@cspeach/cli 1.1.27 → 1.1.29

package/dist/approvals/plan-grant.js

@@ -0,0 +1,297 @@
+import { canonicalApprovalObject } from './canonical.js';
+import { mintPlanGrantToken, verifyPlanGrantToken } from './jwt.js';
+import { normalizeObjectType, toPlannedObject } from '../projects/plan-objects.js';
+import { setRule8BatchApprovedProvider, toolSpendsApprovalId } from '../repl/rule8-detector.js';
+import { isPlanPhaseActive, getActivePlanId } from '../commands/plan-gate.js';
+import { getCurrentTransport } from '../repl/current-transport.js';
+import { loadConfig, effectiveApprovals, } from '../config/loader.js';
+let active = null;
+let boundTransport;
+let transportCreated = false;
+/** Canonical description of the one new transport the grant covered. */
+let grantCtsObject;
+/** The `approvals` setting as last read; anything but 'plan' turns the grant off for Rule 8. */
+let approvalsMode = 'per-write';
+/**
+ * Objects already offered on the "add to the approved list" card, per plan id
+ * ("TYPE:NAME"). Accepted or declined, they are never asked about again in
+ * this session. Cleared with the grant.
+ */
+const offeredDelta = new Map();
+const TR_RE = /^[A-Z0-9]{3}K\d{6}$/;
+function isLive(g) {
+    return typeof g.expiresAt === 'number' && Date.now() < g.expiresAt;
+}
+/** The grant may cover a request now: a step of ITS plan runs and it has not expired. */
+function inScope(g) {
+    return isPlanPhaseActive() && getActivePlanId() === g.planId && isLive(g);
+}
+// Rule 8's batch card stays quiet only for tools that spend an approval id
+// (each is approved one by one), never under approvals = per-write.
+setRule8BatchApprovedProvider((tool) => active !== null && approvalsMode === 'plan' && inScope(active) && toolSpendsApprovalId(tool));
+function normTransport(t) {
+    return t?.trim().toUpperCase() || undefined;
+}
+function fromPayload(p, token) {
+    return {
+        planId: p.plan_id,
+        sessionId: p.session_id,
+        objects: p.objects,
+        ...(p.transport ? { transport: p.transport } : {}),
+        newTransportAllowed: p.new_transport === true,
+        token,
+        ...(typeof p.exp === 'number' ? { expiresAt: p.exp * 1000 } : {}),
+    };
+}
+/** Record the `approvals` setting (request_approval calls this with the config it loaded). */
+export function noteApprovalsSetting(mode) {
+    approvalsMode = mode === 'plan' ? 'plan' : 'per-write';
+}
+export async function mintPlanGrant(a) {
+    const transport = normTransport(a.transport);
+    // Rows are re-validated here: a malformed or never-on-the-list row
+    // (transport, package, deploy) is dropped, never signed.
+    const objects = (Array.isArray(a.objects) ? a.objects : [])
+        .map((o) => toPlannedObject(o))
+        .filter((o) => o !== null);
+    const token = await mintPlanGrantToken({
+        plan_id: a.planId, session_id: a.sessionId, objects,
+        ...(transport ? { transport } : {}), new_transport: !transport,
+    });
+    const p = await verifyPlanGrantToken(token);
+    if (!p)
+        throw new Error('plan grant could not be signed');
+    return fromPayload(p, token);
+}
+/**
+ * Install a grant. Keeps the SIGNED payload, never the caller's copy; a token
+ * that does not verify (or names another plan or session) clears the grant.
+ * A re-mint for the SAME plan and session keeps the transport already bound
+ * and whether the one new transport was already used.
