shapeup-sdlc 3.7.6 → 3.7.8

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "shapeup-sdlc-plugin",
   "displayName": "ShapeUp SDLC Plugin",
-  "version": "3.7.6",
+  "version": "3.7.8",
   "description": "Shape Up SDLC harness for Claude Code: shaping, intake, orient, scope-mapping, building (T0-verified, sandboxed, scope-contracted), evaluation and QA skills orchestrated by a tech-lead.",
   "author": {
     "name": "Liberty Nguyen",

package/kernel/compile.mjs

@@ -26,19 +26,20 @@
 // pretty-printed envelope, colocated so audits can read it). Prints the path on stdout.
 
 import { readFileSync, writeFileSync, mkdirSync, existsSync, readdirSync } from "node:fs";
+import { discover, resolve as resolveGate, appendGateLedger, PRESETS } from "./gate.mjs";
 import { resolve, join, dirname, basename, relative, sep } from "node:path";
 import { fileURLToPath } from "node:url";
 import { validate } from "./verify/envelope.mjs";
 import { readTrials } from "./verify/t0.mjs";
 import { runArgs } from "./lib/argv.mjs";
-import { readRunId, dispatchReceipts, legLedger } from "./lib/paths.mjs";
+import { readRunId, dispatchReceipts, legLedger, readReceipt, receipt } from "./lib/paths.mjs";
 // `specDir` is aliased: this module has a local `let specDir` holding the resolved, possibly
 // --spec-overridden directory, and the import is the convention-derived default.
 import {
   tasksDir, specDir as defaultSpecDir, roundLedger, trials, verdictsDir, ordersDir,
   relShared, relLocal, globLocal, globShared, relKnowledgeBase, resultsDir, scopesDir,
 } from "./lib/paths.mjs";
-import { readContract, readAllContracts, tasksForScope, SCOPE_CONTRACT } from "./lib/contract.mjs";
+import { readContract, readAllContracts, tasksForScope, SCOPE_CONTRACT, reqId } from "./lib/contract.mjs";
 import { writeActiveOrder } from "./probe/resume.mjs";
 import { greenVerdict } from "./probe/t0.mjs";
 import { attemptEvidence, readReceipts } from "./probe/attempts.mjs";
@@ -100,14 +101,27 @@ export function parseTaskFile(path) {
   const body = readFileSync(path, "utf8");
   const fm = frontmatter(body);
   const acceptance_criteria = [];
-  for (const line of body.split(/\r?\n/)) {
-    const m = line.match(/^\s*- \[[ x]\]\s+(.*)$/);
+  // A `(covers: …)` clause is read across the WHOLE bullet — the checkbox line and the indented
+  // continuation lines under it — and each token folds through the one key helper. The clause was
+  // scanned on the checkbox line alone, so a board whose every AC carried one on its continuation
+  // line projected as a board carrying none: the requirements matrix printed "no evidence" for
+  // clauses that had a PASS criterion anchored to them. Measured live. `text` stays byte-identical
+  // to the checkbox line, because ingest ticks the box by matching it back.
+  const lines = body.split(/\r?\n/);
+  for (let i = 0; i < lines.length; i++) {
+    const m = lines[i].match(/^\s*- \[[ x]\]\s+(.*)$/);
     if (!m) continue;
-    const text = m[1].trim(); // byte-identical to the checkbox — ingest ticks by matching it back
-    // Additive covers-closure anchor (spine v1.3): a trailing `(covers: REQ-3, REQ-7)` clause on
-    // the AC line yields {text, covers}; a plain line stays a string (non-regression on legacy boards).
-    const cov = text.match(/\(covers:\s*([^)]*)\)/i);
-    const covers = cov ? cov[1].split(",").map((s) => s.trim()).filter((s) => /^REQ-\d+$/.test(s)) : [];
+    const text = m[1].trim();
+    let block = text;
+    for (let j = i + 1; j < lines.length; j++) {
+      const l = lines[j];
+      if (!l.trim() || /^\s*[-*+]\s/.test(l) || /^#/.test(l) || !/^\s/.test(l)) break;
+      block += "\n" + l;
+    }
+    const covers = [];
+    for (const cov of block.matchAll(/\(covers:\s*([^)]*)\)/gi)) {
+      for (const raw of cov[1].split(",")) { const id = reqId(raw); if (/^REQ-\d+$/.test(id) && !covers.includes(id)) covers.push(id); }
+    }
     acceptance_criteria.push(covers.length ? { text, covers } : text);
   }
   return {
@@ -929,6 +943,28 @@ export async function cli(rawArgv) {
     || (operation ? OP_OWNER[operation] : null);
   if (!worker || !operation) { console.error("compile-order: could not resolve --worker/--operation"); process.exit(2); }
 
