof claim === "string" && FUTURE_CLAIM.test(claim);
+}
+
+/** Read-only mechanical facts about the run — the evidence the claim is checked against. */
+export function gatherFacts(cwd, slug) {
+  const root = localRoot(cwd, slug);
+  const facts = { unfinished: [], red_t0: null, open_escalates: 0, run_status: null, final_verdict: null };
+
+  const tasksDir = join(root, "tasks");
+  if (existsSync(tasksDir)) {
+    for (const f of readdirSync(tasksDir)) {
+      if (!/^TASK-.*\.md$/.test(f)) continue;
+      try {
+        const fm = frontmatter(readFileSync(join(tasksDir, f), "utf8"));
+        if (fm.status && fm.status !== "done") facts.unfinished.push(fm.id || f.replace(/\.md$/, ""));
+      } catch { /* unreadable task file → no fact */ }
+    }
+  }
+
+  const verdictsDir = join(root, "t0", "verdicts");
+  if (existsSync(verdictsDir)) {
+    let latest = null;
+    for (const f of readdirSync(verdictsDir)) {
+      const m = /^r(\d+)-a(\d+)\.json$/.exec(f);
+      if (!m) continue;
+      const key = [Number(m[1]), Number(m[2])];
+      if (!latest || key[0] > latest.key[0] || (key[0] === latest.key[0] && key[1] > latest.key[1])) {
+        latest = { key, file: f };
+      }
+    }
+    if (latest) {
+      const verdict = readJSON(join(verdictsDir, latest.file));
+      if (verdict?.overall === "red") facts.red_t0 = latest.file.replace(/\.json$/, "");
+    }
+  }
+
+  const escDir = join(root, "escalates");
+  if (existsSync(escDir)) {
+    facts.open_escalates = readdirSync(escDir).filter((f) => f.endsWith(".json")).length;
+  }
+
+  const runPath = join(root, "harness-run.md");
+  if (existsSync(runPath)) {
+    try {
+      const fm = frontmatter(readFileSync(runPath, "utf8"));
+      facts.run_status = fm.status || null;
+      facts.final_verdict = fm.final_verdict || null;
+    } catch { /* no fact */ }
+  }
+  return facts;
+}
+
+/**
+ * The facts that contradict a claim, as human-readable fragments.
+ *
+ * TENSE DECIDES WHICH FACTS COUNT, and getting this wrong is what makes a hook get disabled.
+ * An unfinished board, a red T0 and unanswered escalates all contradict "it is done". NONE of
+ * them contradict "I am about to run the evaluator" — they are that sentence's PREMISE. Checking
+ * a promise against them meant every healthy build round ended with the hook announcing that the
+ * turn's own plan "disagrees with the facts", naming as evidence the very work the plan exists to
+ * do. This file's header calls an always-on nag "exactly the annoyance that gets hooks disabled",
+ * and the sibling future-tense detector in gate-zerowork.mjs is marked advisory for the same
+ * reason. So a promise is contradicted by one thing only: a run that is already CLOSED, where the
+ * promised work is never going to happen.
+ *
+ * The zero-work case that motivated future-tense detection — a session that dispatches, narrates
+ * "it will: 1…", and stops having written nothing — is gate-zerowork.mjs's, which blocks on a
+ * mechanical absence rather than on phrasing. It is not this hook's to double-report.
+ *
+ * @param {string} claim - The matched claim fragment from detectClaim().
+ * @param {object} facts - Mechanical facts from gatherFacts().
+ * @returns {string[]} Human-readable contradiction fragments; empty means the claim stands.
