shapeup-sdlc 1.7.0 → 3.0.0

package/skills/tech-lead/references/round-protocol.md

@@ -1,234 +0,0 @@
-# Round Protocol
-
-The orchestration loop in detail. A "round" is one BUILD phase followed by exactly one
-EVAL phase. The feature is done when an EVAL round returns PASS.
-
-> `tasks/_index.md` referenced throughout this file lives in the LOCAL gitignored root
-> (`.shapeup/<slug>/tasks/`, v3.2), not the
-> SHARED spec dir. See tech-lead SKILL.md GATE L1b for the bootstrap step that regenerates it
-> when missing.
-
-**On a spec with committed scope contracts, this loop is now CODE, not prose** —
-`skills/tech-lead/workflows/shapeup-run.js`'s own `while (round <= args.budgets.maxRounds)` loop
-implements exactly the shape below (PASS → ship; `max_rounds` exceeded → GATE H `breaker: outer`;
-else the next round builds bugs only), with the EVAL-timing rule, the regression rule, and the
-three-level breaker all enforced as branches in that script rather than described here for a model
-to follow. Read that script's own comments for the mechanics; this file keeps the historical
-rationale and the parts of the protocol the script does not cover (ESCALATE adjudication,
-discovered-task reconciliation mid-BUILD — see its banner
-for the full list) — and, unchanged, the loop below for a `--tiny` run or a spec with no scope
-contracts, which `shapeup-run.js` is out of scope for by design.
-
-```
-round r = 1
-loop:
-    BUILD(r)                          # see r=1 vs r>1 below
-    assert board 100% done            # GATE L2 — advisory: the hook warns, you decide
-    verdict, bugs = EVAL(r)           # ONE spec-evaluator --feature pass
-    if verdict == PASS:
-        SHIP; break
-    if r >= max_rounds:
-        ESCALATE(bugs); break         # honest stop — no infinite loop
-    r = r + 1                         # next round builds bugs only
-```
-
-## BUILD(r) semantics
-
-| | r = 1 (initial build) | r > 1 (fix build) |
-|--|----------------------|-------------------|
-| Input | the whole task board | the bug list from EVAL(r-1) |
-| Scope | every ready task, dependency/layer order, until board all ✅ | only the tasks/areas named by bugs |
-| Command | compile-order `--next` → task-executor `--order` → ingest, looped | compile-order `--task <id> --operation fix` → dispatch → ingest, per bug |
-| Passing areas | n/a | never touched |
-| SPIKEs | resolved first (they block) | only if a bug is a SPIKE finding |
-
-Re-opening tasks in r>1: the fix order's WorkResult reports the task `partial` while failing
-and `done` when re-verified; ingest-result flips the board accordingly. The board reflects the
-churn so the next EVAL sees a green board again.
-
-Discovered Tasks:
-If WorkResults carry `discoveries[]` during BUILD, ingest-result appends them to the discovery
-ledger (`.shapeup/<slug>/discovery/ledger.md`) and the build loop pauses after the current
-tasks are done. Compile + dispatch a reconcile order (ba-pitch-analyzer, operation: reconcile).
-This reconciles them into new tasks and invariants and updates the board; the tech lead bumps
-`discovered_rounds` in harness-run.md, then routes back to GATE L1b (Board Review) for PO
-approval of the new tasks and estimates before resuming the BUILD loop.
-
-## The EVAL timing rule (the core constraint)
-
-EVAL fires **once** per round and **only** when GATE L2 has confirmed the board is 100% done.
-It is never:
-- called per task,
-- called inside the BUILD loop,
-- called on a partial board.
-
-## Regression rule (r > 1) — QA-meeting Bước 1c
-
-A fix round changes code; a fix can break what passed. Therefore EVAL(r>1) scope is **not**
-just the fixed bugs:
-
-```
-EVAL(r) for r > 1:
-  touched_UCs = every UC referenced (use_case_refs) by a task re-opened in BUILD(r)
-  scope = fixed bugs' criteria
-        + FULL re-run of `## Test Surface` rows for every touched UC
-          (test-surface-conformance dimension, when active)
-        + completeness re-check (cheap, static)
-  untouched UCs' surfaces: NOT re-run (their code didn't change; re-probing everything
-  every round would turn cheap end-of-round QA into a full-suite tax)
-```
-
-Pre-v2.9 specs (no Test Surface anywhere): the rule degrades to bug-criteria-only, as
-before — and the verdict report notes `regression coverage: none (no test surface)`.
-Honest reporting over silent coverage claims.
-
-## QA edge hunt (post-PASS, pre-ship)
-
-When EVAL(r) returns PASS for the **first** time in a run, the orchestrator delegates one
-`/qa-edge-hunter` pass before SHIP (skippable via `--no-qa`, same spirit as `--no-eval`).
