shapeup-sdlc 3.7.3 → 3.7.5

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "shapeup-sdlc-plugin",
   "displayName": "ShapeUp SDLC Plugin",
-  "version": "3.7.3",
+  "version": "3.7.5",
   "description": "Shape Up SDLC harness for Claude Code: shaping, intake, orient, scope-mapping, building (T0-verified, sandboxed, scope-contracted), evaluation and QA skills orchestrated by a tech-lead.",
   "author": {
     "name": "Liberty Nguyen",

package/AGENTS.md

@@ -32,7 +32,7 @@ Betting Table: PO decides; rejected pitches loop back to raw idea.
 | Kick-off | ⏸ **L0** — Intake & Config (L0.8 model/budget matrix) + worker roster ✧ | `/translator` if non-English |
 | Orient (Scout) | ⏸ **L1a** — Orient Review | `/orient` |
 | Requirements | — (reviewed at L1b) | `/ba-pitch-analyzer` (`coverage`): the pitch's clauses → committed `requirements.md`, one atomic clause per `REQ-<n>` row naming the pitch clause it came from, ids assigned once and frozen; dispatched once, ahead of Analyze because the acceptance criteria are what cite its ids. A registry already on disk is not re-dispatched |
-| Analyze | — (reviewed at L1b) | `/ba-pitch-analyzer` (`analyze`): spec tree + board (UC + Invariants + Test Surface ★); before Wire (needs its use cases). An acceptance criterion that grades a requirement carries `(covers: REQ-…)` — that clause is the edge the verdict travels back along |
+| Analyze | — (reviewed at L1b) | `/ba-pitch-analyzer` (`analyze`): spec tree + board (UC + Invariants + Test Surface ★); before Wire (needs its use cases). The tree is committed and the board is per-machine: a run that finds the tree on disk and no board dispatches `board`, which regenerates the board from the tree without re-deriving it — GATE L2 refuses `proceed` over a board with zero tasks. An acceptance criterion that grades a requirement carries `(covers: REQ-…)` — that clause is the edge the verdict travels back along |
 | Wire | ⏸ **L1a.5** — Wiring Review ✚ | `/solution-architect` (`wire`): sole writer of committed `wiring-map.md` — per-UC engine → seam → entry-point call site → affordance, per `project-profile.md` |
 | Map Scopes | ⏸ **L1b** — Board Review (+ substrate disjointness lint) | `/scope-architect` (scope contracts ✦ — sole writer); traceability oracle advisory ✚. A registered requirement that no acceptance criterion grades and no scope claims is **red** here, and L1b prints the `REQ → AC` table: the two ways out are an AC carrying `(covers: REQ-…)` or the PO marking the clause `CUT (PO-approved)`. Red only where the plan is still cheap to change — after L1b nobody re-reads the pitch |
 | Build Vertically | ⏸ **L2** — Board 100% ✅ + T0-green ✦ | per dispatch: compile order → `/task-executor` (--order) → ingest result; T0-verified per attempt (fixtures + DB probe ✦; the seesaw regression arm is declared and not yet wired), substrate-sandboxed ✦. Scopes build **concurrently** ✦ — `--parallel-scopes N` caps it (default 4), a scope is released the moment its own dependencies are green, and a scope green in this round is skipped rather than rebuilt. Then the **round build gate** ⚙: the ledger's run command, then the profile's `build_probe` and `launch_probe`, run once per round before EVAL — a red gate ends the round with no verdict and its failing step is compiled into the next round's orders as bugs; a `mobile` profile with no `launch_probe` is warned about every round, so the install/launch risk has an owner |
@@ -48,7 +48,7 @@ Betting Table: PO decides; rejected pitches loop back to raw idea.
 **Q0** Preflight → **Q1** Charter (6 lenses − EVAL-covered) → **Hunt** (repro required, findings `~` → ledger) → report (no verdict, no score). Skip with `--no-qa`.
 
 ### Ship & Triage
-- **SHIP S.0 / GATE H** — `/scope-hammer`: census (QA findings + discovered ledger + attempt-budget proposals ✦; every "no scope owns X" cites `probe owner`, which derives ownership from the contracts) → baseline comparison (never the ideal) → cut list; TL/PO promotes selected items only.
+- **SHIP S.0 / GATE H** — `/scope-hammer`: census (QA findings + discovered ledger + attempt-budget proposals ✦; every "no scope owns X" cites `probe owner`, which derives ownership from the contracts) → baseline comparison (never the ideal) → cut list; TL/PO promotes selected items only. The census is written as data beside the report, and GATE L4 reads that file — and nothing else — before any answer set may say `ship`. A breaker does not end the run: the run itself dispatches the census, crosses GATE H, writes the ship report with the verdict as it is, crosses L4, and only then closes — `shipped` with the cut list when the census clears it, `escalated` naming the census when it does not.
 - ⏸ **L4** — Ship Sign-off (shows QA status ★).
 - **Coach retro** — L4 feedback → `/coach`; GATE COACH-1 asks the PO which skill owns each rule (never assumes) → committed `shapeup/knowledge-base/<skill>.md` (team inherits on pull). Coachable: `/task-executor`, `/ba-pitch-analyzer`, `/qa-edge-hunter`, `/orient`, `/scope-architect`, `/solution-architect`, and `/tech-lead` (workflow guidance read at L0, plus suggested L0 values it confirms before pinning); `/spec-evaluator` is not (single judge) and neither is `/scope-hammer` (its census cites `probe owner`). **Guidance never decides a gate**: a rule may add a question or a check to a gate block, never an answer, a skip or a wider substrate. `/retro --scan` seeds the same files from the project on disk before the first run, and `/retro --research <stack>` from the platform's official documentation when there is nothing on disk yet (a source, never a verification: nothing it reads runs until the tech lead pins it at L0), optional, every rule confirmed at COACH-1. Mechanism defects file to `knowledge-base/harness-defects.md` as Betting Table raw ideas, never worker steering.
 - Post-fix: `eval --single-pass` → remaining `~` + new feedback → new raw idea.

