@cspeach/cli 1.1.27 → 1.1.29

package/dist/tools/_filesystem-shared.js

@@ -371,6 +371,43 @@ export function isDenylistedPath(realAbsPath, root, platform = process.platform)
     }
     return { blocked: false, relFromRoot };
 }
+/**
+ * READ-ONLY carve-out (2026-10-04, plan sources): the project's own saved
+ * results — `.cspeach/<name>.cspeach.json` (spec-gap, plan, design, … envelopes,
+ * directly in `.cspeach/`) and `.cspeach/lane/<name>.json` (lane decisions) —
+ * are project data the developer saved, not secrets. file_read and glob may
+ * READ / LIST them; file_write / file_edit never consult this, so the
+ * envelopes stay CLI-owned for writes (audits, statuses and `from` refs can
+ * never be forged through a file tool).
+ *
+ * Narrow by construction — true only when ALL hold:
+ *   - the path is NOT under the CLI home (`~/.cspeach`: auth, config, sessions),
+ *     whatever the root (a project run from the home folder gets nothing);
+ *   - it sits inside the spelled root, at exactly one of the two shapes above
+ *     (no deeper nesting, no other `.cspeach` file such as conventions.toml);
+ *   - no NTFS alias spelling: no ':' segment, no trailing dot/space segment,
+ *     and no '~' segment (a possible 8.3 short name — fail closed);
+ *   - the basename is not in the `.env` family.
+ * `.git` / `.cspeach-design` are never matched (the shapes require `.cspeach/`).
+ */
+export function isReadOnlyProjectFile(realAbsPath, root, platform = process.platform) {
+    const isWin = platform === 'win32';
+    const native = platform === process.platform;
+    const p = isWin ? path.win32 : path.posix;
+    if (isUnderCliHome(realAbsPath, p, native))
+        return false;
+    const rel = p.relative(p.resolve(root), realAbsPath).replace(/\\/g, '/');
+    if (!relIsInside(p, rel) || rel === '')
+        return false;
+    const segments = rel.split('/');
+    if (segments.some((seg) => seg.includes(':') || seg.includes('~') || ntfsCanonicalSegment(seg) !== seg))
+        return false;
+    if (BLOCKED_BASENAME_RE.test(segments[segments.length - 1]))
+        return false;
+    const relLower = rel.toLowerCase();
+    return /^\.cspeach\/[^/]+\.cspeach\.json$/.test(relLower)
+        || /^\.cspeach\/lane\/[^/]+\.json$/.test(relLower);
+}
 export class PathOutsideRootError extends Error {
     constructor(givenPath, root) {
         super(`Path "${givenPath}" resolves outside the project root "${root}"`);

