substrate-ai 0.20.4 → 0.20.6

package/dist/cli/index.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
-import { FileStateStore, RunManifest, SUBSTRATE_OWNED_SETTINGS_KEYS, SupervisorLock, VALID_PHASES, WorkGraphRepository, buildPipelineStatusOutput, createDatabaseAdapter, createStateStore, findPackageRoot, formatOutput, formatPipelineStatusHuman, formatPipelineSummary, formatTokenTelemetry, getAllDescendantPids, getAutoHealthData, getSubstrateDefaultSettings, inspectProcessTree, parseDbTimestampAsUtc, registerHealthCommand, resolveBmadMethodSrcPath, resolveBmadMethodVersion, resolveMainRepoRoot, resolveRunManifest } from "../health-CB48LF0t.js";
+import { FileStateStore, RunManifest, SUBSTRATE_OWNED_SETTINGS_KEYS, SupervisorLock, VALID_PHASES, WorkGraphRepository, ZERO_FINDING_COUNTS, buildPipelineStatusOutput, createDatabaseAdapter, createStateStore, findPackageRoot, formatOutput, formatPipelineStatusHuman, formatPipelineSummary, formatTokenTelemetry, getAllDescendantPids, getAutoHealthData, getSubstrateDefaultSettings, inspectProcessTree, parseDbTimestampAsUtc, registerHealthCommand, resolveBmadMethodSrcPath, resolveBmadMethodVersion, resolveMainRepoRoot, resolveRunManifest, rollupFindingCounts } from "../health-BIS34IYK.js";
 import { createLogger } from "../logger-KeHncl-f.js";
 import { createEventBus } from "../helpers-CElYrONe.js";
 import { AdapterRegistry, BudgetConfigSchema, CURRENT_CONFIG_FORMAT_VERSION, CURRENT_TASK_GRAPH_VERSION, ConfigError, CostTrackerConfigSchema, DEFAULT_CONFIG, DoltClient, DoltNotInstalled, GlobalSettingsSchema, IngestionServer, MonitorDatabaseImpl, OPERATIONAL_FINDING, PartialGlobalSettingsSchema, PartialProviderConfigSchema, ProvidersSchema, RoutingRecommender, STORY_METRICS, TelemetryConfigSchema, addTokenUsage, aggregateTokenUsageForRun, checkDoltInstalled, compareRunMetrics, createAmendmentRun, createConfigSystem, createDecision, createDoltClient, createPipelineRun, getActiveDecisions, getAllCostEntriesFiltered, getBaselineRunMetrics, getDecisionsByCategory, getDecisionsByPhaseForRun, getLatestCompletedRun, getLatestRun, getPipelineRunById, getPlanningCostTotal, getRetryableEscalations, getRunMetrics, getRunningPipelineRuns, getSessionCostSummary, getSessionCostSummaryFiltered, getStoryMetricsForRun, getTokenUsageSummary, incrementRunRestarts, initSchema, initializeDolt, listRunMetrics, loadParentRunDecisions, supersedeDecision, tagRunAsBaseline, updatePipelineRun } from "../dist-srr3BfCc.js";
 import "../adapter-registry-DXLMTmfD.js";
-import { AdapterTelemetryPersistence, AppError, DoltRepoMapMetaRepository, DoltSymbolRepository, ERR_REPO_MAP_STORAGE_WRITE, EpicIngester, GitClient, GrammarLoader, RepoMapInjector, RepoMapModule, RepoMapQueryEngine, RepoMapStorage, SymbolParser, createContextCompiler, createDispatcher, createEventEmitter, createImplementationOrchestrator, createPackLoader, createPhaseOrchestrator, createStopAfterGate, createTelemetryAdvisor, formatPhaseCompletionSummary, getFactoryRunSummaries, getScenarioResultsForRun, getTwinRunsForRun, listGraphRuns, registerExportCommand, registerFactoryCommand, registerRunCommand, registerScenariosCommand, resolveStoryKeys, runAnalysisPhase, runPlanningPhase, runSolutioningPhase, validateStopAfterFromConflict } from "../run-BHKqyFFM.js";
+import { AdapterTelemetryPersistence, AppError, DoltRepoMapMetaRepository, DoltSymbolRepository, ERR_REPO_MAP_STORAGE_WRITE, EpicIngester, GitClient, GrammarLoader, RepoMapInjector, RepoMapModule, RepoMapQueryEngine, RepoMapStorage, SymbolParser, createContextCompiler, createDispatcher, createEventEmitter, createImplementationOrchestrator, createPackLoader, createPhaseOrchestrator, createStopAfterGate, createTelemetryAdvisor, formatPhaseCompletionSummary, getFactoryRunSummaries, getScenarioResultsForRun, getTwinRunsForRun, listGraphRuns, registerExportCommand, registerFactoryCommand, registerRunCommand, registerScenariosCommand, resolveStoryKeys, runAnalysisPhase, runPlanningPhase, runSolutioningPhase, validateStopAfterFromConflict } from "../run-BAc1zfMQ.js";
 import "../errors-CSTQNabo.js";
 import "../routing-CcBOCuC9.js";