+ */
+export async function setPlanGrant(g) {
+    if (!g) {
+        clearPlanGrant();
+        return true;
+    }
+    const p = await verifyPlanGrantToken(g.token);
+    if (!p || p.plan_id !== g.planId || p.session_id !== g.sessionId) {
+        clearPlanGrant();
+        return false;
+    }
+    try {
+        noteApprovalsSetting(effectiveApprovals(await loadConfig()));
+    }
+    catch {
+        noteApprovalsSetting('per-write'); // unreadable config: Rule 8 keeps its card
+    }
+    const samePlan = active !== null && active.planId === p.plan_id && active.sessionId === p.session_id;
+    active = fromPayload(p, g.token);
+    if (samePlan) {
+        boundTransport = boundTransport ?? normTransport(p.transport);
+    }
+    else {
+        boundTransport = normTransport(p.transport);
+        transportCreated = false;
+        grantCtsObject = undefined;
+        offeredDelta.clear();
+    }
+    return true;
+}
+export function getPlanGrant() { return active; }
+/** A live grant covers requests right now (a step of its plan runs, not expired). */
+export function isPlanGrantInScope() {
+    return active !== null && approvalsMode === 'plan' && inScope(active);
+}
+/**
+ * The claims a grant-minted id carries for one covered change: the listed
+ * type, the listed row's package, and the bound transport.
+ */
+export function grantClaimsFor(c) {
+    const type = normalizeObjectType(c.type ?? '');
+    const transport = getGrantTransport();
+    const names = memberNames(c.object);
+    const row = names.length === 1 && active
+        ? active.objects.find((o) => o.type === type && o.name === names[0])
+        : undefined;
+    // Package: the listed row's; else the request's; else the grant's only
+    // package. A row with no package never yields an "any package" id when the
+    // request or the plan names one.
+    let pkg = row?.package;
+    if (!pkg && type !== 'CTS') {
+        const reqPkg = typeof c.package === 'string' ? c.package.trim().toUpperCase() : '';
+        if (reqPkg)
+            pkg = reqPkg;
+        else if (active) {
+            const pkgs = new Set(active.objects.map((o) => o.package).filter((x) => !!x));
+            if (pkgs.size === 1)
+                pkg = [...pkgs][0];
+        }
+    }
+    // A batch activate names several objects of several types: keep each
+    // member's listed type so a single-object activate can be checked too.
+    const members = names.length > 1 && active
+        ? names.map((n) => active.objects.find((o) => o.name === n)).filter((o) => !!o)
+            .map((o) => ({ type: o.type, name: o.name }))
+        : undefined;
+    return {
+        type,
+        ...(pkg ? { package: pkg } : {}),
+        ...(transport ? { transport } : {}),
+        ...(members && members.length > 0 ? { members } : {}),
+    };
+}
+export function clearPlanGrant() {
+    active = null;
+    boundTransport = undefined;
+    transportCreated = false;
+    grantCtsObject = undefined;
+    offeredDelta.clear();
+}
+/** The objects ("TYPE:NAME") already offered for this plan on the add-to-list card. */
+export function offeredDeltaObjects(planId) {
+    return offeredDelta.get(planId) ?? new Set();
+}
+/** Remember objects offered on the add-to-list card (whatever the answer). */
+export function noteDeltaOffered(planId, objects) {
+    const set = offeredDelta.get(planId) ?? new Set();
+    for (const o of objects)
+        set.add(`${o.type}:${o.name}`);
+    offeredDelta.set(planId, set);
+}
+/**
+ * May an object-list grant be minted now? Never on a production alias, never
+ * in advisory-only mode, never under `approvals = per-write` (it would cover
+ * nothing), and never when the config cannot be read. Headless runs never get
+ * here: they show no card.
+ */
+export async function planGrantAllowed(sapAlias, deps = {}) {
+    let cfg;
+    try {
+        cfg = await (deps.loadConfig ?? loadConfig)();
+    }
+    catch {
+        return false;
+    }
+    if (effectiveApprovals(cfg) !== 'plan')
+        return false;
+    const alias = sapAlias && sapAlias !== 'none' ? sapAlias : undefined;
+    const role = alias ? cfg.sap?.[alias]?.role : undefined;
+    if (role === 'prd')
+        return false;
+    const effective = (deps.effectiveWriteMode ?? (await import('../repl/mode-cycle.js')).getEffectiveWriteMode)(cfg.write_mode ?? 'approval-gated', role);
+    return effective !== 'advisory-only';
+}
+/**
+ * The default grant install for a card that approves the object list: check
+ * the policy, mint, install. True when a grant is now installed.
