shapeup-sdlc 1.6.3 → 3.0.0

package/skills/scope-architect/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: scope-architect
-description: "Use this skill to map, remap, or split the vertical scopes of a feature — Shape Up's \"map the scopes\" (step 8) as committed, mechanically enforceable contracts. Triggers on: \"map the scopes\", \"write the scope contracts\", \"scope contract\", \"remap this scope\", \"split this stuck scope\", \"the discovered tasks don't fit any scope\", \"re-slice the substrate\", or a tech-lead --order dispatch (operations map-scopes | remap | split-scope). Writes the committed scopes/*.md contracts by import-graph slicing along business flow, with write-whitelist substrates and e2e fixtures. NOT for decomposing a pitch into tasks (ba-pitch-analyzer) or cutting scope at ship time (scope-hammer)."
+description: "Use this skill to map the vertical scopes of a feature — Shape Up's \"map the scopes\" (step 8) as committed, mechanically enforceable contracts. Triggers on: \"map the scopes\", \"write the scope contracts\", \"scope contract\", \"the discovered tasks don't fit any scope\", \"re-slice the substrate\" (operations map-scopes). Writes the committed scopes/*.md contracts by import-graph slicing along business flow, with write-whitelist substrates and e2e fixtures. NOT for decomposing a pitch into tasks (ba-pitch-analyzer) or cutting scope at ship time (scope-hammer)."
 ---
 
 # Scope Architect (pure worker v1.0)
@@ -13,17 +13,15 @@ harness enforces mechanically: the sandbox hook denies writes outside a substrat
 runs the fixtures, the evaluator asserts only against the affordance manifest. This skill is
 the **sole writer** of scope contracts — a distinct authority from the planner (task
 decomposition) and a distinct failure mode (directory-thinking, PA1) deserving its own
-anti-rationalization table.
+the ship report's census table.
 
 ## Input contract — the WorkOrder
 
 | Field | What it is |
 |---|---|
-| `operation` | `map-scopes` (first slicing after the board exists) · `remap` (fold discovered items into scope contracts) · `split-scope` (re-slice one stuck scope) |
+| `operation` | `map-scopes` — the only operation this skill has. It covers first slicing after the board exists, folding discovered items in, and re-slicing a stuck scope; the payload says which of those you are doing |
 | `payload.feature` / `payload.spec_folder` | Slug + committed spec (read ux-behavior.md for manifests; usecases for flows) |
-| `payload.tasks[]` | The board's tasks with their touched files — the slicing input |
-| `payload.discovered_ledger` | (remap) items that fit no existing substrate |
-| `payload.scope_id` | (split-scope) the stuck scope (`rounds_at_position ≥ 3`, or an approved substrate-expansion) |
+| `payload.tasks[]` | The board's tasks with their touched files — the slicing INPUT only. Each carries `use_case_refs`; those UC ids are what you write into the contract. Never copy a task id into a contract |
 | `substrate.allowed` | `scopes/*.md` + `scope-board.md` — your ONLY write surface |
 
