shapeup-sdlc 1.7.0 → 3.0.1

package/skills/ba-pitch-analyzer/assets/templates/scope-summary.tmpl.md

@@ -35,14 +35,15 @@ audit_score: 0
 
 The longest sequential chain — minimum time to complete if parallelized optimally.
 
-```
-TASK-NNN → TASK-NNN → TASK-NNN → TASK-NNN
-  Nh          Nh          Nh          Nh
-```
-
-**Critical path estimate:** Nh total
+**Critical path estimate:** Nh total, N steps
 *(All other work can happen in parallel alongside this chain)*
 
+<!-- Record the DERIVED numbers only — total hours and step count, both from
+     `harness reduce board`. The chain's task ids belong to the LOCAL board
+     (.shapeup/<slug>/tasks/), which is gitignored and renumbers per machine; this
+     document is committed, so an id written here dangles on every other clone
+     (spec-lint TIER-DIRECTION). Read the id-level chain off the board itself. -->
+
 ---
 
 ## Package Distribution
@@ -58,12 +59,16 @@ TASK-NNN → TASK-NNN → TASK-NNN → TASK-NNN
 
 ## Parallel Opportunities
 
-Tasks with no interdependency that can run simultaneously:
+How much of the board can run simultaneously — **counts and use cases, never task ids.** This file
+is COMMITTED; the board is not, and its ids renumber per machine (spec-lint TIER-DIRECTION).
+
+| Group | Use cases | Tasks | Can start after |
+|-------|-----------|-------|-----------------|
+| Group A | UC-x, UC-y | N | nothing — no dependency |
+| Group B | UC-z | N | Group A |
 
-| Group | Tasks | Can start after |
-|-------|-------|----------------|
-| Group A | TASK-NNN, TASK-NNN | TASK-NNN completes |
-| Group B | TASK-NNN | TASK-NNN completes |
+The per-scope release order is `scope-board.md`'s, keyed on `scope_id`. Cite it rather than
+restating it here.
 
 ---
 
@@ -94,7 +99,7 @@ Carried from [[_index#Rabbit-Holes]]:
 
 ## Execution Recommendation
 
-<!-- Filled from spec-lint.mjs output -->
+<!-- Filled from harness verify spec output -->
 
 **Audit Score: N/100**
 

package/skills/ba-pitch-analyzer/assets/templates/synthesis.tmpl.md

@@ -166,50 +166,29 @@ Derived from: `_index.md` rabbit holes + `api-feasibility.md` SPIKE blocks + `in
 
 | Cut | At | Reason | Traded for (if any) |
 |-----|-----|-------|---------------------|
-| ~~[cut capability]~~ | GATE-N | appetite overflow — saved for a later bet | TASK-NNN |
+| ~~[cut capability]~~ | GATE-N | appetite overflow — saved for a later bet | [UC or scope it was traded for] |
 
 *A Cut is a healthy shaping signal, not debt. Revisit it at the betting table next cycle.*
 
 ---
 
-## S-03 — Dependency Graph
+## S-03 — Dependency Shape
 
-> Open this section when **Dependency** is 🟡 or 🔴, or when planning parallel work.
+> Open this section when **Dependency** is 🟡 or 🔴.
 
-Derived from: `depends_on` and `unlocks` in every task frontmatter + `estimated_hours`.
+Derived from: `depends_on` in every task frontmatter. **Counts and shape only — no task ids.**
+This document is COMMITTED and the board is not: ids live in the gitignored tier and renumber on
+every regeneration, so an id written here resolves on the machine that wrote it and nowhere else.
+spec-lint reds a `TASK-` id anywhere in the committed tree (TIER-DIRECTION).
 
-### Critical Path
+| Metric | Value |
+|---|---|
+| Critical path | N tasks · NN hours · NN% of total estimated hours |
+| Widest parallel wave | N tasks |
+| Tasks with no dependency | N |
+| Single points of failure (block > 2 downstream) | N |
 
-```
-Critical path: N tasks · NN hours · NN% of total estimated hours
-
-TASK-001 [SPIKE]  spike-[api]-feasibility         2h
-  └─ blocks ──► TASK-004, TASK-005, TASK-006
-TASK-002 [TASK]   shared-schema                   3h  ← parallel (no dependency on 001)
-TASK-003 [TASK]   contract-stub                   2h  ← parallel
-TASK-004 [FEAT]   implement-[repo]               ⏳ blocked by TASK-001   4h
-  └─ blocks ──► TASK-005
-TASK-005 [FEAT]   [use-case]-service             ⏳ blocked by TASK-004   6h
-  └─ blocks ──► TASK-006, TASK-007
-TASK-006 [FEAT]   [feature]-ui                   ⏳ blocked by TASK-005   8h
-TASK-007 [FEAT]   [feature]-ui-edge-cases        ⏳ blocked by TASK-005   4h
-```
-
-### Parallel Opportunities
-
-Tasks at the same dependency depth with no interdependency — can be executed in parallel:
-
-| Wave | Tasks | Total Hours | Can Parallelize |
-|------|-------|-------------|-----------------|
-| Wave 1 (no deps) | TASK-001, TASK-002, TASK-003 | Nh | ✅ yes — 3 agents |
-| Wave 2 (after 001) | TASK-004 | Nh | — single task |
-| Wave 3 (after 004) | TASK-005 | Nh | — single task |
-| Wave 4 (after 005) | TASK-006, TASK-007 | Nh | ✅ yes — 2 agents |
-
-### Single Points of Failure
-
-Tasks whose delay cascades to > 2 downstream tasks:
-
-| Task | Blocks | Cascaded Hours at Risk |
-|------|--------|----------------------|
-| TASK-NNN | TASK-NNN, TASK-NNN, TASK-NNN | Nh |
+**The per-scope build order — which scopes go in which wave, and what each waits on — lives in
+`scope-board.md`, not here.** `scope-architect` writes that board and is the only worker that knows
+the scope ids; it runs after this document, so the ordering cannot be expressed here in a key that
+survives a clone. Cite the board, never restate it.

