shapeup-sdlc 3.5.0 → 3.6.0

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "shapeup-sdlc-plugin",
   "displayName": "ShapeUp SDLC Plugin",
-  "version": "3.5.0",
+  "version": "3.6.0",
   "description": "Shape Up SDLC harness for Claude Code: shaping, intake, orient, scope-mapping, building (T0-verified, sandboxed, scope-contracted), evaluation and QA skills orchestrated by a tech-lead.",
   "author": {
     "name": "Liberty Nguyen",

package/AGENTS.md

@@ -65,11 +65,21 @@ Everything discovered funnels into `.shapeup/<slug>/discovery/ledger.md` (Orient
 
 ## Setup & Execution
 
-- Orders/results live in `.shapeup/<slug>/orders|results/`; the envelope schemas ship inside the tech-lead skill.
+- Orders/results live in `.shapeup/<slug>/orders|results/`; the envelope schemas ship with the plugin runtime, not with any individual skill, so every worker validates against the same copy.
 - The plugin's run entry points need a one-time permission grant — `npx shapeup-sdlc init` writes it into `.claude/settings.json` (`permissions.allow`); without it a headless run stalls at step one. That grant is necessary, not sufficient: it covers the run's own deterministic entry points, not the generic file edits every worker skill makes constantly, or any command a worker reaches for beyond the grant's own exact shape. A truly unattended run also needs a Claude Code permission mode that covers those (`acceptEdits` at minimum) — the plugin cannot grant that on your behalf.
+- The grant is necessary but sits under two more layers this plugin cannot reach either. A fresh
+  checkout is an **untrusted workspace**, and Claude Code discards the whole permission grant — every
+  rule in it, not only this one — until the workspace is trusted; the installer detects that state and
+  tells you, because trusting a directory to run code from is your decision to make, never a package's
+  to make for you. Above workspace trust sits Claude Code's own **auto-mode classifier**, which can
+  still block a call the grant already covers, invisibly to anything this plugin ships — no rule or
+  hook here can see it, let alone override it. When either layer stops an automated run, the
+  documented fallback is to drive Build by hand: the same per-dispatch cycle named in the Build
+  Vertically step above — compile, dispatch, ingest, verify — run one call at a time instead of
+  through the chained launch, until the run can resume unattended again.
 - Two storage tiers (ADR-0001): COMMITTED `shapeup/<slug>/` (shaping, spec, scopes, wiring-map, project-profile, requirements, hill, `REPORT.md` frozen at L4) vs GITIGNORED `.shapeup/` (board, orders/results, T0/eval/QA artifacts, ledgers, metrics, gate answers, and the run scripts staged for launch).
 - **The run launches from a copy inside your project, and it has to.** The Workflow tool loads a script only from a directory the session may already read; the plugin installs outside your project, so naming the shipped path is refused before the run begins and no permission rule repairs it — the grant authorises the tool, not what it may read. Opening a run therefore re-copies the run scripts to `.shapeup/workflows/` and reports the path the launch names. A run in flight keeps the copy it started with: an upgrade reaches the next run, not the current round.
-- **A write the substrate does not cover is denied for as long as the dispatch is in flight, and no longer.** A dispatch is live from the moment its order is compiled until a result for *that* dispatch lands, and liveness is read off the run's order set — not off the pointer that names the run, which outlives it. So a finished run fences nothing, a re-dispatch is fenced again, and the committed tier is never a worker's to write: those files belong to the orchestrator, whose window is a phase boundary rather than the middle of somebody else's order.
+- **A write the substrate does not cover is denied for as long as the dispatch is in flight, and no longer.** A dispatch is live from the moment its order is compiled until a result for *that* dispatch lands, and liveness is read off the run's order set — not off the pointer that names the run, which outlives it. A run closed any other way than shipping — escalated, aborted, killed outright — can leave one still open, and while the run's pointer is still on disk the fence holds on that order exactly as if the run were live. The pointer is what actually switches it off, though: the fence is enforced only while that pointer exists on disk, so a close that removes it releases the fence whatever the order set still says — restoring the pointer flips it straight back to denying. A **ship** close does not itself answer what it leaves outstanding — a ship close can retire the pointer over an order that never got a result — so it is not special because nothing is left unanswered; it is special only because retiring the pointer is the one lever every close needs pulled, and `reduce ship` pulls it for you. Whichever way a run closes, an order it leaves unanswered stays genuinely unresolved — not merely un-fenced — until `init run --force` runs: it writes a synthetic result for every order the closed run left unanswered, so the fence lifts without waiting on a worker that is never coming back. What the fence actually gates is narrower than "the project," too — it is this assistant's own edit path (a direct file write or edit call) outside the live order's substrate; a shell command, `git`, or any other editor still writes straight through it. Re-dispatch is fenced again, and the committed tier is never a worker's to write either way: those files belong to the orchestrator, whose window is a phase boundary rather than the middle of somebody else's order.
 - Every run has a `run_id` — the receipt mints it, and orders, T0 artifacts, trial rows, agent-call journal rows and hook decisions all carry it. It is the only key that separates two runs of the same feature: everything else (`order_id`, round/attempt) repeats. It is **not** a time boundary — a relaunch resumes the same run and reuses the key, so one `run_id` legitimately spans every launch after a paused gate or a kill, with hours of wall clock between them, and `orders/<id>.json` is rewritten by each. Anything measuring elapsed time reads the append-only records, never the span of a key. SHIP S.7 exports the run's records as fact tables under `.shapeup/exports/<run_id>/` before the run trace is superseded; a WorkResult carries no `run_id` and reaches it through `order_id`.
 - Every run projects a **run graph** — `.shapeup/<slug>/graph.jsonl`, append-only, written only by
   `reduce graph`. Two families kept separate: work lineage (Run, Order, Result, Verdict, Trial,

