shapeup-sdlc 3.6.0 → 3.7.1

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "shapeup-sdlc-plugin",
   "displayName": "ShapeUp SDLC Plugin",
-  "version": "3.6.0",
+  "version": "3.7.1",
   "description": "Shape Up SDLC harness for Claude Code: shaping, intake, orient, scope-mapping, building (T0-verified, sandboxed, scope-contracted), evaluation and QA skills orchestrated by a tech-lead.",
   "author": {
     "name": "Liberty Nguyen",

package/AGENTS.md

@@ -7,12 +7,14 @@ A three-phase Shape Up loop orchestrated by `/tech-lead`. Invariants live in the
 
 Skills and commands are named short throughout this file; every one of them resolves only under the plugin's namespace — `Skill(shapeup-sdlc-plugin:orient)`, `/shapeup-sdlc-plugin:ship`. A bare name is not a typo you get a warning for: an unknown skill name is rejected upstream of the hook layer, so the dispatch fires no hook, leaves no decision row, and is answered by improvisation.
 
-- Hook-denied: dispatching a worker without a schema-valid WorkOrder, writing outside the scope's substrate, stopping a run with no receipt (the run's first act writes one).
+- Hook-denied: dispatching a worker without a schema-valid WorkOrder, writing outside the scope's substrate, writing a committed file whose text names a run-trace path or a board id, stopping a run with no receipt (the run's first act writes one).
+- **The tier-direction rule is refused at the write, not argued at L1b.** A committed file cannot carry a `.shapeup/` path or a `TASK-NNN` id — boards renumber per machine and the run trace is gitignored, so either one resolves only where it was written. Spec-lint has always red'd this at Board Review; the same rule now also refuses the write itself, naming the token, because four producers hit it and one of them hit it twice in one session — a worker carries no lesson across a dispatch, and by L1b the phase that wrote the line is over. The knowledge base is outside the rule: those files are instructions, not references anyone resolves.
 - Attested, not assumed: a dispatch leaves a receipt naming the skill that ran, and ingest refuses an orchestrated result that has none. A dispatch that fails is answered by the sub-agent improvising the craft, which every other check accepts — so "the artifact exists" is not evidence that the shipped skill produced it. `--no-receipt-check` is the way through when the receipt channel itself fails.
 - GATE L2 is advisory — warns when EVAL runs over unfinished tasks, permits the call (per-machine board, operator asked; ADR-0001) — a signal, not a bug.
 - Sign-off is a file: each gate resolves from the answer set (`ci`/`guarded`/`interactive`) — cross, stop for the PO, or abort; the decision's source is ledgered.
+- **Every ending a run does not come back from records a close** — its status, its cause and its timestamp — derived from the ending itself rather than from a hand-kept pair, so an ending nobody enumerated cannot silently record nothing. A breaker trip that routes to GATE H closes the run as `escalated`, carrying the breaker in its cause; a pause records no close **by design**, because a relaunch resumes it.
 - **Your scope cut decides your concurrency, not the dial.** Two scopes that both declare a write to one path never build at the same time: `shared` substrate is the sanctioned escape from disjointness, and an edit is read-modify-write, so concurrent writers silently drop each other's work. An entry point listed as writable by five scopes therefore builds five scopes one at a time whatever `--parallel-scopes` says. The run states the ceiling its contracts actually permit before dispatching anything, as a BUILD-order line — a peak below that ceiling is a dispatch problem, a ceiling below the dial is a scope-cut problem, and only the second is fixable by re-cutting. The fix is a cut where exactly one scope owns each entry point. Note the ceiling is narrated, not gated: it does not travel in the ⏸ L1b block, so an unattended run carries it only in its log.
-- The build+eval loop breaks only three ways ✦: EVAL PASS → QA → Ship; outer `round_budget` exhausted; opt-in `wall_clock_budget_s` tripped (the wall-clock axis event counters miss). Budget trips route to GATE H — ship what's green, never kill the run from outside. A scope exhausting its per-scope `attempt_budget` (T0 attempts) queues a GATE H proposal, never blocks the round.
+- The build+eval loop breaks only three ways ✦: EVAL PASS → QA → Ship; outer `round_budget` exhausted; opt-in `wall_clock_budget_s` tripped (the wall-clock axis event counters miss). Budget trips route to GATE H — ship what's green, never kill the run from outside. A scope exhausting its per-scope `attempt_budget` (T0 attempts) queues a GATE H proposal, never blocks the round. **An attempt is spent only when the attested channels say so** — a dispatch receipt, plus a leg row or a WorkResult. A compiled order and a T0 verdict are both writable by the scope being judged, so neither counts on its own, and an attempt still in flight holds the breaker open rather than tripping it. Opening the next attempt over an unanswered one is refused outright, because grading a tree the previous attempt may still be writing spends a budget on work nobody did.
 
