shapeup-sdlc 3.18.2 → 4.0.0

package/kernel/gate.mjs

@@ -50,11 +50,11 @@
 //   5  no answer and on_missing=abort → the run aborts here, attributably
 //   2  usage / validation error
 
-import { readFileSync, writeFileSync, appendFileSync, existsSync, mkdirSync } from "node:fs";
-import { parseBoard } from "./reduce/board.mjs";
+import { readFileSync, writeFileSync, appendFileSync, existsSync, mkdirSync, readdirSync } from "node:fs";
 import { join, dirname } from "node:path";
 import { runArgs } from "./lib/argv.mjs";
-import { gateAnswerCandidates, gates as gatesPath, LOCAL, resultsDir, tasksDir, hammerCensus, readRunId, harnessRun } from "./lib/paths.mjs";
+import { gateAnswerCandidates, gates as gatesPath, LOCAL, resultsDir, ordersDir, qaDir, tasksDir, hammerCensus, readRunId, harnessRun, insideRunTrace, runArgsPath, dispatchReceipts } from "./lib/paths.mjs";
+import { belowFloor } from "./lib/floor.mjs";
 
 export const GATE_IDS = ["L0", "L1a", "L1a.5", "L1b", "L2", "L3", "QA", "H", "L4", "COACH-1"];
 
@@ -93,7 +93,7 @@ export const PRESETS = {
       "L2": { decision: "proceed", note: CI_NOTE },
       "L3": { decision: "loop", max_rounds: 3, note: "FAIL → fix round r+1, up to the run's max_rounds. The circuit breaker, not this file, ends the loop." },
       "QA": { decision: "run", note: "QA is a level-up, not a gate — it discovers, it cannot block." },
-      "H": { decision: "accept-cut-list", note: "Scope-hammer's cut list is accepted as proposed; baseline comparison still runs and is still recorded." },
+      "H": { decision: "accept-cut-list", note: "The census's cut list is accepted as proposed; baseline comparison still runs and is still recorded." },
       "L4": { decision: "ship", note: "Ship sign-off pre-approved. THIS is the one a reviewer should look at first when auditing a headless run." },
       "COACH-1": { decision: "skip", note: "No live PO to categorize feedback; retro rules are not filed from an unattended run." },
     },
@@ -109,7 +109,7 @@ export const PRESETS = {
     answers: {
       "L0": { decision: "proceed", note: "Config gate — mechanical." },
       "L1a": { decision: "proceed", note: "Orient review — advisory read." },
-      "L1a.5": { decision: "proceed", note: "Wiring review — checked by trace-lint." },
+      "L1a.5": { decision: "proceed", note: "Wiring review." },
       "L1b": { decision: "ask", note: "Board review is where scope is actually decided. Not pre-approvable." },
       "L2": { decision: "proceed", note: "The board facts travel in the gate block itself — green_scopes and hammer_proposals — so a preset answering here is not answering blind. A board with zero tasks is refused here regardless of the answer — the resolver narrows `proceed` to `ask` over an empty board." },
       "L3": { decision: "loop", max_rounds: 3, note: "Loop on FAIL; the breaker ends it." },
@@ -169,17 +169,16 @@ export function validate(set) {
  * Returns { gate, decision, source, note, status } where status ∈ ok | ask | abort.
  * Pure: the CLI turns `status` into the exit code, nothing here exits.
  */
-/** The three verdicts `scope-hammer` may return (shapeup-run.js's HAMMER schema). */
+/** The three verdicts the stop census may carry (`HammerCensus.verdict` in the domain registry). */
 export const HAMMER_VERDICTS = ["ship-now", "ship-after-fixes", "cannot-ship"];
 
