shapeup-sdlc 3.5.0 → 3.7.0

package/skills/tech-lead/SKILL.md

@@ -60,15 +60,15 @@ check the lane:
   legacy loop instead — `references/protocol.md` (BUILD(r)/EVAL) + `references/protocol.md`
   carry the full step-by-step for both the tiny lane and a scope-less BUILD loop, verbatim, non-
   regression. Stop reading this file here for that run.
-- **Otherwise** (the common case — a scoped spec, any auto level): build `RunArgs`
-  (`domain.schema.json` `$defs/RunArgs` — `{slug, runId, autoLevel, answers, lane,
-  models:{exec,eval,qa}, budgets:{maxRounds,attemptBudget,wallClockS}, pluginRoot, startedAt}`,
-  plus every switch the operator typed — `references/gates.md` GATE L0.9 has the flag→field table,
-  and a flag that stops here is a flag that was accepted and ignored). **Write that exact object to
-  `.shapeup/<slug>/run-args.json` before launching**, fresh on every launch and relaunch: the flags
-  reach the workflow as a value in memory, so it is the run's only evidence of what it was launched
-  with, and a run that cannot state its own configuration cannot have a claim about it checked.
-  Then launch with the **`Workflow` tool** — naming `init run`'s staged copy, never the install path:
+- **Otherwise** (the common case — a scoped spec, any auto level): resolve every switch the
+  operator typed (`references/gates.md` GATE L0.9b has the flag→field table) and run the kernel's
+  sole `RunArgs` writer: `node "${CLAUDE_PLUGIN_ROOT}/kernel/harness.mjs" init run-args --slug
+  <slug> --auto-level <level> --exec-model <n> [--eval-model <n>] [--qa-model <n>] --max-rounds <N>
+  --attempts <N> --plugin-root "${CLAUDE_PLUGIN_ROOT}" [--answers <a>] [--lane <l>] [--no-eval]
+  [--no-qa] [--adversarial-verify] [--parallel-scopes <N>]`. It writes `.shapeup/<slug>/run-args.json`
+  fresh on every launch/relaunch and prints that identical object — **pass it to `Workflow`
+  verbatim, never re-type it**. Then launch with the **`Workflow` tool** — naming `init run`'s
+  staged copy, never the install path:
 
 ```
 Workflow({
@@ -114,7 +114,7 @@ did not actually receive from the PO — an unattended lane with no answer for a
 
 FIRST freeze the evidence — run state is gitignored, so `shapeup/<slug>/REPORT.md` (already
 written by `shapeup-run.js` via `harness reduce ship`, or write it now on a `gate_h` close) is all a
-teammate sees. Then emit:
+teammate sees. Then RESOLVE the gate — `references/gates.md` GATE L4 has the call — and emit:
 