 ### Phase 1 — Shaping (`/shapeup`)
 1. Set Boundaries → `/shapeup shaping`
@@ -79,8 +81,8 @@ Everything discovered funnels into `.shapeup/<slug>/discovery/ledger.md` (Orient
   through the chained launch, until the run can resume unattended again.
 - Two storage tiers (ADR-0001): COMMITTED `shapeup/<slug>/` (shaping, spec, scopes, wiring-map, project-profile, requirements, hill, `REPORT.md` frozen at L4) vs GITIGNORED `.shapeup/` (board, orders/results, T0/eval/QA artifacts, ledgers, metrics, gate answers, and the run scripts staged for launch).
 - **The run launches from a copy inside your project, and it has to.** The Workflow tool loads a script only from a directory the session may already read; the plugin installs outside your project, so naming the shipped path is refused before the run begins and no permission rule repairs it — the grant authorises the tool, not what it may read. Opening a run therefore re-copies the run scripts to `.shapeup/workflows/` and reports the path the launch names. A run in flight keeps the copy it started with: an upgrade reaches the next run, not the current round.
-- **A write the substrate does not cover is denied for as long as the dispatch is in flight, and no longer.** A dispatch is live from the moment its order is compiled until a result for *that* dispatch lands, and liveness is read off the run's order set — not off the pointer that names the run, which outlives it. A run closed any other way than shipping — escalated, aborted, killed outright — can leave one still open, and while the run's pointer is still on disk the fence holds on that order exactly as if the run were live. The pointer is what actually switches it off, though: the fence is enforced only while that pointer exists on disk, so a close that removes it releases the fence whatever the order set still says — restoring the pointer flips it straight back to denying. A **ship** close does not itself answer what it leaves outstanding — a ship close can retire the pointer over an order that never got a result — so it is not special because nothing is left unanswered; it is special only because retiring the pointer is the one lever every close needs pulled, and `reduce ship` pulls it for you. Whichever way a run closes, an order it leaves unanswered stays genuinely unresolved — not merely un-fenced — until `init run --force` runs: it writes a synthetic result for every order the closed run left unanswered, so the fence lifts without waiting on a worker that is never coming back. What the fence actually gates is narrower than "the project," too — it is this assistant's own edit path (a direct file write or edit call) outside the live order's substrate; a shell command, `git`, or any other editor still writes straight through it. Re-dispatch is fenced again, and the committed tier is never a worker's to write either way: those files belong to the orchestrator, whose window is a phase boundary rather than the middle of somebody else's order.
-- Every run has a `run_id` — the receipt mints it, and orders, T0 artifacts, trial rows, agent-call journal rows and hook decisions all carry it. It is the only key that separates two runs of the same feature: everything else (`order_id`, round/attempt) repeats. It is **not** a time boundary — a relaunch resumes the same run and reuses the key, so one `run_id` legitimately spans every launch after a paused gate or a kill, with hours of wall clock between them, and `orders/<id>.json` is rewritten by each. Anything measuring elapsed time reads the append-only records, never the span of a key. SHIP S.7 exports the run's records as fact tables under `.shapeup/exports/<run_id>/` before the run trace is superseded; a WorkResult carries no `run_id` and reaches it through `order_id`.
+- **A write the substrate does not cover is denied for as long as the dispatch is in flight, and no longer.** A dispatch is live from the moment its order is compiled until a result for *that* dispatch lands, and liveness is read off the run's order set — not off the pointer that names the run, which outlives it. A run closed any other way than shipping — escalated, aborted, killed outright — leaves an order still open by construction, and the pointer is what decides whether that still fences: the fence is enforced only while the pointer exists on disk, so a close that removes it releases the fence whatever the order set says, and restoring the pointer flips it straight back to denying. **Every terminal close retires it** (3.7.1 onward), not only a ship — an escalated or aborted run stops fencing the checkout the moment it closes, and a close that cannot remove a pointer says so in its own return rather than failing. Retiring is not answering, though, and the difference is the whole reason there are still two levers: the pointer says a run is in flight, the missing result says nobody came back, and only the first stops being true at a close. An order the run left unanswered stays genuinely unresolved — un-fenced, but not done — until `init run --force` writes a synthetic result for it, which is also what lets the attempt census keep telling work nobody did apart from work that failed. What the fence actually gates is narrower than "the project," too — it is this assistant's own edit path (a direct file write or edit call) outside the live order's substrate; a shell command, `git`, or any other editor still writes straight through it. Re-dispatch is fenced again, and the committed tier is never a worker's to write either way: those files belong to the orchestrator, whose window is a phase boundary rather than the middle of somebody else's order.
+- Every run has a `run_id` — the receipt mints it, and orders, T0 artifacts, trial rows, agent-call journal rows and hook decisions all carry it. It is the only key that separates two runs of the same feature: everything else (`order_id`, round/attempt) repeats. It is **not** a time boundary — a relaunch resumes the same run and reuses the key, so one `run_id` legitimately spans every launch after a paused gate or a kill, with hours of wall clock between them, and `orders/<id>.json` is rewritten by each. Anything measuring elapsed time reads the append-only records, never the span of a key. SHIP S.7 exports the run's records as fact tables under `.shapeup/exports/<run_id>/` before the run trace is superseded — and so does **every other terminal ending**: a run that aborts, escalates or stops at GATE H exports on its close, because the runs whose records are worth most are the ones that never reach the Ship phase. The export is advisory at every one of them: a failed export degrades the trace and is reported in the run's state warnings, but never turns a close into a non-close. A WorkResult carries no `run_id` and reaches it through `order_id`.
 - Every run projects a **run graph** — `.shapeup/<slug>/graph.jsonl`, append-only, written only by
   `reduce graph`. Two families kept separate: work lineage (Run, Order, Result, Verdict, Trial,
   GateDecision) and domain (Scope, UseCase, Requirement, Seam). It is derived from the artifacts,

