skalpel 4.0.29 → 4.0.30

package/anchor-shadow.mjs

@@ -0,0 +1,627 @@
+#!/usr/bin/env node
+// anchor-shadow.mjs — ship-status "Auto-Run-the-Anchor", SHADOW mode, READ-ONLY.
+//
+// WHAT: when the user falls into the cycle-12 signature (>=2 consecutive terse re-verify/doubt turns
+// about the SAME claim — "did it merge?", "you sure it's live?", "did that actually push?") AND that
+// doubt is about SHIP STATUS (merged / pushed / live / deployed / price / trial / CI / passing /
+// released), reconstruct the concrete anchor from recent session + repo context (a PR number, a URL,
+// a commit sha, a Stripe price), run ONE read-only allowlisted probe to resolve the doubt, and LOG
+// what we WOULD have injected. It NEVER injects into the live model and NEVER mutates anything.
+//
+// RED LINES honored by construction:
+//   - LOCAL-ONLY: the only side effect is appending to ~/.skalpel/anchor-shadow.log. No network exfil.
+//   - FAIL-OPEN: the per-turn wiring only spawns a DETACHED, unref'd child to run the probe, so the
+//     hook returns immediately — a probe can never block or slow a turn. Every probe has a hard 5s cap.
+//   - REVERSIBLE / SHADOW: log only, never inject, never throw out to the caller.
+//   - PRECISION OVER RECALL: fire only on a tight, consecutive doubt streak about a ship-status claim.
+//   - NO FABRICATED NUMBERS: probe evidence is the REAL stdout of a read-only command (execFile arg
+//     arrays, never a shell string), or an honest "unknown" on error/timeout.
+//
+// INJECTION SAFETY: every probe is `execFile(bin, [args...])` — arguments are an array, so there is NO
+// shell and NO string interpolation. On top of that (defense in depth) every reconstructed value is
+// re-validated against a strict whitelist before it is ever passed as an argument: PR = integer, sha =
+// /^[0-9a-f]{7,40}$/, url = parseable http(s) URL with no whitespace/control chars, repo dir = an
+// existing absolute directory. A crafted target such as url = "; rm -rf x" fails `new URL()` and is
+// rejected; even if it weren't, execFile would hand it to curl as one literal argv, not to a shell.
+
+import {
+  appendFileSync,
+  mkdirSync,
+  existsSync,
+  statSync,
+  writeFileSync,
+  readFileSync,
+  realpathSync,
+} from "node:fs";
+import { homedir } from "node:os";
+import { join, dirname, isAbsolute } from "node:path";
+import { fileURLToPath } from "node:url";
+import { execFile, spawn } from "node:child_process";
+import { tailLines } from "./transcript.mjs";
+
+const SKALPEL_DIR = join(homedir(), ".skalpel");
+const LOG_PATH = join(SKALPEL_DIR, "anchor-shadow.log");
+const PENDING_PATH = join(SKALPEL_DIR, "anchor-pending.json");
+const TRANSCRIPT_TAIL_BYTES = 256 * 1024;
+const PROBE_TIMEOUT_MS = 5000;
+
+// The claim classifier: the doubt only counts as SHIP-STATUS if one of these tokens is present.
+// Word-boundary matched, case-insensitive. Kept tight (precision over recall).
+const SHIP_LEXICON =
+  /\b(merged?|push(?:ed)?|live|deployed?|deploy|prod(?:uction)?|price|pricing|trial|ci|passing|pass(?:ed)?|released?|release|shipp?ed|ship)\b/i;
+
+// The re-verify / doubt signature: a TERSE turn that questions a prior claim without taking a new
+// action. Either it hits one of these doubt phrases, or it is a short bare question ("live?", "did it?").
+const DOUBT_LEXICON =
+  /\b(did (?:it|that|you|they|we)|are you sure|you sure|is it (?:really|actually|live|up|merged|deployed|passing)|are they|has it|have you|really|actually|for real|for sure|double[- ]?check|recheck|re-?verify|verify|confirm|check again|wait\b|hmm+|sure\?)\b/i;
+
+// A NEW ACTION (imperative work) disqualifies a turn from being a pure re-verify. If a "doubt" turn
+// also issues fresh work, it isn't the passive cycle-12 loop we target.
+const NEW_ACTION =
+  /\b(add|fix|change|write|implement|refactor|make|create|update|remove|delete|build|run|try|use|set|rename)\b/i;
+
+// ---------------------------------------------------------------------------------------------------
+// Transcript helpers (bounded tail read — reuses the same helper the hook uses, so no unbounded slurp).
+// ---------------------------------------------------------------------------------------------------
+function entryText(e) {
+  const raw = e?.content ?? e?.message?.content;
+  if (typeof raw === "string") return raw;
+  if (Array.isArray(raw))
+    return raw
+      .map((b) => {
+        if (typeof b === "string") return b;
+        if (b?.type === "text") return b.text || "";
+        // tool_result content can be a string or nested blocks — flatten best-effort for anchor mining.
+        if (b?.type === "tool_result") {
+          const c = b.content;
+          if (typeof c === "string") return c;
+          if (Array.isArray(c)) return c.map((x) => x?.text || "").join(" ");
+        }
+        return "";
+      })
+      .join(" ");
+  return "";
+}
+
+// The last `n` USER turns, newest first, as trimmed strings. Bounded tail read; never throws.
+export function recentUserTurns(payload, n = 5) {
+  const out = [];
+  try {
+    if (payload?.prompt) out.push(String(payload.prompt).trim());
+    if (!payload?.transcript_path) return out.slice(0, n);
+    const lines = tailLines(payload.transcript_path, TRANSCRIPT_TAIL_BYTES);
+    for (let i = lines.length - 1; i >= 0 && out.length < n; i--) {
+      let e;
+      try {
+        e = JSON.parse(lines[i]);
+      } catch {
+        continue;
+      }
+      if (e.type === "user" || e.role === "user") {
+        const t = entryText(e).trim();
+        if (t) out.push(t);
+      }
+    }
+  } catch {
+    /* fail-open */
+  }
+  return out.slice(0, n);
+}
+
+// A broad recent-context string (user + assistant + tool text) for anchor mining — this is where a PR
+// number, URL, or sha most often lives (in the assistant's prior `gh`/`git` output, not the user turn).
+export function recentContextText(payload, entries = 60) {
+  try {
+    if (!payload?.transcript_path) return String(payload?.prompt || "");
+    const lines = tailLines(payload.transcript_path, TRANSCRIPT_TAIL_BYTES);
+    const slice = lines.slice(-entries);
+    const parts = [];
+    for (const ln of slice) {
+      try {
+        parts.push(entryText(JSON.parse(ln)));
+      } catch {
+        /* skip */
+      }
+    }
+    if (payload?.prompt) parts.push(String(payload.prompt));
+    return parts.join("\n");
+  } catch {
+    return "";
+  }
+}
+
+// ---------------------------------------------------------------------------------------------------
+// (1) detectShipStatusSpiral — the cycle-12 re-verify signature + ship-status classification.