 /**
  * The census verdict on disk for one run, or null when no census has run.
  *
- * Derived from the hammer's own WorkResult rather than taken from a caller: the verdict is the
- * product of a dispatch, and a gate that accepts it as an argument accepts whatever the caller
- * believes. `null` is a real answer here — "scope-hammer has not run" — and is the state a run that
- * returned `gate_h` from a circuit breaker is in, because the breaker returns long before the
- * hammer is dispatched.
+ * Derived from the census file the stop step wrote rather than taken from a caller: the verdict is the
+ * product of a step, and a gate that accepts it as an argument accepts whatever the caller
+ * believes. `null` is a real answer here — "the census has not run" — and is the state a run that
+ * routed to GATE H from a circuit breaker is in, until the stop step has written one.
  *
  * @param {string} cwd - Project root.
  * @param {string} slug - Feature slug.
@@ -187,9 +186,9 @@ export const HAMMER_VERDICTS = ["ship-now", "ship-after-fixes", "cannot-ship"];
  */
 export function censusVerdict(cwd, slug) {
   if (!slug) return null;
-  // The census artifact — written by the hammer at a path its order's substrate permits. The
-  // WorkResult fallback below is kept for a lane that wrote one the old way; a WorkResult may not
-  // carry a verdict under the schema, so in practice the artifact is the only source.
+  // The census artifact — written by the stop step. The WorkResult fallback below is kept for a lane
+  // that wrote one the old way; a WorkResult may not carry a verdict under the schema, so in practice
+  // the artifact is the only source.
   try {
     const c = hammerCensus(cwd, slug);
     if (existsSync(c)) {
@@ -207,6 +206,135 @@ export function censusVerdict(cwd, slug) {
   } catch { return null; }
 }
 
