shapeup-sdlc 1.6.3 → 3.0.0

package/hooks/dispatch-receipt.mjs

@@ -0,0 +1,195 @@
+#!/usr/bin/env node
+// Dispatch receipt — PostToolUse hook. The attestation that the SHIPPED skill ran.
+//
+// WHAT IT DEFENDS AGAINST, measured live rather than imagined. A worker dispatch that fails —
+// plugin absent, disabled, or the wrong version loaded — comes back as `<tool_use_error>Unknown
+// skill</tool_use_error>`, and the sub-agent then does the craft ITSELF from the prose in its own
+// prompt. Everything downstream accepts the result: the artifacts are on disk, in exactly the right
+// place, so the phase post-condition passes and the run advances. Both existing walls fire correctly
+// and neither can help — the order gate validates the ORDER, the sandbox guard validates WHERE
+// writes land, and an improvised write satisfies both. Nothing in the system attested WHICH SKILL
+// produced an artifact, so a green run was consistent with zero shipped craft having been applied.
+// That is not a failure, it is a FALSE GREEN, and it defeats "measured, not claimed" at the root:
+// the measurement was "is the artifact on disk", which cannot distinguish skill-produced from
+// improvised.
+//
+// WHY PostToolUse AND NOT PreToolUse. `PreToolUse` fires BEFORE the tool runs, so it cannot separate
+// "the Skill returned" from "the Skill errored and the sub-agent improvised". It appears to catch the
+// observed instance only by coupling — the plugin was not loaded, so these hooks were not registered
+// either, so there was no receipt. The moment the environment is repaired, a dispatch that errors
+// still gets a `PreToolUse` receipt written before it fails, and the fix expires exactly when the
+// thing it guards starts working.
+//
+// WHAT WAS MEASURED, in a real session with the plugin loaded and a SUB-AGENT making the calls
+// (every dispatch in this pipeline is a `Skill(...)` call made by a workflow leg, never by the main
+// session, so a hook that is blind there is blind exactly where it is needed):
+//
+//   skill resolves and completes  →  PostToolUse fires, tool_response = {success, commandName}
+//   skill name unknown            →  NO hook fires at all; the host rejects the name upstream
+//   order missing → gate denies   →  PreToolUse deny, then nothing; a denied call never runs
+//
+// So the discriminator is stronger than a status field: A FAILED DISPATCH LEAVES NO ROW. The mere
+// existence of a matching receipt is the wall; `dispatch_ok` is corroboration on top of it, recorded
+// because a future host that reports failures through this event must not be able to satisfy the
+// wall by firing at all.
+//
+// WHAT IT WILL NOT ATTEST. A receipt is written only when the tool result NAMES the skill that ran
+// (`tool_response.commandName`). An `Agent` dispatch whose prompt merely mentions `--order` gets no
+// receipt: the prompt is a plan to dispatch, not evidence of one, and minting attestation from it
+// would forge the exact fact this file exists to establish.
+//
+// EVERY WRITE IS INSIDE try/catch AND THIS HOOK NEVER DENIES (`lib/decision.mjs`). An unguarded
+// `writeFileSync` in a hook body becomes `verdict:"error"` → exit 0 → the dispatch proceeds WITHOUT
+// a receipt, and the phase then dies at ingest instead — a receipt channel that can break a run
+// gets the whole layer disabled, which is the outcome this file exists to prevent.
+//
+// Contract: PostToolUse stdin JSON { tool_name, tool_input:{skill,args}, tool_response, cwd }.
+
+import { appendFileSync, mkdirSync, readFileSync } from "node:fs";
+import { resolve, dirname } from "node:path";
+import { isMain } from "../kernel/lib/argv.mjs";
+import { dispatchReceipts } from "../kernel/lib/paths.mjs";
+import { runHook, readStdin, settle } from "./lib/decision.mjs";
+
+/**
+ * The `--order` matcher, character-for-character the one the PreToolUse order gate uses
+ * (`kernel/verify/envelope.mjs`). Two dispatch hooks that disagree about what an order path IS
+ * would gate one set of calls and attest another.
+ */
+export const ORDER_RE = /--order(?:\s+|=)(?:"([^"]+)"|'([^']+)'|(\S+))/;
+
+/**
+ * Pull the order path out of a dispatch's tool input.
+ * @param {object} toolInput - The `tool_input` block from the hook payload.
+ * @returns {string|null} The path as written, or null when no `--order` was threaded.
+ */
+export function orderPathFrom(toolInput) {
+  const haystack = [toolInput?.skill_args, toolInput?.args, toolInput?.prompt].filter(Boolean).join(" ");
+  const m = haystack.match(ORDER_RE);
+  return m ? (m[1] || m[2] || m[3]) : null;
+}
+
+/**
+ * Which skill actually ran, from the tool result.
+ *
+ * The host reports it NAMESPACED (`shapeup-sdlc-plugin:orient`) while a WorkOrder's `worker` field
+ * carries the bare skill name (`orient`), so the comparison the ingest gate performs is only
+ * meaningful against the segment after the last `:`.
+ *
+ * @param {object} toolResponse - The `tool_response` block from the hook payload.
+ * @returns {string|null} The bare skill name, or null when the result names no command — which is
+ *   the case for every dispatch that did not resolve to a skill.
+ */
+export function skillInvokedFrom(toolResponse) {
