shapeup-sdlc 3.4.0 → 3.6.0

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "shapeup-sdlc-plugin",
   "displayName": "ShapeUp SDLC Plugin",
-  "version": "3.4.0",
+  "version": "3.6.0",
   "description": "Shape Up SDLC harness for Claude Code: shaping, intake, orient, scope-mapping, building (T0-verified, sandboxed, scope-contracted), evaluation and QA skills orchestrated by a tech-lead.",
   "author": {
     "name": "Liberty Nguyen",

package/AGENTS.md

@@ -28,9 +28,10 @@ Betting Table: PO decides; rejected pitches loop back to raw idea.
 |------|------|--------|
 | Kick-off | ⏸ **L0** — Intake & Config (L0.8 model/budget matrix) + worker roster ✧ | `/translator` if non-English |
 | Orient (Scout) | ⏸ **L1a** — Orient Review | `/orient` |
-| Analyze | — (reviewed at L1b) | `/ba-pitch-analyzer` (`analyze`): spec tree + board (UC + Invariants + Test Surface ★); before Wire (needs its use cases) |
+| Requirements | — (reviewed at L1b) | `/ba-pitch-analyzer` (`coverage`): the pitch's clauses → committed `requirements.md`, one atomic clause per `REQ-<n>` row naming the pitch clause it came from, ids assigned once and frozen; dispatched once, ahead of Analyze because the acceptance criteria are what cite its ids. A registry already on disk is not re-dispatched |
+| Analyze | — (reviewed at L1b) | `/ba-pitch-analyzer` (`analyze`): spec tree + board (UC + Invariants + Test Surface ★); before Wire (needs its use cases). An acceptance criterion that grades a requirement carries `(covers: REQ-…)` — that clause is the edge the verdict travels back along |
 | Wire | ⏸ **L1a.5** — Wiring Review ✚ | `/solution-architect` (`wire`): sole writer of committed `wiring-map.md` — per-UC engine → seam → entry-point call site → affordance, per `project-profile.md` |
-| Map Scopes | ⏸ **L1b** — Board Review (+ substrate disjointness lint) | `/scope-architect` (scope contracts ✦ — sole writer); traceability oracle advisory ✚ |
+| Map Scopes | ⏸ **L1b** — Board Review (+ substrate disjointness lint) | `/scope-architect` (scope contracts ✦ — sole writer); traceability oracle advisory ✚. A registered requirement that no acceptance criterion grades and no scope claims is **red** here, and L1b prints the `REQ → AC` table: the two ways out are an AC carrying `(covers: REQ-…)` or the PO marking the clause `CUT (PO-approved)`. Red only where the plan is still cheap to change — after L1b nobody re-reads the pitch |
 | Build Vertically | ⏸ **L2** — Board 100% ✅ + T0-green ✦ | per dispatch: compile order → `/task-executor` (--order) → ingest result; T0-verified per attempt (fixtures + DB probe + seesaw ✦), substrate-sandboxed ✦. Scopes build **concurrently** ✦ — `--parallel-scopes N` caps it (default 4), a scope is released the moment its own dependencies are green, and a scope green in this round is skipped rather than rebuilt. Then the **round build gate** ⚙: the ledger's run command, then the profile's `build_probe` and `launch_probe`, run once per round before EVAL — a red gate ends the round with no verdict and its failing step is compiled into the next round's orders as bugs; a `mobile` profile with no `launch_probe` is warned about every round, so the install/launch risk has an owner |
 | EVAL (once per round) | ⏸ **L3** — Verdict | `/spec-evaluator` (--order), only over a round whose build gate ⚙ is not red: spec- + test-surface-conformance ★, T0 citation ✦; refuted boxes/verdict applied by ingest |
 | FAIL → round r+1 | — | regression rule ★: bugs + full Test Surface of touched UC |
@@ -58,16 +59,27 @@ Everything discovered funnels into `.shapeup/<slug>/discovery/ledger.md` (Orient
 - **Ledger = single source of truth** — every discovery flow writes only its own section.
 - **QA is a level-up, not a gate** — `--no-qa` skips it; circuit breaker outranks the Hunter.
 - **Role separation** — Evaluator grades, task-executor fixes, QA discovers.
+- **The requirements matrix is a projection, never a verdict** — `REQ → AC → criterion → verdict` is derived from files for one named run (the registry, the board's `covers:` clauses, the run's verdict rows, the T0 citations), never narrated and never passed in. `covers:` is the authoritative join: a criterion anchored to a requirement no AC covers is printed for reconciliation and counted as nothing. L4 reads one line off it, GATE H's census takes the clauses with no evidence, `REPORT.md` freezes the table — and none of that blocks a ship. A clause with no PASS evidence is a fact the baseline comparison weighs, not a veto.
 - **Hill phase is mechanical ✦** — derived only from T0/T1/seesaw artifacts, never self-reported, and a T0-green from a round whose build gate ⚙ is red moves no dot (a green fixture in a round the feature did not build is evidence about the fixture); the evaluator cites a T0 artifact it re-hashes itself, from the list its order carries. A scoped verdict citing none is refused: its round stays open and is evaluated again, never advanced.
 - **Envelope port (v1.0)** — every dispatch is WorkOrder in / WorkResult out; shared state has exactly one writer (the ingest step); malformed envelopes are hook-denied. Workers: stateless, craft-only, pipeline-blind.
 