+// `turns` = user turns newest-first (as returned by recentUserTurns). Returns {fire, claim}.
+// ---------------------------------------------------------------------------------------------------
+function isTerse(t) {
+  return t.split(/\s+/).filter(Boolean).length <= 10;
+}
+function isDoubtTurn(t) {
+  if (!isTerse(t)) return false;
+  if (NEW_ACTION.test(t)) return false; // a fresh instruction is not a passive re-verify
+  return DOUBT_LEXICON.test(t) || /\?\s*$/.test(t); // doubt phrase OR a short bare question
+}
+function shipToken(t) {
+  const m = SHIP_LEXICON.exec(t);
+  return m ? m[1].toLowerCase() : null;
+}
+// Normalize surface variants to a canonical claim keyword for stable grouping/probing.
+function canonicalClaim(tok) {
+  if (!tok) return null;
+  if (/^merg/.test(tok)) return "merged";
+  if (/^push/.test(tok)) return "pushed";
+  if (/^deploy/.test(tok)) return "deployed";
+  if (/^prod/.test(tok)) return "deployed";
+  if (tok === "live") return "live";
+  if (/^releas/.test(tok)) return "released";
+  if (/^ship/.test(tok)) return "released";
+  if (/^pric/.test(tok)) return "price";
+  if (tok === "trial") return "trial";
+  if (tok === "ci" || /^pass/.test(tok)) return "ci";
+  return tok;
+}
+
+export function detectShipStatusSpiral(turns) {
+  const none = { fire: false, claim: null };
+  if (!Array.isArray(turns) || turns.length < 2) return none;
+  // Walk consecutive doubt turns from the newest. Stop at the first non-doubt turn.
+  const streak = [];
+  for (const t of turns) {
+    if (isDoubtTurn(t)) streak.push(t);
+    else break;
+  }
+  if (streak.length < 2) return none; // need >=2 consecutive terse re-verify/doubt turns
+  // The doubt must classify as SHIP-STATUS: a ship-status token present across the streak. "SAME claim"
+  // = the streak shares one canonical ship claim (no conflicting ship subject dominates the streak).
+  const claims = streak.map((t) => canonicalClaim(shipToken(t))).filter(Boolean);
+  if (claims.length === 0) return none; // doubt, but not about ship status → do not fire
+  // pick the most-recent ship claim; require the streak not to mix two different ship subjects.
+  const claim = claims[0];
+  const distinct = new Set(claims);
+  if (distinct.size > 1) return none; // ambiguous — different claims → precision guard, do not fire
+  return { fire: true, claim };
+}
+
+// ---------------------------------------------------------------------------------------------------
+// (2) reconstructTarget — pull the concrete anchor from recent turns + repo context. Returns a STRUCTURED
+// target or null (null = "not confidently reconstructable" → the caller logs a miss and does NOT fire).
+// ---------------------------------------------------------------------------------------------------
+function findPr(text) {
+  // "#123", "PR 123", "PR#123", "pull/123", "pull request 123"
+  const m = /(?:\bpr\s*#?\s*|\bpull(?:\s*request)?\s*#?\s*|\/pull\/|#)(\d{1,6})\b/i.exec(text);
+  if (!m) return null;
+  const n = Number(m[1]);
+  return Number.isInteger(n) && n > 0 && n < 1e7 ? n : null;
+}
+function findUrl(text) {
+  const m = /\bhttps?:\/\/[^\s'")<>`]+/i.exec(text);
+  if (!m) return null;
+  let url = m[0].replace(/[.,);]+$/, ""); // trim trailing punctuation from prose
+  return isSafeUrl(url) ? url : null;
+}
+function findSha(text) {
+  // Prefer a sha that appears near commit-ish words; otherwise the longest lone hex token in [7,40].
+  const near = /\b(?:commit|sha|rev(?:ision)?|HEAD|at)\s+([0-9a-f]{7,40})\b/i.exec(text);
+  if (near && /^[0-9a-f]{7,40}$/.test(near[1])) return near[1].toLowerCase();
+  let best = null;
+  const re = /\b([0-9a-f]{7,40})\b/gi;
+  let m;
+  while ((m = re.exec(text))) {
+    const tok = m[1].toLowerCase();
+    if (/^\d+$/.test(tok)) continue; // pure decimal → not a sha (avoids matching long numbers)
+    if (!best || tok.length > best.length) best = tok;
+  }
+  return best;
+}
+function repoDirOf(payload) {
+  const cwd = payload?.cwd && isAbsolute(payload.cwd) ? payload.cwd : process.cwd();
+  try {
+    return existsSync(cwd) && statSync(cwd).isDirectory() ? cwd : null;
+  } catch {
+    return null;
+  }
+}
+
+export function reconstructTarget(claim, contextText, payload) {
+  const text = String(contextText || "");
+  const repoDir = repoDirOf(payload);
+  const pr = findPr(text);
+  const url = findUrl(text);
+  const sha = findSha(text);
+
+  // Claim-driven preference, each with fallbacks. Return the first that reconstructs; null otherwise.
+  const tryPr = () => (pr != null ? { kind: "pr", n: pr, repoDir } : null);
+  const tryUrl = () => (url ? { kind: "url", url } : null);
+  const tryGit = () => (sha && repoDir ? { kind: "git", sha, repoDir } : null);
+  const tryStripe = () => ({ kind: "stripe-price" });
+
+  let order;
+  switch (claim) {
+    case "merged":
+    case "pushed":
+    case "ci":
+    case "released":
+      order = [tryPr, tryGit, tryUrl];
+      break;
+    case "live":
+    case "deployed":
+      order = [tryUrl, tryPr, tryGit];
+      break;
+    case "price":
+    case "trial":
+      // Only claim a stripe-price target if the context actually talks price/product — otherwise a
+      // bare "stripe prices list" is not a confident reconstruction of THIS doubt.
+      order = /\b(price|pricing|trial|checkout|stripe|plan|subscription|\$\d)/i.test(text)
+        ? [tryStripe, tryUrl]
+        : [tryUrl];
+      break;
+    default:
+      order = [tryPr, tryUrl, tryGit];
+  }
+  for (const f of order) {
+    const t = f();
+    if (t) return t;
+  }
+  return null;
+}
+
+// ---------------------------------------------------------------------------------------------------
+// Strict validators (defense in depth — execFile already means no shell).
