skalpel 4.0.44 → 4.0.46

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skalpel",
-  "version": "4.0.44",
+  "version": "4.0.46",
   "description": "Behavioral graph for AI-assisted coding — learns how you work and steers Claude Code + Codex in real time.",
   "type": "module",
   "bin": {

package/skalpel-setup.mjs

@@ -23,6 +23,7 @@ import { spawn, spawnSync } from "node:child_process";
 import { identity as authIdentity, cliAuthPath } from "./auth.mjs";
 import { isGenuineUserTurn } from "./session-turns.mjs";
 import { appendAdjudication, suppressProof, lastReveal, parseArmToken } from "./insights.mjs";
+import { maybeFirstRunCatch } from "./first-run.mjs";
 
 // CLI (the `skalpel` bin): `skalpel setup [--api https://graph.skalpel.ai]
 // [--user <id>]`, plus `skalpel uninstall` and `skalpel login`. A bare invocation
@@ -1119,6 +1120,13 @@ async function main() {
   // never blocks (stays default OFF). Reversible anytime with `skalpel verify off`.
   await promptVerifyConsent();
 
+  // THE FIRST CATCH — first-run magic. Immediately after consent-arming completes, if this is a TTY and
+  // the user consented, scan their OWN coding history (read-only, ~3s hard budget) and reveal ONE real
+  // "done over a failing test" catch from it — collapsing time-to-first-aha to seconds. Fail-open and
+  // byte-identical-off: non-TTY / CI / declined-consent never scans or reads a transcript, and any error
+  // skips silently to the normal setup ending. Never throws; never blocks setup.
+  await maybeFirstRunCatch({ isTTY, env: process.env });
+
   // 2) find the real coding sessions in the last 30 days (the client reads; the server builds)
   const s1 = spinner(`Looking through your last ${LOOKBACK_DAYS} days of Claude Code + Codex…`);
   await sleep(500);