+  // GATE COACH-1 HAS A DETERMINISTIC CALL SITE: THE COACH DISPATCH. The gate asks whether a PO is
+  // present to categorize feedback; its answer used to be a prose instruction inside the coach
+  // skill, so an unattended lane could dispatch a coach nobody would answer and no row recorded the
+  // decision. Compiling the coach order resolves it with the run's own answer set and records the
+  // row; `skip` refuses the order, which is what "no live PO" means. `ask` compiles it — the
+  // categorization conversation the coach then holds IS the answer.
+  if (operation === "coach") {
+    const ga = readReceipt(receipt(cwd, slug))?.config?.gate_answers ?? null;
+    const presetName = ga && PRESETS[ga] ? ga : null;
+    let found = discover({ cwd, slug, preset: presetName, file: ga && !presetName ? ga : null });
+    if (found.error) found = { set: PRESETS.interactive, source: "preset:interactive (no answer set on disk)" };
+    const r = resolveGate(found.set, "COACH-1", found.source);
+    appendGateLedger(cwd, slug, {
+      at: new Date().toISOString(), run_id: readRunId(cwd, slug), gate: "COACH-1", status: r.status,
+      decision: r.decision ?? null, source: r.source ?? found.source, note: r.note ?? r.reason ?? null, round: null,
+    });
+    if (r.decision === "skip") {
+      console.error(`compile-order: GATE COACH-1 resolved "skip" (${r.source ?? found.source}) — no live PO to categorize feedback, so no coach order is compiled. The decision is on the gate ledger.`);
+      process.exit(3);
+    }
+  }
+
   // Task selection.
   let tasks;
   const board = readBoard(cwd, slug);

package/kernel/gate.mjs

@@ -54,7 +54,7 @@ import { readFileSync, writeFileSync, appendFileSync, existsSync, mkdirSync } fr
 import { parseBoard } from "./reduce/board.mjs";
 import { join, dirname } from "node:path";
 import { runArgs } from "./lib/argv.mjs";
-import { gateAnswerCandidates, gates as gatesPath, LOCAL, resultsDir, tasksDir, hammerCensus } from "./lib/paths.mjs";
+import { gateAnswerCandidates, gates as gatesPath, LOCAL, resultsDir, tasksDir, hammerCensus, readRunId } from "./lib/paths.mjs";
 
 export const GATE_IDS = ["L0", "L1a", "L1a.5", "L1b", "L2", "L3", "QA", "H", "L4", "COACH-1"];
 
@@ -465,7 +465,11 @@ export function cli(rawArgv) {
   // per-run ledger row — the same reasoning `resolveRunId` uses for "no run is active": absence is
   // the correct answer, not an error, so the write is skipped rather than guessing a location.
   if (args.slug) {
+    // THE ROW CARRIES THE RUN KEY. It did not, and the export stamped the current run's key onto
+    // every row it found — a prior run's sign-off became this run's in the one table that answers
+    // "was this ship signed off". Driven on a two-run fixture before it was fixed.
     appendGateLedger(cwd, args.slug, {
+      at: new Date().toISOString(), run_id: readRunId(cwd, args.slug),
       gate: r.gate, status: r.status, decision: r.decision ?? null,
       source: r.source ?? found.source, note: r.note ?? r.reason ?? null,
       round: args.round ?? null,

package/kernel/init/run.mjs

@@ -70,6 +70,7 @@
 // one moment it mattered named a mechanism that does not parse.
 
 import { mkdirSync, writeFileSync, readFileSync, readdirSync, existsSync, copyFileSync, rmSync, statSync } from "node:fs";
+import { discover, resolve as resolveGate, appendGateLedger, PRESETS } from "../gate.mjs";
 import { join, dirname, resolve, relative, sep } from "node:path";
 import { createHash } from "node:crypto";
 import { decideLane, treeSize } from "./fit.mjs";
@@ -671,6 +672,29 @@ export function cli(rawArgv) {
   mkdirSync(dirname(pointer), { recursive: true });
   writeFileSync(pointer, JSON.stringify({ slug, started_at: startedAt }, null, 2) + "\n", "utf8");
 
