shapeup-sdlc 3.7.9 → 3.7.12

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "shapeup-sdlc-plugin",
   "displayName": "ShapeUp SDLC Plugin",
-  "version": "3.7.9",
+  "version": "3.7.12",
   "description": "Shape Up SDLC harness for Claude Code: shaping, intake, orient, scope-mapping, building (T0-verified, sandboxed, scope-contracted), evaluation and QA skills orchestrated by a tech-lead.",
   "author": {
     "name": "Liberty Nguyen",

package/hooks/sandbox-guard.mjs

@@ -329,6 +329,11 @@ async function main() {
     allowed: [...(o.substrate.allowed || []), ...(o.substrate.shared || [])],
     appendOnly: o.substrate.append_only || [],
     frozen: o.substrate.frozen || [],
+    // The one exception to "frozen outranks everything", and it is the compiler's to grant, never
+    // the worker's to request: the paths THIS order authors, named from its own identity. A build
+    // leg's substrate freezes the whole run trace, so without this its own WorkResult — its
+    // documented last step — would be denied along with every channel it must not touch.
+    own: o.substrate.own || [],
   })).filter((c) => c.allowed.length || c.appendOnly.length || c.frozen.length);
 
   if (contracts.length === 0) defer("no live order declares write/append/frozen boundaries", "no-whitelist");
@@ -363,6 +368,10 @@ async function main() {
     // a planner is graded against — so the compiler emitted a declaration with no enforcer, which is
     // the exact state this hook exists to end. A path a live contract freezes is a violation
     // wherever it lives.
+    // `own` first, and only against the contract that declared it: another live order's exception
+    // never licenses this write. A path no contract claims as its own falls through to the freeze.
+    if (contracts.some((c) => matchesAny(rel, c.own, fold))) continue;
+
     const freezer = contracts.find((c) => matchesAny(rel, c.frozen, fold));
     if (freezer) {
       violations.push(rel);

