shapeup-sdlc 1.7.0 → 3.0.1

package/skills/tech-lead/schemas/domain.schema.json

@@ -4,13 +4,56 @@
   "description": "The CENTRAL domain registry of the pure-skill architecture. Every shared field that crosses a skill boundary is defined here exactly once, with its meaning, owner, and storage tier annotated — work-order.schema.json and work-result.schema.json $ref into $defs below instead of re-defining records inline, and no skill may introduce a cross-boundary field that is not registered here first. Annotation keys: x-tier = SHARED (committed under shapeup/, survives clone+crash) | LOCAL (gitignored under .shapeup/, regenerable run-trace) | EMBEDDED (a record type that only lives inside another entity); x-location = the canonical path; x-writer = the single component allowed to write it; x-readers = who consumes it. The x-erd block is the machine-readable entity-relationship map; x-payload-by-worker is the authoritative table of which WorkOrder payload fields each worker may rely on.",
   "x-erd": {
     "description": "Relationship map. Cardinality reads left-to-right (WorkOrder 1:1 WorkResult = every order has exactly one result). Join keys: <slug> (the feature) is the aggregate root every path is keyed off; scope_id is the STABLE cross-machine key (boards regenerate; hill shards, T0 history and branches join on it); TASK-NNN ids are machine-local and must never be joined across machines (board regeneration joins on scope, not task id).",
+    "external": {
+      "WorkOrder": "work-order.schema.json",
+      "WorkResult": "work-result.schema.json"
+    },
+    "projection": {
+      "description": "How `kernel/reduce/graph.mjs`'s node vocabulary maps onto this catalog. The projection uses short names on purpose — a graph is read by hand — so the mapping is declared rather than inferred. A `type` of null is a KNOWN GAP: the projection emits that node and this schema has never typed it. The structural suite asserts this map is TOTAL against the node types the projection actually emits, so a new node type cannot appear without either a type or an explicit gap.",
+      "nodes": {
+        "Run": {
+          "type": null,
+          "gap": "the run receipt's own record — emitted by reduce graph, never typed here"
+        },
+        "Order": {
+          "type": "WorkOrder",
+          "external": true
+        },
+        "Result": {
+          "type": "WorkResult",
+          "external": true
+        },
+        "Verdict": {
+          "type": "Verdict"
+        },
+        "Trial": {
+          "type": "TrialRow"
+        },
+        "GateDecision": {
+          "type": null,
+          "gap": "a gate decision row — emitted by reduce graph, never typed here"
+        },
+        "Scope": {
+          "type": "ScopeContract"
+        },
+        "UseCase": {
+          "type": "UseCase"
+        },
+        "Requirement": {
+          "type": "RequirementClause"
+        },
+        "Seam": {
+          "type": "Seam"
+        }
+      }
+    },
     "relationships": [
       {
         "from": "WorkOrder",
         "to": "WorkResult",
         "cardinality": "1:1",
         "via": "order_id",
-        "note": "the envelope port — compile-order.mjs emits, worker answers, ingest-result.mjs applies"
+        "note": "the envelope port — harness compile emits, worker answers, harness reduce ingest applies"
       },
       {
         "from": "WorkOrder",
@@ -28,28 +71,35 @@
       },
       {
         "from": "TaskRef",
-        "to": "UseCase (SHARED spec doc)",
+        "to": "UseCase",
         "cardinality": "N:1..N",
         "via": "use_case_refs[]",
         "note": "the LOCAL→SHARED traceability anchor (single-anchor rule on reconcile) — spec-evaluator's traceability source. Tier direction: persisted links flow LOCAL→SHARED only; a committed spec doc never references a machine-local task id back (spec-lint TIER-DIRECTION/UC-ANCHOR)"
       },
       {
-        "from": "AcResult (LOCAL board AC)",
-        "to": "RequirementClause (SHARED registry)",
+        "from": "AcResult",
+        "to": "RequirementClause",
         "cardinality": "N:0..N",
         "via": "acceptance_criteria[].covers[]",
         "note": "the covers-closure anchor — same sanctioned LOCAL→SHARED direction as use_case_refs. trace-lint asserts every status:covered REQ-id is named by ≥1 AC's covers[]; a REQ neither covered nor CUT is red. REQ-ids are stable cross-machine keys (supersede-never-delete), never renumbered like TASK-NNN"
       },
       {
-        "from": "CriterionVerdict / Discovery",
-        "to": "RequirementClause (SHARED registry)",
+        "from": "CriterionVerdict",
+        "to": "RequirementClause",
+        "cardinality": "N:0..N",
+        "via": "traces_to[]",
+        "note": "optional finding→REQ back-link (LOCAL→SHARED) so an edge case maps to a business requirement by id, not by grepping the ledger; the lint only checks the id resolves in the registry — purely a navigation anchor split from a compound ERD node; CriterionVerdict carries its own traces_to[]"
+      },
+      {
+        "from": "Discovery",
+        "to": "RequirementClause",
         "cardinality": "N:0..N",
         "via": "traces_to[]",
-        "note": "optional finding→REQ back-link (LOCAL→SHARED) so an edge case maps to a business requirement by id, not by grepping the ledger; the lint only checks the id resolves in the registry — purely a navigation anchor"
+        "note": "optional finding→REQ back-link (LOCAL→SHARED) so an edge case maps to a business requirement by id, not by grepping the ledger; the lint only checks the id resolves in the registry — purely a navigation anchor split from a compound ERD node; Discovery carries its own traces_to[]"
       },
       {
         "from": "WiringMap",
-        "to": "UseCase (SHARED spec doc)",
+        "to": "UseCase",
         "cardinality": "1:N",
         "via": "entries[].use_case",
         "note": "reachability map: per UC engine → wiring seam → entry-point call site → player-visible affordance. trace-lint asserts each UC's engine reaches ProjectProfile.entry_point via the import graph; an unreachable engine (0 import sites) is red"
@@ -89,7 +139,7 @@
       },
       {
         "from": "TaskResult",
-        "to": "Task (LOCAL board file)",
+        "to": "TaskRef",
         "cardinality": "N:1",
         "via": "task_id",
         "note": "ingest ticks AC boxes, flips frontmatter status, appends the Execution Log"
@@ -136,11 +186,33 @@
         "via": "path + sha256",
         "note": "content-addressed evidence the generator cannot fabricate"
       },
+      {
+        "from": "ScopeContract",
+        "to": "UseCase",
+        "cardinality": "1:N",
+        "via": "use_cases[]",
+        "note": "the scope's anchor into the committed spec — the SCOPE-ANCHOR mirror of a task's use_case_refs"
+      },
       {
         "from": "ScopeContract",
         "to": "TaskRef",
         "cardinality": "1:N",
-        "via": "tasks[] (scope_id is the stable key)"
+        "via": "DERIVED — the board tasks whose use_case_refs meet this scope's use_cases (lib/contract.mjs tasksForScope)",
+        "note": "never stored: task ids are machine-local and the contract is committed, so the relation is re-derived per machine from two artifacts that are each valid alone. scope_id is the stable key on this side"
