shapeup-sdlc 3.7.1 → 3.7.2

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "shapeup-sdlc-plugin",
   "displayName": "ShapeUp SDLC Plugin",
-  "version": "3.7.1",
+  "version": "3.7.2",
   "description": "Shape Up SDLC harness for Claude Code: shaping, intake, orient, scope-mapping, building (T0-verified, sandboxed, scope-contracted), evaluation and QA skills orchestrated by a tech-lead.",
   "author": {
     "name": "Liberty Nguyen",

package/README.md

@@ -41,9 +41,14 @@ runs over unfinished tasks rather than denying it. The board is local to the mac
 harness — see [ADR-0001](docs/design/adr/0001-consumer-file-organization.md).)
 
 **2. Progress is measured, not claimed.** A scope counts as built only when `t0-verify` runs
-its fixtures, a DB probe, and the seesaw, and writes an artifact to disk. The evaluator must
-cite that artifact and re-hashes it itself; hill phase is derived from those facts, so no
-worker can self-report confidence.
+its fixtures and its DB probe and writes an artifact to disk — with each command's exit code,
+its captured output, and whether it ran at all. The evaluator must cite that artifact, and the
+hill phase is derived from artifacts rather than from a worker's own account of its progress.
+Two limits, stated here because the point of this section is that a claim without a mechanism
+behind it is the thing this harness exists to prevent: the **seesaw** regression arm is declared
+and not yet wired (no run writes its registry — wiring it is an open Betting Table decision), and
+nothing in the runtime **re-hashes** the citation the evaluator is instructed to re-hash. Both
+are open items in `shapeup/knowledge-base/harness-defects.md`, not shipped guarantees.
 → *Prevents: "done" asserted with nothing behind it.*
 
 **3. Parallel work can't corrupt shared state.** Each scope gets a write-whitelist of files
@@ -300,7 +305,9 @@ These hold across the harness and are the reason it stays predictable:
   count events and neither can notice a single round running for half an hour — tripping it routes
   to GATE H, so a run out of time ships what is green instead of being killed and shipping nothing.
 - **Hill phase is mechanical, never self-reported** — derived only from T0/T1/seesaw facts, closing
-  the self-reported-confidence risk outright.
+  the self-reported-confidence risk — with one gap on record: a scope with no discovery
+  ledger derives the same phase as one whose unknowns are all closed, so absence still reads
+  as progress on that one arm.
 - **One writer per shared file** — every board/ledger/verdict write goes through
   `harness reduce ingest`; workers return data and never touch shared state.
 - **Traceability is oracle-checked, opt-in** — `harness verify trace` verifies covers-closure and

package/kernel/compile.mjs

@@ -218,6 +218,32 @@ export function substrateFor(operation, { slug, specDir, scope } = {}) {
   // in its `allowed` globs, so only a `frozen` entry denies the write. `translate` is the one
   // operation that legitimately rewrites a pitch, and it writes the COMMITTED copy, not this one.
   const FROZEN_INTAKE = [`${local}/intake.md`, `${local}/breadboard.md`];
+  // THE LEG'S OWN ATTESTATION. A dispatch receipt, a leg-completion row and a T0 verdict exist to
+  // answer "did a worker actually run, and what did it measure" from evidence the leg being judged
+  // does not control — the whole reason to prefer them over a compiled order, which is writable by
+  // that same hand. None of the three is ever produced by this assistant's own edit tool in normal
+  // operation: a receipt is stamped by the dispatch hook reacting to the call itself, a
+  // leg-completion row by the step that reads a landed result, and a verdict by the command that
+  // runs the fixtures. A build leg reaching for `Edit`/`Write` on any of them is not doing its job
+  // by another route — it is handing itself the grade — so freezing them costs a well-behaved leg
+  // nothing and removes the one channel through which it could attest work it did not do. The
+  // carve-out below still covers everything else under this root — the doer's own task board and
+  // discovery ledger — because neither lives under any of these three.
+  //
+  // THE RESULT ENVELOPE IS DELIBERATELY NOT ON THIS LIST, and the reasoning is worth keeping because
+  // it looks like it belongs. It is the leg's own claim about its own work, so on the argument above
+  // it is the first thing you would freeze. But a result is not evidence ABOUT the leg, it is the
+  // leg's PRODUCT — the other half of the envelope port, and the thing that answers the order. The
+  // order is unanswered at that moment by construction, so freezing the path would deny every build
+  // leg its documented last step, every time, on the first round: measured end to end against a
+  // compiled order, with the denial telling the worker to widen a substrate that cannot lift a
+  // frozen entry. Nothing else writes an ordinary result either, so there is no fallback. The census
+  // that reads it is already built for this: a result alone attests nothing, and can only turn an
+  // ALREADY-receipted attempt into a spent one, which spends the forger's own budget. What that does
+  // not cover is a leg forging a SIBLING's result, which is a real hole with a different fix — the
+  // glob form here cannot say "every result except this order's own", so closing it needs a
+  // mechanism rather than one more entry on this list.
+  const FROZEN_ATTESTATION = [`${local}/receipts/**`, `${local}/legs.jsonl`, `${local}/t0/verdicts/**`];
   switch (operation) {
     case "execute": case "fix": case "spike":
       // Build legs are the widest window on FROZEN_INTAKE, not an exemption from it: they are the
@@ -228,7 +254,7 @@ export function substrateFor(operation, { slug, specDir, scope } = {}) {
       return {
         allowed: [...(scope?.allowed_file_substrate || []), `${local}/spikes/**`],
         shared: scope?.shared_substrate || [],
-        frozen: [...FROZEN_INTAKE],
+        frozen: [...FROZEN_INTAKE, ...FROZEN_ATTESTATION],
       };
     case "analyze":
       return { allowed: [`${spec}/**`, `${local}/**`], frozen: [...FROZEN_INTAKE] };