 ```
 ⏸ GATE L4 — Ship Sign-Off

package/skills/tech-lead/references/gates.md

@@ -113,11 +113,13 @@ Collect (explicit — never inferred):
         gate to be its first execution.
 ```
 
-**L0.9b — the launch record.** Every switch the operator typed becomes a `RunArgs` field, or it
-does nothing at all: the workflow cannot read a config file and cannot ask a follow-up, so a flag
-that stops at the skill boundary was accepted and ignored. That is not hypothetical — `--no-qa` was
-documented in seven places across the shipped set and inert in all of them, because no line of this
-protocol ever put `noQa` into the record.
+**L0.9b — the launch record.** Every switch the operator typed to *this launch* becomes a `RunArgs`
+field, or it does nothing at all: the workflow cannot read a config file and cannot ask a follow-up,
+so a flag that stops at the skill boundary was accepted and ignored. That is not hypothetical —
+`--no-qa` was documented in seven places across the shipped set and inert in all of them, because no
+line of this protocol ever put `noQa` into the record. `--wall-clock-budget` is the one flag below
+that is not a `RunArgs` field at all — it is consumed earlier, at `init run` itself, and never
+needed to reach this launch; see its row for where it actually lands.
 
 | Flag | `RunArgs` field |
 |---|---|
@@ -125,14 +127,19 @@ protocol ever put `noQa` into the record.
 | `--no-qa` | `noQa: true` |
 | `--parallel-scopes N` | `maxParallelScopes: N` — how many scopes build at once (default 4; `1` = sequential) |
 | `--adversarial-verify` | `adversarialVerify: true` |
-| `--rounds N` / `--attempts N` / `--wall-clock-budget S` | `budgets.{maxRounds,attemptBudget,wallClockS}` |
+| `--rounds N` / `--attempts N` | `budgets.{maxRounds,attemptBudget}` |
 | `--gate-answers <set>` | `answers` |
+| `--wall-clock-budget S` | *(not a `RunArgs` field)* — typed once, on the `harness init run` command line itself, not on this launch; it lands straight in the run receipt as `wall_clock_budget_s`, and the deadline breaker reads that receipt field directly — consumed by `kernel/verify/budget.mjs` as `wall_clock_budget_s`. `budgets` declares only `maxRounds`/`attemptBudget` — the schema, `SKILL.md`'s own RunArgs contract line and this script's own header comment all agree there is no third member |
 | `--orch-model/--exec-model/--eval-model/--qa-model` | `models.{…}` (L0.8) |
 
-The assembled object is written to `.shapeup/<slug>/run-args.json` before the launch, fresh on every
-launch and relaunch. It is the only artifact that records what a run was configured with; the ship
-report, a resumed session and any later measurement all read it, and none of them can recover a
-value that only ever existed as an argument.
+`harness init run-args` (invoked at Step 2 of `SKILL.md`) is the sole writer of the assembled
+object: it takes the resolved values above, writes `.shapeup/<slug>/run-args.json` fresh on every
+launch and relaunch, and prints the same object back so the launch never re-assembles it by hand. It
+is the only artifact that records what a run was configured with; the ship report, a resumed session
+and any later measurement all read it, and none of them can recover a value that only ever existed
+as an argument. Step 2 is not merely advisory: `shapeup-run.js`'s own Preflight refuses to dispatch
+ORIENT (or anything past it) when this file is missing at the run's local root — a launch that
+skipped this step aborts there rather than proceeding on a silent default.
 
 **L0.0 — intake precondition (before any other L0 collection):**
 ```
@@ -161,7 +168,14 @@ Model matrix : orch=[model] exec=[model] eval=[model] qa=[model] digester=[scrip
 Budgets      : round_budget=[N] (outer)   attempt_budget=[N] (inner, per scope)
 Knowledge    : [tech-lead.md — N workflow rules, M suggested values (confirmed above) | none — `/retro --scan` or `/retro --research <stack>` seeds it (optional)]
 ```
-Do NOT start ORIENT until confirmed (interactive/auto). Under --unattended, proceed.
+**Resolve it** — this gate is this skill's own (the workflow never sees it), so it is this skill
+that runs the same tool every other gate resolves through, not a paragraph read as a stand-in for
+one: `node "${CLAUDE_PLUGIN_ROOT}/kernel/harness.mjs" gate --resolve L0 --slug <slug>
+[--file <path>|--preset <name>]`. Exit 4 (`ask`) is the confirmation this block already asks for —
+put it to the PO and wait, same as the paragraph above always meant. Exit 0 (`decision=proceed`) —
+continue straight to ORIENT, which is what `--unattended`'s pre-answered set resolves to. Exit 5
+(`abort`) — stop; do not launch. Either way, the gate's own ledger row is what lets a later reader
+see the decision that opened the run, not only the decisions that closed it.
 
 ---
 
@@ -541,5 +555,28 @@ On confirm:
 - If the PO provides substantive feedback (not just 'y' or empty) → automatically delegate via Agent (model: exec — see references/protocol.md "Invocation mechanism"): Skill(shapeup-sdlc-plugin:coach) with the provided feedback for RLHF. The coach runs its own GATE COACH-1 to have the PO categorize each rule, then files it under the responsible skill in `shapeup/knowledge-base/<skill>.md` (committed → team-shared). Coachable: `task-executor`, `ba-pitch-analyzer`, `qa-edge-hunter`, `orient`, `scope-architect`, `solution-architect` (each reads its own file at the top of its next run) and `tech-lead` (workflow guidance, read at the next GATE L0). Guidance never decides a gate: a filed rule may add a question or a check to a gate block, never an answer. The tech lead does not categorize the feedback itself — that is the coach's gate, by design (no assumptions).
 - Then output → `✅ [slug] [shipped & deployed | built & verified, deploy pending] — [r] rounds, verdict PASS.`
 
+**Resolve the gate itself before any of the above** — this is the decision that shipped the run,
+and without it the trace holds no record of that decision at all: `node
+"${CLAUDE_PLUGIN_ROOT}/kernel/harness.mjs" gate --resolve L4 --slug <slug>
+[--file <path>|--preset <name>]`. Exit 0 (`decision=ship|hold`) — render the block above and close
+the run: `node "${CLAUDE_PLUGIN_ROOT}/kernel/harness.mjs" probe resume --slug <slug> --close shipped
+--cause "verdict=<verdict> rounds=<r> decision=<ship|hold>"`. Always issue this call — a `gate_h`
+close is the ordinary case where `shapeup-run.js` handed off without closing the run, and the
+GATE H → L4 path (scope-hammer's census, then this gate) is the one this instruction exists for.
+The close itself is a once-only fact IN THE KERNEL (`closeRun`'s own guard reads a `closed_status:`
+line that only `closeRun` ever writes — never the mutable `status:` line every phase rewrites, this
+call included), not a conditional this instruction has to get right: if this run_id was NOT already
+closed, this call performs the close, fresh. If it was already closed `shipped` (or `aborted`) and
+the cause text is byte-identical to what is already on the ledger, this call is a true idempotent
+no-op. If it was already closed with the SAME status but a genuinely different cause — a run closed
+more than once across relaunches, the ordinary shape a `gate_h` hand-off after an earlier abort takes
+— this call SUPERSEDES it: the new cause is written, the prior one is folded into the same
+`close_cause` line rather than lost, and the kernel call itself still exits 0 (only the RunReturn a
+launch's own `withWarnings` wraps carries the resulting `state_warning` — a prose-driven close like
+this one has no RunReturn to attach it to, so read `close_cause` by hand if this branch matters to
+you). If it was already closed with a DIFFERENT status altogether, this call is refused outright —
+cause intact, never silently flipped. Exit 4 (`ask`) — the block above IS that stop; put it to the
+PO and wait, same as always. L4's answer set carries no `abort`.
+
 ---
 

package/skills/tech-lead/references/protocol.md

@@ -630,7 +630,7 @@ trace. See `references/gates.md` — GATE L0.1.
 ## Central domain registry
 
 Every record type and payload field that crosses a skill boundary is defined exactly once in
-`skills/tech-lead/schemas/domain.schema.json` — the envelope schemas (`work-order.schema.json`,
+`kernel/schemas/domain.schema.json` — the envelope schemas (`work-order.schema.json`,
 `work-result.schema.json`) only `$ref` it. The registry annotates each entity's tier
 (SHARED/LOCAL), location, sole writer, and readers, carries the machine-readable ERD (`x-erd`),
 and maps which payload fields each worker may rely on (`x-payload-by-worker`).
@@ -686,13 +686,15 @@ lens: lite | standard | cross-context
 eval_dimensions: [spec-conformance]   # the set from GATE L0.5 (init-run --dimensions); every EVAL order is compiled from THIS line
 max_rounds: 3
 auto_level: interactive | auto | unattended
-status: orienting | mapping | building | evaluating | shipped | escalated
+status: orienting | mapping | building | evaluating | shipped | escalated | aborted
 final_verdict: ~ | pass | fail | not-evaluated
 rounds_used: [N]
 discovered_rounds: [N]
 deploy: ~ | deployed | pending-po
 started_at: [ISO]
 closed_at: ~ | [ISO]
+close_cause: ~ | [why the run ended at that terminal status — `probe resume --close` writes this and closed_at together]
+closed_status: ~ | [the terminal status actually closed — written ONLY by `probe resume --close`, never by `--set-status`, so it is immune to `status:` above being rewritten by ordinary phase traffic after the close]
 ---
 ```
 

