shapeup-sdlc 3.9.2 → 3.11.0

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "shapeup-sdlc-plugin",
   "displayName": "ShapeUp SDLC Plugin",
-  "version": "3.9.2",
+  "version": "3.11.0",
   "description": "Shape Up SDLC harness for Claude Code: shaping, intake, orient, scope-mapping, building (T0-verified, sandboxed, scope-contracted), evaluation and QA skills orchestrated by a tech-lead.",
   "author": {
     "name": "Liberty Nguyen",

package/AGENTS.md

@@ -13,7 +13,7 @@ Skills and commands are named short throughout this file; every one of them reso
 - **The single writer is asked, never assumed.** A dispatch's result is applied by exactly one act — the ingest step — and that act leaves a leg row. Every phase post-condition and every settled build scope asks the leg ledger whether the row exists before any verdict on the phase or the scope, whatever the worker reported: a result on disk that nothing applied is ingested there if the scope is green, and otherwise named at the close as `unapplied_results=N`, never folded into "not green". A round that ends with nothing green names `breaker=none` and `stalled=no_green` unless the attested attempt census says a scope tripped — the close cannot name a breaker the census denies. The run graph carries a `Leg` node with an `INGESTED` edge from its `Result`, and the export a `leg` table, so "which results were never read" is one query.
 - GATE L2 is advisory — warns when EVAL runs over unfinished tasks, permits the call (per-machine board, operator asked; ADR-0001) — a signal, not a bug.
 - Sign-off is a file: each gate resolves from the answer set (`ci`/`guarded`/`interactive`) — cross, stop for the PO, or abort; the decision's source is ledgered.
-- **Every ending a run does not come back from records a close** — its status, its cause and its timestamp — derived from the ending itself rather than from a hand-kept pair, so an ending nobody enumerated cannot silently record nothing. The same close derives the ledger's verdict, its round count and its Rounds and Decisions tables from the run's own records — the ones the export reads — so the file a teammate opens first cannot contradict its own close line. A breaker trip that routes to GATE H closes the run as `escalated`, carrying the breaker in its cause; a pause records no close **by design**, because a relaunch resumes it.
+- **Every ending a run does not come back from records a close** — its status, its cause and its timestamp — derived from the ending itself rather than from a hand-kept pair, so an ending nobody enumerated cannot silently record nothing. The same close derives the ledger's verdict, its round count and its Rounds and Decisions tables from the run's own records — the ones the export reads — so the file a teammate opens first cannot contradict its own close line. A breaker trip that routes to GATE H closes the run as `escalated`, carrying the breaker in its cause; a pause records no close **by design**, because a relaunch resumes it. A relaunch that resumes a run which *did* close reopens it on the record: the earlier close is kept under `prior_closes`, the close fields clear, and the run's next ending is recorded as its own — so a run that aborted, was resumed and then shipped reads `shipped` with the abort beside it, never an abort under a `shipped` status. Opening a run over one that closed says it is closed, not open.
 - **Your scope cut decides your concurrency, not the dial.** Two scopes that both declare a write to one path never build at the same time: `shared` substrate is the sanctioned escape from disjointness, and an edit is read-modify-write, so concurrent writers silently drop each other's work. An entry point listed as writable by five scopes therefore builds five scopes one at a time whatever `--parallel-scopes` says. The run states the ceiling its contracts actually permit before dispatching anything, as a BUILD-order line — a peak below that ceiling is a dispatch problem, a ceiling below the dial is a scope-cut problem, and only the second is fixable by re-cutting. The fix is a cut where exactly one scope owns each entry point. Note the ceiling is narrated, not gated: it does not travel in the ⏸ L1b block, so an unattended run carries it only in its log.
 - The build+eval loop breaks only three ways ✦: EVAL PASS → QA → Ship; outer `round_budget` exhausted; opt-in `wall_clock_budget_s` tripped (the wall-clock axis event counters miss). Budget trips route to GATE H — ship what's green, never kill the run from outside. A scope exhausting its per-scope `attempt_budget` (T0 attempts) queues a GATE H proposal, never blocks the round. **An attempt is spent only when the attested channels say so** — a dispatch receipt, plus a leg row or a WorkResult. A compiled order and a T0 verdict are both writable by the scope being judged, so neither counts on its own, and an attempt still in flight holds the breaker open rather than tripping it. Opening the next attempt over an unanswered one is refused outright, because grading a tree the previous attempt may still be writing spends a budget on work nobody did.
 
@@ -36,12 +36,12 @@ Betting Table: PO decides; rejected pitches loop back to raw idea.
 | Wire | ⏸ **L1a.5** — Wiring Review ✚ | `/solution-architect` (`wire`): sole writer of committed `wiring-map.md` — per-UC engine → seam → entry-point call site → affordance, per `project-profile.md` |
 | Map Scopes | ⏸ **L1b** — Board Review (+ substrate disjointness lint) | `/scope-architect` (scope contracts ✦ — sole writer); traceability oracle advisory ✚. A registered requirement that no acceptance criterion grades and no scope claims is **red** here, and L1b prints the `REQ → AC` table: the two ways out are an AC carrying `(covers: REQ-…)` or the PO marking the clause `CUT (PO-approved)`. Red only where the plan is still cheap to change — after L1b nobody re-reads the pitch |
 | Build Vertically | ⏸ **L2** — Board 100% ✅ + T0-green ✦ | per dispatch: compile order → `/task-executor` (--order) → ingest result; T0-verified per attempt (fixtures + DB probe ✦), substrate-sandboxed ✦. Scopes build **concurrently** ✦ — `--parallel-scopes N` caps it (default 4), a scope is released the moment its own dependencies are green, and a scope green in this round is skipped rather than rebuilt. Then the **round build gate** ⚙: the ledger's run command, then the profile's `build_probe` and `launch_probe`, run once per round before EVAL — a red gate ends the round with no verdict and its failing step is compiled into the next round's orders as bugs; a `mobile` profile with no `launch_probe` is warned about every round, so the install/launch risk has an owner |
-| EVAL (once per round) | ⏸ **L3** — Verdict | `/spec-evaluator` (--order), only over a round whose build gate ⚙ is not red: spec- + test-surface-conformance ★, T0 citation ✦; refuted boxes/verdict applied by ingest |
+| EVAL (once per round) | ⏸ **L3** — Verdict | `/spec-evaluator` (--order), only over a round whose build gate ⚙ is not red: spec- + test-surface-conformance ★, T0 citation ✦; refuted boxes/verdict applied by ingest. The order names the round's build gate artifact and the profile's `launch_probe`, so a `[ui]` row is graded on the app the gate launched rather than recorded as no evidence — a project with no `launch_probe` still gets no on-device grade |
 | FAIL → round r+1 | — | regression rule ★: bugs + full Test Surface of touched UC |
 
 ✦ = requires scope contracts (`shapeup/<slug>/scopes/*.md`); ✚ = requires the spine artifacts (`requirements.md`, `wiring-map.md`, `project-profile.md`). Traceability stays advisory until `covers:` is populated. Absent artifact ⇒ arm skipped (non-regression).
 