package/README.md

@@ -210,7 +210,7 @@ the layer that carries it, and the three layers here fail differently:
 | **Runtime** — the kernel and the run script | When the run goes through the harness. A schema rejection or a non-zero exit stops the step. | A lane that never calls the kernel is never checked — which is why the hooks below cover the doors, not the steps. |
 | **Advisory** — a report section | When somebody reads the artifact. | Silently, if nobody does. It is a cleanup list, never a verdict. |
 
-**Four walls.** These are hooks because nothing in the runtime can substitute for them:
+**Five walls.** These are hooks because nothing in the runtime can substitute for them:
 
 - `PreToolUse` (`Skill`) — **`hooks/gate-intake.mjs` denies a `tech-lead` dispatch that carries no
   pitch, no spec folder, and no requirement text.** Observed, not theorized: when the requirement
@@ -227,6 +227,13 @@ the layer that carries it, and the three layers here fail differently:
   checked first and outranks everything, across every live contract — including the carve-out that
   otherwise keeps the active feature's own run trace writable, so a path a live order froze stays
   frozen wherever it lives.
+- `PreToolUse` (`Edit|Write|MultiEdit`) — **`hooks/tier-guard.mjs` refuses a committed-tier write
+  whose content names a path into the local run trace or a board id.** Same rule spec-lint reds at
+  GATE L1b, asked at the moment of writing: four different producers wrote a committed file their
+  own lint then rejected, and one of them did it twice in one session, an hour apart, after fixing
+  the first occurrence itself. A worker carries no lesson across a dispatch, so the remedy is a
+  refusal the writer can act on while it still knows what it meant to say. The knowledge base is
+  outside it — those files are instructions, not references a reader has to resolve.
 - `PreToolUse` (`Bash|Read|Write|Edit|MultiEdit`) — **`hooks/safety-spine.mjs` denies destructive
   commands** (`rm -rf` on unrecoverable targets, force-push/push-to-main, `git reset --hard`,
   `DROP TABLE`) and secret-file reads. A machine guard, not a pipeline guard; the escape hatch is
@@ -265,7 +272,7 @@ the layer that carries it, and the three layers here fail differently:
 | `anti-rationalization` (claims the facts contradict) | The ship report's census, derived from the board and the T0 artifacts | The facts are in an artifact a teammate finds on `git pull`, not in a transcript nobody re-reads. |
 | `slop-cleaner` (TODO/`console.log` leftovers) | The ship report's **Leftovers** section | Same scan, same added-lines-only rule; it lands somewhere checkable. |
 
-**Nothing load-bearing depends on permission mode.** The four walls plus the zero-work gate run
+**Nothing load-bearing depends on permission mode.** The five walls plus the zero-work gate run
 under every mode. The kernel needs a grant to be *invoked* — two Bash lines `npx shapeup-sdlc init`
 writes — but a session that never gets that grant is a session that cannot run the pipeline at all,
 not one that runs it unguarded.
@@ -338,8 +345,8 @@ kernel/{verify,reduce,probe,init,report}/ #   its subcommands, plus compile and
 kernel/lib/           # argv (the typed CLI boundary), paths (+ the run key), contract (shape)
 kernel/schemas/       # the envelope port: WorkOrder, WorkResult, domain registry
 commands/*.md         # slash commands (/ship + the 9 phase commands)
-hooks/                # hooks.json + the four walls: safety-spine, gate-intake, sandbox-guard
-                      #   (PreToolUse) + gate-zerowork (Stop, the one blocking hook)
+hooks/                # hooks.json + the five walls: safety-spine, gate-intake, sandbox-guard,
+                      #   tier-guard (PreToolUse) + gate-zerowork (Stop, the one blocking hook)
                       #   + dispatch-receipt (PostToolUse, denies nothing, attests which skill ran)
                       #   + lib/decision.mjs (every hook records allow / deny / error)
 oracles/              # the evaluation-contract oracle registry (test · snapshot · http · process)