 ## Core process
@@ -39,7 +37,23 @@ anti-rationalization table.
            scalars and [a, b] lists, a `## Affordances` table for affordance_manifest, and a
            short `## Why this slice` paragraph. A reviewer must be able to read the substrate
            in a PR; regeneration preserves prose under headings you do not own.
-             scope_id, topology_type, tasks[]                — the stable join key is the scope
+             scope_id, topology_type                         — the stable join key is the scope
+             use_cases[]                                     — the UC ids this scope implements.
+                                                               THE ONLY LINK YOU WRITE TO THE
+                                                               WORK: never task ids. The contract
+                                                               is committed and the board is not,
+                                                               so a TASK-NNN here dangles on
+                                                               every other clone (spec-lint
+                                                               TIER-DIRECTION reds it). The
+                                                               scope's tasks are re-derived from
+                                                               the board's own use_case_refs
+             covers[]                                        — optional REQ-ids from
+                                                               requirements.md this scope answers
+                                                               for; stable, never renumbered
+             depends_on[]                                    — scope_ids this scope builds AFTER.
+                                                               This is the build ORDER — declare
+                                                               it whenever one scope consumes
+                                                               another's output, or the two race
              allowed_file_substrate[]                        — exact globs; the sandbox hook's
                                                                write-whitelist; wrong here =
                                                                a legitimate ESCALATE later
@@ -59,17 +73,30 @@ anti-rationalization table.
                                                                a fixture for unbuilt behavior
              hill_phase: "UPHILL_UNKNOWN"                    — ALWAYS; phase is derived from
                                                                T0/T1/seesaw facts later,
-                                                               never authored (DD-10)
-4 LINT     node "${CLAUDE_PLUGIN_ROOT}/skills/ba-pitch-analyzer/scripts/spec-lint.mjs" --slug <slug>
-           → PA1 (directory alignment), PA2 (>~15 files), DISJOINT (undeclared overlap).
+                                                               never authored
+4 LINT     node "${CLAUDE_PLUGIN_ROOT}/kernel/harness.mjs" verify spec --slug <slug>
+           → PA1 (directory alignment), PA2 (>~15 files), DISJOINT (undeclared overlap),
+           SCOPE-ANCHOR (empty/unresolvable use_cases), TIER-DIRECTION (a task id in a
+           committed contract), SCOPE-DEPS (depends_on naming a scope that isn't here).
            Fix reds by re-slicing, not by silencing.
-5 BOARD    regenerate scope-board.md (scope_id, topology, task count, substrate size, lint)
+5 BOARD    regenerate scope-board.md — a VIEW of the contracts, nothing more:
+
+             | scope_id | topology | use_cases | depends_on | files | lint |
+
+           Every column restates a field the contract already declares, so the board can be thrown
+           away and rebuilt. Do NOT add a `wave` column: waves are Kahn levels of `depends_on` and
+           `probe resume` derives them at dispatch — a hand-written copy of a derived value drifts,
+           which is exactly why `unlocks` stopped being authored. The BUILD ORDER lives in each
+           contract's `depends_on`; the board only shows it.
+
+           A `TASK-` id anywhere in a contract or the board — a column, a cell, or a sentence in
+           the prose — is spec-lint TIER-DIRECTION red. The board is committed; ids are not.
 ```
 
-**remap:** a discovered item joins the nearest scope only if the flow matches (extend that
+**Folding in a discovered item:** it joins the nearest scope only if the flow matches (extend that
 substrate minimally); otherwise propose a NEW scope — never silently widen an existing one.
-**split-scope:** re-run step 1 on just that scope's task+file set → N new contracts; mark the
-old one `superseded_by: [ids]` — never delete (branch and T0 history stay attributable).
+**Re-slicing a stuck scope:** re-run step 1 on just that scope's task+file set → N new contracts;
+mark the old one `superseded_by: [ids]` — never delete (branch and T0 history stay attributable).
 
 ## Anti-rationalization table
 
@@ -80,19 +107,31 @@ old one `superseded_by: [ids]` — never delete (branch and T0 history stay attr
 | "I'll widen the substrate a little so the doer stops escalating" | A wide substrate is no substrate. Split or add a shared_substrate entry, deliberately. |
 | "This scope looks downhill, I'll set the phase" | hill_phase is UPHILL_UNKNOWN at write, always. Facts move dots, not authors. |
 | "The old contract is superseded, delete it" | supersede-never-delete. History must stay attributable. |
+| "Both scopes implement that UC, the tasks will sort themselves out" | They will not — both scopes get every task of that UC and three of four writes get denied. Give each scope its own use cases, or say so in deviations[] so the board can be stamped. |
+| "I'll list the task ids so the contract says what it builds" | The board is gitignored and renumbers per machine; the contract is committed. Cite the UCs — the tasks are re-derived from them. |
+| "Build order is obvious from the slice, I'll leave depends_on empty" | Nothing infers it any more. An undeclared edge means the two scopes are released into the same wave and race. |
 | "Fixtures can come later, leave the field empty" | Fixture at contract time or an explicit TBD flag — silence is how T0 goes blind. |
 
 ## Output contract — the WorkResult
 
+**Escalation rule.** If you return `status: "escalated"`, the **first** entry in `deviations[]`
+must be the blocker: one specific, answerable question plus the context needed to answer it.
+Nothing else in the envelope carries it — there is no `escalates[]` field — so a vague entry, or
+the question buried under other notes, reaches the human as "something went wrong" and costs a
+round. Write it so someone without your context can answer it in one reply.
+
+
 `scopes/*.md` + `scope-board.md` in your substrate, then
 `.shapeup/<slug>/results/<order-suffix>.json`: `status`, `artifacts[]` (the contracts
-written/superseded), `escalates[]` (e.g. a discovered item implying a new UC — the planner's
-territory), `deviations[]` (any lint warn left standing and why). You never touch task files,
+written/superseded), `deviations[]` (e.g. a discovered item implying a new UC — the planner's
+territory — and any lint warn left standing, with why). You never touch task files,
 `tasks/_index.md`, spec docs, or run-state.
 
 ## Verification checklist
 
 - [ ] Every scope crosses layers or is declared CHOWDER; spec-lint PA1 = 0 red
+- [ ] Every scope names ≥1 `use_cases` that resolves on disk, and NO contract carries a task id
+- [ ] Every scope that consumes another's output declares it in `depends_on`
 - [ ] Substrates disjoint except declared shared_substrate (DISJOINT = 0 red)
 - [ ] Every interactive element in scope screens appears in exactly one affordance_manifest
 - [ ] Every scope has fixtures or an explicit TBD flag
@@ -102,10 +141,10 @@ territory), `deviations[]` (any lint warn left standing and why). You never touc
 ## Invocation
 
