shapeup-sdlc 1.6.3 → 3.0.0

package/skills/tech-lead/schemas/domain.schema.json

@@ -3,14 +3,57 @@
   "title": "HarnessDomain",
   "description": "The CENTRAL domain registry of the pure-skill architecture. Every shared field that crosses a skill boundary is defined here exactly once, with its meaning, owner, and storage tier annotated — work-order.schema.json and work-result.schema.json $ref into $defs below instead of re-defining records inline, and no skill may introduce a cross-boundary field that is not registered here first. Annotation keys: x-tier = SHARED (committed under shapeup/, survives clone+crash) | LOCAL (gitignored under .shapeup/, regenerable run-trace) | EMBEDDED (a record type that only lives inside another entity); x-location = the canonical path; x-writer = the single component allowed to write it; x-readers = who consumes it. The x-erd block is the machine-readable entity-relationship map; x-payload-by-worker is the authoritative table of which WorkOrder payload fields each worker may rely on.",
   "x-erd": {
-    "description": "Relationship map. Cardinality reads left-to-right (WorkOrder 1:1 WorkResult = every order has exactly one result). Join keys: <slug> (the feature) is the aggregate root every path is keyed off; scope_id is the STABLE cross-machine key (boards regenerate; hill shards, T0 history and branches join on it); TASK-NNN ids are machine-local and must never be joined across machines (generate-board joins on scope, not task id).",
+    "description": "Relationship map. Cardinality reads left-to-right (WorkOrder 1:1 WorkResult = every order has exactly one result). Join keys: <slug> (the feature) is the aggregate root every path is keyed off; scope_id is the STABLE cross-machine key (boards regenerate; hill shards, T0 history and branches join on it); TASK-NNN ids are machine-local and must never be joined across machines (board regeneration joins on scope, not task id).",
+    "external": {
+      "WorkOrder": "work-order.schema.json",
+      "WorkResult": "work-result.schema.json"
+    },
+    "projection": {
+      "description": "How `kernel/reduce/graph.mjs`'s node vocabulary maps onto this catalog. The projection uses short names on purpose — a graph is read by hand — so the mapping is declared rather than inferred. A `type` of null is a KNOWN GAP: the projection emits that node and this schema has never typed it. The structural suite asserts this map is TOTAL against the node types the projection actually emits, so a new node type cannot appear without either a type or an explicit gap.",
+      "nodes": {
+        "Run": {
+          "type": null,
+          "gap": "the run receipt's own record — emitted by reduce graph, never typed here"
+        },
+        "Order": {
+          "type": "WorkOrder",
+          "external": true
+        },
+        "Result": {
+          "type": "WorkResult",
+          "external": true
+        },
+        "Verdict": {
+          "type": "Verdict"
+        },
+        "Trial": {
+          "type": "TrialRow"
+        },
+        "GateDecision": {
+          "type": null,
+          "gap": "a gate decision row — emitted by reduce graph, never typed here"
+        },
+        "Scope": {
+          "type": "ScopeContract"
+        },
+        "UseCase": {
+          "type": "UseCase"
+        },
+        "Requirement": {
+          "type": "RequirementClause"
+        },
+        "Seam": {
+          "type": "Seam"
+        }
+      }
+    },
     "relationships": [
       {
         "from": "WorkOrder",
         "to": "WorkResult",
         "cardinality": "1:1",
         "via": "order_id",
-        "note": "the envelope port — compile-order.mjs emits, worker answers, ingest-result.mjs applies"
+        "note": "the envelope port — harness compile emits, worker answers, harness reduce ingest applies"
       },
       {
         "from": "WorkOrder",
@@ -28,28 +71,35 @@
       },
       {
         "from": "TaskRef",
-        "to": "UseCase (SHARED spec doc)",
+        "to": "UseCase",
         "cardinality": "N:1..N",
         "via": "use_case_refs[]",
         "note": "the LOCAL→SHARED traceability anchor (single-anchor rule on reconcile) — spec-evaluator's traceability source. Tier direction: persisted links flow LOCAL→SHARED only; a committed spec doc never references a machine-local task id back (spec-lint TIER-DIRECTION/UC-ANCHOR)"
       },
       {
-        "from": "AcResult (LOCAL board AC)",
-        "to": "RequirementClause (SHARED registry)",
+        "from": "AcResult",
+        "to": "RequirementClause",
         "cardinality": "N:0..N",
         "via": "acceptance_criteria[].covers[]",
         "note": "the covers-closure anchor — same sanctioned LOCAL→SHARED direction as use_case_refs. trace-lint asserts every status:covered REQ-id is named by ≥1 AC's covers[]; a REQ neither covered nor CUT is red. REQ-ids are stable cross-machine keys (supersede-never-delete), never renumbered like TASK-NNN"
       },
       {
-        "from": "CriterionVerdict / Discovery",
-        "to": "RequirementClause (SHARED registry)",
+        "from": "CriterionVerdict",
+        "to": "RequirementClause",
         "cardinality": "N:0..N",
         "via": "traces_to[]",
-        "note": "optional finding→REQ back-link (LOCAL→SHARED) so an edge case maps to a business requirement by id, not by grepping the ledger; the lint only checks the id resolves in the registry — purely a navigation anchor"
+        "note": "optional finding→REQ back-link (LOCAL→SHARED) so an edge case maps to a business requirement by id, not by grepping the ledger; the lint only checks the id resolves in the registry — purely a navigation anchor split from a compound ERD node; CriterionVerdict carries its own traces_to[]"
+      },
+      {
+        "from": "Discovery",
+        "to": "RequirementClause",
+        "cardinality": "N:0..N",
+        "via": "traces_to[]",
+        "note": "optional finding→REQ back-link (LOCAL→SHARED) so an edge case maps to a business requirement by id, not by grepping the ledger; the lint only checks the id resolves in the registry — purely a navigation anchor split from a compound ERD node; Discovery carries its own traces_to[]"
       },
       {
         "from": "WiringMap",
-        "to": "UseCase (SHARED spec doc)",
+        "to": "UseCase",
         "cardinality": "1:N",
         "via": "entries[].use_case",
         "note": "reachability map: per UC engine → wiring seam → entry-point call site → player-visible affordance. trace-lint asserts each UC's engine reaches ProjectProfile.entry_point via the import graph; an unreachable engine (0 import sites) is red"
@@ -89,7 +139,7 @@
       },
       {
         "from": "TaskResult",
-        "to": "Task (LOCAL board file)",
+        "to": "TaskRef",
         "cardinality": "N:1",
         "via": "task_id",
         "note": "ingest ticks AC boxes, flips frontmatter status, appends the Execution Log"
@@ -101,20 +151,6 @@
         "via": "discoveries[]",
         "note": "ingest appends to discovery/ledger.md — three producers (executor +, QA ~, planner overflow), zero direct writers"
       },
-      {
-        "from": "WorkResult",
-        "to": "Escalate",
-        "cardinality": "1:N",
-        "via": "escalates[]",
-        "note": "ingest queues to escalates/<order>.json; advisor-protocol adjudicates into a Decision"
-      },
-      {
-        "from": "Escalate",
-        "to": "Decision",
-        "cardinality": "1:0..1",
-        "via": "advisor-protocol adjudication",
-        "note": "persisted to the committed round-ledger the instant it is answered (zero-memory handoff)"
-      },
       {
         "from": "WorkResult",
         "to": "Verdict",
@@ -150,11 +186,33 @@
         "via": "path + sha256",
         "note": "content-addressed evidence the generator cannot fabricate"
       },
+      {
+        "from": "ScopeContract",
+        "to": "UseCase",
+        "cardinality": "1:N",
+        "via": "use_cases[]",
+        "note": "the scope's anchor into the committed spec — the SCOPE-ANCHOR mirror of a task's use_case_refs"
+      },
       {
         "from": "ScopeContract",
         "to": "TaskRef",
         "cardinality": "1:N",
-        "via": "tasks[] (scope_id is the stable key)"
+        "via": "DERIVED — the board tasks whose use_case_refs meet this scope's use_cases (lib/contract.mjs tasksForScope)",
+        "note": "never stored: task ids are machine-local and the contract is committed, so the relation is re-derived per machine from two artifacts that are each valid alone. scope_id is the stable key on this side"
+      },
+      {
+        "from": "ScopeContract",
+        "to": "RequirementClause",
+        "cardinality": "1:N",
+        "via": "covers[]",
+        "note": "REQ-ids, the same stable key an AC's covers: clause uses"
+      },
+      {
+        "from": "ScopeContract",
+        "to": "ScopeContract",
+        "cardinality": "N:N",
+        "via": "depends_on[]",
+        "note": "build order, in the same tier as the contracts it orders — what scope_waves/scope_deps level"
       },
       {
         "from": "ScopeContract",
@@ -181,7 +239,7 @@
         "to": "ScopeContract",
         "cardinality": "1:N",
         "via": "superseded_by[]",
-        "note": "set by split-scope — supersede-never-delete keeps branch and T0 history attributable"
+        "note": "set by map-scopes — supersede-never-delete keeps branch and T0 history attributable"
       },
       {
         "from": "T0Artifact",
@@ -231,6 +289,13 @@
         "cardinality": "1:N",
         "via": "scopes[].scope_id",
         "note": "every FINISHED scope's fixtures re-run on each later attempt"
+      },
+      {
+        "from": "UseCase",
+        "to": "Seam",
+        "cardinality": "1:N",
+        "via": "wiring-map entries[].wiring_seam",
+        "note": "projected by reduce graph as UseCase -DEPENDS_ON-> Seam. NOTE: the projection reads `row.seam`/`row.entry_point` while WiringEntry declares `wiring_seam`/`entry_call_site` — see harness-defects"
       }
     ]
   },
@@ -254,15 +319,12 @@
       "spec_folder",
       "feature",
       "discovered_ledger",