package/README.md

@@ -332,11 +332,11 @@ claude --plugin-dir .                # load this working copy without installing
   plugin.json         # plugin manifest
   marketplace.json    # marketplace listing (points at this repo)
 skills/<name>/SKILL.md # the 13 harness skills (+ references/ and assets/)
-skills/tech-lead/schemas/                # the envelope port: WorkOrder, WorkResult, domain registry
 skills/tech-lead/workflows/shapeup-run.js # the BUILD-phase pipeline, on the native Workflow runtime
 kernel/harness.mjs    # ONE entry point for every deterministic step; the whole permission grant
 kernel/{verify,reduce,probe,init,report}/ #   its subcommands, plus compile and gate at the root
 kernel/lib/           # argv (the typed CLI boundary), paths (+ the run key), contract (shape)
+kernel/schemas/       # the envelope port: WorkOrder, WorkResult, domain registry
 commands/*.md         # slash commands (/ship + the 9 phase commands)
 hooks/                # hooks.json + the four walls: safety-spine, gate-intake, sandbox-guard
                       #   (PreToolUse) + gate-zerowork (Stop, the one blocking hook)

package/kernel/compile.mjs

@@ -58,7 +58,7 @@ export const COACHABLE = new Set([
 ]);
 
 const HERE = dirname(fileURLToPath(import.meta.url));
-const ORDER_SCHEMA = JSON.parse(readFileSync(resolve(HERE, "./../skills/tech-lead/schemas/work-order.schema.json"), "utf8"));
+const ORDER_SCHEMA = JSON.parse(readFileSync(resolve(HERE, "./schemas/work-order.schema.json"), "utf8"));
 