+// ---------------------------------------------------------------------------------------------------
+function isSafeUrl(u) {
+  if (typeof u !== "string" || u.length === 0 || u.length > 2048) return false;
+  if (/[\s-<>`"'\\]/.test(u)) return false; // no whitespace/control/quote/backtick/backslash
+  try {
+    const p = new URL(u);
+    return p.protocol === "http:" || p.protocol === "https:";
+  } catch {
+    return false;
+  }
+}
+function validateTarget(t) {
+  if (!t || typeof t !== "object") return null;
+  switch (t.kind) {
+    case "pr": {
+      const n = Number(t.n);
+      if (!Number.isInteger(n) || n <= 0 || n >= 1e7) return null;
+      const repoDir = validDir(t.repoDir);
+      return { kind: "pr", n, repoDir };
+    }
+    case "url":
+      return isSafeUrl(t.url) ? { kind: "url", url: t.url } : null;
+    case "git": {
+      if (!/^[0-9a-f]{7,40}$/.test(String(t.sha || ""))) return null;
+      const repoDir = validDir(t.repoDir);
+      if (!repoDir) return null;
+      return { kind: "git", sha: String(t.sha).toLowerCase(), repoDir };
+    }
+    case "stripe-price":
+      return { kind: "stripe-price" };
+    default:
+      return null;
+  }
+}
+function validDir(d) {
+  try {
+    return d && isAbsolute(d) && existsSync(d) && statSync(d).isDirectory() ? d : null;
+  } catch {
+    return null;
+  }
+}
+
+// ---------------------------------------------------------------------------------------------------
+// (3) runProbe — ONE read-only allowlisted command via execFile (arg ARRAYS, never a shell string),
+// hard 5s timeout, catch-all. Returns {pass, evidence}. pass ∈ {true,false,null(unknown)}.
+// ---------------------------------------------------------------------------------------------------
+function run(bin, args, opts = {}) {
+  return new Promise((resolve) => {
+    let done = false;
+    const finish = (v) => {
+      if (!done) {
+        done = true;
+        resolve(v);
+      }
+    };
+    try {
+      const child = execFile(
+        bin,
+        args,
+        { timeout: PROBE_TIMEOUT_MS, killSignal: "SIGKILL", maxBuffer: 1 << 20, ...opts },
+        (err, stdout, stderr) => {
+          finish({ err, stdout: String(stdout || ""), stderr: String(stderr || "") });
+        },
+      );
+      child.on("error", (err) => finish({ err, stdout: "", stderr: String(err) }));
+    } catch (err) {
+      finish({ err, stdout: "", stderr: String(err) });
+    }
+  });
+}
+const clip = (s) =>
+  String(s || "")
+    .replace(/\s+/g, " ")
+    .trim()
+    .slice(0, 200);
+
+export async function runProbe(rawTarget) {
+  const t = validateTarget(rawTarget);
+  if (!t) return { pass: null, evidence: "rejected: target failed validation" };
+  try {
+    if (t.kind === "pr") {
+      // gh pr view <n> --json state,mergedAt   (READ-ONLY)
+      const opts = t.repoDir ? { cwd: t.repoDir } : {};
+      const { err, stdout } = await run(
+        "gh",
+        ["pr", "view", String(t.n), "--json", "state,mergedAt"],
+        opts,
+      );
+      if (err)
+        return { pass: null, evidence: clip(`gh error: ${err.killed ? "timeout" : err.message}`) };
+      let j;
+      try {
+        j = JSON.parse(stdout);
+      } catch {
+        return { pass: null, evidence: clip(`gh non-json: ${stdout}`) };
+      }
+      const merged = j.state === "MERGED" || !!j.mergedAt;
+      return { pass: merged, evidence: clip(`state=${j.state} mergedAt=${j.mergedAt || "null"}`) };
+    }
+    if (t.kind === "url") {
+      // curl -sS -m 5 -o /dev/null -w "%{http_code}" <url>   (READ-ONLY reachability)
+      const { err, stdout } = await run("curl", [
+        "-sS",
+        "-m",
+        "5",
+        "-o",
+        "/dev/null",
+        "-w",
+        "%{http_code}",
+        t.url,
+      ]);
+      if (err)
+        return {
+          pass: null,
+          evidence: clip(`curl error: ${err.killed ? "timeout" : err.message}`),
+        };
+      const code = parseInt(stdout, 10);
+      if (!Number.isFinite(code) || code === 0)
+        return { pass: null, evidence: clip(`no http code: ${stdout}`) };
+      return { pass: code >= 200 && code < 400, evidence: `http_code=${code}` };
+    }
+    if (t.kind === "git") {
+      // git -C <repo> branch --contains <sha> -a   (READ-ONLY: is the commit on main?)
+      const { err, stdout } = await run("git", [
+        "-C",
+        t.repoDir,
+        "branch",
+        "--contains",
+        t.sha,
+        "-a",
+        "--format=%(refname:short)",
+      ]);
+      if (err)
+        return { pass: null, evidence: clip(`git error: ${err.killed ? "timeout" : err.message}`) };
+      const branches = stdout
+        .split("\n")
+        .map((s) => s.trim())
+        .filter(Boolean);
+      const onMain = branches.some((b) => /(^|\/)main$|(^|\/)master$/.test(b));
+      return { pass: onMain, evidence: clip(`contains: ${branches.join(",") || "(none)"}`) };
+    }
+    if (t.kind === "stripe-price") {
+      // stripe prices list --limit 3   (READ-ONLY)
+      const { err, stdout } = await run("stripe", ["prices", "list", "--limit", "3"]);
+      if (err)
+        return {
+          pass: null,
+          evidence: clip(`stripe error: ${err.killed ? "timeout" : err.message}`),
+        };
+      const has = /"id"\s*:/.test(stdout) || /price_/.test(stdout);
+      return { pass: has, evidence: clip(has ? "prices listed" : `no prices: ${stdout}`) };
+    }
+  } catch (e) {
+    return { pass: null, evidence: clip(`probe threw: ${e}`) };
+  }
+  return { pass: null, evidence: "unknown target kind" };
+}
+
+// ---------------------------------------------------------------------------------------------------
+// Logging — the ONLY side effect. Append-only NDJSON at ~/.skalpel/anchor-shadow.log. Never throws.
+// ---------------------------------------------------------------------------------------------------
+function logRow(row) {
+  try {
+    mkdirSync(SKALPEL_DIR, { recursive: true });
+    appendFileSync(LOG_PATH, JSON.stringify(row) + "\n");
+  } catch {
+    /* logging is best-effort; never block or throw */
+  }
+}
+function readPending() {
+  try {
+    return JSON.parse(readFileSync(PENDING_PATH, "utf8"));
+  } catch {
+    return null;
+  }
+}
+function writePending(obj) {
+  try {
+    mkdirSync(SKALPEL_DIR, { recursive: true });
+    writeFileSync(PENDING_PATH, JSON.stringify(obj || {}));
+  } catch {
+    /* best-effort */
+  }
+}
+
+// ---------------------------------------------------------------------------------------------------
+// (4) recordAnchorShadow — the per-turn wiring. SHADOW: log only, never inject, never throw. Cheap on
+// the common path (no spiral → returns after a bounded tail read). On a fire with a reconstructable
+// target it spawns a DETACHED, unref'd child to run the probe so the hook is NEVER slowed by it.
+// ---------------------------------------------------------------------------------------------------
+export function recordAnchorShadow(payload) {
+  try {
+    const session = payload?.session_id ?? null;
+    const turns = recentUserTurns(payload, 5);
+
+    // n+1 instrument (3): resolve the PREVIOUS fire against THIS turn — did the spiral end? (the user's
+    // newest turn no longer doubts the same claim). Race-free: uses only doubt-cessation, not the probe.