+      },
+      {
+        "from": "ScopeContract",
+        "to": "RequirementClause",
+        "cardinality": "1:N",
+        "via": "covers[]",
+        "note": "REQ-ids, the same stable key an AC's covers: clause uses"
+      },
+      {
+        "from": "ScopeContract",
+        "to": "ScopeContract",
+        "cardinality": "N:N",
+        "via": "depends_on[]",
+        "note": "build order, in the same tier as the contracts it orders — what scope_waves/scope_deps level"
       },
       {
         "from": "ScopeContract",
@@ -217,6 +289,13 @@
         "cardinality": "1:N",
         "via": "scopes[].scope_id",
         "note": "every FINISHED scope's fixtures re-run on each later attempt"
+      },
+      {
+        "from": "UseCase",
+        "to": "Seam",
+        "cardinality": "1:N",
+        "via": "wiring-map entries[].wiring_seam",
+        "note": "projected by reduce graph as UseCase -DEPENDS_ON-> Seam. NOTE: the projection reads `row.seam`/`row.entry_point` while WiringEntry declares `wiring_seam`/`entry_call_site` — see harness-defects"
       }
     ]
   },
@@ -398,7 +477,7 @@
     "Substrate": {
       "description": "The write contract of one order — mode/flag differences ARE write-contract differences (one whitelist template per operation, compile-order substrateFor()). Enforced mechanically by the sandbox hook; a worker needing a file outside it must ESCALATE (substrate-expansion), never write.",
       "x-tier": "EMBEDDED",
-      "x-writer": "compile-order.mjs (templates) / scope-architect (per-scope globs)",
+      "x-writer": "harness compile (templates) / scope-architect (per-scope globs)",
       "type": "object",
       "properties": {
         "allowed": {
@@ -449,7 +528,7 @@
     "TaskRef": {
       "description": "One task as carried inside a WorkOrder — parsed from the LOCAL board file (.shapeup/<slug>/tasks/TASK-*.md frontmatter + AC checkboxes) by compile-order parseTaskFile(). NOTE: task ids are machine-local (boards regenerate and renumber); never join on id across machines — the scope is the stable key.",
       "x-tier": "EMBEDDED",
-      "x-writer": "compile-order.mjs (from the board ba-pitch-analyzer generated)",
+      "x-writer": "harness compile (from the board ba-pitch-analyzer generated)",
       "type": "object",
       "required": [
         "id"
@@ -510,7 +589,7 @@
           "items": {
             "type": "string"
           },
-          "description": "Explicit dependencies. The inverse (unlocks) is ALWAYS derived by board-derive.mjs, never hand-authored — hand-authored inverses drift asymmetric, observed repeatedly."
+          "description": "Explicit dependencies. The inverse (unlocks) is ALWAYS derived by harness reduce board, never hand-authored — hand-authored inverses drift asymmetric, observed repeatedly."
         },
         "use_case_refs": {
           "type": "array",
@@ -518,6 +597,10 @@
             "type": "string"
           },
           "description": "UC ids this task implements (e.g. UC-CreateOrder) — the task's LOCAL→SHARED anchor into the committed spec and spec-evaluator's traceability source. Links flow one direction: the LOCAL task cites the SHARED UC; a committed doc never links a task id back (ids are machine-local)."
+        },
+        "scope_id": {
+          "type": "string",
+          "description": "OPTIONAL: the scope that builds this task. The DISAMBIGUATOR, not the primary link — dispatch normally derives a scope's tasks by intersecting the contract's use_cases[] with this task's use_case_refs[], and that is a partition only while each scope owns its own use cases. When several scopes implement one use case (a four-scope, one-UC cut is ordinary) the UC anchor cannot say who builds what and every scope claims every task; spec-lint SCOPE-PARTITION reds that, and this field resolves it. Same sanctioned LOCAL→SHARED direction as use_case_refs: the volatile board names the stable scope_id, never the reverse."
         }
       }
     },
@@ -543,17 +626,24 @@
       }
     },
     "AegisTriple": {
-      "description": "One digested failure — aegis-digest.mjs distills raw build/test/Playwright logs into these so the next attempt gets a few lines of signal instead of a stack-trace dump. Appears as T0Artifact.discovered_tasks[] (red attempts) and as WorkOrder payload.digested_errors[] (the next attempt's starting bug list).",
+      "description": "One digested failure — harness probe digest distills raw build/test/Playwright logs into these so the next attempt gets a few lines of signal instead of a stack-trace dump. Appears as T0Artifact.discovered_tasks[] (red attempts) and as WorkOrder payload.digested_errors[] (the next attempt's starting bug list).",
       "x-tier": "EMBEDDED",
-      "x-writer": "aegis-digest.mjs (regex pass; Sonnet fallback only on unrecognized formats)",
+      "x-writer": "harness probe digest (regex pass; Sonnet fallback only on unrecognized formats)",
       "type": "object",
       "properties": {
         "file": {
-          "type": "string",
+          "type": [
+            "string",
+            "null"
+          ],
           "description": "Source file of the failure; null/absent when the log line carried no location (raw triple — never invented)."
         },
         "line": {
-          "type": "integer"
+          "type": [
+            "integer",
+            "null"
+          ],
+          "description": "Line of the failure; null/absent when the log line carried no location. Paired with `file` — a triple has both or neither, and neither is ever invented to satisfy a shape."
         },
         "core_message": {
           "type": "string",
@@ -622,12 +712,40 @@
         }
       }
     },
+    "UseCase": {
+      "description": "One use case — the STABLE anchor both tiers name, and the only identifier the scope↔task relation is re-derived through. A UC id is assigned once and frozen: it behaves like scope_id and REQ-id, never like TASK-NNN. Referenced three ways across the tree (`UC-x`, `[[UC-x]]`, `[[usecases/UC-x]]`); `kernel/lib/contract.mjs` ucId() is the single normaliser, and both sides of any join must pass through it or they disagree about a UC they both hold.",
+      "x-tier": "SHARED",
+      "x-location": "shapeup/<slug>/spec/usecases/UC-*.md",
+      "x-writer": "ba-pitch-analyzer (operation: analyze; reconcile MAY append, never renumber)",
+      "x-readers": "scope-architect (use_cases[]), solution-architect (wiring-map entries), spec-evaluator (the grading criterion), harness verify spec (SCOPE-ANCHOR + UC-ANCHOR), harness reduce graph",
+      "type": "object",
+      "required": [
+        "id"
+      ],
+      "properties": {
+        "id": {
+          "type": "string",
+          "description": "`UC-*`, matching the filename stem. Frozen once assigned — every use_cases[] and use_case_refs[] link rots if it is renumbered."
+        },
+        "title": {
+          "type": "string",
+          "description": "What the user can do."
+        },
+        "invariants": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "`[INV-NN]` markers declared in the body; the source of regression tasks and Test Surface rows."
