shapeup-sdlc 3.5.0 → 3.7.0

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "shapeup-sdlc-plugin",
   "displayName": "ShapeUp SDLC Plugin",
-  "version": "3.5.0",
+  "version": "3.7.0",
   "description": "Shape Up SDLC harness for Claude Code: shaping, intake, orient, scope-mapping, building (T0-verified, sandboxed, scope-contracted), evaluation and QA skills orchestrated by a tech-lead.",
   "author": {
     "name": "Liberty Nguyen",

package/AGENTS.md

@@ -11,8 +11,9 @@ Skills and commands are named short throughout this file; every one of them reso
 - Attested, not assumed: a dispatch leaves a receipt naming the skill that ran, and ingest refuses an orchestrated result that has none. A dispatch that fails is answered by the sub-agent improvising the craft, which every other check accepts — so "the artifact exists" is not evidence that the shipped skill produced it. `--no-receipt-check` is the way through when the receipt channel itself fails.
 - GATE L2 is advisory — warns when EVAL runs over unfinished tasks, permits the call (per-machine board, operator asked; ADR-0001) — a signal, not a bug.
 - Sign-off is a file: each gate resolves from the answer set (`ci`/`guarded`/`interactive`) — cross, stop for the PO, or abort; the decision's source is ledgered.
+- **Every ending a run does not come back from records a close** — its status, its cause and its timestamp — derived from the ending itself rather than from a hand-kept pair, so an ending nobody enumerated cannot silently record nothing. A breaker trip that routes to GATE H closes the run as `escalated`, carrying the breaker in its cause; a pause records no close **by design**, because a relaunch resumes it.
 - **Your scope cut decides your concurrency, not the dial.** Two scopes that both declare a write to one path never build at the same time: `shared` substrate is the sanctioned escape from disjointness, and an edit is read-modify-write, so concurrent writers silently drop each other's work. An entry point listed as writable by five scopes therefore builds five scopes one at a time whatever `--parallel-scopes` says. The run states the ceiling its contracts actually permit before dispatching anything, as a BUILD-order line — a peak below that ceiling is a dispatch problem, a ceiling below the dial is a scope-cut problem, and only the second is fixable by re-cutting. The fix is a cut where exactly one scope owns each entry point. Note the ceiling is narrated, not gated: it does not travel in the ⏸ L1b block, so an unattended run carries it only in its log.
-- The build+eval loop breaks only three ways ✦: EVAL PASS → QA → Ship; outer `round_budget` exhausted; opt-in `wall_clock_budget_s` tripped (the wall-clock axis event counters miss). Budget trips route to GATE H — ship what's green, never kill the run from outside. A scope exhausting its per-scope `attempt_budget` (T0 attempts) queues a GATE H proposal, never blocks the round.
+- The build+eval loop breaks only three ways ✦: EVAL PASS → QA → Ship; outer `round_budget` exhausted; opt-in `wall_clock_budget_s` tripped (the wall-clock axis event counters miss). Budget trips route to GATE H — ship what's green, never kill the run from outside. A scope exhausting its per-scope `attempt_budget` (T0 attempts) queues a GATE H proposal, never blocks the round. **An attempt is spent only when the attested channels say so** — a dispatch receipt, plus a leg row or a WorkResult. A compiled order and a T0 verdict are both writable by the scope being judged, so neither counts on its own, and an attempt still in flight holds the breaker open rather than tripping it. Opening the next attempt over an unanswered one is refused outright, because grading a tree the previous attempt may still be writing spends a budget on work nobody did.
 
 ### Phase 1 — Shaping (`/shapeup`)
 1. Set Boundaries → `/shapeup shaping`
@@ -65,12 +66,22 @@ Everything discovered funnels into `.shapeup/<slug>/discovery/ledger.md` (Orient
 
