shapeup-sdlc 3.7.7 → 3.7.9

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "shapeup-sdlc-plugin",
   "displayName": "ShapeUp SDLC Plugin",
-  "version": "3.7.7",
+  "version": "3.7.9",
   "description": "Shape Up SDLC harness for Claude Code: shaping, intake, orient, scope-mapping, building (T0-verified, sandboxed, scope-contracted), evaluation and QA skills orchestrated by a tech-lead.",
   "author": {
     "name": "Liberty Nguyen",

package/README.md

@@ -48,10 +48,12 @@ Two limits, stated here because the point of this section is that a claim withou
 behind it is the thing this harness exists to prevent: the **seesaw** regression arm is declared
 and not yet wired (no run writes its registry — wiring it is an open Betting Table decision), and
 the citation **re-hash** the kernel performs proves self-consistency, not provenance — the digest
-and the cited verdict are checked, the scope, round and run the artifact belongs to are not. A T0
-artifact is also evidence about the machine that produced it: it records the tree and nothing
-about the toolchain or caches the commands resolved through. All three are open items in
-`shapeup/knowledge-base/harness-defects.md`, not shipped guarantees.
+and the cited verdict are checked, the scope, round and run the artifact belongs to are not. Both are
+open items in `shapeup/knowledge-base/harness-defects.md`, not shipped guarantees. A T0 artifact is
+also evidence about the machine that produced it, and now says so: each verdict carries where it
+ran — the absolute path, the git tree, the resolved toolchain, lockfile digests, declared cache
+directories and a digest over an allowlist of environment values — so a disagreeing re-run can be
+told from a regression. That block measures and judges nothing.
 → *Prevents: "done" asserted with nothing behind it.*
 
 **3. Parallel work can't corrupt shared state.** Each scope gets a write-whitelist of files

package/kernel/compile.mjs

@@ -26,19 +26,20 @@
 // pretty-printed envelope, colocated so audits can read it). Prints the path on stdout.
 
 import { readFileSync, writeFileSync, mkdirSync, existsSync, readdirSync } from "node:fs";
+import { discover, resolve as resolveGate, appendGateLedger, PRESETS } from "./gate.mjs";
 import { resolve, join, dirname, basename, relative, sep } from "node:path";
 import { fileURLToPath } from "node:url";
 import { validate } from "./verify/envelope.mjs";
 import { readTrials } from "./verify/t0.mjs";
 import { runArgs } from "./lib/argv.mjs";
-import { readRunId, dispatchReceipts, legLedger } from "./lib/paths.mjs";
+import { readRunId, dispatchReceipts, legLedger, readReceipt, receipt } from "./lib/paths.mjs";
 // `specDir` is aliased: this module has a local `let specDir` holding the resolved, possibly
 // --spec-overridden directory, and the import is the convention-derived default.
 import {
   tasksDir, specDir as defaultSpecDir, roundLedger, trials, verdictsDir, ordersDir,
   relShared, relLocal, globLocal, globShared, relKnowledgeBase, resultsDir, scopesDir,
 } from "./lib/paths.mjs";
-import { readContract, readAllContracts, tasksForScope, SCOPE_CONTRACT } from "./lib/contract.mjs";
+import { readContract, readAllContracts, tasksForScope, SCOPE_CONTRACT, reqId } from "./lib/contract.mjs";
 import { writeActiveOrder } from "./probe/resume.mjs";
 import { greenVerdict } from "./probe/t0.mjs";
 import { attemptEvidence, readReceipts } from "./probe/attempts.mjs";
@@ -100,14 +101,27 @@ export function parseTaskFile(path) {
   const body = readFileSync(path, "utf8");
   const fm = frontmatter(body);
   const acceptance_criteria = [];
-  for (const line of body.split(/\r?\n/)) {
-    const m = line.match(/^\s*- \[[ x]\]\s+(.*)$/);
+  // A `(covers: …)` clause is read across the WHOLE bullet — the checkbox line and the indented
+  // continuation lines under it — and each token folds through the one key helper. The clause was
+  // scanned on the checkbox line alone, so a board whose every AC carried one on its continuation
+  // line projected as a board carrying none: the requirements matrix printed "no evidence" for
+  // clauses that had a PASS criterion anchored to them. Measured live. `text` stays byte-identical
+  // to the checkbox line, because ingest ticks the box by matching it back.
+  const lines = body.split(/\r?\n/);
+  for (let i = 0; i < lines.length; i++) {
+    const m = lines[i].match(/^\s*- \[[ x]\]\s+(.*)$/);
     if (!m) continue;
-    const text = m[1].trim(); // byte-identical to the checkbox — ingest ticks by matching it back
-    // Additive covers-closure anchor (spine v1.3): a trailing `(covers: REQ-3, REQ-7)` clause on
-    // the AC line yields {text, covers}; a plain line stays a string (non-regression on legacy boards).
-    const cov = text.match(/\(covers:\s*([^)]*)\)/i);
-    const covers = cov ? cov[1].split(",").map((s) => s.trim()).filter((s) => /^REQ-\d+$/.test(s)) : [];
+    const text = m[1].trim();
+    let block = text;
+    for (let j = i + 1; j < lines.length; j++) {
+      const l = lines[j];
+      if (!l.trim() || /^\s*[-*+]\s/.test(l) || /^#/.test(l) || !/^\s/.test(l)) break;
+      block += "\n" + l;
+    }
+    const covers = [];
+    for (const cov of block.matchAll(/\(covers:\s*([^)]*)\)/gi)) {
+      for (const raw of cov[1].split(",")) { const id = reqId(raw); if (/^REQ-\d+$/.test(id) && !covers.includes(id)) covers.push(id); }
+    }
     acceptance_criteria.push(covers.length ? { text, covers } : text);
   }
   return {
@@ -929,6 +943,28 @@ export async function cli(rawArgv) {
     || (operation ? OP_OWNER[operation] : null);
   if (!worker || !operation) { console.error("compile-order: could not resolve --worker/--operation"); process.exit(2); }
 