+  // GATE L0 HAS A DETERMINISTIC CALL SITE: THE RUN'S OPENING. It used to be a line of prose the
+  // tech lead was asked to act on, and the same consumer ledgered L0 on one run and not the next.
+  // The intake conversation is the L0 decision; opening the run is the act that records it, with
+  // the answer set the run was configured with (a preset name or a file), else the interactive
+  // defaults. Best-effort: a row that cannot be written must not fail the opening.
+  try {
+    const ga = config.gate_answers ?? null;
+    const presetName = ga && PRESETS[ga] ? ga : null;
+    const found = discover({ cwd, slug, preset: presetName, file: ga && !presetName ? ga : null });
+    // A preset or file answers L0 for the run; a run with neither — the interactive lane, where the
+    // tech lead held the intake conversation before opening it — has that conversation as its L0
+    // decision, and the opening records it as such. An answer set that says `ask` is recorded as
+    // `ask`: the row states what the set said, and the intake note says what happened.
+    const r = found.error
+      ? { status: "ok", decision: "proceed", source: "intake (no answer set on disk)", note: "the intake conversation is the L0 decision" }
+      : resolveGate(found.set, "L0", found.source);
+    appendGateLedger(cwd, slug, {
+      at: startedAt, run_id: receipt.run_id, gate: "L0", status: r.status, decision: r.decision ?? null,
+      source: r.source ?? found.source, note: `${r.note ?? r.reason ?? ""} — run opened: intake recorded, receipt written`.replace(/^ — /, ""),
+      round: null,
+    });
+  } catch { /* the ledger row is a record of the opening, never a condition of it */ }
+
   console.log(JSON.stringify({
     ok: true,
     slug,

package/kernel/probe/attempts.mjs

@@ -30,7 +30,7 @@
 import { existsSync, readdirSync, readFileSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { runArgs } from "../lib/argv.mjs";
-import { dispatchReceipts, legLedger, resultsDir, readRunId } from "../lib/paths.mjs";
+import { dispatchReceipts, legLedger, resultsDir, readRunId, ordersDir } from "../lib/paths.mjs";
 import { readLegs } from "./leg.mjs";
 import { greenVerdict } from "./t0.mjs";
 
@@ -84,7 +84,16 @@ export function attemptEvidence(cwd, slug, scopeId, round, attempt, receipts, le
   // so this stays a file check and is deliberately NOT sufficient on its own. It can only turn an
   // already run-scoped receipt into `spent`; a result left behind by an earlier run cannot attest
   // an attempt this run never dispatched.
-  const hasResult = existsSync(join(resultsDir(cwd, slug), `${scopeId}-r${round}-a${attempt}.json`));
+  // A WorkResult carries no run key of its own; it answers THIS run's attempt only through the
+  // order of the same name, which this run's compile rewrote. A result left by a prior run over the
+  // same slug used to close an attempt this run had not even opened.
+  const stem = `${scopeId}-r${round}-a${attempt}.json`;
+  let orderIsMine = true;
+  if (runId != null) {
+    try { const o = JSON.parse(readFileSync(join(ordersDir(cwd, slug), stem), "utf8")); orderIsMine = !o?.run_id || o.run_id === runId; }
+    catch { orderIsMine = false; }
+  }
+  const hasResult = orderIsMine && existsSync(join(resultsDir(cwd, slug), stem));
   const state = !hasReceipt ? "unattested" : (hasResult || hasLeg) ? "spent" : "in-flight";
   return { orderId, hasReceipt, hasResult, hasLeg, state };
 }

package/kernel/probe/eval.mjs

@@ -35,7 +35,7 @@ import { existsSync, readFileSync, readdirSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { createHash } from "node:crypto";
 import { runArgs } from "../lib/argv.mjs";
-import { resultsDir, scopesDir } from "../lib/paths.mjs";
+import { resultsDir, scopesDir, readRunId } from "../lib/paths.mjs";
 
 /** Longest `reason` reported. A deviation is prose written by a worker and can run to paragraphs. */
 const REASON_MAX = 400;
@@ -89,7 +89,7 @@ export function isScoped(cwd, slug) {
  * @returns {(string|null)} A reason phrased for an operator, or null when the file at `path` exists,
  *   hashes to the cited `sha256`, and its own `overall` reads "green".
  */
-function unresolvedCitation(cwd, citation) {
+function unresolvedCitation(cwd, citation, { round = null, runId = null } = {}) {
   const rel = typeof citation?.path === "string" ? citation.path : "";
   if (!rel) return "names no artifact path";
   let text;
@@ -109,6 +109,20 @@ function unresolvedCitation(cwd, citation) {
   try { body = JSON.parse(text); }
   catch { return `cites ${rel}, whose bytes match the hash but do not read as a T0 verdict`; }
   if (body?.overall !== "green") return `cites ${rel}, whose own verdict is "${body?.overall ?? "unknown"}", not green`;
+  // THE ARTIFACT HAS TO BE THE ONE THE CITATION SAYS IT IS. A re-hash proves the bytes are the
+  // file's; it says nothing about whose verdict the file holds. A PASS citing scope alpha's green
+  // artifact while declaring scope beta, or a prior round's, or a prior run's over the same slug,
+  // passed the digest check unremarked. The citation's own required `scope_id`, the round being
+  // judged and the run's key are compared to what the artifact records about itself.
+  if (typeof citation.scope_id === "string" && body?.scope_id && body.scope_id !== citation.scope_id) {
+    return `cites ${rel} for scope "${citation.scope_id}", but the artifact records scope "${body.scope_id}"`;
+  }
+  if (round != null && typeof body?.round === "number" && body.round !== round) {
+    return `cites ${rel}, a round ${body.round} artifact, as evidence for round ${round}`;
+  }
+  if (runId && body?.run_id && body.run_id !== runId) {
+    return `cites ${rel}, an artifact of run ${body.run_id}, as evidence for run ${runId}`;
+  }
   return null;
 }
 
