shapeup-sdlc 3.7.5 → 3.7.7

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "shapeup-sdlc-plugin",
   "displayName": "ShapeUp SDLC Plugin",
-  "version": "3.7.5",
+  "version": "3.7.7",
   "description": "Shape Up SDLC harness for Claude Code: shaping, intake, orient, scope-mapping, building (T0-verified, sandboxed, scope-contracted), evaluation and QA skills orchestrated by a tech-lead.",
   "author": {
     "name": "Liberty Nguyen",

package/AGENTS.md

@@ -13,7 +13,7 @@ Skills and commands are named short throughout this file; every one of them reso
 - **The single writer is asked, never assumed.** A dispatch's result is applied by exactly one act — the ingest step — and that act leaves a leg row. Every phase post-condition and every settled build scope asks the leg ledger whether the row exists before any verdict on the phase or the scope, whatever the worker reported: a result on disk that nothing applied is ingested there if the scope is green, and otherwise named at the close as `unapplied_results=N`, never folded into "not green". A round that ends with nothing green names `breaker=none` and `stalled=no_green` unless the attested attempt census says a scope tripped — the close cannot name a breaker the census denies. The run graph carries a `Leg` node with an `INGESTED` edge from its `Result`, and the export a `leg` table, so "which results were never read" is one query.
 - GATE L2 is advisory — warns when EVAL runs over unfinished tasks, permits the call (per-machine board, operator asked; ADR-0001) — a signal, not a bug.
 - Sign-off is a file: each gate resolves from the answer set (`ci`/`guarded`/`interactive`) — cross, stop for the PO, or abort; the decision's source is ledgered.
-- **Every ending a run does not come back from records a close** — its status, its cause and its timestamp — derived from the ending itself rather than from a hand-kept pair, so an ending nobody enumerated cannot silently record nothing. A breaker trip that routes to GATE H closes the run as `escalated`, carrying the breaker in its cause; a pause records no close **by design**, because a relaunch resumes it.
+- **Every ending a run does not come back from records a close** — its status, its cause and its timestamp — derived from the ending itself rather than from a hand-kept pair, so an ending nobody enumerated cannot silently record nothing. The same close derives the ledger's verdict, its round count and its Rounds and Decisions tables from the run's own records — the ones the export reads — so the file a teammate opens first cannot contradict its own close line. A breaker trip that routes to GATE H closes the run as `escalated`, carrying the breaker in its cause; a pause records no close **by design**, because a relaunch resumes it.
 - **Your scope cut decides your concurrency, not the dial.** Two scopes that both declare a write to one path never build at the same time: `shared` substrate is the sanctioned escape from disjointness, and an edit is read-modify-write, so concurrent writers silently drop each other's work. An entry point listed as writable by five scopes therefore builds five scopes one at a time whatever `--parallel-scopes` says. The run states the ceiling its contracts actually permit before dispatching anything, as a BUILD-order line — a peak below that ceiling is a dispatch problem, a ceiling below the dial is a scope-cut problem, and only the second is fixable by re-cutting. The fix is a cut where exactly one scope owns each entry point. Note the ceiling is narrated, not gated: it does not travel in the ⏸ L1b block, so an unattended run carries it only in its log.
 - The build+eval loop breaks only three ways ✦: EVAL PASS → QA → Ship; outer `round_budget` exhausted; opt-in `wall_clock_budget_s` tripped (the wall-clock axis event counters miss). Budget trips route to GATE H — ship what's green, never kill the run from outside. A scope exhausting its per-scope `attempt_budget` (T0 attempts) queues a GATE H proposal, never blocks the round. **An attempt is spent only when the attested channels say so** — a dispatch receipt, plus a leg row or a WorkResult. A compiled order and a T0 verdict are both writable by the scope being judged, so neither counts on its own, and an attempt still in flight holds the breaker open rather than tripping it. Opening the next attempt over an unanswered one is refused outright, because grading a tree the previous attempt may still be writing spends a budget on work nobody did.
 

package/kernel/compile.mjs

@@ -246,7 +246,10 @@ export function substrateFor(operation, { slug, specDir, scope } = {}) {
   // not cover is a leg forging a SIBLING's result, which is a real hole with a different fix — the
   // glob form here cannot say "every result except this order's own", so closing it needs a
   // mechanism rather than one more entry on this list.
-  const FROZEN_ATTESTATION = [`${local}/receipts/**`, `${local}/legs.jsonl`, `${local}/t0/verdicts/**`];
+  // The board index is ingest's projection of the task results, not the doer's bookkeeping — the
+  // task files are. The executor's contract already forbids editing it; the freeze makes that a
+  // denial rather than a rule, on the same terms as the attestation channels.
+  const FROZEN_ATTESTATION = [`${local}/receipts/**`, `${local}/legs.jsonl`, `${local}/t0/verdicts/**`, `${local}/tasks/_index.md`];
   switch (operation) {
     case "execute": case "fix": case "spike":
       // Build legs are the widest window on FROZEN_INTAKE, not an exemption from it: they are the

package/kernel/gate.mjs

@@ -54,7 +54,7 @@ import { readFileSync, writeFileSync, appendFileSync, existsSync, mkdirSync } fr
 import { parseBoard } from "./reduce/board.mjs";
 import { join, dirname } from "node:path";
 import { runArgs } from "./lib/argv.mjs";
-import { gateAnswerCandidates, gates as gatesPath, LOCAL, resultsDir, tasksDir, hammerCensus } from "./lib/paths.mjs";
+import { gateAnswerCandidates, gates as gatesPath, LOCAL, resultsDir, tasksDir, hammerCensus, readRunId } from "./lib/paths.mjs";
 
 export const GATE_IDS = ["L0", "L1a", "L1a.5", "L1b", "L2", "L3", "QA", "H", "L4", "COACH-1"];
 
