shapeup-sdlc 3.4.0 → 3.6.0

package/kernel/reduce/ship.mjs

@@ -31,11 +31,13 @@ import { join, dirname } from "node:path";
 import { runArgs } from "../lib/argv.mjs";
 import {
   report as reportPath, tasksDir, verdictsDir, trials, evaluationDir, qaDir,
-  roundLedger, discoveryLedger, receipt as receiptPath, harnessRun, relShared, resultsDir,
+  roundLedger, discoveryLedger, receipt as receiptPath, harnessRun, relShared,
   activeOrder,
 } from "../lib/paths.mjs";
 import { readTrials } from "../verify/t0.mjs";
 import { ratchetReport } from "../probe/stats.mjs";
+import { projectRequirements, summaryLine } from "../probe/requirements.mjs";
+import { deriveRounds } from "../probe/rounds.mjs";
 import { collectDiff, scanDiff, summarize } from "./leftovers.mjs";
 
 /** @returns {string} Today as `YYYY-MM-DD` (UTC). */
@@ -166,13 +168,13 @@ export function section(md, heading) {
  */
 export function buildReport(facts) {
   const {
-    slug, at, verdict, qa, rounds, board, t0, artifacts, ratchet,
-    evalCriteria, evalBugs, qaFindings, decisions, discovered, intakeSha, leftovers,
+    slug, at, verdict, qa, rounds, roundsJudged, board, t0, artifacts, ratchet,
+    evalCriteria, evalBugs, qaFindings, decisions, discovered, intakeSha, leftovers, requirements,
   } = facts;
 
   const L = [];
   L.push("---", "type: ship-report", `feature: ${slug}`, `date: ${at}`,
-    `verdict: ${verdict}`, `rounds_used: ${rounds ?? "~"}`, `qa: ${qa}`,
+    `verdict: ${verdict}`, `rounds_used: ${rounds ?? "~"}`, `rounds_judged: ${roundsJudged ?? "~"}`, `qa: ${qa}`,
     `intake_sha256: ${intakeSha ?? "~"}`, "---", "");
   L.push(`# ${slug} — ship report`, "");
   L.push("Frozen at GATE L4. Every figure below is derived from run artifacts on disk — the trial",
@@ -182,6 +184,10 @@ export function buildReport(facts) {
   L.push("| | |", "|---|---|");
   L.push(`| Verdict | **${verdict}** |`);
   L.push(`| Rounds used | ${rounds ?? "—"} |`);
+  // A round built and a round judged are different facts — a round can die before EVAL ever sees
+  // it, so this row is its own line rather than folded into "Rounds used" above. Omitted when EVAL
+  // never ran at all, the same way the sections below it are.
+  if (roundsJudged != null) L.push(`| Rounds judged | ${roundsJudged} |`);
   L.push(`| Board | ${board.done}/${board.total} tasks done |`);
   L.push(`| T0 artifacts | ${artifacts} |`);
   L.push(`| QA | ${qa} |`);
@@ -214,6 +220,40 @@ export function buildReport(facts) {
     L.push("");
   }
 
+  // The requirement matrix — the way back from a verdict to the clause the pitch asked for, frozen
+  // at the one moment the run's local evidence still exists. Omitted entirely when the run has no
+  // registry: a table of nothing reads as "no requirements", which is a different claim from "this
+  // run predates the registry". Derived like every other figure here, by the same probe the L4 line
+  // and GATE H's census read, so the three cannot disagree.
+  if (requirements?.registry && requirements.rows.length) {
+    L.push("## Requirements", "");
+    L.push("One row per registered clause. A requirement has evidence when an acceptance criterion",
+      "covers it AND a criterion grading it passed — `covers:` is the join, the judge's anchor is the",
+      "path back. This is a projection, never a verdict: it never blocked this ship.", "");
+    L.push(`**${summaryLine(requirements)}** · run \`${requirements.run_id ?? "unknown"}\``, "");
+    // A clause, an AC and a criterion are all free prose, and a literal pipe in any of them breaks
+    // the row into columns nobody wrote — a frozen report that misrenders its own evidence.
+    /**
+     * Escape a free-prose value for a Markdown table cell.
+     * @param {string} s - The value.
+     * @returns {string} The value with every literal pipe escaped.
+     */
+    const cell = (s) => String(s).replace(/\|/g, "\\|");
+    L.push("| REQ | source | evidence | covering AC | criterion | T0 |", "|---|---|---|---|---|---|");
+    for (const r of requirements.rows) {
+      const ac = r.covering_acs.length ? `${r.covering_acs[0].task_id}: ${r.covering_acs[0].ac}${r.covering_acs.length > 1 ? ` (+${r.covering_acs.length - 1})` : ""}` : "—";
+      const crit = r.criteria.length ? `${r.criteria[0].criterion}${r.criteria.length > 1 ? ` (+${r.criteria.length - 1})` : ""} → ${r.criteria.map((c) => c.verdict).join(",")}` : "—";
+      const t0h = r.t0.length ? r.t0.map((h) => String(h).slice(0, 12)).join(", ") : "—";
+      L.push(`| ${r.id} | ${cell(r.source || "—")} | ${r.evidence} | ${cell(ac)} | ${cell(crit)} | ${t0h} |`);
+    }
+    L.push("");
+    if (requirements.inconsistencies.length) {
+      L.push("Anchored to a requirement no acceptance criterion covers — reconcile, do not count as evidence:", "");
+      for (const i of requirements.inconsistencies) L.push(`- ${i.requirement} ← "${i.criterion}" (${i.verdict})`);
+      L.push("");
+    }
+  }
+
   // The ratchet aggregate is derived, ~10 scalars that do not grow with the run, which is why it
   // can live in the committed tier while `metrics/` correctly stays gitignored (ADR-0001: a
   // committed shard keyed on $HOSTNAME only grows). Without this the instrument existed and was
@@ -256,32 +296,6 @@ export function buildReport(facts) {
   return L.join("\n");
 }
 
