@cspeach/cli 1.0.0 → 1.1.1

package/dist/projects/extract-plan.js

@@ -1,6 +1,9 @@
 import { parsePlanContent, PLAN_PHASE_STATUSES } from './plan-schema.js';
 import { computeNextPhase, isPhaseSatisfied } from './plan-run.js';
-const MANIFEST_RE = /<!--\s*csforge:plan-manifest\s*\n([\s\S]*?)\n\s*-->/g;
+// E2 dual-read: accept BOTH the legacy `csforge:` prefix (old artifacts on
+// customer disks carry it forever) and the current `cspeach:` prefix. Legacy
+// acceptance is permanent.
+const MANIFEST_RE = /<!--\s*(?:csforge|cspeach):plan-manifest\s*\n([\s\S]*?)\n\s*-->/g;
 // 2026-06-06 live-smoke lesson #4 (Postel): normalise model-emitted
 // `work` blocks instead of rejecting them. Models naturally write
 // `"transport": null` for "none" (schema fields are optional, NOT
@@ -56,6 +59,20 @@ function expandCompactContent(changedRaw, prior, rawStatuses) {
         if (overlay.work == null) {
             delete overlay.work;
         }
+        // Task 6 review I-1 (audit forgery seam): audit verdicts are HARNESS-
+        // authored only (plan-resume.ts / plan-chain.ts). A model-emitted overlay
+        // carrying an `audit` key could wash a persisted 'failed' verdict to
+        // 'passed' — strip it so the prior phase's audit always survives the
+        // spread below.
+        delete overlay.audit;
+        // Track 1 (phase-loss seam): `ui` (flavor/floorplan/appId) is plan-create-
+        // only — set once at plan creation, NEVER edited on resume (abap-plan
+        // SKILL.md hard rule). A resume overlay must never edit or brick it: a
+        // malformed model-written `ui` would fail the STRICT planPhaseUiSchema and
+        // reject the whole merged candidate (losing the phase), and a valid one
+        // would silently rewrite the flavor mid-plan. Strip it so the prior
+        // phase's `ui` always survives the spread below.
+        delete overlay.ui;
         normalizeWorkFields(overlay);
     }
     // 1:1 map over the PRIOR phase list — changed entries overlay their phase,
@@ -76,8 +93,11 @@ function expandCompactContent(changedRaw, prior, rawStatuses) {
     const summary = {
         total: phases.length,
         // Waived phases (C1) count as validated here — summary.validated means
-        // "done for DAG purposes", same as the tracker header tally.
-        validated: phases.filter((p) => isPhaseSatisfied(statuses[p.id])).length,
+        // "done for DAG purposes", same as the tracker header tally. Audit-aware
+        // (fix-wave): a validated-but-audit-failed phase is NOT done — same
+        // predicate call as `next` above and savePlanPatch's recompute, so the
+        // two summary fields can never disagree about the same phase.
+        validated: phases.filter((p) => isPhaseSatisfied(statuses[p.id], p.audit)).length,
         blocked: phases.filter((p) => statuses[p.id] === 'blocked').length,
         next: next?.id ?? null,
     };
@@ -86,8 +106,9 @@ function expandCompactContent(changedRaw, prior, rawStatuses) {
 /**
  * Parse the LAST plan-manifest block out of the skill's markdown output.
  * `priorContent` is the validated content of the envelope being resumed —
- * required to expand the compact shape; ignored for the full shape (seed
- * sessions pass nothing).
+ * required to expand the compact shape; on the full shape it is the source
+ * of truth for per-phase `audit` fields (Task 6 review I-1 — audits are
+ * harness-authored, never model-authored). Seed sessions pass nothing.
  */
 export function extractPlan(markdown, priorContent) {
     // Last block wins — defensive against a turn emitting more than one block.
@@ -141,8 +162,41 @@ export function extractPlan(markdown, priorContent) {
         }
         const rawPhases = rawContent?.phases;
         if (Array.isArray(rawPhases)) {
-            for (const p of rawPhases)
+            // Task 6 review I-1 (audit forgery seam, full-shape variant): the full
+            // shape replaces content wholesale, so a model omitting (or inventing)
+            // `audit` fields would erase or forge persisted verdicts — an absent
+            // audit is fail-OPEN (isAuditResolved(undefined) === true). Re-impose
+            // the prior envelope's audit onto every phase by id and strip any
+            // model-authored audit for phases the prior never audited (seed
+            // sessions have no prior → all audits stripped; audits are harness-
+            // authored only). The just-executed phase needs no exception here:
+            // finishPlanResume overwrites its audit with 'pending' on success, and
+            // carrying the prior verdict on non-success matches the compact merge.
