shapeup-sdlc 3.10.0 → 3.12.0

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "shapeup-sdlc-plugin",
   "displayName": "ShapeUp SDLC Plugin",
-  "version": "3.10.0",
+  "version": "3.12.0",
   "description": "Shape Up SDLC harness for Claude Code: shaping, intake, orient, scope-mapping, building (T0-verified, sandboxed, scope-contracted), evaluation and QA skills orchestrated by a tech-lead.",
   "author": {
     "name": "Liberty Nguyen",

package/AGENTS.md

@@ -13,7 +13,7 @@ Skills and commands are named short throughout this file; every one of them reso
 - **The single writer is asked, never assumed.** A dispatch's result is applied by exactly one act — the ingest step — and that act leaves a leg row. Every phase post-condition and every settled build scope asks the leg ledger whether the row exists before any verdict on the phase or the scope, whatever the worker reported: a result on disk that nothing applied is ingested there if the scope is green, and otherwise named at the close as `unapplied_results=N`, never folded into "not green". A round that ends with nothing green names `breaker=none` and `stalled=no_green` unless the attested attempt census says a scope tripped — the close cannot name a breaker the census denies. The run graph carries a `Leg` node with an `INGESTED` edge from its `Result`, and the export a `leg` table, so "which results were never read" is one query.
 - GATE L2 is advisory — warns when EVAL runs over unfinished tasks, permits the call (per-machine board, operator asked; ADR-0001) — a signal, not a bug.
 - Sign-off is a file: each gate resolves from the answer set (`ci`/`guarded`/`interactive`) — cross, stop for the PO, or abort; the decision's source is ledgered.
-- **Every ending a run does not come back from records a close** — its status, its cause and its timestamp — derived from the ending itself rather than from a hand-kept pair, so an ending nobody enumerated cannot silently record nothing. The same close derives the ledger's verdict, its round count and its Rounds and Decisions tables from the run's own records — the ones the export reads — so the file a teammate opens first cannot contradict its own close line. A breaker trip that routes to GATE H closes the run as `escalated`, carrying the breaker in its cause; a pause records no close **by design**, because a relaunch resumes it.
+- **Every ending a run does not come back from records a close** — its status, its cause and its timestamp — derived from the ending itself rather than from a hand-kept pair, so an ending nobody enumerated cannot silently record nothing. The same close derives the ledger's verdict, its round count and its Rounds and Decisions tables from the run's own records — the ones the export reads — so the file a teammate opens first cannot contradict its own close line. A breaker trip that routes to GATE H closes the run as `escalated`, carrying the breaker in its cause; a pause records no close **by design**, because a relaunch resumes it. A relaunch that resumes a run which *did* close reopens it on the record: the earlier close is kept under `prior_closes`, the close fields clear, and the run's next ending is recorded as its own — so a run that aborted, was resumed and then shipped reads `shipped` with the abort beside it, never an abort under a `shipped` status. Opening a run over one that closed says it is closed, not open.
 - **Your scope cut decides your concurrency, not the dial.** Two scopes that both declare a write to one path never build at the same time: `shared` substrate is the sanctioned escape from disjointness, and an edit is read-modify-write, so concurrent writers silently drop each other's work. An entry point listed as writable by five scopes therefore builds five scopes one at a time whatever `--parallel-scopes` says. The run states the ceiling its contracts actually permit before dispatching anything, as a BUILD-order line — a peak below that ceiling is a dispatch problem, a ceiling below the dial is a scope-cut problem, and only the second is fixable by re-cutting. The fix is a cut where exactly one scope owns each entry point. Note the ceiling is narrated, not gated: it does not travel in the ⏸ L1b block, so an unattended run carries it only in its log.
 - The build+eval loop breaks only three ways ✦: EVAL PASS → QA → Ship; outer `round_budget` exhausted; opt-in `wall_clock_budget_s` tripped (the wall-clock axis event counters miss). Budget trips route to GATE H — ship what's green, never kill the run from outside. A scope exhausting its per-scope `attempt_budget` (T0 attempts) queues a GATE H proposal, never blocks the round. **An attempt is spent only when the attested channels say so** — a dispatch receipt, plus a leg row or a WorkResult. A compiled order and a T0 verdict are both writable by the scope being judged, so neither counts on its own, and an attempt still in flight holds the breaker open rather than tripping it. Opening the next attempt over an unanswered one is refused outright, because grading a tree the previous attempt may still be writing spends a budget on work nobody did.
 
@@ -41,7 +41,7 @@ Betting Table: PO decides; rejected pitches loop back to raw idea.
 
 ✦ = requires scope contracts (`shapeup/<slug>/scopes/*.md`); ✚ = requires the spine artifacts (`requirements.md`, `wiring-map.md`, `project-profile.md`). Traceability stays advisory until `covers:` is populated. Absent artifact ⇒ arm skipped (non-regression).
 
