shapeup-sdlc 3.1.0 → 3.1.2

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "shapeup-sdlc-plugin",
   "displayName": "ShapeUp SDLC Plugin",
-  "version": "3.1.0",
+  "version": "3.1.2",
   "description": "Shape Up SDLC harness for Claude Code: shaping, intake, orient, scope-mapping, building (T0-verified, sandboxed, scope-contracted), evaluation and QA skills orchestrated by a tech-lead.",
   "author": {
     "name": "Liberty Nguyen",

package/AGENTS.md

@@ -58,14 +58,16 @@ Everything discovered funnels into `.shapeup/<slug>/discovery/ledger.md` (Orient
 - **Ledger = single source of truth** — every discovery flow writes only its own section.
 - **QA is a level-up, not a gate** — `--no-qa` skips it; circuit breaker outranks the Hunter.
 - **Role separation** — Evaluator grades, task-executor fixes, QA discovers.
-- **Hill phase is mechanical ✦** — derived only from T0/T1/seesaw artifacts, never self-reported; the evaluator cites a T0 artifact it re-hashes itself.
+- **Hill phase is mechanical ✦** — derived only from T0/T1/seesaw artifacts, never self-reported; the evaluator cites a T0 artifact it re-hashes itself, from the list its order carries. A scoped verdict citing none is refused: its round stays open and is evaluated again, never advanced.
 - **Envelope port (v1.0)** — every dispatch is WorkOrder in / WorkResult out; shared state has exactly one writer (the ingest step); malformed envelopes are hook-denied. Workers: stateless, craft-only, pipeline-blind.
 
 ## Setup & Execution
 
 - Orders/results live in `.shapeup/<slug>/orders|results/`; the envelope schemas ship inside the tech-lead skill.
 - The plugin's run entry points need a one-time permission grant — `npx shapeup-sdlc init` writes it into `.claude/settings.json` (`permissions.allow`); without it a headless run stalls at step one. That grant is necessary, not sufficient: it covers the run's own deterministic entry points, not the generic file edits every worker skill makes constantly, or any command a worker reaches for beyond the grant's own exact shape. A truly unattended run also needs a Claude Code permission mode that covers those (`acceptEdits` at minimum) — the plugin cannot grant that on your behalf.
-- Two storage tiers (ADR-0001): COMMITTED `shapeup/<slug>/` (shaping, spec, scopes, wiring-map, project-profile, requirements, hill, `REPORT.md` frozen at L4) vs GITIGNORED `.shapeup/` (board, orders/results, T0/eval/QA artifacts, ledgers, metrics, gate answers).
+- Two storage tiers (ADR-0001): COMMITTED `shapeup/<slug>/` (shaping, spec, scopes, wiring-map, project-profile, requirements, hill, `REPORT.md` frozen at L4) vs GITIGNORED `.shapeup/` (board, orders/results, T0/eval/QA artifacts, ledgers, metrics, gate answers, and the run scripts staged for launch).
+- **The run launches from a copy inside your project, and it has to.** The Workflow tool loads a script only from a directory the session may already read; the plugin installs outside your project, so naming the shipped path is refused before the run begins and no permission rule repairs it — the grant authorises the tool, not what it may read. Opening a run therefore re-copies the run scripts to `.shapeup/workflows/` and reports the path the launch names. A run in flight keeps the copy it started with: an upgrade reaches the next run, not the current round.
+- **A write the substrate does not cover is denied for as long as the dispatch is in flight, and no longer.** A dispatch is live from the moment its order is compiled until a result for *that* dispatch lands, and liveness is read off the run's order set — not off the pointer that names the run, which outlives it. So a finished run fences nothing, a re-dispatch is fenced again, and the committed tier is never a worker's to write: those files belong to the orchestrator, whose window is a phase boundary rather than the middle of somebody else's order.
 - Every run has a `run_id` — the receipt mints it, and orders, T0 artifacts, trial rows, agent-call journal rows and hook decisions all carry it. It is the only key that separates two runs of the same feature: everything else (`order_id`, round/attempt) repeats. It is **not** a time boundary — a relaunch resumes the same run and reuses the key, so one `run_id` legitimately spans every launch after a paused gate or a kill, with hours of wall clock between them, and `orders/<id>.json` is rewritten by each. Anything measuring elapsed time reads the append-only records, never the span of a key. SHIP S.7 exports the run's records as fact tables under `.shapeup/exports/<run_id>/` before the run trace is superseded; a WorkResult carries no `run_id` and reaches it through `order_id`.
 - Every run projects a **run graph** — `.shapeup/<slug>/graph.jsonl`, append-only, written only by
   `reduce graph`. Two families kept separate: work lineage (Run, Order, Result, Verdict, Trial,

package/README.md

@@ -219,8 +219,9 @@ the layer that carries it, and the three layers here fail differently:
 - `PreToolUse` (`Skill|Agent`) — **`harness verify envelope` denies any worker dispatch whose order
   file is missing or fails the WorkOrder schema.** A malformed envelope never reaches a worker.
 - `PreToolUse` (`Edit|Write|MultiEdit`) — **`hooks/sandbox-guard.mjs` blocks a write that no LIVE
-  order's substrate permits.** It reads every compiled-but-not-yet-ingested order rather than a
-  pointer to one, so scopes building concurrently are each held to their own contract; `frozen`
+  order's substrate permits.** It reads every order that is compiled and not yet answered — a result
+  at least as new as the order itself — rather than a pointer to one, so scopes building
+  concurrently are each held to their own contract and a finished run fences nothing; `frozen`
   outranks everything, across all of them.
 - `PreToolUse` (`Bash|Read|Write|Edit|MultiEdit`) — **`hooks/safety-spine.mjs` denies destructive
   commands** (`rm -rf` on unrecoverable targets, force-push/push-to-main, `git reset --hard`,

package/SECURITY.md

@@ -69,7 +69,7 @@ sitting, and reading them is the recommended review.
 | [`safety-spine.mjs`](hooks/safety-spine.mjs) | PreToolUse (`Bash\|Read\|Write\|Edit\|MultiEdit`) | The proposed command/path; `.shapeup/safety-overrides.json` | Yes — provably destructive ops only: `rm -rf` on unrecoverable targets, `git push --force` / push to main, `git reset --hard`, `git clean -fdx`, `DROP TABLE`/`TRUNCATE`, reads of `.env`/keys/cloud credentials, and any write to its own overrides file | Never blocks an unmatched command; `--force-with-lease` stays allowed |
 | [`gate-intake.mjs`](hooks/gate-intake.mjs) | PreToolUse (`Skill`) | The `tech-lead` dispatch's own arguments | Yes — an orchestrator dispatch carrying no resolvable intake (no pitch, spec, resume or requirement text) | Fails open on `--order` and on any ambiguous arg shape |
 | [`harness verify envelope`](kernel/verify/envelope.mjs) | PreToolUse (`Skill\|Agent`) | The `--order` file named in the dispatch; the JSON schemas | Yes — a worker dispatch whose order file is missing or schema-invalid | Never gates a dispatch that carries no `--order` (standalone skill use stays free) |
-| [`sandbox-guard.mjs`](hooks/sandbox-guard.mjs) | PreToolUse (`Edit\|Write\|MultiEdit`) | The target path; the `substrate` block of every LIVE order (compiled, not yet ingested) | Yes — any write no live order permits: outside every `allowed`/`shared`, inside any `frozen`, or a `Write` to an `append_only` path | No-op unless an order is live; the active feature's own `.shapeup/<slug>/` run-trace is always writable. Appends denials to the local pathology log |
+| [`sandbox-guard.mjs`](hooks/sandbox-guard.mjs) | PreToolUse (`Edit\|Write\|MultiEdit`) | The target path; the `substrate` block of every LIVE order — compiled, with no result at least as new as the order's own `compiled_at` | Yes — any write no live order permits: outside every `allowed`/`shared`, inside any `frozen`, or a `Write` to an `append_only` path | No-op unless an order is live, which a finished run no longer is: the pointer names the run, never a dispatch. The active feature's own `.shapeup/<slug>/` run-trace is always writable. Appends denials to the local pathology log |
 | [`dispatch-receipt.mjs`](hooks/dispatch-receipt.mjs) | PostToolUse (`Skill\|Agent`) | The `--order` file named in the dispatch; the tool result's own report of which skill ran | **No — it has no deny path at all.** It records that the shipped skill ran, so `harness reduce ingest` can refuse a result no dispatch produced | Never writes an attestation for a result that does not name a resolved skill; never fails the call it observes (every write is inside `try`/`catch`) |
 | [`gate-zerowork.mjs`](hooks/gate-zerowork.mjs) | Stop | Run receipts on disk; the session transcript; the decision ledger | **Yes — the one blocking hook.** Returns `decision:"block"` when the session dispatched the orchestrator and produced no run receipt | Defers the moment any receipt exists; `stop_hook_active` caps it at one block per stop chain |
 
