shapeup-sdlc 3.18.2 → 4.0.0

package/kernel/lib/contract.mjs

@@ -1,6 +1,6 @@
 // contract — read and write the committed contracts as markdown.
 //
-// WHY (ADR-0001). Scope contracts, the wiring map and the project profile are *low-level design*:
+// WHY. Scope contracts, the wiring map and the project profile are *low-level design*:
 // which files a slice may touch, which seam each use case attaches to, where the app starts. A
 // teammate should be able to read them in a pull request. As `.json` they were machine artifacts
 // sitting in the tier meant for prose, and nobody read them.
@@ -12,7 +12,7 @@
 //
 //   • scalars and string arrays  → frontmatter, in the `key: value` / `key: [a, b]` dialect the
 //     repo already parses in `compile-order.frontmatter`;
-//   • arrays of objects          → markdown TABLES, which `trace-lint.parseRequirements` and
+//   • arrays of objects          → markdown TABLES, which `requirements.parseRequirements` and
 //     `compile-order.ledgerDecisions` already demonstrate reading;
 //   • everything else in the file is prose, and is preserved on round-trip.
 //
@@ -40,7 +40,7 @@ import { join } from "node:path";
 // `signatures` names the columns that identify a table as THAT field's, and it exists because of
 // The heading match is exact, so a table written under `# Wiring map — <slug>` instead of
 // `## Wiring` parsed as ABSENT, and every reader downstream treats absent as "none declared". The
-// observed consequence was `trace-lint` reporting `🟢 green · 0/0 engines reach src/cli/main.js`
+// observed consequence was a wiring check reporting green with 0/0 engines reached
 // for a committed map holding six correct rows — the gate whose whole purpose is that no engine
 // ships orphaned, failing OPEN.
 //
@@ -60,7 +60,7 @@ export const SCOPE_CONTRACT = {
  * `WiringMap` — per use case: engine → seam → entry-point call site → affordance.
  *
  * `perSection` is a MIGRATION READER, and it exists because the canonical shape was never written.
- * `solution-architect` was told to produce a `{schema_version, feature, entry_point, entries[]}`
+ * The wiring author was told to produce a `{schema_version, feature, entry_point, entries[]}`
  * OBJECT and never told the markdown layout, so every run authored its own: a `## Entries` section
  * with one `### UC-xx — title` subsection per use case, each holding a vertical `| Field | Value |`
  * table. Under this spec that parses as no table at all — and the vertical layout carries no
@@ -68,8 +68,8 @@ export const SCOPE_CONTRACT = {
  * reports as perfectly readable while yielding nothing.
  *
  * Measured across every completed run in the corpus: 9 of 9 committed wiring maps parsed to ZERO
- * entries with `unreadableReason() === null`, and `trace-lint` certified `🟢 green · 0/0 engines
- * reach <entry point>` against a deliverable whose engines were on disk — the exact failure quoted
+ * entries with `unreadableReason() === null`, and the wiring check certified green with 0/0 engines
+ * reached against a deliverable whose engines were on disk — the exact failure quoted
  * in the banner above, recurred in a shape its own fix could not detect.
  *
  * The horizontal `## Wiring` table stays canonical: it is what `renderContract` emits, so a map
@@ -161,7 +161,7 @@ export function coerce(raw) {
   // These contracts are MARKDOWN on disk, and a code span is the idiomatic way to write a path or
   // an identifier in one; this repo's own prose backticks every path it names. Read literally,
   // `` `src/capture/add.js` `` is a filename with two backticks in it, which is on no disk
-  // anywhere — so `trace-lint` reported "engine file not on disk" and then "reachability is not
+  // anywhere — so the wiring check reported "engine file not on disk" and then "reachability is not
   // demonstrated" for a wiring map whose engines all resolve AND all reach the entry point. The
   // gate that exists so no engine ships orphaned failing CLOSED, on a correct map, is the same
   // silent-format family as the parser defects above, arriving from the other direction.
@@ -222,7 +222,7 @@ export function uncoerce(v) {
  * Split a `[a, b]` list body on commas that are NOT inside quotes.
  *
  * The old implementation was `body.split(",")`, and it shredded any member carrying a
- * comma — even a correctly quoted one. Measured: a `scope-architect` run probed the running CLI,
+ * comma — even a correctly quoted one. Measured: a scope-contract run probed the running CLI,
  * confirmed `tag` was unimplemented, and wrote the honest entry its own SKILL.md asks for —
  *   ["TBD — `tag` is not in dispatch.js's TABLE (exits 1, confirmed against the running CLI). A
  *     fixture asserting the spec'd behaviour (attach/remove a tag, idempotent double-tag) can only
@@ -324,7 +324,7 @@ export function splitFrontmatter(md) {
     // An indented run beneath a key is a YAML BLOCK SEQUENCE, and it used to be skipped
     // entirely — so `e2e_verification_fixtures:` followed by two `- "node …"` lines parsed to
     // null, the members vanished, and no reader could tell "declared nothing" from "declared
-    // something I discarded". Measured: a scope-architect run wrote three scopes of researched
+    // something I discarded". Measured: a scope-contract run wrote three scopes of researched
     // fixtures in this form and every one evaporated. It is ACCEPTED now, because it is the form a
     // model reaches for by default and the one that carries prose members without the quoting
     // problem — and anything indented that is NOT a block sequence is reported rather than dropped.
@@ -683,39 +683,6 @@ export function readContract(path, spec = SCOPE_CONTRACT) {
   return null;
 }
 