-QA is a pure worker: no verdict, no score, no gate — it writes `~` findings to
-`discovery/ledger.md` and a `qa/hunt-report.md`. Triage happens at SHIP/GATE L4:
-- all findings stay `~` → SHIP; findings carry over as raw ideas (debt-free).
-- PO/TL promote any to must-have → a fix round r+1 (those items only) → EVAL
-  never a second full hunt) → back to L4.
-- Circuit breaker applies: out of rounds/appetite → ship with `~` findings recorded.
-QA never runs on a FAIL round — a build that hasn't passed conformance isn't worth
-edge-hunting yet.
-
-Rationale (from the long-running harness work): a single end-of-round QA pass over the
-running feature is cheap relative to the build (minutes vs hours) and catches the
-last-mile defects, whereas grading every task multiplies evaluator cost for little gain
-once the generator is competent. If the build round didn't finish, there is nothing
-coherent to evaluate yet.
-
-## Stop conditions
-1. **PASS** — EVAL(r) verdict is PASS → SHIP.
-2. **max_rounds (OUTER breaker)** — r would exceed `--max-rounds` (default 3) without PASS →
-   ESCALATE: print the residual bug list, the rounds used, and hand the decision to the PO
-   (scope contracts present: also `/scope-hammer --breaker outer`). Do not start another
-   build round automatically.
-3. **attempt_budget (INNER breaker, scope contracts only)** — a single scope's T0 attempt
-   loop exhausts `--attempts` (default 5) without reaching a trial that is both `kept` and
-   T0-green, **or** `no_progress_k` consecutive trials come back non-`kept` (the stagnation
-   term, default 2 — `compile-order.mjs` prints it as a JSON breaker object on stderr) →
-   does NOT stop the round; queues a hammer PROPOSAL for GATE H and moves to the next scope
-   in sequence. See "Three-level circuit breaker" below.
-4. **wall_clock_budget (DEADLINE breaker, opt-in)** — elapsed seconds since the run receipt
-   exceed `--wall-clock-budget` → do NOT start another build round or another scope; go
-   straight to GATE H (`/scope-hammer --breaker deadline`). Checked with
-   `scripts/budget-check.mjs` at every round boundary and enforced by `hooks/gate-deadline.mjs`,
-   which denies a `task-executor` dispatch past the deadline while leaving `spec-evaluator`,
-   `scope-hammer` and `qa-edge-hunter` reachable — a run past its deadline
-   must still be able to judge, hammer, and close. Off unless configured.
-5. **Hard error** — a sub-skill fails irrecoverably (e.g. spec folder gone, app won't
-   build at all) → stop and report; do not retry blindly.
-6. **User halt** — at any L-gate the user can stop the run; the ledger preserves state for
-   `--from` resume.
-
-## Three-level circuit breaker
-
-```
-OUTER    round_budget (max_rounds)  — the six-week-timebox analog. Decremented once per
-                                       round at GATE L2, regardless of how many scopes it
-                                       covered. Hitting 0 → GATE H immediately (§ above).
-INNER    attempt_budget (per scope) — decremented once per T0 attempt inside BUILD round r.
-                                       Hitting its cap WITHOUT a T0-green result trips the
-                                       inner breaker for that scope only: the scope is queued
-                                       as a hammer PROPOSAL (not a hard stop) and the round
-                                       moves on to the next scope in the L1b sequence.
-                                       no_progress_k (default 2) is COMPOSED INTO this same
-                                       breaker rather than added beside it as a fourth budget:
-                                       attempt_budget counts attempts and cannot see that the
-                                       last two produced nothing, so k consecutive non-`kept`
-                                       trials queue the same GATE H proposal early.
-DEADLINE wall_clock_budget_s        — elapsed seconds since the run receipt. Opt-in; off
-                                       unless set at L0. Tripping routes to GATE H with
-                                       --breaker deadline. Enforced by hooks/gate-deadline.mjs.
-```
-
-**Why the third one exists — and it corrects an earlier diagnosis.** A run killed at an external
-time cap looks like a stall from outside: no verdict, nothing to show. The natural reading is that
-it hung at a gate. Often the transcript says otherwise — steady turns, steady writes, gate markers
-advancing, zero stall signals. The run was working when the clock ran out.
-
-Both existing breakers count *events*, not time: `round_budget` moves once per round,
-`attempt_budget` once per T0 attempt. Neither can observe that round 1 has been running for
-twenty-nine minutes, so a run can burn its entire wall clock with both breakers untouched. The
-cost is not the missing verdict — it is that a run killed from *outside* ships nothing, not even the
-scopes that were already green. A breaker that trips from the inside routes to GATE H, where
-scope-hammer compares the shippable subset against the baseline and ships what works. Same clock,
-different ending.
