shapeup-sdlc 1.6.3 → 3.0.0

package/skills/tech-lead/references/round-protocol.md

@@ -1,184 +0,0 @@
-# Round Protocol
-
-The orchestration loop in detail. A "round" is one BUILD phase followed by exactly one
-EVAL phase. The feature is done when an EVAL round returns PASS.
-
-> `tasks/_index.md` referenced throughout this file lives in the LOCAL gitignored root
-> (`.shapeup/<slug>/tasks/`, v3.2), not the
-> SHARED spec dir. See tech-lead SKILL.md GATE L1b for the bootstrap step that regenerates it
-> when missing.
-
-```
-round r = 1
-loop:
-    BUILD(r)                          # see r=1 vs r>1 below
-    assert board 100% done            # GATE L2 — advisory: the hook warns, you decide
-    verdict, bugs = EVAL(r)           # ONE spec-evaluator --feature pass
-    if verdict == PASS:
-        SHIP; break
-    if r >= max_rounds:
-        ESCALATE(bugs); break         # honest stop — no infinite loop
-    r = r + 1                         # next round builds bugs only
-```
-
-## BUILD(r) semantics
-
-| | r = 1 (initial build) | r > 1 (fix build) |
-|--|----------------------|-------------------|
-| Input | the whole task board | the bug list from EVAL(r-1) |
-| Scope | every ready task, dependency/layer order, until board all ✅ | only the tasks/areas named by bugs |
-| Command | compile-order `--next` → task-executor `--order` → ingest, looped | compile-order `--task <id> --operation fix` → dispatch → ingest, per bug |
-| Passing areas | n/a | never touched |
-| SPIKEs | resolved first (they block) | only if a bug is a SPIKE finding |
-
-Re-opening tasks in r>1: the fix order's WorkResult reports the task `partial` while failing
-and `done` when re-verified; ingest-result flips the board accordingly. The board reflects the
-churn so the next EVAL sees a green board again.
-
-Discovered Tasks:
-If WorkResults carry `discoveries[]` during BUILD, ingest-result appends them to the discovery
-ledger (`.shapeup/<slug>/discovery/ledger.md`) and the build loop pauses after the current
-tasks are done. Compile + dispatch a reconcile order (ba-pitch-analyzer, operation: reconcile).
-This reconciles them into new tasks and invariants and updates the board; the tech lead bumps
-`discovered_rounds` in harness-run.md, then routes back to GATE L1b (Board Review) for PO
-approval of the new tasks and estimates before resuming the BUILD loop.
-
-## The EVAL timing rule (the core constraint)
-
-EVAL fires **once** per round and **only** when GATE L2 has confirmed the board is 100% done.
-It is never:
-- called per task,
-- called inside the BUILD loop,
-- called on a partial board.
-
-## Regression rule (r > 1) — QA-meeting Bước 1c
-
-A fix round changes code; a fix can break what passed. Therefore EVAL(r>1) scope is **not**
-just the fixed bugs:
-
-```
-EVAL(r) for r > 1:
-  touched_UCs = every UC referenced (use_case_refs) by a task re-opened in BUILD(r)
-  scope = fixed bugs' criteria
-        + FULL re-run of `## Test Surface` rows for every touched UC
-          (test-surface-conformance dimension, when active)
-        + completeness re-check (cheap, static)
-  untouched UCs' surfaces: NOT re-run (their code didn't change; re-probing everything
-  every round would turn cheap end-of-round QA into a full-suite tax)
-```
-
-Pre-v2.9 specs (no Test Surface anywhere): the rule degrades to bug-criteria-only, as
-before — and the verdict report notes `regression coverage: none (no test surface)`.
-Honest reporting over silent coverage claims.
-
-## QA edge hunt (post-PASS, pre-ship)
-
-When EVAL(r) returns PASS for the **first** time in a run, the orchestrator delegates one
-`/qa-edge-hunter` pass before SHIP (skippable via `--no-qa`, same spirit as `--no-eval`).
-QA is a pure worker: no verdict, no score, no gate — it writes `~` findings to
-`discovery/ledger.md` and a `qa/hunt-report.md`. Triage happens at SHIP/GATE L4:
-- all findings stay `~` → SHIP; findings carry over as raw ideas (debt-free).
-- PO/TL promote any to must-have → a fix round r+1 (those items only) → EVAL
-  `--single-pass` on them → `/qa-edge-hunter --recheck` (re-probe ONLY the promoted items;
-  never a second full hunt) → back to L4.