-/**
- * Read every contract in a directory, markdown and legacy JSON alike.
- *
- * A `.md` and a `.json` for the same id is a half-finished migration, not two scopes — the
- * markdown wins and the JSON is ignored, so a stale leftover cannot resurrect an old substrate.
- *
- * @param {string} dir - Directory of contracts (typically `scopes/`).
- * @param {{tables:Object<string,string>}} [spec=SCOPE_CONTRACT] - Field → heading map.
- * @returns {Array<{contract:Object, path:string, format:string, id:string}>} One entry per
- *   contract, sorted by id; [] when the directory is absent. Unparseable files are skipped.
- */
-export function readAllContracts(dir, spec = SCOPE_CONTRACT) {
-  if (!existsSync(dir)) return [];
-  let names;
-  try { names = readdirSync(dir); } catch { return []; }
-  const ids = new Map();
-  for (const f of names) {
-    const m = f.match(/^(.+)\.(md|json)$/);
-    if (!m) continue;
-    // markdown wins over a legacy sibling of the same id
-    if (m[2] === "json" && ids.has(m[1])) continue;
-    if (m[2] === "md" || !ids.has(m[1])) ids.set(m[1], f);
-  }
-  const out = [];
-  for (const [id, file] of [...ids].sort(([a], [b]) => a.localeCompare(b))) {
-    try {
-      const found = readContract(join(dir, file), spec);
-      if (found) out.push({ ...found, id });
-    } catch { /* an unparseable contract is reported by spec-lint, not here */ }
-  }
-  return out;
-}
-
 // ---------------------------------------------------------------------------
 // The scope ↔ spec join
 // ---------------------------------------------------------------------------
@@ -734,35 +701,6 @@ export function ucId(ref) {
   return String(ref ?? "").trim().replace(/^\[\[|\]\]$/g, "").replace(/^usecases\//, "").replace(/\.md$/, "").trim();
 }
 
-/**
- * Normalise one requirement reference to the registry's key space (`REQ-<n>`).
- *
- * TWO KEY SPACES FOR ONE THING, and the measurement is what decided this. A pitch numbers its
- * requirements `R1…R21`; the registry, every AC's `covers:` clause and every `traces_to[]` key off
- * `REQ-<n>`. Measured across two runs of one pitch, the scope contracts cited `R<n>` — 20 of 21
- * requirements had a scope claiming them, and every one of those links resolved to nothing,
- * reported 23 times a run as a shape warning nobody could act on. So the edge WAS produced; it was
- * severed by spelling alone.
- *
- * Normalising here rather than teaching the planner to emit `REQ-<n>` is deliberate: `covers[]` is
- * an OPTIONAL contract field, so a fix that depends on a planner choosing to comply converts
- * whatever links the next run happens to write, while this converts the links on contracts already
- * committed, with no worker behaviour change. The craft still asks for `REQ-<n>` going forward.
- *
- * THIS IS A MAPPING PERFORMED BEFORE THE PATTERN, NOT A LOOSENING OF IT. `^REQ-[0-9]+$` is
- * unchanged everywhere it appears; a reference this function does not recognise is returned
- * verbatim, so it still fails that pattern and is still reported.
- *
- * @param {string} ref - A requirement reference (`REQ-12`, `R12`, `R-12`, `[[REQ-12]]`, any case).
- * @returns {string} The canonical `REQ-<n>` id, or the trimmed input unchanged when it is not a
- *   numbered requirement reference at all.
- */
-export function reqId(ref) {
-  const s = String(ref ?? "").trim().replace(/^\[\[|\]\]$/g, "").trim();
-  const m = s.match(/^(?:REQ|R)-?([0-9]+)$/i);
-  return m ? `REQ-${m[1]}` : s;
-}
-
 /**
  * The tasks on a LOCAL board that belong to a scope, joined through the COMMITTED spec.
  *
@@ -809,28 +747,6 @@ function byUseCase(tasks, contract) {
   return (tasks || []).filter((t) => (t.use_case_refs || []).some((r) => mine.has(ucId(r))));
 }
 