 ## Setup & Execution
 
-- Orders/results live in `.shapeup/<slug>/orders|results/`; the envelope schemas ship inside the tech-lead skill.
+- Orders/results live in `.shapeup/<slug>/orders|results/`; the envelope schemas ship with the plugin runtime, not with any individual skill, so every worker validates against the same copy.
 - The plugin's run entry points need a one-time permission grant — `npx shapeup-sdlc init` writes it into `.claude/settings.json` (`permissions.allow`); without it a headless run stalls at step one. That grant is necessary, not sufficient: it covers the run's own deterministic entry points, not the generic file edits every worker skill makes constantly, or any command a worker reaches for beyond the grant's own exact shape. A truly unattended run also needs a Claude Code permission mode that covers those (`acceptEdits` at minimum) — the plugin cannot grant that on your behalf.
+- The grant is necessary but sits under two more layers this plugin cannot reach either. A fresh
+  checkout is an **untrusted workspace**, and Claude Code discards the whole permission grant — every
+  rule in it, not only this one — until the workspace is trusted; the installer detects that state and
+  tells you, because trusting a directory to run code from is your decision to make, never a package's
+  to make for you. Above workspace trust sits Claude Code's own **auto-mode classifier**, which can
+  still block a call the grant already covers, invisibly to anything this plugin ships — no rule or
+  hook here can see it, let alone override it. When either layer stops an automated run, the
+  documented fallback is to drive Build by hand: the same per-dispatch cycle named in the Build
+  Vertically step above — compile, dispatch, ingest, verify — run one call at a time instead of
+  through the chained launch, until the run can resume unattended again.
 - Two storage tiers (ADR-0001): COMMITTED `shapeup/<slug>/` (shaping, spec, scopes, wiring-map, project-profile, requirements, hill, `REPORT.md` frozen at L4) vs GITIGNORED `.shapeup/` (board, orders/results, T0/eval/QA artifacts, ledgers, metrics, gate answers, and the run scripts staged for launch).
 - **The run launches from a copy inside your project, and it has to.** The Workflow tool loads a script only from a directory the session may already read; the plugin installs outside your project, so naming the shipped path is refused before the run begins and no permission rule repairs it — the grant authorises the tool, not what it may read. Opening a run therefore re-copies the run scripts to `.shapeup/workflows/` and reports the path the launch names. A run in flight keeps the copy it started with: an upgrade reaches the next run, not the current round.
-- **A write the substrate does not cover is denied for as long as the dispatch is in flight, and no longer.** A dispatch is live from the moment its order is compiled until a result for *that* dispatch lands, and liveness is read off the run's order set — not off the pointer that names the run, which outlives it. So a finished run fences nothing, a re-dispatch is fenced again, and the committed tier is never a worker's to write: those files belong to the orchestrator, whose window is a phase boundary rather than the middle of somebody else's order.
-- Every run has a `run_id` — the receipt mints it, and orders, T0 artifacts, trial rows, agent-call journal rows and hook decisions all carry it. It is the only key that separates two runs of the same feature: everything else (`order_id`, round/attempt) repeats. It is **not** a time boundary — a relaunch resumes the same run and reuses the key, so one `run_id` legitimately spans every launch after a paused gate or a kill, with hours of wall clock between them, and `orders/<id>.json` is rewritten by each. Anything measuring elapsed time reads the append-only records, never the span of a key. SHIP S.7 exports the run's records as fact tables under `.shapeup/exports/<run_id>/` before the run trace is superseded; a WorkResult carries no `run_id` and reaches it through `order_id`.
+- **A write the substrate does not cover is denied for as long as the dispatch is in flight, and no longer.** A dispatch is live from the moment its order is compiled until a result for *that* dispatch lands, and liveness is read off the run's order set — not off the pointer that names the run, which outlives it. A run closed any other way than shipping — escalated, aborted, killed outright — can leave one still open, and while the run's pointer is still on disk the fence holds on that order exactly as if the run were live. The pointer is what actually switches it off, though: the fence is enforced only while that pointer exists on disk, so a close that removes it releases the fence whatever the order set still says — restoring the pointer flips it straight back to denying. A **ship** close does not itself answer what it leaves outstanding — a ship close can retire the pointer over an order that never got a result — so it is not special because nothing is left unanswered; it is special only because retiring the pointer is the one lever every close needs pulled, and `reduce ship` pulls it for you. Whichever way a run closes, an order it leaves unanswered stays genuinely unresolved — not merely un-fenced — until `init run --force` runs: it writes a synthetic result for every order the closed run left unanswered, so the fence lifts without waiting on a worker that is never coming back. What the fence actually gates is narrower than "the project," too — it is this assistant's own edit path (a direct file write or edit call) outside the live order's substrate; a shell command, `git`, or any other editor still writes straight through it. Re-dispatch is fenced again, and the committed tier is never a worker's to write either way: those files belong to the orchestrator, whose window is a phase boundary rather than the middle of somebody else's order.
+- Every run has a `run_id` — the receipt mints it, and orders, T0 artifacts, trial rows, agent-call journal rows and hook decisions all carry it. It is the only key that separates two runs of the same feature: everything else (`order_id`, round/attempt) repeats. It is **not** a time boundary — a relaunch resumes the same run and reuses the key, so one `run_id` legitimately spans every launch after a paused gate or a kill, with hours of wall clock between them, and `orders/<id>.json` is rewritten by each. Anything measuring elapsed time reads the append-only records, never the span of a key. SHIP S.7 exports the run's records as fact tables under `.shapeup/exports/<run_id>/` before the run trace is superseded — and so does **every other terminal ending**: a run that aborts, escalates or stops at GATE H exports on its close, because the runs whose records are worth most are the ones that never reach the Ship phase. The export is advisory at every one of them: a failed export degrades the trace and is reported in the run's state warnings, but never turns a close into a non-close. A WorkResult carries no `run_id` and reaches it through `order_id`.
 - Every run projects a **run graph** — `.shapeup/<slug>/graph.jsonl`, append-only, written only by
   `reduce graph`. Two families kept separate: work lineage (Run, Order, Result, Verdict, Trial,
   GateDecision) and domain (Scope, UseCase, Requirement, Seam). It is derived from the artifacts,

package/README.md

@@ -332,11 +332,11 @@ claude --plugin-dir .                # load this working copy without installing
   plugin.json         # plugin manifest
   marketplace.json    # marketplace listing (points at this repo)
 skills/<name>/SKILL.md # the 13 harness skills (+ references/ and assets/)
-skills/tech-lead/schemas/                # the envelope port: WorkOrder, WorkResult, domain registry
 skills/tech-lead/workflows/shapeup-run.js # the BUILD-phase pipeline, on the native Workflow runtime
 kernel/harness.mjs    # ONE entry point for every deterministic step; the whole permission grant
 kernel/{verify,reduce,probe,init,report}/ #   its subcommands, plus compile and gate at the root
 kernel/lib/           # argv (the typed CLI boundary), paths (+ the run key), contract (shape)
+kernel/schemas/       # the envelope port: WorkOrder, WorkResult, domain registry
 commands/*.md         # slash commands (/ship + the 9 phase commands)
 hooks/                # hooks.json + the four walls: safety-spine, gate-intake, sandbox-guard
                       #   (PreToolUse) + gate-zerowork (Stop, the one blocking hook)