+            const priorAudits = new Map((priorContent?.phases ?? []).map((p) => [p.id, p.audit]));
+            for (const p of rawPhases) {
                 normalizeWorkFields(p);
+                if (p !== null && typeof p === 'object' && !Array.isArray(p)) {
+                    const rec = p;
+                    const prior = typeof rec.id === 'string' ? priorAudits.get(rec.id) : undefined;
+                    if (prior !== undefined)
+                        rec.audit = prior;
+                    else
+                        delete rec.audit;
+                }
+            }
+        }
+        // Fix-wave — content.lastStop is HARNESS-authored (chain-stop records),
+        // same rule as the per-phase audits above: the full shape replaces
+        // content wholesale, so a model re-emission would silently drop the
+        // prior stop record (or forge one). Re-impose the prior envelope's
+        // lastStop; strip any model-authored one when the prior never had it
+        // (seed sessions have no prior → always stripped).
+        if (rawContent && typeof rawContent === 'object') {
+            const rc = rawContent;
+            if (priorContent?.lastStop !== undefined)
+                rc.lastStop = priorContent.lastStop;
+            else
+                delete rc.lastStop;
         }
         contentInput = obj.content;
     }

package/dist/projects/extract-test-coverage.js

@@ -25,7 +25,9 @@
  *     item-002 | ZPAYMENTS_OLD     | PROG | ZPAYMENTS_OLD_TEST     | 4 | generated
  *   -->
  */
-const MANIFEST_RE = /<!--\s*csforge:test-coverage-manifest\s*\n([\s\S]*?)\n\s*-->/;
+// E2 dual-read: accept both the legacy `csforge:` and current `cspeach:`
+// prefixes (legacy acceptance is permanent — old saved artifacts carry it).
+const MANIFEST_RE = /<!--\s*(?:csforge|cspeach):test-coverage-manifest\s*\n([\s\S]*?)\n\s*-->/;
 function parseManifestBlock(markdown) {
     const m = MANIFEST_RE.exec(markdown);
     if (!m) {

package/dist/projects/extract-upgrade.js

@@ -36,7 +36,9 @@
  * Parsing is permissive — missing optional fields produce defaults; a
  * missing manifest block throws so callers know to surface the error.
  */
-const MANIFEST_RE = /<!--\s*csforge:upgrade-manifest\s*\n([\s\S]*?)\n\s*-->/;
+// E2 dual-read: accept both the legacy `csforge:` and current `cspeach:`
+// prefixes (legacy acceptance is permanent — old saved artifacts carry it).
+const MANIFEST_RE = /<!--\s*(?:csforge|cspeach):upgrade-manifest\s*\n([\s\S]*?)\n\s*-->/;
 function parseManifestBlock(markdown) {
     const m = MANIFEST_RE.exec(markdown);
     if (!m) {

package/dist/projects/handover-md.js

@@ -0,0 +1,195 @@
+// cspeach-cli/src/projects/handover-md.ts
+//
+// Task 8 (agentic-flow, 2026-07-03) — markdown handover projection.
+//
+// Design rule (docs/strategy/2026-07-02-agentic-flow-design.md, Decision 5):
+// the .cspeach.json envelope is the SINGLE machine source of truth; this
+// markdown file is a WRITE-ONLY, deterministically regenerable projection.
+// Nothing ever reads it back as state — enforced by design: no function in
+// this module accepts markdown. One `<planBase>-handover.md` per plan family
+// (the version suffix is stripped), overwritten on every envelope save.
+//
+// renderPlanHandover is PURE and DETERMINISTIC: no Date.now(), no randomness —
+// every value derives from envelope fields, so the same envelope always
+// renders byte-identical output (regenerability is the whole contract).
+import { writeFileSync } from 'node:fs';
+import { basename, dirname, join } from 'node:path';
+import chalk from 'chalk';
+import { statusesFromItems, computeNextPhase, isPhaseSatisfied, planCompletionLines, } from './plan-run.js';
+import { projectFilename } from './filename.js';
+import { readProjectFile } from './status.js';
+/**
+ * Plain-text mirror of the tracker's auditGlyph wording (plan-run.ts) — same
+ * words, no chalk. Empty-audit phases render NO segment, matching the
+ * tracker's legacy-envelope behaviour. The `default` arm is deliberate
+ * forward-compat: an unknown future PlanAuditState reads "audit not run"
+ * instead of crashing the projection.
+ */
+function auditWords(audit) {
+    if (!audit)
+        return null;
+    switch (audit.state) {
+        case 'passed': return '✔ audited';
+        case 'warn': {
+            // Non-blocking tier — passed WITH notes. Plain-text mirror of the
+            // tracker's warn glyph; count comes from findings.