-Nesting rationale: a struggling scope should not freeze every other scope's progress
-in the same round — only running out of *rounds* (the real six-week analog) stops the whole
-run. A scope that trips its inner breaker still gets judged fairly at GATE H: scope-hammer
-compares "ship without this scope" against the baseline, same as any other cut candidate — it
-is never silently dropped, and it is never allowed to block scopes that ARE working.
-
-## Isolated attempt loop — one T0 attempt, in detail (scope contracts only)
-
-**This is `shapeup-run.js`'s inner per-scope loop, as code**, with one addition the prose below
-never had: before opening a scope's attempt loop, the script checks whether THIS round already
-has a green T0 verdict for that scope on disk, and skips it when it does — the resumability a
-mid-BUILD kill needs, that a session narrating this loop from memory could never guarantee.
-
-Whichever runs it, the loop is a **ratchet**: every attempt is scored against the last kept one,
-and the working tree moves forward only when the score strictly improves. `t0-verify.mjs` makes
-that decision and acts on the tree itself, inside the runtime — its caller reads the decision, it
-never makes it.
-
-```
-compile-order --scope … --round N --attempt M
-                                   → zero-memory WorkOrder (scope contract + this scope's
-                                      tasks + digested errors + ledger decisions +
-                                      trial_history: the last 8 trials for this scope, each
-                                      with score, status, delta and top-3 digest, CROSSING the
-                                      round boundary — compiled facts, no chat history by
-                                      construction)
-dispatch task-executor --order …   → code within substrate; WorkResult in results/
-ingest-result <result>             → board/ledger writes
-(a worker cannot escalate)         → WorkResult carries no escalates field. A phase that
-                                      cannot finish leaves no artifact, the post-condition
-                                      fails, and the run ABORTS naming the phase. Resolve it
-                                      yourself and record the answer in round-ledger.md, which
-                                      the NEXT attempt's fresh context reads back.
-t0-verify.mjs                      → fixtures + DB probe + (on green) seesaw, then scores the
-                                      attempt against the baseline trial and snapshots or
-                                      restores the tree. Branch on `status` from its stdout
-                                      JSON — the tree action has ALREADY happened:
-  kept      strictly better, INCLUDING red-but-improved (2/5 → 4/5 fixtures — the whole point
-              of the ratchet). Tree snapshotted to refs/shapeup/<scope_id>/kept.
-              overall=green → the attempt loop breaks; scope reaches DOWNHILL_EXECUTION.
-              Still red → loop, and attempt M+1 now builds ON attempt M.
-  reverted  not better — and a tie is not better. Tree already restored from the last kept
-              snapshot. Subsumes the retired stash-and-retry branch: a FINISHED scope's broken
-              fixture raises score.regressions and reverts through this same rule, which
-              is why seesaw runs before anything is declared green.
-              rather than the code. Tree kept, baseline reset. Not a verdict, not a failure.
-  crash     a fixture command failed to spawn or timed out; tree restored. Fix the fixture,
-              not the code.
-  (on any red, `discovered_tasks` carries the AEGIS {file, line, core_message} triples, which
-   compile-order folds into the NEXT attempt's order as digested_errors — no separate dispatch)
-```
-
-**The exit code is not the branch selector.** `t0-verify.mjs` exits 0 on T0-green and 1 on
-T0-red (2 on bad argv), mirroring the `oracles/*` convention — so a `kept` red-but-improved
-attempt, the exact case the ratchet exists for, exits 1. Branch on `status` from the stdout
-JSON; never on `$?`, and never wire this call into a `set -e` / `&&` chain that would read a
-non-zero exit as "stop".
-
-This replaces the old flat per-task loop for any scope that has a contract;
-scopes/specs without one keep the v0.2.6 behavior verbatim (see BUILD(r) table above).
-
-## --no-eval (skip evaluation)
-A tech-lead judgment, surfaced at GATE L2: if the feature is clearly within what the model
-builds reliably solo, the evaluator is optional overhead. With `--no-eval`, after GATE L2
-the run goes straight to SHIP with verdict `not-evaluated` recorded in the ledger and a
-clear note that nothing was verified beyond task-executor's own per-AC evidence checks.
-
-## Round-cost intuition
-Build dominates; eval is cheap. Expect each EVAL round to cost a small fraction of a BUILD
-round. This is why running eval once per round (not per task) is the right trade: you pay a
-little QA at the end of each build and keep the expensive build coherent in between.