@@ -465,7 +465,11 @@ export function cli(rawArgv) {
   // per-run ledger row — the same reasoning `resolveRunId` uses for "no run is active": absence is
   // the correct answer, not an error, so the write is skipped rather than guessing a location.
   if (args.slug) {
+    // THE ROW CARRIES THE RUN KEY. It did not, and the export stamped the current run's key onto
+    // every row it found — a prior run's sign-off became this run's in the one table that answers
+    // "was this ship signed off". Driven on a two-run fixture before it was fixed.
     appendGateLedger(cwd, args.slug, {
+      at: new Date().toISOString(), run_id: readRunId(cwd, args.slug),
       gate: r.gate, status: r.status, decision: r.decision ?? null,
       source: r.source ?? found.source, note: r.note ?? r.reason ?? null,
       round: args.round ?? null,

package/kernel/probe/eval.mjs

@@ -35,7 +35,7 @@ import { existsSync, readFileSync, readdirSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { createHash } from "node:crypto";
 import { runArgs } from "../lib/argv.mjs";
-import { resultsDir, scopesDir } from "../lib/paths.mjs";
+import { resultsDir, scopesDir, readRunId } from "../lib/paths.mjs";
 
 /** Longest `reason` reported. A deviation is prose written by a worker and can run to paragraphs. */
 const REASON_MAX = 400;
@@ -89,7 +89,7 @@ export function isScoped(cwd, slug) {
  * @returns {(string|null)} A reason phrased for an operator, or null when the file at `path` exists,
  *   hashes to the cited `sha256`, and its own `overall` reads "green".
  */
-function unresolvedCitation(cwd, citation) {
+function unresolvedCitation(cwd, citation, { round = null, runId = null } = {}) {
   const rel = typeof citation?.path === "string" ? citation.path : "";
   if (!rel) return "names no artifact path";
   let text;
@@ -109,6 +109,20 @@ function unresolvedCitation(cwd, citation) {
   try { body = JSON.parse(text); }
   catch { return `cites ${rel}, whose bytes match the hash but do not read as a T0 verdict`; }
   if (body?.overall !== "green") return `cites ${rel}, whose own verdict is "${body?.overall ?? "unknown"}", not green`;
+  // THE ARTIFACT HAS TO BE THE ONE THE CITATION SAYS IT IS. A re-hash proves the bytes are the
+  // file's; it says nothing about whose verdict the file holds. A PASS citing scope alpha's green
+  // artifact while declaring scope beta, or a prior round's, or a prior run's over the same slug,
+  // passed the digest check unremarked. The citation's own required `scope_id`, the round being
+  // judged and the run's key are compared to what the artifact records about itself.
+  if (typeof citation.scope_id === "string" && body?.scope_id && body.scope_id !== citation.scope_id) {
+    return `cites ${rel} for scope "${citation.scope_id}", but the artifact records scope "${body.scope_id}"`;
+  }
+  if (round != null && typeof body?.round === "number" && body.round !== round) {
+    return `cites ${rel}, a round ${body.round} artifact, as evidence for round ${round}`;
+  }
+  if (runId && body?.run_id && body.run_id !== runId) {
+    return `cites ${rel}, an artifact of run ${body.run_id}, as evidence for run ${runId}`;
+  }
   return null;
 }
 
@@ -143,15 +157,49 @@ function unresolvedCitation(cwd, citation) {
  *   citation resolves, an unscoped spec, or a block with no PASS/FAIL in it (there is no judgement
  *   to invalidate).
  */
-export function citationProblem(cwd, slug, verdict) {
+/**
+ * Why a verdict cannot stand on its own criteria, or null when it can.
+ *
+ * `overall` is the judge's field, and nothing recomputed it from the criteria the judge graded: a
+ * PASS over a failing criterion, or over no criterion at all, validated and ingested, and the
+ * round loop branched on it. The evaluator's own first rule is that absence of evidence is a FAIL,
+ * so a PASS criterion with no evidence is no evidence either. Recomputed here, on ingest and on
+ * read alike: PASS means every graded criterion passed with evidence and at least one was graded;
+ * FAIL means at least one graded criterion failed.
+ *
+ * @param {object} verdict - The WorkResult's `verdict`.
+ * @returns {(string|null)} A reason phrased for an operator, or null.
+ */
+export function verdictProblem(verdict) {
+  const overall = verdict?.overall;
+  if (overall !== "PASS" && overall !== "FAIL") return null;
+  const criteria = Array.isArray(verdict.criteria) ? verdict.criteria : [];
+  const fails = criteria.filter((c) => c?.verdict === "FAIL");
+  const passes = criteria.filter((c) => c?.verdict === "PASS");
+  const other = criteria.length - fails.length - passes.length;
+  if (overall === "PASS") {
+    if (criteria.length === 0) return "the PASS verdict grades no criterion at all — a PASS with no evidence is a claim";
+    if (fails.length) return `the verdict says PASS while ${fails.length} of its ${criteria.length} criteria read FAIL — overall is derived from the criteria, never declared over them`;
+    if (other) return `the verdict says PASS while ${other} of its criteria carry no PASS/FAIL verdict`;
+    const bare = passes.filter((c) => !(typeof c?.evidence === "string" && c.evidence.trim()));
+    if (bare.length) return `the PASS verdict has ${bare.length} criterion(s) marked PASS with no evidence — absence of evidence is a FAIL by the evaluator's own first rule`;
+    return null;
+  }
+  if (criteria.length === 0) return "the FAIL verdict grades no criterion at all — a FAIL must name what failed";
+  if (!fails.length) return `the verdict says FAIL while every one of its ${criteria.length} graded criteria reads PASS — a FAIL must cite the criterion it failed`;
+  return null;
+}
+
+export function citationProblem(cwd, slug, verdict, { round = null } = {}) {
   if (verdict?.overall !== "PASS" && verdict?.overall !== "FAIL") return null;
   if (!isScoped(cwd, slug)) return null;
   if (!Array.isArray(verdict.t0_citations) || !verdict.t0_citations.length) {
     return `the ${verdict.overall} verdict cites no T0 artifact, and a verdict on a scoped spec must ` +
       "cite the T0 verdict it re-hashed (the order lists them under payload.t0_artifacts)";
   }
+  const runId = readRunId(cwd, slug);
   for (const citation of verdict.t0_citations) {
-    const reason = unresolvedCitation(cwd, citation);
+    const reason = unresolvedCitation(cwd, citation, { round, runId });
     if (reason) return `the ${verdict.overall} verdict ${reason} — a T0 citation is re-hashed from disk, never taken on the handed word`;
   }
   return null;
@@ -185,7 +233,7 @@ export function evalVerdict(cwd, slug, round) {
       ? `the evaluator returned ${status || "no status"}: ${first}`
       : `status ${status || "unknown"} with no PASS/FAIL verdict`), status);
   }
-  const problem = citationProblem(cwd, slug, v);
+  const problem = verdictProblem(v) || citationProblem(cwd, slug, v, { round });
   if (problem) return unfit(problem, status, overall);
   return {
     found: true,