-/**
- * Tasks that more than one scope would build — the ambiguity {@link tasksForScope} cannot resolve.
- *
- * Dispatch has to be a partition: a task built by two scopes is built twice, and the second builder
- * is denied by the sandbox for writing outside its own substrate, so the cost lands as burnt
- * attempts and escalations rather than as corruption. Measured on the corpus's four-scope,
- * one-use-case cut: every task claimed by every scope.
- *
- * @param {Array<{id:string, scope_id?:string, use_case_refs?:string[]}>} tasks - The parsed board.
- * @param {Array<{scope_id:string, use_cases?:string[]}>} contracts - Every scope in the run.
- * @returns {Array<{task_id:string, scopes:string[]}>} One entry per contested task; [] when the
- *   assignment is already a partition.
- */
-export function scopePartitionConflicts(tasks, contracts) {
-  const out = [];
-  for (const t of tasks || []) {
-    const owners = (contracts || []).filter((c) => tasksForScope([t], c).length).map((c) => c.scope_id);
-    if (owners.length > 1) out.push({ task_id: t.id, scopes: owners });
-  }
-  return out;
-}
-
 /**
  * Extract the prose a regeneration must not destroy — everything in the body except the sections
  * this spec owns.

package/kernel/lib/floor.mjs

@@ -0,0 +1,64 @@
+// MODEL FLOOR AND LAUNCH-RECORD CHECK — what a run may be launched with, decided in code.
+//
+// The model floor is a denylist of cheap tiers refused for the roles that write code and grade it
+// (`exec`, `eval`). It is a denylist on purpose, and fails open: an id this list has never heard of
+// is allowed, because refusing an unknown future model would stop a run for a reason nobody can
+// act on. `qa` is not checked — a hunt discovers and never decides.
+//
+// WHY THE KERNEL OWNS IT. A rule that only a launch script applied was a rule a different launch
+// path never met. Here it is one function, read by whoever opens the run and by the loop that
+// drives it, so the two cannot disagree about what is below the floor.
+
+const BELOW_FLOOR = [/ha[i1]ku/i, /\binstant\b/i, /\bmini\b/i, /\bnano\b/i, /\blite\b/i, /\bsmall\b/i];
+
+/**
+ * Whether a model id names a tier below the floor.
+ * @param {*} m - A model id or alias.
+ * @returns {boolean} True for an empty value or a denylisted tier.
+ */
+export function belowFloor(m) {
+  const s = String(m ?? "").trim();
+  return s === "" || BELOW_FLOOR.some((re) => re.test(s));
+}
+
+/** The auto levels a launch may name. */
+export const AUTO_LEVELS = ["interactive", "auto", "unattended"];
+
+/**
+ * The roles whose model sits below the floor, as sentences naming the role. `qa` is never checked, and
+ * `eval` is not under `--no-eval`: a run that skips evaluation never resolves a judge.
+ *
+ * @param {object} models - The role -> model matrix (`exec`, `eval`, `qa`).
+ * @param {{noEval?: boolean}} [opts] - Whether evaluation is skipped.
+ * @returns {string[]} One sentence per offending role; empty when the matrix clears the floor.
+ */
+export function floorProblems(models, { noEval = false } = {}) {
+  const out = [];
+  for (const role of ["exec", "eval"]) {
+    if (role === "eval" && noEval) continue;
+    if (belowFloor(models?.[role])) {
+      const m = String(models?.[role] ?? "").trim();
+      out.push(`models.${role} ${m ? `"${m}" ` : ""}is below the model floor (sonnet or above)`);
+    }
+  }
+  return out;
+}
+
+/**
+ * Everything wrong with a launch record, as sentences. Empty means launchable.
+ *
+ * @param {object} a - The parsed launch record (`run-args.json`).
+ * @returns {string[]} Problems, empty when the record may run.
+ */
+export function launchProblems(a) {
+  const problems = [];
+  for (const k of ["slug", "autoLevel", "models", "budgets"]) {
+    if (!a || a[k] === undefined || a[k] === null || a[k] === "") problems.push(`launch record is missing "${k}"`);
+  }
+  if (a?.autoLevel && !AUTO_LEVELS.includes(a.autoLevel)) problems.push(`autoLevel must be one of ${AUTO_LEVELS.join(" | ")}`);
+  if (a?.budgets && !(a.budgets.maxRounds && a.budgets.attemptBudget)) {
+    problems.push("budgets must carry maxRounds and attemptBudget");
+  }
+  if (a?.models) problems.push(...floorProblems(a.models, { noEval: Boolean(a.noEval) }));
+  return problems;
+}