-✧ **Two refusals, and they answer different questions.** Opening a run refuses outright when the worker skills are not on disk — the roster comes from the schema that defines it, so it cannot drift from a hand-kept list. That alone passes green on the two states that actually happen (installed but disabled, or a different version loaded), so the run's first act is one live canary dispatch, and the evidence is the hook layer's rather than the sub-agent's account of it. A run that cannot reach its workers stops before it spends anything, instead of reporting phases complete while none of the shipped craft was applied.
+✧ **Two refusals, and they answer different questions.** Opening a run refuses outright when the worker skills are not on disk — the roster comes from the schema that defines it, so it cannot drift from a hand-kept list. That alone passes green on the two states that actually happen (installed but disabled, or a different version loaded), so the run's first act is one live canary dispatch, and the evidence is the hook layer's rather than the sub-agent's account of it. A run that cannot reach its workers stops before it spends anything, instead of reporting phases complete while none of the shipped craft was applied. The same Preflight then runs the profile's `build_probe` and `launch_probe` once, from a sub-agent through the session's own grant, and writes nothing: a missing package install, a probe outside the grant or an absent device is reported before planning is paid for, not at the first round gate. It warns rather than refuses — a baseline can be red for a reason the feature is meant to fix — and whether a permission exists is judged by that run, never by reading a settings file.
 
 
 ### QA Edge Hunt (`/qa-edge-hunter`, post-PASS, pre-ship)

package/SECURITY.md

@@ -58,7 +58,10 @@ test against machines you don't own.
 6. **Every hook decision is recorded.** `hooks/lib/decision.mjs` is the only exit path a hook
    has, so allow, deny, block and error each leave a row in `.shapeup/decisions.jsonl`. An
    inert hook and a permitting hook are therefore distinguishable — which matters, because
-   "exit 0, no output" is what both used to look like.
+   "exit 0, no output" is what both used to look like. A permitted Bash call's row names the
+   programs the command runs, by basename (`hdc`, `curl | jq`) — never the arguments, which is
+   where a secret, a token or a private path would be. A denied call's row keeps the first 200
+   characters of the command, as it always has, because a denial must be reviewable.
 
 If you find any of these to be false, that is a vulnerability — report it as claim #ⁿ.
 

package/hooks/safety-spine.mjs

@@ -96,6 +96,32 @@ function tokens(segment) {
     .map((t) => t.replace(/^['"]|['"]$/g, ""));
 }
 
+/**
+ * The programs a command runs — the executable of each `&&`/`;`/`|` segment, by basename, and
+ * nothing else.
+ *
+ * WHY AN ALLOW ROW NAMES THE PROGRAM. Every permitted Bash call used to be recorded with no subject,
+ * so "did this worker ever call the device tool, and was it refused?" had no answer in the ledger:
+ * a sub-agent that never tried and one whose call was stopped above this hook left the same rows.
+ * The program names answer it. Arguments are never recorded — they are where a secret, a token or a
+ * private path would be — and a basename says which tool ran without saying where it lives.
+ *
+ * @param {string} command - The raw Bash command.
+ * @returns {(string|null)} Program basenames joined by " | ", in order, duplicates kept; null when
+ *   no segment yields one.
+ */
+export function programsOf(command) {
+  if (!command || typeof command !== "string") return null;
+  const names = [];
+  for (const segment of command.split(/\s*(?:\|\||&&|;|\||\n)\s*/).filter(Boolean)) {
+    const first = commandTokens(segment)[0];
+    if (!first) continue;
+    const base = first.replace(/^["']|["']$/g, "").split("/").pop();
+    if (base && !/^[({]$/.test(base)) names.push(base.slice(0, 64));
+  }
+  return names.length ? names.join(" | ") : null;
+}
+
 /** Strip leading env assignments and privilege/no-op wrappers to find the real command. */
 function commandTokens(segment) {
   const ts = tokens(segment);
@@ -217,8 +243,9 @@ async function main() {
   const raw = await readStdin();
   let p;
   /** Fail-open, with the reason on the record (hooks/lib/decision.mjs). */
-  const defer = (reason, rule) => settle({
+  const defer = (reason, rule, subject = null) => settle({
     verdict: "allow", event: "PreToolUse", tool: p?.tool_name ?? null, cwd: p?.cwd, reason, rule,
+    ...(subject ? { subject } : {}),
   });
   try { p = JSON.parse(raw || "{}"); }
   catch (e) { settle({ verdict: "error", event: "PreToolUse", reason: `unparseable payload: ${e.message}` }); }
@@ -258,7 +285,7 @@ async function main() {
   if (p.tool_name === "Bash") {
     const command = p.tool_input?.command || "";
     const verdict = classifyCommand(command, overrides);
-    if (!verdict.deny) defer("command matched no destructive rule — inspected and permitted", "bash-clean");
+    if (!verdict.deny) defer("command matched no destructive rule — inspected and permitted", "bash-clean", programsOf(command));
     if (commandOverridden(command, overrides)) {
       // Exercised override: allowed, but never invisible.
       logPathology(metricsPath, {

