@christang/keel 5.3.0 → 5.3.3

package/src/core/gates.js

@@ -134,7 +134,10 @@ function taskStart(repo, options) {
   const selection = loadSelection(repo, options);
   const task = selection.selected[0];
   const compiled = compileTaskContract(repo, selection.change, task);
-  const problems = [...compiled.diagnostics];
+  const problems = [
+    ...compiled.diagnostics,
+    ...invalidationProblems(selection.content, selection.tasks),
+  ];
   // Recording the current fingerprint is idempotent: --record replaces the
   // selected task's Contract anchor whatever it holds, so reauthorizing a task
   // whose authority changed — the path the guard's own drift messages direct
@@ -316,7 +319,30 @@ function pathAllowed(candidate, touch) {
   });
 }
 
-function scopeEvidence(repo, task, base, contract = null, change = null) {
+// A base comparison shows that a path changed, never who changed it. When a
+// task of the same change is already checked complete and declares the path in
+// its own Touch, blaming the selected task is a guess — and the wrong one often
+// enough that the per-task commit habit became an implicit requirement whose
+// diagnostic named a file the author never touched. Only a checked sibling
+// counts: an unchecked task's Touch is a plan, not a record.
+function completedSiblingOwners(tasks, selected) {
+  const owners = [];
+  for (const item of tasks || []) {
+    if (item.id === selected.id || !item.checked) continue;
+    const declared = touchEntries(item);
+    if (declared.length > 0) owners.push({ id: item.id, touch: declared });
+  }
+  return owners;
+}
+
+function scopeEvidence(
+  repo,
+  task,
+  base,
+  contract = null,
+  change = null,
+  tasks = null
+) {
   const dirtyPaths = gitPaths(repo);
   if (!base) {
     return {
@@ -358,17 +384,35 @@ function scopeEvidence(repo, task, base, contract = null, change = null) {
   // attributed as outside Touch. Other changes' directories, the archive tree,
   // and the specs/schemas trees stay attributable.
   const authoringPrefix = change ? `openspec/changes/${change}/` : null;
-  const outside = [...changed]
+  const owners = completedSiblingOwners(tasks, task);
+  const warnings = [];
+  const outside = [];
+  const candidates = [...changed]
     .map((item) => item.replace(/\\/g, "/"))
     .filter((item) => item !== "keel/guard.json")
     .filter((item) => !(authoringPrefix && item.startsWith(authoringPrefix)))
     .filter((item) => !pathAllowed(item, touch))
     .sort();
+  for (const item of candidates) {
+    const owner = owners.find((entry) => pathAllowed(item, entry.touch));
+    if (owner) {
+      // Reported, not silent: the comparison could not establish authorship,
+      // and resolving that in the selected task's favour is a judgment the
+      // author should see rather than a fact the gate discovered.
+      warnings.push(
+        `${item} is not attributed to this task: task ${owner.id} of the same `
+          + "change is checked complete and declares it in Touch. A base "
+          + "comparison cannot establish which task wrote it."
+      );
+      continue;
+    }
+    outside.push(item);
+  }
   return {
     problems: outside.map((item) =>
       problem("outside-touch", `Changed path is outside Touch: ${item}`)
     ),
-    warnings: [],
+    warnings,
   };
 }
 
@@ -481,7 +525,8 @@ function taskComplete(repo, options) {
     task,
     options.base,
     usableContract,
-    selection.change
+    selection.change,
+    selection.tasks
   );
   checks.problems.push(...scope.problems);
   const status =
@@ -501,6 +546,103 @@ function taskComplete(repo, options) {
   );
 }
 