 // --- tiny frontmatter reader (scalar keys + [a, b] inline lists) --------------------------
 /**
@@ -218,9 +218,15 @@ export function substrateFor(operation, { slug, specDir, scope } = {}) {
   const FROZEN_INTAKE = [`${local}/intake.md`, `${local}/breadboard.md`];
   switch (operation) {
     case "execute": case "fix": case "spike":
+      // Build legs are the widest window on FROZEN_INTAKE, not an exemption from it: they are the
+      // most numerous and longest-lived dispatches in a run, so a doer that can rewrite the staged
+      // pitch can rewrite the run's own input truth mid-build. `init run` stages these before any
+      // order is live (no live contract yet — nothing to violate) and `translate` writes the
+      // COMMITTED copy, not this one, so neither legitimate write is touched by this line.
       return {
         allowed: [...(scope?.allowed_file_substrate || []), `${local}/spikes/**`],
         shared: scope?.shared_substrate || [],
+        frozen: [...FROZEN_INTAKE],
       };
     case "analyze":
       return { allowed: [`${spec}/**`, `${local}/**`], frozen: [...FROZEN_INTAKE] };
@@ -518,24 +524,30 @@ export function bugLocations(bug) {
  *
  * OWNERSHIP IS BY SUBSTRATE, because that is what the sandbox enforces: a scope is exactly the set
  * of files its worker may write, so a scope whose substrate excludes the cited line cannot fix it
- * however well it understands the bug.
+ * however well it understands the bug. The substrate a scope may write is `allowed ∪ shared` — the
+ * same union `sandbox-guard` composes at the fence — so a path declared ONLY in a contract's
+ * `shared` list is a file that scope may legitimately write, and the election must see it too —
+ * filtering on `allowed` alone elects no one for a shared-only path, and `bugsForScope` then reads
+ * that null as "no scope owns this" and fans the bug out to every scope instead of the one or two
+ * that declared it.
  *
  * BUT A MATCH IS NOT AN ELECTION. An entry point is routinely SHARED — on the measured run
  * `bin/todo.js` sits in five scopes' substrate at once — so "address it to every scope that
  * matches" hands the same one-line fix to five workers building concurrently against one file.
  * That is a write race the harness sets up itself, and four of the five fixes are waste even when
  * it resolves. So: prefer a scope that owns the file EXCLUSIVELY (allowed, not shared), and among
- * equals take the lowest scope id — a rule that needs no coordination to agree with itself, since
- * each leg compiles its own order in its own process.
+ * equals — every remaining candidate declares it shared, exclusive or not — take the lowest scope
+ * id: a rule that needs no coordination to agree with itself, since each leg compiles its own
+ * order in its own process.
  *
  * @param {string} path - Repo-relative file the bug cites.
  * @param {Array<{scope_id:string, allowed:string[], shared:string[]}>} scopes - Every scope.
  * @returns {string|null} The elected scope id, or null when no scope may write that file.
  */
 export function electOwner(path, scopes) {
-  const can = (scopes || []).filter((s) => matchesAny(path, s.allowed));
+  const can = (scopes || []).filter((s) => matchesAny(path, s.allowed) || matchesAny(path, s.shared || []));
   if (!can.length) return null;
-  const exclusive = can.filter((s) => !matchesAny(path, s.shared || []));
+  const exclusive = can.filter((s) => matchesAny(path, s.allowed) && !matchesAny(path, s.shared || []));
   return (exclusive.length ? exclusive : can).map((s) => s.scope_id).sort()[0];
 }
 

package/kernel/harness.mjs

@@ -50,7 +50,8 @@
 //                                              answers which pitch clause a verdict reached, joined
 //                                              through the plan's own covers: edge — the L4 line and
 //                                              GATE H's census cite it for the same reason.
-//   init     run · fit                        Opens a run, or refuses it (exit 3).
+//   init     run · fit · run-args              Opens a run, or refuses it (exit 3). `run-args`
+//                                              writes GATE L0.9b's launch record and echoes it.
 //   report   export                           Projects the run's records as fact tables.
 //   compile                                   The WorkOrder: schema-valid or nothing is dispatched.
 //
@@ -87,7 +88,7 @@ export const ROUTES = {
     leg: "./probe/leg.mjs", eval: "./probe/eval.mjs", owner: "./probe/owner.mjs",
     requirements: "./probe/requirements.mjs",
   },
-  init: { run: "./init/run.mjs", fit: "./init/fit.mjs" },
+  init: { run: "./init/run.mjs", fit: "./init/fit.mjs", "run-args": "./init/run-args.mjs" },
   report: { export: "./report/export.mjs", _default: "export" },
   gate: "./gate.mjs",
   compile: "./compile.mjs",