+  const name = toolResponse?.commandName;
+  if (typeof name !== "string" || !name) return null;
+  return name.slice(name.lastIndexOf(":") + 1) || null;
+}
+
+/**
+ * Build the receipt row for one dispatch.
+ *
+ * Exported so the suite can assert the row's SHAPE without a live session — the hook body is
+ * otherwise reachable only through stdin.
+ *
+ * @param {object} order - The parsed WorkOrder the dispatch was aimed by.
+ * @param {string} skillInvoked - The bare skill name the host reported running.
+ * @param {object} payload - The whole hook payload, for the sub-agent provenance fields.
+ * @returns {object} The row appended to the run's dispatch ledger.
+ */
+export function receiptRow(order, skillInvoked, payload) {
+  return {
+    at: new Date().toISOString(),
+    order_id: order.order_id ?? null,
+    run_id: order.run_id ?? null,
+    worker_declared: order.worker ?? null,
+    skill_invoked: skillInvoked,
+    // Corroboration, not the wall — see the header. `success` is absent on hosts that do not
+    // report one, and an absent field must not read as a successful dispatch.
+    dispatch_ok: payload?.tool_response?.success === true,
+    tool: payload?.tool_name ?? null,
+    // Present when the dispatch came from a sub-agent, absent when the operator called it directly.
+    // That is the difference between an orchestrated leg and someone driving a skill by hand.
+    agent_id: payload?.agent_id ?? null,
+    agent_type: payload?.agent_type ?? null,
+  };
+}
+
+/**
+ * Append one receipt to the run's dispatch ledger. Never throws.
+ * @param {object} row - A {@link receiptRow}.
+ * @param {string} cwd - Project root the LOCAL root resolves against.
+ * @returns {string|null} The ledger path when the row reached disk, else null.
+ */
+export function writeReceipt(row, cwd) {
+  try {
+    const slug = String(row.order_id).split("/")[0];
+    if (!slug) return null;
+    const path = dispatchReceipts(cwd, slug);
+    mkdirSync(dirname(path), { recursive: true });
+    appendFileSync(path, JSON.stringify(row) + "\n");
+    return path;
+  } catch { return null; }
+}
+
+/**
+ * The hook body — attest a completed dispatch, defer on everything else.
+ * @returns {Promise<void>} Settles through {@link runHook}, which always exits 0.
+ */
+export async function main() {
+  await runHook("dispatch-receipt", async () => {
+    /**
+     * Permit with the reason on the record. This hook has no deny path at all.
+     *
+     * THE SKILL NAME TRAVELS ON EVERY ROW, including the defers, and that is load-bearing rather
+     * than decorative. A dispatch whose skill name does not resolve fires no hook at all — measured,
+     * not assumed — so a row naming a skill is itself proof that THIS SESSION resolved THAT skill.
+     * That is the one question a file-existence check cannot answer, and `verify dispatch` answers
+     * it by reading these rows. Without the name here, the evidence exists and is unattributable.
+     *
+     * @param {string} reason - Why no receipt was written.
+     * @param {string} [rule] - Which defer condition matched.
+     * @returns {never} Does not return — settles the hook.
+     */
+    const defer = (reason, rule) => settle({
+      verdict: "allow", event: "PostToolUse", tool: p?.tool_name ?? null, cwd: p?.cwd, reason, rule,
+      subject: p?.tool_input?.skill ?? null,
+    });
+    const raw = await readStdin();
+    let p;
+    try { p = JSON.parse(raw || "{}"); }
+    catch (e) { settle({ verdict: "error", event: "PostToolUse", reason: `unparseable payload: ${e.message}` }); }
+
+    if (p.tool_name !== "Skill" && p.tool_name !== "Agent") {
+      defer(`${p.tool_name ?? "no tool_name"} is not a dispatch tool — out of scope`, "not-a-dispatch");
+    }
+    const cited = orderPathFrom(p.tool_input);
+    if (!cited) defer("no --order threaded — not an orchestrated dispatch", "no-order");
+
+    const skillInvoked = skillInvokedFrom(p.tool_response);
+    if (!skillInvoked) {
+      // The `Agent` case, and any host result that does not name what ran. Attesting here would
+      // mint the fact rather than record it.
+      defer("dispatch result names no resolved skill — nothing to attest", "no-skill-named");
+    }
+
+    const cwd = p.cwd || process.cwd();
+    const orderPath = resolve(cwd, cited);
+    let order;
+    try { order = JSON.parse(readFileSync(orderPath, "utf8")); }
+    catch (e) { defer(`order not readable (${e.message}) — cannot attest a dispatch it cannot identify`, "order-unreadable"); }
+    if (!order?.order_id) defer("order carries no order_id — nothing to key a receipt by", "order-unkeyed");
+
+    const row = receiptRow(order, skillInvoked, p);
+    const written = writeReceipt(row, cwd);
+    return {
+      verdict: "allow", event: "PostToolUse", tool: p.tool_name, cwd, subject: row.order_id,
+      rule: written ? "receipt-written" : "receipt-write-failed",
+      reason: written
+        ? `dispatch receipt: ${row.order_id} ran ${skillInvoked} (declared ${row.worker_declared}, ok=${row.dispatch_ok})`
+        : `dispatch receipt could not be written for ${row.order_id} — ingest will refuse this result unless --no-receipt-check`,
+    };
+  });
+}
+
+if (isMain(import.meta.url)) main();