package/kernel/gate.mjs

@@ -110,7 +110,7 @@ export const PRESETS = {
       "L1a": { decision: "proceed", note: "Orient review — advisory read." },
       "L1a.5": { decision: "proceed", note: "Wiring review — checked by trace-lint." },
       "L1b": { decision: "ask", note: "Board review is where scope is actually decided. Not pre-approvable." },
-      "L2": { decision: "proceed", note: "Board-green is verified by hook, not by opinion." },
+      "L2": { decision: "proceed", note: "The board facts travel in the gate block itself — green_scopes and hammer_proposals — so a preset answering here is not answering blind. Note there is no board check behind this: the L2 hook was retired into the gate block in v2.0." },
       "L3": { decision: "loop", max_rounds: 3, note: "Loop on FAIL; the breaker ends it." },
       "QA": { decision: "run" },
       "H": { decision: "ask", note: "The cut list changes what ships." },

package/kernel/probe/eval.mjs

@@ -33,6 +33,7 @@
 
 import { existsSync, readFileSync, readdirSync } from "node:fs";
 import { join, resolve } from "node:path";
+import { createHash } from "node:crypto";
 import { runArgs } from "../lib/argv.mjs";
 import { resultsDir, scopesDir } from "../lib/paths.mjs";
 
@@ -59,6 +60,58 @@ export function isScoped(cwd, slug) {
   catch { return false; }
 }
 