package/skills/ba-pitch-analyzer/assets/templates/task.tmpl.md

@@ -9,6 +9,9 @@ priority: N
 depends_on: []
 unlocks: []
 use_case_refs: []
+scope_id: ""                     # optional — set ONLY when several scopes share this task's use
+                                 # case and spec-lint SCOPE-PARTITION says the UC anchor cannot
+                                 # decide who builds it. Names a committed scope_id (LOCAL→SHARED).
 entities: []
 repositories: []
 linked_docs: []

package/skills/ba-pitch-analyzer/references/contract-patterns.md

@@ -117,11 +117,15 @@ Every contracts folder must have an `_index.md` registry:
 ```markdown
 # Contract Registry — [feature-slug]
 
-| Repository | Source Type | Service / Engine | Status | SPIKE Task |
-|-----------|------------|-----------------|--------|------------|
-| [[FramerPageRepository]] | third-party-api | Framer REST API | ⚠️ speculative | [[TASK-001]] |
+| Repository | Source Type | Service / Engine | Status | Spike |
+|-----------|------------|-----------------|--------|-------|
+| [[FramerPageRepository]] | third-party-api | Framer REST API | ⚠️ speculative | ⏳ open |
 | [[PageCacheRepository]] | offline-storage | SQLite/Drizzle | ✅ confirmed | — |
 | [[UserSessionRepository]] | be-service | apps/api /auth | ✅ confirmed | — |
+
+The Spike column carries a STATUS, not a task id. The registry is committed; the board is
+not, and its ids renumber on every regeneration — so a task id recorded here resolves on
+the machine that wrote it and nowhere else (spec-lint TIER-DIRECTION).
 ```
 
 This registry is the entry point for the spec-lint structure checks.
@@ -147,6 +151,6 @@ Every implementation task that uses a repository MUST:
 
 3. If contract is still `speculative` at task-generation time:
    ```markdown
-   > ⏳ BLOCKED by [[TASK-001-spike-framer-feasibility]]
+   > ⏳ BLOCKED — spike open, see [[api-feasibility#API-01]]
    > Unblock condition: [[contracts/framer-page.contract.md]] has no remaining ⏳ TBD fields
    ```

package/skills/ba-pitch-analyzer/references/doc-schemas.md

@@ -217,6 +217,8 @@ depends_on: []                   # other TASK IDs: [TASK-001, TASK-002] — the
 unlocks: []                      # DERIVED — inverse of the board's depends_on graph, recomputed
                                  # on every board write; never hand-authored (v3.3)
 use_case_refs: []                # UC IDs this task implements: [UC-CreateOrder]
+scope_id: ""                     # optional disambiguator — the scope that builds this task.
+                                 # Needed only when >1 scope shares a use case (SCOPE-PARTITION).
 entities: []
 repositories: []
 linked_docs: []                  # [[usecase]], [[domain-model#section]]

package/skills/ba-pitch-analyzer/references/task-generation.md

@@ -362,7 +362,7 @@ Slug rules:
 
