shapeup-sdlc 3.14.1 → 3.15.1

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "shapeup-sdlc-plugin",
   "displayName": "ShapeUp SDLC Plugin",
-  "version": "3.14.1",
+  "version": "3.15.1",
   "description": "Shape Up SDLC harness for Claude Code: shaping, intake, orient, scope-mapping, building (T0-verified, sandboxed, scope-contracted), evaluation and QA skills orchestrated by a tech-lead.",
   "author": {
     "name": "Liberty Nguyen",

package/kernel/compile.mjs

@@ -1279,7 +1279,10 @@ export async function cli(rawArgv) {
     const revised = revisedChecksFor(cwd, slug, round);
     if (revised.length) payloadExtra.revised_checks = revised;
   }
-  if (operation === "evaluate") {
+  // The QA hunt drives the same running app the judge grades, so it needs the same way in. A mobile
+  // deliverable has no URL, and a hunt order carrying only `app_url: null` reported "no reachable
+  // deliverable" and hunted nothing over a build the round gate had just launched.
+  if (operation === "evaluate" || operation === "hunt") {
     const ev = launchEvidenceFor(cwd, slug, round);
     if (ev.build_gate !== undefined && payloadExtra.build_gate === undefined) payloadExtra.build_gate = ev.build_gate;
     if (ev.launch_cmd !== undefined && payloadExtra.launch_cmd === undefined) payloadExtra.launch_cmd = ev.launch_cmd;

package/kernel/probe/resume.mjs

@@ -633,10 +633,21 @@ export function deriveLedgerFacts(cwd, slug) {
   const readJson = (p) => { try { return JSON.parse(readFileSync(p, "utf8")); } catch { return null; } };
   const evalRows = [];
   const rDir = resultsDir(cwd, slug);
+  // THIS RUN'S VERDICTS ONLY. A run opened afresh over a slug that already ran keeps the earlier
+  // run's `evaluate-r<N>.json` beside its own, and a later-numbered one from the earlier run was read
+  // as this run's final verdict: measured, a run whose last round PASSed closed as `final_verdict:
+  // FAIL` from a previous run's round 3. A result carries no run key; its order does.
+  const runId = readRunId(cwd, slug);
+  const thisRun = (n) => {
+    if (!runId) return true;
+    const o = readJson(join(ordersDir(cwd, slug), `evaluate-r${n}.json`));
+    return !o?.run_id || o.run_id === runId;
+  };
   if (existsSync(rDir)) {
     for (const f of readdirSync(rDir)) {
       const m = f.match(/^evaluate-r(\d+)\.json$/);
       if (!m) continue;
+      if (!thisRun(m[1])) continue;
       const r = readJson(join(rDir, f));
       const overall = r?.verdict?.overall;
       if (overall) evalRows.push({ round: Number(m[1]), overall: String(overall), criteria: Array.isArray(r.verdict.criteria) ? r.verdict.criteria : [] });
@@ -649,7 +660,11 @@ export function deriveLedgerFacts(cwd, slug) {
   if (existsSync(gp)) {
     for (const line of readFileSync(gp, "utf8").split("\n")) {
       if (!line.trim()) continue;
-      try { decisions.push(JSON.parse(line)); } catch { /* a torn line proves nothing */ }
+      try {
+        const g = JSON.parse(line);
+        // Gate rows carry the run key; a row from an earlier run over the same slug is its history.
+        if (!runId || !g?.run_id || g.run_id === runId) decisions.push(g);
+      } catch { /* a torn line proves nothing */ }
     }
   }
   const t0ByRound = {};
@@ -658,6 +673,7 @@ export function deriveLedgerFacts(cwd, slug) {
     for (const f of readdirSync(vDir).filter((x) => x.endsWith(".json")).sort()) {
       const v = readJson(join(vDir, f));
       if (typeof v?.round !== "number") continue;
+      if (runId && v.run_id && v.run_id !== runId) continue;
       const t = (t0ByRound[v.round] ||= { green: 0, red: 0 });
       if (v.overall === "green") t.green++; else t.red++;
     }
@@ -667,7 +683,10 @@ export function deriveLedgerFacts(cwd, slug) {
   if (existsSync(bDir)) {
     for (const f of readdirSync(bDir).sort()) {
       const m = f.match(/^r(\d+)-t\d+\.json$/);
-      if (m) gateByRound[Number(m[1])] = readJson(join(bDir, f))?.overall ?? "?";
+      if (!m) continue;
+      const g = readJson(join(bDir, f));
+      if (runId && g?.run_id && g.run_id !== runId) continue;
+      gateByRound[Number(m[1])] = g?.overall ?? "?";
     }
   }
   const roundNums = [...new Set([...Object.keys(t0ByRound), ...Object.keys(gateByRound), ...evalRows.map((e) => e.round)].map(Number))].sort((a, b) => a - b);

package/kernel/reduce/ship.mjs

@@ -370,6 +370,21 @@ export function buildReport(facts) {
   return deboard(L.join("\n"), board.anchors);
 }
 