+  // GATE COACH-1 HAS A DETERMINISTIC CALL SITE: THE COACH DISPATCH. The gate asks whether a PO is
+  // present to categorize feedback; its answer used to be a prose instruction inside the coach
+  // skill, so an unattended lane could dispatch a coach nobody would answer and no row recorded the
+  // decision. Compiling the coach order resolves it with the run's own answer set and records the
+  // row; `skip` refuses the order, which is what "no live PO" means. `ask` compiles it — the
+  // categorization conversation the coach then holds IS the answer.
+  if (operation === "coach") {
+    const ga = readReceipt(receipt(cwd, slug))?.config?.gate_answers ?? null;
+    const presetName = ga && PRESETS[ga] ? ga : null;
+    let found = discover({ cwd, slug, preset: presetName, file: ga && !presetName ? ga : null });
+    if (found.error) found = { set: PRESETS.interactive, source: "preset:interactive (no answer set on disk)" };
+    const r = resolveGate(found.set, "COACH-1", found.source);
+    appendGateLedger(cwd, slug, {
+      at: new Date().toISOString(), run_id: readRunId(cwd, slug), gate: "COACH-1", status: r.status,
+      decision: r.decision ?? null, source: r.source ?? found.source, note: r.note ?? r.reason ?? null, round: null,
+    });
+    if (r.decision === "skip") {
+      console.error(`compile-order: GATE COACH-1 resolved "skip" (${r.source ?? found.source}) — no live PO to categorize feedback, so no coach order is compiled. The decision is on the gate ledger.`);
+      process.exit(3);
+    }
+  }
+
   // Task selection.
   let tasks;
   const board = readBoard(cwd, slug);

package/kernel/init/run.mjs

@@ -70,6 +70,7 @@
 // one moment it mattered named a mechanism that does not parse.
 
 import { mkdirSync, writeFileSync, readFileSync, readdirSync, existsSync, copyFileSync, rmSync, statSync } from "node:fs";
+import { discover, resolve as resolveGate, appendGateLedger, PRESETS } from "../gate.mjs";
 import { join, dirname, resolve, relative, sep } from "node:path";
 import { createHash } from "node:crypto";
 import { decideLane, treeSize } from "./fit.mjs";
@@ -671,6 +672,29 @@ export function cli(rawArgv) {
   mkdirSync(dirname(pointer), { recursive: true });
   writeFileSync(pointer, JSON.stringify({ slug, started_at: startedAt }, null, 2) + "\n", "utf8");
 
+  // GATE L0 HAS A DETERMINISTIC CALL SITE: THE RUN'S OPENING. It used to be a line of prose the
+  // tech lead was asked to act on, and the same consumer ledgered L0 on one run and not the next.
+  // The intake conversation is the L0 decision; opening the run is the act that records it, with
+  // the answer set the run was configured with (a preset name or a file), else the interactive
+  // defaults. Best-effort: a row that cannot be written must not fail the opening.
+  try {
+    const ga = config.gate_answers ?? null;
+    const presetName = ga && PRESETS[ga] ? ga : null;
+    const found = discover({ cwd, slug, preset: presetName, file: ga && !presetName ? ga : null });
+    // A preset or file answers L0 for the run; a run with neither — the interactive lane, where the
+    // tech lead held the intake conversation before opening it — has that conversation as its L0
+    // decision, and the opening records it as such. An answer set that says `ask` is recorded as
+    // `ask`: the row states what the set said, and the intake note says what happened.
+    const r = found.error
+      ? { status: "ok", decision: "proceed", source: "intake (no answer set on disk)", note: "the intake conversation is the L0 decision" }
+      : resolveGate(found.set, "L0", found.source);
+    appendGateLedger(cwd, slug, {
+      at: startedAt, run_id: receipt.run_id, gate: "L0", status: r.status, decision: r.decision ?? null,
+      source: r.source ?? found.source, note: `${r.note ?? r.reason ?? ""} — run opened: intake recorded, receipt written`.replace(/^ — /, ""),
+      round: null,
+    });
+  } catch { /* the ledger row is a record of the opening, never a condition of it */ }
+
   console.log(JSON.stringify({
     ok: true,
     slug,

package/kernel/probe/attempts.mjs

@@ -30,7 +30,7 @@
 import { existsSync, readdirSync, readFileSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { runArgs } from "../lib/argv.mjs";
-import { dispatchReceipts, legLedger, resultsDir, readRunId } from "../lib/paths.mjs";
+import { dispatchReceipts, legLedger, resultsDir, readRunId, ordersDir } from "../lib/paths.mjs";
 import { readLegs } from "./leg.mjs";
 import { greenVerdict } from "./t0.mjs";
 
@@ -84,7 +84,16 @@ export function attemptEvidence(cwd, slug, scopeId, round, attempt, receipts, le
   // so this stays a file check and is deliberately NOT sufficient on its own. It can only turn an
   // already run-scoped receipt into `spent`; a result left behind by an earlier run cannot attest
   // an attempt this run never dispatched.
-  const hasResult = existsSync(join(resultsDir(cwd, slug), `${scopeId}-r${round}-a${attempt}.json`));
+  // A WorkResult carries no run key of its own; it answers THIS run's attempt only through the
+  // order of the same name, which this run's compile rewrote. A result left by a prior run over the
+  // same slug used to close an attempt this run had not even opened.
+  const stem = `${scopeId}-r${round}-a${attempt}.json`;
+  let orderIsMine = true;
+  if (runId != null) {
+    try { const o = JSON.parse(readFileSync(join(ordersDir(cwd, slug), stem), "utf8")); orderIsMine = !o?.run_id || o.run_id === runId; }
+    catch { orderIsMine = false; }
+  }
+  const hasResult = orderIsMine && existsSync(join(resultsDir(cwd, slug), stem));
   const state = !hasReceipt ? "unattested" : (hasResult || hasLeg) ? "spent" : "in-flight";
   return { orderId, hasReceipt, hasResult, hasLeg, state };
 }

package/kernel/probe/resume.mjs

@@ -65,6 +65,7 @@ import { parseBoard } from "../reduce/board.mjs";
 import { intake, harnessRun, wiringMap, projectProfile, scopesDir, resultsDir, ordersDir, orientDir, activeOrder, activeScope, usecasesDir, breadboard, receipt, readReceipt, requirements, exportRunDir, lastRun, readRunId, tasksDir, gates, verdictsDir, roundBuildDir } from "../lib/paths.mjs";
 import { evalVerdict } from "./eval.mjs";
 import { deriveRounds } from "./rounds.mjs";
+import { stagedWorkflowDrift, driftWarning } from "./staged.mjs";
 import { collectRun, writeRun } from "../report/export.mjs";
 
