shapeup-sdlc 3.7.1 → 3.7.3

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "shapeup-sdlc-plugin",
   "displayName": "ShapeUp SDLC Plugin",
-  "version": "3.7.1",
+  "version": "3.7.3",
   "description": "Shape Up SDLC harness for Claude Code: shaping, intake, orient, scope-mapping, building (T0-verified, sandboxed, scope-contracted), evaluation and QA skills orchestrated by a tech-lead.",
   "author": {
     "name": "Liberty Nguyen",

package/AGENTS.md

@@ -10,6 +10,7 @@ Skills and commands are named short throughout this file; every one of them reso
 - Hook-denied: dispatching a worker without a schema-valid WorkOrder, writing outside the scope's substrate, writing a committed file whose text names a run-trace path or a board id, stopping a run with no receipt (the run's first act writes one).
 - **The tier-direction rule is refused at the write, not argued at L1b.** A committed file cannot carry a `.shapeup/` path or a `TASK-NNN` id — boards renumber per machine and the run trace is gitignored, so either one resolves only where it was written. Spec-lint has always red'd this at Board Review; the same rule now also refuses the write itself, naming the token, because four producers hit it and one of them hit it twice in one session — a worker carries no lesson across a dispatch, and by L1b the phase that wrote the line is over. The knowledge base is outside the rule: those files are instructions, not references anyone resolves.
 - Attested, not assumed: a dispatch leaves a receipt naming the skill that ran, and ingest refuses an orchestrated result that has none. A dispatch that fails is answered by the sub-agent improvising the craft, which every other check accepts — so "the artifact exists" is not evidence that the shipped skill produced it. `--no-receipt-check` is the way through when the receipt channel itself fails.
+- **The single writer is asked, never assumed.** A dispatch's result is applied by exactly one act — the ingest step — and that act leaves a leg row. Every phase post-condition and every settled build scope asks the leg ledger whether the row exists before any verdict on the phase or the scope, whatever the worker reported: a result on disk that nothing applied is ingested there if the scope is green, and otherwise named at the close as `unapplied_results=N`, never folded into "not green". A round that ends with nothing green names `breaker=none` and `stalled=no_green` unless the attested attempt census says a scope tripped — the close cannot name a breaker the census denies. The run graph carries a `Leg` node with an `INGESTED` edge from its `Result`, and the export a `leg` table, so "which results were never read" is one query.
 - GATE L2 is advisory — warns when EVAL runs over unfinished tasks, permits the call (per-machine board, operator asked; ADR-0001) — a signal, not a bug.
 - Sign-off is a file: each gate resolves from the answer set (`ci`/`guarded`/`interactive`) — cross, stop for the PO, or abort; the decision's source is ledgered.
 - **Every ending a run does not come back from records a close** — its status, its cause and its timestamp — derived from the ending itself rather than from a hand-kept pair, so an ending nobody enumerated cannot silently record nothing. A breaker trip that routes to GATE H closes the run as `escalated`, carrying the breaker in its cause; a pause records no close **by design**, because a relaunch resumes it.
@@ -34,7 +35,7 @@ Betting Table: PO decides; rejected pitches loop back to raw idea.
 | Analyze | — (reviewed at L1b) | `/ba-pitch-analyzer` (`analyze`): spec tree + board (UC + Invariants + Test Surface ★); before Wire (needs its use cases). An acceptance criterion that grades a requirement carries `(covers: REQ-…)` — that clause is the edge the verdict travels back along |
 | Wire | ⏸ **L1a.5** — Wiring Review ✚ | `/solution-architect` (`wire`): sole writer of committed `wiring-map.md` — per-UC engine → seam → entry-point call site → affordance, per `project-profile.md` |
 | Map Scopes | ⏸ **L1b** — Board Review (+ substrate disjointness lint) | `/scope-architect` (scope contracts ✦ — sole writer); traceability oracle advisory ✚. A registered requirement that no acceptance criterion grades and no scope claims is **red** here, and L1b prints the `REQ → AC` table: the two ways out are an AC carrying `(covers: REQ-…)` or the PO marking the clause `CUT (PO-approved)`. Red only where the plan is still cheap to change — after L1b nobody re-reads the pitch |
-| Build Vertically | ⏸ **L2** — Board 100% ✅ + T0-green ✦ | per dispatch: compile order → `/task-executor` (--order) → ingest result; T0-verified per attempt (fixtures + DB probe + seesaw ✦), substrate-sandboxed ✦. Scopes build **concurrently** ✦ — `--parallel-scopes N` caps it (default 4), a scope is released the moment its own dependencies are green, and a scope green in this round is skipped rather than rebuilt. Then the **round build gate** ⚙: the ledger's run command, then the profile's `build_probe` and `launch_probe`, run once per round before EVAL — a red gate ends the round with no verdict and its failing step is compiled into the next round's orders as bugs; a `mobile` profile with no `launch_probe` is warned about every round, so the install/launch risk has an owner |
+| Build Vertically | ⏸ **L2** — Board 100% ✅ + T0-green ✦ | per dispatch: compile order → `/task-executor` (--order) → ingest result; T0-verified per attempt (fixtures + DB probe ✦; the seesaw regression arm is declared and not yet wired), substrate-sandboxed ✦. Scopes build **concurrently** ✦ — `--parallel-scopes N` caps it (default 4), a scope is released the moment its own dependencies are green, and a scope green in this round is skipped rather than rebuilt. Then the **round build gate** ⚙: the ledger's run command, then the profile's `build_probe` and `launch_probe`, run once per round before EVAL — a red gate ends the round with no verdict and its failing step is compiled into the next round's orders as bugs; a `mobile` profile with no `launch_probe` is warned about every round, so the install/launch risk has an owner |
 | EVAL (once per round) | ⏸ **L3** — Verdict | `/spec-evaluator` (--order), only over a round whose build gate ⚙ is not red: spec- + test-surface-conformance ★, T0 citation ✦; refuted boxes/verdict applied by ingest |
 | FAIL → round r+1 | — | regression rule ★: bugs + full Test Surface of touched UC |
 