+            const n = audit.findings?.length ?? 0;
+            return `⚠ passed with ${n} note${n === 1 ? '' : 's'}`;
+        }
+        case 'waived': return `✎ waived${audit.waiveCategory ? ` (${audit.waiveCategory})` : ''}`;
+        case 'failed': return '✖ audit failed';
+        case 'not_audited_hand_edited': return '✋ hand-edited';
+        case 'pending':
+        case 'infra_failed':
+        default:
+            return '⚠ audit not run';
+    }
+}
+/**
+ * Minimal YAML scalar emitter (no library — the frontmatter fields are all
+ * scalars / string arrays). Simple token values stay bare; anything else is
+ * emitted as a JSON string, which is valid YAML 1.2 double-quoted syntax.
+ */
+function yamlScalar(v) {
+    // Bare (plain) scalar only for the safe token alphabet: starts with a
+    // non-indicator char (`@` is a YAML reserved indicator and `-` opens a
+    // block-sequence entry — both are quoted when leading, but stay fine
+    // mid-string), no `: ` (mapping ambiguity), no ` #` (comment), no
+    // trailing space. Everything else goes JSON-quoted.
+    const plainSafe = /^[A-Za-z0-9/_.][A-Za-z0-9@/_.\- ]*$/.test(v)
+        && !v.includes(': ') && !v.includes(' #') && !v.endsWith(' ');
+    return plainSafe ? v : JSON.stringify(v);
+}
+/**
+ * Audit off-switch (2026-07-06, owner) — derive `audits: on | off | mixed` for
+ * the frontmatter PURELY from phase audit-field presence, no new state:
+ * among the SATISFIED phases (the ones that actually ran to completion), an ON
+ * run leaves every one carrying an audit field (passed/waived), an OFF run
+ * leaves none. Mixed = both present (a plan run partly on, partly off).
+ * Nothing satisfied yet ⇒ 'on' (the config default; nothing has run off).
+ * Caveat: a pre-auditor legacy plan (satisfied phases, no audit fields) derives
+ * 'off' — technically "audits never existed" rather than "turned off", but the
+ * field-presence signal is honest and needs no schema addition.
+ */
+function deriveAudits(phases, statuses) {
+    const satisfied = phases.filter((p) => isPhaseSatisfied(statuses[p.id], p.audit));
+    if (satisfied.length === 0)
+        return 'on';
+    const withAudit = satisfied.filter((p) => p.audit !== undefined).length;
+    if (withAudit === 0)
+        return 'off';
+    if (withAudit === satisfied.length)
+        return 'on';
+    return 'mixed';
+}
+function progressLine(p, status) {
+    const segments = [
+        p.id,
+        p.title?.trim() || null,
+        status,
+        auditWords(p.audit),
+        p.work?.transport ? `transport ${p.work.transport}` : null,
+    ].filter((s) => s !== null && s.length > 0);
+    return `- ${segments.join(' — ')}`;
+}
+/**
+ * Render the handover markdown for a plan envelope. Pure + deterministic —
+ * see the module header. Throws on non-plan envelopes (structural misuse);
+ * the write helper below catches everything.
+ */
+export function renderPlanHandover(envelope) {
+    if (envelope.artefactType !== 'plan') {
+        throw new Error(`renderPlanHandover expects a plan envelope, got ${envelope.artefactType}`);
+    }
+    const content = envelope.content;
+    const statuses = statusesFromItems(envelope.interaction.items, content.phases);
+    // Derived status — same predicates as the DAG (never reimplemented here):
+    // all satisfied → complete; any blocked → blocked; else in-progress.
+    const allSatisfied = content.phases.every((p) => isPhaseSatisfied(statuses[p.id], p.audit));
+    const anyBlocked = content.phases.some((p) => statuses[p.id] === 'blocked');
+    const status = allSatisfied ? 'complete' : anyBlocked ? 'blocked' : 'in-progress';
+    const next = computeNextPhase(content.phases, statuses);
+    // 'done' only when genuinely complete; a deadlocked plan (no eligible phase,
+    // not all satisfied) says 'none' — 'done' would misreport a blocked plan.
+    const phaseField = next ? next.id : allSatisfied ? 'done' : 'none';
+    // The resume command uses the canonical filename reconstructed from envelope
+    // fields (deterministic). A rare on-disk `-N` collision sibling still
+    // resolves — version-less/newest-version resolution in plan-resume.ts
+    // matches the whole family.