 /** The run-state values `references/protocol.md` (Part 4 — State) defines. A typo'd status is a rejection,
@@ -445,9 +446,11 @@ export function nextPhase(f) {
  *
  * @param {string} cwd - Project root.
  * @param {string} slug - Feature slug.
+ * @param {object} [opts] - `pluginRoot`, when the caller knows where the plugin it is running from
+ *   lives: the state then also reports whether the staged orchestrator is the installed one.
  * @returns {object} The ResumeState record (domain.schema.json $defs/ResumeState).
  */
-export function deriveResumeState(cwd, slug) {
+export function deriveResumeState(cwd, slug, { pluginRoot = null } = {}) {
   const hrPath = harnessRun(cwd, slug);
   const hr = existsSync(hrPath) ? parseFrontmatter(readFileSync(hrPath, "utf8")) : {};
 
@@ -517,7 +520,22 @@ export function deriveResumeState(cwd, slug) {
       .map((f) => Number(f.match(/\d+/)[0]))
       .filter((n) => evalVerdict(cwd, slug, n).found),
   };
-  return { ...facts, next_phase: nextPhase(facts) };
+  // WHICH ORCHESTRATOR THIS LAUNCH WILL RUN. A run keeps the workflow copy it opened with — right,
+  // and invisible: a relaunch after an upgrade executes the old one and reports normally, so every
+  // observation is of the previous release. Reported, never enforced (see probe/staged.mjs).
+  const staged = stagedWorkflowDrift(cwd, pluginRoot, slug);
+  const warning = driftWarning(staged);
+  return {
+    ...facts,
+    staged_workflow: {
+      checked: staged.checked,
+      drift: staged.drift.map((d) => d.file),
+      installed_version: staged.installed_version,
+      run_version: staged.run_version,
+      ...(warning ? { warning } : {}),
+    },
+    next_phase: nextPhase(facts),
+  };
 }
 
 /**
@@ -933,6 +951,9 @@ export const ARGV_SPEC = {
   // Not `--close`: the caller (shapeup-run.js's closeIfTerminal) hands over a RunReturn arm, never
   // a status it decided was terminal itself — RUN_RETURN_CLOSE/closeArm above make that call.
   "close-arm": { type: "str" },
+  // The launch hands its own plugin root so the state probe can say whether the orchestrator about
+  // to run is the installed one. Optional: a caller that does not know it gets `checked: false`.
+  "plugin-root": { type: "path" },
   cause: { type: "str" },
 };
 
@@ -1001,7 +1022,7 @@ export function cli(rawArgv) {
     process.exit(r.ok ? 0 : 3);
   }
 
-  console.log(JSON.stringify(deriveResumeState(cwd, args.slug)));
+  console.log(JSON.stringify(deriveResumeState(cwd, args.slug, { pluginRoot: args.pluginRoot ?? null })));
   process.exit(0);
 }
 