 import "../decisions-C0pz9Clx.js";
@@ -3619,9 +3619,11 @@ async function runStatusAction(options) {
 			if (run === void 0) run = await getLatestRun(adapter);
 		}
 		let workGraph;
+		let manifestPerStoryState;
 		const { manifest: resolvedManifest } = await resolveRunManifest(dbRoot, run?.id);
 		if (resolvedManifest !== null) try {
 			const manifestData = await resolvedManifest.read();
+			manifestPerStoryState = manifestData.per_story_state;
 			workGraph = buildWorkGraphFromManifest(manifestData.per_story_state);
 			logger$12.debug({ runId: run?.id }, "status: workGraph built from manifest per_story_state");
 		} catch {
@@ -3665,7 +3667,7 @@ async function runStatusAction(options) {
 			logger$12.debug({ err }, "Work graph query failed, continuing without work graph data");
 		}
 		if (run === void 0) {
-			const { inspectProcessTree: inspectProcessTree$1 } = await import("../health-DIMI36KN.js");
+			const { inspectProcessTree: inspectProcessTree$1 } = await import("../health-3-qy8XEI.js");
 			const substrateDirPath = join(projectRoot, ".substrate");
 			const processInfo = inspectProcessTree$1({
 				projectRoot,
@@ -3708,6 +3710,8 @@ async function runStatusAction(options) {
 						for (const [phase, secs] of Object.entries(parsed)) phaseBreakdown[phase] = Math.round(secs * 1e3);
 					}
 				} catch {}
+				const verificationResult = manifestPerStoryState?.[row.story_key]?.verification_result;
+				const verificationFindings = rollupFindingCounts(verificationResult);
 				return {
 					story_key: row.story_key,
 					result: row.result,
@@ -3718,7 +3722,8 @@ async function runStatusAction(options) {
 						output: row.output_tokens ?? 0
 					},
 					review_cycles: row.review_cycles ?? 0,
-					dispatches: row.dispatches ?? 0
+					dispatches: row.dispatches ?? 0,
+					verification_findings: verificationFindings
 				};
 			});
 			let pipelineWallClockMs = 0;
@@ -5191,7 +5196,7 @@ async function runSupervisorAction(options, deps = {}) {
 								await initSchema(expAdapter);
 								const { runRunAction: runPipeline } = await import(
 									/* @vite-ignore */
-									"../run-l5fLWKtI.js"
+									"../run-Dif8PJRd.js"
 );
 								const runStoryFn = async (opts) => {
 									const exitCode = await runPipeline({
@@ -5953,6 +5958,14 @@ async function runMetricsAction(options) {
 				phaseBreakdownMap[run$1.run_id] = raw !== void 0 ? raw : null;
 			}
 		} catch {}
+		const findingCountsByStoryRun = new Map();
+		const uniqueRunIds = Array.from(new Set(storyMetrics.map((sm) => sm.run_id).filter((id) => id !== "")));
+		for (const uniqueRunId of uniqueRunIds) try {
+			const { manifest } = await resolveRunManifest(dbRoot, uniqueRunId);
+			if (manifest === null) continue;
+			const data = await manifest.read();
+			for (const [storyKey, entry] of Object.entries(data.per_story_state)) findingCountsByStoryRun.set(`${storyKey}:${uniqueRunId}`, rollupFindingCounts(entry.verification_result));
+		} catch {}
 		let factoryRuns = [];
 		try {
 			factoryRuns = await getFactoryRunSummaries(adapter, limit);
@@ -5965,10 +5978,14 @@ async function runMetricsAction(options) {
 				type: "sdlc",
 				phase_token_breakdown: phaseBreakdownMap[run$1.run_id] ?? null
 			}));
+			const storyMetricsWithFindings = storyMetrics.map((sm) => ({
+				...sm,
+				verification_findings: findingCountsByStoryRun.get(`${sm.story_key}:${sm.run_id}`) ?? { ...ZERO_FINDING_COUNTS }
+			}));
 			const jsonPayload = {
 				runs: runsWithBreakdown,
 				graph_runs: factoryRuns,
-				story_metrics: storyMetrics
+				story_metrics: storyMetricsWithFindings
 			};
 			if (doltMetrics !== void 0) if (aggregate) {
 				const aggregateResults = doltMetrics.map((m) => ({

package/dist/{health-DIMI36KN.js → health-3-qy8XEI.js}

@@ -1,4 +1,4 @@
-import { DEFAULT_STALL_THRESHOLD_SECONDS, getAllDescendantPids, getAutoHealthData, inspectProcessTree, isOrchestratorProcessLine, registerHealthCommand, runHealthAction } from "./health-CB48LF0t.js";
+import { DEFAULT_STALL_THRESHOLD_SECONDS, getAllDescendantPids, getAutoHealthData, inspectProcessTree, isOrchestratorProcessLine, registerHealthCommand, runHealthAction } from "./health-BIS34IYK.js";
