Require acceptance evidence before workflow closeout

CHANGELOG.md

@@ -4,9 +4,11 @@ summary: Chronological history of repository and skill changes.
 
 # Changelog
 
-## 2026-07-27 — Populated the correctness stratum, and recovered carved suffixes
+## 2026-07-27 — Enforced acceptance-gated closeout, populated the correctness stratum, and recovered carved suffixes
 
+- feat: require acceptance evidence for workflow closeout
 - fix: make every packet diff a valid patch, and gate the adjudication record
+  (`c4e01d3c6fc94f1bd174d1ad5bd2374511c85471`)
 - fix: stop a grader formulation being quotable from its own packet
   (`fa772a7d770bd3d07f3fdd9bdc45a0c237b1d14e`)
 - docs: record the batch-2 delivery, the clean-control standard, and its limits

README.md

@@ -136,6 +136,7 @@ just test-babysit-pr
 just test-implement-ticket
 just test-implement-epic
 just eval-implement-ticket
+just eval-implement-epic
 ```
 
 Validate a review packet and result together:
@@ -149,6 +150,7 @@ Run deterministic local evaluation harnesses without an agent runtime:
 ```bash
 just eval-carve-changesets
 just eval-implement-ticket
+just eval-implement-epic
 ```
 
 The carve-changesets command first runs its objective integration self-test,
@@ -163,14 +165,16 @@ just eval-carve-changesets-executor "python3 /path/to/adapter.py"
 ```
 