package/kernel/probe/leg.mjs

@@ -27,7 +27,7 @@
 import { existsSync, readdirSync, readFileSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { runArgs } from "../lib/argv.mjs";
-import { ordersDir, resultsDir, legLedger } from "../lib/paths.mjs";
+import { ordersDir, resultsDir, legLedger, dispatchReceipts, readRunId } from "../lib/paths.mjs";
 
 /** `<scope>-r<round>-a<attempt>.json` — the only address a build order is written under. */
 const BUILD_ORDER = /^(.+)-r(\d+)-a(\d+)\.json$/;
@@ -80,6 +80,12 @@ export function legsOf(cwd, slug) {
   const ingested = new Set(readLegs(legLedger(cwd, slug))
     .filter((r) => r.ingested_at)
     .map((r) => String(r.order_id)));
+  // Dispatch receipts are the hook layer's record that a Skill was invoked against an order —
+  // scoped to this run, since receipts over one slug accumulate across runs and order ids repeat.
+  const runId = readRunId(cwd, slug);
+  const receipted = new Set(readLegs(dispatchReceipts(cwd, slug))
+    .filter((r) => r?.order_id && (!runId || !r.run_id || r.run_id === runId))
+    .map((r) => String(r.order_id)));
   const out = [];
   for (const f of (existsSync(oDir) ? readdirSync(oDir) : []).filter((x) => x.endsWith(".json")).sort()) {
     let orderId = null;
@@ -88,6 +94,7 @@ export function legsOf(cwd, slug) {
       order: join(oDir, f),
       name: f.replace(/\.json$/, ""),
       order_id: orderId,
+      has_receipt: orderId !== null && receipted.has(orderId),
       has_result: existsSync(join(rDir, f)),
       applied: orderId !== null && ingested.has(orderId),
     });
@@ -104,10 +111,25 @@ export function legsOf(cwd, slug) {
  */
 export function orderLegState(cwd, slug, name) {
   const o = legsOf(cwd, slug).find((x) => x.name === name);
-  if (!o) return { closed: false, found: false, order: null, order_id: null, has_result: false, applied: false };
+  if (!o) return { closed: false, found: false, order: null, order_id: null, has_receipt: false, has_result: false, applied: false };
   return { closed: o.applied, found: true, ...o };
 }
 
+/**
+ * Orders that were dispatched — a receipt says a Skill ran against them — and never answered:
+ * no WorkResult on disk. Measured on a live run: the first dispatch wrote its four artifacts and
+ * no envelope, every later phase read the artifacts, and the run closed `shipped` with the order
+ * still open by construction — the export's own dispatch row said `answered: false` and nothing
+ * upstream of it had noticed. Distinct from {@link openLegs}: that is work nobody applied; this is
+ * a leg that never came back.
+ * @param {string} cwd - Project root.
+ * @param {string} slug - Feature slug.
+ * @returns {{order:string, name:string, order_id:(string|null)}[]}
+ */
+export function unansweredOrders(cwd, slug) {
+  return legsOf(cwd, slug).filter((o) => o.has_receipt && !o.has_result);
+}
+
 /**
  * The results on disk that no leg row applied — finished work the board never saw.
  * @param {string} cwd - Project root.
@@ -171,8 +193,13 @@ export function cli(rawArgv) {
   // `--open`: every result nothing applied, across the whole run, any phase. Exit 0 when none.
   if (args.open) {
     const open = openLegs(cwd, args.slug);
-    console.log(JSON.stringify({ closed: open.length === 0, open_total: open.length, open: open.map((o) => o.order), open_ids: open.map((o) => o.order_id) }));
-    process.exit(open.length === 0 ? 0 : 1);
+    const unanswered = unansweredOrders(cwd, args.slug);
+    console.log(JSON.stringify({
+      closed: open.length === 0 && unanswered.length === 0,
+      open_total: open.length, open: open.map((o) => o.order), open_ids: open.map((o) => o.order_id),
+      unanswered_total: unanswered.length, unanswered: unanswered.map((o) => o.order), unanswered_ids: unanswered.map((o) => o.order_id),
+    }));
+    process.exit(open.length === 0 && unanswered.length === 0 ? 0 : 1);
   }
   // `--order <stem>`: one order by file stem (`analyze`, `alpha-r1-a1`). Exit 0 when its leg closed.
   if (args.order) {