+        }
+      }
+    },
     "ScopeContract": {
-      "description": "A vertical scope as a committed, mechanically enforceable contract — Shape Up's 'map the scopes' as data. Sliced by business flow (one call chain: UI screen + API route + use case + repository), NEVER by directory (PA1). The sandbox hook enforces the substrate, t0-verify runs the fixtures, the evaluator asserts against the manifest. Superseded contracts are kept, never deleted (branch and T0 history stay attributable). ON-DISK FORMAT IS MARKDOWN (ADR-0001): frontmatter carries the scalars and [a, b] lists, a markdown table carries the one array-of-objects field, and prose carries the rationale a reviewer reads. THIS SCHEMA DESCRIBES THE PARSED OBJECT — the wire form embedded in the WorkOrder envelope — not the file. `skills/tech-lead/scripts/lib/contract-md.mjs` is the only reader/writer of the file form; everything downstream of that parse sees exactly this shape.",
+      "description": "A vertical scope as a committed, mechanically enforceable contract — Shape Up's 'map the scopes' as data. Sliced by business flow (one call chain: UI screen + API route + use case + repository), NEVER by directory (PA1). The sandbox hook enforces the substrate, t0-verify runs the fixtures, the evaluator asserts against the manifest. Superseded contracts are kept, never deleted (branch and T0 history stay attributable). ON-DISK FORMAT IS MARKDOWN (ADR-0001): frontmatter carries the scalars and [a, b] lists, a markdown table carries the one array-of-objects field, and prose carries the rationale a reviewer reads. THIS SCHEMA DESCRIBES THE PARSED OBJECT — the wire form embedded in the WorkOrder envelope — not the file. `kernel/lib/contract.mjs` is the only reader/writer of the file form; everything downstream of that parse sees exactly this shape.",
       "x-tier": "SHARED",
       "x-location": "shapeup/<slug>/scopes/<scope-id>.md",
       "x-writer": "scope-architect (SOLE writer — a hand-edit anywhere else is a defect)",
-      "x-readers": "compile-order.mjs, sandbox-guard hook, t0-verify.mjs, spec-lint.mjs, spec-evaluator, scope-hammer, tech-lead",
+      "x-readers": "harness compile, sandbox-guard hook, harness verify t0, harness verify spec, spec-evaluator, scope-hammer, tech-lead",
       "type": "object",
       "required": [
         "scope_id"
@@ -646,12 +764,26 @@
           ],
           "description": "LAYER_CAKE = thin balanced UI+backend · ICEBERG = complexity on one side · CHOWDER = true strays with no shared flow (the one deliberate exception to cross-layer slicing)."
         },
-        "tasks": {
+        "use_cases": {
           "type": "array",
           "items": {
             "type": "string"
           },
-          "description": "Task ids this scope names (machine-local ids; the scope↔task grouping is re-derived on regeneration)."
+          "description": "The COMMITTED use cases this scope implements (`UC-*`, resolving to spec/usecases/UC-*.md) — the scope's anchor into the spec and the join the scope↔task relation is re-derived through. Mirrors the board's own `use_case_refs` in the sanctioned LOCAL→SHARED direction. This REPLACES the former `tasks[]` id list: a contract is committed and a board is not, so naming task ids put a pointer into a gitignored, per-machine tier that resolved to nothing on every other clone without a single check going red. spec-lint SCOPE-ANCHOR reds an empty or unresolvable anchor."
+        },
+        "covers": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "Optional REQ-ids from requirements.md this scope answers for — the same stable, never-renumbered key an AC's `covers:` clause uses. Projected as the Scope→Requirement COVERS edge in the run graph."
+        },
+        "depends_on": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "scope_ids this scope must build AFTER. Build order lives in the same tier as the contracts it orders: this was previously derived from the LOCAL board (contract tasks → task depends_on → owning scope), which collapsed to no edges whenever the board was absent and silently degraded the scheduler to an unscheduled fan-out. An id naming a scope not in the run is dropped by the scheduler (fail-open) and reported by spec-lint SCOPE-DEPS."
         },
         "allowed_file_substrate": {
           "type": "array",
@@ -679,7 +811,7 @@
           "items": {
             "type": "string"
           },
-          "description": "Command(s) that drive this scope end-to-end (the T0 layer). Too speculative to fixture → an explicit TBD flag, never an invented fixture."
+          "description": "Command(s) that drive this scope end-to-end (the T0 layer). EACH MUST EXIT 0 WHEN THE SCOPE IS CORRECT — `harness verify t0` scores a fixture as failed on any non-zero exit, so a fixture written as a bare error-path invocation (`todo done abc  # exit 1`) can never pass and the scope can never go T0-green however correct the code is. Assert error paths INSIDE a test file that itself exits 0 (`node --test test/commands/done.test.js`), which is what the expected non-zero exit belongs in. Too speculative to fixture → an explicit TBD flag, never an invented fixture."
         },
         "db_probe": {
           "type": "string",
@@ -708,6 +840,23 @@
         }
       }
     },
+    "ScopeBoard": {
+      "description": "The scope board — a HUMAN-READABLE PROJECTION of the contracts, not a source. Every column restates something `scopes/*.md` already declares, so it can be regenerated from them and deleting it loses nothing. It deliberately carries no `wave` column: waves are Kahn levels of `depends_on` and `probe resume` derives them, and a hand-authored copy of a derived value is the same defect as the hand-authored `unlocks` that `deriveUnlocks` exists to prevent. Nothing parses this file — that is only safe while it stays a view; the moment it holds a fact of its own it needs a reader and a lint like every other contract.",
+      "x-tier": "SHARED",
+      "x-location": "shapeup/<slug>/scope-board.md",
+      "x-writer": "scope-architect (regenerated whenever the contracts change)",
+      "x-readers": "humans, in a pull request. No code reads it — by design.",
+      "type": "object",
+      "properties": {
+        "rows": {
+          "type": "array",
+          "description": "One row per scope: scope_id · topology_type · use_cases · depends_on · substrate size · lint status. All projected from the contract.",
+          "items": {
+            "type": "object"
+          }
+        }
+      }
+    },
     "AcResult": {
       "description": "One acceptance criterion's outcome with evidence. 'ac' carries the checkbox text VERBATIM — ingest ticks boxes by substring-matching it. No recorded evidence = the worker reports fail by its own hand.",
       "x-tier": "EMBEDDED",
@@ -796,7 +945,7 @@
       "description": "The universal currency of surprise: one raw discovered line. Producers: task-executor (marker +, P3.7), qa-edge-hunter (always ~, repro required), ba-pitch-analyzer (overflow reports). NO producer writes the ledger — ingest-result appends every entry to discovery/ledger.md (single-writer, mechanically). Promotion ~ → must-have is always a human act at SHIP S.0/GATE H.",
       "x-tier": "EMBEDDED (projection into the LOCAL discovery ledger)",
       "x-location": ".shapeup/<slug>/discovery/ledger.md",
-      "x-writer": "ingest-result.mjs",
+      "x-writer": "harness reduce ingest",
       "x-readers": "ba-pitch-analyzer (reconcile), scope-architect (map-scopes), scope-hammer (census), qa-edge-hunter (covered-territory context)",
       "type": "object",
       "required": [
@@ -1073,11 +1222,11 @@
       }
     },
     "T0Artifact": {
-      "description": "The mechanical verification verdict for one build attempt — the evidence layer under the LLM judge. Written by t0-verify.mjs from actually running the scope's fixtures + DB probe + seesaw; zero LLM tokens. spec-evaluator must cite it (sha256) on scoped specs. Red artifacts carry AEGIS triples that become the next attempt's digested_errors.",
+      "description": "The mechanical verification verdict for one build attempt — the evidence layer under the LLM judge. Written by harness verify t0 from actually running the scope's fixtures + DB probe + seesaw; zero LLM tokens. spec-evaluator must cite it (sha256) on scoped specs. Red artifacts carry AEGIS triples that become the next attempt's digested_errors.",
       "x-tier": "LOCAL",
       "x-location": ".shapeup/<slug>/t0/verdicts/r<N>-a<M>-t<T>.json (schema_version 2; the unsuffixed r<N>-a<M>.json of schema_version 1 is still readable)",
-      "x-writer": "t0-verify.mjs",
-      "x-readers": "compile-order.mjs (next attempt), spec-evaluator (citation), tech-lead (hill derivation, GATE L2.3), scope-hammer (stall census)",
+      "x-writer": "harness verify t0",
+      "x-readers": "harness compile (next attempt), spec-evaluator (citation), tech-lead (hill derivation, GATE L2.3), scope-hammer (stall census)",
       "type": "object",
       "properties": {
         "schema_version": {
@@ -1097,6 +1246,11 @@
           "type": "integer",
           "description": "schema_version 2+: the retry ordinal within (round, attempt). Written with flag 'wx', so a retry of the SAME attempt lands beside its predecessor instead of destroying it (invariant I4)."