-- Circuit breaker applies: out of rounds/appetite → ship with `~` findings recorded.
-QA never runs on a FAIL round — a build that hasn't passed conformance isn't worth
-edge-hunting yet.
-
-Rationale (from the long-running harness work): a single end-of-round QA pass over the
-running feature is cheap relative to the build (minutes vs hours) and catches the
-last-mile defects, whereas grading every task multiplies evaluator cost for little gain
-once the generator is competent. If the build round didn't finish, there is nothing
-coherent to evaluate yet.
-
-## Stop conditions
-1. **PASS** — EVAL(r) verdict is PASS → SHIP.
-2. **max_rounds (OUTER breaker)** — r would exceed `--max-rounds` (default 3) without PASS →
-   ESCALATE: print the residual bug list, the rounds used, and hand the decision to the PO
-   (scope contracts present: also `/scope-hammer --breaker outer`). Do not start another
-   build round automatically.
-3. **attempt_budget (INNER breaker, scope contracts only)** — a single scope's T0 attempt
-   loop exhausts `--attempts` (default 5) without a green result → does NOT stop the round;
-   queues a hammer PROPOSAL for GATE H and moves to the next scope in sequence. See
-   "Three-level circuit breaker" below.
-4. **wall_clock_budget (DEADLINE breaker, opt-in)** — elapsed seconds since the run receipt
-   exceed `--wall-clock-budget` → do NOT start another build round or another scope; go
-   straight to GATE H (`/scope-hammer --breaker deadline`). Checked with
-   `scripts/budget-check.mjs` at every round boundary and enforced by `hooks/gate-deadline.mjs`,
-   which denies a `task-executor` dispatch past the deadline while leaving `spec-evaluator`,
-   `scope-hammer`, `qa-edge-hunter` and `advisor-protocol` reachable — a run past its deadline
-   must still be able to judge, hammer, and close. Off unless configured.
-5. **Hard error** — a sub-skill fails irrecoverably (e.g. spec folder gone, app won't
-   build at all) → stop and report; do not retry blindly.
-6. **User halt** — at any L-gate the user can stop the run; the ledger preserves state for
-   `--from` resume.
-
-## Three-level circuit breaker
-
-```
-OUTER    round_budget (max_rounds)  — the six-week-timebox analog. Decremented once per
-                                       round at GATE L2, regardless of how many scopes it
-                                       covered. Hitting 0 → GATE H immediately (§ above).
-INNER    attempt_budget (per scope) — decremented once per T0 attempt inside BUILD round r.
-                                       Hitting its cap WITHOUT a T0-green result trips the
-                                       inner breaker for that scope only: the scope is queued
-                                       as a hammer PROPOSAL (not a hard stop) and the round
-                                       moves on to the next scope in the L1b sequence.
-DEADLINE wall_clock_budget_s        — elapsed seconds since the run receipt. Opt-in; off
-                                       unless set at L0. Tripping routes to GATE H with
-                                       --breaker deadline. Enforced by hooks/gate-deadline.mjs.
-```
-
-**Why the third one exists — it was measured, and it corrected an earlier diagnosis.** On the
-SDD harness benchmark (F3, Sonnet 5) this harness was killed at the declared 1800 s cap and
-published as a DNF. The natural reading was that it had stalled at a gate. Re-reading the
-retained transcript says otherwise: **327 turns, 262 tool calls, 37 file writes, 19 gate markers,
-last gate L3, and zero stall signals** — the least talkative shapeup run in the whole matrix. It
-was working when the clock ran out.
-
-Both existing breakers count *events*, not time: `round_budget` moves once per round,
-`attempt_budget` once per T0 attempt. Neither can observe that round 1 has been running for
-twenty-nine minutes, so a run can burn its entire wall clock with both breakers untouched. The
-cost is not the DNF row — it is that a run killed from *outside* ships nothing, not even the
-scopes that were already green. A breaker that trips from the inside routes to GATE H, where
-scope-hammer compares the shippable subset against the baseline and ships what works. Same clock,
-different ending.
-Nesting rationale (DD-9): a struggling scope should not freeze every other scope's progress
-in the same round — only running out of *rounds* (the real six-week analog) stops the whole
-run. A scope that trips its inner breaker still gets judged fairly at GATE H: scope-hammer
-compares "ship without this scope" against the baseline, same as any other cut candidate — it
-is never silently dropped, and it is never allowed to block scopes that ARE working.