@@ -83,6 +83,11 @@ sitting, and reading them is the recommended review.
   any kind.
 - **The safety-spine actively blocks secret reads** (`.env`, `*.pem`, `*.key`, ssh/cloud
   credentials) rather than merely not making them.
+- **The script the run executes is a copy, and the copy is the shipped file.** Opening a run
+  copies the plugin's own workflow scripts into the gitignored `.shapeup/workflows/`, because the
+  Workflow tool loads a script only from a directory the session may already read and the plugin
+  installs outside your project. They are copied byte for byte — never generated, templated or
+  rewritten — so what you review in the plugin is what runs, and nothing else is added to your tree.
 - The installer (`scripts/install-harness.sh`) writes only into the target project
   (`.claude/`, `shapeup/`, `.gitignore`) and tells you what it
   is going to do first; the `curl | bash` form requires an explicit `--yes` for exactly that

package/commands/build.md

@@ -21,7 +21,7 @@ it belongs to the orchestrator:
 
 ```
 Workflow({
-  scriptPath: "${CLAUDE_PLUGIN_ROOT}/skills/tech-lead/workflows/shapeup-run.js",
+  scriptPath: ".shapeup/workflows/shapeup-run.js",
   args: <the RunArgs object>
 })
 ```

package/commands/ship.md

@@ -20,7 +20,7 @@ launch and does not drive it turn by turn:
 
 ```
 Workflow({
-  scriptPath: "${CLAUDE_PLUGIN_ROOT}/skills/tech-lead/workflows/shapeup-run.js",
+  scriptPath: ".shapeup/workflows/shapeup-run.js",
   args: <the RunArgs object>
 })
 ```

package/hooks/gate-zerowork.mjs

@@ -56,7 +56,7 @@
 import { readFileSync, readdirSync, existsSync, statSync } from "node:fs";
 import { join } from "node:path";
 import { isMain } from "../kernel/lib/argv.mjs";
-import { localDir, globLocal } from "../kernel/lib/paths.mjs";
+import { localDir, globLocal, globWorkflowsStage } from "../kernel/lib/paths.mjs";
 import { runHook, readStdin, settle, decisionsPath } from "./lib/decision.mjs";
 
 const MAX_TRANSCRIPT_BYTES = 20 * 1024 * 1024;
@@ -255,7 +255,7 @@ export function buildReason({ narration, census, enforcement }) {
     "it needs, unless --no-native-workflow was given, in which case approve the launch once):",
     "",
     "  Workflow({",
-    "    scriptPath: \"${CLAUDE_PLUGIN_ROOT}/skills/tech-lead/workflows/shapeup-run.js\",",
+    `    scriptPath: "${globWorkflowsStage("shapeup-run.js")}",  // staged by \`init run\`, above`,
     "    args: <the RunArgs object>",
     "  })",
     "",

package/hooks/sandbox-guard.mjs

@@ -13,14 +13,34 @@
 // and the contract the hook enforces the same object, for every operation, with no per-operation
 // code here.
 //
-// IT READS EVERY LIVE ORDER, NOT A POINTER TO ONE. `.shapeup/active-order` still names the run and
-// seeds the search — `harness compile` publishes it as it writes each order, which is what fences
-// the lanes that never reach the workflow (`--tiny`, the prose round loop, a standalone `/build`).
-// But a single pointer cannot survive concurrency: with scopes building side by side the last
-// compile wins the pointer, and a write from scope A is then judged against scope B's contract —
-// a false block or a false permit depending on which way the race fell. So the candidate set is
-// every order under `orders/` with no matching file under `results/` (compiled, not yet ingested),
-// and a write is permitted when SOME live contract covers it.
+// IT READS EVERY LIVE ORDER, NOT A POINTER TO ONE. `.shapeup/active-order` names the run and
+// nothing more — `harness compile` publishes it as it writes each order, which is what fences the
+// lanes that never reach the workflow (`--tiny`, the prose round loop, a standalone `/build`).
+// A single pointer cannot survive concurrency: with scopes building side by side the last compile
+// wins the pointer, and a write from scope A would be judged against scope B's contract — a false
+// block or a false permit depending on which way the race fell. So the candidate set is every
+// order under `orders/` that is not yet ANSWERED, and a write is permitted when SOME live contract
+// covers it.
+//
+// THE POINTER IS NOT A LIVENESS SIGNAL, and it used to be one: the order it names was counted live
+// unconditionally, "so the single-order lane behaves as it did before concurrency existed". The arm
+// bought nothing — an order that is genuinely in flight has no result yet and is already live by
+// the rule below — and it cost the checkout permanently. The pointer has one writer and no eraser,
+// so the LAST dispatch of a FINISHED run stayed live for good and fenced everything to that one
+// substrate: after a ship, an ordinary edit anywhere in the repo was denied, and the next feature
+// could not write even its own run trace, because the carve-out below is keyed to the slug the
+// stale pointer names. The documented fail-open state ("no pointer — not inside a dispatch") became
+// unreachable after the first run, and the only way out was to delete a file nothing documents.
+// The arm is gone; `reduce ship` and ``harness init run --force`` retire the pointer as well, so a
+// leftover one is untidy rather than load-bearing.
+//
+// ANSWERED IS A COMPARISON, NOT A PRESENCE TEST, and the difference is a hole the removal above
+// would otherwise open. Order filenames for the run-level operations carry no round (`hammer.json`,
+// `wire.json`, `analyze.json`), so re-dispatching one inside the same run rewrites the order beside
+// the PREVIOUS dispatch's result — and a presence test reads that as finished and runs the new
+// dispatch unfenced. An order counts as answered only when its result file is at least as new as
+// the order's own `compiled_at`, the stamp the compiler writes INTO the order, which a copy or a
+// touch cannot perturb. An order carrying no stamp falls back to presence, which is all it ever had.
 //
 // That is the same question as "the writer's own contract" because scope substrates are disjoint by
 // construction — `harness verify spec`'s DISJOINT rule fails a spec where two scopes claim the same
@@ -50,10 +70,10 @@
 // Contract: PreToolUse stdin JSON { tool_name, tool_input:{file_path | edits[].file_path}, cwd }.
 // Deny via { hookSpecificOutput: { hookEventName, permissionDecision:"deny", permissionDecisionReason } }.
 
