shapeup-sdlc 3.12.0 → 3.14.0

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "shapeup-sdlc-plugin",
   "displayName": "ShapeUp SDLC Plugin",
-  "version": "3.12.0",
+  "version": "3.14.0",
   "description": "Shape Up SDLC harness for Claude Code: shaping, intake, orient, scope-mapping, building (T0-verified, sandboxed, scope-contracted), evaluation and QA skills orchestrated by a tech-lead.",
   "author": {
     "name": "Liberty Nguyen",

package/AGENTS.md

@@ -37,7 +37,7 @@ Betting Table: PO decides; rejected pitches loop back to raw idea.
 | Map Scopes | ⏸ **L1b** — Board Review (+ substrate disjointness lint) | `/scope-architect` (scope contracts ✦ — sole writer); traceability oracle advisory ✚. A registered requirement that no acceptance criterion grades and no scope claims is **red** here, and L1b prints the `REQ → AC` table: the two ways out are an AC carrying `(covers: REQ-…)` or the PO marking the clause `CUT (PO-approved)`. Red only where the plan is still cheap to change — after L1b nobody re-reads the pitch |
 | Build Vertically | ⏸ **L2** — Board 100% ✅ + T0-green ✦ | per dispatch: compile order → `/task-executor` (--order) → ingest result; T0-verified per attempt (fixtures + DB probe ✦), substrate-sandboxed ✦. Scopes build **concurrently** ✦ — `--parallel-scopes N` caps it (default 4), a scope is released the moment its own dependencies are green, and a scope green in this round is skipped rather than rebuilt. Then the **round build gate** ⚙: the ledger's run command, then the profile's `build_probe` and `launch_probe`, run once per round before EVAL — a red gate ends the round with no verdict and its failing step is compiled into the next round's orders as bugs; a `mobile` profile with no `launch_probe` is warned about every round, so the install/launch risk has an owner |
 | EVAL (once per round) | ⏸ **L3** — Verdict | `/spec-evaluator` (--order), only over a round whose build gate ⚙ is not red: spec- + test-surface-conformance ★, T0 citation ✦; refuted boxes/verdict applied by ingest. The order names the round's build gate artifact and the profile's `launch_probe`, so a `[ui]` row is graded on the app the gate launched rather than recorded as no evidence — a project with no `launch_probe` still gets no on-device grade |
-| FAIL → round r+1 | — | regression rule ★: bugs + full Test Surface of touched UC |
+| FAIL → round r+1 | — | regression rule ★: bugs + full Test Surface of touched UC. Every criterion the verdict graded FAIL reaches the round, whether or not the judge filed a bug for it, addressed to the scope that owns its use case — a round with a FAIL verdict and nothing to fix is how a run stalls. A row whose check the scope rewrote between a failing trial and a passing one is listed for the judge, who reads it against the row before the pass counts |
 
 ✦ = requires scope contracts (`shapeup/<slug>/scopes/*.md`); ✚ = requires the spine artifacts (`requirements.md`, `wiring-map.md`, `project-profile.md`). Traceability stays advisory until `covers:` is populated. Absent artifact ⇒ arm skipped (non-regression).
 
@@ -69,7 +69,7 @@ Everything discovered funnels into `.shapeup/<slug>/discovery/ledger.md` (Orient
 ## Setup & Execution
 
 - Orders/results live in `.shapeup/<slug>/orders|results/`; the envelope schemas ship with the plugin runtime, not with any individual skill, so every worker validates against the same copy.
-- The plugin's run entry points need a one-time permission grant — `npx shapeup-sdlc init` writes it into `.claude/settings.json` (`permissions.allow`); without it a headless run stalls at step one. That grant is necessary, not sufficient: it covers the run's own deterministic entry points, not the generic file edits every worker skill makes constantly, or any command a worker reaches for beyond the grant's own exact shape. A truly unattended run also needs a Claude Code permission mode that covers those (`acceptEdits` at minimum) — the plugin cannot grant that on your behalf.
+- The plugin's run entry points need a one-time permission grant — `npx shapeup-sdlc init` writes it into `.claude/settings.json` (`permissions.allow`); without it a headless run stalls at step one. That grant is necessary, not sufficient: it covers the run's own deterministic entry points, not the generic file edits every worker skill makes constantly, or any command a worker reaches for beyond the grant's own exact shape. A truly unattended run also needs a Claude Code permission mode that covers those (`acceptEdits` at minimum) — the plugin cannot grant that on your behalf. Two facts about how grants reach the run's workers, both measured: a worker dispatched inside a run takes its permissions from the project's settings file, not from flags given to the launching session, so a tool the workers need belongs in `permissions.allow`; and every work order names the plugin's kernel by absolute path, because a command that spells it through a variable is refused in a headless session before any permission rule is read.
 - The grant is necessary but sits under two more layers this plugin cannot reach either. A fresh
   checkout is an **untrusted workspace**, and Claude Code discards the whole permission grant — every
   rule in it, not only this one — until the workspace is trusted; the installer detects that state and

package/kernel/compile.mjs

@@ -37,7 +37,7 @@ import { readRunId, dispatchReceipts, legLedger, readReceipt, receipt } from "./
 // --spec-overridden directory, and the import is the convention-derived default.
 import {
   tasksDir, specDir as defaultSpecDir, roundLedger, trials, verdictsDir, ordersDir,
-  relShared, relLocal, globLocal, globShared, relKnowledgeBase, resultsDir, scopesDir,
+  relShared, relLocal, globLocal, globShared, relKnowledgeBase, resultsDir, scopesDir, localRoot,
 } from "./lib/paths.mjs";
 import { readContract, readAllContracts, tasksForScope, SCOPE_CONTRACT, reqId } from "./lib/contract.mjs";
 import { writeActiveOrder } from "./probe/resume.mjs";
@@ -527,6 +527,57 @@ export function verdictBugs(cwd, slug, round) {
   return v.bugs.filter((b) => !refuted.has(String(b?.id)) && !refuted.has(String(b?.criterion)));
 }
 