         },
+        "run_id": {
+          "type": "string",
+          "description": "OPTIONAL (v1.8) — the run key (mintRunId in lib/paths.mjs). (round, attempt, trial) addresses an artifact within a run and repeats in the next one, so the evidence layer needed this to be groupable by run.",
+          "pattern": "^[a-z0-9][a-z0-9-]*-[0-9]{8}T[0-9]{6}Z-[0-9a-f]{8}$"
+        },
         "at": {
           "type": "string",
           "description": "ISO timestamp."
@@ -1192,8 +1346,8 @@
       "description": "One row per T0 run — the ratchet's history, and the artifact that makes 'is attempt N+1 better than attempt N?' answerable. Append-only (I4: every superseded object remains addressable). baseline_trial is the parent link: that single field IS the experiment DAG (lineage, PARENT_OF, and a genuine SUPERSEDES edge) delivered without a graph store. Written by t0-verify, NOT ingest-result: a trial row is a mechanical fact produced by running commands, in the same class as the verdict artifact t0-verify already owns, and carries no worker claim to apply.",
       "x-tier": "LOCAL",
       "x-location": ".shapeup/<slug>/t0/trials.jsonl",
-      "x-writer": "t0-verify.mjs (append-only)",
-      "x-readers": "compile-order.mjs (payload.trial_history — the paper's inspect()), stats.mjs --ratchet (improvement_rate, monotone_rate, sawtooth_count)",
+      "x-writer": "harness verify t0 (append-only)",
+      "x-readers": "harness compile (payload.trial_history — the paper's inspect()), harness probe stats --ratchet (improvement_rate, monotone_rate, sawtooth_count)",
       "type": "object",
       "properties": {
         "schema_version": {
@@ -1207,6 +1361,11 @@
           "minimum": 1,
           "description": "Monotone ordinal across the run's whole ledger — what baseline_trial points at."
         },
+        "run_id": {
+          "type": "string",
+          "description": "OPTIONAL (v1.8) — the run key (mintRunId in lib/paths.mjs), read off the receipt in the run root t0-verify was pointed at. `trial` is monotone WITHIN a run and restarts at 1 in the next one, so ratchet history could not be split by run without it.",
+          "pattern": "^[a-z0-9][a-z0-9-]*-[0-9]{8}T[0-9]{6}Z-[0-9a-f]{8}$"
+        },
         "round": {
           "type": "integer"
         },
@@ -1280,7 +1439,7 @@
       "x-tier": "LOCAL",
       "x-location": ".shapeup/<slug>/seesaw/registry.json",
       "x-writer": "tech-lead (when a scope reaches FINISHED)",
-      "x-readers": "t0-verify.mjs",
+      "x-readers": "harness verify t0",
       "type": "object",
       "properties": {
         "scopes": {
@@ -1306,8 +1465,8 @@
       "description": "One appended line of judge history (JSONL). Never rewritten — flips across runs are detected here and force confidence low. run auto-increments per append batch.",
       "x-tier": "LOCAL",
       "x-location": ".shapeup/<slug>/evaluation/.verdicts-<target>.jsonl",
-      "x-writer": "ingest-result.mjs (from Verdict.criteria[])",
-      "x-readers": "spec-evaluator (read-only flip detection), verdict-ledger.mjs",
+      "x-writer": "harness reduce ingest (from Verdict.criteria[])",
+      "x-readers": "spec-evaluator (read-only flip detection), harness reduce verdict",
       "type": "object",
       "properties": {
         "run": {
@@ -1369,10 +1528,10 @@
     },
     "MetricsRow": {
       "description": "One SHIP-time harvest row (facts only — copied from structured output that already exists; never a newly computed verdict/score, which would be a second judge behind spec-evaluator). Sharded per machine so concurrent runs never merge-conflict.",
-      "x-tier": "SHARED",
+      "x-tier": "LOCAL",
       "x-location": ".shapeup/metrics/<machine-id>.jsonl",
       "x-writer": "tech-lead (SHIP S.6)",
-      "x-readers": "tier-3 e2e tooling, stats.mjs (read-only projection)",
+      "x-readers": "harness probe stats (read-only projection), harness report export (the run dimension)",
       "type": "object",
       "properties": {
         "schema_version": {
@@ -1383,7 +1542,12 @@
         },
         "at": {
           "type": "string",
-          "description": "OPTIONAL (v1.2) — ISO harvest timestamp; enables real trend-over-time in stats.mjs. Older rows lack it and fall back to shard append order."
+          "description": "OPTIONAL (v1.2) — ISO harvest timestamp; enables real trend-over-time in harness probe stats. Older rows lack it and fall back to shard append order."
+        },
+        "run_id": {
+          "type": "string",
+          "description": "OPTIONAL (v1.8) — the run key (mintRunId in lib/paths.mjs), COPIED from the receipt at SHIP S.6. This is the harvest row's only link to the run trace that produced it: everything else here is a count, and `feature_slug` groups runs together rather than apart.",
+          "pattern": "^[a-z0-9][a-z0-9-]*-[0-9]{8}T[0-9]{6}Z-[0-9a-f]{8}$"
         },
         "feature_slug": {
           "type": "string"
@@ -1411,7 +1575,7 @@
         },
         "attempt_exhaustions": {
           "type": "integer",
-          "description": "OPTIONAL (v1.2) — scopes whose inner attempt_budget tripped this run, COPIED at SHIP S.6 from the queued GATE H hammer proposals (a fact registered at the source; stats.mjs must never re-derive it)."
+          "description": "OPTIONAL (v1.2) — scopes whose inner attempt_budget tripped this run, COPIED at SHIP S.6 from the queued GATE H hammer proposals (a fact registered at the source; harness probe stats must never re-derive it)."