package/verify-shadow.mjs

@@ -8,15 +8,17 @@
 // invented), RE-RUN it out-of-band, and record the real PASS/FAIL the agent cannot forge. The money
 // metric is the MISMATCH rate: how often the agent claimed success but its own proof, re-run, FAILS.
 //
-// SHIP-STATUS catch (v0, same DARK gates): the SAME "the agent is its own reporter" problem extends past
-// tests to the DEPLOY/GTM claim — "it's live / deployed / merged / pushed / returns 200". When the last
-// turn ASSERTS a ship status, we reconstruct the concrete target from the session (a URL, a PR number, a
-// commit sha) and run ONE READ-ONLY probe to check it — curl -sS -o /dev/null -w %{http_code} for a URL,
-// gh pr view <n> --json state,mergedAt for a PR, git branch --contains <sha> for a push. On a decisive
-// negative (claimed live but 404, claimed merged but OPEN) we surface the SAME honest reveal the test
-// catch uses — from REAL probe output, gated on the SAME opt-in flag. The read-only probe primitives
-// (execFile arg-arrays, strict allowlist, validated args, 5s cap) are REUSED verbatim from the
-// security-reviewed anchor-shadow.mjs (PR #586) — never re-implemented here.
+// SHIP-STATUS v1 catch ("Remote-Truth", same DARK gates): the SAME "the agent is its own reporter"
+// problem extends past tests to the DEPLOY/GTM claim — "it's live / deployed / merged / pushed / released
+// / CI green". When the last turn ASSERTS a ship status, we reconstruct EXACTLY the target of that claim's
+// own family (STRICT kind↔probe, NO cross-kind fallback) and run ONE READ-ONLY probe: pushed → REMOTE-TRUTH
+// (`git ls-remote origin <branch>` for the real tip, then a local `git merge-base --is-ancestor` — a push
+// that never left the machine is caught, a real feature-branch push is never false-accused); merged → `gh
+// pr view`; live/deployed → `curl` (with HTTP precision: 401/403/405/5xx → UNKNOWN, only a CONFIRMED 404/
+// gone fires); released/published → `npm view` / `git ls-remote --tags`; CI green → `gh pr checks`. On a
+// DECISIVE negative we surface the SAME honest reveal the test catch uses — from REAL probe output, gated
+// on the SAME opt-in flag. The read-only probe primitives (execFile arg-arrays, strict whitelist, validated
+// args, bounded cap) are REUSED from the security-reviewed anchor-shadow.mjs (PR #586) — never re-implemented.
 //
 // SHADOW: this LOGS ONLY. It never injects into the model, never blocks or slows a turn, and never
 // deploys anything. It re-runs the session's OWN test/build proof, which is normally read-only; a proof
@@ -30,9 +32,9 @@
 //      npx tsc|jest|vitest|eslint|biome, pytest, cargo test|build|check|clippy, go test|build|vet,
 //      tsc, jest, vitest, eslint, biome, ruff, mypy, pyright, python -m <allowlisted>). Anything else
 //      is REFUSED. The command never comes from prompt/claim CONTENT — only from the session's own
-//      prior Bash tool_use commands. The SHIP-STATUS probe is likewise allowlisted to a fixed set of
-//      READ-ONLY reachability/status commands (gh pr view, curl reachability, git branch/log, stripe
-//      prices list) — see anchor-shadow.mjs runProbe/validateTarget.
+//      prior Bash tool_use commands. The SHIP-STATUS v1 probe is likewise allowlisted to a fixed set of
+//      READ-ONLY reachability/status commands (gh pr view / pr checks, curl reachability, git ls-remote +
+//      merge-base --is-ancestor, npm view) — see anchor-shadow.mjs runShipProbeV1/validateShipTargetV1.
 //   2. execFile, NEVER a shell. Args are passed as a literal ARGUMENT ARRAY; there is no shell to
 //      interpret metacharacters, so a crafted string can never be executed as a command. shell:false.
 //      The ship probe validates every reconstructed value (pr=digits, url=well-formed http(s), sha=hex)
@@ -82,12 +84,20 @@ import {
   AUTO_DARKEN_MIN_ADJ,
   AUTO_DARKEN_MIN_PRECISION,
 } from "./insights.mjs";
-// SHIP-STATUS catch: REUSE the security-reviewed, READ-ONLY probe primitives from anchor-shadow.mjs
-// (PR #586) verbatim — never re-implemented. runProbe(target) runs ONE allowlisted read-only command via
-// execFile arg-arrays with a 5s cap and re-validates the target; reconstructTarget mines a PR/URL/sha from
-// session context; recentContextText is the bounded-tail context reader those two use. Importing (not
-// copying) keeps a SINGLE copy of the safety-critical logic under one review.
-import { runProbe, reconstructTarget, recentContextText } from "./anchor-shadow.mjs";
+// SHIP-STATUS v1 catch: REUSE the security-reviewed, READ-ONLY probe primitives from anchor-shadow.mjs
+// (PR #586) — never re-implemented here. The v1 layer is STRICT kind↔probe (no cross-kind fallback):
+// reconstructShipTargetV1(claim, ctx, payload) mines EXACTLY the target of the claim's own family (or
+// null → honest silence); runShipProbeV1(target) runs that family's single READ-ONLY command via execFile
+// arg-arrays with a bounded cap and re-validated args; SHIP_KIND_PROBE/shipProbeFamily are the 1:1 map;
+// recentContextText is the bounded-tail context reader. Importing (not copying) keeps ONE copy of the
+// safety-critical probe logic under one review.
+import {
+  recentContextText,
+  reconstructShipTargetV1,
+  runShipProbeV1,
+  shipProbeFamily,
+  SHIP_KIND_PROBE,
+} from "./anchor-shadow.mjs";
 