package/kernel/compile.mjs

@@ -31,7 +31,7 @@ import { fileURLToPath } from "node:url";
 import { validate } from "./verify/envelope.mjs";
 import { readTrials } from "./verify/t0.mjs";
 import { runArgs } from "./lib/argv.mjs";
-import { readRunId } from "./lib/paths.mjs";
+import { readRunId, dispatchReceipts, legLedger } from "./lib/paths.mjs";
 // `specDir` is aliased: this module has a local `let specDir` holding the resolved, possibly
 // --spec-overridden directory, and the import is the convention-derived default.
 import {
@@ -41,6 +41,8 @@ import {
 import { readContract, readAllContracts, tasksForScope, SCOPE_CONTRACT } from "./lib/contract.mjs";
 import { writeActiveOrder } from "./probe/resume.mjs";
 import { greenVerdict } from "./probe/t0.mjs";
+import { attemptEvidence, readReceipts } from "./probe/attempts.mjs";
+import { readLegs } from "./probe/leg.mjs";
 import { latestRoundBuild } from "./verify/build.mjs";
 // The SAME matcher the sandbox hook enforces with. "Is this cited file inside this scope's
 // substrate" has to mean exactly what the guard means, or a bug is addressed to a scope that is
@@ -58,7 +60,7 @@ export const COACHABLE = new Set([
 ]);
 
 const HERE = dirname(fileURLToPath(import.meta.url));
-const ORDER_SCHEMA = JSON.parse(readFileSync(resolve(HERE, "./../skills/tech-lead/schemas/work-order.schema.json"), "utf8"));
+const ORDER_SCHEMA = JSON.parse(readFileSync(resolve(HERE, "./schemas/work-order.schema.json"), "utf8"));
 
 // --- tiny frontmatter reader (scalar keys + [a, b] inline lists) --------------------------
 /**
@@ -218,9 +220,15 @@ export function substrateFor(operation, { slug, specDir, scope } = {}) {
   const FROZEN_INTAKE = [`${local}/intake.md`, `${local}/breadboard.md`];
   switch (operation) {
     case "execute": case "fix": case "spike":
+      // Build legs are the widest window on FROZEN_INTAKE, not an exemption from it: they are the
+      // most numerous and longest-lived dispatches in a run, so a doer that can rewrite the staged
+      // pitch can rewrite the run's own input truth mid-build. `init run` stages these before any
+      // order is live (no live contract yet — nothing to violate) and `translate` writes the
+      // COMMITTED copy, not this one, so neither legitimate write is touched by this line.
       return {
         allowed: [...(scope?.allowed_file_substrate || []), `${local}/spikes/**`],
         shared: scope?.shared_substrate || [],
+        frozen: [...FROZEN_INTAKE],
       };
     case "analyze":
       return { allowed: [`${spec}/**`, `${local}/**`], frozen: [...FROZEN_INTAKE] };
@@ -518,24 +526,30 @@ export function bugLocations(bug) {
  *
  * OWNERSHIP IS BY SUBSTRATE, because that is what the sandbox enforces: a scope is exactly the set
  * of files its worker may write, so a scope whose substrate excludes the cited line cannot fix it
- * however well it understands the bug.
+ * however well it understands the bug. The substrate a scope may write is `allowed ∪ shared` — the
+ * same union `sandbox-guard` composes at the fence — so a path declared ONLY in a contract's
+ * `shared` list is a file that scope may legitimately write, and the election must see it too —
+ * filtering on `allowed` alone elects no one for a shared-only path, and `bugsForScope` then reads
+ * that null as "no scope owns this" and fans the bug out to every scope instead of the one or two
+ * that declared it.
  *
  * BUT A MATCH IS NOT AN ELECTION. An entry point is routinely SHARED — on the measured run
  * `bin/todo.js` sits in five scopes' substrate at once — so "address it to every scope that
  * matches" hands the same one-line fix to five workers building concurrently against one file.
  * That is a write race the harness sets up itself, and four of the five fixes are waste even when
  * it resolves. So: prefer a scope that owns the file EXCLUSIVELY (allowed, not shared), and among
- * equals take the lowest scope id — a rule that needs no coordination to agree with itself, since
- * each leg compiles its own order in its own process.
+ * equals — every remaining candidate declares it shared, exclusive or not — take the lowest scope
+ * id: a rule that needs no coordination to agree with itself, since each leg compiles its own
+ * order in its own process.
  *
  * @param {string} path - Repo-relative file the bug cites.
  * @param {Array<{scope_id:string, allowed:string[], shared:string[]}>} scopes - Every scope.
  * @returns {string|null} The elected scope id, or null when no scope may write that file.
  */
 export function electOwner(path, scopes) {
-  const can = (scopes || []).filter((s) => matchesAny(path, s.allowed));
+  const can = (scopes || []).filter((s) => matchesAny(path, s.allowed) || matchesAny(path, s.shared || []));
   if (!can.length) return null;
-  const exclusive = can.filter((s) => !matchesAny(path, s.shared || []));
+  const exclusive = can.filter((s) => matchesAny(path, s.allowed) && !matchesAny(path, s.shared || []));
   return (exclusive.length ? exclusive : can).map((s) => s.scope_id).sort()[0];
 }
 
