@antoneeo/course-creator 0.1.0-beta.14 → 0.1.0-beta.16

package/skills/course-creator/review.md

@@ -198,6 +198,34 @@ is a belief: the row would say a gate ran and never whether it could do its job,
 the correlation with `revise_rounds` and `findings_real` — the only evidence the
 policy pays — could not be drawn.
 
+**The owner approves the design before the work starts (L3).** The reviewer judges
+whether the design holds and serves the Vision; only the owner can say whether it is
+what they meant beyond what the Vision wrote, and an intent error costs least before
+the work exists. So the final design PASS — final once any scoped re-review it owed
+has passed (§Review-driven corrections) — does not start the work: the agent
+presents the design and asks the owner whether to proceed, in the form
+`elicitation.md` §The form of a question gives a reserved approval. The presentation
+is a short summary — what the change does (the Functional Spec, or the lens's
+equivalent), for whom and through which surfaces (use cases, contract), what it
+touches (Impact), the threats and their mitigations, the review's verdict with any
+open findings — and the path of the full design. At the round cap, the hand-over the
+cap prescribes, followed by this one question, takes the place of the form, and the
+owner's answer settles both. An approval is recorded verbatim in the request record
+under a label that begins `design approved`; a no or a correction takes its own
+label, and the design goes back — where the revision changes what the review judged,
+moment 1 runs again on that part first (the delta rule above). Only after the
+approval does the ANALYSIS go `PLANNED` → `IN_PROGRESS` and the work start: code,
+drafting or production, by lens. An instruction given before the design was shown
+("carry on", "do the whole unit") does not approve it. Where a lens's own phases
+already have the owner approve the design — the marketing lens's strategy USER GATE
+— that gate is this approval, never a second question, and the lens's own unattended
+path applies. Otherwise, unattended, the unit is `BLOCKED on the user`
+(`elicitation.md` Unattended path), never approved by assumption; a late arrival
+(moment 1b) asks before any further work. Hybrid: the owner's approval of the
+`E-ISP`/`E-TDD` proposal in devPNT, under devPNT's own authorization rules, is this
+approval. In Standalone, `validate` notes an L3 ANALYSIS in implementation, started
+on or after 2026-10-31, whose request record holds no `design approved` entry.
+
 **One schema for both modes**, meaning one required CORE plus each mode's own
 **mode-specific** realization columns. The core is what both modes actually share: `date`, `doc_key`,
 `tier`, `model`, `findings_raised`, `findings_real`, `verdict`, `revise_rounds`.

package/skills/course-creator/scripts/course_check.py

@@ -2,6 +2,7 @@
 """Structural checks for one course; never certifies teaching quality or learning."""
 from dataclasses import dataclass
 from pathlib import Path
+import os
 import re
 
 
@@ -54,7 +55,7 @@ def _items(cell):
             if part.strip() and part.strip() != "-"]
 