         },
         "qa_findings": {
           "type": "object",
@@ -1433,7 +1597,7 @@
         },
         "ratchet": {
           "type": "object",
-          "description": "OPTIONAL (v1.5) — the DAY-1 exit measurement, COPIED from `stats.mjs --ratchet` over this run's t0/trials.jsonl before the LOCAL trace is wiped. This is the only place the ratchet numbers survive the run, and the only reason they can be compared across machines: `.shapeup/` is gitignored, so a measurement left there answers the question exactly once and then deletes itself. Facts only — every field is a count or a ratio over recorded trial rows, never a grade.",
+          "description": "OPTIONAL (v1.5) — the DAY-1 exit measurement, COPIED from `harness probe stats --ratchet` over this run's t0/trials.jsonl before the LOCAL trace is wiped. This is the only place the ratchet numbers survive the run, and the only reason they can be compared across machines: `.shapeup/` is gitignored, so a measurement left there answers the question exactly once and then deletes itself. Facts only — every field is a count or a ratio over recorded trial rows, never a grade.",
           "properties": {
             "trials": {
               "type": "integer"
@@ -1464,7 +1628,7 @@
         },
         "hooks": {
           "type": "object",
-          "description": "OPTIONAL (v1.5) — the DAY-2 exit measurement, COPIED from `stats.mjs --hooks` over .shapeup/decisions.jsonl. Makes 'never had to fire' and 'never ran' separable across runs: before the decision ledger both produced exit 0 and empty stdout, which is why several enforcement tools were unscoreable.",
+          "description": "OPTIONAL (v1.5) — the DAY-2 exit measurement, COPIED from `harness probe stats --hooks` over .shapeup/decisions.jsonl. Makes 'never had to fire' and 'never ran' separable across runs: before the decision ledger both produced exit 0 and empty stdout, which is why several enforcement tools were unscoreable.",
           "properties": {
             "evaluations": {
               "type": "integer"
@@ -1544,11 +1708,11 @@
       }
     },
     "RunSnapshot": {
-      "description": "Mechanical mid-run state digest, derived ONLY from files (active-scope pointer, harness-run.md frontmatter, board frontmatter, t0/verdicts filenames, orders/ vs results/) — never from conversation memory. The compaction-resilience reflex: persisted by the PreCompact hook as an audit anchor, re-derived fresh and injected as additionalContext by the SessionStart(startup|compact|resume|clear) hook so the orchestrator re-reads the files instead of trusting a lossy summary — or, on a cold startup, instead of re-opening a run that is already open.",
+      "description": "Mechanical mid-run state digest, derived ONLY from files (active-scope pointer, harness-run.md frontmatter, board frontmatter, t0/verdicts filenames, orders/ vs results/) — never from conversation memory. The continuity reflex: after any context loss the orchestrator re-derives this from disk rather than trusting a lossy summary — or, on a cold startup, rather than re-opening a run that is already open.",
       "x-tier": "LOCAL",
-      "x-location": ".shapeup/<slug>/run-snapshot.json (persisted by the compact-snapshot hook; also emitted ephemerally on stdout by run-snapshot.mjs)",
-      "x-writer": "run-snapshot.mjs --write (invoked by the PreCompact hook — never a worker; this is LOCAL derived cache, ingest-result.mjs remains the sole writer of SHARED state)",
-      "x-readers": "session-rehydrate hook, tech-lead (--from resume aid), human",
+      "x-location": ".shapeup/<slug>/run-snapshot.json (written by harness reduce snapshot --write; also emitted ephemerally on stdout by harness reduce snapshot)",
+      "x-writer": "harness reduce snapshot --write (never a worker; this is LOCAL derived cache, harness reduce ingest remains the sole writer of SHARED state)",
+      "x-readers": "tech-lead (--from resume aid), human",
       "type": "object",
       "required": [
         "schema_version",
@@ -1653,14 +1817,14 @@
         },
         "rehydrate_hint": {
           "type": "string",
-          "description": "The composed one-paragraph instruction injected after compaction: re-read run-state, trust the files, not the summary."
+          "description": "The composed one-paragraph instruction for resuming after a context loss: re-read run-state, trust the files, not the summary."
         }
       }
     },
     "StatsReport": {
       "description": "The telemetry read-plane's output — an aggregate projection over the MetricsRow shards. Aggregates COPIED facts only (counts, rates, trends over already-recorded fields); it never grades, so it can never become a second judge. Malformed rows are skipped fail-open and counted; pathology rows (sandbox-guard/safety-spine denials share the shards) are partitioned, not errors.",
       "x-tier": "EMBEDDED (ephemeral projection — printed to stdout, never persisted; the metrics JSONL stays the only source of truth)",
-      "x-writer": "stats.mjs (read-only over metrics/ — writes nothing)",
+      "x-writer": "harness probe stats (read-only over metrics/ — writes nothing)",
       "x-readers": "human / CLI / CI",
       "type": "object",
       "required": [
@@ -1806,7 +1970,7 @@
       }
     },
     "Lane": {
-      "description": "The run's lane (full|tiny), computed by fit-check.mjs at GATE L0.3 and recorded in harness-run.md frontmatter `lane:` (with its evidence, and marked overridden when --lane/--tiny outranks the recommendation); RunArgs.lane carries it to the workflow launch. The lane is pipeline knowledge: the orchestrator compiles it away into existing registered knobs (lens, budgets, gate policy) — it NEVER rides in WorkOrderPayload, so workers stay pipeline-blind.",
+      "description": "The run's lane (full|tiny), computed by harness init fit at GATE L0.3 and recorded in harness-run.md frontmatter `lane:` (with its evidence, and marked overridden when --lane/--tiny outranks the recommendation); RunArgs.lane carries it to the workflow launch. The lane is pipeline knowledge: the orchestrator compiles it away into existing registered knobs (lens, budgets, gate policy) — it NEVER rides in WorkOrderPayload, so workers stay pipeline-blind.",
       "x-tier": "EMBEDDED (recorded in harness-run.md frontmatter `lane:` — never a WorkOrderPayload field)",
       "x-writer": "tech-lead (GATE L0 lane selection)",
       "x-readers": "tech-lead only",
@@ -1857,7 +2021,7 @@
       "x-tier": "SHARED",
       "x-location": "shapeup/<slug>/requirements.md",
       "x-writer": "ba-pitch-analyzer (operation: coverage) — extraction only; CUT status is a PO governance edit (same class as a round-ledger Decision)",
-      "x-readers": "trace-lint.mjs (covers-closure oracle), tech-lead, human (coverage/cut audit)",
+      "x-readers": "harness verify trace (covers-closure oracle), tech-lead, human (coverage/cut audit)",
       "type": "object",
       "required": [
         "id",
@@ -1923,12 +2087,32 @@
         }
       }
     },
+    "Seam": {
+      "description": "How one use case's engine attaches to the entry point — the `wiring_seam` value of a WiringEntry, promoted to a first-class node by `reduce graph` so a verdict can be traced back through the seam to the objective. Not a file: it exists only as a cell in the committed wiring map and as a node in the derived run graph.",
+      "x-tier": "EMBEDDED (a WiringEntry.wiring_seam value; promoted to a node by reduce graph)",
+      "x-writer": "solution-architect (operation: wire), inside wiring-map.md",
+      "type": "object",
+      "properties": {
+        "seam": {
+          "type": "string",
+          "description": "The attachment mechanism — a route registration, an event handler, a direct call from the composition root."
+        },
+        "engine": {
+          "type": "string",
+          "description": "The repo-relative module the seam attaches."