package/kernel/probe/resume.mjs

@@ -62,8 +62,9 @@ import { runArgs } from "../lib/argv.mjs";
 import { splitFrontmatter, uncoerce } from "../lib/contract.mjs";
 import { globToRegExp } from "../verify/spec.mjs";
 import { parseBoard } from "../reduce/board.mjs";
-import { intake, harnessRun, wiringMap, projectProfile, scopesDir, resultsDir, ordersDir, orientDir, activeOrder, activeScope, usecasesDir, breadboard, receipt, readReceipt, requirements, exportRunDir, lastRun, readRunId, tasksDir } from "../lib/paths.mjs";
+import { intake, harnessRun, wiringMap, projectProfile, scopesDir, resultsDir, ordersDir, orientDir, activeOrder, activeScope, usecasesDir, breadboard, receipt, readReceipt, requirements, exportRunDir, lastRun, readRunId, tasksDir, gates, verdictsDir, roundBuildDir } from "../lib/paths.mjs";
 import { evalVerdict } from "./eval.mjs";
+import { deriveRounds } from "./rounds.mjs";
 import { collectRun, writeRun } from "../report/export.mjs";
 
 /** The run-state values `references/protocol.md` (Part 4 — State) defines. A typo'd status is a rejection,
@@ -560,7 +561,83 @@ export function setRunStatus(cwd, slug, status) {
  *   already normalized prose (newlines collapsed, truncated) — this function only `uncoerce`s it.
  * @returns {string} The rewritten text.
  */
-function writeCloseLines(body, { status, closedAt, cause }) {
+/**
+ * What the ledger's front matter and tables should say at a close, derived from the run's own
+ * records — the same ones the export reads. The counters (`final_verdict`, `rounds_used`) and the
+ * Rounds/Decisions tables used to be hand-shaped placeholders nothing filled: a run closed
+ * `shipped` beside `final_verdict: ~`, `rounds_used: 0`, an empty Decisions table and seven rows in
+ * `gates.jsonl`. A reader who trusted the counters concluded no round ran. Measured live.
+ *
+ * @param {string} cwd - Project root.
+ * @param {string} slug - Feature slug.
+ * @returns {{final_verdict:string, rounds_used:(number|null), decisions:object[], roundRows:string[]}}
+ */
+export function deriveLedgerFacts(cwd, slug) {
+  const readJson = (p) => { try { return JSON.parse(readFileSync(p, "utf8")); } catch { return null; } };
+  const evalRows = [];
+  const rDir = resultsDir(cwd, slug);
+  if (existsSync(rDir)) {
+    for (const f of readdirSync(rDir)) {
+      const m = f.match(/^evaluate-r(\d+)\.json$/);
+      if (!m) continue;
+      const r = readJson(join(rDir, f));
+      const overall = r?.verdict?.overall;
+      if (overall) evalRows.push({ round: Number(m[1]), overall: String(overall), criteria: Array.isArray(r.verdict.criteria) ? r.verdict.criteria : [] });
+    }
+  }
+  evalRows.sort((a, b) => a.round - b.round);
+  const finalVerdict = evalRows.length ? evalRows[evalRows.length - 1].overall : "not-evaluated";
+  const decisions = [];
+  const gp = gates(cwd, slug);
+  if (existsSync(gp)) {
+    for (const line of readFileSync(gp, "utf8").split("\n")) {
+      if (!line.trim()) continue;
+      try { decisions.push(JSON.parse(line)); } catch { /* a torn line proves nothing */ }
+    }
+  }
+  const t0ByRound = {};
+  const vDir = verdictsDir(cwd, slug);
+  if (existsSync(vDir)) {
+    for (const f of readdirSync(vDir).filter((x) => x.endsWith(".json")).sort()) {
+      const v = readJson(join(vDir, f));
+      if (typeof v?.round !== "number") continue;
+      const t = (t0ByRound[v.round] ||= { green: 0, red: 0 });
+      if (v.overall === "green") t.green++; else t.red++;
+    }
+  }
+  const gateByRound = {};
+  const bDir = roundBuildDir(cwd, slug);
+  if (existsSync(bDir)) {
+    for (const f of readdirSync(bDir).sort()) {
+      const m = f.match(/^r(\d+)-t\d+\.json$/);
+      if (m) gateByRound[Number(m[1])] = readJson(join(bDir, f))?.overall ?? "?";
+    }
+  }
+  const roundNums = [...new Set([...Object.keys(t0ByRound), ...Object.keys(gateByRound), ...evalRows.map((e) => e.round)].map(Number))].sort((a, b) => a - b);
+  const roundRows = [];
+  for (const r of roundNums) {
+    const t0 = t0ByRound[r], bg = gateByRound[r], ev = evalRows.find((e) => e.round === r);
+    roundRows.push(`| Build | ${r} | ${t0 ? `T0 ${t0.green} green / ${t0.red} red` : "no T0 verdict"} | — | round build gate: ${bg ?? "not run"} |`);
+    if (ev) {
+      const p = ev.criteria.filter((c) => c?.verdict === "PASS").length, f = ev.criteria.filter((c) => c?.verdict === "FAIL").length;
+      roundRows.push(`| Eval | ${r} | ${ev.overall} | — | ${p} PASS / ${f} FAIL criteria |`);
+    }
+  }
+  let roundsUsed = null;
+  try { roundsUsed = deriveRounds(cwd, slug, null)?.rounds_used ?? null; } catch { roundsUsed = null; }
+  if (roundsUsed == null && roundNums.length) roundsUsed = roundNums[roundNums.length - 1];
+  return { final_verdict: finalVerdict, rounds_used: roundsUsed, decisions, roundRows };
+}
+
+/** Replace the rows of one markdown table (identified by its header line) with `rows`, keeping the header, the separator and any row the caller marks as kept. */
+function rewriteTable(body, headerRe, rows, keepRow = null) {
+  return body.replace(headerRe, (m, header, sep, oldRows) => {
+    const kept = keepRow && oldRows ? oldRows.split("\n").filter((l) => l.startsWith(keepRow)) : [];
+    return header + sep + [...kept, ...rows].map((l) => `${l}\n`).join("");
+  });
+}
+
+function writeCloseLines(body, { status, closedAt, cause, derived = null }) {
   const causeLine = `close_cause: ${uncoerce(cause || null)}`;
   const closedStatusLine = `closed_status: ${status}`;
   let out = body
@@ -574,6 +651,15 @@ function writeCloseLines(body, { status, closedAt, cause }) {
   out = /^close_cause:.*$/m.test(out)
     ? out.replace(/^close_cause:.*$/m, causeLine)
     : out.replace(/^closed_at:.*$/m, (m) => `${m}\n${causeLine}`);
+  if (derived) {
+    // THE COUNTERS AND TABLES ARE DERIVED, IN THE SAME PASS AS THE CLOSE LINE. Written from the
+    // run's own records so they cannot disagree with the export that reads the same records.
+    if (/^final_verdict:.*$/m.test(out)) out = out.replace(/^final_verdict:.*$/m, `final_verdict: ${derived.final_verdict}`);
+    if (typeof derived.rounds_used === "number" && /^rounds_used:.*$/m.test(out)) out = out.replace(/^rounds_used:.*$/m, `rounds_used: ${derived.rounds_used}`);
+    out = rewriteTable(out, /(\| Phase \| Round \| Result \| Duration \| Notes \|\n)(\|[-| ]+\|\n)((?:\|[^\n]*\n)*)/, derived.roundRows, "| Init");
+    const decisionRows = derived.decisions.map((g) => `| ${g.gate ?? "?"} | ${g.decision ?? g.status ?? "?"} | ${g.source ?? "?"} | ${String(g.note ?? "").replace(/\|/g, "\\|").replace(/\s+/g, " ").slice(0, 160)} |`);
+    out = rewriteTable(out, /(\| Gate \| Decision \| Source \| Note \|\n)(\|[-| ]+\|\n)((?:\|[^\n]*\n)*)/, decisionRows);
+  }
   return out;
 }
 