package/kernel/probe/staged.mjs

@@ -0,0 +1,83 @@
+// staged — is the orchestrator this launch will execute the one that is installed?
+//
+// A run stages its own copy of the workflow scripts into the local tier when it is OPENED, and
+// keeps that copy for the run's life. That is deliberate and right: an upgrade must not swap the
+// orchestrator under a run in flight. The consequence is not obvious from anywhere a person about
+// to soak an upgrade would look — relaunching an existing run after installing a new version
+// executes the OLD orchestrator, reports normally, closes normally, and every observation made of
+// it is an observation of the previous release. That is worse than a failed soak: it is confident
+// evidence about the wrong artifact.
+//
+// So the launch compares, and says so. A warning, never a block — the run keeping its copy is the
+// correct behaviour, and the operator is the one who decides whether this run is the one they
+// meant to measure.
+import { existsSync, readFileSync, readdirSync } from "node:fs";
+import { join } from "node:path";
+import { createHash } from "node:crypto";
+import { workflowsStage, receipt, readReceipt } from "../lib/paths.mjs";
+
+const sha256 = (buf) => createHash("sha256").update(buf).digest("hex");
+
+/** A file's digest, or null when it cannot be read. */
+function digestOf(path) {
+  try { return sha256(readFileSync(path)); } catch { return null; }
+}
+
+/** The version the plugin at `pluginRoot` declares, or null. */
+export function installedPluginVersion(pluginRoot) {
+  if (!pluginRoot) return null;
+  try { return JSON.parse(readFileSync(join(pluginRoot, ".claude-plugin", "plugin.json"), "utf8")).version ?? null; }
+  catch { return null; }
+}
+
+/**
+ * How the orchestrator this launch will run compares with the one installed.
+ *
+ * @param {string} cwd - Project root.
+ * @param {(string|null)} pluginRoot - The installed plugin's root, as the launch knows it.
+ * @param {(string|null)} [slug] - The run, when the caller knows it — for the version the run opened under.
+ * @returns {object} `{checked, drift, staged_dir, plugin_root, installed_version, run_version}`.
+ *   `drift` lists each script whose staged copy differs from the installed one; `checked: false`
+ *   means the comparison could not be made (no plugin root, or nothing staged), which is not the
+ *   same fact as "they agree" and is reported as itself.
+ */
+export function stagedWorkflowDrift(cwd, pluginRoot, slug = null) {
+  const stagedDir = workflowsStage(cwd);
+  const srcDir = pluginRoot ? join(pluginRoot, "skills", "tech-lead", "workflows") : null;
+  const out = {
+    checked: false,
+    drift: [],
+    staged_dir: stagedDir,
+    plugin_root: pluginRoot ?? null,
+    installed_version: installedPluginVersion(pluginRoot),
+    run_version: slug ? (readReceipt(receipt(cwd, slug))?.plugin?.version ?? null) : null,
+  };
+  if (!srcDir || !existsSync(srcDir) || !existsSync(stagedDir)) return out;
+  let names;
+  try { names = readdirSync(stagedDir).filter((f) => f.endsWith(".js")).sort(); } catch { return out; }
+  if (!names.length) return out;
+  out.checked = true;
+  for (const f of names) {
+    const staged = digestOf(join(stagedDir, f));
+    const installed = digestOf(join(srcDir, f));
+    // A script the installed plugin no longer carries is drift too — the staged copy is running
+    // something that has no counterpart in what is installed.
+    if (staged !== installed) out.drift.push({ file: f, staged_sha256: staged, installed_sha256: installed });
+  }
+  return out;
+}
+
+/**
+ * The one-line warning a launch prints, or null when there is nothing to say.
+ * @param {object} d - A {@link stagedWorkflowDrift} result.
+ * @returns {(string|null)} Operator-facing text naming both versions.
+ */
+export function driftWarning(d) {
+  if (!d?.checked || !d.drift.length) return null;
+  const versions = d.run_version && d.installed_version && d.run_version !== d.installed_version
+    ? ` The run opened under plugin ${d.run_version}; ${d.installed_version} is installed.`
+    : d.installed_version ? ` Installed plugin: ${d.installed_version}.` : "";
+  return `the orchestrator this launch runs is NOT the installed one — ${d.drift.length} staged script(s) differ `
+    + `(${d.drift.map((x) => x.file).join(", ")}).${versions} A run keeps the copy it opened with, by design, so this `
+    + `launch measures the release the run was opened under. Open a NEW run to soak an upgrade.`;
+}

package/kernel/probe/t0.mjs

@@ -16,7 +16,7 @@
 import { existsSync, readdirSync, readFileSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { runArgs } from "../lib/argv.mjs";
-import { verdictsDir } from "../lib/paths.mjs";
+import { verdictsDir, readRunId } from "../lib/paths.mjs";
 
 /**
  * Verdict filenames, newest first by their NUMERIC address.
@@ -55,10 +55,15 @@ export function greenVerdict(cwd, slug, scopeId, round) {
   if (!existsSync(dir)) return { green: false, path: null };
   // Newest first: an attempt retried after a red one writes a higher trial ordinal at the same
   // (round, attempt) address, and the LAST verdict is the one that stands.
+  // THIS RUN'S VERDICTS. Verdicts over one slug accumulate across runs and carry the run's key; a
+  // second run used to be told its scope was green on the first run's artifact, and the round loop
+  // skipped building it. A verdict with no key at all predates the key and is kept.
+  const runId = readRunId(cwd, slug);
   for (const f of newestFirst(readdirSync(dir).filter((x) => x.endsWith(".json")))) {
     const p = join(dir, f);
     try {
       const b = JSON.parse(readFileSync(p, "utf8"));
+      if (runId && b.run_id && b.run_id !== runId) continue;
       if (b.scope_id === scopeId && (round == null || b.round === round) && b.overall === "green") return { green: true, path: p };
     } catch { /* a torn artifact proves nothing; keep looking */ }
   }

package/kernel/reduce/graph.mjs

@@ -33,7 +33,7 @@ import {
   localRoot, receipt as receiptPath, ordersDir, resultsDir, verdictsDir, trials as trialsPath, gates as gatesPath, scopesDir, usecasesDir, requirements as requirementsPath, wiringMap as wiringMapPath, legLedger,
 } from "../lib/paths.mjs";
 import { readAllContracts, readContract, ucId, reqId, SCOPE_CONTRACT, WIRING_MAP } from "../lib/contract.mjs";
-import { runIdFromReceipt } from "../lib/paths.mjs";
+import { runIdFromReceipt, readRunId } from "../lib/paths.mjs";
 
 /** The graph's home — one file per feature, beside the run trace it projects. */
 export const graphPath = (cwd, slug) => join(localRoot(cwd, slug), "graph.jsonl");
@@ -384,7 +384,16 @@ export function appendGraph(cwd, slug) {
 export function runSubgraph(cwd, slug) {
   const { nodes, edges, lines } = readGraph(cwd, slug);
   const of = (t) => [...nodes.values()].filter((n) => n.t === t);
-  const orders = of("Order"), results = of("Result"), verdicts = of("Verdict");
+  // ONE RUN'S SUBGRAPH. The graph is append-only over a slug and every run of it lands there; this
+  // query used to aggregate every run's verdicts into `green_scopes_by_round` and report the FIRST
+  // run ever recorded as `run`, so a relaunch skipped scopes a prior run had built. Work nodes carry
+  // the run key and are filtered on it; a node with no key predates the key and is kept; a Result
+  // has no key of its own and belongs to the run its Order does.
+  const runId = readRunId(cwd, slug);
+  const mine = (n) => !runId || !n.run_id || n.run_id === runId;
+  const orders = of("Order").filter(mine), verdicts = of("Verdict").filter(mine);
+  const orderIds = new Set(orders.map((o) => o.order_id));
+  const results = of("Result").filter((r) => !runId || orderIds.has(r.order_id));
   const resultIds = new Set(results.map((r) => r.order_id));
   const ingestedFrom = new Set([...edges.values()].filter((e) => e.t === "INGESTED").map((e) => e.from));
   const greenByRound = {};
@@ -394,7 +403,7 @@ export function runSubgraph(cwd, slug) {
   }
   return {
     graph_lines: lines,
-    run: of("Run")[0]?.run_id ?? null,
+    run: runId ?? of("Run")[0]?.run_id ?? null,
     scopes: of("Scope").map((s) => s.scope_id).sort(),
     use_cases: of("UseCase").map((u) => u.use_case).sort(),
     requirements: of("Requirement").map((r) => r.req_id).sort(),