+/**
+ * The previous round's FAILED CRITERIA that the judge filed no bug for, as bug entries.
+ *
+ * A verdict carries two lists: the criteria it graded and the bugs it filed. Only the second
+ * reached the next round, so a criterion graded FAIL — "no evidence: no check names this row", a
+ * device row the judge could not observe — with no matching bug handed the fix round nothing to do.
+ * Measured: three fix rounds in a row compiled with no bugs over a FAIL verdict, and the run ended
+ * where it started. Every failed criterion is a thing the round must address, so each one without a
+ * bug becomes one, addressed to the scope whose contract lists the use case the criterion names.
+ *
+ * @param {string} cwd - Project root.
+ * @param {string} slug - Feature slug.
+ * @param {number} [round] - The round being compiled.
+ * @returns {Array<object>} `{criterion, severity, expected, actual, source:"criterion", scope_id?}`
+ *   per uncovered FAIL criterion; [] for round 1, a PASS, or an unreadable result.
+ */
+export function criteriaBugs(cwd, slug, round) {
+  if (!round || round < 2) return [];
+  const p = join(resultsDir(cwd, slug), `evaluate-r${round - 1}.json`);
+  if (!existsSync(p)) return [];
+  let v;
+  try { v = JSON.parse(readFileSync(p, "utf8"))?.verdict; } catch { return []; }
+  if (v?.overall !== "FAIL" || !Array.isArray(v.criteria)) return [];
+  const filed = (Array.isArray(v.bugs) ? v.bugs : []).map((b) => String(b?.criterion ?? ""));
+  const refuted = new Set((Array.isArray(v.refuted) ? v.refuted : [])
+    .flatMap((r) => [r?.id, r?.ac_id, r?.criterion, typeof r === "string" ? r : null]).filter(Boolean).map(String));
+  const owners = new Map();
+  for (const { contract, id } of readAllContracts(scopesDir(cwd, slug))) {
+    const sid = contract?.scope_id || id;
+    for (const uc of Array.isArray(contract?.use_cases) ? contract.use_cases : []) if (!owners.has(uc)) owners.set(uc, sid);
+  }
+  const out = [];
+  for (const c of v.criteria) {
+    if (c?.verdict !== "FAIL" || typeof c.criterion !== "string") continue;
+    const name = c.criterion;
+    if (refuted.has(name)) continue;
+    if (filed.some((f) => f && (f === name || f.includes(name) || name.includes(f)))) continue;
+    const uc = (name.match(/\bUC-[A-Za-z0-9_-]+/) || [])[0];
+    const owner = uc ? owners.get(uc) : undefined;
+    out.push({
+      criterion: name,
+      severity: "major",
+      expected: "the criterion is met, with evidence the judge can cite",
+      actual: String(c.evidence ?? "graded FAIL").slice(0, 400),
+      source: "criterion",
+      ...(owner ? { scope_id: owner } : {}),
+    });
+  }
+  return out;
+}
+
 /**
  * The previous round's RED BUILD GATE, as bug entries the fix round can act on.
  *
@@ -748,6 +799,38 @@ export function t0ArtifactsFor(cwd, slug, round) {
   return { artifacts, missing };
 }
 
+// --- checks a scope rewrote between a failing trial and a passing one --------------------------
+
+/**
+ * Every revised check any trial of the round recorded, with the scope it belongs to.
+ *
+ * Read across all of the round's trials rather than off the cited verdict alone: a check rewritten
+ * on attempt 2 and re-run unchanged on attempt 3 leaves no mark on attempt 3's verdict, which is the
+ * one the judge cites.
+ *
+ * @param {string} cwd - Project root.
+ * @param {string} slug - Feature slug.
+ * @param {number} [round] - The round being evaluated; omitted, every round.
+ * @returns {Array<{scope_id:string, id:string, file:string}>} Deduplicated by scope, id and file.
+ */
+export function revisedChecksFor(cwd, slug, round) {
+  const seen = new Set();
+  const out = [];
+  for (const tr of readTrials(trials(cwd, slug))) {
+    if (round != null && tr.round !== round) continue;
+    if (!tr.artifact) continue;
+    let v;
+    try { v = JSON.parse(readFileSync(join(localRoot(cwd, slug), tr.artifact), "utf8")); } catch { continue; }
+    for (const r of Array.isArray(v?.revised_checks) ? v.revised_checks : []) {
+      const key = `${tr.scope_id}\u0000${r.id}\u0000${r.file}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      out.push({ scope_id: tr.scope_id, id: r.id, file: r.file });
+    }
+  }
+  return out;
+}
+
 // --- the launch evidence the judge grades `[ui]` rows against ---------------------------------
 //
 // WHY THE KERNEL DERIVES IT. A `[ui]` criterion is graded on the RUNNING app, and the evaluator's
@@ -851,6 +934,13 @@ export function compileOrder({
   const order = {
     schema_version: 1,
     order_id: `${slug}/${suffix}`,
+    // WHERE THE KERNEL IS, AS A PATH A PERMISSION RULE CAN MATCH. Workers were told to run
+    // `node "${CLAUDE_PLUGIN_ROOT}/kernel/harness.mjs" …`. In a headless session that variable is not
+    // expanded for them, and a command carrying an unexpanded variable is refused before any rule is
+    // consulted ("Contains expansion") — so every kernel query a worker's contract requires was
+    // refused, and workers reported it as "not permitted". The absolute path of this very file's
+    // kernel is known here, and quoted it matches the grant `init` writes.
+    kernel: join(HERE, "harness.mjs"),
     // THE TWO ANALYTIC FIELDS, and why they are on the ORDER rather than the result.
     //
     // `order_id` identifies a dispatch within a run and repeats across runs of the same slug, so
@@ -1009,7 +1099,7 @@ export async function cli(rawArgv) {
   // this line, and none of them can pass a payload to a build order (see the banner above).
   // Two sources, one channel: the judge's cited defects and the build gate's failing steps.
   const bugs = scope
-    ? bugsForScope([...verdictBugs(cwd, slug, round), ...buildBugs(cwd, slug, round)], scope.scope_id, scopeSubstrates(cwd, slug))
+    ? bugsForScope([...verdictBugs(cwd, slug, round), ...criteriaBugs(cwd, slug, round), ...buildBugs(cwd, slug, round)], scope.scope_id, scopeSubstrates(cwd, slug))
     : [];
 