@@ -696,6 +782,9 @@ export function closeRun(cwd, slug, { status, cause = null, withExport = true }
   // The Ship phase (`shapeup-run.js`) already exports a shipped run itself, before this call ever
   // runs — Stage 2 adds the endings that wrote nothing, and leaves that path untouched.
   const shouldExport = withExport && status !== "shipped";
+  // Derived once, from the run's own records, and written with the close line (see deriveLedgerFacts).
+  let derived = null;
+  try { derived = deriveLedgerFacts(cwd, slug); } catch { derived = null; }
 
   /**
    * Everything a close owes the checkout once the ledger line is written: export the run's
@@ -778,7 +867,7 @@ export function closeRun(cwd, slug, { status, cause = null, withExport = true }
     // new line rather than lost, and the return says so explicitly.
     const closedAt = new Date().toISOString();
     const foldedCause = `${normCause || "no reason recorded"} — supersedes an earlier close recorded ${priorClosedAt} (cause: ${JSON.stringify(priorCause)})`.slice(0, 4000);
-    body = writeCloseLines(body, { status, closedAt, cause: foldedCause });
+    body = writeCloseLines(body, { status, closedAt, cause: foldedCause, derived });
     try { writeFileSync(p, body); } catch (e) {
       return { ok: false, path: p, status, reason: `could not write the ledger: ${e.message}` };
     }
@@ -793,7 +882,7 @@ export function closeRun(cwd, slug, { status, cause = null, withExport = true }
   }
 
   const closedAt = new Date().toISOString();
-  body = writeCloseLines(body, { status, closedAt, cause: normCause });
+  body = writeCloseLines(body, { status, closedAt, cause: normCause, derived });
   try { writeFileSync(p, body); } catch (e) {
     return { ok: false, path: p, status, reason: `could not write the ledger: ${e.message}` };
   }

package/kernel/probe/rounds.mjs

@@ -22,7 +22,7 @@
 
 import { existsSync, readdirSync, readFileSync } from "node:fs";
 import { join } from "node:path";
-import { ordersDir, verdictsDir, roundBuildDir, resultsDir } from "../lib/paths.mjs";
+import { ordersDir, verdictsDir, roundBuildDir, resultsDir, readRunId } from "../lib/paths.mjs";
 