-      "kb_rules_path",
-      "requirements"
+      "kb_rules_path"
     ],
     "scope-architect": [
       "feature",
       "spec_folder",
-      "tasks",
-      "discovered_ledger",
-      "scope_id"
+      "tasks"
     ],
     "solution-architect": [
       "feature",
@@ -304,12 +366,6 @@
     ],
     "coach": [
       "feedback"
-    ],
-    "advisor-protocol": [
-      "ledger",
-      "escalate",
-      "scope_id",
-      "round"
     ]
   },
   "x-result-by-worker": {
@@ -317,7 +373,6 @@
     "task-executor": [
       "task_results",
       "files_touched",
-      "escalates",
       "discoveries",
       "artifacts",
       "assumptions",
@@ -332,21 +387,18 @@
     ],
     "ba-pitch-analyzer": [
       "discoveries",
-      "escalates",
       "files_touched",
       "artifacts",
       "assumptions",
       "deviations"
     ],
     "scope-architect": [
-      "escalates",
       "files_touched",
       "artifacts",
       "assumptions",
       "deviations"
     ],
     "solution-architect": [
-      "escalates",
       "files_touched",
       "artifacts",
       "assumptions",
@@ -382,12 +434,6 @@
       "artifacts",
       "assumptions",
       "deviations"
-    ],
-    "advisor-protocol": [
-      "files_touched",
-      "artifacts",
-      "assumptions",
-      "deviations"
     ]
   },
   "$defs": {
@@ -404,40 +450,34 @@
         "qa-edge-hunter",
         "translator",
         "scope-hammer",
-        "coach",
-        "advisor-protocol"
+        "coach"
       ]
     },
     "Operation": {
-      "description": "The full operation vocabulary. Replaces lifecycle flags (--tasks-only, --from-discovered, --remap …): the caller knows the pipeline position; the worker never re-derives it. Ownership: execute/fix/spike = task-executor · analyze/generate-board/reconcile/retrofit-surface/coverage = ba-pitch-analyzer · map-scopes/remap/split-scope = scope-architect · wire = solution-architect · evaluate = spec-evaluator · orient = orient · hunt/recheck = qa-edge-hunter · translate = translator · hammer = scope-hammer · coach = coach · adjudicate = advisor-protocol.",
+      "description": "The full operation vocabulary. Replaces lifecycle flags (--tasks-only, --from-discovered, --map-scopes …): the caller knows the pipeline position; the worker never re-derives it. Ownership: execute/fix/spike = task-executor · analyze/reconcile/retrofit-surface/coverage = ba-pitch-analyzer · map-scopes = scope-architect · wire = solution-architect · evaluate = spec-evaluator · orient = orient · hunt = qa-edge-hunter · translate = translator · hammer = scope-hammer · coach = coach.",
       "type": "string",
       "enum": [
         "execute",
         "fix",
         "spike",
         "analyze",
-        "generate-board",
         "reconcile",
         "retrofit-surface",
         "coverage",
         "map-scopes",
-        "remap",
-        "split-scope",
         "wire",
         "evaluate",
         "orient",
         "hunt",
-        "recheck",
         "translate",
         "hammer",
-        "coach",
-        "adjudicate"
+        "coach"
       ]
     },
     "Substrate": {
       "description": "The write contract of one order — mode/flag differences ARE write-contract differences (one whitelist template per operation, compile-order substrateFor()). Enforced mechanically by the sandbox hook; a worker needing a file outside it must ESCALATE (substrate-expansion), never write.",
       "x-tier": "EMBEDDED",
-      "x-writer": "compile-order.mjs (templates) / scope-architect (per-scope globs)",
+      "x-writer": "harness compile (templates) / scope-architect (per-scope globs)",
       "type": "object",
       "properties": {
         "allowed": {
@@ -477,7 +517,7 @@
       "properties": {
         "pause_gates": {
           "type": "boolean",
-          "description": "true (standalone default): pause at the worker's phase checkpoints. false: run straight through, surfacing questions as assumptions[]/escalates[]."
+          "description": "true (standalone default): pause at the worker's phase checkpoints. false: run straight through, surfacing questions as assumptions[] — or, when one genuinely blocks, deviations[] with status 'escalated'."
         },
         "max_questions": {
           "type": "integer",
@@ -488,7 +528,7 @@
     "TaskRef": {
       "description": "One task as carried inside a WorkOrder — parsed from the LOCAL board file (.shapeup/<slug>/tasks/TASK-*.md frontmatter + AC checkboxes) by compile-order parseTaskFile(). NOTE: task ids are machine-local (boards regenerate and renumber); never join on id across machines — the scope is the stable key.",
       "x-tier": "EMBEDDED",
-      "x-writer": "compile-order.mjs (from the board ba-pitch-analyzer generated)",
+      "x-writer": "harness compile (from the board ba-pitch-analyzer generated)",
       "type": "object",
       "required": [
         "id"
@@ -549,7 +589,7 @@
           "items": {
             "type": "string"
           },
-          "description": "Explicit dependencies. The inverse (unlocks) is ALWAYS derived by board-derive.mjs, never hand-authored (KB-BA-001)."
+          "description": "Explicit dependencies. The inverse (unlocks) is ALWAYS derived by harness reduce board, never hand-authored — hand-authored inverses drift asymmetric, observed repeatedly."
         },
         "use_case_refs": {
           "type": "array",
@@ -557,6 +597,10 @@
             "type": "string"
           },
           "description": "UC ids this task implements (e.g. UC-CreateOrder) — the task's LOCAL→SHARED anchor into the committed spec and spec-evaluator's traceability source. Links flow one direction: the LOCAL task cites the SHARED UC; a committed doc never links a task id back (ids are machine-local)."
+        },
+        "scope_id": {
+          "type": "string",
+          "description": "OPTIONAL: the scope that builds this task. The DISAMBIGUATOR, not the primary link — dispatch normally derives a scope's tasks by intersecting the contract's use_cases[] with this task's use_case_refs[], and that is a partition only while each scope owns its own use cases. When several scopes implement one use case (a four-scope, one-UC cut is ordinary) the UC anchor cannot say who builds what and every scope claims every task; spec-lint SCOPE-PARTITION reds that, and this field resolves it. Same sanctioned LOCAL→SHARED direction as use_case_refs: the volatile board names the stable scope_id, never the reverse."
         }
       }
     },
@@ -564,7 +608,7 @@
       "description": "One adjudicated ESCALATE answer as carried inside a WorkOrder — binding precedent the worker must apply. Compiled from the committed round-ledger.md Decisions table (columns: Round | Scope | Kind | Question | Answer | Resolved by) filtered to this scope. The full row lives in the ledger; the envelope carries the minimal {id, answer} projection.",
       "x-tier": "EMBEDDED (projection of the SHARED round-ledger.md Decisions row)",
       "x-location": ".shapeup/<slug>/round-ledger.md",
-      "x-writer": "advisor-protocol (via tech-lead) — promoted the instant an answer is given",
+      "x-writer": "tech-lead — promoted the instant the PO gives an answer",
       "type": "object",
       "required": [
         "id",
@@ -582,17 +626,24 @@
       }
     },
     "AegisTriple": {
-      "description": "One digested failure — aegis-digest.mjs distills raw build/test/Playwright logs into these so the next attempt gets a few lines of signal instead of a stack-trace dump. Appears as T0Artifact.discovered_tasks[] (red attempts) and as WorkOrder payload.digested_errors[] (the next attempt's starting bug list).",
+      "description": "One digested failure — harness probe digest distills raw build/test/Playwright logs into these so the next attempt gets a few lines of signal instead of a stack-trace dump. Appears as T0Artifact.discovered_tasks[] (red attempts) and as WorkOrder payload.digested_errors[] (the next attempt's starting bug list).",
       "x-tier": "EMBEDDED",
-      "x-writer": "aegis-digest.mjs (regex pass; Sonnet fallback only on unrecognized formats)",
+      "x-writer": "harness probe digest (regex pass; Sonnet fallback only on unrecognized formats)",
       "type": "object",
       "properties": {
         "file": {
-          "type": "string",
+          "type": [
+            "string",
+            "null"
+          ],
           "description": "Source file of the failure; null/absent when the log line carried no location (raw triple — never invented)."
         },
         "line": {
-          "type": "integer"
+          "type": [
+            "integer",
+            "null"
+          ],
+          "description": "Line of the failure; null/absent when the log line carried no location. Paired with `file` — a triple has both or neither, and neither is ever invented to satisfy a shape."
         },
         "core_message": {
           "type": "string",
@@ -661,12 +712,40 @@
         }
       }
     },
+    "UseCase": {
+      "description": "One use case — the STABLE anchor both tiers name, and the only identifier the scope↔task relation is re-derived through. A UC id is assigned once and frozen: it behaves like scope_id and REQ-id, never like TASK-NNN. Referenced three ways across the tree (`UC-x`, `[[UC-x]]`, `[[usecases/UC-x]]`); `kernel/lib/contract.mjs` ucId() is the single normaliser, and both sides of any join must pass through it or they disagree about a UC they both hold.",
+      "x-tier": "SHARED",
+      "x-location": "shapeup/<slug>/spec/usecases/UC-*.md",
+      "x-writer": "ba-pitch-analyzer (operation: analyze; reconcile MAY append, never renumber)",
+      "x-readers": "scope-architect (use_cases[]), solution-architect (wiring-map entries), spec-evaluator (the grading criterion), harness verify spec (SCOPE-ANCHOR + UC-ANCHOR), harness reduce graph",
+      "type": "object",
+      "required": [
+        "id"
+      ],
+      "properties": {
+        "id": {
+          "type": "string",
+          "description": "`UC-*`, matching the filename stem. Frozen once assigned — every use_cases[] and use_case_refs[] link rots if it is renumbered."