+    const pending = readPending();
+    if (pending && pending.claim) {
+      const newest = turns[0] || "";
+      const stillDoubting =
+        isDoubtTurn(newest) && canonicalClaim(shipToken(newest)) === pending.claim;
+      logRow({
+        ts: new Date().toISOString(),
+        session,
+        event: "resolve",
+        ref_ts: pending.ts,
+        claim: pending.claim,
+        spiral_ended: !stillDoubting,
+      });
+      writePending({});
+    }
+
+    const { fire, claim } = detectShipStatusSpiral(turns);
+    if (!fire) return;
+
+    const target = reconstructTarget(claim, recentContextText(payload), payload);
+    if (!target) {
+      // Fire but no concrete anchor → DO NOT fire the probe; log a miss (instrument 2 denominator).
+      logRow({ ts: new Date().toISOString(), session, event: "miss", claim, reason: "no-target" });
+      return;
+    }
+
+    // Arm the n+1 resolution for next turn, then hand the read-only probe to a detached child.
+    writePending({ ts: new Date().toISOString(), claim });
+    spawnProbeChild({ session, claim, target });
+  } catch {
+    /* SHADOW: swallow everything — this can NEVER affect the hook or its injected output. */
+  }
+}
+
+// Spawn a detached, unref'd child that runs ONE read-only probe and appends the fire row, then exits.
+// The parent returns immediately → zero added per-turn latency. Job passed via env as JSON (no shell,
+// no argv interpolation); the child re-validates every field before executing anything.
+function spawnProbeChild(job) {
+  try {
+    const self = fileURLToPath(import.meta.url);
+    const child = spawn(process.execPath, [self, "--run-probe"], {
+      detached: true,
+      stdio: "ignore",
+      env: { ...process.env, SKALPEL_ANCHOR_JOB: JSON.stringify(job) },
+    });
+    child.on("error", () => {});
+    child.unref();
+  } catch {
+    /* if we can't spawn, log a miss so the fire is still accounted for */
+    logRow({
+      ts: new Date().toISOString(),
+      session: job?.session ?? null,
+      event: "miss",
+      claim: job?.claim ?? null,
+      reason: "spawn-failed",
+    });
+  }
+}
+
+async function runDetachedProbe() {
+  let job;
+  try {
+    job = JSON.parse(process.env.SKALPEL_ANCHOR_JOB || "{}");
+  } catch {
+    return;
+  }
+  const { pass, evidence } = await runProbe(job.target);
+  logRow({
+    ts: new Date().toISOString(),
+    session: job.session ?? null,
+    event: "probe",
+    claim: job.claim ?? null,
+    target: safeTarget(job.target),
+    would_inject_pass_fail: pass === null ? "UNKNOWN" : pass ? "PASS" : "FAIL",
+    evidence: clip(evidence),
+  });
+}
+// A compact, non-sensitive view of the target for the log.
+function safeTarget(t) {
+  if (!t || typeof t !== "object") return null;
+  if (t.kind === "pr") return { kind: "pr", n: t.n };
+  if (t.kind === "url") return { kind: "url", url: clip(t.url) };
+  if (t.kind === "git") return { kind: "git", sha: t.sha };
+  if (t.kind === "stripe-price") return { kind: "stripe-price" };
+  return null;
+}
+
+// ---------------------------------------------------------------------------------------------------
+// The tiny analyzer — `skalpel __anchor-report`. Prints the three instrument numbers from the log.
+// ---------------------------------------------------------------------------------------------------
+export function report() {
+  let lines = [];
+  try {
+    lines = readFileSync(LOG_PATH, "utf8").trim().split("\n").filter(Boolean);
+  } catch {
+    console.log(`no anchor-shadow log yet (${LOG_PATH})`);
+    return;
+  }
+  const rows = [];
+  for (const ln of lines) {
+    try {
+      rows.push(JSON.parse(ln));
+    } catch {
+      /* skip */
+    }
+  }
+  const fires = rows.filter((r) => r.event === "probe" || r.event === "miss");
+  const probes = rows.filter((r) => r.event === "probe");
+  const resolves = rows.filter((r) => r.event === "resolve");
+
+  const withTarget = probes.length;
+  const decisive = probes.filter((r) => r.would_inject_pass_fail !== "UNKNOWN").length;
+  const spiralEnded = resolves.filter((r) => r.spiral_ended).length;
+
+  const pct = (a, b) => (b > 0 ? `${((100 * a) / b).toFixed(0)}%` : "n/a");
+
+  console.log(`\nskalpel anchor-shadow report — ${rows.length} rows — ${LOG_PATH}\n`);
+  console.log(`  1. fires (detected ship-status spirals):        ${fires.length}`);
+  console.log(
+    `  2. target-reconstruction success rate:           ${pct(withTarget, fires.length)}  (${withTarget}/${fires.length})`,
+  );
+  console.log(
+    `  3. probe would-resolve the doubt (decisive):     ${pct(decisive, withTarget)}  (${decisive}/${withTarget})`,
+  );
+  console.log(
+    `     └ spiral ended on the next human turn:        ${pct(spiralEnded, resolves.length)}  (${spiralEnded}/${resolves.length})`,
+  );
+  // Pass/fail split of what we WOULD have surfaced — real command output, never fabricated.
+  const p = probes.filter((r) => r.would_inject_pass_fail === "PASS").length;
+  const f = probes.filter((r) => r.would_inject_pass_fail === "FAIL").length;
+  const u = probes.filter((r) => r.would_inject_pass_fail === "UNKNOWN").length;
+  console.log(`\n  would-inject verdicts:  PASS ${p} · FAIL ${f} · UNKNOWN ${u}\n`);
+}
+
+// ---------------------------------------------------------------------------------------------------
+// CLI entry (only when run directly). `--run-probe` = the detached child; `--report` = the analyzer.
+// When imported (from the hook or tests) none of this runs — only the exports above are used.
+// ---------------------------------------------------------------------------------------------------
+const isMain = (() => {
+  try {
+    if (!process.argv[1]) return false;
+    const self = fileURLToPath(import.meta.url);
+    if (self === process.argv[1]) return true;
+    // Tolerate symlinked staging paths (~/.skalpel/hooks may be reached via a symlink).
+    return realpathSync(self) === realpathSync(process.argv[1]);
+  } catch {
+    return false;
+  }
+})();
+if (isMain) {
+  if (process.argv.includes("--run-probe")) {
+    runDetachedProbe().finally(() => process.exit(0));
+  } else if (process.argv.includes("--report")) {
+    report();
+    process.exit(0);
+  } else {
+    console.log("anchor-shadow.mjs — internal skalpel module. Use `skalpel __anchor-report`.");
+    process.exit(0);
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skalpel",
-  "version": "4.0.29",
+  "version": "4.0.30",
   "description": "Behavioral graph for AI-assisted coding — learns how you work and steers Claude Code + Codex in real time.",
   "type": "module",
   "bin": {

package/verify-shadow.mjs

@@ -8,22 +8,40 @@
 // invented), RE-RUN it out-of-band, and record the real PASS/FAIL the agent cannot forge. The money
 // metric is the MISMATCH rate: how often the agent claimed success but its own proof, re-run, FAILS.