 
-def _anchor_exists(path, anchor):
+def _anchor_exists(path, anchor):
     if path.suffix.lower() not in (".md", ".txt"):
         if path.suffix.lower() == ".pdf":
             return bool(re.fullmatch(r"page=[1-9]\d*", anchor))
@@ -63,132 +64,284 @@ def _anchor_exists(path, anchor):
         return bool(re.fullmatch(r"\d{2}:\d{2}(?::\d{2})?", anchor))
     text = path.read_text(encoding="utf-8", errors="replace")
     return any(re.sub(r"[^a-z0-9 -]", "", heading.lower()).strip().replace(" ", "-") == anchor.lower()
-               for heading in re.findall(r"^#+\s+(.+)$", text, re.M))
-
-
-def _content_contract(course_dir, plan, plan_rows, read, ref, add):
-    """Validate authored-source structure, not its pedagogical sufficiency."""
-    plan_path = course_dir / "COURSE_PLAN.md"
-
-    def field(text, key, path, item):
-        values = re.findall(r"^" + re.escape(key) + r":[ \t]*(.*)$", text, re.M)
-        if len(values) != 1 or not values[0].strip() or values[0].strip() == "-":
-            add(path, item, f"{key} must occur once with a value")
-            return ""
-        return values[0].strip()
-
-    declarations = re.findall(r"^Content contract:[ \t]*(.*)$", plan, re.M)
-    if not declarations:
-        add(plan_path, "content", "legacy course: migrate to a complete textual content contract; quality is not certified", "WARN")
-        return
-    contract = field(plan, "Content contract", plan_path, "content")
-    if contract not in ("slide-content-v1", "text-content-v1"):
-        add(plan_path, "content", "unknown content contract")
-        return
-    prefix, name = ("S", "SLIDE_CONTENT.md") if contract == "slide-content-v1" else ("U", "COURSE_CONTENT.md")
-    if prefix == "U":
-        field(plan, "Format exception", plan_path, "content")
-    path = course_dir / name
-    text = read(path, "content")
-    if text is None:
-        return
-    intro = text.split("\n## ", 1)[0]
-    if field(intro, "Course version", path, "version") != field(plan, "Course version", plan_path, "version"):
-        add(path, "version", "content version differs from COURSE_PLAN")
-    if field(intro, "Delivery mode", path, "delivery") not in ("self-study", "instructor-led"):
-        add(path, "delivery", "unknown delivery mode")
-    for key in ("Efficacy", "Feedback flow"):
-        if field(intro, key, path, key) != field(plan, key, plan_path, key):
-            add(path, key, f"{key} differs from COURSE_PLAN")
-    headers = ("profile", "baseline", "target capability", "teaching contribution", "observable check", "alternative and limits")
-    values = _table(text, headers) or []
-    expected_profiles = {row["profile"] for row in plan_rows}
-    if {row["profile"] for row in values} != expected_profiles or len(values) != len(expected_profiles):
-        add(path, "value", "Course Value must cover each taught profile exactly once")
-    for row in values:
-        if any(not row[h] or row[h] == "-" for h in headers):
-            add(path, "value", "Course Value fields must be populated; semantic review still required")
-        ref(row["observable check"], path, "value")
-    modules = {row["module id"]: row for row in plan_rows}
-    sections = re.split(r"(?m)^## (.+)\n", text)
-    units = {}
-    order = []
-    for heading, body in zip(sections[1::2], sections[2::2]):
-        if heading == "Course Value":
-            continue
-        if not re.fullmatch(prefix + r"[0-9]+", heading):
-            add(path, heading, "unexpected unit heading")
-            continue
-        if heading in units:
-            add(path, heading, "duplicate unit ID")
-        metadata = body.split("### ", 1)[0]
-        unit = {key: field(metadata, key, path, heading) for key in
-                ("Module", "Objective", "Role", "Title", "Value contribution")}
-        units[heading] = unit
-        order.append(heading)
-        unit["coverage"] = {(unit["Module"], unit["Objective"])}
-        extra_coverage = re.findall(r"^Covers:[ \t]*(.*)$", metadata, re.M)
-        if len(extra_coverage) > 1:
-            add(path, heading, "Covers must occur at most once")
-        if extra_coverage:
-            pairs = _items(extra_coverage[0])
-            if not pairs:
-                add(path, heading, "Covers must list module/objective pairs")
-            for pair in pairs:
-                if not re.fullmatch(r"M\d+/O\d+", pair):
-                    add(path, heading, "invalid coverage pair; expected M1/O1")
-                    continue
-                mid, objective = pair.split("/")
-                if (mid, objective) in unit["coverage"]:
-                    add(path, heading, "duplicate coverage pair")
-                unit["coverage"].add((mid, objective))