package/kernel/compile.mjs

@@ -175,6 +175,9 @@ export function ledgerDecisions(ledgerText, scopeId) {
  */
 export const OP_OWNER = {
   analyze: "ba-pitch-analyzer", reconcile: "ba-pitch-analyzer",
+  // `board` regenerates the per-machine board from a committed spec tree without re-deriving the
+  // tree — the half of ANALYZE that does not survive a clone. Same worker, narrower write surface.
+  board: "ba-pitch-analyzer",
   "retrofit-surface": "ba-pitch-analyzer", coverage: "ba-pitch-analyzer",
   "map-scopes": "scope-architect",
   wire: "solution-architect", evaluate: "spec-evaluator", orient: "orient",
@@ -259,6 +262,14 @@ export function substrateFor(operation, { slug, specDir, scope } = {}) {
     case "analyze":
       return { allowed: [`${spec}/**`, `${local}/**`], frozen: [...FROZEN_INTAKE] };
 
+    case "board":
+      // The spec is READ, never written: this operation exists because the tree is already on disk
+      // and the board is not. Task ids renumber per machine by design, so nothing here is committed.
+      return {
+        allowed: [`${local}/tasks/**`, `${working}/**`],
+        frozen: [...FROZEN_SPEC_CORE, ...FROZEN_INTAKE, `${spec}/usecases/*.md`, `${spec}/scope-summary.md`],
+      };
+
     case "reconcile":
       return {
         allowed: [`${local}/tasks/**`, `${spec}/scope-summary.md`, `${working}/**`],
@@ -857,12 +868,22 @@ export async function cli(rawArgv) {
   // receipts ledger EXISTING while carrying no row for the previous attempt: a lane that does not
   // attest dispatches at all (no ledger on disk) cannot be judged by this rule and is waved
   // through, so `--tiny`, a prose round loop and a standalone build are untouched.
-  if (scope?.scope_id && round && attempt > 1) {
+  //
+  // THE RUN KEY IS PART OF THE QUESTION. `attemptEvidence` matches a receipt to an attempt by
+  // `order_id` AND `run_id` — deliberately, so a previous run's receipt over the same slug cannot
+  // answer for this one — and this call used to omit the key. With no key nothing matches, so every
+  // previous attempt read "unattested" and every attempt 2 was refused as unanswered, on every run,
+  // with the receipt, the leg row and the result all on disk. Measured on a live run: one attempt
+  // spent of five, the census reading it spent, and the gate refusing to open the next one three
+  // times over. The ratchet was one attempt deep for as long as the gate has existed. A run with no
+  // readable receipt has no key to ask with and is waved through, like a lane with no ledger.
+  const myRunId = (scope?.scope_id && round && attempt > 1) ? readRunId(cwd, slug) : null;
+  if (scope?.scope_id && round && attempt > 1 && myRunId) {
     const receiptsPath = dispatchReceipts(cwd, slug);
     if (existsSync(receiptsPath)) {
       const prev = attemptEvidence(
         cwd, slug, scope.scope_id, round, attempt - 1,
-        readReceipts(receiptsPath), readLegs(legLedger(cwd, slug)),
+        readReceipts(receiptsPath), readLegs(legLedger(cwd, slug)), myRunId,
       );
       if (prev.state !== "spent") {
         const why = prev.state === "unattested"

package/kernel/gate.mjs

@@ -51,9 +51,10 @@
 //   2  usage / validation error
 
 import { readFileSync, writeFileSync, appendFileSync, existsSync, mkdirSync } from "node:fs";
+import { parseBoard } from "./reduce/board.mjs";
 import { join, dirname } from "node:path";
 import { runArgs } from "./lib/argv.mjs";
-import { gateAnswerCandidates, gates as gatesPath, LOCAL, resultsDir } from "./lib/paths.mjs";
+import { gateAnswerCandidates, gates as gatesPath, LOCAL, resultsDir, tasksDir, hammerCensus } from "./lib/paths.mjs";
 
 export const GATE_IDS = ["L0", "L1a", "L1a.5", "L1b", "L2", "L3", "QA", "H", "L4", "COACH-1"];
 