 ```bash
-# Orchestrated — compile-order --operation map-scopes|remap|split-scope --worker scope-architect …
+# Orchestrated — compile-order --operation map-scopes --worker scope-architect …
 /scope-architect --order .shapeup/checkout-vnpay/orders/map-scopes.json
 
 # Standalone shims (compile the same envelope)
 /scope-architect --map shapeup/checkout-vnpay/
-/scope-architect --split cart-creation shapeup/checkout-vnpay/
+/scope-architect --map --split cart-creation shapeup/checkout-vnpay/   # re-slice one scope
 ```

package/skills/scope-hammer/SKILL.md

@@ -11,7 +11,7 @@ live with today — not to a hypothetical perfect version. "Better than the base
 enough to ship; "not as good as I imagined" is not a reason to keep building.
 
 **Why this is its own skill, not tech-lead prose.** GATE H census pulls from several sources
-that accumulate over a whole run (QA findings, discovered-task ledger, advisor-protocol budget
+that accumulate over a whole run (QA findings, discovered-task ledger, attempt-budget
 overflows, per-scope inner-breaker trips) — a genuinely separate synthesis step from
 orchestration. Splitting it out keeps `tech-lead` thin (it dispatches, this skill decides what
 survives the hammer) and gives the census/cut-list/verdict logic one owner instead of being
@@ -22,10 +22,10 @@ re-derived inline at every SHIP.
 ## When this fires
 
 ```
-1. All scopes reach FINISHED on the hill (design spec B2) → normal stop, post-QA-hunt.
+1. All scopes reach FINISHED on the hill → normal stop, post-QA-hunt.
 2. Outer circuit breaker trips: round_budget reaches 0 with scopes still uphill/downhill.
 3. Inner circuit breaker trips: a scope's attempt_budget (default 5) is exhausted without a
-   T0-green result → queued as a hammer PROPOSAL (design spec Blueprint A `hammer_proposals`),
+   T0-green result → queued as a hammer PROPOSAL (`hammer_proposals`),
    judged here rather than immediately blocking the round.
 ```
 Any of the three routes to this skill; the difference is only what's in the census (case 1 has
@@ -63,7 +63,7 @@ H0.1  Unresolved scopes (breaker cases only):
           with the T0 failure that stalled them (from the last red t0/verdicts/*.json)
 H0.2  QA findings (qa-edge-hunter's hunt-report.md, when present) — all `~` by default.
 H0.3  Discovered-task ledger entries still open (discovery/ledger.md, `[+]`/`~` unresolved).
-H0.4  advisor-protocol budget-overflow flags (auto-resolved ESCALATEs logged for GATE H review).
+H0.4  Attempt-budget hammer proposals (scopes that exhausted their T0 attempts during BUILD).
 H0.5  Classify every item: MUST-HAVE (the pitch's core problem is unsolved without it) vs
       NICE-TO-HAVE (`~`, improves but doesn't block the core promise). Default to NICE-TO-HAVE
       unless the item traces directly to a pitch boundary or a scope's business_goal — a
@@ -87,7 +87,7 @@ customer suffers through today), never to a perfect ideal.
 