+        },
+        "title": {
+          "type": "string",
+          "description": "What the user can do."
+        },
+        "invariants": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "`[INV-NN]` markers declared in the body; the source of regression tasks and Test Surface rows."
+        }
+      }
+    },
     "ScopeContract": {
-      "description": "A vertical scope as a committed, mechanically enforceable contract — Shape Up's 'map the scopes' as data. Sliced by business flow (one call chain: UI screen + API route + use case + repository), NEVER by directory (PA1). The sandbox hook enforces the substrate, t0-verify runs the fixtures, the evaluator asserts against the manifest. Superseded contracts are kept, never deleted (branch and T0 history stay attributable). ON-DISK FORMAT IS MARKDOWN (ADR-0001): frontmatter carries the scalars and [a, b] lists, a markdown table carries the one array-of-objects field, and prose carries the rationale a reviewer reads. THIS SCHEMA DESCRIBES THE PARSED OBJECT — the wire form embedded in the WorkOrder envelope — not the file. `skills/tech-lead/scripts/lib/contract-md.mjs` is the only reader/writer of the file form; everything downstream of that parse sees exactly this shape.",
+      "description": "A vertical scope as a committed, mechanically enforceable contract — Shape Up's 'map the scopes' as data. Sliced by business flow (one call chain: UI screen + API route + use case + repository), NEVER by directory (PA1). The sandbox hook enforces the substrate, t0-verify runs the fixtures, the evaluator asserts against the manifest. Superseded contracts are kept, never deleted (branch and T0 history stay attributable). ON-DISK FORMAT IS MARKDOWN (ADR-0001): frontmatter carries the scalars and [a, b] lists, a markdown table carries the one array-of-objects field, and prose carries the rationale a reviewer reads. THIS SCHEMA DESCRIBES THE PARSED OBJECT — the wire form embedded in the WorkOrder envelope — not the file. `kernel/lib/contract.mjs` is the only reader/writer of the file form; everything downstream of that parse sees exactly this shape.",
       "x-tier": "SHARED",
       "x-location": "shapeup/<slug>/scopes/<scope-id>.md",
       "x-writer": "scope-architect (SOLE writer — a hand-edit anywhere else is a defect)",
-      "x-readers": "compile-order.mjs, sandbox-guard hook, t0-verify.mjs, spec-lint.mjs, spec-evaluator, scope-hammer, tech-lead",
+      "x-readers": "harness compile, sandbox-guard hook, harness verify t0, harness verify spec, spec-evaluator, scope-hammer, tech-lead",
       "type": "object",
       "required": [
         "scope_id"
@@ -685,12 +764,26 @@
           ],
           "description": "LAYER_CAKE = thin balanced UI+backend · ICEBERG = complexity on one side · CHOWDER = true strays with no shared flow (the one deliberate exception to cross-layer slicing)."
         },
-        "tasks": {
+        "use_cases": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "The COMMITTED use cases this scope implements (`UC-*`, resolving to spec/usecases/UC-*.md) — the scope's anchor into the spec and the join the scope↔task relation is re-derived through. Mirrors the board's own `use_case_refs` in the sanctioned LOCAL→SHARED direction. This REPLACES the former `tasks[]` id list: a contract is committed and a board is not, so naming task ids put a pointer into a gitignored, per-machine tier that resolved to nothing on every other clone without a single check going red. spec-lint SCOPE-ANCHOR reds an empty or unresolvable anchor."
+        },
+        "covers": {
           "type": "array",
           "items": {
             "type": "string"
           },
-          "description": "Task ids this scope names (machine-local ids; the scope↔task grouping is re-derived on regeneration)."
+          "description": "Optional REQ-ids from requirements.md this scope answers for — the same stable, never-renumbered key an AC's `covers:` clause uses. Projected as the Scope→Requirement COVERS edge in the run graph."
+        },
+        "depends_on": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "scope_ids this scope must build AFTER. Build order lives in the same tier as the contracts it orders: this was previously derived from the LOCAL board (contract tasks → task depends_on → owning scope), which collapsed to no edges whenever the board was absent and silently degraded the scheduler to an unscheduled fan-out. An id naming a scope not in the run is dropped by the scheduler (fail-open) and reported by spec-lint SCOPE-DEPS."
         },
         "allowed_file_substrate": {
           "type": "array",
@@ -718,7 +811,7 @@
           "items": {
             "type": "string"
           },
-          "description": "Command(s) that drive this scope end-to-end (the T0 layer). Too speculative to fixture → an explicit TBD flag, never an invented fixture."
+          "description": "Command(s) that drive this scope end-to-end (the T0 layer). EACH MUST EXIT 0 WHEN THE SCOPE IS CORRECT — `harness verify t0` scores a fixture as failed on any non-zero exit, so a fixture written as a bare error-path invocation (`todo done abc  # exit 1`) can never pass and the scope can never go T0-green however correct the code is. Assert error paths INSIDE a test file that itself exits 0 (`node --test test/commands/done.test.js`), which is what the expected non-zero exit belongs in. Too speculative to fixture → an explicit TBD flag, never an invented fixture."
         },
         "db_probe": {
           "type": "string",
@@ -732,14 +825,14 @@
             "DOWNHILL_EXECUTION",
             "FINISHED"
           ],
-          "description": "ALWAYS authored as UPHILL_UNKNOWN (DD-10). The live phase is DERIVED from T0/T1/seesaw facts into hill/<scope-id>.yml — facts move dots, not authors."
+          "description": "ALWAYS authored as UPHILL_UNKNOWN — self-reported confidence is the risk this closes. The live phase is DERIVED from T0/T1/seesaw facts into hill/<scope-id>.yml — facts move dots, not authors."
         },
         "superseded_by": {
           "type": "array",
           "items": {
             "type": "string"
           },
-          "description": "Set by split-scope: the replacing scope ids. Supersede-never-delete."
+          "description": "Set by map-scopes: the replacing scope ids. Supersede-never-delete."
         },
         "business_goal": {
           "type": "string",
@@ -747,6 +840,23 @@
         }
       }
     },
+    "ScopeBoard": {
+      "description": "The scope board — a HUMAN-READABLE PROJECTION of the contracts, not a source. Every column restates something `scopes/*.md` already declares, so it can be regenerated from them and deleting it loses nothing. It deliberately carries no `wave` column: waves are Kahn levels of `depends_on` and `probe resume` derives them, and a hand-authored copy of a derived value is the same defect as the hand-authored `unlocks` that `deriveUnlocks` exists to prevent. Nothing parses this file — that is only safe while it stays a view; the moment it holds a fact of its own it needs a reader and a lint like every other contract.",
+      "x-tier": "SHARED",
+      "x-location": "shapeup/<slug>/scope-board.md",
+      "x-writer": "scope-architect (regenerated whenever the contracts change)",
+      "x-readers": "humans, in a pull request. No code reads it — by design.",
+      "type": "object",
+      "properties": {
+        "rows": {
+          "type": "array",
+          "description": "One row per scope: scope_id · topology_type · use_cases · depends_on · substrate size · lint status. All projected from the contract.",
+          "items": {
+            "type": "object"
+          }
+        }
+      }
+    },
     "AcResult": {
       "description": "One acceptance criterion's outcome with evidence. 'ac' carries the checkbox text VERBATIM — ingest ticks boxes by substring-matching it. No recorded evidence = the worker reports fail by its own hand.",
       "x-tier": "EMBEDDED",
@@ -831,87 +941,12 @@
         }
       }
     },
-    "Escalate": {
-      "description": "The worker's ONE outward port: a decision it cannot make alone. Ingest queues these to escalates/<order>.json; advisor-protocol adjudicates (budget ≤3/scope/round) and the answer returns as a Decision in the next order. The advisor-side grammar adds scope_id/round/attempt/options/default_if_silent (see EscalateBlock).",
-      "x-tier": "EMBEDDED",
-      "type": "object",
-      "required": [
-        "kind",
-        "question"
-      ],
-      "properties": {
-        "kind": {
-          "type": "string",
-          "enum": [
-            "design-decision",
-            "spec-ambiguity",
-            "substrate-expansion"
-          ],
-          "description": "Three kinds, three resolution paths: design/spec go to the PO (or default_if_silent unattended); substrate-expansion is NEVER silently approved — it routes to a scope-architect remap order."
-        },
-        "question": {
-          "type": "string",
-          "description": "One checkable question."
-        },
-        "blocked_ac": {
-          "type": "string",
-          "description": "Which AC waits on this — work on unrelated ACs continues."
-        },
-        "context": {
-          "type": "string",
-          "description": "The two interpretations / the file and why it's needed."
-        }
-      }
-    },
-    "EscalateBlock": {
-      "description": "The advisor-protocol adjudication grammar — an Escalate enriched with run coordinates and options, as passed to /advisor-protocol --escalate. The answer is persisted to the committed round-ledger.md Decisions table the instant it's given (zero-memory handoff: escalation memory lives in files, not chat).",
-      "x-tier": "EMBEDDED",
-      "x-readers": "advisor-protocol",
-      "type": "object",
-      "required": [
-        "kind",
-        "question"
-      ],
-      "properties": {
-        "scope_id": {
-          "type": "string"
-        },
-        "round": {
-          "type": "integer"
-        },
-        "attempt": {
-          "type": "integer"
-        },
-        "kind": {
-          "type": "string",
-          "enum": [
-            "design-decision",
-            "spec-ambiguity",
-            "substrate-expansion"
-          ]
-        },
-        "question": {
-          "type": "string"
-        },
-        "options": {
-          "type": "array",
-          "items": {
-            "type": "string"
-          },
-          "description": "Proposed answers, each with its rationale."