@@ -110,7 +111,7 @@ export const PRESETS = {
       "L1a": { decision: "proceed", note: "Orient review — advisory read." },
       "L1a.5": { decision: "proceed", note: "Wiring review — checked by trace-lint." },
       "L1b": { decision: "ask", note: "Board review is where scope is actually decided. Not pre-approvable." },
-      "L2": { decision: "proceed", note: "The board facts travel in the gate block itself — green_scopes and hammer_proposals — so a preset answering here is not answering blind. Note there is no board check behind this: the L2 hook was retired into the gate block in v2.0." },
+      "L2": { decision: "proceed", note: "The board facts travel in the gate block itself — green_scopes and hammer_proposals — so a preset answering here is not answering blind. A board with zero tasks is refused here regardless of the answer — the resolver narrows `proceed` to `ask` over an empty board." },
       "L3": { decision: "loop", max_rounds: 3, note: "Loop on FAIL; the breaker ends it." },
       "QA": { decision: "run" },
       "H": { decision: "ask", note: "The cut list changes what ships." },
@@ -186,6 +187,17 @@ export const HAMMER_VERDICTS = ["ship-now", "ship-after-fixes", "cannot-ship"];
  */
 export function censusVerdict(cwd, slug) {
   if (!slug) return null;
+  // The census artifact — written by the hammer at a path its order's substrate permits. The
+  // WorkResult fallback below is kept for a lane that wrote one the old way; a WorkResult may not
+  // carry a verdict under the schema, so in practice the artifact is the only source.
+  try {
+    const c = hammerCensus(cwd, slug);
+    if (existsSync(c)) {
+      const r = JSON.parse(readFileSync(c, "utf8"));
+      const v = r?.verdict ?? null;
+      if (HAMMER_VERDICTS.includes(v)) return v;
+    }
+  } catch { /* unreadable census proves nothing — fall through */ }
   try {
     const p = join(resultsDir(cwd, slug), "hammer.json");
     if (!existsSync(p)) return null;
@@ -218,6 +230,26 @@ export function censusVerdict(cwd, slug) {
  * @returns {object} The result, or an `ask` carrying why `ship` was not available.
  */
 export function narrowToEvidence(r, cwd, slug) {
+  // GATE L2's question is "is the board done", and a preset used to answer it over a board with
+  // zero tasks — 100% of nothing. Measured on a consumer: a committed spec fast-forwarded ANALYZE,
+  // the per-machine board was never regenerated, L2 crossed `proceed` from the `ci` preset and the
+  // frozen report printed `Board 0/0 tasks done`. Same rule as L4 below: an answer set chooses
+  // among allowed answers and cannot supply the evidence that makes one allowed.
+  if (r?.gate === "L2" && r?.status === "ok" && r?.decision === "proceed" && slug) {
+    let tasks = 0;
+    try { tasks = parseBoard(tasksDir(cwd, slug)).length; } catch { tasks = 0; }
+    if (tasks === 0) {
+      return {
+        gate: r.gate, status: "ask", source: r.source, decision: "ask", note: r.note,
+        refused: "proceed", board_tasks: 0,
+        reason: `GATE L2 cannot be answered "proceed": the board has no tasks, so "board 100%" is a ` +
+                `hundred percent of nothing. A committed spec with no per-machine board needs the board ` +
+                `regenerated (operation \`board\`) before this gate means anything. Put the block to ` +
+                `the PO, or regenerate the board first.`,
+      };
+    }
+    return r;
+  }
   if (r?.gate !== "L4" || r?.status !== "ok" || r?.decision !== "ship") return r;
   const verdict = censusVerdict(cwd, slug);
   if (verdict === "ship-now" || verdict === "ship-after-fixes") return r;

package/kernel/lib/paths.mjs

@@ -306,6 +306,16 @@ export const activeOrder = (cwd) => join(localDir(cwd), "active-order");
  */
 export const lastRun = (cwd) => join(localDir(cwd), "last-run");
 
+/**
+ * Scope-hammer's census as DATA — `{verdict, cut_list, …}` — the one artifact GATE L4's resolver
+ * reads before it lets an answer set say `ship`. The hammer's WorkResult may not carry a verdict
+ * (its census is a proposal, never envelope data ingest acts on), and its printed H0/H1/H2 blocks
+ * are prose; this file is the same proposal, written by the same hand, in a shape a gate can read.
+ * Measured before it existed: a green census returned as the worker's report, and L4 could only
+ * record `ask`, because nothing on disk said so.
+ */
+export const hammerCensus = (cwd, slug) => join(localRoot(cwd, slug), "reports", "hammer-census.json");
+
 /**
  * Where the run scripts are staged for launch, inside the project.
  *

package/kernel/probe/resume.mjs

@@ -61,7 +61,8 @@ import { dirname, join, resolve } from "node:path";
 import { runArgs } from "../lib/argv.mjs";
 import { splitFrontmatter, uncoerce } from "../lib/contract.mjs";
 import { globToRegExp } from "../verify/spec.mjs";
-import { intake, harnessRun, wiringMap, projectProfile, scopesDir, resultsDir, ordersDir, orientDir, activeOrder, activeScope, usecasesDir, breadboard, receipt, readReceipt, requirements, exportRunDir, lastRun, readRunId } from "../lib/paths.mjs";
+import { parseBoard } from "../reduce/board.mjs";
+import { intake, harnessRun, wiringMap, projectProfile, scopesDir, resultsDir, ordersDir, orientDir, activeOrder, activeScope, usecasesDir, breadboard, receipt, readReceipt, requirements, exportRunDir, lastRun, readRunId, tasksDir } from "../lib/paths.mjs";
 import { evalVerdict } from "./eval.mjs";
 import { collectRun, writeRun } from "../report/export.mjs";
 
@@ -371,6 +372,21 @@ export function usecasesPath(cwd, slug, specFolder) {
  * @param {string|null} specFolder - The ledger's `spec_folder`, if it names one.
  * @returns {boolean} True when at least one use case (not the index) is on disk.
  */
+/**
+ * Is the per-machine board on disk with at least one task? ANALYZE writes two artifacts in two
+ * tiers — the spec tree, committed, and the board, gitignored — and a fast-forward that asked only
+ * about the committed half walked every later run on a machine, and every run in a fresh checkout,
+ * into a build with a spec and no board: GATE L2 crossed over 0/0 tasks, the evaluator could read no
+ * `covers:` clause, and the requirements projection printed "no evidence" on a round whose static
+ * criteria all passed. Measured on a live consumer, fourth run of one pitch.
+ * @param {string} cwd - Project root.
+ * @param {string} slug - Feature slug.
+ * @returns {boolean} True when the board directory holds at least one task file.
+ */
+export function hasBoard(cwd, slug) {
+  try { return parseBoard(tasksDir(cwd, slug)).length > 0; } catch { return false; }
+}
+
 export function hasSpecTree(cwd, slug, specFolder) {
   const dir = usecasesPath(cwd, slug, specFolder);
   if (!existsSync(dir)) return false;
@@ -385,7 +401,10 @@ export function hasSpecTree(cwd, slug, specFolder) {
  */
 export const PHASE_ARTIFACT = {
   orient: { fact: "has_orient_artifacts", artifact: "orient/{code-surface,discovered-seed,hill-signal}.md + spike-*.md" },
-  analyze: { fact: "has_spec_tree", artifact: "spec/usecases/*.md" },
+  // BOTH HALVES. The spec tree is committed and survives a clone; the board is per-machine and does
+  // not. A phase is complete only when both are on disk — a committed spec with no board resumes AT
+  // analyze, where the workflow dispatches the board-only operation rather than the whole phase.
+  analyze: { fact: "has_spec_tree", also: "has_board", artifact: "spec/usecases/*.md + tasks/TASK-*.md" },
   wire: { fact: "has_wiring_map", artifact: "wiring-map.md" },
   "map-scopes": { fact: "scope_files", artifact: "scopes/*.md" },
 };
@@ -399,8 +418,9 @@ export const PHASES = Object.keys(PHASE_ARTIFACT);
  * @returns {boolean} True when the phase's artifact exists.
  */
 export function phaseSatisfied(state, phase) {
-  const v = state[PHASE_ARTIFACT[phase].fact];
-  return Array.isArray(v) ? v.length > 0 : Boolean(v);
+  const present = (k) => { const v = state[k]; return Array.isArray(v) ? v.length > 0 : Boolean(v); };
+  const p = PHASE_ARTIFACT[phase];
+  return present(p.fact) && (!p.also || present(p.also));
 }
 