@@ -804,6 +818,40 @@ export async function cli(rawArgv) {
   const round = flag("round");
   const attempt = flag("attempt");
 
+  // AN ATTEMPT MAY NOT OPEN OVER AN UNANSWERED ONE — the write half of the attested-channel rule.
+  //
+  // `--attempt` is a flag: the CALLER picks the number, and nothing here used to check that the
+  // previous one had come back. Measured on a consumer run: attempt 2 was compiled and T0-verified
+  // while attempt 1 was still in flight, so the round graded the tree attempt 1 was still writing,
+  // counted the attempt, and stopped at GATE H with most of its budget and clock unspent. An order
+  // and a T0 verdict are both writable by the very scope being judged; only a dispatch receipt, a
+  // leg row or a WorkResult attests that work actually happened.
+  //
+  // FAILS OPEN, NEVER CLOSED, unless the bad state is positively proven. The proof required is the
+  // receipts ledger EXISTING while carrying no row for the previous attempt: a lane that does not
+  // attest dispatches at all (no ledger on disk) cannot be judged by this rule and is waved
+  // through, so `--tiny`, a prose round loop and a standalone build are untouched.
+  if (scope?.scope_id && round && attempt > 1) {
+    const receiptsPath = dispatchReceipts(cwd, slug);
+    if (existsSync(receiptsPath)) {
+      const prev = attemptEvidence(
+        cwd, slug, scope.scope_id, round, attempt - 1,
+        readReceipts(receiptsPath), readLegs(legLedger(cwd, slug)),
+      );
+      if (prev.state !== "spent") {
+        const why = prev.state === "unattested"
+          ? "no dispatch receipt was ever written for it"
+          : "it was dispatched but has neither a leg-completion row nor a WorkResult";
+        console.error(
+          `compile-order: refusing to open attempt ${attempt} for "${scope.scope_id}" in round ${round} — ` +
+          `attempt ${attempt - 1} (${prev.orderId}) is unanswered: ${why}. Grading a tree the previous ` +
+          `attempt may still be writing counts an attempt that never ran, and spends a budget on work ` +
+          `nobody did. Wait for it to return, or record its outcome, before opening the next one.`);
+        process.exit(3);
+      }
+    }
+  }
+
   // The fix round's inbound evidence. Derived here, from the ledgered verdict, for every lane —
   // the workflow, `--tiny`, the prose round loop and a standalone `/build` all compile through
   // this line, and none of them can pass a payload to a build order (see the banner above).

package/kernel/harness.mjs

@@ -32,7 +32,7 @@
 //   gate                                      An answer file with a source, not a vibe.
 //   probe    resume · t0 · stats · digest ·   Read-only queries over run state. `concurrency`
 //            concurrency · leg · eval ·        answers how many legs ran at once and what the
-//            owner · requirements
+//            owner · requirements · attempts
 //                                              fan-out bought, and refuses a figure the record set
 //                                              cannot support rather than printing a plausible one.
 //                                              `leg` answers whether a scope's work reached the
@@ -50,7 +50,14 @@
 //                                              answers which pitch clause a verdict reached, joined
 //                                              through the plan's own covers: edge — the L4 line and
 //                                              GATE H's census cite it for the same reason.
-//   init     run · fit                        Opens a run, or refuses it (exit 3).
+//                                              `attempts` answers how many of a scope's attempts are
+//                                              ATTESTED (a dispatch receipt AND a leg row or a
+//                                              WorkResult), never the order set or the T0 verdict
+//                                              set alone — the round loop's inner breaker and
+//                                              scope-hammer's census both cite it, so they cannot
+//                                              disagree about the same exhaustion again.
+//   init     run · fit · run-args              Opens a run, or refuses it (exit 3). `run-args`
+//                                              writes GATE L0.9b's launch record and echoes it.
 //   report   export                           Projects the run's records as fact tables.
 //   compile                                   The WorkOrder: schema-valid or nothing is dispatched.
 //
@@ -85,9 +92,9 @@ export const ROUTES = {
     resume: "./probe/resume.mjs", t0: "./probe/t0.mjs", stats: "./probe/stats.mjs",
     digest: "./probe/digest.mjs", concurrency: "./probe/concurrency.mjs",
     leg: "./probe/leg.mjs", eval: "./probe/eval.mjs", owner: "./probe/owner.mjs",
-    requirements: "./probe/requirements.mjs",
+    requirements: "./probe/requirements.mjs", attempts: "./probe/attempts.mjs",
   },
-  init: { run: "./init/run.mjs", fit: "./init/fit.mjs" },
+  init: { run: "./init/run.mjs", fit: "./init/fit.mjs", "run-args": "./init/run-args.mjs" },
   report: { export: "./report/export.mjs", _default: "export" },
   gate: "./gate.mjs",
   compile: "./compile.mjs",