 **`depends_on` is the single authoritative edge; `unlocks` is derived, never hand-authored.**
 On EVERY board write — analyze, reconcile — recompute (via
-`board-derive.mjs --write`, never by hand) the `unlocks` field of every task on the board as the
+`harness reduce board --write`, never by hand) the `unlocks` field of every task on the board as the
 exact inverse of the full board's `depends_on` graph, then write it. Adding one task that
 declares `depends_on: [TASK-007]` therefore rewrites `TASK-007.unlocks` in the same pass.
 "Write both sides when you remember" allows drift; a derived field cannot drift
@@ -563,7 +563,7 @@ tasks). Scope (Basecamp sense) maps onto a UC; an invariant lives *inside* the U
    task-executor / the tech lead; this mode only surfaces the disagreement.
 9. Regenerate ONLY the derived files: tasks/_index.md, scope-summary.md, synthesis.md
    (+ the unlocks frontmatter recompute from step 7).
-10. Run board-derive.mjs (Appetite Guard arithmetic, below); report overflow as a discovery.
+10. Run harness reduce board (Appetite Guard arithmetic, below); report overflow as a discovery.
 ```
 
 **Appetite Guard (forcing function, not a report):**

package/skills/qa-edge-hunter/SKILL.md

@@ -33,14 +33,17 @@ tech-lead: ... GATE L2 → EVAL → GATE L3 PASS ──► QA EDGE HUNT (you)
 |------|----------|
 | Read EVAL-*.md to map covered territory — then hunt OUTSIDE it | Re-probe anything the evaluator already graded |
 | Charter edges via six fixed lenses, minus covered territory | Author or extend `## Test Surface` (that is the planner's retrofit-surface operation) |
-| Execute charters on the **running app** (session-based exploratory) | Read-only speculate from code ("this looks racy") — every finding needs a live repro |
+| Execute charters against the **running deliverable** (session-based exploratory) | Read-only speculate from code ("this looks racy") — every finding needs a live repro |
 | Return each finding in the WorkResult's `discoveries[]`, **always `~`** | Promote `~` → must-have (PO/TL at SHIP S.0; severity-hint is advice, not a decision) |
 | Emit `qa/hunt-report.md` — charters run/cut, findings by lens | Render a verdict, score, or PASS/FAIL of any kind |
 
 Pure worker (harness rule: stateless workers, one stateful orchestrator). Its WorkOrder
 carries `payload.feature`, `payload.spec_folder`, `payload.eval_report`, `payload.app_url`,
 `payload.kb_rules_path`, and `payload.ledger` (the discovery ledger, READ-ONLY — covered-territory
-context so a hunt does not re-report what is already known); its write surface is
+context so a hunt does not re-report what is already known). **`app_url` is null when the
+deliverable is not served over HTTP** — a CLI, a library, a batch job. That is a normal order, not a
+malformed one: drive the built entry point instead, exactly as the Test Surface's process rows do.
+Do not refuse the hunt, and do not invent a URL. Its write surface is
 `.shapeup/<feature>/qa/**` only. The Hunter never touches the discovery ledger itself —
 ingest appends its `discoveries[]` under a `## Discovered` section, preserving single-writer
 mechanically.
@@ -50,7 +53,8 @@ mechanically.
 ## Workflow
 
 ```
-⏸ GATE Q0 │ Preflight ────► hard: app running? EVAL verdict PASS? ledger exists?
+⏸ GATE Q0 │ Preflight ────► hard: deliverable reachable (one real request at `app_url`, or one
+          │                 real invocation of the entry point when it is null)? EVAL PASS? ledger?
           │                 soft: Test Surface present? absent → DEGRADED MODE offer
 Phase Q1  │ Charter Map ──► 6 lenses × UC tree − covered territory (EVAL-probed rows/AC)
 ⏸ GATE Q1 │ Charter Review► PO/TL hammer the charter list (QA's own appetite is fixed too)

package/skills/scope-architect/SKILL.md

@@ -13,7 +13,7 @@ harness enforces mechanically: the sandbox hook denies writes outside a substrat
 runs the fixtures, the evaluator asserts only against the affordance manifest. This skill is
 the **sole writer** of scope contracts — a distinct authority from the planner (task
 decomposition) and a distinct failure mode (directory-thinking, PA1) deserving its own
-anti-rationalization table.
+the ship report's census table.
 
 ## Input contract — the WorkOrder
 
@@ -21,7 +21,7 @@ anti-rationalization table.
 |---|---|
 | `operation` | `map-scopes` — the only operation this skill has. It covers first slicing after the board exists, folding discovered items in, and re-slicing a stuck scope; the payload says which of those you are doing |
 | `payload.feature` / `payload.spec_folder` | Slug + committed spec (read ux-behavior.md for manifests; usecases for flows) |
-| `payload.tasks[]` | The board's tasks with their touched files — the slicing input |
+| `payload.tasks[]` | The board's tasks with their touched files — the slicing INPUT only. Each carries `use_case_refs`; those UC ids are what you write into the contract. Never copy a task id into a contract |
 | `substrate.allowed` | `scopes/*.md` + `scope-board.md` — your ONLY write surface |
 