package/kernel/init/run-args.mjs

@@ -0,0 +1,206 @@
+#!/usr/bin/env node
+// GATE L0.9b — THE LAUNCH RECORD, GIVEN A WRITER.
+//
+// WHY THIS EXISTS. `domain.schema.json`'s `RunArgs` entry calls `.shapeup/<slug>/run-args.json`
+// "the only artifact that records what a run was configured with" and names tech-lead as the
+// writer — but "tech-lead" meant a paragraph of prose telling the orchestrating session to
+// assemble a JSON object by hand and `Write` it. Outside a structural-test fixture, nothing ever
+// did: no kernel module wrote the file, so `probe concurrency`'s `dialFrom()` read a fan-out dial
+// that was never recorded and reported the effective default every time, indistinguishable from a
+// run that genuinely chose it. A registry entry is not an instruction, and an instruction with no
+// enforcer is how a documented record becomes a file that simply never exists.
+//
+// THE FIX. This is the single writer. It takes the resolved GATE L0 values as flags, builds the
+// exact `RunArgs` object the schema describes, writes it to `.shapeup/<slug>/run-args.json`, and
+// prints that SAME object on stdout — so tech-lead passes the printed value straight to
+// `Workflow({args: ...})` rather than re-typing it a second time. One construction, not two: the
+// file on disk and the value the workflow actually launches with can no longer disagree.
+//
+// `wallClockS` is NOT one of this command's flags and never lands in the object it writes.
+// `--wall-clock-budget` is consumed earlier, by `harness init run` (see `RECEIPT_VERSION` and
+// `config.wall_clock_budget_s` in `./run.mjs`) — the deadline breaker reads that receipt field
+// directly and was never going to see this launch's `RunArgs` at all. Naming a third field here
+// that nothing reads is the exact defect this command exists to close, not one to reintroduce.
+//
+// USAGE
+//   node `harness init run-args` --slug <slug> --auto-level interactive|auto|unattended \
+//        --exec-model <name> [--eval-model <name>] [--qa-model <name>] \
+//        --max-rounds N --attempts N --plugin-root <dir> \
+//        [--run-id <id>] [--answers <preset|path>] [--lane full|tiny] \
+//        [--no-eval] [--no-qa] [--adversarial-verify] [--parallel-scopes N] [--cwd <dir>]
+//
+// `--eval-model` is required unless `--no-eval` is set — an EVAL-skipping run never resolves one.
+// `--run-id`, given no explicit value, is read off the run's own receipt (the run must already be
+// open — see `harness init run`), never invented.
+//
+// Prints the written `RunArgs` object as JSON on stdout. Exit 0 on success, 2 on a usage error,
+// 3 when no run is open at `--slug` (the receipt is what makes this artifact meaningful at all).
+
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { runArgs } from "../lib/argv.mjs";
+import { localRoot, RECEIPT_FILE, runArgsPath, runIdFromReceipt } from "../lib/paths.mjs";
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+/** The plugin root, resolved from where this file actually is (`kernel/init/` → repo root). */
+export const PLUGIN_ROOT = resolve(HERE, "../..");
+
+/**
+ * The `autoLevel` enum, read from the schema that defines it — never hand-typed here.
+ *
+ * `domain.schema.json`'s `$defs/RunArgs.properties.autoLevel.enum` is the one place this set is
+ * declared. A `new Set([...])` beside it, inside the very module written to close run-argument
+ * contract drift (see this file's own banner), would be that drift repeating one level down —
+ * the same class of failure this module exists to close, applied here to an *enum's values*
+ * instead of RunArgs *field* names. Mirrors `kernel/verify/skills.mjs`'s `roster()`, which
+ * derives `WorkerName` the same way.
+ *
+ * @param {string} [root=PLUGIN_ROOT] - Plugin root the schema is read from — overridable so a test
+ *   can point this at a scratch copy of the schema and prove the result grows and shrinks with it,
+ *   never with an edit to this function.
+ * @returns {string[]} The enum, in schema order.
+ * @throws {Error} When the schema is missing or does not carry the enum.
+ */
+export function autoLevels(root = PLUGIN_ROOT) {
+  const schemaPath = join(root, "kernel/schemas/domain.schema.json");
+  const schema = JSON.parse(readFileSync(schemaPath, "utf8"));
+  const levels = schema?.$defs?.RunArgs?.properties?.autoLevel?.enum;
+  if (!Array.isArray(levels) || !levels.length) {
+    throw new Error(`${schemaPath} carries no $defs/RunArgs.properties.autoLevel.enum — the auto-level set cannot be derived`);
+  }
+  return levels;
+}
+
+/** The typed argv contract (see `../lib/argv.mjs`). */
+export const ARGV_SPEC = {
+  usage: `harness.mjs init run-args --slug <slug> --auto-level ${autoLevels().join("|")} ` +
+         '--exec-model <name> [--eval-model <name>] [--qa-model <name>] --max-rounds N --attempts N ' +
+         '--plugin-root <dir> [--run-id <id>] [--answers <preset|path>] [--lane full|tiny] ' +