package/hooks/gate-intake.mjs

@@ -3,23 +3,21 @@
 //
 // Denies a `tech-lead` dispatch that carries no pitch, no spec folder, and no requirement text.
 //
-// WHY THIS EXISTS (measured, not theorized). On the SDD harness benchmark
-// (`sdd-harness-bench`, feature F2, Haiku 4.5, n=3, zero variance) the orchestrator was reached as
+// WHY THIS EXISTS (reproduced, not theorized). The orchestrator was reached as
 //
 //     Skill(tech-lead, args: "--unattended")
 //
 // — the flag survived the hand-off, the requirement text did not. With nothing to orchestrate,
-// the run printed eleven gate names, a confident plan, and wrote no code, scoring 29% against a
-// hidden acceptance suite while *looking* like a successful run. The same harness invoked with
-// --pitch/--spec scored 100%, n=3. A stronger model happened to inline the text and recover; a
-// cheaper one did not, three times out of three.
+// the run printed the gate names, a confident plan, and wrote no code, while *looking* like a
+// successful run. The same harness invoked with --pitch/--spec built the feature. Whether a model
+// happens to inline the text and recover is a property of the model, not of the harness.
 //
 // That is the "agent claims done" failure this project exists to prevent, happening at the
 // project's own front door. Every other invariant that matters here lives in the runtime; this one
 // was living in a prompt, and a prompt is exactly what gets dropped on a hand-off. So it becomes a
 // hook, like GATE L2.
 //
-// Design mirrors gate-l2.mjs deliberately:
+// Design mirrors the GATE L2 block deliberately:
 //   • Scope — only `Skill` → tech-lead. Anything else defers instantly.
 //   • Fail-CLOSED only on a provably empty intake, with an actionable re-invocation in the reason.
 //   • Fail-OPEN on anything ambiguous (unparseable payload, unknown arg shape, an envelope
@@ -29,10 +27,10 @@
 // Contract: PreToolUse stdin JSON { tool_name, tool_input:{skill_name|skill, skill_args|args}, ... }
 // Deny via { hookSpecificOutput: { hookEventName, permissionDecision:"deny", permissionDecisionReason } }.
 