+    const nextAction = allSatisfied
+        ? planCompletionLines(content.phases).join(' ')
+        : `/abap-plan --resume @${projectFilename({
+            title: envelope.title, artefactType: 'plan', id: envelope.id, version: envelope.version,
+        })}`;
+    const artifacts = content.phases.flatMap((p) => p.work?.generated ?? []);
+    const audits = deriveAudits(content.phases, statuses);
+    const lines = [
+        '---',
+        `status: ${status}`,
+        `audits: ${audits}`,
+        `phase: ${yamlScalar(phaseField)}`,
+        `next-action: ${yamlScalar(nextAction)}`,
+        `artifacts: [${artifacts.map(yamlScalar).join(', ')}]`,
+        `envelope-version: ${envelope.version}`,
+        '---',
+        `# ${envelope.title} — plan handover`,
+        '',
+        '## Progress',
+        '',
+        ...content.phases.map((p) => progressLine(p, statuses[p.id] ?? 'todo')),
+        '',
+        '## Last stop',
+        '',
+    ];
+    const stop = content.lastStop;
+    lines.push(stop
+        ? `${stop.phaseId} — ${stop.reason}${stop.detail ? ` — ${stop.detail}` : ''} (${stop.at})`
+        : '(none)');
+    lines.push('', '## Decisions & notes', '');
+    const noted = content.phases.filter((p) => (p.work?.notes ?? '').trim().length > 0);
+    if (noted.length === 0) {
+        lines.push('(none)');
+    }
+    else {
+        for (const p of noted) {
+            lines.push(`### ${p.id}`, '', p.work.notes.trim(), '');
+        }
+        lines.pop(); // drop the trailing blank inside the section
+    }
+    return lines.join('\n') + '\n';
+}
+/**
+ * The projection's path for an envelope path: version suffix (`-vN` and any
+ * `-vN-M` collision sub-suffix from saveProject) stripped, so ONE handover
+ * file per plan family is overwritten across versions —
+ * `hr-extract-plan-ab12-v3.cspeach.json` → `hr-extract-plan-ab12-handover.md`.
+ */
+export function handoverPathFor(envelopePath) {
+    const name = basename(envelopePath);
+    const base = name.replace(/(?:-v\d+(?:-\d+)?)?\.cspeach\.json$/, '');
+    return join(dirname(envelopePath), `${base}-handover.md`);
+}
+/**
+ * Regenerate `<planBase>-handover.md` beside a just-saved plan envelope.
+ * Reads the ENVELOPE back from `savedPath` (reading the envelope is fine —
+ * it is the source of truth; the .md is never read). Best-effort by design:
+ * any failure logs one dim line and returns null — projection loss must
+ * never break the run. Returns the written path on success; null for
+ * non-plan envelopes and on any failure.
+ */
+export function writePlanHandover(savedPath, log) {
+    const logFn = log ?? ((...lines) => { for (const l of lines)
+        console.log(l); });
+    try {
+        const envelope = readProjectFile(savedPath);
+        if (envelope.artefactType !== 'plan')
+            return null;
+        const target = handoverPathFor(savedPath);
+        writeFileSync(target, renderPlanHandover(envelope), 'utf8');
+        return target;
+    }
+    catch (e) {
+        logFn(chalk.dim(`[plan] handover markdown not regenerated (${e instanceof Error ? e.message : String(e)}) — the envelope remains the source of truth.`));
+        return null;
+    }
+}

package/dist/projects/index.js

@@ -1,6 +1,6 @@
 export { planContentSchema, parsePlanContent, PLAN_LAYERS, PLAN_DELEGATE_SKILLS, PLAN_PHASE_STATUSES } from './plan-schema.js';
 export { extractPlan } from './extract-plan.js';
-export { statusesFromItems, computeNextPhase, renderPlanTracker, buildPlanRevision, isPhaseSatisfied } from './plan-run.js';
+export { statusesFromItems, computeNextPhase, renderPlanTracker, buildPlanRevision, isPhaseSatisfied, isAuditResolved } from './plan-run.js';
 export { validateEnvelope } from './validate.js';
 export { canonicalSha256 } from './canonicalize.js';
 export { titleSlug, shortId, projectFilename } from './filename.js';

package/dist/projects/plan-run.js

@@ -8,14 +8,45 @@
 import chalk from 'chalk';
 /** Statuses a dead session may have left behind — resumable, picked before fresh `todo`s. */
 const IN_PROGRESS = ['designing', 'building', 'verifying'];
+/**
+ * Auditor verdict resolution (2026-07-03 agentic-flow design). A phase's
+ * audit is RESOLVED when the independent auditor passed it or the user
+ * explicitly waived the findings. An ABSENT audit is resolved too — legacy
+ * envelopes (phases validated before the auditor existed) must remain
+ * satisfied, or every pre-audit plan would deadlock on resume.