+/**
+ * Why one T0 citation does not resolve, or null when the kernel can positively confirm it does.
+ *
+ * Re-checks the two facts a citation can lie about and the schema promises are enforced
+ * (`T0Citation`: "the evaluator RECOMPUTES sha256 from disk — a handed hash is never trusted"):
+ * that the bytes at `path` hash to the cited `sha256`, and that what those bytes actually say is a
+ * green T0 verdict — a PASS/FAIL cannot ride on an artifact that itself recorded red. NOT checked:
+ * whether `path` is one of the order's own `payload.t0_artifacts` (see the note on
+ * {@link citationProblem} for why that is left to the operator rather than enforced here).
+ *
+ * FAILS OPEN ON "CANNOT TELL", CLOSED ON "PROVEN WRONG" — and the two are not the same fact. A read
+ * that fails for a reason that says something DEFINITE about what is (or isn't) at `path` is proof,
+ * same as a hash mismatch: `ENOENT` (nothing there) and `EISDIR` (a directory, never a file — T0
+ * verdicts are always files, per `writeArtifact`) both mean no such artifact was ever produced, so
+ * both refuse. `verify t0` writes verdict artifacts immutably and never deletes one
+ * (`writeArtifact`'s `wx` flag — see kernel/verify/t0.mjs), so that absence or shape mismatch is a
+ * positive fact about the citation, not a guess. Anything else a read can fail with — permission
+ * denied, a symlink loop, a transient I/O error — says nothing about the citation's honesty, only
+ * that THIS MACHINE could not check it just now, so it is not refused on that ground alone: the
+ * fail-open discipline this repo's guards already use elsewhere for an unproven bad state.
+ *
+ * @param {string} cwd - Project root.
+ * @param {object} citation - One `T0Citation` (`scope_id`, `path`, `sha256`). Read defensively:
+ *   `reduce ingest` only reaches this after the enclosing WorkResult passed schema validation, but
+ *   `probe eval` reaches it over a result file it merely `JSON.parse`s, so a malformed citation must
+ *   fail this check rather than throw.
+ * @returns {(string|null)} A reason phrased for an operator, or null when the file at `path` exists,
+ *   hashes to the cited `sha256`, and its own `overall` reads "green".
+ */
+function unresolvedCitation(cwd, citation) {
+  const rel = typeof citation?.path === "string" ? citation.path : "";
+  if (!rel) return "names no artifact path";
+  let text;
+  try {
+    text = readFileSync(resolve(cwd, rel), "utf8");
+  } catch (e) {
+    if (e.code === "ENOENT") return `cites ${rel}, which does not exist on disk`;
+    if (e.code === "EISDIR") return `cites ${rel}, which is a directory, not a T0 verdict file`;
+    // EACCES, ELOOP, EIO, EMFILE… — this machine failing to look, not evidence against the
+    // citation, so it is not refused on that ground.
+    return null;
+  }
+  const actual = createHash("sha256").update(text).digest("hex");
+  const claimed = typeof citation.sha256 === "string" ? citation.sha256.toLowerCase() : "";
+  if (actual !== claimed) return `cites ${rel} with sha256 ${citation.sha256}, but the file on disk hashes to ${actual}`;
+  let body;
+  try { body = JSON.parse(text); }
+  catch { return `cites ${rel}, whose bytes match the hash but do not read as a T0 verdict`; }
+  if (body?.overall !== "green") return `cites ${rel}, whose own verdict is "${body?.overall ?? "unknown"}", not green`;
+  return null;
+}
+
 /**
  * Why a verdict cannot stand as its round's judgement on T0 grounds, or null when it can.
  *
@@ -68,21 +121,40 @@ export function isScoped(cwd, slug) {
  * and branched on like any other. It is checked here so the round loop, the resume derivation, the
  * hill and ingest all refuse the same verdict for the same reason.
  *
- * PRESENCE, NOT HASHES. The evaluator re-hashes what it cites; a slip transcribing a digest is not
- * evidence the verdict is wrong, and refusing a round over one would cost a whole re-evaluation.
+ * RESOLVES, NOT JUST PRESENT. A citation naming a path and a hash used to be taken on faith: any
+ * non-empty `t0_citations[]` passed, whatever it pointed at. Measured live: a PASS citing a path
+ * that does not exist on disk, and a PASS citing a real artifact whose own verdict was red, both
+ * ingested clean — presence stood in for a re-hash the schema had already promised. Each citation is
+ * now re-checked through {@link unresolvedCitation}.
+ *
+ * WHAT THIS DOES NOT CHECK: whether a citation is drawn from the order's own `payload.t0_artifacts`
+ * list. That would need the compiled order, which this function's callers do not equally have —
+ * `reduce ingest` holds it, but `probe eval` (and the round-loop/resume/hill readers behind it)
+ * knows only (cwd, slug, round), and a scope's T0 attempt can legitimately go green again LATER than
+ * whatever list was frozen at compile time (`greenVerdict` already treats "newest green" as
+ * authoritative for exactly this reason — see kernel/probe/t0.mjs). Enforcing membership only where
+ * the order happens to be on hand would let one channel refuse a citation the other accepts, for
+ * evidence that may simply be fresher than the order — worse than leaving it unenforced.
  *
  * @param {string} cwd - Project root.
  * @param {string} slug - Feature slug.
  * @param {object} verdict - The WorkResult's `verdict` block.
- * @returns {(string|null)} The problem, phrased for an operator; null for a cited verdict, an
- *   unscoped spec, or a block with no PASS/FAIL in it (there is no judgement to invalidate).
+ * @returns {(string|null)} The problem, phrased for an operator; null for a verdict whose every
+ *   citation resolves, an unscoped spec, or a block with no PASS/FAIL in it (there is no judgement
+ *   to invalidate).
  */
 export function citationProblem(cwd, slug, verdict) {
   if (verdict?.overall !== "PASS" && verdict?.overall !== "FAIL") return null;
-  if (Array.isArray(verdict.t0_citations) && verdict.t0_citations.length) return null;
   if (!isScoped(cwd, slug)) return null;
-  return `the ${verdict.overall} verdict cites no T0 artifact, and a verdict on a scoped spec must ` +
-    "cite the T0 verdict it re-hashed (the order lists them under payload.t0_artifacts)";
+  if (!Array.isArray(verdict.t0_citations) || !verdict.t0_citations.length) {
+    return `the ${verdict.overall} verdict cites no T0 artifact, and a verdict on a scoped spec must ` +
+      "cite the T0 verdict it re-hashed (the order lists them under payload.t0_artifacts)";
+  }
+  for (const citation of verdict.t0_citations) {
+    const reason = unresolvedCitation(cwd, citation);
+    if (reason) return `the ${verdict.overall} verdict ${reason} — a T0 citation is re-hashed from disk, never taken on the handed word`;
+  }
+  return null;
 }
 
 /**

package/kernel/reduce/hill.mjs

@@ -6,24 +6,158 @@
 import { readFileSync, writeFileSync, existsSync, readdirSync, mkdirSync } from "node:fs";
 import { resolve, join } from "node:path";
 import { runArgs } from "../lib/argv.mjs";
-import { scopesDir, hillDir, verdictsDir, resultsDir, discoveryLedger } from "../lib/paths.mjs";
+import { scopesDir, hillDir, verdictsDir, resultsDir, discoveryLedger, localRoot } from "../lib/paths.mjs";
 import { readAllContracts, SCOPE_CONTRACT } from "../lib/contract.mjs";
 import { evalVerdict } from "../probe/eval.mjs";
 import { redBuildRounds } from "../verify/build.mjs";
 