 const DIR = join(homedir(), ".skalpel");
 export const VERIFY_LOG_PATH = join(DIR, "verify-shadow.log");
@@ -889,10 +899,10 @@ export function buildRevealLine(row) {
 // sha on main?), not a re-run. We look at the agent's LAST assistant prose (same source as the test
 // claim) and fire ONLY on an ASSERTION of ship status — never a question, never a stated intention.
 //
-// Each pattern maps to a canonical claim keyword that anchor-shadow.mjs `reconstructTarget` understands
-// (live | deployed | merged | pushed | released). A "returns 200 / is up" claim maps to `live` (a URL
-// reachability probe). Precision over recall: a missed claim just means no catch, but a false claim
-// would probe a target the agent never actually shipped.
+// Each pattern maps to a canonical claim kind that anchor-shadow.mjs `reconstructShipTargetV1` understands
+// (live | deployed | merged | pushed | released | published | ci). Each kind has EXACTLY ONE probe family
+// (SHIP_KIND_PROBE) — a missed claim just means no catch, but a false claim would probe a target the agent
+// never actually shipped, so precision over recall. First matching pattern per line wins.
 const SHIP_CLAIM_PATTERNS = [
   // deployed / deploy complete / pushed the deploy
   [
@@ -919,10 +929,20 @@ const SHIP_CLAIM_PATTERNS = [
     "pushed",
     /\b(?:it'?s\s+|now\s+|has\s+been\s+|is\s+)?pushed\b|\bpushed\s+(?:it|the\s+(?:commit|branch|changes?)|to\s+(?:main|origin|remote))\b/i,
   ],
+  // published (to npm) — the registry claim, distinct from a git-tag release
+  [
+    "published",
+    /\bpublished\b|\bpush(?:ed)?\s+to\s+npm\b|\bnpm\s+publish(?:ed)?\b|\bon\s+(?:the\s+)?(?:npm\s+)?registry\b/i,
+  ],
   // released / shipped / shipped to prod
   [
     "released",
-    /\b(?:it'?s\s+|now\s+|has\s+been\s+)?released\b|\bshipp?ed\s+(?:it|to\s+prod(?:uction)?)\b/i,
+    /\b(?:it'?s\s+|now\s+|has\s+been\s+)?released\b|\bshipp?ed\s+(?:it|to\s+prod(?:uction)?)\b|\btagged\s+(?:the\s+)?release\b/i,
+  ],
+  // CI green / checks passing / pipeline green — the REMOTE checks claim (distinct from a local test claim)
+  [
+    "ci",
+    /\bci\s+(?:is\s+|are\s+|now\s+|all\s+)?(?:green|passing|pass(?:ed|es)?)\b|\b(?:the\s+)?checks?\s+(?:are\s+|is\s+|all\s+|now\s+)?(?:green|passing|pass(?:ed|es)?)\b|\ball\s+checks?\s+(?:are\s+)?(?:green|passing|passed)\b|\bpipeline\s+(?:is\s+)?(?:green|passing)\b/i,
   ],
 ];
 
@@ -931,7 +951,7 @@ const SHIP_FUTURE_OR_QUESTION =
   /\b(?:will|i'?ll|we'?ll|going\s+to|gonna|about\s+to|let\s+me|planning\s+to|need\s+to|shall\s+i|should\s+i|can\s+i|once\s+|after\s+i|before\s+i|ready\s+to)\b/i;
 
 // detectShipClaim(text) → { claim:bool, kind, text:<the claim line, <=120c> }. Scans lines; returns the
-// first ASSERTIVE ship-status line. `kind` is the canonical claim keyword reconstructTarget consumes.
+// first ASSERTIVE ship-status line. `kind` is the canonical claim keyword reconstructShipTargetV1 consumes.
 export function detectShipClaim(text) {
   const s = typeof text === "string" ? text : "";
   if (!s.trim()) return { claim: false, kind: null, text: "" };
@@ -955,19 +975,34 @@ function safeShipTarget(t) {
   if (!t || typeof t !== "object") return null;
   if (t.kind === "url") return { kind: "url", url: clipText(t.url, 160) };
   if (t.kind === "pr") return { kind: "pr", n: t.n };
-  if (t.kind === "git") return { kind: "git", sha: String(t.sha || "").toLowerCase() };
-  if (t.kind === "stripe-price") return { kind: "stripe-price" };
+  if (t.kind === "git-remote")
+    return {
+      kind: "git-remote",
+      sha: String(t.sha || "").toLowerCase(),
+      remote: t.remote || "origin",
+      branch: t.branch || null,
+    };
+  if (t.kind === "npm") return { kind: "npm", name: t.name, version: t.version };
+  if (t.kind === "git-tag") return { kind: "git-tag", tag: t.tag, remote: t.remote || "origin" };
+  if (t.kind === "gh-checks")
+    return { kind: "gh-checks", n: t.n ?? null, sha: t.sha ? String(t.sha).slice(0, 12) : null };
   return null;
 }
 