-
-<!-- test requirement -->
-kept|reverted|rebased|crash, decided in t0-verify.mjs decideStatus()

package/skills/tech-lead/references/state-model.md

@@ -1,66 +0,0 @@
-# State Model — who writes what
-
-Reference for the orchestrator. Moved out of `SKILL.md` so the front door stays a runbook: the
-first screen a model reads decides whether it acts or describes, and every line of architecture
-prose ahead of the first tool call is a line it can summarise instead of execute.
-
----
-
-## State ownership (D6, mechanically closed in v1.0)
-
-Workers are stateless; the orchestrator layer is the **sole writer of ALL run-state**. Every
-worker receives a structured **WorkOrder** envelope (`.shapeup/<slug>/orders/`, compiled by
-`compile-order.mjs`) and returns a **WorkResult** envelope (`results/`); the deterministic
-`ingest-result.mjs` performs every shared-state write — board status, AC ticks, unblock
-propagation, discovery-ledger appends, verdict bookkeeping.
-
-No worker writes `run-state.md`, `tasks/_index.md`, or the ledger. Everything a worker used to
-write into shared files, it now returns as data.
-
-The tech lead owns `harness-run.md` — rounds, gate decisions, Hill positions, verdicts,
-`discovered_rounds`, config, language record. The board (`tasks/_index.md`, LOCAL root — v3.2) is
-**execution truth**, maintained exclusively through ingest.
-
-**The run receipt (v1.4).** `scripts/init-run.mjs` opens the run and writes
-`.shapeup/<slug>/receipt.json` plus `.shapeup/active-scope` before any gate. The
-receipt is the mechanical fact that a run *started* — distinct from every other artifact here,
-which records what a run *did*. That distinction is load-bearing: the guards that check a run's
-progress (`anti-rationalization.mjs`) are all scoped to an active run, so before the receipt
-existed, a run that never started was invisible to every one of them. `hooks/gate-zerowork.mjs`
-reads only the receipt's presence, which is why it can see a total failure that leaves no other
-trace. See `references/gates.md` — GATE L0.1.
-
-## Central domain registry
-
-Every record type and payload field that crosses a skill boundary is defined exactly once in
-`skills/tech-lead/schemas/domain.schema.json` — the envelope schemas (`work-order.schema.json`,
-`work-result.schema.json`) only `$ref` it. The registry annotates each entity's tier
-(SHARED/LOCAL), location, sole writer, and readers, carries the machine-readable ERD (`x-erd`),
-and maps which payload fields each worker may rely on (`x-payload-by-worker`).
-
-A new cross-boundary field is added THERE first (structural test #24 enforces the map's
-consistency); a skill inventing its own undeclared field is a defect — the orchestrator, not the
-worker, owns the vocabulary.
-
-## Two ledgers, split by promotion timing
-
-(Addendum §F.3 — only when scope contracts exist.)
-
-`harness-run.md` stays the LOCAL (`.shapeup/<slug>/`, gitignored) full run trace: it can be
-rebuilt or lost without consequence.
-
-A second, committed `round-ledger.md` (`shapeup/<slug>/round-ledger.md`, SHARED,
-Tier A) holds only what must survive a crash or a `.shapeup/` wipe:
-
-- the resolved model/budget matrix (L0.8/L0.9),
-- the **Decisions** table — every gate crossing and every PO answer to a blocked phase,
-  promoted the instant it is given, never batched to round close.
-
-Gate crossings resolved from a **gate answer set** (`scripts/gate-answers.mjs`) are written here
-with their source — `preset:ci`, `file:.shapeup/gate-answers.json` — and the set's
-`authorized_by`. A headless run that ships must always be able to name the human behind its
-sign-off; that name lives here and nowhere else.
-
-The tech lead is the sole writer of both. `round-ledger.md` is simply the subset that must never
-live only in a session or a gitignored file. No scope contracts → `round-ledger.md` is not
-written, and `harness-run.md`'s "Decisions log" is the only ledger, exactly as in v0.2.6.

package/skills/tech-lead/scripts/ingest-result.mjs

@@ -1,258 +0,0 @@
-#!/usr/bin/env node
-// WorkResult ingester (pure-skill architecture v1.0, plan P1).
-//
-// The other half of the orchestrator's pipeline sub-layer — and the mechanism that finally
-// closes D6: workers no longer write shared state; they RETURN data (a WorkResult envelope)
-// and this script performs every shared-state write, deterministically, in one place:
-//
-//   task_results[]      → tick AC boxes, flip task frontmatter status, append Execution Log,
-//                         update tasks/_index.md row, propagate unblocks (old P3.1–P3.6)
-//   discoveries[]       → append to .shapeup/<slug>/discovery/ledger.md (old P3.7 / QA H.3)
-//   verdict.criteria[]  → append evaluation/.verdicts-<target>.jsonl (old evaluator B.0)
-//   verdict.refuted[]   → un-tick refuted AC boxes + set eval_verdict frontmatter (old B.2/B.2b)
-//
-// Zero dependencies, zero network, schema-validated input (a malformed result never mutates
-// the board). Single-writer becomes mechanically true, not aspirational.