+ */
+export function isAuditResolved(audit) {
+    if (!audit)
+        return true; // legacy envelope — pre-auditor phases stay satisfied
+    // 'warn' (confidence-tiered redesign, 2026-07-08) is the NON-BLOCKING tier:
+    // the phase passed with notes, so — exactly like a pass or an explicit waiver
+    // — it RESOLVES the audit and unlocks dependants. The notes ride along on
+    // audit.findings and are surfaced by the tracker glyph + the chain render.
+    //
+    // 'infra_failed' (audit-infra-continue, 2026-07-09) is RESOLVED too, for a
+    // different reason: the audit could not RUN (the model call returned no
+    // output after its in-turn retries). An audit that can't run is not a finding
+    // against the work — and the phase already passed its own exit gate
+    // (activation + ATC) — so walling verified work on an infra outage is wrong.
+    // It resolves like a warn: dependants unlock, the chain continues, and the
+    // "not verified" fact is surfaced (loud chain note + the ⚠ audit-not-run
+    // glyph) and recorded (state stays infra_failed; NOT laundered to waived).
+    return audit.state === 'passed' || audit.state === 'waived'
+        || audit.state === 'warn' || audit.state === 'infra_failed';
+}
 /**
  * C1 (2026-06-11, D30 waiver) — a phase counts as DONE for DAG purposes when
  * it is 'validated' OR 'validated-with-waiver' (exit gate not met, but the
  * user explicitly waived it). Single predicate so eligibility, summary
  * counting, and the "plan complete" checks can never drift apart.
+ *
+ * 2026-07-03 (agentic-flow): additionally, when the phase carries an auditor
+ * verdict, it must be resolved (passed/waived) — a validated-but-audit-failed
+ * phase does NOT unlock dependants. The param is optional so pre-audit call
+ * sites keep their exact behaviour.
  */
-export function isPhaseSatisfied(s) {
-    return s === 'validated' || s === 'validated-with-waiver';
+export function isPhaseSatisfied(s, audit) {
+    return (s === 'validated' || s === 'validated-with-waiver') && isAuditResolved(audit);
 }
 /**
  * Phase status lives in interaction.items (store convention). Build the
@@ -38,13 +69,16 @@ export function statusesFromItems(items, phases) {
  * re-entered from the top, gates and grounding included.
  */
 export function computeNextPhase(phases, statuses) {
+    // Audit verdicts live on the phase objects, not the status map — look each
+    // dependency up so a validated-but-audit-failed phase gates its dependants.
+    const byId = new Map(phases.map((p) => [p.id, p]));
     for (const p of phases) {
         const s = statuses[p.id] ?? 'todo';
-        if (isPhaseSatisfied(s) || s === 'blocked')
+        if (isPhaseSatisfied(s, p.audit) || s === 'blocked')
             continue;
         if (s !== 'todo' && !IN_PROGRESS.includes(s))
             continue;
-        if (p.entryCriteria.every((dep) => isPhaseSatisfied(statuses[dep])))
+        if (p.entryCriteria.every((dep) => isPhaseSatisfied(statuses[dep], byId.get(dep)?.audit)))
             return p;
     }
     return null;
@@ -105,6 +139,33 @@ function phaseDetail(p, s) {
     }
     return shortGate(p.exitGate);
 }
+/**
+ * Auditor-verdict glyph rendered after the phase status (2026-07-03,
+ * agentic-flow). Empty string when the phase carries no audit — legacy
+ * envelopes must render byte-identical to the pre-audit tracker.
+ */
+function auditGlyph(audit) {
+    if (!audit)
+        return '';
+    switch (audit.state) {
+        case 'passed': return ` ${chalk.green('✔ audited')}`;
+        case 'warn': {
+            // Non-blocking tier: validated-WITH-NOTES. Distinct from a clean pass and
+            // from the "not run" states — it ran, passed, and carries N notes.
+            const n = audit.findings?.length ?? 0;
+            return ` ${chalk.yellow(`⚠ ${n} note${n === 1 ? '' : 's'}`)}`;
+        }
+        case 'waived': return ` ${chalk.yellow(`✎ waived${audit.waiveCategory ? ` (${audit.waiveCategory})` : ''}`)}`;
+        case 'failed': return ` ${chalk.red('✖ audit failed')}`;
+        case 'not_audited_hand_edited': return ` ${chalk.yellow('✋ hand-edited')}`;
+        case 'pending':
+        case 'infra_failed':
+        default:
+            // `default` is deliberate forward-compat, not a missed case: an unknown
+            // future PlanAuditState renders "⚠ audit not run" instead of crashing.