+        },
+        "entry_point": {
+          "type": "string",
+          "description": "The call site the seam reaches from."
+        }
+      }
+    },
     "WiringMap": {
-      "description": "The reachability map — per UC, the chain from engine to a player-visible affordance (spine v1.3). Written DIRECTLY by solution-architect at gate L1a.5 (precedent: ScopeContract is written directly by scope-architect, bypassing ingest-result). Its purpose: no engine ships orphaned from the running application. trace-lint folds reachability into its covers-closure pass — a UC whose engine does not reach ProjectProfile.entry_point via the import graph is red. A Mermaid view is auto-rendered from this map (a view of a checked graph, so it cannot drift). ON-DISK FORMAT IS MARKDOWN (ADR-0001): frontmatter carries the scalars and [a, b] lists, a markdown table carries the one array-of-objects field, and prose carries the rationale a reviewer reads. THIS SCHEMA DESCRIBES THE PARSED OBJECT — the wire form embedded in the WorkOrder envelope — not the file. `skills/tech-lead/scripts/lib/contract-md.mjs` is the only reader/writer of the file form; everything downstream of that parse sees exactly this shape.",
+      "description": "The reachability map — per UC, the chain from engine to a player-visible affordance (spine v1.3). Written DIRECTLY by solution-architect at gate L1a.5 (precedent: ScopeContract is written directly by scope-architect, bypassing ingest-result). Its purpose: no engine ships orphaned from the running application. trace-lint folds reachability into its covers-closure pass — a UC whose engine does not reach ProjectProfile.entry_point via the import graph is red. A Mermaid view is auto-rendered from this map (a view of a checked graph, so it cannot drift). ON-DISK FORMAT IS MARKDOWN (ADR-0001): frontmatter carries the scalars and [a, b] lists, a markdown table carries the one array-of-objects field, and prose carries the rationale a reviewer reads. THIS SCHEMA DESCRIBES THE PARSED OBJECT — the wire form embedded in the WorkOrder envelope — not the file. `kernel/lib/contract.mjs` is the only reader/writer of the file form; everything downstream of that parse sees exactly this shape.",
       "x-tier": "SHARED",
       "x-location": "shapeup/<slug>/wiring-map.md",
       "x-writer": "solution-architect (SOLE writer, direct — like scope-architect writes scopes/*.md)",
-      "x-readers": "trace-lint.mjs (reachability oracle), scope-architect (integration seam at slicing time), tech-lead",
+      "x-readers": "harness verify trace (reachability oracle), scope-architect (integration seam at slicing time), tech-lead",
       "type": "object",
       "required": [
         "schema_version",
@@ -1959,11 +2143,11 @@
       }
     },
     "ProjectProfile": {
-      "description": "The archetype + entry-point declaration reachability depends on (spine v1.3). Exists for ONE load-bearing reason: reachability must know the entry point, and that is archetype-specific (main.js for a client-only game is not the seam for a web-service). SHARED — a declaration that must survive `rm -rf .shapeup/` + clone cannot live in the gitignored run-trace. Role-gating (skip SysRS/Auth/CI-CD) is explicitly OUT of scope — those roles are not workers; the profile is introduced only as the entry-point/archetype declaration. ON-DISK FORMAT IS MARKDOWN (ADR-0001): frontmatter carries the scalars and [a, b] lists, a markdown table carries the one array-of-objects field, and prose carries the rationale a reviewer reads. THIS SCHEMA DESCRIBES THE PARSED OBJECT — the wire form embedded in the WorkOrder envelope — not the file. `skills/tech-lead/scripts/lib/contract-md.mjs` is the only reader/writer of the file form; everything downstream of that parse sees exactly this shape.",
+      "description": "The archetype + entry-point declaration reachability depends on (spine v1.3). Exists for ONE load-bearing reason: reachability must know the entry point, and that is archetype-specific (main.js for a client-only game is not the seam for a web-service). SHARED — a declaration that must survive `rm -rf .shapeup/` + clone cannot live in the gitignored run-trace. Role-gating (skip SysRS/Auth/CI-CD) is explicitly OUT of scope — those roles are not workers; the profile is introduced only as the entry-point/archetype declaration. ON-DISK FORMAT IS MARKDOWN (ADR-0001): frontmatter carries the scalars and [a, b] lists, a markdown table carries the one array-of-objects field, and prose carries the rationale a reviewer reads. THIS SCHEMA DESCRIBES THE PARSED OBJECT — the wire form embedded in the WorkOrder envelope — not the file. `kernel/lib/contract.mjs` is the only reader/writer of the file form; everything downstream of that parse sees exactly this shape.",
       "x-tier": "SHARED",
       "x-location": "shapeup/<slug>/project-profile.md",
-      "x-writer": "tech-lead (GATE L0 — not compile-order.mjs, which stays pipeline-blind)",
-      "x-readers": "trace-lint.mjs (reachability entry_point), solution-architect (wire), tech-lead",
+      "x-writer": "tech-lead (GATE L0 — not harness compile, which stays pipeline-blind)",
+      "x-readers": "harness verify trace (reachability entry_point), solution-architect (wire), tech-lead",
       "type": "object",
       "required": [
         "schema_version",
@@ -2050,7 +2234,7 @@
         },
         "bugs": {
           "type": "array",
-          "description": "task-executor (operation: fix): the EVAL report's bug entries for this task — touch nothing else."
+          "description": "The previous round's FAIL verdict, addressed to the scope whose substrate contains each cited file — touch nothing else. Written by `harness compile` from results/evaluate-r<N-1>.json, never by a caller: a build order is addressed by scope/round/attempt and carries no caller payload, and the verdict must survive the relaunch that separates two rounds. Present on any r≥2 execute order whose predecessor failed; an entry matching no scope's substrate is marked `unowned` and sent to all of them rather than dropped."
         },
         "spec_folder": {
           "type": "string",
@@ -2129,8 +2313,11 @@
           "description": "qa-edge-hunter: the PASS EVAL report — negative-space input; its covered territory is subtracted from charters."
         },
         "app_url": {
-          "type": "string",
-          "description": "qa-edge-hunter: the running app to hunt (one real request at Q0, not a ping)."
+          "type": [
+            "string",
+            "null"
+          ],
+          "description": "qa-edge-hunter: the running app to hunt (one real request at Q0, not a ping). NULL for a deliverable that is not served over HTTP — a CLI, a library, a batch job — where Q0 drives the binary instead. It was a bare string, so the first genuinely non-UI run could not compile a QA order at all: the payload carries null, the order fails its own schema, and the hunt is skipped for a reason that looks nothing like 'this deliverable has no URL'."