-        for mid, objective in unit["coverage"]:
-            if mid not in modules or modules[mid]["objective id"] != objective:
-                add(path, heading, "coverage module/objective differs from COURSE_PLAN")
-        module = modules.get(unit["Module"])
-        if not module or module["objective id"] != unit["Objective"]:
-            add(path, heading, "unit module/objective differs from COURSE_PLAN")
-        if unit["Role"] not in ("orientation", "explanation", "check", "solution", "closing"):
-            add(path, heading, "unknown unit role")
-        if unit["Role"] == "check":
-            unit["Solution"] = field(metadata, "Solution", path, heading)
-        parts = re.split(r"(?m)^### (.+)\n", body)
-        content = list(zip(parts[1::2], parts[2::2]))
-        for key in ("Learner content", "Complete explanation", "Visual content", "Transition", "Sources"):
-            blocks = [b.strip() for k, b in content if k == key]
-            if len(blocks) != 1 or not blocks[0] or blocks[0] == "-":
-                add(path, heading, f"{key} section must occur once with content")
-        for key, block in content:
-            if key == "Sources":
-                for source in block.strip().splitlines():
-                    ref(source.removeprefix("- ").strip(), path, heading, allow_url=True)
-    source_path = path.relative_to(course_dir.parents[3]).as_posix()
-    for mid, row in modules.items():
-        for key, roles in (("explanation", {"orientation", "explanation"}), ("check", {"check"})):
-            references = _items(row[key])
-            if not references:
-                continue  # existing module checker reports missing fields
-            for value in references:
-                target, _, anchor = value.partition("#")
-                uid = anchor.upper()
-                unit = units.get(uid, {})
-                if (target != source_path or (mid, row["objective id"]) not in unit.get("coverage", set())
-                        or unit.get("Role") not in roles):
-                    add(plan_path, mid, f"{key} must locate its module's canonical content unit")
-    for uid, unit in units.items():
-        if unit["Role"] == "check":
-            solution_id = unit.get("Solution", "")
-            solution = units.get(solution_id, {})
-            if (solution.get("Role") != "solution"
-                    or not unit["coverage"].issubset(solution.get("coverage", set()))
-                    or order.index(solution_id) <= order.index(uid)):
-                add(path, uid, "check needs a subsequent solution covering every module/objective")
-    for row in values:
-        target, _, anchor = row["observable check"].partition("#")
-        unit = units.get(anchor.upper(), {})
-        covered_profiles = {modules[mid]["profile"] for mid, obj in unit.get("coverage", set()) if mid in modules}
-        if target != source_path or unit.get("Role") != "check" or row["profile"] not in covered_profiles:
-            add(path, "value", "observable check must locate a canonical check for its profile")
+               for heading in re.findall(r"^#+\s+(.+)$", text, re.M))
+
+
+def _content_contract(course_dir, plan, plan_rows, read, ref, add):
+    """Validate authored-source structure, not its pedagogical sufficiency."""
+    plan_path = course_dir / "COURSE_PLAN.md"
+
+    def field(text, key, path, item):
+        values = re.findall(r"^" + re.escape(key) + r":[ \t]*(.*)$", text, re.M)
+        if len(values) != 1 or not values[0].strip() or values[0].strip() == "-":
+            add(path, item, f"{key} must occur once with a value")
+            return ""
+        return values[0].strip()
+
+    declarations = re.findall(r"^Content contract:[ \t]*(.*)$", plan, re.M)
+    if not declarations:
+        add(plan_path, "content", "legacy course: migrate to a complete textual content contract; quality is not certified", "WARN")
+        return
+    contract = field(plan, "Content contract", plan_path, "content")
+    if contract not in ("slide-content-v1", "text-content-v1"):
+        add(plan_path, "content", "unknown content contract")
+        return
+    prefix, name = ("S", "SLIDE_CONTENT.md") if contract == "slide-content-v1" else ("U", "COURSE_CONTENT.md")
+    if prefix == "U":
+        field(plan, "Format exception", plan_path, "content")
+    path = course_dir / name
+    text = read(path, "content")
+    if text is None:
+        return
+    intro = text.split("\n## ", 1)[0]
+    if field(intro, "Course version", path, "version") != field(plan, "Course version", plan_path, "version"):
+        add(path, "version", "content version differs from COURSE_PLAN")
+    mode = field(intro, "Delivery mode", path, "delivery")
+    if mode not in ("self-study", "instructor-led"):
