Imported from FarhanRiuzaki/Mega-SDD (plugins/mega-sdd/skills/execute-bolts/SKILL.md). Install upstream with npx skills add FarhanRiuzaki/Mega-SDD --skill execute-bolts. Copyright stays with the author.

Execute-Bolts

The terminal phase of the SDD pipeline — turns units into code. It is also an anti-hallucination gate: every unit's ## Hard rules are validated against the real codebase before and after the bolt. Commit topology (one truth): the bolt-implementer subagent commits after its tests pass; the controller's L0 gates, review panel, and post-flight Hard-rule scan run after that commit (detect-after). A violation therefore never claims the code is "uncommitted" — it records the failure (postflight.json / halt YAML), blocks further bolts via the PreToolUse gates, and the remediation is fix-forward or revert of the flagged commit.

Announce at start: "I'm using the execute-bolts skill to implement units via the mega-sdd bolt agents (parallel review panel). mega-sdd-trace:execute-bolts"

Instruction language: this skill reasons in English. Code, commit messages, and provenance trailers are emitted verbatim against the codebase.

When to use

• After generate-units wrote <vault>/units/U-*.md.
• User explicit: execute-bolts <unit-id> or --all.
• orchestrate-flow auto-routes here once units are ready.

Inputs

• Unit path OR unit ID OR --all (positional).
• Flags:
  • --parallel — the main-thread controller dispatches independent units concurrently, each still running the review panel; wave width is capped at config.yaml parallel_max: (default 4) (v7.1 — CC's 20-subagent default × an ~80-turn implementer is a token/fleet hazard). On --all this is the DEFAULT (spec 2026-08-29 Fase 2 — a 30-unit vault whose DAG is 10 deep costs 30 bolt-times sequentially and 10 wave-times in sprints; measured parallelism_speedup: 3.0); the flag DEFAULT stays off for standalone non---all invocations, where it is what forces waves on a multi-unit filter. The Overlap rail (intersecting target_files serialize), depth-1 discipline, wave-plan consumption, and per-unit gate ranges are owned by references/batch-and-fanout.md §--all — load it before any parallel dispatch.
  • --sequential — opt OUT of wave execution on --all: one unit at a time in topological order. Use when the project's test suite is not concurrency-safe (shared test DB / fixtures / caches) and --worktree is not an option. Mutually exclusive with --parallel; passing both is a usage error.
  • --sprint=<n> — execute ONE sprint (one topological wave, 1-indexed) and stop. Prerequisite: every unit in sprints 1..n-1 is complete; otherwise halt sprint_blocked_by. The sprint numbering is analyze-parallelism.sh --format=json waves[] — never hand-numbered.
  • --sprint-checkpoint — hold at every sprint boundary for human review instead of rolling into the next wave. Prints the sprint summary (units landed, advisory findings, gate results, elapsed) and waits. Off by default. Under --auto (non-interactive by contract) it does NOT wait — it emits the sprint summary into the handoff YAML at each boundary (sprints[]) and continues; a checkpoint that silently evaporates would be worse than none.
  • --worktree — isolate each bolt in a git worktree.
  • --max-retries=N — default 3.
  • --dry-run — walk steps, do not commit.
  • --rebind=@<paths-file> (v8 P3, 8.0 — lane lite / layout-3 only) — re-verdict, without dispatching anything, every unit whose target_files ∪ ## Anchors ∪ per-unit binding anchors intersect the listed changed paths: Run bash <plugin-root>/scripts/rebind-units.sh --cwd=<root> --vault=<vault> --paths=@<file> (exit 0 = nothing affected · 4 = re-bound, read gate · 2/3 = fail-closed → --units=all). It is the sync/delta lane's re-bind hop on this layout (the state engine renders it; bind-codebase --paths=@… FATALs bind_folded_into_bolts here); the CONFLICT gate it writes is the same .validation-blockers.json every dispatch meets.
  • --force — re-execute completed units / proceed on a dirty tree.
  • --auto — non-interactive (emit handoff YAML).
  • --per-squad — fan out across all squads in _meta/squads.yaml (main-thread loop, depth-1, NO squad subagent) — procedure in references/batch-and-fanout.md + references/squad-subagent.md.
  • --review-panel=minimal|standard|full|auto — force the review-panel tier; default auto (risk-based selection per references/review-panel.md). Forcing minimal on a unit with risk signals logs a warning in the bolt-report — never silent.
  • --model-tier=inherit|auto|haiku|sonnet|opus — v7.1 per-unit implementer model. Override chain: this flag > config.yaml model_tiers.bolt_implementer: > the config DEFAULT inherit. inherit = today's behavior (session model; NO model param passed on the Agent call). auto = the router's implementer_model from the SAME resolve-review-tier.sh JSON the panel tier uses (spec docs/superpowers/specs/2026-08-22-per-unit-model-routing-design.md); a hard value pins every unit. Whatever the source, the decision is recorded in the bolt-report (model_used + signals_fired).
  • --no-escalate — disable the v7.1 cascade (see Step 2 model routing). Escalation is otherwise ON whenever routing is active (auto or a hard pin below opus).
  • --no-code-gates — skip the L0 toolchain + SAST gates for this run (forwarded verbatim to scripts/run-code-gates.sh; logged in the bolt-report). The secret scan and new-dep existence check ALWAYS run — no flag disables them (per references/code-gates.md).
  • --no-full-suite — DISCOURAGED escape hatch that skips the batch-completion full-suite gate for THIS run (broken/absent project test command only). Logged in _summary.md + handoff notes.full_suite_skipped: true; the PreToolUse gate still blocks the next run until a green _batch-suite.json covers the newest code commit — never silent.
  • --squad=<id> — filter units to one squad (human-team handoff). Halts on cross_squad_interface_draft if a consumed interface is still draft.
  • --module=<id> — filter units to one module (per generate-units/references/modules-schema.md); topo-sort within module. Halts on module_blocked_by if a prerequisite module is incomplete.
  • --hard-rule-grammar=v1|v2 — force the Hard-rule grammar; default auto (detect from YAML presence under ## Hard rules).
  • --no-pbt — skip Property-Based Testing validation (example-test-only behaviour).
  • --no-empty-commits — skip the bolt-report-only commit for task_type: verify units with no changes (per the verify-unit special path).
  • --no-drift-check — opt out of the end-of-chain detect-drift auto-gate (per references/halts-and-handoff.md / ../orchestrate-flow/references/chain-execution.md).
  • --resume — resume a partially-completed bolt from <vault>/bolts/U-XXX/partial-state.json (forward-only from current_step).
  • --rollback <unit-id-or-vault-path> — saga compensating actions: replay rollback_hints[] in reverse to undo a crashed bolt.
• Unit selection (living-vault lifecycle): units with status: superseded are SKIPPED with a one-line warning (claim no longer exists); units with status: stale are ELIGIBLE for re-execution (treated as not-yet-completed — the sync lane's "stale/new units only" semantics). Absent status = legacy behavior unchanged.
  • --force-skip-postflight — DISCOURAGED escape hatch that skips the ast-grep Hard Rule postflight validation for THIS run only. Use only when the ast-grep binary is broken or a known false-positive pattern blocks otherwise-valid work; document the reason in the bolt-report self-assessment. It does NOT downgrade the rail — BLOCKING remains BLOCKING per the plugin's "no bypassing anti-hallucination" rule. Any use is logged in the handoff YAML notes.postflight_skipped: true and surfaces in <vault>/bolts/_summary.md; a follow-up bolt re-run WITHOUT the flag is required before drift-detect / merge.