-/**
- * How many BUILD/EVAL rounds this run actually completed.
- *
- * `harness-run.md`'s `rounds_used` frontmatter field is written ONCE, at GATE L0.1 (`init run`),
- * as `0` — nothing in the round loop ever rewrites it as rounds complete. The orchestrator's own
- * `RunReturn` carries the real count (`shapeup-run.js`'s `rounds_used: round`), but that value
- * never reaches `reduce ship`, so every real run's report printed "Rounds used | 0" beside its own
- * `results/evaluate-r1.json` — a claim the frontmatter makes about the run, contradicted by the
- * artifact sitting next to it. Derived instead, the same way `probe resume`'s `eval_rounds_done`
- * already does: the highest `evaluate-r<N>.json` result on disk. Falls back to the frontmatter
- * value only when no EVAL round ever ran (the `--tiny` lane has no round concept at all), so a
- * bare or tiny run's reporting is unchanged.
- * @param {string} cwd - Project root.
- * @param {string} slug - Feature slug.
- * @param {(string|undefined)} fallback - `run.rounds_used` from the frontmatter.
- * @returns {(number|string|undefined)} The derived round count, or the fallback.
- */
-function roundsUsed(cwd, slug, fallback) {
-  const dir = resultsDir(cwd, slug);
-  const done = (existsSync(dir) ? readdirSync(dir) : [])
-    .map((f) => f.match(/^evaluate-r(\d+)\.json$/))
-    .filter(Boolean)
-    .map((m) => Number(m[1]));
-  return done.length ? Math.max(...done) : fallback;
-}
-
 /**
  * Gather every fact from disk and render the report.
  * @param {{cwd:string, slug:string, verdict?:string, qa?:string}} opts - Inputs.
@@ -296,16 +310,23 @@ export function generate({ cwd, slug, verdict, qa }) {
   const ledger = readIf(roundLedger(cwd, slug));
   const discovery = readIf(discoveryLedger(cwd, slug));
 
+  // Two numbers, not one: `rounds` (built — an order, a T0 verdict, a build-gate artifact or an
+  // EVAL result) and `roundsJudged` (EVAL actually returned a verdict for), kept separate so a run
+  // whose later rounds never reached EVAL still reports the rounds it built.
+  const derivedRounds = deriveRounds(cwd, slug, run.rounds_used);
+
   const facts = {
     slug,
     at: today(),
     verdict: verdict || run.final_verdict || "not-evaluated",
     qa: qa || (huntReport ? "run" : "skipped"),
-    rounds: roundsUsed(cwd, slug, run.rounds_used),
+    rounds: derivedRounds.rounds_used,
+    roundsJudged: derivedRounds.rounds_judged,
     intakeSha: receipt.intake_sha256,
     board: boardCensus(cwd, slug),
     t0: t0Summary(cwd, slug),
     ratchet: ratchetReport(readTrials(trials(cwd, slug))),
+    requirements: projectRequirements({ cwd, slug }),
     artifacts: verdictArtifactCount(cwd, slug),
     evalCriteria: section(evalReport, /^#+\s.*criteria/i) || section(evalReport, /^#+\s*spec-conformance/i),
     evalBugs: section(evalReport, /^#+\s*Bugs?\b/i),

package/kernel/reduce/snapshot.mjs

@@ -25,6 +25,7 @@ import { resolve, join } from "node:path";
 import { validate } from "../verify/envelope.mjs";
 import { runArgs } from "../lib/argv.mjs";
 import { localDir, localRoot, relLocal, globLocal, runSnapshot as runSnapshotPath } from "../lib/paths.mjs";
+import { deriveRounds } from "../probe/rounds.mjs";
 