package/skills/tech-lead/workflows/shapeup-run.js

@@ -33,7 +33,7 @@
 //
 // args — RunArgs (domain.schema.json $defs/RunArgs):
 //   slug, autoLevel (interactive|auto|unattended), answers (preset name or path),
-//   models {exec, eval, qa?}, budgets {maxRounds, attemptBudget, wallClockS?}, pluginRoot,
+//   models {exec, eval, qa?}, budgets {maxRounds, attemptBudget}, pluginRoot,
 //   startedAt, and the optional switches noEval / noQa / adversarialVerify /
 //   maxParallelScopes (default 4).
 //
@@ -391,6 +391,9 @@ const CMD = {
     // from `detail` on purpose: `detail` is prose for a human to read, this is a token the control
     // plane branches on, and collapsing the two is what made every gate comparison silently false.
     decision: { type: "string" },
+    // A close's own advisory failure (kernel/probe/resume.mjs's `exportOnClose`) — copied verbatim, the same discipline as `decision`, so "the export failed" is a
+    // fact `closeIfTerminal` can act on rather than a line buried inside free-text `detail`.
+    export_warning: { type: "string" },
   },
   required: ["exit_code", "ok"],
 };
@@ -617,7 +620,9 @@ async function cmd(verbs, phaseName, label) {
     `Report its exit code as exit_code, ok=true if and only if exit_code is 0, and one line of ` +
     `detail. If the command printed JSON carrying a top-level "decision" key, copy that value into ` +
     `decision EXACTLY as it appears — one bare token, no sentence, no quotes, no rephrasing. ` +
-    `Otherwise omit decision. Do not interpret, summarise or act on the command's output beyond that.\n\n` +
+    `Otherwise omit decision. If the command printed JSON carrying a top-level "export_warning" ` +
+    `key with a non-empty string value, copy that string into export_warning verbatim. Otherwise ` +
+    `omit export_warning. Do not interpret, summarise or act on the command's output beyond that.\n\n` +
     `If the tool call itself is refused or blocked before the command ever runs — a permission or ` +
     `policy denial, not the command's own exit — that is NOT an exit code, and you must never invent ` +
     `one to fill the field: report exit_code as -1 and put the denial's own wording verbatim in ` +
@@ -901,6 +906,47 @@ async function fastForward(gate, phaseKey, phaseName, what) {
     `${phaseKey} artifact by hand before assuming it regressed, then relaunch.`);
 }
 