-        },
-        "default_if_silent": {
-          "type": "string",
-          "description": "Optional low-risk fallback — applied under --unattended (logged + flagged for GATE H); the advisor is never forced to accept it."
-        }
-      }
-    },
     "Discovery": {
       "description": "The universal currency of surprise: one raw discovered line. Producers: task-executor (marker +, P3.7), qa-edge-hunter (always ~, repro required), ba-pitch-analyzer (overflow reports). NO producer writes the ledger — ingest-result appends every entry to discovery/ledger.md (single-writer, mechanically). Promotion ~ → must-have is always a human act at SHIP S.0/GATE H.",
       "x-tier": "EMBEDDED (projection into the LOCAL discovery ledger)",
       "x-location": ".shapeup/<slug>/discovery/ledger.md",
-      "x-writer": "ingest-result.mjs",
-      "x-readers": "ba-pitch-analyzer (reconcile), scope-architect (remap), scope-hammer (census), qa-edge-hunter (covered-territory context)",
+      "x-writer": "harness reduce ingest",
+      "x-readers": "ba-pitch-analyzer (reconcile), scope-architect (map-scopes), scope-hammer (census), qa-edge-hunter (covered-territory context)",
       "type": "object",
       "required": [
         "marker",
@@ -961,7 +996,7 @@
       }
     },
     "T0Citation": {
-      "description": "The judge's pointer to a mechanical T0 artifact. The evaluator RECOMPUTES sha256 from disk — a handed hash is never trusted; a verdict on a scoped spec without a citation is structurally invalid (PA4/DD-7: T0 is a machine fact the generator cannot fabricate).",
+      "description": "The judge's pointer to a mechanical T0 artifact. The evaluator RECOMPUTES sha256 from disk — a handed hash is never trusted; a verdict on a scoped spec without a citation is structurally invalid: T0 is a machine fact the generator cannot fabricate.",
       "x-tier": "EMBEDDED",
       "type": "object",
       "required": [
@@ -1071,7 +1106,7 @@
             "evidence": {
               "type": "string",
               "pattern": "[\\w./\\-]+:[0-9]+",
-              "description": "A FAIL must carry a file:line locator. Was stated 5x in spec-evaluator/SKILL.md prose and enforced 0x; a measured run returned a correct FAIL verdict with bugs[] null and no locator anywhere, so the finding could not be acted on without re-investigating. Now mechanical: validate-envelope rejects it before ingest."
+              "description": "A FAIL must carry a file:line locator. The rule used to live in prose and be enforced nowhere — a correct FAIL verdict with no locator anywhere is unactionable without re-investigating (observed, not theorized). Now mechanical: the ingest-side schema validation rejects it before any write."
             },
             "traces_to": {
               "type": "array",
@@ -1187,11 +1222,11 @@
       }
     },
     "T0Artifact": {
-      "description": "The mechanical verification verdict for one build attempt — the evidence layer under the LLM judge. Written by t0-verify.mjs from actually running the scope's fixtures + DB probe + seesaw; zero LLM tokens. spec-evaluator must cite it (sha256) on scoped specs. Red artifacts carry AEGIS triples that become the next attempt's digested_errors.",
+      "description": "The mechanical verification verdict for one build attempt — the evidence layer under the LLM judge. Written by harness verify t0 from actually running the scope's fixtures + DB probe + seesaw; zero LLM tokens. spec-evaluator must cite it (sha256) on scoped specs. Red artifacts carry AEGIS triples that become the next attempt's digested_errors.",
       "x-tier": "LOCAL",
       "x-location": ".shapeup/<slug>/t0/verdicts/r<N>-a<M>-t<T>.json (schema_version 2; the unsuffixed r<N>-a<M>.json of schema_version 1 is still readable)",
-      "x-writer": "t0-verify.mjs",
-      "x-readers": "compile-order.mjs (next attempt), spec-evaluator (citation), tech-lead (hill derivation, GATE L2.3), scope-hammer (stall census)",
+      "x-writer": "harness verify t0",
+      "x-readers": "harness compile (next attempt), spec-evaluator (citation), tech-lead (hill derivation, GATE L2.3), scope-hammer (stall census)",
       "type": "object",
       "properties": {
         "schema_version": {
@@ -1211,6 +1246,11 @@
           "type": "integer",
           "description": "schema_version 2+: the retry ordinal within (round, attempt). Written with flag 'wx', so a retry of the SAME attempt lands beside its predecessor instead of destroying it (invariant I4)."
         },
+        "run_id": {
+          "type": "string",
+          "description": "OPTIONAL (v1.8) — the run key (mintRunId in lib/paths.mjs). (round, attempt, trial) addresses an artifact within a run and repeats in the next one, so the evidence layer needed this to be groupable by run.",
+          "pattern": "^[a-z0-9][a-z0-9-]*-[0-9]{8}T[0-9]{6}Z-[0-9a-f]{8}$"
+        },
         "at": {
           "type": "string",
           "description": "ISO timestamp."
@@ -1306,8 +1346,8 @@
       "description": "One row per T0 run — the ratchet's history, and the artifact that makes 'is attempt N+1 better than attempt N?' answerable. Append-only (I4: every superseded object remains addressable). baseline_trial is the parent link: that single field IS the experiment DAG (lineage, PARENT_OF, and a genuine SUPERSEDES edge) delivered without a graph store. Written by t0-verify, NOT ingest-result: a trial row is a mechanical fact produced by running commands, in the same class as the verdict artifact t0-verify already owns, and carries no worker claim to apply.",
       "x-tier": "LOCAL",
       "x-location": ".shapeup/<slug>/t0/trials.jsonl",
-      "x-writer": "t0-verify.mjs (append-only)",
-      "x-readers": "compile-order.mjs (payload.trial_history — the paper's inspect()), stats.mjs --ratchet (improvement_rate, monotone_rate, sawtooth_count)",
+      "x-writer": "harness verify t0 (append-only)",
+      "x-readers": "harness compile (payload.trial_history — the paper's inspect()), harness probe stats --ratchet (improvement_rate, monotone_rate, sawtooth_count)",
       "type": "object",
       "properties": {
         "schema_version": {
@@ -1321,6 +1361,11 @@
           "minimum": 1,
           "description": "Monotone ordinal across the run's whole ledger — what baseline_trial points at."
         },
+        "run_id": {
+          "type": "string",
+          "description": "OPTIONAL (v1.8) — the run key (mintRunId in lib/paths.mjs), read off the receipt in the run root t0-verify was pointed at. `trial` is monotone WITHIN a run and restarts at 1 in the next one, so ratchet history could not be split by run without it.",
+          "pattern": "^[a-z0-9][a-z0-9-]*-[0-9]{8}T[0-9]{6}Z-[0-9a-f]{8}$"
+        },
         "round": {
           "type": "integer"
         },
@@ -1390,11 +1435,11 @@
       ]
     },
     "SeesawRegistry": {
-      "description": "The fixture registry of every FINISHED scope — what seesawCheck re-runs on each later attempt so a new scope cannot silently break a shipped one (PA5).",
+      "description": "The fixture registry of every FINISHED scope — what seesawCheck re-runs on each later attempt so a new scope cannot silently break a shipped one — a regression mistaken for progress is the pathology the seesaw exists for.",
       "x-tier": "LOCAL",
       "x-location": ".shapeup/<slug>/seesaw/registry.json",
       "x-writer": "tech-lead (when a scope reaches FINISHED)",
-      "x-readers": "t0-verify.mjs",
+      "x-readers": "harness verify t0",
       "type": "object",
       "properties": {
         "scopes": {
@@ -1420,8 +1465,8 @@
       "description": "One appended line of judge history (JSONL). Never rewritten — flips across runs are detected here and force confidence low. run auto-increments per append batch.",
       "x-tier": "LOCAL",
       "x-location": ".shapeup/<slug>/evaluation/.verdicts-<target>.jsonl",
-      "x-writer": "ingest-result.mjs (from Verdict.criteria[])",
-      "x-readers": "spec-evaluator (read-only flip detection), verdict-ledger.mjs",
+      "x-writer": "harness reduce ingest (from Verdict.criteria[])",
+      "x-readers": "spec-evaluator (read-only flip detection), harness reduce verdict",
       "type": "object",
       "properties": {
         "run": {
@@ -1460,10 +1505,10 @@
       }
     },
     "HillShard": {
-      "description": "One scope's hill position — DERIVED, never self-reported (DD-10): UPHILL_UNKNOWN (open unknowns > 0) → UPHILL_SOLVED (unknowns 0, no T0-green yet) → DOWNHILL_EXECUTION (≥1 T0-green; T1/seesaw pending) → FINISHED (T1 PASS ∧ seesaw green ∧ merged). Single-writer = whoever holds that scope's branch. Progress is reported by hill position, never task counts.",
+      "description": "One scope's hill position — DERIVED, never self-reported: UPHILL_UNKNOWN (open unknowns > 0) → UPHILL_SOLVED (unknowns 0, no T0-green yet) → DOWNHILL_EXECUTION (≥1 T0-green; T1/seesaw pending) → FINISHED (T1 PASS ∧ seesaw green ∧ merged). Single-writer = whoever holds that scope's branch. Progress is reported by hill position, never task counts.",
       "x-tier": "SHARED",
       "x-location": "shapeup/<slug>/hill/<scope-id>.yml",
-      "x-writer": "tech-lead (GATE L2.4 derivation)",
+      "x-writer": "tech-lead (GATE L2 derivation)",
       "x-readers": "tech-lead (GATE L3 hill report), scope-hammer (census), GATE L1b sequencing",
       "type": "object",
       "properties": {
@@ -1483,10 +1528,10 @@
     },
     "MetricsRow": {
       "description": "One SHIP-time harvest row (facts only — copied from structured output that already exists; never a newly computed verdict/score, which would be a second judge behind spec-evaluator). Sharded per machine so concurrent runs never merge-conflict.",
-      "x-tier": "SHARED",
+      "x-tier": "LOCAL",
       "x-location": ".shapeup/metrics/<machine-id>.jsonl",
       "x-writer": "tech-lead (SHIP S.6)",
-      "x-readers": "tier-3 e2e benchmark tooling, stats.mjs (read-only projection)",
+      "x-readers": "harness probe stats (read-only projection), harness report export (the run dimension)",
       "type": "object",
       "properties": {
         "schema_version": {
@@ -1497,7 +1542,12 @@
         },
         "at": {
           "type": "string",
-          "description": "OPTIONAL (v1.2) — ISO harvest timestamp; enables real trend-over-time in stats.mjs. Older rows lack it and fall back to shard append order."