@@ -143,15 +157,49 @@ function unresolvedCitation(cwd, citation) {
  *   citation resolves, an unscoped spec, or a block with no PASS/FAIL in it (there is no judgement
  *   to invalidate).
  */
-export function citationProblem(cwd, slug, verdict) {
+/**
+ * Why a verdict cannot stand on its own criteria, or null when it can.
+ *
+ * `overall` is the judge's field, and nothing recomputed it from the criteria the judge graded: a
+ * PASS over a failing criterion, or over no criterion at all, validated and ingested, and the
+ * round loop branched on it. The evaluator's own first rule is that absence of evidence is a FAIL,
+ * so a PASS criterion with no evidence is no evidence either. Recomputed here, on ingest and on
+ * read alike: PASS means every graded criterion passed with evidence and at least one was graded;
+ * FAIL means at least one graded criterion failed.
+ *
+ * @param {object} verdict - The WorkResult's `verdict`.
+ * @returns {(string|null)} A reason phrased for an operator, or null.
+ */
+export function verdictProblem(verdict) {
+  const overall = verdict?.overall;
+  if (overall !== "PASS" && overall !== "FAIL") return null;
+  const criteria = Array.isArray(verdict.criteria) ? verdict.criteria : [];
+  const fails = criteria.filter((c) => c?.verdict === "FAIL");
+  const passes = criteria.filter((c) => c?.verdict === "PASS");
+  const other = criteria.length - fails.length - passes.length;
+  if (overall === "PASS") {
+    if (criteria.length === 0) return "the PASS verdict grades no criterion at all — a PASS with no evidence is a claim";
+    if (fails.length) return `the verdict says PASS while ${fails.length} of its ${criteria.length} criteria read FAIL — overall is derived from the criteria, never declared over them`;
+    if (other) return `the verdict says PASS while ${other} of its criteria carry no PASS/FAIL verdict`;
+    const bare = passes.filter((c) => !(typeof c?.evidence === "string" && c.evidence.trim()));
+    if (bare.length) return `the PASS verdict has ${bare.length} criterion(s) marked PASS with no evidence — absence of evidence is a FAIL by the evaluator's own first rule`;
+    return null;
+  }
+  if (criteria.length === 0) return "the FAIL verdict grades no criterion at all — a FAIL must name what failed";
+  if (!fails.length) return `the verdict says FAIL while every one of its ${criteria.length} graded criteria reads PASS — a FAIL must cite the criterion it failed`;
+  return null;
+}
+
+export function citationProblem(cwd, slug, verdict, { round = null } = {}) {
   if (verdict?.overall !== "PASS" && verdict?.overall !== "FAIL") return null;
   if (!isScoped(cwd, slug)) return null;
   if (!Array.isArray(verdict.t0_citations) || !verdict.t0_citations.length) {
     return `the ${verdict.overall} verdict cites no T0 artifact, and a verdict on a scoped spec must ` +
       "cite the T0 verdict it re-hashed (the order lists them under payload.t0_artifacts)";
   }
+  const runId = readRunId(cwd, slug);
   for (const citation of verdict.t0_citations) {
-    const reason = unresolvedCitation(cwd, citation);
+    const reason = unresolvedCitation(cwd, citation, { round, runId });
     if (reason) return `the ${verdict.overall} verdict ${reason} — a T0 citation is re-hashed from disk, never taken on the handed word`;
   }
   return null;
@@ -185,7 +233,7 @@ export function evalVerdict(cwd, slug, round) {
       ? `the evaluator returned ${status || "no status"}: ${first}`
       : `status ${status || "unknown"} with no PASS/FAIL verdict`), status);
   }
-  const problem = citationProblem(cwd, slug, v);
+  const problem = verdictProblem(v) || citationProblem(cwd, slug, v, { round });
   if (problem) return unfit(problem, status, overall);
   return {
     found: true,

package/kernel/probe/rounds.mjs

@@ -22,7 +22,7 @@
 
 import { existsSync, readdirSync, readFileSync } from "node:fs";
 import { join } from "node:path";
-import { ordersDir, verdictsDir, roundBuildDir, resultsDir } from "../lib/paths.mjs";
+import { ordersDir, verdictsDir, roundBuildDir, resultsDir, readRunId } from "../lib/paths.mjs";
 