⚠️ Anti-bypass policy. --force-skip-postflight exists for operational continuity (broken tool / known false-positive), NOT to ship code that fails Hard Rules; BLOCKING remains BLOCKING and any use is logged in the handoff YAML + _summary.md. Repeated unauthorized use is treated as a constitution violation (§B Security) per ../bind-codebase/references/constitution-and-oq.md.

Pre-flight checks (skeleton)

Each check below can HALT before any code is written. Snapshot formats, grammar detail, and full halt YAMLs → references/hard-rule-scan.md.

1. Dispatch readiness. The first-class agents ship in this plugin tree (agents/) — no external plugin, no vendored fallback (removed v7.4.0), nothing to probe. If the Agent tool cannot dispatch mega-sdd:bolt-implementer, that is a broken install: STOP and surface it (untyped blocker → pure-pause), per references/superpowers-bridge.md §Dispatch order.
2. Unit validity. For each target unit: frontmatter parses + matches unit-schema.md; target_files non-empty (EXCEPT task_type: verify, which requires empty / operation: none); acceptance_test has ≥1 type: test entry; depends_on references resolve (no dangling). A task_type: verify unit with any target_files carrying operation: create | modify | delete → halt verify_unit_writable (verify units are read-only — verified, never written).
3. Repo state. Working tree clean (or --force). Bolts produce commits, so a dirty tree could lose work. Each bolt is an atomic commit with a provenance trailer (see the per-unit procedure). Repo mid-rebase/merge → STOP: resolve the git state first. Probe worktree-safely via git rev-parse --git-path rebase-merge / --git-path MERGE_HEAD (in a linked worktree .git is a FILE and the state lives under .git/worktrees/<name>/ — never test the literal .git/... path). 3.5. Test framework present. Probe the manifest/lockfile for the project's test runner (phpunit/pest, jest/vitest, pytest, go test, cargo test, rspec/minitest — per the detected ecosystem). Absent → halt dep_missing naming the runner + install command. NEVER proceed by fabricating "green" tests against a runner that doesn't exist — TDD without a runner is fiction. 3.6. Commit-path expectations. If the repo has client-side commit hooks (probe $(git rev-parse --git-path hooks)/pre-commit — worktree-safe — plus husky/lefthook config) note it; when a bolt's commit is REJECTED by such a hook → halt commit_rejected_by_hook with the hook output verbatim — never retry with --no-verify (forbidden plugin-wide). commit.gpgsign=true and signing fails → same halt shape, cause commit_signing_unavailable. 3.7. Anchor freshness — script-run, ONE batched call. Run scripts/check-anchor-freshness.sh --cwd=<root> --units=U-001,U-002,… ONCE with ALL target units (comma-separated; the script self-skips units without ## Anchors, so pass the full list unfiltered — never loop per unit) — every file:line anchor must resolve against git-tracked ground truth (file tracked; line within the file) BEFORE the implementer reads it as evidence. Exit 1 → halt anchor_missing (the script prints EVERY offending unit's stale anchors + keterangan: refresh via /mega-sdd:sync or a re-bind, or fix the listed units' ## Anchors lines). Any OTHER non-zero exit (incl. 2 — unresolvable unit id / not a git repo) → STOP: the probe aborted BEFORE producing a verdict for ANY unit (pre-loop abort, no remainder listing); fix the invocation/unit set and re-run — never treat a non-1 failure as "proceed". Commit-keyed: a unit whose bolt commits already exist gets an ADVISORY warn only — pre-v5/already-bolted units are never retro-blocked (B1 read-obligation-at-commit precedent). 3.8. L0 toolchain decision — one-time advisory, NEVER blocks (7.13.0, spec 2026-08-31 §1). If .mega-sdd/.l0-toolchain-probe.json (written by GROUND) has advisory: true AND .mega-sdd/l0-toolchain-decision.json is absent: the repo has 0 formatters + 0 linters, so gate-L0 format/lint will SKIP on every bolt this run. Ask ONCE via AskUserQuestion (keterangan per option, Bahasa Indonesia): (a) pasang linter/formatter dulu — pause supaya user setup, lalu lanjut; (b) pakai ## Toolchain di pack proyek .mega-sdd/packs/ (jalur override F-14); (c) N/A tercatat — repo memang tanpa lint standard. Write the answer to .mega-sdd/l0-toolchain-decision.json ({"decision":"linter-planned|pack-toolchain|na","by":"user","written_at":"<ISO8601>"}) — every later run stays silent. Proceed with the run whatever the answer; the honest per-bolt SKIPs in l0-results remain the enforcement-side record. W1 (v8 P1.e): on an express chain the batched OQ ask in resolve-oq already carried this item and wrote the decision file — then this step stays silent (the file is the only trigger either way). 