+// ---------------------------------------------------------------------------------------------
+// THE DISCOVERY LEDGER, AND WHY ITS ABSENCE IS NOT A ZERO.
+//
+// The ledger arm is the only thing that promotes a scope from UPHILL_UNKNOWN to UPHILL_SOLVED —
+// "the open questions are closed". It used to be read as `scopeUnknowns[id] || 0`, which made
+// "nobody has filed a ledger yet" and "every unknown is closed" the same value, and that value
+// selects the FLATTERING phase. An absent value and a real one must not share a signature; when
+// they do, the run reports progress it has no evidence for. So the count is `null` — not `0` —
+// whenever the ledger could not actually be read and understood, and `null` promotes nothing.
+//
+// THE HEADING IS THE ATTRIBUTION KEY, and it has to match what the ingest step really writes:
+// `## Discovered — <order_id> (<date>)`, where `order_id` is `<slug>/<suffix>`. Two ways that
+// parse used to fail silently, both ending in the same false zero:
+//   * It required a COLON between the slug and the suffix. The order-envelope schema pins
+//     `order_id` to a slug, a SLASH, and a suffix drawn from `[a-z0-9.-]` — a colon cannot appear
+//     in a schema-valid order id at all, so the scope was never captured from any real ledger and
+//     every scope on every project read zero unknowns regardless of what was open.
+//   * It matched the em dash only, so a heading typed with a plain hyphen contributed nothing.
+// Both are fixed by matching the dash as a class and splitting the order id on its "/", and by
+// resolving the scope against the CONTRACTS ON DISK rather than guessing at the suffix's shape: a
+// build suffix is `<scope>-r<N>-a<M>` and a scoped operation's is `<operation>-<scope>[-r<N>]`, so
+// a pattern that tried to carve the scope out positionally captured the round suffix along with it.
+// ---------------------------------------------------------------------------------------------
+
+/** A ledger block heading, naming the order it files: `## Discovered — <slug>/<suffix> (<date>)`. */
+const LEDGER_HEADING = /^##\s+Discovered\s+[—–-]\s+(\S+)/;
+
+/**
+ * Index the scopes by the filename-safe form `harness compile` puts in an order suffix, so a
+ * heading is matched against ids that actually exist rather than parsed speculatively.
+ *
+ * @param {Array<object>} scopes - Parsed scope contracts.
+ * @returns {Map<string,string>} Compile's suffix form → the contract's own `scope_id`.
+ */
+function scopeSuffixIndex(scopes) {
+  const ix = new Map();
+  for (const s of scopes) {
+    const id = String(s?.scope_id || "");
+    if (!id) continue;
+    // Mirrors `harness compile`'s own normalisation of a scope id into an order suffix.
+    const key = id.toLowerCase().replace(/[^a-z0-9.-]/g, "-").replace(/^[^a-z0-9]+/, "");
+    if (key) ix.set(key, id);
+  }
+  return ix;
+}
+
+/**
+ * The scope a ledger heading's order belongs to, or `null` when it belongs to none.
+ *
+ * Operation-level dispatches (orient, analyze, wire, evaluate, hunt, hammer) carry no scope in
+ * their order id by construction, so "no scope" is a real and common answer here, not a parse
+ * failure — their rows are feature-wide and are deliberately credited to nobody.
+ *
+ * @param {string} orderId - The order id as the heading names it (`<slug>/<suffix>`).
+ * @param {Map<string,string>} ix - The index from `scopeSuffixIndex`.
+ * @returns {string|null} The owning contract's `scope_id`, or null.
+ */
+function scopeOfHeading(orderId, ix) {
+  const slash = orderId.indexOf("/");
+  const suffix = slash === -1 ? orderId : orderId.slice(slash + 1);
+  const core = suffix.replace(/-r\d+(?:-a\d+)?$/, "");
+  // Longest match wins, so a project holding both `pages` and `pages-admin` attributes each
+  // heading to the scope it actually names rather than to whichever was indexed first.
+  let best = null;
+  let bestLen = -1;
+  for (const [key, id] of ix) {
+    if ((core === key || core.endsWith(`-${key}`)) && key.length > bestLen) { best = id; bestLen = key.length; }
+  }
+  return best;
+}
+
+/**
+ * Open unknowns (`~` rows) per scope, read from the discovery ledger.
+ *
+ * @param {string} ledgerPath - Path to the run's discovery ledger.
+ * @param {Array<object>} scopes - Parsed scope contracts, used to attribute each block.
+ * @returns {Object<string,number>|null} Counts per `scope_id` — a scope with a block and no open
+ *   row is a genuine `0`. `null` means the ledger was NOT read: it is absent, unreadable, or
+ *   nothing in it could be attributed to a scope. `null` is never treated as zero, because "we
+ *   understood none of this file" is not evidence that nothing is open.
+ */
+function ledgerUnknowns(ledgerPath, scopes) {
+  if (!existsSync(ledgerPath)) return null;
+  let text;
+  try { text = readFileSync(ledgerPath, "utf8"); } catch { return null; }
+
+  const ix = scopeSuffixIndex(scopes);
+  const counts = {};
+  let headings = 0;
+  let attributed = 0;
+  let current = null;
+
+  for (const line of text.split("\n")) {
+    if (line.startsWith("## ")) {
+      // Reset on EVERY heading, matched or not. Carrying the previous block's scope across an
+      // unrecognised heading would credit one scope's open rows to another.
+      current = null;
+      const m = line.match(LEDGER_HEADING);
+      if (!m) continue;
+      headings++;
+      const id = scopeOfHeading(m[1], ix);
+      if (id) { attributed++; current = id; counts[id] = counts[id] || 0; }
+      continue;
+    }
+    if (current && line.startsWith("~ ")) counts[current]++;
+  }
+
+  // A ledger whose blocks we could not attribute to a single scope tells us nothing per scope.
+  // Reporting that as all-zero is the same false signature the colon-vs-slash bug produced.
+  if (headings === 0 || attributed === 0) return null;
+  return counts;
+}
+
+/**
+ * The phase currently recorded in a committed hill shard.
+ *
+ * @param {string} hDir - The committed hill directory.
+ * @param {string} id - Scope id.
+ * @returns {string|null} The recorded phase, or null when no shard exists for that scope.
+ */
+function committedPhase(hDir, id) {
+  const p = join(hDir, `${id}.yml`);
+  if (!existsSync(p)) return null;
+  try { return readFileSync(p, "utf8").match(/^phase:\s*(\S+)/m)?.[1] ?? null; } catch { return null; }
+}
+
 /**
  * Derive and write the hill phase for all scopes mechanically based on T0, T1, and ledger facts.
  * 
  * The derived phase follows these progression rules (facts move dots, not authors):
- * - UPHILL_UNKNOWN: open unknowns > 0 in the ledger for this scope
- * - UPHILL_SOLVED: unknowns 0, no T0-green yet
+ * - UPHILL_UNKNOWN: open unknowns > 0 in the ledger for this scope — and the floor the scope sits
+ *   at whenever the ledger has not answered at all, which is where every run legitimately begins
+ * - UPHILL_SOLVED: the ledger was read and reports zero open unknowns, no T0-green yet
  * - DOWNHILL_EXECUTION: ≥1 T0-green in a round whose build gate is not red; T1/seesaw pending
  * - FINISHED: T1 PASS ∧ seesaw green
  *
  * @param {string} cwd - The project root directory.
  * @param {string} slug - The feature slug being built.
- * @returns {Array<{scope_id: string, phase: string, changed: boolean}>} A report of all scopes processed, their derived phase, and whether the hill shard on disk was modified.
- *   Side effects: writes to `shapeup/<slug>/hill/<scope-id>.yml` for each scope.
+ * @returns {Array<{scope_id: string, phase: (string|null), changed: boolean, derived: boolean,
+ *   unknowns: (number|null), reason?: string}>} A report of all scopes processed. `derived` says
+ *   whether the phase was computed from run evidence at all: when it is false the phase is
+ *   whatever the committed shard already records (or null when there is none), nothing was
+ *   written, and `reason` names why. `unknowns` is the ledger count behind the phase, or null
+ *   when the ledger could not be read — the two are deliberately distinguishable in the output as
+ *   well as in the derivation.
+ *   Side effects: writes to `shapeup/<slug>/hill/<scope-id>.yml` for each scope, EXCEPT on the
+ *   refusal path below, which writes nothing at all.
  */
 export function deriveHill(cwd, slug) {
   const scopes = readAllContracts(scopesDir(cwd, slug), SCOPE_CONTRACT).map((x) => x.contract);
@@ -31,6 +165,44 @@ export function deriveHill(cwd, slug) {
   const ledgerPath = discoveryLedger(cwd, slug);
   const hDir = hillDir(cwd, slug);
 