   // A ROUND CARRYING CITED DEFECTS IS A `fix`, AND THE ORDER HAS TO SAY SO.
@@ -1131,6 +1221,10 @@ export async function cli(rawArgv) {
   }
   // The launch evidence, for every lane (see launchEvidenceFor). Same rule as above: an explicit
   // `--payload` value outranks the derivation.
+  if (operation === "evaluate" && payloadExtra.revised_checks === undefined) {
+    const revised = revisedChecksFor(cwd, slug, round);
+    if (revised.length) payloadExtra.revised_checks = revised;
+  }
   if (operation === "evaluate") {
     const ev = launchEvidenceFor(cwd, slug, round);
     if (ev.build_gate !== undefined && payloadExtra.build_gate === undefined) payloadExtra.build_gate = ev.build_gate;

package/kernel/gate.mjs

@@ -364,7 +364,7 @@ export function discover({ cwd = process.cwd(), file = null, preset = null, slug
 export const ARGV_SPEC = {
   usage: "harness.mjs gate (--init | --list | --verify | --resolve <gate-id>) [--preset <name>] " +
          "[--file <path>] [--slug <slug>] [--cwd <dir>] [--out <path>] [--by <who>] " +
-         "[--auto-level <level>] [--tiny] [--no-qa] [--round <n>]",
+         "[--auto-level <level>] [--tiny] [--no-qa] [--round <n>] [--verdict <pass|fail|…>]",
   _: { arity: 0, max: 0, name: "(no positional operands)" },
   cwd: { type: "path" },
   init: { type: "flag" },
@@ -383,8 +383,32 @@ export const ARGV_SPEC = {
   // ledger row needs it to key a `GateDecision` node uniquely per crossing. Round-independent gates
   // (L0, L1a, …) simply omit it and the row carries `round: null`.
   round: { type: "int", min: 1 },
+  // The verdict the round being crossed actually reached, when there is one. A preset answers L3
+  // before any verdict exists — "loop" on a FAIL — and its note says so; recorded without the
+  // verdict, a PASS round's row read "FAIL → fix round", the opposite of what happened.
+  verdict: { type: "str" },
 };
 
+/**
+ * The note a gate row carries — the answer's own, unless the verdict it was crossed over makes that
+ * note false.
+ *
+ * L3's answers are written for a verdict that has not happened yet: `loop` means "on a FAIL, run
+ * the next round". Crossed over a PASS, nothing loops, and the preset's "FAIL → fix round" note
+ * would put a failed round on the record for a round that passed.
+ *
+ * @param {{gate:string, decision?:string, note?:string, reason?:string}} r - The resolved answer.
+ * @param {(string|null)} verdict - The round's verdict, lower-cased, or null when none was given.
+ * @returns {(string|null)} The note to record.
+ */
+export function gateNote(r, verdict) {
+  const own = r.note ?? r.reason ?? null;
+  if (r.gate === "L3" && verdict === "pass") {
+    return `verdict PASS — the "${r.decision}" answer applies only to a failed round; the run goes on to QA and GATE H`;
+  }
+  return own;
+}
+
 function out(obj, code = 0) {
   console.log(JSON.stringify(obj, null, 2));
   process.exit(code);
@@ -468,11 +492,13 @@ export function cli(rawArgv) {
     // THE ROW CARRIES THE RUN KEY. It did not, and the export stamped the current run's key onto
     // every row it found — a prior run's sign-off became this run's in the one table that answers
     // "was this ship signed off". Driven on a two-run fixture before it was fixed.
+    const verdict = args.verdict ? String(args.verdict).toLowerCase() : null;
     appendGateLedger(cwd, args.slug, {
       at: new Date().toISOString(), run_id: readRunId(cwd, args.slug),
       gate: r.gate, status: r.status, decision: r.decision ?? null,
-      source: r.source ?? found.source, note: r.note ?? r.reason ?? null,
+      source: r.source ?? found.source, note: gateNote(r, verdict),
       round: args.round ?? null,
+      ...(verdict ? { verdict } : {}),
     });
   }
   if (r.status === "ask") out({ ...r, ok: false }, 4);

package/kernel/probe/digest.mjs

@@ -33,6 +33,11 @@ const PATTERNS = [
   // ("ERROR in the build pipeline", "ERROR in test suite failed to run") is left unmatched
   // instead of handing back a fabricated file.
   { re: /^(?:ERROR|WARNING)\s+in\s+(\.{1,2}\/[^\s:]*|[^\s:]+\.[A-Za-z0-9]{1,10})\b/i, kind: "compiler-diagnostic" },
+  // hvigor / ArkTS compiler: the message and the location arrive on ONE line,
+  //   "Error Message: Expected 5 arguments, but got 3. At File: /abs/path/Foo.test.ets:75:33"
+  // — the commonest failure on that toolchain, and one no other pattern here anchored, so every red
+  // compile handed the next attempt an empty error list.
+  { re: /^\s*Error Message:\s*(.+?)\s+At File:\s*(.+?):(\d+):\d+\s*$/, kind: "arkts-compiler" },
   // A test that FAILED BY NAME, with no file:line: "FAIL TS-05-05 step 4: no text 'Bread' on screen"
   // or jest's "FAIL src/cart.test.js". Runners that drive an app from outside it (a device flow, an
   // end-to-end script) report a case this way and nothing else, and the line is the whole signal —
@@ -77,6 +82,11 @@ export function digest(rawText) {
         pendingMessage = coreMessage(m[1]);
         continue; // wait for the stack frame that follows to get a file:line
       }
+      if (kind === "arkts-compiler") {
+        triples.push({ file: m[2].trim(), line: Number(m[3]), core_message: coreMessage(m[1]), kind });
+        pendingMessage = null;
+        break;
+      }
       const named = kind === "named-test-failure";
       const file = named ? (/[\\/]|\.[A-Za-z0-9]{1,10}$/.test(m[1]) ? m[1] : null) : m[1]?.trim();
       const lineNo = !named && m[2] ? Number(m[2]) : null;

package/kernel/probe/stats.mjs

@@ -194,7 +194,10 @@ export function ratchetReport(trials) {
       }
       if (scopeMonotone) monotone++;
     }
-    const greenAt = seq.findIndex((t) => t.score && t.score.fixtures_total > 0 && t.score.fixtures_passed === t.score.fixtures_total && t.score.regressions === 0);
+    // A score with no `regressions` field was not measured for regressions — T0 writes one only when
+    // it has a baseline to regress against — which is not the same as having some. Requiring an
+    // explicit 0 reported "no scope reached green" over a run whose every scope was green.
+    const greenAt = seq.findIndex((t) => t.score && t.score.fixtures_total > 0 && t.score.fixtures_passed === t.score.fixtures_total && (t.score.regressions ?? 0) === 0);
     if (greenAt !== -1) toGreen.push(greenAt + 1);
     per_scope.push({
       scope_id, trials: seq.length,