 /**
  * Read a JSON file, tolerating absence/parse errors.
@@ -126,8 +127,28 @@ export function deriveSnapshot(cwd) {
   if (existsSync(runPath)) {
     try {
       const fm = frontmatter(readFileSync(runPath, "utf8"));
-      if (MID_RUN.has(fm.status) || ["shipped", "escalated"].includes(fm.status)) snapshot.status = fm.status;
-      if (/^\d+$/.test(fm.rounds_used || "")) snapshot.rounds_used = Number(fm.rounds_used);
+      // The terminal allowlist mirrors kernel/probe/resume.mjs's TERMINAL_STATUSES, not just the two
+      // members it used to carry — a schema/allowlist that disagrees with RUN_STATUSES is silent on
+      // both sides here (findRun only ever surfaces a MID_RUN run today, so this whole branch is
+      // unreachable in practice), but is exactly the divergence class this file's own imports exist
+      // to close elsewhere (deriveRounds, above). "aborted" is a real RUN_STATUSES member.
+      if (MID_RUN.has(fm.status) || ["shipped", "escalated", "aborted"].includes(fm.status)) snapshot.status = fm.status;
+      // MIGRATED to the same mechanical derivation `reduce ship` and `report export` already use
+      // (kernel/probe/rounds.mjs), rather than reading `harness-run.md`'s `rounds_used` literally.
+      // That frontmatter line is written ONCE, as 0, by `init run`, and nothing in the round loop
+      // ever rewrites it — so the third mechanical reader of "how many rounds did this run build"
+      // was the one still reporting the pre-fix number. Measured on a two-round, no-EVAL fixture:
+      // this line alone reported `rounds_used: 0` beside its own `round: 2` a few lines below,
+      // the exact disagreement `deriveRounds` exists to close. `fm.rounds_used` still travels in as
+      // the fallback for a run neither this fix nor deriveRounds can see evidence for (a `--tiny`
+      // lane, or a run from before any of these artifacts existed).
+      const derivedRounds = deriveRounds(cwd, run.slug, fm.rounds_used);
+      if (Number.isFinite(Number(derivedRounds.rounds_used))) snapshot.rounds_used = Number(derivedRounds.rounds_used);
+      // Kept as its OWN field, never folded into rounds_used — a round built is not a round judged,
+      // and collapsing the two into one number is exactly the ambiguity this migration removes.
+      // null (no EVAL result on disk yet) is a real answer and is not written at all, the same
+      // optional-field discipline every other snapshot field here follows.
+      if (Number.isFinite(derivedRounds.rounds_judged)) snapshot.rounds_judged = derivedRounds.rounds_judged;
       if (/^\d+$/.test(fm.max_rounds || "")) snapshot.max_rounds = Number(fm.max_rounds);
       if (fm.auto_level) snapshot.auto_level = fm.auto_level;
       if (fm.spec_folder) snapshot.spec_folder = fm.spec_folder;

package/kernel/report/export.mjs

@@ -47,10 +47,11 @@ import { runArgs } from "../lib/argv.mjs";
 import { splitFrontmatter } from "../lib/contract.mjs";
 import { runIdFromReceipt, readReceipt } from "../lib/paths.mjs";
 import { TABLES, runRow, dispatchFacts } from "./facts.mjs";
+import { deriveRounds } from "../probe/rounds.mjs";
 import {
   localDir, activeScope, receipt as receiptPath, harnessRun, ordersDir, resultsDir,
   trials as trialsPath, verdictsDir, evaluationDir, decisions as decisionsPath,
-  exportsDir, exportRunDir,
+  gates as gatesPath, roundBuildDir, exportsDir, exportRunDir,
 } from "../lib/paths.mjs";
 
 export const EXPORT_SCHEMA_VERSION = 1;
@@ -164,6 +165,51 @@ function criterionRows(dir, runId, t) {
   return out;
 }
 
+/**
+ * Flatten one gate-crossing ledger row (`gates.jsonl`, `kernel/gate.mjs`'s sole writer) into a
+ * flat `gate_decision` fact row. The row on disk already carries exactly these fields
+ * (see `appendGateLedger`), so this is a pass-through with a stamped `run_id` fallback rather than
+ * a re-derivation: two readers of "what did this gate decide" must not compute the answer twice.
+ * @param {object} g - One parsed line of `gates.jsonl`.
+ * @param {(string|null)} runId - Run key for a row written before it carried its own.
+ * @returns {object} A flat `gate_decision` row.
+ */
+function gateDecisionRow(g, runId) {
+  return {
+    run_id: g?.run_id ?? runId ?? null,
+    gate: g?.gate ?? null,
+    decision: g?.decision ?? null,
+    status: g?.status ?? null,
+    source: g?.source ?? null,
+    round: g?.round ?? null,
+    has_note: !!(g?.note && String(g.note).trim()),
+  };
+}
+
+/**
+ * Flatten one round build-gate artifact (`kernel/verify/build.mjs`'s `writeRoundBuild`) into a flat
+ * `build_gate` fact row. The gate ends a round exactly as EVAL does (AGENTS.md's round
+ * build gate ⚙), and until now had no fact table at all.
+ * @param {object} a - A parsed round-build artifact.
+ * @param {(string|null)} runId - Run key for an artifact written before it carried its own.
+ * @returns {object} A flat `build_gate` row.
+ */
+function buildGateRow(a, runId) {
+  const steps = Array.isArray(a?.steps) ? a.steps : [];
+  return {
+    run_id: a?.run_id ?? runId ?? null,
+    round: a?.round ?? null,
+    trial: a?.trial ?? null,
+    at: a?.at ?? null,
+    overall: a?.overall ?? null,
+    archetype: a?.archetype ?? null,
+    steps_total: steps.length,
+    steps_failed: steps.filter((s) => !s?.skipped && s?.pass === false).length,
+    warnings: Array.isArray(a?.warnings) ? a.warnings.length : 0,
+    discovered_tasks: Array.isArray(a?.discovered_tasks) ? a.discovered_tasks.length : 0,
+  };
+}
+
 // ---------------------------------------------------------------------------
 // The export itself
 // ---------------------------------------------------------------------------
@@ -190,7 +236,10 @@ export function collectRun(cwd, slug) {
   const results = readJsonDir(resultsDir(cwd, slug), t);
 
   const { dispatch, ac_result, discovery, file_touched } = dispatchFacts({ orders, results, runId });
-  const run = runRow({ receipt: rec, ledger, runId });
+  // Computed here, once, from the same trace this whole function reads, and handed to
+  // runRow rather than re-derived by it: runRow stays pure (no I/O), this function already has cwd.
+  const rounds = deriveRounds(cwd, slug, ledger.rounds_used);
+  const run = runRow({ receipt: rec, ledger, runId, rounds });
 