package/dist/tools/approval.js

@@ -17,7 +17,9 @@ function noteApprovedTransport(t) {
 import { mintChangeApproval } from '../approvals/jwt.js';
 import { canonicalApprovalObject } from '../approvals/canonical.js';
 import { renderPlanGate, renderPerChangeApprovalV3 } from '../approvals/render.js';
-import { loadConfig } from '../config/loader.js';
+import { loadConfig, effectiveApprovals } from '../config/loader.js';
+import { getPlanGrant, grantCovers, noteGrantUse, noteApprovalsSetting, grantClaimsFor } from '../approvals/plan-grant.js';
+import { normalizeObjectType } from '../projects/plan-objects.js';
 import { maybeShowAutoApproveNag } from '../approvals/approval-prompt.js';
 import { renderAdvisoryProposal, } from '../approvals/advisory-render.js';
 import { promptAdvisory } from '../approvals/advisory-prompt.js';
@@ -161,7 +163,9 @@ registerTool({
         // sanctioned rule-4a self-create. The very act of routing through
         // request_approval IS the user-consent gate, so it must NOT be denied here
         // — fall through to the normal approval flow (which prompts the user, whose
-        // approval is the 4a consent). Guarded-mode clients could otherwise never
+        // approval is the 4a consent; or, for the ONE new transport of a plan that
+        // had none, the plan object-list grant, whose "a new one for this build"
+        // the user already approved). Guarded-mode clients could otherwise never
         // run 4a: this backstop blocks it BEFORE the audit even runs. TIGHT: the
         // exception fires only when EVERY change is infra; a deliverable
         // (CLAS/DDLS/…) or a mixed set still denies (correct out-of-lane B3).
@@ -202,6 +206,48 @@ registerTool({
         const changes = args.changes;
         const declared = args.risk;
         const eff = effectiveRisk(declared, changes, riskCtx);
+        // 2026-10-04 (continuous run, spec §3.2) — the plan object-list grant. The
+        // developer approved these exact objects on "Build this now?" (or
+        // "Continue"); a request whose EVERY change is on that list is approved by
+        // that human answer — not an auto-approval, so it applies in guarded runs.
+        // Anything else (off the list, another package or transport, a delete, a
+        // release, a deploy) falls through to the cards below. The advisory clamp
+        // above already returned for advisory/production; approvals = per-write
+        // turns this off; a headless run never uses it.
+        // A change that is really high risk (declared high, or an object whose last
+        // syntax check found errors) always shows its card, listed or not. The
+        // auto_approve = never setting also lifts every request to high, but that
+        // is a setting, not a risk (see shownRiskReasons), so it is left out here.
+        // The approvals setting is recorded for Rule 8's batch card as well.
+        const grant = getPlanGrant();
+        const approvalsSetting = grant ? effectiveApprovals(cfg) : null;
+        if (approvalsSetting)
+            noteApprovalsSetting(approvalsSetting);
+        if (grant && !isHeadless() && approvalsSetting === 'plan'
+            && effectiveRisk(declared, changes, { ...riskCtx, autoApprovePolicy: 'medium' }).level !== 'high'
+            && ctx.session?.id === grant.sessionId
+            && grantCovers(grant, changes, args.transport)) {
+            noteGrantUse(changes);
+            const ids = [];
+            for (const c of changes) {
+                // The grant's one new transport: its id creates ONE transport, never more.
+                const oneShot = c.op === 'create' && normalizeObjectType(c.type ?? '') === 'CTS';
+                // Grant claims: the write tools hold the id to the listed type,
+                // package and bound transport.
+                ids.push(await mintChangeApproval(c, ctx.session.id, { grant: grantClaimsFor(c), ...(oneShot ? { oneShot: true } : {}) }));
+            }
+            markPlanGateApproved();
+            noteApprovedTransport(args.transport);
+            return {
+                content: JSON.stringify({
+                    approved: true,
+                    approved_by: 'the plan object list',
+                    approval_ids: ids,
+                    effective_risk: eff.level,
+                    raised_by: eff.raisedBy.map(riskReasonText),
+                }),
+            };
+        }
         // Transport shown on the approval surfaces — resolved PER OP to mirror
         // what the write tools will actually do (I2, 2026-07-05 review):
         // create-family tools fall back to the session transport, so the box may

package/dist/tools/dispatch-skill.js

@@ -33,9 +33,10 @@
  */
 import { registerTool } from './index.js';
 import { isPlanResumeCommand } from '../commands/plan-resume.js';
+export const PLAN_RESUME_DISPATCH_REASON = 'Do not dispatch /abap-plan --resume. When your plan manifest is saved, CSPeach runs the next step itself with the exact saved file. Simply end the turn now.';
 registerTool({
     name: 'dispatch_skill',
-    description: 'Queue the next user submission to a slash command the user already explicitly approved via an inquirer picker. Use this in place of telling the user "Type X at the next prompt" — re-typing what they already picked is friction. Only call this AFTER an explicit user consent (ask_question pick, picker confirmation, etc.); never from prose or a one-line suggestion. The command must start with a known slash route (e.g. "/abap-rap --from @<file>"). NEVER dispatch "/abap-plan --resume" — plan continuation is harness-owned: the CLI offers and dispatches the next phase itself after the manifest is persisted. After this tool returns, end the turn — do not also print a continuation hint.',
+    description: 'Queue the next user submission to a slash command the user already explicitly approved via an inquirer picker. Use this in place of telling the user "Type X at the next prompt" — re-typing what they already picked is friction. Only call this AFTER an explicit user consent (ask_question pick, picker confirmation, etc.); never from prose or a one-line suggestion. The command must start with a known slash route (e.g. "/abap-rap --from @<file>"). NEVER dispatch "/abap-plan --resume" — plan continuation is owned by CSPeach: when the manifest is saved, CSPeach runs the next step itself. After this tool returns, end the turn — do not also print a continuation hint.',
     isMutating: false,
     input_schema: {
         type: 'object',
@@ -75,7 +76,7 @@ registerTool({
                 is_error: true,
                 content: JSON.stringify({
                     error: 'PLAN_RESUME_HARNESS_OWNED',
-                    reason: 'Do not dispatch /abap-plan --resume. After your plan manifest is persisted, the CLI itself offers the user the next phase and dispatches the resume with the exact saved file in a fresh bounded context. Simply end the turn now.',
+                    reason: PLAN_RESUME_DISPATCH_REASON,
                 }),
             };
         }