 ## Setup & Execution
 
-- Orders/results live in `.shapeup/<slug>/orders|results/`; the envelope schemas ship inside the tech-lead skill.
+- Orders/results live in `.shapeup/<slug>/orders|results/`; the envelope schemas ship with the plugin runtime, not with any individual skill, so every worker validates against the same copy.
 - The plugin's run entry points need a one-time permission grant — `npx shapeup-sdlc init` writes it into `.claude/settings.json` (`permissions.allow`); without it a headless run stalls at step one. That grant is necessary, not sufficient: it covers the run's own deterministic entry points, not the generic file edits every worker skill makes constantly, or any command a worker reaches for beyond the grant's own exact shape. A truly unattended run also needs a Claude Code permission mode that covers those (`acceptEdits` at minimum) — the plugin cannot grant that on your behalf.
+- The grant is necessary but sits under two more layers this plugin cannot reach either. A fresh
+  checkout is an **untrusted workspace**, and Claude Code discards the whole permission grant — every
+  rule in it, not only this one — until the workspace is trusted; the installer detects that state and
+  tells you, because trusting a directory to run code from is your decision to make, never a package's
+  to make for you. Above workspace trust sits Claude Code's own **auto-mode classifier**, which can
+  still block a call the grant already covers, invisibly to anything this plugin ships — no rule or
+  hook here can see it, let alone override it. When either layer stops an automated run, the
+  documented fallback is to drive Build by hand: the same per-dispatch cycle named in the Build
+  Vertically step above — compile, dispatch, ingest, verify — run one call at a time instead of
+  through the chained launch, until the run can resume unattended again.
 - Two storage tiers (ADR-0001): COMMITTED `shapeup/<slug>/` (shaping, spec, scopes, wiring-map, project-profile, requirements, hill, `REPORT.md` frozen at L4) vs GITIGNORED `.shapeup/` (board, orders/results, T0/eval/QA artifacts, ledgers, metrics, gate answers, and the run scripts staged for launch).
 - **The run launches from a copy inside your project, and it has to.** The Workflow tool loads a script only from a directory the session may already read; the plugin installs outside your project, so naming the shipped path is refused before the run begins and no permission rule repairs it — the grant authorises the tool, not what it may read. Opening a run therefore re-copies the run scripts to `.shapeup/workflows/` and reports the path the launch names. A run in flight keeps the copy it started with: an upgrade reaches the next run, not the current round.
-- **A write the substrate does not cover is denied for as long as the dispatch is in flight, and no longer.** A dispatch is live from the moment its order is compiled until a result for *that* dispatch lands, and liveness is read off the run's order set — not off the pointer that names the run, which outlives it. So a finished run fences nothing, a re-dispatch is fenced again, and the committed tier is never a worker's to write: those files belong to the orchestrator, whose window is a phase boundary rather than the middle of somebody else's order.
+- **A write the substrate does not cover is denied for as long as the dispatch is in flight, and no longer.** A dispatch is live from the moment its order is compiled until a result for *that* dispatch lands, and liveness is read off the run's order set — not off the pointer that names the run, which outlives it. A run closed any other way than shipping — escalated, aborted, killed outright — can leave one still open, and while the run's pointer is still on disk the fence holds on that order exactly as if the run were live. The pointer is what actually switches it off, though: the fence is enforced only while that pointer exists on disk, so a close that removes it releases the fence whatever the order set still says — restoring the pointer flips it straight back to denying. A **ship** close does not itself answer what it leaves outstanding — a ship close can retire the pointer over an order that never got a result — so it is not special because nothing is left unanswered; it is special only because retiring the pointer is the one lever every close needs pulled, and `reduce ship` pulls it for you. Whichever way a run closes, an order it leaves unanswered stays genuinely unresolved — not merely un-fenced — until `init run --force` runs: it writes a synthetic result for every order the closed run left unanswered, so the fence lifts without waiting on a worker that is never coming back. What the fence actually gates is narrower than "the project," too — it is this assistant's own edit path (a direct file write or edit call) outside the live order's substrate; a shell command, `git`, or any other editor still writes straight through it. Re-dispatch is fenced again, and the committed tier is never a worker's to write either way: those files belong to the orchestrator, whose window is a phase boundary rather than the middle of somebody else's order.
 - Every run has a `run_id` — the receipt mints it, and orders, T0 artifacts, trial rows, agent-call journal rows and hook decisions all carry it. It is the only key that separates two runs of the same feature: everything else (`order_id`, round/attempt) repeats. It is **not** a time boundary — a relaunch resumes the same run and reuses the key, so one `run_id` legitimately spans every launch after a paused gate or a kill, with hours of wall clock between them, and `orders/<id>.json` is rewritten by each. Anything measuring elapsed time reads the append-only records, never the span of a key. SHIP S.7 exports the run's records as fact tables under `.shapeup/exports/<run_id>/` before the run trace is superseded; a WorkResult carries no `run_id` and reaches it through `order_id`.
 - Every run projects a **run graph** — `.shapeup/<slug>/graph.jsonl`, append-only, written only by
   `reduce graph`. Two families kept separate: work lineage (Run, Order, Result, Verdict, Trial,