   // Hook decisions are checkout-wide, so they are FILTERED to this run rather than read from a
   // per-run file. Rows with a null key belong to no run (a hook that fired outside one) and are
@@ -208,6 +257,9 @@ export function collectRun(cwd, slug) {
       t0_verdict: readJsonDir(verdictsDir(cwd, slug), t).map((a) => t0Row(a, runId)),
       criterion_verdict: criterionRows(evaluationDir(cwd, slug), runId, t),
       hook_decision,
+      // The decision that crossed each gate, and the round build gate's own artifact.
+      gate_decision: readJsonl(gatesPath(cwd, slug), t).map((g) => gateDecisionRow(g, runId)),
+      build_gate: readJsonDir(roundBuildDir(cwd, slug), t).map((a) => buildGateRow(a, runId)),
     },
     defects: { records_skipped: t.skipped },
   };

package/kernel/report/facts.mjs

@@ -27,6 +27,11 @@
 export const TABLES = [
   "run", "dispatch", "ac_result", "discovery", "file_touched",
   "trial", "t0_verdict", "criterion_verdict", "hook_decision",
+  // The decision that shipped a run (or any other gate) had a ledger row (`gates.jsonl`)
+  // and no table — a reader had to open the LOCAL trace itself, which the export exists so nobody
+  // has to. `build_gate` is the round build gate's own artifact (kernel/verify/build.mjs), on the
+  // same terms: it ends a round exactly as EVAL does, and had no table either.
+  "gate_decision", "build_gate",
 ];
 
 /** Coerce anything to a finite number, or null. Keeps `0` and rejects `NaN`/`""`/undefined. */
@@ -76,9 +81,14 @@ export function parseOrderStem(orderId) {
  * @param {(object|null)} o.receipt - Parsed `receipt.json`.
  * @param {(object|null)} [o.ledger] - Parsed `harness-run.md` frontmatter (a flat scalar map).
  * @param {(string|null)} [o.runId] - The run key, when already resolved.
+ * @param {({rounds_used:*, rounds_judged:(number|null)}|null)} [o.rounds] - The two-number
+ *   derivation (`probe/rounds.mjs`'s `deriveRounds`), computed by the caller because it needs the
+ *   filesystem and this function stays pure. Falls back to the ledger's own (unreliable — see
+ *   `deriveRounds`) `rounds_used` line when the caller has not derived one, so an existing caller
+ *   is unaffected rather than broken.
  * @returns {(object|null)} The run row, or null when there is no receipt to describe.
  */
-export function runRow({ receipt, ledger = null, runId = null }) {
+export function runRow({ receipt, ledger = null, runId = null, rounds = null }) {
   if (!receipt) return null;
   const c = receipt.config || {};
   const fm = ledger || {};
@@ -87,6 +97,9 @@ export function runRow({ receipt, ledger = null, runId = null }) {
     slug: receipt.slug ?? null,
     started_at: receipt.started_at ?? null,
     closed_at: fm.closed_at && fm.closed_at !== "~" ? fm.closed_at : null,
+    // Why the run ended at a terminal status, written by `probe resume --close` alongside
+    // `closed_at` — the two facts a trace needs to tell a live run from a dead one apart.
+    close_cause: fm.close_cause && fm.close_cause !== "~" ? fm.close_cause : null,
     intake_sha256: receipt.intake_sha256 ?? null,
     intake_chars: num(receipt.intake_chars),
     intake_lines: num(receipt.intake_lines),
@@ -101,8 +114,17 @@ export function runRow({ receipt, ledger = null, runId = null }) {
     // Copied from the ledger, never re-derived: the run's own status line is the harness's answer,
     // and a read plane that recomputed it would be asserting a second one.
     status: fm.status ?? null,
+    // The terminal status `closeRun` alone writes, carried BESIDE `status` rather than instead of
+    // it. `status:` is ordinary phase traffic and a later phase may move it, so an export that
+    // carried only that line could show a run wearing another close's cause. These two disagreeing
+    // is itself the fact worth exporting: it says the ledger was written after the close.
+    closed_status: fm.closed_status && fm.closed_status !== "~" ? fm.closed_status : null,
     final_verdict: fm.final_verdict && fm.final_verdict !== "~" ? fm.final_verdict : null,
-    rounds_used: num(Number(fm.rounds_used)),
+    // Two fields, not one: `rounds_used` is the highest round carrying ANY build evidence,
+    // `rounds_judged` the highest round EVAL actually returned a verdict for. A caller that has not
+    // derived `rounds` falls back to the ledger's own (pre-fix, unreliable) line, non-regression.
+    rounds_used: rounds ? num(Number(rounds.rounds_used)) : num(Number(fm.rounds_used)),
+    rounds_judged: rounds ? num(rounds.rounds_judged) : null,
   };
 }
 