+ */
+export function contradictions(claim, facts) {
+  const out = [];
+
+  if (isFutureClaim(claim)) {
+    if (facts.run_status === "shipped" || facts.run_status === "escalated") {
+      out.push(`run status is already "${facts.run_status}" — the run is closed, so the promised work cannot happen in it`);
+    }
+    return out;
+  }
+
+  if (facts.unfinished.length > 0) {
+    const named = facts.unfinished.slice(0, 5).join(", ");
+    out.push(`${facts.unfinished.length} board task(s) not done (${named}${facts.unfinished.length > 5 ? ", …" : ""})`);
+  }
+  if (facts.red_t0) out.push(`latest T0 verdict ${facts.red_t0} is red`);
+  if (facts.open_escalates > 0) out.push(`${facts.open_escalates} escalate(s) unanswered`);
+  if (facts.final_verdict === "fail") out.push("harness-run records final_verdict: fail");
+  if (/ship/i.test(claim || "") && MID_RUN.has(facts.run_status)) out.push(`run status is still "${facts.run_status}"`);
+  return out;
+}
+
+function lastAssistantFromTranscript(transcriptPath) {
+  try {
+    if (!transcriptPath || !existsSync(transcriptPath)) return null;
+    if (statSync(transcriptPath).size > 20 * 1024 * 1024) return null; // stay cheap
+    const lines = readFileSync(transcriptPath, "utf8").trim().split("\n");
+    for (let i = lines.length - 1; i >= 0 && i >= lines.length - 64; i--) {
+      let entry;
+      try { entry = JSON.parse(lines[i]); } catch { continue; }
+      const msg = entry?.message;
+      if (entry?.type === "assistant" || msg?.role === "assistant") {
+        const content = msg?.content ?? entry?.content;
+        if (typeof content === "string") return content;
+        if (Array.isArray(content)) {
+          return content.filter((b) => b?.type === "text").map((b) => b.text).join("\n");
+        }
+      }
+    }
+  } catch { /* unreadable transcript → no claim source */ }
+  return null;
+}
+
+async function main() {
+  await runHook("anti-rationalization", async () => {
+  const raw = await readStdin();
+  let p;
+  /** Stay silent — with the reason on the record (hooks/lib/decision.mjs). */
+  const defer = (reason, rule) => settle({ verdict: "allow", event: "Stop", cwd: p?.cwd, reason, rule });
+  try { p = JSON.parse(raw || "{}"); }
+  catch (e) { settle({ verdict: "error", event: "Stop", reason: `unparseable payload: ${e.message}` }); }
+
+  if (p.stop_hook_active) defer("stop_hook_active — never participate in a stop-hook loop", "loop-guard");
+
+  const cwd = p.cwd || process.cwd();
+  const slug = activeSlug(cwd);
+  if (!slug) defer("no active run — nothing to check the claim against", "no-run");
+
+  const message = typeof p.last_assistant_message === "string" && p.last_assistant_message
+    ? p.last_assistant_message
+    : lastAssistantFromTranscript(p.transcript_path);
+  const claim = detectClaim(message);
+  if (!claim) defer("the final message makes no completion claim", "no-claim");
+
+  const facts = gatherFacts(cwd, slug);
+  const contra = contradictions(claim, facts);
+  if (contra.length === 0) defer(`claim "${claim}" agrees with the run facts — inspected and permitted`, "claim-supported");
+
+  return {
+    verdict: "allow", event: "Stop", cwd, subject: slug, rule: "claim-contradicted", emit: true,
+    reason: `claim "${claim}" contradicted by ${contra.length} fact(s) — advisory note emitted, not a block`,
+    payload: {
+      systemMessage:
+        `anti-rationalization (advisory): the last message claims "${claim}" but run "${slug}" facts disagree — ` +
+        `${contra.join("; ")}. Not blocking (QA is a level-up, not a gate) — verify against the board and T0 before shipping.`,
+    },
+  };
+  });
+}
+
+if (isMain(import.meta.url)) {
+  main();
+}

package/hooks/compact-snapshot.mjs

@@ -0,0 +1,47 @@
+#!/usr/bin/env node
+// Compact snapshot — PreCompact hook (v1.2, absorb-audit P4).
+//
+// PreCompact provably CANNOT inject context (no additionalContext/systemMessage channel), so
+// this hook is a pure side effect: when a harness run is mid-flight, freeze a RunSnapshot to
+// .shapeup/<slug>/run-snapshot.json before the conversation is compacted. It is the
+// audit anchor ("what did the files say the moment the summary was made?") and the fallback
+// hooks/session-rehydrate.mjs reads if live derivation ever throws post-compact.
+//
+// Never blocks compaction: the whole body is fail-open, exit 0 always.
+//
+// Contract: PreCompact stdin JSON { cwd, trigger: "manual"|"auto" }.