+          "description": "OPTIONAL (v1.2) — ISO harvest timestamp; enables real trend-over-time in harness probe stats. Older rows lack it and fall back to shard append order."
+        },
+        "run_id": {
+          "type": "string",
+          "description": "OPTIONAL (v1.8) — the run key (mintRunId in lib/paths.mjs), COPIED from the receipt at SHIP S.6. This is the harvest row's only link to the run trace that produced it: everything else here is a count, and `feature_slug` groups runs together rather than apart.",
+          "pattern": "^[a-z0-9][a-z0-9-]*-[0-9]{8}T[0-9]{6}Z-[0-9a-f]{8}$"
         },
         "feature_slug": {
           "type": "string"
@@ -1525,7 +1575,7 @@
         },
         "attempt_exhaustions": {
           "type": "integer",
-          "description": "OPTIONAL (v1.2) — scopes whose inner attempt_budget tripped this run, COPIED at SHIP S.6 from the queued GATE H hammer proposals (a fact registered at the source; stats.mjs must never re-derive it)."
+          "description": "OPTIONAL (v1.2) — scopes whose inner attempt_budget tripped this run, COPIED at SHIP S.6 from the queued GATE H hammer proposals (a fact registered at the source; harness probe stats must never re-derive it)."
         },
         "qa_findings": {
           "type": "object",
@@ -1547,7 +1597,7 @@
         },
         "ratchet": {
           "type": "object",
-          "description": "OPTIONAL (v1.5) — the DAY-1 exit measurement, COPIED from `stats.mjs --ratchet` over this run's t0/trials.jsonl before the LOCAL trace is wiped. This is the only place the ratchet numbers survive the run, and the only reason they can be compared across machines: `.shapeup/` is gitignored, so a measurement left there answers the question exactly once and then deletes itself. Facts only — every field is a count or a ratio over recorded trial rows, never a grade.",
+          "description": "OPTIONAL (v1.5) — the DAY-1 exit measurement, COPIED from `harness probe stats --ratchet` over this run's t0/trials.jsonl before the LOCAL trace is wiped. This is the only place the ratchet numbers survive the run, and the only reason they can be compared across machines: `.shapeup/` is gitignored, so a measurement left there answers the question exactly once and then deletes itself. Facts only — every field is a count or a ratio over recorded trial rows, never a grade.",
           "properties": {
             "trials": {
               "type": "integer"
@@ -1578,7 +1628,7 @@
         },
         "hooks": {
           "type": "object",
-          "description": "OPTIONAL (v1.5) — the DAY-2 exit measurement, COPIED from `stats.mjs --hooks` over .shapeup/decisions.jsonl. Makes 'never had to fire' and 'never ran' separable across runs: before the decision ledger both produced exit 0 and empty stdout, which is why several enforcement tools were unscoreable.",
+          "description": "OPTIONAL (v1.5) — the DAY-2 exit measurement, COPIED from `harness probe stats --hooks` over .shapeup/decisions.jsonl. Makes 'never had to fire' and 'never ran' separable across runs: before the decision ledger both produced exit 0 and empty stdout, which is why several enforcement tools were unscoreable.",
           "properties": {
             "evaluations": {
               "type": "integer"
@@ -1658,11 +1708,11 @@
       }
     },
     "RunSnapshot": {
-      "description": "Mechanical mid-run state digest, derived ONLY from files (active-scope pointer, harness-run.md frontmatter, board frontmatter, t0/verdicts filenames, orders/ vs results/) — never from conversation memory. The compaction-resilience reflex: persisted by the PreCompact hook as an audit anchor, re-derived fresh and injected as additionalContext by the SessionStart(startup|compact|resume|clear) hook so the orchestrator re-reads the files instead of trusting a lossy summary — or, on a cold startup, instead of re-opening a run that is already open.",
+      "description": "Mechanical mid-run state digest, derived ONLY from files (active-scope pointer, harness-run.md frontmatter, board frontmatter, t0/verdicts filenames, orders/ vs results/) — never from conversation memory. The continuity reflex: after any context loss the orchestrator re-derives this from disk rather than trusting a lossy summary — or, on a cold startup, rather than re-opening a run that is already open.",
       "x-tier": "LOCAL",
-      "x-location": ".shapeup/<slug>/run-snapshot.json (persisted by the compact-snapshot hook; also emitted ephemerally on stdout by run-snapshot.mjs)",
-      "x-writer": "run-snapshot.mjs --write (invoked by the PreCompact hook — never a worker; this is LOCAL derived cache, ingest-result.mjs remains the sole writer of SHARED state)",
-      "x-readers": "session-rehydrate hook, tech-lead (--from resume aid), human",
+      "x-location": ".shapeup/<slug>/run-snapshot.json (written by harness reduce snapshot --write; also emitted ephemerally on stdout by harness reduce snapshot)",
+      "x-writer": "harness reduce snapshot --write (never a worker; this is LOCAL derived cache, harness reduce ingest remains the sole writer of SHARED state)",
+      "x-readers": "tech-lead (--from resume aid), human",
       "type": "object",
       "required": [
         "schema_version",
@@ -1755,9 +1805,6 @@
             }
           }
         },
-        "open_escalates": {
-          "type": "integer"
-        },
         "pending_orders": {
           "type": "array",
           "items": {
@@ -1770,14 +1817,14 @@
         },
         "rehydrate_hint": {
           "type": "string",
-          "description": "The composed one-paragraph instruction injected after compaction: re-read run-state, trust the files, not the summary."
+          "description": "The composed one-paragraph instruction for resuming after a context loss: re-read run-state, trust the files, not the summary."
         }
       }
     },
     "StatsReport": {
       "description": "The telemetry read-plane's output — an aggregate projection over the MetricsRow shards. Aggregates COPIED facts only (counts, rates, trends over already-recorded fields); it never grades, so it can never become a second judge. Malformed rows are skipped fail-open and counted; pathology rows (sandbox-guard/safety-spine denials share the shards) are partitioned, not errors.",
       "x-tier": "EMBEDDED (ephemeral projection — printed to stdout, never persisted; the metrics JSONL stays the only source of truth)",
-      "x-writer": "stats.mjs (read-only over metrics/ — writes nothing)",
+      "x-writer": "harness probe stats (read-only over metrics/ — writes nothing)",
       "x-readers": "human / CLI / CI",
       "type": "object",
       "required": [
@@ -1923,8 +1970,8 @@
       }
     },
     "Lane": {
-      "description": "v1.2 DESIGN DRAFT — reserves the name and makes the policy reviewable; no envelope references it yet and no runtime reads it. See docs/design/04-functional-design.md §4.7. When implemented, the lane is pipeline knowledge: the orchestrator compiles it away into existing registered knobs (payload.lens, payload.dimensions, interaction gate policy) — it NEVER rides in WorkOrderPayload, so workers stay pipeline-blind.",
-      "x-tier": "EMBEDDED (when implemented: recorded in harness-run.md frontmatter `lane:` — never a WorkOrderPayload field)",
+      "description": "The run's lane (full|tiny), computed by harness init fit at GATE L0.3 and recorded in harness-run.md frontmatter `lane:` (with its evidence, and marked overridden when --lane/--tiny outranks the recommendation); RunArgs.lane carries it to the workflow launch. The lane is pipeline knowledge: the orchestrator compiles it away into existing registered knobs (lens, budgets, gate policy) — it NEVER rides in WorkOrderPayload, so workers stay pipeline-blind.",
+      "x-tier": "EMBEDDED (recorded in harness-run.md frontmatter `lane:` — never a WorkOrderPayload field)",
       "x-writer": "tech-lead (GATE L0 lane selection)",
       "x-readers": "tech-lead only",
       "x-lane-policy": {
@@ -1970,11 +2017,11 @@
       ]
     },
     "RequirementClause": {
-      "description": "One atomic customer requirement, frozen with a STABLE id — the covers-closure input truth (spine v1.3). Extracted from the REQ source (Open Decision A: pitch / customer-requirements doc / use-case bodies) by ba-pitch-analyzer's `coverage` operation; extraction is judgment (LLM), but ids are assigned ONCE and never renumber (they behave like scope_id, not TASK-NNN — every covers: link would rot otherwise). Supersede-never-delete: a dropped clause is marked CUT (PO-approved), never removed, so the registry stays auditable on a fresh clone. The original REQ source is never edited — the registry is a separate derived, committed file.",
+      "description": "One atomic customer requirement, frozen with a STABLE id — the covers-closure input truth (spine v1.3). Extracted from the REQ source (pitch / customer-requirements doc / use-case bodies) by the planner — extraction is judgment (LLM), but ids are assigned ONCE and never renumber (they behave like scope_id, not TASK-NNN — every covers: link would rot otherwise). Supersede-never-delete: a dropped clause is marked CUT (PO-approved), never removed, so the registry stays auditable on a fresh clone. The original REQ source is never edited — the registry is a separate derived, committed file.",
       "x-tier": "SHARED",
       "x-location": "shapeup/<slug>/requirements.md",
       "x-writer": "ba-pitch-analyzer (operation: coverage) — extraction only; CUT status is a PO governance edit (same class as a round-ledger Decision)",
-      "x-readers": "trace-lint.mjs (covers-closure oracle), tech-lead, human (coverage/cut audit)",
+      "x-readers": "harness verify trace (covers-closure oracle), tech-lead, human (coverage/cut audit)",
       "type": "object",
       "required": [
         "id",
@@ -2040,12 +2087,32 @@
         }
       }
     },
+    "Seam": {
+      "description": "How one use case's engine attaches to the entry point — the `wiring_seam` value of a WiringEntry, promoted to a first-class node by `reduce graph` so a verdict can be traced back through the seam to the objective. Not a file: it exists only as a cell in the committed wiring map and as a node in the derived run graph.",
+      "x-tier": "EMBEDDED (a WiringEntry.wiring_seam value; promoted to a node by reduce graph)",
+      "x-writer": "solution-architect (operation: wire), inside wiring-map.md",
+      "type": "object",
+      "properties": {
+        "seam": {
+          "type": "string",
+          "description": "The attachment mechanism — a route registration, an event handler, a direct call from the composition root."