@@ -62,7 +63,7 @@ Everything discovered funnels into `.shapeup/<slug>/discovery/ledger.md` (Orient
 - **QA is a level-up, not a gate** — `--no-qa` skips it; circuit breaker outranks the Hunter.
 - **Role separation** — Evaluator grades, task-executor fixes, QA discovers.
 - **The requirements matrix is a projection, never a verdict** — `REQ → AC → criterion → verdict` is derived from files for one named run (the registry, the board's `covers:` clauses, the run's verdict rows, the T0 citations), never narrated and never passed in. `covers:` is the authoritative join: a criterion anchored to a requirement no AC covers is printed for reconciliation and counted as nothing. L4 reads one line off it, GATE H's census takes the clauses with no evidence, `REPORT.md` freezes the table — and none of that blocks a ship. A clause with no PASS evidence is a fact the baseline comparison weighs, not a veto.
-- **Hill phase is mechanical ✦** — derived only from T0/T1/seesaw artifacts, never self-reported, and a T0-green from a round whose build gate ⚙ is red moves no dot (a green fixture in a round the feature did not build is evidence about the fixture); the evaluator cites a T0 artifact it re-hashes itself, from the list its order carries. A scoped verdict citing none is refused: its round stays open and is evaluated again, never advanced.
+- **Hill phase is mechanical ✦** — derived only from T0/T1 artifacts (the seesaw arm is declared, not yet wired), never self-reported, and a T0-green from a round whose build gate ⚙ is red moves no dot (a green fixture in a round the feature did not build is evidence about the fixture); the evaluator cites a T0 artifact it re-hashes itself, from the list its order carries. A scoped verdict citing none is refused: its round stays open and is evaluated again, never advanced.
 - **Envelope port (v1.0)** — every dispatch is WorkOrder in / WorkResult out; shared state has exactly one writer (the ingest step); malformed envelopes are hook-denied. Workers: stateless, craft-only, pipeline-blind.
 
 ## Setup & Execution
@@ -81,11 +82,11 @@ Everything discovered funnels into `.shapeup/<slug>/discovery/ledger.md` (Orient
   through the chained launch, until the run can resume unattended again.
 - Two storage tiers (ADR-0001): COMMITTED `shapeup/<slug>/` (shaping, spec, scopes, wiring-map, project-profile, requirements, hill, `REPORT.md` frozen at L4) vs GITIGNORED `.shapeup/` (board, orders/results, T0/eval/QA artifacts, ledgers, metrics, gate answers, and the run scripts staged for launch).
 - **The run launches from a copy inside your project, and it has to.** The Workflow tool loads a script only from a directory the session may already read; the plugin installs outside your project, so naming the shipped path is refused before the run begins and no permission rule repairs it — the grant authorises the tool, not what it may read. Opening a run therefore re-copies the run scripts to `.shapeup/workflows/` and reports the path the launch names. A run in flight keeps the copy it started with: an upgrade reaches the next run, not the current round.
-- **A write the substrate does not cover is denied for as long as the dispatch is in flight, and no longer.** A dispatch is live from the moment its order is compiled until a result for *that* dispatch lands, and liveness is read off the run's order set — not off the pointer that names the run, which outlives it. A run closed any other way than shipping — escalated, aborted, killed outright — leaves an order still open by construction, and the pointer is what decides whether that still fences: the fence is enforced only while the pointer exists on disk, so a close that removes it releases the fence whatever the order set says, and restoring the pointer flips it straight back to denying. **Every terminal close retires it** (3.7.1 onward), not only a ship — an escalated or aborted run stops fencing the checkout the moment it closes, and a close that cannot remove a pointer says so in its own return rather than failing. Retiring is not answering, though, and the difference is the whole reason there are still two levers: the pointer says a run is in flight, the missing result says nobody came back, and only the first stops being true at a close. An order the run left unanswered stays genuinely unresolved — un-fenced, but not done — until `init run --force` writes a synthetic result for it, which is also what lets the attempt census keep telling work nobody did apart from work that failed. What the fence actually gates is narrower than "the project," too — it is this assistant's own edit path (a direct file write or edit call) outside the live order's substrate; a shell command, `git`, or any other editor still writes straight through it. Re-dispatch is fenced again, and the committed tier is never a worker's to write either way: those files belong to the orchestrator, whose window is a phase boundary rather than the middle of somebody else's order.
-- Every run has a `run_id` — the receipt mints it, and orders, T0 artifacts, trial rows, agent-call journal rows and hook decisions all carry it. It is the only key that separates two runs of the same feature: everything else (`order_id`, round/attempt) repeats. It is **not** a time boundary — a relaunch resumes the same run and reuses the key, so one `run_id` legitimately spans every launch after a paused gate or a kill, with hours of wall clock between them, and `orders/<id>.json` is rewritten by each. Anything measuring elapsed time reads the append-only records, never the span of a key. SHIP S.7 exports the run's records as fact tables under `.shapeup/exports/<run_id>/` before the run trace is superseded — and so does **every other terminal ending**: a run that aborts, escalates or stops at GATE H exports on its close, because the runs whose records are worth most are the ones that never reach the Ship phase. The export is advisory at every one of them: a failed export degrades the trace and is reported in the run's state warnings, but never turns a close into a non-close. A WorkResult carries no `run_id` and reaches it through `order_id`.
+- **A write the substrate does not cover is denied for as long as the dispatch is in flight, and no longer.** A dispatch is live from the moment its order is compiled until a result for *that* dispatch lands, and liveness is read off the run's order set — not off the pointer that names the run, which outlives it. A run closed any other way than shipping — escalated, aborted, killed outright — leaves an order still open by construction, and the pointer is what decides whether that still fences: the fence is enforced only while the pointer exists on disk, so a close that removes it releases the fence whatever the order set says, and restoring the pointer flips it straight back to denying. **Every terminal close retires it** (3.7.1 onward), not only a ship — an escalated or aborted run stops fencing the checkout the moment it closes, and a close that cannot remove a pointer says so in its own return rather than failing. Retiring the pointer does not orphan what follows: the close leaves a breadcrumb naming the run it ended, so the hook decisions taken in the census and ship phase after it still carry that run's key, marked as taken over a closed run. Retiring is not answering, though, and the difference is the whole reason there are still two levers: the pointer says a run is in flight, the missing result says nobody came back, and only the first stops being true at a close. An order the run left unanswered stays genuinely unresolved — un-fenced, but not done — until `init run --force` writes a synthetic result for it, which is also what lets the attempt census keep telling work nobody did apart from work that failed. What the fence actually gates is narrower than "the project," too — it is this assistant's own edit path (a direct file write or edit call) outside the live order's substrate; a shell command, `git`, or any other editor still writes straight through it. Re-dispatch is fenced again, and the committed tier is never a worker's to write either way: those files belong to the orchestrator, whose window is a phase boundary rather than the middle of somebody else's order.
+- Every run has a `run_id` — the receipt mints it, and orders, T0 artifacts, trial rows and hook decisions all carry it. It is the only key that separates two runs of the same feature: everything else (`order_id`, round/attempt) repeats. It is **not** a time boundary — a relaunch resumes the same run and reuses the key, so one `run_id` legitimately spans every launch after a paused gate or a kill, with hours of wall clock between them, and `orders/<id>.json` is rewritten by each. Anything measuring elapsed time reads the append-only records, never the span of a key. SHIP S.7 exports the run's records as fact tables under `.shapeup/exports/<run_id>/` before the run trace is superseded — and so does **every other terminal ending**: a run that aborts, escalates or stops at GATE H exports on its close, because the runs whose records are worth most are the ones that never reach the Ship phase. The export is advisory at every one of them: a failed export degrades the trace and is reported in the run's state warnings, but never turns a close into a non-close. A WorkResult carries no `run_id` and reaches it through `order_id`.
 - Every run projects a **run graph** — `.shapeup/<slug>/graph.jsonl`, append-only, written only by
-  `reduce graph`. Two families kept separate: work lineage (Run, Order, Result, Verdict, Trial,
-  GateDecision) and domain (Scope, UseCase, Requirement, Seam). It is derived from the artifacts,
+  `reduce graph`. Two families kept separate: work lineage (Run, Order, Result, Leg, Verdict,
+  Trial, GateDecision) and domain (Scope, UseCase, Requirement, Seam). It is derived from the artifacts,
   never authored, so it can be deleted and rebuilt — and a run recorded before it existed backfills
   on first touch. `--subgraph run` is the fast-forward as one bounded query; `--trace <node>` walks
   a verdict back to the objective, the plan, the source, the execution record and the gate that