package/kernel/init/run.mjs

@@ -75,12 +75,12 @@ import { join, dirname, resolve, relative, sep } from "node:path";
 import { createHash } from "node:crypto";
 import { decideLane, treeSize } from "./fit.mjs";
 import { runArgs } from "../lib/argv.mjs";
-import { uncoerce } from "../lib/contract.mjs";
+import { uncoerce, splitFrontmatter } from "../lib/contract.mjs";
 import { deriveSnapshot } from "../reduce/snapshot.mjs";
 import { mintRunId } from "../lib/paths.mjs";
 import {
   localRoot, activeScope, activeOrder, globLocal, globShared, ordersDir, resultsDir,
-  workflowsStage, globWorkflowsStage, sharedRoot, shapingDir, breadboard as stagedBreadboard,
+  workflowsStage, globWorkflowsStage, sharedRoot, shapingDir, breadboard as stagedBreadboard, harnessRun,
 } from "../lib/paths.mjs";
 import { parseBreadboard, hasBreadboardTables, idCounts } from "../lib/breadboard.mjs";
 import { resolveWorkers } from "../verify/skills.mjs";
@@ -603,8 +603,22 @@ export function cli(rawArgv) {
   if (existsSync(receiptPath) && !args.force) {
     let resume = null;
     try { resume = deriveSnapshot(cwd); } catch { /* a broken run must still produce the refusal */ }
+    // A receipt says a run EXISTS, not that it is open: a terminal close leaves the receipt in place.
+    // Calling a closed run "open" hid the one fact that changes what resuming it means.
+    let closed = null;
+    try {
+      const fm = splitFrontmatter(readFileSync(harnessRun(cwd, slug), "utf8")).meta || {};
+      if (fm.closed_status && fm.closed_status !== "~") closed = { status: fm.closed_status, at: fm.closed_at, cause: fm.close_cause };
+    } catch { /* no ledger — the receipt alone decides, as before */ }
     fail(3, [
-      `✋ init-run: a run is ALREADY OPEN — receipt exists at ${receiptPath}.`,
+      closed
+        ? `✋ init-run: this run is CLOSED as "${closed.status}" at ${closed.at ?? "?"} — receipt exists at ${receiptPath}.`
+        : `✋ init-run: a run is ALREADY OPEN — receipt exists at ${receiptPath}.`,
+      ...(closed ? [
+        `   Its close: ${closed.cause && closed.cause !== "~" ? closed.cause : "no cause recorded"}`,
+        "   Resuming it REOPENS it: the first phase that runs moves the ledger off the closed state, keeps",
+        "   this close under prior_closes, and the run's next terminal close is recorded as its own.",
+      ] : []),
       "",
       "Do NOT re-initialise and do NOT restart the pipeline from phase 1. Re-opening would discard",
       "the round history the circuit breaker counts against, and the board, ledger and receipt below",

package/kernel/probe/digest.mjs

@@ -33,6 +33,12 @@ const PATTERNS = [
   // ("ERROR in the build pipeline", "ERROR in test suite failed to run") is left unmatched
   // instead of handing back a fabricated file.
   { re: /^(?:ERROR|WARNING)\s+in\s+(\.{1,2}\/[^\s:]*|[^\s:]+\.[A-Za-z0-9]{1,10})\b/i, kind: "compiler-diagnostic" },
+  // A test that FAILED BY NAME, with no file:line: "FAIL TS-05-05 step 4: no text 'Bread' on screen"
+  // or jest's "FAIL src/cart.test.js". Runners that drive an app from outside it (a device flow, an
+  // end-to-end script) report a case this way and nothing else, and the line is the whole signal —
+  // dropping it handed the next attempt an empty error list over a red fixture. The name is kept as
+  // the file only when it looks like a path; an id like TS-05-05 is not one.
+  { re: /^(?:FAIL|FAILED)\s+(\S+)(?:\s+.*)?$/, kind: "named-test-failure" },
   // Generic "Error: message" line followed later by a stack — capture the message alone.
   { re: /^\s*(?:Error|TypeError|ReferenceError|AssertionError)\s*:\s*(.+)$/, kind: "error-message" },
 ];
@@ -71,8 +77,9 @@ export function digest(rawText) {
         pendingMessage = coreMessage(m[1]);
         continue; // wait for the stack frame that follows to get a file:line
       }
-      const file = m[1]?.trim();
-      const lineNo = m[2] ? Number(m[2]) : null;
+      const named = kind === "named-test-failure";
+      const file = named ? (/[\\/]|\.[A-Za-z0-9]{1,10}$/.test(m[1]) ? m[1] : null) : m[1]?.trim();
+      const lineNo = !named && m[2] ? Number(m[2]) : null;
       triples.push({
         file: file || null,
         line: lineNo,