+        },
+        "engine": {
+          "type": "string",
+          "description": "The repo-relative module the seam attaches."
+        },
+        "entry_point": {
+          "type": "string",
+          "description": "The call site the seam reaches from."
+        }
+      }
+    },
     "WiringMap": {
-      "description": "The reachability map — per UC, the chain from engine to a player-visible affordance (spine v1.3). Written DIRECTLY by solution-architect at gate L1a.5 (precedent: ScopeContract is written directly by scope-architect, bypassing ingest-result). Its purpose: no engine ships orphaned from the running application. trace-lint folds reachability into its covers-closure pass — a UC whose engine does not reach ProjectProfile.entry_point via the import graph is red. A Mermaid view is auto-rendered from this map (a view of a checked graph, so it cannot drift). ON-DISK FORMAT IS MARKDOWN (ADR-0001): frontmatter carries the scalars and [a, b] lists, a markdown table carries the one array-of-objects field, and prose carries the rationale a reviewer reads. THIS SCHEMA DESCRIBES THE PARSED OBJECT — the wire form embedded in the WorkOrder envelope — not the file. `skills/tech-lead/scripts/lib/contract-md.mjs` is the only reader/writer of the file form; everything downstream of that parse sees exactly this shape.",
+      "description": "The reachability map — per UC, the chain from engine to a player-visible affordance (spine v1.3). Written DIRECTLY by solution-architect at gate L1a.5 (precedent: ScopeContract is written directly by scope-architect, bypassing ingest-result). Its purpose: no engine ships orphaned from the running application. trace-lint folds reachability into its covers-closure pass — a UC whose engine does not reach ProjectProfile.entry_point via the import graph is red. A Mermaid view is auto-rendered from this map (a view of a checked graph, so it cannot drift). ON-DISK FORMAT IS MARKDOWN (ADR-0001): frontmatter carries the scalars and [a, b] lists, a markdown table carries the one array-of-objects field, and prose carries the rationale a reviewer reads. THIS SCHEMA DESCRIBES THE PARSED OBJECT — the wire form embedded in the WorkOrder envelope — not the file. `kernel/lib/contract.mjs` is the only reader/writer of the file form; everything downstream of that parse sees exactly this shape.",
       "x-tier": "SHARED",
       "x-location": "shapeup/<slug>/wiring-map.md",
       "x-writer": "solution-architect (SOLE writer, direct — like scope-architect writes scopes/*.md)",
-      "x-readers": "trace-lint.mjs (reachability oracle), scope-architect (integration seam at slicing time), tech-lead",
+      "x-readers": "harness verify trace (reachability oracle), scope-architect (integration seam at slicing time), tech-lead",
       "type": "object",
       "required": [
         "schema_version",
@@ -2076,11 +2143,11 @@
       }
     },
     "ProjectProfile": {
-      "description": "The archetype + entry-point declaration reachability depends on (spine v1.3). Exists for ONE load-bearing reason: reachability must know the entry point, and that is archetype-specific (main.js for a client-only game is not the seam for a web-service). SHARED — a declaration that must survive `rm -rf .shapeup/` + clone cannot live in the gitignored run-trace. Role-gating (skip SysRS/Auth/CI-CD) is explicitly OUT of scope — those roles are not workers; the profile is introduced only as the entry-point/archetype declaration. ON-DISK FORMAT IS MARKDOWN (ADR-0001): frontmatter carries the scalars and [a, b] lists, a markdown table carries the one array-of-objects field, and prose carries the rationale a reviewer reads. THIS SCHEMA DESCRIBES THE PARSED OBJECT — the wire form embedded in the WorkOrder envelope — not the file. `skills/tech-lead/scripts/lib/contract-md.mjs` is the only reader/writer of the file form; everything downstream of that parse sees exactly this shape.",
+      "description": "The archetype + entry-point declaration reachability depends on (spine v1.3). Exists for ONE load-bearing reason: reachability must know the entry point, and that is archetype-specific (main.js for a client-only game is not the seam for a web-service). SHARED — a declaration that must survive `rm -rf .shapeup/` + clone cannot live in the gitignored run-trace. Role-gating (skip SysRS/Auth/CI-CD) is explicitly OUT of scope — those roles are not workers; the profile is introduced only as the entry-point/archetype declaration. ON-DISK FORMAT IS MARKDOWN (ADR-0001): frontmatter carries the scalars and [a, b] lists, a markdown table carries the one array-of-objects field, and prose carries the rationale a reviewer reads. THIS SCHEMA DESCRIBES THE PARSED OBJECT — the wire form embedded in the WorkOrder envelope — not the file. `kernel/lib/contract.mjs` is the only reader/writer of the file form; everything downstream of that parse sees exactly this shape.",
       "x-tier": "SHARED",
       "x-location": "shapeup/<slug>/project-profile.md",
-      "x-writer": "tech-lead (GATE L0 — not compile-order.mjs, which stays pipeline-blind)",
-      "x-readers": "trace-lint.mjs (reachability entry_point), solution-architect (wire), tech-lead",
+      "x-writer": "tech-lead (GATE L0 — not harness compile, which stays pipeline-blind)",
+      "x-readers": "harness verify trace (reachability entry_point), solution-architect (wire), tech-lead",
       "type": "object",
       "required": [
         "schema_version",
@@ -2167,7 +2234,7 @@
         },
         "bugs": {
           "type": "array",
-          "description": "task-executor (operation: fix): the EVAL report's bug entries for this task — touch nothing else."
+          "description": "The previous round's FAIL verdict, addressed to the scope whose substrate contains each cited file — touch nothing else. Written by `harness compile` from results/evaluate-r<N-1>.json, never by a caller: a build order is addressed by scope/round/attempt and carries no caller payload, and the verdict must survive the relaunch that separates two rounds. Present on any r≥2 execute order whose predecessor failed; an entry matching no scope's substrate is marked `unowned` and sent to all of them rather than dropped."
         },
         "spec_folder": {
           "type": "string",
@@ -2200,11 +2267,11 @@
         },
         "discovered_ledger": {
           "type": "string",
-          "description": "ba-pitch-analyzer (reconcile) / scope-architect (remap): the discovery ledger path whose raw [+]/~ lines get folded in."
+          "description": "ba-pitch-analyzer (reconcile) / scope-architect (map-scopes): the discovery ledger path whose raw [+]/~ lines get folded in."
         },
         "requirements": {
           "type": "string",
-          "description": "ba-pitch-analyzer (operation: coverage): the REQ source to extract atomic clauses from (Open Decision A — pitch / customer-requirements doc / use-case bodies). Absent → the planner defaults to the pitch and records the choice in assumptions[]. The written registry lands at shapeup/<slug>/requirements.md (RequirementClause rows)."
+          "description": "ba-pitch-analyzer: the REQ source to extract atomic clauses from (Open Decision A — pitch / customer-requirements doc / use-case bodies). Absent → the planner defaults to the pitch and records the choice in assumptions[]. The written registry lands at shapeup/<slug>/requirements.md (RequirementClause rows)."
         },
         "project_profile": {
           "type": "string",
@@ -2212,7 +2279,7 @@
         },
         "scope_id": {
           "type": "string",
-          "description": "scope-architect (split-scope): the stuck scope · scope-hammer (--breaker inner): the exhausted scope · advisor-protocol: budget scope."
+          "description": "scope-architect (map-scopes): the stuck scope · scope-hammer (--breaker inner): the exhausted scope."
         },
         "dimensions": {
           "type": "array",
@@ -2246,20 +2313,19 @@
           "description": "qa-edge-hunter: the PASS EVAL report — negative-space input; its covered territory is subtracted from charters."