package/kernel/reduce/hill.mjs

@@ -6,7 +6,7 @@
 import { readFileSync, writeFileSync, existsSync, readdirSync, mkdirSync } from "node:fs";
 import { resolve, join } from "node:path";
 import { runArgs } from "../lib/argv.mjs";
-import { scopesDir, hillDir, verdictsDir, resultsDir, discoveryLedger, localRoot } from "../lib/paths.mjs";
+import { scopesDir, hillDir, verdictsDir, resultsDir, discoveryLedger, receipt, readRunId } from "../lib/paths.mjs";
 import { readAllContracts, SCOPE_CONTRACT } from "../lib/contract.mjs";
 import { evalVerdict } from "../probe/eval.mjs";
 import { redBuildRounds } from "../verify/build.mjs";
@@ -190,9 +190,15 @@ export function deriveHill(cwd, slug) {
   // and reports what they currently support, in both directions. A guard phrased as "never lower a
   // phase" would quietly turn a derived value into a high-water mark, which is a different defect
   // wearing this one's clothes. The condition is the narrowest one that is positively provable:
-  // the tier holding every input is not there.
+  // the RUN is not there — its receipt, the record every run's first act writes. The condition used
+  // to be the local root's existence, and any single file satisfies that: `reduce graph` creates
+  // `graph.jsonl` under it as a side effect, so a committed-only checkout that ran graph and then
+  // hill had its FINISHED shards flattened to UPHILL_UNKNOWN, exit 0, no warning. A backstop whose
+  // condition another command satisfies is a backstop only in the order nobody varied.
   // -------------------------------------------------------------------------------------------
-  if (!existsSync(localRoot(cwd, slug))) {
+  // Evidence the derivation actually needs: the run's receipt, or the T0 verdicts it reads. A
+  // `graph.jsonl` alone is neither.
+  if (!existsSync(receipt(cwd, slug)) && !existsSync(verdictsDir(cwd, slug))) {
     return scopes.map((s) => ({
       scope_id: s.scope_id,
       phase: committedPhase(hDir, s.scope_id),
@@ -235,11 +241,14 @@ export function deriveHill(cwd, slug) {
   // verdict counting exactly as before.
   const redRounds = redBuildRounds(cwd, slug);
   const t0Facts = {};
+  // This run's verdicts only — a prior run's green over the same slug moved this run's dot.
+  const hillRunId = readRunId(cwd, slug);
   if (existsSync(vDir)) {
     for (const f of readdirSync(vDir)) {
       if (!f.endsWith(".json")) continue;
       try {
         const b = JSON.parse(readFileSync(join(vDir, f), "utf8"));
+        if (hillRunId && b.run_id && b.run_id !== hillRunId) continue;
         if (!t0Facts[b.scope_id]) t0Facts[b.scope_id] = { hasGreen: false, seesawGreen: false };
         if (b.overall === "green" && !redRounds.has(Number(b.round))) {
           t0Facts[b.scope_id].hasGreen = true;

package/kernel/report/export.mjs

@@ -130,6 +130,11 @@ function t0Row(a, runId) {
     fixtures_green: a?.fixtures_green ?? null,
     db_probe_green: a?.db_probe_green ?? null,
     seesaw_green: a?.seesaw_green ?? null,
+    // One field a reader compares, and the block itself stays in the artifact for a human to diff:
+    // two rows with the same tree and different env digests are two machines, not a regression.
+    env_sha256: a?.env?.env_sha256 ?? null,
+    tree_head: a?.env?.tree?.head ?? null,
+    tree_dirty: a?.env?.tree?.dirty ?? null,
     fixtures_total: fixtures.length,
     fixtures_passed: fixtures.filter((f) => f?.pass === true).length,
     seesaw_ran: a?.seesaw?.ran ?? null,

