v2.0: state enforcement, project scoping, harness integration

State Enforcement (v2.0):
- .state file as single source of truth for task phase
- Approval gates for research, decomposition, design, test_design
- status.py --transition refuses illegal phase transitions
- status.py --validate-folder detects out-of-order artifacts
- status.py --audit checks all tasks for violations
- status.py --create-task is the only valid way to create tasks
- Pre-v2.0 tasks without .state are UNTRACKED -- all commands refuse them
- New --upgrade command bootstraps .state files for existing tasks

Project Scoping:
- --project flag added to all status.py commands across 16+ files
- _find_project_dir errors instead of silently falling back to ~/.automaton/
- --scope-check marks framework files OUT_OF_SCOPE when working on a project
- Dashboard handlers use stored project_root instead of re-detecting from CWD
- Prompts reference ~/.automaton/scripts/vram_detect.py (not {project}/.automaton/)

Harness Integration:
- status.py --can-edit now supports project-level checks (no --task required)
- --can-edit --file checks file scope without --task
- --json output for machine-readable harness integration
- opencode plugin (plugins/automaton-guard/plugin.ts) intercepts edit/write
- Git pre-commit hook (scripts/git-hooks/pre-commit) blocks commits without task
- Formal integration contract (contracts/harness-integration.md)

Other:
- upgrade.sh delegates to status.py --upgrade instead of manual heuristics
- Phase prompts reference --project {project} for multi-project scoping
- 200 tests passing (14 new)

tasks/task-status-reason/ADVERSARIAL_BUG_REPORT.md

@@ -0,0 +1,35 @@
+# Adversarial Bug Report: task-status-reason
+
+## Summary
+Deep-dive audit found 3 subtle issues: misleading red border on bug_find cards, redundant verdict parsing, and no status_reason propagation to subtasks.
+
+## Bugs Found
+
+### Bug 1: Red error border on bug_find task cards is misleading
+- **Severity**: Low
+- **Location**: `automaton/dashboard/html/styles.css` — `.task-card-reason` rule
+- **Description**: The `.task-card-reason` CSS uses `border-left: 2px solid var(--error)` for all three states (blocked, bug_find, adv_bug_find). But `bug_find` and `adv_bug_find` are normal workflow states, not errors. A green or neutral border would be more appropriate for non-terminal states.
+- **Reproduction**: Open any task in bug_find or adv_bug_find state — the reason banner shows a red border suggesting something is wrong, when it's expected behavior.
+- **Suggested Fix**: Use `var(--warning)` for bug_find states and reserve `var(--error)` for blocked only.
+
+### Bug 2: Redundant verdict parsing on every status_reason access
+- **Severity**: Low
+- **Location**: `automaton/dashboard/core/task.py:136-175` — `status_reason` property
+- **Description**: `status_reason` calls `parse_verdict_status()` again for BLOCKED/DONE tasks, even though `determine_task_state()` already parsed the verdict to classify the state. For DONE, it doesn't re-parse (just returns "Verdict: PASS"), but for BLOCKED it re-reads the verdict content and re-parses. This is redundant but cheap given the small number of tasks.
+- **Reproduction**: Every time the dashboard renders, BLOCKED tasks trigger a second verdict parse just for the display string.
+- **Suggested Fix**: Cache the parsed verdict status on the Task object during `discover_tasks()`, e.g., a `_verdict_status` field that `status_reason` can reference instead of re-parsing.
+
+### Bug 3: Subtask state not visible in detail panel reason
+- **Severity**: Low
+- **Location**: `automaton/dashboard/html/dashboard.js:236-241` — subtask list in detail panel
+- **Description**: Subtasks in the detail panel show only a verdict pass/fail indicator. Unlike parent tasks, blocked subtasks don't display their status_reason in the list. A blocked subtask just shows "✗" next to its name with no explanation of why.
+- **Suggested Fix**: For blocked subtasks, include the subtask's verdict status (FAIL/NEEDS_REVIEW) in the list item, or hover tooltip with the reason.
+
+### Bug 4: Fallthrough status_reason never reached, masks missing states
+- **Severity**: Low
+- **Location**: `automaton/dashboard/core/task.py:175`
+- **Description**: The fallthrough `return f"In {self.state.value} phase"` is dead code — every TaskState value is covered by explicit branches. If a new state is added (e.g., INTEGRATION_TEST), no compile-time error occurs and a vague message is shown. Contrast with Python enums which have no exhaustiveness checking.
+- **Suggested Fix**: Add `# pragma: no cover` or raise/log a warning if a new state goes unhandled.
+
+## Score
++3