 import "./logger-KeHncl-f.js";
 import "./dist-srr3BfCc.js";
 import "./decisions-C0pz9Clx.js";

package/dist/{health-CB48LF0t.js → health-BIS34IYK.js}

@@ -4,6 +4,7 @@ import { createRequire } from "module";
 import { dirname, join } from "path";
 import { readFile } from "fs/promises";
 import { EventEmitter } from "node:events";
+import { YAMLException, load } from "js-yaml";
 import { existsSync, promises, readFileSync } from "node:fs";
 import { spawn, spawnSync } from "node:child_process";
 import { dirname as dirname$1, join as join$1, resolve as resolve$1 } from "node:path";
@@ -3259,7 +3260,7 @@ const MAX_OUTPUT_CHARS = 2e3;
 /** Per-stream tail size cap for structured findings (story 55-1 convention). */
 const TAIL_BYTES = 4 * 1024;
 /** Return the last N bytes of a UTF-8 string, sliced by string length for simplicity. */
-function tail(text, bytes = TAIL_BYTES) {
+function tail$1(text, bytes = TAIL_BYTES) {
 	return text.length <= bytes ? text : text.slice(text.length - bytes);
 }
 /**
@@ -3351,8 +3352,8 @@ var BuildCheck = class {
 					severity: "error",
 					message: `command exceeded ${BUILD_CHECK_TIMEOUT_MS}ms`,
 					command: cmd,
-					stdoutTail: tail(stdout),
-					stderrTail: tail(stderr),
+					stdoutTail: tail$1(stdout),
+					stderrTail: tail$1(stderr),
 					durationMs: duration
 				}];
 				resolve$2({
@@ -3379,8 +3380,8 @@ var BuildCheck = class {
 						message: `build failed (exit ${code}): ${truncated}`,
 						command: cmd,
 						...code !== null ? { exitCode: code } : {},
-						stdoutTail: tail(stdout),
-						stderrTail: tail(stderr),
+						stdoutTail: tail$1(stdout),
+						stderrTail: tail$1(stderr),
 						durationMs: duration
 					}];
 					resolve$2({
@@ -3395,6 +3396,342 @@ var BuildCheck = class {
 	}
 };
 
+//#endregion
+//#region packages/sdlc/dist/verification/probes/types.js
+/**
+* Execution sandbox for a runtime probe.
+*
+* - `host`: probe runs directly on the operator's machine. Explicit opt-in.
+*   Cheapest; most dangerous. Authors choosing `host` acknowledge the probe
+*   may touch host state (ports, systemd units, filesystem) and take
+*   responsibility for cleanup.
+* - `twin`: probe runs inside an ephemeral sandbox brokered by the Digital
+*   Twin subsystem (Epic 47). Twin integration is **deferred to Phase 3** —
+*   probes with `sandbox: twin` currently emit a `probe-deferred` warn
+*   finding rather than executing. Authors can declare twin-scoped probes
+*   today and they will execute transparently once Phase 3 lands.
+*/
+const RuntimeProbeSandboxSchema = z.enum(["host", "twin"]);
+/**
+* Default per-probe timeout in milliseconds. Matches the existing
+* BuildCheck ceiling (60 s) — deliberate, so probe timeouts are bounded
+* by the same policy the pipeline already uses for long-running checks.
+*/
+const DEFAULT_PROBE_TIMEOUT_MS = 6e4;
+/** Hard upper bound on per-probe stdout/stderr retention (≤ 4 KiB — the
+*  same convention as VerificationFinding.{stdoutTail,stderrTail}). */
+const PROBE_TAIL_BYTES = 4 * 1024;
+/**
+* Zod schema for one runtime probe declared in a story's
+* `## Runtime Probes` section.
+*
+* Required fields (`name`, `sandbox`, `command`) force authors to make
+* intent explicit — no silent defaults that could mask a miswritten probe.
+* Optional fields cover operational knobs with sensible fallbacks.
+*/
+const RuntimeProbeSchema = z.object({
+	name: z.string().min(1, "probe name is required"),
+	sandbox: RuntimeProbeSandboxSchema,
+	command: z.string().min(1, "probe command is required"),
+	timeout_ms: z.number().int().positive().optional(),
+	description: z.string().optional()
+});
+/** Zod schema for the full list (wrapping the per-probe schema). */
+const RuntimeProbeListSchema = z.array(RuntimeProbeSchema);
+
+//#endregion
+//#region packages/sdlc/dist/verification/probes/parser.js
+const SECTION_HEADING = /^##\s+Runtime\s+Probes\s*$/i;
+/**
+* Return the raw text of the story's `## Runtime Probes` section (excluding
+* the heading line itself), or `undefined` if the section is not present.