package/dist/tools/filesystem/file-read.js

@@ -10,7 +10,7 @@
  */
 import { promises as fs } from 'node:fs';
 import { registerTool } from '../index.js';
-import { resolveSafePath, assertRealPathContained, PathOutsideRootError, DENYLIST_DESCRIPTION, isDenylistedPath } from '../_filesystem-shared.js';
+import { resolveSafePath, assertRealPathContained, PathOutsideRootError, DENYLIST_DESCRIPTION, isDenylistedPath, isReadOnlyProjectFile } from '../_filesystem-shared.js';
 import { spillToolResult, isUnderSpillRoot } from '../result-spill.js';
 import { basename } from 'node:path';
 const MAX_LINES = 2000;
@@ -45,9 +45,11 @@ export async function fileReadHandler(args, ctx) {
         }
         return { content: `error: ${err instanceof Error ? err.message : String(err)}`, is_error: true };
     }
-    // Denylist check: refuse sensitive in-root paths
+    // Denylist check: refuse sensitive in-root paths. The project's own saved
+    // results (.cspeach/*.cspeach.json, .cspeach/lane/*.json) are readable —
+    // isReadOnlyProjectFile; the write tools never get this carve-out.
     const denylist = isDenylistedPath(realAbs, ctx.cwd);
-    if (denylist.blocked) {
+    if (denylist.blocked && !isReadOnlyProjectFile(realAbs, ctx.cwd)) {
         return {
             content: `error: refusing to read sensitive path "${denylist.relFromRoot}" (denylist: ${DENYLIST_DESCRIPTION})`,
             is_error: true,