3.9. JIT bind per wave (v8 P1, spec 2026-09-10 App. F2–F4) — runs when the run is lite (front-door --lite or derived.lane: lite from config.yaml) OR any unit in the wave carries ## Claims / existing_interfaces; otherwise skipped (v7 parity). Three script calls, never hand-written verdicts: derive-unit-claims.sh (one per wave; symbol_claims=text_claims=0 = zero model tokens, say so) → write-unit-binding.sh per unit (sole, hook-guarded writer; text claims via ladder E3 verbatim, --verdicts=) → validate-handoff-binding-units.sh --units= → FAIL ⇒ halt binding_conflict (ALWAYS STOP; resolve via resolve-oq --binding). When it triggers, Read references/jit-bind-and-quarantine.md §3.9 for the exact calls, the ladder contract and the keterangan. 3.10. Quarantine instead of parking (W1 zero-idle, v8 P1.e — spec App. F6c). Only three halts wait for a human: binding_conflict/bind_conflict, hard_rule_violated, OQ P1 business — plus, by owner exception (2026-09-10, CONFLICT-like), bolt_introduces_locked_drift (step 5d) stays a pure-pause. Every other DEFER-class halt on a unit is recorded with write-unit-quarantine.sh (gate still blocks that unit; dependents skipped with the reason; wave continues; status: quarantined), and _summary.md MUST carry a Karantina table with the record's question object rendered verbatim (text · source · RETRY/MANUAL/DROP + keterangan) — one answer per unit, at the end. When a DEFER-class halt fires, Read references/jit-bind-and-quarantine.md §3.10. BLOCKING halts keep the one-screen shape in references/propose-and-confirm-prompt.md §One-screen halt.
4. Hard Rule pre-flight scan — script-run, never hand-written, ONE batched call. Run scripts/run-preflight-scan.sh --cwd=<root> --units=U-001,U-002,… ONCE with ALL target units (comma-separated; the script self-skips units with no ## Hard rules, so pass the full list unfiltered — never loop per unit) — the deterministic writer that detects grammar, validates every rule via the shared _lib/postflight_rules.py lexer (byte-identical to the post-flight engine), and captures the snapshot to <vault>/bolts/U-XXX/preflight.json itself (hook-guarded like postflight.json — a hand-written snapshot is a forged baseline). When the user passed --hard-rule-grammar=<v>, forward it as --grammar=<v> on the script invocation (the script accepts only --grammar). Exit-code → halt map (a fatal code 3/4/5/6/8 names the offending unit on stderr and stops the batch fail-fast, listing the unprocessed remainder; exit 2 is a PRE-LOOP abort — unresolvable unit id / usage / not a git repo — NOTHING was processed and NO baseline exists for ANY unit: STOP, fix the invocation/unit set, re-run — never treat it as "proceed"): 3 → halt hard_rule_unparseable; 4 → halt hard_rule_mixed_grammar; 5 → halt hard_rule_unanchored; 6 → halt dep_missing (v2 grammar, ast-grep absent); 7 → snapshot refused post-hoc for the unit(s) named on stderr (bolt commits already exist — proceed, post-flight falls back to commit evidence; log EACH refused unit in its bolt-report; the batch continues past refusals); 8 → dirty protected path at baseline time — treat as a hard_rule_violated-style STOP (a rule target path differs from HEAD; the refusal is anti-laundering, so fix the tree — commit or restore the protected file — then re-run; NEVER proceed past it). Grammar table, snapshot JSON, and halt YAMLs → references/hard-rule-scan.md.
5. Reuse symbol index — ONCE per run, batch setup, never per bolt. Run scripts/build-symbol-index.sh --cwd=<root> here so every dispatch's symbol_slice (context-enrichment §Symbol slice (3b)) reads a fresh index. Exit 3 = ast-grep not installed → proceed (the dispatch builder records the omission honestly). Any OTHER non-zero → say so in one chat line and proceed — the index is ADVISORY reuse material and must never block bolts; the dispatch's index@<head8> stamp keeps the staleness visible. A per-bolt re-run is the per-item spawn-fan-out regression class this repo shipped fixes for twice — do not move this into the Procedure loop.
6. PBT citation pre-flight. When a unit has a non-empty properties: field, each properties[].cites must resolve to a real vault section / entity / constitution clause → else halt pbt_citation_invalid. Full PBT flow → references/halt-recovery.md (load only when a halt fires or a properties: unit is batched).

