feat(effort): max at the verify-secure caps and ship-feature 4b; STOP texts suggest /effort-max

lib/challenge-plan.md

@@ -59,6 +59,8 @@ silently downgrade the judgment. (The executor gates stay sonnet.)
 
 A challenger that returns a malformed/empty verdict, a missing `PROOF`, or dies →
 retry ONCE with a fresh challenger; a 2nd failure on that lens → STOP and escalate
+(the STOP text names the level reached, `$CLAUDE_EFFORT`, and suggests `/effort-max`
+for the relaunch; no shift here: a mute challenger is an infrastructure failure)
 to the human, NAMING the lens. Never carry "plan challenged" into the gate on a
 silently dropped lens (`verify-secure-loop.md`: "a mute verifier is NEVER a PASS").
 

lib/tests/effort-routing.test.sh

@@ -78,6 +78,12 @@ has "lib/effort-shift.md" 'lone Skill call is a no-op'
 has "lib/effort-shift.md" 're-applies its'
 [ "$(grep -c 'a lone Skill call is a no-op' "$R/skills/feat/SKILL.md")" -ge 1 ] && ok || ko "feat INC line must carry the pairing rule"
 
+# ── 7) escalation at max (spec D4)
+[ "$(grep -c 'Skill(effort-max)' "$R/lib/verify-secure-loop.md")" -eq 3 ] && ok || ko "verify-secure-loop.md must shift to max at its 3 caps"
+has "skills/ship-feature/SKILL.md" 'Skill(effort-max)'
+has "lib/challenge-plan.md" '/effort-max'
+has "lib/verify-secure-loop.md" '/effort-max'
+
 # ── summary (later tasks insert their locks ABOVE this line)
 printf 'effort-routing census: %d pass, %d fail\n' "$pass" "$fail"
 [ "$fail" -eq 0 ]

lib/verify-secure-loop.md

@@ -35,7 +35,7 @@ single `GATES — VERDICT:` line:
 - `UNMET(n)` → hand the dev the CONTRACT path + the `NOT-MET` rows verbatim,
   nothing else; re-run GATE 0. **No verifier is dispatched** — a red build or
   a red suite is not a judgement call, and paying an LLM to discover it is
-  waste. **Max 3 floor iterations** → STOP + human escalation with the rows.
+  waste. **Max 3 floor iterations** → `Skill(effort-max)` (effort-shift: cap reached, diagnose at max before escalating; send it in the same message as the first tool call that gathers the escalation evidence), then STOP + human escalation with the rows.
 - `ABANDONED(n)` → floor green but a handoff stands. Continue to GATE 1; the
   verifier surfaces it and its `ABANDONED(n)` verdict routes to the human
   gate.
@@ -74,7 +74,7 @@ Parse its single `VERIFY — VERDICT:` line:
   lines (NOT-MET / out-of-scope), nothing else: re-dispatch a FRESH executor
   with those inputs only, never redo the fix by hand. Then re-run GATE 0 and
   re-dispatch a FRESH verifier. Repeat.
-  **Max 3 conformity iterations** → STOP + human escalation with the
+  **Max 3 conformity iterations** → `Skill(effort-max)` (effort-shift: cap reached, diagnose at max before escalating; send it in the same message as the first tool call that gathers the escalation evidence), then STOP + human escalation with the
   CRITERIA table (the contract-vs-realized diff).
 - `ABANDONED(n)` → direct human gate, never a dev loop (a dev cannot close
   what was proven impossible). The human lifts the abandonment or accepts
@@ -104,8 +104,9 @@ Parse its single `SECURITY — VERDICT:` line:
   (re-dispatch a FRESH executor, never fix by hand). Then re-run GATE 0, then
   **re-verify the REQUEST first** (GATE 1, fresh verifier) — a security fix
   can drift the behavior — **then re-run GATE 2** (fresh auditor), in that
-  order. **Max 3 security iterations** → STOP + human escalation with the
-  BLOCKING table.
+  order. **Max 3 security iterations** → `Skill(effort-max)` (effort-shift: cap reached, diagnose at max before escalating; send it in the same message as the first tool call that gathers the escalation evidence), then STOP + human escalation with the
+  BLOCKING table. Every STOP text names the level reached (`$CLAUDE_EFFORT`)
+  and suggests `/effort-max` for the relaunch.
 - `DEGRADED` (semgrep absent) → does NOT block on the tool's absence; surface
   the checklist result + recommend `make plugin`. A DEGRADED run that still
   BLOCKs (grep-caught secret/injection) blocks like any other.