-
-## Isolated attempt loop — one T0 attempt, in detail (scope contracts only)
-
-```
-compile-order --scope … --round N --attempt M
-                                   → zero-memory WorkOrder (scope contract + this scope's
-                                      tasks + digested errors + ledger decisions — compiled
-                                      facts, no chat history by construction)
-dispatch task-executor --order …   → code within substrate; WorkResult in results/
-ingest-result <result>             → board/ledger writes; escalates[] queued
-handle_escalations(≤3/scope/round) → /advisor-protocol; answer promoted to round-ledger.md
-                                      immediately (must survive the NEXT attempt's fresh
-                                      context — this is what "zero-memory" is compatible with
-                                      escalation memory means, DD-8)
-t0-verify.mjs                      → fixtures + DB probe + (on green) seesaw
-  green            → attempt loop breaks; scope reaches DOWNHILL_EXECUTION
-  red, regression  → git stash (never a hard discard) + retry; a FINISHED scope's fixture
-                      broke (PA5) — the whole point of running seesaw before declaring green
-  red, own fixture  → AEGIS-digest the failure into {file, line, core_message} triples,
-                      feed them into the NEXT attempt's brief; loop
-```
-This replaces the old flat per-task loop for any scope that has a contract;
-scopes/specs without one keep the v0.2.6 behavior verbatim (see BUILD(r) table above).
-
-## --no-eval (skip evaluation)
-A tech-lead judgment, surfaced at GATE L2: if the feature is clearly within what the model
-builds reliably solo, the evaluator is optional overhead. With `--no-eval`, after GATE L2
-the run goes straight to SHIP with verdict `not-evaluated` recorded in the ledger and a
-clear note that nothing was verified beyond the build's own task-executor GATE D checks.
-
-## Round-cost intuition
-Build dominates; eval is cheap. Expect each EVAL round to cost a small fraction of a BUILD
-round. This is why running eval once per round (not per task) is the right trade: you pay a
-little QA at the end of each build and keep the expensive build coherent in between.

package/skills/tech-lead/references/state-model.md

@@ -1,66 +0,0 @@
-# State Model — who writes what
-
-Reference for the orchestrator. Moved out of `SKILL.md` so the front door stays a runbook: the
-first screen a model reads decides whether it acts or describes, and every line of architecture
-prose ahead of the first tool call is a line it can summarise instead of execute.
-
----
-
-## State ownership (D6, mechanically closed in v1.0)
-
-Workers are stateless; the orchestrator layer is the **sole writer of ALL run-state**. Every
-worker receives a structured **WorkOrder** envelope (`.shapeup/<slug>/orders/`, compiled by
-`compile-order.mjs`) and returns a **WorkResult** envelope (`results/`); the deterministic
-`ingest-result.mjs` performs every shared-state write — board status, AC ticks, unblock
-propagation, discovery-ledger appends, verdict bookkeeping.
-
-No worker writes `run-state.md`, `tasks/_index.md`, or the ledger. Everything a worker used to
-write into shared files, it now returns as data.
-
-The tech lead owns `harness-run.md` — rounds, gate decisions, Hill positions, verdicts,
-`discovered_rounds`, config, language record. The board (`tasks/_index.md`, LOCAL root — v3.2) is
-**execution truth**, maintained exclusively through ingest.
-
-**The run receipt (v1.4).** `scripts/init-run.mjs` opens the run and writes
-`.shapeup/<slug>/receipt.json` plus `.shapeup/active-scope` before any gate. The
-receipt is the mechanical fact that a run *started* — distinct from every other artifact here,
-which records what a run *did*. That distinction is load-bearing: the guards that check a run's
-progress (`anti-rationalization.mjs`) are all scoped to an active run, so before the receipt
-existed, a run that never started was invisible to every one of them. `hooks/gate-zerowork.mjs`
-reads only the receipt's presence, which is why it can see a total failure that leaves no other
-trace. See `references/gates.md` — GATE L0.1.
-
-## Central domain registry
-
-Every record type and payload field that crosses a skill boundary is defined exactly once in
-`skills/tech-lead/schemas/domain.schema.json` — the envelope schemas (`work-order.schema.json`,
-`work-result.schema.json`) only `$ref` it. The registry annotates each entity's tier
-(SHARED/LOCAL), location, sole writer, and readers, carries the machine-readable ERD (`x-erd`),
-and maps which payload fields each worker may rely on (`x-payload-by-worker`).