-// probeCommandString(t) — a human receipt of the exact READ-ONLY command that ran (for the log + report).
-// It mirrors anchor-shadow.mjs runProbe's argv EXACTLY; it is never executed (execFile ran the arg-array).
+// probeCommandString(t) — a human receipt of the READ-ONLY command(s) that ran (for the log + report).
+// It mirrors anchor-shadow.mjs runShipProbeV1's argv; it is never executed (execFile ran the arg-array).
 function probeCommandString(t) {
   if (!t || typeof t !== "object") return null;
   if (t.kind === "url") return `curl -sS -m 5 -o /dev/null -w %{http_code} ${clipText(t.url, 120)}`;
   if (t.kind === "pr") return `gh pr view ${t.n} --json state,mergedAt`;
-  if (t.kind === "git") return `git branch --contains ${String(t.sha || "").slice(0, 12)}`;
-  if (t.kind === "stripe-price") return `stripe prices list --limit 3`;
+  if (t.kind === "git-remote")
+    return `git ls-remote ${t.remote || "origin"} ${t.branch || "<branch>"} ; git merge-base --is-ancestor ${String(t.sha || "").slice(0, 12)} <remoteTip>`;
+  if (t.kind === "npm") return `npm view ${t.name}@${t.version} version`;
+  if (t.kind === "git-tag") return `git ls-remote --tags ${t.remote || "origin"} ${t.tag}`;
+  if (t.kind === "gh-checks")
+    return t.n != null
+      ? `gh pr checks ${t.n} --json state,bucket`
+      : `gh run list --commit ${String(t.sha || "").slice(0, 12)} --json conclusion,status`;
   return null;
 }
 
@@ -1002,7 +1037,7 @@ export function buildShipRevealLine(row) {
   const ev = String(row.evidence || "");
   if (t.kind === "url") {
     const m = ev.match(/http_code=(\d+)/);
-    const tail = m ? `returns HTTP ${m[1]}` : "is not reachable";
+    const tail = m ? `returns HTTP ${m[1]}` : "is unreachable (no response)";
     return `🔬 skalpel caught it — your agent said "${claim}" but \`${clipText(t.url, 48)}\` ${tail}. It's not live.`;
   }
   if (t.kind === "pr") {
@@ -1010,12 +1045,22 @@ export function buildShipRevealLine(row) {
     const st = m ? m[1].toUpperCase() : "OPEN";
     return `🔬 skalpel caught it — your agent said "${claim}" but PR #${t.n} is ${st}, not merged. It's not done.`;
   }
-  if (t.kind === "git") {
+  if (t.kind === "git-remote") {
     const sha = String(t.sha || "").slice(0, 7);
-    return `🔬 skalpel caught it — your agent said "${claim}" but commit ${sha} isn't on main yet. It's not pushed.`;
+    const branch = `${t.remote || "origin"}/${t.branch || "?"}`;
+    const tm = ev.match(/remoteTip=([0-9a-f]{7,12})/);
+    const at = tm ? ` at ${tm[1]}` : "";
+    return `🔬 skalpel caught it — your agent said "${claim}" but ${sha} isn't in ${branch}${at} — it never left your machine. It's not pushed.`;
+  }
+  if (t.kind === "npm") {
+    return `🔬 skalpel caught it — your agent said "${claim}" but ${t.name}@${t.version} isn't on the npm registry. It's not published.`;
   }
-  if (t.kind === "stripe-price") {
-    return `🔬 skalpel caught it — your agent said "${claim}" but Stripe returned no matching price. It's not live.`;
+  if (t.kind === "git-tag") {
+    return `🔬 skalpel caught it — your agent said "${claim}" but tag ${t.tag} isn't on ${t.remote || "origin"}. It's not released.`;
+  }
+  if (t.kind === "gh-checks") {
+    const ref = t.n != null ? `PR #${t.n}` : `commit ${String(t.sha || "").slice(0, 7)}`;
+    return `🔬 skalpel caught it — your agent said "${claim}" but checks on ${ref} are failing, not green.`;
   }
   return `🔬 skalpel caught it — your agent said "${claim}" but the ship-status probe came back negative.`;
 }
@@ -1152,11 +1197,13 @@ function maybeSurfaceReveal(row) {
         line: revealLineFor(row),
       });
       // MEASURABLE: one reveal_shown insight per fire → fire-rate + (later) retention, no fabricated data.
+      // A ship reveal carries its ship-claim kind (pushed/merged/live/…) so per-kind precision is derivable.
       recordInsight({
         kind: "reveal_shown",
         display: revealLineFor(row),
         proof: sig,
         session: row.session || null,
+        ...(row.category === "ship" ? { ship_kind: row.ship_claim || null } : {}),
       });
     } else if (isPass) {
       clearReveal(row.session || null); // resolved — don't wallpaper a catch the agent already fixed
@@ -1179,12 +1226,98 @@ function maybeSurfaceReveal(row) {
   }
 }
 