 ```
 H1.1  Resolve the baseline: shapeup/<slug>/shaping/baseline.md if present (written at
-      shaping time, design spec Blueprint F — first-class, not a pitch footnote). Absent →
+      shaping time — first-class, not a pitch footnote). Absent →
       degrade honestly: read the pitch's problem statement as the implicit baseline and flag
       "baseline not first-class — comparison is approximate" in the report. Do not invent one.
 H1.2  For each MUST-HAVE item from H0: "with this item cut/carried, is the shipped product

package/skills/shapeup/SKILL.md

@@ -33,7 +33,7 @@ This skill lazily loads detail from resource files. **Read the relevant resource
 | `/shapeup breadboard-reflection` | `resources/breadboard-reflection.md` |
 | `/shapeup full` | Read `resources/shaping.md` first, then `resources/breadboarding.md` before B-phases, and `resources/context-compaction.md` for the run digest |
 
-> Resource paths are relative to this skill's directory. In Claude Code: `.claude/skills/shapeup/resources/`.
+> Resource paths are relative to this skill's directory (`resources/` beside this SKILL.md, wherever the plugin is installed).
 > Multi-gate runs maintain a derived **decision digest** so each gate reads a compact slice instead of full prose — see `resources/context-compaction.md` and the "Run Workspace & Digest" section below.
 
 ---
@@ -374,8 +374,8 @@ Two roots, separated by artifact **nature** (full design →
 - **Shared** root `shapeup/[slug]/` = what the team contributes to
   (source + deliverable). **Local** root `.shapeup/[slug]/` = per-run scratch,
   hidden and fully gitignorable. Add **one** line to `.gitignore`: `.shapeup/`.
-  No carve-out needed — the one committed report surface, the harvest feed
-  `shapeup/metrics.jsonl`, lives in the shared root.
+  No carve-out needed — everything machine-written at run time, including the
+  harvest shards `.shapeup/metrics/*.jsonl`, lives under the local root.
 - `digest.md` is the run's derived decision context (the 4-field, two-zone read
   model the gates consume). It is **never** the source of truth and never crosses
   a skill boundary — `ba-pitch-analyzer` reads `pitch.md`/`shaping.md`, never the

package/skills/shapeup/resources/context-compaction.md

@@ -182,9 +182,10 @@ Everything keys off the feature `<slug>`. Two roots, split by **who needs it**:
 - The **local** root `.shapeup/[slug]/` is per-run scratch + reports — hidden,
   fully gitignorable, dies with the run. It is derived from the same `<slug>`.
 - `.gitignore`: one line — `.shapeup/`. The whole local root is ignored; no
-  carve-out is needed because the one committed report surface, the harvested
-  signal feed `shapeup/metrics.jsonl` (written by the tech-lead at SHIP,
-  fact-only; see the tech-lead skill's SHIP step), lives in the **shared** root.
+  carve-out is needed because everything machine-written at run time lives there,
+  including the harvested signal shards `.shapeup/metrics/*.jsonl` (written by
+  the tech-lead at SHIP, fact-only; see the tech-lead skill's SHIP step). The
+  committed report surface is the frozen `shapeup/[slug]/REPORT.md`.
 - All paths are **project-relative, resolved from the project root / cwd.** Never
   `/mnt/...` — that is the claude.ai authoring sandbox and dies in a user repo.
 