package/kernel/lib/paths.mjs

@@ -5,7 +5,7 @@
 // syntaxes (a string literal and a `join(cwd, "…", …)` chain) is a rename that no single search
 // completes.
 //
-// TIER DISCIPLINE (ADR-0001), the reason there are two roots:
+// TIER DISCIPLINE, the reason there are two roots:
 //   SHARED (committed) — prose a teammate reads: shaping, spec, contracts, requirements, report.
 //   LOCAL (gitignored) — run state, envelopes, verification artifacts, machine policy.
 //
@@ -17,12 +17,12 @@
 // touching no filesystem. The run-key half reads receipts and fails open (`null`, never a throw),
 // because hooks call it and telemetry must never break a tool call.
 
-import { join } from "node:path";
+import { join, resolve, sep } from "node:path";
 import { readFileSync } from "node:fs";
 import { createHash } from "node:crypto";
 
 // ---------------------------------------------------------------------------
-// The two roots. Renaming a root is these two lines plus migration 0006.
+// The two roots. Renaming a root is these two lines.
 // ---------------------------------------------------------------------------
 
 // Both roots are POSIX strings, deliberately. They are used two ways — fed to `join()` (which
@@ -35,7 +35,7 @@ import { createHash } from "node:crypto";
  *
  * Was `docs/shapeup-sdlc`. Moved out of `docs/` because many projects publish that directory
  * through a static-site generator, which either publishes the spec tree by accident or fails the
- * site build on it (ADR-0001).
+ * site build on it.
  */
 export const SHARED = "shapeup";
 
@@ -43,8 +43,8 @@ export const SHARED = "shapeup";
 export const LOCAL = ".shapeup";
 
 /**
- * The pre-ADR-0001 roots. Migration `0006` moves a project from these to the pair above;
- * `bin/init.mjs` writes ignore rules covering both so a half-migrated checkout cannot commit a
+ * The earlier roots. Nothing migrates a project off them any more;
+ * `bin/init.mjs` writes ignore rules covering both so a checkout still carrying one cannot commit a
  * run trace. Nothing else should read these.
  */
 export const LEGACY = { shared: "docs/shapeup-sdlc", local: ".shapeup-sdlc" };
@@ -81,6 +81,18 @@ export const sharedRoot = (cwd, slug) => join(cwd, SHARED, slug);
  * @param {string} slug - Feature slug.
  * @returns {string} `<cwd>/.shapeup/<slug>`.
  */
+/**
+ * Whether a working directory is inside a run trace (a `.shapeup/` folder).
+ *
+ * A kernel command resolves every path from the working directory, so run from inside the trace it
+ * would open a second, empty run nested in the first and write its records there — a real run did
+ * exactly that. The commands that write run state refuse instead.
+ *
+ * @param {string} cwd - The directory the command was run from.
+ * @returns {boolean} True when `.shapeup` is one of its path segments.
+ */
+export const insideRunTrace = (cwd) => resolve(cwd).split(sep).includes(LOCAL);
+
 export const localRoot = (cwd, slug) => join(cwd, LOCAL, slug);
 
 // ---------------------------------------------------------------------------
@@ -93,7 +105,7 @@ export const specDir = (cwd, slug) => join(sharedRoot(cwd, slug), "spec");
 export const usecasesDir = (cwd, slug) => join(specDir(cwd, slug), "usecases");
 /** Shaping artifacts — pitch, framing, breadboard, baseline, glossary. `init run` looks here for a breadboard. */
 export const shapingDir = (cwd, slug) => join(sharedRoot(cwd, slug), "shaping");
-// The three contracts are markdown on disk and JSON on the wire (ADR-0001) — see
+// The three contracts are markdown on disk and JSON on the wire — see
 // `lib/contract.mjs`. `readContract()` accepts either extension, so a project mid-migration
 // keeps working; these builders name the form the harness WRITES.
 