+/**
+ * The positive enforcer for GATE L0.9b's launch record: the RunArgs object this run was
+ * configured with, kernel-written to the run's own local root, is on disk before this file
+ * dispatches anything past Preflight.
+ *
+ * Nothing upstream of this call can be trusted to have written it. `SKILL.md` Step 2 tells the
+ * orchestrating session to run `harness init run-args` right before `Workflow(...)` is invoked, but
+ * that is prose the session reads, not a check anything runs — and a session that launches this
+ * script without having done it left no trace anywhere else: the receipt, `intake.md` and
+ * `harness-run.md` all exist regardless, and `dialFrom()` (`kernel/probe/concurrency.mjs`) answers
+ * every reader with a silent default rather than an error. So the record's existence would depend
+ * entirely on whether a prior step of prose was followed — exactly the shape this file's own header
+ * exists to retire (no rule with no enforcer). `probe concurrency --require-run-args` is a presence
+ * check, not a measurement: it shares `dialFrom()`'s run-root resolution and file path so there is
+ * one definition of where the record lives, not two.
+ *
+ * @returns {Promise<(object|null)>} An aborted RunReturn, or null when the record is there.
+ */
+async function requireLaunchRecord() {
+  const r = await cmd(`probe concurrency --slug ${slug} --require-run-args`, "Preflight", "launch-record");
+  if (r.exit_code === 0) return null;
+  // Same distinction requirePhase/fastForward draw: only exit 6 is the predicate genuinely
+  // answering "not there". Anything else means the check itself did not run.
+  if (r.exit_code === 6) {
+    return aborted("preflight",
+      `the run's launch record does not exist — GATE L0.9b's RunArgs (the model matrix, budgets and ` +
+      `every operator switch this run was typed with) was never written to disk before this launch, ` +
+      `so nothing downstream can be attested against what the operator actually configured. Run ` +
+      `\`harness init run-args\` (references/gates.md L0.9b names every flag it resolves — \`SKILL.md\` ` +
+      `Step 2 runs it right before this workflow launches) and relaunch.`);
+  }
+  return aborted("preflight",
+    `the launch-record check did not run to a verdict — exit_code ${r.exit_code}, not the 0 (present) ` +
+    `or 6 (absent) \`probe concurrency --require-run-args\` documents.` +
+    `${r.detail ? ` Courier reported: ${r.detail}.` : ""} This is NOT evidence the record is missing — ` +
+    `most often a Bash call denied above this plugin's own hooks and permission grant (an untrusted ` +
+    `workspace, or Claude Code's auto-mode classifier). Verify the run's launch record by hand — ` +
+    `\`harness probe concurrency --slug ${slug} --require-run-args\` — before assuming it is absent, ` +
+    `then relaunch.`);
+}
+
 // The ledger's `status` field is bookkeeping, not this file's resume oracle — the fast-forward reads
 // artifacts. It survives because `reduce snapshot` and the the ship report's census hook read it to tell
 // a run in flight from a finished one. A lost write is a degraded digest, not a corrupted build, so
@@ -917,7 +963,76 @@ async function setRunStatus(status, phaseName) {
     stateWarnings.push(`status="${status}" did not take: ${why}`);
   }
 }
-const withWarnings = (ret) => (stateWarnings.length ? { ...ret, state_warnings: stateWarnings } : ret);
+
+// A free-text reason, made safe to spell into a sub-agent's shell instruction: no quotes, no
+// newlines, no backticks or `$` — every one of those risks breaking the command the sub-agent
+// itself constructs from this file's own instruction text (see `cmd()`'s banner: every kernel call
+// in this script is spelled into a prompt, not spawned directly). Truncated, not elided: the exit
+// code and the ledger's own close_cause line are still the source of record — this is only what
+// crosses the prompt boundary.
+const causeArg = (s) => (String(s ?? "").replace(/[`"'$\\\n\r]/g, " ").replace(/\s+/g, " ").trim().slice(0, 300) || "no reason recorded");
+
+// A terminal RunReturn closes the run's own ledger — a terminal status, its cause, and a close
+// timestamp, in one write. WHICH arms are terminal, and what status each closes as, is no longer
+// decided here: `probe resume --close-arm <ret.status>` hands the kernel the RunReturn arm itself
+// and it answers from `RUN_RETURN_CLOSE` (kernel/probe/resume.mjs), derived from the schema's own
+// enum rather than a pair of statuses this file used to compare `ret.status` against by hand — a
+// literal comparison that could not see a new arm go unhandled, because it never consulted the
+// kernel's own list of terminal statuses at all. `gate_h` now closes the run as `escalated` — the
+// breaker that tripped travels in the close's cause text, never as a status of its own; the
+// tech-lead skill's own GATE H → L4 orchestration still runs the census and the ship decision, it
+// just no longer finds the ledger's close fields unset when it gets there. `paused` and `ok` remain
+// explicitly non-terminal — the kernel says so, this call site no longer needs to know why.
+// Best-effort, the same discipline as `setRunStatus` above: a lost write degrades the trace's own
+// record of why the run ended, it does not change what this return reports.
+//
+// A close can also come back `ok:true` and still be a degraded outcome: `closeRun`
+// (kernel/probe/resume.mjs) refuses a DIFFERENT terminal status outright (that failure already hits
+// the `!r.ok` branch below, exit 3), but the SAME status with a DIFFERENT cause — a run_id closed
+// more than once across relaunches, e.g. `aborted` at Preflight then `aborted` again for a different
+// reason after a later relaunch — is *superseded* rather than refused: `ok:true`, the new cause
+// folded together with the old one on disk, and `decision:"superseded"` (the one bare token `cmd()`
+// relays verbatim across the courier boundary — see its own banner) naming that outcome. Reporting
+// that as a clean, silent success would be a state fact the trace needs with nothing surfacing it —
+// the same shape as leaving a run's ledger open after it ended. It costs nothing this return itself
+// reports — the ledger already folded the prior cause in — but the run's own RunReturn must say the
+// trace is degraded.
+async function closeIfTerminal(ret) {
+  const cause = ret.status === "aborted"
+    ? `${ret.aborted_at || "?"}: ${ret.reason || "no reason recorded"}`
+    : ret.status === "gate_h"
+    ? `breaker=${ret.breaker ?? "?"} green_scopes=${Array.isArray(ret.green_scopes) ? ret.green_scopes.length : "?"} hammer_proposals=${Array.isArray(ret.hammer_proposals) ? ret.hammer_proposals.length : "?"}`
+    : `verdict=${ret.verdict ?? "?"} rounds=${ret.rounds_used ?? "?"} qa_findings=${ret.qa_findings ?? "?"}`;
+  // `--close-arm` hands the kernel the arm itself (not a status this file decided was terminal) —
+  // a non-terminal arm (`paused`, `ok`) still exits 0 with no "decision" key, so the branches below
+  // stay silent for it exactly as they did when this file's own guard returned early.
+  const r = await cmd(`probe resume --slug ${slug} --close-arm ${ret.status} --cause "${causeArg(cause)}"`, "Ship", `close:${ret.status}`);
+  if (!r.ok) {
+    const why = (r.detail || `exit ${r.exit_code}`).trim();
+    log(`RUN STATE — close(${ret.status}) did not take: ${why}. This return's own status and reason still ` +
+        `stand; only the ledger's own closed_at/close_cause record is degraded.`);
+    stateWarnings.push(`close(${ret.status}) did not take: ${why}`);
+    return;
+  }
+  if (String(r.decision ?? "").trim() === "superseded") {
+    log(`RUN STATE — close(${ret.status}) superseded an earlier close recorded under the same status ` +
+        `but a different cause — this run_id was closed more than once. Both causes are on the ledger's ` +
+        `own close_cause line; this return's trace is degraded, not corrupted.`);
+    stateWarnings.push(`close(${ret.status}) superseded an earlier close of this run_id — see harness-run.md's close_cause for both reasons`);
+  }
+  // The close itself took (r.ok above) — an export_warning here is `exportOnClose`
+  // (kernel/probe/resume.mjs) reporting it could not project this run's
+  // fact tables. Advisory, same as every other line in this function: the close stands, the run's
+  // own return says the trace is short one export rather than swallowing the fact.
+  if (r.export_warning) {
+    log(`RUN STATE — close(${ret.status}) took, but its export did not: ${r.export_warning}`);
+    stateWarnings.push(`close(${ret.status}): ${r.export_warning}`);
+  }
+}
+const withWarnings = async (ret) => {
+  await closeIfTerminal(ret);
+  return stateWarnings.length ? { ...ret, state_warnings: stateWarnings } : ret;
+};
 
