shapeup-sdlc 3.7.0 → 3.7.2

package/kernel/schemas/domain.schema.json

@@ -1215,7 +1215,7 @@
       }
     },
     "CommandResult": {
-      "description": "One executed command's outcome inside a T0 artifact — produced by actually running the command; no agent can fabricate it.",
+      "description": "One executed command's outcome inside a T0 artifact — produced by actually running the command; no agent can fabricate it. It carries the EVIDENCE, not only the score: `exit` maps a command that never started onto the same 1 a real failure returns, so without `error` a refused or timed-out command and a broken build are the same record everywhere downstream, and without the output a verdict asserting `exit 1` is an assertion nobody can check.",
       "x-tier": "EMBEDDED",
       "type": "object",
       "properties": {
@@ -1223,10 +1223,23 @@
           "type": "string"
         },
         "exit": {
-          "type": "integer"
+          "type": "integer",
+          "description": "The process exit code, or 1 when the command never produced one. Not a discriminator on its own — read `error` to tell a crash from a failure."
         },
         "pass": {
           "type": "boolean"
+        },
+        "error": {
+          "type": "string",
+          "description": "Present ONLY when the command did not run to completion — a spawn failure, a maxBuffer overflow, or the 10-minute timeout. Its presence is the fact the ratchet grades as `crash` (tree restored, never counted as a reverted attempt); its absence means the command ran and the exit code is its own."
+        },
+        "stdout_tail": {
+          "type": "string",
+          "description": "The last 4000 characters of stdout, omitted when nothing was printed. Kept for passing commands too: a fixture that exits 0 having run zero tests is the false green this layer exists to catch. A truncated tail carries a leading `[truncated: kept the last N of M characters]` line, so a partial stream never reads as a complete one."
+        },
+        "stderr_tail": {
+          "type": "string",
+          "description": "The last 4000 characters of stderr, same bound and same truncation marker as `stdout_tail`."
         }
       }
     },
@@ -2833,9 +2846,10 @@
           "type": "string",
           "enum": [
             "pass",
-            "fail"
+            "fail",
+            "not-evaluated"
           ],
-          "description": "shipped | ok: the round or run's EVAL verdict, lowercased from spec-evaluator's PASS|FAIL."
+          "description": "shipped | ok: the round or run's EVAL verdict, lowercased from spec-evaluator's PASS|FAIL — or `not-evaluated` when a `shipped` return closed a `--no-eval` run, which reaches SHIP without ever dispatching the judge. Recorded plainly, never upgraded to `pass` (references/protocol.md)."
         },
         "rounds_used": {
           "type": "integer"

package/kernel/verify/spec.mjs

@@ -235,11 +235,56 @@ export function lintScopes(scopes, repoFiles) {
 }
 
 /** Text forms worth scanning; anything else in a committed tree is not a reference carrier. */
-const SCANNED = /\.(md|markdown|yml|yaml|json|txt)$/i;
+export const SCANNED = /\.(md|markdown|yml|yaml|json|txt)$/i;
 
 /** A machine-local board id. Strict on purpose: a committed tree has no reason to carry one at all. */
 const TASK_ID = /\bTASK-[A-Za-z0-9][\w.-]*/;
 