-//
-// Usage:  node skills/tech-lead/scripts/ingest-result.mjs <result.json> [--cwd <dir>]
-// Exit:   0 = ingested, 1 = result rejected (schema) or a write failed.
-
-import { readFileSync, writeFileSync, appendFileSync, mkdirSync, existsSync, readdirSync } from "node:fs";
-import { resolve, join, dirname } from "node:path";
-import { fileURLToPath } from "node:url";
-import { validate } from "./validate-envelope.mjs";
-import { isMain } from "./lib/is-main.mjs";
-import { runArgs } from "./lib/argv.mjs";
-import { tasksDir, localRoot } from "./lib/paths.mjs";
-
-const HERE = dirname(fileURLToPath(import.meta.url));
-const RESULT_SCHEMA = JSON.parse(readFileSync(resolve(HERE, "../schemas/work-result.schema.json"), "utf8"));
-
-/**
- * @returns {string} Today's date as an ISO `YYYY-MM-DD` string (UTC), for log/frontmatter stamps.
- */
-const today = () => new Date().toISOString().slice(0, 10);
-
-/**
- * Locate a task file on the LOCAL board by id.
- * @param {string} cwd - Working-directory root.
- * @param {string} slug - Feature slug.
- * @param {string} taskId - Task id prefix to match (e.g. "TASK-001").
- * @returns {string|null} Absolute path of the first `<taskId>*.md` file, or null when the tasks
- *   directory or a matching file does not exist.
- */
-export function findTaskFile(cwd, slug, taskId) {
-  const dir = tasksDir(cwd, slug);
-  if (!existsSync(dir)) return null;
-  const f = readdirSync(dir).find((n) => n.startsWith(taskId) && n.endsWith(".md"));
-  return f ? join(dir, f) : null;
-}
-
-/**
- * Set a scalar frontmatter field in a task-file body, adding it when absent.
- * @param {string} body - Full task-file text.
- * @param {string} key - Frontmatter key to set.
- * @param {(string|number)} value - Value to write (stringified inline).
- * @returns {string} The body with `key: value` set; returned unchanged when the body has no
- *   frontmatter block.
- */
-export function setFrontmatter(body, key, value) {
-  const m = body.match(/^---\r?\n([\s\S]*?)\r?\n---/);
-  if (!m) return body;
-  const re = new RegExp(`^${key}:.*$`, "m");
-  const fm = re.test(m[1]) ? m[1].replace(re, `${key}: ${value}`) : `${m[1]}\n${key}: ${value}`;
-  return body.replace(m[1], fm);
-}
-
-/**
- * Tick or un-tick the first acceptance-criterion checkbox whose text matches `ac`.
- * @param {string} body - Full task-file text.
- * @param {string} ac - Criterion text to match (case/space-insensitive substring, either direction).
- * @param {boolean} checked - true to write `[x]`, false to write `[ ]`.
- * @returns {{body:string, hit:boolean}} The updated body and whether a checkbox matched (only the
- *   first match is changed).
- */
-export function setCheckbox(body, ac, checked) {
-  const needle = ac.toLowerCase().replace(/\s+/g, " ").trim();
-  const lines = body.split(/\r?\n/);
-  let hit = false;
-  const out = lines.map((line) => {
-    const m = line.match(/^(\s*- \[)([ x])(\]\s+)(.*)$/);
-    if (!m || hit) return line;
-    const text = m[4].toLowerCase().replace(/\s+/g, " ").trim();
-    if (text.includes(needle) || needle.includes(text)) {
-      hit = true;
-      return `${m[1]}${checked ? "x" : " "}${m[3]}${m[4]}`;
-    }
-    return line;
-  });
-  return { body: out.join("\n"), hit };
-}
-
-/**
- * Flip a task's row in `tasks/_index.md` to a done state.
- * @param {string} indexBody - Full board-index text.
- * @param {string} taskId - Task id whose row to update.
- * @param {boolean} done - When true, rewrite the row's status emoji/word to done; false is a no-op.
- * @returns {string} The board text with the matching row updated (unchanged when no row matches).