+        add(path, "delivery", "unknown delivery mode")
+    for key in ("Efficacy", "Feedback flow"):
+        if field(intro, key, path, key) != field(plan, key, plan_path, key):
+            add(path, key, f"{key} differs from COURSE_PLAN")
+    headers = ("profile", "baseline", "target capability", "teaching contribution", "observable check", "alternative and limits")
+    values = _table(text, headers) or []
+    expected_profiles = {row["profile"] for row in plan_rows}
+    if {row["profile"] for row in values} != expected_profiles or len(values) != len(expected_profiles):
+        add(path, "value", "Course Value must cover each taught profile exactly once")
+    for row in values:
+        if any(not row[h] or row[h] == "-" for h in headers):
+            add(path, "value", "Course Value fields must be populated; semantic review still required")
+        ref(row["observable check"], path, "value")
+    modules = {row["module id"]: row for row in plan_rows}
+    sections = re.split(r"(?m)^## (.+)\n", text)
+    units = {}
+    order = []
+    for heading, body in zip(sections[1::2], sections[2::2]):
+        if heading == "Course Value":
+            continue
+        if not re.fullmatch(prefix + r"[0-9]+", heading):
+            add(path, heading, "unexpected unit heading")
+            continue
+        if heading in units:
+            add(path, heading, "duplicate unit ID")
+        metadata = body.split("### ", 1)[0]
+        unit = {key: field(metadata, key, path, heading) for key in
+                ("Module", "Objective", "Role", "Title", "Value contribution")}
+        units[heading] = unit
+        order.append(heading)
+        unit["coverage"] = {(unit["Module"], unit["Objective"])}
+        extra_coverage = re.findall(r"^Covers:[ \t]*(.*)$", metadata, re.M)
+        if len(extra_coverage) > 1:
+            add(path, heading, "Covers must occur at most once")
+        if extra_coverage:
+            pairs = _items(extra_coverage[0])
+            if not pairs:
+                add(path, heading, "Covers must list module/objective pairs")
+            for pair in pairs:
+                if not re.fullmatch(r"M\d+/O\d+", pair):
+                    add(path, heading, "invalid coverage pair; expected M1/O1")
+                    continue
+                mid, objective = pair.split("/")
+                if (mid, objective) in unit["coverage"]:
+                    add(path, heading, "duplicate coverage pair")
+                unit["coverage"].add((mid, objective))
+        for mid, objective in unit["coverage"]:
+            if mid not in modules or modules[mid]["objective id"] != objective:
+                add(path, heading, "coverage module/objective differs from COURSE_PLAN")
+        module = modules.get(unit["Module"])
+        if not module or module["objective id"] != unit["Objective"]:
+            add(path, heading, "unit module/objective differs from COURSE_PLAN")
+        if unit["Role"] not in ("orientation", "explanation", "check", "solution", "closing"):
+            add(path, heading, "unknown unit role")
+        if unit["Role"] == "check":
+            unit["Solution"] = field(metadata, "Solution", path, heading)
+        parts = re.split(r"(?m)^### (.+)\n", body)
+        content = list(zip(parts[1::2], parts[2::2]))
+        for key in ("Learner content", "Complete explanation", "Visual content", "Transition", "Sources"):
+            blocks = [b.strip() for k, b in content if k == key]
+            if len(blocks) != 1 or not blocks[0] or blocks[0] == "-":
+                add(path, heading, f"{key} section must occur once with content")
+        for key, block in content:
+            if key == "Sources":
+                for source in block.strip().splitlines():
+                    ref(source.removeprefix("- ").strip(), path, heading, allow_url=True)
+    source_path = path.relative_to(course_dir.parents[3]).as_posix()
+    for mid, row in modules.items():
+        for key, roles in (("explanation", {"orientation", "explanation"}), ("check", {"check"})):
+            references = _items(row[key])
+            if not references:
+                continue  # existing module checker reports missing fields
+            for value in references:
+                target, _, anchor = value.partition("#")
+                uid = anchor.upper()
+                unit = units.get(uid, {})
+                if (target != source_path or (mid, row["objective id"]) not in unit.get("coverage", set())
+                        or unit.get("Role") not in roles):
+                    add(plan_path, mid, f"{key} must locate its module's canonical content unit")
+    for uid, unit in units.items():
+        if unit["Role"] == "check":