package/{skills/tech-lead → kernel}/schemas/domain.schema.json

@@ -341,6 +341,7 @@
       "spec_folder",
       "feature",
       "discovered_ledger",
+      "requirements",
       "kb_rules_path"
     ],
     "scope-architect": [
@@ -667,14 +668,14 @@
             "string",
             "null"
           ],
-          "description": "Source file of the failure; null/absent when the log line carried no location (raw triple — never invented)."
+          "description": "Source file of the failure; null/absent when the log line named no file at all (raw triple — never invented)."
         },
         "line": {
           "type": [
             "integer",
             "null"
           ],
-          "description": "Line of the failure; null/absent when the log line carried no location. Paired with `file` — a triple has both or neither, and neither is ever invented to satisfy a shape."
+          "description": "Line of the failure; null/absent when the diagnostic carried no line number — independently of `file`, since a diagnostic can name a file with no line (a resource-compiler error, for example). Never invented to satisfy a shape."
         },
         "core_message": {
           "type": "string",
@@ -1890,9 +1891,10 @@
             "building",
             "evaluating",
             "shipped",
-            "escalated"
+            "escalated",
+            "aborted"
           ],
-          "description": "Mirrors harness-run.md frontmatter status."
+          "description": "Mirrors harness-run.md frontmatter status — kernel/probe/resume.mjs's RUN_STATUSES is the source enum this one must not drift from."
         },
         "round": {
           "type": "integer",
@@ -1903,7 +1905,12 @@
           "description": "From the latest t0/verdicts/r<N>-a<M>.json filename."
         },
         "rounds_used": {
-          "type": "integer"
+          "type": "integer",
+          "description": "Highest round carrying any build evidence (an order, a T0 verdict, a round build-gate artifact, or an EVAL result) — kernel/probe/rounds.mjs's deriveRounds(), the same derivation the ship report and the export use. Falls back to harness-run.md's literal frontmatter value only when no such evidence exists on disk."
+        },
+        "rounds_judged": {
+          "type": "integer",
+          "description": "Highest round EVAL actually returned a verdict for (an evaluate-r<N>.json result on disk) — its own field, never folded into rounds_used: a round built is not a round judged. Omitted when no round has been judged yet."
         },
         "max_rounds": {
           "type": "integer"
@@ -2611,6 +2618,10 @@
           "type": "boolean",
           "description": "ANALYZE finished: the spec folder's usecases/ carries at least one use case that is not _index.md. WIRE reads these — one wiring-map entry per use case — which is why ANALYZE precedes WIRE in the phase chain: dispatched against an empty spec folder, WIRE escalates on every launch."
         },
+        "has_requirements": {
+          "type": "boolean",
+          "description": "The requirements registry is on disk: shapeup/<slug>/requirements.md exists. A PLAIN FACT, not a phase — the orchestrator guards its single `coverage` dispatch on this boolean, and it is deliberately absent from kernel/probe/resume.mjs's PHASE_ARTIFACT map, which doubles as nextPhase()'s ordered list: an entry there would fast-forward every run recorded before the registry existed to the registry instead of to build."
+        },
         "has_wiring_map": {
           "type": "boolean",
           "description": "WIRE finished: shapeup/<slug>/wiring-map.md exists."
@@ -2699,10 +2710,10 @@
       }
     },
     "RunArgs": {
-      "description": "C1 — the launch half of the workflow's only conversation. Compiled ONCE by tech-lead at GATE L0 from harness init run output + the L0.8 model matrix + budgets, written to .shapeup/<slug>/run-args.json and handed to the harness run launch as one JSON literal — the workflow cannot ask follow-ups and cannot read config files itself, so everything a run will ever need travels in this one record. A workflow script validates its own subset of this shape in code (no runtime schema check at the C1 boundary itself); this entry is the central-registry definition the workflow script and the tech-lead skill both read as the one true shape.",
+      "description": "C1 — the launch half of the workflow's only conversation. Resolved ONCE at GATE L0 from harness init run output + the L0.8 model matrix + budgets, then built by `harness init run-args`, which writes it to .shapeup/<slug>/run-args.json AND prints it — tech-lead passes that printed value to the harness run launch as one JSON literal, never a second, hand-typed copy of it. The workflow cannot ask follow-ups and cannot read config files itself, so everything a run will ever need travels in this one record. A workflow script validates its own subset of this shape in code (no runtime schema check at the C1 boundary itself); this entry is the central-registry definition the workflow script, `harness init run-args` and the tech-lead skill all read as the one true shape.",
       "x-tier": "EMBEDDED",
-      "x-location": ".shapeup/<slug>/run-args.json — written fresh by tech-lead on every launch and relaunch; the workflow receives it as its args and never reads other config",
-      "x-writer": "tech-lead (GATE L0, on every launch AND every relaunch after a paused gate)",
+      "x-location": ".shapeup/<slug>/run-args.json — written fresh on every launch and relaunch by `harness init run-args`; the workflow receives it as its args and never reads other config",
+      "x-writer": "harness init run-args (kernel), invoked by tech-lead at GATE L0 on every launch AND every relaunch after a paused gate",
       "x-readers": "the Workflow runtime (shapeup-run, and shapeup-run's own inner round dispatch)",
       "x-not-here": "Run config the LEDGER already carries does NOT get a second home in RunArgs — eval_dimensions, lens, spec_folder, stack, run_cmd, app_url are read off harness-run.md frontmatter by resume-state on every launch AND every relaunch, so a copy here would be a second source that can disagree with the first. RunArgs carries what a workflow cannot derive from disk (identity, budgets, the model matrix, pluginRoot, startedAt) plus noEval, which no frontmatter line holds.",
       "type": "object",
@@ -2754,16 +2765,13 @@
         },
         "budgets": {
           "type": "object",
-          "description": "The three-level circuit breaker's own limits (AGENTS.md) — outer round_budget, inner attempt_budget, and the opt-in wall-clock breaker.",
+          "description": "The two RunArgs-level circuit breakers (AGENTS.md) — outer round_budget, inner attempt_budget. The third, opt-in DEADLINE breaker (the wall-clock budget) is NOT a RunArgs field: it is typed once, at `harness init run --wall-clock-budget`, and lands in the run receipt's `wall_clock_budget_s` — `harness verify budget` reads that receipt field directly and never sees this launch's RunArgs at all, so it has no member here to declare.",
           "properties": {
             "maxRounds": {
               "type": "integer"
             },
             "attemptBudget": {
               "type": "integer"
-            },
-            "wallClockS": {
-              "type": "integer"
             }
           }
         },