package/README.md

@@ -41,9 +41,17 @@ runs over unfinished tasks rather than denying it. The board is local to the mac
 harness — see [ADR-0001](docs/design/adr/0001-consumer-file-organization.md).)
 
 **2. Progress is measured, not claimed.** A scope counts as built only when `t0-verify` runs
-its fixtures, a DB probe, and the seesaw, and writes an artifact to disk. The evaluator must
-cite that artifact and re-hashes it itself; hill phase is derived from those facts, so no
-worker can self-report confidence.
+its fixtures and its DB probe and writes an artifact to disk — with each command's exit code,
+its captured output, and whether it ran at all. The evaluator must cite that artifact, and the
+hill phase is derived from artifacts rather than from a worker's own account of its progress.
+Two limits, stated here because the point of this section is that a claim without a mechanism
+behind it is the thing this harness exists to prevent: the **seesaw** regression arm is declared
+and not yet wired (no run writes its registry — wiring it is an open Betting Table decision), and
+the citation **re-hash** the kernel performs proves self-consistency, not provenance — the digest
+and the cited verdict are checked, the scope, round and run the artifact belongs to are not. A T0
+artifact is also evidence about the machine that produced it: it records the tree and nothing
+about the toolchain or caches the commands resolved through. All three are open items in
+`shapeup/knowledge-base/harness-defects.md`, not shipped guarantees.
 → *Prevents: "done" asserted with nothing behind it.*
 
 **3. Parallel work can't corrupt shared state.** Each scope gets a write-whitelist of files
@@ -122,8 +130,8 @@ rest of this README after this table and nothing will be a surprise.
 |---|---|
 | **board** | The round's task list. "Green" means every task is done. GATE L2's hook reads this before an evaluation and warns if it is not green. |
 | **round** | One build → evaluate cycle. A FAIL verdict starts round *r+1*. |
-| **T0** | The smoke test a scope must pass before it counts as built: its fixtures + a DB probe + the seesaw. Writes an artifact to disk that the evaluator must cite. |
-| **seesaw** | The part of T0 that re-runs *other* scopes' fixtures — so a regression is never mistaken for progress. |
+| **T0** | The smoke test a scope must pass before it counts as built: its fixtures + a DB probe (the seesaw arm is declared and not yet wired — see §2 above). Writes an artifact to disk that the evaluator must cite. |
+| **seesaw** | The regression arm of T0, meant to re-run *other* scopes' fixtures so a regression is never mistaken for progress. Declared, not yet wired: no run writes its registry, so no run has executed it. |
 | **substrate** | The exact list of files one dispatch is allowed to write, stamped into its work order. A hook blocks anything outside it — and anything the order marks frozen. |
 | **scope contract** | The file defining one vertical slice: its substrate, its fixtures, its affordances. |
 | **affordance** | The thing a user can actually click, type or call. UI is graded on affordances, not on looks. |
@@ -178,7 +186,7 @@ every arm is skipped when its artifact is absent, so older specs are unaffected.
 | QA (post-PASS) | `qa-edge-hunter` | v1.1 | Exploratory edge hunt on the running app through six fixed lenses, charting edges *outside* what the evaluator probed. Findings go to the ledger as `~`; never blocks ship. |
 | Stop (11) | `scope-hammer` | v0.1 | GATE H: must-have census → baseline comparison (never vs. the ideal) → cut list + ship verdict. Handles the normal stop and both circuit-breaker triggers. |
 | Retro (post-L4) | `coach` | — | RLHF for the harness: turns raw PO/TL feedback at Ship Sign-off into per-skill guidelines under committed `shapeup/knowledge-base/<skill>.md`, read back by six coachable workers on their next run and by `tech-lead` at GATE L0 (workflow guidance, never a gate answer). `--scan` seeds the same files from the project on disk before the first run; `--research <stack>` seeds them from the platform's official documentation when the project has nothing to scan, and cross-checks a scan's rules when it has. GATE COACH-1 asks the PO which skill owns each rule — never assumes; mechanism defects are filed to the harness-defect register instead. |
-| Orchestrator | `tech-lead` | v1.0 | Owns the run end-to-end: PLAN once → BUILD all tasks → EVAL once per round, looping on FAIL. Three-level circuit breaker (rounds / T0 attempts / wall clock), T0/seesaw-verified build rounds, mechanical hill derivation. Sole writer of run-state. |
+| Orchestrator | `tech-lead` | v1.0 | Owns the run end-to-end: PLAN once → BUILD all tasks → EVAL once per round, looping on FAIL. Three-level circuit breaker (rounds / T0 attempts / wall clock), T0-verified build rounds, mechanical hill derivation. Sole writer of run-state. |
 
