shallnot: Spec-to-Test Traceability Gate for Coding Agents

shallnot closes the loop on an agent’s self-report. Every requirement in a Markdown or YAML spec carries an ID and a revision, written PWD-2~1; every test cites one through a [verifies PWD-2~1] tag, placed wherever its runner will echo it into JUnit XML. The gate joins those three inputs and fails unless each requirement is cited by a test that actually ran and passed, so a tag sitting in a comment, or on a test that never executed, binds nothing. Bumping a revision invalidates every test still citing the previous meaning, which stops a reworded requirement from riding on a stale green. shallnot init equips a repository in one command: config for the detected runner, agent instructions, skills, and an end-of-turn hook that hands the findings back so the agent keeps working instead of stopping. Determinism is enforced rather than promised: an architecture test fails the build if the binary ever links a networking package, or if the domain and analysis layers reach for a file. The tool gates itself, binding its own 57 requirements to tagged tests in its CI. What a pass does not prove is that the tests are any good, and the project says so plainly: judging that is a review job, left to a skill rather than claimed by the gate.