+ */
+export async function installPlanGrant(a, deps = {}) {
+    if (!(await planGrantAllowed(a.sapAlias, deps)))
+        return false;
+    return setPlanGrant(await mintPlanGrant({
+        planId: a.planId, sessionId: a.sessionId, objects: a.objects, ...(a.transport ? { transport: a.transport } : {}),
+    }));
+}
+/** The transport writes under this grant use (recorded at mint, or the grant's own new one). */
+export function getGrantTransport() {
+    return boundTransport ?? active?.transport;
+}
+/**
+ * The transport create the grant covered succeeded: bind its number. Only the
+ * create the grant covered (same description) binds, and only once.
+ */
+export function bindGrantTransport(transportNumber, description) {
+    const nr = normTransport(transportNumber);
+    if (!active || !transportCreated || boundTransport || !nr || !TR_RE.test(nr))
+        return false;
+    if (!grantCtsObject || canonicalApprovalObject(description) !== grantCtsObject)
+        return false;
+    boundTransport = nr;
+    return true;
+}
+const COVERED_OPS = new Set(['create', 'modify', 'activate']);
+/** The objects a change names: a batch activate may name several, comma-joined. */
+function memberNames(object) {
+    return String(object ?? '').split(',').map((m) => canonicalApprovalObject(m));
+}
+/**
+ * True only when EVERY change is a create/modify/activate of a listed object
+ * (or the one new transport the plan allowed), in a listed package, on the
+ * grant's transport — while a step of the grant's plan runs and before the
+ * grant expires. `g` must be the installed grant.
+ */
+export function grantCovers(g, changes, requestTransport) {
+    if (g !== active || !inScope(g))
+        return false;
+    if (!Array.isArray(changes) || changes.length === 0)
+        return false;
+    const tr = normTransport(requestTransport);
+    const bound = boundTransport ?? g.transport;
+    if (tr && bound && tr !== bound)
+        return false;
+    // The one new transport was covered but its number is not bound yet: no
+    // other transport may be bound in its place.
+    if (tr && !bound && transportCreated)
+        return false;
+    const grantPackages = new Set(g.objects.map((o) => o.package).filter((x) => !!x));
+    for (const c of changes) {
+        if (!c || !COVERED_OPS.has(c.op))
+            return false;
+        const type = normalizeObjectType(c.type ?? '');
+        if (type === 'WAPA')
+            return false;
+        if (type === 'CTS') {
+            // A request that names a transport AND asks for a new one is two transports.
+            if (tr)
+                return false;
+            if (!(c.op === 'create' && g.newTransportAllowed && !transportCreated && !bound))
+                return false;
+            continue;
+        }
+        // Every non-CTS change needs a BOUND transport: the plan's recorded one
+        // (or the session transport adopted at mint), or the one the grant's own
+        // transport create made (bindGrantTransport). A request never binds one,
+        // so the model cannot pick some other open transport. A named transport
+        // must equal it (checked above); with none named, the write falls back to
+        // the session transport, which must equal it. So every grant-minted id
+        // carries a transport claim.
+        if (!bound)
+            return false;
+        if (!tr && normTransport(getCurrentTransport()) !== bound)
+            return false;
+        const names = memberNames(c.object);
+        // A batch activate row carries one type for objects of several types.
+        const anyType = c.op === 'activate' && names.length > 1;
+        const reqPkg = typeof c.package === 'string' ? c.package.trim().toUpperCase() : '';
+        for (const name of names) {
+            if (!name)
+                return false;
+            const listed = g.objects.find((o) => o.name === name && (anyType || o.type === type));
+            if (!listed)
+                return false;
+            if (reqPkg) {
+                if (listed.package) {
+                    if (reqPkg !== listed.package)
+                        return false;
+                }
+                else if (grantPackages.size > 0 && !grantPackages.has(reqPkg)) {
+                    // A row with no package never means "any package" when the plan names one.