Procedure (per unit)

Follows references/superpowers-bridge.md per-unit flow — the default executor is the first-class mega-sdd:bolt-implementer agent, followed by the L0 code gates (deterministic floor: repo-own format/lint/typecheck, secret scan, SAST, new-dep existence, dep-authorization (advisory, per-unit) — per references/code-gates.md; secret_in_code / sast_critical_finding / dep_not_found halt before the panel), then the review panel: a risk-tiered set of read-only lenses (spec-reviewer, code-quality-reviewer, security-reviewer, standards-reviewer) dispatched in parallel and blind with the L0 results as a lens-input file path, merged in the controller into the finding ledger per references/review-panel.md (spec ❌ or any Critical → pointer re-dispatch within the retry cap; fix rounds are reviewed by the resolution-verifier, not a full re-panel). Superpowers technique skills are an optional enhancement (a real install only — the vendored fallback was removed in v7.4.0). Gate steps in bold:

0. Create the bolt artifact dir — deterministic, FIRST. Run mkdir -p <vault>/bolts/U-XXX/ as the literal first action for the unit, before pre-flight/dispatch. The folder MUST exist even for an empty-## Hard rules unit, a task_type: verify unit, an early pre-flight halt, or a --auto/--parallel run — do NOT rely on a later file-write to auto-create it (that is the prose-only gap that drops the folder when the controller is terse). Every per-unit artifact (preflight.json, dispatch-prompt.md, bolt-report.md) is written into this dir; the bolt-implementer agent writes code/tests/commit, NOT this dir — the controller owns it.

1. Pre-flight: re-run the snapshot writer for THIS unit (run-preflight-scan.sh --cwd=<root> --unit=U-XXX, single-unit form) — the per-unit re-capture is KEPT deliberately, not folded into the check-4 batch: a pre-commit re-run OVERWRITES the batch baseline with the file state at dispatch time, so a sibling bolt that legitimately committed to a later unit's DO NOT modify path since the batch capture cannot read as a false hard_rule_violated at post-flight. Bolted units are immutable-keep (idempotent); the controller never writes preflight.json by hand (hook-denied).

2. Model routing (v7.1, before dispatch). Resolve the implementer model by the override chain (--model-tier= > config model_tiers.bolt_implementer: > config default inherit): inherit → pass NO model param (today's behavior); auto → use implementer_model from the SAME resolve-review-tier.sh JSON already obtained for the panel tier; hard value → that model. Lane lite (v8 W2 measured cell): when the resolved value is the default inherit AND the router says unit_tier: xs, route as auto (→ implementer_model, sonnet for a minimal-tier unit) and record w2_model_cell: xs→sonnet in the bolt-report — --model-tier= and an explicit config value still win; the cascade below is unchanged. Wall per model for xs units is a P2 measurement; the cell stays only if acceptance pass rate holds. When a model is routed, pass it as the Agent call's model parameter. Cascade (skip under --no-escalate or when the resolved model is already opus): if this unit's ledger shows 2 consecutive failed attempts at the current model on a trusted quality signal (acceptance red / L0 gate red / fix-round with a P1 finding), dispatch the next attempt ONE tier higher (haiku→sonnet→opus), at most ONCE per unit, and record escalated_from in the bolt-report. Never auto-de-escalate. Build the tiered dispatch prompt with scripts/build-dispatch-prompt.sh (Step 4.5 below — script-assembled, never hand-typed) and dispatch the first-class mega-sdd:bolt-implementer agent with the returned inline_core — it implements the unit into target_files (whitelisted), writes + runs the acceptance test failing-first (TDD, via the test-driven-development technique when a real superpowers install is present), and commits the bolt (feat(U-XXX): … carrying the Unit: + SDD-PROVENANCE: trailers per references/bolt-contract.md). This commit is the antecedent for every detect-after gate below — L0, the panel, and post-flight all run against the landed commit, never a working-tree preview.

   • 2.5 — Positive UI obligations (defense-in-depth). When a target_files path is a view file (matches the active framework pack ## UI quality signatures → view_glob), the generated view MUST be fit for a human operator, not a raw scaffold dump: no scaffold_tells (human page title, humanized labels, foreign keys resolved to the related record's label, money formatted, project notification idiom instead of native alert/confirm), and every required_element (extend the app layout, responsive grid that works at 375px and desktop). This prose is defense-in-depth — validate-ui-quality.sh runs PostToolUse on every view write and the PreToolUse ui-quality gate blocks the next execute-bolts on a scaffold tell / missing element. Packs with no ## UI quality signatures section are exempt (gate SKIPs).
   • Render-test emission (defense-in-depth). If the unit ships a detail/show view (matches pack ## Test patterns → detail_view_glob), the implementer emits the type: render acceptance_test from the pack detail_view_render template (factory-create the model, GET the detail route, assert 200 AND assert a real display field renders — not a bare route-200 smoke test). The unit's render acceptance_test (authored by generate-units) is the contract. Defense-in-depth — validate-unit-spec.sh (render_test_missing) + the PreToolUse render-test gate already block any view-bearing unit lacking it.

3. L0 code gates — ONE call. Run the wrapper against the landed commit:

   bash "${CLAUDE_PLUGIN_ROOT}/scripts/run-code-gates.sh" \
     --cwd=<project-root> --base=<bolt-base-sha> --head=<new-head-sha> \
     --unit=<vault>/units/U-XXX.md --write

   --write persists the merged record as <vault>/lens-inputs/U-XXX/l0-results.json (7.11.0 — script-written, stamped, hook-guarded; never hand-write it). The panel-evidence gate reads it: a bolt dispatched with review-tier.json and no script-written L0 record halts l0_evidence_missing at the next dispatch.