package/kernel/probe/resume.mjs

@@ -557,14 +557,53 @@ export function setRunStatus(cwd, slug, status) {
   if (!/^status:.*$/m.test(body)) {
     return { ok: false, path: p, status, reason: `harness-run.md carries no "status:" line to replace — the ledger's frontmatter is malformed (references/protocol.md)` };
   }
+  // A CLOSED RUN THAT MOVES AGAIN IS REOPENED, AND SAYS SO. A relaunch resumes the same run by
+  // design, so a run closed `aborted` can be carried on to a later ship. Its close was written once
+  // and the once-only guard in closeRun refuses to flip an outcome, which is right for a close
+  // nobody took back — but here somebody did, by resuming it. Leaving the old close in place made
+  // the ledger read `status: shipped` over `closed_status: aborted`, and every reader of the close
+  // reported an abort for a run that shipped. The move to a live status is the one act that takes a
+  // close back, so it is recorded here: the prior close joins `prior_closes`, the three close
+  // fields return to `~`, and the next terminal close is written as the run's own. Nothing is lost
+  // and nothing is flipped silently — the abort stays on the record beside the outcome that
+  // replaced it.
+  const fm = parseFrontmatter(body);
+  const priorStatus = fm.closed_status && fm.closed_status !== "~" ? String(fm.closed_status) : null;
+  let next = body.replace(/^status:.*$/m, `status: ${status}`);
+  let reopened = null;
+  if (priorStatus && TERMINAL_STATUSES.includes(priorStatus) && !TERMINAL_STATUSES.includes(status)) {
+    const priorAt = fm.closed_at && fm.closed_at !== "~" ? String(fm.closed_at) : null;
+    const priorCause = fm.close_cause && fm.close_cause !== "~" ? String(fm.close_cause) : null;
+    const reopenedAt = new Date().toISOString();
+    reopened = { closed_status: priorStatus, closed_at: priorAt, cause: priorCause, reopened_at: reopenedAt };
+    const entry = `${priorStatus} at ${priorAt ?? "?"} (reopened ${reopenedAt}): ${priorCause ?? "no cause recorded"}`;
+    const history = fm.prior_closes && fm.prior_closes !== "~" ? `${fm.prior_closes} | ${entry}` : entry;
+    const historyLine = `prior_closes: ${uncoerce(history)}`;
+    next = next
+      .replace(/^closed_at:.*$/m, "closed_at: ~")
+      .replace(/^closed_status:.*$/m, "closed_status: ~")
+      .replace(/^close_cause:.*$/m, "close_cause: ~");
+    next = /^prior_closes:.*$/m.test(next)
+      ? next.replace(/^prior_closes:.*$/m, historyLine)
+      : next.replace(/^closed_at:.*$/m, (m) => `${m}\n${historyLine}`);
+  }
   try {
-    writeFileSync(p, body.replace(/^status:.*$/m, `status: ${status}`));
+    writeFileSync(p, next);
   } catch (e) {
     return { ok: false, path: p, status, reason: `could not write the ledger: ${e.message}` };
   }
-  const after = parseFrontmatter(readFileSync(p, "utf8")).status;
-  if (after !== status) {
-    return { ok: false, path: p, status, reason: `wrote "status: ${status}" but the ledger reads "${after}" — the write did not take` };
+  const after = parseFrontmatter(readFileSync(p, "utf8"));
+  if (after.status !== status) {
+    return { ok: false, path: p, status, reason: `wrote "status: ${status}" but the ledger reads "${after.status}" — the write did not take` };
+  }
+  if (reopened) {
+    // The breadcrumb names a run that is OVER; this one no longer is. Removed only when it names
+    // this run, so another run's close is left alone.
+    try {
+      const crumb = JSON.parse(readFileSync(lastRun(cwd), "utf8"));
+      if (crumb?.run_id && crumb.run_id === readRunId(cwd, slug)) rmSync(lastRun(cwd), { force: true });
+    } catch { /* no breadcrumb, or unreadable — nothing to retire */ }
+    return { ok: true, path: p, status, reopened, decision: "reopened" };
   }
   return { ok: true, path: p, status };
 }

package/kernel/reduce/board.mjs

@@ -293,7 +293,15 @@ export function derive({ cwd, slug, appetiteHours = null }) {
 }
 