+         '[--no-eval] [--no-qa] [--adversarial-verify] [--parallel-scopes N] [--cwd <dir>]',
+  _: { arity: 0, max: 0, name: "(no positional operands)" },
+  cwd: { type: "path" },
+  slug: { type: "str", required: true },
+  "run-id": { type: "str" },
+  "auto-level": { type: "str", required: true },
+  answers: { type: "str" },
+  lane: { type: "str" },
+  "exec-model": { type: "str", required: true },
+  "eval-model": { type: "str" },
+  "qa-model": { type: "str" },
+  "max-rounds": { type: "int", min: 1, required: true },
+  attempts: { type: "int", min: 1, required: true },
+  "plugin-root": { type: "path", required: true },
+  "no-eval": { type: "flag" },
+  "no-qa": { type: "flag" },
+  "adversarial-verify": { type: "flag" },
+  "parallel-scopes": { type: "int", min: 1 },
+};
+
+function fail(code, msg) {
+  console.error(msg);
+  process.exit(code);
+}
+
+/**
+ * Drop `undefined`-valued keys, one level deep on the named nested objects — so the JSON this
+ * writes never carries a literal `"eval": undefined` for a skipped role or an unset switch.
+ *
+ * @param {object} o - The candidate RunArgs object.
+ * @returns {object} The same shape with every `undefined` leaf and empty nested object removed.
+ */
+function pruned(o) {
+  const out = {};
+  for (const [k, v] of Object.entries(o)) {
+    if (v === undefined) continue;
+    if (v && typeof v === "object" && !Array.isArray(v)) {
+      const inner = pruned(v);
+      if (Object.keys(inner).length) out[k] = inner;
+      continue;
+    }
+    out[k] = v;
+  }
+  return out;
+}
+
+/**
+ * Build the `RunArgs` object — pure, so the structural suite can assert its shape without a
+ * filesystem. Mirrors `domain.schema.json` `$defs/RunArgs` exactly: this is the one place that
+ * shape is constructed, so a field this function does not carry cannot reach the file either.
+ *
+ * @param {object} o - Resolved inputs (destructured); optional fields may be `undefined`.
+ * @returns {object} The RunArgs object, pruned of unset optionals.
+ */
+export function buildRunArgs({
+  slug, runId, autoLevel, answers, lane, execModel, evalModel, qaModel,
+  maxRounds, attemptBudget, pluginRoot, startedAt,
+  noEval, noQa, adversarialVerify, maxParallelScopes,
+}) {
+  return pruned({
+    slug, runId, autoLevel, answers, lane,
+    models: { exec: execModel, eval: evalModel, qa: qaModel },
+    budgets: { maxRounds, attemptBudget },
+    pluginRoot, startedAt,
+    noEval, noQa, adversarialVerify, maxParallelScopes,
+  });
+}
+
+/**
+ * Write `.shapeup/<slug>/run-args.json`, or refuse (exit 3) when no run is open at `--slug`.
+ *
+ * @param {string[]} rawArgv - The subcommand's own arguments (harness.mjs strips the verb words).
+ * @returns {(Promise<void>|void)} Settles when the subcommand has written its output; every path
+ *   calls `process.exit()` with the subcommand's documented code rather than returning.
+ */
+export function cli(rawArgv) {
+  const args = runArgs(ARGV_SPEC, rawArgv);
+  const cwd = args.cwd || process.cwd();
+
+  if (!autoLevels().includes(args.autoLevel)) {
+    fail(2, `--auto-level must be one of: ${autoLevels().join(", ")}`);
+  }
+  if (!args.noEval && !args.evalModel) {
+    fail(2, "--eval-model is required unless --no-eval is set — an EVAL-skipping run never resolves one.");
+  }
+
+  const runRoot = localRoot(cwd, args.slug);
+  const receiptPath = join(runRoot, RECEIPT_FILE);
+  if (!existsSync(receiptPath)) {
+    fail(3, [
+      `✋ init run-args: no open run at ${runRoot} — run "harness init run" first (GATE L0.1).`,
+      "",
+      "`run-args.json` records what an OPEN run was launched with; writing one with no receipt",
+      "behind it would leave a launch record for a run that, everywhere else in the harness, never",
+      "started.",
+    ].join("\n"));
+  }
+  let receipt = null;
+  try { receipt = JSON.parse(readFileSync(receiptPath, "utf8")); } catch { /* handled below */ }
+  const runId = args.runId ?? runIdFromReceipt(receipt) ?? undefined;
+
+  const runArgsObj = buildRunArgs({
+    slug: args.slug,
+    runId,
+    autoLevel: args.autoLevel,
+    answers: args.answers ?? undefined,
+    lane: args.lane ?? undefined,
+    execModel: args.execModel,
+    evalModel: args.evalModel ?? undefined,
+    qaModel: args.qaModel ?? undefined,
+    maxRounds: args.maxRounds,
+    attemptBudget: args.attempts,
+    pluginRoot: args.pluginRoot,
+    startedAt: new Date().toISOString(),
+    noEval: args.noEval || undefined,
+    noQa: args.noQa || undefined,
+    adversarialVerify: args.adversarialVerify || undefined,
+    maxParallelScopes: args.parallelScopes ?? undefined,
+  });
+
+  mkdirSync(runRoot, { recursive: true });
+  writeFileSync(runArgsPath(cwd, args.slug), JSON.stringify(runArgsObj, null, 2) + "\n", "utf8");
+
+  // Printed, not just written — so the caller's `Workflow({args: ...})` reads this stdout instead
+  // of re-assembling the object from the flags it just typed.
+  console.log(JSON.stringify(runArgsObj, null, 2));
+}