package/kernel/init/run-args.mjs

@@ -0,0 +1,206 @@
+#!/usr/bin/env node
+// GATE L0.9b — THE LAUNCH RECORD, GIVEN A WRITER.
+//
+// WHY THIS EXISTS. `domain.schema.json`'s `RunArgs` entry calls `.shapeup/<slug>/run-args.json`
+// "the only artifact that records what a run was configured with" and names tech-lead as the
+// writer — but "tech-lead" meant a paragraph of prose telling the orchestrating session to
+// assemble a JSON object by hand and `Write` it. Outside a structural-test fixture, nothing ever
+// did: no kernel module wrote the file, so `probe concurrency`'s `dialFrom()` read a fan-out dial
+// that was never recorded and reported the effective default every time, indistinguishable from a
+// run that genuinely chose it. A registry entry is not an instruction, and an instruction with no
+// enforcer is how a documented record becomes a file that simply never exists.
+//
+// THE FIX. This is the single writer. It takes the resolved GATE L0 values as flags, builds the
+// exact `RunArgs` object the schema describes, writes it to `.shapeup/<slug>/run-args.json`, and
+// prints that SAME object on stdout — so tech-lead passes the printed value straight to
+// `Workflow({args: ...})` rather than re-typing it a second time. One construction, not two: the
+// file on disk and the value the workflow actually launches with can no longer disagree.
+//
+// `wallClockS` is NOT one of this command's flags and never lands in the object it writes.
+// `--wall-clock-budget` is consumed earlier, by `harness init run` (see `RECEIPT_VERSION` and
+// `config.wall_clock_budget_s` in `./run.mjs`) — the deadline breaker reads that receipt field
+// directly and was never going to see this launch's `RunArgs` at all. Naming a third field here
+// that nothing reads is the exact defect this command exists to close, not one to reintroduce.
+//
+// USAGE
+//   node `harness init run-args` --slug <slug> --auto-level interactive|auto|unattended \
+//        --exec-model <name> [--eval-model <name>] [--qa-model <name>] \
+//        --max-rounds N --attempts N --plugin-root <dir> \
+//        [--run-id <id>] [--answers <preset|path>] [--lane full|tiny] \
+//        [--no-eval] [--no-qa] [--adversarial-verify] [--parallel-scopes N] [--cwd <dir>]
+//
+// `--eval-model` is required unless `--no-eval` is set — an EVAL-skipping run never resolves one.
+// `--run-id`, given no explicit value, is read off the run's own receipt (the run must already be
+// open — see `harness init run`), never invented.
+//
+// Prints the written `RunArgs` object as JSON on stdout. Exit 0 on success, 2 on a usage error,
+// 3 when no run is open at `--slug` (the receipt is what makes this artifact meaningful at all).
+
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { runArgs } from "../lib/argv.mjs";
+import { localRoot, RECEIPT_FILE, runArgsPath, runIdFromReceipt } from "../lib/paths.mjs";
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+/** The plugin root, resolved from where this file actually is (`kernel/init/` → repo root). */
+export const PLUGIN_ROOT = resolve(HERE, "../..");
+
+/**
+ * The `autoLevel` enum, read from the schema that defines it — never hand-typed here.
+ *
+ * `domain.schema.json`'s `$defs/RunArgs.properties.autoLevel.enum` is the one place this set is
+ * declared. A `new Set([...])` beside it, inside the very module written to close run-argument
+ * contract drift (see this file's own banner), would be that drift repeating one level down —
+ * the same class of failure this module exists to close, applied here to an *enum's values*
+ * instead of RunArgs *field* names. Mirrors `kernel/verify/skills.mjs`'s `roster()`, which
+ * derives `WorkerName` the same way.
+ *
+ * @param {string} [root=PLUGIN_ROOT] - Plugin root the schema is read from — overridable so a test
+ *   can point this at a scratch copy of the schema and prove the result grows and shrinks with it,
+ *   never with an edit to this function.
+ * @returns {string[]} The enum, in schema order.
+ * @throws {Error} When the schema is missing or does not carry the enum.
+ */
+export function autoLevels(root = PLUGIN_ROOT) {
+  const schemaPath = join(root, "kernel/schemas/domain.schema.json");
+  const schema = JSON.parse(readFileSync(schemaPath, "utf8"));
+  const levels = schema?.$defs?.RunArgs?.properties?.autoLevel?.enum;
+  if (!Array.isArray(levels) || !levels.length) {
+    throw new Error(`${schemaPath} carries no $defs/RunArgs.properties.autoLevel.enum — the auto-level set cannot be derived`);
+  }
+  return levels;
+}
+
+/** The typed argv contract (see `../lib/argv.mjs`). */
+export const ARGV_SPEC = {
+  usage: `harness.mjs init run-args --slug <slug> --auto-level ${autoLevels().join("|")} ` +
+         '--exec-model <name> [--eval-model <name>] [--qa-model <name>] --max-rounds N --attempts N ' +
+         '--plugin-root <dir> [--run-id <id>] [--answers <preset|path>] [--lane full|tiny] ' +