-import { readFileSync, existsSync, appendFileSync, mkdirSync, readdirSync } from "node:fs";
+import { readFileSync, existsSync, appendFileSync, mkdirSync, readdirSync, statSync } from "node:fs";
 import { resolve, join, relative, dirname, sep } from "node:path";
 import { isMain } from "../kernel/lib/argv.mjs";
-import { LOCAL, activeOrder, ordersDir, resultsDir, metricsShard } from "../kernel/lib/paths.mjs";
+import { LOCAL, SHARED, activeOrder, ordersDir, resultsDir, metricsShard } from "../kernel/lib/paths.mjs";
 import { runHook, readStdin, settle } from "./lib/decision.mjs";
 
 // --- tiny glob matcher: supports *, **, ? — enough for substrate globs, zero dependencies ---
@@ -89,28 +109,48 @@ function readJSON(p) {
 }
 
 /**
- * Every order for this run that has been compiled and not yet ingested.
+ * Has this order been answered — i.e. has a result for THIS dispatch landed?
  *
- * "Not yet ingested" is read off the filesystem — an order with a same-named file under `results/`
- * has finished — because that is the only signal that survives a killed session. The pointer's own
- * order is always included, even when its result has landed, so the single-order lane behaves
- * exactly as it did before concurrency existed.
+ * Filesystem-only, because that is the one signal that survives a killed session. See the banner's
+ * "ANSWERED IS A COMPARISON" note for why a same-named result file is not on its own an answer.
+ *
+ * @param {string} resultPath - Where this order's result would be.
+ * @param {object} order - The parsed order, for its `compiled_at` stamp.
+ * @returns {boolean} True when the result belongs to this dispatch rather than an earlier one.
+ */
+function answered(resultPath, order) {
+  let mtimeMs;
+  try { mtimeMs = statSync(resultPath).mtimeMs; } catch { return false; }
+  const compiledAt = Date.parse(order?.compiled_at ?? "");
+  if (Number.isNaN(compiledAt)) return true;    // no stamp to compare against — presence is the answer
+  // WHOLE SECONDS, because that is all some filesystems keep of an mtime — HFS+ among them, which
+  // this plugin's own development volume uses. The stamp carries milliseconds; compared raw against
+  // a truncated mtime, a result written in the same second as its compile reads as OLDER than the
+  // order and the order stays live. Flooring the stamp costs a one-second window the other way — a
+  // re-dispatch inside the same second as the previous result reads as answered — which no real
+  // dispatch is fast enough to hit.
+  return mtimeMs >= Math.floor(compiledAt / 1000) * 1000;
+}
+
+/**
+ * Every order for this run that has been compiled and not yet answered.
  *
  * @param {string} cwd - Project root.
- * @param {string} slug - The active run's slug.
- * @param {string} pointerOrder - Absolute path of the order the pointer names.
+ * @param {string} slug - The run named by the pointer.
  * @returns {object[]} Parsed orders; unreadable files are skipped, never treated as permissive.
  */
-function liveOrders(cwd, slug, pointerOrder) {
+function liveOrders(cwd, slug) {
   const dir = ordersDir(cwd, slug);
-  const done = new Set(existsSync(resultsDir(cwd, slug)) ? readdirSync(resultsDir(cwd, slug)) : []);
-  const paths = new Set(existsSync(pointerOrder) ? [pointerOrder] : []);
-  if (existsSync(dir)) {
-    for (const f of readdirSync(dir)) {
-      if (f.endsWith(".json") && !done.has(f)) paths.add(join(dir, f));
-    }
+  if (!existsSync(dir)) return [];
+  const rDir = resultsDir(cwd, slug);
+  const live = [];
+  for (const f of readdirSync(dir)) {
+    if (!f.endsWith(".json")) continue;
+    const order = readJSON(join(dir, f));
+    if (!order) continue;
+    if (!answered(join(rDir, f), order)) live.push(order);
   }
-  return [...paths].map(readJSON).filter(Boolean);
+  return live;
 }
 
 function extractPaths(toolInput) {
@@ -159,9 +199,10 @@ async function main() {
   // writer's own contract" are the same question — and only the first can be asked without a
   // shared mutable pointer.
   //
-  // Live = compiled and not yet ingested. An order whose result is on disk has finished; leaving it
-  // in the candidate set would keep a finished scope's substrate open for the rest of the run.
-  const orders = liveOrders(cwd, active.slug, resolve(cwd, active.order_path));
+  // Live = compiled and not yet answered. An order whose result is on disk has finished; leaving it
+  // in the candidate set would keep a finished scope's substrate open for the rest of the run — and
+  // leaving the POINTER's own order in unconditionally kept a finished RUN's substrate open forever.
+  const orders = liveOrders(cwd, active.slug);
   if (orders.length === 0) defer(`no live order for ${active.slug}`, "no-order");
 
   const withSubstrate = orders.filter((o) => o.substrate);
@@ -219,6 +260,18 @@ async function main() {
     defer(`${targetPaths.length} path(s) inside a live order's substrate (${contracts.length} live) — permitted`, "in-substrate");
   }
 
+  // THE REMEDY DIFFERS BY TIER, and naming the wrong one costs a session real time. A product-code
+  // path outside every substrate is a scope-cut question, and widening the order is the honest fix.
+  // A path under the COMMITTED tier is not: no build scope may own the run's own governance and
+  // spec artifacts, so widening a substrate to reach one is the wrong move in a plausible-looking
+  // direction. Those files belong to the orchestrator, whose write window is a phase boundary —
+  // no dispatch in flight — and never the middle of somebody else's dispatch.
+  const committed = violations.filter((v) => v.split(/[\\/]/)[0] === SHARED);
+  const hint = committed.length === violations.length
+    ? `${SHARED}/ is committed tier: these belong to the orchestrator, not to a worker substrate. `
+      + "Write them at a phase boundary, with no dispatch in flight — do not widen an order to reach one."
+    : "If this write legitimately crosses scopes, the order's substrate needs to be expanded (e.g. via ba --remap).";
+
   logPathology(metricsPath, {
     schema_version: 1,
     at: new Date().toISOString(),
@@ -240,7 +293,7 @@ async function main() {
         permissionDecisionReason:
           `Sandbox guard (PA3) — no live order's substrate covers these writes:\n` +
           `${blockReasons.join("\n")}\n` +
-          `If this write legitimately crosses scopes, the order's substrate needs to be expanded (e.g. via ba --remap).`,
+          hint,
       },
     },
   };

package/kernel/compile.mjs

@@ -36,10 +36,11 @@ import { readRunId } from "./lib/paths.mjs";
 // --spec-overridden directory, and the import is the convention-derived default.
 import {
   tasksDir, specDir as defaultSpecDir, roundLedger, trials, verdictsDir, ordersDir,
-  relShared, globLocal, globShared, relKnowledgeBase, resultsDir, scopesDir,
+  relShared, relLocal, globLocal, globShared, relKnowledgeBase, resultsDir, scopesDir,
 } from "./lib/paths.mjs";
-import { readContract, tasksForScope, SCOPE_CONTRACT } from "./lib/contract.mjs";
+import { readContract, readAllContracts, tasksForScope, SCOPE_CONTRACT } from "./lib/contract.mjs";
 import { writeActiveOrder } from "./probe/resume.mjs";
+import { greenVerdict } from "./probe/t0.mjs";
 // The SAME matcher the sandbox hook enforces with. "Is this cited file inside this scope's
 // substrate" has to mean exactly what the guard means, or a bug is addressed to a scope that is
 // then denied the write that fixes it.
@@ -482,6 +483,43 @@ export function scopeSubstrates(cwd, slug) {
   return out;
 }
 