 /**
@@ -461,6 +481,7 @@ export function deriveResumeState(cwd, slug) {
     orient_dir: `.shapeup/${slug}/orient/`,
     has_orient_artifacts: hasOrientArtifacts(cwd, slug),
     has_spec_tree: hasSpecTree(cwd, slug, hr.spec_folder || null),
+    has_board: hasBoard(cwd, slug),
     // A PLAIN FACT, DELIBERATELY NOT A PHASE. The requirements registry is dispatched once, before
     // ANALYZE, and the orchestrator guards that one dispatch on this boolean. It is NOT an entry in
     // PHASE_ARTIFACT, and adding it there would be a migration hazard rather than a tidier shape:

package/kernel/schemas/domain.schema.json

@@ -494,7 +494,7 @@
         "execute",
         "fix",
         "spike",
-        "analyze",
+        "analyze", "board",
         "reconcile",
         "retrofit-surface",
         "coverage",
@@ -2537,6 +2537,22 @@
         }
       }
     },
+    "HammerCensus": {
+      "description": "Scope-hammer's census as data — the proposal GATE L4's resolver reads before it lets an answer set say `ship`. Written by the hammer at `.shapeup/<slug>/reports/hammer-census.json`, the only path its order's substrate permits besides the committed report. A proposal, never a decision: promotion and shipping stay the PO's call, and ingest never acts on it.",
+      "x-tier": "LOCAL",
+      "x-location": ".shapeup/<slug>/reports/hammer-census.json",
+      "type": "object",
+      "required": ["schema_version", "verdict", "cut_list"],
+      "properties": {
+        "schema_version": { "const": 1 },
+        "order_id": { "type": "string" },
+        "verdict": { "type": "string", "enum": ["ship-now", "ship-after-fixes", "cannot-ship"] },
+        "cut_list": { "type": "array", "items": { "type": "string" } },
+        "ship_blocking": { "type": "array", "items": { "type": "string" }, "description": "Must-have items that failed the baseline comparison — non-empty exactly when the verdict is cannot-ship." },
+        "breaker": { "type": ["string", "null"] },
+        "baseline": { "type": ["string", "null"], "description": "The baseline the comparison ran against, or null when the pitch's problem statement stood in for it." }
+      }
+    },
     "ResumeState": {
       "description": "The fast-forward derivation: which phase a launch resumes at, derived from artifacts on disk and NEVER from stored state or conversation memory. Produced by kernel/probe/resume.mjs on stdout and consumed by shapeup-run.js's preamble on every launch, fresh or relaunch alike. Every phase predicate is an artifact test — `has_orient_artifacts` exists because the ORIENT branch was once gated on the ledger's stored `status` instead, which a silent courier failure left stale, and a completed ORIENT phase was re-dispatched on resume. `next_phase` is a convenience derived from the same booleans, which all travel too: a caller is never forced to trust a summary it cannot re-derive.",
       "x-tier": "EMBEDDED",
@@ -2635,6 +2651,7 @@
           "type": "boolean",
           "description": "ANALYZE finished: the spec folder's usecases/ carries at least one use case that is not _index.md. WIRE reads these — one wiring-map entry per use case — which is why ANALYZE precedes WIRE in the phase chain: dispatched against an empty spec folder, WIRE escalates on every launch."
         },
+        "has_board": { "type": "boolean", "description": "The per-machine board (tasks/TASK-*.md) holds at least one task. ANALYZE is complete only with both the committed spec tree and this; a committed tree with no board resumes at analyze, where the board-only operation regenerates it." },
         "has_requirements": {
           "type": "boolean",
           "description": "The requirements registry is on disk: shapeup/<slug>/requirements.md exists. A PLAIN FACT, not a phase — the orchestrator guards its single `coverage` dispatch on this boolean, and it is deliberately absent from kernel/probe/resume.mjs's PHASE_ARTIFACT map, which doubles as nextPhase()'s ordered list: an entry there would fast-forward every run recorded before the registry existed to the registry instead of to build."

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shapeup-sdlc",
-  "version": "3.7.3",
+  "version": "3.7.5",
   "description": "Shape Up for coding agents \u2014 with gates the agent can't talk its way past. Harness for Claude Code.",
   "bin": {
     "shapeup-sdlc": "bin/init.mjs"

package/skills/ba-pitch-analyzer/SKILL.md

@@ -24,7 +24,7 @@ Invoked as `--order <path>`. Fields you may rely on (absent = unknown; surface i
 
 | Field | What it is |
 |---|---|
-| `operation` | `analyze` (pitch → full spec tree + board) · `reconcile` (fold discovered-ledger items into the board + UC invariants) · `retrofit-surface` (append `## Test Surface` to a pre-surface spec) · `coverage` (extract atomic requirement clauses → the SHARED `requirements.md` registry) |
+| `operation` | `analyze` (pitch → full spec tree + board) · `board` (committed spec tree → the per-machine board only; the tree is frozen) · `reconcile` (fold discovered-ledger items into the board + UC invariants) · `retrofit-surface` (append `## Test Surface` to a pre-surface spec) · `coverage` (extract atomic requirement clauses → the SHARED `requirements.md` registry) |
 | `payload.pitch` | The pitch/PRD path (analyze) |
 | `payload.breadboard` | The breadboard (analyze): its Places are your screens; its U# and N# are the affordances you place and cite. Absent = none separate; never inferred |
 | `payload.requirements` | (coverage) the REQ source to extract atomic clauses from — pitch / a customer-requirements doc / the use-case bodies. Absent → default to the pitch and record the choice in `assumptions[]` |
@@ -115,10 +115,11 @@ covered AC is a requirement the run can be measured against.
 