package/dist/tools/filesystem/glob.js

@@ -19,7 +19,7 @@
 import { promises as fs } from 'node:fs';
 import * as path from 'node:path';
 import { registerTool } from '../index.js';
-import { resolveSafePath, assertRealPathContained, PathOutsideRootError, isDenylistedPath, DENYLIST_DESCRIPTION, } from '../_filesystem-shared.js';
+import { resolveSafePath, assertRealPathContained, PathOutsideRootError, isDenylistedPath, isReadOnlyProjectFile, DENYLIST_DESCRIPTION, } from '../_filesystem-shared.js';
 const MAX_RESULTS = 500;
 const MAX_FILES_TRAVERSED = 10_000;
 const ALWAYS_SKIPPED_DIRS = new Set([
@@ -70,6 +70,16 @@ export function globToRegex(pattern) {
     out += '$';
     return new RegExp(out);
 }
+/** True when the pattern explicitly asks for the project's saved results. */
+export function isCspeachPattern(pattern) {
+    const p = pattern.replace(/\\/g, '/').replace(/^\.\//, '').toLowerCase();
+    return p.startsWith('.cspeach/') || p.includes('.cspeach.json');
+}
+/** True for a relPath inside the root-level `.cspeach/` folder. */
+function inCspeach(relPath) {
+    const l = relPath.toLowerCase();
+    return l === '.cspeach' || l.startsWith('.cspeach/');
+}
 export async function globHandler(args, ctx) {
     // Validate args
     if (!args.pattern || typeof args.pattern !== 'string') {
@@ -97,6 +107,12 @@ export async function globHandler(args, ctx) {
         return { content: `error: search root "${args.cwd ?? '.'}" does not exist`, is_error: true };
     }
     const regex = globToRegex(args.pattern);
+    // 2026-10-04 (plan sources) — the project's saved results live in
+    // `.cspeach/` (skipped by default: noise + CLI-owned). A pattern that
+    // names them (`.cspeach/...` or `*.cspeach.json`) walks the ROOT-level
+    // `.cspeach/` folder; each file there is listed only when it is readable
+    // (isReadOnlyProjectFile, or a carved-out work file).
+    const wantsCspeach = isCspeachPattern(args.pattern);
     const collected = [];
     let budget = MAX_FILES_TRAVERSED;
     async function walk(dir, relPrefix) {
@@ -125,7 +141,10 @@ export async function globHandler(args, ctx) {
                 continue;
             }
             if (ent.isDirectory()) {
-                if (ALWAYS_SKIPPED_DIRS.has(ent.name))
+                const intoCspeach = wantsCspeach && dir === realRoot && ent.name.toLowerCase() === '.cspeach';
+                // Inside the walked `.cspeach/` every subfolder is entered (lane/, the
+                // work subdirs); the per-file read check decides what is listed.
+                if (ALWAYS_SKIPPED_DIRS.has(ent.name) && !intoCspeach && !inCspeach(relPrefix))
                     continue;
                 await walk(path.join(dir, ent.name), relPath);
             }
@@ -136,7 +155,7 @@ export async function globHandler(args, ctx) {
                 // Denylist check on the matched path
                 const abs = path.join(dir, ent.name);
                 const denylist = isDenylistedPath(abs, ctx.cwd);
-                if (denylist.blocked)
+                if (denylist.blocked && !isReadOnlyProjectFile(abs, ctx.cwd))
                     continue;
                 let mtime = 0;
                 try {
@@ -178,7 +197,11 @@ export async function globHandler(args, ctx) {
     collected.sort((a, b) => b.mtime - a.mtime);
     const sample = collected.slice(0, MAX_RESULTS).map((f) => f.relPath);
     if (sample.length === 0) {
-        return { content: `no files match "${args.pattern}"` };
+        // A search for saved results that did not name `.cspeach/` gets the hint.
+        const hint = !wantsCspeach && /\.json$/i.test(args.pattern)
+            ? ' (saved CSPeach results live in .cspeach/ — search there with pattern ".cspeach/*.cspeach.json")'
+            : '';
+        return { content: `no files match "${args.pattern}"${hint}` };
     }
     const truncated = collected.length > MAX_RESULTS;
     const trailer = truncated

package/dist/tools/fiori/tools.js

@@ -774,6 +774,12 @@ export async function fioriDraftSmokeHandler(args, ctx, deps) {
     if (!verify.ok) {
         return { content: `error: APPROVAL_INVALID: ${verify.reason} — ${howToApprove}.`, is_error: true };
     }
+    // 2026-10-04 — the id must be one minted for this data run (type DATA), not
+    // one for the service binding object itself (e.g. a plan-list SRVB change):
+    // the smoke writes live rows, so the developer must have approved exactly that.
+    if (String(verify.payload.type ?? '').trim().toUpperCase() !== 'DATA') {
+        return { content: `error: APPROVAL_INVALID: type_mismatch — ${howToApprove}.`, is_error: true };
+    }
     if (draftSmokeApprovalsUsed.has(verify.payload.nonce)) {
         return {
             content: `error: this approval_id already ran one draft smoke — each run needs its own approval; ${howToApprove}.`,

package/dist/tools/lane/app-lane-resolve.js

@@ -306,7 +306,7 @@ registerTool({
     name: 'app_lane_resolve',
     description: 'App lane routing for /abap-app. Pass the spec file path and the signal sheet: for each fixed key a value and, ' +
         'when the value is true / a service name, an evidence quote copied word for word from the spec (max 300 chars). ' +
-        'The CLI checks the quotes, reads the system facts, the project pin and the standards file, picks the lane, ' +
+        'CSPeach checks the quotes, reads the system facts, the project pin and the standards file, picks the lane, ' +
         'shows the lane card, saves the decision file and queues the plan. Never guess a lane yourself. ' +
         'Keys: app_requested, ui_only_service (string|null), report_only, analytical, transactional, custom_ui, ' +
         'cap_external_users, cap_multi_system, cap_own_release_cycle, cap_ui_on_released_api.',