+            return ` ${chalk.yellow('⚠ audit not run')}`;
+    }
+}
 /**
  * Plan-progress board — a Claude-Code-style checkbox task list. Each phase is
  * named for the work it does (not its mechanical id), so the reader can follow
@@ -118,7 +179,10 @@ export function renderPlanTracker(a) {
     const total = a.content.phases.length;
     // Waived phases count as done in the header tally — the DAG treats them as
     // satisfied; the per-line "✓* (waived)" marker carries the distinction.
-    const validated = a.content.phases.filter((p) => isPhaseSatisfied(a.statuses[p.id])).length;
+    // Audit-aware (2026-07-03): a validated-but-audit-failed phase must NOT
+    // count as done, or the header would say "N/N done" while the completion
+    // check refuses to complete — the tally uses the same predicate as the DAG.
+    const validated = a.content.phases.filter((p) => isPhaseSatisfied(a.statuses[p.id], p.audit)).length;
     if (a.includeHeader !== false) {
         lines.push(chalk.dim(`─ ${a.title} (v${a.version}) · ${validated}/${total} done ─`));
         lines.push('');
@@ -129,28 +193,37 @@ export function renderPlanTracker(a) {
         const title = phaseTitle(p);
         const detail = phaseDetail(p, s);
         const dash = detail ? ` — ${detail}` : '';
+        // Auditor verdict after the status — '' on legacy phases (no audit field),
+        // so pre-audit envelopes render byte-identical.
+        const audit = auditGlyph(p.audit);
         if (s === 'validated') {
-            lines.push(chalk.dim(`  ☒ ${title}${dash}`));
+            lines.push(chalk.dim(`  ☒ ${title}${dash}`) + audit);
         }
         else if (s === 'validated-with-waiver') {
             // C1 (D30 waiver) — done-but-waived: the exit gate was never met; the
             // user accepted it anyway. Distinct marker so a tracker reader can tell
             // a verified phase from a waived one at a glance.
-            lines.push(chalk.dim(`  ☒ ${title}${dash}`) + ` ${chalk.yellow('✓* (waived)')}`);
+            lines.push(chalk.dim(`  ☒ ${title}${dash}`) + ` ${chalk.yellow('✓* (waived)')}` + audit);
         }
         else if (s === 'blocked') {
-            lines.push(`  ${chalk.red('☐')} ${chalk.red(title)} ${chalk.red('— blocked')}${detail ? chalk.dim(` · ${detail}`) : ''}`);
+            lines.push(`  ${chalk.red('☐')} ${chalk.red(title)} ${chalk.red('— blocked')}${detail ? chalk.dim(` · ${detail}`) : ''}${audit}`);
         }
         else if (isCurrent) {
-            lines.push(`  ${chalk.hex(PEACH)('☐')} ${chalk.bold(title)}${dash}  ${chalk.hex(PEACH).bold('◀ now')}`);
+            lines.push(`  ${chalk.hex(PEACH)('☐')} ${chalk.bold(title)}${dash}${audit}  ${chalk.hex(PEACH).bold('◀ now')}`);
         }
         else if (IN_PROGRESS.includes(s)) {
-            lines.push(`  ${chalk.hex(PEACH)('☐')} ${chalk.bold(title)}${dash}  ${chalk.dim(`(${s})`)}`);
+            lines.push(`  ${chalk.hex(PEACH)('☐')} ${chalk.bold(title)}${dash}${audit}  ${chalk.dim(`(${s})`)}`);
         }
         else {
-            lines.push(`  ☐ ${title}${chalk.dim(dash)}`);
+            lines.push(`  ☐ ${title}${chalk.dim(dash)}${audit}`);
         }
     }
+    // Off-switch footer — honesty: state plainly that this run's phases are not
+    // being audited. Rendered only when the caller threads auditsOff (in-memory).
+    if (a.auditsOff) {
+        lines.push('');
+        lines.push(chalk.dim('  audits: off'));
+    }
     return lines.join('\n');
 }
 /* ── plan-complete chaining (C2, 2026-06-11, D24) ───────────────────────── */
@@ -201,6 +274,42 @@ export function findServiceBinding(phases) {
  */
 export function planCompletionLines(phases) {
     const lines = ['Plan complete — every phase validated.'];
+    // Confidence-tiered redesign (2026-07-08): a completed plan that carried
+    // non-blocking warn verdicts surfaces them in the FINAL summary — a warned
+    // phase shows its notes, so an "all validated" plan never hides that a phase
+    // passed WITH reservations. (Empty when no phase warned ⇒ byte-identical to
+    // the pre-warn completion message.)