   It sequences the deterministic floor internally (repo-own format/lint/typecheck, secret scan, SAST, new-dep existence, dep-authorization (advisory, per-unit) — order, merged-JSON shape, --pack= override, and timeout bounds per references/code-gates.md). <bolt-base-sha> = the unit's own landed commit's parent and <new-head-sha> = that commit — under sequential execution that is simply pre-dispatch HEAD..the bolt commit; under --parallel it is load-bearing: wave commits interleave, so the range is the unit's OWN commit, never wave-base..wave-head (per references/batch-and-fanout.md §--all — a sibling's finding must never be attributed to this unit). Exit 1 → the stdout JSON's halt object IS the blocker payload — the controller wraps it with the unit/commit context per references/code-gates.md §Halt YAMLs: secret_in_code / sast_critical_finding / dep_not_found halt before the panel (the short-circuit means later gates were never spawned — their not_run[] entries are the record). Exit 2 → environment error: nothing was certified — fix and re-run, never treat as clean. Exit 0 → Write the stdout JSON ONCE to <vault>/lens-inputs/U-XXX/l0-results.json (controller-written lens input; overwrite on a re-round so stale results can never ride forward) and carry that PATH in each lens/verifier prompt; do not paste the JSON per lens, re-run the gates per-script, or re-assemble the JSON by hand.

4. Review panel — ROUND 1: the risk-tiered read-only lenses (spec-reviewer, code-quality-reviewer, security-reviewer, standards-reviewer, + design-reviewer for UI units) dispatched in parallel and blind, each prompt carrying the <vault>/lens-inputs/U-XXX/l0-results.json path (the controller writes the L0 JSON there ONCE — never pasted per lens) and, for the quality lens, the mechanical reuse-duplication evidence rows (validate-reuse-duplication.sh --cwd=<root> --range=<base>..<head> --json), merged by scripts/merge-panel-findings.sh (the SOLE writer of bolts/U-XXX/findings.json — severity→status mapping, evidence-or-drop, dedup, consensus and id stability are mechanical; its stdout gate field is the merge verdict, never re-derived) per references/review-panel.md; spec ❌ or any Critical → re-dispatch by pointer (ledger path + open finding IDs — findings are never inlined into the prompt) within the retry cap — a re-dispatch re-enters at step 3: the L0 gates re-run against the new head (a fix commit adding a dep or pasting a credential is scanned like any other commit) — and the fix round is reviewed by ONE mega-sdd:resolution-verifier dispatch (fix-guided verification of each open finding + delta review of the fix range; full re-panel only via the logged escape hatch) per references/review-panel.md §Attempt rounds; cap exhausted with a Critical still open OR spec still ❌ → halt review_critical_unresolved.

5. Post-flight: re-validate Hard rules against the just-committed bolt (detect-after — the implementer already committed; gate below), then run the B4 acceptance-evidence writer scripts/run-acceptance-tests.sh --cwd=<root> --unit=U-XXX — it re-executes every acceptance_test entry against the landed commit (one bounded auto-retry, </dev/null, ~120s timeout) with the L0 syntax floor as a pre-rung (zero-config php -l / python3 -m py_compile / node --check / ruby -c over the bolt's changed files, only when the interpreter exists) and records the hook-guarded <vault>/bolts/U-XXX/acceptance.json itself. Exit 1 with failing type: syntax entries → halt build_broken (no retry — syntax is deterministic); exit 1 otherwise → halt acceptance_red (the retry already happened inside the writer). type: manual / command-less entries are recorded pending_manual — never executed, never a failure (SIT surfaces them). Then write bolt-report.md into the Step 0 dir — frontmatter MUST include target_hashes: (sha256 per target file, computed from the just-committed content; the living-vault staleness anchor per references/halts-and-handoff.md §Outputs detail). MANDATORY: a completed unit with no <vault>/bolts/U-XXX/bolt-report.md is invalid — the Stop-hook handoff validator halts bolt_artifacts_missing when an emitted_by: execute-bolts status: completed handoff lists no bolts/ artifact.

Step 4.5 — Tiered context enrichment per bolt (script-assembled)

Run the builder — do NOT assemble the prompt in your head, and do NOT re-type it into the dispatch.

bash "${CLAUDE_PLUGIN_ROOT}/scripts/build-dispatch-prompt.sh" \
  --cwd=<project-root> --vault=<vault> --unit=U-XXX \
  --plugin-root="${CLAUDE_PLUGIN_ROOT}" \
  --unit-tier=<unit_tier from the resolve-review-tier.sh JSON you already hold>

Pass --unit-tier from the SAME router verdict you obtained for the panel/model routing (resolve-review-tier.sh JSON, field unit_tier — one source of verdict; the builder never calls the router itself). Only xs changes the emission: payload slices are cut/floored per references/context-enrichment.md §XS emission while the unit body stays verbatim and every gate/validator is untouched; an unknown value fails OPEN to the full payload. Omitting the flag = full payload (legacy behavior).

Pass --plugin-root — it is required, not optional. You already have the value; passing it skips the plugin-root resolver spawn and its internal ls | grep | sort | tail pipeline — 6 process creations per bolt, ≈53 s over a 40-unit run on a CrowdStrike-scanned Windows laptop, at zero behavioral cost.