+*
+* The section ends at the next `##` heading or end-of-file. Sub-headings
+* (`###`, `####`) remain part of the section body.
+*/
+function extractRuntimeProbesSection(storyContent) {
+	const lines = storyContent.split(/\r?\n/);
+	const start = lines.findIndex((line) => SECTION_HEADING.test(line.trim()));
+	if (start === -1) return void 0;
+	let end = lines.length;
+	for (let i = start + 1; i < lines.length; i += 1) if (/^##\s+\S/.test(lines[i] ?? "")) {
+		end = i;
+		break;
+	}
+	return lines.slice(start + 1, end).join("\n");
+}
+/**
+* Extract the body of the first ```yaml (or ```yml) fenced block in the
+* given section text. Returns `undefined` if no yaml fence is present.
+*
+* The opening fence is recognized case-insensitively and may carry an
+* arbitrary trailing info string (e.g. ```yaml title=...). The closing
+* fence is any line whose first non-whitespace run is exactly three
+* backticks.
+*/
+function extractYamlFence(section) {
+	const lines = section.split(/\r?\n/);
+	let inside = false;
+	let collected;
+	for (const line of lines) {
+		if (!inside) {
+			if (/^\s*```\s*(yaml|yml)\b/i.test(line)) {
+				inside = true;
+				collected = [];
+			}
+			continue;
+		}
+		if (/^\s*```\s*$/.test(line)) return (collected ?? []).join("\n");
+		collected?.push(line);
+	}
+	return void 0;
+}
+/**
+* Parse the `## Runtime Probes` section of a story's markdown content.
+*
+* Outcomes:
+*   - section missing                                  → { kind: 'absent' }
+*   - section present, no yaml fence                   → { kind: 'invalid' }
+*   - section present, yaml fence malformed            → { kind: 'invalid' }
+*   - section present, yaml root is not a list         → { kind: 'invalid' }
+*   - section present, entry fails RuntimeProbeSchema  → { kind: 'invalid' }
+*   - section present, yaml valid, all entries valid   → { kind: 'parsed' }
+*
+* Duplicate names within a single story are surfaced as `invalid` so that
+* finding messages can unambiguously reference a probe by name.
+*/
+function parseRuntimeProbes(storyContent) {
+	const section = extractRuntimeProbesSection(storyContent);
+	if (section === void 0) return { kind: "absent" };
+	const yamlBody = extractYamlFence(section);
+	if (yamlBody === void 0) return {
+		kind: "invalid",
+		error: "## Runtime Probes section is present but contains no terminated ```yaml fenced block"
+	};
+	let parsed;
+	try {
+		parsed = load(yamlBody) ?? [];
+	} catch (err) {
+		const detail = err instanceof YAMLException ? err.message : String(err);
+		return {
+			kind: "invalid",
+			error: `YAML parse error: ${detail}`
+		};
+	}
+	if (!Array.isArray(parsed)) return {
+		kind: "invalid",
+		error: `probe block root must be a YAML list; got ${typeof parsed}`
+	};
+	const validation = RuntimeProbeListSchema.safeParse(parsed);
+	if (!validation.success) {
+		const first = validation.error.issues[0];
+		const path$1 = first?.path.join(".") ?? "";
+		const message = first?.message ?? "schema validation failed";
+		return {
+			kind: "invalid",
+			error: `probe list is malformed at ${path$1 || "<root>"}: ${message}`
+		};
+	}
+	const probes = validation.data;
+	const seen = new Set();
+	for (const probe of probes) {
+		if (seen.has(probe.name)) return {
+			kind: "invalid",
+			error: `duplicate probe name: ${probe.name}`
+		};
+		seen.add(probe.name);
+	}
+	return {
+		kind: "parsed",
+		probes
+	};
+}
+
+//#endregion
+//#region packages/sdlc/dist/verification/probes/executor.js
+/** Return the last N bytes of a UTF-8 string (sliced by length for simplicity). */
+function tail(text, bytes = PROBE_TAIL_BYTES) {
+	return text.length <= bytes ? text : text.slice(text.length - bytes);
+}
+/**
+* Execute one probe on the host and return a structured ProbeResult.
+*
+* Behavior notes:
+*   - The shell used is `/bin/sh -c '<probe.command>'` inside a detached
+*     process group (so the entire tree is killed on timeout).
+*   - stdout and stderr are captured independently; each is returned
+*     tailed to PROBE_TAIL_BYTES (≤ 4 KiB) so published tarballs of the
+*     run manifest stay small.