package/kernel/compile.mjs

@@ -211,13 +211,37 @@ export const OP_OWNER = {
  * operation, so mode/flag differences are enforced by the sandbox hook reading the order's substrate, not trusted to prose.
  * @param {string} operation - The order's operation (execute|fix|spike|analyze|reconcile|
  *   retrofit-surface|coverage|map-scopes|wire|evaluate|orient|hunt|translate|hammer|coach|scan|research).
- * @param {{slug?:string, specDir?:string, scope?:object}} [ctx] - slug (names LOCAL/SHARED roots),
- *   specDir (overrides the default spec path), scope (contract supplying allowed/shared substrates).
- * @returns {{allowed:string[], shared?:string[], frozen?:string[], append_only?:string[]}} The
- *   substrate contract: globs the worker may write (`allowed`), shared-write globs, read-only
- *   `frozen` globs, and `append_only` globs. An unknown operation returns a LOCAL-only default.
+ * @param {{slug?:string, specDir?:string, scope?:object, ownStem?:string}} [ctx] - slug (names
+ *   LOCAL/SHARED roots), specDir (overrides the default spec path), scope (contract supplying
+ *   allowed/shared substrates), ownStem (this order's own file stem, so a build leg may write its
+ *   own WorkResult and no one else's).
+ * @returns {{allowed:string[], shared?:string[], frozen?:string[], append_only?:string[], own?:string[]}}
+ *   The substrate contract: globs the worker may write (`allowed`), shared-write globs, read-only
+ *   `frozen` globs, `append_only` globs, and `own` — the paths this order may write DESPITE a
+ *   broader freeze, derived by the compiler from the order's own identity and never requested.
+ *   An unknown operation returns a LOCAL-only default.
  */
-export function substrateFor(operation, { slug, specDir, scope } = {}) {
+export function substrateFor(operation, ctx = {}) {
+  // EVERY ORDER NAMES THE RESULT IT ANSWERS WITH. A worker used to infer that path from its order's
+  // own filename — the one thing in the envelope that was convention rather than contract — so the
+  // one file every dispatch must write was the one the order did not mention. It is `own` for every
+  // operation now: the compiler derives it from the order's identity, which is also what keeps a leg
+  // from writing somebody else's.
+  const base = substrateTemplate(operation, ctx);
+  if (!ctx.ownStem) return base;
+  const ownResult = `${globLocal(ctx.slug)}/results/${ctx.ownStem}.json`;
+  return { ...base, own: [...new Set([...(base.own || []), ownResult])] };
+}
+
+/**
+ * The per-operation template {@link substrateFor} builds on.
+ *
+ * @param {string} operation - The order's operation.
+ * @param {object} [ctx] - As {@link substrateFor}: slug, specDir, scope, ownStem.
+ * @returns {{allowed:string[], shared?:string[], frozen?:string[], append_only?:string[], own?:string[]}}
+ *   The operation's write contract before the result path every order names is merged in.
+ */
+function substrateTemplate(operation, { slug, specDir, scope, ownStem = null } = {}) {
   const local = globLocal(slug);
   const spec = specDir || globShared(slug, "spec");
   const scopesDir = globShared(slug, "scopes");
@@ -266,15 +290,30 @@ export function substrateFor(operation, { slug, specDir, scope } = {}) {
   const FROZEN_ATTESTATION = [`${local}/receipts/**`, `${local}/legs.jsonl`, `${local}/t0/verdicts/**`, `${local}/tasks/_index.md`];
   switch (operation) {
     case "execute": case "fix": case "spike":
-      // Build legs are the widest window on FROZEN_INTAKE, not an exemption from it: they are the
-      // most numerous and longest-lived dispatches in a run, so a doer that can rewrite the staged
-      // pitch can rewrite the run's own input truth mid-build. `init run` stages these before any
-      // order is live (no live contract yet — nothing to violate) and `translate` writes the
-      // COMMITTED copy, not this one, so neither legitimate write is touched by this line.
+      // THE RUN TRACE IS THE KERNEL'S, EXCEPT WHAT THIS LEG AUTHORS. The freeze used to be a list of
+      // channels a defect had named — the staged pitch, the receipts, the leg ledger, the T0
+      // verdicts, the board index — and each review found more of the same class: the trial ledger,
+      // the gate ledger, the round build gates, the graph, the run args, the run ledger itself. A
+      // list that grows one defect at a time is not a boundary. So the boundary is inverted here:
+      // everything under the run trace is frozen for a build leg, and `own` carries the short,
+      // derived list of what such a leg actually writes. Everything else under there is written by
+      // the kernel in its own process or by the hook layer, and neither goes through this guard —
+      // so freezing it costs no legitimate write. `${local}/**` subsumes FROZEN_INTAKE and
+      // FROZEN_ATTESTATION for this operation, and a check asserts that rather than restating them.
       return {
         allowed: [...(scope?.allowed_file_substrate || []), `${local}/spikes/**`],
         shared: scope?.shared_substrate || [],
-        frozen: [...FROZEN_INTAKE, ...FROZEN_ATTESTATION],
+        frozen: [`${local}/**`],
+        own: [
+          // The result this order answers with, and no sibling's: a leg that can write another
+          // leg's WorkResult can report work nobody did, and ingest would have no way to tell.
+          // With no stem the caller is asking about the operation in general, not about one order,
+          // and the honest answer is the whole directory rather than a guess at which file.
+          ...(ownStem ? [`${local}/results/${ownStem}.json`] : [`${local}/results/**`]),
+          `${local}/tasks/TASK-*.md`,
+          `${local}/discovery/**`,
+          `${local}/spikes/**`,
+        ],
       };
     case "analyze":
       return { allowed: [`${spec}/**`, `${local}/**`], frozen: [...FROZEN_INTAKE] };
@@ -315,9 +354,22 @@ export function substrateFor(operation, { slug, specDir, scope } = {}) {
         frozen: [...FROZEN_SPEC_CORE, ...FROZEN_INTAKE, `${scopesDir}/**`, globShared(slug, "project-profile.md")],
       };
     case "evaluate":
-      return { allowed: [`${local}/evaluation/**`], frozen: [`${spec}/**`, ...FROZEN_INTAKE, `${local}/tasks/**`] };
+      // THE JUDGE MAY NOT WRITE THE EVIDENCE IT CITES. Its substrate froze the spec, the pitch and
+      // the board — and not `t0/verdicts/**`, so a judge could write a green verdict artifact into
+      // the canonical directory under the run-trace carve-out and then cite it, correctly hashed.
+      // Same inversion as a build leg: the run trace is the kernel's, and `own` names what the
+      // judge authors — its report and the envelope that answers its order.
+      return {
+        allowed: [],
+        frozen: [`${spec}/**`, `${local}/**`],
+        own: [`${local}/evaluation/**`, ...(ownStem ? [`${local}/results/${ownStem}.json`] : [`${local}/results/**`])],
+      };
     case "hunt":
-      return { allowed: [`${local}/qa/**`], frozen: [`${spec}/**`, ...FROZEN_INTAKE, `${local}/tasks/**`] };
+      return {
+        allowed: [],
+        frozen: [`${spec}/**`, `${local}/**`],
+        own: [`${local}/qa/**`, ...(ownStem ? [`${local}/results/${ownStem}.json`] : [`${local}/results/**`])],
+      };
     case "orient":
       return { allowed: [`${local}/orient/**`], frozen: [`${spec}/**`] };
     case "translate":
@@ -782,7 +834,7 @@ export function compileOrder({
     mode,
     ...(operation ? { operation } : {}),
     ...(interaction ? { interaction } : {}),
-    substrate: substrateFor(operation, { slug, specDir, scope }),
+    substrate: substrateFor(operation, { slug, specDir, scope, ownStem: suffix }),
     payload: {
       ...(scope ? { scope_contract: scope } : {}),
       ...(tasks?.length ? { tasks } : {}),