 ## Core process
@@ -37,7 +37,23 @@ anti-rationalization table.
            scalars and [a, b] lists, a `## Affordances` table for affordance_manifest, and a
            short `## Why this slice` paragraph. A reviewer must be able to read the substrate
            in a PR; regeneration preserves prose under headings you do not own.
-             scope_id, topology_type, tasks[]                — the stable join key is the scope
+             scope_id, topology_type                         — the stable join key is the scope
+             use_cases[]                                     — the UC ids this scope implements.
+                                                               THE ONLY LINK YOU WRITE TO THE
+                                                               WORK: never task ids. The contract
+                                                               is committed and the board is not,
+                                                               so a TASK-NNN here dangles on
+                                                               every other clone (spec-lint
+                                                               TIER-DIRECTION reds it). The
+                                                               scope's tasks are re-derived from
+                                                               the board's own use_case_refs
+             covers[]                                        — optional REQ-ids from
+                                                               requirements.md this scope answers
+                                                               for; stable, never renumbered
+             depends_on[]                                    — scope_ids this scope builds AFTER.
+                                                               This is the build ORDER — declare
+                                                               it whenever one scope consumes
+                                                               another's output, or the two race
              allowed_file_substrate[]                        — exact globs; the sandbox hook's
                                                                write-whitelist; wrong here =
                                                                a legitimate ESCALATE later
@@ -58,10 +74,23 @@ anti-rationalization table.
              hill_phase: "UPHILL_UNKNOWN"                    — ALWAYS; phase is derived from
                                                                T0/T1/seesaw facts later,
                                                                never authored
-4 LINT     node "${CLAUDE_PLUGIN_ROOT}/skills/ba-pitch-analyzer/scripts/spec-lint.mjs" --slug <slug>
-           → PA1 (directory alignment), PA2 (>~15 files), DISJOINT (undeclared overlap).
+4 LINT     node "${CLAUDE_PLUGIN_ROOT}/kernel/harness.mjs" verify spec --slug <slug>
+           → PA1 (directory alignment), PA2 (>~15 files), DISJOINT (undeclared overlap),
+           SCOPE-ANCHOR (empty/unresolvable use_cases), TIER-DIRECTION (a task id in a
+           committed contract), SCOPE-DEPS (depends_on naming a scope that isn't here).
            Fix reds by re-slicing, not by silencing.
-5 BOARD    regenerate scope-board.md (scope_id, topology, task count, substrate size, lint)
+5 BOARD    regenerate scope-board.md — a VIEW of the contracts, nothing more:
+
+             | scope_id | topology | use_cases | depends_on | files | lint |
+
+           Every column restates a field the contract already declares, so the board can be thrown
+           away and rebuilt. Do NOT add a `wave` column: waves are Kahn levels of `depends_on` and
+           `probe resume` derives them at dispatch — a hand-written copy of a derived value drifts,
+           which is exactly why `unlocks` stopped being authored. The BUILD ORDER lives in each
+           contract's `depends_on`; the board only shows it.
+
+           A `TASK-` id anywhere in a contract or the board — a column, a cell, or a sentence in
+           the prose — is spec-lint TIER-DIRECTION red. The board is committed; ids are not.
 ```
 
 **Folding in a discovered item:** it joins the nearest scope only if the flow matches (extend that
@@ -78,6 +107,9 @@ mark the old one `superseded_by: [ids]` — never delete (branch and T0 history
 | "I'll widen the substrate a little so the doer stops escalating" | A wide substrate is no substrate. Split or add a shared_substrate entry, deliberately. |
 | "This scope looks downhill, I'll set the phase" | hill_phase is UPHILL_UNKNOWN at write, always. Facts move dots, not authors. |
 | "The old contract is superseded, delete it" | supersede-never-delete. History must stay attributable. |
+| "Both scopes implement that UC, the tasks will sort themselves out" | They will not — both scopes get every task of that UC and three of four writes get denied. Give each scope its own use cases, or say so in deviations[] so the board can be stamped. |
+| "I'll list the task ids so the contract says what it builds" | The board is gitignored and renumbers per machine; the contract is committed. Cite the UCs — the tasks are re-derived from them. |
+| "Build order is obvious from the slice, I'll leave depends_on empty" | Nothing infers it any more. An undeclared edge means the two scopes are released into the same wave and race. |
 | "Fixtures can come later, leave the field empty" | Fixture at contract time or an explicit TBD flag — silence is how T0 goes blind. |
 
 ## Output contract — the WorkResult
@@ -98,6 +130,8 @@ territory — and any lint warn left standing, with why). You never touch task f
 ## Verification checklist
 
 - [ ] Every scope crosses layers or is declared CHOWDER; spec-lint PA1 = 0 red
+- [ ] Every scope names ≥1 `use_cases` that resolves on disk, and NO contract carries a task id
+- [ ] Every scope that consumes another's output declares it in `depends_on`
 - [ ] Substrates disjoint except declared shared_substrate (DISJOINT = 0 red)
 - [ ] Every interactive element in scope screens appears in exactly one affordance_manifest
 - [ ] Every scope has fixtures or an explicit TBD flag

package/skills/solution-architect/SKILL.md

@@ -23,7 +23,7 @@ orchestrator's `trace-lint` proves against real code at L1b. Your job is to make
 
 Two payoffs, one artifact:
 - **Reachability becomes checkable later.** Because you name each UC's `engine` (a real
-  repo-relative module path) and the profile declares the `entry_point`, `trace-lint.mjs` can
+  repo-relative module path) and the profile declares the `entry_point`, `harness verify trace` can
   fold this map into its oracle *after the build*: a UC whose engine does not reach the
   `entry_point` via the import graph goes red. You supply the two anchors; the oracle does the
   proving.
@@ -70,8 +70,23 @@ guessed `main.js` would make the later oracle certify nothing.
                                the import graph, it does not parse this field)
              affordance        the player-visible thing this UC exposes once wired (the human
                                end of the chain — what a user can DO, not an internal call)
-3 WRITE    shapeup/<slug>/wiring-map.md (WiringMap): {schema_version:1, feature,
-           entry_point (echo of the profile), entries[]}. One entry per use case. A UC whose
+3 WRITE    shapeup/<slug>/wiring-map.md (WiringMap): frontmatter for schema_version, feature
+           and entry_point (echo of the profile), then entries[] as ONE MARKDOWN TABLE under a
+           `## Wiring` heading — this exact shape, because it is the only one the reader parses:
+
+             ## Wiring
+
+             | use_case | engine | wiring_seam | entry_call_site | affordance |
+             |---|---|---|---|---|
+             | UC-01 | src/parsing.mjs | argv dispatch calls parseEnv | bin/envlint.mjs | envlint <file> |
+
+           One ROW per use case + engine pair — a UC carried by two engines gets two rows, never
+           one cell naming both. `engine` is a bare repo-relative path and nothing else: the
+           oracle resolves that cell against disk, and a cell like "`a.mjs` and `b.mjs` — two pure
+           modules" resolves to no file and is reported unverifiable. Put the explanation in the
+           `## Deviations` prose, never in the cell.
+
+           A UC whose
            engine has no attachment path is exactly the gap this artifact exists to surface —
            write the entry with the seam you INTEND and raise it in deviations[], so
            the build knows the wiring it must close. Your craft ends here: WRITE, then return the
@@ -132,5 +147,5 @@ seam, or an engine with no attachment path, and why). You never touch spec docs,
 # The reachability oracle is the ORCHESTRATOR's, run advisory at L1b — not part of your craft.
 # Standalone, you MAY preview it after writing the map (it self-skips arms whose artifacts are
 # absent, and is near-vacuous pre-build since the engine code does not exist yet):
-#   node "${CLAUDE_PLUGIN_ROOT}/skills/tech-lead/scripts/trace-lint.mjs" --slug checkout-vnpay
+#   node "${CLAUDE_PLUGIN_ROOT}/kernel/harness.mjs" verify trace --slug checkout-vnpay
 ```