package/kernel/reduce/ship.mjs

@@ -280,7 +280,7 @@ export function buildReport(facts) {
     L.push("| scope | fixtures | regressions | trials | last status | delta |", "|---|---|---|---|---|---|");
     for (const s of t0) {
       const f = s.score ? `${s.score.fixtures_passed}/${s.score.fixtures_total}` : "—";
-      const r = s.score ? String(s.score.regressions) : "—";
+      const r = s.score?.regressions != null ? String(s.score.regressions) : "—";
       L.push(`| ${s.scope_id} | ${f} | ${r} | ${s.trials} | ${s.status} | ${s.delta || "—"} |`);
     }
     L.push("");

package/kernel/schemas/domain.schema.json

@@ -362,6 +362,7 @@
       "run_cmd",
       "launch_cmd",
       "build_gate",
+      "revised_checks",
       "t0_artifacts",
       "browser",
       "tasks"
@@ -2429,6 +2430,19 @@
           "type": "string",
           "description": "spec-evaluator: the project profile's launch probe — installs the built artifact, starts it and asserts the first screen. Derived by `harness compile` from project-profile.md, absent when the profile declares none. Where `run_cmd` is only a build, this is how the app is brought up; a non-zero exit is a finding, not a reason to guess another way."
         },
+        "revised_checks": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "properties": {
+              "scope_id": { "type": "string" },
+              "id": { "type": "string" },
+              "file": { "type": "string" }
+            },
+            "required": ["id", "file"]
+          },
+          "description": "spec-evaluator: rows that FAILed in one of the round's T0 trials and PASS in a later one whose own check file (named by the row id) changed in between. Derived by harness compile. Each must be read against its row before its PASS counts; absent when none."
+        },
         "build_gate": {
           "type": "string",
           "description": "spec-evaluator: this run's newest round build gate artifact (build/r<N>-t<T>.json) — each step's exit code and output tail, the record that the build ran and the app launched. Derived by `harness compile`, absent when the gate never ran. Read it before grading a [ui] row NO EVIDENCE."

package/kernel/schemas/work-order.schema.json

@@ -1,30 +1,61 @@
 {
   "$id": "work-order.schema.json",
   "title": "WorkOrder",
-  "description": "The orchestrator → worker envelope (pure-skill architecture v1.0). Compiled by kernel/compile.mjs, validated by harness verify envelope before any worker dispatch. A worker depends only on this envelope — never on filesystem topology, run-state format, board schema, or another worker. Path: .shapeup/<slug>/orders/r<N>-a<M>.json (or <slug>/orders/<operation>.json for non-attempt work). Every record type and payload field is DEFINED CENTRALLY in domain.schema.json ($defs + x-payload-by-worker) — this file only shapes the envelope; it never re-defines a domain entity.",
+  "description": "The orchestrator \u2192 worker envelope (pure-skill architecture v1.0). Compiled by kernel/compile.mjs, validated by harness verify envelope before any worker dispatch. A worker depends only on this envelope \u2014 never on filesystem topology, run-state format, board schema, or another worker. Path: .shapeup/<slug>/orders/r<N>-a<M>.json (or <slug>/orders/<operation>.json for non-attempt work). Every record type and payload field is DEFINED CENTRALLY in domain.schema.json ($defs + x-payload-by-worker) \u2014 this file only shapes the envelope; it never re-defines a domain entity.",
   "type": "object",
-  "required": ["schema_version", "order_id", "worker", "mode", "payload"],
+  "required": [
+    "schema_version",
+    "order_id",
+    "worker",
+    "mode",
+    "payload"
+  ],
   "properties": {
-    "schema_version": { "type": "integer", "enum": [1] },
+    "schema_version": {
+      "type": "integer",
+      "enum": [
+        1
+      ]
+    },
     "order_id": {
       "type": "string",
-      "description": "\"<slug>/r<N>-a<M>\" for build attempts, \"<slug>/<operation>[-r<N>]\" otherwise. Identifies a dispatch WITHIN a run — it repeats across runs of the same slug, which is why run_id exists.",
+      "description": "\"<slug>/r<N>-a<M>\" for build attempts, \"<slug>/<operation>[-r<N>]\" otherwise. Identifies a dispatch WITHIN a run \u2014 it repeats across runs of the same slug, which is why run_id exists.",
       "pattern": "^[a-z0-9][a-z0-9-]*/[a-z0-9][A-Za-z0-9.-]*$"
     },
+    "kernel": {
+      "type": "string",
+      "description": "OPTIONAL \u2014 the absolute path of the kernel entry point (harness.mjs) of the plugin copy that compiled this order. A worker runs every kernel command as node \"<kernel>\" \u2026: a command naming a variable instead (${CLAUDE_PLUGIN_ROOT}) is refused in a headless session before any permission rule is consulted."
+    },
     "run_id": {
       "type": "string",
-      "description": "OPTIONAL (v1.8) — the run this dispatch belongs to, stamped by harness compile from the receipt (kernel/lib/paths.mjs). The join key the analysis plane groups on: order_id alone collides across runs of the same slug, so without this no record the pipeline writes can be attributed to a run. Absent when no readable receipt exists (a standalone dispatch in a workspace with no open run) — never invented, and never required, because an analytic field must not be able to block a build.",
+      "description": "OPTIONAL (v1.8) \u2014 the run this dispatch belongs to, stamped by harness compile from the receipt (kernel/lib/paths.mjs). The join key the analysis plane groups on: order_id alone collides across runs of the same slug, so without this no record the pipeline writes can be attributed to a run. Absent when no readable receipt exists (a standalone dispatch in a workspace with no open run) \u2014 never invented, and never required, because an analytic field must not be able to block a build.",
       "pattern": "^[a-z0-9][a-z0-9-]*-[0-9]{8}T[0-9]{6}Z-[0-9a-f]{8}$"
     },
     "compiled_at": {
       "type": "string",
-      "description": "OPTIONAL (v1.8) — ISO timestamp of compilation. The dispatch record's own time dimension: WorkResult carries none, and the journal's timings exist only on the workflow lane, so without this a dispatch on the prose lane is timeless."
-    },
-    "worker": { "$ref": "domain.schema.json#/$defs/WorkerName" },
-    "mode": { "type": "string", "enum": ["orchestrated", "standalone"] },
-    "operation": { "$ref": "domain.schema.json#/$defs/Operation" },
-    "interaction": { "$ref": "domain.schema.json#/$defs/Interaction" },
-    "substrate": { "$ref": "domain.schema.json#/$defs/Substrate" },
-    "payload": { "$ref": "domain.schema.json#/$defs/WorkOrderPayload" }
+      "description": "OPTIONAL (v1.8) \u2014 ISO timestamp of compilation. The dispatch record's own time dimension: WorkResult carries none, and the journal's timings exist only on the workflow lane, so without this a dispatch on the prose lane is timeless."
+    },
+    "worker": {
+      "$ref": "domain.schema.json#/$defs/WorkerName"
+    },
+    "mode": {
+      "type": "string",
+      "enum": [
+        "orchestrated",
+        "standalone"
+      ]
+    },
+    "operation": {
+      "$ref": "domain.schema.json#/$defs/Operation"
+    },
+    "interaction": {
+      "$ref": "domain.schema.json#/$defs/Interaction"
+    },
+    "substrate": {
+      "$ref": "domain.schema.json#/$defs/Substrate"
+    },
+    "payload": {
+      "$ref": "domain.schema.json#/$defs/WorkOrderPayload"
+    }
   }
 }