package/README.md

@@ -221,8 +221,12 @@ the layer that carries it, and the three layers here fail differently:
 - `PreToolUse` (`Edit|Write|MultiEdit`) — **`hooks/sandbox-guard.mjs` blocks a write that no LIVE
   order's substrate permits.** It reads every order that is compiled and not yet answered — a result
   at least as new as the order itself — rather than a pointer to one, so scopes building
-  concurrently are each held to their own contract and a finished run fences nothing; `frozen`
-  outranks everything, across all of them.
+  concurrently are each held to their own contract and a finished run fences nothing. A phase
+  dispatch the run has already moved past stops fencing too: once a later phase compiles its order,
+  an evaluation or a QA leg that never returned a result no longer holds the board. `frozen` is
+  checked first and outranks everything, across every live contract — including the carve-out that
+  otherwise keeps the active feature's own run trace writable, so a path a live order froze stays
+  frozen wherever it lives.
 - `PreToolUse` (`Bash|Read|Write|Edit|MultiEdit`) — **`hooks/safety-spine.mjs` denies destructive
   commands** (`rm -rf` on unrecoverable targets, force-push/push-to-main, `git reset --hard`,
   `DROP TABLE`) and secret-file reads. A machine guard, not a pipeline guard; the escape hatch is
@@ -328,11 +332,11 @@ claude --plugin-dir .                # load this working copy without installing
   plugin.json         # plugin manifest
   marketplace.json    # marketplace listing (points at this repo)
 skills/<name>/SKILL.md # the 13 harness skills (+ references/ and assets/)
-skills/tech-lead/schemas/                # the envelope port: WorkOrder, WorkResult, domain registry
 skills/tech-lead/workflows/shapeup-run.js # the BUILD-phase pipeline, on the native Workflow runtime
 kernel/harness.mjs    # ONE entry point for every deterministic step; the whole permission grant
 kernel/{verify,reduce,probe,init,report}/ #   its subcommands, plus compile and gate at the root
 kernel/lib/           # argv (the typed CLI boundary), paths (+ the run key), contract (shape)
+kernel/schemas/       # the envelope port: WorkOrder, WorkResult, domain registry
 commands/*.md         # slash commands (/ship + the 9 phase commands)
 hooks/                # hooks.json + the four walls: safety-spine, gate-intake, sandbox-guard
                       #   (PreToolUse) + gate-zerowork (Stop, the one blocking hook)

package/SECURITY.md

@@ -72,7 +72,7 @@ sitting, and reading them is the recommended review.
 | [`safety-spine.mjs`](hooks/safety-spine.mjs) | PreToolUse (`Bash\|Read\|Write\|Edit\|MultiEdit`) | The proposed command/path; `.shapeup/safety-overrides.json` | Yes — provably destructive ops only: `rm -rf` on unrecoverable targets, `git push --force` / push to main, `git reset --hard`, `git clean -fdx`, `DROP TABLE`/`TRUNCATE`, reads of `.env`/keys/cloud credentials, and any write to its own overrides file | Never blocks an unmatched command; `--force-with-lease` stays allowed |
 | [`gate-intake.mjs`](hooks/gate-intake.mjs) | PreToolUse (`Skill`) | The `tech-lead` dispatch's own arguments | Yes — an orchestrator dispatch carrying no resolvable intake (no pitch, spec, resume or requirement text) | Fails open on `--order` and on any ambiguous arg shape |
 | [`harness verify envelope`](kernel/verify/envelope.mjs) | PreToolUse (`Skill\|Agent`) | The `--order` file named in the dispatch; the JSON schemas | Yes — a worker dispatch whose order file is missing or schema-invalid | Never gates a dispatch that carries no `--order` (standalone skill use stays free) |
-| [`sandbox-guard.mjs`](hooks/sandbox-guard.mjs) | PreToolUse (`Edit\|Write\|MultiEdit`) | The target path; the `substrate` block of every LIVE order — compiled, with no result at least as new as the order's own `compiled_at` | Yes — any write no live order permits: outside every `allowed`/`shared`, inside any `frozen`, or a `Write` to an `append_only` path | No-op unless an order is live, which a finished run no longer is: the pointer names the run, never a dispatch. The active feature's own `.shapeup/<slug>/` run-trace is always writable. Appends denials to the local pathology log |
+| [`sandbox-guard.mjs`](hooks/sandbox-guard.mjs) | PreToolUse (`Edit\|Write\|MultiEdit`) | The target path; the `substrate` block of every LIVE order — compiled, with no result at least as new as the order's own `compiled_at`, and, for a run-level phase dispatch, not yet superseded by a later phase's order | Yes — any write no live order permits: inside any `frozen`, outside every `allowed`/`shared`, or a `Write` to an `append_only` path. `frozen` is checked FIRST, so it also outranks the run-trace carve-out | No-op unless an order is live, which a finished run no longer is: the pointer names the run, never a dispatch. The active feature's own `.shapeup/<slug>/` run trace is writable EXCEPT where a live order freezes a path inside it. Appends denials to the local pathology log |
 | [`dispatch-receipt.mjs`](hooks/dispatch-receipt.mjs) | PostToolUse (`Skill\|Agent`) | The `--order` file named in the dispatch; the tool result's own report of which skill ran | **No — it has no deny path at all.** It records that the shipped skill ran, so `harness reduce ingest` can refuse a result no dispatch produced | Never writes an attestation for a result that does not name a resolved skill; never fails the call it observes (every write is inside `try`/`catch`) |
 | [`gate-zerowork.mjs`](hooks/gate-zerowork.mjs) | Stop | Run receipts on disk; the session transcript; the decision ledger | **Yes — the one blocking hook.** Returns `decision:"block"` when the session dispatched the orchestrator and produced no run receipt | Defers the moment any receipt exists; `stop_hook_active` caps it at one block per stop chain |
 

