shapeup-sdlc 3.14.0 → 3.15.0

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "shapeup-sdlc-plugin",
   "displayName": "ShapeUp SDLC Plugin",
-  "version": "3.14.0",
+  "version": "3.15.0",
   "description": "Shape Up SDLC harness for Claude Code: shaping, intake, orient, scope-mapping, building (T0-verified, sandboxed, scope-contracted), evaluation and QA skills orchestrated by a tech-lead.",
   "author": {
     "name": "Liberty Nguyen",

package/kernel/compile.mjs

@@ -527,6 +527,44 @@ export function verdictBugs(cwd, slug, round) {
   return v.bugs.filter((b) => !refuted.has(String(b?.id)) && !refuted.has(String(b?.criterion)));
 }
 
+/**
+ * Who owns the row a bug or a failed criterion is about — by use case, not by file.
+ *
+ * A bug names a code location, and electing its owner from that location is right when one scope
+ * writes the file. Screens are shared: on a live run two bugs about rows of UC-05 and UC-07 both
+ * named screen files that three scopes could write, both were elected to a third scope that owned
+ * neither row, and that scope could not write the row's check and escalated. The criterion says
+ * which row it is; the row's use case says which scope owns it. Read from the name directly
+ * (`UC-05 …`), else from the spec's use-case file whose Test Surface lists the row id.
+ *
+ * @param {string} cwd - Project root.
+ * @param {string} slug - Feature slug.
+ * @returns {function(string): (string|undefined)} Criterion text → owning scope_id, or undefined
+ *   when no use case can be read off it or no scope lists that use case.
+ */
+export function rowOwner(cwd, slug) {
+  const owners = new Map();
+  for (const { contract, id } of readAllContracts(scopesDir(cwd, slug))) {
+    const sid = contract?.scope_id || id;
+    for (const uc of Array.isArray(contract?.use_cases) ? contract.use_cases : []) if (!owners.has(uc)) owners.set(uc, sid);
+  }
+  const rowUc = new Map();
+  const ucDir = join(defaultSpecDir(cwd, slug), "usecases");
+  let files = [];
+  try { files = readdirSync(ucDir).filter((f) => /^UC-.*\.md$/.test(f)); } catch { /* no spec tree */ }
+  for (const f of files) {
+    const uc = f.replace(/\.md$/, "");
+    let text = "";
+    try { text = readFileSync(join(ucDir, f), "utf8"); } catch { continue; }
+    for (const m of text.matchAll(/^\|\s*(TS-[A-Za-z0-9_-]+)\s*\|/gm)) if (!rowUc.has(m[1])) rowUc.set(m[1], uc);
+  }
+  return (criterion) => {
+    const s = String(criterion ?? "");
+    const uc = (s.match(/\bUC-[A-Za-z0-9_-]+/) || [])[0] || rowUc.get((s.match(/\bTS-[A-Za-z0-9_-]+/) || [])[0]);
+    return uc ? owners.get(uc) : undefined;
+  };
+}
+
 /**
  * The previous round's FAILED CRITERIA that the judge filed no bug for, as bug entries.
  *
@@ -578,6 +616,22 @@ export function criteriaBugs(cwd, slug, round) {
   return out;
 }
 
+/**
+ * Stamp each verdict bug with the scope that owns the row it names, where one can be read. A bug
+ * that already carries a scope, or names no row a scope owns, is left to the file election.
+ *
+ * @param {Array<object>} bugs - Verdict and criterion bugs.
+ * @param {function(string): (string|undefined)} owner - From {@link rowOwner}.
+ * @returns {Array<object>} The same bugs, `scope_id` added where the row's owner is known.
+ */
+export function byRow(bugs, owner) {
+  return (bugs || []).map((b) => {
+    if (b?.scope_id) return b;
+    const sid = owner(b?.criterion);
+    return sid ? { ...b, scope_id: sid } : b;
+  });
+}
+
 /**
  * The previous round's RED BUILD GATE, as bug entries the fix round can act on.
  *
@@ -1099,7 +1153,7 @@ export async function cli(rawArgv) {
   // this line, and none of them can pass a payload to a build order (see the banner above).
   // Two sources, one channel: the judge's cited defects and the build gate's failing steps.
   const bugs = scope
-    ? bugsForScope([...verdictBugs(cwd, slug, round), ...criteriaBugs(cwd, slug, round), ...buildBugs(cwd, slug, round)], scope.scope_id, scopeSubstrates(cwd, slug))
+    ? bugsForScope(byRow([...verdictBugs(cwd, slug, round), ...criteriaBugs(cwd, slug, round)], rowOwner(cwd, slug)).concat(buildBugs(cwd, slug, round)), scope.scope_id, scopeSubstrates(cwd, slug))
     : [];
 
