The Method

The full spec ships in the package as METHOD.md. The core design rule: a phase boundary is a gate only if a machine can check it — a verification command's exit code, or an independent reviewer's structured verdict; never the implementing agent's own judgment.

The seven phases

1. Spec — human-approved intent (PRD).
2. Readiness — binary verdict with empirically-derived hard caps.
3. Task plan — human-approved decomposition with declared conflict surfaces.
4. Implement — autonomous, gated on typecheck/lint/build/tests.
5. Verify — executed evidence; a listed-but-not-run command is never "passed".
6. Review — blocking adversarial review by a different model family.
7. Land — knowledge capture + no-ff local merge; push stays human.

Phases 4–7 run autonomously. Humans own the spec, the readiness verdict, the task plan — and the push.

Closed-loop memory (opt-in)

A durable-memory store answers "what did we already learn?", but a store alone cannot show that a known constraint was considered. With memory.enabled set in workflow.config.json, two parsed sections close that loop through artifacts the repository already commits — no database, no service, no second state store.

Either section may instead carry exactly one reasoned none. A rationale is required in every form: an unreasoned none is the ceremonial answer the contract exists to prevent, and a non-empty output set may not contain none at all — the two forms assert opposite things about the same set.

Four rules do the work:

• Inputs resolve against the real store. A slug must name an active, indexed record; a superseded one, an unindexed file, or a record that fails validation is refused by name at gate check time.
• A watch is a review trigger, not a staleness verdict. When an active record's watch glob overlaps a declared FR target — or a file in the closing diff — that record needs an input disposition. It never needs to be edited. The opposite rule would make declaring a watch expensive for its author and train agents to omit them.
• Outputs are proved against the diff. Every declared output is an exact repo-relative path that also appears in Durable Artifacts, and Phase 7 refuses a close whose declared paths the merge diff does not contain. A declaration is not a capture.
• Weakening is proved against the base ref. The baseline is the work item as committed on the base branch — the one version an agent editing its own spec cannot rewrite. Appending an output discovered during implementation is always allowed; removing one, changing its type or path, or replacing it with none is refused outright for an autonomously-closeable item, and needs owner acceptance otherwise.

Manifest safety

A generated practices manifest omits phases.4 rather than writing phases.4: []. Manifest load deep-merges over the built-in floor, so an absent key inherits the four configured floor commands while an empty array erases them. Emptying the floor is the one manifest edit that silently removes gates instead of adding them.

Turning the contract on is gate land-gated: the merge runs inside the same workspace mutex that guards lease claims and refuses while another work item holds an active lease, so gate policy never changes under a running agent's feet. That is a gate land precondition and not a git-level invariant — a direct git merge bypasses it, as it bypasses every gate here.

Control-artifact revalidation, and what it does not cover

gate run and gate land revalidate the checkout before anything executes: when a lease carries worktree stamps, the config and the gates manifest the checkout holds must match what the base branch holds. They are compared as the union of what is present in either place, so a file deleted locally while still committed on base is drift rather than an omission — otherwise manifest load quietly falls back to the built-in defaults and the agent runs a different set of gates than the repository declares. On a mismatch the command stops before any phase command runs, before any metric row is written, and before any merge, and it names the remedy: merge or rebase base into the feature branch.

The boundary is narrow on purpose, and it is worth stating rather than implying:

• A direct git merge bypasses it entirely. The check lives in the runner, so it binds the commands that go through the runner and nothing else.
• gate check, gate status, and gate queue do not check, by design. They read and report; refusing to answer a question about a stale checkout would remove the tool you reach for while diagnosing one.
• gate run --dry-run plans without checking. A plan executes nothing, so there is nothing to protect — and a plan that refuses to print is a plan you cannot read.