         },
         "ledger": {
           "type": "string",
@@ -2170,10 +2357,10 @@
       }
     },
     "ResumeState": {
-      "description": "The fast-forward derivation: which phase a launch resumes at, derived from artifacts on disk and NEVER from stored state or conversation memory. Produced by skills/tech-lead/scripts/resume-state.mjs on stdout and consumed by shapeup-run.js's preamble on every launch, fresh or relaunch alike. Every phase predicate is an artifact test — `has_orient_artifacts` exists because the ORIENT branch was once gated on the ledger's stored `status` instead, which a silent courier failure left stale, and a completed ORIENT phase was re-dispatched on resume. `next_phase` is a convenience derived from the same booleans, which all travel too: a caller is never forced to trust a summary it cannot re-derive.",
+      "description": "The fast-forward derivation: which phase a launch resumes at, derived from artifacts on disk and NEVER from stored state or conversation memory. Produced by kernel/probe/resume.mjs on stdout and consumed by shapeup-run.js's preamble on every launch, fresh or relaunch alike. Every phase predicate is an artifact test — `has_orient_artifacts` exists because the ORIENT branch was once gated on the ledger's stored `status` instead, which a silent courier failure left stale, and a completed ORIENT phase was re-dispatched on resume. `next_phase` is a convenience derived from the same booleans, which all travel too: a caller is never forced to trust a summary it cannot re-derive.",
       "x-tier": "EMBEDDED",
-      "x-location": "stdout of resume-state.mjs — never written to disk (the run's state IS the artifacts this record reports on)",
-      "x-writer": "resume-state.mjs (deriving; the same script's --set-status / --set-active-scope operations write, and report their own outcome record instead)",
+      "x-location": "stdout of harness probe resume — never written to disk (the run's state IS the artifacts this record reports on)",
+      "x-writer": "harness probe resume (deriving; the same script's --set-status / --set-active-scope operations write, and report their own outcome record instead)",
       "x-readers": "shapeup-run.js (the fast-forward preamble, one call per launch)",
       "type": "object",
       "required": [
@@ -2204,7 +2391,46 @@
             "string",
             "null"
           ],
-          "description": "The ledger's stored status, reported for the readers that legitimately hold a MID_RUN set over it (run-snapshot.mjs, hooks/anti-rationalization.mjs). NOT a resume predicate: no phase decision in shapeup-run.js may branch on this field."
+          "description": "The ledger's stored status, reported for the readers that legitimately hold a MID_RUN set over it (harness reduce snapshot, and the ship report's census). NOT a resume predicate: no phase decision in shapeup-run.js may branch on this field."
+        },
+        "lens": {
+          "type": [
+            "string",
+            "null"
+          ],
+          "description": "From harness-run.md frontmatter; forwarded to the analyze dispatch. Null when the ledger names none — an unknown value is an ABSENT key in the order, never a null."
+        },
+        "stack": {
+          "type": [
+            "string",
+            "null"
+          ],
+          "description": "From harness-run.md frontmatter; forwarded to the orient dispatch. Null when the ledger names none."
+        },
+        "run_cmd": {
+          "type": [
+            "string",
+            "null"
+          ],
+          "description": "How to run the feature, from harness-run.md frontmatter; forwarded to the evaluate dispatch so the judge exercises a running thing. Null when the ledger names none."
+        },
+        "app_url": {
+          "type": [
+            "string",
+            "null"
+          ],
+          "description": "Where the feature answers, from harness-run.md frontmatter; forwarded to the QA hunt. Null when the ledger names none."
+        },
+        "eval_dimensions": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "The dimensions this run's EVAL grades, from harness-run.md frontmatter. Defaults to [\"spec-conformance\"] rather than empty, so a ledger that names none still produces a graded run — and the ship sign-off reports the complement as the dimensions the run did NOT cover."
+        },
+        "orient_dir": {
+          "type": "string",
+          "description": "The run's LOCAL orient directory, resolved for the analyze dispatch: ORIENT's spike and code-surface notes are working artifacts, not deliverables, so they live in the gitignored tier (ADR-0001)."
         },
         "has_orient_artifacts": {
           "type": "boolean",
@@ -2227,7 +2453,7 @@
         },
         "scope_files": {
           "type": "array",
-          "description": "MAP SCOPES finished when non-empty. Each entry carries a RESOLVED path, never a bare filename — compile-order.mjs and t0-verify.mjs resolve --scope against cwd, and a bare id makes compile-order exit 2, which the attempt loop reads as the stagnation breaker.",
+          "description": "MAP SCOPES finished when non-empty. Each entry carries a RESOLVED path, never a bare filename — harness compile and harness verify t0 resolve --scope against cwd, and a bare id makes compile-order exit 2, which the attempt loop reads as the stagnation breaker.",
           "items": {
             "type": "object",
             "required": [
@@ -2244,12 +2470,42 @@
             }
           }
         },
+        "scope_waves": {
+          "type": "array",
+          "description": "The same scopes as scope_files, grouped into dependency WAVES: no wave contains a scope that depends on one still in flight. Levelled by `probe resume` from each contract's own `depends_on` — declared in the same COMMITTED tier as the contracts it orders, so it survives the clone that a join through machine-local task ids never could. Under the edge-released scheduler this is an ORDER and a cross-check rather than a barrier: the orchestrator trusts `scope_deps` only when Kahn-levelling it reproduces this field, so an edge lost crossing the sub-agent boundary degrades to wave release instead of starting a scope early. ADDITIVE: a consumer that ignores it, or a tree where no contract declares `depends_on`, every declared id names a scope not in the run, or the relation is cyclic, gets a single wave containing everything, which is the unscheduled fixed-width fan-out this replaced.",
+          "items": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          }
+        },
+        "scope_deps": {
+          "type": "array",
+          "description": "The dependency edges the waves were levelled from, as `[dependant, dependency]` pairs, so a scope can be released the moment ITS OWN dependencies are green rather than when its whole wave finishes. Same parse as scope_waves; the two validate each other. ADDITIVE — absent, unusable or disagreeing with scope_waves, release falls back to the wave boundary.",
+          "items": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          }
+        },
+        "scope_exclusions": {
+          "type": "array",
+          "description": "Pairs of scopes that may not build AT THE SAME TIME because both declare a write to one path — `substrate.shared` is the sanctioned escape from the disjointness rule, so the lint passes it and the substrate wall permits that path to every live order. Measured: three concurrent writers to one entry point lost work in 20 of 20 trials, because an edit is read-modify-write and the later writer drops the earlier one silently. Unlike scope_deps these pairs are UNORDERED — neither scope waits for the other, they merely never overlap — and unlike a dependency they cost concurrency rather than buying correctness in sequence, which is why the release ceiling they imply is reported before a run spends anything.",
+          "items": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          }
+        },
         "pending_orders": {
           "type": "array",
           "items": {
             "type": "string"
           },
-          "description": "Order files with no result beside them. Diagnostic only — build orders carry no scope id, so this set is not an audit trail of build dispatches (see compile-order.mjs's order-id note)."
+          "description": "Order files with no result beside them. Diagnostic only — build orders carry no scope id, so this set is not an audit trail of build dispatches (see harness compile's order-id note)."
         },
         "eval_rounds_done": {
           "type": "array",
@@ -2267,12 +2523,12 @@
             "map-scopes",
             "build"
           ],
-          "description": "The first phase whose artifacts are incomplete. Derived from the booleans above, in that order. The same table (resume-state.mjs PHASE_ARTIFACT) answers `--require <phase>`, the post-condition shapeup-run.js checks after every phase dispatch — resume and completion are ONE predicate by construction."
+          "description": "The first phase whose artifacts are incomplete. Derived from the booleans above, in that order. The same table (harness probe resume PHASE_ARTIFACT) answers `--require <phase>`, the post-condition shapeup-run.js checks after every phase dispatch — resume and completion are ONE predicate by construction."