package/kernel/schemas/domain.schema.json

@@ -1354,6 +1354,21 @@
             "$ref": "#/$defs/AegisTriple"
           },
           "description": "Populated only on red; feeds the next order."
+        },
+        "env": {
+          "type": "object",
+          "description": "Where the fixtures ran — host, cwd, git tree, resolved toolchain paths, lockfile digests, profile-declared cache dirs, and a digest over an allowlist of environment variable VALUES (names in the clear, values never stored). `env_sha256` digests the whole block, so a reader compares one field and a human diffs the rest: two verdicts with the same tree and different digests were measured on different machines, which is a fact about portability rather than a regression. Written by kernel/verify/env.mjs, which judges nothing — no field here makes a verdict green or red.",
+          "properties": {
+            "schema_version": { "const": 1 },
+            "env_sha256": { "type": "string" },
+            "host": { "type": "object", "description": "platform, arch, os_release, node, hostname_sha256 (hashed — equality is all a reader needs)." },
+            "cwd": { "type": "string", "description": "Absolute: a path-keyed toolchain cache is identified by this." },
+            "tree": { "type": "object", "description": "git head, branch, and a dirty flag — which says something differs, never what." },
+            "toolchain": { "type": "array", "description": "Each invoked binary as written, and where it resolved on this machine (null when nothing resolved it)." },
+            "lockfiles": { "type": "array", "description": "Digest per lockfile present at the root. Says what was declared, never what is installed." },
+            "caches": { "type": ["array", "null"], "description": "Cache dirs the project profile declares, resolved. null means the profile declared none — NOT that there are none." },
+            "env": { "type": "object", "description": "The allowlist of variable names, and one digest over their values." }
+          }
         }
       }
     },
@@ -2652,6 +2667,17 @@
           "description": "ANALYZE finished: the spec folder's usecases/ carries at least one use case that is not _index.md. WIRE reads these — one wiring-map entry per use case — which is why ANALYZE precedes WIRE in the phase chain: dispatched against an empty spec folder, WIRE escalates on every launch."
         },
         "has_board": { "type": "boolean", "description": "The per-machine board (tasks/TASK-*.md) holds at least one task. ANALYZE is complete only with both the committed spec tree and this; a committed tree with no board resumes at analyze, where the board-only operation regenerates it." },
+        "staged_workflow": {
+          "type": "object",
+          "description": "Whether the orchestrator this launch will execute is the installed one. A run stages its own copy of the workflow scripts when it is OPENED and keeps them for its life — right for a run in flight, and silent: relaunching after an upgrade executes the OLD orchestrator, reports normally, and every observation is of the previous release. `checked: false` means the comparison could not be made (no plugin root, nothing staged), which is not the same fact as agreement. A warning, never a block: opening a new run is how an upgrade is soaked.",
+          "properties": {
+            "checked": { "type": "boolean" },
+            "drift": { "type": "array", "items": { "type": "string" }, "description": "Staged scripts whose bytes differ from the installed plugin's." },
+            "installed_version": { "type": ["string", "null"] },
+            "run_version": { "type": ["string", "null"], "description": "The plugin version the run's receipt records — what this run actually opened under." },
+            "warning": { "type": "string" }
+          }
+        },
         "has_requirements": {
           "type": "boolean",
           "description": "The requirements registry is on disk: shapeup/<slug>/requirements.md exists. A PLAIN FACT, not a phase — the orchestrator guards its single `coverage` dispatch on this boolean, and it is deliberately absent from kernel/probe/resume.mjs's PHASE_ARTIFACT map, which doubles as nextPhase()'s ordered list: an entry there would fast-forward every run recorded before the registry existed to the registry instead of to build."

package/kernel/verify/build.mjs

@@ -42,7 +42,7 @@ import { join, resolve } from "node:path";
 import { spawnSync } from "node:child_process";
 import { createHash } from "node:crypto";
 import { runArgs, isMain } from "../lib/argv.mjs";
-import { harnessRun, projectProfile, roundBuildDir, localRoot, runIdFromRoot } from "../lib/paths.mjs";
+import { harnessRun, projectProfile, roundBuildDir, localRoot, runIdFromRoot, readRunId } from "../lib/paths.mjs";
 import { readContract, readAllContracts, PROJECT_PROFILE, SCOPE_CONTRACT, splitFrontmatter } from "../lib/contract.mjs";
 import { scopesDir } from "../lib/paths.mjs";
 import { digest } from "../probe/digest.mjs";
@@ -231,9 +231,15 @@ export function redBuildRounds(cwd, slug) {
   const latest = new Map();
   let files;
   try { files = readdirSync(roundBuildDir(cwd, slug)); } catch { return new Set(); }
+  // This run's gates only: a prior run's red round over the same slug must not hold this run's dot.
+  const runId = readRunId(cwd, slug);
   for (const f of files) {
     const m = f.match(/^r(\d+)-t(\d+)\.json$/);
     if (!m) continue;
+    if (runId) {
+      try { const g = JSON.parse(readFileSync(join(roundBuildDir(cwd, slug), f), "utf8")); if (g?.run_id && g.run_id !== runId) continue; }
+      catch { continue; }
+    }
     const round = Number(m[1]), trial = Number(m[2]);
     if (!latest.has(round) || latest.get(round).trial < trial) latest.set(round, { trial, file: f });
   }