package/dist/tools/sap-read.js

@@ -258,11 +258,33 @@ registerTool({
 // -----------------------------------------------------------------------
 // 5. sap_sql_query
 // -----------------------------------------------------------------------
+/**
+ * 2026-10-04 (live run, S/4HANA 2023): a design phase guessed
+ * `SELECT object_type, object_key … FROM ars_w_api_state` → SAP HTTP 400
+ * "Unknown column name OBJECT_KEY", then retried. The columns below are the
+ * ones SAP returned for `SELECT * FROM ars_w_api_state` in that run
+ * (I_OPERATIONALACCTGDOCITEM: OBJECT_ID = OBJECT_NAME, OBJECT_TYPE DDLS,
+ * SUB_OBJECT_TYPE CDS_STOB, COMPATIBILITY_CONTRACT C1, RELEASE_STATE RELEASED).
+ */
+export const ARS_COLUMNS_HINT = 'Release state of an SAP object (C1/C2): SELECT object_id, object_type, compatibility_contract, release_state '
+    + 'FROM ars_w_api_state WHERE object_id LIKE \'I_JOURNALENTRY%\' — columns are OBJECT_ID, OBJECT_TYPE (DDLS for CDS views, '
+    + 'CLAS, BDEF, …), OBJECT_NAME, SUB_OBJECT_TYPE, SUB_OBJECT_NAME, COMPATIBILITY_CONTRACT, RELEASE_STATE, '
+    + 'SUCCESSOR_OBJECT_TYPE, SUCCESSOR_OBJECT_NAME (there is no OBJECT_KEY).';
+/** The hint for a failed ARS_* query that named an unknown column, else undefined. */
+export function arsColumnErrorHint(query, err) {
+    if (typeof query !== 'string' || !/\bars_(?:w_)?api_\w+/i.test(query))
+        return undefined;
+    const msg = err instanceof Error ? err.message : String(err);
+    if (!/unknown column/i.test(msg))
+        return undefined;
+    return `${msg}\n${ARS_COLUMNS_HINT}`;
+}
 registerTool({
     name: 'sap_sql_query',
     description: 'Execute a read-only SQL SELECT against the SAP database via ADT Data Preview. Security-sensitive tables are blocked automatically. '
         + 'Dialect limits (violations return an opaque "SAP HTTP 400: sqlQuery"): no IN-lists and at most one LIKE per WHERE clause '
-        + '(multi-OR LIKE chains are rejected) — use a single LIKE or split into separate queries.',
+        + '(multi-OR LIKE chains are rejected) — use a single LIKE or split into separate queries. '
+        + ARS_COLUMNS_HINT,
     isMutating: false,
     requiresSap: true,
     input_schema: {
@@ -274,7 +296,18 @@ registerTool({
         required: ['query'],
     },
     handler: async (args, ctx) => {
-        const result = await ctx.adt.sqlQuery(args.query, args.maxRows ?? 100);
+        let result;
+        try {
+            result = await ctx.adt.sqlQuery(args.query, args.maxRows ?? 100);
+        }
+        catch (e) {
+            // A wrong ARS_W_API_STATE column costs a failed round trip: answer with
+            // the real column list so the retry is right the first time.
+            const hint = arsColumnErrorHint(args.query, e);
+            if (hint)
+                return { content: hint, is_error: true };
+            throw e;
+        }
         return spillToolResult({ content: formatSqlTsv(result) }, ctx, 'sql', { label: 'query result' });
     },
 });
@@ -391,7 +424,8 @@ registerTool({
 // -----------------------------------------------------------------------
 registerTool({
     name: 'sap_api_state',
-    description: 'Check the ABAP Cloud / clean-core release state of SAP objects. Pass comma-separated TYPE:NAME pairs, e.g. "CLAS:CL_GUI_ALV_GRID,FUNC:BAPI_SALESORDER_GETLIST".',
+    description: 'Check the ABAP Cloud / clean-core release state of SAP objects. Pass comma-separated TYPE:NAME pairs, e.g. "CLAS:CL_GUI_ALV_GRID,FUNC:BAPI_SALESORDER_GETLIST" '
+        + '(CDS views: "DDLS:I_JOURNALENTRY"). Returns RELEASE_STATE only; for the contract (C1/C2) query ARS_W_API_STATE with sap_sql_query.',
     isMutating: false,
     requiresSap: true,
     input_schema: {