 /**
- * Persist derived `unlocks` into task frontmatter — the ONE write this script makes.
+ * Persist derived `unlocks` into task frontmatter — and give a task with NO status the one status a
+ * task on a freshly written board can have.
+ *
+ * `unlocks` is derived, so writing it is safe by construction. `status: todo` is the other field a
+ * board is written with, and it is added only where the line is absent — an existing status is never
+ * touched, so a task in progress or done is never reset. A regenerated board once came back with
+ * `depends_on` and neither field on every task; spec-lint failed all of them at L1b and an unattended
+ * run had nobody to add a line the worker's own template already prescribes.
+ *
  * @param {{_tasks:Array<object>, unlocks:Object<string,string[]>}} report - A {@link derive} report.
  * @returns {string[]} The ids of task files actually rewritten (unchanged files are skipped).
  *   Side effect: writes those task files.
@@ -305,7 +313,8 @@ export function writeUnlocks(report) {
     const fmMatch = t.body.match(/^---\r?\n([\s\S]*?)\r?\n---/);
     if (!fmMatch) continue;
     const fm = fmMatch[1];
-    const next = /^unlocks:.*$/m.test(fm) ? fm.replace(/^unlocks:.*$/m, `unlocks: ${want}`) : `${fm}\nunlocks: ${want}`;
+    let next = /^unlocks:.*$/m.test(fm) ? fm.replace(/^unlocks:.*$/m, `unlocks: ${want}`) : `${fm}\nunlocks: ${want}`;
+    if (!/^status:/m.test(next)) next = `${next}\nstatus: todo`;
     if (next !== fm) {
       writeFileSync(t.file, t.body.replace(fm, next));
       written.push(t.id);

package/kernel/reduce/ship.mjs

@@ -32,7 +32,7 @@ import { runArgs } from "../lib/argv.mjs";
 import {
   report as reportPath, tasksDir, verdictsDir, trials, evaluationDir, qaDir,
   roundLedger, discoveryLedger, receipt as receiptPath, harnessRun, relShared,
-  activeOrder, runArgsPath, readReceipt, runIdFromReceipt,
+  activeOrder, runArgsPath, readReceipt, runIdFromReceipt, hammerCensus,
 } from "../lib/paths.mjs";
 import { readTrials } from "../verify/t0.mjs";
 import { ratchetReport } from "../probe/stats.mjs";
@@ -191,6 +191,31 @@ export function section(md, heading) {
   return body || null;
 }
 
+/**
+ * The report's opening line when the ship is not a passing one — null for a PASS.
+ *
+ * @param {string} verdict - The run's final verdict (`PASS`, `FAIL`, `not-evaluated`, …).
+ * @param {({verdict?:string, cut_list?:Array}|null)} census - GATE H's census as data, or null.
+ * @returns {(string|null)} One markdown line naming the verdict, and the cut list that cleared it
+ *   when a census is on record; null when the verdict is PASS.
+ */
+export function shipHeadline(verdict, census) {
+  if (verdict === "PASS") return null;
+  const cuts = Array.isArray(census?.cut_list) ? census.cut_list.length : null;
+  const why = census
+    ? `GATE H's baseline comparison cleared it${census.verdict ? ` (census: ${census.verdict})` : ""}` +
+      (cuts != null ? ` with ${cuts} item${cuts === 1 ? "" : "s"} cut` : "")
+    : "no GATE H census was on record when it shipped";
+  // A FAIL is a judgement that some criterion failed; anything else here means no judgement was
+  // made at all, and the line must not claim criteria failed that nobody graded.
+  if (verdict === "FAIL") {
+    return `> **Shipped with a FAIL verdict.** Not every criterion passed; ${why}. Read the failed ` +
+      "criteria and the cut list below before treating this feature as done.";
+  }
+  return `> **Shipped without a passing verdict (${verdict}).** No criterion was graded as passing; ${why}. ` +
+    "Nothing below is evidence that this feature works.";
+}
+
 /**
  * Assemble the report. Pure given its inputs, so the structural tests can assert its shape
  * without a filesystem.
@@ -201,6 +226,7 @@ export function buildReport(facts) {
   const {
     slug, at, verdict, qa, rounds, roundsJudged, board, t0, artifacts, ratchet,
     evalCriteria, evalBugs, qaFindings, decisions, discovered, intakeSha, leftovers, requirements,
+    census = null,
   } = facts;
 
   const L = [];
@@ -208,6 +234,12 @@ export function buildReport(facts) {
     `verdict: ${verdict}`, `rounds_used: ${rounds ?? "~"}`, `rounds_judged: ${roundsJudged ?? "~"}`, `qa: ${qa}`,
     `intake_sha256: ${intakeSha ?? "~"}`, "---", "");
   L.push(`# ${slug} — ship report`, "");
+  // A SHIP IS NOT A PASS, AND THE FIRST LINE SAYS WHICH ONE THIS IS. A run whose verdict FAILed can
+  // still ship — GATE H compares against the baseline, not the ideal, and a cut list can clear it —
+  // and its status then reads `shipped` like any other. The verdict sat in a table cell below the
+  // fold, so a reader who stopped at the title took a shipped FAIL for a passing build.
+  const headline = shipHeadline(verdict, census);
+  if (headline) L.push(headline, "");
   L.push("Frozen at GATE L4. Every figure below is derived from run artifacts on disk — the trial",
     "ledger, the verdict artifacts, the board — never from a summary of the run.", "");
 