package/kernel/verify/envelope.mjs

@@ -12,7 +12,7 @@
 //   #/$defs/Name                       — a definition in the SAME schema document
 //   domain.schema.json#/$defs/Name     — a definition in a SIBLING file (the central domain
 //                                        registry; resolved against the schema's own dir,
-//                                        falling back to skills/tech-lead/schemas/)
+//                                        falling back to kernel/schemas/)
 //
 // Usage (CLI):    node kernel/harness.mjs verify envelope <envelope.json> <schema.json>
 //                 exit 0 = valid, 1 = invalid (errors printed one per line)
@@ -28,7 +28,7 @@ import { runArgs } from "../lib/argv.mjs";
 import { runHook, readStdin, settle } from "../../hooks/lib/decision.mjs";
 
 const HERE = dirname(fileURLToPath(import.meta.url));
-export const SCHEMAS_DIR = resolve(HERE, "../../skills/tech-lead/schemas");
+export const SCHEMAS_DIR = resolve(HERE, "../schemas");
 
 /**
  * Validate a value against the JSON-Schema subset the envelope schemas use (type, required,

package/kernel/verify/skills.mjs

@@ -45,7 +45,7 @@ export const PLUGIN_ROOT = resolve(HERE, "../..");
  *   its own domain registry has a broken installation, which is the very thing being checked.
  */
 export function roster(root = PLUGIN_ROOT) {
-  const schemaPath = join(root, "skills/tech-lead/schemas/domain.schema.json");
+  const schemaPath = join(root, "kernel/schemas/domain.schema.json");
   const schema = JSON.parse(readFileSync(schemaPath, "utf8"));
   const names = schema?.$defs?.WorkerName?.enum;
   if (!Array.isArray(names) || !names.length) {

package/kernel/verify/spec.mjs

@@ -34,6 +34,11 @@
 //   SCOPE-COVERS  a contract's covers entry that is not a REQ-id (warn), or names a REQ that
 //             is not in requirements.md (red, when a registry exists) — shape alone let a scope
 //             claim coverage of a requirement that does not exist
+//   REQ-UNCOVERED  the other direction of the same edge: a registered requirement still marked
+//             covered that NO acceptance criterion grades and NO scope claims. SCOPE-COVERS asks
+//             whether a link resolves; this asks whether a requirement has one at all. Red here
+//             and only advisory in trace-lint, because a requirement nothing reaches is a plan
+//             defect the PO can still answer at L1b — cover it, or cut it on the record
 //   SCOPE-PARTITION  a task claimed by more than one scope. The UC anchor is a SPEC link, not an
 //             assignment: one use case is routinely implemented by several scopes, so on a
 //             four-scope/one-UC cut every scope claimed every task and would build all of them.
@@ -65,9 +70,18 @@ import { parseBoard, deriveUnlocks } from "../reduce/board.mjs";
 import { runArgs } from "../lib/argv.mjs";
 import { LOCAL } from "../lib/paths.mjs";
 import { specDir, scopesDir, tasksDir, intake, sharedRoot, requirements } from "../lib/paths.mjs";
-import { readAllContracts, unreadableReason, ucId, scopePartitionConflicts, SCOPE_CONTRACT } from "../lib/contract.mjs";
+import { readAllContracts, unreadableReason, ucId, reqId, scopePartitionConflicts, SCOPE_CONTRACT } from "../lib/contract.mjs";
+import { UNREADABLE, LEGACY_LAYOUT } from "../lib/contract.mjs";
+import { validate as validateAgainstSchema, SCHEMAS_DIR } from "./envelope.mjs";
 import { breadboard as stagedBreadboard } from "../lib/paths.mjs";
 import { parseBreadboard, hasBreadboardTables, idCounts } from "../lib/breadboard.mjs";
+// ONE implementation of covers-closure, two reporters: trace-lint narrates it, spec-lint gates it.
+// Re-deriving either here is how the advisory report and the gate start disagreeing about which
+// requirement is covered. This closes the import ring spec → trace → compile → probe/resume → spec,
+// which holds only while no module in it dereferences an imported binding at module-evaluation
+// time — do NOT add a top-level `const x = someImportedFn()` to any of the four.
+import { parseRequirements, coveredReqIds } from "./trace.mjs";
+import { readBoard } from "../compile.mjs";
 