-
-A new cross-boundary field is added THERE first (structural test #24 enforces the map's
-consistency); a skill inventing its own undeclared field is a defect — the orchestrator, not the
-worker, owns the vocabulary.
-
-## Two ledgers, split by promotion timing
-
-(Addendum §F.3 — only when scope contracts exist.)
-
-`harness-run.md` stays the LOCAL (`.shapeup/<slug>/`, gitignored) full run trace: it can be
-rebuilt or lost without consequence.
-
-A second, committed `round-ledger.md` (`shapeup/<slug>/round-ledger.md`, SHARED,
-Tier A) holds only what must survive a crash or a `.shapeup/` wipe:
-
-- the resolved model/budget matrix (L0.8/L0.9),
-- the **Decisions** table — every gate crossing and every advisor-protocol ESCALATE answer,
-  promoted the instant it is given, never batched to round close.
-
-Gate crossings resolved from a **gate answer set** (`scripts/gate-answers.mjs`) are written here
-with their source — `preset:ci`, `file:.shapeup/gate-answers.json` — and the set's
-`authorized_by`. A headless run that ships must always be able to name the human behind its
-sign-off; that name lives here and nowhere else.
-
-The tech lead is the sole writer of both. `round-ledger.md` is simply the subset that must never
-live only in a session or a gitignored file. No scope contracts → `round-ledger.md` is not
-written, and `harness-run.md`'s "Decisions log" is the only ledger, exactly as in v0.2.6.

package/skills/tech-lead/scripts/ingest-result.mjs

@@ -1,270 +0,0 @@
-#!/usr/bin/env node
-// WorkResult ingester (pure-skill architecture v1.0, plan P1).
-//
-// The other half of the orchestrator's pipeline sub-layer — and the mechanism that finally
-// closes D6: workers no longer write shared state; they RETURN data (a WorkResult envelope)
-// and this script performs every shared-state write, deterministically, in one place:
-//
-//   task_results[]      → tick AC boxes, flip task frontmatter status, append Execution Log,
-//                         update tasks/_index.md row, propagate unblocks (old P3.1–P3.6)
-//   discoveries[]       → append to .shapeup/<slug>/discovery/ledger.md (old P3.7 / QA H.3)
-//   verdict.criteria[]  → append evaluation/.verdicts-<target>.jsonl (old evaluator B.0)
-//   verdict.refuted[]   → un-tick refuted AC boxes + set eval_verdict frontmatter (old B.2/B.2b)
-//   escalates[]         → queue .shapeup/<slug>/escalates/<order>.json for the orchestrator
-//
-// Zero dependencies, zero network, schema-validated input (a malformed result never mutates
-// the board). Single-writer becomes mechanically true, not aspirational.
-//
-// Usage:  node skills/tech-lead/scripts/ingest-result.mjs <result.json> [--cwd <dir>]
-// Exit:   0 = ingested, 1 = result rejected (schema) or a write failed.
-
-import { readFileSync, writeFileSync, appendFileSync, mkdirSync, existsSync, readdirSync } from "node:fs";
-import { resolve, join, dirname } from "node:path";
-import { fileURLToPath } from "node:url";
-import { validate } from "./validate-envelope.mjs";
-import { isMain } from "./lib/is-main.mjs";
-import { runArgs } from "./lib/argv.mjs";
-import { tasksDir, localRoot } from "./lib/paths.mjs";
-
-const HERE = dirname(fileURLToPath(import.meta.url));
-const RESULT_SCHEMA = JSON.parse(readFileSync(resolve(HERE, "../schemas/work-result.schema.json"), "utf8"));
-
-/**
- * @returns {string} Today's date as an ISO `YYYY-MM-DD` string (UTC), for log/frontmatter stamps.
- */
-const today = () => new Date().toISOString().slice(0, 10);
-
-/**
- * Locate a task file on the LOCAL board by id.
- * @param {string} cwd - Working-directory root.
- * @param {string} slug - Feature slug.
- * @param {string} taskId - Task id prefix to match (e.g. "TASK-001").
- * @returns {string|null} Absolute path of the first `<taskId>*.md` file, or null when the tasks
- *   directory or a matching file does not exist.