-✧ **Two refusals, and they answer different questions.** Opening a run refuses outright when the worker skills are not on disk — the roster comes from the schema that defines it, so it cannot drift from a hand-kept list. That alone passes green on the two states that actually happen (installed but disabled, or a different version loaded), so the run's first act is one live canary dispatch, and the evidence is the hook layer's rather than the sub-agent's account of it. A run that cannot reach its workers stops before it spends anything, instead of reporting phases complete while none of the shipped craft was applied.
+✧ **Two refusals, and they answer different questions.** Opening a run refuses outright when the worker skills are not on disk — the roster comes from the schema that defines it, so it cannot drift from a hand-kept list. That alone passes green on the two states that actually happen (installed but disabled, or a different version loaded), so the run's first act is one live canary dispatch, and the evidence is the hook layer's rather than the sub-agent's account of it. A run that cannot reach its workers stops before it spends anything, instead of reporting phases complete while none of the shipped craft was applied. The same Preflight then runs the profile's `build_probe` and `launch_probe` once, from a sub-agent through the session's own grant, and writes nothing: a missing package install, a probe outside the grant or an absent device is reported before planning is paid for, not at the first round gate. It warns rather than refuses — a baseline can be red for a reason the feature is meant to fix — and whether a permission exists is judged by that run, never by reading a settings file.
 
 
 ### QA Edge Hunt (`/qa-edge-hunter`, post-PASS, pre-ship)

package/kernel/compile.mjs

@@ -44,7 +44,7 @@ import { writeActiveOrder } from "./probe/resume.mjs";
 import { greenVerdict } from "./probe/t0.mjs";
 import { attemptEvidence, readReceipts } from "./probe/attempts.mjs";
 import { readLegs } from "./probe/leg.mjs";
-import { latestRoundBuild } from "./verify/build.mjs";
+import { latestRoundBuild, latestRoundBuildFile, launchProbeFor } from "./verify/build.mjs";
 // The SAME matcher the sandbox hook enforces with. "Is this cited file inside this scope's
 // substrate" has to mean exactly what the guard means, or a bug is addressed to a scope that is
 // then denied the write that fixes it.
@@ -748,6 +748,42 @@ export function t0ArtifactsFor(cwd, slug, round) {
   return { artifacts, missing };
 }
 
+// --- the launch evidence the judge grades `[ui]` rows against ---------------------------------
+//
+// WHY THE KERNEL DERIVES IT. A `[ui]` criterion is graded on the RUNNING app, and the evaluator's
+// contract for getting one is `payload.run_cmd`; absent, an orchestrated evaluator escalates rather
+// than guess. The ledger's `run_cmd` is what the round build gate runs FIRST, as the build — on a
+// toolchain where building and launching are different acts it is a build, and the ledger carries
+// none at all when nobody pinned one. Meanwhile the gate had already run the project's launch probe
+// (install, start, assert the first screen) moments earlier, recorded its output, and left the
+// app up. None of that reached the order: the gate's artifact was forwarded only when RED, as the
+// next round's bug list, so a green launch was proven and then unavailable to the one reader who
+// needed it. Every `[ui]` row was graded "no evidence on the running app" over a build that launched.
+//
+// Two fields, both derived from disk, both optional, both absent when there is nothing to say —
+// the same non-regression rule as `t0_artifacts`: a project that declares no launch probe compiles
+// exactly the order it always did.
+
+/**
+ * What an evaluate order should carry about launching the app.
+ *
+ * @param {string} cwd - Project root.
+ * @param {string} slug - Feature slug.
+ * @param {number} [round] - The round being evaluated. Omitted, the newest gate artifact of any
+ *   round — a standalone evaluation has no round.
+ * @returns {{build_gate?: string, launch_cmd?: string}} `build_gate`: repo-relative path of this
+ *   run's newest round build gate artifact (each step's exit and output tail). `launch_cmd`: the
+ *   profile's launch probe. A key is omitted, never null, when its source is absent.
+ */
+export function launchEvidenceFor(cwd, slug, round) {
+  const out = {};
+  const gate = latestRoundBuildFile(cwd, slug, round);
+  if (gate) out.build_gate = relLocal(slug, "build", basename(gate.path));
+  const cmd = launchProbeFor(cwd, slug);
+  if (cmd) out.launch_cmd = cmd;
+  return out;
+}
+
 /**
  * Assemble a WorkOrder envelope. Pure given its inputs — the CLI wrapper does the disk reads.
  * @param {object} opts - The order inputs (destructured):
@@ -1093,6 +1129,13 @@ export async function cli(rawArgv) {
         `${missing.join(", ")}; the evaluator has nothing to cite for ${missing.length === 1 ? "that scope" : "those scopes"}`);
     }
   }
+  // The launch evidence, for every lane (see launchEvidenceFor). Same rule as above: an explicit
+  // `--payload` value outranks the derivation.
+  if (operation === "evaluate") {
+    const ev = launchEvidenceFor(cwd, slug, round);
+    if (ev.build_gate !== undefined && payloadExtra.build_gate === undefined) payloadExtra.build_gate = ev.build_gate;
+    if (ev.launch_cmd !== undefined && payloadExtra.launch_cmd === undefined) payloadExtra.launch_cmd = ev.launch_cmd;
+  }
 
   const order = compileOrder({
     slug, worker, operation, round, attempt, scope, tasks, decisions, digestedErrors, trialHistory, bugs,