package/SECURITY.md

@@ -1,7 +1,7 @@
 # Security
 
-This plugin installs **seven hook entries (six Node scripts + one `echo`)**: four in a
-`PreToolUse` position, **all four of which can deny a tool call**, one `PostToolUse` hook that has no
+This plugin installs **eight hook entries (seven Node scripts + one `echo`)**: five in a
+`PreToolUse` position, **all five of which can deny a tool call**, one `PostToolUse` hook that has no
 deny path at all, and one `Stop`-position hook that can block a session from ending. That is the
 product — and it is also exactly the kind of surface a careful reviewer should want spelled out
 before installing. This page is that spelling-out.
@@ -73,6 +73,7 @@ sitting, and reading them is the recommended review.
 | [`gate-intake.mjs`](hooks/gate-intake.mjs) | PreToolUse (`Skill`) | The `tech-lead` dispatch's own arguments | Yes — an orchestrator dispatch carrying no resolvable intake (no pitch, spec, resume or requirement text) | Fails open on `--order` and on any ambiguous arg shape |
 | [`harness verify envelope`](kernel/verify/envelope.mjs) | PreToolUse (`Skill\|Agent`) | The `--order` file named in the dispatch; the JSON schemas | Yes — a worker dispatch whose order file is missing or schema-invalid | Never gates a dispatch that carries no `--order` (standalone skill use stays free) |
 | [`sandbox-guard.mjs`](hooks/sandbox-guard.mjs) | PreToolUse (`Edit\|Write\|MultiEdit`) | The target path; the `substrate` block of every LIVE order — compiled, with no result at least as new as the order's own `compiled_at`, and, for a run-level phase dispatch, not yet superseded by a later phase's order | Yes — any write no live order permits: inside any `frozen`, outside every `allowed`/`shared`, or a `Write` to an `append_only` path. `frozen` is checked FIRST, so it also outranks the run-trace carve-out | No-op unless an order is live, which a finished run no longer is: the pointer names the run, never a dispatch. The active feature's own `.shapeup/<slug>/` run trace is writable EXCEPT where a live order freezes a path inside it. Appends denials to the local pathology log |
+| [`tier-guard.mjs`](hooks/tier-guard.mjs) | PreToolUse (`Edit\|Write\|MultiEdit`) | The target path; the text the call is about to write (`content`, `new_string`, or any edit in a `MultiEdit` batch) | Yes — a write into `shapeup/<slug>/` whose content names a `.shapeup/` path or a `TASK-NNN` board id: the same tier-direction rule spec-lint reds at GATE L1b, refused at the moment of writing, with the offending token quoted back | No-op outside `shapeup/<slug>/`, on file forms the lint does not scan, and on `shapeup/knowledge-base/` (instructions to a worker, not references). Reads nothing off disk and writes only its decision row; it never inspects a file it is not being asked to write |
 | [`dispatch-receipt.mjs`](hooks/dispatch-receipt.mjs) | PostToolUse (`Skill\|Agent`) | The `--order` file named in the dispatch; the tool result's own report of which skill ran | **No — it has no deny path at all.** It records that the shipped skill ran, so `harness reduce ingest` can refuse a result no dispatch produced | Never writes an attestation for a result that does not name a resolved skill; never fails the call it observes (every write is inside `try`/`catch`) |
 | [`gate-zerowork.mjs`](hooks/gate-zerowork.mjs) | Stop | Run receipts on disk; the session transcript; the decision ledger | **Yes — the one blocking hook.** Returns `decision:"block"` when the session dispatched the orchestrator and produced no run receipt | Defers the moment any receipt exists; `stop_hook_active` caps it at one block per stop chain |
 

package/hooks/hooks.json

@@ -50,6 +50,16 @@
             "timeout": 10
           }
         ]
+      },
+      {
+        "matcher": "Edit|Write|MultiEdit",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/tier-guard.mjs\"",
+            "timeout": 10
+          }
+        ]
       }
     ],
     "PostToolUse": [