   // A ROUND CARRYING CITED DEFECTS IS A `fix`, AND THE ORDER HAS TO SAY SO.
@@ -1225,7 +1279,10 @@ export async function cli(rawArgv) {
     const revised = revisedChecksFor(cwd, slug, round);
     if (revised.length) payloadExtra.revised_checks = revised;
   }
-  if (operation === "evaluate") {
+  // The QA hunt drives the same running app the judge grades, so it needs the same way in. A mobile
+  // deliverable has no URL, and a hunt order carrying only `app_url: null` reported "no reachable
+  // deliverable" and hunted nothing over a build the round gate had just launched.
+  if (operation === "evaluate" || operation === "hunt") {
     const ev = launchEvidenceFor(cwd, slug, round);
     if (ev.build_gate !== undefined && payloadExtra.build_gate === undefined) payloadExtra.build_gate = ev.build_gate;
     if (ev.launch_cmd !== undefined && payloadExtra.launch_cmd === undefined) payloadExtra.launch_cmd = ev.launch_cmd;

package/kernel/probe/resume.mjs

@@ -633,10 +633,21 @@ export function deriveLedgerFacts(cwd, slug) {
   const readJson = (p) => { try { return JSON.parse(readFileSync(p, "utf8")); } catch { return null; } };
   const evalRows = [];
   const rDir = resultsDir(cwd, slug);
+  // THIS RUN'S VERDICTS ONLY. A run opened afresh over a slug that already ran keeps the earlier
+  // run's `evaluate-r<N>.json` beside its own, and a later-numbered one from the earlier run was read
+  // as this run's final verdict: measured, a run whose last round PASSed closed as `final_verdict:
+  // FAIL` from a previous run's round 3. A result carries no run key; its order does.
+  const runId = readRunId(cwd, slug);
+  const thisRun = (n) => {
+    if (!runId) return true;
+    const o = readJson(join(ordersDir(cwd, slug), `evaluate-r${n}.json`));
+    return !o?.run_id || o.run_id === runId;
+  };
   if (existsSync(rDir)) {
     for (const f of readdirSync(rDir)) {
       const m = f.match(/^evaluate-r(\d+)\.json$/);
       if (!m) continue;
+      if (!thisRun(m[1])) continue;
       const r = readJson(join(rDir, f));
       const overall = r?.verdict?.overall;
       if (overall) evalRows.push({ round: Number(m[1]), overall: String(overall), criteria: Array.isArray(r.verdict.criteria) ? r.verdict.criteria : [] });
@@ -649,7 +660,11 @@ export function deriveLedgerFacts(cwd, slug) {
   if (existsSync(gp)) {
     for (const line of readFileSync(gp, "utf8").split("\n")) {
       if (!line.trim()) continue;
-      try { decisions.push(JSON.parse(line)); } catch { /* a torn line proves nothing */ }
+      try {
+        const g = JSON.parse(line);
+        // Gate rows carry the run key; a row from an earlier run over the same slug is its history.
+        if (!runId || !g?.run_id || g.run_id === runId) decisions.push(g);
+      } catch { /* a torn line proves nothing */ }
     }
   }
   const t0ByRound = {};
@@ -658,6 +673,7 @@ export function deriveLedgerFacts(cwd, slug) {
     for (const f of readdirSync(vDir).filter((x) => x.endsWith(".json")).sort()) {
       const v = readJson(join(vDir, f));
       if (typeof v?.round !== "number") continue;
+      if (runId && v.run_id && v.run_id !== runId) continue;
       const t = (t0ByRound[v.round] ||= { green: 0, red: 0 });
       if (v.overall === "green") t.green++; else t.red++;
     }
@@ -667,7 +683,10 @@ export function deriveLedgerFacts(cwd, slug) {
   if (existsSync(bDir)) {
     for (const f of readdirSync(bDir).sort()) {
       const m = f.match(/^r(\d+)-t\d+\.json$/);
-      if (m) gateByRound[Number(m[1])] = readJson(join(bDir, f))?.overall ?? "?";
+      if (!m) continue;
+      const g = readJson(join(bDir, f));
+      if (runId && g?.run_id && g.run_id !== runId) continue;
+      gateByRound[Number(m[1])] = g?.overall ?? "?";
     }
   }
   const roundNums = [...new Set([...Object.keys(t0ByRound), ...Object.keys(gateByRound), ...evalRows.map((e) => e.round)].map(Number))].sort((a, b) => a - b);