 /** Parse a JSON file, returning null rather than throwing — every reader here is best-effort. */
 function readJson(p) {
@@ -59,12 +59,22 @@ const maxOf = (nums) => (nums.length ? Math.max(...nums) : null);
  * @returns {{rounds_used:*, rounds_judged:(number|null)}} Both counts.
  */
 export function deriveRounds(cwd, slug, fallback) {
+  // THIS RUN'S RECORDS ONLY. Orders, verdicts and build gates over one slug accumulate across runs
+  // and carry their run key; walking the directories unfiltered handed a run that had dispatched
+  // nothing a prior run's round count — into the committed report. A record with no key at all was
+  // written before the key existed and is kept; one with a different key is another run's.
+  const runId = readRunId(cwd, slug);
+  const mine = (rec) => !runId || !rec?.run_id || rec.run_id === runId;
   const orderRounds = [];
   const oDir = ordersDir(cwd, slug);
+  const orderOf = {};
   if (existsSync(oDir)) {
     for (const f of readdirSync(oDir)) {
       if (!f.endsWith(".json")) continue;
-      const r = orderRound(readJson(join(oDir, f))?.order_id);
+      const o = readJson(join(oDir, f));
+      orderOf[f] = o;
+      if (!mine(o)) continue;
+      const r = orderRound(o?.order_id);
       if (r !== null) orderRounds.push(r);
     }
   }
@@ -74,7 +84,7 @@ export function deriveRounds(cwd, slug, fallback) {
   if (existsSync(vDir)) {
     for (const f of readdirSync(vDir).filter((x) => x.endsWith(".json"))) {
       const v = readJson(join(vDir, f));
-      if (typeof v?.round === "number") verdictRounds.push(v.round);
+      if (mine(v) && typeof v?.round === "number") verdictRounds.push(v.round);
     }
   }
 
@@ -83,7 +93,7 @@ export function deriveRounds(cwd, slug, fallback) {
   if (existsSync(bDir)) {
     for (const f of readdirSync(bDir)) {
       const m = f.match(/^r(\d+)-t\d+\.json$/);
-      if (m) buildGateRounds.push(Number(m[1]));
+      if (m && mine(readJson(join(bDir, f)))) buildGateRounds.push(Number(m[1]));
     }
   }
 
@@ -92,7 +102,8 @@ export function deriveRounds(cwd, slug, fallback) {
   if (existsSync(rDir)) {
     for (const f of readdirSync(rDir)) {
       const m = f.match(/^evaluate-r(\d+)\.json$/);
-      if (m) evalRounds.push(Number(m[1]));
+      // A WorkResult carries no run key; it reaches one through its order of the same name.
+      if (m && mine(orderOf[f] ?? readJson(join(oDir, f)))) evalRounds.push(Number(m[1]));
     }
   }
 

package/kernel/reduce/ingest.mjs

@@ -37,7 +37,7 @@ import { fileURLToPath } from "node:url";
 import { validate } from "../verify/envelope.mjs";
 import { runArgs } from "../lib/argv.mjs";
 import { tasksDir, localRoot, dispatchReceipts, legLedger, readRunId } from "../lib/paths.mjs";
-import { citationProblem } from "../probe/eval.mjs";
+import { citationProblem, verdictProblem } from "../probe/eval.mjs";
 
 const HERE = dirname(fileURLToPath(import.meta.url));
 const RESULT_SCHEMA = JSON.parse(readFileSync(resolve(HERE, "../schemas/work-result.schema.json"), "utf8"));
@@ -187,11 +187,48 @@ export function setCheckbox(body, ac, checked) {
  * @param {boolean} done - When true, rewrite the row's status emoji/word to done; false is a no-op.
  * @returns {string} The board text with the matching row updated (unchanged when no row matches).
  */
-export function updateBoardRow(indexBody, taskId, done) {
+/**
+ * Is this index line the row FOR `taskId` — its first cell — rather than a row that merely
+ * mentions it? A task id appears in other rows' `Depends On` column, and matching by substring
+ * anywhere in the line flipped every dependent of a finished task to done along with it. Measured
+ * on a live run: the executor reported one task `skipped`, its task file still said `ready`, and
+ * the index showed it ✅ because the task it depended on had just been ticked. The census read the
+ * index.
+ * @param {string} line - One line of `tasks/_index.md`.
+ * @param {string} taskId - `TASK-NNN`.
+ * @returns {boolean}
+ */
+export function rowIs(line, taskId) {
+  const id = taskId.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  return new RegExp(`^\\|\\s*(?:\\[\\[)?${id}(?:\\\\\\|${id}\\]\\])?\\s*\\|`).test(line);
+}
+
+/**
+ * The status cell for one TaskResult status, or null when the index should not change.
+ * @param {(string|boolean)} status - A TaskResult status (`true` is accepted as `done` for callers written before skipped existed).
+ * @returns {({icon:string, word:string}|null)} The icon and word the index row should carry.
+ */
+export function boardCell(status) {
+  if (status === true || status === "done") return { icon: "✅", word: "done" };
+  if (status === "skipped") return { icon: "⏭", word: "skipped" };
+  if (status === "partial" || status === "failed") return { icon: "🔄", word: "in-progress" };
+  return null;
+}
+
+/**
+ * Rewrite one task's status cell in `tasks/_index.md` — the row whose id cell is `taskId`, never a
+ * row that merely mentions it in `Depends On`.
+ * @param {string} indexBody - The index file's text.
+ * @param {string} taskId - `TASK-NNN`.
+ * @param {(string|boolean)} status - A TaskResult status; statuses the index does not render leave it unchanged.
+ * @returns {string} The rewritten index text.
+ */
+export function updateBoardRow(indexBody, taskId, status) {
+  const cell = boardCell(status);
+  if (!cell) return indexBody;
   return indexBody.split(/\r?\n/).map((line) => {
-    if (!line.includes(taskId) || !line.includes("|")) return line;
-    if (done) return line.replace(/⬜|🔄|⏳|🚫/g, "✅").replace(/\b(ready|in-progress|blocked)\b/gi, "done");
-    return line;
+    if (!rowIs(line, taskId)) return line;
+    return line.replace(/⬜|🔄|⏳|🚫|✅|⏭/g, cell.icon).replace(/\b(ready|in-progress|blocked|done|skipped)\b/gi, cell.word);
   }).join("\n");
 }
 