-// RECEIPTS (v1.5). This gate was scored `No effect` — built, verified on 10 cases, and the
-// benchmark re-run still 4/14 — because the hook CORRECTLY never fired and the cause was elsewhere.
-// That distinction was unprovable from a hook that answers "inspected and permitted" and "never
-// ran" with the same silence. Every decision below is now recorded (hooks/lib/decision.mjs).
+// RECEIPTS (v1.5). This gate has been scored `No effect` on a re-run where the acceptance rate did
+// not move — because the hook CORRECTLY never fired and the cause was elsewhere. That distinction
+// is unprovable from a hook that answers "inspected and permitted" and "never ran" with the same
+// silence. Every decision below is now recorded (hooks/lib/decision.mjs).
 
 import { runHook, readStdin, settle } from "./lib/decision.mjs";
 
@@ -57,7 +55,7 @@ const args = String(p.tool_input?.skill_args ?? p.tool_input?.args ?? "");
 const skill = String(skillRaw).split(":").pop();
 if (skill !== "tech-lead") defer(`Skill(${skill}) is not the orchestrator — out of scope`);
 
-// The envelope port supplies its own intake; validate-envelope.mjs owns that path.
+// The envelope port supplies its own intake; `harness verify envelope` owns that path.
 if (/--order\b/.test(args)) defer("envelope dispatch — validate-envelope owns this path", "--order");
 
 // Intake is satisfied by ANY of: a pitch path, a spec folder, or free requirement text.
@@ -68,13 +66,14 @@ const hasResume = /--from\s+\S/.test(args); // resuming an existing run has its
 // Free text = anything left once flags and their values are removed.
 // Every flag that TAKES A VALUE must be listed here. A flag whose value is not stripped reads as
 // free requirement text, and the gate then defers on an empty intake — the exact dispatch it
-// exists to deny. This is a live failure mode, not a hypothetical: adding `--gate-answers ci` and
-// `--wall-clock-budget 2400` silently blinded the gate, and the very next benchmark run reached
-// tech-lead as `args:"--unattended --gate-answers ci --wall-clock-budget 2400"` — no requirement
-// text at all — and was waved straight through, because "ci" and "2400" counted as the spec.
+// exists to deny. This is a live failure mode, not a hypothetical: adding `--gate-answers` and
+// `--wall-clock-budget` without listing them here silently blinded the gate, and the very next run
+// reached tech-lead as `args:"--unattended --gate-answers ci --wall-clock-budget 2400"` — no
+// requirement text at all — and was waved straight through, because "ci" and "2400" counted as
+// the spec.
 // Adding a valued flag anywhere in the harness means adding it here, and structural test §39
 // enforces exactly that against commands/ship.md.
-const VALUED_FLAGS = /--(pitch|spec|from|lens|rounds|attempts|orch-model|exec-model|eval-model|qa-model|feature|task|gate-answers|wall-clock-budget|slug|auto-level|max-rounds|intake-file|intake-text|spec-folder|cwd|out|by|preset|file|order)\s+\S+/g;
+const VALUED_FLAGS = /--(pitch|spec|from|lens|rounds|attempts|parallel-scopes|orch-model|exec-model|eval-model|qa-model|feature|task|gate-answers|wall-clock-budget|slug|auto-level|max-rounds|intake-file|intake-text|spec-folder|cwd|out|by|preset|file|order)\s+\S+/g;
 const BARE_FLAGS = /--[a-z0-9-]+/g;
 const freeText = args.replace(VALUED_FLAGS, " ").replace(BARE_FLAGS, " ").trim();
 