- */
-export function updateBoardRow(indexBody, taskId, done) {
-  return indexBody.split(/\r?\n/).map((line) => {
-    if (!line.includes(taskId) || !line.includes("|")) return line;
-    if (done) return line.replace(/⬜|🔄|⏳|🚫/g, "✅").replace(/\b(ready|in-progress|blocked)\b/gi, "done");
-    return line;
-  }).join("\n");
-}
-
-/**
- * Apply one validated WorkResult to the working tree — the single-writer step (D6): ticks AC
- * boxes, flips task status, appends the Execution Log, propagates unblocks, appends discoveries,
- * writes the verdict ledger + un-ticks refuted boxes.
- *   verdict{criteria[],refuted[]}).
- * @param {{cwd:string}} opts - cwd: working-directory root every LOCAL path resolves against.
- * @returns {{slug:string, tasks_updated:string[], acs_ticked:number, unblocked:string[],
- *   discoveries_appended:number, refuted_unticked:number, verdict_lines:number}} A summary of every write performed.
- * @throws {Error} If a task/board/ledger file it must write is not writable (fs error propagates).
- *   `evaluation/.verdicts-*.jsonl` under `.shapeup/<slug>/`.
- */
-export function applyResult(result, { cwd }) {
-  const slug = result.order_id.split("/")[0];
-  const local = localRoot(cwd, slug);
-  const summary = { slug, tasks_updated: [], acs_ticked: 0, unblocked: [], discoveries_appended: 0, refuted_unticked: 0, verdict_lines: 0 };
-
-  // 1. Task results → task files + board (old task-executor P3.1/P3.2/P3.6).
-  const boardIndex = join(local, "tasks", "_index.md");
-  for (const tr of result.task_results || []) {
-    const path = findTaskFile(cwd, slug, tr.task_id);
-    if (!path) continue;
-    let body = readFileSync(path, "utf8");
-    for (const acr of tr.ac_results || []) {
-      if (acr.result === "pass") {
-        const r = setCheckbox(body, acr.ac, true);
-        body = r.body;
-        if (r.hit) summary.acs_ticked++;
-      }
-    }
-    if (tr.status === "done") {
-      body = setFrontmatter(body, "status", "done");
-      body = setFrontmatter(body, "completed_at", today());
-    } else if (tr.status === "partial" || tr.status === "failed") {
-      body = setFrontmatter(body, "status", "in-progress");
-    }
-    // Execution Log (append; the checkbox list must never disagree with it).
-    const logLines = (tr.ac_results || []).map((a) => `- ${a.ac}: ${a.result}${a.evidence ? ` (${a.evidence})` : ""}`).join("\n");
-    body += `\n\n## Execution Log — ${today()} (${result.order_id})\n- executor: ${result.worker || "task-executor"} via ingest-result\n- status: ${tr.status}\n${logLines}${tr.notes ? `\n- notes: ${tr.notes}` : ""}\n`;
-    writeFileSync(path, body);
-    summary.tasks_updated.push(tr.task_id);
-    if (tr.status === "done" && existsSync(boardIndex)) {
-      writeFileSync(boardIndex, updateBoardRow(readFileSync(boardIndex, "utf8"), tr.task_id, true));
-    }
-  }
-
-  // 2. Unblock propagation (old P3.4): any blocked task whose dependencies are all done → ready.
-  const tasksDir = join(local, "tasks");
-  if (existsSync(tasksDir)) {
-    const files = readdirSync(tasksDir).filter((f) => /^TASK-[\w.-]+\.md$/i.test(f));
-    const statusOf = {};
-    const parsed = files.map((f) => {
-      const body = readFileSync(join(tasksDir, f), "utf8");
-      const id = (body.match(/^id:\s*(TASK-[\w.-]+)/im) || [])[1] || f.replace(/\.md$/, "");
-      const status = (body.match(/^status:\s*(\S+)/im) || [])[1] || "unknown";
-      const deps = (body.match(/^depends_on:\s*\[([^\]]*)\]/im) || [, ""])[1]
-        .split(",").map((s) => s.trim().replace(/^["']|["']$/g, "")).filter(Boolean);
-      statusOf[id] = status;
-      return { f, id, status, deps, body };
-    });
-    for (const t of parsed) {
-      if (t.status === "blocked" && t.deps.length && t.deps.every((d) => statusOf[d] === "done")) {
-        writeFileSync(join(tasksDir, t.f), setFrontmatter(t.body, "status", "ready"));
-        summary.unblocked.push(t.id);
-        if (existsSync(boardIndex)) {
-          const idx = readFileSync(boardIndex, "utf8").split(/\r?\n/).map((line) =>
-            line.includes(t.id) && line.includes("|")
-              ? line.replace(/🚫|⏳/g, "⬜").replace(/\bblocked\b/gi, "ready")
-              : line).join("\n");
-          writeFileSync(boardIndex, idx);
-        }
-      }
-    }
-  }
-
-  // 3. Discoveries → the ledger (old P3.7 / QA H.3). Single writer: this script.