+         '[--no-eval] [--no-qa] [--adversarial-verify] [--parallel-scopes N] [--cwd <dir>]',
+  _: { arity: 0, max: 0, name: "(no positional operands)" },
+  cwd: { type: "path" },
+  slug: { type: "str", required: true },
+  "run-id": { type: "str" },
+  "auto-level": { type: "str", required: true },
+  answers: { type: "str" },
+  lane: { type: "str" },
+  "exec-model": { type: "str", required: true },
+  "eval-model": { type: "str" },
+  "qa-model": { type: "str" },
+  "max-rounds": { type: "int", min: 1, required: true },
+  attempts: { type: "int", min: 1, required: true },
+  "plugin-root": { type: "path", required: true },
+  "no-eval": { type: "flag" },
+  "no-qa": { type: "flag" },
+  "adversarial-verify": { type: "flag" },
+  "parallel-scopes": { type: "int", min: 1 },
+};
+
+function fail(code, msg) {
+  console.error(msg);
+  process.exit(code);
+}
+
+/**
+ * Drop `undefined`-valued keys, one level deep on the named nested objects — so the JSON this
+ * writes never carries a literal `"eval": undefined` for a skipped role or an unset switch.
+ *
+ * @param {object} o - The candidate RunArgs object.
+ * @returns {object} The same shape with every `undefined` leaf and empty nested object removed.
+ */
+function pruned(o) {
+  const out = {};
+  for (const [k, v] of Object.entries(o)) {
+    if (v === undefined) continue;
+    if (v && typeof v === "object" && !Array.isArray(v)) {
+      const inner = pruned(v);
+      if (Object.keys(inner).length) out[k] = inner;
+      continue;
+    }
+    out[k] = v;
+  }
+  return out;
+}
+
+/**
+ * Build the `RunArgs` object — pure, so the structural suite can assert its shape without a
+ * filesystem. Mirrors `domain.schema.json` `$defs/RunArgs` exactly: this is the one place that
+ * shape is constructed, so a field this function does not carry cannot reach the file either.
+ *
+ * @param {object} o - Resolved inputs (destructured); optional fields may be `undefined`.
+ * @returns {object} The RunArgs object, pruned of unset optionals.
+ */
+export function buildRunArgs({
+  slug, runId, autoLevel, answers, lane, execModel, evalModel, qaModel,
+  maxRounds, attemptBudget, pluginRoot, startedAt,
+  noEval, noQa, adversarialVerify, maxParallelScopes,
+}) {
+  return pruned({
+    slug, runId, autoLevel, answers, lane,
+    models: { exec: execModel, eval: evalModel, qa: qaModel },
+    budgets: { maxRounds, attemptBudget },
+    pluginRoot, startedAt,
+    noEval, noQa, adversarialVerify, maxParallelScopes,
+  });
+}
+
+/**
+ * Write `.shapeup/<slug>/run-args.json`, or refuse (exit 3) when no run is open at `--slug`.
+ *
+ * @param {string[]} rawArgv - The subcommand's own arguments (harness.mjs strips the verb words).
+ * @returns {(Promise<void>|void)} Settles when the subcommand has written its output; every path
+ *   calls `process.exit()` with the subcommand's documented code rather than returning.
+ */
+export function cli(rawArgv) {
+  const args = runArgs(ARGV_SPEC, rawArgv);
+  const cwd = args.cwd || process.cwd();
+
+  if (!autoLevels().includes(args.autoLevel)) {
+    fail(2, `--auto-level must be one of: ${autoLevels().join(", ")}`);
+  }
+  if (!args.noEval && !args.evalModel) {
+    fail(2, "--eval-model is required unless --no-eval is set — an EVAL-skipping run never resolves one.");
+  }
+
+  const runRoot = localRoot(cwd, args.slug);
+  const receiptPath = join(runRoot, RECEIPT_FILE);
+  if (!existsSync(receiptPath)) {
+    fail(3, [
+      `✋ init run-args: no open run at ${runRoot} — run "harness init run" first (GATE L0.1).`,
+      "",
+      "`run-args.json` records what an OPEN run was launched with; writing one with no receipt",
+      "behind it would leave a launch record for a run that, everywhere else in the harness, never",
+      "started.",
+    ].join("\n"));
+  }
+  let receipt = null;
+  try { receipt = JSON.parse(readFileSync(receiptPath, "utf8")); } catch { /* handled below */ }
+  const runId = args.runId ?? runIdFromReceipt(receipt) ?? undefined;
+
+  const runArgsObj = buildRunArgs({
+    slug: args.slug,
+    runId,
+    autoLevel: args.autoLevel,
+    answers: args.answers ?? undefined,
+    lane: args.lane ?? undefined,
+    execModel: args.execModel,
+    evalModel: args.evalModel ?? undefined,
+    qaModel: args.qaModel ?? undefined,
+    maxRounds: args.maxRounds,
+    attemptBudget: args.attempts,
+    pluginRoot: args.pluginRoot,
+    startedAt: new Date().toISOString(),
+    noEval: args.noEval || undefined,
+    noQa: args.noQa || undefined,
+    adversarialVerify: args.adversarialVerify || undefined,
+    maxParallelScopes: args.parallelScopes ?? undefined,
+  });
+
+  mkdirSync(runRoot, { recursive: true });
+  writeFileSync(runArgsPath(cwd, args.slug), JSON.stringify(runArgsObj, null, 2) + "\n", "utf8");
+
+  // Printed, not just written — so the caller's `Workflow({args: ...})` reads this stdout instead
+  // of re-assembling the object from the flags it just typed.
+  console.log(JSON.stringify(runArgsObj, null, 2));
+}