 The ticket-composition evaluator starts a fresh process for each case, with
-fixture identity and grader expectations withheld. Case artifacts carry
-pre-classified scenario flags (for example, a CI failure already labeled
-branch-caused or infrastructure), so the harness grades obligation mapping and
-terminal-state selection — not evidence classification itself. Its bundled
-reference executor is a deterministic simulation of a compliant runtime, not a
-model. To forward-evaluate a real agent runtime, pass its stdin/stdout JSON
-adapter through `scripts/evals/run_forward.py --executor` and retain captured
-observations with `--output-dir`. A Claude Code headless adapter is bundled:
+fixture identity and grader expectations withheld. Its shared corpus targets
+both `implement-ticket` and `implement-epic`; `just eval-implement-epic` filters
+the same validated corpus to epic packets. Case artifacts carry raw, live-shaped
+workflow state, including criterion-specific acceptance evidence bound to the
+candidate or deployed SHA. The harness grades obligation mapping and
+terminal-state selection. Its bundled reference executor is a deterministic
+simulation of a compliant runtime, not a model. To forward-evaluate a real agent
+runtime, pass its stdin/stdout JSON adapter through
+`scripts/evals/run_forward.py --executor` and retain captured observations with
+`--output-dir`. A Claude Code headless adapter is bundled:
 
 ```bash
 just eval-implement-ticket-claude

justfile

@@ -71,6 +71,10 @@ test-implement-ticket:
 eval-implement-ticket:
   python3 {{skills_dir}}/implement-ticket/scripts/evals/run_forward.py
 
+# Run only implement-epic packets from the shared result-blind corpus.
+eval-implement-epic:
+  python3 {{skills_dir}}/implement-ticket/scripts/evals/run_forward.py \
+    --target-skill implement-epic
 # Real-runtime forward evaluation; requires the `claude` CLI on PATH.
 eval-implement-ticket-claude:
   python3 {{skills_dir}}/implement-ticket/scripts/evals/run_forward.py \

skills/implement-epic/SKILL.md

@@ -75,20 +75,23 @@ Before selecting work, discover or receive and verify:
 - named architecture, design, contract, migration, and rollout documents;
 - completion policy: ready PRs only, merge children after gates, or merge plus
   separately authorized epic closeout;
+- each child and parent acceptance criterion, required verification item,
+  pre/post-merge stage, and criterion-specific evidence ledger;
 - serial execution by default, with parallel execution only when explicitly
   authorized and proven non-overlapping; and
-- authority for child execution, merge, manual transitions, graph edits,
-  follow-up creation, decomposition of an oversized coherent candidate into a
-  stacked chain, branch deletion, parent closeout, deployment, production
-  mutation, and destructive operations.
+- authority for child execution, merge, post-merge verification, manual
+  transitions, graph edits, follow-up creation, decomposition of an oversized
+  coherent candidate into a stacked chain, branch deletion, parent closeout,
+  deployment, production mutation, and destructive operations.
 
 Pass authority into `implement-ticket` without expansion. The
 `decompose oversized candidates into stacked changesets` grant is off by default
 and must be passed through verbatim; this skill gains no decomposition
 mechanics. Ready-PR authority does not imply merge. Child merge authority does
-not imply parent closeout. Words such as `finish`, `complete`, or `end to end`
-do not independently grant decomposition, merge, graph mutation, deployment, or
-closeout authority.
+not imply deployment, post-merge verification, child tracker transition, or
+parent closeout. Words such as `finish`, `complete`, or `end to end` do not
+independently grant decomposition, merge, graph mutation, deployment,
+verification, or closeout authority.
 
 Use this source order:
 
@@ -108,9 +111,10 @@ blocker requires user input.
 
 ### 1. Refresh live state
 
-- Read every in-scope epic and its current children.
+- Read every in-scope epic and its current children, including closed children.
 - Read native parent, sub-issue, `blockedBy`, and `blocking` relationships.
-- Read dispositions and delivered outcomes of closed blockers.
+- Read dispositions, delivered outcomes, and criterion-specific acceptance
+  ledgers for every required child and closed blocker.
 - Inspect existing branches and open or merged PRs before selecting a child.
 - Separate the serial critical-path recommendation from other parallel-ready
   work.
@@ -120,8 +124,13 @@ list, label, or previous loop iteration when native relationships are available.
 
 ### 2. Select one child
 
-Select an open, in-scope, PR-sized child only when native graph state shows no
-open blocker. At the graph boundary, verify that every required closed-blocker
+Select an in-scope, PR-sized child only when native graph state shows no open
+blocker and the child is either open or was auto-closed while required
+acceptance remains missing. Route that auto-closed child through
+`implement-ticket`, passing its closeout state and granted or withheld reopen
+authority so the ticket workflow can reopen it when authorized or report the
+authority blocker. Do not select an accepted, superseded, or otherwise terminal