+/**
+ * The number of charters a hunt report says it ran.
+ *
+ * @param {(string|null)} text - The hunt report's text.
+ * @returns {(number|null)} The run count from its `charters: <run>/<approved>` line, or null.
+ */
+export function chartersRun(text) {
+  const m = String(text ?? "").match(/^charters:\s*(\d+)/m);
+  return m ? Number(m[1]) : null;
+}
+
+const readJson = (p) => { try { return JSON.parse(readFileSync(p, "utf8")); } catch { return null; } };
+
+/**
+ * Why a run that owes a QA hunt cannot ship, or null when it owes none or paid it.
+ *
+ * Derived from files, never from the census (the loop writes that itself). A hunt is owed when the
+ * evaluator passed a round (or the round was not evaluated) and the run was not launched with
+ * `noQa` and no QA row of this run says `skip`. It is paid when `results/hunt.json` exists and, for
+ * a `done` result over an app its order could reach, the hunt report ran at least one charter. A
+ * `failed` hunt says it could not hunt, which is honest and accepted. A run that never reached a
+ * passing round owes nothing: a build that has not passed is not worth edge-hunting.
+ *
+ * The case this exists for is the one nothing else sees: QA answered `run` and the hunter never
+ * dispatched, so no result exists to be wrong. An explicit `skip` answer is the recorded way out.
+ *
+ * @param {string} cwd - Project root.
+ * @param {string} slug - Feature slug.
+ * @returns {(string|null)} A reason phrased for the PO, or null.
+ */
+export function qaProblem(cwd, slug) {
+  if (!slug) return null;
+  if (readJson(runArgsPath(cwd, slug))?.noQa) return null;
+  const runId = readRunId(cwd, slug);
+  let rows = [];
+  try {
+    rows = readFileSync(gatesPath(cwd, slug), "utf8").split("\n").filter(Boolean)
+      .map((l) => { try { return JSON.parse(l); } catch { return null; } })
+      .filter((r) => r && r.run_id === runId && r.status === "ok");
+  } catch { return null; }
+  const qa = rows.filter((r) => r.gate === "QA").at(-1);
+  if (qa?.decision === "skip") return null;
+  const owed = rows.some((r) => r.gate === "L3" && ["pass", "not-evaluated"].includes(r.verdict));
+  if (!qa) return owed ? "the round passed but GATE QA was never crossed" : null;
+  if (qa.decision !== "run") return null;
+  const hunt = join(resultsDir(cwd, slug), "hunt.json");
+  if (!existsSync(hunt)) return "GATE QA was answered run and no hunt was dispatched (no results/hunt.json)";
+  const result = readJson(hunt);
+  if (!result) return "the hunt result cannot be read";
+  if (result.status !== "done") return null;
+  const payload = readJson(join(ordersDir(cwd, slug), "hunt.json"))?.payload || {};
+  if (!payload.launch_cmd && !payload.app_url) return null;
+  let report = null;
+  try { report = readFileSync(join(qaDir(cwd, slug), "hunt-report.md"), "utf8"); } catch { /* no report */ }
+  const n = chartersRun(report);
+  if (n === null) return "the hunt returned done with no hunt report carrying a `charters:` line";
+  return n > 0 ? null : "the hunt returned done over an app its order could reach, having run 0 charters";
+}
+
+/** The launch-record role each worker runs under; `qa` is never held to the floor. */
+export const WORKER_ROLE = { orient: "exec", "task-executor": "exec", "spec-evaluator": "eval", "qa-edge-hunter": "qa" };
+
+/**
+ * Whether a launch record's model names the model a receipt says ran.
+ *
+ * The record carries what the launcher typed — an alias (`sonnet`) or an id — and the receipt the id the
+ * host resolved (`claude-sonnet-5-5`), so equality is too strict and the alias is looked for inside the
+ * id. Nothing to compare on either side is not a mismatch: a mismatch is a claim, and it needs both names.
+ *
+ * @param {*} asked - The launch record's model for the role.
+ * @param {*} ran - The receipt's `usage.model`.
+ * @returns {boolean} True when they name the same model, or when one side is missing.
+ */
+export function sameModel(asked, ran) {
+  const a = String(asked ?? "").trim().toLowerCase();
+  const r = String(ran ?? "").trim().toLowerCase();
+  if (!a || !r) return true;
+  return a === r || r.includes(a) || a.includes(r);
+}
+
+/**
+ * The model each role ran on, read off this run's dispatch receipts, against the launch record.
+ *
+ * WHY THE GATE READS THIS. The floor is checked when the run opens, on the launch record — a request.
+ * The agents are defined `model: inherit`, so the model that ran is the launching session's unless the
+ * dispatch passed one, and the receipts are the only record of it. Across every archived run the record
+ * asked for `sonnet` and two runs that were compared against each other had run their workers on two
+ * different models, which no reader of the record could see. So the ship gate reads the receipts: an
+ * `exec` or `eval` worker that ran below the floor is the floor's own refusal, applied to what ran rather
+ * than to what was asked; any other difference is written down, because a cost or a verdict read against
+ * the wrong model is a figure about a different run.
+ *
+ * A receipt with no model (a background launch reports none) is counted as `unreported` and claims
+ * nothing. Rows of another run are ignored.
+ *
+ * @param {string} cwd - Project root.
+ * @param {string} slug - Feature slug.
+ * @returns {{asked: object, ran: object, unreported: number, mismatch: string[], below_floor: string[]}}
+ *   `ran` maps role → model id → receipt count; `mismatch` and `below_floor` are sentences for the PO.
+ */
+export function modelEvidence(cwd, slug) {
+  const asked = readJson(runArgsPath(cwd, slug))?.models ?? {};
+  const runId = readRunId(cwd, slug);
+  let rows = [];
+  try {
+    rows = readFileSync(dispatchReceipts(cwd, slug), "utf8").split("\n").filter(Boolean)