+/**
+ * The tier-direction violations one piece of text carries — the whole rule, on a string.
+ *
+ * EXPORTED BECAUSE IT HAS TWO ENFORCEMENT POINTS NOW, and they must not be allowed to drift.
+ * `lintCommittedTier` below walks files at GATE L1b; `hooks/tier-guard.mjs` refuses the same text
+ * at the moment a tool writes it, minutes earlier, while the writer still holds the context needed
+ * to rephrase. Four producers wrote committed files this rule reds and none of them learned from
+ * the lint, because by the time it speaks the dispatch that wrote the line is over. A second
+ * enforcement point is only worth having if it enforces the SAME predicate, so both call this.
+ *
+ * The detail strings are the message the writer reads, so they carry the remedy, not just the
+ * verdict: a board id resolves on the machine that wrote it and nowhere else, and a path into the
+ * gitignored tier dangles on every clone.
+ *
+ * @param {string} text - The file body, or the fragment a tool is about to write.
+ * @returns {Array<{kind:("board-id"|"local-path"), token:string, line:number, detail:string}>}
+ *   One entry per offending line and form, in file order; [] when clean.
+ */
+export function tierLeaks(text) {
+  // Built from the LOCAL constant, never a literal — the storage roots have exactly one home.
+  const esc = LOCAL.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  // `\S+` where the walk's own rule is `\S`: the same LINES match either way (a path with one
+  // non-space character after the slash has at least one), and the longer form yields the token to
+  // quote back at the writer. Trailing punctuation the prose wrapped it in is trimmed off the
+  // quote only — never off the test.
+  const localPath = new RegExp(`${esc}/\\S+`);
+  const leaks = [];
+  String(text ?? "").split(/\r?\n/).forEach((line, i) => {
+    const task = line.match(TASK_ID);
+    if (task) {
+      leaks.push({ kind: "board-id", token: task[0], line: i + 1, detail:
+        `names ${task[0]} — a committed file cannot carry a board id. Boards live in ${LOCAL}/ ` +
+        "(gitignored) and renumber on every regeneration, so this resolves on the machine that wrote it " +
+        "and nowhere else. Cite the use case or the scope_id, which are stable." });
+    }
+    const path = line.match(localPath);
+    if (path) {
+      leaks.push({ kind: "local-path", token: path[0].replace(/[`)\]},.;:'"]+$/, ""), line: i + 1, detail:
+        `points into ${LOCAL}/ — a committed file cannot reference the gitignored tier; the path ` +
+        "dangles on every other clone. Name the committed artifact, or describe the tier without a path." });
+    }
+  });
+  return leaks;
+}
+
 /**
  * Lint the WHOLE committed tree for references into the gitignored tier.
  *
@@ -265,28 +310,15 @@ const TASK_ID = /\bTASK-[A-Za-z0-9][\w.-]*/;
 export function lintCommittedTier({ cwd, slug }) {
   const root = sharedRoot(cwd, slug);
   if (!existsSync(root)) return [];
-  // Built from the LOCAL constant, never a literal — the storage roots have exactly one home.
-  const localPath = new RegExp(`${LOCAL.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}/\\S`);
   const findings = [];
   for (const rel of walkFiles(root)) {
     if (!SCANNED.test(rel)) continue;
-    let lines;
-    try { lines = readFileSync(join(root, rel), "utf8").split(/\r?\n/); } catch { continue; }
-    lines.forEach((line, i) => {
-      const at = `${relative(cwd, join(root, rel))}:${i + 1}`;
-      const task = line.match(TASK_ID);
-      if (task) {
-        findings.push({ rule: "TIER-DIRECTION", level: "red", detail:
-          `${at} names ${task[0]} — a committed file cannot carry a board id. Boards live in ${LOCAL}/ ` +
-          "(gitignored) and renumber on every regeneration, so this resolves on the machine that wrote it " +
-          "and nowhere else. Cite the use case or the scope_id, which are stable." });
-      }
-      if (localPath.test(line)) {
-        findings.push({ rule: "TIER-DIRECTION", level: "red", detail:
-          `${at} points into ${LOCAL}/ — a committed file cannot reference the gitignored tier; the path ` +
-          "dangles on every other clone. Name the committed artifact, or describe the tier without a path." });
-      }
-    });
+    let text;
+    try { text = readFileSync(join(root, rel), "utf8"); } catch { continue; }
+    for (const leak of tierLeaks(text)) {
+      findings.push({ rule: "TIER-DIRECTION", level: "red",
+        detail: `${relative(cwd, join(root, rel))}:${leak.line} ${leak.detail}` });
+    }
   }
   return findings;
 }

package/kernel/verify/t0.mjs

@@ -79,6 +79,69 @@ function runCommand(cmd, cwd) {
   return { cmd, exit: r.status ?? 1, pass: r.status === 0, stdout, stderr, ...(error ? { error } : {}) };
 }
 