+  // -------------------------------------------------------------------------------------------
+  // A DERIVATION THAT CANNOT SEE THE RUN TRACE MUST NOT WRITE THE DELIVERABLE.
+  //
+  // This function reads one tier and writes the other. Every input below — T0 verdicts, the EVAL
+  // results, the round build gates, the discovery ledger — lives in the gitignored run trace,
+  // while the shards it writes are committed and outlive it: after a ship the run trace is cleaned
+  // up and the shards are the ONLY surviving record of where the work got to. So when the run
+  // trace for this slug is not on disk, every input is provably absent, and anything derived from
+  // that is derived from nothing.
+  //
+  // This is not a hypothetical. Pulling a branch mid-run is a supported state: the puller gets the
+  // committed spec, scopes and shards and no run trace of their own. Their first launch used to
+  // re-derive every scope from the empty set and overwrite the shards with the result — losing
+  // committed history rather than misreporting it.
+  //
+  // WHY REFUSE RATHER THAN WRITE AN "UNKNOWN" PHASE. Writing anything here destroys the record
+  // just as thoroughly; a shard that says "I could not look" has still replaced the one that said
+  // FINISHED, and the phase enum is a committed data format that a reader parses as current
+  // status. Not writing already expresses "no opinion" exactly, and it needs no new enum value.
+  //
+  // WHY THE CONDITION IS THE TIER'S EXISTENCE AND NOT "the phase would go down". Moving a dot
+  // backwards is correct and must stay possible — this is a pure function of the artifacts present
+  // and reports what they currently support, in both directions. A guard phrased as "never lower a
+  // phase" would quietly turn a derived value into a high-water mark, which is a different defect
+  // wearing this one's clothes. The condition is the narrowest one that is positively provable:
+  // the tier holding every input is not there.
+  // -------------------------------------------------------------------------------------------
+  if (!existsSync(localRoot(cwd, slug))) {
+    return scopes.map((s) => ({
+      scope_id: s.scope_id,
+      phase: committedPhase(hDir, s.scope_id),
+      changed: false,
+      derived: false,
+      unknowns: null,
+      reason: "local-run-trace-absent",
+    }));
+  }
+
   if (!existsSync(hDir)) mkdirSync(hDir, { recursive: true });
 