+      .map((l) => { try { return JSON.parse(l); } catch { return null; } })
+      .filter((r) => r && (!runId || r.run_id === runId));
+  } catch { rows = []; }
+  const ran = { exec: {}, eval: {}, qa: {} };
+  let unreported = 0;
+  for (const r of rows) {
+    const role = WORKER_ROLE[r.skill_invoked] ?? null;
+    if (!role) continue;
+    const m = typeof r.usage?.model === "string" && r.usage.model ? r.usage.model : null;
+    if (!m) { unreported++; continue; }
+    ran[role][m] = (ran[role][m] ?? 0) + 1;
+  }
+  const n = (k) => `${k} receipt${k === 1 ? "" : "s"}`;
+  const mismatch = [], below = [];
+  for (const role of ["exec", "eval", "qa"]) {
+    for (const [m, k] of Object.entries(ran[role])) {
+      if (!sameModel(asked[role], m)) mismatch.push(`${role}: the launch record asked for ${asked[role] ?? "no model"}, ${n(k)} name${k === 1 ? "s" : ""} ${m}`);
+      if (role !== "qa" && belowFloor(m)) below.push(`${role} ran on ${m} in ${n(k)}, below the model floor (sonnet or above)`);
+    }
+  }
+  return { asked, ran, unreported, mismatch, below_floor: below };
+}
+
 /**
  * Narrow a resolved gate answer to what the run's own evidence supports.
  *
@@ -215,10 +343,10 @@ export function censusVerdict(cwd, slug) {
  * census cleared the run, so `ship` is only on the menu when a census exists and did clear it.
  *
  * Measured on a consumer: a run whose dispatch receipts carried `orient` and `task-executor` and
- * nothing else — `scope-hammer` never dispatched — recorded `H → accept-cut-list` and `L4 → ship`
+ * nothing else — no census was ever written — recorded `H → accept-cut-list` and `L4 → ship`
  * from the `ci` preset, while its own ledger read `status: escalated`, `final_verdict: ~`, every
- * requirement at `no evidence`. `shapeup-run.js` does guard this, but only after the hammer
- * dispatch, so a run that returns `gate_h` from a breaker reaches L4 by a route the guard does not
+ * requirement at `no evidence`. The run script did guard this, but only after the census
+ * step, so a run that returns `gate_h` from a breaker reaches L4 by a route the guard does not
  * cover. A check on one call site is not a property.
  *
  * Absence of a census disqualifies `ship` on its own: "no one looked" and "someone looked and it
@@ -237,7 +365,7 @@ export function narrowToEvidence(r, cwd, slug) {
   // among allowed answers and cannot supply the evidence that makes one allowed.
   if (r?.gate === "L2" && r?.status === "ok" && r?.decision === "proceed" && slug) {
     let tasks = 0;
-    try { tasks = parseBoard(tasksDir(cwd, slug)).length; } catch { tasks = 0; }
+    try { tasks = readdirSync(tasksDir(cwd, slug)).filter((f) => /^TASK-[\w.-]+\.md$/i.test(f)).length; } catch { tasks = 0; }
     if (tasks === 0) {
       return {
         gate: r.gate, status: "ask", source: r.source, decision: "ask", note: r.note,
@@ -252,10 +380,36 @@ export function narrowToEvidence(r, cwd, slug) {
   }
   if (r?.gate !== "L4" || r?.status !== "ok" || r?.decision !== "ship") return r;
   const verdict = censusVerdict(cwd, slug);
-  if (verdict === "ship-now" || verdict === "ship-after-fixes") return r;
+  if (verdict === "ship-now" || verdict === "ship-after-fixes") {
+    const qa = qaProblem(cwd, slug);
+    if (!qa) {
+      // The floor, applied to what ran. Opening the run checked the launch record; the receipts say
+      // which model each worker actually ran on, and `ship` over a build or a verdict produced below
+      // the floor is the same refusal one step later. A model that merely differs from the record is
+      // carried on the result and into the row, not refused: the PO may well have meant it.
+      const models = modelEvidence(cwd, slug);
+      if (models.below_floor.length) {
+        return {
+          gate: r.gate, status: "ask", source: r.source, decision: "ask", note: r.note,
+          refused: "ship", census: verdict, models,
+          reason: `GATE L4 cannot be answered "ship": ${models.below_floor.join("; ")}. The floor was checked on ` +
+                  `the launch record when the run opened; the dispatch receipts say what ran. Re-run the role on a ` +
+                  `model at or above the floor, or put the block to the PO.`,
+        };
+      }
+      return { ...r, models };
+    }
+    return {
+      gate: r.gate, status: "ask", source: r.source, decision: "ask", note: r.note,
+      refused: "ship", census: verdict, qa,
+      reason: `GATE L4 cannot be answered "ship": ${qa}. Dispatch the hunt, or answer GATE QA \`skip\` ` +
+              `(a recorded decision) and resolve L4 again. An answer chooses among the answers a gate ` +
+              `allows; it cannot supply the evidence that makes one allowed.`,
+    };
+  }
   const why = verdict === "cannot-ship"
-    ? "scope-hammer's census returned CANNOT SHIP"
-    : "scope-hammer has not run, so no census exists";
+    ? "the census returned CANNOT SHIP"
+    : "the census has not been written, so none exists";
   return {
     gate: r.gate, status: "ask", source: r.source, decision: "ask", note: r.note,
     refused: "ship", census: verdict,
@@ -415,6 +569,11 @@ export const ARGV_SPEC = {
   // before any verdict exists — "loop" on a FAIL — and its note says so; recorded without the
   // verdict, a PASS round's row read "FAIL → fix round", the opposite of what happened.
   verdict: { type: "str" },
+  // A decision the PO just gave in the session that reached the gate. It resolves THIS crossing with
+  // the source `PO (live)` and needs no answer file: the ledger row records who decided, and the
+  // evidence narrowing (`ship` needs a clearing census) still applies — an answer chooses among the
+  // answers a gate allows, never the evidence that makes one allowed.
+  answer: { type: "str" },
 };
 