 ---
 
-## The other three operations — same craft, different payload + whitelist
+## The other four operations — same craft, different payload + whitelist
 
 | Operation | Essence | Never |
 |---|---|---|
+| `board` | The spec tree is already on disk and committed; the board is per-machine and is not. Regenerate `tasks/` from the use cases as they are — same task derivation as `analyze`, every AC carrying its `(covers: REQ-…)` clause, ids numbered fresh for this machine | touch the spec folder (frozen), re-derive or "improve" a use case, invent a task no UC step or Test Surface row sources |
 | `reconcile` | Verify `ledger.feature == payload.feature` (mismatch → STOP). Map each `[+]` Keep item → its owning UC; new task continues numbering (never renumber); `~`/Cut → synthesis "Hammered Out" row, no file. A Keep item asserting a new invariant → APPEND `[INV-NN]` + TS-INV row to that UC (append-only sections in your substrate). A new actor/action with no UC → `status: "escalated"` + a `deviations[]` spec-ambiguity entry: spawning a UC mid-cycle is silent re-shaping, the PO decides. Finish with board-derive (appetite overflow → report) + spec-lint | re-run phases 1–5; edit UC Steps; resolve the appetite HAMMER yourself |
 | `retrofit-surface` | Append `## Test Surface` (derived rows only, after Error Cases) to each UC of a pre-surface spec; an all-sources-empty UC gets the explicit empty-sources line | touch anything else — append-only substrate |
 | `coverage` | Extract **atomic** customer requirement clauses from `payload.requirements` (default: the pitch) and write the SHARED `shapeup/<slug>/requirements.md` registry: one `\| REQ-id \| clause (verbatim) \| source \| status \| note \|` row per clause. **The `source` cell, and any other prose in this file, cites the committed pitch or shaping doc — never the gitignored run-tier path** (`.shapeup/<slug>/intake.md`, or any other `.shapeup/` path): spec-lint's `TIER-DIRECTION` rule reds a committed file naming that path in ANY form, a bare path in a sentence exactly as much as a `[[tasks/...]]` wikilink, because it dangles on every other clone. When the intake has no committed original to name, describe the run tier without a path (`"the pitch staged for this run"`) rather than citing where it actually lives. Split compound sentences into one testable clause each — a clause lost *inside* a bigger sentence is a requirement nothing can be traced to. **Assign REQ-ids ONCE and freeze them** (they behave like scope_id, never TASK-NNN — every `covers:` link rots otherwise): re-running, append new clauses with fresh ids, mark a removed clause `CUT (PO-approved)`, never renumber or delete. Status starts `covered` (a live requirement); only the PO sets `CUT`. The REQ source itself is frozen — the registry is a separate derived file. **Numbering.** A source clause already carrying an `R<n>` keeps its number — `R12` → `REQ-12` — and its `source` cell records where it came from verbatim (`shaping.md R12`), because that cell is the only thing that survives a re-run. A clause with no R-id takes the next free number ABOVE the highest `R<n>` in the source, so it can never collide with one added later. Splitting a compound clause keeps `REQ-12` for the first atomic part and records `shaping.md R12 (split 2/3)` for the rest — a requirement graded in parts is why splitting matters at all. On a re-run, match an existing id by its frozen `source` cell and clause text, **never** by re-deriving the number from the source's current order | edit the REQ source; renumber existing REQ-ids; delete a dropped clause instead of marking it CUT; invent a requirement not in the source; re-point an existing REQ-id because the source's R-numbers shifted |

package/skills/scope-hammer/SKILL.md

@@ -171,6 +171,19 @@ The WorkResult may carry only `files_touched`, `artifacts`, `assumptions`, `devi
 (`x-result-by-worker`): the census, cut list, and ship verdict live in the report artifact as a
 **proposal** — promotion and shipping stay a human call, never envelope data ingest acts on.
 
+**The census is also written as data**, at `.shapeup/<slug>/reports/hammer-census.json` (inside
+this operation's substrate), shape `HammerCensus` in the domain registry:
+
+```json
+{ "schema_version": 1, "order_id": "<the order>", "verdict": "ship-now | ship-after-fixes | cannot-ship",
+  "cut_list": ["…"], "ship_blocking": ["…"], "breaker": "outer | inner | deadline | null", "baseline": "<path or null>" }
+```
+
+GATE L4's resolver reads this file — and nothing else — before it lets any answer set say `ship`.
+It is the same proposal as the H2 block, written by the same hand, in a shape a gate can read:
+a census that lives only in printed blocks cannot be read by a gate, and a run that reached L4
+with a green census could only be recorded as `ask`. Still a proposal: the file grants nothing.
+
 ---
 