 //
+// SHIP-STATUS catch (v0, same DARK gates): the SAME "the agent is its own reporter" problem extends past
+// tests to the DEPLOY/GTM claim — "it's live / deployed / merged / pushed / returns 200". When the last
+// turn ASSERTS a ship status, we reconstruct the concrete target from the session (a URL, a PR number, a
+// commit sha) and run ONE READ-ONLY probe to check it — curl -sS -o /dev/null -w %{http_code} for a URL,
+// gh pr view <n> --json state,mergedAt for a PR, git branch --contains <sha> for a push. On a decisive
+// negative (claimed live but 404, claimed merged but OPEN) we surface the SAME honest reveal the test
+// catch uses — from REAL probe output, gated on the SAME opt-in flag. The read-only probe primitives
+// (execFile arg-arrays, strict allowlist, validated args, 5s cap) are REUSED verbatim from the
+// security-reviewed anchor-shadow.mjs (PR #586) — never re-implemented here.
+//
 // SHADOW: this LOGS ONLY. It never injects into the model, never blocks or slows a turn, never writes
-// or deploys anything. The per-turn hook launches it DETACHED (see skalpel-hook.mjs) so the user's turn
-// is never delayed by the (up to 60s) re-run.
+// or deploys anything (every probe is READ-ONLY — no mutations). The per-turn hook launches it DETACHED
+// (see skalpel-hook.mjs) so the user's turn is never delayed by the (up to 60s) re-run / (5s) probe.
 //
 // HARD RED LINES (enforced by construction below):
 //   1. ALLOWLIST ONLY. Only test/build/typecheck/lint binaries re-run (npm/pnpm/yarn test|build|run,
 //      npx tsc|jest|vitest|eslint|biome, pytest, cargo test|build|check|clippy, go test|build|vet,
 //      tsc, jest, vitest, eslint, biome, ruff, mypy, pyright, python -m <allowlisted>). Anything else
 //      is REFUSED. The command never comes from prompt/claim CONTENT — only from the session's own
-//      prior Bash tool_use commands.
+//      prior Bash tool_use commands. The SHIP-STATUS probe is likewise allowlisted to a fixed set of
+//      READ-ONLY reachability/status commands (gh pr view, curl reachability, git branch/log, stripe
+//      prices list) — see anchor-shadow.mjs runProbe/validateTarget.
 //   2. execFile, NEVER a shell. Args are passed as a literal ARGUMENT ARRAY; there is no shell to
 //      interpret metacharacters, so a crafted string can never be executed as a command. shell:false.
-//   3. HARD TIMEOUT (~60s), bounded output, single-flight lock. FAIL-OPEN: any error → log-or-skip,
-//      never throw, never affect the hook.
-//   4. LOCAL ONLY. Imports only node: core; opens no socket; logs to ~/.skalpel/verify-shadow.log.
-//   5. NO FABRICATED NUMBERS. pass_fail is the real process exit code; evidence is the real tail output.
+//      The ship probe validates every reconstructed value (pr=digits, url=well-formed http(s), sha=hex)
+//      before it is ever passed as an argv element.
+//   3. HARD TIMEOUT (~60s re-run / ~5s probe), bounded output, single-flight lock. FAIL-OPEN: any error →
+//      log-or-skip, never throw, never affect the hook. An UNKNOWN probe (timeout, missing gh/curl, DNS)
+//      NEVER surfaces a reveal — only a decisive negative does — so we never cry wolf.
+//   4. LOCAL ONLY. The proof re-run opens no socket. The ship probe makes a single READ-ONLY, user-driven
+//      reachability/status check to a target the SESSION itself named (never exfil) and logs to
+//      ~/.skalpel/verify-shadow.log.
+//   5. NO FABRICATED NUMBERS. pass_fail is the real process exit code / the real HTTP code / the real PR
+//      state; evidence is the real tail output. A reveal never shows a number the probe did not print.
 import {
   appendFileSync,
   mkdirSync,
@@ -44,10 +62,18 @@ import { tailLines } from "./transcript.mjs";
 // Local sibling modules only (no sockets — RED LINE #4 holds): recordInsight logs the reveal fire for
 // measurement; REVEAL_PATH/revealEnabled are the single-sourced state-file path + opt-in flag.
 import { recordInsight, REVEAL_PATH, VERDICT_PATH, revealEnabled } from "./insights.mjs";
+// SHIP-STATUS catch: REUSE the security-reviewed, READ-ONLY probe primitives from anchor-shadow.mjs
+// (PR #586) verbatim — never re-implemented. runProbe(target) runs ONE allowlisted read-only command via
+// execFile arg-arrays with a 5s cap and re-validates the target; reconstructTarget mines a PR/URL/sha from
+// session context; recentContextText is the bounded-tail context reader those two use. Importing (not
+// copying) keeps a SINGLE copy of the safety-critical logic under one review.
+import { runProbe, reconstructTarget, recentContextText } from "./anchor-shadow.mjs";
 
 const DIR = join(homedir(), ".skalpel");
 export const VERIFY_LOG_PATH = join(DIR, "verify-shadow.log");
 const LAST_PATH = join(DIR, "verify-last.json");
+// Ship-status catch keeps its OWN dedup cursor so it never collides with the test-proof dedup (LAST_PATH).
+const SHIP_LAST_PATH = join(DIR, "verify-ship-last.json");
 const LOCK_PATH = join(DIR, "verify-shadow.lock");
 
 // Re-run budget + read caps. The re-run is out-of-band (detached), so it is NOT on the hook deadline —
@@ -590,19 +616,21 @@ function djb2(s) {
 
 // Dedup: don't re-run the same (session, claim) twice — guards double hook fires and repeated prompts
 // that still see the same prior assistant turn. Best-effort; a miss just means one extra honest re-run.
-function alreadyVerified(sig) {
+// `cursorPath` selects which dedup cursor to use (the test-proof path and the ship-status path each keep
+// their own so a claim of one kind never suppresses the other in the same turn).
+function alreadyVerified(sig, cursorPath = LAST_PATH) {
   try {
-    return JSON.parse(readFileSync(LAST_PATH, "utf8"))?.sig === sig;
+    return JSON.parse(readFileSync(cursorPath, "utf8"))?.sig === sig;
   } catch {
     return false;
   }
 }
-function markVerified(sig) {
+function markVerified(sig, cursorPath = LAST_PATH) {
   try {
     mkdirSync(DIR, { recursive: true });
-    const tmp = `${LAST_PATH}.tmp`;
+    const tmp = `${cursorPath}.tmp`;
     writeFileSync(tmp, JSON.stringify({ sig, ts: Date.now() }));
-    renameSync(tmp, LAST_PATH);
+    renameSync(tmp, cursorPath);
   } catch {
     /* dedup is a bonus */
   }
@@ -694,6 +722,126 @@ export function buildRevealLine(row) {
   return `🔬 skalpel caught it — your agent said "${claim}" but \`${proof}\` just failed${count}. It's not done.`;
 }
 
+// ===================== SHIP-STATUS claim detection + reveal (new proof-category) =====================
+// Distinct from a test claim: the proof is a READ-ONLY probe (is the URL live? is the PR merged? is the
+// sha on main?), not a re-run. We look at the agent's LAST assistant prose (same source as the test
+// claim) and fire ONLY on an ASSERTION of ship status — never a question, never a stated intention.
