fix: repair frontier eval budgets and workflow instructions

Preserve frontier models and quality thresholds while fixing truncated judge output, ordered section expansion, consent checks, QA scoring, and ship audit gates. Add regression coverage and refresh generated docs.

Co-Authored-By: OpenAI Codex <noreply@openai.com>

ship/SKILL.md.tmpl

@@ -36,17 +36,17 @@ triggers:
 
 # Ship: Fully Automated Ship Workflow
 
-You are running the `/ship` workflow. This is a **non-interactive, fully automated** workflow. Do NOT ask for confirmation at any step. The user said `/ship` which means DO IT. Run straight through and output the PR URL at the end.
+You are running the `/ship` workflow. Automate routine work without confirmation. The user said `/ship` which authorizes that work, but does not waive the explicit safety and user-decision gates below. Run through to the PR URL unless a gate requires input or reports a blocker.
 
-**Only stop for:**
+**Stop for blockers and explicit decision gates.** Follow every STOP or AskUserQuestion instruction in the steps below and the preamble. Common gates include:
 - On the base branch (abort)
 - Merge conflicts that can't be auto-resolved (stop, show conflicts)
 - In-branch test failures (pre-existing failures are triaged, not auto-blocking)
 - Pre-landing review finds ASK items that need user judgment
 - MINOR or MAJOR version bump needed (ask — see Step 12)
 - Greptile review comments that need user decision (complex fixes, false positives)
-- AI-assessed coverage below minimum threshold (hard gate with user override — see Step 7)
-- Plan items NOT DONE with no user override (see Step 8)
+- AI-assessed coverage below target (see Step 7 for minimum/target decisions)
+- Plan items NOT DONE or UNVERIFIABLE (see Step 8)
 - Plan verification failures (see Step 8.1)
 - TODOS.md missing and user wants to create one (ask — see Step 14)
 - TODOS.md disorganized and user wants to reorganize (ask — see Step 14)
@@ -179,7 +179,7 @@ stay agent judgment; the slot pick stays `gstack-next-version`.
    ```bash
    bun run ~/.claude/skills/gstack/bin/gstack-version-bump classify --base <base>
    ```
-   Read the JSON `state` and dispatch:
+   Save the JSON `baseVersion` as `BASE_VERSION`, then read `state` and dispatch:
    - **FRESH** → do the bump (steps 2-4).
    - **ALREADY_BUMPED** → skip the bump, but run the queue-drift check (step 3) with the reported `currentVersion`. If the queue moved (next free version differs), **AskUserQuestion**: rebump to the new version (rewrites CHANGELOG header + PR title) or keep current (CI version-gate will reject until resolved).
    - **DRIFT_STALE_PKG** → run `gstack-version-bump repair` (syncs package.json to VERSION). No re-bump; reuse `currentVersion` for CHANGELOG + PR.
@@ -299,17 +299,29 @@ git log <base>..HEAD --grep="^WIP:" --format="%H%n%B%n---END---" > \
 DO NOT DO THAT. Instead, use `git rebase` scoped to filter WIP commits only.
 
 Option 1 (preferred, if there are non-WIP commits mixed in):
+Only rewrite unpublished commits. If any are already on the remote, stop and ask
+before rewriting; never force-push. Prepare a rebase todo in a temporary file:
+list commits oldest-first, keep every non-WIP commit as `pick` in its original
+relative order, move each WIP directly after its corresponding logical commit,
+and mark it `fixup`. Inspect the diffs to choose each target; if a WIP's target
+is ambiguous or outside this branch, stop and ask. Every commit must appear
+exactly once, and the first entry must be `pick`. Set `WIP_TODO` below to that
+prepared file's absolute path. Do not run with an empty or unreviewed todo.
+
 ```bash
-# Interactive rebase with automated WIP squashing.
-# Mark every WIP commit as 'fixup' (drop its message, fold changes into prior commit).
-git rebase -i $(git merge-base HEAD origin/<base>) \
-  --exec 'true' \
-  -X ours 2>/dev/null || {
+export WIP_TODO="<absolute path to prepared todo>"
+test -s "$WIP_TODO" || exit 1
+ORIGINAL_TREE=$(git rev-parse 'HEAD^{tree}')
+GIT_SEQUENCE_EDITOR='cp "$WIP_TODO"' git rebase -i "$(git merge-base HEAD origin/<base>)" || {
     echo "Rebase conflict. Aborting: git rebase --abort"
     git rebase --abort
     echo "STATUS: BLOCKED — manual WIP squash required"
     exit 1
   }
+test "$ORIGINAL_TREE" = "$(git rev-parse 'HEAD^{tree}')" || {
+  echo "STATUS: BLOCKED — squash changed file contents; inspect before continuing"
+  exit 1
+}
 ```
 
 Option 2 (simpler, if the branch is ALL WIP commits so far — no landed work):
@@ -381,6 +393,7 @@ The evidence ledger is the mechanical arm of this law. Check it FIRST:
 ~/.claude/skills/gstack/bin/gstack-evidence check --label tests --expect-cmd '<exact tests-lane command from Step 5>' --label vitest --expect-cmd '<exact vitest-lane command from Step 5>' --max-age 24 --allow-paths CHANGELOG.md,VERSION,package.json,agents-digest/gstack-AGENTS.md
 ```
 
+Include only lane labels actually run in Step 5; `vitest` is an example, not a required framework.
 Pass each `--expect-cmd` the exact command string the wrapped Step 5 lane ran —
 that binds FRESH to the real suite (a green `echo ok` recorded under the label
 can never satisfy the check). Residual risk, accepted: `package.json` sits on
@@ -399,7 +412,7 @@ advisory either way.
   recorded: `~/.claude/skills/gstack/bin/gstack-evidence run --label <lane> -- '<command>'`.
   The check is an advisory guardrail — a failed CHECK never blocks; a failed RUN does.
 
-Before pushing, re-verify if code changed during Steps 4-6:
+Before pushing, re-verify if code changed at any point after Step 5:
 
 1. **Test verification:** If ANY code changed after Step 5's test run (fixes from review findings, CHANGELOG edits don't count), re-run the test suite. The evidence check above IS this rule, mechanized — trust FRESH, re-run on STALE. Paste fresh output when you re-run. Stale output from Step 5 with changed content is NOT acceptable.