package/kernel/schemas/domain.schema.json

@@ -380,6 +380,8 @@
       "spec_folder",
       "eval_report",
       "app_url",
+      "launch_cmd",
+      "build_gate",
       "ledger",
       "kb_rules_path"
     ],
@@ -2428,7 +2430,7 @@
         },
         "launch_cmd": {
           "type": "string",
-          "description": "spec-evaluator: the project profile's launch probe — installs the built artifact, starts it and asserts the first screen. Derived by `harness compile` from project-profile.md, absent when the profile declares none. Where `run_cmd` is only a build, this is how the app is brought up; a non-zero exit is a finding, not a reason to guess another way."
+          "description": "spec-evaluator, qa-edge-hunter: the project profile's launch probe — installs the built artifact, starts it and asserts the first screen. Derived by `harness compile` from project-profile.md, absent when the profile declares none. Where `run_cmd` is only a build, this is how the app is brought up; a non-zero exit is a finding, not a reason to guess another way."
         },
         "revised_checks": {
           "type": "array",
@@ -2445,7 +2447,7 @@
         },
         "build_gate": {
           "type": "string",
-          "description": "spec-evaluator: this run's newest round build gate artifact (build/r<N>-t<T>.json) — each step's exit code and output tail, the record that the build ran and the app launched. Derived by `harness compile`, absent when the gate never ran. Read it before grading a [ui] row NO EVIDENCE."
+          "description": "spec-evaluator, qa-edge-hunter: this run's newest round build gate artifact (build/r<N>-t<T>.json) — each step's exit code and output tail, the record that the build ran and the app launched. Derived by `harness compile`, absent when the gate never ran. Read it before grading a [ui] row NO EVIDENCE."
         },
         "t0_artifacts": {
           "type": "array",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shapeup-sdlc",
-  "version": "3.14.0",
+  "version": "3.15.0",
   "description": "Shape Up for coding agents \u2014 with gates the agent can't talk its way past. Harness for Claude Code.",
   "bin": {
     "shapeup-sdlc": "bin/init.mjs"

package/skills/qa-edge-hunter/SKILL.md

@@ -39,10 +39,13 @@ tech-lead: ... GATE L2 → EVAL → GATE L3 PASS ──► QA EDGE HUNT (you)
 
 Pure worker (harness rule: stateless workers, one stateful orchestrator). Its WorkOrder
 carries `payload.feature`, `payload.spec_folder`, `payload.eval_report`, `payload.app_url`,
-`payload.kb_rules_path`, and `payload.ledger` (the discovery ledger, READ-ONLY — covered-territory
+`payload.launch_cmd`, `payload.build_gate`, `payload.kb_rules_path`, and `payload.ledger` (the discovery ledger, READ-ONLY — covered-territory
 context so a hunt does not re-report what is already known). **`app_url` is null when the
-deliverable is not served over HTTP** — a CLI, a library, a batch job. That is a normal order, not a
-malformed one: drive the built entry point instead, exactly as the Test Surface's process rows do.
+deliverable is not served over HTTP** — a CLI, a library, a batch job, a mobile app. That is a normal
+order, not a malformed one: drive the built entry point instead, exactly as the Test Surface's process
+rows do. When the order carries `launch_cmd`, that is how the app is brought up — run it, and treat a
+zero exit as the deliverable reached; `build_gate` records that the round's gate already launched it.
+Drive it with the tools the project's knowledge base names, by the path it gives.
 Do not refuse the hunt, and do not invent a URL. Its write surface is
 `.shapeup/<feature>/qa/**` only. The Hunter never touches the discovery ledger itself —
 ingest appends its `discoveries[]` under a `## Discovered` section, preserving single-writer
@@ -68,7 +71,8 @@ Phase Q3  │ Report ───────► qa/hunt-report.md — no score, no
 
 ```
 HARD (any miss → STOP, report which):
-  ✅ app reachable at the given URL (one real request, not a ping)
+  ✅ deliverable reachable: one real request at `app_url`, or `launch_cmd` run and exit 0, or one
+     real invocation of the entry point (not a ping, not a guess that a tool is missing)
   ✅ EVAL-FEATURE-<slug>.md exists with verdict: PASS
   ✅ if discovery/ledger.md exists: ledger.feature == <feature> (read-only context check —
      a missing ledger is fine; ingest creates it when your findings land)