- */
-export function findTaskFile(cwd, slug, taskId) {
-  const dir = tasksDir(cwd, slug);
-  if (!existsSync(dir)) return null;
-  const f = readdirSync(dir).find((n) => n.startsWith(taskId) && n.endsWith(".md"));
-  return f ? join(dir, f) : null;
-}
-
-/**
- * Set a scalar frontmatter field in a task-file body, adding it when absent.
- * @param {string} body - Full task-file text.
- * @param {string} key - Frontmatter key to set.
- * @param {(string|number)} value - Value to write (stringified inline).
- * @returns {string} The body with `key: value` set; returned unchanged when the body has no
- *   frontmatter block.
- */
-export function setFrontmatter(body, key, value) {
-  const m = body.match(/^---\r?\n([\s\S]*?)\r?\n---/);
-  if (!m) return body;
-  const re = new RegExp(`^${key}:.*$`, "m");
-  const fm = re.test(m[1]) ? m[1].replace(re, `${key}: ${value}`) : `${m[1]}\n${key}: ${value}`;
-  return body.replace(m[1], fm);
-}
-
-/**
- * Tick or un-tick the first acceptance-criterion checkbox whose text matches `ac`.
- * @param {string} body - Full task-file text.
- * @param {string} ac - Criterion text to match (case/space-insensitive substring, either direction).
- * @param {boolean} checked - true to write `[x]`, false to write `[ ]`.
- * @returns {{body:string, hit:boolean}} The updated body and whether a checkbox matched (only the
- *   first match is changed).
- */
-export function setCheckbox(body, ac, checked) {
-  const needle = ac.toLowerCase().replace(/\s+/g, " ").trim();
-  const lines = body.split(/\r?\n/);
-  let hit = false;
-  const out = lines.map((line) => {
-    const m = line.match(/^(\s*- \[)([ x])(\]\s+)(.*)$/);
-    if (!m || hit) return line;
-    const text = m[4].toLowerCase().replace(/\s+/g, " ").trim();
-    if (text.includes(needle) || needle.includes(text)) {
-      hit = true;
-      return `${m[1]}${checked ? "x" : " "}${m[3]}${m[4]}`;
-    }
-    return line;
-  });
-  return { body: out.join("\n"), hit };
-}
-
-/**
- * Flip a task's row in `tasks/_index.md` to a done state.
- * @param {string} indexBody - Full board-index text.
- * @param {string} taskId - Task id whose row to update.
- * @param {boolean} done - When true, rewrite the row's status emoji/word to done; false is a no-op.
- * @returns {string} The board text with the matching row updated (unchanged when no row matches).
- */
-export function updateBoardRow(indexBody, taskId, done) {
-  return indexBody.split(/\r?\n/).map((line) => {
-    if (!line.includes(taskId) || !line.includes("|")) return line;
-    if (done) return line.replace(/⬜|🔄|⏳|🚫/g, "✅").replace(/\b(ready|in-progress|blocked)\b/gi, "done");
-    return line;
-  }).join("\n");
-}
-
-/**
- * Apply one validated WorkResult to the working tree — the single-writer step (D6): ticks AC
- * boxes, flips task status, appends the Execution Log, propagates unblocks, appends discoveries,
- * writes the verdict ledger + un-ticks refuted boxes, and queues escalates.
- * @param {object} result - A schema-valid WorkResult (order_id, task_results[], discoveries[],
- *   verdict{criteria[],refuted[]}, escalates[]).
- * @param {{cwd:string}} opts - cwd: working-directory root every LOCAL path resolves against.
- * @returns {{slug:string, tasks_updated:string[], acs_ticked:number, unblocked:string[],
- *   discoveries_appended:number, refuted_unticked:number, verdict_lines:number,
- *   escalates_queued:number}} A summary of every write performed.
- * @throws {Error} If a task/board/ledger file it must write is not writable (fs error propagates).
- *   Side effects: writes task files, `tasks/_index.md`, `discovery/ledger.md`,
- *   `evaluation/.verdicts-*.jsonl`, and `escalates/*.json` under `.shapeup/<slug>/`.
- */
-export function applyResult(result, { cwd }) {
-  const slug = result.order_id.split("/")[0];
-  const local = localRoot(cwd, slug);
-  const summary = { slug, tasks_updated: [], acs_ticked: 0, unblocked: [], discoveries_appended: 0, refuted_unticked: 0, verdict_lines: 0, escalates_queued: 0 };
-
-  // 1. Task results → task files + board (old task-executor P3.1/P3.2/P3.6).