+*   - Timeout defaults to `probe.timeout_ms ?? DEFAULT_PROBE_TIMEOUT_MS`
+*     (60 s). When the timeout fires, the process group is SIGKILL'd and
+*     the returned result has `outcome: 'timeout'`, `exitCode` undefined.
+*   - Never throws. Spawn errors (e.g. exec format error) are returned as
+*     `outcome: 'fail'` with exitCode -1 and the error message captured on
+*     stderrTail, so the caller can emit a deterministic finding.
+*/
+function executeProbeOnHost(probe, options = {}) {
+	const timeoutMs = probe.timeout_ms ?? DEFAULT_PROBE_TIMEOUT_MS;
+	const cwd = options.cwd ?? process.cwd();
+	const env = options.env ?? process.env;
+	const start = Date.now();
+	return new Promise((resolve$2) => {
+		let stdout = "";
+		let stderr = "";
+		let settled = false;
+		const child = spawn(probe.command, [], {
+			cwd,
+			env,
+			detached: true,
+			shell: true,
+			stdio: [
+				"ignore",
+				"pipe",
+				"pipe"
+			]
+		});
+		const finalize = (result) => {
+			if (settled) return;
+			settled = true;
+			resolve$2(result);
+		};
+		child.on("error", (err) => {
+			finalize({
+				outcome: "fail",
+				command: probe.command,
+				exitCode: -1,
+				stdoutTail: tail(stdout),
+				stderrTail: tail(stderr + (stderr.length > 0 && !stderr.endsWith("\n") ? "\n" : "") + `spawn error: ${err.message}\n`),
+				durationMs: Date.now() - start
+			});
+		});
+		child.stdout?.on("data", (chunk) => {
+			stdout += chunk.toString();
+		});
+		child.stderr?.on("data", (chunk) => {
+			stderr += chunk.toString();
+		});
+		const timeoutHandle = setTimeout(() => {
+			try {
+				if (child.pid !== void 0) process.kill(-child.pid, "SIGKILL");
+			} catch {}
+			finalize({
+				outcome: "timeout",
+				command: probe.command,
+				stdoutTail: tail(stdout),
+				stderrTail: tail(stderr),
+				durationMs: Date.now() - start
+			});
+		}, timeoutMs);
+		child.on("close", (code) => {
+			clearTimeout(timeoutHandle);
+			const duration = Date.now() - start;
+			finalize({
+				outcome: code === 0 ? "pass" : "fail",
+				command: probe.command,
+				...code !== null ? { exitCode: code } : {},
+				stdoutTail: tail(stdout),
+				stderrTail: tail(stderr),
+				durationMs: duration
+			});
+		});
+	});
+}
+
+//#endregion
+//#region packages/sdlc/dist/verification/checks/runtime-probe-check.js
+const CATEGORY_PARSE = "runtime-probe-parse-error";
+const CATEGORY_SKIP = "runtime-probe-skip";
+const CATEGORY_DEFERRED = "runtime-probe-deferred";
+const CATEGORY_FAIL = "runtime-probe-fail";
+const CATEGORY_TIMEOUT = "runtime-probe-timeout";
+const defaultExecutors = { host: (probe) => executeProbeOnHost(probe, { cwd: process.cwd() }) };
+var RuntimeProbeCheck = class {
+	name = "runtime-probes";
+	tier = "A";
+	_executors;
+	constructor(executors) {
+		this._executors = {
+			...defaultExecutors,
+			...executors ?? {}
+		};
+	}
+	async run(context) {
+		const start = Date.now();
+		if (context.storyContent === void 0) {
+			const findings$1 = [{
+				category: CATEGORY_SKIP,
+				severity: "warn",
+				message: "story content unavailable — skipping runtime probe check"
+			}];
+			return {
+				status: "warn",
+				details: renderFindings(findings$1),
+				duration_ms: Date.now() - start,
+				findings: findings$1
+			};
+		}
+		const parsed = parseRuntimeProbes(context.storyContent);
+		if (parsed.kind === "absent") return {
+			status: "pass",
+			details: "runtime-probes: no ## Runtime Probes section declared — skipping",
+			duration_ms: Date.now() - start,
+			findings: []
+		};
+		if (parsed.kind === "invalid") {
+			const findings$1 = [{
+				category: CATEGORY_PARSE,
+				severity: "error",
+				message: parsed.error
+			}];
+			return {
+				status: "fail",
+				details: renderFindings(findings$1),
+				duration_ms: Date.now() - start,
+				findings: findings$1
+			};
+		}
+		if (parsed.probes.length === 0) return {
+			status: "pass",
+			details: "runtime-probes: 0 probes declared — skipping",
+			duration_ms: Date.now() - start,
+			findings: []
+		};
+		const findings = [];
+		for (const probe of parsed.probes) {
+			if (probe.sandbox === "twin") {
+				findings.push({
+					category: CATEGORY_DEFERRED,
+					severity: "warn",
+					message: `probe "${probe.name}" uses sandbox=twin which is deferred until Phase 3 (Digital Twin integration); skipping`