+closed child. At the graph boundary, verify that every required closed-blocker
 outcome exists in its authoritative repository, artifact registry, tracker, or
 environment. Treat canceled or not-planned blockers with missing required
 outcomes as unresolved.
@@ -161,34 +170,42 @@ material overlap.
 
 Do not trust a reported result until ticket identity, repository, base,
 branch/worktree, candidate, PR, validation, review, remote-gate, merge,
-transition, and cleanup evidence are internally consistent and match live state.
+delivery, criterion-specific acceptance, transition, and cleanup evidence are
+internally consistent and match live state.
 
-- `ready_pr`: verify the candidate is open, mergeable, and at the complete
-  current-candidate non-merge gate with only merge withheld. Do not count the
-  child complete or unblock dependents that require merge. Continue only with
-  another independently ready child when the requested scope permits it.
+- `ready_pr`: verify the candidate is open, mergeable, at the complete
+  current-candidate non-merge gate, and has every required pre-merge acceptance
+  entry passing. Do not count the child complete or unblock dependents that
+  require merge or acceptance.
 - `ready_prs`: verify the reported PR count, ordered predecessor-base topology,
-  final-only closing syntax, per-PR candidate and non-merge gate evidence, and
-  whole-chain equivalence with the ticket candidate. Do not count the child
-  complete or unblock dependents that require merge.
-- `merged`: verify mainline and tracker evidence, then refresh the complete live
-  graph before any selection or completion claim. For a stacked child, also
-  verify `all_merged`, every PR merge and propagation step, and full-chain
+  correct closing/non-closing syntax, per-PR candidate and non-merge gate
+  evidence, passing required pre-merge entries, and whole-chain equivalence. Do
+  not count the child complete or unblock dependents that require merge or
+  acceptance.
+- `merged`: verify mainline, the child's complete current acceptance ledger, and
+  tracker evidence before refreshing the graph. For a stacked child, also verify
+  `all_merged`, every PR merge and propagation step, and full-chain
   representation on the base. Do not reproduce decomposition or propagation
   mechanics while verifying the result.
-- `blocked`: preserve the exact reason and partial artifacts. Never count it as
-  complete. Select another independently ready child only when the requested
-  scope permits; otherwise stop for the missing decision, outcome, or
-  capability.
+- `blocked`: preserve the exact reason and partial artifacts, including a merged
+  delivery whose post-merge acceptance is pending. Never count it as complete. A
+  verified merge, delivery, or tracker transition still requires a complete
+  graph refresh before any next selection; acceptance separately determines
+  which dependency edges are satisfied. Select another independently ready child
+  only when the refreshed graph and requested scope permit; otherwise stop for
+  the missing decision, outcome, evidence, authority, or capability.
 - `requires_epic`: treat it as an invalid child selection or malformed handoff.
   Stop or refresh and resolve scope; never recursively invoke this skill, bounce
   back to `implement-ticket`, or flatten the returned epic into the child.
 
 ### 5. Refresh or stop at the requested boundary
 
-After every verified merge or tracker transition, reread the native graph. Do
-not reuse an earlier ready set. Report newly unblocked work even when the
-requested boundary has been reached.
+After every verified merge, delivery, or tracker transition, reread the complete
+native graph regardless of the ticket terminal state. Then separately determine
+which edges are satisfied by delivery and which require complete acceptance. A
+merged delivery with pending acceptance remains incomplete, but its graph-state
+change must still inform the next ready set. Do not reuse an earlier ready set.
+Report newly unblocked work even when the requested boundary has been reached.
 
 For one named child, stop after that child's completion policy. For a named
 subset, process only that subset in dependency order. Do not implement unnamed
@@ -200,15 +217,31 @@ eligible or a genuine blocker remains.
 Follow [epic closeout](references/closeout.md). Close a parent only with
 explicit parent-close authority and current evidence that:
 
-- every required child and blocker outcome is satisfied;
-- every required PR result is represented on the base;
-- parent acceptance criteria hold against resulting behavior;
+- every required child's criterion-specific acceptance ledger is complete and
+  current, regardless of its native state;
+- every required blocker outcome is satisfied;
+- every required PR result is represented on the current remote base;
+- the parent's own acceptance ledger passes against resulting behavior;
+- current-main representation and the exact deployed SHA are verified whenever
+  deployment is required;
+- explicit visual-layout requirements have screenshot or
+  geometry/computed-layout evidence rather than functional browser evidence
+  alone;
 - required clean-main, documentation, migration, compatibility, rollout, and
   cleanup checks pass; and