package/hooks/sandbox-guard.mjs

@@ -42,6 +42,21 @@
 // the order's own `compiled_at`, the stamp the compiler writes INTO the order, which a copy or a
 // touch cannot perturb. An order carrying no stamp falls back to presence, which is all it ever had.
 //
+// A RUN-LEVEL ORDER RETIRES AT ITS PHASE BOUNDARY, which is the other half of that same question.
+// Liveness is "compiled, no result yet", so a PHASE dispatch whose worker never returned — a killed
+// evaluation, a QA leg that escalated without a result, a failed scope mapping — would stay live for
+// the rest of the run, and everything its `frozen` list names (the board, the spec tree) would be
+// fenced from then on. The board is the one that bites: the next round's doer cannot tick its own
+// acceptance criteria, and the run wedges with no dispatch actually in flight. The orchestrator has
+// long since moved on by the time that matters, and the move itself is the signal: the next phase
+// compiles its own order. So an order for a RUN-LEVEL operation stops being live once an order for a
+// DIFFERENT operation has been compiled after it — the window the committed tier already has, a
+// phase boundary rather than the middle of somebody else's dispatch. Build legs are exempt: they run
+// concurrently, finish out of order, and an abandoned one is resolved by ``harness init run --force``
+// rather than by a sibling's compile stamp. Two concurrent legs of the SAME operation never retire
+// each other, for that same reason. An order carrying no operation or no `compiled_at` keeps
+// fencing — an unreadable claim is not a retired one.
+//
 // That is the same question as "the writer's own contract" because scope substrates are disjoint by
 // construction — `harness verify spec`'s DISJOINT rule fails a spec where two scopes claim the same
 // path, and it runs at GATE L1b before any build starts. `frozen` is checked across all of them, so
@@ -133,7 +148,37 @@ function answered(resultPath, order) {
 }
 
 /**
- * Every order for this run that has been compiled and not yet answered.
+ * Operations whose order is a BUILD leg — one scope, one attempt, dispatched alongside its siblings.
+ *
+ * Everything else the compiler emits is a RUN-LEVEL phase dispatch, and only those retire at a phase
+ * boundary (see the banner). The distinction is by operation rather than by "does it carry a scope",
+ * because the single-task lane compiles an `execute` order with no scope contract on it and that leg
+ * is still a build.
+ */
+const BUILD_OPERATIONS = new Set(["execute", "fix", "spike"]);
+
+/**
+ * Has the run moved past this order's phase — i.e. did a LATER order for a different operation get
+ * compiled while this one was still unanswered?
+ *
+ * Conservative in both directions it cannot read: an order with no `operation`, a build leg, or an
+ * order with no parseable `compiled_at` keeps fencing.
+ *
+ * @param {object} order - The parsed, unanswered order.
+ * @param {Array<{operation:(string|undefined), at:number}>} stamps - Every compiled order's
+ *   operation and parsed `compiled_at`, unparseable stamps excluded.
+ * @returns {boolean} True when this order's phase is over and it should stop being enforced.
+ */
+function pastItsPhase(order, stamps) {
+  const op = order?.operation;
+  if (!op || BUILD_OPERATIONS.has(op)) return false;
+  const at = Date.parse(order?.compiled_at ?? "");
+  if (Number.isNaN(at)) return false;
+  return stamps.some((s) => s.at > at && s.operation !== op);
+}
+
+/**
+ * Every order for this run that has been compiled, not yet answered, and whose phase is still open.
  *
  * @param {string} cwd - Project root.
  * @param {string} slug - The run named by the pointer.
@@ -143,14 +188,17 @@ function liveOrders(cwd, slug) {
   const dir = ordersDir(cwd, slug);
   if (!existsSync(dir)) return [];
   const rDir = resultsDir(cwd, slug);
-  const live = [];
+  const unanswered = [];
+  const stamps = [];
   for (const f of readdirSync(dir)) {
     if (!f.endsWith(".json")) continue;
     const order = readJSON(join(dir, f));
     if (!order) continue;
-    if (!answered(join(rDir, f), order)) live.push(order);
+    const at = Date.parse(order.compiled_at ?? "");
+    if (!Number.isNaN(at)) stamps.push({ operation: order.operation, at });
+    if (!answered(join(rDir, f), order)) unanswered.push(order);
   }
-  return live;
+  return unanswered.filter((o) => !pastItsPhase(o, stamps));
 }
 
 function extractPaths(toolInput) {
@@ -231,22 +279,33 @@ async function main() {
   const runTracePrefix = join(LOCAL, active.slug) + sep;
   const violations = [];
   const blockReasons = [];
+  let frozenHits = 0;
 
   for (const raw of targetPaths) {
     const abs = resolve(cwd, raw);
     const rel = relative(root, abs);
-    if (rel.startsWith(runTracePrefix)) continue;
 
     // Frozen takes absolute precedence, and it is checked across EVERY live contract: a path one
     // scope froze stays frozen while another scope is in flight, which is the whole point of
     // declaring it.
+    //
+    // IT IS CHECKED BEFORE THE RUN-TRACE CARVE-OUT, and that order is load-bearing. The carve-out
+    // below exists so the doer can keep its own bookkeeping current; it was never a licence to
+    // overwrite a file a live contract declared read-only. Checked after it, every `frozen` glob
+    // naming a path inside the run trace was inert — the board an evaluation froze, the staged pitch
+    // a planner is graded against — so the compiler emitted a declaration with no enforcer, which is
+    // the exact state this hook exists to end. A path a live contract freezes is a violation
+    // wherever it lives.
     const freezer = contracts.find((c) => matchesAny(rel, c.frozen));
     if (freezer) {
       violations.push(rel);
+      frozenHits++;
       blockReasons.push(`${rel} is frozen by ${freezer.order_id}`);
       continue;
     }
 