+
+// RECEIPTS (v1.5). This hook is the sharpest case for `hooks/lib/decision.mjs`: across 1.2M
+// benchmark tokens it was scored `Unfired` — 0 `PreCompact` events observed — and that score was
+// UNOBTAINABLE, because "never had to fire" and "never ran" produced identical evidence (exit 0,
+// no output). With a decision row per invocation the two become separable facts.
+
+import { deriveSnapshot, writeSnapshot } from "../skills/tech-lead/scripts/run-snapshot.mjs";
+import { isMain } from "../skills/tech-lead/scripts/lib/is-main.mjs";
+import { runHook, readStdin } from "./lib/decision.mjs";
+
+async function main() {
+  await runHook("compact-snapshot", async () => {
+    const raw = await readStdin();
+    let p;
+    try { p = JSON.parse(raw || "{}"); }
+    catch (e) { return { verdict: "error", event: "PreCompact", reason: `unparseable payload: ${e.message}` }; }
+    const cwd = p.cwd || process.cwd();
+    try {
+      const snapshot = deriveSnapshot(cwd);
+      if (!snapshot) return { verdict: "allow", event: "PreCompact", cwd, reason: "no active run — nothing to freeze" };
+      writeSnapshot(cwd, snapshot);
+      return {
+        verdict: "allow", event: "PreCompact", cwd, rule: "snapshot-written",
+        subject: snapshot.slug ?? null, reason: "RunSnapshot frozen before compaction",
+      };
+    } catch (e) {
+      // A snapshot failure must never block compaction — but it is now a fact rather than silence.
+      return { verdict: "error", event: "PreCompact", cwd, reason: `snapshot failed: ${e.message}` };
+    }
+  });
+}
+
+if (isMain(import.meta.url)) {
+  main();
+}

package/hooks/gate-deadline.mjs

@@ -0,0 +1,151 @@
+#!/usr/bin/env node
+// GATE D — DEADLINE. PreToolUse hook. The wall-clock breaker, enforced rather than requested.
+//
+// WHY THIS EXISTS (measured, and it corrects an earlier diagnosis).
+//
+// SDD harness benchmark, F3 (Sonnet 5): this harness was killed at the declared 1800 s cap and
+// published as a DNF — no acceptance, no cost, no turns, a dash in every column. The natural
+// reading was "it stalled at a gate". Re-reading the retained transcript says the opposite:
+//
+//     327 assistant turns · 262 tool calls · 130 work calls · 37 file writes
+//     19 gate markers, last gate L3 · narration_ratio 0.047 · stall_signals 0
+//
+// It was working — the least talkative shapeup run in the matrix — and it was still working when
+// the clock ran out. Both existing breakers count EVENTS (`round_budget` per round,
+// `attempt_budget` per T0 attempt), so neither can observe that a single round has been running
+// for twenty-nine minutes. The run burned its whole budget with both breakers untouched.
+//
+// The cost of that is not the DNF row. It is that an externally killed run ships NOTHING, not
+// even the scopes that were already green. A breaker that trips from the inside routes to GATE H
+// instead: census, baseline comparison, ship the part that works. Same clock, different ending.
+//
+// WHAT IT DENIES, AND WHAT IT DELIBERATELY DOES NOT. Past the deadline this denies dispatches
+// that START NEW WORK — `task-executor`. It never denies `spec-evaluator`, `scope-hammer`,
+// `qa-edge-hunter` or `advisor-protocol`, because a run past its deadline must still be able to
+// judge, hammer and close. A breaker that also blocked the exit would strand the run with green
+// scopes it could not ship, which is the failure it exists to prevent.
+//
+// Non-regression: with no `wall_clock_budget_s` in the receipt (the default) this defers
+// instantly. Everything ambiguous — no receipt, unparseable payload, missing timestamp — fails
+// open, because a gate that blocks legitimate runs gets disabled, and a disabled gate enforces
+// nothing.
+//
+// Contract: PreToolUse stdin JSON { tool_name, tool_input:{skill_name|skill, skill_args|args}, cwd }.
+// Deny via { hookSpecificOutput: { hookEventName, permissionDecision:"deny", permissionDecisionReason } }.