+//
+// Each pattern maps to a canonical claim keyword that anchor-shadow.mjs `reconstructTarget` understands
+// (live | deployed | merged | pushed | released). A "returns 200 / is up" claim maps to `live` (a URL
+// reachability probe). Precision over recall: a missed claim just means no catch, but a false claim
+// would probe a target the agent never actually shipped.
+const SHIP_CLAIM_PATTERNS = [
+  // deployed / deploy complete / pushed the deploy
+  [
+    "deployed",
+    /\bdeployed\b|\bdeploy(?:ment)?\s+(?:is\s+)?(?:complete|done|succeeded|finished|live|up)\b|\bpushed\s+(?:the\s+|a\s+)?deploy(?:ment)?\b/i,
+  ],
+  // it's live / now live / went live / live at <url>
+  [
+    "live",
+    /\bit'?s\s+live\b|\bnow\s+live\b|\bis\s+(?:now\s+)?live\b|\b(?:went|gone)\s+live\b|\blive\s+(?:at|on|now)\b/i,
+  ],
+  // returns 200 / 200 OK / responds with 200 / is up / reachable / responding
+  [
+    "live",
+    /\breturns?\s+(?:a\s+)?(?:http\s+)?200\b|\b200\s*ok\b|\bresponds?\s+with\s+(?:a\s+)?(?:http\s+)?200\b|\b(?:site|url|page|endpoint)\s+is\s+(?:up|reachable|responding)\b/i,
+  ],
+  // merged / merged the PR / merged to main
+  [
+    "merged",
+    /\b(?:it'?s\s+|now\s+|has\s+been\s+|is\s+)?merged\b|\bmerged\s+(?:it|the\s+pr|to\s+main|into\s+main|it\s+in)\b/i,
+  ],
+  // pushed / pushed to main|origin|remote
+  [
+    "pushed",
+    /\b(?:it'?s\s+|now\s+|has\s+been\s+|is\s+)?pushed\b|\bpushed\s+(?:it|the\s+(?:commit|branch|changes?)|to\s+(?:main|origin|remote))\b/i,
+  ],
+  // released / shipped / shipped to prod
+  [
+    "released",
+    /\b(?:it'?s\s+|now\s+|has\s+been\s+)?released\b|\bshipp?ed\s+(?:it|to\s+prod(?:uction)?)\b/i,
+  ],
+];
+
+// A stated INTENTION or a QUESTION is not a completed ship claim. If a line hits one of these, skip it.
+const SHIP_FUTURE_OR_QUESTION =
+  /\b(?:will|i'?ll|we'?ll|going\s+to|gonna|about\s+to|let\s+me|planning\s+to|need\s+to|shall\s+i|should\s+i|can\s+i|once\s+|after\s+i|before\s+i|ready\s+to)\b/i;
+
+// detectShipClaim(text) → { claim:bool, kind, text:<the claim line, <=120c> }. Scans lines; returns the
+// first ASSERTIVE ship-status line. `kind` is the canonical claim keyword reconstructTarget consumes.
+export function detectShipClaim(text) {
+  const s = typeof text === "string" ? text : "";
+  if (!s.trim()) return { claim: false, kind: null, text: "" };
+  for (const line of s.split(/\r?\n/)) {
+    const l = line.trim();
+    if (!l) continue;
+    if (/\?\s*$/.test(l)) continue; // a question is not a claim
+    if (SHIP_FUTURE_OR_QUESTION.test(l)) continue; // intention, not "it's done"
+    for (const [kind, re] of SHIP_CLAIM_PATTERNS) {
+      if (re.test(l)) {
+        return { claim: true, kind, text: l.replace(/\s+/g, " ").trim().slice(0, 120) };
+      }
+    }
+  }
+  return { claim: false, kind: null, text: "" };
+}
+
+// A compact, non-sensitive view of the reconstructed target, kept on the log row AND used to render the
+// reveal. Retains only the identifier the reveal names (url / pr number / sha) — no repo paths.
+function safeShipTarget(t) {
+  if (!t || typeof t !== "object") return null;
+  if (t.kind === "url") return { kind: "url", url: clipText(t.url, 160) };
+  if (t.kind === "pr") return { kind: "pr", n: t.n };
+  if (t.kind === "git") return { kind: "git", sha: String(t.sha || "").toLowerCase() };
+  if (t.kind === "stripe-price") return { kind: "stripe-price" };
+  return null;
+}
+
+// probeCommandString(t) — a human receipt of the exact READ-ONLY command that ran (for the log + report).
+// It mirrors anchor-shadow.mjs runProbe's argv EXACTLY; it is never executed (execFile ran the arg-array).
+function probeCommandString(t) {
+  if (!t || typeof t !== "object") return null;
+  if (t.kind === "url") return `curl -sS -m 5 -o /dev/null -w %{http_code} ${clipText(t.url, 120)}`;
+  if (t.kind === "pr") return `gh pr view ${t.n} --json state,mergedAt`;
+  if (t.kind === "git") return `git branch --contains ${String(t.sha || "").slice(0, 12)}`;
+  if (t.kind === "stripe-price") return `stripe prices list --limit 3`;
+  return null;
+}
+
+// buildShipRevealLine(row) → the plain-text ship reveal. Every number/state comes from the REAL probe
+// evidence anchor-shadow.mjs recorded (`http_code=<n>`, `state=<S> mergedAt=…`, `contains: …`) — nothing
+// is fabricated. Falls back to a generic negative phrasing if the structured field isn't present.
+export function buildShipRevealLine(row) {
+  const claim = clipText(row.claim_text, 72) || "it's shipped";
+  const t = row.target || {};
+  const ev = String(row.evidence || "");
+  if (t.kind === "url") {
+    const m = ev.match(/http_code=(\d+)/);
+    const tail = m ? `returns HTTP ${m[1]}` : "is not reachable";
+    return `🔬 skalpel caught it — your agent said "${claim}" but \`${clipText(t.url, 48)}\` ${tail}. It's not live.`;
+  }
+  if (t.kind === "pr") {
+    const m = ev.match(/state=([A-Za-z]+)/);
+    const st = m ? m[1].toUpperCase() : "OPEN";
+    return `🔬 skalpel caught it — your agent said "${claim}" but PR #${t.n} is ${st}, not merged. It's not done.`;
+  }
+  if (t.kind === "git") {
+    const sha = String(t.sha || "").slice(0, 7);
+    return `🔬 skalpel caught it — your agent said "${claim}" but commit ${sha} isn't on main yet. It's not pushed.`;
+  }
+  if (t.kind === "stripe-price") {
+    return `🔬 skalpel caught it — your agent said "${claim}" but Stripe returned no matching price. It's not live.`;
+  }
+  return `🔬 skalpel caught it — your agent said "${claim}" but the ship-status probe came back negative.`;
+}
+
+// The single reveal-line dispatcher: ship rows render the ship line, everything else the test line. Keeps
+// the test path byte-for-byte identical (a row with no `category` is a test row).