@@ -103,20 +115,18 @@ export const scopesDir = (cwd, slug) => join(sharedRoot(cwd, slug), "scopes");
 export const scopeContract = (cwd, slug, id) => join(scopesDir(cwd, slug), `${id}.md`);
 /** The wiring map — engine → seam → entry-point call site → affordance. */
 export const wiringMap = (cwd, slug) => join(sharedRoot(cwd, slug), "wiring-map.md");
-/** Archetype + entry_point; gates the reachability arm of trace-lint. */
+/** Archetype + entry_point + the build and launch probes. */
 export const projectProfile = (cwd, slug) => join(sharedRoot(cwd, slug), "project-profile.md");
 /** The REQ clause registry that covers-closure checks against. */
 export const requirements = (cwd, slug) => join(sharedRoot(cwd, slug), "requirements.md");
-/** Hill shards — mechanical phase per scope. */
-export const hillDir = (cwd, slug) => join(sharedRoot(cwd, slug), "hill");
 /** The frozen ship report, written once at GATE L4. */
 export const report = (cwd, slug) => join(sharedRoot(cwd, slug), "REPORT.md");
-/** Team-shared coaching rules, read back by the coachable workers and by the tech lead at GATE L0. */
+/** Team-shared coaching rules, read back by the coachable workers, the plan activity and the loop at GATE L0. */
 export const knowledgeBaseDir = (cwd) => join(sharedDir(cwd), "knowledge-base");
-/** One worker's coaching file. */
+/** One reader's coaching file (a coachable worker, or the `plan` / `building` activity). */
 export const knowledgeBase = (cwd, skill) => join(knowledgeBaseDir(cwd), `${skill}.md`);
 // `.harness-version` and `.harness-migrations` were resolved here, committed by necessity as
-// ADR-0001's third exception. Their sole writer was the upgrade path's data-migration runner, which
+// The third exception to the tier rule. Their sole writer was the upgrade path's data-migration runner, which
 // has been removed; no code in the plugin has written either file since. The helpers went with
 // them rather than remaining as resolvable paths to files nothing produces — a path helper is a
 // claim that the file is part of the layout, and this one would have been false.
@@ -142,22 +152,18 @@ export const intake = (cwd, slug) => join(localRoot(cwd, slug), "intake.md");
 export const breadboard = (cwd, slug) => join(localRoot(cwd, slug), "breadboard.md");
 /**
  * The launch record's filename, as a constant rather than a literal at each call site — the
- * writer (`harness init run-args`) and every reader (`probe concurrency`'s `dialFrom()`) resolve
+ * writer (`harness init run`) and every reader resolve
  * the same path through this constant, the same way {@link runIdFromRoot} resolves `RECEIPT_FILE`
  * against a bare run root rather than through {@link receipt}'s `(cwd, slug)` form: a caller that
  * already holds the run root (an archived trace, `--run-root <dir>`) has no slug to reconstruct.
  */
 export const RUN_ARGS_FILE = "run-args.json";
-/** The launch record — the RunArgs object a run was launched with (GATE L0.9b), kernel-written. */
+/** The launch record — the RunArgs object a run was launched with (GATE L0.9b), written by `init run`. */
 export const runArgsPath = (cwd, slug) => join(localRoot(cwd, slug), RUN_ARGS_FILE);
 /** The run ledger — rounds, decisions, status frontmatter. */
 export const harnessRun = (cwd, slug) => join(localRoot(cwd, slug), "harness-run.md");
-/** File-derived mid-run digest, frozen by `reduce snapshot --write` as an audit anchor. */
-export const runSnapshot = (cwd, slug) => join(localRoot(cwd, slug), "run-snapshot.json");
 /** The task board directory. */
 export const tasksDir = (cwd, slug) => join(localRoot(cwd, slug), "tasks");
-/** The board index. */
-export const boardIndex = (cwd, slug) => join(tasksDir(cwd, slug), "_index.md");
 /** Compiled WorkOrders. */
 export const ordersDir = (cwd, slug) => join(localRoot(cwd, slug), "orders");
 /** Returned WorkResults. */
@@ -167,7 +173,7 @@ export const resultsDir = (cwd, slug) => join(localRoot(cwd, slug), "results");
  *
  * IT HAS ITS OWN DIRECTORY, and that is not tidiness. A receipt filed as a sibling of the order it
  * answers (`orders/orient.receipt.json`) would land inside a directory three readers enumerate —
- * `probe resume`, `reduce graph` and `report export` all `readdirSync` `orders/` — where it survives
+ * `probe resume` and the order set both `readdirSync` `orders/` — where it survives
  * today only because each of them happens to filter `.json`. `orient.receipt.json` passes that
  * filter and becomes a bogus `Order` node in the run graph. A separate directory means no future
  * reader has to know this file exists.
@@ -180,27 +186,6 @@ export const resultsDir = (cwd, slug) => join(localRoot(cwd, slug), "results");