package/kernel/probe/eval.mjs

@@ -31,11 +31,11 @@
 // cause as its first deviation. A bare `ok: false` reached the operator as a sub-agent that died
 // after retries, while the one sentence naming the actual cause sat in a file nobody was pointed at.
 
-import { existsSync, readFileSync, readdirSync } from "node:fs";
-import { join, resolve } from "node:path";
+import { existsSync, readFileSync, readdirSync, realpathSync } from "node:fs";
+import { join, resolve, resolve as resolvePath, sep } from "node:path";
 import { createHash } from "node:crypto";
 import { runArgs } from "../lib/argv.mjs";
-import { resultsDir, scopesDir, readRunId } from "../lib/paths.mjs";
+import { resultsDir, scopesDir, readRunId, verdictsDir } from "../lib/paths.mjs";
 
 /** Longest `reason` reported. A deviation is prose written by a worker and can run to paragraphs. */
 const REASON_MAX = 400;
@@ -89,7 +89,7 @@ export function isScoped(cwd, slug) {
  * @returns {(string|null)} A reason phrased for an operator, or null when the file at `path` exists,
  *   hashes to the cited `sha256`, and its own `overall` reads "green".
  */
-function unresolvedCitation(cwd, citation, { round = null, runId = null } = {}) {
+function unresolvedCitation(cwd, citation, { round = null, runId = null, verdicts = null } = {}) {
   const rel = typeof citation?.path === "string" ? citation.path : "";
   if (!rel) return "names no artifact path";
   let text;
@@ -109,6 +109,19 @@ function unresolvedCitation(cwd, citation, { round = null, runId = null } = {})
   try { body = JSON.parse(text); }
   catch { return `cites ${rel}, whose bytes match the hash but do not read as a T0 verdict`; }
   if (body?.overall !== "green") return `cites ${rel}, whose own verdict is "${body?.overall ?? "unknown"}", not green`;
+  // INSIDE THIS RUN'S OWN VERDICTS DIRECTORY, resolved — asked of a file that exists, so "does not
+  // exist" and "resolves somewhere else" stay different answers. Accepted before this check: a
+  // green artifact in the source tree, one outside the project reached by `../`, one by absolute
+  // path, and a symlink in the verdicts directory pointing at a forged file. Every one hashed
+  // correctly, because a digest says the bytes are the file's and nothing about which file it
+  // should have been.
+  if (verdicts) {
+    const real = (() => { try { return realpathSync.native(resolvePath(cwd, rel)); } catch { return resolvePath(cwd, rel); } })();
+    const home = (() => { try { return realpathSync.native(verdicts); } catch { return verdicts; } })();
+    if (!real.startsWith(home.endsWith(sep) ? home : home + sep)) {
+      return `cites ${rel}, which resolves outside this run's own verdicts directory (${home}) — a verdict cites what this run's own verifier wrote, not a file the judge can reach`;
+    }
+  }
   // THE ARTIFACT HAS TO BE THE ONE THE CITATION SAYS IT IS. A re-hash proves the bytes are the
   // file's; it says nothing about whose verdict the file holds. A PASS citing scope alpha's green
   // artifact while declaring scope beta, or a prior round's, or a prior run's over the same slug,
@@ -198,8 +211,9 @@ export function citationProblem(cwd, slug, verdict, { round = null } = {}) {
       "cite the T0 verdict it re-hashed (the order lists them under payload.t0_artifacts)";
   }
   const runId = readRunId(cwd, slug);
+  const verdicts = verdictsDir(cwd, slug);
   for (const citation of verdict.t0_citations) {
-    const reason = unresolvedCitation(cwd, citation, { round, runId });
+    const reason = unresolvedCitation(cwd, citation, { round, runId, verdicts });
     if (reason) return `the ${verdict.overall} verdict ${reason} — a T0 citation is re-hashed from disk, never taken on the handed word`;
   }
   return null;