-  const boardIndex = join(local, "tasks", "_index.md");
-  for (const tr of result.task_results || []) {
-    const path = findTaskFile(cwd, slug, tr.task_id);
-    if (!path) continue;
-    let body = readFileSync(path, "utf8");
-    for (const acr of tr.ac_results || []) {
-      if (acr.result === "pass") {
-        const r = setCheckbox(body, acr.ac, true);
-        body = r.body;
-        if (r.hit) summary.acs_ticked++;
-      }
-    }
-    if (tr.status === "done") {
-      body = setFrontmatter(body, "status", "done");
-      body = setFrontmatter(body, "completed_at", today());
-    } else if (tr.status === "partial" || tr.status === "failed") {
-      body = setFrontmatter(body, "status", "in-progress");
-    }
-    // Execution Log (append; the checkbox list must never disagree with it).
-    const logLines = (tr.ac_results || []).map((a) => `- ${a.ac}: ${a.result}${a.evidence ? ` (${a.evidence})` : ""}`).join("\n");
-    body += `\n\n## Execution Log — ${today()} (${result.order_id})\n- executor: ${result.worker || "task-executor"} via ingest-result\n- status: ${tr.status}\n${logLines}${tr.notes ? `\n- notes: ${tr.notes}` : ""}\n`;
-    writeFileSync(path, body);
-    summary.tasks_updated.push(tr.task_id);
-    if (tr.status === "done" && existsSync(boardIndex)) {
-      writeFileSync(boardIndex, updateBoardRow(readFileSync(boardIndex, "utf8"), tr.task_id, true));
-    }
-  }
-
-  // 2. Unblock propagation (old P3.4): any blocked task whose dependencies are all done → ready.
-  const tasksDir = join(local, "tasks");
-  if (existsSync(tasksDir)) {
-    const files = readdirSync(tasksDir).filter((f) => /^TASK-[\w.-]+\.md$/i.test(f));
-    const statusOf = {};
-    const parsed = files.map((f) => {
-      const body = readFileSync(join(tasksDir, f), "utf8");
-      const id = (body.match(/^id:\s*(TASK-[\w.-]+)/im) || [])[1] || f.replace(/\.md$/, "");
-      const status = (body.match(/^status:\s*(\S+)/im) || [])[1] || "unknown";
-      const deps = (body.match(/^depends_on:\s*\[([^\]]*)\]/im) || [, ""])[1]
-        .split(",").map((s) => s.trim().replace(/^["']|["']$/g, "")).filter(Boolean);
-      statusOf[id] = status;
-      return { f, id, status, deps, body };
-    });
-    for (const t of parsed) {
-      if (t.status === "blocked" && t.deps.length && t.deps.every((d) => statusOf[d] === "done")) {
-        writeFileSync(join(tasksDir, t.f), setFrontmatter(t.body, "status", "ready"));
-        summary.unblocked.push(t.id);
-        if (existsSync(boardIndex)) {
-          const idx = readFileSync(boardIndex, "utf8").split(/\r?\n/).map((line) =>
-            line.includes(t.id) && line.includes("|")
-              ? line.replace(/🚫|⏳/g, "⬜").replace(/\bblocked\b/gi, "ready")
-              : line).join("\n");
-          writeFileSync(boardIndex, idx);
-        }
-      }
-    }
-  }
-
-  // 3. Discoveries → the ledger (old P3.7 / QA H.3). Single writer: this script.
-  if (result.discoveries?.length) {
-    const ledgerDir = join(local, "discovery");
-    mkdirSync(ledgerDir, { recursive: true });
-    const ledger = join(ledgerDir, "ledger.md");
-    if (!existsSync(ledger)) writeFileSync(ledger, `---\nfeature: ${slug}\n---\n# Discovery Ledger — ${slug}\n`);
-    const lines = result.discoveries.map((d) => {
-      const tags = [d.lens ? `[lens:${d.lens}]` : "", d.severity_hint ? `severity-hint: ${d.severity_hint}` : "", d.test_gap ? `test-gap: ${d.test_gap}` : "", d.contradicts ? `contradicts: ${d.contradicts}` : "", d.traces_to?.length ? `traces_to: ${d.traces_to.join(", ")}` : ""].filter(Boolean);
-      return `${d.marker} ${d.lens ? tags[0] + " " : ""}${d.line}${d.repro ? `\n    repro: ${d.repro}` : ""}${tags.slice(d.lens ? 1 : 0).map((t) => `\n    ${t}`).join("")}`;
-    }).join("\n");
-    appendFileSync(ledger, `\n## Discovered — ${result.order_id} (${today()})\n${lines}\n`);
-    summary.discoveries_appended = result.discoveries.length;
-  }
-
-  // 4. Verdict bookkeeping (old evaluator B.0/B.2/B.2b) — judge returns data, ingest writes.