 ### Commands
 
@@ -299,8 +307,10 @@ These hold across the harness and are the reason it stays predictable:
   of blocking the round. An opt-in third breaker bounds the **wall clock**, because the other two
   count events and neither can notice a single round running for half an hour — tripping it routes
   to GATE H, so a run out of time ships what is green instead of being killed and shipping nothing.
-- **Hill phase is mechanical, never self-reported** — derived only from T0/T1/seesaw facts, closing
-  the self-reported-confidence risk outright.
+- **Hill phase is mechanical, never self-reported** — derived only from T0/T1 facts (the seesaw
+  arm is declared, not yet wired), closing the self-reported-confidence risk. A scope with no
+  discovery ledger derives no phase rather than a solved one, so absence no longer reads as
+  progress on that arm.
 - **One writer per shared file** — every board/ledger/verdict write goes through
   `harness reduce ingest`; workers return data and never touch shared state.
 - **Traceability is oracle-checked, opt-in** — `harness verify trace` verifies covers-closure and

package/SECURITY.md

@@ -45,7 +45,7 @@ test against machines you don't own.
    (override channel fails closed), and every exercised override is logged. The same principle
    covers `.shapeup/active-order`, which `sandbox-guard` reads to find the run whose orders fence
    a worker's writes: it sits outside the run-trace carve-out, so a worker cannot repoint its own
-   sandbox. Every hook resolves that pointer, the decision ledger and the substrate globs against
+   sandbox. The `last-run` breadcrumb a terminal close leaves beside it is read for one purpose — keying a decision row to the run that just ended, marked `run_closed` — and arms nothing: liveness is derived from the order set and the pointer, never from that file. Every hook resolves that pointer, the decision ledger and the substrate globs against
    the project root it finds above the tool call's working directory (a run pointer, the committed
    tier, or a git boundary) — a worker that `cd`s into a sub-folder is fenced exactly as one at the
    top, and its receipts land in the same ledger.
@@ -72,7 +72,7 @@ sitting, and reading them is the recommended review.
 | [`safety-spine.mjs`](hooks/safety-spine.mjs) | PreToolUse (`Bash\|Read\|Write\|Edit\|MultiEdit`) | The proposed command/path; `.shapeup/safety-overrides.json` | Yes — provably destructive ops only: `rm -rf` on unrecoverable targets, `git push --force` / push to main, `git reset --hard`, `git clean -fdx`, `DROP TABLE`/`TRUNCATE`, reads of `.env`/keys/cloud credentials, and any write to its own overrides file | Never blocks an unmatched command; `--force-with-lease` stays allowed |
 | [`gate-intake.mjs`](hooks/gate-intake.mjs) | PreToolUse (`Skill`) | The `tech-lead` dispatch's own arguments | Yes — an orchestrator dispatch carrying no resolvable intake (no pitch, spec, resume or requirement text) | Fails open on `--order` and on any ambiguous arg shape |
 | [`harness verify envelope`](kernel/verify/envelope.mjs) | PreToolUse (`Skill\|Agent`) | The `--order` file named in the dispatch; the JSON schemas | Yes — a worker dispatch whose order file is missing or schema-invalid | Never gates a dispatch that carries no `--order` (standalone skill use stays free) |
-| [`sandbox-guard.mjs`](hooks/sandbox-guard.mjs) | PreToolUse (`Edit\|Write\|MultiEdit`) | The target path; the `substrate` block of every LIVE order — compiled, with no result at least as new as the order's own `compiled_at`, and, for a run-level phase dispatch, not yet superseded by a later phase's order | Yes — any write no live order permits: inside any `frozen`, outside every `allowed`/`shared`, or a `Write` to an `append_only` path. `frozen` is checked FIRST, so it also outranks the run-trace carve-out | No-op unless an order is live, which a finished run no longer is: the pointer names the run, never a dispatch. The active feature's own `.shapeup/<slug>/` run trace is writable EXCEPT where a live order freezes a path inside it. Appends denials to the local pathology log |
+| [`sandbox-guard.mjs`](hooks/sandbox-guard.mjs) | PreToolUse (`Edit\|Write\|MultiEdit`) | The target path, resolved through the filesystem before it is compared — symlinks followed, the unborn tail re-attached to its real ancestor, case folded where the filesystem folds case — so a spelling variant of a frozen file is the frozen file; the `substrate` block of every LIVE order — compiled, with no result at least as new as the order's own `compiled_at`, and, for a run-level phase dispatch, not yet superseded by a later phase's order | Yes — any write no live order permits: inside any `frozen`, outside every `allowed`/`shared`, or a `Write` to an `append_only` path. `frozen` is checked FIRST, so it also outranks the run-trace carve-out | No-op unless an order is live, which a finished run no longer is: the pointer names the run, never a dispatch. The active feature's own `.shapeup/<slug>/` run trace is writable EXCEPT where a live order freezes a path inside it. Appends denials to the local pathology log |
 | [`tier-guard.mjs`](hooks/tier-guard.mjs) | PreToolUse (`Edit\|Write\|MultiEdit`) | The target path; the text the call is about to write (`content`, `new_string`, or any edit in a `MultiEdit` batch) | Yes — a write into `shapeup/<slug>/` whose content names a `.shapeup/` path or a `TASK-NNN` board id: the same tier-direction rule spec-lint reds at GATE L1b, refused at the moment of writing, with the offending token quoted back | No-op outside `shapeup/<slug>/`, on file forms the lint does not scan, and on `shapeup/knowledge-base/` (instructions to a worker, not references). Reads nothing off disk and writes only its decision row; it never inspects a file it is not being asked to write |
 | [`dispatch-receipt.mjs`](hooks/dispatch-receipt.mjs) | PostToolUse (`Skill\|Agent`) | The `--order` file named in the dispatch; the tool result's own report of which skill ran | **No — it has no deny path at all.** It records that the shipped skill ran, so `harness reduce ingest` can refuse a result no dispatch produced | Never writes an attestation for a result that does not name a resolved skill; never fails the call it observes (every write is inside `try`/`catch`) |
 | [`gate-zerowork.mjs`](hooks/gate-zerowork.mjs) | Stop | Run receipts on disk; the session transcript; the decision ledger | **Yes — the one blocking hook.** Returns `decision:"block"` when the session dispatched the orchestrator and produced no run receipt | Defers the moment any receipt exists; `stop_hook_active` caps it at one block per stop chain |