package/kernel/init/run.mjs

@@ -75,12 +75,12 @@ import { join, dirname, resolve, relative, sep } from "node:path";
 import { createHash } from "node:crypto";
 import { decideLane, treeSize } from "./fit.mjs";
 import { runArgs } from "../lib/argv.mjs";
-import { uncoerce } from "../lib/contract.mjs";
+import { uncoerce, splitFrontmatter } from "../lib/contract.mjs";
 import { deriveSnapshot } from "../reduce/snapshot.mjs";
 import { mintRunId } from "../lib/paths.mjs";
 import {
   localRoot, activeScope, activeOrder, globLocal, globShared, ordersDir, resultsDir,
-  workflowsStage, globWorkflowsStage, sharedRoot, shapingDir, breadboard as stagedBreadboard,
+  workflowsStage, globWorkflowsStage, sharedRoot, shapingDir, breadboard as stagedBreadboard, harnessRun,
 } from "../lib/paths.mjs";
 import { parseBreadboard, hasBreadboardTables, idCounts } from "../lib/breadboard.mjs";
 import { resolveWorkers } from "../verify/skills.mjs";
@@ -603,8 +603,22 @@ export function cli(rawArgv) {
   if (existsSync(receiptPath) && !args.force) {
     let resume = null;
     try { resume = deriveSnapshot(cwd); } catch { /* a broken run must still produce the refusal */ }
+    // A receipt says a run EXISTS, not that it is open: a terminal close leaves the receipt in place.
+    // Calling a closed run "open" hid the one fact that changes what resuming it means.
+    let closed = null;
+    try {
+      const fm = splitFrontmatter(readFileSync(harnessRun(cwd, slug), "utf8")).meta || {};
+      if (fm.closed_status && fm.closed_status !== "~") closed = { status: fm.closed_status, at: fm.closed_at, cause: fm.close_cause };
+    } catch { /* no ledger — the receipt alone decides, as before */ }
     fail(3, [
-      `✋ init-run: a run is ALREADY OPEN — receipt exists at ${receiptPath}.`,
+      closed
+        ? `✋ init-run: this run is CLOSED as "${closed.status}" at ${closed.at ?? "?"} — receipt exists at ${receiptPath}.`
+        : `✋ init-run: a run is ALREADY OPEN — receipt exists at ${receiptPath}.`,
+      ...(closed ? [
+        `   Its close: ${closed.cause && closed.cause !== "~" ? closed.cause : "no cause recorded"}`,
+        "   Resuming it REOPENS it: the first phase that runs moves the ledger off the closed state, keeps",
+        "   this close under prior_closes, and the run's next terminal close is recorded as its own.",
+      ] : []),
       "",
       "Do NOT re-initialise and do NOT restart the pipeline from phase 1. Re-opening would discard",
       "the round history the circuit breaker counts against, and the board, ledger and receipt below",

package/kernel/probe/resume.mjs

@@ -557,14 +557,53 @@ export function setRunStatus(cwd, slug, status) {
   if (!/^status:.*$/m.test(body)) {
     return { ok: false, path: p, status, reason: `harness-run.md carries no "status:" line to replace — the ledger's frontmatter is malformed (references/protocol.md)` };
   }
+  // A CLOSED RUN THAT MOVES AGAIN IS REOPENED, AND SAYS SO. A relaunch resumes the same run by
+  // design, so a run closed `aborted` can be carried on to a later ship. Its close was written once
+  // and the once-only guard in closeRun refuses to flip an outcome, which is right for a close
+  // nobody took back — but here somebody did, by resuming it. Leaving the old close in place made
+  // the ledger read `status: shipped` over `closed_status: aborted`, and every reader of the close
+  // reported an abort for a run that shipped. The move to a live status is the one act that takes a
+  // close back, so it is recorded here: the prior close joins `prior_closes`, the three close
+  // fields return to `~`, and the next terminal close is written as the run's own. Nothing is lost
+  // and nothing is flipped silently — the abort stays on the record beside the outcome that
+  // replaced it.
+  const fm = parseFrontmatter(body);
+  const priorStatus = fm.closed_status && fm.closed_status !== "~" ? String(fm.closed_status) : null;
+  let next = body.replace(/^status:.*$/m, `status: ${status}`);
+  let reopened = null;
+  if (priorStatus && TERMINAL_STATUSES.includes(priorStatus) && !TERMINAL_STATUSES.includes(status)) {
+    const priorAt = fm.closed_at && fm.closed_at !== "~" ? String(fm.closed_at) : null;
+    const priorCause = fm.close_cause && fm.close_cause !== "~" ? String(fm.close_cause) : null;
+    const reopenedAt = new Date().toISOString();
+    reopened = { closed_status: priorStatus, closed_at: priorAt, cause: priorCause, reopened_at: reopenedAt };
+    const entry = `${priorStatus} at ${priorAt ?? "?"} (reopened ${reopenedAt}): ${priorCause ?? "no cause recorded"}`;
+    const history = fm.prior_closes && fm.prior_closes !== "~" ? `${fm.prior_closes} | ${entry}` : entry;
+    const historyLine = `prior_closes: ${uncoerce(history)}`;
+    next = next
+      .replace(/^closed_at:.*$/m, "closed_at: ~")
+      .replace(/^closed_status:.*$/m, "closed_status: ~")
+      .replace(/^close_cause:.*$/m, "close_cause: ~");
+    next = /^prior_closes:.*$/m.test(next)
+      ? next.replace(/^prior_closes:.*$/m, historyLine)
+      : next.replace(/^closed_at:.*$/m, (m) => `${m}\n${historyLine}`);
+  }
   try {
-    writeFileSync(p, body.replace(/^status:.*$/m, `status: ${status}`));
+    writeFileSync(p, next);
   } catch (e) {
     return { ok: false, path: p, status, reason: `could not write the ledger: ${e.message}` };
   }
-  const after = parseFrontmatter(readFileSync(p, "utf8")).status;
-  if (after !== status) {
-    return { ok: false, path: p, status, reason: `wrote "status: ${status}" but the ledger reads "${after}" — the write did not take` };
+  const after = parseFrontmatter(readFileSync(p, "utf8"));
+  if (after.status !== status) {
+    return { ok: false, path: p, status, reason: `wrote "status: ${status}" but the ledger reads "${after.status}" — the write did not take` };
+  }
+  if (reopened) {
+    // The breadcrumb names a run that is OVER; this one no longer is. Removed only when it names
+    // this run, so another run's close is left alone.
+    try {
+      const crumb = JSON.parse(readFileSync(lastRun(cwd), "utf8"));
+      if (crumb?.run_id && crumb.run_id === readRunId(cwd, slug)) rmSync(lastRun(cwd), { force: true });
+    } catch { /* no breadcrumb, or unreadable — nothing to retire */ }
+    return { ok: true, path: p, status, reopened, decision: "reopened" };
   }
   return { ok: true, path: p, status };
 }