It writes the full tiered prompt to <vault>/bolts/U-XXX/dispatch-prompt.md — provenance, and the advisory validator's ONLY input — and prints ONE JSON object. Never pass --quiet: stdout is the sole channel carrying inline_core and design_slice_path. Dispatch mega-sdd:bolt-implementer with that inline_core VERBATIM as the Agent prompt (≤700B: trace tag, unit id + title, an absolute READ-FIRST pointer to the written file, the target_files whitelist, the binding anti-context/provenance pointer). The subagent Reads dispatch-prompt.md itself — the controller never re-types, paraphrases, or summarizes the assembled prompt into the Agent call.

• Exit 0 → dispatch. status: ok_with_soft_halts carries soft_halts[] with their existing meanings (deep_scan_cache_corrupt = unparseable starterkit-context.yaml; the starterkit slice is skipped, the bolt proceeds) — log them in the bolt-report.
• Exit 1 AND stdout carries a halt object → halt dispatch_prompt_too_large; that object IS the blocker payload (cap_hard, total, t1_bytes, t2_bytes, warnings, truncation_exhausted). The prompt is still written — forensic evidence, never a dispatchable artifact.
• Exit 2 → usage / IO / no-interpreter, detected before assembly; this run published nothing (publication is temp-file + atomic rename, and the rename never happened). Fix and re-run.
• Exit 4 — internal error (also: exit 1 with empty or unparseable stdout). The builder crashed; stdout carries {"status":"internal_error", …} when it can. This run published nothing, and destroyed nothing — a correct dispatch-prompt.md from a previous attempt is left INTACT and unchanged, so the path may still hold one. Treat it as a defect, not a budget halt: report the error, re-run once, escalate. Never dispatch.
• The EXIT CODE is the discriminator, never the file's existence. 2 and 4 both mean NEVER DISPATCH even when a prompt is sitting there — it is the previous attempt's. Equally: never dispatch a bolt whose dispatch-prompt.md is absent, and never infer a halt from an exit code alone.

No validator call here. validate-dispatch-prompt.sh is ADVISORY and re-runs under the analyze skill (run-analyze.sh V16); no hook fires it per bolt (the PostToolUse leg died in v7.5.0 №C/№D). Do not add a manual refresh step — a rule that duplicates a dispatcher rots, and plugins/mega-sdd/CLAUDE.md's gates > rules > hooks runs one way only.

The prompt's T1/T2/T3 tier contents, budget constants, the 9-priority T2 truncation cascade, and the three-way dispatch_prompt_too_large conjunction are the SPECIFICATION the builder implements → references/context-enrichment.md (single owner; emitted shape → references/bolt-dispatch-prompt.md) — the controller neither assembles nor needs that inventory at run time. Read that file's ## AMENDMENT before quoting a budget figure anywhere (caps re-derived from 123 measured builder runs, 2026-07-31). Anti-halu rails still bind: the contracts stay agent-carried (obligations unchanged); every T2 inclusion cites its source; the anti-context block is built from real data and an absent input OMITS its section, never invents one; constitution_clauses is NEVER truncation-dropped; self-assessment confidence is numeric 0.0–1.0; a provenance trailer is MANDATORY in every modified file (post-flight verifies it — missing → halt provenance_missing).

Post-flight Hard Rule validation (the safety net — gate)

After the implementer reports DONE (its commit already landed — see the commit topology above), run the post-flight scan via scripts/run-postflight-scan.sh --cwd=<root> --unit=U-XXX — the deterministic writer records <vault>/bolts/U-XXX/postflight.json itself (hook-guarded; a hand-written artifact is a forged verdict). ANY rule violated → halt hard_rule_violated (detect-after: the code is already committed — fix forward or git revert, then re-run the scanner; the B1 gate blocks every further execute-bolts until a passing artifact is recorded), write bolt-report.md with status: halted_postflight. --force-skip-postflight never changes this contract (anti-bypass policy above). Per-rule mechanics, snapshot formats, violation-handling detail + the halt YAML → references/hard-rule-scan.md (single owner).

After the post-flight scan passes (or a confirmed fix is applied), and before the unit is accepted as done, run the per-bolt lightweight drift check; drift on a LOCKED entity → halt bolt_introduces_locked_drift (pure-pause; override-only — NEVER propose-and-confirm); INTENT/ARTIFACT drift → logged + continue. Procedure → references/halts-and-handoff.md §Per-bolt drift check.

Self-assessment + provenance gate

Every bolt-report.md MUST carry a bolt_self_report YAML block (numeric confidence, certain/uncertain decisions, retry history) → missing → halt self_assessment_missing. Post-flight also verifies the provenance trailer in every modified file → missing → halt provenance_missing. bolt_self_report and the trailer format → references/halts-and-handoff.md.

Post-flight evidence is enforced, not prose (B1). A committed Hard-rule bolt MUST carry a passing script-written postflight.json; the gate RECOMPUTES it from git/fs ground truth (validate-bolt-artifacts.sh --postflight-scan --recompute, shared _lib/postflight_rules.py engine) and OVERWRITES the artifact before the state is read — then blocks the next execute-bolts with postflight_evidence_missing when no passing evidence covers a Hard-rule bolt. The obligation is read from the unit at the bolt commit (git show) — a retroactive unit edit cannot erase it; verify units are exempt. Full contract (writer, hook-guard classes, recompute + directive carry-forward) → references/hard-rule-scan.md §Mandatory evidence (B1) — single owner.