package/hooks/gate-zerowork.mjs

@@ -1,10 +1,9 @@
 #!/usr/bin/env node
 // GATE Z — ZERO-WORK. Blocking Stop hook. The detector for "the harness described itself".
 //
-// WHY THIS EXISTS (measured, not theorized).
+// WHY THIS EXISTS (reproduced, not theorized).
 //
-// SDD harness benchmark, F2, Haiku 4.5, n=5, zero variance. The orchestrator was dispatched
-// with a valid spec and returned this, in full:
+// Dispatched with a valid spec, the orchestrator returned this, in full:
 //
 //     TOOL   Skill(tech-lead, "--unattended --rounds 3\n\n# F2 — category budgets…")
 //     TEXT   "The tech-lead skill is orchestrating the full Shape Up harness. It will: 1. …"
@@ -14,7 +13,7 @@
 // That is the "agent claims done" pathology this project exists to prevent, reproduced by the
 // project, at its own front door.
 //
-// THE TWO STRUCTURAL MISSES IT EXPOSED. `anti-rationalization.mjs` is the guard for exactly
+// THE TWO STRUCTURAL MISSES IT EXPOSED. the ship report's census is the guard for exactly
 // this class of failure, and it could not see this one for two independent reasons:
 //
 //   1. SCOPE. It defers unless a run is active (`activeSlug()` → `.shapeup/<slug>/`).
@@ -30,10 +29,10 @@
 //
 //     the session dispatched the orchestrator   AND   the run left no receipt
 //
-// `init-run.mjs` writes that receipt as the orchestrator's first tool call. Its absence is the
+// ``harness init run`` writes that receipt as the orchestrator's first tool call. Its absence is the
 // fact. Nothing here parses intent, so nothing here can be talked past.
 //
-// WHY THIS ONE BLOCKS, WHEN anti-rationalization DOES NOT. The invariant is "QA is a level-up,
+// WHY THIS ONE BLOCKS, WHEN the ship report's census DOES NOT. The invariant is "QA is a level-up,
 // not a gate" — no second judge behind `spec-evaluator`. That governs quality JUDGMENTS. This
 // hook makes no judgment: it reports that no work exists to judge. Blocking is also uniquely
 // safe here, because a session with no artifacts has nothing to lose by continuing, and a
@@ -50,25 +49,77 @@
 // SECOND CONDITION (v1.5). Since `hooks/lib/decision.mjs` gives every hook a receipt, this gate
 // gains a second, independent fact it can assert at `Stop`: the orchestrator was dispatched, and
 // `decisions.jsonl` holds ZERO rows for this pid — meaning the enforcement layer itself never ran.
-// That is F-16's class, not its instance: under a symlinked install every gate was inert while
-// every gate reported success. The detector for "the gates didn't run" now stops depending on the
-// gates running.
+// That is a whole CLASS of failure, not one instance: under a symlinked install every gate can be
+// inert while every gate reports success. The detector for "the gates didn't run" therefore stops
+// depending on the gates running.
 
 import { readFileSync, readdirSync, existsSync, statSync } from "node:fs";
 import { join } from "node:path";
-import { isMain } from "../skills/tech-lead/scripts/lib/is-main.mjs";
-import { localDir, globLocal } from "../skills/tech-lead/scripts/lib/paths.mjs";
+import { isMain } from "../kernel/lib/argv.mjs";
+import { localDir, globLocal } from "../kernel/lib/paths.mjs";
 import { runHook, readStdin, settle, decisionsPath } from "./lib/decision.mjs";
 
 const MAX_TRANSCRIPT_BYTES = 20 * 1024 * 1024;
 