 /** Parse a JSON file, returning null rather than throwing — every reader here is best-effort. */
 function readJson(p) {
@@ -59,12 +59,22 @@ const maxOf = (nums) => (nums.length ? Math.max(...nums) : null);
  * @returns {{rounds_used:*, rounds_judged:(number|null)}} Both counts.
  */
 export function deriveRounds(cwd, slug, fallback) {
+  // THIS RUN'S RECORDS ONLY. Orders, verdicts and build gates over one slug accumulate across runs
+  // and carry their run key; walking the directories unfiltered handed a run that had dispatched
+  // nothing a prior run's round count — into the committed report. A record with no key at all was
+  // written before the key existed and is kept; one with a different key is another run's.
+  const runId = readRunId(cwd, slug);
+  const mine = (rec) => !runId || !rec?.run_id || rec.run_id === runId;
   const orderRounds = [];
   const oDir = ordersDir(cwd, slug);
+  const orderOf = {};
   if (existsSync(oDir)) {
     for (const f of readdirSync(oDir)) {
       if (!f.endsWith(".json")) continue;
-      const r = orderRound(readJson(join(oDir, f))?.order_id);
+      const o = readJson(join(oDir, f));
+      orderOf[f] = o;
+      if (!mine(o)) continue;
+      const r = orderRound(o?.order_id);
       if (r !== null) orderRounds.push(r);
     }
   }
@@ -74,7 +84,7 @@ export function deriveRounds(cwd, slug, fallback) {
   if (existsSync(vDir)) {
     for (const f of readdirSync(vDir).filter((x) => x.endsWith(".json"))) {
       const v = readJson(join(vDir, f));
-      if (typeof v?.round === "number") verdictRounds.push(v.round);
+      if (mine(v) && typeof v?.round === "number") verdictRounds.push(v.round);
     }
   }
 
@@ -83,7 +93,7 @@ export function deriveRounds(cwd, slug, fallback) {
   if (existsSync(bDir)) {
     for (const f of readdirSync(bDir)) {
       const m = f.match(/^r(\d+)-t\d+\.json$/);
-      if (m) buildGateRounds.push(Number(m[1]));
+      if (m && mine(readJson(join(bDir, f)))) buildGateRounds.push(Number(m[1]));
     }
   }
 
@@ -92,7 +102,8 @@ export function deriveRounds(cwd, slug, fallback) {
   if (existsSync(rDir)) {
     for (const f of readdirSync(rDir)) {
       const m = f.match(/^evaluate-r(\d+)\.json$/);
-      if (m) evalRounds.push(Number(m[1]));
+      // A WorkResult carries no run key; it reaches one through its order of the same name.
+      if (m && mine(orderOf[f] ?? readJson(join(oDir, f)))) evalRounds.push(Number(m[1]));
     }
   }
 

package/kernel/probe/t0.mjs

@@ -16,7 +16,7 @@
 import { existsSync, readdirSync, readFileSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { runArgs } from "../lib/argv.mjs";
-import { verdictsDir } from "../lib/paths.mjs";
+import { verdictsDir, readRunId } from "../lib/paths.mjs";
 
 /**
  * Verdict filenames, newest first by their NUMERIC address.
@@ -55,10 +55,15 @@ export function greenVerdict(cwd, slug, scopeId, round) {
   if (!existsSync(dir)) return { green: false, path: null };
   // Newest first: an attempt retried after a red one writes a higher trial ordinal at the same
   // (round, attempt) address, and the LAST verdict is the one that stands.
+  // THIS RUN'S VERDICTS. Verdicts over one slug accumulate across runs and carry the run's key; a
+  // second run used to be told its scope was green on the first run's artifact, and the round loop
+  // skipped building it. A verdict with no key at all predates the key and is kept.
+  const runId = readRunId(cwd, slug);
   for (const f of newestFirst(readdirSync(dir).filter((x) => x.endsWith(".json")))) {
     const p = join(dir, f);
     try {
       const b = JSON.parse(readFileSync(p, "utf8"));
+      if (runId && b.run_id && b.run_id !== runId) continue;
       if (b.scope_id === scopeId && (round == null || b.round === round) && b.overall === "green") return { green: true, path: p };
     } catch { /* a torn artifact proves nothing; keep looking */ }
   }

package/kernel/reduce/graph.mjs

@@ -33,7 +33,7 @@ import {
   localRoot, receipt as receiptPath, ordersDir, resultsDir, verdictsDir, trials as trialsPath, gates as gatesPath, scopesDir, usecasesDir, requirements as requirementsPath, wiringMap as wiringMapPath, legLedger,
 } from "../lib/paths.mjs";
 import { readAllContracts, readContract, ucId, reqId, SCOPE_CONTRACT, WIRING_MAP } from "../lib/contract.mjs";
-import { runIdFromReceipt } from "../lib/paths.mjs";
+import { runIdFromReceipt, readRunId } from "../lib/paths.mjs";
 