         },
         "app_url": {
-          "type": "string",
-          "description": "qa-edge-hunter: the running app to hunt (one real request at Q0, not a ping)."
+          "type": [
+            "string",
+            "null"
+          ],
+          "description": "qa-edge-hunter: the running app to hunt (one real request at Q0, not a ping). NULL for a deliverable that is not served over HTTP — a CLI, a library, a batch job — where Q0 drives the binary instead. It was a bare string, so the first genuinely non-UI run could not compile a QA order at all: the payload carries null, the order fails its own schema, and the hunt is skipped for a reason that looks nothing like 'this deliverable has no URL'."
         },
         "ledger": {
           "type": "string",
-          "description": "qa-edge-hunter: discovery ledger path (READ-ONLY context) · advisor-protocol: the committed round-ledger.md decisions persist to."
-        },
-        "escalate": {
-          "$ref": "#/$defs/EscalateBlock",
-          "description": "advisor-protocol: the worker's ESCALATE block to adjudicate."
+          "description": "qa-edge-hunter: discovery ledger path (READ-ONLY context)."
         },
         "round": {
           "type": "integer",
-          "description": "advisor-protocol: the round the budget/decision is counted against."
+          "description": "the round this order is counted against."
         },
         "baseline": {
           "type": "string",
@@ -2289,6 +2355,387 @@
           "description": "translator: existing glossary.md to reuse as the base term map."
         }
       }
+    },
+    "ResumeState": {
+      "description": "The fast-forward derivation: which phase a launch resumes at, derived from artifacts on disk and NEVER from stored state or conversation memory. Produced by kernel/probe/resume.mjs on stdout and consumed by shapeup-run.js's preamble on every launch, fresh or relaunch alike. Every phase predicate is an artifact test — `has_orient_artifacts` exists because the ORIENT branch was once gated on the ledger's stored `status` instead, which a silent courier failure left stale, and a completed ORIENT phase was re-dispatched on resume. `next_phase` is a convenience derived from the same booleans, which all travel too: a caller is never forced to trust a summary it cannot re-derive.",
+      "x-tier": "EMBEDDED",
+      "x-location": "stdout of harness probe resume — never written to disk (the run's state IS the artifacts this record reports on)",
+      "x-writer": "harness probe resume (deriving; the same script's --set-status / --set-active-scope operations write, and report their own outcome record instead)",
+      "x-readers": "shapeup-run.js (the fast-forward preamble, one call per launch)",
+      "type": "object",
+      "required": [
+        "intake_path",
+        "status",
+        "has_orient_artifacts",
+        "has_spec_tree",
+        "has_wiring_map",
+        "scope_files",
+        "pending_orders",
+        "eval_rounds_done",
+        "next_phase"
+      ],
+      "properties": {
+        "intake_path": {
+          "type": "string",
+          "description": "Resolved path to the run's intake — the pitch a fresh ORIENT dispatch is compiled against."
+        },
+        "spec_folder": {
+          "type": [
+            "string",
+            "null"
+          ],
+          "description": "From harness-run.md frontmatter; null before the ledger names one."
+        },
+        "status": {
+          "type": [
+            "string",
+            "null"
+          ],
+          "description": "The ledger's stored status, reported for the readers that legitimately hold a MID_RUN set over it (harness reduce snapshot, and the ship report's census). NOT a resume predicate: no phase decision in shapeup-run.js may branch on this field."
+        },
+        "lens": {
+          "type": [
+            "string",
+            "null"
+          ],
+          "description": "From harness-run.md frontmatter; forwarded to the analyze dispatch. Null when the ledger names none — an unknown value is an ABSENT key in the order, never a null."
+        },
+        "stack": {
+          "type": [
+            "string",
+            "null"
+          ],
+          "description": "From harness-run.md frontmatter; forwarded to the orient dispatch. Null when the ledger names none."
+        },
+        "run_cmd": {
+          "type": [
+            "string",
+            "null"
+          ],
+          "description": "How to run the feature, from harness-run.md frontmatter; forwarded to the evaluate dispatch so the judge exercises a running thing. Null when the ledger names none."
+        },
+        "app_url": {
+          "type": [
+            "string",
+            "null"
+          ],
+          "description": "Where the feature answers, from harness-run.md frontmatter; forwarded to the QA hunt. Null when the ledger names none."
+        },
+        "eval_dimensions": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "The dimensions this run's EVAL grades, from harness-run.md frontmatter. Defaults to [\"spec-conformance\"] rather than empty, so a ledger that names none still produces a graded run — and the ship sign-off reports the complement as the dimensions the run did NOT cover."
+        },
+        "orient_dir": {
+          "type": "string",
+          "description": "The run's LOCAL orient directory, resolved for the analyze dispatch: ORIENT's spike and code-surface notes are working artifacts, not deliverables, so they live in the gitignored tier (ADR-0001)."
+        },
+        "has_orient_artifacts": {
+          "type": "boolean",
+          "description": "ORIENT finished: orient/ carries code-surface.md, discovered-seed.md, hill-signal.md and at least one spike-*.md (skills/orient/SKILL.md §Outputs). The ORIENT skip gates on THIS."
+        },
+        "has_spec_tree": {
+          "type": "boolean",
+          "description": "ANALYZE finished: the spec folder's usecases/ carries at least one use case that is not _index.md. WIRE reads these — one wiring-map entry per use case — which is why ANALYZE precedes WIRE in the phase chain: dispatched against an empty spec folder, WIRE escalates on every launch."
+        },
+        "has_wiring_map": {
+          "type": "boolean",
+          "description": "WIRE finished: shapeup/<slug>/wiring-map.md exists."
+        },
+        "project_profile_path": {
+          "type": "string"
+        },
+        "has_project_profile": {
+          "type": "boolean",
+          "description": "tech-lead writes project-profile.md at GATE L0, before the launch; trace-lint resolves reachability by its archetype."
+        },
+        "scope_files": {
+          "type": "array",
+          "description": "MAP SCOPES finished when non-empty. Each entry carries a RESOLVED path, never a bare filename — harness compile and harness verify t0 resolve --scope against cwd, and a bare id makes compile-order exit 2, which the attempt loop reads as the stagnation breaker.",
+          "items": {
+            "type": "object",
+            "required": [
+              "scope_id",
+              "path"
+            ],
+            "properties": {
+              "scope_id": {
+                "type": "string"
+              },
+              "path": {
+                "type": "string"
+              }
+            }
+          }
+        },
+        "scope_waves": {
+          "type": "array",
+          "description": "The same scopes as scope_files, grouped into dependency WAVES: no wave contains a scope that depends on one still in flight. Levelled by `probe resume` from each contract's own `depends_on` — declared in the same COMMITTED tier as the contracts it orders, so it survives the clone that a join through machine-local task ids never could. Under the edge-released scheduler this is an ORDER and a cross-check rather than a barrier: the orchestrator trusts `scope_deps` only when Kahn-levelling it reproduces this field, so an edge lost crossing the sub-agent boundary degrades to wave release instead of starting a scope early. ADDITIVE: a consumer that ignores it, or a tree where no contract declares `depends_on`, every declared id names a scope not in the run, or the relation is cyclic, gets a single wave containing everything, which is the unscheduled fixed-width fan-out this replaced.",
+          "items": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          }
+        },
+        "scope_deps": {
+          "type": "array",
+          "description": "The dependency edges the waves were levelled from, as `[dependant, dependency]` pairs, so a scope can be released the moment ITS OWN dependencies are green rather than when its whole wave finishes. Same parse as scope_waves; the two validate each other. ADDITIVE — absent, unusable or disagreeing with scope_waves, release falls back to the wave boundary.",
+          "items": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          }
+        },
+        "scope_exclusions": {
+          "type": "array",
+          "description": "Pairs of scopes that may not build AT THE SAME TIME because both declare a write to one path — `substrate.shared` is the sanctioned escape from the disjointness rule, so the lint passes it and the substrate wall permits that path to every live order. Measured: three concurrent writers to one entry point lost work in 20 of 20 trials, because an edit is read-modify-write and the later writer drops the earlier one silently. Unlike scope_deps these pairs are UNORDERED — neither scope waits for the other, they merely never overlap — and unlike a dependency they cost concurrency rather than buying correctness in sequence, which is why the release ceiling they imply is reported before a run spends anything.",
+          "items": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          }
+        },
+        "pending_orders": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "Order files with no result beside them. Diagnostic only — build orders carry no scope id, so this set is not an audit trail of build dispatches (see harness compile's order-id note)."
+        },
+        "eval_rounds_done": {
+          "type": "array",
+          "items": {
+            "type": "integer"
+          },
+          "description": "Round numbers with an evaluate-r<n>.json result — the resumed run's round counter starts one past the maximum."
+        },
+        "next_phase": {
+          "type": "string",
+          "enum": [
+            "orient",
+            "analyze",
+            "wire",
+            "map-scopes",
+            "build"
+          ],
+          "description": "The first phase whose artifacts are incomplete. Derived from the booleans above, in that order. The same table (harness probe resume PHASE_ARTIFACT) answers `--require <phase>`, the post-condition shapeup-run.js checks after every phase dispatch — resume and completion are ONE predicate by construction."