package/hooks/tier-guard.mjs

@@ -0,0 +1,162 @@
+#!/usr/bin/env node
+// Tier guard — PreToolUse hook: the committed tier's write boundary.
+//
+// Refuses an Edit/Write/MultiEdit into `shapeup/<slug>/` whose CONTENT carries a reference the
+// committed tier cannot hold — a path into the gitignored run trace, or a machine-local board id.
+// It is the same rule spec-lint's TIER-DIRECTION already enforces, asked at a different moment.
+//
+// WHY A SECOND ENFORCEMENT POINT FOR A RULE THAT WAS NEVER IN DOUBT. Four different producers wrote
+// committed files this harness's own lint then reds: the requirements registry, the ship report, the
+// project profile, the coverage clauses. The lint was right every time and caught every one of them
+// — at GATE L1b, a whole phase after the sentence was written, addressed to a worker that no longer
+// holds the context needed to rephrase it. The run pays for the round trip, and the fix lands in
+// whatever wording the next reader guesses at.
+//
+// TEACHING DOES NOT CLOSE IT, and that is measured rather than assumed. One of the four recurred
+// INSIDE A SINGLE SESSION, an hour apart, on a different line of the same file, after that same
+// author had fixed the first occurrence and watched its own lint go green. A worker carries no
+// lesson across a dispatch. So the remedy has to be a precondition the model cannot talk past, and
+// it has to speak AT THE WRITE — the one moment the writer still knows what it meant to say.
+//
+// THE PREDICATE IS IMPORTED, NEVER RESTATED. `tierLeaks` is the lint's own scanner
+// (kernel/verify/spec.mjs), so this hook cannot become narrower than the rule it fronts — which
+// would let the defect through to L1b exactly as before — nor wider, which is how a guard earns
+// being switched off. The structural suite executes both over one corpus and requires agreement.
+//
+// Design (deliberately conservative, the shape `sandbox-guard.mjs` argues for):
+//   • Fail-OPEN on everything it cannot positively prove: not a write tool, no resolvable path, a
+//     path outside `shapeup/<slug>/`, a file form the lint does not scan, or a payload carrying no
+//     content to read. A guard that blocks legitimate work gets disabled, and a disabled guard
+//     enforces nothing.
+//   • `shapeup/knowledge-base/` is OUTSIDE by construction, exactly as it is outside the lint's
+//     walk: those files are instructions read by a worker at runtime, not references a reader is
+//     expected to resolve, and the defect register they hold has every reason to quote a local path.
+//   • Fail-CLOSED only on a leak the lint would red, with the file, the line, the offending token,
+//     why it is wrong and what to write instead — all in the denial, because a denial the writer
+//     cannot act on immediately just becomes the L1b round trip with extra steps.
+//
+// WHAT IT DOES NOT COVER, stated because the gap is the same one the substrate fence has: this is a
+// PreToolUse hook, so it sees this assistant's own edit path and nothing else. A kernel subcommand
+// writing a committed file, a shell heredoc, or any other editor writes straight through it. Those
+// producers are answered where they are written; this closes the channel the four measured
+// recurrences actually came through.
+//
+// Contract: PreToolUse stdin JSON { tool_name, tool_input:{file_path, content | new_string |
+// edits[]}, cwd }. Deny via { hookSpecificOutput: { hookEventName, permissionDecision:"deny",
+// permissionDecisionReason } }.
+
+import { resolve, relative, sep } from "node:path";
+import { isMain } from "../kernel/lib/argv.mjs";
+import { SHARED } from "../kernel/lib/paths.mjs";
+import { SCANNED, tierLeaks } from "../kernel/verify/spec.mjs";
+import { runHook, readStdin, settle, projectRoot } from "./lib/decision.mjs";
+
+/** Committed-tier trees that hold instructions rather than references — outside the lint's walk. */
+const NOT_A_SLUG = new Set(["knowledge-base"]);
+
+/**
+ * The (path, content) pairs one write tool call is about to commit to disk.
+ *
+ * THE THREE WRITE TOOLS SPELL CONTENT THREE WAYS, and a guard that reads only `content` is blind to
+ * the Edit that adds the same line — which is the form the measured recurrence took, since the file
+ * already existed by then.
+ *
+ * @param {object} toolInput - The PreToolUse `tool_input` block.
+ * @returns {Array<{path:string, content:string}>} Pairs with a usable path and string content.
+ */
+export function extractWrites(toolInput) {
+  const out = [];
+  const base = toolInput?.file_path;
+  if (typeof toolInput?.content === "string" && base) out.push({ path: base, content: toolInput.content });
+  if (typeof toolInput?.new_string === "string" && base) out.push({ path: base, content: toolInput.new_string });
+  if (Array.isArray(toolInput?.edits)) {
+    for (const e of toolInput.edits) {
+      const p = e?.file_path || base;
+      if (p && typeof e?.new_string === "string") out.push({ path: p, content: e.new_string });
+    }
+  }
+  return out;
+}
+
+/**
+ * Is this path inside the committed tier the lint walks — `shapeup/<slug>/…`, scanned form?
+ *
+ * @param {string} rel - Path relative to the project root, as the lint would name it.
+ * @returns {boolean} True when a leak here is a leak the lint would red.
+ */
+export function inCommittedTier(rel) {
+  if (!rel || rel.startsWith("..") || rel.startsWith(sep)) return false;
+  const parts = rel.split(/[\\/]/);
+  // `shapeup/<slug>/<file>` — the lint walks a slug's tree, so a file at the tier root belongs to
+  // no run and is left alone, and `knowledge-base` is a sibling of the slugs, not one of them.
+  if (parts[0] !== SHARED || parts.length < 3 || NOT_A_SLUG.has(parts[1])) return false;
+  return SCANNED.test(rel);
+}
+
+async function main() {
+  await runHook("tier-guard", async () => {
+    const raw = await readStdin();
+    let p;
+    /** Fail-open, with the reason on the record (hooks/lib/decision.mjs). */
+    const defer = (reason, rule) => settle({
+      verdict: "allow", event: "PreToolUse", tool: p?.tool_name ?? null, cwd: p?.cwd, reason, rule,
+    });
+    try { p = JSON.parse(raw || "{}"); }
+    catch (e) { settle({ verdict: "error", event: "PreToolUse", reason: `unparseable payload: ${e.message}` }); }
+
+    if (!["Edit", "Write", "MultiEdit"].includes(p.tool_name)) {
+      defer(`${p.tool_name ?? "no tool_name"} is not a write tool — out of scope`, "not-write-tool");
+    }
+
+    // The shell's cwd is where the call fired; the tier lives at the project root. Same split the
+    // substrate fence has to make, and for the same reason: a worker that `cd`s into a sub-folder
+    // must not thereby leave the tier unguarded. Raw tool paths still resolve against the shell.
+    const cwd = p.cwd || process.cwd();
+    const root = projectRoot(cwd);
+
+    const writes = extractWrites(p.tool_input);
+    if (writes.length === 0) defer("no readable path+content pair in the tool input", "no-content");
+
+    const inTier = writes
+      .map((w) => ({ ...w, rel: relative(root, resolve(cwd, w.path)) }))
+      .filter((w) => inCommittedTier(w.rel));
+    if (inTier.length === 0) defer(`${writes.length} write(s), none inside ${SHARED}/<slug>/ in a scanned form`, "not-committed-tier");
+
+    const blocked = [];
+    for (const w of inTier) {
+      // THE TOKEN IS QUOTED BACK, which the lint's own message does not do and does not need to —
+      // it reports against a file on disk the reader can open at that line. Here the line does not
+      // exist yet, so "line 1 points into the local tier" leaves the writer hunting through a
+      // fragment it is holding in its head. Naming the exact string is the difference between a
+      // denial that is acted on and one that is retried verbatim.
+      for (const leak of tierLeaks(w.content)) blocked.push(`${w.rel}:${leak.line} — \`${leak.token}\` ${leak.detail}`);
+    }
+
+    if (blocked.length === 0) {
+      defer(`${inTier.length} committed-tier write(s) carry no tier-direction leak — permitted`, "tier-clean");
+    }
+
+    return {
+      verdict: "deny", event: "PreToolUse", tool: p.tool_name, subject: inTier[0].rel, cwd: root,
+      rule: "tier-direction",
+      reason: `${blocked.length} tier-direction leak(s) refused at the write boundary: ${blocked.join("; ")}`,
+      payload: {
+        hookSpecificOutput: {
+          hookEventName: "PreToolUse",
+          permissionDecision: "deny",
+          permissionDecisionReason:
+            "Tier guard (TIER-DIRECTION) — this write would put a reference into the committed tier that " +
+            "cannot survive the trip to another machine:\n" +
+            `${blocked.join("\n")}\n` +
+            `Refused here rather than at GATE L1b, where spec-lint reds the same file after the phase is over. ` +
+            "Rephrase the line now: cite the committed artifact, the use case or the scope_id, or describe the " +
+            "tier without naming a path.",
+        },
+      },
+    };
+  });
+}
+
+if (isMain(import.meta.url)) {
+  main();
+}

