feat(unic-archon-dlc): the config declares the SDLC's needs and the Boxes name no tool

apps/claude-code/unic-archon-dlc/.archon/workflows/unic-dlc-pr-review.yaml

@@ -41,10 +41,47 @@ nodes:
              `pr-review.inline_comments`      (default true)
              `docs.type` / `docs.access`      (for intent composition from docs)
              `project.branching`              (default "gitflow")
+             the whole `sdlc_needs` block
       3. If slug and config are both present → status "ready".
          (There is no PRD precondition: intent is composed from whatever sources resolve — see prep.)
 
       Compute `expected_base` from branching: "develop" when branching == "gitflow", else "main".
+
+      ## The `sdlc_needs` block — a key names a need, never a tool
+      Every key in it names a NEED of this project's development process. `test` names the need;
+      whichever runner this project uses is the tool that serves it, and this Box names none. Pass the
+      block downstream as ONE object carrying ALL NINE keys — `install`, `build`, `test`, `e2e`, `lint`,
+      `format`, `typecheck`, `dev`, `coverage` — every time. Copy each value the config sets verbatim:
+      rename nothing, rewrite nothing, infer nothing. Emit `null` for every key the config omits. A
+      config may carry a partial block, or none at all, and both are normal — a tenant hand-edits this
+      file, and a key added by a later release reaches them only at their next `reconfigure`. What is
+      never allowed is emitting fewer than nine keys: this node's schema requires all of them, so a
+      short object fails validation and aborts the run before a guard can cancel it cleanly. A key that
+      arrives null stays null. What happens next depends on the node: one that wants that need reports
+      an **unresolved** check, one that does not want it reports nothing at all, and neither fabricates
+      a command — a guessed command reports a result that means nothing.
+      **This Box runs no build, lint, type-check or test command by instruction** (ADR-0026): it
+      carries the block so that `reconcile` can tell the reader which checks the project has and this
+      review did not run. `install` is the exception and is not a check — you run it below, once,
+      because a sub-agent that decides on its own that it needs to run something should fail on that
+      decision rather than on which worktree the run drew (ADR-0037 §6).
+
+      ## Install once, and say what you did
+      One Archon worktree serves this whole run and may or may not already carry this project's
+      dependencies. So install here, once, and nowhere else. No node here is instructed to run a
+      check, and this Box installs anyway with no exception: a review sub-agent that decides on its own
+      that it needs to run something should fail on the merits of that decision, not on which worktree
+      the run happened to draw. When status is "ready", run `sdlc_needs.install` from the repo root if
+      it is declared, and set `install_report` to:
+        - declared, exit 0     → "ran the declared install command: ok"
+        - declared, non-zero   → "ran the declared install command: FAILED — <what it printed>"
+        - not declared         → "sdlc_needs.install is not declared, so nothing was installed.
+                                  Dependencies may still be present in this worktree by chance, and a
+                                  later green check here is not proof of a deliberately built
+                                  environment."
+      A failed install does not fail this node — report it and carry on. On any status other than
+      "ready", set `install_report` to "not attempted (<status>)".
+
       ALWAYS emit EVERY required field, including in the no-slug and no-config branches, so the object
       validates before a guard can cancel. When a value cannot be read, fall back to: slug "" (if
       no-slug), artifacts_dir "workflows", gate "hitl", confidence_threshold 60, inline_comments
@@ -67,9 +104,23 @@ nodes:
           type: string
           enum: ['true', 'false']
         branching: { type: string }
+        sdlc_needs:
+          type: object
+          properties:
+            install: { type: [string, 'null'] }
+            build: { type: [string, 'null'] }
+            test: { type: [string, 'null'] }
+            e2e: { type: [string, 'null'] }
+            lint: { type: [string, 'null'] }
+            format: { type: [string, 'null'] }
+            typecheck: { type: [string, 'null'] }
+            dev: { type: [string, 'null'] }
+            coverage: { type: [string, 'null'] }
+          required: [install, build, test, e2e, lint, format, typecheck, dev, coverage]
+        install_report: { type: string }
         expected_base: { type: string }
         message: { type: string }
-      required: [status, slug, artifacts_dir, gate, confidence_threshold, inline_comments, branching, expected_base, message]
+      required: [status, slug, artifacts_dir, gate, confidence_threshold, inline_comments, branching, sdlc_needs, install_report, expected_base, message]
 
   # ---------------------------------------------------------------------------------------------
   # guard — expected precondition failures cancel cleanly (ADR-0011: cancel vs fail). One guard,
@@ -467,6 +518,8 @@ nodes:
            ## unic-dlc /pr-review — $prep.output.pr_title · Iteration <ITERATION>
 
            <contradictions callout, if any>
+           ### Checks this review did not run
+           <the block — see step 5b>
            ### Since iteration <ITERATION-1>        (only when ITERATION > 1)
            <delta line>
            <the ### Intent Check / severity / What's good sections from SESSION/summary-sections.md,
@@ -491,6 +544,21 @@ nodes:
          only place the reader sees it resolved and the only place the next iteration can read its hash
          back. A fixed finding whose marker you omit cannot return as `regressed` — it returns as new,
          which is the classification this whole node exists to keep stable.
+      5b. Fill the "Checks this review did not run" block. It is a block of its own, in the frame
+         above every finding, and it is present in EVERY iteration — a reader skimming for severity
+         must not be able to pass over it. Three sentences, in this order:
+           - **This Box runs no build, lint, type-check or test command by instruction**, so nothing
+             below checks a claim the author made about one. That is deliberate: running a check
+             against a claim is a Method's procedure, not this Harness's (ADR-0030).
+           - Which **checks** the project declares: name the keys of `$bootstrap.output.sdlc_needs`
+             whose value is set, `install` excluded, and say that this review executed none of them.
+             Leave `install` out of that sentence — this Box does run it, and the line below reports
+             what happened, so naming it here would deny something the next line proves. Name the
+             keys, never their values: the command is the project's business and this Box names no
+             tool.
+           - `$bootstrap.output.install_report`, verbatim.
+         Without this block that admission lives only in the plugin's own issue tracker, where the
+         developer reading a review never sees it.
       6. Build the thread plan → SESSION/threads.json: an array of
          { kind, file, line, severity, hash, classification, body }. Every entry's `body` starts with
          the hidden marker `<!-- unic-dlc-pr-review:finding=<hash> -->` and then the rendered finding.