 // Inlined from hooks/sandbox-guard.mjs so this skill ships self-contained (a skill's scripts
 // must not reach outside its own folder — channels that copy only skills/ would dangle).
@@ -347,7 +361,11 @@ export function lintScopeAnchors({ scopes, specDir: specRoot, reqIds = null, tas
       else if (id && !ids.has(id)) findings.push({ rule: "SCOPE-DEPS", level: "red", scope: where, detail: `depends_on "${id}" is not a scope in this run — the scheduler drops the edge, so this scope may build before its dependency` });
     }
     for (const r of s.covers || []) {
-      const req = String(r).trim();
+      // ONE KEY SPACE. A pitch numbers its requirements `R<n>` and the registry keys off
+      // `REQ-<n>`; `reqId` maps the first onto the second BEFORE the pattern below, so a link the
+      // planner actually wrote resolves instead of reading as a shape warning nobody can act on.
+      // A reference neither space recognises comes back verbatim and still fails the pattern.
+      const req = reqId(r);
       if (!/^REQ-[A-Z0-9-]+$/i.test(req)) {
         findings.push({ rule: "SCOPE-COVERS", level: "warn", scope: where, detail: `covers "${r}" is not a REQ-id — the requirement edge will not resolve` });
         continue;
@@ -372,6 +390,55 @@ export function lintScopeAnchors({ scopes, specDir: specRoot, reqIds = null, tas
   return findings;
 }
 
+/**
+ * REQ-UNCOVERED — a live requirement that nothing in the plan reaches.
+ *
+ * THE OTHER DIRECTION OF THE COVERS EDGE. `SCOPE-COVERS` walks the links that exist and asks
+ * whether each one resolves; a requirement with no link at all satisfies it perfectly. Measured on
+ * a full run of one pitch: twenty-one requirements, every one of them with an acceptance criterion
+ * somewhere, and only eleven reaching a criterion the judge grades — the board is the last place a
+ * requirement can be dropped without anything going red, because after L1b nobody re-reads the
+ * pitch.
+ *
+ * WHY THE BOARD HERE IS `readBoard`, NOT `lint()`'s `tasks`. `parseBoard` (`kernel/reduce/board.mjs`)
+ * builds the scheduling view and its records carry no `acceptance_criteria` field at all, while
+ * `coveredReqIds` reads exactly that field — feed it the wrong board and the covered set is empty
+ * and EVERY requirement reds on EVERY run. `readBoard` (`kernel/compile.mjs`) is the parser that
+ * carries the criteria, and it is the only other one there may be: a second parser of the task file
+ * is explicitly ruled out where the first one lives.
+ *
+ * A SCOPE'S CLAIM COUNTS. The arm is about requirements nothing reaches, not about which layer
+ * reaches them: a clause claimed by a contract's `covers:` has an owner who answers for it at L1b,
+ * even before the criterion that grades it is written. `CUT (PO-approved)` is likewise an answer
+ * already given, not a defect — which is why `status` is read rather than assumed.
+ *
+ * @param {{clauses:Array<{id:string, clause:string, source:string, status:string}>,
+ *   board:Array<object>, scopes:Array<{covers?:string[]}>}} input - The registry clauses
+ *   (`parseRequirements`), the board `readBoard` parsed, and the scope contracts. An empty
+ *   `clauses` (no registry on disk) yields no findings — absent artifact ⇒ arm skipped.
+ * @returns {Array<{rule:string, level:("red"|"warn"), scope:string, detail:string}>} One red per
+ *   uncovered live requirement; [] when every one is graded, claimed or cut.
+ */
+export function lintRequirementCoverage({ clauses = [], board = [], scopes = [] }) {
+  const findings = [];
+  const graded = coveredReqIds(board);
+  // The contracts speak the pitch's numbering as readily as the registry's; `reqId` lands both in
+  // the one key space before the comparison, exactly as SCOPE-COVERS does above.
+  const claimed = new Set();
+  for (const s of scopes) for (const r of s.covers || []) claimed.add(reqId(r).toUpperCase());
+  for (const c of clauses) {
+    if (c.status !== "covered") continue; // CUT (PO-approved) — an answer on the record, not a gap
+    const id = c.id.toUpperCase();
+    if (graded.has(c.id) || claimed.has(id)) continue;
+    const from = c.source ? ` ← ${c.source}` : "";
+    findings.push({ rule: "REQ-UNCOVERED", level: "red", scope: c.id, detail:
+      `${c.id}${from} is graded by no acceptance criterion and claimed by no scope — "${(c.clause || "").slice(0, 60)}" ` +
+      "would ship unverified and nothing downstream would say so. Cover it with an AC carrying " +
+      `(covers: ${c.id}), or mark it CUT (PO-approved) in requirements.md.` });
+  }
+  return findings;
+}
+
 /**
  * Every dependency cycle among the scopes, each reported once from its lowest-sorting member.
  * @param {Array<{scope_id:string, depends_on?:string[]}>} scopes - The contracts.
@@ -663,6 +730,51 @@ export function runBreadboard(cwd, slug, intakeContent) {
   return hasBreadboardTables(intakeContent) ? intakeContent : null;
 }
 