+    if (rel.startsWith(runTracePrefix)) continue;
+
     if (contracts.some((c) => matchesAny(rel, c.allowed))) continue;      // inside a live contract
 
     if (contracts.some((c) => matchesAny(rel, c.appendOnly))) {
@@ -291,7 +350,11 @@ async function main() {
 
   return {
     verdict: "deny", event: "PreToolUse", tool: p.tool_name, subject: active.order_path, cwd: root,
-    rule: "outside-substrate",
+    // THE LEDGER NAMES THE CAUSE, not just the verdict. A write refused because a live contract
+    // FROZE the path and a write refused because no contract covers it are different facts with
+    // different remedies, and a single rule string cannot tell the reader which one happened —
+    // which is how a frozen declaration can stop being enforced without a single row moving.
+    rule: frozenHits === violations.length ? "frozen" : "outside-substrate",
     reason: `${violations.length} write(s) rejected by substrate boundaries: ${blockReasons.join("; ")}`,
     payload: {
       hookSpecificOutput: {

package/kernel/compile.mjs

@@ -58,7 +58,7 @@ export const COACHABLE = new Set([
 ]);
 
 const HERE = dirname(fileURLToPath(import.meta.url));
-const ORDER_SCHEMA = JSON.parse(readFileSync(resolve(HERE, "./../skills/tech-lead/schemas/work-order.schema.json"), "utf8"));
+const ORDER_SCHEMA = JSON.parse(readFileSync(resolve(HERE, "./schemas/work-order.schema.json"), "utf8"));
 
 // --- tiny frontmatter reader (scalar keys + [a, b] inline lists) --------------------------
 /**
@@ -207,14 +207,29 @@ export function substrateFor(operation, { slug, specDir, scope } = {}) {
   // `feedback.md`, `api-feasibility.md` and `integration.md` are analysis, not contract.
   const working = `${local}/working`;
   const FROZEN_SPEC_CORE = [`${spec}/domain-model.md`, `${spec}/usecases/*.md#Steps`, `${spec}/contracts/**`, `${spec}/ux-behavior.md`];
+  // THE STAGED PITCH IS THE RUN'S OWN INPUT TRUTH, and it is a separate constant from the spec core
+  // on purpose: the spec core is what a planner PRODUCES and a judge grades against, while these two
+  // are what the run was asked for. `init run` stages them beside the receipt that digests them, and
+  // every planning and evaluating operation reads them — so a worker that can rewrite either can
+  // rewrite the question it is about to be measured on, and the receipt's digest stops describing
+  // the file next to it. Frozen, not merely unlisted: `analyze` already carries the whole run trace
+  // in its `allowed` globs, so only a `frozen` entry denies the write. `translate` is the one
+  // operation that legitimately rewrites a pitch, and it writes the COMMITTED copy, not this one.
+  const FROZEN_INTAKE = [`${local}/intake.md`, `${local}/breadboard.md`];
   switch (operation) {
     case "execute": case "fix": case "spike":
+      // Build legs are the widest window on FROZEN_INTAKE, not an exemption from it: they are the
+      // most numerous and longest-lived dispatches in a run, so a doer that can rewrite the staged
+      // pitch can rewrite the run's own input truth mid-build. `init run` stages these before any
+      // order is live (no live contract yet — nothing to violate) and `translate` writes the
+      // COMMITTED copy, not this one, so neither legitimate write is touched by this line.
       return {
         allowed: [...(scope?.allowed_file_substrate || []), `${local}/spikes/**`],
         shared: scope?.shared_substrate || [],
+        frozen: [...FROZEN_INTAKE],
       };
     case "analyze":
-      return { allowed: [`${spec}/**`, `${local}/**`], frozen: [] };
+      return { allowed: [`${spec}/**`, `${local}/**`], frozen: [...FROZEN_INTAKE] };
 
     case "reconcile":
       return {
@@ -229,24 +244,24 @@ export function substrateFor(operation, { slug, specDir, scope } = {}) {
       // The covers-closure input truth. Writes ONLY the derived registry: the REQ source it
       // extracts from is frozen alongside the spec core, because a planner that may edit the
       // requirements it is being measured against is not measuring anything.
-      return { allowed: [globShared(slug, "requirements.md")], frozen: FROZEN_SPEC_CORE };
+      return { allowed: [globShared(slug, "requirements.md")], frozen: [...FROZEN_SPEC_CORE, ...FROZEN_INTAKE] };
 