package/kernel/init/run.mjs

@@ -224,6 +224,16 @@ export function runFrontmatter({ slug, config, startedAt }) {
     "deploy: ~",
     `started_at: ${startedAt}`,
     "closed_at: ~",
+    // The cause a terminal status ended on, written alongside `closed_at` by
+    // `probe resume --close` (kernel/probe/resume.mjs's closeRun) — the two land in one write, so a
+    // closed run's ledger never carries a timestamp with no reason beside it.
+    "close_cause: ~",
+    // The once-only guard's OWN record of what closed this run — deliberately separate from
+    // `status:` above, which every phase rewrites (`setRunStatus`) for the life of the run,
+    // including the product's own ship path immediately before `probe resume --close` runs. Only
+    // `closeRun` ever writes this line, so it is the one field an intervening `status:` rewrite
+    // cannot move (kernel/probe/resume.mjs's closeRun docblock has the measured scenario).
+    "closed_status: ~",
     "---",
     "",
     `# Harness run — ${slug}`,

package/kernel/lib/paths.mjs

@@ -140,6 +140,16 @@ export const receipt = (cwd, slug) => join(localRoot(cwd, slug), RECEIPT_FILE);
 export const intake = (cwd, slug) => join(localRoot(cwd, slug), "intake.md");
 /** The breadboard the pitch was shaped with, verbatim, next to its digest in the receipt. */
 export const breadboard = (cwd, slug) => join(localRoot(cwd, slug), "breadboard.md");
+/**
+ * The launch record's filename, as a constant rather than a literal at each call site — the
+ * writer (`harness init run-args`) and every reader (`probe concurrency`'s `dialFrom()`) resolve
+ * the same path through this constant, the same way {@link runIdFromRoot} resolves `RECEIPT_FILE`
+ * against a bare run root rather than through {@link receipt}'s `(cwd, slug)` form: a caller that
+ * already holds the run root (an archived trace, `--run-root <dir>`) has no slug to reconstruct.
+ */
+export const RUN_ARGS_FILE = "run-args.json";
+/** The launch record — the RunArgs object a run was launched with (GATE L0.9b), kernel-written. */
+export const runArgsPath = (cwd, slug) => join(localRoot(cwd, slug), RUN_ARGS_FILE);
 /** The run ledger — rounds, decisions, status frontmatter. */
 export const harnessRun = (cwd, slug) => join(localRoot(cwd, slug), "harness-run.md");
 /** File-derived mid-run digest, frozen by `reduce snapshot --write` as an audit anchor. */