+    for (const p of phases) {
+        if (p.audit?.state !== 'warn')
+            continue;
+        const notes = p.audit.findings ?? [];
+        lines.push(notes.length > 0
+            ? `⚠ ${p.id} passed with ${notes.length} note${notes.length === 1 ? '' : 's'}: ${notes.join('; ')}.`
+            : `⚠ ${p.id} passed with notes.`);
+    }
+    // §10 Q2 (audit-confidence redesign): a waived phase surfaces its light
+    // category + reason in the FINAL summary — an "all validated" plan never
+    // hides that a gate was a human override, and the category (false-positive
+    // vs accepted-risk) is right there for the reader. Legacy waivers without a
+    // category degrade to a bare `waived:` line (back-compat).
+    for (const p of phases) {
+        if (p.audit?.state !== 'waived')
+            continue;
+        const cat = p.audit.waiveCategory ? ` (${p.audit.waiveCategory})` : '';
+        const reason = p.audit.waivedReason ? `: ${p.audit.waivedReason}` : '';
+        lines.push(`✎ ${p.id} waived${cat}${reason}.`);
+    }
+    // audit-infra-continue (2026-07-09): a phase whose audit could NOT RUN
+    // surfaces in the FINAL summary as a DISTINCT "unverified" line — an "all
+    // validated" plan must never hide that a phase shipped without an independent
+    // audit. It is framed as an infrastructure failure (not a code finding) and
+    // NOT as a waiver (the user never asserted acceptance). Empty when no phase
+    // hit infra ⇒ byte-identical to the pre-fix completion message.
+    for (const p of phases) {
+        if (p.audit?.state !== 'infra_failed')
+            continue;
+        lines.push(`⚠ ${p.id} was NOT audit-verified (audit infrastructure failed — its own exit gate, activation + ATC, passed).`);
+    }
     const hasUi = phases.some((p) => p.layer === 'ui' || p.delegateTo === 'abap-fiori-build');
     const hasService = phases.some((p) => p.layer === 'service');
     if (!hasUi && hasService) {
@@ -209,6 +318,13 @@ export function planCompletionLines(phases) {
             ? `Backend complete. Next: /abap-fiori-build — point it at ${binding}.`
             : 'Backend complete. Next: /abap-fiori-build — point it at the published service binding.');
     }
+    // Last-written-wins: the LAST ui phase carrying a deployedUrl, matching
+    // buildUiPhaseContext's reverse-scan resolution (both consume ui work that
+    // ui.deploy records — direction must agree between the two sites).
+    const deployed = [...phases].reverse().find((p) => p.layer === 'ui' && p.work?.deployedUrl);
+    if (deployed?.work?.deployedUrl) {
+        lines.push(`App deployed: ${deployed.work.deployedUrl}`);
+    }
     lines.push('Consider /abap-preflight on the produced transport(s) before release.');
     return lines;
 }
@@ -224,7 +340,14 @@ export function planCompletionLines(phases) {
  *  - item comments / answers added via the editor survive the revision —
  *    only the status comes from the new extract
  */
-export function buildPlanRevision(original, extract, author, nowIso) {
+export function buildPlanRevision(original, extract, author, nowIso, 
+/**
+ * Task 6 (2026-07-03): optional history-entry summary. Audit-verdict
+ * revisions carry no phase-status diff, so the default "resume run — no
+ * phase status change" would hide WHY the version exists; callers like
+ * applyAuditResult pass e.g. "audit c1.design: failed (2 findings)".
+ */
+summaryOverride) {
     if (original.artefactType !== 'plan') {
         throw new Error(`buildPlanRevision expects a plan envelope, got ${original.artefactType}`);
     }
@@ -241,7 +364,8 @@ export function buildPlanRevision(original, extract, author, nowIso) {
         if (before !== after)
             diffs.push(`${p.id}: ${before} → ${after}`);
     }
-    const summary = diffs.length > 0 ? diffs.join('; ') : 'resume run — no phase status change';
+    const summary = summaryOverride
+        ?? (diffs.length > 0 ? diffs.join('; ') : 'resume run — no phase status change');
     return {
         ...original,
         lastEditedAt: nowIso,

package/dist/projects/plan-schema.js

@@ -56,7 +56,71 @@ const planPhaseWorkSchema = z.object({
     notes: z.string().optional(),
     // C2 (D24): exact SRVB name for the plan-complete /abap-fiori-build chain.
     binding: z.string().optional(),
+    // Track 1 ui-phase fields — tolerant on purpose (written mid-resume by the
+    // model; a malformed value must degrade to undefined, never fail the whole
+    // envelope parse). Keep in sync with PlanPhaseWork in types.ts.