+				});
+				continue;
+			}
+			const result = await this._executors.host(probe);
+			if (result.outcome === "pass") continue;
+			const category = result.outcome === "timeout" ? CATEGORY_TIMEOUT : CATEGORY_FAIL;
+			const descriptor = probe.description ? ` (${probe.description})` : "";
+			const message = result.outcome === "timeout" ? `probe "${probe.name}"${descriptor} timed out after ${result.durationMs}ms` : `probe "${probe.name}"${descriptor} failed with exit ${result.exitCode ?? "unknown"}`;
+			findings.push({
+				category,
+				severity: "error",
+				message,
+				command: result.command,
+				...result.exitCode !== void 0 ? { exitCode: result.exitCode } : {},
+				stdoutTail: result.stdoutTail,
+				stderrTail: result.stderrTail,
+				durationMs: result.durationMs
+			});
+		}
+		const status = findings.some((f) => f.severity === "error") ? "fail" : findings.some((f) => f.severity === "warn") ? "warn" : "pass";
+		return {
+			status,
+			details: findings.length > 0 ? renderFindings(findings) : `runtime-probes: ${parsed.probes.length} probe(s) passed`,
+			duration_ms: Date.now() - start,
+			findings
+		};
+	}
+};
+
 //#endregion
 //#region packages/sdlc/dist/verification/verification-pipeline.js
 /**
@@ -3460,7 +3797,8 @@ var VerificationPipeline = class {
 					checkName: check.name,
 					status: runResult.status,
 					details: runResult.details,
-					duration_ms: runResult.duration_ms
+					duration_ms: runResult.duration_ms,
+					...runResult.findings !== void 0 ? { findings: runResult.findings } : {}
 				};
 			} catch (err) {
 				const elapsed = Date.now() - checkStart;
@@ -3470,7 +3808,12 @@ var VerificationPipeline = class {
 					checkName: check.name,
 					status: "warn",
 					details: message,
-					duration_ms: elapsed
+					duration_ms: elapsed,
+					findings: [{
+						category: "check-exception",
+						severity: "warn",
+						message
+					}]
 				};
 			}
 			checkResults.push(result);
@@ -3495,11 +3838,13 @@ var VerificationPipeline = class {
 /**
 * Create a VerificationPipeline pre-loaded with the canonical check set.
 *
-* Canonical Tier A check order (architecture section 3.5):
+* Canonical Tier A check order:
 *   1. PhantomReviewCheck — story 51-2  (runs first: unreviewed stories skipped)
 *   2. TrivialOutputCheck — story 51-3
 *   3. AcceptanceCriteriaEvidenceCheck
 *   4. BuildCheck         — story 51-4
+*   5. RuntimeProbeCheck  — Epic 55 Phase 2: runtime behavior gate; runs last
+*                           in Tier A because probes may depend on built artifacts
 *
 * @param bus    Typed event bus for verification events.
 * @param config Optional config (used to forward threshold to TrivialOutputCheck).
@@ -3509,7 +3854,8 @@ function createDefaultVerificationPipeline(bus, config) {
 		new PhantomReviewCheck(),
 		new TrivialOutputCheck(config),
 		new AcceptanceCriteriaEvidenceCheck(),
-		new BuildCheck()
+		new BuildCheck(),
+		new RuntimeProbeCheck()
 	];
 	return new VerificationPipeline(bus, checks);
 }
@@ -4140,6 +4486,61 @@ var RunManifest = class RunManifest {
 	}
 };
 
+//#endregion
+//#region packages/sdlc/dist/run-model/verification-findings-counts.js
+/**
+* Verification finding count roll-up — Story 55-3b.
+*
+* Collapses every finding across every check in a StoredVerificationSummary
+* into a `{error, warn, info}` triple, suitable for per-story surfacing in
+* the status/metrics CLI JSON payloads.
+*
+* Intentionally pure: no I/O, no logger, no throw. Fits cleanly in the
+* run-model package so both the status and metrics commands (and any
+* future consumer) can share a single implementation and one set of tests.
+*/
+/** Zero-counts object used as the default return value and as the identity
+*  element in consumer-side accumulations. */
+const ZERO_FINDING_COUNTS = Object.freeze({
+	error: 0,
+	warn: 0,
+	info: 0
+});
+/**
+* Sum findings across every check in the summary, grouped by severity.
+*
+* Backward-compatible — when the summary is `undefined`, or a check has no
+* `findings` field (legacy manifests written before Story 55-2 migrated the
+* checks), the absent arrays contribute 0 to every severity. No severity
+* ever reports undefined.