+function revealLineFor(row) {
+  return row && row.category === "ship" ? buildShipRevealLine(row) : buildRevealLine(row);
+}
+
 // writeReveal(row) — atomic write of the reveal state file the statusline reads. Best-effort; never throws.
 function writeReveal(row) {
   try {
@@ -702,10 +850,12 @@ function writeReveal(row) {
       ts: row.ts,
       session: row.session || null,
       claim_text: row.claim_text,
-      proof_command: row.proof_command,
-      fail_count: extractFailCount(row.evidence),
+      // A ship row's "proof" is the read-only probe command; a test row's is the re-run command.
+      proof_command: row.category === "ship" ? row.probe_command : row.proof_command,
+      // fail_count is a test-runner failing-test count; a ship probe has none (HTTP code/PR state ≠ count).
+      fail_count: row.category === "ship" ? null : extractFailCount(row.evidence),
       evidence: row.evidence,
-      line: buildRevealLine(row),
+      line: revealLineFor(row),
     };
     const tmp = `${REVEAL_PATH}.tmp`;
     writeFileSync(tmp, JSON.stringify(rec));
@@ -763,29 +913,40 @@ function clearVerdict() {
   }
 }
 
-// maybeSurfaceReveal(row) — the single opt-in branch. OFF by default → does nothing (fully dark).
+// maybeSurfaceReveal(row) — the single opt-in branch. OFF by default → does nothing (fully dark). It
+// surfaces on a decisive negative (a test GENUINE_FAIL, or a ship SHIP_FAIL: claimed live but 404 /
+// claimed merged but OPEN) and retracts on a decisive positive (test PASS, or ship SHIP_OK). An
+// UNKNOWN/HARNESS_ERROR/ship SHIP_UNKNOWN NEVER surfaces — we never cry wolf on a broken probe.
 function maybeSurfaceReveal(row) {
   try {
     if (!revealEnabled(process.env)) return; // SKALPEL_VERIFY_REVEAL unset/off → dark, no-op
-    if (row.outcome === "GENUINE_FAIL" && row.mismatch === true) {
+    const isFail =
+      (row.outcome === "GENUINE_FAIL" || row.outcome === "SHIP_FAIL") && row.mismatch === true;
+    const isPass = row.outcome === "PASS" || row.outcome === "SHIP_OK";
+    if (isFail) {
       writeReveal(row);
       clearVerdict(); // a real catch overrides any stale green — never show a ✓ next to a ✗
       // MEASURABLE: one reveal_shown insight per fire → fire-rate + (later) retention, no fabricated data.
       recordInsight({
         kind: "reveal_shown",
-        display: buildRevealLine(row),
-        proof: row.proof_command,
+        display: revealLineFor(row),
+        proof: row.category === "ship" ? row.probe_command : row.proof_command,
         session: row.session || null,
       });
-    } else if (row.outcome === "PASS") {
+    } else if (isPass) {
       clearReveal(); // resolved — don't wallpaper a catch the agent already fixed
-      writeVerdict(row); // …and stamp the earned green so the ambient trust-line keeps building
-      recordInsight({
-        kind: "verdict_shown",
-        display: buildVerdictLine(row),
-        proof: row.proof_command,
-        session: row.session || null,
-      });
+      // The green VERDICT stamp is #612's TEST-pass path only: its line ("re-ran `<proof>`, exit 0") is a
+      // real test re-run receipt. A ship SHIP_OK (read-only probe came back positive) has no re-run and no
+      // proof_command, so it must NOT borrow that wording — it only clears any prior catch (as #611 did).
+      if (row.outcome === "PASS") {
+        writeVerdict(row); // …and stamp the earned green so the ambient trust-line keeps building
+        recordInsight({
+          kind: "verdict_shown",
+          display: buildVerdictLine(row),
+          proof: row.proof_command,
+          session: row.session || null,
+        });
+      }
     }
     // HARNESS_ERROR / REFUSED: neither a catch nor a clean pass — surface nothing, touch no state file.
   } catch {
@@ -793,6 +954,82 @@ function maybeSurfaceReveal(row) {
   }
 }
 
+// maybeShipStatusCatch(...) — the SHIP-STATUS proof-category. When the agent's last turn ASSERTS a ship
+// status, reconstruct the concrete target from session context and run ONE READ-ONLY allowlisted probe
+// (reused verbatim from anchor-shadow.mjs). Appends one `category:"ship"` shadow row and, on a decisive
+// negative, surfaces the SAME reveal (gated on SKALPEL_VERIFY_REVEAL). Returns { surfaced } — surfaced is
+// true ONLY when a decisive ship FAIL was revealed, so the caller can skip the test path (the concrete
+// ship catch is the stronger signal). LOG ONLY otherwise; never injects, never throws.
+async function maybeShipStatusCatch({ text, session, cwd, transcriptPath }) {
+  try {
+    const { claim, kind, text: claimText } = detectShipClaim(text);
+    if (!claim) return { surfaced: false };
+
+    const sig = `ship|${session || ""}|${djb2(claimText)}`;
+    if (alreadyVerified(sig, SHIP_LAST_PATH)) return { surfaced: false };
+
+    // Reconstruct the target with the SAME primitives anchor-shadow.mjs uses. The context is the bounded
+    // recent transcript tail (where the agent's own `gh`/`git`/deploy output printed the PR/URL/sha); the
+    // claim line is appended so a target named only in the claim ("deployed to https://x") is seen too.
+    const payload = {
+      cwd: cwd || process.cwd(),
+      transcript_path: transcriptPath,
+      prompt: claimText,
+    };
+    const target = reconstructTarget(kind, recentContextText(payload), payload);
+    if (!target) {
+      markVerified(sig, SHIP_LAST_PATH);
+      appendShadowLog({
+        ts: new Date().toISOString(),
+        session: session || null,
+        category: "ship",
+        claim_text: claimText,
+        ship_claim: kind,
+        target: null,
+        probe_command: null,
+        pass_fail: null,
+        outcome: "NO_TARGET",
+        mismatch: false,
+        evidence: "",
+      });
+      return { surfaced: false };
+    }
+
+    // One read-only probe, single-flight (shares the lock with the test re-run so a burst never piles up).
+    if (!acquireLock()) return { surfaced: false };
+    let res;
+    try {
+      res = await runProbe(target); // execFile arg-array, 5s cap, re-validates target — no mutations
+    } finally {
+      releaseLock();
+    }
+    markVerified(sig, SHIP_LAST_PATH);
+    // pass ∈ { true (reachable/merged/on-main), false (decisive negative), null (unknown — never a lie) }.