-/** Tool names that constitute doing something to the project, as opposed to looking at it. */
+/**
+ * Tool names that constitute doing something to the project, as opposed to looking at it.
+ *
+ * The census these produce is now DESCRIPTIVE ONLY — it sharpens the block message and nothing
+ * decides on it. Until v1.7.1 a count above two was a fail-open ("the session did work by other
+ * means"), and it was retired for the reason spelled out at the `work-done` note below. `Workflow` stays absent because a launch is not work — it is the work this hook is
+ * asking about — and it is a DISPATCH signal instead (`dispatchedOrchestrator`).
+ */
 const WORK_TOOLS = new Set(["Write", "Edit", "MultiEdit", "NotebookEdit", "Bash", "Task", "Agent"]);
 
-/** Did this session dispatch the orchestrator? Skill(tech-lead) in any of its surface spellings. */
+/**
+ * Is this block a launch of the orchestrator's own workflow script, by either surface?
+ *
+ * The shipped front door is `Workflow({scriptPath})`; `npx shapeup-sdlc init` writes the grant it
+ * needs. The Bash arm below is kept because a project that declined that grant, or one still on a
+ * v1 install, launches the same script through a Bash runtime — a gate that knew only one surface
+ * would go blind on the lane those users actually run, which is the same "the emptier the failure,
+ * the less of it there is to detect" hole the banner above describes.
+ *
+ * Matched on the BASENAME, anchored. `CLAUDE_PLUGIN_ROOT` itself ends in `shapeup-sdlc-plugin/` on
+ * a normal install — so a substring match on the whole path would count EVERY workflow script that
+ * happens to live under the plugin root, including one a user wrote for something else. The
+ * basename is the part the skill controls and the part `SKILL.md` names.
+ *
+ * @param {object} block - A `tool_use` content block.
+ * @returns {boolean} True when the block launches a `shapeup-*` workflow.
+ */
+function launchedShapeupWorkflow(block) {
+  if (block.name === "Bash") {
+    const cmd = String(block.input?.command ?? "");
+    // Both halves required: a node launcher AND an orchestrator script. A launcher carrying
+    // somebody else's workflow is not a harness dispatch, and neither is a bare mention of the
+    // script in an unrelated command (`ls`, `cat`).
+    return /\bnode\b/.test(cmd) && /[\\/]shapeup-[\w.-]*\.[cm]?js\b/.test(cmd);
+  }
+  if (block.name !== "Workflow") return false;
+  const scriptPath = String(block.input?.scriptPath ?? "");
+  const base = scriptPath.split(/[\\/]/).pop().replace(/\.[cm]?js$/, "");
+  const named = String(block.input?.name ?? "");
+  return /^shapeup-/.test(base) || /^shapeup-/.test(named);
+}
+
+/**
+ * Did this session dispatch the orchestrator? Three surface spellings, all equivalent:
+ * `Skill(tech-lead)`, a leading `/ship` slash command, and — since the workflow cutover (v1.7) —
+ * a `Workflow` tool_use launching one of the orchestrator's own `shapeup-*` scripts.
+ *
+ * The third arm is a correctness repair, not a new detector. `SKILL.md`'s Step 2 makes the
+ * Workflow launch the scoped lane's front door, so a session can now reach the orchestrator
+ * without ever emitting `Skill(tech-lead)` — and before this arm existed such a session was
+ * invisible to the gate, exactly the "the emptier the failure, the less of it there is to detect"
+ * hole the banner above describes. It is a TRIGGER, never an escape: a launch that left no
+ * receipt is still a blocked stop, because a `Workflow` call that returned without starting a run
+ * is precisely the narration case wearing a tool call.
+ */
 export function dispatchedOrchestrator(events) {
   for (const ev of events) {
     for (const block of toolUses(ev)) {
+      if (launchedShapeupWorkflow(block)) return true;
       if (block.name !== "Skill") continue;
       const skill = String(block.input?.skill ?? block.input?.skill_name ?? "");
       if (skill.split(":").pop() === "tech-lead") return true;
@@ -110,7 +161,7 @@ export function workCensus(events) {
   return census;
 }
 