package/kernel/verify/env.mjs

@@ -0,0 +1,180 @@
+// env — the machine a T0 verdict was measured on.
+//
+// A T0 artifact records `exit 0`, `pass: true` and a captured tail, and the harness treats that as
+// the fact a generator cannot fabricate. What it did not record is that the command's outcome
+// depended on state outside the tree. Measured on a consumer whose toolchain resolves its build
+// plugins through a cache keyed by the project's ABSOLUTE PATH: the working tree built green; a
+// clone of the same commit at a different path failed on a registry 404; a clone with a
+// hand-seeded cache compiled a different plugin set and produced two errors the original never
+// saw. Three environments, three outcomes, one tree — and three byte-identical verdicts apart from
+// their captured output.
+//
+// The consequence is not that such a project is badly configured; that is its own problem. It is
+// that a green verdict is portable evidence in appearance only, and nothing in it said so. This
+// module records enough about where a command ran that two machines disagreeing can be told from a
+// regression. It measures and never judges: no field here makes a verdict green or red.
+//
+// WHAT IS DELIBERATELY NOT HERE. No wall clock — a duration is not an environment fact and invites
+// comparing speeds across machines. No dependency-tree manifest — the lockfile digest plus the
+// cache paths answer the decision this record exists for, and a manifest is unbounded. No raw
+// environment values: variables are hashed, never stored, and only from a declared allowlist.
+import { existsSync, readFileSync, statSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { createHash } from "node:crypto";
+import { spawnSync } from "node:child_process";
+import { platform, arch, release, hostname } from "node:os";
+import { splitFrontmatter } from "../lib/contract.mjs";
+
+const sha256 = (t) => createHash("sha256").update(t).digest("hex");
+
+/** Lockfiles worth digesting, by ecosystem. Bounded on purpose — a glob would walk the tree. */
+export const LOCKFILES = [
+  "package-lock.json", "npm-shrinkwrap.json", "yarn.lock", "pnpm-lock.yaml", "bun.lockb",
+  "oh-package-lock.json5", "Podfile.lock", "Gemfile.lock", "Cargo.lock", "go.sum",
+  "poetry.lock", "Pipfile.lock", "composer.lock", "gradle.lockfile", "pubspec.lock",
+];
+
+/**
+ * Environment variables whose VALUES are hashed into the fingerprint. Names are recorded in the
+ * clear; values never are. Kept short and reviewed — a wide allowlist is how a token ends up
+ * hashed into a record somebody later publishes.
+ */
+export const ENV_ALLOWLIST = ["PATH", "NODE_ENV", "CI", "LANG", "TZ"];
+
+/** What an unset variable hashes as — distinct from a variable set to the empty string. */
+const UNSET = "<unset>";
+
+/**
+ * The tokens a shell command actually invokes — one per `&&`/`;`/`||` segment, with `cd`, `env` and
+ * `VAR=value` prefixes stripped. Returns the token AS WRITTEN (`./scripts/t0-assemble.sh`,
+ * `/Applications/…/hvigorw`), because the resolved path is the signal a basename loses.
+ *
+ * @param {string} cmd - A shell command line.
+ * @returns {string[]} Invoked tokens, in order, without duplicates.
+ */
+export function invokedTokens(cmd) {
+  const out = [];
+  for (const seg of String(cmd || "").split(/&&|;|\|\|/).map((s) => s.trim()).filter(Boolean)) {
+    if (seg.startsWith("cd ")) continue;
+    const tokens = seg.split(/\s+/).filter((t) => t && !/^[A-Za-z_][A-Za-z0-9_]*=/.test(t) && t !== "env" && t !== "cd");
+    if (tokens.length && !out.includes(tokens[0])) out.push(tokens[0]);
+  }
+  return out;
+}
+
+/** Where a token resolves on this machine, or null when nothing resolves it. */
+function resolveBin(token, cwd) {
+  try {
+    const r = spawnSync(`command -v ${JSON.stringify(token)}`, { shell: true, cwd, encoding: "utf8", timeout: 10_000 });
+    const p = (r.stdout || "").trim().split("\n")[0];
+    return p || null;
+  } catch { return null; }
+}
+
+/** `git rev-parse HEAD` plus whether the tree is dirty. All null outside a repository. */
+function treeState(cwd) {
+  const git = (args) => {
+    try {
+      const r = spawnSync("git", args, { cwd, encoding: "utf8", timeout: 20_000 });
+      return r.status === 0 ? (r.stdout || "").trim() : null;
+    } catch { return null; }
+  };
+  const head = git(["rev-parse", "HEAD"]);
+  if (head === null) return { head: null, dirty: null, branch: null };
+  const porcelain = git(["status", "--porcelain"]);
+  return {
+    head,
+    // A dirty flag says "something differs", never what — the honest limit of one boolean, and the
+    // reason `head` alone cannot call two measurements the same measurement.
+    dirty: porcelain === null ? null : porcelain.length > 0,
+    branch: git(["rev-parse", "--abbrev-ref", "HEAD"]),
+  };
+}
+
+/**
+ * Cache directories the project profile declares, resolved. A path-keyed cache is identified by its
+ * path, which is exactly the mechanism that made one tree build three ways.
+ *
+ * `null` means the profile declared nothing — NOT that there are none. "Not asked" and "none" are
+ * different facts, and collapsing them is the mistake the seesaw arm already makes elsewhere.
+ *
+ * @param {(string|null)} profilePath - `shapeup/<slug>/project-profile.md`, when the caller knows it.
+ * @returns {(object[]|null)} One entry per declared cache, or null when none is declared.
+ */
+export function declaredCaches(profilePath) {
+  if (!profilePath || !existsSync(profilePath)) return null;
+  let meta;
+  try { meta = splitFrontmatter(readFileSync(profilePath, "utf8")).meta || {}; } catch { return null; }
+  const raw = meta.cache_dirs ?? meta.caches ?? null;
+  const list = Array.isArray(raw)
+    ? raw
+    : typeof raw === "string" && raw.trim() && raw.trim() !== "~"
+      ? raw.replace(/^\[|\]$/g, "").split(",").map((s) => s.trim().replace(/^["']|["']$/g, "")).filter(Boolean)
+      : null;
+  if (!list || !list.length) return null;
+  return list.map((p) => {
+    const path = p.startsWith("~") ? join(process.env.HOME || "", p.slice(1)) : p;
+    let mtime = null;
+    try { mtime = statSync(path).mtime.toISOString(); } catch { /* absent is a fact, not an error */ }
+    return { declared: p, path, exists: existsSync(path), mtime };
+  });
+}
+
+/**
+ * Stable JSON: object keys sorted at every depth, so a digest does not depend on insertion order.
+ * @param {*} value - Anything JSON-representable.
+ * @returns {string} The canonical form.
+ */
+export function canonical(value) {
+  if (Array.isArray(value)) return `[${value.map(canonical).join(",")}]`;
+  if (value && typeof value === "object") {
+    return `{${Object.keys(value).sort().map((k) => `${JSON.stringify(k)}:${canonical(value[k])}`).join(",")}}`;
+  }
+  return JSON.stringify(value ?? null);
+}
+
+/**
+ * The environment block a T0 verdict carries.
+ *
+ * @param {string} rawCwd - The directory the fixtures ran in; resolved to an absolute path here.
+ * @param {object} [opts] - `commands` (the fixture command lines) and `profilePath`.
+ * @returns {object} `{schema_version, host, cwd, tree, toolchain, lockfiles, caches, env, env_sha256}`.
+ *   `env_sha256` digests the block itself, so a reader compares one field and a human diffs the
+ *   rest. Without the digest every consumer re-implements the comparison and they disagree, which
+ *   is three key spaces for one id waiting to happen on a new record.
+ */
+export function environmentFingerprint(rawCwd, { commands = [], profilePath = null } = {}) {
+  // ABSOLUTE, always. A caller that ran with `--cwd .` would otherwise record "." as the place —
+  // and the place is the whole point: the cache that made one tree build three ways is keyed by
+  // the project's absolute path.
+  const cwd = resolve(rawCwd || process.cwd());
+  const tokens = [...new Set(commands.flatMap((c) => invokedTokens(c)))];
+  const block = {
+    schema_version: 1,
+    host: {
+      platform: platform(),
+      arch: arch(),
+      os_release: release(),
+      node: process.version,
+      // Hashed: equality is all a reader needs, and a hostname names a person's laptop.
+      hostname_sha256: sha256(hostname()),
+    },
+    cwd,
+    tree: treeState(cwd),
+    toolchain: tokens.map((bin) => ({ bin, path: resolveBin(bin, cwd) })),
+    lockfiles: LOCKFILES
+      .filter((f) => existsSync(join(cwd, f)))
+      .map((f) => {
+        try { return { file: f, sha256: sha256(readFileSync(join(cwd, f))) }; }
+        catch { return { file: f, sha256: null }; }
+      }),
+    caches: declaredCaches(profilePath),
+    env: {
+      allowlist: ENV_ALLOWLIST,
+      // One digest over the allowlisted names AND values: a PATH that changed shows up, and no
+      // value is stored.
+      sha256: sha256(ENV_ALLOWLIST.map((k) => `${k}=${process.env[k] ?? UNSET}`).join("\n")),
+    },
+  };
+  return { ...block, env_sha256: sha256(canonical(block)) };
+}