package/kernel/probe/t0.mjs

@@ -1,8 +1,16 @@
 // probe t0 — "has this scope already reached T0-green in this round?"
 //
 // CONTRACT. A bounded, read-only query over the verdict artifacts on disk. Prints
-// `{green, path, round, scope_id}` on stdout; exits 0 when green, 1 when not, 2 on a bad argv.
-// Writes nothing.
+// `{green, path, sha256?, round, scope_id}` on stdout; exits 0 when green, 1 when not, 2 on a bad
+// argv. Writes nothing.
+//
+// WHY IT PRINTS A DIGEST. A verdict on a scoped spec must cite a T0 artifact with the sha256 of the
+// file as it is on disk now, and the judge is asked to obtain that itself rather than accept one it
+// was handed. Some sessions have no shell hasher they may run, and a grant that covers this entry
+// point and not `shasum` is the ordinary case, not an oversight. The digest here is computed from
+// the bytes at the moment of the call, with the same reading the ingest step re-checks it against,
+// so a judge that asks for it is asking the file, not a caller. `sha256` is present only when the
+// verdict is green and readable; absent — never null — otherwise.
 //
 // WHY IT IS A SUBCOMMAND AND NOT AN INLINE SNIPPET. The control plane has no filesystem of its
 // own, so the alternative is a `node -e` blob assembled inside the workflow script. Such a blob is
@@ -14,6 +22,7 @@
 // the only durable evidence of that is the verdict artifact the evaluator is required to cite.
 
 import { existsSync, readdirSync, readFileSync } from "node:fs";
+import { createHash } from "node:crypto";
 import { join, resolve } from "node:path";
 import { runArgs } from "../lib/argv.mjs";
 import { verdictsDir, readRunId } from "../lib/paths.mjs";
@@ -89,6 +98,18 @@ export function cli(rawArgv) {
   const args = runArgs(ARGV_SPEC, rawArgv);
   const cwd = resolve(args.cwd || process.cwd());
   const { green, path } = greenVerdict(cwd, args.slug, args.scope, args.round);
-  console.log(JSON.stringify({ green, path, scope_id: args.scope, round: args.round }));
+  const sha256 = green ? digestOf(path) : null;
+  console.log(JSON.stringify({ green, path, ...(sha256 ? { sha256 } : {}), scope_id: args.scope, round: args.round }));
   process.exit(green ? 0 : 1);
 }
+
+/**
+ * The sha256 of a verdict artifact, read as `reduce ingest` re-reads it (utf8 text, then hashed) so
+ * the two can never disagree about the same bytes.
+ * @param {string} path - Absolute path of the verdict file.
+ * @returns {(string|null)} Lowercase hex digest, or null when the file cannot be read.
+ */
+function digestOf(path) {
+  try { return createHash("sha256").update(readFileSync(path, "utf8")).digest("hex"); }
+  catch { return null; }
+}

package/kernel/reduce/board.mjs

@@ -293,7 +293,15 @@ export function derive({ cwd, slug, appetiteHours = null }) {
 }
 
 /**
- * Persist derived `unlocks` into task frontmatter — the ONE write this script makes.
+ * Persist derived `unlocks` into task frontmatter — and give a task with NO status the one status a
+ * task on a freshly written board can have.
+ *
+ * `unlocks` is derived, so writing it is safe by construction. `status: todo` is the other field a
+ * board is written with, and it is added only where the line is absent — an existing status is never
+ * touched, so a task in progress or done is never reset. A regenerated board once came back with
+ * `depends_on` and neither field on every task; spec-lint failed all of them at L1b and an unattended
+ * run had nobody to add a line the worker's own template already prescribes.
+ *
  * @param {{_tasks:Array<object>, unlocks:Object<string,string[]>}} report - A {@link derive} report.
  * @returns {string[]} The ids of task files actually rewritten (unchanged files are skipped).
  *   Side effect: writes those task files.
@@ -305,7 +313,8 @@ export function writeUnlocks(report) {
     const fmMatch = t.body.match(/^---\r?\n([\s\S]*?)\r?\n---/);
     if (!fmMatch) continue;
     const fm = fmMatch[1];
-    const next = /^unlocks:.*$/m.test(fm) ? fm.replace(/^unlocks:.*$/m, `unlocks: ${want}`) : `${fm}\nunlocks: ${want}`;
+    let next = /^unlocks:.*$/m.test(fm) ? fm.replace(/^unlocks:.*$/m, `unlocks: ${want}`) : `${fm}\nunlocks: ${want}`;
+    if (!/^status:/m.test(next)) next = `${next}\nstatus: todo`;
     if (next !== fm) {
       writeFileSync(t.file, t.body.replace(fm, next));
       written.push(t.id);

package/kernel/reduce/ship.mjs

@@ -32,7 +32,7 @@ import { runArgs } from "../lib/argv.mjs";
 import {
   report as reportPath, tasksDir, verdictsDir, trials, evaluationDir, qaDir,
   roundLedger, discoveryLedger, receipt as receiptPath, harnessRun, relShared,
-  activeOrder, runArgsPath, readReceipt, runIdFromReceipt,
+  activeOrder, runArgsPath, readReceipt, runIdFromReceipt, hammerCensus,
 } from "../lib/paths.mjs";
 import { readTrials } from "../verify/t0.mjs";
 import { ratchetReport } from "../probe/stats.mjs";
@@ -191,6 +191,31 @@ export function section(md, heading) {
   return body || null;
 }
 