  * (`receipt`, above, is the RUN receipt — a different fact, hence the different name.)
  */
 export const dispatchReceipts = (cwd, slug) => join(localRoot(cwd, slug), "receipts", "dispatch.jsonl");
-/**
- * Leg-completion rows — the moment a dispatched leg was closed by the reducer.
- *
- * WHY IT IS A SEPARATE LEDGER FROM {@link dispatchReceipts}. A dispatch receipt is written by a
- * `PostToolUse` hook, which fires when the skill RESOLVES — measured across archived runs, 1.8 to
- * 47 seconds after the order was compiled, on legs that then ran for minutes. So the receipt is a
- * hook-attested START and there is no end anywhere in the record set: concurrency and span are
- * guesses without one. This ledger is the end, written by the one component that closes a leg.
- *
- * WHY IT SNAPSHOTS RATHER THAN POINTS. A row carries the order's `compiled_at` as a VALUE, not a
- * path to read it from later. Order paths are reused verbatim on relaunch, so the `compiled_at` in
- * `orders/<id>.json` is the LAST compile's; a row that deferred to the file would silently re-date
- * itself to a dispatch that is not the one it recorded.
- *
- * APPEND-ONLY JSONL, for the same two reasons `dispatch.jsonl` is: order ids repeat across
- * relaunches and rounds, and scopes close concurrently. One `O_APPEND` line needs no lock.
- *
- * A LEG THAT DIES LEAVES NO ROW, deliberately. The absence is the fact — a reader compares starts
- * to completions and reports the hole rather than averaging over it.
- */
-export const legLedger = (cwd, slug) => join(localRoot(cwd, slug), "legs.jsonl");
 /** T0 verification artifacts. */
 export const t0Dir = (cwd, slug) => join(localRoot(cwd, slug), "t0");
 /** Immutable per-attempt verdict artifacts the evaluator must cite. */
@@ -216,45 +201,22 @@ export const trials = (cwd, slug) => join(t0Dir(cwd, slug), "trials.jsonl");
  * {@link decisions}, one small file with one writer.
  */
 export const gates = (cwd, slug) => join(localRoot(cwd, slug), "gates.jsonl");
-/**
- * The round build gate's verdicts — one immutable artifact per gate run, `r<N>-t<T>.json`.
- *
- * A separate directory from `t0/`, on purpose. A T0 verdict is one scope's fixtures inside that
- * scope's substrate; this is the FEATURE's build, launched the way the ledger's `run_cmd` and the
- * profile's probes say a user would, and it belongs to no scope. Written by `harness verify build`,
- * read by `reduce hill` (a green T0 in a round whose build is red moves no dot) and by
- * `harness compile` (a red gate is the next round's bug list).
- */
-export const roundBuildDir = (cwd, slug) => join(localRoot(cwd, slug), "build");
 /** Evaluator output — report, evidence, verdict ledger. */
 export const evaluationDir = (cwd, slug) => join(localRoot(cwd, slug), "evaluation");
-/** The workflow launcher's run directory — `journal.jsonl` and the launch `result.json`. */
-export const workflowRunDir = (cwd, slug) => join(localRoot(cwd, slug), "workflow-run");
 /** QA hunt output. */
 export const qaDir = (cwd, slug) => join(localRoot(cwd, slug), "qa");
 /** Scout recon — code-surface map, spikes, discovered seed. */
 export const orientDir = (cwd, slug) => join(localRoot(cwd, slug), "orient");
 /** Time-boxed spike workspace. */
 export const spikesDir = (cwd, slug) => join(localRoot(cwd, slug), "spikes");
-/** Covers-closure + reachability run trace. */
-export const traceDir = (cwd, slug) => join(localRoot(cwd, slug), "trace");
 /** The discovered-task ledger every discovery flow appends to. */
 export const discoveryLedger = (cwd, slug) => join(localRoot(cwd, slug), "discovery", "ledger.md");
-/**
- * Adjudicated decisions, read back by `compile-order` as binding precedent.
- *
- * LOCAL since ADR-0001. It was committed, and it is appended to DURING a build round — so a run
- * left the working tree dirty in the deliverable tier while it was still building. Its
- * conclusions reach the team in `REPORT.md` at GATE L4 instead, frozen once.
- */
-export const roundLedger = (cwd, slug) => join(localRoot(cwd, slug), "round-ledger.md");
-
 /**
  * Spec WORKING NOTES — analysis that informed the contract but is not the contract.
  *
  * `synthesis.md`, `assess-report.md`, `feedback.md`, `api-feasibility.md`, `integration.md`. The
- * committed `spec/` keeps only what the evaluator grades against and a reviewer needs (ADR-0001
- * "contract vs working artifact").
+ * committed `spec/` keeps only what the evaluator grades against and a reviewer needs (the
+ * "contract vs working artifact" rule).
  */
 export const workingDir = (cwd, slug) => join(localRoot(cwd, slug), "working");
 