package/skills/solution-architect/SKILL.md

@@ -7,9 +7,9 @@ description: "Use this skill to design how each use-case's engine integrates int
 
 **Design the seam, or the engine ships orphaned.**
 
-The audit that motivated this skill found a 631-line asset pipeline with 26 passing tests and
-**zero call sites** in the app's composition root — built, green, and unreachable from the
-running application. Five more scopes had engines never wired to a player. This skill closes that
+This skill exists because a sizeable engine module can be built, fully tested, and still have
+**zero call sites** in the app's composition root — green, and unreachable from the
+running application; observed across multiple scopes in one run, not theorized. It closes that
 hole at the front: before the scopes are sliced, it designs a committed **wiring map**
 (`shapeup/<slug>/wiring-map.md`) that names, for every use case, the chain from the
 engine module to a player-visible affordance — including **how** and **where** the engine attaches
@@ -23,13 +23,13 @@ orchestrator's `trace-lint` proves against real code at L1b. Your job is to make
 
 Two payoffs, one artifact:
 - **Reachability becomes checkable later.** Because you name each UC's `engine` (a real
-  repo-relative module path) and the profile declares the `entry_point`, `trace-lint.mjs` can
+  repo-relative module path) and the profile declares the `entry_point`, `harness verify trace` can
   fold this map into its oracle *after the build*: a UC whose engine does not reach the
   `entry_point` via the import graph goes red. You supply the two anchors; the oracle does the
   proving.
 - **The slicer gets its integration seam up front.** Declaring each attachment *before*
   `scope-architect` runs supplies the missing input behind the round-1 substrate-expansion
-  escalations — the four identical "declined by precedent" stalls. (This skill *front-loads* the
+  escalations — repeated identical "declined by precedent" stalls. (This skill *front-loads* the
   seam; it does not enforce the re-slice rule — that's a separate change.)
 