package/skills/spec-evaluator/SKILL.md

@@ -97,6 +97,15 @@ Done-when statements; `_index.md` Non-Go list. Which UCs are in scope comes from
   trust a handed hash. A verdict on a scoped spec without a T0 citation is structurally
   invalid, regardless of how convincing your own probing looked; generator prose ("tests
   pass", "verified locally") is never admissible evidence.
+- **When a criterion names a command, run THAT command.** Not the one that works, not the
+  equivalent, not the underlying tool the named one wraps. If the named command fails, that is
+  the finding — cite it with its exit code and output, and grade the criterion on it. Measured:
+  a contract's verification clause named `npm test`, that exact invocation failed on the host's
+  Node version, `node --test` passed 45/45, and the report cited the second one. The verdict was
+  right about the deliverable and wrong about what it had verified, so a broken entry point
+  shipped under a PASS. Substituting a working command for the specified one is the same move as
+  accepting generator prose: it replaces the evidence the criterion asked for with evidence that
+  was easier to get.
 
 ---
 
@@ -107,6 +116,7 @@ Done-when statements; `_index.md` Non-Go list. Which UCs are in scope comes from
 | "The code clearly implements it, no need to run it" | Apps that look right still break when used. Probe the running app. |
 | "It failed, but the feature mostly works" | One FAIL fails the dimension. Thresholds are hard. |
 | "The generator says tests pass" | Generator prose is not evidence. Your probe or the T0 artifact is. |
+| "`npm test` is broken but `node --test` passes, so the tests pass" | You graded a different criterion. Run the command the contract names; if it fails, that IS the finding. |
 | "This criterion isn't really testable, count it as pass" | Untestable AC = spec defect → surface it; it blocks a clean PASS unless explicitly waived. |
 | "The other dimensions are strong, round up" | Halo effect banned. Dimensions never average. |
 | "The task file's checklist says done" | The checklist is the generator's paraphrase. Grade the committed UC text. |
@@ -191,7 +201,7 @@ bug_template). Adding one (e.g. security) = write `references/dimensions/securit
 /spec-evaluator --order .shapeup/checkout-vnpay/orders/evaluate-r2.json
 
 # Standalone — the preamble shim compiles a minimal order, then the single code path runs:
-#   node "${CLAUDE_PLUGIN_ROOT}/skills/tech-lead/scripts/compile-order.mjs" --operation evaluate --slug <slug> \
+#   node "${CLAUDE_PLUGIN_ROOT}/kernel/harness.mjs" compile --operation evaluate --slug <slug> \
 #        --worker spec-evaluator [--payload '{"dimensions": [...], "run_cmd": "..."}']
 /spec-evaluator --spec shapeup/checkout-vnpay/spec/ --task TASK-007
 /spec-evaluator --spec shapeup/checkout-vnpay/spec/ --feature checkout-vnpay --single-pass
@@ -199,7 +209,7 @@ bug_template). Adding one (e.g. security) = write `references/dimensions/securit
 
 Standalone keeps `--task` (per-task check, not round-gated) and `--single-pass` (feature-level)
 — the shim maps them onto the order's payload; missing run command → ask. After writing the
-WorkResult, run `node "${CLAUDE_PLUGIN_ROOT}/skills/tech-lead/scripts/ingest-result.mjs" <result path>` and show its
+WorkResult, run `node "${CLAUDE_PLUGIN_ROOT}/kernel/harness.mjs" reduce ingest <result path>` and show its
 summary — standalone has no orchestrator to ingest for you.
 