+/**
+ * Every scope contract whose PARSED shape fails `$defs/ScopeContract`.
+ *
+ * `kernel/lib/contract.mjs`'s own banner promised this check — "spec-lint re-validates every parsed
+ * contract against domain.schema.json, so a hand-edit that breaks the shape fails loudly instead of
+ * silently widening a sandbox" — and it did not exist. `compile` validated, spec-lint did not, so a
+ * contract could pass GATE L1b green and then be refused at dispatch by the one reader that checked.
+ *
+ * Measured 2026-09-19 on a real run: a planner wrote every `required_states` table cell bare
+ * (`loading, error, ready`) where the dialect wants `[loading, error, ready]`, so all 32 manifest
+ * rows across the six UI scopes parsed as strings. `verify spec` reported `red=0`; `compile` then
+ * refused all six with `expected array, got string`, and those scopes were never dispatched — no
+ * order, no leg, no T0 trial. The round reached EVAL with six of eighteen scopes missing and the
+ * evaluator escalated rather than grading. This arm turns that into a red at the gate, naming the
+ * scope and the field, with the message the compiler would otherwise produce an hour later.
+ *
+ * The validator is the one `compile` already uses; there is no second implementation here.
+ *
+ * @param {Array<{contract:object, path:string}>} contracts - Parsed contracts with their paths.
+ * @param {object} domainSchema - The parsed `domain.schema.json`.
+ * @returns {Array<{rule:string, level:string, scope:string, detail:string}>} One red per invalid
+ *   contract; [] when the schema cannot be read (absent artifact ⇒ arm skipped).
+ */
+export function lintContractSchema(contracts, domainSchema) {
+  const def = domainSchema?.$defs?.ScopeContract;
+  if (!def) return [];
+  const schema = { ...def, $defs: domainSchema.$defs };
+  const out = [];
+  for (const { contract, path } of contracts) {
+    const c = { ...contract };
+    delete c[UNREADABLE];
+    delete c[LEGACY_LAYOUT];
+    let res;
+    try { res = validateAgainstSchema(c, schema); } catch { continue; }  // fail open, never closed
+    if (res?.valid) continue;
+    out.push({
+      rule: "CONTRACT-SCHEMA", level: "red", scope: contract.scope_id || path,
+      detail: `the contract parses, but not into the shape a WorkOrder carries — ${(res.errors || [])[0] || "schema validation failed"}. ` +
+        `compile refuses an order that fails its own schema, so as written this scope would be silently undispatched. ` +
+        `A list in a table cell is written [a, b], brackets and all.`,
+    });
+  }
+  return out;
+}
+
 /**
  * Run the full spec lint (scopes + structure) for a slug.
  * @param {{cwd:string, slug:string}} opts - Working root and feature slug.
@@ -679,10 +791,21 @@ export function lint({ cwd, slug }) {
   const intakeContent = existsSync(intakePath) ? readFileSync(intakePath, "utf8") : "";
   // The REQ registry, when the tree has one — absent means covers-closure simply cannot apply.
   const reqFile = requirements(cwd, slug);
-  const reqIds = existsSync(reqFile)
-    ? new Set([...readFileSync(reqFile, "utf8").matchAll(/\bREQ-[A-Z0-9-]+/gi)].map((m) => m[0].toUpperCase()))
+  const reqText = existsSync(reqFile) ? readFileSync(reqFile, "utf8") : null;
+  const reqIds = reqText !== null
+    ? new Set([...reqText.matchAll(/\bREQ-[A-Z0-9-]+/gi)].map((m) => m[0].toUpperCase()))
     : null;
+  // Table rows only, and with the status/source cells REQ-UNCOVERED reports from — the id set
+  // above is deliberately looser (it also sees ids named in the registry's prose) and stays that
+  // way, because the two arms ask different questions of the same file.
+  const reqClauses = reqText !== null ? parseRequirements(reqText) : [];
   const repoFiles = walkFiles(cwd);
+  // Loaded HERE, not at module scope. `spec → trace → compile → probe/resume → spec` is a live
+  // import ring, and a top-level dereference of an imported binding is what would break it.
+  // Unreadable schema ⇒ the arm skips itself, like every other absent-artifact arm.
+  let domainSchema = null;
+  try { domainSchema = JSON.parse(readFileSync(join(SCHEMAS_DIR, "domain.schema.json"), "utf8")); } catch { /* arm skipped */ }
+
   const findings = [
     // A contract whose table this parser cannot see reads as a contract that declared no
     // table, and every rule below then passes for the part it could not read. Loud, not empty.
@@ -690,8 +813,11 @@ export function lint({ cwd, slug }) {
       .map(({ contract, path }) => ({ reason: unreadableReason(contract), scope: contract.scope_id || path }))
       .filter((x) => x.reason)
       .map((x) => ({ rule: "CONTRACT-UNREADABLE", level: "red", scope: x.scope, detail: `${x.reason} — the rules below could not check what they could not read` })),
+    ...lintContractSchema(contracts, domainSchema),
     ...lintScopes(scopes, repoFiles),
     ...lintScopeAnchors({ scopes, specDir: specRoot, reqIds, tasks }),
+    // `readBoard`, not the `tasks` above: only the compile-order parser carries acceptance_criteria.
+    ...lintRequirementCoverage({ clauses: reqClauses, board: readBoard(cwd, slug), scopes }),
     ...lintCommittedTier({ cwd, slug }),
     ...lintStructure({ specDir: specRoot, tasks, intakeContent }),
     ...(() => {