+/**
+ * The report's opening line when the ship is not a passing one — null for a PASS.
+ *
+ * @param {string} verdict - The run's final verdict (`PASS`, `FAIL`, `not-evaluated`, …).
+ * @param {({verdict?:string, cut_list?:Array}|null)} census - GATE H's census as data, or null.
+ * @returns {(string|null)} One markdown line naming the verdict, and the cut list that cleared it
+ *   when a census is on record; null when the verdict is PASS.
+ */
+export function shipHeadline(verdict, census) {
+  if (verdict === "PASS") return null;
+  const cuts = Array.isArray(census?.cut_list) ? census.cut_list.length : null;
+  const why = census
+    ? `GATE H's baseline comparison cleared it${census.verdict ? ` (census: ${census.verdict})` : ""}` +
+      (cuts != null ? ` with ${cuts} item${cuts === 1 ? "" : "s"} cut` : "")
+    : "no GATE H census was on record when it shipped";
+  // A FAIL is a judgement that some criterion failed; anything else here means no judgement was
+  // made at all, and the line must not claim criteria failed that nobody graded.
+  if (verdict === "FAIL") {
+    return `> **Shipped with a FAIL verdict.** Not every criterion passed; ${why}. Read the failed ` +
+      "criteria and the cut list below before treating this feature as done.";
+  }
+  return `> **Shipped without a passing verdict (${verdict}).** No criterion was graded as passing; ${why}. ` +
+    "Nothing below is evidence that this feature works.";
+}
+
 /**
  * Assemble the report. Pure given its inputs, so the structural tests can assert its shape
  * without a filesystem.
@@ -201,6 +226,7 @@ export function buildReport(facts) {
   const {
     slug, at, verdict, qa, rounds, roundsJudged, board, t0, artifacts, ratchet,
     evalCriteria, evalBugs, qaFindings, decisions, discovered, intakeSha, leftovers, requirements,
+    census = null,
   } = facts;
 
   const L = [];
@@ -208,6 +234,12 @@ export function buildReport(facts) {
     `verdict: ${verdict}`, `rounds_used: ${rounds ?? "~"}`, `rounds_judged: ${roundsJudged ?? "~"}`, `qa: ${qa}`,
     `intake_sha256: ${intakeSha ?? "~"}`, "---", "");
   L.push(`# ${slug} — ship report`, "");
+  // A SHIP IS NOT A PASS, AND THE FIRST LINE SAYS WHICH ONE THIS IS. A run whose verdict FAILed can
+  // still ship — GATE H compares against the baseline, not the ideal, and a cut list can clear it —
+  // and its status then reads `shipped` like any other. The verdict sat in a table cell below the
+  // fold, so a reader who stopped at the title took a shipped FAIL for a passing build.
+  const headline = shipHeadline(verdict, census);
+  if (headline) L.push(headline, "");
   L.push("Frozen at GATE L4. Every figure below is derived from run artifacts on disk — the trial",
     "ledger, the verdict artifacts, the board — never from a summary of the run.", "");
 
@@ -361,6 +393,7 @@ export function generate({ cwd, slug, verdict, qa }) {
     slug,
     at: today(),
     verdict: verdict || run.final_verdict || "not-evaluated",
+    census: (() => { try { return JSON.parse(readIf(hammerCensus(cwd, slug)) || "null"); } catch { return null; } })(),
     qa: qa || (huntReport ? "run" : "skipped"),
     rounds: derivedRounds.rounds_used,
     roundsJudged: derivedRounds.rounds_judged,

package/kernel/schemas/domain.schema.json

@@ -301,6 +301,13 @@
         "via": "discovered_tasks[]",
         "note": "a red gate's output, digested — surfaces as payload.bugs on the next round's orders"
       },
+      {
+        "from": "WorkOrder",
+        "to": "RoundBuildVerdict",
+        "cardinality": "N:1",
+        "via": "payload.build_gate",
+        "note": "an evaluate order names this run's newest gate artifact for its round, green or red, so the judge knows the build ran and the app launched before grading a [ui] row; payload.launch_cmd carries the profile's launch_probe beside it"
+      },
       {
         "from": "RoundBuildVerdict",
         "to": "HillShard",
@@ -353,6 +360,8 @@
       "feature",
       "dimensions",
       "run_cmd",
+      "launch_cmd",
+      "build_gate",
       "t0_artifacts",
       "browser",
       "tasks"
@@ -2416,6 +2425,14 @@
           "type": "string",
           "description": "spec-evaluator: how to start the running app. Absent orchestrated → ESCALATE, never guess."
         },
+        "launch_cmd": {
+          "type": "string",
+          "description": "spec-evaluator: the project profile's launch probe — installs the built artifact, starts it and asserts the first screen. Derived by `harness compile` from project-profile.md, absent when the profile declares none. Where `run_cmd` is only a build, this is how the app is brought up; a non-zero exit is a finding, not a reason to guess another way."
+        },
+        "build_gate": {
+          "type": "string",
+          "description": "spec-evaluator: this run's newest round build gate artifact (build/r<N>-t<T>.json) — each step's exit code and output tail, the record that the build ran and the app launched. Derived by `harness compile`, absent when the gate never ran. Read it before grading a [ui] row NO EVIDENCE."
+        },
         "t0_artifacts": {
           "type": "array",
           "items": {

package/kernel/verify/build.mjs

@@ -220,6 +220,62 @@ export function latestRoundBuild(cwd, slug, round) {
   return all.length ? all[all.length - 1].body : null;
 }
 
+/**
+ * The gate artifact an evaluate order should name — the newest one THIS run wrote, with the file it
+ * lives in.
+ *
+ * {@link latestRoundBuild} answers "what did the gate say about round N" and hands back a body; an
+ * order has to point at a file, so the path travels with it here. Scoped to the current run when a
+ * receipt is readable: a prior run over the same slug leaves its own `r1-t1.json` on disk, and the
+ * judge must not be pointed at another run's launch evidence. Scoped to one round when given; with
+ * no round it is the newest of any round — a standalone evaluation has none, the same reading
+ * `t0ArtifactsFor` uses for the T0 verdicts.
+ *
+ * @param {string} cwd - Project root.
+ * @param {string} slug - Feature slug.
+ * @param {number} [round] - The round being evaluated.
+ * @returns {({path:string, body:object}|null)} null when the gate never ran, or nothing readable
+ *   belongs to this run. Never throws: an order must compile without it.
+ */
+export function latestRoundBuildFile(cwd, slug, round) {
+  let files;
+  const dir = roundBuildDir(cwd, slug);
+  try { files = readdirSync(dir); } catch { return null; }
+  const runId = readRunId(cwd, slug);
+  let best = null;
+  for (const f of files) {
+    const m = f.match(/^r(\d+)-t(\d+)\.json$/);
+    if (!m) continue;
+    const r = Number(m[1]), t = Number(m[2]);
+    if (round != null && r !== Number(round)) continue;
+    let body;
+    try { body = JSON.parse(readFileSync(join(dir, f), "utf8")); } catch { continue; }
+    if (runId && body?.run_id && body.run_id !== runId) continue;
+    if (!best || r > best.r || (r === best.r && t > best.t)) best = { r, t, path: join(dir, f), body };
+  }
+  return best && { path: best.path, body: best.body };
+}
+
+/**
+ * The command the project declared for bringing the built app up — `launch_probe` in the committed
+ * profile: install the artifact, start it, assert the first screen. Read on its own rather than
+ * through {@link declaredSteps}, which also reads the ledger and computes warnings an order has no
+ * use for.
+ *
+ * @param {string} cwd - Project root.
+ * @param {string} slug - Feature slug.
+ * @returns {(string|null)} The command, or null when the profile is absent or declares none.
+ *   Never throws.
+ */
+export function launchProbeFor(cwd, slug) {
+  try {
+    const pp = projectProfile(cwd, slug);
+    if (!existsSync(pp)) return null;
+    const v = readContract(pp, PROJECT_PROFILE)?.contract?.launch_probe;
+    return typeof v === "string" && v.trim() ? v.trim() : null;
+  } catch { return null; }
+}
+
 /**
  * The rounds whose latest gate artifact is red — the set `reduce hill` subtracts from.
  * @param {string} cwd - Project root.
@@ -275,13 +331,40 @@ export function writeRoundBuild(cwd, slug, round, body) {
 }
 