 ---

package/skills/task-executor/SKILL.md

@@ -30,7 +30,8 @@ rely on (anything absent = **unknown**; never invent it):
 | `payload.verify.test_cmd` | The command that verifies your work. No test_cmd → command-verifiable ACs still need *some* observable check; say what you used |
 | `payload.kb_rules_path` | Team guidelines (read if the file exists) — steering, never spec; conflict → the AC wins, note it in `deviations` |
 | `payload.constraints` | Non-Go items and freezes (e.g. `ui_layers.layer3_frozen`) |
-| `operation` | `execute` (fresh), `fix` (only the bugs in `payload.bugs` — touch nothing else), `spike` (produce a decision doc, not code) |
+| `payload.bugs[]` | The previous round's FAIL verdict, addressed to files inside YOUR substrate: `{severity, criterion, location, repro, expected, actual}`. Fix exactly these and touch nothing else. They are spec-conformance defects, so verification is ALREADY green and will stay green whether or not you fix them — a passing `test_cmd` is not evidence you are done this round, and re-running it cannot tell you. Read the cited lines against the committed spec instead. An entry marked `unowned` cites a file no scope owns: fix it only if it falls inside your substrate. Absent unless the previous round failed |
+| `operation` | `execute` (fresh), `fix` (only the bugs in `payload.bugs` — touch nothing else), `spike` (produce a decision doc, not code). A build round whose predecessor returned FAIL arrives as `fix` with the same substrate as the `execute` that preceded it |
 
 **Zero-memory rule.** You have no memory of prior attempts or sessions. Decisions that
 mattered are in `payload.decisions`; errors that mattered are in `payload.digested_errors`.
@@ -168,7 +169,7 @@ self-planned: no new task files, no spec edits — one raw line per discovery.
 
 You do NOT: tick AC boxes, edit `tasks/_index.md`, write `run-state.md`, touch the discovery
 ledger, mark anything done outside your result, or update any other spec document. The
-orchestrator's `ingest-result.mjs` does all of that from your envelope.
+orchestrator's `harness reduce ingest` does all of that from your envelope.
 
 ---
 
@@ -193,15 +194,15 @@ orchestrator's `ingest-result.mjs` does all of that from your envelope.
 
 # Standalone — the preamble shim compiles a minimal WorkOrder from the flags, then the
 # single code path above runs. Requires the harness scripts (plugin install):
-#   node "${CLAUDE_PLUGIN_ROOT}/skills/tech-lead/scripts/compile-order.mjs" --task TASK-003 --slug checkout-vnpay
-#   node "${CLAUDE_PLUGIN_ROOT}/skills/tech-lead/scripts/compile-order.mjs" --next --slug checkout-vnpay
+#   node "${CLAUDE_PLUGIN_ROOT}/kernel/harness.mjs" compile --task TASK-003 --slug checkout-vnpay
+#   node "${CLAUDE_PLUGIN_ROOT}/kernel/harness.mjs" compile --next --slug checkout-vnpay
 /task-executor --spec shapeup/checkout-vnpay/spec/ --task TASK-003
 /task-executor --spec shapeup/checkout-vnpay/spec/ --next
 ```
 
 Standalone shim: derive `<slug>` from the `--spec` path (`shapeup/<slug>/spec`),
-run `compile-order.mjs` with the matching flags (mode becomes `standalone`), then proceed
+run `harness compile` with the matching flags (mode becomes `standalone`), then proceed
 against the compiled order exactly as if dispatched. After writing the WorkResult, run
-`node "${CLAUDE_PLUGIN_ROOT}/skills/tech-lead/scripts/ingest-result.mjs" <result path>` yourself and show the user its
+`node "${CLAUDE_PLUGIN_ROOT}/kernel/harness.mjs" reduce ingest <result path>` yourself and show the user its
 summary — standalone has no orchestrator to ingest for you. One code path inside; two entry
 points outside.

package/skills/tech-lead/SKILL.md

@@ -12,7 +12,7 @@ call is narration, and a narrated run is a failed run — it reads like a clean
 escaped defects behind it. `hooks/gate-zerowork.mjs` (Stop) blocks a session
 that **reached the orchestrator and left no receipt** — where "reached the orchestrator" means
 dispatching this skill or launching a `shapeup-*` workflow by either surface, and the receipt is
-what `init-run.mjs` writes. Working around the harness is not an exemption: a busy session used to
+what `harness init run` writes. Working around the harness is not an exemption: a busy session used to
 switch this gate off and no longer does. Loading these instructions is not running them.
 
 **Step 1 — open the run.** Write the requirement to a file first, then pass the path — a
@@ -20,12 +20,19 @@ multi-line requirement inlined into a shell argument is where this step goes wro
 turns fighting shell quoting):
 