@@ -361,6 +393,7 @@ export function generate({ cwd, slug, verdict, qa }) {
     slug,
     at: today(),
     verdict: verdict || run.final_verdict || "not-evaluated",
+    census: (() => { try { return JSON.parse(readIf(hammerCensus(cwd, slug)) || "null"); } catch { return null; } })(),
     qa: qa || (huntReport ? "run" : "skipped"),
     rounds: derivedRounds.rounds_used,
     roundsJudged: derivedRounds.rounds_judged,

package/kernel/verify/build.mjs

@@ -331,13 +331,40 @@ export function writeRoundBuild(cwd, slug, round, body) {
 }
 
 export const ARGV_SPEC = {
-  usage: "harness.mjs verify build --slug <slug> --round <N> [--cwd <dir>]",
+  usage: "harness.mjs verify build --slug <slug> (--round <N> | --preflight) [--cwd <dir>]",
   _: { arity: 0, max: 0, name: "(no positional operands)" },
   slug: { type: "str", required: true },
-  round: { type: "int", min: 1, required: true },
+  round: { type: "int", min: 1 },
+  preflight: { type: "flag" },
   cwd: { type: "path" },
 };
 
+/**
+ * Classify a preflight: the declared steps run, nothing is written.
+ *
+ * WHY A PREFLIGHT, AND WHY IT WRITES NOTHING. Every environment fault a run has died of was
+ * discoverable in seconds and discovered after most of an hour: a checkout missing its package
+ * install or its local SDK pointer fails the build in about a second, a probe outside the session's
+ * grant is refused, a device that is not attached leaves every `[ui]` row ungraded. Each surfaced
+ * only at the first round gate, after planning had been paid for. The same commands, run once before
+ * anything is dispatched, turn that into one report up front. It is not a round, so it writes no
+ * round artifact: a red preflight read back as round 0's gate would reach round 1's orders as bugs,
+ * handing a feature worker an environment fault it cannot fix.
+ *
+ * A step that exits 2 is a probe that COULD NOT RUN — the fixture convention, e.g. no device
+ * attached — which is a gap in the environment rather than a red build, and is reported apart.
+ *
+ * @param {{overall:string, steps:Array<{kind:string, exit?:number, pass?:boolean, skipped?:boolean}>}} gate
+ *   What {@link runGate} returned.
+ * @returns {{status:("green"|"red"|"cannot-run"), failed_step:(string|null)}} `cannot-run` when the
+ *   first failing step exited 2.
+ */
+export function classifyPreflight(gate) {
+  const failing = gate.steps.find((s) => !s.skipped && !s.pass);
+  if (!failing) return { status: "green", failed_step: null };
+  return { status: failing.exit === 2 ? "cannot-run" : "red", failed_step: failing.kind };
+}
+
 /**
  * Run the round build gate and write its artifact.
  *
@@ -348,9 +375,29 @@ export async function cli(rawArgv) {
   const args = runArgs(ARGV_SPEC, rawArgv);
   const cwd = resolve(args.cwd || process.cwd());
   const { slug, round } = args;
+  if (Boolean(args.preflight) === (round != null)) {
+    console.error("verify build: pass exactly one of --round <N> (the round gate, writes its artifact) or --preflight (runs the same steps, writes nothing)");
+    process.exit(2);
+  }
   const { archetype, steps, warnings } = declaredSteps(cwd, slug);
   for (const w of warnings) console.error(`build-gate: ${w}`);
 
+  if (args.preflight) {
+    if (steps.length === 0) {
+      console.log(JSON.stringify({ preflight: true, status: "undeclared", steps: [], warnings }, null, 2));
+      process.exit(3);
+    }
+    const gate = runGate(steps, cwd);
+    const { status, failed_step } = classifyPreflight(gate);
+    const failing = gate.steps.find((s) => s.kind === failed_step);
+    console.log(JSON.stringify({
+      preflight: true, status, archetype, warnings,
+      steps: gate.steps.map((s) => (s.skipped ? { kind: s.kind, skipped: true } : { kind: s.kind, exit: s.exit, pass: s.pass })),
+      ...(failing ? { failed_step, stderr_tail: `${failing.stdout_tail || ""}\n${failing.stderr_tail || ""}`.trim().slice(-1200) } : {}),
+    }, null, 2));
+    process.exit(status === "green" ? 0 : status === "cannot-run" ? 4 : 1);
+  }
+
   if (steps.length === 0) {
     console.log(JSON.stringify({ round, overall: "skipped", steps: [], warnings,
       reason: "nothing declared — no run_cmd in the run ledger, no build_probe or launch_probe in project-profile.md" }, null, 2));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shapeup-sdlc",
-  "version": "3.10.0",
+  "version": "3.12.0",
   "description": "Shape Up for coding agents \u2014 with gates the agent can't talk its way past. Harness for Claude Code.",
   "bin": {
     "shapeup-sdlc": "bin/init.mjs"