 ## Invocation

package/skills/tech-lead/references/gates.md

@@ -560,9 +560,12 @@ and without it the trace holds no record of that decision at all: `node
 "${CLAUDE_PLUGIN_ROOT}/kernel/harness.mjs" gate --resolve L4 --slug <slug>
 [--file <path>|--preset <name>]`. Exit 0 (`decision=ship|hold`) — render the block above and close
 the run: `node "${CLAUDE_PLUGIN_ROOT}/kernel/harness.mjs" probe resume --slug <slug> --close shipped
---cause "verdict=<verdict> rounds=<r> decision=<ship|hold>"`. Always issue this call — a `gate_h`
-close is the ordinary case where `shapeup-run.js` handed off without closing the run, and the
-GATE H → L4 path (scope-hammer's census, then this gate) is the one this instruction exists for.
+--cause "verdict=<verdict> rounds=<r> decision=<ship|hold>"`. **This applies to the prose lane
+only.** A launched run (`shapeup-run.js`) resolves L4 itself, on both the PASS path and a breaker
+path: it dispatches the census, crosses GATE H, writes the ship report with the verdict as it is,
+crosses L4, and only then closes — `shipped` when the census and L4 clear it, `escalated` naming
+the census when they do not. A run that returned `{status: "shipped"}` or `{status: "gate_h"}` is
+already closed; do not close it again, and do not run the census by hand after it.
 The close itself is a once-only fact IN THE KERNEL (`closeRun`'s own guard reads a `closed_status:`
 line that only `closeRun` ever writes — never the mutable `status:` line every phase rewrites, this
 call included), not a conditional this instruction has to get right: if this run_id was NOT already

package/skills/tech-lead/workflows/shapeup-run.js

@@ -42,7 +42,9 @@
 //   { status: "paused",  paused_at, block, valid_decisions, context }
 //   { status: "aborted", aborted_at, reason }
 //   { status: "gate_h",  breaker: "outer"|"attempt_budget"|"none"|"deadline", hammer_proposals, green_scopes,
-//                        tripped_scopes?, unapplied_results? }
+//                        tripped_scopes?, unapplied_results?, census?, cut_list?, l4? }
+//     — returned only when the census said cannot-ship, L4 said hold, or the ship report was
+//       refused; a breaker whose census clears the run ends as `shipped` with `after: "gate_h"`.
 
 // meta must be a PURE LITERAL — the runtime parses it statically, before the body ever runs, and
 // rejects the whole script on anything it has to evaluate. A `+`-joined description is a
@@ -411,6 +413,7 @@ const RESUME = {
     eval_dimensions: { type: "array", items: { type: "string" } },
     has_orient_artifacts: { type: "boolean" },
     has_spec_tree: { type: "boolean" },
+    has_board: { type: "boolean" },
     // The requirements registry — a fact, not a phase. See the COVERAGE block below for why it is
     // guarded on this bare boolean and never asked about through `probe resume --require`.
     has_requirements: { type: "boolean" },
@@ -624,6 +627,69 @@ const HAMMER = {
   required: ["ok", "verdict", "cut_list"],
 };
 