package/kernel/init/run.mjs

@@ -224,6 +224,16 @@ export function runFrontmatter({ slug, config, startedAt }) {
     "deploy: ~",
     `started_at: ${startedAt}`,
     "closed_at: ~",
+    // The cause a terminal status ended on, written alongside `closed_at` by
+    // `probe resume --close` (kernel/probe/resume.mjs's closeRun) — the two land in one write, so a
+    // closed run's ledger never carries a timestamp with no reason beside it.
+    "close_cause: ~",
+    // The once-only guard's OWN record of what closed this run — deliberately separate from
+    // `status:` above, which every phase rewrites (`setRunStatus`) for the life of the run,
+    // including the product's own ship path immediately before `probe resume --close` runs. Only
+    // `closeRun` ever writes this line, so it is the one field an intervening `status:` rewrite
+    // cannot move (kernel/probe/resume.mjs's closeRun docblock has the measured scenario).
+    "closed_status: ~",
     "---",
     "",
     `# Harness run — ${slug}`,

package/kernel/lib/paths.mjs

@@ -140,6 +140,16 @@ export const receipt = (cwd, slug) => join(localRoot(cwd, slug), RECEIPT_FILE);
 export const intake = (cwd, slug) => join(localRoot(cwd, slug), "intake.md");
 /** The breadboard the pitch was shaped with, verbatim, next to its digest in the receipt. */
 export const breadboard = (cwd, slug) => join(localRoot(cwd, slug), "breadboard.md");
+/**
+ * The launch record's filename, as a constant rather than a literal at each call site — the
+ * writer (`harness init run-args`) and every reader (`probe concurrency`'s `dialFrom()`) resolve
+ * the same path through this constant, the same way {@link runIdFromRoot} resolves `RECEIPT_FILE`
+ * against a bare run root rather than through {@link receipt}'s `(cwd, slug)` form: a caller that
+ * already holds the run root (an archived trace, `--run-root <dir>`) has no slug to reconstruct.
+ */
+export const RUN_ARGS_FILE = "run-args.json";
+/** The launch record — the RunArgs object a run was launched with (GATE L0.9b), kernel-written. */
+export const runArgsPath = (cwd, slug) => join(localRoot(cwd, slug), RUN_ARGS_FILE);
 /** The run ledger — rounds, decisions, status frontmatter. */
 export const harnessRun = (cwd, slug) => join(localRoot(cwd, slug), "harness-run.md");
 /** File-derived mid-run digest, frozen by `reduce snapshot --write` as an audit anchor. */

package/kernel/probe/concurrency.mjs

@@ -30,13 +30,16 @@
 //
 // Usage: node kernel/harness.mjs probe concurrency --slug <slug> [--cwd <dir>] [--run-root <dir>]
 //                                                  [--round N] [--gap-s N] [--format json|table]
+//                                                  [--require-run-args]
 // Exit:  0 = a report was produced with at least one usable leg · 1 = ran, and no leg in scope had
 //        a usable interval (the report still prints, and says why) · 2 = malformed argv.
+//        With --require-run-args the report is skipped: 0 = run-args.json exists at this run root ·
+//        6 = it does not (mirrors `probe resume --require`'s "artifact absent" convention).
 