 /**
@@ -434,6 +593,11 @@ export function gateNote(r, verdict) {
   if (r.gate === "L3" && verdict === "pass") {
     return `verdict PASS — the "${r.decision}" answer applies only to a failed round; the run goes on to QA and GATE H`;
   }
+  // A ship over workers that ran on a model other than the launch record's says so in the row itself,
+  // where whoever reads the ledger for a cost or a verdict will see it.
+  if (r.gate === "L4" && r.decision === "ship" && r.models?.mismatch?.length) {
+    return `${own ?? ""}${own ? " — " : ""}model differs from the launch record: ${r.models.mismatch.join("; ")}`;
+  }
   return own;
 }
 
@@ -456,6 +620,10 @@ function die(msg, code = 2) {
 export function cli(rawArgv) {
   const args = runArgs(ARGV_SPEC, rawArgv);
   const cwd = args.cwd || process.cwd();
+  if (args.resolve && insideRunTrace(cwd)) {
+    console.error(`✋ gate: ${cwd} is inside a run trace (${LOCAL}/); run it from the project root, or its row lands in a nested ledger.`);
+    process.exit(2);
+  }
 
   if (args.init) {
     const presetName = args.preset ?? "ci";
@@ -472,7 +640,18 @@ export function cli(rawArgv) {
     out({ ok: true, wrote: dest, preset: presetName, authorized_by: set.authorized_by, gates: Object.keys(set.answers).length });
   }
 
-  const found = discover({ cwd, file: args.file ?? null, preset: args.preset ?? null, slug: args.slug ?? null });
+  // A live answer builds a one-gate set instead of discovering one. `ask` is not an answer.
+  let found;
+  if (args.answer !== undefined && args.resolve) {
+    const valid = VALID_BY_GATE[args.resolve];
+    if (!valid) die(`unknown gate "${args.resolve}" — known: ${GATE_IDS.join(", ")}`);
+    if (args.answer === "ask" || !valid.includes(args.answer)) {
+      die(`"${args.answer}" is not a decision GATE ${args.resolve} takes — valid: ${valid.filter((d) => d !== "ask").join(", ")}`);
+    }
+    found = { set: { version: 1, preset: "custom", answers: { [args.resolve]: { decision: args.answer, note: "answered live by the PO" } } }, source: "PO (live)" };
+  } else {
+    found = discover({ cwd, file: args.file ?? null, preset: args.preset ?? null, slug: args.slug ?? null });
+  }
   if (found.error) die(found.error);
   const errs = validate(found.set);
   if (errs.length) die(`invalid gate answer set (${found.source}):\n  - ${errs.join("\n  - ")}`);
@@ -531,6 +710,8 @@ export function cli(rawArgv) {
       source: r.source ?? found.source, note: gateNote(r, verdict),
       round: args.round ?? null,
       ...(verdict ? { verdict } : {}),
+      // What ran, per role, beside what was asked — the machine-readable half of the note above.
+      ...(r.models ? { models: { asked: r.models.asked, ran: r.models.ran, unreported: r.models.unreported, mismatch: r.models.mismatch } } : {}),
     });
   }
   if (r.status === "ask") out({ ...r, ok: false }, 4);