   // 1. Check if T1 Evaluation passed — the LATEST evaluate round's verdict, read the same way
@@ -95,28 +267,20 @@ export function deriveHill(cwd, slug) {
     }
   }
   
-  // 3. Ledger unknowns per scope
-  const scopeUnknowns = {};
-  if (existsSync(ledgerPath)) {
-    const lines = readFileSync(ledgerPath, "utf8").split("\n");
-    let currentScope = null;
-    for (const line of lines) {
-      const m = line.match(/^## Discovered — .*?:([\w.-]+)-a\d+/);
-      if (m) {
-        currentScope = m[1];
-      }
-      if (currentScope && line.startsWith("~ ")) {
-        scopeUnknowns[currentScope] = (scopeUnknowns[currentScope] || 0) + 1;
-      }
-    }
-  }
-  
+  // 3. Ledger unknowns per scope — `null` for every scope when the ledger itself was not readable
+  //    or nothing in it named a scope (see `ledgerUnknowns`). Only a real count can promote.
+  const scopeUnknowns = ledgerUnknowns(ledgerPath, scopes);
+
   const report = [];
   for (const s of scopes) {
     const id = s.scope_id;
     const t0 = t0Facts[id] || { hasGreen: false, seesawGreen: false };
-    const unknowns = scopeUnknowns[id] || 0;
-    
+    // `null` = the ledger did not answer; a number = it did. `|| 0` collapsed the two.
+    const unknowns = scopeUnknowns === null ? null : (scopeUnknowns[id] || 0);
+
+    // UPHILL_UNKNOWN is the floor, and the honest answer whenever nothing has promoted a scope off
+    // it — including before Orient has filed anything, which is where every run legitimately
+    // starts. Only an ANSWERED count of zero promotes to UPHILL_SOLVED; `null` never does.
     let phase = "UPHILL_UNKNOWN";
     if (t1Pass && t0.hasGreen && t0.seesawGreen) {
       phase = "FINISHED";
@@ -125,7 +289,7 @@ export function deriveHill(cwd, slug) {
     } else if (unknowns === 0) {
       phase = "UPHILL_SOLVED";
     }
-    
+
     const yaml = `scope_id: ${id}\nphase: ${phase}\n`;
     const out = join(hDir, `${id}.yml`);
     let changed = false;
@@ -133,7 +297,7 @@ export function deriveHill(cwd, slug) {
       writeFileSync(out, yaml);
       changed = true;
     }
-    report.push({ scope_id: id, phase, changed });
+    report.push({ scope_id: id, phase, changed, derived: true, unknowns });
   }
   return report;
 }
@@ -156,5 +320,16 @@ export async function cli(rawArgv) {
   const args = runArgs(ARGV_SPEC, rawArgv);
   const cwd = resolve(args.cwd || process.cwd());
   const report = deriveHill(cwd, args.slug);
+  // A refusal that is visible only as a missing write reads exactly like a derivation that
+  // happened to agree with what was already on disk, so say it out loud. It is not an error —
+  // the caller runs this advisorily several times a run, and declining to derive from nothing is
+  // the correct outcome, not a failure — so the exit code stays 0 and the warning goes to stderr.
+  const underived = report.filter((r) => r.derived === false);
+  if (underived.length) {
+    console.error(
+      `hill: derived nothing for ${underived.length} scope(s) (${underived[0].reason}) — ` +
+      `the run trace this phase is derived from is not on disk, so the committed shards were left as they are.`,
+    );
+  }
   console.log(JSON.stringify(report, null, 2));
 }