package/kernel/verify/t0.mjs

@@ -40,10 +40,11 @@ import { join, dirname } from "node:path";
 import { spawnSync } from "node:child_process";
 import { createHash } from "node:crypto";
 import { digest } from "../probe/digest.mjs";
+import { environmentFingerprint } from "./env.mjs";
 import { runArgs } from "../lib/argv.mjs";
 import { snapshot, restore, keptRef } from "./ratchet-tree.mjs";
 import { readContract, SCOPE_CONTRACT } from "../lib/contract.mjs";
-import { runIdFromRoot, localRoot, SHARED } from "../lib/paths.mjs";
+import { runIdFromRoot, localRoot, SHARED, projectProfile } from "../lib/paths.mjs";
 
 /**
  * The feature slug a scope contract belongs to, from its path.
@@ -576,6 +577,14 @@ export async function cli(rawArgv) {
   const { path, sha256: hash, trial } = writeArtifact(outDir, round, attempt, {
     ...(runId ? { run_id: runId } : {}),
     scope_id: contract.scope_id,
+    // WHERE IT RAN, beside what it measured. A verdict that records only the tree is portable
+    // evidence in appearance only: the same commit built three ways on three machines because the
+    // toolchain resolved through a path-keyed cache. This block does not judge — it is what lets a
+    // disagreeing re-run be told from a regression (see verify/env.mjs).
+    env: environmentFingerprint(cwd, {
+      commands: [...fixtures.results.map((r) => r.cmd), ...(dbProbe?.cmd ? [dbProbe.cmd] : [])],
+      profilePath: projectProfile(cwd, slugFromContractPath(contractPath)),
+    }),
     // The evidence, not just the score — see `commandEvidence` for what the three-field record
     // could not tell apart, and why `exit` still reads the way it always did.
     fixtures: fixtures.results.map((r) => commandEvidence(r)),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shapeup-sdlc",
-  "version": "3.7.7",
+  "version": "3.7.9",
   "description": "Shape Up for coding agents \u2014 with gates the agent can't talk its way past. Harness for Claude Code.",
   "bin": {
     "shapeup-sdlc": "bin/init.mjs"

package/skills/coach/SKILL.md

@@ -117,7 +117,7 @@ fields nobody used" → "Prefer the minimum DTO that satisfies the AC; don't add
 fields"). Keep the originating why — a rule without its reason gets ignored or misapplied.
 
 ### Step 2 — ⏸ GATE COACH-1: Categorize (ASK, never assume)
-This is the load-bearing gate. **Resolve it first** — `node
+This is the load-bearing gate. Dispatched with an order, it is already resolved and on the gate ledger: compiling a coach order crosses COACH-1 with the run's answer set and refuses the order on `skip`, so an order in your hands means `ask`. Invoked standalone, **resolve it first** — `node
 "${CLAUDE_PLUGIN_ROOT}/kernel/harness.mjs" gate --resolve COACH-1 --slug <slug>
 [--file <path>|--preset <name>]` — so the ledger carries a row for the decision this gate makes,
 same as every other gate in the run. Exit 0 (`decision=skip`) — an unattended lane with no live PO;

package/skills/tech-lead/workflows/shapeup-run.js

@@ -414,6 +414,16 @@ const RESUME = {
     has_orient_artifacts: { type: "boolean" },
     has_spec_tree: { type: "boolean" },
     has_board: { type: "boolean" },
+    staged_workflow: {
+      type: "object",
+      properties: {
+        checked: { type: "boolean" },
+        drift: { type: "array", items: { type: "string" } },
+        installed_version: nullable("string"),
+        run_version: nullable("string"),
+        warning: { type: "string" },
+      },
+    },
     // The requirements registry — a fact, not a phase. See the COVERAGE block below for why it is
     // guarded on this bare boolean and never asked about through `probe resume --require`.
     has_requirements: { type: "boolean" },
@@ -1232,7 +1242,14 @@ if (launchRecordAbort) return await withWarnings(launchRecordAbort);
 
 phase("Orient");
 
-const rs = await query(`probe resume --slug ${slug}`, RESUME, "Orient", "resume-state");
+const rs = await query(`probe resume --slug ${slug} --plugin-root "${args.pluginRoot}"`, RESUME, "Orient", "resume-state");
+// WHICH ORCHESTRATOR IS RUNNING. A run keeps the workflow copy it opened with — correct for a run
+// in flight, and silent: a relaunch after an upgrade executes the old script, reports normally and
+// closes normally, so every observation is of the previous release. Said out loud, never enforced.
+if (rs.staged_workflow?.warning) {
+  log(`RUN STATE — ${rs.staged_workflow.warning}`);
+  stateWarnings.push(rs.staged_workflow.warning);
+}
 // A probe that produced nothing is not an EMPTY run — it is an unknown one. Treating it as empty
 // would re-dispatch every phase from the top, over a run that may be in progress.
 if (!rs) {