package/kernel/schemas/domain.schema.json

@@ -542,7 +542,14 @@
           "items": {
             "type": "string"
           },
-          "description": "Explicitly untouchable paths (spec core: domain-model, UC Steps, contracts, ux-behavior)."
+          "description": "Explicitly untouchable paths (spec core: domain-model, UC Steps, contracts, ux-behavior). A build leg's order freezes the whole run trace here and carves out what it authors through `own`: a freeze that lists the channels a defect happened to name grows one defect at a time and is not a boundary."
+        },
+        "own": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "Paths this order may write DESPITE a broader freeze — the compiler's grant, derived from the order's own identity and never requested by a worker. For a build leg: its own WorkResult (no sibling's — a leg that can write another's can report work nobody did), its task files, the discovery ledger, its spikes. Checked BEFORE `frozen`, and only against the contract that declared it, so another live order's exception never licenses this write."
         }
       }
     },

package/kernel/verify/env.mjs

@@ -52,6 +52,16 @@ const UNSET = "<unset>";
  * @param {string} cmd - A shell command line.
  * @returns {string[]} Invoked tokens, in order, without duplicates.
  */
+export function cdTargets(cmd) {
+  const out = [];
+  for (const seg of String(cmd || "").split(/&&|;|\|\|/).map((s) => s.trim()).filter(Boolean)) {
+    const m = seg.match(/^cd\s+(?:"([^"]+)"|'([^']+)'|(\S+))/);
+    const dir = m && (m[1] || m[2] || m[3]);
+    if (dir && !dir.startsWith("-") && !out.includes(dir)) out.push(dir);
+  }
+  return out;
+}
+
 export function invokedTokens(cmd) {
   const out = [];
   for (const seg of String(cmd || "").split(/&&|;|\|\|/).map((s) => s.trim()).filter(Boolean)) {
@@ -162,12 +172,19 @@ export function environmentFingerprint(rawCwd, { commands = [], profilePath = nu
     cwd,
     tree: treeState(cwd),
     toolchain: tokens.map((bin) => ({ bin, path: resolveBin(bin, cwd) })),
-    lockfiles: LOCKFILES
-      .filter((f) => existsSync(join(cwd, f)))
-      .map((f) => {
-        try { return { file: f, sha256: sha256(readFileSync(join(cwd, f))) }; }
-        catch { return { file: f, sha256: null }; }
-      }),
+    // The root AND wherever the commands actually run. Measured on a consumer whose fixtures are
+    // `cd app && …`: the lockfile that decides what the build resolves lives in `app/`, and a scan
+    // of the project root alone recorded an empty list beside a build whose dependencies were the
+    // whole question.
+    lockfiles: [...new Set(["", ...commands.flatMap((c) => cdTargets(c))])]
+      .flatMap((sub) => LOCKFILES
+        .map((f) => (sub ? `${sub.replace(/\/+$/, "")}/${f}` : f))
+        .filter((rel) => existsSync(join(cwd, rel)))
+        .map((rel) => {
+          try { return { file: rel, sha256: sha256(readFileSync(join(cwd, rel))) }; }
+          catch { return { file: rel, sha256: null }; }
+        }))
+      .filter((l, i, all) => all.findIndex((x) => x.file === l.file) === i),
     caches: declaredCaches(profilePath),
     env: {
       allowlist: ENV_ALLOWLIST,

package/kernel/verify/spec.mjs

@@ -422,6 +422,9 @@ export function lintScopeAnchors({ scopes, specDir: specRoot, reqIds = null, tas
   return findings;
 }
 