+                    return false;
+                }
+            }
+        }
+    }
+    return true;
+}
+/**
+ * Record a covered request: the one new transport is used up. A request never
+ * binds a transport (only the mint and bindGrantTransport do).
+ */
+export function noteGrantUse(changes) {
+    const cts = changes.find((c) => c.op === 'create' && normalizeObjectType(c.type ?? '') === 'CTS');
+    if (cts) {
+        transportCreated = true;
+        grantCtsObject = canonicalApprovalObject(cts.object);
+    }
+}

package/dist/commands/config-set.js

@@ -20,6 +20,7 @@ const MUTABLE_KEYS = new Set([
     'write_mode',
     'plan_mode',
     'plan_audit',
+    'approvals',
     'no_sap',
     'llm.mode',
     'llm.ai_hub_base_url',
@@ -72,6 +73,7 @@ const SYSTEM_ROLE_VALUES = ['dev', 'qas', 'prd'];
 const LLM_MODE_VALUES = ['managed', 'byok', 'ai-hub', 'local'];
 const PLAN_MODE_VALUES = ['step', 'guarded'];
 const PLAN_AUDIT_VALUES = ['on', 'off'];
+const APPROVALS_VALUES = ['plan', 'per-write'];
 /**
  * Thrown on validation failure. The outer CLI dispatcher converts to
  * `console.error` + `process.exit(exitCode)`. Throwing instead of calling
@@ -555,6 +557,14 @@ export async function runConfigSet(args) {
             }
             cfg.plan_audit = value;
             break;
+        case 'approvals':
+            // 'plan' = the plan's one approval covers its listed objects (default);
+            // 'per-write' = a card before every write.
+            if (!APPROVALS_VALUES.includes(value)) {
+                err(`Invalid approvals "${value}". Allowed: ${APPROVALS_VALUES.join(', ')}`);
+            }
+            cfg.approvals = value;
+            break;
         case 'llm.mode':
             if (!LLM_MODE_VALUES.includes(value)) {
                 err(`Invalid llm.mode "${value}". Allowed: ${LLM_MODE_VALUES.join(', ')}`);
@@ -679,6 +689,8 @@ export function validateValue(key, value) {
             return PLAN_MODE_VALUES.includes(value);
         case 'plan_audit':
             return PLAN_AUDIT_VALUES.includes(value);
+        case 'approvals':
+            return APPROVALS_VALUES.includes(value);
         case 'no_sap':
             return coerceBool(value) !== null;
         case 'llm.mode':

package/dist/commands/deploy-card.js

@@ -26,6 +26,7 @@ import { promises as fs } from 'node:fs';
 import * as path from 'node:path';
 import { readDeployYaml } from '../tools/fiori/deploy/yaml-read.js';
 import { cardLine } from '../lane/card.js';
+import { phaseDisplayTitle } from '../projects/plan-run.js';
 /** The last value of a work field across phases (last written wins, as in planCompletionLines). */
 function lastWork(phases, pick) {
     for (const p of [...phases].reverse()) {
@@ -83,13 +84,14 @@ export async function gatherDeployCardFacts(a) {
     }
     return f;
 }
-export function renderDeployCard(f, nextPhaseId) {
+/** `nextStepTitle` is the deploy step's display title (phaseDisplayTitle) — never its id. */
+export function renderDeployCard(f, nextStepTitle) {
     const v = (s, fallback) => (s ? cardLine(s) : fallback);
     const lines = [
         '',
-        `Deploy the app to SAP (next phase: ${cardLine(nextPhaseId)})`,
+        `Deploy the app to SAP (next step: ${cardLine(nextStepTitle)})`,
         `  System     ${v(f.alias, '(none)')}${f.systemUrl ? ` — ${cardLine(f.systemUrl)}` : ''}${f.client ? ` · client ${cardLine(f.client)}` : ''}`,
-        `  App        ${v(f.appDir, '(recorded by ui.build)')}`,
+        `  App        ${v(f.appDir, '(recorded by the app build step)')}`,
         `  BSP name   ${v(f.bsp, 'set in this phase (max 15 characters, Z/Y, uppercase)')}`,
         `  Package    ${v(f.package, 'set in this phase (the backend package)')}`,
         `  Transport  ${f.package === '$TMP' ? '(none — $TMP, local only)' : v(f.transport, 'the session transport')}`,
@@ -117,12 +119,15 @@ export async function askDeployCard(a) {
         ...(a.deps?.loadConfig ? { loadConfig: a.deps.loadConfig } : {}),
         ...(a.deps?.effectiveWriteMode ? { effectiveWriteMode: a.deps.effectiveWriteMode } : {}),
     });
-    a.log(...renderDeployCard(facts, a.nextPhaseId));
+    // Task 13 — the step title on screen, never the phase id.