package/hooks/lib/decision.mjs

@@ -49,7 +49,7 @@
 import { appendFileSync, mkdirSync, existsSync, statSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 import { decisions, activeScope, sharedDir } from "../../kernel/lib/paths.mjs";
-import { resolveRunId } from "../../kernel/lib/paths.mjs";
+import { resolveRun } from "../../kernel/lib/paths.mjs";
 
 /**
  * The project root a hook should file under, from wherever the tool call happened to fire.
@@ -221,7 +221,15 @@ export async function runHook(name, fn) {
     // run, and recording that is what lets the export tier partition ambient decisions from run
     // ones. Resolution reads two small files and swallows every error — a receipt must never be
     // able to fail a tool call.
-    run_id: (() => { try { return resolveRunId(projectRoot(d.cwd || process.cwd())); } catch { return null; } })(),
+    // A row written after the run's terminal close still keys to that run — the close leaves a
+    // breadcrumb for exactly this stretch — and says so, because a decision taken over a closed run
+    // is a different fact from one taken inside it.
+    ...(() => {
+      try {
+        const { run_id, source } = resolveRun(projectRoot(d.cwd || process.cwd()));
+        return source === "closed" ? { run_id, run_closed: true } : { run_id };
+      } catch { return { run_id: null }; }
+    })(),
     event: d.event ?? null,
     tool: d.tool ?? null,
     subject: d.subject ?? null,

package/hooks/sandbox-guard.mjs

@@ -85,8 +85,8 @@
 // Contract: PreToolUse stdin JSON { tool_name, tool_input:{file_path | edits[].file_path}, cwd }.
 // Deny via { hookSpecificOutput: { hookEventName, permissionDecision:"deny", permissionDecisionReason } }.
 
-import { readFileSync, existsSync, appendFileSync, mkdirSync, readdirSync, statSync } from "node:fs";
-import { resolve, join, relative, dirname, sep } from "node:path";
+import { readFileSync, existsSync, appendFileSync, mkdirSync, readdirSync, statSync, realpathSync, lstatSync, readlinkSync } from "node:fs";
+import { resolve, join, relative, dirname, basename, sep } from "node:path";
 import { isMain } from "../kernel/lib/argv.mjs";
 import { LOCAL, SHARED, activeOrder, ordersDir, resultsDir, metricsShard } from "../kernel/lib/paths.mjs";
 import { runHook, readStdin, settle, projectRoot } from "./lib/decision.mjs";
@@ -115,8 +115,69 @@ export function globToRegExp(glob) {
   return new RegExp(`^${re}$`);
 }
 
-export function matchesAny(relPath, globs) {
-  return (globs || []).some((g) => globToRegExp(g).test(relPath));
+/**
+ * Does `relPath` match any of `globs`? With `fold` set, both sides are compared case-folded — the
+ * caller passes it when the filesystem underneath does not distinguish case, so that a glob
+ * declared as `receipts/**` also covers the spelling `Receipts/**`, which on that filesystem is the
+ * same directory.
+ */
+export function matchesAny(relPath, globs, fold = false) {
+  const path = fold ? relPath.toLowerCase() : relPath;
+  return (globs || []).some((g) => globToRegExp(fold ? g.toLowerCase() : g).test(path));
+}
+
+// --- the path a write actually lands on ---------------------------------------------------------
+//
+// A substrate glob is a SPELLING; what it protects is a FILE. Measured against a real compiled
+// order: `.shapeup/<slug>/receipts/dispatch.jsonl` was denied as frozen, `Receipts/dispatch.jsonl`
+// was permitted, and on this machine's case-insensitive filesystem the second spelling overwrote
+// the first file. A symlink was the same hole from another side: `src/x -> ../.shapeup/<slug>/legs.jsonl`
+// sits inside an allowed `src/**` and resolves `..` without following the link, so the write went
+// through. No list of globs can close either — case, links, Unicode forms are all further spellings
+// of one target — so the comparison is made on the resolved real path instead, and case-folded when
+// the filesystem itself folds case. The globs stay exactly as the compiler wrote them.
+
+/**
+ * Resolve `abs` through the filesystem: symlinks in any existing ancestor are followed (a dangling
+ * link is followed by reading it), and the part that does not exist yet is re-attached to the real
+ * path of the deepest ancestor that does. A path nothing on disk can resolve is returned as given.
+ *
+ * @param {string} abs - Absolute path as the tool named it.
+ * @param {number} [depth] - Recursion guard for link chains.
+ * @returns {string} The path the write would actually reach.
+ */
+export function realPathOf(abs, depth = 0) {
+  if (depth > 40) return abs;
+  let cur = abs;
+  const tail = [];
+  for (let i = 0; i < 128; i++) {
+    try { return join(realpathSync.native(cur), ...[...tail].reverse()); } catch { /* not yet resolvable as a whole */ }
+    try {
+      if (lstatSync(cur).isSymbolicLink()) {
+        const target = resolve(dirname(cur), readlinkSync(cur));
+        return realPathOf(join(target, ...[...tail].reverse()), depth + 1);
+      }
+    } catch { /* does not exist at all — climb */ }
+    const parent = dirname(cur);
+    if (parent === cur) return abs;
+    tail.push(basename(cur));
+    cur = parent;
+  }
+  return abs;
+}
+
+/**
+ * Does the filesystem under `dir` fold case? Decided by asking it: the directory's own real path,
+ * with every letter's case swapped, exists and resolves back to the same real path only where the
+ * filesystem does not distinguish case. A path with no letters to swap answers "no".
+ *
+ * @param {string} dir - An existing directory (the project root).
+ * @returns {boolean} True on a case-insensitive filesystem.
+ */
+export function fsFoldsCase(dir) {
+  const swapped = dir.replace(/[a-zA-Z]/g, (c) => (c === c.toLowerCase() ? c.toUpperCase() : c.toLowerCase()));
+  if (swapped === dir) return false;
+  try { return existsSync(swapped) && realpathSync.native(swapped) === realpathSync.native(dir); } catch { return false; }
 }
 