+// --- the T0 artifacts the judge must cite ----------------------------------------------------
+//
+// WHY THE KERNEL DERIVES THEM. spec-evaluator treats a scoped spec whose order lists no T0 artifact
+// as NOT gradeable and returns `failed` without grading a criterion. The precondition is right —
+// its verdict must cite a T0 artifact it re-hashed itself — and nothing met it: the list was once
+// assembled by an orchestrator courier from the paths each scope reported, and was lost when the
+// orchestrator became a workflow script that passes only `{dimensions, run_cmd, round}`. Evaluators
+// that went looking on disk graded anyway; one that followed its contract refused, and the run
+// aborted at L3 over a round whose every scope was green.
+//
+// Derived here for the reason `bugs` is: this is the one line every lane compiles through, and the
+// evidence is already on disk. A caller could not rebuild the list from filenames in any case —
+// verdict files are addressed by round, attempt and trial, never by scope, so the scope lives only
+// inside each body, which is what `probe t0` reads.
+
+/**
+ * The green T0 verdict each scope contract holds for a round — an evaluate order's `t0_artifacts`.
+ *
+ * @param {string} cwd - Project root.
+ * @param {string} slug - Feature slug.
+ * @param {number} [round] - The round being evaluated. Omitted, each scope's newest green verdict
+ *   of any round — a standalone evaluation has no round.
+ * @returns {{artifacts: string[], missing: string[]}} Repo-relative verdict paths in scope-id
+ *   order, one per scope that has one; and the scopes that have none. Both empty on an unscoped spec.
+ */
+export function t0ArtifactsFor(cwd, slug, round) {
+  const artifacts = [];
+  const missing = [];
+  for (const { contract, id } of readAllContracts(scopesDir(cwd, slug))) {
+    const scopeId = contract?.scope_id || id;
+    const { green, path } = greenVerdict(cwd, slug, scopeId, round);
+    if (green) artifacts.push(relLocal(slug, "t0", "verdicts", basename(path)));
+    else missing.push(scopeId);
+  }
+  return { artifacts, missing };
+}
+
 /**
  * Assemble a WorkOrder envelope. Pure given its inputs — the CLI wrapper does the disk reads.
  * @param {object} opts - The order inputs (destructured):
@@ -743,6 +781,17 @@ export async function cli(rawArgv) {
   let payloadExtra = flag("payload") || {};
   if (specDir && !payloadExtra.spec_folder) payloadExtra.spec_folder = specDir;
   if (!payloadExtra.feature) payloadExtra.feature = slug;
+  // The judge's citations, for every lane (see t0ArtifactsFor). An explicit `--payload` list still
+  // wins, as it does for `bugs`: an operator naming the evidence outranks the derivation.
+  if (operation === "evaluate" && payloadExtra.t0_artifacts === undefined) {
+    const { artifacts, missing } = t0ArtifactsFor(cwd, slug, round);
+    if (artifacts.length) payloadExtra.t0_artifacts = artifacts;
+    // On stderr, never stdout: stdout is the order path the caller consumes.
+    if (missing.length) {
+      console.error(`compile-order: warning — no green T0 verdict${round ? ` in round ${round}` : ""} for ` +
+        `${missing.join(", ")}; the evaluator has nothing to cite for ${missing.length === 1 ? "that scope" : "those scopes"}`);
+    }
+  }
 
   const order = compileOrder({
     slug, worker, operation, round, attempt, scope, tasks, decisions, digestedErrors, trialHistory, bugs,
@@ -771,17 +820,17 @@ export async function cli(rawArgv) {
   // through.
   //
   // `hooks/sandbox-guard.mjs` enforces the order's own `substrate` block — allowed/shared,
-  // append_only, frozen — and it finds the order through `.shapeup/active-order`. Until this
-  // write existed the pointer had exactly one author, the workflow script, so the guard fenced
-  // the workflow lane and DEFERRED everywhere else: `--tiny`, the prose round loop, and a
-  // standalone `/build` all compiled an order carrying a write contract that nothing enforced.
-  // A substrate that is only enforced on the lane that also happens to be the most supervised
-  // one is the wrong way round.
+  // append_only, frozen — and it finds the RUN through `.shapeup/active-order`. Until this write
+  // existed the pointer had exactly one author, the workflow script, so the guard fenced the
+  // workflow lane and DEFERRED everywhere else: `--tiny`, the prose round loop, and a standalone
+  // `/build` all compiled an order carrying a write contract that nothing enforced. A substrate
+  // that is only enforced on the lane that also happens to be the most supervised one is the wrong
+  // way round. This is now the pointer's ONLY author.
   //
-  // Compiling an order is the moment the write contract comes into existence, so it is the
-  // correct moment to publish it. The workflow script still sets the pointer explicitly before
-  // dispatch (it interleaves phases and must be exact about which order is live); this write
-  // makes the SAME mechanism cover callers that never reach that code.
+  // Compiling an order is the moment the write contract comes into existence, so it is the correct
+  // moment to publish it. What the pointer supplies is the run's slug; which of that run's orders
+  // are LIVE is derived from the order set (compiled, not yet answered), never from this file — so
+  // republishing it on every compile costs nothing and a stale one fences nothing.
   //
   // Best-effort, on stderr, and never fatal: a compiled order that cannot publish its pointer is
   // still a valid order, and stdout belongs to the order path the caller consumes. The guard

package/kernel/init/run.mjs

@@ -68,7 +68,7 @@
 // that takes a phase, not an init-run flag that takes a slug: the one instruction available at the
 // one moment it mattered named a mechanism that does not parse.
 
-import { mkdirSync, writeFileSync, readFileSync, readdirSync, existsSync } from "node:fs";
+import { mkdirSync, writeFileSync, readFileSync, readdirSync, existsSync, copyFileSync, rmSync } from "node:fs";
 import { join, dirname, resolve } from "node:path";
 import { createHash } from "node:crypto";
 import { decideLane, treeSize } from "./fit.mjs";
@@ -76,7 +76,10 @@ import { runArgs } from "../lib/argv.mjs";
 import { uncoerce } from "../lib/contract.mjs";
 import { deriveSnapshot } from "../reduce/snapshot.mjs";
 import { mintRunId } from "../lib/paths.mjs";
-import { localRoot, activeScope, globLocal, globShared, ordersDir, resultsDir } from "../lib/paths.mjs";
+import {
+  localRoot, activeScope, activeOrder, globLocal, globShared, ordersDir, resultsDir,
+  workflowsStage, globWorkflowsStage,
+} from "../lib/paths.mjs";
 import { resolveWorkers } from "../verify/skills.mjs";
 
 export const RECEIPT_VERSION = 1;
@@ -257,6 +260,58 @@ export function resolveAbandonedOrders(cwd, slug) {
   return resolved;
 }
 