 /** The graph's home — one file per feature, beside the run trace it projects. */
 export const graphPath = (cwd, slug) => join(localRoot(cwd, slug), "graph.jsonl");
@@ -384,7 +384,16 @@ export function appendGraph(cwd, slug) {
 export function runSubgraph(cwd, slug) {
   const { nodes, edges, lines } = readGraph(cwd, slug);
   const of = (t) => [...nodes.values()].filter((n) => n.t === t);
-  const orders = of("Order"), results = of("Result"), verdicts = of("Verdict");
+  // ONE RUN'S SUBGRAPH. The graph is append-only over a slug and every run of it lands there; this
+  // query used to aggregate every run's verdicts into `green_scopes_by_round` and report the FIRST
+  // run ever recorded as `run`, so a relaunch skipped scopes a prior run had built. Work nodes carry
+  // the run key and are filtered on it; a node with no key predates the key and is kept; a Result
+  // has no key of its own and belongs to the run its Order does.
+  const runId = readRunId(cwd, slug);
+  const mine = (n) => !runId || !n.run_id || n.run_id === runId;
+  const orders = of("Order").filter(mine), verdicts = of("Verdict").filter(mine);
+  const orderIds = new Set(orders.map((o) => o.order_id));
+  const results = of("Result").filter((r) => !runId || orderIds.has(r.order_id));
   const resultIds = new Set(results.map((r) => r.order_id));
   const ingestedFrom = new Set([...edges.values()].filter((e) => e.t === "INGESTED").map((e) => e.from));
   const greenByRound = {};
@@ -394,7 +403,7 @@ export function runSubgraph(cwd, slug) {
   }
   return {
     graph_lines: lines,
-    run: of("Run")[0]?.run_id ?? null,
+    run: runId ?? of("Run")[0]?.run_id ?? null,
     scopes: of("Scope").map((s) => s.scope_id).sort(),
     use_cases: of("UseCase").map((u) => u.use_case).sort(),
     requirements: of("Requirement").map((r) => r.req_id).sort(),

package/kernel/reduce/hill.mjs

@@ -6,7 +6,7 @@
 import { readFileSync, writeFileSync, existsSync, readdirSync, mkdirSync } from "node:fs";
 import { resolve, join } from "node:path";
 import { runArgs } from "../lib/argv.mjs";
-import { scopesDir, hillDir, verdictsDir, resultsDir, discoveryLedger, localRoot } from "../lib/paths.mjs";
+import { scopesDir, hillDir, verdictsDir, resultsDir, discoveryLedger, receipt, readRunId } from "../lib/paths.mjs";
 import { readAllContracts, SCOPE_CONTRACT } from "../lib/contract.mjs";
 import { evalVerdict } from "../probe/eval.mjs";
 import { redBuildRounds } from "../verify/build.mjs";
@@ -190,9 +190,15 @@ export function deriveHill(cwd, slug) {
   // and reports what they currently support, in both directions. A guard phrased as "never lower a
   // phase" would quietly turn a derived value into a high-water mark, which is a different defect
   // wearing this one's clothes. The condition is the narrowest one that is positively provable:
-  // the tier holding every input is not there.
+  // the RUN is not there — its receipt, the record every run's first act writes. The condition used
+  // to be the local root's existence, and any single file satisfies that: `reduce graph` creates
+  // `graph.jsonl` under it as a side effect, so a committed-only checkout that ran graph and then
+  // hill had its FINISHED shards flattened to UPHILL_UNKNOWN, exit 0, no warning. A backstop whose
+  // condition another command satisfies is a backstop only in the order nobody varied.
   // -------------------------------------------------------------------------------------------
-  if (!existsSync(localRoot(cwd, slug))) {
+  // Evidence the derivation actually needs: the run's receipt, or the T0 verdicts it reads. A
+  // `graph.jsonl` alone is neither.
+  if (!existsSync(receipt(cwd, slug)) && !existsSync(verdictsDir(cwd, slug))) {
     return scopes.map((s) => ({
       scope_id: s.scope_id,
       phase: committedPhase(hDir, s.scope_id),
@@ -235,11 +241,14 @@ export function deriveHill(cwd, slug) {
   // verdict counting exactly as before.
   const redRounds = redBuildRounds(cwd, slug);
   const t0Facts = {};
+  // This run's verdicts only — a prior run's green over the same slug moved this run's dot.
+  const hillRunId = readRunId(cwd, slug);
   if (existsSync(vDir)) {
     for (const f of readdirSync(vDir)) {
       if (!f.endsWith(".json")) continue;
       try {
         const b = JSON.parse(readFileSync(join(vDir, f), "utf8"));
+        if (hillRunId && b.run_id && b.run_id !== hillRunId) continue;
         if (!t0Facts[b.scope_id]) t0Facts[b.scope_id] = { hasGreen: false, seesawGreen: false };
         if (b.overall === "green" && !redRounds.has(Number(b.round))) {
           t0Facts[b.scope_id].hasGreen = true;