package/kernel/verify/t0.mjs

@@ -34,8 +34,8 @@
 //
 // Exit code: 0 = overall green, 1 = overall red (mirrors the oracle convention), 2 = bad argv.
 
-import { readFileSync, writeFileSync, appendFileSync, mkdirSync, existsSync, readdirSync } from "node:fs";
-import { join, dirname } from "node:path";
+import { readFileSync, writeFileSync, appendFileSync, mkdirSync, existsSync, readdirSync, statSync } from "node:fs";
+import { join, dirname, basename, extname, resolve as resolvePath, relative } from "node:path";
 import { spawnSync } from "node:child_process";
 import { createHash } from "node:crypto";
 import { digest } from "../probe/digest.mjs";
@@ -389,6 +389,97 @@ export function nextTrialNo(dir, round, attempt) {
   return max + 1;
 }
 
+// --- a check rewritten to pass ----------------------------------------------------------------
+//
+// A fixture that names Test Surface rows (`PASS TS-02-04`, `FAIL TS-02-04 step 10: …`) reads its
+// checks from files the scope itself writes. Measured on a live run: a row FAILed on attempt 1 —
+// the check renamed a list and found the old name still on screen — and went green on attempt 2
+// because the check had been rewritten to stop renaming, while the code was unchanged. Nothing
+// recorded that the evidence had moved. So each verdict records the checks it read, by digest, and
+// the named results they printed; a row that failed in this scope's previous trial and passes now,
+// whose own check file changed in between, is a REVISED check — a pass the judge must read against
+// its row before it can count. Recorded, never refused: rewriting a check that overreached is
+// legitimate, and only a person or the judge can tell which it was.
+
+/**
+ * The files a fixture's arguments name, with their digests — a named directory contributes its
+ * direct children. Paths resolve against the project root and are recorded relative to it.
+ *
+ * @param {string[]} commands - The fixture command lines.
+ * @param {string} cwd - Project root.
+ * @returns {Object<string,string>} Relative path → sha256 of its bytes. Empty when no argument names
+ *   an existing path.
+ */
+export function checkFiles(commands, cwd) {
+  const out = {};
+  /**
+   * Record one file's digest under its project-relative path.
+   * @param {string} abs - Absolute path of the file.
+   * @returns {void} Nothing; an unreadable file is skipped, since it is not evidence.
+   */
+  const add = (abs) => {
+    try { out[relative(cwd, abs)] = createHash("sha256").update(readFileSync(abs)).digest("hex"); } catch { /* unreadable — not evidence */ }
+  };
+  for (const cmd of commands || []) {
+    const tokens = String(cmd).match(/"[^"]*"|'[^']*'|\S+/g) || [];
+    for (const raw of tokens.slice(1)) {
+      const tok = raw.replace(/^["']|["']$/g, "");
+      if (!tok || tok.startsWith("-")) continue;
+      const abs = resolvePath(cwd, tok);
+      let st; try { st = statSync(abs); } catch { continue; }
+      if (st.isFile()) add(abs);
+      else if (st.isDirectory()) {
+        for (const f of readdirSync(abs).sort()) {
+          const child = join(abs, f);
+          try { if (statSync(child).isFile()) add(child); } catch { /* skip */ }
+        }
+      }
+    }
+  }
+  return out;
+}
+
+/**
+ * The rows a fixture's output names, and how each came out.
+ *
+ * @param {Array<{stdout?:string}>} results - Fixture results with their full stdout.
+ * @returns {Object<string,("PASS"|"FAIL")>} Row id → its result; a FAIL anywhere wins over a PASS.
+ */
+export function namedResults(results) {
+  const out = {};
+  for (const r of results || []) {
+    for (const line of String(r?.stdout || "").split(/\r?\n/)) {
+      const m = line.match(/^(PASS|FAIL)\s+(\S+)/);
+      if (!m) continue;
+      if (m[1] === "FAIL" || out[m[2]] !== "FAIL") out[m[2]] = m[1];
+    }
+  }
+  return out;
+}
+
+/**
+ * Rows that failed in the previous trial and pass now while their own check file changed.
+ *
+ * A row's check is the file whose name, without extension, is the row id — the convention a
+ * per-row check follows. A row with no such file is not reported: nothing can be said about it.
+ *
+ * @param {({check_files?:Object<string,string>, named_results?:Object<string,string>}|null)} prev
+ *   The scope's previous verdict in this round, or null.
+ * @param {{check_files:Object<string,string>, named_results:Object<string,string>}} curr - This one.
+ * @returns {Array<{id:string, file:string}>} One entry per revised check.
+ */
+export function revisedChecks(prev, curr) {
+  if (!prev?.named_results || !prev?.check_files) return [];
+  const out = [];
+  for (const [id, now] of Object.entries(curr.named_results || {})) {
+    if (now !== "PASS" || prev.named_results[id] !== "FAIL") continue;
+    const file = Object.keys(curr.check_files || {}).find((f) => basename(f, extname(f)) === id);
+    if (!file) continue;
+    if (prev.check_files[file] !== curr.check_files[file]) out.push({ id, file });
+  }
+  return out;
+}
+
 /**
  * Distill every failing command's output into AEGIS {file,line,core_message} triples.
  * @param {{fixtures:{results:Array<{pass:boolean,stdout:string,stderr:string}>},
@@ -514,6 +605,10 @@ export async function cli(rawArgv) {
   const dbProbe = runDbProbe(contract.db_probe, cwd);
   const verdict = computeVerdict({ fixtures, dbProbe });
   const discovered = verdict.overall === "red" ? digestFailures({ fixtures, dbProbe }) : [];
+  const checks = {
+    check_files: checkFiles(fixtures.results.map((r) => r.cmd), cwd),
+    named_results: namedResults(fixtures.results),
+  };
 