+/** Registry sources that name the pitch's own out-of-scope section, in the spellings pitches use. */
+const NOGO_SOURCE = /\bno[-\s]?gos?\b|\bnon[-\s]?goals?\b|\bout[-\s]of[-\s]scope\b|\bwill not build\b/i;
+
 /**
  * REQ-UNCOVERED — a live requirement that nothing in the plan reaches.
  *
@@ -451,6 +454,57 @@ export function lintScopeAnchors({ scopes, specDir: specRoot, reqIds = null, tas
  * @returns {Array<{rule:string, level:("red"|"warn"), scope:string, detail:string}>} One red per
  *   uncovered live requirement; [] when every one is graded, claimed or cut.
  */
+/**
+ * REQ-NARRATED — a committed spec file stating the requirement-coverage verdict as fact.
+ *
+ * The Health Dashboard's `Coverage` row is about USE CASES and tasks, derived by inverting each
+ * task's `use_case_refs` over the local board. Measured on a consumer, a worker filled its Signal
+ * cell with a different claim entirely — *"every registered non-CUT REQ-id (REQ-1 … REQ-7) reaches
+ * an AC carrying `(covers: REQ-…)`"*, with a 🟢 beside it — while a grep for `covers:` across the
+ * whole spec folder returned that sentence and nothing else. Not one acceptance criterion carried
+ * the clause, and the run's own derived report said `0/11 PASS`.
+ *
+ * `AGENTS.md` names the invariant this breaks: the requirements matrix is a projection, never a
+ * verdict, derived from files for one named run and never narrated. The rule is the narrow,
+ * checkable form of it — a dashboard Coverage row in a committed file may not name a REQ id — and
+ * it cannot fire on the legitimate signal, which counts use cases and tasks.
+ *
+ * @param {{cwd:string, slug:string}} opts - Working root and feature slug.
+ * @returns {object[]} Findings, one per offending line.
+ */
+export function lintNarratedCoverage({ cwd, slug }) {
+  const findings = [];
+  const dir = join(sharedRoot(cwd, slug), "spec");
+  let files;
+  try { files = readdirSync(dir).filter((f) => f.endsWith(".md")); } catch { return findings; }
+  for (const f of files) {
+    let lines;
+    try { lines = readFileSync(join(dir, f), "utf8").split(/\r?\n/); } catch { continue; }
+    lines.forEach((line, i) => {
+      if (!/^\|\s*Coverage\s*\|/i.test(line.trim())) return;
+      const named = [...line.matchAll(/\bREQ-\d+/g)].map((m) => m[0]);
+      if (!named.length) return;
+      findings.push({ rule: "REQ-NARRATED", level: "red", scope: `${f}:${i + 1}`, detail:
+        `${f}:${i + 1} states the requirement-coverage verdict in a committed file, naming ${named.slice(0, 3).join(", ")}` +
+        `${named.length > 3 ? ` (+${named.length - 3})` : ""}. That row is the UC × Task indicator; the ` +
+        "REQ → AC → criterion → verdict state is a projection derived per run (probe requirements), " +
+        "never a claim a committed artifact may make — a reader who checks the file finds corroboration " +
+        "for something no run measured. Say what the use cases and tasks show, and leave the requirement " +
+        "matrix to the run that derives it." });
+    });
+  }
+  return findings;
+}
+
+/**
+ * REQ-UNCOVERED and REQ-NOGO — the registry's two ways of being wrong about what ships.
+ *
+ * @param {{clauses:object[], board:object[], scopes:object[]}} opts - The parsed registry, the
+ *   board `readBoard` produced (its acceptance criteria carry the covers clauses), and the scope
+ *   contracts.
+ * @returns {object[]} Findings, most specific first: a no-go registered as covered is reported as
+ *   itself rather than as the coverage gap it inevitably becomes.
+ */
 export function lintRequirementCoverage({ clauses = [], board = [], scopes = [] }) {
   const findings = [];
   const graded = coveredReqIds(board);
@@ -459,6 +513,21 @@ export function lintRequirementCoverage({ clauses = [], board = [], scopes = []
   const claimed = new Set();
   for (const s of scopes) for (const r of s.covers || []) claimed.add(reqId(r).toUpperCase());
   for (const c of clauses) {
+    // A NO-GO IS A CONSTRAINT, NOT A DELIVERABLE, and marking one `covered` asserts something that
+    // cannot be true: nothing grades "do not build a settings screen". Measured on a consumer — a
+    // coverage dispatch lifted seven clauses out of the pitch's No-gos section, registered each as
+    // covered, and L1b then refused the run with seven REQ-UNCOVERED findings, correctly and
+    // unavoidably. Reported here as itself, so the operator reads one cause instead of seven
+    // symptoms, and named before REQ-UNCOVERED can fire on the same row.
+    if (c.status === "covered" && NOGO_SOURCE.test(c.source || "")) {
+      findings.push({ rule: "REQ-NOGO", level: "red", scope: c.id, detail:
+        `${c.id} ← ${c.source} registers a NO-GO as a covered requirement — "${(c.clause || "").slice(0, 60)}". ` +
+        "A no-go is a constraint the shape deliberately does not build, so no acceptance criterion can " +
+        "grade it and nothing downstream can ever turn it green. Mark it CUT (PO-approved) in " +
+        "requirements.md — the family that already means deliberately-not-built — or drop the row and give " +
+        "the breach a Test Surface row (TS-NOGO-NN) instead, which is the channel that does grade one." });
+      continue;
+    }
     if (c.status !== "covered") continue; // CUT (PO-approved) — an answer on the record, not a gap
     const id = c.id.toUpperCase();
     if (graded.has(c.id) || claimed.has(id)) continue;
@@ -851,6 +920,7 @@ export function lint({ cwd, slug }) {
     // `readBoard`, not the `tasks` above: only the compile-order parser carries acceptance_criteria.
     ...lintRequirementCoverage({ clauses: reqClauses, board: readBoard(cwd, slug), scopes }),
     ...lintCommittedTier({ cwd, slug }),
+    ...lintNarratedCoverage({ cwd, slug }),
     ...lintStructure({ specDir: specRoot, tasks, intakeContent }),
     ...(() => {
       const bbText = runBreadboard(cwd, slug, intakeContent);