package/kernel/probe/attempts.mjs

@@ -0,0 +1,135 @@
+// probe attempts — "how many of this scope's attempts are ATTESTED work, not writable artifacts?"
+//
+// CONTRACT. A bounded, read-only query over one scope's attested channels for one round: dispatch
+// receipts (`receipts/dispatch.jsonl`), leg-completion rows (`legs.jsonl`) and WorkResults
+// (`results/`). Prints `{scope_id, round, attempt_budget, spent, in_flight, unattested, green,
+// tripped, attempts}` on stdout; exits 0 when the breaker holds, 1 when it has tripped, 2 on a bad
+// argv. Writes nothing.
+//
+// WHY IT EXISTS. Measured on a real run: attempt 2 of a scope was compiled and T0-verified
+// several minutes BEFORE attempt 1 ingested — while attempt 1 was still in flight. No worker was
+// ever dispatched for attempt 2:
+// `receipts/dispatch.jsonl`, `legs.jsonl` and `results/` carried no row for it. A derivation keyed
+// off the order set (`orders/`) or the T0 verdict set (`t0/verdicts/`) alone counts a compiled
+// order or a green trial as a spent attempt regardless of whether a worker ever ran — both are
+// WRITABLE by the very leg whose exhaustion is being judged. This module counts an attempt as
+// SPENT only when a dispatch receipt attests it started AND either a leg-completion row or a
+// WorkResult on disk attests it closed. Neither channel alone is enough: a receipt with no result
+// is a leg still in flight (open, not spent — the breaker must not trip on unanswered work), and a
+// result or verdict with no receipt is unattested — no worker ran, which is the shape that
+// produced this module.
+//
+// WHY THE SAME FUNCTION SERVES THE BREAKER AND THE CENSUS. Before this module, the round loop's
+// inner breaker and `scope-hammer`'s GATE H0 census read different evidence for the same question
+// — the loop trusted the worker's own self-reported `attempts_used`/`breaker` (schema-shaped, not
+// re-verified), the census read `t0/verdicts/*.json` directly — and disagreed on the measured run.
+// One shared, attested derivation is what makes "the census and the breaker agree" true by
+// construction rather than by coincidence: `skills/scope-hammer/SKILL.md` cites this same probe
+// the way it already cites `probe owner` for ownership claims.
+
+import { existsSync, readdirSync, readFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { runArgs } from "../lib/argv.mjs";
+import { dispatchReceipts, legLedger, resultsDir } from "../lib/paths.mjs";
+import { readLegs } from "./leg.mjs";
+import { greenVerdict } from "./t0.mjs";
+
+/**
+ * Every dispatch-receipt row on disk, tolerant of a torn last line (mirrors {@link readLegs}).
+ * @param {string} path - `receipts/dispatch.jsonl`.
+ * @returns {object[]} Parsed rows; an unparsable line is skipped rather than fatal.
+ */
+export function readReceipts(path) {
+  if (!existsSync(path)) return [];
+  return readFileSync(path, "utf8").split("\n").filter(Boolean)
+    .map((l) => { try { return JSON.parse(l); } catch { return null; } })
+    .filter(Boolean);
+}
+
+/**
+ * One attempt's evidence across the three attested channels, and the state it derives to.
+ *
+ * `unattested` (no receipt at all) counts as though the attempt never happened — the order and any
+ * T0 verdict may still be sitting on disk, written by something other than a dispatched worker, and
+ * neither is asked here. `in-flight` (a receipt, but no leg row and no result) is a real dispatch
+ * whose leg has not yet closed: open, not spent. `spent` is closed either way a leg closes — via
+ * `reduce ingest`'s own leg-completion row, or a WorkResult already on disk pending ingest.
+ *
+ * @param {string} cwd - Project root.
+ * @param {string} slug - Feature slug.
+ * @param {string} scopeId - Scope contract id (the order id's own address, e.g. `shell-r1-a2`).
+ * @param {number} round - Build round.
+ * @param {number} attempt - Attempt number within the round.
+ * @param {object[]} receipts - Pre-read `receipts/dispatch.jsonl` rows (avoids re-reading per attempt).
+ * @param {object[]} legs - Pre-read `legs.jsonl` rows.
+ * @returns {{orderId:string, hasReceipt:boolean, hasResult:boolean, hasLeg:boolean, state:("unattested"|"in-flight"|"spent")}}
+ */
+export function attemptEvidence(cwd, slug, scopeId, round, attempt, receipts, legs) {
+  const orderId = `${slug}/${scopeId}-r${round}-a${attempt}`;
+  const hasReceipt = receipts.some((r) => r?.order_id === orderId);
+  const hasLeg = legs.some((r) => r?.order_id === orderId);
+  const hasResult = existsSync(join(resultsDir(cwd, slug), `${scopeId}-r${round}-a${attempt}.json`));
+  const state = !hasReceipt ? "unattested" : (hasResult || hasLeg) ? "spent" : "in-flight";
+  return { orderId, hasReceipt, hasResult, hasLeg, state };
+}
+
+/**
+ * A scope's attempt census for one round, derived ONLY from attested channels — the function both
+ * the round loop's inner breaker and scope-hammer's GATE H0 census call, so they cannot drift apart
+ * again the way a measured run found them.
+ *
+ * @param {string} cwd - Project root.
+ * @param {string} slug - Feature slug.
+ * @param {string} scopeId - Scope contract id.
+ * @param {number} round - Build round.
+ * @param {number} attemptBudget - The scope's configured `attempt_budget`.
+ * @returns {{scope_id:string, round:number, attempt_budget:number, spent:number, in_flight:number,
+ *   unattested:number, green:boolean, tripped:boolean, attempts:object[]}} `tripped` is true only
+ *   when every attempt within budget is genuinely SPENT and none produced a green T0 — an attempt
+ *   still in flight holds the breaker open regardless of how many slots are nominally used.
+ */
+export function scopeAttempts(cwd, slug, scopeId, round, attemptBudget) {
+  const receipts = readReceipts(dispatchReceipts(cwd, slug));
+  const legs = readLegs(legLedger(cwd, slug));
+  const attempts = [];
+  let spent = 0, inFlight = 0, unattested = 0;
+  for (let a = 1; a <= attemptBudget; a++) {
+    const ev = attemptEvidence(cwd, slug, scopeId, round, a, receipts, legs);
+    if (ev.state === "spent") spent++;
+    else if (ev.state === "in-flight") inFlight++;
+    else unattested++;
+    attempts.push({ attempt: a, ...ev });
+  }
+  const { green } = greenVerdict(cwd, slug, scopeId, round);
+  return {
+    scope_id: scopeId, round, attempt_budget: attemptBudget,
+    spent, in_flight: inFlight, unattested, green,
+    tripped: !green && spent >= attemptBudget,
+    attempts,
+  };
+}
+
+export const ARGV_SPEC = {
+  usage: "harness.mjs probe attempts --slug <slug> --scope <scope-id> --round N --attempt-budget N [--cwd <dir>]",
+  _: { arity: 0, max: 0, name: "(no positional operands)" },
+  slug: { type: "str", required: true },
+  scope: { type: "str", required: true },
+  round: { type: "int", min: 1, required: true },
+  "attempt-budget": { type: "int", min: 1, required: true },
+  cwd: { type: "path" },
+};
+
+/**
+ * Report one scope's attested attempt census for one round.
+ *
+ * @param {string[]} rawArgv - The subcommand's own arguments (harness.mjs strips the verb words).
+ * @returns {void} Exits 0 when the breaker holds, 1 when it has tripped — the shape a caller (or a
+ *   census citing this row) can branch on without parsing prose.
+ */
+export function cli(rawArgv) {
+  const args = runArgs(ARGV_SPEC, rawArgv);
+  const cwd = resolve(args.cwd || process.cwd());
+  const r = scopeAttempts(cwd, args.slug, args.scope, args.round, args.attemptBudget);
+  console.log(JSON.stringify(r));
+  process.exit(r.tripped ? 1 : 0);
+}