fix: apply the no-code-before-plan-approval rule to Standard work

docs/changelogs/CHANGELOG.md

@@ -13,6 +13,7 @@
 - Hardened Controlled work for `claude-sonnet-5-5`, which built a payment change with no lifecycle files in one run and, in another, used one reviewer per checkpoint and skipped final verification. The router now says size never lowers the lane, that Controlled work edits no code before a recorded `plan` approval whatever the task size or general file-avoidance instructions, and that the next skill is invoked, never done from the router. Controlled work without an approved `intent.md` routes to shape, and plan no longer writes a missing specification itself. The README lists `claude-sonnet-5-5` as not yet qualified for Controlled work. Build now names the two-reviewer checkpoint gate inline, requires invoking the review skill rather than only a reviewer agent, and forbids reporting completion before verification. The payment-build checker now requires a final `status: verified`.
 - Added an optional Claude Code guard hook (`hooks/edit_guard.py`, registered from `.claude-plugin/hooks.json`). In a session using this plugin it denies file writes until the lane is stated and the required approvals are recorded in `state.md` (`plan` for Standard; `intent`, `design`, and `plan` for Controlled), and it blocks ending a Standard or Controlled turn once while `status` is `building` or `reviewing`. It needs `python` on PATH, is inactive without it, and does not apply on Codex. See ADR-003.
 - Fixed a regression from the Controlled routing hardening: a plan-only request on Controlled work stopped at the intent gate and produced no specification or plan. Router and shape now draft `spec.md` and `plan.md` for plan-only requests, with nothing accepted. The full 12-case suite found it; `payment` had not been re-run after the hardening. The suite also showed `payment-build` asking for an extra approval after the last checkpoint in 2 of 5 runs; build now says the stop after checkpoint 1 is the only mandatory approval stop.
+- Fixed a Codex failure of the `feature` case: a Standard-lane task wrote and verified code before the human approved the plan, apparently because the Controlled-only hard stop read as optional for Standard. The router now applies the no-code-before-plan-approval rule to Standard and Controlled work. Shape now hands a plan-only request to plan in the same turn; one `payment` run had stopped after writing the specification.
 - The router now counts a risk signal that cannot be ruled out after reading the relevant code as present, so uncertain work cannot fall into the Fast lane. TypeSafe Jev was evaluated for routing and not adopted (ADR-002).
 - Fixed lane consistency: plan stops without required artifacts or plan approval, shape writes `intent.md` for Standard work only when ambiguous, and Fast excludes cross-service effects in the operating model.
 - Added scoped commit/push checkpoints to planning, building, and shipping; separated branch sharing from integration/release gates and preserved staged-snapshot, outgoing-history, and authorization checks.

skills/ai-native-sdlc/SKILL.md

@@ -13,7 +13,7 @@ When a leaf skill opened this file, use only its lane and invariants. Do not rou
 
 1. Read repository instructions, current status, relevant code, tests, and existing `.sdlc/` artifacts.
 2. Restate the requested outcome, explicit boundaries, and assumptions. Do not widen authorization.
-3. Choose the lane. Fast means small, reversible, clear, and no security, privacy, money, migration, production, destructive, or cross-service effect. Controlled means any of those risks. Standard covers the middle, including bounded features, ordinary bugs, and any request that asks for a plan or specification. A risk signal you cannot rule out after reading the relevant code counts as present. Size never lowers the lane. Controlled work edits no code until `state.md` records a `plan` approval; a small or fully specified task, or a general instruction to avoid extra files, does not waive this. Read [operating-model.md](references/operating-model.md) only for Standard, Controlled, or unclear classification.
+3. Choose the lane. Fast means small, reversible, clear, and no security, privacy, money, migration, production, destructive, or cross-service effect. Controlled means any of those risks. Standard covers the middle, including bounded features, ordinary bugs, and any request that asks for a plan or specification. A risk signal you cannot rule out after reading the relevant code counts as present. Size never lowers the lane. Standard and Controlled work edit no code until `state.md` records a `plan` approval (Controlled also needs `intent` and `design` approvals); a small or fully specified task, a request that already authorizes implementation, or a general instruction to avoid extra files does not waive this. Read [operating-model.md](references/operating-model.md) only for Standard, Controlled, or unclear classification.
 4. Use the first sufficient option: skip speculative work, reuse existing code, use the standard library, use a native feature, use an installed dependency, then write minimum new code. Keep small, tightly coupled work local unless applicable instructions require delegation. Read [economy.md](references/economy.md) for Standard or Controlled work, complex context, substantial output, or before delegating.
 5. If `.sdlc/changes/*/state.md` identifies this work, resume its `next_action`; do not restart the lifecycle. For model selection, model qualification claims, or cost comparisons, read [model-selection.md](references/model-selection.md).
 6. For Fast work, stay inline: state the short plan, make the smallest authorized edit, inspect the diff, run focused proof, and report fresh evidence. Use `ai-native-debug` first only when the cause is unknown. Do not create lifecycle files.

skills/ai-native-shape/SKILL.md

@@ -18,7 +18,7 @@ When invoked directly, first read `../ai-native-sdlc/SKILL.md` and confirm the l
 7. For Controlled work, or Standard work whose request is materially ambiguous, write `intent.md` using `../ai-native-sdlc/references/artifact-contracts.md`. Do not mark it accepted until the authorized human accepts it.
 8. After intent acceptance, directly for clear Standard work, or as an unaccepted draft for a plan-only request, produce `spec.md`. Trace every requirement to the intent, assign acceptance IDs, describe failure behavior and trust boundaries, and flag policy conflicts.
 9. Self-review for placeholders, contradictions, unowned decisions, scope creep, and acceptance criteria that cannot be tested or observed.
-10. Stop at the design gate when human judgment is required. Controlled work always needs a recorded `design` approval of `spec.md`, even when the same reply approves the plan. Otherwise hand the accepted spec to `ai-native-plan`.
+10. Stop at the design gate when human judgment is required. Controlled work always needs a recorded `design` approval of `spec.md`, even when the same reply approves the plan. Otherwise hand the accepted spec to `ai-native-plan`. For a plan-only request, hand the unaccepted drafts to `ai-native-plan` in the same turn instead of stopping after the specification.
 
 ## Boundaries