+/**
+ * Copy the plugin's run scripts into the project so the launch can actually read them.
+ *
+ * WHY A COPY, AND WHY HERE. `Workflow({scriptPath})` loads a script only from somewhere the session
+ * is already allowed to read — the working directory, or a directory the operator added. The plugin
+ * is installed OUTSIDE the project (a version-stamped cache directory on a marketplace install), so
+ * naming the shipped path fails the launch outright, and no permission rule fixes it: the grant that
+ * authorises the Workflow tool says nothing about where it may read from. The failure is invisible
+ * in development, where the plugin root and the working directory are the same tree, and total for
+ * everybody else. A project-local copy is inside the working directory by construction, so it loads
+ * in every permission mode without widening what the session may read.
+ *
+ * Opening a run is the right moment: it is the one step every lane passes through before a launch,
+ * and it already knows which copy of the plugin answered.
+ *
+ * `refresh` is what keeps an upgrade from arriving mid-round. Opening a run (or forcing over one)
+ * overwrites the staged copies, so a plugin upgrade reaches the NEXT run. A call that finds a run
+ * already open only fills in what is missing: that run should finish on the orchestrator it started
+ * with, and swapping the script under a resumed round is a different build than the one the gates
+ * were answered for — but a relaunch with no script at all is a dead end, so a copy that is gone
+ * (a cleaned run workspace, a run opened by a version that never staged) is written back.
+ *
+ * Best-effort by design: a project that cannot be written to still opens its run and can still be
+ * launched from the install path by an operator who adds that directory. Reporting beats refusing.
+ *
+ * @param {string} cwd - Project root.
+ * @param {string} pluginRoot - The plugin copy that answered this call.
+ * @param {object} [opts] - Options.
+ * @param {boolean} [opts.refresh] - Overwrite an existing copy (true) or only fill gaps (false).
+ * @returns {{ok: boolean, dir: string, staged: string[], reason?: string}} Outcome, for the caller to report.
+ */
+export function stageWorkflows(cwd, pluginRoot, { refresh = true } = {}) {
+  const src = join(pluginRoot, "skills", "tech-lead", "workflows");
+  const dir = workflowsStage(cwd);
+  let names;
+  try {
+    names = readdirSync(src).filter((f) => f.endsWith(".js")).sort();
+  } catch (e) {
+    return { ok: false, dir, staged: [], reason: `no workflow scripts at ${src}: ${e.message}` };
+  }
+  try {
+    mkdirSync(dir, { recursive: true });
+    for (const f of names) {
+      const dst = join(dir, f);
+      if (refresh || !existsSync(dst)) copyFileSync(join(src, f), dst);
+    }
+  } catch (e) {
+    return { ok: false, dir, staged: [], reason: `could not stage into ${dir}: ${e.message}` };
+  }
+  return { ok: true, dir, staged: names };
+}
+
 // ---- CLI -------------------------------------------------------------------
 
 /** The typed argv contract (see `./lib/argv.mjs`). */
@@ -398,6 +453,19 @@ export function cli(rawArgv) {
 
   const runRoot = localRoot(cwd, slug);
   const receiptPath = join(runRoot, "receipt.json");
+
+  // STAGE THE RUN SCRIPTS BEFORE THE ALREADY-OPEN REFUSAL, not after: a session resuming a paused
+  // run reaches that refusal and nothing else, and it still needs a `scriptPath` it can name. What
+  // it does NOT get is a swapped orchestrator — see stageWorkflows() for why `refresh` is false
+  // exactly when a run is already open and is not being forced over.
+  // `Boolean(...)`, not the bare flag: an absent `--force` is `undefined`, and `false || undefined`
+  // is `undefined`, which a destructured default reads as "not passed" and turns back into `true`.
+  const staged = stageWorkflows(cwd, plugin.root, { refresh: !existsSync(receiptPath) || Boolean(args.force) });
+  if (!staged.ok) {
+    console.error(`⚠ init-run: could not stage the run scripts — ${staged.reason}`);
+    console.error(`  Launch from the install path instead, and add ${plugin.root} to the session's`);
+    console.error("  readable directories (/add-dir) if the Workflow tool refuses to load it.");
+  }
   // A RUN IS ALREADY OPEN. This is the resume path, and it used to be a dead end.
   //
   // The refusal is right: silently re-initialising would discard the round history the circuit
@@ -437,6 +505,10 @@ export function cli(rawArgv) {
       "To re-derive this at any time:",
       "  node <plugin>/kernel/harness.mjs reduce snapshot --cwd <dir>",
       "To abandon the open run and start over, deliberately: --force",
+      "",
+      staged.ok
+        ? `Relaunch the same run with: Workflow({scriptPath: "${globWorkflowsStage("shapeup-run.js")}", args: <the same RunArgs>})`
+        : "The run scripts are NOT staged in this project — see the warning above before relaunching.",
     ].join("\n"));
   }
 
@@ -453,6 +525,10 @@ export function cli(rawArgv) {
         `⚠ init-run --force: resolved ${abandoned.length} dispatched-but-unanswered order(s) as abandoned — ${abandoned.join(", ")}`,
       );
     }
+    // And the pointer the abandoned run left behind. It names a run that is being forced over, so
+    // the next compile republishes it within the second; retiring it here means a `--force` that
+    // resolves nothing still leaves no stale claim about which run is open.
+    rmSync(activeOrder(cwd), { force: true });
   }
 
   const startedAt = new Date().toISOString();
@@ -483,6 +559,8 @@ export function cli(rawArgv) {
     intake_sha256: receipt.intake_sha256,
     intake_chars: receipt.intake_chars,
     config,
+    // What the launch names. Project-local by necessity, not by preference — see stageWorkflows().
+    workflow_script: staged.ok ? globWorkflowsStage("shapeup-run.js") : null,
     next: "GATE L0 — pin the run config, emit the gate block, then ORIENT.",
   }, null, 2));
 }

package/kernel/lib/paths.mjs

@@ -258,8 +258,34 @@ export const workingDir = (cwd, slug) => join(localRoot(cwd, slug), "working");
  * rows, above all, which without it are written unjoinable to any run.
  */
 export const activeScope = (cwd) => join(localDir(cwd), "active-scope");
-/** The pointer the sandbox guard reads to answer "which order is executing?". */
+/**
+ * The pointer that tells the sandbox guard WHICH RUN it is fencing.
+ *
+ * It names a run, not a live dispatch. `harness compile` republishes it as it writes each order —
+ * the one place every lane passes through — and the guard uses the `slug` in it to find the run's
+ * order set; liveness is then derived from that set, never from this file. That separation is
+ * deliberate: this pointer has one writer and no natural eraser, so a run that ends leaves it
+ * behind, and anything that treated it as "a dispatch is in flight" kept a finished run's last
+ * substrate armed over an idle checkout. `reduce ship` and ``harness init run --force`` retire it
+ * so it does not outlive its run, and the guard is correct either way.
+ */
 export const activeOrder = (cwd) => join(localDir(cwd), "active-order");
+
+/**
+ * Where the run scripts are staged for launch, inside the project.
+ *
+ * The orchestrator's Workflow scripts ship with the plugin, which lives OUTSIDE the project — and
+ * the Workflow tool will only load a script it is already allowed to read, meaning the working
+ * directory or a directory the operator added. An install path therefore fails the launch outright,
+ * with no permission rule that can fix it: the grant that authorises the tool does not widen where
+ * it may read from. So ``harness init run`` copies the shipped scripts here, and the launch names
+ * this project-local path. LOCAL, because a staged copy is a build artifact of the run, not a
+ * source file anybody should review or commit.
+ */
+export const workflowsStage = (cwd) => join(localDir(cwd), "workflows");
+
+/** The staged run script as the LAUNCH names it — project-relative, `/`-joined on every platform. */
+export const globWorkflowsStage = (...parts) => [LOCAL, "workflows", ...parts].join("/");
 /** Hook receipts — one row per evaluation, so `allow` carries evidence. */
 export const decisions = (cwd) => join(localDir(cwd), "decisions.jsonl");
 /** Human-authored safety escape hatch. LOCAL so no PR can widen another machine's envelope. */

package/kernel/probe/eval.mjs

@@ -1,8 +1,10 @@
 // probe eval — "what did round N's EVAL WorkResult actually say?"
 //
 // CONTRACT. A bounded, read-only query over the evaluate WorkResult ingest already wrote. Prints
-// `{ok, overall, bug_count, report_path}` on stdout; exits 0 when found and readable, 1 when the
-// result is missing (nothing ran, or ingest hasn't landed yet), 2 on a bad argv. Writes nothing.
+// `{ok, overall, bug_count, report_path, round, status, reason}` on stdout; exits 0 when the round
+// holds a verdict the run may act on, 1 when it does not — nothing ran, ingest hasn't landed, the
+// evaluator refused the round, or the verdict is structurally invalid; `reason` says which — and 2
+// on a bad argv. Writes nothing.
 //
 // WHY THIS EXISTS. `shapeup-run.js` cannot read a file itself (a Workflow script has no filesystem
 // of its own — see this repo's own note on why it may not call `Date.now()`), so every fact it
@@ -23,11 +25,65 @@
 // shared state; the `.md` report is prose for a human. Reading the prose to re-derive a verdict a
 // schema already carries structurally is the paraphrase channel this repo's hooks exist to close
 // everywhere else.
+//
+// WHY "NO VERDICT" CARRIES A REASON. An evaluator that refuses a round — a structural precondition
+// it cannot meet — still writes `evaluate-r<N>.json`, with `status: failed`, no verdict, and the
+// cause as its first deviation. A bare `ok: false` reached the operator as a sub-agent that died
+// after retries, while the one sentence naming the actual cause sat in a file nobody was pointed at.
 