-/** Any run receipt on disk, from any run. Written by init-run.mjs as the run's first act. */
+/** Any run receipt on disk, from any run. Written by `harness init run` as the run's first act. */
 export function findReceipts(cwd) {
   const root = localDir(cwd);
   if (!existsSync(root)) return [];
@@ -178,26 +229,39 @@ export function buildReason({ narration, census, enforcement }) {
     `Mechanical facts: ${census.tool_calls} tool call(s), ${census.work_calls} of them work calls, ` +
     `${census.writes} file write(s), and no \`${globLocal("<slug>", "receipt.json")}\`.`,
     narration ? `The final message reads as a plan, not a result (matched: "${narration}").` : null,
+    census.work_calls > 2
+      ? `Those ${census.work_calls} work calls are why this block exists, not a reason to waive it: a busy ` +
+        "session used to switch this gate off. Work done AROUND the harness has no board, no T0 verdict and " +
+        "no receipt — a hand-built feature can pass its own oracle while the pipeline never ran."
+      : null,
     enforcement && enforcement.readable && enforcement.rows === 0
       ? "AND the enforcement layer left zero decision rows — the gates did not merely permit this run, they never ran. " +
-        "Check the plugin install (a symlinked or spaced path was the measured cause; see lib/is-main.mjs)."
+        "Check the plugin install — a symlinked path or a path with a space is the usual cause."
       : null,
     "",
     "A run that describes its own pipeline and stops is the exact failure this harness exists to",
-    "prevent — measured at 29% acceptance with 10 escaped defects while looking like a clean run.",
+    "prevent: it reads like a clean run and leaves escaped defects behind it.",
     "Loading the instructions is not running them.",
     "",
     "Do the work now, starting with the first step of the runbook:",
     "",
     "  # write the requirement to a file first — inlining multi-line text into a shell",
     "  # argument is where this step goes wrong",
-    "  node \"${CLAUDE_PLUGIN_ROOT}/skills/tech-lead/scripts/init-run.mjs\" \\",
+    "  node \"${CLAUDE_PLUGIN_ROOT}/kernel/harness.mjs\" init run \\",
     "       --slug <slug> --intake-file <path/to/requirement.md> \\",
     "       --auto-level <interactive|auto|unattended> [--gate-answers <preset|path>]",
     "",
-    "Then proceed through the gates, resolving each one with:",
+    "Then launch the lane itself with the Workflow tool (`npx shapeup-sdlc init` writes the grant",
+    "it needs, unless --no-native-workflow was given, in which case approve the launch once):",
+    "",
+    "  Workflow({",
+    "    scriptPath: \"${CLAUDE_PLUGIN_ROOT}/skills/tech-lead/workflows/shapeup-run.js\",",
+    "    args: <the RunArgs object>",
+    "  })",
     "",
-    "  node \"${CLAUDE_PLUGIN_ROOT}/skills/tech-lead/scripts/gate-answers.mjs\" --resolve <gate-id> …",
+    "Resolve each gate the run pauses at with:",
+    "",
+    "  node \"${CLAUDE_PLUGIN_ROOT}/kernel/harness.mjs\" gate --resolve <gate-id> …",
     "",
     "If the command comes back \"requires approval\", say so and stop — the harness's scripts ship with",
     "the plugin and need a one-time permission grant (`npx shapeup-sdlc init` writes it). Do NOT route",
@@ -231,18 +295,36 @@ async function main() {
   // not a harness session → not our business
   if (!dispatchedOrchestrator(events)) defer("session never dispatched the orchestrator — not a harness run", "no-dispatch");
 
-  // A receipt means the run started. What happens after that is anti-rationalization's job and
+  // A receipt means the run started. What happens after that is the ship report's census's job and
   // the evaluator's; this hook only asks whether anything started at all.
   const receipts = findReceipts(cwd);
   if (receipts.length > 0) defer(`${receipts.length} run receipt(s) on disk — the run started`, "receipt-present");
 
   const census = workCensus(events);
 