 You are the **sole writer** of the wiring map, written **directly** (the same authority
@@ -70,17 +70,32 @@ guessed `main.js` would make the later oracle certify nothing.
                                the import graph, it does not parse this field)
              affordance        the player-visible thing this UC exposes once wired (the human
                                end of the chain — what a user can DO, not an internal call)
-3 WRITE    shapeup/<slug>/wiring-map.md (WiringMap): {schema_version:1, feature,
-           entry_point (echo of the profile), entries[]}. One entry per use case. A UC whose
+3 WRITE    shapeup/<slug>/wiring-map.md (WiringMap): frontmatter for schema_version, feature
+           and entry_point (echo of the profile), then entries[] as ONE MARKDOWN TABLE under a
+           `## Wiring` heading — this exact shape, because it is the only one the reader parses:
+
+             ## Wiring
+
+             | use_case | engine | wiring_seam | entry_call_site | affordance |
+             |---|---|---|---|---|
+             | UC-01 | src/parsing.mjs | argv dispatch calls parseEnv | bin/envlint.mjs | envlint <file> |
+
+           One ROW per use case + engine pair — a UC carried by two engines gets two rows, never
+           one cell naming both. `engine` is a bare repo-relative path and nothing else: the
+           oracle resolves that cell against disk, and a cell like "`a.mjs` and `b.mjs` — two pure
+           modules" resolves to no file and is reported unverifiable. Put the explanation in the
+           `## Deviations` prose, never in the cell.
+
+           A UC whose
            engine has no attachment path is exactly the gap this artifact exists to surface —
-           write the entry with the seam you INTEND and raise it in deviations[]/escalates[], so
+           write the entry with the seam you INTEND and raise it in deviations[], so
            the build knows the wiring it must close. Your craft ends here: WRITE, then return the
            WorkResult. You do not run trace-lint — the orchestrator runs it advisory at L1b.
 ```
 
 **No use case is exempt.** If a UC's engine genuinely has no player-facing seam (a pure
 background job), say so in `wiring_seam` and name the boot/cron/init attachment that starts it — a
-cron registration, a boot hook. "It's internal" is how the asset pipeline stayed orphaned; there
+cron registration, a boot hook. "It's internal" is how an engine stays orphaned; there
 is always an attachment to the entry point, or the code never runs.
 
 ## Anti-rationalization table
@@ -96,11 +111,18 @@ is always an attachment to the entry point, or the code never runs.
 
 ## Output contract — the WorkResult
 
+**Escalation rule.** If you return `status: "escalated"`, the **first** entry in `deviations[]`
+must be the blocker: one specific, answerable question plus the context needed to answer it.
+Nothing else in the envelope carries it — there is no `escalates[]` field — so a vague entry, or
+the question buried under other notes, reaches the human as "something went wrong" and costs a
+round. Write it so someone without your context can answer it in one reply.
+
+
 `wiring-map.md` in your substrate, then `.shapeup/<slug>/results/<order-suffix>.json`:
-`status`, `artifacts[]` (the wiring map written), `escalates[]` (e.g. a missing profile, or a UC
-whose engine the spec never names — the planner's territory), `assumptions[]` (engine paths
-inferred from the domain model where the spec was silent), `deviations[]` (any UC left with an
-uncertain seam, or an engine with no attachment path, and why). You never touch spec docs,
+`status`, `artifacts[]` (the wiring map written), `assumptions[]` (engine paths
+inferred from the domain model where the spec was silent), `deviations[]` (a missing profile, a
+UC whose engine the spec never names — the planner's territory — a UC left with an uncertain
+seam, or an engine with no attachment path, and why). You never touch spec docs,
 `scopes/*.md`, `project-profile.md`, task files, or run-state.
 
 ## Verification checklist
@@ -110,7 +132,7 @@ uncertain seam, or an engine with no attachment path, and why). You never touch
 - [ ] `entry_call_site` is a symbolic composition-root attachment resolved against the profile's `entry_point` — no invented line number, no guessed entry point
 - [ ] `entry_point` echoes the profile — no independently-chosen seam
 - [ ] The profile was READ, not guessed; a missing profile in orchestrated mode → ESCALATE, not an invented entry point
-- [ ] Any UC whose engine has no attachment path is raised in `deviations[]`/`escalates[]` (the wiring the build must close), never silently dropped
+- [ ] Any UC whose engine has no attachment path is raised in `deviations[]` (the wiring the build must close), never silently dropped
 - [ ] The WorkResult validates against `work-result.schema.json`
 
 ## Invocation
@@ -125,5 +147,5 @@ uncertain seam, or an engine with no attachment path, and why). You never touch
 # The reachability oracle is the ORCHESTRATOR's, run advisory at L1b — not part of your craft.
 # Standalone, you MAY preview it after writing the map (it self-skips arms whose artifacts are
 # absent, and is near-vacuous pre-build since the engine code does not exist yet):
-#   node "${CLAUDE_PLUGIN_ROOT}/skills/tech-lead/scripts/trace-lint.mjs" --slug checkout-vnpay
+#   node "${CLAUDE_PLUGIN_ROOT}/kernel/harness.mjs" verify trace --slug checkout-vnpay
 ```

package/skills/spec-evaluator/SKILL.md

@@ -97,6 +97,15 @@ Done-when statements; `_index.md` Non-Go list. Which UCs are in scope comes from
   trust a handed hash. A verdict on a scoped spec without a T0 citation is structurally
   invalid, regardless of how convincing your own probing looked; generator prose ("tests
   pass", "verified locally") is never admissible evidence.
+- **When a criterion names a command, run THAT command.** Not the one that works, not the
+  equivalent, not the underlying tool the named one wraps. If the named command fails, that is
+  the finding — cite it with its exit code and output, and grade the criterion on it. Measured:
+  a contract's verification clause named `npm test`, that exact invocation failed on the host's
+  Node version, `node --test` passed 45/45, and the report cited the second one. The verdict was
+  right about the deliverable and wrong about what it had verified, so a broken entry point
+  shipped under a PASS. Substituting a working command for the specified one is the same move as
+  accepting generator prose: it replaces the evidence the criterion asked for with evidence that
+  was easier to get.
 