-// maybeShipStatusCatch(...) — the SHIP-STATUS proof-category. When the agent's last turn ASSERTS a ship
-// status, reconstruct the concrete target from session context and run ONE READ-ONLY allowlisted probe
-// (reused verbatim from anchor-shadow.mjs). Appends one `category:"ship"` shadow row and, on a decisive
-// negative, surfaces the SAME reveal (gated on SKALPEL_VERIFY_REVEAL). Returns { surfaced } — surfaced is
-// true ONLY when a decisive ship FAIL was revealed, so the caller can skip the test path (the concrete
-// ship catch is the stronger signal). LOG ONLY otherwise; never injects, never throws.
+// SHIP-STATUS v1 confirm-gate: the wait between a URL FAIL_CANDIDATE (404/410/NXDOMAIN/refused) and its
+// ONE confirming re-probe. Default ~60s; overridable via env (SKALPEL_SHIP_CONFIRM_MS, 0 for tests). The
+// wait happens ONLY inside the DETACHED, unref'd `--run` worker — never on the per-turn hook deadline.
+const SHIP_CONFIRM_DELAY_MS = (() => {
+  const v = parseInt(process.env.SKALPEL_SHIP_CONFIRM_MS ?? "", 10);
+  return Number.isFinite(v) && v >= 0 ? v : 60_000;
+})();
+function shipSleep(ms) {
+  return new Promise((r) => {
+    const t = setTimeout(r, ms);
+    if (t && typeof t.unref === "function") t.unref(); // never keep the worker alive on our account
+  });
+}
+
+// resolveShipStatus({kind, contextText, payload, target?, exec?, ...}) — the TESTABLE core of the ship
+// catch: reconstruct the strict single-family target (or accept a prebuilt one), run its ONE read-only
+// probe, and (only for a URL FAIL_CANDIDATE) confirm-gate before ever calling it a red. Returns a plain
+// result object — no I/O, no lock, no reveal. `exec` (the read-only command runner) and `sleep` are
+// injectable purely so the eval harness can drive every branch hermetically. Never throws to the caller.
+//   outcome ∈ { NO_TARGET, SHIP_OK, SHIP_FAIL, SHIP_UNKNOWN };  mismatch === (outcome === "SHIP_FAIL").
+export async function resolveShipStatus({
+  kind,
+  contextText,
+  payload,
+  target,
+  exec,
+  confirmDelayMs,
+  sleep = shipSleep,
+  beforeReprobe,
+}) {
+  const tgt = target !== undefined ? target : reconstructShipTargetV1(kind, contextText, payload);
+  if (!tgt) {
+    return {
+      kind,
+      target: null,
+      probe_kind: null,
+      outcome: "NO_TARGET",
+      mismatch: false,
+      evidence: "",
+      confirm_reprobe: false,
+      confirm_outcome: null,
+    };
+  }
+  const probe_kind = shipProbeFamily(tgt.kind);
+  const first = await runShipProbeV1(tgt, exec);
+  let verdict = first.verdict;
+  let evidence = first.evidence;
+  let confirm_reprobe = false;
+  let confirm_outcome = null;
+  // Defect 3 CONFIRM-GATE: a URL fail candidate (a 404/410/gone or a NXDOMAIN/refused, which can be pure
+  // CDN/propagation lag) NEVER reveals immediately — wait ~60s and re-probe ONCE; only a CONFIRMED
+  // double-negative (2/2 fail candidate) fires. A PASS on the re-probe means it was transient → SHIP_OK.
+  if (verdict === "FAIL_CANDIDATE" && tgt.kind === "url") {
+    if (typeof beforeReprobe === "function") {
+      try {
+        beforeReprobe();
+      } catch {
+        /* the confirm re-probe proceeds even if the lock refresh fails */
+      }
+    }
+    const wait = confirmDelayMs != null ? confirmDelayMs : SHIP_CONFIRM_DELAY_MS;
+    if (wait > 0) await sleep(wait);
+    const second = await runShipProbeV1(tgt, exec);
+    confirm_reprobe = true;
+    confirm_outcome = second.verdict;
+    evidence = second.evidence || evidence;
+    verdict =
+      second.verdict === "FAIL_CANDIDATE" ? "FAIL" : second.verdict === "PASS" ? "PASS" : "UNKNOWN";
+  } else if (verdict === "FAIL_CANDIDATE") {
+    // A non-URL probe should never yield a lone candidate; treat as UNKNOWN so it can never single-red.
+    verdict = "UNKNOWN";
+  }
+  const outcome =
+    verdict === "PASS" ? "SHIP_OK" : verdict === "FAIL" ? "SHIP_FAIL" : "SHIP_UNKNOWN";
+  return {
+    kind,
+    target: tgt,
+    probe_kind,
+    outcome,
+    mismatch: outcome === "SHIP_FAIL",
+    evidence,
+    confirm_reprobe,
+    confirm_outcome,
+  };
+}
+
+// maybeShipStatusCatch(...) — the SHIP-STATUS v1 proof-category. When the agent's last turn ASSERTS a ship
+// status, reconstruct EXACTLY the target of that claim's own family (STRICT kind↔probe, no cross-kind
+// fallback) and run ONE READ-ONLY probe (reused from anchor-shadow.mjs). Appends one `category:"ship"`
+// shadow row and, on a DECISIVE negative, surfaces the SAME reveal (gated on SKALPEL_VERIFY_REVEAL).
+// Returns { surfaced } — true ONLY when a decisive ship FAIL was revealed, so the caller can skip the test
+// path (the concrete ship catch is the stronger signal). LOG ONLY otherwise; never injects, never throws.
 async function maybeShipStatusCatch({ text, session, cwd, transcriptPath }) {
   try {
     const { claim, kind, text: claimText } = detectShipClaim(text);
@@ -1193,16 +1326,18 @@ async function maybeShipStatusCatch({ text, session, cwd, transcriptPath }) {
     const sig = `ship|${session || ""}|${djb2(claimText)}`;
     if (alreadyVerified(sig, SHIP_LAST_PATH)) return { surfaced: false };
 