+    const pass = res && res.pass;
+    const outcome = pass === true ? "SHIP_OK" : pass === false ? "SHIP_FAIL" : "SHIP_UNKNOWN";
+    const pass_fail = pass === true ? "PASS" : pass === false ? "FAIL" : "UNKNOWN";
+    const compact = safeShipTarget(target);
+    const row = {
+      ts: new Date().toISOString(),
+      session: session || null,
+      category: "ship",
+      claim_text: claimText,
+      ship_claim: kind,
+      target: compact,
+      probe_command: probeCommandString(target),
+      pass_fail,
+      outcome,
+      mismatch: pass === false, // claimed shipped, the read-only probe says it is NOT
+      evidence: String((res && res.evidence) || "").slice(0, 200),
+    };
+    appendShadowLog(row);
+    maybeSurfaceReveal(row); // gated on SKALPEL_VERIFY_REVEAL — dark by default
+    return { surfaced: pass === false && revealEnabled(process.env) };
+  } catch {
+    return { surfaced: false }; // SHADOW: swallow everything — never affect the hook or the turn
+  }
+}
+
 // recordVerifyShadow({transcriptPath, session, cwd}) — the wired entry. On (claim + reconstructable
 // proof) it re-runs the proof and appends one shadow row. LOG ONLY. Never injects, never throws.
 export async function recordVerifyShadow({ transcriptPath, session, cwd }) {
@@ -800,7 +1037,16 @@ export async function recordVerifyShadow({ transcriptPath, session, cwd }) {
     if (!transcriptPath) return;
     const entries = readEntries(transcriptPath);
     if (!entries.length) return;
-    const { claim, text } = detectCompletionClaim(lastAssistantText(entries));
+    const assistantText = lastAssistantText(entries);
+
+    // NEW proof-category: the SHIP-STATUS catch runs first. A decisive ship FAIL (claimed live but 404,
+    // claimed merged but OPEN) is the most concrete catch, so when it surfaces a reveal we stop here and
+    // don't also run the test path (which could clobber the ship reveal). On no ship claim / PASS /
+    // UNKNOWN it falls through to the unchanged test-proof path below.
+    const ship = await maybeShipStatusCatch({ text: assistantText, session, cwd, transcriptPath });
+    if (ship && ship.surfaced) return;
+
+    const { claim, text } = detectCompletionClaim(assistantText);
     if (!claim) return; // no claim this turn → nothing to verify (keeps the log claim-only)
 
     const sig = `${session || ""}|${djb2(text)}`;
@@ -877,15 +1123,21 @@ export function renderVerifyReport() {
     return `no claim-verification shadow data yet (${VERIFY_LOG_PATH})\n\nEnable the shadow with SKALPEL_VERIFY_SHADOW=1, then keep coding — every turn your agent claims "done / tests pass" gets its own proof re-run and logged here.`;
   }
 
-  const claims = rows.length;
-  const withProof = rows.filter((r) => r.proof_command).length;
+  // The test-proof instrument counts ONLY test rows (no `category`). Ship-status rows (category:"ship")
+  // are a separate proof-category with their own probe verbs, reported in their own section below — so
+  // adding them never perturbs the pre-existing test numbers on old logs.
+  const testRows = rows.filter((r) => r.category !== "ship");
+  const shipRows = rows.filter((r) => r.category === "ship");
+
+  const claims = testRows.length;
+  const withProof = testRows.filter((r) => r.proof_command).length;
   // Genuine re-runs only (PASS or a real test FAIL). HARNESS_ERROR rows (timeout, missing script, wrong
   // cwd) are EXCLUDED from the mismatch denominator — the proof machinery broke, not the agent's work.
-  const reran = rows.filter((r) => r.pass_fail === "PASS" || r.pass_fail === "FAIL").length;
-  const harnessErrors = rows.filter(
+  const reran = testRows.filter((r) => r.pass_fail === "PASS" || r.pass_fail === "FAIL").length;
+  const harnessErrors = testRows.filter(
     (r) => r.pass_fail === "HARNESS_ERROR" || r.outcome === "HARNESS_ERROR",
   ).length;
-  const mismatches = rows.filter((r) => r.mismatch === true).length;
+  const mismatches = testRows.filter((r) => r.mismatch === true).length;
 
   // Denominator for claim fire-rate: total prompt turns the hook saw (metrics.ndjson prompt events).
   let promptTurns = 0;
@@ -924,7 +1176,7 @@ export function renderVerifyReport() {
     `      ${mismatches} time(s) the agent claimed done but its own proof, re-run, did NOT pass.`,
   );
   // Show the most recent few mismatches concretely (the receipt).
-  const recentMismatch = rows
+  const recentMismatch = testRows
     .filter((r) => r.mismatch)
     .slice(-3)
     .reverse();
@@ -937,6 +1189,46 @@ export function renderVerifyReport() {
       if (r.evidence) L.push(`      ${String(r.evidence).slice(0, 68)}`);
     }
   }
+
+  // SHIP-STATUS proof-category — the deploy/GTM claim ("it's live / merged / pushed / returns 200")
+  // checked by a READ-ONLY probe. Its own instrument: how many ship claims were probed, how many were
+  // decisive, and how many were caught (claimed shipped, the probe said NO). Every number is real probe
+  // output — an UNKNOWN probe (timeout/missing gh|curl/DNS) is excluded, never counted as a lie.
+  if (shipRows.length) {
+    const shipProbed = shipRows.filter((r) => r.target).length;
+    const shipDecisive = shipRows.filter(
+      (r) => r.pass_fail === "PASS" || r.pass_fail === "FAIL",
+    ).length;
+    const shipCaught = shipRows.filter((r) => r.mismatch === true).length;
+    const shipUnknown = shipRows.filter((r) => r.outcome === "SHIP_UNKNOWN").length;
+    L.push("");
+    L.push("─".repeat(72));
+    L.push("  SHIP-STATUS catch (claimed live/merged/pushed → checked by a READ-ONLY probe)");
+    L.push(`  ship claims logged                 ${shipRows.length}`);
+    L.push(
+      `  (S1) target-reconstruction rate    ${pct(shipProbed, shipRows.length)}   ${shipProbed}/${shipRows.length} ship claims yielded a probeable target`,
+    );
+    L.push(
+      `  (S2) SHIP-MISMATCH rate            ${pct(shipCaught, shipDecisive)}   ${shipCaught}/${shipDecisive} decisive probes said NOT shipped after a ship claim`,
+    );
+    L.push(
+      `      (excluded: ${shipUnknown} unknown probe(s) — timeout/missing gh|curl/DNS, not counted as a lie)`,
+    );
+    const recentShip = shipRows
+      .filter((r) => r.mismatch)
+      .slice(-3)
+      .reverse();
+    if (recentShip.length) {
+      L.push("");
+      L.push("  recent ship-status catches:");
+      for (const r of recentShip) {
+        L.push(`    • claim: ${String(r.claim_text || "").slice(0, 68)}`);
+        L.push(`      probe: ${String(r.probe_command || "").slice(0, 68)}  → NOT SHIPPED`);
+        if (r.evidence) L.push(`      ${String(r.evidence).slice(0, 68)}`);
+      }
+    }
+  }
+
   L.push("");
   L.push(
     "  SHADOW mode: logged locally only — never injected into the model, never blocks a turn.",