 // =============================================================================================
 // THE RUN
@@ -950,20 +1065,25 @@ await agent(
 );
 const canary = await cmd(`verify dispatch --skill ${canarySkill} --within 900`, "Preflight", "canary-evidence");
 if (!canary.ok) {
-  return aborted("preflight",
+  return await withWarnings(aborted("preflight",
     `the ${canarySkill} skill did not resolve in this session — no dispatch reached the hook layer. ` +
     `A run would report phases completing while the sub-agents improvised every worker's craft. ` +
     `Load the plugin (\`claude --plugin-dir <repo>\`, or install and enable it) and relaunch. ` +
-    `(${canary.detail || `exit ${canary.exit_code}`})`);
+    `(${canary.detail || `exit ${canary.exit_code}`})`));
 }
 
+// GATE L0.9b's launch record must exist before anything past Preflight dispatches; see
+// requireLaunchRecord()'s own banner for why this cannot be left to Step 2's prose alone.
+const launchRecordAbort = await requireLaunchRecord();
+if (launchRecordAbort) return await withWarnings(launchRecordAbort);
+
 phase("Orient");
 
 const rs = await query(`probe resume --slug ${slug}`, RESUME, "Orient", "resume-state");
 // A probe that produced nothing is not an EMPTY run — it is an unknown one. Treating it as empty
 // would re-dispatch every phase from the top, over a run that may be in progress.
 if (!rs) {
-  return aborted("probe", "the fast-forward derivation returned no state — refusing to re-dispatch a run that may already be in progress");
+  return await withWarnings(aborted("probe", "the fast-forward derivation returned no state — refusing to re-dispatch a run that may already be in progress"));
 }
 
 const specFolder = rs.spec_folder || `shapeup/${slug}/spec/`;
@@ -991,14 +1111,14 @@ if (!rs.has_orient_artifacts) {
       "when the risk scan came back rank 0). Any other filename leaves the phase incomplete and " +
       "the run aborts, however good the contents are.",
   });
-  if (o.__failed) return diedAt("ORIENT", o);
+  if (o.__failed) return await withWarnings(diedAt("ORIENT", o));
   const post = await requirePhase("ORIENT", "orient", "Orient");
-  if (post) return withWarnings(post);
+  if (post) return await withWarnings(post);
   await advisory(`reduce graph --slug ${slug}`, "Orient", "graph:orient");
   spikedArea = o.spiked_area; spikeResult = o.spike_result; riskiest = o.riskiest_unknowns || [];
 } else {
   const post = await fastForward("ORIENT", "orient", "Orient", "artifacts already on disk");
-  if (post) return withWarnings(post);
+  if (post) return await withWarnings(post);
 }
 