-    // Reconstruct the target with the SAME primitives anchor-shadow.mjs uses. The context is the bounded
-    // recent transcript tail (where the agent's own `gh`/`git`/deploy output printed the PR/URL/sha); the
-    // claim line is appended so a target named only in the claim ("deployed to https://x") is seen too.
+    // Reconstruct the STRICT single-family target. The context is the bounded recent transcript tail
+    // (where the agent's own `gh`/`git`/deploy output printed the PR/URL/sha); the claim line is appended
+    // so a target named only in the claim ("deployed to https://x") is seen too.
     const payload = {
       cwd: cwd || process.cwd(),
       transcript_path: transcriptPath,
       prompt: claimText,
     };
-    const target = reconstructTarget(kind, recentContextText(payload), payload);
+    const target = reconstructShipTargetV1(kind, recentContextText(payload), payload);
     if (!target) {
+      // No target of the RIGHT kind → NO_TARGET → honest silence (no red). Logged so the instrument can
+      // count the reconstruction miss. (Cheap, no probe, no lock.)
       markVerified(sig, SHIP_LAST_PATH);
       appendShadowLog({
         ts: new Date().toISOString(),
@@ -1210,59 +1345,53 @@ async function maybeShipStatusCatch({ text, session, cwd, transcriptPath }) {
         category: "ship",
         claim_text: claimText,
         ship_claim: kind,
+        probe_kind: SHIP_KIND_PROBE[kind] || null,
         target: null,
         probe_command: null,
         pass_fail: null,
         outcome: "NO_TARGET",
         mismatch: false,
+        confirm_reprobe: false,
+        confirm_outcome: null,
         evidence: "",
       });
       return { surfaced: false };
     }
 