+*/
+function rollupFindingCounts(summary) {
+	if (summary === void 0 || summary === null) return { ...ZERO_FINDING_COUNTS };
+	let error = 0;
+	let warn = 0;
+	let info = 0;
+	for (const check of summary.checks) {
+		const findings = check.findings;
+		if (findings === void 0) continue;
+		for (const finding of findings) switch (finding.severity) {
+			case "error":
+				error += 1;
+				break;
+			case "warn":
+				warn += 1;
+				break;
+			case "info":
+				info += 1;
+				break;
+		}
+	}
+	return {
+		error,
+		warn,
+		info
+	};
+}
+
 //#endregion
 //#region packages/sdlc/dist/run-model/supervisor-lock.js
 const defaultLogger = console;
@@ -4884,5 +5285,5 @@ function registerHealthCommand(program, _version = "0.0.0", projectRoot = proces
 }
 
 //#endregion
-export { BMAD_BASELINE_TOKENS_FULL, DEFAULT_STALL_THRESHOLD_SECONDS, DoltMergeConflict, FileStateStore, FindingsInjector, RunManifest, STOP_AFTER_VALID_PHASES, STORY_KEY_PATTERN$1 as STORY_KEY_PATTERN, SUBSTRATE_OWNED_SETTINGS_KEYS, SupervisorLock, VALID_PHASES, WorkGraphRepository, __commonJS, __require, __toESM, applyConfigToGraph, buildPipelineStatusOutput, createDatabaseAdapter$1 as createDatabaseAdapter, createDefaultVerificationPipeline, createGraphOrchestrator, createSdlcCodeReviewHandler, createSdlcCreateStoryHandler, createSdlcDevStoryHandler, createSdlcPhaseHandler, createStateStore, detectCycles, extractTargetFilesFromStoryContent, findPackageRoot, formatOutput, formatPipelineStatusHuman, formatPipelineSummary, formatTokenTelemetry, getAllDescendantPids, getAutoHealthData, getSubstrateDefaultSettings, inspectProcessTree, isOrchestratorProcessLine, parseDbTimestampAsUtc, registerHealthCommand, renderFindings, resolveBmadMethodSrcPath, resolveBmadMethodVersion, resolveGraphPath, resolveMainRepoRoot, resolveRunManifest, runHealthAction, validateStoryKey };
-//# sourceMappingURL=health-CB48LF0t.js.map
+export { BMAD_BASELINE_TOKENS_FULL, DEFAULT_STALL_THRESHOLD_SECONDS, DoltMergeConflict, FileStateStore, FindingsInjector, RunManifest, STOP_AFTER_VALID_PHASES, STORY_KEY_PATTERN$1 as STORY_KEY_PATTERN, SUBSTRATE_OWNED_SETTINGS_KEYS, SupervisorLock, VALID_PHASES, WorkGraphRepository, ZERO_FINDING_COUNTS, __commonJS, __require, __toESM, applyConfigToGraph, buildPipelineStatusOutput, createDatabaseAdapter$1 as createDatabaseAdapter, createDefaultVerificationPipeline, createGraphOrchestrator, createSdlcCodeReviewHandler, createSdlcCreateStoryHandler, createSdlcDevStoryHandler, createSdlcPhaseHandler, createStateStore, detectCycles, extractTargetFilesFromStoryContent, findPackageRoot, formatOutput, formatPipelineStatusHuman, formatPipelineSummary, formatTokenTelemetry, getAllDescendantPids, getAutoHealthData, getSubstrateDefaultSettings, inspectProcessTree, isOrchestratorProcessLine, parseDbTimestampAsUtc, registerHealthCommand, renderFindings, resolveBmadMethodSrcPath, resolveBmadMethodVersion, resolveGraphPath, resolveMainRepoRoot, resolveRunManifest, rollupFindingCounts, runHealthAction, validateStoryKey };
+//# sourceMappingURL=health-BIS34IYK.js.map

package/dist/{run-BHKqyFFM.js → run-BAc1zfMQ.js}

@@ -1,4 +1,4 @@
-import { BMAD_BASELINE_TOKENS_FULL, DoltMergeConflict, FileStateStore, FindingsInjector, RunManifest, STOP_AFTER_VALID_PHASES, STORY_KEY_PATTERN, VALID_PHASES, WorkGraphRepository, __commonJS, __require, __toESM, applyConfigToGraph, buildPipelineStatusOutput, createDatabaseAdapter, createDefaultVerificationPipeline, createGraphOrchestrator, createSdlcCodeReviewHandler, createSdlcCreateStoryHandler, createSdlcDevStoryHandler, createSdlcPhaseHandler, detectCycles, extractTargetFilesFromStoryContent, formatOutput, formatPipelineSummary, formatTokenTelemetry, inspectProcessTree, parseDbTimestampAsUtc, renderFindings, resolveGraphPath, resolveMainRepoRoot, validateStoryKey } from "./health-CB48LF0t.js";