@@ -272,8 +234,7 @@ export const workingDir = (cwd, slug) => join(localRoot(cwd, slug), "working");
  *
  * What is left is written once, at run open, and never moved again, so it is not a concurrency
  * hazard. Its readers all degrade rather than fail without it: the budget check and the snapshot
- * both fall back to scanning for a receipt or a mid-run ledger, and `report export` refuses with
- * instructions rather than guessing. The one thing it uniquely supplies is the slug that
+ * both fall back to scanning for a receipt or a mid-run ledger. The one thing it uniquely supplies is the slug that
  * {@link resolveRunId} turns into a `run_id` for callers that were handed no slug — hook decision
  * rows, above all, which without it are written unjoinable to any run.
  */
@@ -296,7 +257,7 @@ export const activeOrder = (cwd) => join(localDir(cwd), "active-order");
  * close in the same act that retires the run pointers, and superseded by the next close.
  *
  * Why it exists: retiring the pointers is right (a finished run must stop fencing the checkout),
- * but the close lands BEFORE the stretch that decides the most — the scope-hammer census, the ship
+ * but the close lands BEFORE the stretch that decides the most — the stop census, the ship
  * phase, the export — and every hook decision in that stretch resolved its run through the pointer
  * that was just removed. Measured on a live run: every decision row after `closed_at` carried
  * `run_id: null`, the census dispatch included. The breadcrumb keeps that join without keeping the
@@ -305,30 +266,14 @@ export const activeOrder = (cwd) => join(localDir(cwd), "active-order");
 export const lastRun = (cwd) => join(localDir(cwd), "last-run");
 