package/skills/spec-evaluator/SKILL.md

@@ -83,6 +83,11 @@ Done-when statements; `_index.md` Non-Go list. Which UCs are in scope comes from
   freeze through the judge). Ugly-but-correct PASSes; pretty-but-wrong-`data-state` FAILs.
 - `[data]`: query the DB/storage, capture actual state.
 - Contract work: send real requests, compare field-by-field.
+- **A fixture that names a row is evidence for that row.** When a T0 artifact you cite, or the
+  build gate, carries output that names a Test Surface row by id — `PASS TS-05-05`, or
+  `FAIL TS-05-05 step 4: …` — grade that row on it: a named PASS confirms, a named FAIL is a
+  FAIL whose bug is that line. This is how a device row is evidenced when you cannot drive the
+  app yourself; it is never a reason to skip driving it when you can.
 - No evidence collected = recorded "NO EVIDENCE" → FAILs at verdict.
 
 **VERDICT.**

package/skills/task-executor/SKILL.md

@@ -25,7 +25,7 @@ rely on (anything absent = **unknown**; never invent it):
 | `payload.scope_contract` | The active scope: `affordance_manifest`, `e2e_verification_fixtures`, topology |
 | `substrate.allowed` / `substrate.shared` | The ONLY globs you may write. A needed file outside them → ESCALATE, never a write (a sandbox hook blocks it anyway) |
 | `payload.decisions[]` | Adjudicated answers from prior escalations — binding precedent, apply them |
-| `payload.digested_errors[]` | `{file, line, core_message}` triples from the previous attempt's failed verification — your starting bug list |
+| `payload.digested_errors[]` | `{file, line, core_message}` triples from the previous attempt's failed verification (a test that failed by name with no file:line — `FAIL TS-05-05 step 4: …` — arrives with `file: null` and the whole line as its message) — your starting bug list |
 | `payload.trial_history[]` | Up to 8 prior attempts on this scope, oldest first, CROSSING the round boundary: `{score, status, delta, digest}`. `status: "reverted"` is a change that was tried and made things WORSE — do not re-propose it. `status: "kept"` with a still-red score is the tree you are building ON, not a failure to undo. Absent on the first attempt |
 | `payload.verify.test_cmd` | The command that verifies your work. No test_cmd → command-verifiable ACs still need *some* observable check; say what you used |
 | `payload.kb_rules_path` | Team guidelines (read if the file exists) — steering, never spec; conflict → the AC wins, note it in `deviations` |

package/skills/tech-lead/SKILL.md

@@ -39,9 +39,9 @@ derived RESUME STATE (slug, status, round, board counts) — read it and go stra
 this session's memory. `--force` re-opens deliberately and discards the round history the breaker
 counts.
 
-**If this command comes back "requires approval", stop and say so.** These scripts ship with the
-plugin and need a one-time permission grant (`npx shapeup-sdlc init` writes it). Do not route
-around it, and do not silently hand-build the feature instead.
+**If this command comes back "requires approval", stop and say so** — the scripts need a one-time grant
+(`npx shapeup-sdlc init`); never route around it or hand-build the feature. Know a grant by running the
+command, never by reading `.claude/settings.json` — Preflight runs the project's probes and reports.
 
 **Language gate (delegated to `translator`, not this skill):** before Step 1 opens the run, dispatch
 an Agent (model: exec) calling `Skill(shapeup-sdlc-plugin:translator) --check` on the pitch *and* its

package/skills/tech-lead/references/protocol.md

@@ -477,6 +477,13 @@ Read back: stdout JSON — {overall: green|red, steps[], warnings[], failed_step
         A `mobile` profile with no launch_probe is warned about on stderr every round, and so is
         every scope none of whose fixtures invoke the tool run_cmd builds with — advisory, because a
         green T0 from such fixtures is not evidence the scope compiles.
+Preflight form — the same steps, run once before anything is dispatched, WRITING NOTHING:
+  node "${CLAUDE_PLUGIN_ROOT}/kernel/harness.mjs" verify build --slug <slug> --preflight
+        stdout JSON {preflight: true, status: green|red|cannot-run|undeclared, steps[], failed_step?,
+        stderr_tail?}. Exit 0 green · 1 a step red · 4 a probe could not run (it exited 2 — no
+        device, no artifact) · 3 nothing declared. No round artifact: a red preflight read back as
+        round 0's gate would reach round 1's orders as bugs. The workflow warns on 1 and 4, never
+        aborts.
 Consequences, both mechanical and both read off the artifact, never off this prose:
         red → EVAL is not dispatched this round; `harness compile` turns each failing step into a
               `payload.bugs` entry for round N+1, addressed to the scope whose substrate holds the