package/kernel/reduce/ingest.mjs

@@ -37,7 +37,7 @@ import { fileURLToPath } from "node:url";
 import { validate } from "../verify/envelope.mjs";
 import { runArgs } from "../lib/argv.mjs";
 import { tasksDir, localRoot, dispatchReceipts, legLedger, readRunId } from "../lib/paths.mjs";
-import { citationProblem } from "../probe/eval.mjs";
+import { citationProblem, verdictProblem } from "../probe/eval.mjs";
 
 const HERE = dirname(fileURLToPath(import.meta.url));
 const RESULT_SCHEMA = JSON.parse(readFileSync(resolve(HERE, "../schemas/work-result.schema.json"), "utf8"));
@@ -697,7 +697,8 @@ export async function cli(rawArgv) {
   // on (see `citationProblem`). `probe eval` refuses it to the round loop; refusing it here as well
   // keeps the verdict ledger from recording a verdict the loop will never branch on.
   if (result.verdict) {
-    const problem = citationProblem(cwd, String(result.order_id).split("/")[0], result.verdict);
+    const evalRound = Number((String(result.order_id).match(/-r(\d+)$/) || [])[1]) || null;
+    const problem = verdictProblem(result.verdict) || citationProblem(cwd, String(result.order_id).split("/")[0], result.verdict, { round: evalRound });
     if (problem) {
       console.error(`ingest-result: result refused — ${problem}.`);
       console.error(`  The round stays open: re-dispatch the evaluator against its order, which lists`);

package/kernel/reduce/ship.mjs

@@ -329,7 +329,13 @@ export function buildReport(facts) {
     "*Run state (board, orders, results, T0 artifacts, evaluation and QA reports) stays in the",
     "gitignored local tier (ADR-0001). This report",
     "is the frozen conclusion of it.*", "");
-  return L.join("\n");
+  // THE WHOLE REPORT, ONCE. Board ids were anchored in three places and leaked through a fourth: a
+  // discovery-ledger entry copied verbatim into "Discovered, not built" carried `[TASK-005]`, this
+  // kernel wrote it straight to the committed tier past the hook that guards the model's edits, and
+  // the next run's L1b lint red'd the file the previous run had frozen. A committed report may not
+  // name a board id anywhere, so the rule is applied to the finished text rather than section by
+  // section.
+  return deboard(L.join("\n"), board.anchors);
 }
 
 /**

package/kernel/report/export.mjs

@@ -173,12 +173,14 @@ function criterionRows(dir, runId, t) {
  * (see `appendGateLedger`), so this is a pass-through with a stamped `run_id` fallback rather than
  * a re-derivation: two readers of "what did this gate decide" must not compute the answer twice.
  * @param {object} g - One parsed line of `gates.jsonl`.
- * @param {(string|null)} runId - Run key for a row written before it carried its own.
+ * @param {(string|null)} runId - The run being exported (unused for attribution — the row's own key is the only one exported).
  * @returns {object} A flat `gate_decision` row.
  */
 function gateDecisionRow(g, runId) {
   return {
-    run_id: g?.run_id ?? runId ?? null,
+    // The row's own key, never the current run's stamped on: a row that carries no key was written
+    // before the ledger did, and is exported as unattributed rather than claimed.
+    run_id: g?.run_id ?? null,
     gate: g?.gate ?? null,
     decision: g?.decision ?? null,
     status: g?.status ?? null,
@@ -260,7 +262,9 @@ export function collectRun(cwd, slug) {
       criterion_verdict: criterionRows(evaluationDir(cwd, slug), runId, t),
       hook_decision,
       // The decision that crossed each gate, and the round build gate's own artifact.
-      gate_decision: readJsonl(gatesPath(cwd, slug), t).map((g) => gateDecisionRow(g, runId)),
+      // Scoped to the run, like hook_decision one line up: gate rows over one slug accumulate across
+      // runs, and a prior run's L4 exported under this run's key is a fabricated sign-off.
+      gate_decision: readJsonl(gatesPath(cwd, slug), t).filter((g) => runId && g?.run_id === runId).map((g) => gateDecisionRow(g, runId)),
       build_gate: readJsonDir(roundBuildDir(cwd, slug), t).map((a) => buildGateRow(a, runId)),
       leg: readJsonl(legLedger(cwd, slug), t)
         .filter((r) => !runId || !r?.run_id || r.run_id === runId)