 /**
- * Scope-hammer's census as DATA — `{verdict, cut_list, …}` — the one artifact GATE L4's resolver
- * reads before it lets an answer set say `ship`. The hammer's WorkResult may not carry a verdict
- * (its census is a proposal, never envelope data ingest acts on), and its printed H0/H1/H2 blocks
- * are prose; this file is the same proposal, written by the same hand, in a shape a gate can read.
- * Measured before it existed: a green census returned as the worker's report, and L4 could only
- * record `ask`, because nothing on disk said so.
+ * The stop step's census as DATA — `{verdict, cut_list, …}` — the one artifact GATE L4's resolver
+ * reads before it lets an answer set say `ship`. The loop's printed H0/H1/H2 blocks are prose; this
+ * file is the same proposal, written by the same hand, in a shape a gate can read. Measured before
+ * it existed: a green census returned as the worker's report, and L4 could only record `ask`,
+ * because nothing on disk said so. (The file keeps its name from when a worker wrote it.)
  */
 export const hammerCensus = (cwd, slug) => join(localRoot(cwd, slug), "reports", "hammer-census.json");
 
-/**
- * Where the run scripts are staged for launch, inside the project.
- *
- * The orchestrator's Workflow scripts ship with the plugin, which lives OUTSIDE the project — and
- * the Workflow tool will only load a script it is already allowed to read, meaning the working
- * directory or a directory the operator added. An install path therefore fails the launch outright,
- * with no permission rule that can fix it: the grant that authorises the tool does not widen where
- * it may read from. So ``harness init run`` copies the shipped scripts here, and the launch names
- * this project-local path. LOCAL, because a staged copy is a build artifact of the run, not a
- * source file anybody should review or commit.
- */
-export const workflowsStage = (cwd) => join(localDir(cwd), "workflows");
-
-/** The staged run script as the LAUNCH names it — project-relative, `/`-joined on every platform. */
-export const globWorkflowsStage = (...parts) => [LOCAL, "workflows", ...parts].join("/");
 /** Hook receipts — one row per evaluation, so `allow` carries evidence. */
 export const decisions = (cwd) => join(localDir(cwd), "decisions.jsonl");
 /** Human-authored safety escape hatch. LOCAL so no PR can widen another machine's envelope. */
@@ -336,9 +281,9 @@ export const safetyOverrides = (cwd) => join(localDir(cwd), "safety-overrides.js
 /**
  * Telemetry shards.
  *
- * LOCAL since ADR-0001. Committed, they put `process.env.HOSTNAME` — a person's laptop name —
+ * LOCAL. Committed, they put `process.env.HOSTNAME` — a person's laptop name —
  * into the repository, and append-only JSONL in git only grows. The cost, stated plainly: with
- * these local, ``harness probe stats`` becomes a personal tool and "is the KB flywheel working across the
+ * these local, the shards are a personal record, and "is the KB flywheel working across the
  * team?" is no longer answerable from the repo.
  */
 export const metricsDir = (cwd) => join(localDir(cwd), "metrics");
@@ -346,28 +291,10 @@ export const metricsDir = (cwd) => join(localDir(cwd), "metrics");
 export const metricsShard = (cwd, id = process.env.HOSTNAME || "local") =>
   join(metricsDir(cwd), `${id}.jsonl`);
 
-/**
- * The default landing tier for exported run records — the analysis plane's staging area.
- *
- * DELIBERATELY LOCAL, and the trade-off is stated rather than dodged. The run trace it reads from
- * (`.shapeup/<slug>/`) is regenerable and gets wiped per-slug; an export keyed by run id survives
- * that, which is the failure this directory closes. What it does NOT do is cross a machine
- * boundary: making it SHARED would put per-run structured data and a machine id back in the
- * repository, which is exactly what ADR-0001 moved the metrics shards out of git to prevent. A
- * cross-machine warehouse is therefore an explicit `--out <dir>` to a destination the operator
- * owns, never a default that commits telemetry on their behalf.
- */
-export const exportsDir = (cwd) => join(localDir(cwd), "exports");
-
-/** One exported run's table directory, keyed by the run id (see {@link mintRunId}). */
-export const exportRunDir = (cwd, runId) => join(exportsDir(cwd), String(runId ?? "unkeyed"));
-/** Archived pitches. */
-export const pitchArchiveDir = (cwd) => join(localDir(cwd), "pitch-archive");
-
 /**
  * Gate answer sets, in resolution order (first hit wins).
  *
- * ONE TIER ONLY, since ADR-0001. There used to be a third candidate — a COMMITTED
+ * ONE TIER ONLY. There used to be a third candidate — a COMMITTED
  * `gate-answers.json`, auto-discovered with no flag — so a file with `preset: ci` pre-approved
  * GATE L4 ship sign-off for everyone who pulled the repo, and the same filename meant "my
  * personal lane" at one path and "team policy" at another. Consent is now per-machine by
@@ -426,7 +353,7 @@ export const globShared = (slug, ...parts) => [SHARED, slug, ...parts].join("/")
 
 /**
  * The coaching file a coachable worker reads, as a repo-relative path for the WorkOrder payload.
- * @param {string} skill - A coachable worker name (`COACHABLE` in compile.mjs), or `tech-lead`.
+ * @param {string} skill - A coachable worker name (`COACHABLE` in compile.mjs), or an activity name (`plan`, `building`).
  * @returns {string} e.g. `shapeup/knowledge-base/task-executor.md`.
  */
 export const relKnowledgeBase = (skill) => [SHARED, "knowledge-base", `${skill}.md`].join("/");