 ```bash
-node "${CLAUDE_PLUGIN_ROOT}/skills/tech-lead/scripts/init-run.mjs" \
+node "${CLAUDE_PLUGIN_ROOT}/kernel/harness.mjs" init run \
   --slug <slug-from-the-request> --intake-file <path/to/the/requirement.md> \
   --auto-level <interactive|auto|unattended> \
   [--dimensions <a,b>] [--gate-answers <ci|guarded|path.json>] [--wall-clock-budget <seconds>] [--max-rounds 3]
 ```
 
+**After a compaction, or in a fresh session over an open run, re-derive before you act.** One
+command answers where the run stands, from artifacts and never from memory:
+
+```bash
+node "${CLAUDE_PLUGIN_ROOT}/kernel/harness.mjs" reduce graph --slug <slug> --subgraph run
+```
+
 **Exit 3 means a run is ALREADY OPEN.** Resume it; do not re-open it. The refusal prints the
 derived RESUME STATE (slug, status, round, board counts) — read it and go straight to Step 2;
 `shapeup-run.js`'s own fast-forward will re-derive exactly where to continue from disk, never from
@@ -45,58 +52,62 @@ translates itself.
 **Step 2 — pin GATE L0, then launch.** Collect the L0.1–L0.9 config (spec folder, lens, stack,
 eval dims, max_rounds, the model/budget matrix — see `references/gates.md` GATE L0 for the full
 collect-list), write the SHARED `project-profile.md` yourself (`{schema_version:1, archetype,
-entry_point}` — the only artifact this skill writes directly; `shapeup-run.js` has no filesystem
-of its own), emit the `⏸ GATE L0` block, then check the lane:
+entry_point}` — `shapeup-run.js` has no filesystem of its own), emit the `⏸ GATE L0` block, then
+check the lane:
 
 - **`--tiny`, or the spec has no committed `scopes/*.md` yet** (pre-v0.3.0 spec): `shapeup-run.js`
   is out of scope for this lane by design (it targets scope-contract specs). Run the unchanged
-  legacy loop instead — `references/round-protocol.md` (BUILD(r)/EVAL) + `references/delegation.md`
+  legacy loop instead — `references/protocol.md` (BUILD(r)/EVAL) + `references/protocol.md`
   carry the full step-by-step for both the tiny lane and a scope-less BUILD loop, verbatim, non-
   regression. Stop reading this file here for that run.
-- **Otherwise** (the common case — a scoped spec, any auto level): write `RunArgs`
-  (`domain.schema.json` `$defs/RunArgs` — `{slug, autoLevel, answers, models:{exec,eval,qa},
-  budgets:{maxRounds,attemptBudget,wallClockS}, pluginRoot, startedAt}`) to
-  `.shapeup/<slug>/run-args.json`, then launch it as a **background** Bash call:
+- **Otherwise** (the common case — a scoped spec, any auto level): build `RunArgs`
+  (`domain.schema.json` `$defs/RunArgs` — `{slug, runId, autoLevel, answers, lane,
+  models:{exec,eval,qa}, budgets:{maxRounds,attemptBudget,wallClockS}, pluginRoot, startedAt}`,
+  plus every switch the operator typed — `references/gates.md` GATE L0.9 has the flag→field table,
+  and a flag that stops here is a flag that was accepted and ignored). **Write that exact object to
+  `.shapeup/<slug>/run-args.json` before launching**, fresh on every launch and relaunch: the flags
+  reach the workflow as a value in memory, so it is the run's only evidence of what it was launched
+  with, and a run that cannot state its own configuration cannot have a claim about it checked.
+  Then launch the run script with the **`Workflow` tool**:
 
-```bash
-node "${CLAUDE_PLUGIN_ROOT}/skills/tech-lead/scripts/run-workflow.mjs" \
-  "${CLAUDE_PLUGIN_ROOT}/skills/tech-lead/workflows/shapeup-run.js" \
-  --args-file .shapeup/<slug>/run-args.json --run-dir .shapeup/<slug>/workflow-run
+```
+Workflow({
+  scriptPath: "${CLAUDE_PLUGIN_ROOT}/skills/tech-lead/workflows/shapeup-run.js",
+  args: <the RunArgs object>
+})
 ```
 
 `shapeup-run.js` (`domain.schema.json` `$defs/RunArgs`/`RunReturn`) owns everything from ORIENT
-through GATE H and ship-report — every gate inside that range resolves via `gate-answers.mjs`'s
-exit code, in code, not by this skill's own reading of a paragraph. The `RunReturn` arrives as
-`result` in `.shapeup/<slug>/workflow-run/result.json`, and on stdout.
-
-**Background, and by Bash — both are load-bearing.** A real run outlives any foreground tool-call
-ceiling. And **do not launch this with the `Workflow` tool** unless the project has explicitly
-granted it: that call is denied by default in a headless session — the lane then executes zero
-times while the session improvises the feature by hand — and the only grant that unblocks it is
-the unscoped token `"Workflow"`, which permits *every*
-dynamic workflow script in the project. `run-workflow.mjs` runs the same script under the
-path-scoped grant `npx shapeup-sdlc init` already writes. Headless runs also need
-`CLAUDE_CODE_PRINT_BG_WAIT_CEILING_MS=0`, or the wait is cut at 600 s and a truncated run is
-reported as a clean one. If the launch comes back "requires approval", stop
-and say so — do not hand-build the feature instead.
+through GATE H and the ship report — every gate inside that range resolves via `harness gate`'s
+exit code, in code, not by this skill's own reading of a paragraph. The `RunReturn` is the script's
+return value, and it arrives as the workflow's result.
+
+**Why the tool and not a Bash launcher.** The native runtime is what gives the run
+resume-from-journal, worktree isolation, and sub-agents that share this session's prompt cache
+instead of paying a cold start each. `npx shapeup-sdlc init` writes the `"Workflow"` grant the
+launch needs. That grant is UNSCOPED — it authorises every dynamic workflow script in the project,
+not only this one — so an install may decline it with `--no-native-workflow`, in which case the
+launch prompts for approval once per session and the unattended lane is unavailable. If the launch
+comes back "requires approval" in a headless session, stop and say so — do not hand-build the
+feature instead.
 