+/**
+ * How much of each stream the persisted record keeps, per command.
+ *
+ * A bound rather than the whole stream, because one chatty fixture would otherwise make every
+ * reader of the run trace pay for it — and a bound at the END rather than the start, because that
+ * is where a stack trace, an assertion diff and a test summary all land.
+ */
+export const EVIDENCE_TAIL_CHARS = 4000;
+
+/**
+ * The last `limit` characters of a stream, marked when anything was dropped.
+ *
+ * THE MARKER IS NOT DECORATION. A truncated tail that does not say so is a partial stream that
+ * reads as a complete one, which is the same class of defect as the one this whole change fixes:
+ * a record that overstates what it actually holds.
+ *
+ * @param {(string|null|undefined)} text - The captured stream.
+ * @param {number} [limit] - Characters to keep.
+ * @returns {(string|null)} The kept tail, or null when the stream was empty (the field is then
+ *   omitted rather than stored as "", so "nothing was printed" stays visibly different from
+ *   "nothing was kept").
+ */
+export function boundedTail(text, limit = EVIDENCE_TAIL_CHARS) {
+  const s = String(text ?? "");
+  if (!s) return null;
+  if (s.length <= limit) return s;
+  return `[truncated: kept the last ${limit} of ${s.length} characters]\n${s.slice(-limit)}`;
+}
+
+/**
+ * One command's outcome as the verdict artifact stores it — the evidence, not just the score.
+ *
+ * WHAT THIS FIXES. The artifact used to keep `{cmd, exit, pass}`, and `runCommand` maps a command
+ * that never started onto `exit: 1` — the same number a genuine failure returns. So a refused or
+ * timed-out command and a broken build were the SAME RECORD everywhere downstream: the digest, the
+ * hill, the report, the evaluator's citation and anyone reading the trace back afterwards. The
+ * kernel computed the difference (`error`, which the ratchet grades as `crash`) and discarded it
+ * one line later.
+ *
+ * `exit` is deliberately left as it is. Mapping a crash to some other number would change what the
+ * ratchet compares and what every existing reader parses; the distinction travels in `error`, which
+ * is the field that actually means "this never ran", and which the crash branch already reads.
+ *
+ * Output is kept for PASSING commands too, and that direction is not an afterthought: a fixture
+ * that exits 0 having run zero tests is the false green this evidence layer exists to catch, and
+ * its stdout is the only place that shows.
+ *
+ * @param {({cmd:string, exit:number, pass:boolean, stdout?:string, stderr?:string, error?:string}|null)} r
+ *   A `runCommand` result, or null when no command was declared.
+ * @returns {(object|null)} The record to persist; null passes through unchanged.
+ */
+export function commandEvidence(r) {
+  if (!r) return null;
+  const stdout = boundedTail(r.stdout);
+  const stderr = boundedTail(r.stderr);
+  return {
+    cmd: r.cmd, exit: r.exit, pass: r.pass,
+    ...(r.error ? { error: r.error } : {}),
+    ...(stdout ? { stdout_tail: stdout } : {}),
+    ...(stderr ? { stderr_tail: stderr } : {}),
+  };
+}
+
 /**
  * Run every e2e fixture command for a scope.
  * @param {string[]} fixtures - Fixture command lines (null/empty → no commands).
@@ -513,8 +576,10 @@ export async function cli(rawArgv) {
   const { path, sha256: hash, trial } = writeArtifact(outDir, round, attempt, {
     ...(runId ? { run_id: runId } : {}),
     scope_id: contract.scope_id,
-    fixtures: fixtures.results.map(({ cmd, exit, pass }) => ({ cmd, exit, pass })),
-    db_probe: dbProbe && { cmd: dbProbe.cmd, exit: dbProbe.exit, pass: dbProbe.pass },
+    // The evidence, not just the score — see `commandEvidence` for what the three-field record
+    // could not tell apart, and why `exit` still reads the way it always did.
+    fixtures: fixtures.results.map((r) => commandEvidence(r)),
+    db_probe: commandEvidence(dbProbe),
     seesaw,
     ...verdict,
     score: s,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shapeup-sdlc",
-  "version": "3.7.0",
+  "version": "3.7.2",
   "description": "Shape Up for coding agents \u2014 with gates the agent can't talk its way past. Harness for Claude Code.",
   "bin": {
     "shapeup-sdlc": "bin/init.mjs"