package/dist/tools/sap-write.js

@@ -25,6 +25,7 @@ import crypto from 'node:crypto';
 import { readFileSync } from 'node:fs';
 import { registerTool } from './index.js';
 import { verifyAndSpendApprovalId } from '../approvals/jwt.js';
+import { grantClaimMismatch, grantActivateMismatch, grantOwningTransportMismatch, grantOwningTransportDetail } from '../approvals/grant-claims.js';
 import { autoSnapshot, autoSnapshotClassInclude } from './snapshot.js';
 import { includeSnapshotType } from './include-snapshot.js';
 import { buildWriteChainLine } from '../renderer/verify-chain.js';
@@ -177,6 +178,12 @@ registerTool({
                 is_error: true,
             };
         }
+        // 2026-10-04 — a plan-grant id holds the write to its claims (type, package, transport).
+        {
+            const claim = grantClaimMismatch(verify.payload, { type: args.type, transport: args.transport ?? ctx.currentTransport?.get() ?? null });
+            if (claim)
+                return { content: JSON.stringify({ error: ERR.APPROVAL_INVALID, reason: claim }), is_error: true };
+        }
         const toolUseId = ctx.toolUseId ?? crypto.randomUUID();
         const startedAt = Date.now();
         // ── Rule 9 conflict warning ──────────────────────────────────────────────
@@ -193,6 +200,13 @@ registerTool({
         // If the object is already locked in an open request, write under THAT
         // request — any other transport is a guaranteed CTS lock conflict.
         const resolved = await resolveWriteTransport(ctx, args.type, args.name, args.transport);
+        // 2026-10-04 — a plan-grant id never writes into a transport other than the grant's.
+        if (grantOwningTransportMismatch(verify.payload, resolved.owning)) {
+            return {
+                content: JSON.stringify({ error: ERR.APPROVAL_INVALID, reason: 'transport_mismatch', detail: grantOwningTransportDetail(args.name, resolved.owning) }),
+                is_error: true,
+            };
+        }
         // ── Gate 2: Snapshot (Rule 7) — HARD gate ────────────────────────────────
         // Only a genuine 404 (new object) may proceed snapshot-less. A read
         // failure on a possibly-EXISTING object means no recovery copy → block.
@@ -352,6 +366,12 @@ registerTool({
                 is_error: true,
             };
         }
+        // 2026-10-04 — a plan-grant id holds the write to its claims (type, package, transport).
+        {
+            const claim = grantClaimMismatch(verify.payload, { type: 'CLAS', transport: args.transport ?? ctx.currentTransport?.get() ?? null });
+            if (claim)
+                return { content: JSON.stringify({ error: ERR.APPROVAL_INVALID, reason: claim }), is_error: true };
+        }
         const toolUseId = ctx.toolUseId ?? crypto.randomUUID();
         const startedAt = Date.now();
         // ── Rule 9 conflict warning ──────────────────────────────────────────────
@@ -366,6 +386,13 @@ registerTool({
         }
         // ── Rule 9 owning-transport check (D15/D20) ──────────────────────────────
         const resolved = await resolveWriteTransport(ctx, 'CLAS', args.class_name, args.transport);
+        // 2026-10-04 — a plan-grant id never writes into a transport other than the grant's.
+        if (grantOwningTransportMismatch(verify.payload, resolved.owning)) {
+            return {
+                content: JSON.stringify({ error: ERR.APPROVAL_INVALID, reason: 'transport_mismatch', detail: grantOwningTransportDetail(args.class_name, resolved.owning) }),
+                is_error: true,
+            };
+        }
         // ── Gate 2: Snapshot (Rule 7) — HARD gate ────────────────────────────────
         // sap_update_method always targets an EXISTING class, so a read failure
         // (non-404) means no recovery copy → block. (A genuine 404 falls through
@@ -674,6 +701,12 @@ registerTool({
                 is_error: true,
             };
         }
+        // 2026-10-04 — a plan-grant id holds the write to its claims (type, package, transport).
+        {
+            const claim = grantClaimMismatch(verify.payload, { type: args.type, package: args.package, transport: args.transport ?? ctx.currentTransport?.get() ?? null });