@@ -240,14 +277,18 @@ function applyResultLocked(result, { cwd, slug }) {
       body = setFrontmatter(body, "completed_at", today());
     } else if (tr.status === "partial" || tr.status === "failed") {
       body = setFrontmatter(body, "status", "in-progress");
+    } else if (tr.status === "skipped") {
+      // Rendered as what it is. A skipped task used to leave its file at `ready` and, through the
+      // substring match above, could show ✅ on the index — the census read the index.
+      body = setFrontmatter(body, "status", "skipped");
     }
     // Execution Log (append; the checkbox list must never disagree with it).
     const logLines = (tr.ac_results || []).map((a) => `- ${a.ac}: ${a.result}${a.evidence ? ` (${a.evidence})` : ""}`).join("\n");
     body += `\n\n## Execution Log — ${today()} (${result.order_id})\n- executor: ${result.worker || "task-executor"} via ingest-result\n- status: ${tr.status}\n${logLines}${tr.notes ? `\n- notes: ${tr.notes}` : ""}\n`;
     writeFileSync(path, body);
     summary.tasks_updated.push(tr.task_id);
-    if (tr.status === "done" && existsSync(boardIndex)) {
-      writeFileSync(boardIndex, updateBoardRow(readFileSync(boardIndex, "utf8"), tr.task_id, true));
+    if (existsSync(boardIndex) && boardCell(tr.status)) {
+      writeFileSync(boardIndex, updateBoardRow(readFileSync(boardIndex, "utf8"), tr.task_id, tr.status));
     }
   }
 
@@ -271,7 +312,7 @@ function applyResultLocked(result, { cwd, slug }) {
         summary.unblocked.push(t.id);
         if (existsSync(boardIndex)) {
           const idx = readFileSync(boardIndex, "utf8").split(/\r?\n/).map((line) =>
-            line.includes(t.id) && line.includes("|")
+            rowIs(line, t.id)
               ? line.replace(/🚫|⏳/g, "⬜").replace(/\bblocked\b/gi, "ready")
               : line).join("\n");
           writeFileSync(boardIndex, idx);
@@ -656,7 +697,8 @@ export async function cli(rawArgv) {
   // on (see `citationProblem`). `probe eval` refuses it to the round loop; refusing it here as well
   // keeps the verdict ledger from recording a verdict the loop will never branch on.
   if (result.verdict) {
-    const problem = citationProblem(cwd, String(result.order_id).split("/")[0], result.verdict);
+    const evalRound = Number((String(result.order_id).match(/-r(\d+)$/) || [])[1]) || null;
+    const problem = verdictProblem(result.verdict) || citationProblem(cwd, String(result.order_id).split("/")[0], result.verdict, { round: evalRound });
     if (problem) {
       console.error(`ingest-result: result refused — ${problem}.`);
       console.error(`  The round stays open: re-dispatch the evaluator against its order, which lists`);

package/kernel/reduce/ship.mjs

@@ -329,7 +329,13 @@ export function buildReport(facts) {
     "*Run state (board, orders, results, T0 artifacts, evaluation and QA reports) stays in the",
     "gitignored local tier (ADR-0001). This report",
     "is the frozen conclusion of it.*", "");
-  return L.join("\n");
+  // THE WHOLE REPORT, ONCE. Board ids were anchored in three places and leaked through a fourth: a
+  // discovery-ledger entry copied verbatim into "Discovered, not built" carried `[TASK-005]`, this
+  // kernel wrote it straight to the committed tier past the hook that guards the model's edits, and
+  // the next run's L1b lint red'd the file the previous run had frozen. A committed report may not
+  // name a board id anywhere, so the rule is applied to the finished text rather than section by
+  // section.
+  return deboard(L.join("\n"), board.anchors);
 }
 
 /**

package/kernel/report/export.mjs

@@ -173,12 +173,14 @@ function criterionRows(dir, runId, t) {
  * (see `appendGateLedger`), so this is a pass-through with a stamped `run_id` fallback rather than
  * a re-derivation: two readers of "what did this gate decide" must not compute the answer twice.
  * @param {object} g - One parsed line of `gates.jsonl`.
- * @param {(string|null)} runId - Run key for a row written before it carried its own.
+ * @param {(string|null)} runId - The run being exported (unused for attribution — the row's own key is the only one exported).
  * @returns {object} A flat `gate_decision` row.
  */
 function gateDecisionRow(g, runId) {
   return {
-    run_id: g?.run_id ?? runId ?? null,
+    // The row's own key, never the current run's stamped on: a row that carries no key was written
+    // before the ledger did, and is exported as unattributed rather than claimed.
+    run_id: g?.run_id ?? null,
     gate: g?.gate ?? null,
     decision: g?.decision ?? null,
     status: g?.status ?? null,
@@ -260,7 +262,9 @@ export function collectRun(cwd, slug) {
       criterion_verdict: criterionRows(evaluationDir(cwd, slug), runId, t),
       hook_decision,
       // The decision that crossed each gate, and the round build gate's own artifact.
-      gate_decision: readJsonl(gatesPath(cwd, slug), t).map((g) => gateDecisionRow(g, runId)),
+      // Scoped to the run, like hook_decision one line up: gate rows over one slug accumulate across
+      // runs, and a prior run's L4 exported under this run's key is a fabricated sign-off.
+      gate_decision: readJsonl(gatesPath(cwd, slug), t).filter((g) => runId && g?.run_id === runId).map((g) => gateDecisionRow(g, runId)),
       build_gate: readJsonDir(roundBuildDir(cwd, slug), t).map((a) => buildGateRow(a, runId)),
       leg: readJsonl(legLedger(cwd, slug), t)
         .filter((r) => !runId || !r?.run_id || r.run_id === runId)

package/kernel/verify/trace.mjs

@@ -40,7 +40,7 @@ import { resolve, join, dirname, relative, isAbsolute } from "node:path";
 import { readBoard } from "../compile.mjs";
 import { runArgs } from "../lib/argv.mjs";
 import { sharedRoot, traceDir, relLocal } from "../lib/paths.mjs";
-import { readContract, unreadableReason, LEGACY_LAYOUT, WIRING_MAP, PROJECT_PROFILE } from "../lib/contract.mjs";
+import { readContract, unreadableReason, LEGACY_LAYOUT, WIRING_MAP, PROJECT_PROFILE, reqId } from "../lib/contract.mjs";
 