 export const ARGV_SPEC = {
-  usage: "harness.mjs verify build --slug <slug> --round <N> [--cwd <dir>]",
+  usage: "harness.mjs verify build --slug <slug> (--round <N> | --preflight) [--cwd <dir>]",
   _: { arity: 0, max: 0, name: "(no positional operands)" },
   slug: { type: "str", required: true },
-  round: { type: "int", min: 1, required: true },
+  round: { type: "int", min: 1 },
+  preflight: { type: "flag" },
   cwd: { type: "path" },
 };
 
+/**
+ * Classify a preflight: the declared steps run, nothing is written.
+ *
+ * WHY A PREFLIGHT, AND WHY IT WRITES NOTHING. Every environment fault a run has died of was
+ * discoverable in seconds and discovered after most of an hour: a checkout missing its package
+ * install or its local SDK pointer fails the build in about a second, a probe outside the session's
+ * grant is refused, a device that is not attached leaves every `[ui]` row ungraded. Each surfaced
+ * only at the first round gate, after planning had been paid for. The same commands, run once before
+ * anything is dispatched, turn that into one report up front. It is not a round, so it writes no
+ * round artifact: a red preflight read back as round 0's gate would reach round 1's orders as bugs,
+ * handing a feature worker an environment fault it cannot fix.
+ *
+ * A step that exits 2 is a probe that COULD NOT RUN — the fixture convention, e.g. no device
+ * attached — which is a gap in the environment rather than a red build, and is reported apart.
+ *
+ * @param {{overall:string, steps:Array<{kind:string, exit?:number, pass?:boolean, skipped?:boolean}>}} gate
+ *   What {@link runGate} returned.
+ * @returns {{status:("green"|"red"|"cannot-run"), failed_step:(string|null)}} `cannot-run` when the
+ *   first failing step exited 2.
+ */
+export function classifyPreflight(gate) {
+  const failing = gate.steps.find((s) => !s.skipped && !s.pass);
+  if (!failing) return { status: "green", failed_step: null };
+  return { status: failing.exit === 2 ? "cannot-run" : "red", failed_step: failing.kind };
+}
+
 /**
  * Run the round build gate and write its artifact.
  *
@@ -292,9 +375,29 @@ export async function cli(rawArgv) {
   const args = runArgs(ARGV_SPEC, rawArgv);
   const cwd = resolve(args.cwd || process.cwd());
   const { slug, round } = args;
+  if (Boolean(args.preflight) === (round != null)) {
+    console.error("verify build: pass exactly one of --round <N> (the round gate, writes its artifact) or --preflight (runs the same steps, writes nothing)");
+    process.exit(2);
+  }
   const { archetype, steps, warnings } = declaredSteps(cwd, slug);
   for (const w of warnings) console.error(`build-gate: ${w}`);
 
+  if (args.preflight) {
+    if (steps.length === 0) {
+      console.log(JSON.stringify({ preflight: true, status: "undeclared", steps: [], warnings }, null, 2));
+      process.exit(3);
+    }
+    const gate = runGate(steps, cwd);
+    const { status, failed_step } = classifyPreflight(gate);
+    const failing = gate.steps.find((s) => s.kind === failed_step);
+    console.log(JSON.stringify({
+      preflight: true, status, archetype, warnings,
+      steps: gate.steps.map((s) => (s.skipped ? { kind: s.kind, skipped: true } : { kind: s.kind, exit: s.exit, pass: s.pass })),
+      ...(failing ? { failed_step, stderr_tail: `${failing.stdout_tail || ""}\n${failing.stderr_tail || ""}`.trim().slice(-1200) } : {}),
+    }, null, 2));
+    process.exit(status === "green" ? 0 : status === "cannot-run" ? 4 : 1);
+  }
+
   if (steps.length === 0) {
     console.log(JSON.stringify({ round, overall: "skipped", steps: [], warnings,
       reason: "nothing declared — no run_cmd in the run ledger, no build_probe or launch_probe in project-profile.md" }, null, 2));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shapeup-sdlc",
-  "version": "3.9.2",
+  "version": "3.11.0",
   "description": "Shape Up for coding agents \u2014 with gates the agent can't talk its way past. Harness for Claude Code.",
   "bin": {
     "shapeup-sdlc": "bin/init.mjs"