   // ---- the ratchet ---------------------------------------------------------------------
   // `current` is the incumbent: the score of the most recent trial whose TREE is the one on disk
@@ -526,6 +621,11 @@ export async function cli(rawArgv) {
   const verdictBetter = better(s, baseline ? baseline.score : null);
   const crashed = fixtures.results.some((r) => r.error) || !!dbProbe?.error;
   const { status, action } = decideStatus(verdictBetter, crashed);
+  // The scope's previous trial in this round, read back for the checks it recorded.
+  const prevTrial = [...priorTrials].reverse().find((tr) => tr.round === round);
+  let prevVerdict = null;
+  if (prevTrial?.artifact) { try { prevVerdict = JSON.parse(readFileSync(join(outDir, prevTrial.artifact), "utf8")); } catch { /* none */ } }
+  const revised = revisedChecks(prevVerdict, checks);
 
   // The run key, read from the receipt that lives in the run root this script was pointed at.
   // `--out` IS that root, so identity comes from the receipt rather than from parsing a slug back
@@ -550,6 +650,9 @@ export async function cli(rawArgv) {
     ...verdict,
     score: s,
     discovered_tasks: discovered,
+    ...(Object.keys(checks.check_files).length ? { check_files: checks.check_files } : {}),
+    ...(Object.keys(checks.named_results).length ? { named_results: checks.named_results } : {}),
+    ...(revised.length ? { revised_checks: revised } : {}),
   });
 
   // The tree operation. `--no-ratchet` leaves the working tree exactly as the attempt left it —

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shapeup-sdlc",
-  "version": "3.12.0",
+  "version": "3.14.0",
   "description": "Shape Up for coding agents \u2014 with gates the agent can't talk its way past. Harness for Claude Code.",
   "bin": {
     "shapeup-sdlc": "bin/init.mjs"

package/skills/ba-pitch-analyzer/SKILL.md

@@ -20,6 +20,8 @@ same artifacts out.
 
 ## Input contract — the WorkOrder
 
+**Kernel commands.** `<kernel>` below is the absolute path in your order's `kernel` field: run every kernel command as `node "<kernel>" …`. Never spell it `${CLAUDE_PLUGIN_ROOT}` — a command carrying a variable is refused in a headless session before any permission rule is read, and the query your contract requires never runs. With no order (invoked by hand), the kernel is `kernel/harness.mjs` two directories above this skill's base directory.
+
 Invoked as `--order <path>`. Fields you may rely on (absent = unknown; surface it, never guess):
 
 | Field | What it is |
@@ -69,10 +71,10 @@ its phase; templates live in `assets/templates/`.
 6  TASKS       atomic, ordered, executable → tasks/ (LOCAL root; the one uncommitted branch
                of the tree — regenerable, machine-local)        [references/task-generation.md]
 7  DERIVE+LINT mechanical, not yours to grade:
-               node "${CLAUDE_PLUGIN_ROOT}/kernel/harness.mjs" reduce board --slug <slug> --write
+               node "<kernel>" reduce board --slug <slug> --write
                  (unlocks = depends_on inverse; Σ hours; critical path; appetite arithmetic —
                   overflow is a fact you REPORT for the caller's HAMMER gate, never resolve)
-               node "${CLAUDE_PLUGIN_ROOT}/kernel/harness.mjs" verify spec --slug <slug>
+               node "<kernel>" verify spec --slug <slug>
                  (structure, wikilinks, edge symmetry — fix reds, then re-run; you never
                   self-grade with a hand-walked checklist. BREADBOARD-PLACE / BREADBOARD-UI:
                   add the screen or defer the Place; never fold it into another screen)
@@ -187,7 +189,7 @@ status flips for built work (ingest's job), scope contracts (scope-architect's),
 /ba-pitch-analyzer --order .shapeup/checkout-vnpay/orders/analyze.json
 
 # Standalone — the preamble shim compiles the order (mode: standalone, pause_gates: true):
-#   node "${CLAUDE_PLUGIN_ROOT}/kernel/harness.mjs" compile --operation analyze --slug <slug> \
+#   node "<kernel>" compile --operation analyze --slug <slug> \
 #        --worker ba-pitch-analyzer --payload '{"pitch": "docs/pitch.md", "lens": "standard"}'
 /ba-pitch-analyzer docs/pitch.md                      # operation: analyze, lens judged
 /ba-pitch-analyzer --lens standard docs/pitch.md      # lens pinned

package/skills/scope-architect/SKILL.md

@@ -17,6 +17,8 @@ the ship report's census table.
 
 ## Input contract — the WorkOrder
 
+**Kernel commands.** `<kernel>` below is the absolute path in your order's `kernel` field: run every kernel command as `node "<kernel>" …`. Never spell it `${CLAUDE_PLUGIN_ROOT}` — a command carrying a variable is refused in a headless session before any permission rule is read, and the query your contract requires never runs. With no order (invoked by hand), the kernel is `kernel/harness.mjs` two directories above this skill's base directory.
+
 | Field | What it is |
 |---|---|
 | `operation` | `map-scopes` — the only operation this skill has. It covers first slicing after the board exists, folding discovered items in, and re-slicing a stuck scope; the payload says which of those you are doing |
@@ -95,7 +97,7 @@ the ship report's census table.
              hill_phase: "UPHILL_UNKNOWN"                    — ALWAYS; phase is derived from
                                                                T0/T1 facts later,
                                                                never authored
-4 LINT     node "${CLAUDE_PLUGIN_ROOT}/kernel/harness.mjs" verify spec --slug <slug>
+4 LINT     node "<kernel>" verify spec --slug <slug>
            → PA1 (directory alignment), PA2 (>~15 files), DISJOINT (undeclared overlap),
            SCOPE-ANCHOR (empty/unresolvable use_cases), TIER-DIRECTION (a task id in a
            committed contract), SCOPE-DEPS (depends_on naming a scope that isn't here).

package/skills/scope-hammer/SKILL.md

@@ -52,13 +52,15 @@ INPUT: run's finished/unfinished scopes + baseline + census sources
 