+// Follow-up Ownership governs work a change left undone. This is the opposite
+// shape: statements left standing by work the change completed. It is asked at
+// task-start rather than change-close because the whole value is that the
+// affected paths enter Touch before implementation — asking at the close finds
+// the same facts after the reauthorization it was meant to prevent.
+//
+// A location list is refused on purpose. The text that goes stale is the text
+// the author was not already holding in mind, so a list of remembered files
+// reproduces the failure; a searchable phrase is what turns the declaration
+// into a grep. What the phrase says is the agent's judgment, not the gate's.
+function invalidationProblems(content, tasks) {
+  const heading = content.search(/^## Invalidates\s*$/m);
+  if (heading < 0) {
+    return [
+      problem(
+        "invalidation-declaration",
+        "tasks.md requires a `## Invalidates` section before its tasks are "
+          + "executable: one `- I<n>: \"searchable phrase\" — where it lives. "
+          + "Updated by: <task ids>` line per statement this change makes "
+          + "stale, using `Durable owner:` or `Discard reason:` instead when "
+          + "no task of this change updates it, or `- None.`."
+      ),
+    ];
+  }
+  const bodyStart = content.indexOf("\n", heading);
+  const remainder = bodyStart < 0 ? "" : content.slice(bodyStart + 1);
+  const nextHeading = remainder.search(/^##\s+/m);
+  const section = nextHeading < 0 ? remainder : remainder.slice(0, nextHeading);
+  if (/^\s*-\s+None\.?\s*$/im.test(section)) return [];
+  const entries = [
+    ...section.matchAll(
+      /^\s*-\s+(I\d+)\s*:\s*([\s\S]*?)(?=^\s*-\s+I\d+\s*:|(?![\s\S]))/gm
+    ),
+  ];
+  if (entries.length === 0) {
+    return [
+      problem(
+        "invalidation-declaration",
+        "Invalidates must declare each `I<n>` entry — a quoted searchable "
+          + "phrase, where it lives, and a closure (`Updated by:`, "
+          + "`Durable owner:`, or `Discard reason:`) — or `- None.`."
+      ),
+    ];
+  }
+  const problems = [];
+  for (const entry of entries) {
+    const [, id, body] = entry;
+    if (!/"[^"\n]{3,}"/.test(body)) {
+      problems.push(
+        problem(
+          "invalidation-phrase",
+          `${id} names where to look but not what to look for. Quote the `
+            + "wording a reader would search for, so the entry is a search "
+            + "rather than a reminder."
+        )
+      );
+      continue;
+    }
+    const updated = body.match(/Updated by:\s*([0-9.,\s-]+)/i);
+    const declaredOwner = body.match(/Durable owner:\s*(\S[^\n]*)/i);
+    const hasDurableOwner = Boolean(
+      declaredOwner
+      && (/^openspec\/changes\//i.test(declaredOwner[1].trim())
+        || SHARED_DURABLE_OWNER_FORMS.test(declaredOwner[1]))
+    );
+    const discarded = /Discard(?:ed)? (?:reason|rationale):\s*\S/i.test(body);
+    if (!updated && !hasDurableOwner && !discarded) {
+      problems.push(
+        problem(
+          "invalidation-closure",
+          `${id} lacks an updating task, a durable owner, or a discard `
+            + "rationale."
+        )
+      );
+      continue;
+    }
+    // Deliberately weaker than Expectation Coverage, which requires a checked
+    // task: at authoring time the updater has not run yet, so existence is the
+    // only honest assertion. Completion is then structural — the named task
+    // carries the paths in its Touch and passes its own gate.
+    if (updated) {
+      const ids = updated[1].match(/\d+(?:\.\d+)+/g) || [];
+      for (const taskId of ids) {
+        if (!tasks.some((task) => task.id === taskId)) {
+          problems.push(
+            problem(
+              "invalidation-owner",
+              `${id} names task ${taskId}, which this change does not define.`
+            )
+          );
+        }
+      }
+    }
+  }
+  return problems;
+}
+
 function expectationProblems(content, tasks) {
   const heading = content.search(/^## Expectation Coverage\s*$/m);
   if (heading < 0) {