+
+import { readFileSync, readdirSync, existsSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { evaluateBudget } from "../skills/tech-lead/scripts/budget-check.mjs";
+import { runHook, readStdin, settle } from "./lib/decision.mjs";
+import { localDir, localRoot } from "../skills/tech-lead/scripts/lib/paths.mjs";
+
+await runHook("gate-deadline", async () => {
+/** Fail-open, with the reason on the record (hooks/lib/decision.mjs). */
+const defer = (reason, rule) => settle({ verdict: "allow", event: "PreToolUse", tool: p?.tool_name ?? null, reason, rule });
+
+// Only these start new build work. Everything else in the harness is how a run ENDS, and must
+// stay reachable after the deadline.
+const STARTS_NEW_WORK = new Set(["task-executor"]);
+
+const raw = await readStdin();
+
+let p;
+try { p = JSON.parse(raw || "{}"); }
+catch (e) { settle({ verdict: "error", event: "PreToolUse", reason: `unparseable payload: ${e.message}` }); }
+
+if (p.tool_name !== "Skill") defer(`not a Skill call (${p.tool_name ?? "no tool_name"}) — out of scope`);
+
+const skillRaw = p.tool_input?.skill_name ?? p.tool_input?.skill ?? "";
+const skill = String(skillRaw).split(":").pop();
+if (!STARTS_NEW_WORK.has(skill)) defer(`Skill(${skill || "?"}) does not start new build work — a run past its deadline must still be able to close`, "not-new-work");
+
+const cwd = p.cwd || process.cwd();
+
+/** The active run's receipt, or null. Mirrors budget-check.mjs's discovery. */
+function findRun() {
+  const root = localDir(cwd);
+  if (!existsSync(root)) return null;
+  let slug = null;
+  try { slug = JSON.parse(readFileSync(join(root, "active-scope"), "utf8"))?.slug || null; } catch { /* scan instead */ }
+  const candidates = slug ? [slug] : (() => { try { return readdirSync(root); } catch { return []; } })();
+  for (const entry of candidates) {
+    const f = join(root, entry, "receipt.json");
+    if (!existsSync(f)) continue;
+    try { return { slug: entry, receipt: JSON.parse(readFileSync(f, "utf8")) }; } catch { /* not a run */ }
+  }
+  return null;
+}
+
+const run = findRun();
+if (!run) defer("no run receipt — nothing to time", "no-run");
+
+const budget = Number(run.receipt.config?.wall_clock_budget_s || 0) || null;
+if (!budget) defer("no wall_clock_budget_s in the receipt — breaker off (the default)", "breaker-off");
+
+const startedAt = Date.parse(run.receipt.started_at || "");
+if (Number.isNaN(startedAt)) defer("receipt has no parseable started_at — no clock, no claim", "no-clock");
+
+const state = evaluateBudget((Date.now() - startedAt) / 1000, budget);
+if (state.status !== "trip") defer(`within budget (${state.status}) — inspected and permitted`, "within-budget");
+
+// STICKY TRIP. The first version of this hook denied and said what to do instead; the orchestrator
+// then re-dispatched task-executor and was denied again, THIRTEEN times in one measured run. Each
+// denial costs a turn out of the budget the breaker exists to protect, so a re-triable denial
+// actively makes the failure it is preventing worse.
+//
+// The fix is to make the trip a FACT rather than an event: record it once, count the retries, and
+// escalate the language so the second denial cannot read like the first. A model that ignored
+// "route to GATE H" phrased gently is not helped by receiving the identical text again.