package/skills/spec-evaluator/SKILL.md

@@ -36,7 +36,9 @@ Invoked as `--order <path>`. Fields you may rely on (absent = unknown, never inf
 | `payload.spec_folder` | The committed grading truth: `usecases/` + `domain-model.md` (+ `contracts/`, `scope-summary.md`, `_index.md`). No `usecases/` → HARD STOP, nothing to grade against |
 | `payload.feature` | Feature slug — scopes the probe and names the report |
 | `payload.dimensions[]` | The active dimension set (the caller resolved precedence). Absent → `[spec-conformance]` + the auto-enable rules below |
-| `payload.run_cmd` | How to start the running app. Absent standalone → ask; absent orchestrated → ESCALATE, do not guess |
+| `payload.run_cmd` | How to start the running app. On a stack where building and launching are different acts it is only the build — prefer `payload.launch_cmd` when the order carries one. Absent standalone → ask; absent orchestrated with no `launch_cmd` either → ESCALATE, do not guess |
+| `payload.launch_cmd` | The project profile's launch probe: installs the built artifact, starts it and asserts the first screen. This is how the app is brought up for `[ui]` probing. A non-zero exit is a finding to cite, not a reason to try another way. Absent → the profile declares none; fall back to `run_cmd` |
+| `payload.build_gate` | This run's newest round build gate artifact — each step's exit code and output tail. It records that the build ran and whether the app launched, and the launch step's output names what it captured. Read it before grading any `[ui]` row NO EVIDENCE: a launch that succeeded is evidence the app can be probed, and the row is graded on the app, not on its absence. Absent → the gate never ran |
 | `payload.t0_artifacts[]` | Per-scope T0 verdict paths for this round (scoped specs), compiled from each scope's green verdict. An artifact listed but missing/red on disk, or a scoped spec with none listed → the round is NOT gradeable: return `status: failed` with the reason, naming the scope, as your FIRST deviation — a structural precondition, not a criterion |
 | `payload.browser` | `cli` (default, ~4x cheaper) \| `mcp` \| `none` |
 | `payload.tasks[]` | Traceability only (which UCs a task claims): NEVER a grading source — the committed UC text is the criterion, a paraphrase mismatch is a finding |
@@ -94,7 +96,10 @@ Done-when statements; `_index.md` Non-Go list. Which UCs are in scope comes from
   contract triplet + Non-Go). Overall PASS only if ALL active dimensions pass — the halo
   effect is banned; a strong dimension never lifts a failing one.
 - **T0 citation (scoped specs).** Recompute each cited artifact's sha256 from disk — never
-  trust a handed hash. A verdict on a scoped spec without a T0 citation is structurally
+  trust a handed hash. Use any hasher you may run; when none is available to you,
+  `harness probe t0 --slug <slug> --scope <scope_id> --round <r>` prints the digest of that
+  scope's green verdict as the file is at that moment. A digest from any other place — a ledger
+  line, an earlier report, an error message — is a handed hash, however correct it looks. A verdict on a scoped spec without a T0 citation is structurally
   invalid, regardless of how convincing your own probing looked; generator prose ("tests
   pass", "verified locally") is never admissible evidence.
 - **When a criterion names a command, run THAT command.** Not the one that works, not the

package/skills/tech-lead/SKILL.md

@@ -39,9 +39,9 @@ derived RESUME STATE (slug, status, round, board counts) — read it and go stra
 this session's memory. `--force` re-opens deliberately and discards the round history the breaker
 counts.
 
-**If this command comes back "requires approval", stop and say so.** These scripts ship with the
-plugin and need a one-time permission grant (`npx shapeup-sdlc init` writes it). Do not route
-around it, and do not silently hand-build the feature instead.
+**If this command comes back "requires approval", stop and say so** — the scripts need a one-time grant
+(`npx shapeup-sdlc init`); never route around it or hand-build the feature. Know a grant by running the
+command, never by reading `.claude/settings.json` — Preflight runs the project's probes and reports.
 
 **Language gate (delegated to `translator`, not this skill):** before Step 1 opens the run, dispatch
 an Agent (model: exec) calling `Skill(shapeup-sdlc-plugin:translator) --check` on the pitch *and* its

package/skills/tech-lead/references/protocol.md

@@ -477,6 +477,13 @@ Read back: stdout JSON — {overall: green|red, steps[], warnings[], failed_step
         A `mobile` profile with no launch_probe is warned about on stderr every round, and so is
         every scope none of whose fixtures invoke the tool run_cmd builds with — advisory, because a
         green T0 from such fixtures is not evidence the scope compiles.
+Preflight form — the same steps, run once before anything is dispatched, WRITING NOTHING:
+  node "${CLAUDE_PLUGIN_ROOT}/kernel/harness.mjs" verify build --slug <slug> --preflight
+        stdout JSON {preflight: true, status: green|red|cannot-run|undeclared, steps[], failed_step?,
+        stderr_tail?}. Exit 0 green · 1 a step red · 4 a probe could not run (it exited 2 — no
+        device, no artifact) · 3 nothing declared. No round artifact: a red preflight read back as
+        round 0's gate would reach round 1's orders as bugs. The workflow warns on 1 and 4, never
+        aborts.
 Consequences, both mechanical and both read off the artifact, never off this prose:
         red → EVAL is not dispatched this round; `harness compile` turns each failing step into a
               `payload.bugs` entry for round N+1, addressed to the scope whose substrate holds the
@@ -490,6 +497,9 @@ compile-order --operation evaluate --slug <slug> --worker spec-evaluator --round
   --payload '{"dimensions": ["spec-conformance"], "run_cmd": "<cmd>"}'
   t0_artifacts is compiled from each scope's green T0 verdict for round <r> — pass it only to
   override. A scope with no green verdict is named on stderr: the judge has nothing to cite for it.
+  build_gate and launch_cmd are compiled too: this run's newest round build gate artifact, and the
+  profile's launch_probe. Neither is passed here — a `[ui]` row is graded on the running app, and
+  these are how the judge finds out the app was launched and how to bring it up again.
 Invoke via Agent (model: eval), ONCE, after GATE L2:
   Skill(shapeup-sdlc-plugin:spec-evaluator) --order <path>
 Effect: one feature-level pass over the running app against all AC + Done-when; writes
@@ -548,7 +558,7 @@ Read back: the proposed cut list + verdict (SHIP now | SHIP after fixing ship-bl
 | `harness-run.md` | **tech lead (sole writer)** | tech lead (round ledger + Hill + run-state), PO (audit) |
 | `scopes/<scope-id>.md` | `scope-architect` (sole writer) | tech lead (substrate/sequence), sandbox hook (write-whitelist), compile-order (inlined into orders) |
 | `t0/verdicts/r<N>-a<M>-t<T>.json` | `harness verify t0` (skill-local, mechanical — not a worker) | spec-evaluator (required citation), tech lead (hill derivation), compile-order (digested errors) |
-| `build/r<N>-t<T>.json` (the round build gate) | `harness verify build` (mechanical — run_cmd + build_probe + launch_probe, once per round before EVAL) | tech lead (GATE L2 block), `harness reduce hill` (a red round moves no dot), compile-order (`payload.bugs` for round N+1) |
+| `build/r<N>-t<T>.json` (the round build gate) | `harness verify build` (mechanical — run_cmd + build_probe + launch_probe, once per round before EVAL) | tech lead (GATE L2 block), `harness reduce hill` (a red round moves no dot), compile-order (`payload.bugs` for round N+1 when red; `payload.build_gate` on the same round's evaluate order) |
 | `t0/trials.jsonl` (the ratchet ledger, append-only, `baseline_trial` as the parent link) | `harness verify t0` (one row per attempt: score, status, delta, tree_ref) | compile-order (`trial_history` into the next order), ship-report (T0 + Ratchet sections), `harness probe stats --ratchet` |
 | `round-ledger.md` | **tech lead (sole writer)** | compile-order (decisions into every order), PO (audit) |
 | `hill/<scope-id>.yml` + `hill-chart.md` | **tech lead (sole writer)** | PO ("status without asking"), scope-hammer (H0 census) |