 ## GATE H0 — Census
 
+**Kernel commands.** `<kernel>` below is the absolute path in your order's `kernel` field: run every kernel command as `node "<kernel>" …`. Never spell it `${CLAUDE_PLUGIN_ROOT}` — a command carrying a variable is refused in a headless session before any permission rule is read, and the query your contract requires never runs. With no order (invoked by hand), the kernel is `kernel/harness.mjs` two directories above this skill's base directory.
+
 **Purpose:** Gather every open item into one list before judging any of them. Never judge
 piecemeal — a partial view produces a wrong cut.
 
 ```
 H0.0  Ownership is DERIVED, never stated. Before the census says "no scope owns X" or "X is
       scope Y's", run
-        node "${CLAUDE_PLUGIN_ROOT}/kernel/harness.mjs" probe owner --slug <slug> [--path <p>]...
+        node "<kernel>" probe owner --slug <slug> [--path <p>]...
       and cite its row. With no --path it answers for every engine and entry call site the wiring
       map names plus the profile's entry point; `writers: []` is an unowned seam and `missing`
       lists seams the wiring names that are not on disk — owned but never written. A census that
@@ -70,7 +72,7 @@ H0.1  Unresolved scopes (breaker cases only):
         - scopes with hammer_proposals (attempt_budget exhausted) → CARRY candidates. Exhaustion
           is DERIVED, never read off `t0/verdicts/*.json` directly — a compiled order or a T0
           verdict is writable by the very scope being judged and proves nothing on its own. Run
-            node "${CLAUDE_PLUGIN_ROOT}/kernel/harness.mjs" probe attempts --slug <slug> \
+            node "<kernel>" probe attempts --slug <slug> \
               --scope <scope-id> --round <n> --attempt-budget <n>
           and cite its `spent`/`tripped` fields (exit 1 = tripped) — an attempt counts only when a
           dispatch receipt AND either a leg-completion row or a WorkResult attest it, so a leg still
@@ -81,7 +83,7 @@ H0.2  QA findings (qa-edge-hunter's hunt-report.md, when present) — all `~` by
 H0.3  Discovered-task ledger entries still open (discovery/ledger.md, `[+]`/`~` unresolved).
 H0.4  Attempt-budget hammer proposals (scopes that exhausted their T0 attempts during BUILD).
 H0.4b Requirements with no PASS evidence — the pitch clauses the run never showed working. Run
-        node "${CLAUDE_PLUGIN_ROOT}/kernel/harness.mjs" probe requirements --slug <slug> --format table
+        node "<kernel>" probe requirements --slug <slug> --format table
       and take its `no evidence` rows; cite the row, the same way H0.0 cites ownership. Each is a
       census item carrying its source clause (`REQ-12 ← shaping.md R12`). A `cut` row is an answer
       the PO already gave — not an item. An inconsistency row (a criterion anchored to a
@@ -200,8 +202,8 @@ with a green census could only be recorded as `ask`. Still a proposal: the file
 /scope-hammer --slug checkout-vnpay --unattended
 
 # The ownership query every census claim cites (H0.0)
-node "${CLAUDE_PLUGIN_ROOT}/kernel/harness.mjs" probe owner --slug checkout-vnpay --format table
-node "${CLAUDE_PLUGIN_ROOT}/kernel/harness.mjs" probe owner --slug checkout-vnpay --path src/pages/Cart.ets
+node "<kernel>" probe owner --slug checkout-vnpay --format table
+node "<kernel>" probe owner --slug checkout-vnpay --path src/pages/Cart.ets
 ```
 
 ### Flags

package/skills/solution-architect/SKILL.md

@@ -38,6 +38,8 @@ return as a WorkResult.
 