+            solution_id = unit.get("Solution", "")
+            solution = units.get(solution_id, {})
+            if (solution.get("Role") != "solution"
+                    or not unit["coverage"].issubset(solution.get("coverage", set()))
+                    or order.index(solution_id) <= order.index(uid)):
+                add(path, uid, "check needs a subsequent solution covering every module/objective")
+    for row in values:
+        target, _, anchor = row["observable check"].partition("#")
+        unit = units.get(anchor.upper(), {})
+        covered_profiles = {modules[mid]["profile"] for mid, obj in unit.get("coverage", set()) if mid in modules}
+        if target != source_path or unit.get("Role") != "check" or row["profile"] not in covered_profiles:
+            add(path, "value", "observable check must locate a canonical check for its profile")
+    title = re.search(r"^# (.+)$", text, re.M)
+    return {"path": path, "text": text, "mode": mode, "title": title.group(1).strip() if title else "",
+            "solutions": [uid for uid in dict.fromkeys(order) if units[uid]["Role"] == "solution"]}
+
+
+GUIDE_SECTIONS = ("Before the course", "Schedule", "Reserved material", "When something deviates",
+                  "After the course", "Materials")
+VERSION_MENTION = re.compile(r"\bversion[e]?\s*:?\s*v?(\d+\.[A-Za-z0-9][A-Za-z0-9.-]*)", re.I)
+COURSE_WORD = re.compile(r"\b(?:corso|course)\b", re.I)
+
+
+def _version_mentions(path, body, version, names, add):
+    """Flag a line that names the course and mentions a version other than Course version."""
+    heading = "text"
+    for line in body.splitlines():
+        if line.startswith("## "):
+            heading = line[3:].strip()
+            continue
+        if not (COURSE_WORD.search(line) or any(
+                re.search(r"(?<!\w)" + re.escape(name) + r"(?!\w)", line, re.I) for name in names if name)):
+            continue
+        for match in VERSION_MENTION.finditer(line):
+            found = match.group(1).rstrip(".")
+            if found != version:
+                add(path, heading, f"mentions course version {found}; Course version is {version}")
+
+
+def _delivery_package(root, course_dir, plan, plan_rows, contract, risks, read, add):
+    """Validate the instructor-led delivery package; structure only, never the quality of the instructions."""
+    version = (re.findall(r"^Course version:[ \t]*(.*)$", plan, re.M) or [""])[0].strip()
+    names = (course_dir.name, contract["title"])
+    if version:
+        _, _, rest = contract["text"].partition("\n## ")
+        _version_mentions(contract["path"], "## " + rest if rest else "", version, names, add)
+    guide_path = course_dir / "INSTRUCTOR_GUIDE.md"
+    if not guide_path.is_file():
+        if contract["mode"] == "instructor-led":
+            add(guide_path, "instructor guide", "instructor-led course needs INSTRUCTOR_GUIDE.md before delivery")
+        return
+    guide = read(guide_path, "instructor guide")
+    if guide is None:
+        return
+    intro, _, rest = guide.partition("\n## ")
+    body = "## " + rest if rest else ""
+    for key in ("Course version", "Feedback flow"):
+        values = re.findall(r"^" + re.escape(key) + r":[ \t]*(.*)$", intro, re.M)
+        expected = re.findall(r"^" + re.escape(key) + r":[ \t]*(.*)$", plan, re.M)
+        if len(values) != 1 or not expected or values[0].strip() != expected[0].strip():
+            add(guide_path, key, f"{key} must occur once and equal COURSE_PLAN")
+    if version:
+        _version_mentions(guide_path, body, version, names, add)
+    parts = re.split(r"(?m)^## (.+)\n", body)
+    sections = {}
+    for heading, block in zip(parts[1::2], parts[2::2]):
+        sections.setdefault(heading.strip(), []).append(block.strip())
+    for name in GUIDE_SECTIONS:
+        blocks = sections.get(name, [])
+        if len(blocks) != 1 or not blocks[0]:
+            add(guide_path, name, f"section '## {name}' must occur once with content")
+
+    def section(name):
+        return (sections.get(name) or [""])[0]
+
+    course_root = course_dir.resolve()
+    docs_root = (root / "ai_docs").resolve()
+
+    def packaged(value, item, locator_allowed):
+        """Resolve a guide path inside the project; report and return None when it is not usable."""
+        path_part, sep, anchor = value.partition("#")
+        path = Path(path_part)
+        if (not path.parts or path.is_absolute() or path.drive or path.root or ".." in path.parts
+                or (sep and (not locator_allowed or not anchor))):
+            add(guide_path, item, f"'{value}' must be a path relative to the project root, with no drive, "
+                "leading '/' or '..'" + ("" if locator_allowed else ", and no '#locator'"))