 import { existsSync, readFileSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { runArgs } from "../lib/argv.mjs";
-import { localRoot, runIdFromRoot, RECEIPT_FILE } from "../lib/paths.mjs";
+import { localRoot, runIdFromRoot, RECEIPT_FILE, RUN_ARGS_FILE } from "../lib/paths.mjs";
 
 /** The round-addressed order id forms `<scope>-r<N>-a<M>` and `<phase>-r<N>`. */
 const ROUND_SUFFIX = /^(.*?)-r(\d+)(?:-a(\d+))?$/;
@@ -301,16 +304,18 @@ export function summarise(index, legs) {
 /**
  * Which fan-out width the run was launched with — read, never assumed.
  *
- * The dial is written into `run-args.json` by the launcher. It is absent from every run recorded so
- * far, so the honest answer is the effective default WITH the fact that it is a default: reporting
- * `4` unqualified would assert an operator choice nobody made.
+ * The dial is written into `run-args.json` by `harness init run-args` (GATE L0.9b), the kernel
+ * writer tech-lead invokes right before the launch. A run opened before that writer existed, or one
+ * whose launcher never passed `--parallel-scopes`, still has no file or no key — so the honest
+ * answer stays the effective default WITH the fact that it is a default: reporting `4` unqualified
+ * would assert an operator choice nobody made.
  *
  * @param {string} runRoot - The run's LOCAL root.
  * @returns {{max_parallel_scopes:number, source:string}} The value and where it came from.
  */
 export function dialFrom(runRoot) {
   try {
-    const a = JSON.parse(readFileSync(join(runRoot, "run-args.json"), "utf8"));
+    const a = JSON.parse(readFileSync(join(runRoot, RUN_ARGS_FILE), "utf8"));
     const n = Number(a?.maxParallelScopes);
     if (Number.isFinite(n) && n >= 1) return { max_parallel_scopes: n, source: "run-args" };
     return { max_parallel_scopes: DEFAULT_MAX_PARALLEL_SCOPES, source: "default (run-args.json declares none)" };
@@ -474,7 +479,7 @@ export function table(r) {
 /** The typed argv contract (see `./lib/argv.mjs`). */
 export const ARGV_SPEC = {
   usage: "harness.mjs probe concurrency (--slug <slug> | --run-root <dir>) [--cwd <dir>] [--round N] " +
-         "[--gap-s N] [--format json|table]",
+         "[--gap-s N] [--format json|table] [--require-run-args]",
   _: { arity: 0, max: 0, name: "(no positional operands)" },
   slug: { type: "str" },
   // The archived-trace and post-export cases, and the same escape `verify t0 --out` has: a caller
@@ -484,6 +489,10 @@ export const ARGV_SPEC = {
   round: { type: "int", min: 1 },
   "gap-s": { type: "int", min: 1, default: DEFAULT_GAP_S },
   format: { type: "enum", values: ["json", "table"], default: "json" },
+  // The positive enforcer for the launch record (see the banner below). Skips the concurrency
+  // report entirely — this is a presence check, not a measurement, and the two must not be
+  // confused by sharing an exit code.
+  "require-run-args": { type: "flag" },
 };
 
 /**
@@ -492,6 +501,14 @@ export const ARGV_SPEC = {
  * @param {string[]} rawArgv - The subcommand's own arguments (harness.mjs strips the verb words).
  * @returns {void} Exits 0 when at least one leg had a usable interval, 1 when none did — and the
  *   report prints either way, because "nothing was measurable" is the answer, not an error.
+ *
+ *   `--require-run-args` is a different question with its own exit convention, mirroring
+ *   `probe resume --require`'s 0 (satisfied) / 6 (artifact absent): it never reaches the report at
+ *   all. The launch record had exactly one reader (`dialFrom()`, below) and zero enforcers — a
+ *   run missing it proceeded green with a silently substituted default, "indistinguishable from an
+ *   operator choice" (`gates.md` L0.9b). This flag is what `shapeup-run.js` calls at Preflight, before
+ *   ORIENT, so that state stops being invisible: this module already owns run-root resolution and the
+ *   file's path, so the check is a few lines here rather than a new kernel entry point.
  */
 export function cli(rawArgv) {
   const args = runArgs(ARGV_SPEC, rawArgv);
@@ -504,6 +521,14 @@ export function cli(rawArgv) {
     ? resolve(args.runRoot)
     : localRoot(resolve(args.cwd || process.cwd()), args.slug);
 