+const tripPath = join(localRoot(cwd, run.slug), "deadline-tripped.json");
+let denials = 0;
+try { denials = JSON.parse(readFileSync(tripPath, "utf8"))?.denials || 0; } catch { /* first trip */ }
+denials += 1;
+try {
+  writeFileSync(tripPath, JSON.stringify({
+    type: "deadline-trip", slug: run.slug, denials,
+    first_tripped_at: denials === 1 ? new Date().toISOString() : undefined,
+    elapsed_s: state.elapsed_s, budget_s: budget,
+  }, null, 2) + "\n");
+} catch { /* recording is best-effort; the denial still stands */ }
+
+const repeat = denials > 1
+  ? [
+      "",
+      `⛔ THIS IS DENIAL #${denials}. Re-dispatching task-executor will be denied every time, and each`,
+      "attempt spends wall-clock the run does not have. STOP TRYING TO BUILD. The only forward move is",
+      "GATE H, below. If you have already dispatched scope-hammer, wait for it and close the run.",
+    ]
+  : [];
+
+const reason = [
+  `✋ GATE D — DEADLINE BREAKER. Run "${run.slug}" has used ${state.elapsed_s}s of its ${budget}s wall-clock budget.`,
+  "",
+  "Dispatching task-executor would start work this run cannot finish. Denied — not because the work",
+  "is wrong, but because a run that is killed from outside ships nothing, including the scopes that",
+  "are already green.",
+  "",
+  "Go to GATE H instead:",
+  "",
+  "  Skill(scope-hammer, \"--breaker deadline --feature " + run.slug + "\")",
+  "",
+  "Scope-hammer runs the must-have census, compares the shippable subset against the BASELINE (never",
+  "against the ideal), and produces a cut list. Ship what is green; the rest becomes a raw idea for",
+  "the next Betting Table.",
+  "",
+  "spec-evaluator, scope-hammer, qa-edge-hunter and advisor-protocol are all still permitted — a run",
+  "past its deadline must still be able to judge, hammer, and close.",
+  ...repeat,
+].join("\n");
+
+return {
+  verdict: "deny", event: "PreToolUse", tool: "Skill", subject: skill, rule: "deadline-tripped",
+  reason: `wall-clock budget of ${budget}s exhausted — routing to GATE H`,
+  payload: {
+    hookSpecificOutput: {
+      hookEventName: "PreToolUse",
+      permissionDecision: "deny",
+      permissionDecisionReason: reason,
+    },
+  },
+};
+});

package/hooks/gate-intake.mjs

@@ -0,0 +1,110 @@
+#!/usr/bin/env node
+// GATE L0.0 — intake precondition. PreToolUse hook.
+//
+// Denies a `tech-lead` dispatch that carries no pitch, no spec folder, and no requirement text.
+//
+// WHY THIS EXISTS (measured, not theorized). On the SDD harness benchmark
+// (`sdd-harness-bench`, feature F2, Haiku 4.5, n=3, zero variance) the orchestrator was reached as
+//
+//     Skill(tech-lead, args: "--unattended")
+//
+// — the flag survived the hand-off, the requirement text did not. With nothing to orchestrate,
+// the run printed eleven gate names, a confident plan, and wrote no code, scoring 29% against a
+// hidden acceptance suite while *looking* like a successful run. The same harness invoked with
+// --pitch/--spec scored 100%, n=3. A stronger model happened to inline the text and recover; a
+// cheaper one did not, three times out of three.
+//
+// That is the "agent claims done" failure this project exists to prevent, happening at the
+// project's own front door. Every other invariant that matters here lives in the runtime; this one
+// was living in a prompt, and a prompt is exactly what gets dropped on a hand-off. So it becomes a
+// hook, like GATE L2.
+//
+// Design mirrors gate-l2.mjs deliberately:
+//   • Scope — only `Skill` → tech-lead. Anything else defers instantly.
+//   • Fail-CLOSED only on a provably empty intake, with an actionable re-invocation in the reason.
+//   • Fail-OPEN on anything ambiguous (unparseable payload, unknown arg shape, an envelope
+//     --order). A gate that blocks legitimate runs gets disabled, and a disabled gate enforces
+//     nothing.
+//
+// Contract: PreToolUse stdin JSON { tool_name, tool_input:{skill_name|skill, skill_args|args}, ... }
+// Deny via { hookSpecificOutput: { hookEventName, permissionDecision:"deny", permissionDecisionReason } }.
+
+// RECEIPTS (v1.5). This gate was scored `No effect` — built, verified on 10 cases, and the
+// benchmark re-run still 4/14 — because the hook CORRECTLY never fired and the cause was elsewhere.
+// That distinction was unprovable from a hook that answers "inspected and permitted" and "never
+// ran" with the same silence. Every decision below is now recorded (hooks/lib/decision.mjs).
