@cleocode/playbooks 2026.4.129 → 2026.4.131

package/dist/runtime.js

@@ -34,6 +34,8 @@
  * @task T930 — Playbook Runtime State Machine
  * @task T1261 PSYCHE E4 — contract enforcement + context boundary
  */
+import { appendFileSync, mkdirSync } from 'node:fs';
+import { dirname, join } from 'node:path';
 import { createApprovalGate, getPlaybookSecret } from './approval.js';
 import { createPlaybookApproval, createPlaybookRun, getPlaybookApprovalByToken, getPlaybookRun, updatePlaybookRun, } from './state.js';
 /**
@@ -302,18 +304,21 @@ function auditContractViolation(projectRoot, runId, nodeId, field, key, playbook
     if (!projectRoot)
         return;
     try {
-        // Lazy-import to avoid a hard dep on @cleocode/core from @cleocode/playbooks.
-        // The audit is best-effort; we swallow any dynamic import failure.
-        void import('@cleocode/core').then(({ appendContractViolation }) => {
-            appendContractViolation(projectRoot, {
-                runId,
-                nodeId,
-                field,
-                key,
-                message: `contract_violation: ${field}['${key}'] check failed on node '${nodeId}'`,
-                playbookName,
-            });
+        // Write directly via node:fs to avoid importing @cleocode/core from
+        // @cleocode/playbooks (avoids circular TS project reference issues).
+        // Follows the same ADR-039 append-only NDJSON pattern as audit.ts.
+        const filePath = join(projectRoot, '.cleo', 'audit', 'contract-violations.jsonl');
+        mkdirSync(dirname(filePath), { recursive: true });
+        const entry = JSON.stringify({
+            timestamp: new Date().toISOString(),
+            runId,
+            nodeId,
+            field,
+            key,
+            message: `contract_violation: ${field}['${key}'] check failed on node '${nodeId}'`,
+            playbookName,
         });
+        appendFileSync(filePath, `${entry}\n`, { encoding: 'utf-8' });
     }
     catch {
         // non-fatal

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cleocode/playbooks",
-  "version": "2026.4.129",
+  "version": "2026.4.131",
   "description": "Playbook DSL + runtime for CLEO — T889 Orchestration Coherence v3",
   "type": "module",
   "main": "./dist/index.js",
@@ -19,8 +19,8 @@
   "dependencies": {
     "drizzle-orm": "1.0.0-beta.22-ec7b61d",
     "js-yaml": "^4.1.0",
-    "@cleocode/contracts": "2026.4.129",
-    "@cleocode/core": "2026.4.129"
+    "@cleocode/contracts": "2026.4.131",
+    "@cleocode/core": "2026.4.131"
   },
   "devDependencies": {
     "@types/js-yaml": "^4.0.9",

package/src/runtime.ts

@@ -35,6 +35,8 @@
  * @task T1261 PSYCHE E4 — contract enforcement + context boundary
  */
 
+import { appendFileSync, mkdirSync } from 'node:fs';
+import { dirname, join } from 'node:path';
 import type { DatabaseSync } from 'node:sqlite';
 import type {
   PlaybookAgenticNode,
@@ -563,18 +565,21 @@ function auditContractViolation(
 ): void {
   if (!projectRoot) return;
   try {
-    // Lazy-import to avoid a hard dep on @cleocode/core from @cleocode/playbooks.
-    // The audit is best-effort; we swallow any dynamic import failure.
-    void import('@cleocode/core').then(({ appendContractViolation }) => {
-      appendContractViolation(projectRoot, {
-        runId,
-        nodeId,
-        field,
-        key,
-        message: `contract_violation: ${field}['${key}'] check failed on node '${nodeId}'`,
-        playbookName,
-      });
+    // Write directly via node:fs to avoid importing @cleocode/core from
+    // @cleocode/playbooks (avoids circular TS project reference issues).
+    // Follows the same ADR-039 append-only NDJSON pattern as audit.ts.
+    const filePath = join(projectRoot, '.cleo', 'audit', 'contract-violations.jsonl');
+    mkdirSync(dirname(filePath), { recursive: true });
+    const entry = JSON.stringify({
+      timestamp: new Date().toISOString(),
+      runId,
+      nodeId,
+      field,
+      key,
+      message: `contract_violation: ${field}['${key}'] check failed on node '${nodeId}'`,
+      playbookName,
     });
+    appendFileSync(filePath, `${entry}\n`, { encoding: 'utf-8' });
   } catch {
     // non-fatal
   }