package/kernel/compile.mjs

@@ -31,7 +31,7 @@ import { fileURLToPath } from "node:url";
 import { validate } from "./verify/envelope.mjs";
 import { readTrials } from "./verify/t0.mjs";
 import { runArgs } from "./lib/argv.mjs";
-import { readRunId } from "./lib/paths.mjs";
+import { readRunId, dispatchReceipts, legLedger } from "./lib/paths.mjs";
 // `specDir` is aliased: this module has a local `let specDir` holding the resolved, possibly
 // --spec-overridden directory, and the import is the convention-derived default.
 import {
@@ -41,6 +41,8 @@ import {
 import { readContract, readAllContracts, tasksForScope, SCOPE_CONTRACT } from "./lib/contract.mjs";
 import { writeActiveOrder } from "./probe/resume.mjs";
 import { greenVerdict } from "./probe/t0.mjs";
+import { attemptEvidence, readReceipts } from "./probe/attempts.mjs";
+import { readLegs } from "./probe/leg.mjs";
 import { latestRoundBuild } from "./verify/build.mjs";
 // The SAME matcher the sandbox hook enforces with. "Is this cited file inside this scope's
 // substrate" has to mean exactly what the guard means, or a bug is addressed to a scope that is
@@ -816,6 +818,40 @@ export async function cli(rawArgv) {
   const round = flag("round");
   const attempt = flag("attempt");
 