package/kernel/reduce/ship.mjs

@@ -32,7 +32,7 @@ import { runArgs } from "../lib/argv.mjs";
 import {
   report as reportPath, tasksDir, verdictsDir, trials, evaluationDir, qaDir,
   roundLedger, discoveryLedger, receipt as receiptPath, harnessRun, relShared,
-  activeOrder,
+  activeOrder, runArgsPath, readReceipt, runIdFromReceipt,
 } from "../lib/paths.mjs";
 import { readTrials } from "../verify/t0.mjs";
 import { ratchetReport } from "../probe/stats.mjs";
@@ -398,9 +398,51 @@ export const ARGV_SPEC = {
  * @returns {(Promise<void>|void)} Settles when the subcommand has written its output; most paths
  *   call `process.exit()` with the subcommand's documented code rather than returning.
  */
+/**
+ * Did THIS run skip evaluation? Read from the run's own recorded arguments, and believed only when
+ * the record can be shown to belong to this run.
+ *
+ * WHY THE KERNEL ASKS AT ALL. A run launched with `--no-eval` verified nothing, and the protocol
+ * has always said such a run ships as `not-evaluated`, "recorded plainly — never silently
+ * upgraded". That promise lived entirely inside the orchestrator's control flow, where one
+ * assignment downstream of the branch restores the old behaviour with every check still green —
+ * measured, not supposed. The gate block tells the human the truth either way; the committed report
+ * a teammate inherits on `git pull` is the artifact that was lying, so the refusal belongs at the
+ * writer of that artifact, where a future orchestrator edit cannot reach it.
+ *
+ * POSITIVELY PROVEN OR NOT AT ALL. The record is written at launch, later than the receipt that
+ * mints the run key, so a freshly opened run can still find the PREVIOUS run's record on disk. A
+ * stale flag would refuse a ship that verified everything — a worse failure than the one this
+ * closes. The flag therefore counts only when the record names the same run the receipt does;
+ * a missing, unreadable or differently-keyed record proves nothing and permits.
+ *
+ * @param {string} cwd - Project root.
+ * @param {string} slug - Feature slug.
+ * @returns {boolean} True only when this run's own record says evaluation was skipped.
+ */
+function evalWasSkipped(cwd, slug) {
+  try {
+    const record = JSON.parse(readFileSync(runArgsPath(cwd, slug), "utf8"));
+    if (record?.noEval !== true) return false;
+    const mine = runIdFromReceipt(readReceipt(receiptPath(cwd, slug)));
+    return Boolean(mine) && record.runId === mine;
+  } catch { return false; }
+}
+
+/** The verdict values that assert the feature was graded and passed. */
+const PASSING = new Set(["PASS", "pass"]);
+
 export async function cli(rawArgv) {
   const args = runArgs(ARGV_SPEC, rawArgv);
   const cwd = args.cwd || process.cwd();
+  if (PASSING.has(String(args.verdict ?? "")) && evalWasSkipped(cwd, args.slug)) {
+    console.error(
+      "✋ reduce ship: this run was launched with --no-eval, so nothing graded it — refusing to freeze a report " +
+      `that says ${args.verdict}. Ship it as --verdict not-evaluated, which the report, the ledger and the ` +
+      "sign-off block all carry.",
+    );
+    process.exit(3);
+  }
   const { markdown, path } = generate({ cwd, slug: args.slug, verdict: args.verdict, qa: args.qa });
   if (args.stdout) {
     process.stdout.write(markdown);

package/kernel/schemas/domain.schema.json

@@ -2846,9 +2846,10 @@
           "type": "string",
           "enum": [
             "pass",
-            "fail"
+            "fail",
+            "not-evaluated"
           ],
-          "description": "shipped | ok: the round or run's EVAL verdict, lowercased from spec-evaluator's PASS|FAIL."
+          "description": "shipped | ok: the round or run's EVAL verdict, lowercased from spec-evaluator's PASS|FAIL — or `not-evaluated` when a `shipped` return closed a `--no-eval` run, which reaches SHIP without ever dispatching the judge. Recorded plainly, never upgraded to `pass` (references/protocol.md)."
         },
         "rounds_used": {
           "type": "integer"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shapeup-sdlc",
-  "version": "3.7.1",
+  "version": "3.7.2",
   "description": "Shape Up for coding agents \u2014 with gates the agent can't talk its way past. Harness for Claude Code.",
   "bin": {
     "shapeup-sdlc": "bin/init.mjs"