+import { BMAD_BASELINE_TOKENS_FULL, DoltMergeConflict, FileStateStore, FindingsInjector, RunManifest, STOP_AFTER_VALID_PHASES, STORY_KEY_PATTERN, VALID_PHASES, WorkGraphRepository, __commonJS, __require, __toESM, applyConfigToGraph, buildPipelineStatusOutput, createDatabaseAdapter, createDefaultVerificationPipeline, createGraphOrchestrator, createSdlcCodeReviewHandler, createSdlcCreateStoryHandler, createSdlcDevStoryHandler, createSdlcPhaseHandler, detectCycles, extractTargetFilesFromStoryContent, formatOutput, formatPipelineSummary, formatTokenTelemetry, inspectProcessTree, parseDbTimestampAsUtc, renderFindings, resolveGraphPath, resolveMainRepoRoot, validateStoryKey } from "./health-BIS34IYK.js";
 import { createLogger } from "./logger-KeHncl-f.js";
 import { TypedEventBusImpl, createEventBus, createTuiApp, isTuiCapable, printNonTtyWarning, sleep } from "./helpers-CElYrONe.js";
 import { ADVISORY_NOTES, Categorizer, ConsumerAnalyzer, DEFAULT_GLOBAL_SETTINGS, DispatcherImpl, DoltClient, ESCALATION_DIAGNOSIS, EXPERIMENT_RESULT, EfficiencyScorer, IngestionServer, LogTurnAnalyzer, OPERATIONAL_FINDING, Recommender, RoutingRecommender, RoutingResolver, RoutingTelemetry, RoutingTokenAccumulator, RoutingTuner, STORY_METRICS, STORY_OUTCOME, SubstrateConfigSchema, TEST_EXPANSION_FINDING, TEST_PLAN, TelemetryNormalizer, TelemetryPipeline, TurnAnalyzer, addTokenUsage, aggregateTokenUsageForRun, aggregateTokenUsageForStory, callLLM, createConfigSystem, createDatabaseAdapter$1, createDecision, createPipelineRun, createRequirement, detectInterfaceChanges, getArtifactByTypeForRun, getArtifactsByRun, getDecisionsByCategory, getDecisionsByPhase, getDecisionsByPhaseForRun, getLatestRun, getPipelineRunById, getRunMetrics, getRunningPipelineRuns, getStoryMetricsForRun, getTokenUsageSummary, initSchema, listRequirements, loadModelRoutingConfig, registerArtifact, updatePipelineRun, updatePipelineRunConfig, upsertDecision, writeRunMetrics, writeStoryMetrics } from "./dist-srr3BfCc.js";
@@ -43840,4 +43840,4 @@ function registerRunCommand(program, _version = "0.0.0", projectRoot = process.c
 
 //#endregion
 export { AdapterTelemetryPersistence, AppError, DoltRepoMapMetaRepository, DoltSymbolRepository, ERR_REPO_MAP_STORAGE_WRITE, EpicIngester, GitClient, GrammarLoader, RepoMapInjector, RepoMapModule, RepoMapQueryEngine, RepoMapStorage, SymbolParser, createContextCompiler, createDispatcher, createEventEmitter, createImplementationOrchestrator, createPackLoader, createPhaseOrchestrator, createStopAfterGate, createTelemetryAdvisor, formatPhaseCompletionSummary, getFactoryRunSummaries, getScenarioResultsForRun, getTwinRunsForRun, listGraphRuns, normalizeGraphSummaryToStatus, registerExportCommand, registerFactoryCommand, registerRunCommand, registerScenariosCommand, resolveMaxReviewCycles, resolveStoryKeys, runAnalysisPhase, runPlanningPhase, runRunAction, runSolutioningPhase, validateStopAfterFromConflict, wireNdjsonEmitter };
-//# sourceMappingURL=run-BHKqyFFM.js.map
+//# sourceMappingURL=run-BAc1zfMQ.js.map

package/dist/{run-l5fLWKtI.js → run-Dif8PJRd.js}

@@ -1,8 +1,8 @@
-import "./health-CB48LF0t.js";
+import "./health-BIS34IYK.js";
 import "./logger-KeHncl-f.js";
 import "./helpers-CElYrONe.js";
 import "./dist-srr3BfCc.js";
-import { normalizeGraphSummaryToStatus, registerRunCommand, resolveMaxReviewCycles, runRunAction, wireNdjsonEmitter } from "./run-BHKqyFFM.js";
+import { normalizeGraphSummaryToStatus, registerRunCommand, resolveMaxReviewCycles, runRunAction, wireNdjsonEmitter } from "./run-BAc1zfMQ.js";
 import "./routing-CcBOCuC9.js";
 import "./decisions-C0pz9Clx.js";
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "substrate-ai",
-  "version": "0.20.4",
+  "version": "0.20.6",
   "description": "Substrate — multi-agent orchestration daemon for AI coding agents",
   "type": "module",
   "license": "MIT",