     case "map-scopes":
       return {
         allowed: [`${scopesDir}/*.md`, globShared(slug, "scope-board.md")],
-        frozen: [...FROZEN_SPEC_CORE, `${local}/tasks/**`],
+        frozen: [...FROZEN_SPEC_CORE, ...FROZEN_INTAKE, `${local}/tasks/**`],
       };
     case "wire":
       // solution-architect writes the SHARED wiring map DIRECTLY (precedent: scope-architect
       // writes scopes/*.md). The spec core, the scopes, and the profile stay frozen.
       return {
         allowed: [globShared(slug, "wiring-map.md")],
-        frozen: [...FROZEN_SPEC_CORE, `${scopesDir}/**`, globShared(slug, "project-profile.md")],
+        frozen: [...FROZEN_SPEC_CORE, ...FROZEN_INTAKE, `${scopesDir}/**`, globShared(slug, "project-profile.md")],
       };
     case "evaluate":
-      return { allowed: [`${local}/evaluation/**`], frozen: [`${spec}/**`, `${local}/tasks/**`] };
+      return { allowed: [`${local}/evaluation/**`], frozen: [`${spec}/**`, ...FROZEN_INTAKE, `${local}/tasks/**`] };
     case "hunt":
-      return { allowed: [`${local}/qa/**`], frozen: [`${spec}/**`, `${local}/tasks/**`] };
+      return { allowed: [`${local}/qa/**`], frozen: [`${spec}/**`, ...FROZEN_INTAKE, `${local}/tasks/**`] };
     case "orient":
       return { allowed: [`${local}/orient/**`], frozen: [`${spec}/**`] };
     case "translate":
@@ -509,24 +524,30 @@ export function bugLocations(bug) {
  *
  * OWNERSHIP IS BY SUBSTRATE, because that is what the sandbox enforces: a scope is exactly the set
  * of files its worker may write, so a scope whose substrate excludes the cited line cannot fix it
- * however well it understands the bug.
+ * however well it understands the bug. The substrate a scope may write is `allowed ∪ shared` — the
+ * same union `sandbox-guard` composes at the fence — so a path declared ONLY in a contract's
+ * `shared` list is a file that scope may legitimately write, and the election must see it too —
+ * filtering on `allowed` alone elects no one for a shared-only path, and `bugsForScope` then reads
+ * that null as "no scope owns this" and fans the bug out to every scope instead of the one or two
+ * that declared it.
  *
  * BUT A MATCH IS NOT AN ELECTION. An entry point is routinely SHARED — on the measured run
  * `bin/todo.js` sits in five scopes' substrate at once — so "address it to every scope that
  * matches" hands the same one-line fix to five workers building concurrently against one file.
  * That is a write race the harness sets up itself, and four of the five fixes are waste even when
  * it resolves. So: prefer a scope that owns the file EXCLUSIVELY (allowed, not shared), and among
- * equals take the lowest scope id — a rule that needs no coordination to agree with itself, since
- * each leg compiles its own order in its own process.
+ * equals — every remaining candidate declares it shared, exclusive or not — take the lowest scope
+ * id: a rule that needs no coordination to agree with itself, since each leg compiles its own
+ * order in its own process.
  *
  * @param {string} path - Repo-relative file the bug cites.
  * @param {Array<{scope_id:string, allowed:string[], shared:string[]}>} scopes - Every scope.
  * @returns {string|null} The elected scope id, or null when no scope may write that file.
  */
 export function electOwner(path, scopes) {
-  const can = (scopes || []).filter((s) => matchesAny(path, s.allowed));
+  const can = (scopes || []).filter((s) => matchesAny(path, s.allowed) || matchesAny(path, s.shared || []));
   if (!can.length) return null;
-  const exclusive = can.filter((s) => !matchesAny(path, s.shared || []));
+  const exclusive = can.filter((s) => matchesAny(path, s.allowed) && !matchesAny(path, s.shared || []));
   return (exclusive.length ? exclusive : can).map((s) => s.scope_id).sort()[0];
 }
 

package/kernel/harness.mjs

@@ -31,7 +31,8 @@
 //            ship · board · verdict · graph
 //   gate                                      An answer file with a source, not a vibe.
 //   probe    resume · t0 · stats · digest ·   Read-only queries over run state. `concurrency`
-//            concurrency · leg · eval · owner  answers how many legs ran at once and what the
+//            concurrency · leg · eval ·        answers how many legs ran at once and what the
+//            owner · requirements
 //                                              fan-out bought, and refuses a figure the record set
 //                                              cannot support rather than printing a plausible one.
 //                                              `leg` answers whether a scope's work reached the
@@ -45,8 +46,12 @@
 //                                              own end-of-turn summary of its own verdict. `owner`
 //                                              answers which scope may write a path, elected from
 //                                              the contracts — so a census cites it instead of
-//                                              asserting ownership from memory.
-//   init     run · fit                        Opens a run, or refuses it (exit 3).
+//                                              asserting ownership from memory. `requirements`
+//                                              answers which pitch clause a verdict reached, joined
+//                                              through the plan's own covers: edge — the L4 line and
+//                                              GATE H's census cite it for the same reason.
+//   init     run · fit · run-args              Opens a run, or refuses it (exit 3). `run-args`
+//                                              writes GATE L0.9b's launch record and echoes it.
 //   report   export                           Projects the run's records as fact tables.
 //   compile                                   The WorkOrder: schema-valid or nothing is dispatched.
 //
@@ -81,8 +86,9 @@ export const ROUTES = {
     resume: "./probe/resume.mjs", t0: "./probe/t0.mjs", stats: "./probe/stats.mjs",
     digest: "./probe/digest.mjs", concurrency: "./probe/concurrency.mjs",
     leg: "./probe/leg.mjs", eval: "./probe/eval.mjs", owner: "./probe/owner.mjs",
+    requirements: "./probe/requirements.mjs",
   },
-  init: { run: "./init/run.mjs", fit: "./init/fit.mjs" },
+  init: { run: "./init/run.mjs", fit: "./init/fit.mjs", "run-args": "./init/run-args.mjs" },
   report: { export: "./report/export.mjs", _default: "export" },
   gate: "./gate.mjs",
   compile: "./compile.mjs",