package/skills/hill-chart/SKILL.md

@@ -48,12 +48,16 @@ node "${CLAUDE_PLUGIN_ROOT}/kernel/harness.mjs" reduce graph --slug <slug>
 ```
 
 **For a committed-only slug (`hasCommitted && !hasLocal`), NEVER call `reduce hill`.**
-`deriveHill()` folds whatever T0 verdicts currently exist on disk; a committed-only pitch has
-none (the local trace was cleaned up after shipping), so re-running it would silently regress a
-true historical `FINISHED` down to a fabricated `UPHILL_SOLVED` — reading absence of evidence as
-evidence of absence. Read `shapeup/<slug>/hill/*.yml` for those slugs exactly as committed, and
-render them with the archived state the template already implements (see below). Same reasoning
-applies to `reduce graph` — there is no local trace to append from.
+`deriveHill()` folds whatever T0 verdicts, evaluation results and ledger rows exist in the LOCAL
+run trace; a committed-only pitch has none, because that trace was cleaned up after shipping.
+
+The runtime no longer takes that silence for an answer: a derivation whose run trace is absent
+declines to write anything and reports every scope as underived (`derived: false`), so the
+committed shards survive a call made in error. Treat that as a backstop, not a licence — an
+underived report is not a refresh, and rendering it as one would show a pitch's true `FINISHED`
+as freshly confirmed when nothing confirmed it. Read `shapeup/<slug>/hill/*.yml` for those slugs
+exactly as committed, and render them with the archived state the template already implements
+(see below). Same reasoning applies to `reduce graph` — there is no local trace to append from.
 
 ## Reading the hill shards
 

package/skills/tech-lead/references/gates.md

@@ -389,7 +389,7 @@ feature) and the failing step is compiled into round r+1's orders as `payload.bu
 means L0 pinned no run command and the profile names no probe — the round proceeds over an
 unproven build, and the block says so.
 
-Under `--interactive` / `--auto`, the hook warns if the board is not truly green (advisory) and requires explicit PO approval to proceed. Under `--unattended`, it automatically aborts on a red board or proceeds on a green one.
+Under `--interactive` / `--auto`, the gate block carries the board facts — `green_scopes`, `hammer_proposals` — and requires explicit PO approval to proceed. Under `--unattended` the answer set resolves it. **There is no hook behind this gate**: the `PreToolUse` warning it used to carry was retired into the block in v2.0, so what an unfinished board costs you here is a human reading the numbers, not a machine refusing the call.
 
 ---
 

package/skills/tech-lead/workflows/shapeup-run.js

@@ -1596,7 +1596,11 @@ while (verdict !== "pass" && round <= maxRounds) {
         `feature; this one does not build or launch. Round ${round + 1} fixes the gate's failing step.`);
   } else if (args.noEval) {
     log("EVAL — skipped (--no-eval)");
-    verdict = "pass";
+    // references/protocol.md's own words for this, twice: a run --no-eval ships records
+    // `not-evaluated` — "recorded plainly — never silently upgraded [to `pass`]". Nothing verified
+    // the feature beyond task-executor's own per-AC evidence checks, and the report this run
+    // freezes at GATE L4 has to say that as plainly as the gate block already does.
+    verdict = "not-evaluated";
   } else {
     const e = await worker({
       skill: "spec-evaluator", operation: "evaluate", schema: EVAL, phase: "Eval", label: `eval:r${round}`,
@@ -1647,14 +1651,16 @@ while (verdict !== "pass" && round <= maxRounds) {
   const g3 = await crossGate("L3", "Eval", ["loop", "stop", "ask"], { round, verdict, build_gate: buildGate });
   if (g3.stop) return await withWarnings(g3.stop);
 
-  if (verdict === "pass") break;                                  // → QA → GATE H → ship
+  // "not-evaluated" (--no-eval) ships exactly like "pass" — protocol.md: the run "goes straight to
+  // SHIP" once EVAL is skipped, never spends another round waiting on a verdict nobody is producing.
+  if (verdict === "pass" || verdict === "not-evaluated") break;   // → QA → GATE H → ship
   if (g3.decision === "stop" || round >= maxRounds) {
     return await withWarnings({ status: "gate_h", breaker: "outer", hammer_proposals: allHammer, green_scopes: allGreen });
   }
   round += 1;
 }
 
-if (verdict !== "pass") {
+if (verdict !== "pass" && verdict !== "not-evaluated") {
   return await withWarnings({ status: "gate_h", breaker: "outer", hammer_proposals: allHammer, green_scopes: allGreen });
 }
 
@@ -1692,7 +1698,12 @@ if (h.verdict === "cannot-ship") {
   if (g.stop) return await withWarnings(g.stop);
 }
 
-const ship = await cmd(`reduce ship --slug ${slug} --verdict PASS --qa ${qaRan ? "run" : "skipped"}`, "Ship", "ship-report");
+// The frozen report's own verdict line has to say what actually happened — a `--no-eval` run
+// verified nothing beyond task-executor's per-AC checks, and `reduce ship` already accepts
+// "not-evaluated" as a real verdict (its own usage string, and `generate()`'s no-artifact
+// default). Hardcoding PASS here is exactly the silent upgrade protocol.md's Rules forbid.
+const shipVerdict = verdict === "not-evaluated" ? "not-evaluated" : "PASS";
+const ship = await cmd(`reduce ship --slug ${slug} --verdict ${shipVerdict} --qa ${qaRan ? "run" : "skipped"}`, "Ship", "ship-report");
 await advisory(`report export --slug ${slug}`, "Ship", "export-run");
 // The run's own concurrency, printed once where the records are complete and before the next run
 // supersedes the trace. It is a projection over `receipts/dispatch.jsonl` and `legs.jsonl`, so it
@@ -1707,7 +1718,10 @@ const ALL_DIMS = ["spec-conformance", "tdd-surface", "integration", "completenes
 
 return await withWarnings({
   status: "shipped",
-  verdict: "pass",
+  // The real verdict this run reached — "pass" or, over a --no-eval run, "not-evaluated". GATE L4's
+  // own sign-off block reads this field verbatim (SKILL.md Step 4); hardcoding "pass" here told a
+  // human answering that gate the run was graded when it never was.
+  verdict,
   rounds_used: round,
   dims_not_evaluated: ALL_DIMS.filter((d) => !evalDims.includes(d)),
   qa_findings: qaFindings,