 ---
 
@@ -107,6 +116,7 @@ Done-when statements; `_index.md` Non-Go list. Which UCs are in scope comes from
 | "The code clearly implements it, no need to run it" | Apps that look right still break when used. Probe the running app. |
 | "It failed, but the feature mostly works" | One FAIL fails the dimension. Thresholds are hard. |
 | "The generator says tests pass" | Generator prose is not evidence. Your probe or the T0 artifact is. |
+| "`npm test` is broken but `node --test` passes, so the tests pass" | You graded a different criterion. Run the command the contract names; if it fails, that IS the finding. |
 | "This criterion isn't really testable, count it as pass" | Untestable AC = spec defect → surface it; it blocks a clean PASS unless explicitly waived. |
 | "The other dimensions are strong, round up" | Halo effect banned. Dimensions never average. |
 | "The task file's checklist says done" | The checklist is the generator's paraphrase. Grade the committed UC text. |
@@ -116,6 +126,13 @@ Done-when statements; `_index.md` Non-Go list. Which UCs are in scope comes from
 
 ## Output contract — the WorkResult
 
+**Escalation rule.** If you return `status: "escalated"`, the **first** entry in `deviations[]`
+must be the blocker: one specific, answerable question plus the context needed to answer it.
+Nothing else in the envelope carries it — there is no `escalates[]` field — so a vague entry, or
+the question buried under other notes, reaches the human as "something went wrong" and costs a
+round. Write it so someone without your context can answer it in one reply.
+
+
 1. Write the report `.shapeup/<slug>/evaluation/EVAL-FEATURE-<slug>.md` (or
    `EVAL-<task_id>.md` for a per-task run) per `references/report-schema.md`: verdict,
    per-dimension criteria table with confidence, stability block (flips), bug list (severity,
@@ -143,10 +160,10 @@ Done-when statements; `_index.md` Non-Go list. Which UCs are in scope comes from
 ```
 
 **Every FAIL criterion's `evidence` MUST carry a `file:line` locator** — schema-enforced, not
-advice: `validate-envelope` rejects the whole result before ingest sees it. A PASS may cite plain
-output. (Measured: a run returned a correct FAIL with `bugs: null` and no locator anywhere, which
-is unactionable without re-investigating. The rule used to be repeated five times in this prompt
-and enforced nowhere; it is now stated once and enforced by `domain.schema.json`.)
+advice: the envelope is validated against `work-result.schema.json` at ingest and a locatorless
+FAIL is rejected before any write. A PASS may cite plain output. (Observed, not theorized: a
+correct FAIL verdict with no locator anywhere is unactionable without re-investigating — the
+rule used to live in prose and be enforced nowhere; it is now data in `domain.schema.json`.)
 
 The orchestrator's ingest appends the verdict ledger, un-ticks the `refuted` boxes, and sets
 `eval_verdict` frontmatter. You never touch a task file, a board, or run-state — and you
@@ -184,7 +201,7 @@ bug_template). Adding one (e.g. security) = write `references/dimensions/securit
 /spec-evaluator --order .shapeup/checkout-vnpay/orders/evaluate-r2.json
 
 # Standalone — the preamble shim compiles a minimal order, then the single code path runs:
-#   node "${CLAUDE_PLUGIN_ROOT}/skills/tech-lead/scripts/compile-order.mjs" --operation evaluate --slug <slug> \
+#   node "${CLAUDE_PLUGIN_ROOT}/kernel/harness.mjs" compile --operation evaluate --slug <slug> \
 #        --worker spec-evaluator [--payload '{"dimensions": [...], "run_cmd": "..."}']
 /spec-evaluator --spec shapeup/checkout-vnpay/spec/ --task TASK-007
 /spec-evaluator --spec shapeup/checkout-vnpay/spec/ --feature checkout-vnpay --single-pass
@@ -192,7 +209,7 @@ bug_template). Adding one (e.g. security) = write `references/dimensions/securit
 
 Standalone keeps `--task` (per-task check, not round-gated) and `--single-pass` (feature-level)