 ## Input contract — the WorkOrder
 
+**Kernel commands.** `<kernel>` below is the absolute path in your order's `kernel` field: run every kernel command as `node "<kernel>" …`. Never spell it `${CLAUDE_PLUGIN_ROOT}` — a command carrying a variable is refused in a headless session before any permission rule is read, and the query your contract requires never runs. With no order (invoked by hand), the kernel is `kernel/harness.mjs` two directories above this skill's base directory.
+
 | Field | What it is |
 |---|---|
 | `operation` | `wire` (author/refresh the wiring map after `analyze`, before `map-scopes`) |
@@ -152,5 +154,5 @@ seam, or an engine with no attachment path, and why). You never touch spec docs,
 # The reachability oracle is the ORCHESTRATOR's, run advisory at L1b — not part of your craft.
 # Standalone, you MAY preview it after writing the map (it self-skips arms whose artifacts are
 # absent, and is near-vacuous pre-build since the engine code does not exist yet):
-#   node "${CLAUDE_PLUGIN_ROOT}/kernel/harness.mjs" verify trace --slug checkout-vnpay
+#   node "<kernel>" verify trace --slug checkout-vnpay
 ```

package/skills/spec-evaluator/SKILL.md

@@ -29,6 +29,8 @@ criterion with no collected evidence is a **FAIL**, never a pass-by-assumption.
 
 ## Input contract — the WorkOrder
 
+**Kernel commands.** `<kernel>` below is the absolute path in your order's `kernel` field: run every kernel command as `node "<kernel>" …`. Never spell it `${CLAUDE_PLUGIN_ROOT}` — a command carrying a variable is refused in a headless session before any permission rule is read, and the query your contract requires never runs. With no order (invoked by hand), the kernel is `kernel/harness.mjs` two directories above this skill's base directory.
+
 Invoked as `--order <path>`. Fields you may rely on (absent = unknown, never inferred):
 
 | Field | What it is |
@@ -39,6 +41,7 @@ Invoked as `--order <path>`. Fields you may rely on (absent = unknown, never inf
 | `payload.run_cmd` | How to start the running app. On a stack where building and launching are different acts it is only the build — prefer `payload.launch_cmd` when the order carries one. Absent standalone → ask; absent orchestrated with no `launch_cmd` either → ESCALATE, do not guess |
 | `payload.launch_cmd` | The project profile's launch probe: installs the built artifact, starts it and asserts the first screen. This is how the app is brought up for `[ui]` probing. A non-zero exit is a finding to cite, not a reason to try another way. Absent → the profile declares none; fall back to `run_cmd` |
 | `payload.build_gate` | This run's newest round build gate artifact — each step's exit code and output tail. It records that the build ran and whether the app launched, and the launch step's output names what it captured. Read it before grading any `[ui]` row NO EVIDENCE: a launch that succeeded is evidence the app can be probed, and the row is graded on the app, not on its absence. Absent → the gate never ran |
+| `payload.revised_checks[]` | Rows that FAILed in one trial of this round and PASS in a later one whose own check file changed in between — a pass obtained by editing the check. Read each listed file against its row's Expect before you let its PASS count; a check that no longer asserts what the row asks makes that row a FAIL, and the bug names the check. Absent → no check was rewritten |
 | `payload.t0_artifacts[]` | Per-scope T0 verdict paths for this round (scoped specs), compiled from each scope's green verdict. An artifact listed but missing/red on disk, or a scoped spec with none listed → the round is NOT gradeable: return `status: failed` with the reason, naming the scope, as your FIRST deviation — a structural precondition, not a criterion |
 | `payload.browser` | `cli` (default, ~4x cheaper) \| `mcp` \| `none` |
 | `payload.tasks[]` | Traceability only (which UCs a task claims): NEVER a grading source — the committed UC text is the criterion, a paraphrase mismatch is a finding |
@@ -85,9 +88,11 @@ Done-when statements; `_index.md` Non-Go list. Which UCs are in scope comes from
 - Contract work: send real requests, compare field-by-field.
 - **A fixture that names a row is evidence for that row.** When a T0 artifact you cite, or the
   build gate, carries output that names a Test Surface row by id — `PASS TS-05-05`, or
-  `FAIL TS-05-05 step 4: …` — grade that row on it: a named PASS confirms, a named FAIL is a
-  FAIL whose bug is that line. This is how a device row is evidenced when you cannot drive the
-  app yourself; it is never a reason to skip driving it when you can.
+  `FAIL TS-05-05 step 4: …` — grade that row on it, after reading the check that printed it: a
+  named PASS confirms only when that check asserts the row's Expect; a check weaker than its row
+  (it opens the dialog, the row says pre-filled) is not evidence for the row, and grading it PASS
+  is the generator grading itself. A named FAIL is a FAIL whose bug is that line. This is how a
+  device row is evidenced when you cannot drive the app; never a reason not to when you can.
 - No evidence collected = recorded "NO EVIDENCE" → FAILs at verdict.
 
 **VERDICT.**
@@ -222,7 +227,7 @@ bug_template). Adding one (e.g. security) = write `references/dimensions/securit
 /spec-evaluator --order .shapeup/checkout-vnpay/orders/evaluate-r2.json
 
 # Standalone — the preamble shim compiles a minimal order, then the single code path runs:
-#   node "${CLAUDE_PLUGIN_ROOT}/kernel/harness.mjs" compile --operation evaluate --slug <slug> \
+#   node "<kernel>" compile --operation evaluate --slug <slug> \
 #        --worker spec-evaluator [--payload '{"dimensions": [...], "run_cmd": "..."}']
 /spec-evaluator --spec shapeup/checkout-vnpay/spec/ --task TASK-007
 /spec-evaluator --spec shapeup/checkout-vnpay/spec/ --feature checkout-vnpay --single-pass
@@ -230,7 +235,7 @@ bug_template). Adding one (e.g. security) = write `references/dimensions/securit
 
 Standalone keeps `--task` (per-task check, not round-gated) and `--single-pass` (feature-level)
 — the shim maps them onto the order's payload; missing run command → ask. After writing the
-WorkResult, run `node "${CLAUDE_PLUGIN_ROOT}/kernel/harness.mjs" reduce ingest <result path>` and show its
+WorkResult, run `node "<kernel>" reduce ingest <result path>` and show its
 summary — standalone has no orchestrator to ingest for you.
 
 ---

package/skills/task-executor/SKILL.md

@@ -16,6 +16,8 @@ it does not exist for you.
 
 ## Input contract — the WorkOrder
 
+**Kernel commands.** `<kernel>` below is the absolute path in your order's `kernel` field: run every kernel command as `node "<kernel>" …`. Never spell it `${CLAUDE_PLUGIN_ROOT}` — a command carrying a variable is refused in a headless session before any permission rule is read, and the query your contract requires never runs. With no order (invoked by hand), the kernel is `kernel/harness.mjs` two directories above this skill's base directory.
+
 You are invoked as `--order <path>` pointing at a schema-valid WorkOrder. Fields you may
 rely on (anything absent = **unknown**; never invent it):
 
@@ -194,8 +196,8 @@ orchestrator's `harness reduce ingest` does all of that from your envelope.
 
 # Standalone — the preamble shim compiles a minimal WorkOrder from the flags, then the
 # single code path above runs. Requires the harness scripts (plugin install):
-#   node "${CLAUDE_PLUGIN_ROOT}/kernel/harness.mjs" compile --task TASK-003 --slug checkout-vnpay
-#   node "${CLAUDE_PLUGIN_ROOT}/kernel/harness.mjs" compile --next --slug checkout-vnpay
+#   node "<kernel>" compile --task TASK-003 --slug checkout-vnpay
+#   node "<kernel>" compile --next --slug checkout-vnpay
 /task-executor --spec shapeup/checkout-vnpay/spec/ --task TASK-003
 /task-executor --spec shapeup/checkout-vnpay/spec/ --next
 ```
@@ -203,6 +205,6 @@ orchestrator's `harness reduce ingest` does all of that from your envelope.
 Standalone shim: derive `<slug>` from the `--spec` path (`shapeup/<slug>/spec`),
 run `harness compile` with the matching flags (mode becomes `standalone`), then proceed
 against the compiled order exactly as if dispatched. After writing the WorkResult, run
-`node "${CLAUDE_PLUGIN_ROOT}/kernel/harness.mjs" reduce ingest <result path>` yourself and show the user its
+`node "<kernel>" reduce ingest <result path>` yourself and show the user its
 summary — standalone has no orchestrator to ingest for you. One code path inside; two entry
 points outside.

package/skills/tech-lead/workflows/shapeup-run.js

@@ -898,7 +898,7 @@ async function crossGate(gateId, phaseName, validDecisions, ctx) {
   // The gate ledger keys a per-round crossing (L2, L3) on gate id + round, so it needs the round
   // whenever the caller already has one to show in the block — the same value `ctx.round` carries
   // for display, threaded through rather than re-derived.
-  const roundFlag = ctx?.round != null ? ` --round ${ctx.round}` : "";
+  const roundFlag = (ctx?.round != null ? ` --round ${ctx.round}` : "") + (ctx?.verdict ? ` --verdict ${ctx.verdict}` : "");
   const g = await cmd(`gate --resolve ${gateId} --slug ${slug}${roundFlag} ${answersFlag(args.answers)}`.trim(), phaseName, `gate:${gateId}`);
   if (g.exit_code === 4) return { stop: paused(gateId, validDecisions, ctx) };
   if (g.exit_code === 5) return { stop: aborted(gateId, g.detail || `GATE ${gateId} aborted`) };