+            if (claim)
+                return { content: JSON.stringify({ error: ERR.APPROVAL_INVALID, reason: claim }), is_error: true };
+        }
         const toolUseId = ctx.toolUseId ?? crypto.randomUUID();
         const startedAt = Date.now();
         // No snapshot — new object has no prior source.
@@ -780,6 +813,12 @@ registerTool({
                 is_error: true,
             };
         }
+        // 2026-10-04 — a plan-grant id holds the write to its claims (type, package, transport).
+        {
+            const claim = grantClaimMismatch(verify.payload, { type: 'CLAS', transport: args.transport ?? ctx.currentTransport?.get() ?? null });
+            if (claim)
+                return { content: JSON.stringify({ error: ERR.APPROVAL_INVALID, reason: claim }), is_error: true };
+        }
         const toolUseId = ctx.toolUseId ?? crypto.randomUUID();
         const startedAt = Date.now();
         // ── Rule 9 conflict warning + 3-tier transport fallback ──────────────────
@@ -794,6 +833,13 @@ registerTool({
         // The CCIMP piece (LIMU CINC) is exactly the kind of object that sits
         // locked in a request from earlier work — battery S1's 409 root cause.
         const resolved = await resolveWriteTransport(ctx, 'CLAS', args.className, effectiveTransport);
+        // 2026-10-04 — a plan-grant id never writes into a transport other than the grant's.
+        if (grantOwningTransportMismatch(verify.payload, resolved.owning)) {
+            return {
+                content: JSON.stringify({ error: ERR.APPROVAL_INVALID, reason: 'transport_mismatch', detail: grantOwningTransportDetail(args.className, resolved.owning) }),
+                is_error: true,
+            };
+        }
         // ── Gate 2: Snapshot (Rule 7) — of the INCLUDE being overwritten ─────────
         // Not the class main source: for a behaviour pool that is an empty shell and
         // the change lives in CCIMP (2026-09-21 — the old main-source snapshot left
@@ -928,6 +974,12 @@ registerTool({
                 is_error: true,
             };
         }
+        // 2026-10-04 — a plan-grant id holds the write to its claims (type, package, transport).
+        {
+            const claim = grantClaimMismatch(verify.payload, { type: 'DOMA', package: args.package, transport: args.transport ?? ctx.currentTransport?.get() ?? null });
+            if (claim)
+                return { content: JSON.stringify({ error: ERR.APPROVAL_INVALID, reason: claim }), is_error: true };
+        }
         const toolUseId = ctx.toolUseId ?? crypto.randomUUID();
         const startedAt = Date.now();
         // No snapshot — new object has no prior source.
@@ -1061,6 +1113,12 @@ registerTool({
                 is_error: true,
             };
         }
+        // 2026-10-04 — a plan-grant id holds the write to its claims (type, package, transport).
+        {
+            const claim = grantClaimMismatch(verify.payload, { type: 'DTEL', package: args.package, transport: args.transport ?? ctx.currentTransport?.get() ?? null });
+            if (claim)
+                return { content: JSON.stringify({ error: ERR.APPROVAL_INVALID, reason: claim }), is_error: true };
+        }
         const toolUseId = ctx.toolUseId ?? crypto.randomUUID();
         const startedAt = Date.now();
         // No snapshot — new object has no prior source.
@@ -1188,6 +1246,13 @@ registerTool({
                 is_error: true,
             };
         }
+        // 2026-10-04 — a plan-grant id activates only the objects it names (every
+        // member, not just the first), with the listed type for a single object.
+        {
+            const claim = grantActivateMismatch(verify.payload, args.objects);
+            if (claim)
+                return { content: JSON.stringify({ error: ERR.APPROVAL_INVALID, reason: claim }), is_error: true };
+        }
         // Round 7 item 8e — an approval auto_approve minted (no human saw it)
         // never activates an object whose last syntax check found errors. Any
         // approval minted after the errors went through the card (risk floor).