 {
@@ -1006,7 +1126,7 @@ if (!rs.has_orient_artifacts) {
   // downstream artifact reads the same whether or not the pitch's second half reached the run.
   const g = await crossGate("L1a", "Orient", ["proceed", "ask", "abort"],
     { breadboard: rs.breadboard_source ?? "none", spiked_area: spikedArea, spike_result: spikeResult, riskiest_unknowns: riskiest });
-  if (g.stop) return withWarnings(g.stop);
+  if (g.stop) return await withWarnings(g.stop);
 }
 
 // ---- COVERAGE (the requirements registry) — ahead of ANALYZE, whose ACs cite its ids ----------
@@ -1043,7 +1163,7 @@ if (!rs.has_requirements) {
       "clause per row. A clause carrying an R-id keeps its number as REQ-<n> and records the R-id " +
       "verbatim in its source cell; ids are assigned once and never renumbered.",
   });
-  if (c.__failed) return diedAt("COVERAGE", c);
+  if (c.__failed) return await withWarnings(diedAt("COVERAGE", c));
   await advisory(`reduce graph --slug ${slug}`, "Analyze", "graph:coverage");
 } else {
   log(`COVERAGE — a requirements registry is already on disk; not re-dispatching it`);
@@ -1063,13 +1183,13 @@ if (!rs.has_spec_tree) {
     payload: { pitch: rs.intake_path, breadboard: rs.breadboard_path, spec_folder: specFolder, feature: slug, lens: rs.lens, orient_dir: rs.orient_dir },
     extra: "Write the spec tree and the board from the orient artifacts — do not re-scan the code.",
   });
-  if (a.__failed) return diedAt("ANALYZE", a);
+  if (a.__failed) return await withWarnings(diedAt("ANALYZE", a));
   const post = await requirePhase("ANALYZE", "analyze", "Analyze");
-  if (post) return withWarnings(post);
+  if (post) return await withWarnings(post);
   await advisory(`reduce graph --slug ${slug}`, "Analyze", "graph:analyze");
 } else {
   const post = await fastForward("ANALYZE", "analyze", "Analyze", "spec tree already on disk");
-  if (post) return withWarnings(post);
+  if (post) return await withWarnings(post);
 }
 
 // ---- WIRE + GATE L1a.5 ------------------------------------------------------------------------
@@ -1083,7 +1203,7 @@ if (!rs.has_wiring_map) {
   // stays false and every relaunch re-dispatches and re-escalates identically. The orchestrator
   // holds the state a gate needs; it should not hand the check to the LLM it is about to pay for.
   if (!rs.has_project_profile) {
-    return withWarnings(aborted("WIRE",
+    return await withWarnings(aborted("WIRE",
       `missing SHARED project-profile.md at ${rs.project_profile_path} — GATE L0 writes it ` +
       `({schema_version:1, archetype, entry_point}; references/gates.md GATE L0 §PROFILE) before ` +
       `this workflow launches. WIRE cannot resolve an entry_call_site without an entry_point to ` +
@@ -1095,18 +1215,18 @@ if (!rs.has_wiring_map) {
     payload: { feature: slug, spec_folder: specFolder, project_profile: rs.project_profile_path, breadboard: rs.breadboard_path },
     extra: "Write the wiring map: per use case, engine → seam → entry-point call site → affordance.",
   });
-  if (w.__failed) return diedAt("WIRE", w);
+  if (w.__failed) return await withWarnings(diedAt("WIRE", w));
   const post = await requirePhase("WIRE", "wire", "Wire");
-  if (post) return withWarnings(post);
+  if (post) return await withWarnings(post);
   await advisory(`reduce graph --slug ${slug}`, "Wire", "graph:wire");
 } else {
   const post = await fastForward("WIRE", "wire", "Wire", "wiring map already on disk");
-  if (post) return withWarnings(post);
+  if (post) return await withWarnings(post);
 }
 
 {
   const g = await crossGate("L1a.5", "Wire", ["proceed", "ask", "abort"], { wiring_map: "written" });
-  if (g.stop) return withWarnings(g.stop);
+  if (g.stop) return await withWarnings(g.stop);
 }
 
 // ---- MAP SCOPES + GATE L1b --------------------------------------------------------------------
@@ -1141,15 +1261,15 @@ if (scopes.length === 0) {
       "with prose appended to it is not runnable. A scope whose fixtures do not parse has nothing " +
       "to verify it and is refused at the board review.",
   });
-  if (m.__failed) return diedAt("MAP SCOPES", m);
+  if (m.__failed) return await withWarnings(diedAt("MAP SCOPES", m));
   const post = await requirePhase("MAP SCOPES", "map-scopes", "MapScopes");
-  if (post) return withWarnings(post);
+  if (post) return await withWarnings(post);
   await advisory(`reduce graph --slug ${slug}`, "MapScopes", "graph:map-scopes");
   scopes = m.scopes;
 } else {
   const post = await fastForward("MAP SCOPES", "map-scopes", "MapScopes",
     `${scopes.length} scope contract(s) already on disk`);
-  if (post) return withWarnings(post);
+  if (post) return await withWarnings(post);
 }
 