+    const next = a.phases.find((p) => p.id === a.nextPhaseId);
+    const title = next ? phaseDisplayTitle(next, a.phases) : 'the deploy step';
+    a.log(...renderDeployCard(facts, title));
     if (facts.blocked)
         return { outcome: 'blocked', reason: facts.blocked };
     const { askYesNo, isYes } = await import('../projects/yes-no.js');
     const answer = await askYesNo({
-        question: `Deploy now — run ${a.nextPhaseId} with the stored SAP logon for ${facts.alias}?`,
+        question: `Deploy now — run ${title} with the stored SAP logon for ${facts.alias}?`,
         confirm: a.confirm,
         prompt: a.prompt,
     });

package/dist/commands/export-audit.js

@@ -33,7 +33,7 @@ export async function runExportAuditCommand(opts) {
     const costEntries = opts.costEntries ?? (await readCostLog(session.id));
     // The exported .md is a file the customer opens and forwards, so it carries
     // their credits (not our COGS) whenever credits mode is active.
-    const report = buildAuditReport({ session, costEntries, transport, credits: globalCredits.snapshot() });
+    const report = buildAuditReport({ session, costEntries, transport, credits: globalCredits.snapshot(), ...(opts.operator ? { operator: opts.operator } : {}) });
     const name = opts.filename && opts.filename.trim().length > 0
         ? opts.filename.trim()
         : defaultAuditFilename(session);

package/dist/commands/plan-audit-evidence.js

@@ -69,6 +69,29 @@ const PROTECTED_TOOL_RE = /^sap_(set_source|update_method|create_object|delete_o
 const EXISTENCE_READ_RE = /^sap_(object_structure|get_source|transport_for_object)/;
 /** Any row the auditor may see is the union of the two tiers. */
 const EVIDENCE_TOOL_RE = new RegExp(`${PROTECTED_TOOL_RE.source}|${EXISTENCE_READ_RE.source}`);
+/**
+ * 2026-10-04 (live W4 false-warn, FI Document Aging c1.design): RELEASE-STATE
+ * evidence. A design phase proves "I_JournalEntry is C1 released" by reading
+ * the API release registry — `sap_api_state`, or `sap_sql_query` against
+ * ARS_W_API_STATE (the only way to see COMPATIBILITY_CONTRACT). Neither tool
+ * matched the tiers above, so three successful ARS queries were filtered out
+ * and the auditor warned that only a sap_get_source read was "in the window".
+ * Like the existence reads these are ground truth the audited model did not
+ * author (a SELECT on the live registry), so they join the FILLABLE existence
+ * tier. sap_sql_query is admitted ONLY when the query reads an ARS_* API
+ * registry table — arbitrary data queries stay out (row-cap safety).