 — the shim maps them onto the order's payload; missing run command → ask. After writing the
-WorkResult, run `node "${CLAUDE_PLUGIN_ROOT}/skills/tech-lead/scripts/ingest-result.mjs" <result path>` and show its
+WorkResult, run `node "${CLAUDE_PLUGIN_ROOT}/kernel/harness.mjs" reduce ingest <result path>` and show its
 summary — standalone has no orchestrator to ingest for you.
 
 ---
@@ -209,5 +226,5 @@ summary — standalone has no orchestrator to ingest for you.
 | Probe the RUNNING app, not the source alone | Apps that look right still break when used |
 | Re-probe every FAIL; flip ⇒ confidence low | A single snapshot lies; the ledger makes it visible |
 | Verdict-ledger lines are returned, appended by ingest, never rewritten | Verdict history is how a single-snapshot judge becomes measurable |
-| A verdict on a scoped spec without a T0 citation is structurally invalid | T0 is a machine fact the generator cannot fabricate (DD-7, PA4) |
+| A verdict on a scoped spec without a T0 citation is structurally invalid | T0 is a machine fact the generator cannot fabricate |
 | UI assertions target affordances only (test_id/role/data-state) | Layer-3 styling is frozen; grading it resurrects the freeze through the judge |

package/skills/spec-evaluator/references/dimensions/_registry.md

@@ -9,9 +9,9 @@ command line overrides this table for a single run.
 |----|---------|------|----------------------|-------|
 | `spec-conformance` | ✅ true | `dimensions/spec-conformance.md` | all tasks | baseline correctness: AC + Done-when + contract shapes + non-go |
 | `tdd-surface` | ✅ true | `dimensions/tdd-surface.md` | all tasks | suite green + companion test files for new code; TDD-1/2 critical, TDD-3 advisory |
-| `integration` | ✅ true | `dimensions/integration.md` | `.be` and `.e2e` variants only | full-stack integration test + auth boundary + RLS-JWT pattern; runs only when variant matches |
+| `integration` | ✅ true | `dimensions/integration.md` | `.be` and `.e2e` variants only | full-stack integration test + access boundary + enforcement-path integrity; stack read from the project profile, not hard-coded; runs only when variant matches |
 | `completeness` | ⚙️ auto | `dimensions/completeness.md` | all tasks (lens lite/standard) | auto-ON when spec has UC `## Invariants` (v2.8+); no-op on older specs |
-| `test-surface-conformance` | ⚙️ auto | `dimensions/test-surface-conformance.md` | all tasks (lens lite/standard) | auto-ON when spec has UC `## Test Surface` (v2.9+ or `--surface-only` retrofit); no-op otherwise. Report must list every TS row probed — qa-edge-hunter's negative-space input |
+| `test-surface-conformance` | ⚙️ auto | `dimensions/test-surface-conformance.md` | all tasks (lens lite/standard) | auto-ON when spec has UC `## Test Surface` (v2.9+ or a retrofit-surface order); no-op otherwise. Report must list every TS row probed — qa-edge-hunter's negative-space input |
 | `security` | ⛔ false | `dimensions/security.md` | be / shared | stub — flip on when ready |
 | `performance` | ⛔ false | `dimensions/performance.md` | be / web | stub — flip on when ready |
 

package/skills/spec-evaluator/references/dimensions/completeness.md

@@ -25,7 +25,7 @@ criteria?"* — it grades the tasks that exist. It cannot see the task that was
 written. Shape Up's discovered-task philosophy says the real bulk of work is found while
 building; an invariant declared on a UC but never backed by a regression task is exactly
 that blind spot. This dimension converts "absence of a task" from invisible into a graded
-**GAP** — the judge surfaces it; the planner (a ba-pitch-analyzer reconcile/generate-board order) fills it.
+**GAP** — the judge surfaces it; the planner (a ba-pitch-analyzer `reconcile` order) fills it.
 Judge never fills it itself.
 
 **Distinction held:** conformance = *the tasks that exist are correct*; completeness =