+/** What every hammer dispatch is told, on the PASS path and the breaker path alike. */
+const HAMMER_EXTRA =
+  "Run the census, compare against the BASELINE and never the ideal, and produce the cut list. " +
+  "Write the census as data to `reports/hammer-census.json` under the run's local root — the " +
+  "`reports/**` entry in your order's substrate names the directory — with schema_version 1, " +
+  "order_id, verdict (ship-now | ship-after-fixes | cannot-ship), cut_list, ship_blocking, breaker, " +
+  "baseline — beside the human-readable report. GATE L4's resolver reads that file and nothing " +
+  "else before it lets any answer set say `ship`; a census that lives only in your printed blocks " +
+  "cannot be read by a gate.";
+
+/**
+ * A breaker routed the run to GATE H. This used to be a terminal return: the loop handed back
+ * `{status: "gate_h"}`, the close-out stamped the ledger `escalated` and retired the pointers, and
+ * the census, GATE H, the ship report and GATE L4 all happened AFTER the close, in the tech
+ * lead's prose — so the census reached no artifact, `gates.jsonl` held no H and no L4, and a later
+ * `--close shipped` was refused over the `escalated` fact already on the ledger. Measured on three
+ * consumer runs. AGENTS.md has always said what a breaker means: "ship what's green, never kill the
+ * run from outside". So the run does that itself, in this launch: the hammer census (an artifact),
+ * GATE H (a row), the ship report (with the verdict as it is, FAIL or not-evaluated included), and
+ * GATE L4 (a row) — and only then a close, `shipped` or `escalated`, that names the census.
+ *
+ * QA never ran on this path (it sits after a PASS), so the census is told so plainly. `qaFindings`
+ * is declared after the round loop and must not be read from here.
+ *
+ * @param {object} ret - The gate_h return the round loop built.
+ * @returns {Promise<object>} The RunReturn that actually ends the run.
+ */
+async function settleAtGateH(ret) {
+  phase("Ship");
+  const h = await worker({
+    skill: "scope-hammer", operation: "hammer", schema: HAMMER, phase: "Ship", label: "hammer",
+    payload: { feature: slug, qa_findings: 0, hammer_proposals: ret.hammer_proposals || [], breaker: ret.breaker ?? null },
+    extra: HAMMER_EXTRA,
+  });
+  if (h.__failed) return await withWarnings(diedAt("H", h));
+  {
+    const g = await crossGate("H", "Ship", ["accept-cut-list", "ship-all", "ask"],
+      { verdict: h.verdict, cut_list: h.cut_list, breaker: ret.breaker ?? null, green_scopes: ret.green_scopes, hammer_proposals: ret.hammer_proposals });
+    if (g.stop) return await withWarnings(g.stop);
+  }
+  if (h.verdict === "cannot-ship") {
+    return await withWarnings({ ...ret, census: "cannot-ship", cut_list: h.cut_list });
+  }
+  const hVerdict = verdict === "pass" ? "PASS" : verdict === "fail" ? "FAIL" : "not-evaluated";
+  const ship = await cmd(`reduce ship --slug ${slug} --verdict ${hVerdict} --qa skipped`, "Ship", "ship-report");
+  if (!ship.ok) {
+    return await withWarnings({ ...ret, census: h.verdict, cut_list: h.cut_list, ship_report: `refused: ${ship.detail || `exit ${ship.exit_code}`}` });
+  }
+  {
+    const g = await crossGate("L4", "Ship", ["ship", "hold", "ask"], { verdict: hVerdict, census: h.verdict, cut_list: h.cut_list, breaker: ret.breaker ?? null });
+    if (g.stop) return await withWarnings(g.stop);
+    if (g.decision === "hold") return await withWarnings({ ...ret, census: h.verdict, cut_list: h.cut_list, l4: "hold" });
+  }
+  await advisory(`report export --slug ${slug}`, "Ship", "export-run");
+  await setRunStatus("shipped", "Ship");
+  return await withWarnings({
+    status: "shipped", verdict, rounds_used: round, after: "gate_h", breaker: ret.breaker ?? null,
+    census: h.verdict, cut_list: h.cut_list, green_scopes: ret.green_scopes,
+    unapplied_results: ret.unapplied_results || [], qa_findings: 0,
+    report: ship.detail || `shapeup/${slug}/REPORT.md`,
+  });
+}
+
 // ---------------------------------------------------------------------------------------------
 // DISPATCH — three shapes, and none of them parses text.
 //
@@ -859,13 +925,15 @@ const attest = (phaseKey, phaseName, label) =>
  * rather than folding the gap into a phase that "completed".
  *
  * @param {string} gate - The gate name to report the abort under.
- * @param {string} phaseKey - The phase, which is also its order's file stem.
+ * @param {string} phaseKey - The phase.
  * @param {string} phaseName - Progress group.
+ * @param {string} [orderStem=phaseKey] - The order's file stem, when the phase was dispatched
+ *   under a different operation (a board-only ANALYZE compiles `board.json`).
  * @returns {Promise<(object|null)>} An aborted RunReturn, or null when the leg closed (or the
  *   question could not be asked — a probe that did not run proves nothing, and is logged as such).
  */
-async function requireLeg(gate, phaseKey, phaseName) {
-  const ask = () => query(`probe leg --slug ${slug} --order "${phaseKey}"`, ORDERLEG, phaseName, `legcheck:${phaseKey}`);
+async function requireLeg(gate, phaseKey, phaseName, orderStem = phaseKey) {
+  const ask = () => query(`probe leg --slug ${slug} --order "${orderStem}"`, ORDERLEG, phaseName, `legcheck:${orderStem}`);
   let leg = await ask();
   if (!leg || !leg.found) { log(`${gate} — could not ask the leg ledger about "${phaseKey}" (probe returned ${leg ? "no order" : "nothing"}); proceeding on the artifact alone.`); return null; }
   if (!leg.has_result || leg.applied) return null;
@@ -891,9 +959,9 @@ async function requireLeg(gate, phaseKey, phaseName) {
  * @param {string} phaseName - Progress group.
  * @returns {Promise<(object|null)>} An aborted RunReturn, or null when the artifact is there.
  */
-async function requirePhase(gate, phaseKey, phaseName) {
+async function requirePhase(gate, phaseKey, phaseName, orderStem = phaseKey) {
   const r = await attest(phaseKey, phaseName, `require:${phaseKey}`);
-  if (r.exit_code === 0) return await requireLeg(gate, phaseKey, phaseName);
+  if (r.exit_code === 0) return await requireLeg(gate, phaseKey, phaseName, orderStem);
   // Exit 6 is `probe resume --require`'s OWN documented code for "the artifact really is not on
   // disk" (kernel/probe/resume.mjs banner). Any other value — including -1, the courier's sentinel
   // for a tool call that never ran — is not that predicate answering "no"; it is the predicate never
@@ -1069,7 +1137,9 @@ async function closeIfTerminal(ret) {
       + (Array.isArray(ret.tripped_scopes) ? ` tripped_scopes=${ret.tripped_scopes.length}` : "")
       // A result the single writer never applied is named at the close, not folded into "not green".
       + (Array.isArray(ret.unapplied_results) && ret.unapplied_results.length ? ` unapplied_results=${ret.unapplied_results.length}` : "")
-    : `verdict=${ret.verdict ?? "?"} rounds=${ret.rounds_used ?? "?"} qa_findings=${ret.qa_findings ?? "?"}`;
+      + (ret.census ? ` census=${ret.census}` : "") + (ret.l4 ? ` l4=${ret.l4}` : "") + (ret.ship_report ? ` ship_report=${ret.ship_report}` : "")
+    : `verdict=${ret.verdict ?? "?"} rounds=${ret.rounds_used ?? "?"} qa_findings=${ret.qa_findings ?? "?"}`
+      + (ret.after ? ` after=${ret.after} breaker=${ret.breaker ?? "?"} census=${ret.census ?? "?"} cut_list=${Array.isArray(ret.cut_list) ? ret.cut_list.length : "?"}` : "");
   // `--close-arm` hands the kernel the arm itself (not a status this file decided was terminal) —
   // a non-terminal arm (`paused`, `ok`) still exits 0 with no "decision" key, so the branches below
   // stay silent for it exactly as they did when this file's own guard returned early.
@@ -1254,8 +1324,28 @@ if (!rs.has_spec_tree) {
   const post = await requirePhase("ANALYZE", "analyze", "Analyze");
   if (post) return await withWarnings(post);
   await advisory(`reduce graph --slug ${slug}`, "Analyze", "graph:analyze");
+} else if (!rs.has_board) {
+  // THE HALF THAT DOES NOT SURVIVE. The spec tree is committed; the board is per-machine and
+  // gitignored, and ANALYZE writes both. A run after the first on a machine — and every run in a
+  // fresh checkout — used to fast-forward on the committed half alone and build over no board:
+  // GATE L2 crossed 0/0 tasks, the evaluator could read no `covers:` clause, and the requirements
+  // projection said "no evidence" for a round whose static criteria all passed. The board-only
+  // operation regenerates it from the tree without re-deriving the tree.
+  log(`ANALYZE — spec tree on disk, no board: dispatching the board-only operation (slug ${slug})`);
+  await setRunStatus("mapping", "Analyze");
+  const b = await worker({
+    skill: "ba-pitch-analyzer", operation: "board", schema: PHASE_OK, phase: "Analyze", label: "board",
+    payload: { spec_folder: specFolder, feature: slug, lens: rs.lens },
+    extra: "The spec tree is committed and FROZEN for this dispatch. Regenerate the per-machine board " +
+           "under the run's tasks/ directory from the use cases on disk — every acceptance criterion " +
+           "carrying its `(covers: REQ-…)` clause — and write nothing under the spec folder.",
+  });
+  if (b.__failed) return await withWarnings(diedAt("ANALYZE", b));
+  const post = await requirePhase("ANALYZE", "analyze", "Analyze", "board");
+  if (post) return await withWarnings(post);
+  await advisory(`reduce graph --slug ${slug}`, "Analyze", "graph:board");
 } else {
-  const post = await fastForward("ANALYZE", "analyze", "Analyze", "spec tree already on disk");
+  const post = await fastForward("ANALYZE", "analyze", "Analyze", "spec tree and board already on disk");
   if (post) return await withWarnings(post);
 }
 