 ## Step 3 — the pause protocol: branch on `RunReturn.status`
 
 | `status` | What the workflow is telling you | What you do |
 |---|---|---|
-| `paused` | A gate resolved "ask" — `paused_at` names it, `block` is composed and ready | Emit `block` **verbatim** (never re-summarise it — that is the paraphrase channel this design exists to close). Put it to the PO, get a decision. Write it to `.shapeup/<slug>/gate-answers.json` (`{"version":1,"preset":"custom","answers":{"<paused_at>":{"decision":"<answer>"}}}`, merging with any prior gate's answer already there). **Relaunch the SAME command, same `--args-file`** — the fast-forward re-derives from disk and re-dispatches nothing already done (verify: `orders/` minus `results/` is empty before it proceeds) |
-| `aborted` | A gate resolved "abort", or a hard stop (spec-lint red, scope-hammer CANNOT SHIP) | Report `aborted_at` + `reason` to the PO. Do not relaunch without a human decision — `--force` on `init-run.mjs` if truly restarting |
+| `paused` | A gate resolved "ask" — `paused_at` names it, `block` is composed and ready | Emit `block` **verbatim** (never re-summarise it — that is the paraphrase channel this design exists to close). Put it to the PO, get a decision. Write it to `.shapeup/<slug>/gate-answers.json` (`{"version":1,"preset":"custom","answers":{"<paused_at>":{"decision":"<answer>"}}}`, merging with any prior gate's answer already there). **Relaunch the SAME `Workflow` call, same `args`** — the fast-forward re-derives from disk and re-dispatches nothing already done (verify: `orders/` minus `results/` is empty before it proceeds) |
+| `aborted` | A gate resolved "abort", or a hard stop (spec-lint red, scope-hammer CANNOT SHIP) | Report `aborted_at` + `reason` to the PO. Do not relaunch without a human decision — `--force` on `harness init run` if truly restarting |
 | `gate_h` | A circuit breaker tripped (`breaker`: outer \| inner \| deadline) — `green_scopes` shipped nothing, `hammer_proposals` needs a census | Dispatch a fresh Agent (model: exec): `Skill(shapeup-sdlc-plugin:scope-hammer) --slug <slug> --breaker <breaker> [--scope <id>]` for the census + cut list, put the PO's decision to `references/gates.md` GATE H, then close out via Step 4 below |
 | `shipped` | The board's final round passed EVAL, QA ran, GATE H accepted the cut list, `report` names the frozen `shapeup/<slug>/REPORT.md` | Go straight to Step 4 |
 
 **Never** treat a `paused` return as a stall to work around, and never invent an answer this skill
 did not actually receive from the PO — an unattended lane with no answer for a gate is meant to
-`abort` (see `gate-answers.mjs`'s `on_missing`), not silently proceed.
+`abort` (see `harness gate`'s `on_missing`), not silently proceed.
 
 ## Step 4 — GATE L4 — Ship Sign-Off (this skill's own gate; the workflow never sees it)
 
 FIRST freeze the evidence — run state is gitignored, so `shapeup/<slug>/REPORT.md` (already
-written by `shapeup-run.js` via `ship-report.mjs`, or write it now on a `gate_h` close) is all a
+written by `shapeup-run.js` via `harness reduce ship`, or write it now on a `gate_h` close) is all a
 teammate sees. Then emit:
 
 ```
@@ -119,18 +130,19 @@ never orients, plans, builds, or judges itself — `shapeup-run.js` **sequences*
 and returns to the PO at every gate.
 
 > **Gate collect-lists + output-block formats** → `references/gates.md`
-> **How each sub-skill is invoked + handoff files (the envelope port)** → `references/delegation.md`
-> **The round loop, stop conditions, three-level breaker rationale** → `references/round-protocol.md`
-> **Run ledger format + Hill report** → `references/ledger-schema.md`
-> **State ownership, the central domain registry, two-ledger split** → `references/state-model.md`
-> **Hard rules this design enforces, and why** → `references/hard-rules.md`
-> **Full invocation examples + the complete flag table** → `references/invocation.md`
+> **How each sub-skill is invoked + handoff files (the envelope port)** → `references/protocol.md`
+> **The round loop, stop conditions, three-level breaker rationale** → `references/protocol.md`
+> **Run ledger format + Hill report** → `references/protocol.md` (Part 4 — State)
+> **State ownership, the central domain registry, two-ledger split** → `references/protocol.md` (Part 4 — State)
+> **Hard rules this design enforces, and why** → `references/protocol.md`
+> **Full invocation examples + the complete flag table** →
 > **The small-change lane (`--tiny`)** → `references/tiny-lane.md`
 
 ## Invocation
 
 `/tech-lead --pitch <shaping.md> --spec <spec/> --lens standard` for an interactive run; `--auto`
 (pause only at L1a/L1b/L3/L4), `--unattended` (headless/CI), `--from build` (resume), `--no-eval`/
-`--no-qa` to skip passes. **`--tiny`** stays a prose-only lane (`references/tiny-lane.md`) —
+`--no-qa` to skip passes, `--parallel-scopes N` to set how many scopes build at once (default 4,
+`1` = sequential), `--adversarial-verify` to refute each FAIL finding before it costs a fix round. **`--tiny`** stays a prose-only lane (`references/tiny-lane.md`) —
 `shapeup-run.js` targets specs with committed scope contracts; a tiny change or a pre-scope-
 contract spec runs the unchanged v0.2.6 flow this file's Hard Rules already describe.