 // DEPENDENCY ORDER — a scope is never built beside a scope it consumes.
@@ -1214,14 +1334,14 @@ if (waves.length > 1 || excluded.added || ceiling < maxParallelScopes) {
 // has more than one kind of red, and the detail says which.
 const specLint = await cmd(`verify spec --slug ${slug}`, "MapScopes", "spec-lint");
 if (!specLint.ok) {
-  return aborted("L1b", `spec-lint reported red findings before BUILD: ${specLint.detail || `exit ${specLint.exit_code}`}`);
+  return await withWarnings(aborted("L1b", `spec-lint reported red findings before BUILD: ${specLint.detail || `exit ${specLint.exit_code}`}`));
 }
 await advisory(`verify trace --slug ${slug} --quiet`, "MapScopes", "trace-lint");
 await advisory(`reduce hill --slug ${slug}`, "MapScopes", "hill-derive");
 
 {
   const g = await crossGate("L1b", "MapScopes", ["proceed", "ask", "abort"], { scopes: scopes.map((s) => s.scope_id) });
-  if (g.stop) return withWarnings(g.stop);
+  if (g.stop) return await withWarnings(g.stop);
 }
 
 // =============================================================================================
@@ -1288,7 +1408,7 @@ while (verdict !== "pass" && round <= maxRounds) {
   const budget = await cmd(`verify budget --slug ${slug} --strict`, "Build", `budget:r${round}`);
   if (budget.exit_code === 6) {
     await advisory(`reduce hill --slug ${slug}`, "Build", "hill-derive");
-    return withWarnings({ status: "gate_h", breaker: "deadline", hammer_proposals: allHammer, green_scopes: allGreen });
+    return await withWarnings({ status: "gate_h", breaker: "deadline", hammer_proposals: allHammer, green_scopes: allGreen });
   }
 
   log(`BUILD round ${round} — ${scopes.length} scope(s), up to ${maxParallelScopes} at once, attempt budget ${attemptBudget}`);
@@ -1424,7 +1544,7 @@ while (verdict !== "pass" && round <= maxRounds) {
   // INNER breaker: nothing green and something queued → GATE H. The census is scope-hammer's job.
   if (roundGreen.length === 0 && roundHammer.length > 0) {
     await advisory(`reduce hill --slug ${slug}`, "Build", "hill-derive");
-    return withWarnings({ status: "gate_h", breaker: "inner", hammer_proposals: allHammer, green_scopes: allGreen });
+    return await withWarnings({ status: "gate_h", breaker: "inner", hammer_proposals: allHammer, green_scopes: allGreen });
   }
 
   // ---- ROUND BUILD GATE — the feature builds and launches, measured before anyone is asked --------
@@ -1461,7 +1581,7 @@ while (verdict !== "pass" && round <= maxRounds) {
   {
     const g = await crossGate("L2", "Build", ["proceed", "ask", "abort"],
       { round, green_scopes: roundGreen, hammer_proposals: roundHammer, build_gate: buildGate });
-    if (g.stop) return withWarnings(g.stop);
+    if (g.stop) return await withWarnings(g.stop);
   }
 
   // ---- EVAL — exactly one feature-level pass per round (the single-judge invariant) ------------
@@ -1486,16 +1606,16 @@ while (verdict !== "pass" && round <= maxRounds) {
       payload: { dimensions: evalDims, run_cmd: rs.run_cmd, round },
       extra: "Evaluate the running feature against every acceptance criterion and Done-when. One feature-level pass; cite every artifact the order lists under t0_artifacts, re-hashing each yourself.",
     });
-    if (e.__failed) return diedAt("L3", e);
+    if (e.__failed) return await withWarnings(diedAt("L3", e));
     // The pass/fail branch is decided from the WorkResult on disk, not from the dispatching
     // agent's own summary of it (`e.overall`) — see EVAL_VERDICT's comment for why.
     const ev = await query(`probe eval --slug ${slug} --round ${round}`, EVAL_VERDICT, "Eval", `verdict:r${round}`);
-    if (!ev) return diedAt("L3", nullFail(`verdict:r${round}`));
+    if (!ev) return await withWarnings(diedAt("L3", nullFail(`verdict:r${round}`)));
     // A round with no verdict to act on is NOT a dead worker. An evaluator that refused the round
     // wrote a result saying why, and `probe eval` carries it as `reason`; reported as "died after
     // retries", the one sentence naming the cause stayed in a file nobody was pointed at.
     if (!ev.ok || !ev.overall) {
-      return diedAt("L3", { __failed: `verdict:r${round}: no verdict this round can act on — ${ev.reason || `status ${ev.status || "unknown"}`}` });
+      return await withWarnings(diedAt("L3", { __failed: `verdict:r${round}: no verdict this round can act on — ${ev.reason || `status ${ev.status || "unknown"}`}` }));
     }
     verdict = ev.overall === "PASS" ? "pass" : "fail";
     findings = e.findings || [];
@@ -1525,24 +1645,24 @@ while (verdict !== "pass" && round <= maxRounds) {
   await advisory(`reduce graph --slug ${slug}`, "Eval", `graph:eval-r${round}`);
   await advisory(`reduce hill --slug ${slug}`, "Eval", "hill-derive");
   const g3 = await crossGate("L3", "Eval", ["loop", "stop", "ask"], { round, verdict, build_gate: buildGate });
-  if (g3.stop) return withWarnings(g3.stop);
+  if (g3.stop) return await withWarnings(g3.stop);
 