package/kernel/verify/build.mjs

@@ -42,7 +42,7 @@ import { join, resolve } from "node:path";
 import { spawnSync } from "node:child_process";
 import { createHash } from "node:crypto";
 import { runArgs, isMain } from "../lib/argv.mjs";
-import { harnessRun, projectProfile, roundBuildDir, localRoot, runIdFromRoot } from "../lib/paths.mjs";
+import { harnessRun, projectProfile, roundBuildDir, localRoot, runIdFromRoot, readRunId } from "../lib/paths.mjs";
 import { readContract, readAllContracts, PROJECT_PROFILE, SCOPE_CONTRACT, splitFrontmatter } from "../lib/contract.mjs";
 import { scopesDir } from "../lib/paths.mjs";
 import { digest } from "../probe/digest.mjs";
@@ -231,9 +231,15 @@ export function redBuildRounds(cwd, slug) {
   const latest = new Map();
   let files;
   try { files = readdirSync(roundBuildDir(cwd, slug)); } catch { return new Set(); }
+  // This run's gates only: a prior run's red round over the same slug must not hold this run's dot.
+  const runId = readRunId(cwd, slug);
   for (const f of files) {
     const m = f.match(/^r(\d+)-t(\d+)\.json$/);
     if (!m) continue;
+    if (runId) {
+      try { const g = JSON.parse(readFileSync(join(roundBuildDir(cwd, slug), f), "utf8")); if (g?.run_id && g.run_id !== runId) continue; }
+      catch { continue; }
+    }
     const round = Number(m[1]), trial = Number(m[2]);
     if (!latest.has(round) || latest.get(round).trial < trial) latest.set(round, { trial, file: f });
   }

package/kernel/verify/trace.mjs

@@ -40,7 +40,7 @@ import { resolve, join, dirname, relative, isAbsolute } from "node:path";
 import { readBoard } from "../compile.mjs";
 import { runArgs } from "../lib/argv.mjs";
 import { sharedRoot, traceDir, relLocal } from "../lib/paths.mjs";
-import { readContract, unreadableReason, LEGACY_LAYOUT, WIRING_MAP, PROJECT_PROFILE } from "../lib/contract.mjs";
+import { readContract, unreadableReason, LEGACY_LAYOUT, WIRING_MAP, PROJECT_PROFILE, reqId } from "../lib/contract.mjs";
 
 // --- requirements.md registry parser -----------------------------------------
 // A committed markdown table: | REQ-id | clause (verbatim) | source | status | note |
@@ -87,7 +87,10 @@ export function coveredReqIds(board) {
   for (const task of board) {
     for (const ac of task.acceptance_criteria || []) {
       const covers = typeof ac === "object" && Array.isArray(ac.covers) ? ac.covers : [];
-      for (const id of covers) if (/^REQ-\d+$/.test(id)) covered.add(id);
+      // ONE KEY SPACE. `R-2`, `[[REQ-5]]` and `req-4` are the same clause spelled three ways, and the
+      // sibling rule accepts all of them; testing the raw string here counted every one as nothing, so
+      // an author told at L1b to cover a requirement with an AC — which they had — stayed red.
+      for (const raw of covers) { const id = reqId(raw); if (/^REQ-\d+$/.test(id)) covered.add(id); }
     }
   }
   return covered;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shapeup-sdlc",
-  "version": "3.7.6",
+  "version": "3.7.8",
   "description": "Shape Up for coding agents \u2014 with gates the agent can't talk its way past. Harness for Claude Code.",
   "bin": {
     "shapeup-sdlc": "bin/init.mjs"

package/skills/coach/SKILL.md

@@ -117,7 +117,7 @@ fields nobody used" → "Prefer the minimum DTO that satisfies the AC; don't add
 fields"). Keep the originating why — a rule without its reason gets ignored or misapplied.
 
 ### Step 2 — ⏸ GATE COACH-1: Categorize (ASK, never assume)
-This is the load-bearing gate. **Resolve it first** — `node
+This is the load-bearing gate. Dispatched with an order, it is already resolved and on the gate ledger: compiling a coach order crosses COACH-1 with the run's answer set and refuses the order on `skip`, so an order in your hands means `ask`. Invoked standalone, **resolve it first** — `node
 "${CLAUDE_PLUGIN_ROOT}/kernel/harness.mjs" gate --resolve COACH-1 --slug <slug>
 [--file <path>|--preset <name>]` — so the ledger carries a row for the decision this gate makes,
 same as every other gate in the run. Exit 0 (`decision=skip`) — an unattended lane with no live PO;