+            return None
+        target = (root / path).resolve()
+        if not target.is_relative_to(root):
+            add(guide_path, item, f"'{value}' resolves outside the project, so it cannot be delivered")
+        elif not target.exists():
+            add(guide_path, item, f"'{value}' does not exist: create it, or correct the path")
+        elif not locator_allowed and path_part.endswith("/") != target.is_dir():
+            add(guide_path, item, f"'{value}' must end with '/' exactly when it is a folder")
+        elif anchor and (not target.is_file() or not _anchor_exists(target, anchor)):
+            add(guide_path, item, f"'{value}' has no matching locator")
+        else:
+            return target
+        return None
+
+    def nested_repository(target):
+        """Read folder names only; never follow a symlink or a Windows junction out of the folder."""
+        for base, dirs, _ in os.walk(target):
+            if ".git" in dirs or "ai_docs" in dirs or Path(base, ".git").is_file():
+                return True
+            dirs[:] = [d for d in dirs if not (os.path.islink(os.path.join(base, d))
+                                               or getattr(os.path, "isjunction", lambda _: False)(
+                                                   os.path.join(base, d)))]
+        return False
+
+    rows = _table(section("Materials"), ("material", "path", "seen by", "used in")) or []
+    if not rows:
+        add(guide_path, "Materials", "Materials table must list the delivered package")
+    targets = []
+    for row in rows:
+        target = packaged(row["path"], "Materials", False)
+        if target is not None:
+            targets.append(target)
+            if target.is_dir() and target.is_relative_to(docs_root) and nested_repository(target):
+                add(guide_path, "Materials", f"'{row['path']}' holds its own repository (.git or ai_docs/) "
+                    "inside ai_docs/, so project memory indexes its files as this project's: "
+                    "keep it outside ai_docs/", "WARN")
+        if row["seen by"] not in ("instructor", "learners"):
+            add(guide_path, "Materials", f"'{row['path']}' Seen by must be instructor or learners")
+    listed = {row["path"] for row in rows}
+    materials = {value.rstrip("/") for value in listed}
+    cited = {value.rstrip(".,;:") for value in re.findall(r"(?<![\w/.])ai_docs/[^\s|`<>\"'()*]+", guide)}
+    for value in sorted(cited - listed):
+        target = packaged(value, "citation", True)
+        if target is not None and not any(target == t or target.is_relative_to(t)
+                                          for t in (course_root, *targets)):
+            add(guide_path, "citation", f"'{value}' is cited but is not in the delivered package: "
+                "list it in '## Materials' or move it into the course folder")
+    reserved = section("Reserved material")
+    for uid in contract["solutions"]:
+        if not re.search(r"\b" + re.escape(uid) + r"\b", reserved):
+            add(guide_path, uid, f"solution unit {uid} must be named in '## Reserved material'")
+    rows = _table(section("When something deviates"),
+                  ("risk id", "in class it looks like", "instructor action", "fallback material")) or []
+    if not rows:
+        add(guide_path, "When something deviates", "deviation table must have at least one row")
+    for row in rows:
+        rid = row["risk id"] or "deviation"
+        if row["risk id"] not in risks:
+            add(guide_path, rid, f"risk {rid} is not defined in P-TM.md")
+        fallback = row["fallback material"]
+        if not fallback:
+            add(guide_path, rid, "fallback material must be '-' or paths listed in '## Materials'")
+        elif fallback != "-":
+            for value in (part.strip() for part in fallback.split(",") if part.strip()):
+                if value.rstrip("/") not in materials:
+                    add(guide_path, rid, f"fallback '{value}' is not listed in '## Materials'")
+    modules = {row["module id"] for row in plan_rows}
+    rows = _table(section("Schedule"), ("session", "duration", "modules")) or []
+    if not rows:
+        add(guide_path, "Schedule", "schedule table must have at least one session")
+    for row in rows:
+        if not row["session"] or not row["duration"] or not (_items(row["modules"]) or row["modules"] == "-"):
+            add(guide_path, "Schedule", "each schedule row needs a name, a duration and its modules, "
+                "or '-' for a break or closing")
+        for mid in _items(row["modules"]):
+            if mid not in modules:
+                add(guide_path, mid, f"schedule module {mid} is not in COURSE_PLAN")
 