@@ -1476,7 +1566,7 @@ while (verdict !== "pass" && round <= maxRounds) {
   const budget = await cmd(`verify budget --slug ${slug} --strict`, "Build", `budget:r${round}`);
   if (budget.exit_code === 6) {
     await advisory(`reduce hill --slug ${slug}`, "Build", "hill-derive");
-    return await withWarnings({ status: "gate_h", breaker: "deadline", unapplied_results: allUnapplied, hammer_proposals: allHammer, green_scopes: allGreen });
+    return await settleAtGateH({ status: "gate_h", breaker: "deadline", unapplied_results: allUnapplied, hammer_proposals: allHammer, green_scopes: allGreen });
   }
 
   log(`BUILD round ${round} — ${scopes.length} scope(s), up to ${maxParallelScopes} at once, attempt budget ${attemptBudget}`);
@@ -1640,7 +1730,7 @@ while (verdict !== "pass" && round <= maxRounds) {
       if (census?.tripped) tripped.push(sid);
     }
     await advisory(`reduce hill --slug ${slug}`, "Build", "hill-derive");
-    return await withWarnings({
+    return await settleAtGateH({
       status: "gate_h", breaker: tripped.length ? "attempt_budget" : "none", stalled: "no_green",
       tripped_scopes: tripped, unapplied_results: allUnapplied,
       hammer_proposals: allHammer, green_scopes: allGreen,
@@ -1755,13 +1845,13 @@ while (verdict !== "pass" && round <= maxRounds) {
   // SHIP" once EVAL is skipped, never spends another round waiting on a verdict nobody is producing.
   if (verdict === "pass" || verdict === "not-evaluated") break;   // → QA → GATE H → ship
   if (g3.decision === "stop" || round >= maxRounds) {
-    return await withWarnings({ status: "gate_h", breaker: "outer", unapplied_results: allUnapplied, hammer_proposals: allHammer, green_scopes: allGreen });
+    return await settleAtGateH({ status: "gate_h", breaker: "outer", unapplied_results: allUnapplied, hammer_proposals: allHammer, green_scopes: allGreen });
   }
   round += 1;
 }
 
 if (verdict !== "pass" && verdict !== "not-evaluated") {
-  return await withWarnings({ status: "gate_h", breaker: "outer", unapplied_results: allUnapplied, hammer_proposals: allHammer, green_scopes: allGreen });
+  return await settleAtGateH({ status: "gate_h", breaker: "outer", unapplied_results: allUnapplied, hammer_proposals: allHammer, green_scopes: allGreen });
 }
 
 // ---- QA (post-PASS, pre-ship) — a level-up, never a gate. `--no-qa` answers it "skip". --------
@@ -1786,7 +1876,7 @@ phase("Ship");
 const h = await worker({
   skill: "scope-hammer", operation: "hammer", schema: HAMMER, phase: "Ship", label: "hammer",
   payload: { feature: slug, qa_findings: qaFindings, hammer_proposals: allHammer },
-  extra: "Run the census, compare against the BASELINE and never the ideal, and produce the cut list.",
+  extra: HAMMER_EXTRA,
 });
 if (h.__failed) return await withWarnings(diedAt("H", h));
 if (h.verdict === "cannot-ship") {
@@ -1804,6 +1894,14 @@ if (h.verdict === "cannot-ship") {
 // default). Hardcoding PASS here is exactly the silent upgrade protocol.md's Rules forbid.
 const shipVerdict = verdict === "not-evaluated" ? "not-evaluated" : "PASS";
 const ship = await cmd(`reduce ship --slug ${slug} --verdict ${shipVerdict} --qa ${qaRan ? "run" : "skipped"}`, "Ship", "ship-report");
+// GATE L4 HAS A CALL SITE. It used to be a line of prose in the tech lead's references — "resolve
+// the gate itself before any of the above" — and a run reached its ship decision with no ledger row
+// for it. The resolver narrows `ship` on the census artifact the hammer just wrote.
+{
+  const g = await crossGate("L4", "Ship", ["ship", "hold", "ask"], { verdict: shipVerdict, census: h.verdict, cut_list: h.cut_list });
+  if (g.stop) return await withWarnings(g.stop);
+  if (g.decision === "hold") return await withWarnings({ status: "aborted", aborted_at: "L4", reason: `GATE L4 answered "hold" (census ${h.verdict}, verdict ${shipVerdict})` });
+}
 await advisory(`report export --slug ${slug}`, "Ship", "export-run");
 // The run's own concurrency, printed once where the records are complete and before the next run
 // supersedes the trace. It is a projection over `receipts/dispatch.jsonl` and `legs.jsonl`, so it