-  if (result.discoveries?.length) {
-    const ledgerDir = join(local, "discovery");
-    mkdirSync(ledgerDir, { recursive: true });
-    const ledger = join(ledgerDir, "ledger.md");
-    if (!existsSync(ledger)) writeFileSync(ledger, `---\nfeature: ${slug}\n---\n# Discovery Ledger — ${slug}\n`);
-    const lines = result.discoveries.map((d) => {
-      const tags = [d.lens ? `[lens:${d.lens}]` : "", d.severity_hint ? `severity-hint: ${d.severity_hint}` : "", d.test_gap ? `test-gap: ${d.test_gap}` : "", d.contradicts ? `contradicts: ${d.contradicts}` : "", d.traces_to?.length ? `traces_to: ${d.traces_to.join(", ")}` : ""].filter(Boolean);
-      return `${d.marker} ${d.lens ? tags[0] + " " : ""}${d.line}${d.repro ? `\n    repro: ${d.repro}` : ""}${tags.slice(d.lens ? 1 : 0).map((t) => `\n    ${t}`).join("")}`;
-    }).join("\n");
-    appendFileSync(ledger, `\n## Discovered — ${result.order_id} (${today()})\n${lines}\n`);
-    summary.discoveries_appended = result.discoveries.length;
-  }
-
-  // 4. Verdict bookkeeping (old evaluator B.0/B.2/B.2b) — judge returns data, ingest writes.
-  if (result.verdict) {
-    const evalDir = join(local, "evaluation");
-    mkdirSync(evalDir, { recursive: true });
-    if (result.verdict.criteria?.length) {
-      const target = result.order_id.split("/")[1] || "run";
-      const ledger = join(evalDir, `.verdicts-${target}.jsonl`);
-      let run = 1;
-      if (existsSync(ledger)) {
-        const prior = readFileSync(ledger, "utf8").trim().split(/\n/).filter(Boolean).map((l) => { try { return JSON.parse(l); } catch { return null; } }).filter(Boolean);
-        run = prior.reduce((mx, r) => Math.max(mx, r.run || 0), 0) + 1;
-      }
-      const lines = result.verdict.criteria.map((c) => JSON.stringify({
-        run, dimension: c.dimension || "spec-conformance", criterion: c.criterion,
-        verdict: c.verdict, confidence: c.confidence, reprobed: !!c.reprobed,
-        evidence: c.evidence || "", at: new Date().toISOString(),
-      })).join("\n");
-      appendFileSync(ledger, lines + "\n");
-      summary.verdict_lines = result.verdict.criteria.length;
-    }
-    for (const ref of result.verdict.refuted || []) {
-      const path = findTaskFile(cwd, slug, ref.task_id);
-      if (!path) continue;
-      let body = readFileSync(path, "utf8");
-      const r = setCheckbox(body, ref.ac, false);
-      if (r.hit) summary.refuted_unticked++;
-      body = setFrontmatter(r.body, "eval_verdict", "fail");
-      body = setFrontmatter(body, "eval_at", today());
-      writeFileSync(path, body);
-    }
-  }
-
-
-
-  return summary;
-}
-
-// ---------------------------------------------------------------------------
-/** The typed argv contract (see `./lib/argv.mjs`). */
-export const ARGV_SPEC = {
-  usage: "ingest-result.mjs <result.json> [--cwd <dir>]",
-  _: { arity: 1, max: 1, name: "result.json" },
-  cwd: { type: "path" },
-};
-
-const isMainModule = isMain(import.meta.url);
-if (isMainModule) {
-  const args = runArgs(ARGV_SPEC);
-  const file = args._[0];
-  const cwd = resolve(args.cwd || process.cwd());
-
-  let result;
-  try { result = JSON.parse(readFileSync(resolve(file), "utf8")); }
-  catch (e) { console.error(`  ✗ result unreadable: ${e.message}`); process.exit(1); }
-
-  const { valid, errors } = validate(result, RESULT_SCHEMA);
-  if (!valid) {
-    console.error("ingest-result: result rejected — a malformed result never mutates the board:");
-    for (const e of errors) console.error(`  ✗ ${e}`);
-    process.exit(1);
-  }
-  const s = applyResult(result, { cwd });
-  console.log(`✅ ingested ${result.order_id} — tasks: [${s.tasks_updated.join(", ")}] · ACs ticked: ${s.acs_ticked} · unblocked: [${s.unblocked.join(", ")}] · discoveries: ${s.discoveries_appended} · verdict lines: ${s.verdict_lines} · refuted un-ticked: ${s.refuted_unticked}`);
-}

package/skills/tech-lead/scripts/lib/is-main.mjs

@@ -1,81 +0,0 @@
-// isMain — "was this module executed directly, or imported?"