     // One read-only probe, single-flight (shares the lock with the test re-run so a burst never piles up).
+    // The lock is held across the (possibly ~60s) URL confirm-gate; touchLock refreshes our own mtime so
+    // it isn't read as stale mid-confirm. All of this runs in the DETACHED worker — off the hook deadline.
     if (!acquireLock()) return { surfaced: false };
-    let res;
-    let ev1 = null;
-    let ev2 = null; // set only when a URL no-response triggers a confirming re-probe (2/2 rule)
+    let resolved;
     try {
-      res = await runProbe(target); // execFile arg-array, 5s cap — READ-ONLY, no mutations
-      ev1 = res && res.evidence;
-      // URL FALSE-RED SAFEGUARD: any HTTP status = reachable/live. Only a genuine no-response may be a
-      // red, and only after a CONFIRMING re-probe. Held under the same single-flight lock (mtime refreshed).
-      if (target.kind === "url" && !urlResponded(ev1)) {
-        touchLock();
-        const res2 = await runProbe(target);
-        ev2 = res2 && res2.evidence;
-        if (urlResponded(ev2)) res = res2; // came back on the 2nd probe → surface the LIVE result
-      }
+      resolved = await resolveShipStatus({ kind, target, payload, beforeReprobe: touchLock });
     } finally {
       releaseLock();
     }
     markVerified(sig, SHIP_LAST_PATH);
-    // pass ∈ { true (reachable/merged/on-main), false (decisive negative), null (unknown — never a lie) }.
-    // For a URL we reinterpret via shipUrlPass: any HTTP response → live (never a red); a red needs 2/2
-    // no-response. gh/git/stripe keep runProbe's decisive true/false/null verdict unchanged.
-    const pass = target.kind === "url" ? shipUrlPass(ev1, ev2) : res && res.pass;
-    const outcome = pass === true ? "SHIP_OK" : pass === false ? "SHIP_FAIL" : "SHIP_UNKNOWN";
-    const pass_fail = pass === true ? "PASS" : pass === false ? "FAIL" : "UNKNOWN";
-    const compact = safeShipTarget(target);
+
+    const outcome = resolved.outcome;
+    const pass_fail = outcome === "SHIP_OK" ? "PASS" : outcome === "SHIP_FAIL" ? "FAIL" : "UNKNOWN"; // NO_TARGET handled above
     const row = {
       ts: new Date().toISOString(),
       session: session || null,
       category: "ship",
       claim_text: claimText,
       ship_claim: kind,
-      target: compact,
+      probe_kind: resolved.probe_kind,
+      target: safeShipTarget(target),
       probe_command: probeCommandString(target),
       pass_fail,
       outcome,
-      mismatch: pass === false, // claimed shipped, the read-only probe says it is NOT
-      evidence: String((res && res.evidence) || "").slice(0, 200),
+      mismatch: outcome === "SHIP_FAIL", // claimed shipped, the read-only probe DECISIVELY says it is NOT
+      // The instrument records the confirm re-probe (URL fail-candidate) and its second-probe verdict.
+      confirm_reprobe: resolved.confirm_reprobe,
+      confirm_outcome: resolved.confirm_outcome,
+      evidence: String(resolved.evidence || "").slice(0, 200),
     };
     appendShadowLog(row);
     maybeSurfaceReveal(row); // gated on SKALPEL_VERIFY_REVEAL — dark by default
-    return { surfaced: pass === false && revealEnabled(process.env) };
+    return { surfaced: outcome === "SHIP_FAIL" && revealEnabled(process.env) };
   } catch {
     return { surfaced: false }; // SHADOW: swallow everything — never affect the hook or the turn
   }
@@ -1456,10 +1585,11 @@ export function renderVerifyReport() {
     }
   }
 