-  if (result.verdict) {
-    const evalDir = join(local, "evaluation");
-    mkdirSync(evalDir, { recursive: true });
-    if (result.verdict.criteria?.length) {
-      const target = result.order_id.split("/")[1] || "run";
-      const ledger = join(evalDir, `.verdicts-${target}.jsonl`);
-      let run = 1;
-      if (existsSync(ledger)) {
-        const prior = readFileSync(ledger, "utf8").trim().split(/\n/).filter(Boolean).map((l) => { try { return JSON.parse(l); } catch { return null; } }).filter(Boolean);
-        run = prior.reduce((mx, r) => Math.max(mx, r.run || 0), 0) + 1;
-      }
-      const lines = result.verdict.criteria.map((c) => JSON.stringify({
-        run, dimension: c.dimension || "spec-conformance", criterion: c.criterion,
-        verdict: c.verdict, confidence: c.confidence, reprobed: !!c.reprobed,
-        evidence: c.evidence || "", at: new Date().toISOString(),
-      })).join("\n");
-      appendFileSync(ledger, lines + "\n");
-      summary.verdict_lines = result.verdict.criteria.length;
-    }
-    for (const ref of result.verdict.refuted || []) {
-      const path = findTaskFile(cwd, slug, ref.task_id);
-      if (!path) continue;
-      let body = readFileSync(path, "utf8");
-      const r = setCheckbox(body, ref.ac, false);
-      if (r.hit) summary.refuted_unticked++;
-      body = setFrontmatter(r.body, "eval_verdict", "fail");
-      body = setFrontmatter(body, "eval_at", today());
-      writeFileSync(path, body);
-    }
-  }
-
-  // 5. Escalates → a queue file the orchestrator adjudicates via advisor-protocol.
-  if (result.escalates?.length) {
-    const escDir = join(local, "escalates");
-    mkdirSync(escDir, { recursive: true });
-    const out = join(escDir, `${result.order_id.split("/")[1] || "run"}.json`);
-    writeFileSync(out, JSON.stringify(result.escalates, null, 2) + "\n");
-    summary.escalates_queued = result.escalates.length;
-  }
-
-  return summary;
-}
-
-// ---------------------------------------------------------------------------
-/** The typed argv contract (see `./lib/argv.mjs`). */
-export const ARGV_SPEC = {
-  usage: "ingest-result.mjs <result.json> [--cwd <dir>]",
-  _: { arity: 1, max: 1, name: "result.json" },
-  cwd: { type: "path" },
-};
-
-const isMainModule = isMain(import.meta.url);
-if (isMainModule) {
-  const args = runArgs(ARGV_SPEC);
-  const file = args._[0];
-  const cwd = resolve(args.cwd || process.cwd());
-
-  let result;
-  try { result = JSON.parse(readFileSync(resolve(file), "utf8")); }
-  catch (e) { console.error(`  ✗ result unreadable: ${e.message}`); process.exit(1); }
-
-  const { valid, errors } = validate(result, RESULT_SCHEMA);
-  if (!valid) {
-    console.error("ingest-result: result rejected — a malformed result never mutates the board:");
-    for (const e of errors) console.error(`  ✗ ${e}`);
-    process.exit(1);
-  }
-  const s = applyResult(result, { cwd });
-  console.log(`✅ ingested ${result.order_id} — tasks: [${s.tasks_updated.join(", ")}] · ACs ticked: ${s.acs_ticked} · unblocked: [${s.unblocked.join(", ")}] · discoveries: ${s.discoveries_appended} · verdict lines: ${s.verdict_lines} · refuted un-ticked: ${s.refuted_unticked} · escalates queued: ${s.escalates_queued}`);
-  if (s.escalates_queued) process.exitCode = 0; // escalates are data, not failure
-}