 function readJSON(p) {
@@ -281,9 +342,15 @@ async function main() {
   const blockReasons = [];
   let frozenHits = 0;
 
+  // Compare where the write lands, not how it was spelled (see `realPathOf`). The root is resolved
+  // the same way so a checkout reached through a linked directory still yields a relative path.
+  const realRoot = realPathOf(resolve(root));
+  const fold = fsFoldsCase(realRoot);
+  const under = (rel, prefix) => (fold ? rel.toLowerCase().startsWith(prefix.toLowerCase()) : rel.startsWith(prefix));
+
   for (const raw of targetPaths) {
-    const abs = resolve(cwd, raw);
-    const rel = relative(root, abs);
+    const abs = realPathOf(resolve(cwd, raw));
+    const rel = relative(realRoot, abs);
 
     // Frozen takes absolute precedence, and it is checked across EVERY live contract: a path one
     // scope froze stays frozen while another scope is in flight, which is the whole point of
@@ -296,7 +363,7 @@ async function main() {
     // a planner is graded against — so the compiler emitted a declaration with no enforcer, which is
     // the exact state this hook exists to end. A path a live contract freezes is a violation
     // wherever it lives.
-    const freezer = contracts.find((c) => matchesAny(rel, c.frozen));
+    const freezer = contracts.find((c) => matchesAny(rel, c.frozen, fold));
     if (freezer) {
       violations.push(rel);
       frozenHits++;
@@ -304,11 +371,11 @@ async function main() {
       continue;
     }
 
-    if (rel.startsWith(runTracePrefix)) continue;
+    if (under(rel, runTracePrefix)) continue;
 
-    if (contracts.some((c) => matchesAny(rel, c.allowed))) continue;      // inside a live contract
+    if (contracts.some((c) => matchesAny(rel, c.allowed, fold))) continue;      // inside a live contract
 
-    if (contracts.some((c) => matchesAny(rel, c.appendOnly))) {
+    if (contracts.some((c) => matchesAny(rel, c.appendOnly, fold))) {
       if (p.tool_name === "Write") {
         violations.push(rel);
         blockReasons.push(`${rel} is append-only (Write overwrites, use Edit)`);
@@ -332,7 +399,7 @@ async function main() {
   // spec artifacts, so widening a substrate to reach one is the wrong move in a plausible-looking
   // direction. Those files belong to the orchestrator, whose write window is a phase boundary —
   // no dispatch in flight — and never the middle of somebody else's dispatch.
-  const committed = violations.filter((v) => v.split(/[\\/]/)[0] === SHARED);
+  const committed = violations.filter((v) => (fold ? v.split(/[\\/]/)[0].toLowerCase() === SHARED.toLowerCase() : v.split(/[\\/]/)[0] === SHARED));
   const hint = committed.length === violations.length
     ? `${SHARED}/ is committed tier: these belong to the orchestrator, not to a worker substrate. `
       + "Write them at a phase boundary, with no dispatch in flight — do not widen an order to reach one."

package/kernel/compile.mjs

@@ -218,6 +218,32 @@ export function substrateFor(operation, { slug, specDir, scope } = {}) {
   // in its `allowed` globs, so only a `frozen` entry denies the write. `translate` is the one
   // operation that legitimately rewrites a pitch, and it writes the COMMITTED copy, not this one.
   const FROZEN_INTAKE = [`${local}/intake.md`, `${local}/breadboard.md`];
+  // THE LEG'S OWN ATTESTATION. A dispatch receipt, a leg-completion row and a T0 verdict exist to
+  // answer "did a worker actually run, and what did it measure" from evidence the leg being judged
+  // does not control — the whole reason to prefer them over a compiled order, which is writable by
+  // that same hand. None of the three is ever produced by this assistant's own edit tool in normal
+  // operation: a receipt is stamped by the dispatch hook reacting to the call itself, a
+  // leg-completion row by the step that reads a landed result, and a verdict by the command that
+  // runs the fixtures. A build leg reaching for `Edit`/`Write` on any of them is not doing its job
+  // by another route — it is handing itself the grade — so freezing them costs a well-behaved leg
+  // nothing and removes the one channel through which it could attest work it did not do. The
+  // carve-out below still covers everything else under this root — the doer's own task board and
+  // discovery ledger — because neither lives under any of these three.
+  //
+  // THE RESULT ENVELOPE IS DELIBERATELY NOT ON THIS LIST, and the reasoning is worth keeping because
+  // it looks like it belongs. It is the leg's own claim about its own work, so on the argument above
+  // it is the first thing you would freeze. But a result is not evidence ABOUT the leg, it is the
+  // leg's PRODUCT — the other half of the envelope port, and the thing that answers the order. The
+  // order is unanswered at that moment by construction, so freezing the path would deny every build
+  // leg its documented last step, every time, on the first round: measured end to end against a
+  // compiled order, with the denial telling the worker to widen a substrate that cannot lift a
+  // frozen entry. Nothing else writes an ordinary result either, so there is no fallback. The census
+  // that reads it is already built for this: a result alone attests nothing, and can only turn an
+  // ALREADY-receipted attempt into a spent one, which spends the forger's own budget. What that does
+  // not cover is a leg forging a SIBLING's result, which is a real hole with a different fix — the
+  // glob form here cannot say "every result except this order's own", so closing it needs a
+  // mechanism rather than one more entry on this list.
+  const FROZEN_ATTESTATION = [`${local}/receipts/**`, `${local}/legs.jsonl`, `${local}/t0/verdicts/**`];
   switch (operation) {
     case "execute": case "fix": case "spike":
       // Build legs are the widest window on FROZEN_INTAKE, not an exemption from it: they are the
@@ -228,7 +254,7 @@ export function substrateFor(operation, { slug, specDir, scope } = {}) {
       return {
         allowed: [...(scope?.allowed_file_substrate || []), `${local}/spikes/**`],
         shared: scope?.shared_substrate || [],
-        frozen: [...FROZEN_INTAKE],
+        frozen: [...FROZEN_INTAKE, ...FROZEN_ATTESTATION],
       };
     case "analyze":
       return { allowed: [`${spec}/**`, `${local}/**`], frozen: [...FROZEN_INTAKE] };