 
 def validate_course(root, course_dir):
@@ -448,11 +601,14 @@ def validate_course(root, course_dir):
         else:
             add(course_dir / "COURSE_PLAN.md", "efficacy",
                 "human review of efficacy evidence required", severity="WARN")
-    _content_contract(course_dir, plan, plan_rows, read, ref, add)
-    return findings
-
-
-def validate_all(root):
+    contract = _content_contract(course_dir, plan, plan_rows, read, ref, add)
+    if contract:
+        risks = {row["risk id"] for row in _table(material["P-TM.md"] or "", ("risk id",)) or []}
+        _delivery_package(root, course_dir, plan, plan_rows, contract, risks, read, add)
+    return findings
+
+
+def validate_all(root):
     root = Path(root).resolve()
     docs = root / "ai_docs"
     parent = docs / "solutions/courses"

package/skills/course-creator/scripts/sdlc_core.py

@@ -100,6 +100,10 @@ CHRONOLOGY_EPOCH = "2026-10-18"
 # filled '## Guide check'. The day AFTER the rule was written, so the analyses
 # opened that day by parallel units (which never saw the template) stay quiet.
 GUIDE_CHECK_EPOCH = "2026-10-24"
+# Owner design approval (F-087): an L3 started on/after this date owes a request-
+# record entry labelled `design approved` before implementation. The day AFTER the
+# rule was written, like GUIDE_CHECK_EPOCH.
+DESIGN_APPROVAL_EPOCH = "2026-10-31"
 NEXT_MAX_CHARS = 240        # this repository's longest `next:` was 214 at the epoch
 ID_SCAN_MAX_REFS = 300      # A3 is skipped above it (one advisory says so, T9)
 ID_SCAN_REFS_PER_CALL = 50  # keeps one git command line far below 32k chars
@@ -1479,17 +1483,50 @@ def id_advisories(root):
     return out
 
 
-def design_review_due(meta):
-    """True when an L3 ANALYSIS owes a design-review row (review.md moment 1):
-    implementation has started or finished, and it began on/after the gate
-    shipped. PLANNED is exempt -- the review is due at the END of Phase 3, so an
-    analysis still being drafted is not late."""
+def _l3_in_work_since(meta, epoch):
+    """True when an L3 ANALYSIS is in implementation or done and began on/after
+    `epoch` (an ISO date string)."""
     if meta.get("level", "").upper() != "L3":
         return False
     if meta.get("status") not in ("IN_PROGRESS", "COMPLETED"):
         return False
     started = parse_iso((meta.get("start_date") or "").strip().strip("'\""))
-    return started is not None and started >= parse_iso(DESIGN_REVIEW_EPOCH)
+    return started is not None and started >= parse_iso(epoch)
+
+
+def design_review_due(meta):
+    """True when an L3 ANALYSIS owes a design-review row (review.md moment 1):
+    implementation has started or finished, and it began on/after the gate
+    shipped. PLANNED is exempt -- the review is due at the END of Phase 3, so an
+    analysis still being drafted is not late."""
+    return _l3_in_work_since(meta, DESIGN_REVIEW_EPOCH)
+
+
+def design_approval_due(meta):
+    """True when an L3 ANALYSIS owes the owner's design approval (review.md
+    section When a review is due): in implementation or done, begun on/after
+    DESIGN_APPROVAL_EPOCH. PLANNED is exempt -- the question comes after the PASS."""
+    return _l3_in_work_since(meta, DESIGN_APPROVAL_EPOCH)
+
+
+def requests_naming(root, analysis_name):
+    """The request records whose `analysis:` field names this ANALYSIS file."""
+    req = ai_path(root, "audit", "requests")
+    if not req.is_dir():
+        return []
+    return [r for r in sorted(req.glob("REQUEST_*.md"))
+            if str(load_frontmatter(read_text(r).splitlines()).get("analysis") or "")
+            .strip().strip("'\"`") == analysis_name]
+
+
+def design_approval_logged(root, analysis_name):
+    """True when a request record naming this ANALYSIS has an entry whose LABEL
+    begins `design approved` (case-insensitive). Only the label is read, never
+    the quoted words: a quotation is data, and a 'design approved?' inside a
+    refusal approves nothing."""
+    return any(label.lower().startswith("design approved")
+               for r in requests_naming(root, analysis_name)
+               for _, _, label, _ in request_entries(read_text(r))[0])
 