+  if (args.requireRunArgs) {
+    const path = join(runRoot, RUN_ARGS_FILE);
+    const present = existsSync(path);
+    console.log(JSON.stringify({ ok: present, run_root: runRoot, run_args_path: path,
+      reason: present ? null : "no run-args.json at this run root — GATE L0.9b's launch record was never written before this launch" }));
+    process.exit(present ? 0 : 6);
+  }
+
   const r = report(runRoot, { round: args.round ?? null, gapS: args.gapS });
   console.log(args.format === "table" ? table(r) : JSON.stringify(r));
   process.exit(r.launches.length ? 0 : 1);

package/kernel/probe/digest.mjs

@@ -6,7 +6,9 @@
 // Script-first by design: regex over known log formats is free (no model tokens); an
 // unrecognized line becomes a "raw" triple (file/line unknown) rather than being silently
 // dropped, so a Sonnet fallback (or a human) still has something to look at — this module never
-// invents a file:line it didn't find in the text.
+// invents a file:line it didn't find in the text. `file` and `line` are independent: a
+// diagnostic that names a file but no line number (a resource-compiler error, for example)
+// still yields its file — `line` stays null rather than being guessed at.
 //
 // Zero dependencies, zero network — same discipline as oracles/*.
 
@@ -19,6 +21,18 @@ const PATTERNS = [
   { re: /^(?:✗|not ok\b.*?)[^()]*\((.+?):(\d+)\)\s*$/, kind: "test-failure" },
   // ESLint/tsc style: "path/to/file.ts:12:34 - error TS2345: message"
   { re: /^(.+?):(\d+):\d+\s*[-–]\s*(?:error|warning)\b.*$/, kind: "compiler-diagnostic" },
+  // File-level diagnostic with NO line number: "resource.xml: error: message" or
+  // "resource.xml - fatal error: message" (resource compilers and linkers report this way —
+  // the failure is the whole file, so there is no line to cite). The file must look like a
+  // path (ends in a dotted extension, no embedded whitespace/colon) so this stays anchored to
+  // real diagnostics rather than matching arbitrary prose that happens to contain "error:".
+  { re: /^([^\s:]+?\.[A-Za-z0-9]{1,10})\s*[:\-–—]\s*(?:fatal\s+error|error|warning)\b.*$/i, kind: "compiler-diagnostic" },
+  // Bundler style: "ERROR in ./src/components/Foo.tsx" (webpack et al.) — file, no line. The
+  // captured token must look like a path — leads with "./"/"../", or ends in a dotted extension
+  // of 1-10 alnum chars (same anchor the sibling pattern above uses) — so prose after "ERROR in"
+  // ("ERROR in the build pipeline", "ERROR in test suite failed to run") is left unmatched
+  // instead of handing back a fabricated file.
+  { re: /^(?:ERROR|WARNING)\s+in\s+(\.{1,2}\/[^\s:]*|[^\s:]+\.[A-Za-z0-9]{1,10})\b/i, kind: "compiler-diagnostic" },
   // Generic "Error: message" line followed later by a stack — capture the message alone.
   { re: /^\s*(?:Error|TypeError|ReferenceError|AssertionError)\s*:\s*(.+)$/, kind: "error-message" },
 ];

package/kernel/probe/owner.mjs

@@ -46,8 +46,11 @@ import { matchesAny } from "../../hooks/sandbox-guard.mjs";
  */
 export function ownership(path, scopes, cwd = null) {
   const rel = String(path).replace(/^\.\//, "");
-  const writers = (scopes || []).filter((s) => matchesAny(rel, s.allowed)).map((s) => s.scope_id).sort();
   const shared = (scopes || []).filter((s) => matchesAny(rel, s.shared || [])).map((s) => s.scope_id).sort();
+  // `writers` is admits-the-path, the same union the sandbox fence composes (allowed ++ shared) —
+  // a path declared only in a contract's `shared` list is still a scope this path may write, and
+  // must read as owned rather than UNOWNED. `shared_with` (below) stays the narrower subset.
+  const writers = (scopes || []).filter((s) => matchesAny(rel, s.allowed) || matchesAny(rel, s.shared || [])).map((s) => s.scope_id).sort();
   return { path: rel, owner: electOwner(rel, scopes), writers, shared_with: shared, exists: cwd ? existsSync(join(cwd, rel)) : null };
 }