package/skills/tech-lead/workflows/shapeup-run.js

@@ -54,7 +54,7 @@ export const meta = {
   name: "shapeup-run",
   description: "BUILD-phase pipeline: ORIENT → ANALYZE → WIRE → MAP SCOPES → rounds of BUILD/EVAL → QA → GATE H → ship. Gates resolve by the kernel's exit code; every dispatch is WorkOrder in / WorkResult out; the fast-forward is derived from artifacts on disk.",
   phases: [
-    { title: "Preflight", detail: "one canary dispatch — can this session resolve a worker skill" },
+    { title: "Preflight", detail: "one canary dispatch — can this session resolve a worker skill; then the project's build and launch probes, run once and recorded nowhere" },
     { title: "Orient" }, { title: "Analyze" }, { title: "Wire" }, { title: "MapScopes" },
     { title: "Build" }, { title: "Eval" }, { title: "Refute" }, { title: "QA" }, { title: "Ship" },
   ],
@@ -1117,6 +1117,11 @@ async function setRunStatus(status, phaseName) {
         `artifacts, not from this field), but the snapshot and the the ship report's census hook will read ` +
         `this run as unfinished.`);
     stateWarnings.push(`status="${status}" did not take: ${why}`);
+  } else if (r.decision === "reopened") {
+    // The ledger now carries the earlier close under `prior_closes`; say so where a reader of the
+    // run's own log will see it, because resuming a closed run changes what its close will say.
+    log(`RUN STATE — this run had been closed; moving it to "${status}" reopened it. The earlier close is ` +
+        `kept in the ledger under prior_closes, and the run's next terminal close is recorded as its own.`);
   }
 }
 
@@ -1235,6 +1240,33 @@ if (!canary.ok) {
     `(${canary.detail || `exit ${canary.exit_code}`})`));
 }
 
+// ENVIRONMENT CANARY — do the project's own build and launch probes run in THIS session?
+//
+// The skill canary proves the workers resolve; it says nothing about whether the commands the round
+// gate will run can. A missing package install or local SDK pointer fails the build in a second, a
+// probe outside the grant is refused, a device that is not attached leaves every `[ui]` row
+// ungraded — and each used to surface only at the first round gate, after planning was paid for.
+// `verify build --preflight` runs the same declared steps from a sub-agent, through the same grant,
+// and writes nothing. It WARNS rather than aborts: a baseline can be red for a reason the feature is
+// meant to fix, and an unattended run should still say so up front rather than stop.
+//
+// The evidence is this command's exit code. Whether a grant "looks present" in a settings file is
+// not evidence of anything: a grant can arrive by other routes, and one in the file can still be
+// refused above it.
+const envCanary = await cmd(`verify build --slug ${slug} --preflight`, "Preflight", "canary-env");
+if (envCanary.exit_code === 1 || envCanary.exit_code === 4) {
+  const kind = envCanary.exit_code === 4 ? "a probe could not run (exit 2 — typically no device attached, or a missing artifact)" : "a declared step is red";
+  const msg = `ENVIRONMENT — preflight: ${kind}${envCanary.detail ? `: ${envCanary.detail}` : ""}. The same step runs in every ` +
+    `round's build gate, so fix the environment now if it is not the feature's to fix.`;
+  log(msg);
+  stateWarnings.push(msg);
+} else if (envCanary.exit_code !== 0 && envCanary.exit_code !== 3) {
+  const msg = `ENVIRONMENT — preflight did not run (exit ${envCanary.exit_code}${envCanary.detail ? `: ${envCanary.detail}` : ""}); ` +
+    `nothing is known about the build or launch probes until the first round gate.`;
+  log(msg);
+  stateWarnings.push(msg);
+}
+
 // GATE L0.9b's launch record must exist before anything past Preflight dispatches; see
 // requireLaunchRecord()'s own banner for why this cannot be left to Step 2's prose alone.
 const launchRecordAbort = await requireLaunchRecord();
@@ -1374,6 +1406,10 @@ if (!rs.has_spec_tree) {
            "carrying its `(covers: REQ-…)` clause — and write nothing under the spec folder.",
   });
   if (b.__failed) return await withWarnings(diedAt("ANALYZE", b));
+  // The board a worker writes carries `depends_on`; its inverse (`unlocks`) and a new task's
+  // `status: todo` are mechanical, so the kernel writes them rather than trusting every regeneration
+  // to remember — a board that came back without both failed spec-lint on every task at L1b.
+  await advisory(`reduce board --slug ${slug} --write`, "Analyze", "board:derive");
   const post = await requirePhase("ANALYZE", "analyze", "Analyze", "board");
   if (post) return await withWarnings(post);
   await advisory(`reduce graph --slug ${slug}`, "Analyze", "graph:board");
@@ -1837,6 +1873,9 @@ while (verdict !== "pass" && round <= maxRounds) {
       model: evalModel, round,
       // No `t0_artifacts` here, deliberately: `harness compile` derives them from the round's green
       // T0 verdicts on disk, for every lane — this script could only name paths it was told about.
+      // The same goes for `build_gate` and `launch_cmd`: compile reads them off the round's gate
+      // artifact and the project profile, so the judge gets the launch evidence without this script
+      // having to carry it.
       payload: { dimensions: evalDims, run_cmd: rs.run_cmd, round },
       extra: "Evaluate the running feature against every acceptance criterion and Done-when. One feature-level pass; cite every artifact the order lists under t0_artifacts, re-hashing each yourself.",
     });