+    app: z.object({ dir: z.string().min(1) }).optional().catch(undefined),
+    service: z.object({
+        url: z.string().min(1).optional(),
+        path: z.string().min(1).optional(),
+        version: z.enum(['2.0', '4.0']).optional(),
+    }).optional().catch(undefined),
+    deployedUrl: z.string().min(1).optional().catch(undefined),
 }).passthrough();
+export const PLAN_UI_FLAVORS = ['fiori-elements', 'freestyle'];
+export const PLAN_UI_FLOORPLANS = ['listReport', 'worklist', 'ovp', 'alp'];
+// Strict on purpose: written once at plan-create under save validation —
+// a bad flavor must fail the save, not silently degrade.
+const planPhaseUiSchema = z.object({
+    flavor: z.enum(PLAN_UI_FLAVORS),
+    floorplan: z.enum(PLAN_UI_FLOORPLANS).optional(),
+    appId: z.string().min(1).optional(),
+    appTitle: z.string().min(1).optional(),
+});
+/** Keep in sync with PlanAuditState in types.ts. 'warn' is the non-blocking
+ * tier (confidence-tiered redesign, 2026-07-08) — persisted literally so a
+ * warned phase records its notes and renders distinctly from a clean pass. */
+export const PLAN_AUDIT_STATES = [
+    'pending', 'passed', 'warn', 'failed', 'infra_failed', 'waived', 'not_audited_hand_edited',
+];
+/**
+ * Reasons a chain stop can record on content.lastStop. Keep in sync with
+ * PlanContent['lastStop']['reason'] in types.ts (same single-source pattern
+ * as PLAN_AUDIT_STATES/PlanAuditState — the zod enum below derives from this).
+ */
+export const PLAN_STOP_REASONS = [
+    'write-phase', 'audit-failed', 'audit-infra', 'deviation',
+];
+/**
+ * §10 Q2 (audit-confidence tiered redesign, 2026-07-08): the light category a
+ * human waive records so the audit's false-positive rate is measurable. Keep in
+ * sync with PlanWaiveCategory in types.ts (the zod enum below derives from it).
+ */
+export const PLAN_WAIVE_CATEGORIES = ['false-positive', 'accepted-risk'];
+const planPhaseAuditSchema = z.object({
+    state: z.enum(PLAN_AUDIT_STATES),
+    findings: z.array(z.string()).optional(),
+    waivedReason: z.string().optional(),
+    // §10 Q2 (2026-07-08): light waive category (see PlanPhaseAudit in types.ts).
+    // Must be listed here or z.object strips it on the next parse — losing the
+    // datum the audit FP-rate query depends on. Optional for back-compat: legacy
+    // waivers carry no category and must still parse.
+    waiveCategory: z.enum(PLAN_WAIVE_CATEGORIES).optional(),
+    at: z.string().optional(),
+    // Task 6 (2026-07-03): evidence-session pointer + consecutive-failure
+    // counter (see PlanPhaseAudit in types.ts). Both MUST be in the schema —
+    // z.object strips unknown keys, so an unlisted field would be silently
+    // dropped on the next parse and the counter/evidence pointer lost.
+    sessionId: z.string().optional(),
+    // D-B review item 1 (2026-07-05): attempt-window cutoff for re-audits (see
+    // PlanPhaseAudit in types.ts). Must be in the schema or z.object strips it.
+    attemptStartedAt: z.string().optional(),
+    consecutiveFailures: z.number().int().nonnegative().optional(),
+});
+/** Fail-safe write-ness: a phase that doesn't declare is treated as writing. */
+export function phaseWrites(phase) {
+    return phase.writes !== false;
+}
 const planPhaseSchema = z.object({
     id: z.string().min(1),
     // C2 (D29): optional short human name for the tracker board; old envelopes
@@ -69,6 +133,9 @@ const planPhaseSchema = z.object({
     manifest: planPhaseManifestSchema,
     exitGate: z.string().min(1),
     approval: z.boolean().optional(),
+    writes: z.boolean().optional(),
+    ui: planPhaseUiSchema.optional(),
+    audit: planPhaseAuditSchema.optional(),
     work: planPhaseWorkSchema.optional(),
 });
 /**
@@ -140,6 +207,12 @@ export const planContentSchema = z
         blocked: z.number().int().nonnegative(),
         next: z.string().nullable(),
     }),
+    lastStop: z.object({
+        phaseId: z.string().min(1),
+        reason: z.enum(PLAN_STOP_REASONS),
+        detail: z.string().optional(),
+        at: z.string(),
+    }).optional(),
 })
     .superRefine((content, ctx) => {
     // mode:'revision' requires a revision target map (the discovered live stack).