+ */
+const RELEASE_STATE_TOOL_RE = /^sap_api_state$/;
+const RELEASE_STATE_SQL_RE = /\bars_(?:w_)?api_\w+/i;
+/** True for a release-state proof row (tool + args). Exported for tests. */
+export function isReleaseStateRow(toolName, args) {
+    if (RELEASE_STATE_TOOL_RE.test(toolName))
+        return true;
+    if (toolName !== 'sap_sql_query' || !args || typeof args !== 'object')
+        return false;
+    const q = args.query;
+    return typeof q === 'string' && RELEASE_STATE_SQL_RE.test(q);
+}
 /**
  * CAP phase 2 (2026-09-30): a CAP phase writes LOCAL files and proves itself
  * with `cds build` + the Fiori/CAP smokes — none of which are sap_* rows. Without
@@ -138,6 +161,9 @@ const ARGS_COMPACT_CHARS = 80;
  */
 const INACTIVE_LIST_CAP = 4000;
 const ATC_RESULT_CAP = 500;
+/** Release-state rows: the auditor must see each object's RELEASE_STATE + contract, not a header. */
+const RELEASE_STATE_RESULT_CAP = 800;
+const SQL_QUERY_ARGS_CHARS = 200;
 /** Appended when the inactive-objects list itself is clipped — see the contract. */
 const INACTIVE_CLIP_MARKER = ' … (list clipped — absence not verifiable from this row; use object_structure version)';
 function resultCapFor(toolName) {
@@ -145,6 +171,8 @@ function resultCapFor(toolName) {
         return INACTIVE_LIST_CAP;
     if (/^sap_atc_run/.test(toolName))
         return ATC_RESULT_CAP;
+    if (toolName === 'sap_api_state' || toolName === 'sap_sql_query')
+        return RELEASE_STATE_RESULT_CAP;
     return RESULT_EXCERPT_CHARS;
 }
 function normalizeRow(raw, capPhase) {
@@ -176,13 +204,22 @@ function normalizeRow(raw, capPhase) {
  * arbitrary shell rows).
  */
 function isEvidenceRow(row, capPhase) {
-    return EVIDENCE_TOOL_RE.test(row.toolName) || isCapProof(row.toolName, row.args, capPhase);
+    return EVIDENCE_TOOL_RE.test(row.toolName) || isCapProof(row.toolName, row.args, capPhase)
+        || isReleaseStateRow(row.toolName, row.args);
 }
 /** Render the args as `name/type` when available, else a compact fallback. */
 function renderArgs(args) {
     if (args === null || args === undefined || typeof args !== 'object')
         return '';
     const a = args;
+    // A release-state SQL row is judged by WHICH objects it asked for — show
+    // the query itself (one line), not an 80-char JSON clip that cuts the WHERE.
+    if (typeof a.query === 'string') {
+        const q = a.query.replace(/\s+/g, ' ').trim();
+        return q.length <= SQL_QUERY_ARGS_CHARS ? q : q.slice(0, SQL_QUERY_ARGS_CHARS) + '…';
+    }
+    if (typeof a.objects === 'string')
+        return a.objects;
     const name = a.name ?? a.object_name;
     const type = a.type ?? a.object_type;
     if (typeof name === 'string' && name.length > 0) {
@@ -244,6 +281,9 @@ function renderRow(row) {
  *   are excluded — so an audit judging attempt N of a phase never sees the
  *   rows of an earlier attempt that shares the same session JSONL (two
  *   attempts in one CLI process). Untimestamped rows are kept (fail-open).
+ * - When `untilIso` is given, rows at or after it are excluded too, so the
+ *   window is [sinceIso, untilIso): in a continuous run the later phases'
+ *   rows neither leak into nor evict this phase's evidence. Fail-open too.
  * - D-F two-tier cap: chronological order is preserved (newest-last). When
  *   the evidence exceeds `maxRows` (default 60), the OLDEST existence-read
  *   rows are dropped first; a PROTECTED (write / verify-proof) row is dropped
@@ -259,6 +299,7 @@ export async function extractAuditEvidence(sessionId, opts) {
     const maxRows = opts?.maxRows ?? DEFAULT_MAX_ROWS;
     const capPhase = opts?.capPhase === true;
     const sinceIso = opts?.sinceIso;
+    const untilIso = opts?.untilIso;
     const filePath = path.join(checkpointsRoot(), sessionId, 'tool-calls.jsonl');
     let content;
     try {
@@ -287,6 +328,11 @@ export async function extractAuditEvidence(sessionId, opts) {
         // timestamp is never excluded (fail-open).
         if (sinceIso && row.at !== null && row.at < sinceIso)
             continue;
+        // 2026-10-04 (continuous run) — the phase's END bound: later phases of the
+        // same run share this JSONL; their rows must neither be judged as this
+        // phase's evidence nor evict its rows from the 60-row cap.