 - the epic-wide late-feedback sweep has no undispositioned material finding.
 
-Validate and close each epic separately before an umbrella parent. A nearly
-complete graph is not complete.
+Validate and close each epic separately before an umbrella parent. "All
+implementation PRs merged" and "all native children closed" are delivery and
+administrative milestones, not epic acceptance.
+
+## Reclose escaped epics proportionally
+
+When an epic was reopened for an escaped acceptance defect, require a focused
+corrective child, a regression test at the escaped boundary, and renewed
+evidence for the full affected customer journey before reclosure. A merged
+corrective PR alone is insufficient. Revalidate only the affected journey and
+requirements; do not impose unrelated full-system testing.
 
 ## Stop conditions
 
@@ -219,15 +252,18 @@ Stop and report `blocked` when:
 - a product, architecture, migration, destructive, or authorization decision is
   unresolved;
 - delegated mutation ownership or returned evidence is ambiguous;
+- a child or parent has missing, failed, unavailable, stale, wrong-environment,
+  or category-mismatched required acceptance evidence;
 - epic-wide validation or late feedback shows a required unresolved gap; or
 - parent closeout lacks authority.
 
 Difficulty, ordinary CI wait time, or unrelated ready children are not blockers.
 
 ## Report the epic result
 
-Report the requested scope, each invoked ticket and its terminal state, merged
-and ready PRs or stacks, refreshed graph state, serial critical-path and
-parallel-ready work, parent acceptance and closeout evidence, intentionally
-deferred work, and one concrete next action. Never report a child or parent
-complete from stale or unverified evidence.
+Report the requested scope, each invoked ticket and its delivery, acceptance,
+and terminal state, merged and ready PRs or stacks, refreshed graph state,
+serial critical-path and parallel-ready work, child and parent acceptance
+ledgers, closeout evidence, intentionally deferred work, and one concrete next
+action. Never report a child or parent complete from tracker state, stale
+verification, or delivery evidence alone.

skills/implement-epic/evals/cases.json

@@ -57,7 +57,7 @@
     "id": "authorized-full-epic-closeout",
     "request": "Implement and close epic G-190.",
     "authority": "child merge and parent closeout explicitly granted",
-    "closeout": "All children merged and closed; graph, base representation, acceptance, clean-main, rollout, and late-feedback gates pass."
+    "closeout": "Every child and parent criterion ledger passes, every required PR is represented on current main, exact deployed SHA evidence is current, clean-main and late-feedback gates pass."
   },
   {
     "id": "umbrella-closeout-separately",
@@ -113,5 +113,17 @@
     "request": "Continue epic G-280 after authorized child G-281 returns a three-PR carved result.",
     "graph": "G-282 is blocked until G-281 is fully merged.",
     "ticket_results": ["G-281 reports all_merged with three ordered PRs, per-PR gate evidence, propagation evidence, and full-chain representation on main"]
+  },
+  {
+    "id": "closed-children-missing-manual-browser",
+    "request": "Close epic G-290 after every child PR merged and every child ticket closed.",
+    "graph": "Every required child is administratively closed and represented on main.",
+    "closeout": "A required child acceptance ledger has missing authenticated manual-browser evidence for the exact deployment."
+  },
+  {
+    "id": "reopened-correction-missing-journey-revalidation",
+    "request": "Reclose escaped epic G-300 after corrective child G-301 merged.",
+    "graph": "G-301 is merged and closed with a focused regression test.",
+    "closeout": "The escaped boundary regression passes, but the full affected customer journey has not been revalidated."
   }
 ]

skills/implement-epic/evals/expectations.json

@@ -47,7 +47,7 @@
   {
     "case_id": "authorized-full-epic-closeout",
     "workflow_state": "epic_closed",
-    "required_actions": ["verify every closeout gate", "close G-190", "report final graph and evidence"]
+    "required_actions": ["verify every child and parent acceptance ledger", "verify current-main and exact deployment identities", "close G-190", "report final graph and evidence"]
   },
   {
     "case_id": "umbrella-closeout-separately",
@@ -93,5 +93,15 @@
     "case_id": "verify-stacked-child-result",
     "workflow_state": "stack_child_verified",
     "required_actions": ["verify stack topology and every PR gate", "verify all_merged and full-chain representation on base", "do not invoke carve-changesets directly", "refresh graph before considering G-282"]
+  },
+  {
+    "case_id": "closed-children-missing-manual-browser",
+    "workflow_state": "closeout_blocked",
+    "required_actions": ["read the closed child ledger", "record manual browser evidence as missing", "keep G-290 open", "report delivery separately from acceptance"]
+  },
+  {
+    "case_id": "reopened-correction-missing-journey-revalidation",
+    "workflow_state": "closeout_blocked",
+    "required_actions": ["preserve the corrective child result", "require full affected journey revalidation", "keep G-300 open", "do not impose unrelated full-system testing"]
   }
 ]