+
+import { runHook, readStdin, settle } from "./lib/decision.mjs";
+
+await runHook("gate-intake", async () => {
+/** Fail-open, with the reason on the record. */
+const defer = (reason, rule) => settle({ verdict: "allow", event: "PreToolUse", tool: p?.tool_name ?? null, reason, rule });
+
+const raw = await readStdin();
+
+let p;
+try { p = JSON.parse(raw || "{}"); }
+catch (e) { settle({ verdict: "error", event: "PreToolUse", reason: `unparseable payload: ${e.message}` }); }
+
+if (p.tool_name !== "Skill") defer(`not a Skill call (${p.tool_name ?? "no tool_name"}) — out of scope`);
+
+// The Skill tool's field names differ by surface: `skill_name`/`skill_args` in the hook payload,
+// `skill`/`args` in the model-facing stream. Accept both — assuming one was already wrong once.
+const skillRaw = p.tool_input?.skill_name ?? p.tool_input?.skill ?? "";
+const args = String(p.tool_input?.skill_args ?? p.tool_input?.args ?? "");
+
+// Plugin skills arrive namespaced, e.g. "shapeup-sdlc-plugin:tech-lead".
+const skill = String(skillRaw).split(":").pop();
+if (skill !== "tech-lead") defer(`Skill(${skill}) is not the orchestrator — out of scope`);
+
+// The envelope port supplies its own intake; validate-envelope.mjs owns that path.
+if (/--order\b/.test(args)) defer("envelope dispatch — validate-envelope owns this path", "--order");
+
+// Intake is satisfied by ANY of: a pitch path, a spec folder, or free requirement text.
+const hasPitch = /--pitch\s+\S/.test(args);
+const hasSpec = /--spec\s+\S/.test(args);
+const hasResume = /--from\s+\S/.test(args); // resuming an existing run has its state on disk
+
+// Free text = anything left once flags and their values are removed.
+// Every flag that TAKES A VALUE must be listed here. A flag whose value is not stripped reads as
+// free requirement text, and the gate then defers on an empty intake — the exact dispatch it
+// exists to deny. This is a live failure mode, not a hypothetical: adding `--gate-answers ci` and
+// `--wall-clock-budget 2400` silently blinded the gate, and the very next benchmark run reached
+// tech-lead as `args:"--unattended --gate-answers ci --wall-clock-budget 2400"` — no requirement
+// text at all — and was waved straight through, because "ci" and "2400" counted as the spec.
+// Adding a valued flag anywhere in the harness means adding it here, and structural test §39
+// enforces exactly that against commands/ship.md.
+const VALUED_FLAGS = /--(pitch|spec|from|lens|rounds|attempts|orch-model|exec-model|eval-model|qa-model|feature|task|gate-answers|wall-clock-budget|slug|auto-level|max-rounds|intake-file|intake-text|spec-folder|cwd|out|by|preset|file|order)\s+\S+/g;
+const BARE_FLAGS = /--[a-z0-9-]+/g;
+const freeText = args.replace(VALUED_FLAGS, " ").replace(BARE_FLAGS, " ").trim();
+
+if (hasPitch || hasSpec || hasResume || freeText.length > 0) {
+  const via = hasPitch ? "--pitch" : hasSpec ? "--spec" : hasResume ? "--from" : "free requirement text";
+  defer(`intake resolvable via ${via} — inspected and permitted`, via);
+}
+
+// Provably empty intake → deny, and say exactly how to fix it.
+const reason = [
+  "✋ GATE L0.0 — NO INTAKE. tech-lead was dispatched with no pitch, no spec folder, and no",
+  "requirement text; only flags survived the hand-off (args: " + JSON.stringify(args.slice(0, 80)) + ").",
+  "",
+  "An orchestrator with no spec has nothing to orchestrate. Proceeding would print the gate list",
+  "and build nothing — output that reads like a successful run and contains no work.",
+  "",
+  "Re-dispatch with the requirement text or an on-disk spec:",
+  "  Skill(tech-lead, \"<the full requirement text>\")",
+  "  Skill(tech-lead, \"--pitch <shaping.md> --spec <spec/>\")",
+].join("\n");
+
+return {
+  verdict: "deny", event: "PreToolUse", tool: "Skill", subject: "tech-lead", rule: "empty-intake",
+  reason: "no pitch, no spec folder, and no requirement text survived the hand-off",
+  payload: {
+    hookSpecificOutput: {
+      hookEventName: "PreToolUse",
+      permissionDecision: "deny",
+      permissionDecisionReason: reason,
+    },
+  },
+};
+});