         }
       }
     },
     "RunArgs": {
-      "description": "C1 — the launch half of the workflow's only conversation. Compiled ONCE by tech-lead at GATE L0 from init-run.mjs output + the L0.8 model matrix + budgets, written to .shapeup/<slug>/run-args.json and handed to the run-workflow.mjs launch as one JSON literal — the workflow cannot ask follow-ups and cannot read config files itself, so everything a run will ever need travels in this one record. A workflow script validates its own subset of this shape in code (no runtime schema check at the C1 boundary itself); this entry is the central-registry definition the workflow script and the tech-lead skill both read as the one true shape.",
+      "description": "C1 — the launch half of the workflow's only conversation. Compiled ONCE by tech-lead at GATE L0 from harness init run output + the L0.8 model matrix + budgets, written to .shapeup/<slug>/run-args.json and handed to the harness run launch as one JSON literal — the workflow cannot ask follow-ups and cannot read config files itself, so everything a run will ever need travels in this one record. A workflow script validates its own subset of this shape in code (no runtime schema check at the C1 boundary itself); this entry is the central-registry definition the workflow script and the tech-lead skill both read as the one true shape.",
       "x-tier": "EMBEDDED",
       "x-location": ".shapeup/<slug>/run-args.json — written fresh by tech-lead on every launch and relaunch; the workflow receives it as its args and never reads other config",
       "x-writer": "tech-lead (GATE L0, on every launch AND every relaunch after a paused gate)",
@@ -2292,6 +2548,11 @@
           "type": "string",
           "description": "The feature slug this run builds — the aggregate root every path is keyed off."
         },
+        "runId": {
+          "type": "string",
+          "description": "OPTIONAL (v1.8) — the run key, COPIED from harness init run's `run_id` output. Carried here so harness run stamps every journal row without a receipt lookup per launch; a launch without it falls back to reading the receipt, so this is an optimisation, not the source of truth. This is identity, which x-not-here explicitly admits to RunArgs — it is not run config the ledger already carries.",
+          "pattern": "^[a-z0-9][a-z0-9-]*-[0-9]{8}T[0-9]{6}Z-[0-9a-f]{8}$"
+        },
         "autoLevel": {
           "type": "string",
           "enum": [
@@ -2299,7 +2560,7 @@
             "auto",
             "unattended"
           ],
-          "description": "Resolved once at GATE L0; governs which gates pre-approve and what on_missing does (gate-answers.mjs)."
+          "description": "Resolved once at GATE L0; governs which gates pre-approve and what on_missing does (harness gate)."
         },
         "answers": {
           "type": "string",
@@ -2341,7 +2602,7 @@
         },
         "startedAt": {
           "type": "string",
-          "description": "ISO timestamp, passed in because Date.now() is unavailable inside a workflow script by design — the deadline breaker (budget-check.mjs) computes elapsed time itself, in Node, where the clock lives."
+          "description": "ISO timestamp, passed in because Date.now() is unavailable inside a workflow script by design — the deadline breaker (harness verify budget) computes elapsed time itself, in Node, where the clock lives."
         },
         "lane": {
           "$ref": "#/$defs/Lane",
@@ -2350,11 +2611,25 @@
         "noEval": {
           "type": "boolean",
           "description": "If true, skips the EVAL phase completely. Rides here rather than in the ledger because there is no frontmatter line that carries it — contrast eval_dimensions, which does."
+        },
+        "noQa": {
+          "type": "boolean",
+          "description": "If true, skips the QA Edge Hunt (`--no-qa`). Rides here for the same reason as noEval: no frontmatter line carries it. It is declared because the workflow reads it — an arg the script consumes and this record omits is a switch the launcher never learns to send, which is a documented flag that does nothing."
+        },
+        "maxParallelScopes": {
+          "type": "integer",
+          "minimum": 1,
+          "default": 4,
+          "description": "How many scopes may build at once (`--parallel-scopes`). A dial rather than a constant because concurrency is a COST question before it is a speed one: every extra leg is another worker's full context. 1 restores sequential scope building, which is the mitigation when a worker archetype proves unsafe to run beside itself."
+        },
+        "adversarialVerify": {
+          "type": "boolean",
+          "description": "If true, each FAIL finding gets one independent skeptic before it costs a whole fix round (`--adversarial-verify`). Off by default: it is a pure addition that spends one sub-agent per finding, and the single-judge invariant is unaffected — a refutation retracts a finding, it never issues a verdict."
         }
       }
     },
     "RunReturn": {
-      "description": "C1 — the return half of the workflow's only conversation. The ONLY way the workflow speaks back to tech-lead, so it is a tagged union keyed on `status` — the skill branches on the tag, never on prose (the same exit-code discipline gate-answers.mjs already applies to gate sign-off, extended to the orchestrator's own return value). A gate resolved 'ask' (exit 4) always returns `paused`; a gate resolved 'abort' (exit 5) always returns `aborted`; any circuit breaker tripping (outer round_budget, inner attempt_budget, or the deadline breaker) returns `gate_h`; a full run whose final EVAL passes returns `shipped`. The union is written as a superset of what one inner round can itself produce (`paused`, `aborted`, `gate_h`, or a round-complete carrying a verdict) — `shipped` belongs only to a full run. It is deliberately NOT narrowed, because the round-scoped subset is what a `workflow()` child would return if the fan-out this design anticipates ever spends that nesting level.",
+      "description": "C1 — the return half of the workflow's only conversation. The ONLY way the workflow speaks back to tech-lead, so it is a tagged union keyed on `status` — the skill branches on the tag, never on prose (the same exit-code discipline harness gate already applies to gate sign-off, extended to the orchestrator's own return value). A gate resolved 'ask' (exit 4) always returns `paused`; a gate resolved 'abort' (exit 5) always returns `aborted`; any circuit breaker tripping (outer round_budget, inner attempt_budget, or the deadline breaker) returns `gate_h`; a full run whose final EVAL passes returns `shipped`. The union is written as a superset of what one inner round can itself produce (`paused`, `aborted`, `gate_h`, or a round-complete carrying a verdict) — `shipped` belongs only to a full run. It is deliberately NOT narrowed, because the round-scoped subset is what a `workflow()` child would return if the fan-out this design anticipates ever spends that nesting level.",
       "x-tier": "EMBEDDED",
       "x-location": "in-memory only — a Workflow return value, never written to disk",
       "x-writer": "the workflow runtime (shapeup-run — the sole writer)",
@@ -2423,7 +2698,7 @@
           "items": {
             "type": "string"
           },
-          "description": "paused: the decisions VALID_BY_GATE allows at this gate (gate-answers.mjs)."
+          "description": "paused: the decisions VALID_BY_GATE allows at this gate (harness gate)."
         },
         "context": {
           "type": "object",
@@ -2435,7 +2710,7 @@
         },
         "reason": {
           "type": "string",
-          "description": "aborted: the attributable reason (gate-answers.mjs's own `reason` field, carried through verbatim)."
+          "description": "aborted: the attributable reason (harness gate's own `reason` field, carried through verbatim)."
         },
         "breaker": {
           "type": "string",