package/kernel/verify/t0.mjs

@@ -194,13 +194,17 @@ export function runDbProbe(dbProbeCmd, cwd) {
  */
 export function seesawCheck(registryPath, cwd) {
   if (!registryPath || !existsSync(registryPath)) {
-    return { ran: false, pass: true, scopes_checked: [], failing: [] };
+    // `pass: null`, not `pass: true`: a check that did not run has no result, and recording one as
+    // clean is how "not asked" came to read as "nothing regressed". The verdict below still treats
+    // an absent seesaw as non-blocking — that part is deliberate while the arm is unwired — but the
+    // artifact now says which of the two it was.
+    return { ran: false, pass: null, scopes_checked: [], failing: [] };
   }
   let registry;
   try {
     registry = JSON.parse(readFileSync(registryPath, "utf8"));
   } catch {
-    return { ran: false, pass: true, scopes_checked: [], failing: [], error: "registry unparsable" };
+    return { ran: false, pass: null, scopes_checked: [], failing: [], error: "registry unparsable" };
   }
   const scopes = registry.scopes || [];
   const failing = [];
@@ -222,7 +226,12 @@ export function seesawCheck(registryPath, cwd) {
 export function computeVerdict({ fixtures, dbProbe, seesaw }) {
   const fixturesGreen = fixtures.pass;
   const dbGreen = dbProbe === null || dbProbe.pass;
-  const seesawGreen = !seesaw.ran || seesaw.pass;
+  // A seesaw that did not run does not hold the verdict red — the arm is declared and unwired, and
+  // blocking every build on it would be a different defect. It does not make it green either: the
+  // hill requires `ran && pass` before a scope may reach FINISHED, and `seesaw_green` here means
+  // "nothing this check found is wrong", which is true of a check that found nothing because it
+  // never looked.
+  const seesawGreen = seesaw.ran ? seesaw.pass === true : true;
   return {
     fixtures_green: fixturesGreen,
     db_probe_green: dbGreen,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shapeup-sdlc",
-  "version": "3.7.9",
+  "version": "3.7.12",
   "description": "Shape Up for coding agents \u2014 with gates the agent can't talk its way past. Harness for Claude Code.",
   "bin": {
     "shapeup-sdlc": "bin/init.mjs"

package/skills/ba-pitch-analyzer/assets/templates/synthesis.tmpl.md

@@ -26,6 +26,11 @@ depends_on:
 
 | Indicator | Status | Signal |
 |-----------|--------|--------|
+<!-- Coverage here is USE CASES × TASKS, derived by inverting each task's use_case_refs over the
+     local board. It is NOT requirement coverage: whether every REQ-id reaches an acceptance
+     criterion that a judge graded is a projection derived per run (`probe requirements`), and a
+     committed file that states it is corroborating something no run measured. Name REQ ids in this
+     row and spec-lint reds it (REQ-NARRATED). Count use cases and tasks; say nothing about REQ. -->
 | Coverage | COVERAGE_STATUS | COVERAGE_SIGNAL |
 | Risk | RISK_STATUS | RISK_SIGNAL |
 | Dependency | DEPENDENCY_STATUS | DEPENDENCY_SIGNAL |