+        }
+      }
+    },
+    "RunArgs": {
+      "description": "C1 — the launch half of the workflow's only conversation. Compiled ONCE by tech-lead at GATE L0 from harness init run output + the L0.8 model matrix + budgets, written to .shapeup/<slug>/run-args.json and handed to the harness run launch as one JSON literal — the workflow cannot ask follow-ups and cannot read config files itself, so everything a run will ever need travels in this one record. A workflow script validates its own subset of this shape in code (no runtime schema check at the C1 boundary itself); this entry is the central-registry definition the workflow script and the tech-lead skill both read as the one true shape.",
+      "x-tier": "EMBEDDED",
+      "x-location": ".shapeup/<slug>/run-args.json — written fresh by tech-lead on every launch and relaunch; the workflow receives it as its args and never reads other config",
+      "x-writer": "tech-lead (GATE L0, on every launch AND every relaunch after a paused gate)",
+      "x-readers": "the Workflow runtime (shapeup-run, and shapeup-run's own inner round dispatch)",
+      "x-not-here": "Run config the LEDGER already carries does NOT get a second home in RunArgs — eval_dimensions, lens, spec_folder, stack, run_cmd, app_url are read off harness-run.md frontmatter by resume-state on every launch AND every relaunch, so a copy here would be a second source that can disagree with the first. RunArgs carries what a workflow cannot derive from disk (identity, budgets, the model matrix, pluginRoot, startedAt) plus noEval, which no frontmatter line holds.",
+      "type": "object",
+      "required": [
+        "slug",
+        "autoLevel",
+        "models",
+        "budgets",
+        "pluginRoot",
+        "startedAt"
+      ],
+      "properties": {
+        "slug": {
+          "type": "string",
+          "description": "The feature slug this run builds — the aggregate root every path is keyed off."
+        },
+        "runId": {
+          "type": "string",
+          "description": "OPTIONAL (v1.8) — the run key, COPIED from harness init run's `run_id` output. Carried here so harness run stamps every journal row without a receipt lookup per launch; a launch without it falls back to reading the receipt, so this is an optimisation, not the source of truth. This is identity, which x-not-here explicitly admits to RunArgs — it is not run config the ledger already carries.",
+          "pattern": "^[a-z0-9][a-z0-9-]*-[0-9]{8}T[0-9]{6}Z-[0-9a-f]{8}$"
+        },
+        "autoLevel": {
+          "type": "string",
+          "enum": [
+            "interactive",
+            "auto",
+            "unattended"
+          ],
+          "description": "Resolved once at GATE L0; governs which gates pre-approve and what on_missing does (harness gate)."
+        },
+        "answers": {
+          "type": "string",
+          "description": "A gate-answers preset name (ci|guarded|interactive) or a path to a gate-answers.json file — the ONLY thing that decides whether a gate crosses, pauses, or aborts."
+        },
+        "models": {
+          "type": "object",
+          "description": "The L0.8 role -> model matrix, resolved once. The model floor: sonnet or above on every role, including mechanical couriers — no exceptions.",
+          "properties": {
+            "exec": {
+              "type": "string"
+            },
+            "eval": {
+              "type": "string"
+            },
+            "qa": {
+              "type": "string"
+            }
+          }
+        },
+        "budgets": {
+          "type": "object",
+          "description": "The three-level circuit breaker's own limits (AGENTS.md) — outer round_budget, inner attempt_budget, and the opt-in wall-clock breaker.",
+          "properties": {
+            "maxRounds": {
+              "type": "integer"
+            },
+            "attemptBudget": {
+              "type": "integer"
+            },
+            "wallClockS": {
+              "type": "integer"
+            }
+          }
+        },
+        "pluginRoot": {
+          "type": "string",
+          "description": "${CLAUDE_PLUGIN_ROOT} — the only thing a workflow script may ever root a path in (a workflow has no filesystem of its own; every path it resolves is either rooted here or produced by a prior call's stdout)."
+        },
+        "startedAt": {
+          "type": "string",
+          "description": "ISO timestamp, passed in because Date.now() is unavailable inside a workflow script by design — the deadline breaker (harness verify budget) computes elapsed time itself, in Node, where the clock lives."
+        },
+        "lane": {
+          "$ref": "#/$defs/Lane",
+          "description": "The fit-check verdict (full|tiny) — compiles away into existing knobs; never rides in WorkOrderPayload."
+        },
+        "noEval": {
+          "type": "boolean",
+          "description": "If true, skips the EVAL phase completely. Rides here rather than in the ledger because there is no frontmatter line that carries it — contrast eval_dimensions, which does."
+        },
+        "noQa": {
+          "type": "boolean",
+          "description": "If true, skips the QA Edge Hunt (`--no-qa`). Rides here for the same reason as noEval: no frontmatter line carries it. It is declared because the workflow reads it — an arg the script consumes and this record omits is a switch the launcher never learns to send, which is a documented flag that does nothing."
+        },
+        "maxParallelScopes": {
+          "type": "integer",
+          "minimum": 1,
+          "default": 4,
+          "description": "How many scopes may build at once (`--parallel-scopes`). A dial rather than a constant because concurrency is a COST question before it is a speed one: every extra leg is another worker's full context. 1 restores sequential scope building, which is the mitigation when a worker archetype proves unsafe to run beside itself."
+        },
+        "adversarialVerify": {
+          "type": "boolean",
+          "description": "If true, each FAIL finding gets one independent skeptic before it costs a whole fix round (`--adversarial-verify`). Off by default: it is a pure addition that spends one sub-agent per finding, and the single-judge invariant is unaffected — a refutation retracts a finding, it never issues a verdict."
+        }
+      }
+    },
+    "RunReturn": {
+      "description": "C1 — the return half of the workflow's only conversation. The ONLY way the workflow speaks back to tech-lead, so it is a tagged union keyed on `status` — the skill branches on the tag, never on prose (the same exit-code discipline harness gate already applies to gate sign-off, extended to the orchestrator's own return value). A gate resolved 'ask' (exit 4) always returns `paused`; a gate resolved 'abort' (exit 5) always returns `aborted`; any circuit breaker tripping (outer round_budget, inner attempt_budget, or the deadline breaker) returns `gate_h`; a full run whose final EVAL passes returns `shipped`. The union is written as a superset of what one inner round can itself produce (`paused`, `aborted`, `gate_h`, or a round-complete carrying a verdict) — `shipped` belongs only to a full run. It is deliberately NOT narrowed, because the round-scoped subset is what a `workflow()` child would return if the fan-out this design anticipates ever spends that nesting level.",
+      "x-tier": "EMBEDDED",
+      "x-location": "in-memory only — a Workflow return value, never written to disk",
+      "x-writer": "the workflow runtime (shapeup-run — the sole writer)",
+      "x-readers": "tech-lead (branches on `status`, emits `block` verbatim on a pause, never re-summarizes it)",
+      "type": "object",
+      "required": [
+        "status"
+      ],
+      "properties": {
+        "status": {
+          "type": "string",
+          "enum": [
+            "shipped",
+            "paused",
+            "aborted",
+            "gate_h",
+            "ok"
+          ],
+          "description": "shipped = the happy ending (outer run only) · paused = a gate resolved 'ask', relaunch after a recorded decision · aborted = a gate resolved 'abort', attributable stop · gate_h = a circuit breaker tripped, ship what is green · ok = one inner round completed (build+eval), not itself a ship — the outer loop decides whether to loop again."
+        },
+        "verdict": {
+          "type": "string",
+          "enum": [
+            "pass",
+            "fail"
+          ],
+          "description": "shipped | ok: the round or run's EVAL verdict, lowercased from spec-evaluator's PASS|FAIL."
+        },
+        "rounds_used": {
+          "type": "integer"
+        },
+        "dims_not_evaluated": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "qa_findings": {
+          "type": "integer"
+        },
+        "report": {
+          "type": "string",
+          "description": "shipped: shapeup/<slug>/REPORT.md path."
+        },
+        "state_warnings": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "shipped | gate_h: bookkeeping writes that did not take (a ledger status that read back wrong), carried on the ONE channel a headless launch preserves. The workflow's own log() goes to the progress narrator and `claude -p` stdout carries only the final message, so a run that returned `shipped` over a ledger still reading `evaluating` could not be told from one that warned about it. Absent when every state write took. Diagnostic, never a status: a lost bookkeeping write is a degraded digest, not a corrupted build."
+        },
+        "round": {
+          "type": "integer",
+          "description": "ok: which round this return describes."
+        },
+        "paused_at": {
+          "type": "string",
+          "description": "paused: the gate id that resolved 'ask' (e.g. L1b, L2, L3)."
+        },
+        "block": {
+          "type": "string",
+          "description": "paused: the ⏸ gate block, emitted VERBATIM by the skill — the block is the handoff contract; re-phrasing it is the paraphrase channel this design exists to close."
+        },
+        "valid_decisions": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "paused: the decisions VALID_BY_GATE allows at this gate (harness gate)."
+        },
+        "context": {
+          "type": "object",
+          "description": "paused: whatever facts the paused gate needs the PO to see (round, scope counts, spec_lint status, …)."
+        },
+        "aborted_at": {
+          "type": "string",
+          "description": "aborted: the gate id that resolved 'abort'."
+        },
+        "reason": {
+          "type": "string",
+          "description": "aborted: the attributable reason (harness gate's own `reason` field, carried through verbatim)."
+        },
+        "breaker": {
+          "type": "string",
+          "enum": [
+            "outer",
+            "inner",
+            "deadline"
+          ],
+          "description": "gate_h: which of the three breakers fired (AGENTS.md's three-level circuit breaker)."
+        },
+        "hammer_proposals": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "gate_h | ok: scope ids queued for GATE H's census (scope-hammer) — an exhausted scope never blocks the round, it proposes."
+        },
+        "green_scopes": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "gate_h | ok: scope ids that reached T0-green this round."
+        }
+      }
     }
   }
 }