package/kernel/harness.mjs

@@ -2,8 +2,7 @@
 // harness — the kernel's single entry point.
 //
 // WHAT THIS IS. Everything in the pipeline that must be DETERMINISTIC — measured rather than
-// claimed, single-writer rather than negotiated, an answer file rather than a vibe — is a
-// subcommand of this one script:
+// claimed, an answer file rather than a vibe — is a subcommand of this one script:
 //
 //     node ${CLAUDE_PLUGIN_ROOT}/kernel/harness.mjs <verb> [<action>] [flags]
 //
@@ -13,66 +12,34 @@
 // matches nothing is indistinguishable from a rule that works until the first dispatch fails.
 // Subcommands are free; entry points are not.
 //
-// WHO CALLS IT. Worker skills, from their own shells, and the hooks. The control plane — the
-// Workflow script — calls no shell at all: it branches on the structured return of an `agent()`
-// and never parses stdout.
+// WHO CALLS IT. The loop that drives a run (the `building` skill, in the session), worker skills
+// from their own shells, and the hooks.
 //
 // THE VERBS, and the invariant each one exists to keep:
 //
-//   verify   t0 · budget · envelope ·        Measured, not claimed. A model verifying itself is
-//            trace · spec · skills ·          claiming; these read artifacts and re-hash them.
-//            dispatch · build                 `skills` reads the roster off disk; `dispatch` reads
-//                                             the hook layer's evidence that a skill really resolved
-//                                             in this session — the half a file check cannot answer.
-//                                             `build` runs the feature's build and launch probes once
-//                                             per round before EVAL — T0 is per scope and proves
-//                                             nothing about whether the whole compiles or starts.
-//   reduce   ingest · hill · snapshot ·       Single writer. Shared state has exactly one author.
-//            ship · board · verdict · graph
-//   gate                                      An answer file with a source, not a vibe.
-//   probe    resume · t0 · stats · digest ·   Read-only queries over run state. `concurrency`
-//            concurrency · leg · eval ·        answers how many legs ran at once and what the
-//            owner · requirements · attempts ·
-//            hunt
-//                                              fan-out bought, and refuses a figure the record set
-//                                              cannot support rather than printing a plausible one.
-//                                              `leg` answers whether a scope's work reached the
-//                                              board — a green T0 says its fixtures passed, not that
-//                                              its result was ever applied, and a leg that skipped
-//                                              its own ingest step is indistinguishable from one that
-//                                              did not until something reads the writer's own record.
-//                                              `eval` answers what an EVAL round's WorkResult
-//                                              actually said, mechanically — the round-loop branch
-//                                              reads this instead of trusting a dispatching agent's
-//                                              own end-of-turn summary of its own verdict. `owner`
-//                                              answers which scope may write a path, elected from
-//                                              the contracts — so a census cites it instead of
-//                                              asserting ownership from memory. `requirements`
-//                                              answers which pitch clause a verdict reached, joined
-//                                              through the plan's own covers: edge — the L4 line and
-//                                              GATE H's census cite it for the same reason.
-//                                              `attempts` answers how many of a scope's attempts are
-//                                              ATTESTED (a dispatch receipt AND a leg row or a
-//                                              WorkResult), never the order set or the T0 verdict
-//                                              set alone — the round loop's inner breaker and
-//                                              scope-hammer's census both cite it, so they cannot
-//                                              disagree about the same exhaustion again.
-//   init     run · fit · run-args              Opens a run, or refuses it (exit 3). `run-args`
-//                                              writes GATE L0.9b's launch record and echoes it.
-//   report   export                           Projects the run's records as fact tables.
-//   compile                                   The WorkOrder: schema-valid or nothing is dispatched.
+//   verify   t0 · envelope · skills    Measured, not claimed. A model verifying itself is claiming;
+//                                      these read artifacts and re-hash them. `t0` runs a scope's
+//                                      fixtures and keeps or reverts the tree; `envelope` checks an
+//                                      order or a result against its schema (and is the dispatch
+//                                      gate when called as a hook); `skills` reads the worker roster
+//                                      off disk.
+//   gate                               An answer file with a source, not a vibe.
+//   init     run                       Opens a run, or refuses it (exit 3). Writes the receipt and
+//                                      the launch record, and refuses a model below the floor.
+//   order    open · close              Arms and retires the write fence's pointer, and records how a
+//                                      run ended.
 //
 // EXIT CODES are the subcommand's own and are part of its contract: 0 success · 1 ran, answer is
 // no · 2 malformed input, nothing ran (`lib/argv.mjs`) · 3 `init run` refused to open · 4/5 gate
-// stop/abort · 6 budget tripped. This dispatcher adds exactly one of its own: 2 for an unknown
-// verb, which is the same "the input was malformed" case.
+// stop/abort. This dispatcher adds exactly one of its own: 2 for an unknown verb, which is the same
+// "the input was malformed" case.
 