package/kernel/gate.mjs

@@ -110,7 +110,7 @@ export const PRESETS = {
       "L1a": { decision: "proceed", note: "Orient review — advisory read." },
       "L1a.5": { decision: "proceed", note: "Wiring review — checked by trace-lint." },
       "L1b": { decision: "ask", note: "Board review is where scope is actually decided. Not pre-approvable." },
-      "L2": { decision: "proceed", note: "Board-green is verified by hook, not by opinion." },
+      "L2": { decision: "proceed", note: "The board facts travel in the gate block itself — green_scopes and hammer_proposals — so a preset answering here is not answering blind. Note there is no board check behind this: the L2 hook was retired into the gate block in v2.0." },
       "L3": { decision: "loop", max_rounds: 3, note: "Loop on FAIL; the breaker ends it." },
       "QA": { decision: "run" },
       "H": { decision: "ask", note: "The cut list changes what ships." },

package/kernel/lib/paths.mjs

@@ -293,6 +293,19 @@ export const activeScope = (cwd) => join(localDir(cwd), "active-scope");
  */
 export const activeOrder = (cwd) => join(localDir(cwd), "active-order");
 
+/**
+ * The run a terminal close just ended — `{slug, run_id, closed_at, closed_status}`, written by the
+ * close in the same act that retires the run pointers, and superseded by the next close.
+ *
+ * Why it exists: retiring the pointers is right (a finished run must stop fencing the checkout),
+ * but the close lands BEFORE the stretch that decides the most — the scope-hammer census, the ship
+ * phase, the export — and every hook decision in that stretch resolved its run through the pointer
+ * that was just removed. Measured on a live run: every decision row after `closed_at` carried
+ * `run_id: null`, the census dispatch included. The breadcrumb keeps that join without keeping the
+ * fence: it names a run, it never arms anything, and a row keyed through it says so.
+ */
+export const lastRun = (cwd) => join(localDir(cwd), "last-run");
+
 /**
  * Where the run scripts are staged for launch, inside the project.
  *
@@ -531,9 +544,31 @@ export function readRunId(cwd, slug) {
  * @returns {(string|null)} The run key, or null when no run is active or readable.
  */
 export function resolveRunId(cwd, slug = null) {
-  if (slug) return readRunId(cwd, slug);
+  return resolveRun(cwd, slug).run_id;
+}
+
+/**
+ * The run key AND where it came from — the shape a ledger row needs when the distinction matters.
+ *
+ * Resolution order: the slug the caller knows (`slug`); else the `active-scope` pointer a live run
+ * publishes (`pointer`); else the breadcrumb the last terminal close left (`closed`), so the census
+ * and ship phase that follow a close still key to the run they belong to; else `null`, which is
+ * "no run" and a real answer. A key resolved through the breadcrumb is a key to a run that is
+ * OVER: the caller records that alongside it rather than presenting the two the same way.
+ *
+ * @param {string} cwd - Project root.
+ * @param {(string|null)} [slug=null] - Feature slug when the caller already knows it.
+ * @returns {{run_id:(string|null), source:("slug"|"pointer"|"closed"|null)}}
+ */
+export function resolveRun(cwd, slug = null) {
+  if (slug) return { run_id: readRunId(cwd, slug), source: "slug" };
   try {
     const ptr = JSON.parse(readFileSync(activeScope(cwd), "utf8"));
-    return ptr?.slug ? readRunId(cwd, ptr.slug) : null;
-  } catch { return null; }
+    if (ptr?.slug) return { run_id: readRunId(cwd, ptr.slug), source: "pointer" };
+  } catch { /* no live run — fall through to the breadcrumb */ }
+  try {
+    const crumb = JSON.parse(readFileSync(lastRun(cwd), "utf8"));
+    if (typeof crumb?.run_id === "string" && crumb.run_id) return { run_id: crumb.run_id, source: "closed" };
+  } catch { /* no close on record either */ }
+  return { run_id: null, source: null };
 }

package/kernel/probe/eval.mjs

@@ -33,6 +33,7 @@
 
 import { existsSync, readFileSync, readdirSync } from "node:fs";
 import { join, resolve } from "node:path";
+import { createHash } from "node:crypto";
 import { runArgs } from "../lib/argv.mjs";
 import { resultsDir, scopesDir } from "../lib/paths.mjs";
 
@@ -59,6 +60,58 @@ export function isScoped(cwd, slug) {
   catch { return false; }
 }
 