-//
-// WHY THIS FILE EXISTS (observed, not theorized).
-//
-// Eighteen of this plugin's scripts and hooks decided whether to do anything at all with:
-//
-//     if (import.meta.url === `file://${process.argv[1]}`) main();
-//
-// That comparison is FALSE — and the whole body silently does nothing, exit 0, no output —
-// whenever the path the process was invoked with is not byte-identical to the resolved module
-// URL. Two extremely common cases make it false:
-//
-//  1. A SYMLINKED DIRECTORY ANYWHERE IN THE PATH. Node resolves `import.meta.url` through
-//     symlinks; `process.argv[1]` is the string as typed. On macOS `/var` is a symlink to
-//     `/private/var`, so EVERY path under the system temp directory mismatches — which is where
-//     an npm-packed install lands (`/var/folders/…/package`). nvm, pnpm's content store,
-//     Homebrew and any symlinked checkout do the same thing on every platform.
-//
-//  2. A SPACE OR OTHER URL-RESERVED CHARACTER IN THE PATH. `import.meta.url` is percent-encoded
-//     (`My%20Plugins`); the template literal is not (`My Plugins`). So a plugin installed under
-//     `~/Library/Application Support/…` or any directory with a space in its name mismatches too.
-//
-// WHAT THAT COSTS. `init-run.mjs` is GATE L0.1 — the orchestrator's mandatory first tool call, the
-// script that writes the run receipt everything else is derived from. Under a `/var` path it
-// exited 0 with empty stdout and wrote no receipt. The orchestrator then cannot distinguish "the
-// run opened" from "nothing happened", and burns its budget on forensics against its own
-// bootstrap — retrying the script several ways, hitting permission refusals trying to capture an
-// exit code, and finally searching the filesystem for its own skill — while the artifact it needs
-// sits on disk the entire time.
-//
-// The same guard sits in seven hooks, including `gate-zerowork`, `safety-spine` and
-// `sandbox-guard`. This project's stated organising idea is that "every invariant that matters
-// lives in the runtime, not in a prompt" — and under a symlinked install the runtime half was
-// inert, while every gate still reported success. A silent no-op is the single worst failure mode
-// an enforcement layer can have, because it is indistinguishable from working.
-//
-// THE FIX. Compare resolved URL to resolved URL, using `pathToFileURL` so encoding matches and
-// `realpathSync` so symlinks match. The structural suite asserts that no file
-// reintroduces the fragile form, and actually executes each entry point through a symlinked
-// directory AND through a directory with a space in its name to prove the guard holds — because
-// this defect was invisible to every test that invoked scripts by their real path.
-
-import { realpathSync } from "node:fs";
-import { pathToFileURL } from "node:url";
-
-/**
- * True when `moduleUrl` belongs to the module Node was asked to execute.
- *
- * Usage, at the bottom of an entry point:
- *
- *     import { isMain } from "./lib/is-main.mjs";
- *     if (isMain(import.meta.url)) main();
- *
- * @param {string} moduleUrl - The caller's `import.meta.url`.
- * @returns {boolean} true if executed directly, false if imported (or if there is no entry point,
- *   e.g. `node --eval`, where nothing should auto-run).
- */
-export function isMain(moduleUrl) {
-  const entry = process.argv[1];
-  if (!entry || !moduleUrl) return false;
-
-  // Cheap path first: correct encoding, no filesystem access. Handles spaces and unicode.
-  let entryUrl;
-  try { entryUrl = pathToFileURL(entry).href; } catch { return false; }
-  if (entryUrl === moduleUrl) return true;
-
-  // Then resolve symlinks on both sides. `import.meta.url` is already realpath-resolved by Node,
-  // but resolving it again is harmless and covers the reverse case (a caller passing an
-  // unresolved URL) rather than assuming Node's behaviour never changes.
-  try {
-    const realEntry = pathToFileURL(realpathSync(entry)).href;
-    if (realEntry === moduleUrl) return true;
-    return realEntry === pathToFileURL(realpathSync(new URL(moduleUrl))).href;
-  } catch {
-    // An unreadable or deleted entry point is not this function's problem to report. Returning
-    // false means "do not auto-run", which is the safe direction for an imported module and is
-    // never the direction that silently skips a gate — a directly-invoked script whose own path
-    // cannot be stat'd has larger problems that will surface immediately.
-    return false;
-  }
-}