package/kernel/init/run-args.mjs

@@ -0,0 +1,206 @@
+#!/usr/bin/env node
+// GATE L0.9b — THE LAUNCH RECORD, GIVEN A WRITER.
+//
+// WHY THIS EXISTS. `domain.schema.json`'s `RunArgs` entry calls `.shapeup/<slug>/run-args.json`
+// "the only artifact that records what a run was configured with" and names tech-lead as the
+// writer — but "tech-lead" meant a paragraph of prose telling the orchestrating session to
+// assemble a JSON object by hand and `Write` it. Outside a structural-test fixture, nothing ever
+// did: no kernel module wrote the file, so `probe concurrency`'s `dialFrom()` read a fan-out dial
+// that was never recorded and reported the effective default every time, indistinguishable from a
+// run that genuinely chose it. A registry entry is not an instruction, and an instruction with no
+// enforcer is how a documented record becomes a file that simply never exists.
+//
+// THE FIX. This is the single writer. It takes the resolved GATE L0 values as flags, builds the
+// exact `RunArgs` object the schema describes, writes it to `.shapeup/<slug>/run-args.json`, and
+// prints that SAME object on stdout — so tech-lead passes the printed value straight to
+// `Workflow({args: ...})` rather than re-typing it a second time. One construction, not two: the
+// file on disk and the value the workflow actually launches with can no longer disagree.
+//
+// `wallClockS` is NOT one of this command's flags and never lands in the object it writes.
+// `--wall-clock-budget` is consumed earlier, by `harness init run` (see `RECEIPT_VERSION` and
+// `config.wall_clock_budget_s` in `./run.mjs`) — the deadline breaker reads that receipt field
+// directly and was never going to see this launch's `RunArgs` at all. Naming a third field here
+// that nothing reads is the exact defect this command exists to close, not one to reintroduce.
+//
+// USAGE
+//   node `harness init run-args` --slug <slug> --auto-level interactive|auto|unattended \
+//        --exec-model <name> [--eval-model <name>] [--qa-model <name>] \
+//        --max-rounds N --attempts N --plugin-root <dir> \
+//        [--run-id <id>] [--answers <preset|path>] [--lane full|tiny] \
+//        [--no-eval] [--no-qa] [--adversarial-verify] [--parallel-scopes N] [--cwd <dir>]
+//
+// `--eval-model` is required unless `--no-eval` is set — an EVAL-skipping run never resolves one.
+// `--run-id`, given no explicit value, is read off the run's own receipt (the run must already be
+// open — see `harness init run`), never invented.
+//
+// Prints the written `RunArgs` object as JSON on stdout. Exit 0 on success, 2 on a usage error,
+// 3 when no run is open at `--slug` (the receipt is what makes this artifact meaningful at all).
+
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { runArgs } from "../lib/argv.mjs";
+import { localRoot, RECEIPT_FILE, runArgsPath, runIdFromReceipt } from "../lib/paths.mjs";
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+/** The plugin root, resolved from where this file actually is (`kernel/init/` → repo root). */
+export const PLUGIN_ROOT = resolve(HERE, "../..");
+
+/**
+ * The `autoLevel` enum, read from the schema that defines it — never hand-typed here.
+ *
+ * `domain.schema.json`'s `$defs/RunArgs.properties.autoLevel.enum` is the one place this set is
+ * declared. A `new Set([...])` beside it, inside the very module written to close run-argument
+ * contract drift (see this file's own banner), would be that drift repeating one level down —
+ * the same class of failure this module exists to close, applied here to an *enum's values*
+ * instead of RunArgs *field* names. Mirrors `kernel/verify/skills.mjs`'s `roster()`, which
+ * derives `WorkerName` the same way.
+ *
+ * @param {string} [root=PLUGIN_ROOT] - Plugin root the schema is read from — overridable so a test
+ *   can point this at a scratch copy of the schema and prove the result grows and shrinks with it,
+ *   never with an edit to this function.
+ * @returns {string[]} The enum, in schema order.
+ * @throws {Error} When the schema is missing or does not carry the enum.
+ */
+export function autoLevels(root = PLUGIN_ROOT) {
+  const schemaPath = join(root, "kernel/schemas/domain.schema.json");
+  const schema = JSON.parse(readFileSync(schemaPath, "utf8"));
+  const levels = schema?.$defs?.RunArgs?.properties?.autoLevel?.enum;
+  if (!Array.isArray(levels) || !levels.length) {
+    throw new Error(`${schemaPath} carries no $defs/RunArgs.properties.autoLevel.enum — the auto-level set cannot be derived`);
+  }
+  return levels;
+}
+
+/** The typed argv contract (see `../lib/argv.mjs`). */
+export const ARGV_SPEC = {
+  usage: `harness.mjs init run-args --slug <slug> --auto-level ${autoLevels().join("|")} ` +
+         '--exec-model <name> [--eval-model <name>] [--qa-model <name>] --max-rounds N --attempts N ' +
+         '--plugin-root <dir> [--run-id <id>] [--answers <preset|path>] [--lane full|tiny] ' +
+         '[--no-eval] [--no-qa] [--adversarial-verify] [--parallel-scopes N] [--cwd <dir>]',
+  _: { arity: 0, max: 0, name: "(no positional operands)" },
+  cwd: { type: "path" },
+  slug: { type: "str", required: true },
+  "run-id": { type: "str" },
+  "auto-level": { type: "str", required: true },
+  answers: { type: "str" },
+  lane: { type: "str" },
+  "exec-model": { type: "str", required: true },
+  "eval-model": { type: "str" },
+  "qa-model": { type: "str" },
+  "max-rounds": { type: "int", min: 1, required: true },