   if (verdict === "pass") break;                                  // → QA → GATE H → ship
   if (g3.decision === "stop" || round >= maxRounds) {
-    return withWarnings({ status: "gate_h", breaker: "outer", hammer_proposals: allHammer, green_scopes: allGreen });
+    return await withWarnings({ status: "gate_h", breaker: "outer", hammer_proposals: allHammer, green_scopes: allGreen });
   }
   round += 1;
 }
 
 if (verdict !== "pass") {
-  return withWarnings({ status: "gate_h", breaker: "outer", hammer_proposals: allHammer, green_scopes: allGreen });
+  return await withWarnings({ status: "gate_h", breaker: "outer", hammer_proposals: allHammer, green_scopes: allGreen });
 }
 
 // ---- QA (post-PASS, pre-ship) — a level-up, never a gate. `--no-qa` answers it "skip". --------
 phase("QA");
 let qaFindings = 0;
 const qaG = await crossGate("QA", "QA", ["run", "skip", "ask"], { round, verdict });
-if (qaG.stop) return withWarnings(qaG.stop);
+if (qaG.stop) return await withWarnings(qaG.stop);
 const qaRan = !args.noQa && qaG.decision === "run";
 if (qaRan) {
   const q = await worker({
@@ -1562,14 +1682,14 @@ const h = await worker({
   payload: { feature: slug, qa_findings: qaFindings, hammer_proposals: allHammer },
   extra: "Run the census, compare against the BASELINE and never the ideal, and produce the cut list.",
 });
-if (h.__failed) return diedAt("H", h);
+if (h.__failed) return await withWarnings(diedAt("H", h));
 if (h.verdict === "cannot-ship") {
-  return withWarnings(aborted("H", `scope-hammer: CANNOT SHIP — ${h.cut_list.join(", ") || "a must-have failed"}`));
+  return await withWarnings(aborted("H", `scope-hammer: CANNOT SHIP — ${h.cut_list.join(", ") || "a must-have failed"}`));
 }
 
 {
   const g = await crossGate("H", "Ship", ["accept-cut-list", "ship-all", "ask"], { verdict: h.verdict, cut_list: h.cut_list });
-  if (g.stop) return withWarnings(g.stop);
+  if (g.stop) return await withWarnings(g.stop);
 }
 
 const ship = await cmd(`reduce ship --slug ${slug} --verdict PASS --qa ${qaRan ? "run" : "skipped"}`, "Ship", "ship-report");
@@ -1585,7 +1705,7 @@ await setRunStatus("shipped", "Ship");
 const ALL_DIMS = ["spec-conformance", "tdd-surface", "integration", "completeness",
                   "test-surface-conformance", "security", "performance"];
 
-return withWarnings({
+return await withWarnings({
   status: "shipped",
   verdict: "pass",
   rounds_used: round,
@@ -1643,11 +1763,15 @@ async function buildScope(scope, roundNo) {
           `and keep T0 green. An entry marked \`unowned\` cites no file any scope owns — fix it only ` +
           `if it falls inside your substrate. `
         : "") +
-      `Re-compile the order for every attempt after the first, with --attempt <n>. ` +
+      `Re-compile the order for every attempt after the first, with --attempt <n>. An attempt will ` +
+      `be REFUSED (exit 3) while the previous one is unanswered — dispatched with no leg row and no ` +
+      `WorkResult — because grading a tree the previous attempt may still be writing counts an ` +
+      `attempt nobody ran. Let it come back rather than opening the next one. ` +
       `Run the attempt ratchet for THIS scope only: up to ${attemptBudget} attempts of implement → ` +
       `\`node "${KERNEL}" verify t0 "${scope.path}" --round ${roundNo} --attempt <n>\`, each scored against ` +
       `the last kept trial. Stop on the first green T0, or when the attempt budget or the stagnation ` +
       `breaker trips. Write only inside this scope's substrate whitelist — the sandbox hook enforces it. ` +
-      `Report green, attempts_used, which breaker (if any) tripped, and the T0 artifact path.`,
+      `Report green, attempts_used, which breaker (if any) tripped, and the T0 artifact path — ` +
+      `attempts_used is what the attested channels carry, not a count of the orders you compiled.`,
   });
 }

package/skills/translator/SKILL.md

@@ -188,7 +188,7 @@ shared vocabulary → write it to `shapeup/<slug>/shaping/glossary.md`.
 Orchestrated, this skill is dispatched like every worker: a **WorkOrder** in (`--order <path>`,
 operation `translate`), a **WorkResult** out. The standalone arguments below map 1:1 onto the
 payload fields registered for this worker in the central domain registry
-(`skills/tech-lead/schemas/domain.schema.json`, `x-payload-by-worker`):
+(`kernel/schemas/domain.schema.json`, `x-payload-by-worker`):
 
 | Payload field | Standalone form | Meaning |
 |---|---|---|