 // --- requirements.md registry parser -----------------------------------------
 // A committed markdown table: | REQ-id | clause (verbatim) | source | status | note |
@@ -87,7 +87,10 @@ export function coveredReqIds(board) {
   for (const task of board) {
     for (const ac of task.acceptance_criteria || []) {
       const covers = typeof ac === "object" && Array.isArray(ac.covers) ? ac.covers : [];
-      for (const id of covers) if (/^REQ-\d+$/.test(id)) covered.add(id);
+      // ONE KEY SPACE. `R-2`, `[[REQ-5]]` and `req-4` are the same clause spelled three ways, and the
+      // sibling rule accepts all of them; testing the raw string here counted every one as nothing, so
+      // an author told at L1b to cover a requirement with an AC — which they had — stayed red.
+      for (const raw of covers) { const id = reqId(raw); if (/^REQ-\d+$/.test(id)) covered.add(id); }
     }
   }
   return covered;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shapeup-sdlc",
-  "version": "3.7.5",
+  "version": "3.7.7",
   "description": "Shape Up for coding agents \u2014 with gates the agent can't talk its way past. Harness for Claude Code.",
   "bin": {
     "shapeup-sdlc": "bin/init.mjs"

package/skills/tech-lead/workflows/shapeup-run.js

@@ -482,6 +482,7 @@ const ORDERLEG = {
     closed: { type: "boolean" },
     found: { type: "boolean" },
     order: nullable("string"),
+    has_receipt: { type: "boolean" },
     has_result: { type: "boolean" },
     applied: { type: "boolean" },
   },
@@ -936,7 +937,18 @@ async function requireLeg(gate, phaseKey, phaseName, orderStem = phaseKey) {
   const ask = () => query(`probe leg --slug ${slug} --order "${orderStem}"`, ORDERLEG, phaseName, `legcheck:${orderStem}`);
   let leg = await ask();
   if (!leg || !leg.found) { log(`${gate} — could not ask the leg ledger about "${phaseKey}" (probe returned ${leg ? "no order" : "nothing"}); proceeding on the artifact alone.`); return null; }
-  if (!leg.has_result || leg.applied) return null;
+  if (!leg.has_result) {
+    // The artifact is on disk and the envelope never came back. Measured live: the first dispatch of
+    // a run wrote its four artifacts and no WorkResult, every later phase read the artifacts, and
+    // the run closed `shipped` over an order still open by construction. The phase stands on its
+    // artifact — that is what the post-condition checks — but the order is named at the close, and
+    // the next run over this slug will find it unanswered rather than be surprised by it.
+    log(`${gate} — "${phaseKey}" ${leg.has_receipt ? "was dispatched (receipt on disk) and" : "has an order but no receipt, and"} never answered: no WorkResult at all. ` +
+        `Its artifacts are on disk and the phase proceeds on them; the order stays unanswered and is named at the close.`);
+    if (leg.order && !unansweredOrders.includes(leg.order)) unansweredOrders.push(leg.order);
+    return null;
+  }
+  if (leg.applied) return null;
   log(`${gate} — "${phaseKey}" came back with a result nothing applied (no leg row). Ingesting it here: ${leg.order}.`);
   await advisory(`reduce ingest --order "${leg.order}"`, phaseName, `late-ingest:${phaseKey}`);
   leg = await ask();
@@ -1084,6 +1096,9 @@ async function requireLaunchRecord() {
 // it warns and continues — and the warning travels in the RunReturn, because a headless stdout
 // carries only the final message and a diagnostic on a channel nobody reads is not a diagnostic.
 const stateWarnings = [];
+// Orders a receipt says were dispatched and no WorkResult ever answered — a leg that did its craft
+// and never came back. Named at every close, whatever the close; never folded into "complete".
+const unansweredOrders = [];
 async function setRunStatus(status, phaseName) {
   const r = await cmd(`probe resume --slug ${slug} --set-status ${status}`, phaseName, `status:${status}`);
   if (!r.ok) {
@@ -1143,7 +1158,8 @@ async function closeIfTerminal(ret) {
   // `--close-arm` hands the kernel the arm itself (not a status this file decided was terminal) —
   // a non-terminal arm (`paused`, `ok`) still exits 0 with no "decision" key, so the branches below
   // stay silent for it exactly as they did when this file's own guard returned early.
-  const r = await cmd(`probe resume --slug ${slug} --close-arm ${ret.status} --cause "${causeArg(cause)}"`, "Ship", `close:${ret.status}`);
+  const unanswered = unansweredOrders.length ? ` unanswered_orders=${unansweredOrders.length}` : "";
+  const r = await cmd(`probe resume --slug ${slug} --close-arm ${ret.status} --cause "${causeArg(cause + unanswered)}"`, "Ship", `close:${ret.status}`);
   if (!r.ok) {
     const why = (r.detail || `exit ${r.exit_code}`).trim();
     log(`RUN STATE — close(${ret.status}) did not take: ${why}. This return's own status and reason still ` +