Module ship_evidence 

Read-only structural oracle: “did this phase actually ship?”

Closes the false-green attestation class described in 23-06-PLAN.md’s objective — an agent-authored attestation document (VERIFICATION.md, SUMMARY.md, …) previously had to be trusted or caught by a non-deterministic review prompt, because devflow-core never exposed its own append-only record of whether a phase actually reached a finalized Ship. collect exposes that record directly, and ShipEvidence::shipped is safe to declare as a verify::external_verify_commands probe (Layer 0, agent_result.rs:704-711): a failed declared probe outranks every agent-controlled signal.

This module is opt-in per phase, deliberately, and this module does not itself decide whether Layer 0 is active — it only reports facts. A declared command must be approved via crate::verify::TRUST_EXTERNAL_VERIFY_ENV before it ever runs, on top of whatever project-level configuration gates declared-probe execution in the first place. This module must not be, and is not, the thing that flips that switch on: a default-on, unconditional --require-shipped probe would fail at every pre-Ship stage of every phase and block all work (T-23-64). Declaring this probe is a per-phase choice a PLAN author makes when a phase’s own attestation claims a completed Ship.

Structs

ShipEvidence

DevFlow’s own structural record of whether a phase has shipped.

Functions

collect

Collect DevFlow’s own structural record of whether phase has shipped.

is_stopped_at

Whether finished_reason names the --until clean-stop branch, so callers (the CLI’s --require-shipped failure message) can say “it finished but it did not ship” instead of a generic “not shipped” — the confusing case a reader hits first, per the plan’s Task 1 acceptance criteria.