package/skills/ba-pitch-analyzer/references/doc-schemas.md

@@ -281,6 +281,10 @@ Always use wikilinks (double brackets), never relative paths like `../domain-mod
   (`"extracted from .shapeup/<slug>/intake.md"`) reds for the same reason a task
   wikilink does: the path dangles on every other clone. Cite the committed pitch or
   shaping doc instead, or describe the run tier without a path.
+- **You will be stopped at the write, not at the gate.** The same rule is enforced as a
+  refusal on the Write/Edit itself, quoting the offending token back. There is nothing to
+  appeal: rephrase the line and write it again. Waiting for spec-lint to tell you at Board
+  Review costs the whole phase, which is what it used to cost every time.
 - `[[tasks/...]]` wikilinks are valid only inside LOCAL documents (task files, the board,
   EVAL reports), where they resolve against the LOCAL root (`.shapeup/<slug>/`);
   every wikilink in a SHARED doc stays `spec_folder`-relative.

package/skills/hill-chart/SKILL.md

@@ -48,12 +48,16 @@ node "${CLAUDE_PLUGIN_ROOT}/kernel/harness.mjs" reduce graph --slug <slug>
 ```
 
 **For a committed-only slug (`hasCommitted && !hasLocal`), NEVER call `reduce hill`.**
-`deriveHill()` folds whatever T0 verdicts currently exist on disk; a committed-only pitch has
-none (the local trace was cleaned up after shipping), so re-running it would silently regress a
-true historical `FINISHED` down to a fabricated `UPHILL_SOLVED` — reading absence of evidence as
-evidence of absence. Read `shapeup/<slug>/hill/*.yml` for those slugs exactly as committed, and
-render them with the archived state the template already implements (see below). Same reasoning
-applies to `reduce graph` — there is no local trace to append from.
+`deriveHill()` folds whatever T0 verdicts, evaluation results and ledger rows exist in the LOCAL
+run trace; a committed-only pitch has none, because that trace was cleaned up after shipping.
+
+The runtime no longer takes that silence for an answer: a derivation whose run trace is absent
+declines to write anything and reports every scope as underived (`derived: false`), so the
+committed shards survive a call made in error. Treat that as a backstop, not a licence — an
+underived report is not a refresh, and rendering it as one would show a pitch's true `FINISHED`
+as freshly confirmed when nothing confirmed it. Read `shapeup/<slug>/hill/*.yml` for those slugs
+exactly as committed, and render them with the archived state the template already implements
+(see below). Same reasoning applies to `reduce graph` — there is no local trace to append from.
 
 ## Reading the hill shards
 

package/skills/tech-lead/references/gates.md

@@ -389,7 +389,7 @@ feature) and the failing step is compiled into round r+1's orders as `payload.bu
 means L0 pinned no run command and the profile names no probe — the round proceeds over an
 unproven build, and the block says so.
 
-Under `--interactive` / `--auto`, the hook warns if the board is not truly green (advisory) and requires explicit PO approval to proceed. Under `--unattended`, it automatically aborts on a red board or proceeds on a green one.
+Under `--interactive` / `--auto`, the gate block carries the board facts — `green_scopes`, `hammer_proposals` — and requires explicit PO approval to proceed. Under `--unattended` the answer set resolves it. **There is no hook behind this gate**: the `PreToolUse` warning it used to carry was retired into the block in v2.0, so what an unfinished board costs you here is a human reading the numbers, not a machine refusing the call.
 
 ---
 

package/skills/tech-lead/references/tiny-lane.md

@@ -26,7 +26,8 @@ scales down, its *verification floor* does not.
   ingest-result dispatch. Tiny never means "just edit the file inline".
 - **T0 verification.** A tiny change still proves itself by running — never by claim. If there
   is no runnable check at all, that is a fit-check failure, not a reason to skip T0.