-  // SHIP-STATUS proof-category — the deploy/GTM claim ("it's live / merged / pushed / returns 200")
-  // checked by a READ-ONLY probe. Its own instrument: how many ship claims were probed, how many were
-  // decisive, and how many were caught (claimed shipped, the probe said NO). Every number is real probe
-  // output — an UNKNOWN probe (timeout/missing gh|curl/DNS) is excluded, never counted as a lie.
+  // SHIP-STATUS v1 proof-category — the deploy/GTM claim ("it's live / merged / pushed / released / CI
+  // green") checked by a STRICT single-family READ-ONLY probe. Its own instrument: how many ship claims
+  // were probed, how many were decisive, how many were caught (claimed shipped, the probe DECISIVELY said
+  // NO), plus a PER-KIND S1/S2 breakdown and the URL confirm-reprobe count. Every number is real probe
+  // output — an UNKNOWN probe (auth-wall/5xx/timeout/missing gh|curl|npm/DNS) is excluded, never a lie.
   if (shipRows.length) {
     const shipProbed = shipRows.filter((r) => r.target).length;
     const shipDecisive = shipRows.filter(
@@ -1467,9 +1597,13 @@ export function renderVerifyReport() {
     ).length;
     const shipCaught = shipRows.filter((r) => r.mismatch === true).length;
     const shipUnknown = shipRows.filter((r) => r.outcome === "SHIP_UNKNOWN").length;
+    const shipNoTarget = shipRows.filter((r) => r.outcome === "NO_TARGET").length;
+    const shipReprobes = shipRows.filter((r) => r.confirm_reprobe === true).length;
     L.push("");
     L.push("─".repeat(72));
-    L.push("  SHIP-STATUS catch (claimed live/merged/pushed → checked by a READ-ONLY probe)");
+    L.push(
+      "  SHIP-STATUS v1 catch (claimed live/merged/pushed/released/CI → STRICT read-only probe)",
+    );
     L.push(`  ship claims logged                 ${shipRows.length}`);
     L.push(
       `  (S1) target-reconstruction rate    ${pct(shipProbed, shipRows.length)}   ${shipProbed}/${shipRows.length} ship claims yielded a probeable target`,
@@ -1478,8 +1612,30 @@ export function renderVerifyReport() {
       `  (S2) SHIP-MISMATCH rate            ${pct(shipCaught, shipDecisive)}   ${shipCaught}/${shipDecisive} decisive probes said NOT shipped after a ship claim`,
     );
     L.push(
-      `      (excluded: ${shipUnknown} unknown probe(s) — timeout/missing gh|curl/DNS, not counted as a lie)`,
+      `      (excluded: ${shipUnknown} unknown probe(s) — auth-wall/5xx/timeout/missing gh|curl|npm/DNS, not counted as a lie)`,
+    );
+    L.push(
+      `      (no-target: ${shipNoTarget} claim(s) with no probeable target of the right kind — honest silence, no red)`,
+    );
+    L.push(
+      `      (confirm-reprobes: ${shipReprobes} URL fail-candidate(s) re-probed after ~60s — only a 2/2 double-negative fires)`,
     );
+    // PER-KIND S1(fires)/S2(catches) + reprobes. Each kind maps to exactly one probe family.
+    const kinds = [...new Set(shipRows.map((r) => r.ship_claim).filter(Boolean))].sort();
+    if (kinds.length) {
+      L.push("");
+      L.push("  per-kind  (probe · S1 fires · S2 catches · reprobes):");
+      for (const k of kinds) {
+        const kr = shipRows.filter((r) => r.ship_claim === k);
+        const s1 = kr.length;
+        const s2 = kr.filter((r) => r.mismatch === true).length;
+        const rp = kr.filter((r) => r.confirm_reprobe === true).length;
+        const pk = (kr.find((r) => r.probe_kind) || {}).probe_kind || SHIP_KIND_PROBE[k] || "?";
+        L.push(
+          `    ${String(k).padEnd(10)} → ${String(pk).padEnd(11)} S1 ${s1} · S2 ${s2} · reprobe ${rp}`,
+        );
+      }
+    }
     const recentShip = shipRows
       .filter((r) => r.mismatch)
       .slice(-3)