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync, readFileSync, readdirSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { runArgs } from "../lib/argv.mjs";
-import { resultsDir } from "../lib/paths.mjs";
+import { resultsDir, scopesDir } from "../lib/paths.mjs";
+
+/** Longest `reason` reported. A deviation is prose written by a worker and can run to paragraphs. */
+const REASON_MAX = 400;
+
+/**
+ * Bound a reason to {@link REASON_MAX} characters.
+ * @param {string} s - The reason.
+ * @returns {string} `s`, or its first REASON_MAX − 1 characters and an ellipsis.
+ */
+const clip = (s) => (s.length > REASON_MAX ? `${s.slice(0, REASON_MAX - 1)}…` : s);
+
+/**
+ * Whether a feature's spec is SCOPED — has scope contracts, the case in which every verdict must
+ * cite the T0 artifacts it re-hashed.
+ *
+ * @param {string} cwd - Project root.
+ * @param {string} slug - Feature slug.
+ * @returns {boolean} True when `scopes/` holds at least one contract (`.md`, or a legacy `.json`).
+ */
+export function isScoped(cwd, slug) {
+  try { return readdirSync(scopesDir(cwd, slug)).some((f) => /\.(md|json)$/.test(f)); }
+  catch { return false; }
+}
+
+/**
+ * Why a verdict cannot stand as its round's judgement on T0 grounds, or null when it can.
+ *
+ * A PASS or FAIL on a scoped spec that cites no T0 artifact is structurally invalid — the
+ * evaluator's own contract says so, because T0 is the machine fact a generator cannot fabricate.
+ * That rule used to live only in the contract, so a verdict citing nothing was ingested, ledgered
+ * and branched on like any other. It is checked here so the round loop, the resume derivation, the
+ * hill and ingest all refuse the same verdict for the same reason.
+ *
+ * PRESENCE, NOT HASHES. The evaluator re-hashes what it cites; a slip transcribing a digest is not
+ * evidence the verdict is wrong, and refusing a round over one would cost a whole re-evaluation.
+ *
+ * @param {string} cwd - Project root.
+ * @param {string} slug - Feature slug.
+ * @param {object} verdict - The WorkResult's `verdict` block.
+ * @returns {(string|null)} The problem, phrased for an operator; null for a cited verdict, an
+ *   unscoped spec, or a block with no PASS/FAIL in it (there is no judgement to invalidate).
+ */
+export function citationProblem(cwd, slug, verdict) {
+  if (verdict?.overall !== "PASS" && verdict?.overall !== "FAIL") return null;
+  if (Array.isArray(verdict.t0_citations) && verdict.t0_citations.length) return null;
+  if (!isScoped(cwd, slug)) return null;
+  return `the ${verdict.overall} verdict cites no T0 artifact, and a verdict on a scoped spec must ` +
+    "cite the T0 verdict it re-hashed (the order lists them under payload.t0_artifacts)";
+}
 
 /**
  * Read one round's EVAL verdict straight from the WorkResult `reduce ingest` wrote.
@@ -35,20 +91,35 @@ import { resultsDir } from "../lib/paths.mjs";
  * @param {string} cwd - Project root.
  * @param {string} slug - Feature slug.
  * @param {number} round - The EVAL round (`evaluate-r<N>.json`).
- * @returns {{found: boolean, overall: (string|null), bug_count: (number|null),
- *   report_path: (string|null)}} `found: false` when no result exists yet — a fact, not a guess.
+ * @returns {{found: boolean, overall: (string|null), status: (string|null), reason: (string|null),
+ *   bug_count: (number|null), report_path: (string|null)}} `found` is true only for a PASS/FAIL the
+ *   round may act on; otherwise `reason` says why not — a fact, not a guess.
  */
 export function evalVerdict(cwd, slug, round) {
   const path = join(resultsDir(cwd, slug), `evaluate-r${round}.json`);
-  if (!existsSync(path)) return { found: false, overall: null, bug_count: null, report_path: null };
+  const unfit = (reason, status = null, overall = null) =>
+    ({ found: false, overall, status, reason, bug_count: null, report_path: null });
+  if (!existsSync(path)) return unfit("no evaluate result for this round yet");
   let doc;
   try { doc = JSON.parse(readFileSync(path, "utf8")); }
-  catch { return { found: false, overall: null, bug_count: null, report_path: null }; }
+  catch { return unfit("the evaluate result is not readable JSON"); }
+  const status = typeof doc?.status === "string" ? doc.status : null;
   const v = doc?.verdict || {};
   const overall = v.overall === "PASS" || v.overall === "FAIL" ? v.overall : null;
+  if (!overall) {
+    // A worker that refused to grade says why in its FIRST deviation — the only channel it has.
+    const first = Array.isArray(doc?.deviations) && typeof doc.deviations[0] === "string" ? doc.deviations[0] : "";
+    return unfit(clip(first
+      ? `the evaluator returned ${status || "no status"}: ${first}`
+      : `status ${status || "unknown"} with no PASS/FAIL verdict`), status);
+  }
+  const problem = citationProblem(cwd, slug, v);
+  if (problem) return unfit(problem, status, overall);
   return {
-    found: overall !== null,
+    found: true,
     overall,
+    status,
+    reason: null,
     bug_count: Array.isArray(v.bugs) ? v.bugs.length : null,
     report_path: typeof v.report_path === "string" ? v.report_path : null,
   };
@@ -66,12 +137,12 @@ export const ARGV_SPEC = {
  * Report round N's EVAL verdict, mechanically, from the WorkResult on disk.
  *
  * @param {string[]} rawArgv - The subcommand's own arguments (harness.mjs strips the verb words).
- * @returns {void} Exits 0 when a verdict was found, 1 when none exists yet for this round.
+ * @returns {void} Exits 0 when the round holds a verdict the run may act on, 1 when it does not.
  */
 export function cli(rawArgv) {
   const args = runArgs(ARGV_SPEC, rawArgv);
   const cwd = resolve(args.cwd || process.cwd());
-  const { found, overall, bug_count, report_path } = evalVerdict(cwd, args.slug, args.round);
-  console.log(JSON.stringify({ ok: found, overall, bug_count, report_path, round: args.round }));
+  const { found, overall, status, reason, bug_count, report_path } = evalVerdict(cwd, args.slug, args.round);
+  console.log(JSON.stringify({ ok: found, overall, bug_count, report_path, round: args.round, status, reason }));
   process.exit(found ? 0 : 1);
 }

package/kernel/probe/resume.mjs

@@ -65,6 +65,7 @@ import {
   intake, harnessRun, wiringMap, projectProfile, scopesDir, resultsDir, ordersDir,
   orientDir, activeOrder, usecasesDir,
 } from "../lib/paths.mjs";
+import { evalVerdict } from "./eval.mjs";
 