-  // Fail open when the session clearly did work by other means. A user may have run the harness
-  // steps by hand, or be on a pre-receipt version of the plugin. Real narration has ~zero work
-  // calls; this threshold keeps the hook off everything else.
-  if (census.work_calls > 2) defer(`${census.work_calls} work calls — the session did work by other means`, "work-done");
-
+  // ── The `work-done` fail-open is GONE, and its removal is the point.
+  //
+  // WHAT IT USED TO DO: `if (census.work_calls > 2) defer("the session did work by other means")`.
+  // The stated rationale was that a user may have run the harness steps by hand, or be on a
+  // pre-receipt version of the plugin.
+  //
+  // WHAT IT ACTUALLY DID, observed. `Skill(tech-lead)` was dispatched, the lane could not start,
+  // the agent hand-built the whole feature, and the hook ALLOWED the Stop on `"37 work calls — the
+  // session did work by other means"`. That session passed its own oracle and read like a clean
+  // run, with no board, no T0, no verdict and no receipt. A busy session was the one thing that
+  // could switch this gate off — so the harder the agent worked around the harness, the safer it
+  // was from the gate watching for exactly that.
+  //
+  // BOTH HALVES OF THE RATIONALE FAIL ON INSPECTION. Running the harness steps by hand starts with
+  // ``harness init run``, which writes the receipt — such a session already deferred at `receipt-present`
+  // two lines up and never reached here. And a pre-receipt plugin cannot be the one executing this
+  // hook: ``harness init run`` ships in the same install, beside the `lib/` this file imports from.
+  // Neither case needs an escape, so no replacement escape is added — an escape that cannot fire
+  // is the "row that cannot fail" this project keeps catching.
+  //
+  // WHAT KEEPS THIS SAFE is not a threshold, it is the loop guard: `stop_hook_active` defers
+  // unconditionally, so a session that genuinely did the work outside the harness costs one extra
+  // turn and then stops. One nudge, never a hang. That is the trade this gate is worth.
   const message = typeof p.last_assistant_message === "string" ? p.last_assistant_message : "";
   const narration = detectNarration(message);
   const enforcement = enforcementCensus(cwd);

package/hooks/hooks.json

@@ -8,27 +8,6 @@
             "command": "echo \"shapeup-sdlc-plugin loaded from ${CLAUDE_PLUGIN_ROOT}\""
           }
         ]
-      },
-      {
-        "matcher": "startup|compact|resume|clear",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/session-rehydrate.mjs\"",
-            "timeout": 10
-          }
-        ]
-      }
-    ],
-    "PreCompact": [
-      {
-        "hooks": [
-          {
-            "type": "command",
-            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/compact-snapshot.mjs\"",
-            "timeout": 10
-          }
-        ]
       }
     ],
     "PreToolUse": [
@@ -42,16 +21,6 @@
           }
         ]
       },
-      {
-        "matcher": "Skill",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/gate-l2.mjs\"",
-            "timeout": 10
-          }
-        ]
-      },
       {
         "matcher": "Skill",
         "hooks": [
@@ -63,31 +32,33 @@
         ]
       },
       {
-        "matcher": "Skill",
+        "matcher": "Skill|Agent",
         "hooks": [
           {
             "type": "command",
-            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/gate-deadline.mjs\"",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/kernel/harness.mjs\" verify envelope",
             "timeout": 10
           }
         ]
       },
       {
-        "matcher": "Skill|Agent",
+        "matcher": "Edit|Write|MultiEdit",
         "hooks": [
           {
             "type": "command",
-            "command": "node \"${CLAUDE_PLUGIN_ROOT}/skills/tech-lead/scripts/validate-envelope.mjs\"",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/sandbox-guard.mjs\"",
             "timeout": 10
           }
         ]
-      },
+      }
+    ],
+    "PostToolUse": [
       {
-        "matcher": "Edit|Write|MultiEdit",
+        "matcher": "Skill|Agent",
         "hooks": [
           {
             "type": "command",
-            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/sandbox-guard.mjs\"",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/dispatch-receipt.mjs\"",
             "timeout": 10
           }
         ]
@@ -100,16 +71,6 @@
             "type": "command",
             "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/gate-zerowork.mjs\"",
             "timeout": 10
-          },
-          {
-            "type": "command",
-            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/anti-rationalization.mjs\"",
-            "timeout": 10
-          },
-          {
-            "type": "command",
-            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/slop-cleaner.mjs\"",
-            "timeout": 15
           }
         ]
       }