+  attempts: { type: "int", min: 1, required: true },
+  "plugin-root": { type: "path", required: true },
+  "no-eval": { type: "flag" },
+  "no-qa": { type: "flag" },
+  "adversarial-verify": { type: "flag" },
+  "parallel-scopes": { type: "int", min: 1 },
+};
+
+function fail(code, msg) {
+  console.error(msg);
+  process.exit(code);
+}
+
+/**
+ * Drop `undefined`-valued keys, one level deep on the named nested objects — so the JSON this
+ * writes never carries a literal `"eval": undefined` for a skipped role or an unset switch.
+ *
+ * @param {object} o - The candidate RunArgs object.
+ * @returns {object} The same shape with every `undefined` leaf and empty nested object removed.
+ */
+function pruned(o) {
+  const out = {};
+  for (const [k, v] of Object.entries(o)) {
+    if (v === undefined) continue;
+    if (v && typeof v === "object" && !Array.isArray(v)) {
+      const inner = pruned(v);
+      if (Object.keys(inner).length) out[k] = inner;
+      continue;
+    }
+    out[k] = v;
+  }
+  return out;
+}
+
+/**
+ * Build the `RunArgs` object — pure, so the structural suite can assert its shape without a
+ * filesystem. Mirrors `domain.schema.json` `$defs/RunArgs` exactly: this is the one place that
+ * shape is constructed, so a field this function does not carry cannot reach the file either.
+ *
+ * @param {object} o - Resolved inputs (destructured); optional fields may be `undefined`.
+ * @returns {object} The RunArgs object, pruned of unset optionals.
+ */
+export function buildRunArgs({
+  slug, runId, autoLevel, answers, lane, execModel, evalModel, qaModel,
+  maxRounds, attemptBudget, pluginRoot, startedAt,
+  noEval, noQa, adversarialVerify, maxParallelScopes,
+}) {
+  return pruned({
+    slug, runId, autoLevel, answers, lane,
+    models: { exec: execModel, eval: evalModel, qa: qaModel },
+    budgets: { maxRounds, attemptBudget },
+    pluginRoot, startedAt,
+    noEval, noQa, adversarialVerify, maxParallelScopes,
+  });
+}
+
+/**
+ * Write `.shapeup/<slug>/run-args.json`, or refuse (exit 3) when no run is open at `--slug`.
+ *
+ * @param {string[]} rawArgv - The subcommand's own arguments (harness.mjs strips the verb words).
+ * @returns {(Promise<void>|void)} Settles when the subcommand has written its output; every path
+ *   calls `process.exit()` with the subcommand's documented code rather than returning.
+ */
+export function cli(rawArgv) {
+  const args = runArgs(ARGV_SPEC, rawArgv);
+  const cwd = args.cwd || process.cwd();
+
+  if (!autoLevels().includes(args.autoLevel)) {
+    fail(2, `--auto-level must be one of: ${autoLevels().join(", ")}`);
+  }
+  if (!args.noEval && !args.evalModel) {
+    fail(2, "--eval-model is required unless --no-eval is set — an EVAL-skipping run never resolves one.");
+  }
+
+  const runRoot = localRoot(cwd, args.slug);
+  const receiptPath = join(runRoot, RECEIPT_FILE);
+  if (!existsSync(receiptPath)) {
+    fail(3, [
+      `✋ init run-args: no open run at ${runRoot} — run "harness init run" first (GATE L0.1).`,
+      "",
+      "`run-args.json` records what an OPEN run was launched with; writing one with no receipt",
+      "behind it would leave a launch record for a run that, everywhere else in the harness, never",
+      "started.",
+    ].join("\n"));
+  }
+  let receipt = null;
+  try { receipt = JSON.parse(readFileSync(receiptPath, "utf8")); } catch { /* handled below */ }
+  const runId = args.runId ?? runIdFromReceipt(receipt) ?? undefined;
+
+  const runArgsObj = buildRunArgs({
+    slug: args.slug,
+    runId,
+    autoLevel: args.autoLevel,
+    answers: args.answers ?? undefined,
+    lane: args.lane ?? undefined,
+    execModel: args.execModel,
+    evalModel: args.evalModel ?? undefined,
+    qaModel: args.qaModel ?? undefined,
+    maxRounds: args.maxRounds,
+    attemptBudget: args.attempts,
+    pluginRoot: args.pluginRoot,
+    startedAt: new Date().toISOString(),
+    noEval: args.noEval || undefined,
+    noQa: args.noQa || undefined,
+    adversarialVerify: args.adversarialVerify || undefined,
+    maxParallelScopes: args.parallelScopes ?? undefined,
+  });
+
+  mkdirSync(runRoot, { recursive: true });
+  writeFileSync(runArgsPath(cwd, args.slug), JSON.stringify(runArgsObj, null, 2) + "\n", "utf8");
+
+  // Printed, not just written — so the caller's `Workflow({args: ...})` reads this stdout instead
+  // of re-assembling the object from the flags it just typed.
+  console.log(JSON.stringify(runArgsObj, null, 2));
+}

package/kernel/init/run.mjs

@@ -224,6 +224,16 @@ export function runFrontmatter({ slug, config, startedAt }) {
     "deploy: ~",
     `started_at: ${startedAt}`,
     "closed_at: ~",
+    // The cause a terminal status ended on, written alongside `closed_at` by
+    // `probe resume --close` (kernel/probe/resume.mjs's closeRun) — the two land in one write, so a
+    // closed run's ledger never carries a timestamp with no reason beside it.
+    "close_cause: ~",
+    // The once-only guard's OWN record of what closed this run — deliberately separate from
+    // `status:` above, which every phase rewrites (`setRunStatus`) for the life of the run,
+    // including the product's own ship path immediately before `probe resume --close` runs. Only
+    // `closeRun` ever writes this line, so it is the one field an intervening `status:` rewrite
+    // cannot move (kernel/probe/resume.mjs's closeRun docblock has the measured scenario).
+    "closed_status: ~",
     "---",
     "",
     `# Harness run — ${slug}`,