 /** The run-state values `references/protocol.md` (Part 4 — State) defines. A typo'd status is a rejection,
  *  not a write — the whole point of this file is that a write nobody validates is a write nobody
@@ -405,9 +406,15 @@ export function deriveResumeState(cwd, slug) {
     // that permits the overlap is the same one that makes it invisible to the disjointness lint.
     scope_exclusions: scopeExclusions(cwd, slug, scope_files),
     pending_orders: orderFiles.filter((f) => f.endsWith(".json") && !resultFiles.includes(f)),
+    // A round is DONE when it was graded, not when its result file exists. An evaluator that
+    // refused the round — no PASS/FAIL, or a scoped verdict citing no T0 artifact — still writes
+    // `evaluate-r<N>.json`; counted, the relaunch opened round N+1 over a round nobody judged, with
+    // no bugs to route, and rebuilt every scope. Left open, it re-enters round N, skips the scopes
+    // already green there, and evaluates again.
     eval_rounds_done: resultFiles
       .filter((f) => /^evaluate-r\d+\.json$/.test(f))
-      .map((f) => Number(f.match(/\d+/)[0])),
+      .map((f) => Number(f.match(/\d+/)[0]))
+      .filter((n) => evalVerdict(cwd, slug, n).found),
   };
   return { ...facts, next_phase: nextPhase(facts) };
 }

package/kernel/probe/t0.mjs

@@ -18,13 +18,36 @@ import { join, resolve } from "node:path";
 import { runArgs } from "../lib/argv.mjs";
 import { verdictsDir } from "../lib/paths.mjs";
 
+/**
+ * Verdict filenames, newest first by their NUMERIC address.
+ *
+ * A string sort files `r1-a1-t10.json` before `r1-a1-t9.json`, and the trial ordinal is shared by
+ * every scope verified at one (round, attempt) — ten scopes on their first attempt are enough to
+ * make an older verdict read as the newest. Names that carry no address sort last.
+ *
+ * @param {string[]} names - Filenames from the verdicts directory.
+ * @returns {string[]} A new array, newest first: round, then attempt, then trial, descending.
+ */
+export function newestFirst(names) {
+  const key = (f) => {
+    const m = f.match(/^r(\d+)-a(\d+)(?:-t(\d+))?\.json$/);
+    return m ? [Number(m[1]), Number(m[2]), Number(m[3] ?? 0)] : [-1, -1, -1];
+  };
+  return [...names].sort((a, b) => {
+    const ka = key(a), kb = key(b);
+    for (let i = 0; i < 3; i++) if (ka[i] !== kb[i]) return kb[i] - ka[i];
+    return b.localeCompare(a);
+  });
+}
+
 /**
  * The newest green T0 verdict for one scope in one round.
  *
  * @param {string} cwd - Project root.
  * @param {string} slug - Feature slug.
  * @param {string} scopeId - Scope contract id.
- * @param {number} round - Build round.
+ * @param {number} [round] - Build round. Omitted, the newest green verdict of ANY round — what an
+ *   evaluation with no round (a standalone single pass) has to cite.
  * @returns {{green: boolean, path: (string|null)}} `path` is the artifact a later EVAL can cite.
  */
 export function greenVerdict(cwd, slug, scopeId, round) {
@@ -32,11 +55,11 @@ export function greenVerdict(cwd, slug, scopeId, round) {
   if (!existsSync(dir)) return { green: false, path: null };
   // Newest first: an attempt retried after a red one writes a higher trial ordinal at the same
   // (round, attempt) address, and the LAST verdict is the one that stands.
-  for (const f of readdirSync(dir).filter((x) => x.endsWith(".json")).sort().reverse()) {
+  for (const f of newestFirst(readdirSync(dir).filter((x) => x.endsWith(".json")))) {
     const p = join(dir, f);
     try {
       const b = JSON.parse(readFileSync(p, "utf8"));
-      if (b.scope_id === scopeId && b.round === round && b.overall === "green") return { green: true, path: p };
+      if (b.scope_id === scopeId && (round == null || b.round === round) && b.overall === "green") return { green: true, path: p };
     } catch { /* a torn artifact proves nothing; keep looking */ }
   }
   return { green: false, path: null };

package/kernel/reduce/ingest.mjs

@@ -28,6 +28,7 @@ import { fileURLToPath } from "node:url";
 import { validate } from "../verify/envelope.mjs";
 import { runArgs } from "../lib/argv.mjs";
 import { tasksDir, localRoot, dispatchReceipts, legLedger, readRunId } from "../lib/paths.mjs";
+import { citationProblem } from "../probe/eval.mjs";
 
 const HERE = dirname(fileURLToPath(import.meta.url));
 const RESULT_SCHEMA = JSON.parse(readFileSync(resolve(HERE, "../../skills/tech-lead/schemas/work-result.schema.json"), "utf8"));
@@ -596,6 +597,20 @@ export async function cli(rawArgv) {
     process.exit(1);
   }
 
+  // --- T0 citation gate -----------------------------------------------------------------------
+  // A PASS or FAIL on a scoped spec that cites no T0 artifact is not a judgement this run may act
+  // on (see `citationProblem`). `probe eval` refuses it to the round loop; refusing it here as well
+  // keeps the verdict ledger from recording a verdict the loop will never branch on.
+  if (result.verdict) {
+    const problem = citationProblem(cwd, String(result.order_id).split("/")[0], result.verdict);
+    if (problem) {
+      console.error(`ingest-result: result refused — ${problem}.`);
+      console.error(`  The round stays open: re-dispatch the evaluator against its order, which lists`);
+      console.error(`  the T0 artifacts to cite. Nothing was written.`);
+      process.exit(1);
+    }
+  }
+
   // Resolved for EVERY order, not only the gated ones: the attesting receipt is this leg's start,
   // and a standalone or `--no-receipt-check` ingest still deserves a truthful timing row rather
   // than one silently falling back to the order's re-writable `compiled_at`.

package/kernel/reduce/ship.mjs

@@ -26,12 +26,13 @@
 //
 // Exit: 0 written (path on stdout), 2 usage error.
 
-import { readFileSync, writeFileSync, mkdirSync, existsSync, readdirSync } from "node:fs";
+import { readFileSync, writeFileSync, mkdirSync, existsSync, readdirSync, rmSync } from "node:fs";
 import { join, dirname } from "node:path";
 import { runArgs } from "../lib/argv.mjs";
 import {
   report as reportPath, tasksDir, verdictsDir, trials, evaluationDir, qaDir,
   roundLedger, discoveryLedger, receipt as receiptPath, harnessRun, relShared, resultsDir,
+  activeOrder,
 } from "../lib/paths.mjs";
 import { readTrials } from "../verify/t0.mjs";
 import { ratchetReport } from "../probe/stats.mjs";
@@ -349,6 +350,15 @@ export async function cli(rawArgv) {
   } else {
     mkdirSync(dirname(path), { recursive: true });
     writeFileSync(path, markdown, "utf8");
+
+    // THE RUN IS OVER, SO RETIRE ITS POINTER. `harness compile` publishes `.shapeup/active-order`
+    // as it writes each order and nothing ever erased it, so the pointer outlived every run that
+    // produced one. That is harmless to the guard now — liveness comes from the order set, and a
+    // shipped run has no unanswered orders — but a pointer naming a finished run is a fact on disk
+    // that is no longer true, and the next reader to trust it inherits the same class of bug.
+    // Only on the writing path: `--stdout` is a preview of the report, not the end of the run.
+    rmSync(activeOrder(cwd), { force: true });
+
     console.log(relShared(args.slug, "REPORT.md"));
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shapeup-sdlc",
-  "version": "3.1.0",
+  "version": "3.1.2",
   "description": "Shape Up for coding agents \u2014 with gates the agent can't talk its way past. Harness for Claude Code.",
   "bin": {
     "shapeup-sdlc": "bin/init.mjs"