package/skills/tech-lead/workflows/shapeup-run.js

@@ -54,7 +54,7 @@ export const meta = {
   name: "shapeup-run",
   description: "BUILD-phase pipeline: ORIENT → ANALYZE → WIRE → MAP SCOPES → rounds of BUILD/EVAL → QA → GATE H → ship. Gates resolve by the kernel's exit code; every dispatch is WorkOrder in / WorkResult out; the fast-forward is derived from artifacts on disk.",
   phases: [
-    { title: "Preflight", detail: "one canary dispatch — can this session resolve a worker skill" },
+    { title: "Preflight", detail: "one canary dispatch — can this session resolve a worker skill; then the project's build and launch probes, run once and recorded nowhere" },
     { title: "Orient" }, { title: "Analyze" }, { title: "Wire" }, { title: "MapScopes" },
     { title: "Build" }, { title: "Eval" }, { title: "Refute" }, { title: "QA" }, { title: "Ship" },
   ],
@@ -1117,6 +1117,11 @@ async function setRunStatus(status, phaseName) {
         `artifacts, not from this field), but the snapshot and the the ship report's census hook will read ` +
         `this run as unfinished.`);
     stateWarnings.push(`status="${status}" did not take: ${why}`);
+  } else if (r.decision === "reopened") {
+    // The ledger now carries the earlier close under `prior_closes`; say so where a reader of the
+    // run's own log will see it, because resuming a closed run changes what its close will say.
+    log(`RUN STATE — this run had been closed; moving it to "${status}" reopened it. The earlier close is ` +
+        `kept in the ledger under prior_closes, and the run's next terminal close is recorded as its own.`);
   }
 }
 
@@ -1235,6 +1240,33 @@ if (!canary.ok) {
     `(${canary.detail || `exit ${canary.exit_code}`})`));
 }
 
+// ENVIRONMENT CANARY — do the project's own build and launch probes run in THIS session?
+//
+// The skill canary proves the workers resolve; it says nothing about whether the commands the round
+// gate will run can. A missing package install or local SDK pointer fails the build in a second, a
+// probe outside the grant is refused, a device that is not attached leaves every `[ui]` row
+// ungraded — and each used to surface only at the first round gate, after planning was paid for.
+// `verify build --preflight` runs the same declared steps from a sub-agent, through the same grant,
+// and writes nothing. It WARNS rather than aborts: a baseline can be red for a reason the feature is
+// meant to fix, and an unattended run should still say so up front rather than stop.
+//
+// The evidence is this command's exit code. Whether a grant "looks present" in a settings file is
+// not evidence of anything: a grant can arrive by other routes, and one in the file can still be
+// refused above it.
+const envCanary = await cmd(`verify build --slug ${slug} --preflight`, "Preflight", "canary-env");
+if (envCanary.exit_code === 1 || envCanary.exit_code === 4) {
+  const kind = envCanary.exit_code === 4 ? "a probe could not run (exit 2 — typically no device attached, or a missing artifact)" : "a declared step is red";
+  const msg = `ENVIRONMENT — preflight: ${kind}${envCanary.detail ? `: ${envCanary.detail}` : ""}. The same step runs in every ` +
+    `round's build gate, so fix the environment now if it is not the feature's to fix.`;
+  log(msg);
+  stateWarnings.push(msg);
+} else if (envCanary.exit_code !== 0 && envCanary.exit_code !== 3) {
+  const msg = `ENVIRONMENT — preflight did not run (exit ${envCanary.exit_code}${envCanary.detail ? `: ${envCanary.detail}` : ""}); ` +
+    `nothing is known about the build or launch probes until the first round gate.`;
+  log(msg);
+  stateWarnings.push(msg);
+}
+
 // GATE L0.9b's launch record must exist before anything past Preflight dispatches; see
 // requireLaunchRecord()'s own banner for why this cannot be left to Step 2's prose alone.
 const launchRecordAbort = await requireLaunchRecord();
@@ -1374,6 +1406,10 @@ if (!rs.has_spec_tree) {
            "carrying its `(covers: REQ-…)` clause — and write nothing under the spec folder.",
   });
   if (b.__failed) return await withWarnings(diedAt("ANALYZE", b));
+  // The board a worker writes carries `depends_on`; its inverse (`unlocks`) and a new task's
+  // `status: todo` are mechanical, so the kernel writes them rather than trusting every regeneration
+  // to remember — a board that came back without both failed spec-lint on every task at L1b.
+  await advisory(`reduce board --slug ${slug} --write`, "Analyze", "board:derive");
   const post = await requirePhase("ANALYZE", "analyze", "Analyze", "board");
   if (post) return await withWarnings(post);
   await advisory(`reduce graph --slug ${slug}`, "Analyze", "graph:board");