+  // AN ATTEMPT MAY NOT OPEN OVER AN UNANSWERED ONE — the write half of the attested-channel rule.
+  //
+  // `--attempt` is a flag: the CALLER picks the number, and nothing here used to check that the
+  // previous one had come back. Measured on a consumer run: attempt 2 was compiled and T0-verified
+  // while attempt 1 was still in flight, so the round graded the tree attempt 1 was still writing,
+  // counted the attempt, and stopped at GATE H with most of its budget and clock unspent. An order
+  // and a T0 verdict are both writable by the very scope being judged; only a dispatch receipt, a
+  // leg row or a WorkResult attests that work actually happened.
+  //
+  // FAILS OPEN, NEVER CLOSED, unless the bad state is positively proven. The proof required is the
+  // receipts ledger EXISTING while carrying no row for the previous attempt: a lane that does not
+  // attest dispatches at all (no ledger on disk) cannot be judged by this rule and is waved
+  // through, so `--tiny`, a prose round loop and a standalone build are untouched.
+  if (scope?.scope_id && round && attempt > 1) {
+    const receiptsPath = dispatchReceipts(cwd, slug);
+    if (existsSync(receiptsPath)) {
+      const prev = attemptEvidence(
+        cwd, slug, scope.scope_id, round, attempt - 1,
+        readReceipts(receiptsPath), readLegs(legLedger(cwd, slug)),
+      );
+      if (prev.state !== "spent") {
+        const why = prev.state === "unattested"
+          ? "no dispatch receipt was ever written for it"
+          : "it was dispatched but has neither a leg-completion row nor a WorkResult";
+        console.error(
+          `compile-order: refusing to open attempt ${attempt} for "${scope.scope_id}" in round ${round} — ` +
+          `attempt ${attempt - 1} (${prev.orderId}) is unanswered: ${why}. Grading a tree the previous ` +
+          `attempt may still be writing counts an attempt that never ran, and spends a budget on work ` +
+          `nobody did. Wait for it to return, or record its outcome, before opening the next one.`);
+        process.exit(3);
+      }
+    }
+  }
+
   // The fix round's inbound evidence. Derived here, from the ledgered verdict, for every lane —
   // the workflow, `--tiny`, the prose round loop and a standalone `/build` all compile through
   // this line, and none of them can pass a payload to a build order (see the banner above).
@@ -971,7 +1007,21 @@ export async function cli(rawArgv) {
   // than the flailing it detects. It advises; the orchestrator queues the GATE H proposal.
   if (scope?.scope_id) {
     const k = Number(scope.no_progress_k ?? payloadExtra.no_progress_k ?? 2);
-    const st = stagnation(allTrials.filter((t) => t.scope_id === scope.scope_id), k);
+    // SCOPED TO THIS RUN, for the same reason the attempt census is. `t0/trials.jsonl` is per-slug
+    // and append-only, so a streak survives the run that produced it. Measured on a consumer: two
+    // non-kept trials from earlier runs — one of them graded against an order no worker was ever
+    // dispatched for — read as a stagnation streak that every later run of that scope tripped on,
+    // seven hours after the tree they graded had been fixed. The breaker escalated on evidence that
+    // predated its own fix, and no attempt of the tripping run had been dispatched at all.
+    //
+    // A trial with no run key counts for no run; an unresolvable current run matches nothing. Both
+    // leave the breaker un-tripped, which is the fail-open direction this repo's guards take when
+    // the bad state cannot be positively proven.
+    const myRunId = readRunId(cwd, slug);
+    const st = stagnation(
+      allTrials.filter((t) => t.scope_id === scope.scope_id && myRunId != null && t.run_id === myRunId),
+      k,
+    );
     if (st.stagnant) {
       console.error(JSON.stringify({
         breaker: "stagnation", scope_id: scope.scope_id, streak: st.streak, no_progress_k: st.k,

package/kernel/gate.mjs

@@ -53,7 +53,7 @@
 import { readFileSync, writeFileSync, appendFileSync, existsSync, mkdirSync } from "node:fs";
 import { join, dirname } from "node:path";
 import { runArgs } from "./lib/argv.mjs";
-import { gateAnswerCandidates, gates as gatesPath, LOCAL } from "./lib/paths.mjs";
+import { gateAnswerCandidates, gates as gatesPath, LOCAL, resultsDir } from "./lib/paths.mjs";
 
 export const GATE_IDS = ["L0", "L1a", "L1a.5", "L1b", "L2", "L3", "QA", "H", "L4", "COACH-1"];
 