+/**
+ * Why one T0 citation does not resolve, or null when the kernel can positively confirm it does.
+ *
+ * Re-checks the two facts a citation can lie about and the schema promises are enforced
+ * (`T0Citation`: "the evaluator RECOMPUTES sha256 from disk — a handed hash is never trusted"):
+ * that the bytes at `path` hash to the cited `sha256`, and that what those bytes actually say is a
+ * green T0 verdict — a PASS/FAIL cannot ride on an artifact that itself recorded red. NOT checked:
+ * whether `path` is one of the order's own `payload.t0_artifacts` (see the note on
+ * {@link citationProblem} for why that is left to the operator rather than enforced here).
+ *
+ * FAILS OPEN ON "CANNOT TELL", CLOSED ON "PROVEN WRONG" — and the two are not the same fact. A read
+ * that fails for a reason that says something DEFINITE about what is (or isn't) at `path` is proof,
+ * same as a hash mismatch: `ENOENT` (nothing there) and `EISDIR` (a directory, never a file — T0
+ * verdicts are always files, per `writeArtifact`) both mean no such artifact was ever produced, so
+ * both refuse. `verify t0` writes verdict artifacts immutably and never deletes one
+ * (`writeArtifact`'s `wx` flag — see kernel/verify/t0.mjs), so that absence or shape mismatch is a
+ * positive fact about the citation, not a guess. Anything else a read can fail with — permission
+ * denied, a symlink loop, a transient I/O error — says nothing about the citation's honesty, only
+ * that THIS MACHINE could not check it just now, so it is not refused on that ground alone: the
+ * fail-open discipline this repo's guards already use elsewhere for an unproven bad state.
+ *
+ * @param {string} cwd - Project root.
+ * @param {object} citation - One `T0Citation` (`scope_id`, `path`, `sha256`). Read defensively:
+ *   `reduce ingest` only reaches this after the enclosing WorkResult passed schema validation, but
+ *   `probe eval` reaches it over a result file it merely `JSON.parse`s, so a malformed citation must
+ *   fail this check rather than throw.
+ * @returns {(string|null)} A reason phrased for an operator, or null when the file at `path` exists,
+ *   hashes to the cited `sha256`, and its own `overall` reads "green".
+ */
+function unresolvedCitation(cwd, citation) {
+  const rel = typeof citation?.path === "string" ? citation.path : "";
+  if (!rel) return "names no artifact path";
+  let text;
+  try {
+    text = readFileSync(resolve(cwd, rel), "utf8");
+  } catch (e) {
+    if (e.code === "ENOENT") return `cites ${rel}, which does not exist on disk`;
+    if (e.code === "EISDIR") return `cites ${rel}, which is a directory, not a T0 verdict file`;
+    // EACCES, ELOOP, EIO, EMFILE… — this machine failing to look, not evidence against the
+    // citation, so it is not refused on that ground.
+    return null;
+  }
+  const actual = createHash("sha256").update(text).digest("hex");
+  const claimed = typeof citation.sha256 === "string" ? citation.sha256.toLowerCase() : "";
+  if (actual !== claimed) return `cites ${rel} with sha256 ${citation.sha256}, but the file on disk hashes to ${actual}`;
+  let body;
+  try { body = JSON.parse(text); }
+  catch { return `cites ${rel}, whose bytes match the hash but do not read as a T0 verdict`; }
+  if (body?.overall !== "green") return `cites ${rel}, whose own verdict is "${body?.overall ?? "unknown"}", not green`;
+  return null;
+}
+
 /**
  * Why a verdict cannot stand as its round's judgement on T0 grounds, or null when it can.
  *
@@ -68,21 +121,40 @@ export function isScoped(cwd, slug) {
  * and branched on like any other. It is checked here so the round loop, the resume derivation, the
  * hill and ingest all refuse the same verdict for the same reason.
  *
- * PRESENCE, NOT HASHES. The evaluator re-hashes what it cites; a slip transcribing a digest is not
- * evidence the verdict is wrong, and refusing a round over one would cost a whole re-evaluation.
+ * RESOLVES, NOT JUST PRESENT. A citation naming a path and a hash used to be taken on faith: any
+ * non-empty `t0_citations[]` passed, whatever it pointed at. Measured live: a PASS citing a path
+ * that does not exist on disk, and a PASS citing a real artifact whose own verdict was red, both
+ * ingested clean — presence stood in for a re-hash the schema had already promised. Each citation is
+ * now re-checked through {@link unresolvedCitation}.
+ *
+ * WHAT THIS DOES NOT CHECK: whether a citation is drawn from the order's own `payload.t0_artifacts`
+ * list. That would need the compiled order, which this function's callers do not equally have —
+ * `reduce ingest` holds it, but `probe eval` (and the round-loop/resume/hill readers behind it)
+ * knows only (cwd, slug, round), and a scope's T0 attempt can legitimately go green again LATER than
+ * whatever list was frozen at compile time (`greenVerdict` already treats "newest green" as
+ * authoritative for exactly this reason — see kernel/probe/t0.mjs). Enforcing membership only where
+ * the order happens to be on hand would let one channel refuse a citation the other accepts, for
+ * evidence that may simply be fresher than the order — worse than leaving it unenforced.
  *
  * @param {string} cwd - Project root.
  * @param {string} slug - Feature slug.
  * @param {object} verdict - The WorkResult's `verdict` block.
- * @returns {(string|null)} The problem, phrased for an operator; null for a cited verdict, an
- *   unscoped spec, or a block with no PASS/FAIL in it (there is no judgement to invalidate).
+ * @returns {(string|null)} The problem, phrased for an operator; null for a verdict whose every
+ *   citation resolves, an unscoped spec, or a block with no PASS/FAIL in it (there is no judgement
+ *   to invalidate).
  */
 export function citationProblem(cwd, slug, verdict) {
   if (verdict?.overall !== "PASS" && verdict?.overall !== "FAIL") return null;
-  if (Array.isArray(verdict.t0_citations) && verdict.t0_citations.length) return null;
   if (!isScoped(cwd, slug)) return null;
-  return `the ${verdict.overall} verdict cites no T0 artifact, and a verdict on a scoped spec must ` +
-    "cite the T0 verdict it re-hashed (the order lists them under payload.t0_artifacts)";
+  if (!Array.isArray(verdict.t0_citations) || !verdict.t0_citations.length) {
+    return `the ${verdict.overall} verdict cites no T0 artifact, and a verdict on a scoped spec must ` +
+      "cite the T0 verdict it re-hashed (the order lists them under payload.t0_artifacts)";
+  }
+  for (const citation of verdict.t0_citations) {
+    const reason = unresolvedCitation(cwd, citation);
+    if (reason) return `the ${verdict.overall} verdict ${reason} — a T0 citation is re-hashed from disk, never taken on the handed word`;
+  }
+  return null;
 }
 
 /**