Acceptance evidence is enforced too (B4 — commit-keyed). A bolt commit carrying the SDD-Acceptance: v5 trailer (stamped per references/bolt-contract.md) MUST carry a fresh passing acceptance.json written by run-acceptance-tests.sh (hook-guarded); the gate blocks the next execute-bolts with acceptance_evidence_missing / acceptance_red / build_broken (only L0 syntax-rung entries failing). Legacy bolts — commits without the trailer — are NEVER blocked (the migration guarantee). Like B2, the artifact is READ at the gate, never re-executed inside a hook.

verify-unit special path

task_type: verify units run a simplified flow: pre-flight asserts target_files is empty / all operation: none (else halt verify_unit_writable); skip executing-plans; skip the Step-3 L0 gate call (no code diff — the report-only commit touches sanctioned vault artifacts only); run acceptance tests; skip the post-flight Hard-rule scan (no changes to validate); commit only the bolt-report (or skip the commit on --no-empty-commits). Reference loads for this lane are pinned in §Specialist references (never squad/parallel/code-gate material). Step 4.5 is NOT skipped — the builder handles an empty target_files natively (verified: exit 0; the TARGET FILES (whitelist): line is simply absent from both the prompt and inline_core). Do not hand-write a dispatch for a verify unit.

Batch + fan-out execution

--all (topo-sort by depends_on into SPRINTS — wave execution is the default, --sequential opts out; any failure halts the whole run, no skip-ahead), --sprint=<n>, --per-squad, --squad=<id>, and --module=<id> each have a procedure: squad fan-out, module gating, the cross_squad_interface_draft / module_blocked_by halts, and the parallel parent-thread post-flight re-scan → references/batch-and-fanout.md — load it ONLY for a multi-unit invocation (single-unit runs never need it; the per-bolt drift check + B2 live in references/halts-and-handoff.md).

Batch completion — final full-suite gate (the safety net for cross-bolt regressions)

After the last committed code-bearing bolt of the invocation (single OR batch — a lone bolt can break a sibling), run the project's FULL test suite exactly once via the sanctioned writer scripts/run-full-suite.sh --cwd=<root> (it runs the suite itself, pins HEAD, and records the hook-guarded <vault>/bolts/_batch-suite.json). RED → halt batch_suite_red (do not auto-revert; no status: completed handoff). Skipped only for --dry-run, a zero-code-commit run, or --no-full-suite (logged, never silent). Enforcement (not prose): the Stop hook + the execute-bolts gate run validate-bolt-artifacts.sh --batch-suite-gate; the PreToolUse aggregator blocks the next execute-bolts when no green _batch-suite.json covers the newest code commit (batch_suite_gate_missing) or the covering suite is RED (batch_suite_red) — the hook VERIFIES the artifact, it never runs the suite. Out-of-band bypass guard, freshness-anchor mechanics + the sync lane → references/halts-and-handoff.md §Batch completion — full-suite gate (B2) — single owner; design → docs/superpowers/specs/2026-06-26-batch-suite-gate-and-bypass-guard.md.

Partial-state, resume + saga rollback

A crashed bolt writes <vault>/bolts/U-XXX/partial-state.json (v2.0 schema: current_step, files_modified[], rollback_hints[]). --resume re-executes forward-only from current_step (3 partial attempts → halt bolt_repeated_partial_failure); a corrupt or malformed-hints file → halt partial_state_corrupt (rename aside, then re-run). --rollback replays rollback_hints[] in reverse with per-action confirmation (default safe for non-idempotent ops). Schema, step-type taxonomy, resume integrity checks, and the rollback flow → references/partial-state-and-saga.md.

Halt protocol + propose-and-confirm

Always emit a blocker YAML on halt (per references/bolt-contract.md). Exhausted acceptance-test retries → test_fail; a stale consumed interface → cross_squad_interface_draft; the batch-completion full suite ends RED → batch_suite_red (and the PreToolUse gate blocks the next run with batch_suite_red / batch_suite_gate_missing until a green _batch-suite.json covers the newest code commit). Eligible halts (test_fail, hard_rule_violated, pbt_property_violated) may dispatch an AI fix-proposer (propose-and-confirm UX) per references/propose-and-confirm-prompt.md; structural / business / config halts always pure-pause. Full halt YAMLs, the eligibility table, the propose-and-confirm dispatch contract + config override, the new-halt-types table, and the Property-Based Testing flow → references/halt-recovery.md — load it ONLY when a halt actually fires (or a properties: unit is in the batch); the blocker envelope + the canonical bolt-halt enum stay in references/halts-and-handoff.md.

Anti-hallucination rails

• target_files whitelist enforced at THREE layers: the dispatch prompt forbids out-of-whitelist writes (rules tier), the review panel checks scope (judgment tier), and the deterministic B3 whitelist observer (validate-bolt-artifacts.sh --whitelist-scan, Stop-hook + gate-time) diffs each bolted unit's COMMITTED paths against target_files ∪ sanctioned extras (vault/bolt artifacts, .mega-sdd/, test files) — escaped paths block the next execute-bolts with whitelist_violation. Existing interfaces preserved (verified by tests).
• No auto-bypass of pre-commit hooks; no --force commits or pushes to remote.
• An OQ in a unit body → prompt the user before the bolt finalizes.
• The Hard Rule pre-flight snapshot is mandatory when ## Hard rules is non-empty — captured by run-preflight-scan.sh (script-written; hook-guarded) — NEVER skip it to save time. Post-flight validation is detect-after (the implementer's commit already landed): violations halt the run, gate every further bolt, and the remediation is fix-forward or revert of the flagged commit — never a claim that the code is uncommitted. Unparseable rules halt at pre-flight — NEVER silently skip a rule whose grammar isn't recognized.
• There is no --skip-preflight flag; the pre-flight scan is the contract. Memory consultation NEVER bypasses pre/post-flight Hard-rule validation.
• Starterkit slice constraints are honoring obligations: when the T2 starterkit section is present, the bolt MUST extend the named layout, use the named notification lib, and use only the listed libs (violations rejected at post-flight).