+/**
+ * The QA line the report may print. The run says whether it dispatched the hunt; the hunt's own
+ * report says whether anything was hunted. A hunter that could not reach the app still returns, and
+ * a report opening `charters: 0/…` over a dispatched hunt read as "QA: run" with no findings — which
+ * a reader takes for an app with nothing wrong, not for an app nobody drove.
+ * @param {string|undefined} passed - What the caller recorded (`run`, `skipped`), if anything.
+ * @param {string|null} huntReport - The hunt report's text, or null when there is none.
+ * @returns {string} `skipped`, `not-hunted` (dispatched, zero charters run), or `run`.
+ */
+export function qaStatus(passed, huntReport) {
+  if (passed === "skipped" || (!passed && !huntReport)) return passed || "skipped";
+  if (huntReport && /^charters:\s*0\s*\//m.test(huntReport)) return "not-hunted";
+  return passed || "run";
+}
+
 /**
  * Gather every fact from disk and render the report.
  * @param {{cwd:string, slug:string, verdict?:string, qa?:string}} opts - Inputs.
@@ -394,7 +409,7 @@ export function generate({ cwd, slug, verdict, qa }) {
     at: today(),
     verdict: verdict || run.final_verdict || "not-evaluated",
     census: (() => { try { return JSON.parse(readIf(hammerCensus(cwd, slug)) || "null"); } catch { return null; } })(),
-    qa: qa || (huntReport ? "run" : "skipped"),
+    qa: qaStatus(qa, huntReport),
     rounds: derivedRounds.rounds_used,
     roundsJudged: derivedRounds.rounds_judged,
     intakeSha: receipt.intake_sha256,

package/kernel/schemas/domain.schema.json

@@ -380,6 +380,8 @@
       "spec_folder",
       "eval_report",
       "app_url",
+      "launch_cmd",
+      "build_gate",
       "ledger",
       "kb_rules_path"
     ],
@@ -2428,7 +2430,7 @@
         },
         "launch_cmd": {
           "type": "string",
-          "description": "spec-evaluator: the project profile's launch probe — installs the built artifact, starts it and asserts the first screen. Derived by `harness compile` from project-profile.md, absent when the profile declares none. Where `run_cmd` is only a build, this is how the app is brought up; a non-zero exit is a finding, not a reason to guess another way."
+          "description": "spec-evaluator, qa-edge-hunter: the project profile's launch probe — installs the built artifact, starts it and asserts the first screen. Derived by `harness compile` from project-profile.md, absent when the profile declares none. Where `run_cmd` is only a build, this is how the app is brought up; a non-zero exit is a finding, not a reason to guess another way."
         },
         "revised_checks": {
           "type": "array",
@@ -2445,7 +2447,7 @@
         },
         "build_gate": {
           "type": "string",
-          "description": "spec-evaluator: this run's newest round build gate artifact (build/r<N>-t<T>.json) — each step's exit code and output tail, the record that the build ran and the app launched. Derived by `harness compile`, absent when the gate never ran. Read it before grading a [ui] row NO EVIDENCE."
+          "description": "spec-evaluator, qa-edge-hunter: this run's newest round build gate artifact (build/r<N>-t<T>.json) — each step's exit code and output tail, the record that the build ran and the app launched. Derived by `harness compile`, absent when the gate never ran. Read it before grading a [ui] row NO EVIDENCE."
         },
         "t0_artifacts": {
           "type": "array",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shapeup-sdlc",
-  "version": "3.14.1",
+  "version": "3.15.1",
   "description": "Shape Up for coding agents \u2014 with gates the agent can't talk its way past. Harness for Claude Code.",
   "bin": {
     "shapeup-sdlc": "bin/init.mjs"

package/skills/qa-edge-hunter/SKILL.md

@@ -39,10 +39,13 @@ tech-lead: ... GATE L2 → EVAL → GATE L3 PASS ──► QA EDGE HUNT (you)
 
 Pure worker (harness rule: stateless workers, one stateful orchestrator). Its WorkOrder
 carries `payload.feature`, `payload.spec_folder`, `payload.eval_report`, `payload.app_url`,
-`payload.kb_rules_path`, and `payload.ledger` (the discovery ledger, READ-ONLY — covered-territory
+`payload.launch_cmd`, `payload.build_gate`, `payload.kb_rules_path`, and `payload.ledger` (the discovery ledger, READ-ONLY — covered-territory
 context so a hunt does not re-report what is already known). **`app_url` is null when the
-deliverable is not served over HTTP** — a CLI, a library, a batch job. That is a normal order, not a
-malformed one: drive the built entry point instead, exactly as the Test Surface's process rows do.
+deliverable is not served over HTTP** — a CLI, a library, a batch job, a mobile app. That is a normal
+order, not a malformed one: drive the built entry point instead, exactly as the Test Surface's process
+rows do. When the order carries `launch_cmd`, that is how the app is brought up — run it, and treat a
+zero exit as the deliverable reached; `build_gate` records that the round's gate already launched it.
+Drive it with the tools the project's knowledge base names, by the path it gives.
 Do not refuse the hunt, and do not invent a URL. Its write surface is
 `.shapeup/<feature>/qa/**` only. The Hunter never touches the discovery ledger itself —
 ingest appends its `discoveries[]` under a `## Discovered` section, preserving single-writer
@@ -67,8 +70,13 @@ Phase Q3  │ Report ───────► qa/hunt-report.md — no score, no
 ## GATE Q0 — Preflight
 
 ```
+FIRST: read `payload.kb_rules_path` for the tool paths it names — a device tool that is not on PATH is
+  named there by its full path, and a bare-name lookup (`which`, a bare call) proves nothing.
 HARD (any miss → STOP, report which):
-  ✅ app reachable at the given URL (one real request, not a ping)
+  ✅ deliverable reachable: one real request at `app_url`, or `launch_cmd` run and exit 0, or one
+     real invocation of the entry point (not a ping, not a guess that a tool is missing). When the
+     order carries `launch_cmd`, run it before concluding anything; the report names the command
+     and its exit. A hunt that reached nothing returns `status: failed`, never `done`.
   ✅ EVAL-FEATURE-<slug>.md exists with verdict: PASS
   ✅ if discovery/ledger.md exists: ledger.feature == <feature> (read-only context check —
      a missing ledger is fine; ingest creates it when your findings land)