@@ -168,6 +168,71 @@ export function validate(set) {
  * Returns { gate, decision, source, note, status } where status ∈ ok | ask | abort.
  * Pure: the CLI turns `status` into the exit code, nothing here exits.
  */
+/** The three verdicts `scope-hammer` may return (shapeup-run.js's HAMMER schema). */
+export const HAMMER_VERDICTS = ["ship-now", "ship-after-fixes", "cannot-ship"];
+
+/**
+ * The census verdict on disk for one run, or null when no census has run.
+ *
+ * Derived from the hammer's own WorkResult rather than taken from a caller: the verdict is the
+ * product of a dispatch, and a gate that accepts it as an argument accepts whatever the caller
+ * believes. `null` is a real answer here — "scope-hammer has not run" — and is the state a run that
+ * returned `gate_h` from a circuit breaker is in, because the breaker returns long before the
+ * hammer is dispatched.
+ *
+ * @param {string} cwd - Project root.
+ * @param {string} slug - Feature slug.
+ * @returns {(string|null)} The verdict, or null when there is no readable census.
+ */
+export function censusVerdict(cwd, slug) {
+  if (!slug) return null;
+  try {
+    const p = join(resultsDir(cwd, slug), "hammer.json");
+    if (!existsSync(p)) return null;
+    const r = JSON.parse(readFileSync(p, "utf8"));
+    const v = r?.payload?.verdict ?? r?.verdict ?? null;
+    return HAMMER_VERDICTS.includes(v) ? v : null;
+  } catch { return null; }
+}
+
+/**
+ * Narrow a resolved gate answer to what the run's own evidence supports.
+ *
+ * THE RULE, and it is about answers rather than callers. An answer set chooses among the answers a
+ * gate ALLOWS; it can never supply the evidence that makes one allowed. `ship` at L4 asserts the
+ * census cleared the run, so `ship` is only on the menu when a census exists and did clear it.
+ *
+ * Measured on a consumer: a run whose dispatch receipts carried `orient` and `task-executor` and
+ * nothing else — `scope-hammer` never dispatched — recorded `H → accept-cut-list` and `L4 → ship`
+ * from the `ci` preset, while its own ledger read `status: escalated`, `final_verdict: ~`, every
+ * requirement at `no evidence`. `shapeup-run.js` does guard this, but only after the hammer
+ * dispatch, so a run that returns `gate_h` from a breaker reaches L4 by a route the guard does not
+ * cover. A check on one call site is not a property.
+ *
+ * Absence of a census disqualifies `ship` on its own: "no one looked" and "someone looked and it
+ * was fine" are different facts, and only the second warrants a ship.
+ *
+ * @param {object} r - A resolved gate result from {@link resolve}.
+ * @param {string} cwd - Project root.
+ * @param {(string|null)} slug - Feature slug, when the gate is being resolved inside a run.
+ * @returns {object} The result, or an `ask` carrying why `ship` was not available.
+ */
+export function narrowToEvidence(r, cwd, slug) {
+  if (r?.gate !== "L4" || r?.status !== "ok" || r?.decision !== "ship") return r;
+  const verdict = censusVerdict(cwd, slug);
+  if (verdict === "ship-now" || verdict === "ship-after-fixes") return r;
+  const why = verdict === "cannot-ship"
+    ? "scope-hammer's census returned CANNOT SHIP"
+    : "scope-hammer has not run, so no census exists";
+  return {
+    gate: r.gate, status: "ask", source: r.source, decision: "ask", note: r.note,
+    refused: "ship", census: verdict,
+    reason: `GATE L4 cannot be answered "ship": ${why}. An answer set chooses among the answers a ` +
+            `gate allows; it cannot supply the evidence that makes one allowed. Put the block to the ` +
+            `PO, or run the census first.`,
+  };
+}
+
 export function resolve(set, gate, source) {
   if (!GATE_IDS.includes(gate)) {
     return { gate, status: "error", reason: `unknown gate "${gate}" — known: ${GATE_IDS.join(", ")}` };
@@ -362,7 +427,7 @@ export function cli(rawArgv) {
   const gate = args.resolve ?? null;
   if (!gate) die("nothing to do — pass --init, --list, --verify, or --resolve <gate-id>");
 
-  const r = resolve(found.set, gate, found.source);
+  const r = narrowToEvidence(resolve(found.set, gate, found.source), cwd, args.slug ?? null);
   if (r.status === "error") die(r.reason);
   // A gate with no `--slug` (e.g. `--file` used ad hoc, outside any run) has nowhere to file a
   // per-run ledger row — the same reasoning `resolveRunId` uses for "no run is active": absence is

package/kernel/harness.mjs

@@ -32,7 +32,7 @@
 //   gate                                      An answer file with a source, not a vibe.
 //   probe    resume · t0 · stats · digest ·   Read-only queries over run state. `concurrency`
 //            concurrency · leg · eval ·        answers how many legs ran at once and what the
-//            owner · requirements
+//            owner · requirements · attempts
 //                                              fan-out bought, and refuses a figure the record set
 //                                              cannot support rather than printing a plausible one.
 //                                              `leg` answers whether a scope's work reached the
@@ -50,6 +50,12 @@
 //                                              answers which pitch clause a verdict reached, joined
 //                                              through the plan's own covers: edge — the L4 line and
 //                                              GATE H's census cite it for the same reason.
+//                                              `attempts` answers how many of a scope's attempts are
+//                                              ATTESTED (a dispatch receipt AND a leg row or a
+//                                              WorkResult), never the order set or the T0 verdict
+//                                              set alone — the round loop's inner breaker and
+//                                              scope-hammer's census both cite it, so they cannot
+//                                              disagree about the same exhaustion again.
 //   init     run · fit · run-args              Opens a run, or refuses it (exit 3). `run-args`
 //                                              writes GATE L0.9b's launch record and echoes it.
 //   report   export                           Projects the run's records as fact tables.
@@ -86,7 +92,7 @@ export const ROUTES = {
     resume: "./probe/resume.mjs", t0: "./probe/t0.mjs", stats: "./probe/stats.mjs",
     digest: "./probe/digest.mjs", concurrency: "./probe/concurrency.mjs",
     leg: "./probe/leg.mjs", eval: "./probe/eval.mjs", owner: "./probe/owner.mjs",
-    requirements: "./probe/requirements.mjs",
+    requirements: "./probe/requirements.mjs", attempts: "./probe/attempts.mjs",
   },
   init: { run: "./init/run.mjs", fit: "./init/fit.mjs", "run-args": "./init/run-args.mjs" },
   report: { export: "./report/export.mjs", _default: "export" },