Outputs

Per unit: a <vault>/bolts/U-XXX/ dir (created deterministically at Procedure Step 0 — MANDATORY, one per executed unit); code commit(s) on the current branch (skipped for task_type: verify with no changes); bolt-report.md (MANDATORY); preflight.json + postflight.json (both script-written — run-preflight-scan.sh / run-postflight-scan.sh — and hook-guarded; Hard-rule snapshots/results for audit, when ## Hard rules is non-empty); acceptance.json (B4 — script-written by run-acceptance-tests.sh, hook-guarded; per-entry acceptance verdicts + the L0 syntax-floor results; SIT's executed-evidence column reads it). Per batch: a single <vault>/bolts/_batch-suite.json (full-suite gate result — written once after the last code-bearing bolt). Global: a bolt_completed entry appended to <vault>/vault.json changelog. When vault.json carries a scope, the bolt-report header includes scope / scope_name for multi-squad traceability. Compact streaming progress + the aggregate <vault>/bolts/_summary.md format → references/halts-and-handoff.md.

Hand-off

After the last unit: suggest detect-drift to verify the bolts honored the vault; show a summary (N done, M failed, P skipped). Auto-render HTML (7.18.0, 0 model tokens): run bash "${CLAUDE_PLUGIN_ROOT}/scripts/render-html.sh" <vault>/bolts/_summary.md and name the html path in the summary — the batch report as a shareable offline page. Fail-open (one warning line, never a halt); skip when .mega-sdd/config.yaml has render_html: off. Under --auto, emit the handoff YAML (artifacts one-line-per-bolt with NO range shorthand; starterkit_context + metrics incl. acceptance_test_concerns; conditional scope: block). End-of-chain phase advancement (multi-phase rebuild) and the full handoff YAML schema → references/halts-and-handoff.md.

Specialist references (load on the stated condition — v7 R4 loading contract)

Every implement unit (the default lane):

• references/superpowers-bridge.md — dispatch order, the review-panel per-unit flow, whitelist enforcement, bolt-report schema.
• references/review-panel.md — the parallel blind lens panel: tier selection, blind dispatch protocol, merge + severity gate.
• references/code-gates.md — L0 deterministic floor: gate order, halt YAMLs, blocking-vs-advisory split, code_gates: config.
• references/hard-rule-scan.md — Hard Rule pre/post-flight: grammars, snapshot formats, per-rule checks, B1 evidence contract, hard_rule_* / verify_unit_writable halt YAMLs. (Skippable when NO batched unit has ## Hard rules.)
• references/bolt-contract.md — bolt failure modes, commit trailers + the canonical blocker YAML envelope.
• references/halts-and-handoff.md — halt protocol, per-bolt drift check, streaming + _summary.md, B2 full-suite gate detail, outputs, handoff YAML + the canonical bolt-halt enum.

Only when the condition holds (do NOT load otherwise):

• references/batch-and-fanout.md — multi-unit invocations only (--all/--parallel/--per-squad/--squad=/--module=): the batch procedures + wave/overlap rails.
• references/squad-subagent.md — --per-squad only: filter + consolidation protocol (depth-1, no squad subagent).
• references/partial-state-and-saga.md — --resume/--rollback or a crashed bolt only: partial-state v2.0 schema, integrity checks, saga flow.
• references/halt-recovery.md — ONLY when a halt fires or a properties: unit is batched: full halt YAMLs, propose-and-confirm UX + config, new-halt-types table, PBT flow.
• references/propose-and-confirm-prompt.md — only when dispatching the AI fix-proposer (eligible halts).
• references/jit-bind-and-quarantine.md — only when pre-flight 3.9 triggers (--lite / a unit with ## Claims) or a DEFER-class halt quarantines a unit: the three JIT bind calls, the ladder-E3 verdict contract, the Karantina table shape.
• references/hard-rule-grammar-v2.md — only when authoring/debugging v2 (ast-grep) rules or on grammar halts.
• references/migrate-rules.md — only for the Hard Rule v1→v2 migration procedure.

Script-owned specs (read to REVIEW or AMEND behavior — never load at run time):

• references/context-enrichment.md — the SPECIFICATION scripts/build-dispatch-prompt.sh implements (budgets, T2 cascade, halt conjunction); the controller no longer executes it.
• references/starterkit-enrichment.md — the builder's starterkit-slice spec (applied only when starterkit-context.yaml exists).
• references/bolt-dispatch-prompt.md — the canonical dispatch prompt template the builder populates.

task_type: verify lane (v7 R4): load ONLY the always-set above MINUS code-gates.md and hard-rule-scan.md — a verify unit commits no code (no L0 diff to gate; pre-flight self-skips units without Hard rules, post-flight is skipped by contract) and is never a batch driver on its own. Never load squad/parallel/code-gate material for a verify unit.

Related skills

Units come from generate-units (unit schema, modules schema, PBT integration, adversarial-test provenance). Bridges to superpowers executing-plans / subagent-driven-development / test-driven-development. Halt envelope + handoff template: references/halts-and-handoff.md (operative; base schema + routing index in ../orchestrate-flow/references/handoff-contract.md). The anti-bypass policy cites the bind-codebase constitution clauses. After a clean batch the detect-drift auto-gate runs (DEFAULT-ON in the chain; --no-drift-check opts out per references/halts-and-handoff.md); standalone runs can invoke detect-drift manually.