-- **The safety-spine and sandbox hooks.** Machine guards do not scale down.
+- **The machine guards — safety spine, substrate sandbox, tier guard.** They do not scale down,
+  and a tiny lane is where a committed file is most likely to be written by hand.
 - **The discovery ledger.** `lane: tiny` is recorded, so a later reader knows exactly what was
   NOT checked (no EVAL verdict, no QA charter, no wiring assertion).
 

package/skills/tech-lead/workflows/shapeup-run.js

@@ -1596,7 +1596,11 @@ while (verdict !== "pass" && round <= maxRounds) {
         `feature; this one does not build or launch. Round ${round + 1} fixes the gate's failing step.`);
   } else if (args.noEval) {
     log("EVAL — skipped (--no-eval)");
-    verdict = "pass";
+    // references/protocol.md's own words for this, twice: a run --no-eval ships records
+    // `not-evaluated` — "recorded plainly — never silently upgraded [to `pass`]". Nothing verified
+    // the feature beyond task-executor's own per-AC evidence checks, and the report this run
+    // freezes at GATE L4 has to say that as plainly as the gate block already does.
+    verdict = "not-evaluated";
   } else {
     const e = await worker({
       skill: "spec-evaluator", operation: "evaluate", schema: EVAL, phase: "Eval", label: `eval:r${round}`,
@@ -1647,14 +1651,16 @@ while (verdict !== "pass" && round <= maxRounds) {
   const g3 = await crossGate("L3", "Eval", ["loop", "stop", "ask"], { round, verdict, build_gate: buildGate });
   if (g3.stop) return await withWarnings(g3.stop);
 
-  if (verdict === "pass") break;                                  // → QA → GATE H → ship
+  // "not-evaluated" (--no-eval) ships exactly like "pass" — protocol.md: the run "goes straight to
+  // SHIP" once EVAL is skipped, never spends another round waiting on a verdict nobody is producing.
+  if (verdict === "pass" || verdict === "not-evaluated") break;   // → QA → GATE H → ship
   if (g3.decision === "stop" || round >= maxRounds) {
     return await withWarnings({ status: "gate_h", breaker: "outer", hammer_proposals: allHammer, green_scopes: allGreen });
   }
   round += 1;
 }
 
-if (verdict !== "pass") {
+if (verdict !== "pass" && verdict !== "not-evaluated") {
   return await withWarnings({ status: "gate_h", breaker: "outer", hammer_proposals: allHammer, green_scopes: allGreen });
 }
 
@@ -1692,7 +1698,12 @@ if (h.verdict === "cannot-ship") {
   if (g.stop) return await withWarnings(g.stop);
 }
 
-const ship = await cmd(`reduce ship --slug ${slug} --verdict PASS --qa ${qaRan ? "run" : "skipped"}`, "Ship", "ship-report");
+// The frozen report's own verdict line has to say what actually happened — a `--no-eval` run
+// verified nothing beyond task-executor's per-AC checks, and `reduce ship` already accepts
+// "not-evaluated" as a real verdict (its own usage string, and `generate()`'s no-artifact
+// default). Hardcoding PASS here is exactly the silent upgrade protocol.md's Rules forbid.
+const shipVerdict = verdict === "not-evaluated" ? "not-evaluated" : "PASS";
+const ship = await cmd(`reduce ship --slug ${slug} --verdict ${shipVerdict} --qa ${qaRan ? "run" : "skipped"}`, "Ship", "ship-report");
 await advisory(`report export --slug ${slug}`, "Ship", "export-run");
 // The run's own concurrency, printed once where the records are complete and before the next run
 // supersedes the trace. It is a projection over `receipts/dispatch.jsonl` and `legs.jsonl`, so it
@@ -1707,7 +1718,10 @@ const ALL_DIMS = ["spec-conformance", "tdd-surface", "integration", "completenes
 
 return await withWarnings({
   status: "shipped",
-  verdict: "pass",
+  // The real verdict this run reached — "pass" or, over a --no-eval run, "not-evaluated". GATE L4's
+  // own sign-off block reads this field verbatim (SKILL.md Step 4); hardcoding "pass" here told a
+  // human answering that gate the run was graded when it never was.
+  verdict,
   rounds_used: round,
   dims_not_evaluated: ALL_DIMS.filter((d) => !evalDims.includes(d)),
   qa_findings: qaFindings,