+        if (untilIso && row.at !== null && row.at >= untilIso)
+            continue;
         rows.push(row);
     }
     if (rows.length === 0)

package/dist/commands/plan-audit.js

@@ -170,6 +170,11 @@ export const PLAN_AUDIT_PROMPT_CONTRACT = [
     '   claim. Default this to WARN, never to fail. (This is the load-bearing rule: an unsure',
     '   judgment is a WARN, not a block.)',
     '',
+    'RELEASE-STATE claims ("C1 released", "released API"): proven by an ok sap_api_state row, or an',
+    'ok sap_sql_query row on ARS_W_API_STATE whose result lists the object with RELEASE_STATE',
+    'RELEASED (and its COMPATIBILITY_CONTRACT, e.g. C1). One such query (e.g. LIKE \'I_JOURNALENTRY%\')',
+    'can prove several objects. A sap_get_source read alone does not prove a release state.',
+    '',
     'OBJECT-LIFECYCLE PROOF TABLE (§5) — classify each claimed object by its type code (visible',
     'in the evidence rows as name/TYPE and in work.generated) and require ONLY the proof its',
     'class needs. The absence of sap_activate is a finding ONLY for the source-activatable class:',
@@ -406,7 +411,7 @@ export function parseAuditVerdict(text) {
  * unknown phase) — runPhaseAudit converts those to infra_failed.
  */
 async function buildAuditPrompt(args) {
-    const { envelope, phaseId, sessionId, sinceIso } = args;
+    const { envelope, phaseId, sessionId, sinceIso, untilIso } = args;
     if (envelope.artefactType !== 'plan') {
         throw new Error(`expected a plan envelope, got '${envelope.artefactType}'`);
     }
@@ -438,9 +443,12 @@ async function buildAuditPrompt(args) {
     const capPhase = typeof phase.layer === 'string' && phase.layer.startsWith('cap.');
     const evidence = await extractAuditEvidence(sessionId, {
         ...(sinceIso ? { sinceIso } : {}),
+        ...(untilIso ? { untilIso } : {}),
         ...(capPhase ? { capPhase } : {}),
     });
-    const windowAttr = sinceIso ? ` window="this attempt only, since ${sinceIso}"` : '';
+    const windowAttr = sinceIso
+        ? (untilIso ? ` window="this phase only, ${sinceIso} to ${untilIso}"` : ` window="this attempt only, since ${sinceIso}"`)
+        : '';
     return [
         `Independent audit of plan phase "${phaseId}" — plan "${envelope.title}" (envelope v${envelope.version}).`,
         '',
@@ -461,15 +469,22 @@ async function buildAuditPrompt(args) {
         // the first cut did, inside the static contract) was FALSE for unwindowed
         // legacy re-audits over a multi-attempt JSONL — coaching the exact
         // cross-attempt misread this fix exists to close.
-        ...(sinceIso
+        ...(sinceIso && untilIso
             ? [
-                `The <evidence> block above covers THIS phase attempt only — rows recorded before ${sinceIso}`,
-                '(earlier attempts of the same phase) have been filtered out. Judge the manifest against',
-                'exactly these rows; do not infer that a step is missing merely because an earlier attempt',
-                'is absent.',
+                `The <evidence> block above covers THIS phase only — rows before ${sinceIso} and from ${untilIso} on`,
+                '(other phases of the same run, or earlier attempts) have been filtered out. Judge the manifest against',
+                'exactly these rows; do not infer that a step is missing merely because another phase\'s rows are absent.',
                 '',
             ]
-            : []),
+            : sinceIso
+                ? [
+                    `The <evidence> block above covers THIS phase attempt only — rows recorded before ${sinceIso}`,
+                    '(earlier attempts of the same phase) have been filtered out. Judge the manifest against',
+                    'exactly these rows; do not infer that a step is missing merely because an earlier attempt',
+                    'is absent.',
+                    '',
+                ]
+                : []),
         PLAN_AUDIT_PROMPT_CONTRACT,
     ].join('\n');
 }