package/skills/spec-evaluator/SKILL.md

@@ -37,7 +37,7 @@ Invoked as `--order <path>`. Fields you may rely on (absent = unknown, never inf
 | `payload.feature` | Feature slug — scopes the probe and names the report |
 | `payload.dimensions[]` | The active dimension set (the caller resolved precedence). Absent → `[spec-conformance]` + the auto-enable rules below |
 | `payload.run_cmd` | How to start the running app. Absent standalone → ask; absent orchestrated → ESCALATE, do not guess |
-| `payload.t0_artifacts[]` | Per-scope T0 verdict paths for this round (scoped specs). An artifact listed but missing/red on disk, or a scoped spec with none listed → the round is NOT gradeable: return `status: failed` naming the scope — a structural precondition, not a criterion |
+| `payload.t0_artifacts[]` | Per-scope T0 verdict paths for this round (scoped specs), compiled from each scope's green verdict. An artifact listed but missing/red on disk, or a scoped spec with none listed → the round is NOT gradeable: return `status: failed` with the reason, naming the scope, as your FIRST deviation — a structural precondition, not a criterion |
 | `payload.browser` | `cli` (default, ~4x cheaper) \| `mcp` \| `none` |
 | `payload.tasks[]` | Traceability only (which UCs a task claims): NEVER a grading source — the committed UC text is the criterion, a paraphrase mismatch is a finding |
 | `substrate.allowed` | Your only write surface: `.shapeup/<slug>/evaluation/**` (the report + evidence) |

package/skills/tech-lead/SKILL.md

@@ -68,11 +68,11 @@ check the lane:
   `.shapeup/<slug>/run-args.json` before launching**, fresh on every launch and relaunch: the flags
   reach the workflow as a value in memory, so it is the run's only evidence of what it was launched
   with, and a run that cannot state its own configuration cannot have a claim about it checked.
-  Then launch the run script with the **`Workflow` tool**:
+  Then launch with the **`Workflow` tool** — naming `init run`'s staged copy, never the install path:
 
 ```
 Workflow({
-  scriptPath: "${CLAUDE_PLUGIN_ROOT}/skills/tech-lead/workflows/shapeup-run.js",
+  scriptPath: ".shapeup/workflows/shapeup-run.js",
   args: <the RunArgs object>
 })
 ```
@@ -91,6 +91,12 @@ launch prompts for approval once per session and the unattended lane is unavaila
 comes back "requires approval" in a headless session, stop and say so — do not hand-build the
 feature instead.
 
+**Why a project-local `scriptPath`.** The tool loads a script only from a directory the session may
+already read, and the plugin installs outside your project, so the shipped path is refused before the
+run begins — no permission rule repairs it. `init run` re-copies the scripts to `.shapeup/workflows/`
+on every open, never on a relaunch, so a run finishes on the orchestrator it started with. If staging
+failed, launch from the install path and have the operator `/add-dir` the plugin directory.
+
 ## Step 3 — the pause protocol: branch on `RunReturn.status`
 
 | `status` | What the workflow is telling you | What you do |

package/skills/tech-lead/references/protocol.md

@@ -465,7 +465,9 @@ Read back: the stdout JSON — {path, sha256, trial, overall, regression, score,
 ## 4. EVAL → spec-evaluator (once per round)
 ```
 compile-order --operation evaluate --slug <slug> --worker spec-evaluator --round <r>
-  --payload '{"dimensions": ["spec-conformance"], "run_cmd": "<cmd>", "t0_artifacts": [...]}'
+  --payload '{"dimensions": ["spec-conformance"], "run_cmd": "<cmd>"}'
+  t0_artifacts is compiled from each scope's green T0 verdict for round <r> — pass it only to
+  override. A scope with no green verdict is named on stderr: the judge has nothing to cite for it.
 Invoke via Agent (model: eval), ONCE, after GATE L2:
   Skill(shapeup-sdlc-plugin:spec-evaluator) --order <path>
 Effect: one feature-level pass over the running app against all AC + Done-when; writes
@@ -473,6 +475,8 @@ Effect: one feature-level pass over the running app against all AC + Done-when;
         verdicts, refuted boxes, T0 citations). It touches NO task file and NO board.
 ingest-result <results/evaluate-r<r>.json>: appends the .verdicts JSONL ledger, un-ticks the
         refuted AC boxes, sets eval_verdict frontmatter — the judge returns data, ingest writes.
+        A verdict on a scoped spec that cites no T0 artifact is refused and the round stays
+        open: re-dispatch the evaluator, do not advance the round.
 Read back: EVAL-FEATURE-<slug>.md → verdict (pass|fail) + the bug list (each bug has
         task ref, severity, file:line, expected vs actual).
 ```

package/skills/tech-lead/schemas/domain.schema.json

@@ -2512,7 +2512,7 @@
           "items": {
             "type": "integer"
           },
-          "description": "Round numbers with an evaluate-r<n>.json result — the resumed run's round counter starts one past the maximum."
+          "description": "Round numbers whose evaluate-r<n>.json holds a verdict the run may act on (PASS/FAIL, citing T0 artifacts when the spec is scoped) — the resumed run's round counter starts one past the maximum. A refused or uncited round is not done: the relaunch re-enters it."
         },
         "next_phase": {
           "type": "string",

package/skills/tech-lead/workflows/shapeup-run.js

@@ -560,6 +560,10 @@ const EVAL_VERDICT = {
     bug_count: nullable("integer"),
     report_path: nullable("string"),
     round: { type: "integer" },
+    // Why the round holds no verdict it may act on — the evaluator's own first deviation when it
+    // refused, or what is structurally wrong with the verdict it returned. Null when `ok`.
+    status: nullable("string"),
+    reason: nullable("string"),
   },
   required: ["ok", "round"],
 };
@@ -1358,14 +1362,22 @@ while (verdict !== "pass" && round <= maxRounds) {
     const e = await worker({
       skill: "spec-evaluator", operation: "evaluate", schema: EVAL, phase: "Eval", label: `eval:r${round}`,
       model: evalModel, round,
+      // No `t0_artifacts` here, deliberately: `harness compile` derives them from the round's green
+      // T0 verdicts on disk, for every lane — this script could only name paths it was told about.
       payload: { dimensions: evalDims, run_cmd: rs.run_cmd, round },
-      extra: "Evaluate the running feature against every acceptance criterion and Done-when. One feature-level pass; cite the T0 artifact you re-hash yourself.",
+      extra: "Evaluate the running feature against every acceptance criterion and Done-when. One feature-level pass; cite every artifact the order lists under t0_artifacts, re-hashing each yourself.",
     });
     if (e.__failed) return diedAt("L3", e);
     // The pass/fail branch is decided from the WorkResult on disk, not from the dispatching
     // agent's own summary of it (`e.overall`) — see EVAL_VERDICT's comment for why.
     const ev = await query(`probe eval --slug ${slug} --round ${round}`, EVAL_VERDICT, "Eval", `verdict:r${round}`);
-    if (!ev || !ev.ok || !ev.overall) return diedAt("L3", nullFail(`verdict:r${round}`));
+    if (!ev) return diedAt("L3", nullFail(`verdict:r${round}`));
+    // A round with no verdict to act on is NOT a dead worker. An evaluator that refused the round
+    // wrote a result saying why, and `probe eval` carries it as `reason`; reported as "died after
+    // retries", the one sentence naming the cause stayed in a file nobody was pointed at.
+    if (!ev.ok || !ev.overall) {
+      return diedAt("L3", { __failed: `verdict:r${round}: no verdict this round can act on — ${ev.reason || `status ${ev.status || "unknown"}`}` });
+    }
     verdict = ev.overall === "PASS" ? "pass" : "fail";
     findings = e.findings || [];
   }