 import { isMain } from "./lib/argv.mjs";
 
 /**
  * verb → action → module, the whole routing table.
  *
- * A verb whose value is a string takes no action word (`gate`, `compile`); a verb whose value is an
+ * A verb whose value is a string takes no action word (`gate`, `order`); a verb whose value is an
  * object requires one, and `_default` names the action taken when it is omitted.
  *
  * Exported so the structural suite enumerates the subcommands from THIS table rather than from a
@@ -80,25 +47,11 @@ import { isMain } from "./lib/argv.mjs";
  */
 export const ROUTES = {
   verify: {
-    t0: "./verify/t0.mjs", budget: "./verify/budget.mjs", envelope: "./verify/envelope.mjs",
-    trace: "./verify/trace.mjs", spec: "./verify/spec.mjs", skills: "./verify/skills.mjs",
-    dispatch: "./verify/dispatch.mjs", build: "./verify/build.mjs",
+    t0: "./verify/t0.mjs", envelope: "./verify/envelope.mjs", skills: "./verify/skills.mjs",
   },
-  reduce: {
-    ingest: "./reduce/ingest.mjs", hill: "./reduce/hill.mjs", snapshot: "./reduce/snapshot.mjs",
-    ship: "./reduce/ship.mjs", board: "./reduce/board.mjs", verdict: "./reduce/verdict.mjs",
-    graph: "./reduce/graph.mjs",
-  },
-  probe: {
-    resume: "./probe/resume.mjs", t0: "./probe/t0.mjs", stats: "./probe/stats.mjs",
-    digest: "./probe/digest.mjs", concurrency: "./probe/concurrency.mjs",
-    leg: "./probe/leg.mjs", eval: "./probe/eval.mjs", owner: "./probe/owner.mjs",
-    requirements: "./probe/requirements.mjs", attempts: "./probe/attempts.mjs", hunt: "./probe/hunt.mjs",
-  },
-  init: { run: "./init/run.mjs", fit: "./init/fit.mjs", "run-args": "./init/run-args.mjs" },
-  report: { export: "./report/export.mjs", _default: "export" },
   gate: "./gate.mjs",
-  compile: "./compile.mjs",
+  init: { run: "./init/run.mjs" },
+  order: "./order.mjs",
 };
 
 /** Every `<verb> <action>` pair, for the usage text and the unknown-verb rejection. */