 
 def review_logged(root, analysis_name):
@@ -1801,6 +1838,12 @@ def cmd_validate(root, strict=False, hybrid=False):
             advisories.append(f"{rel}: L3 in implementation with no design-review row in "
                               f"{review_log_rel()} -- the design was reviewed by nobody but its "
                               "author before code was written (review.md moment 1)")
+        if (not hybrid and design_approval_due(meta)
+                and not design_approval_logged(root, p.name)):
+            advisories.append(f"{rel}: L3 in implementation with no design approval in its "
+                              "request record (no entry whose label begins 'design approved') -- the "
+                              "owner never said the design was what they meant before the "
+                              "work started (review.md, When a review is due)")
         if ledger_due(meta) and not has_ledger_heading(text):
             advisories.append(f"{rel}: L3 without '## Capability Ledger' -- the architect pass "
                               "left no record (architect.md); run it before the Impact")
@@ -2562,7 +2605,8 @@ def cmd_gate(args):
     sys.stderr.write(
         f"[sdlc gate] '{rel}' is on a protected path but no ANALYSIS_*.md is IN_PROGRESS. "
         "If your analysis already exists, set its frontmatter to 'status: IN_PROGRESS' "
-        "(that flip is what opens the gate); otherwise write it first (Phase 3).\n")
+        "(that flip is what opens the gate; at L3, only after the owner's design approval, "
+        "review.md); otherwise write it first (Phase 3).\n")
     return 2
 
 
@@ -3063,13 +3107,9 @@ def _unit_documents(root, p):
     reading or writing any of them is working on the unit."""
     slug = p.stem[len("ANALYSIS_"):]
     docs = {p, ai_path(root, "audit", f"HANDOFF_{slug}.md")}
-    req = ai_path(root, "audit", "requests")
-    if req.is_dir():
-        for r in req.glob("REQUEST_*.md"):
-            meta = load_frontmatter(read_text(r).splitlines())
-            if str(meta.get("analysis") or "").strip().strip("'\"`") == p.name:
-                docs.add(r)
-                docs.add(ai_path(root, "audit", f"HANDOFF_{r.stem[len('REQUEST_'):]}.md"))
+    for r in requests_naming(root, p.name):
+        docs.add(r)
+        docs.add(ai_path(root, "audit", f"HANDOFF_{r.stem[len('REQUEST_'):]}.md"))
     return {_norm_rel(d.resolve().as_posix()) for d in docs}
 
 

package/skills/course-creator/scripts/shared_files.py

@@ -57,6 +57,7 @@ SHARED_FILES = (
     "scripts/test_merge_safety.py",
     "scripts/test_audit_refs.py",
     "scripts/test_constraints.py",
+    "scripts/test_design_approval.py",
     # the docs site (F-072): generator, its battery and its page
     "scripts/docs_site.py",
     "scripts/test_docs_site.py",