@deksden-com/dd-flow-cli 0.9.0-beta.119 → 0.9.0-beta.121

package/dist/services/vnext-plan.js

@@ -201,6 +201,7 @@ export function prepareVnextPlanArtifacts(context, input) {
     const batch = path.join(input.home, "03-plan", "code-work-batch.json");
     const ownership = protocolOwnership(input.home, input.protocols);
     const obligations = acceptedObligations(input.home);
+    const mergeEnding = runEndsAtMerge(context, input.projectRoot, input.runId);
     const frozenDocumentBaselines = input.publishBatch === false && fs.existsSync(batch)
         ? new Map(readJson(batch).works?.flatMap((work) => typeof work.key === "string" ? (work.document_updates ?? []).flatMap((update) => typeof update.path === "string" && (typeof update.baseline_sha256 === "string" || update.baseline_sha256 === null)
             ? [[`${work.key}\u0000${update.path}`, update.baseline_sha256]]
@@ -214,7 +215,7 @@ export function prepareVnextPlanArtifacts(context, input) {
         try {
             const { value } = prepareJsonSchema(file, "PLAN", { schemaName: "vnext-protocol-plan", projectRoot: workspaceRoot, ddFlowHome: context.ddFlowHome, runId: input.runId, runRoot: input.home });
             assertPlanIdentity(value, planIdentity(input.home, input.runId, protocolId, ownership.get(protocolId) ?? []), file);
-            validatePlanSemantics(file, value, new Set(ownership.get(protocolId) ?? []), obligations);
+            validatePlanSemantics(file, value, new Set(ownership.get(protocolId) ?? []), obligations, mergeEnding);
             validateCodeCheckCommands(workspaceRoot, value.checks.filter((check) => check.availability === "available").map((check) => check.command));
             for (const check of value.checks.filter((item) => item.availability === "available"))
                 validateCheckDeclaration(workspaceRoot, check);
@@ -481,7 +482,7 @@ function normalizedAspectMapRefs(file, bytes, projectRoot, runHome, runId) {
             aspect.planned_artifact_refs = aspect.planned_artifact_refs.map(normalize);
     return changed ? `${JSON.stringify(map, null, 2)}\n` : bytes;
 }
-function projectCodeWorkBatch(input) {
+export function projectCodeWorkBatch(input) {
     const obligationMap = acceptedObligationMap(input.home);
     const orientation = projectOrientation(input.workspaceRoot);
     const works = input.plans.flatMap(({ protocolId, file, value }) => value.items.map((item) => {
@@ -516,10 +517,9 @@ function projectCodeWorkBatch(input) {
                 ])],
             discovery_boundary: item.execution_context.discovery_boundary,
             planned_write_areas: [...new Set([...item.execution_context.planned_write_areas, ...documentPaths])],
-            // A criterion belongs to every listed Work. Its proof must travel with
-            // those Work packets as well as item-local verification; otherwise CODE
-            // silently loses readiness/code checks declared only by acceptance.
-            checks: value.checks.filter((check) => itemCheckRefs(item, value.acceptance).includes(check.id)),
+            // CODE still needs acceptance-only aggregate declarations in its packets;
+            // work checks belong only to the item that explicitly verifies them.
+            checks: value.checks.filter((check) => itemCheckRefs(item, value.acceptance, value.checks).includes(check.id)),
             provides_checks: value.checks.filter((check) => check.availability === "planned" && check.provided_by === item.id),
             stop_conditions: item.execution_context.stop_conditions,
             depends_on: item.depends_on.map((dependency) => `${protocolId}:${dependency}`),
@@ -548,10 +548,15 @@ function projectCodeWorkBatch(input) {
     const ordered = [...works].sort((a, b) => a.key.localeCompare(b.key));
     return { schema_id: "dd-flow/code-work-batch@5", sources: input.plans.map(({ protocolId, file, value }) => ({ plan_id: value.plan_id, protocol_id: protocolId, revision: value.revision, sha256: checksum(file) })), works: ordered };
 }
-function itemCheckRefs(item, acceptance) {
-    return [...new Set([...item.verification.check_refs, ...acceptance.filter((entry) => entry.plan_item_ids.includes(item.id)).flatMap((entry) => entry.check_refs)])];
+function itemCheckRefs(item, acceptance, catalog) {
+    const aggregate = new Set(catalog.filter((check) => check.run_at !== "work").map((check) => check.id));
+    return [...new Set([...item.verification.check_refs, ...acceptance.filter((entry) => entry.plan_item_ids.includes(item.id)).flatMap((entry) => entry.check_refs.filter((ref) => aggregate.has(ref)))])];
+}
+function renderCodeTask(item, catalog, acceptance = []) {
+    const local = catalog.filter((check) => check.run_at === "work" && item.verification.check_refs.includes(check.id));
+    const aggregate = catalog.filter((check) => check.run_at !== "work" && itemCheckRefs(item, acceptance, catalog).includes(check.id));
+    return [item.title, item.summary, item.details, `Preserve: ${item.semantic_spine.must_preserve.join("; ")}`, `Work checks: ${local.map((check) => `${check.id}:${check.command}`).join("; ")}`, `Later aggregate checks (CODE/MERGE; do not run in this Work): ${aggregate.map((check) => `${check.id}:${check.command}`).join("; ")}`, `Stop: ${item.execution_context.stop_conditions.join("; ")}`].join("\n\n");
 }
-function renderCodeTask(item, catalog, acceptance = []) { const checks = catalog.filter((check) => itemCheckRefs(item, acceptance).includes(check.id)); return [item.title, item.summary, item.details, `Preserve: ${item.semantic_spine.must_preserve.join("; ")}`, `Checks: ${checks.map((check) => `${check.id}:${check.command}`).join("; ")}`, `Stop: ${item.execution_context.stop_conditions.join("; ")}`].join("\n\n"); }
 function validateProjectedPaths(batch, workspaceRoot, home, runId) {
     for (const work of batch.works) {
         for (const write of work.planned_write_areas)
@@ -595,7 +600,7 @@ function resolvePortablePath(value, workspaceRoot, home, runId) {
 }
 function writeJson(file, value) { const temporary = `${file}.${crypto.randomUUID()}.tmp`; fs.writeFileSync(temporary, `${JSON.stringify(value, null, 2)}\n`); fs.renameSync(temporary, file); }
 function runRef(runId, runHome, file) { return `run://${runId}/${path.relative(runHome, file).split(path.sep).join("/")}`; }
-function validatePlanSemantics(file, plan, ownedRefs, acceptedRefs) {
+function validatePlanSemantics(file, plan, ownedRefs, acceptedRefs, mergeEnding) {
     const items = plan.items ?? [];
     const ids = new Set(items.map((item) => item.id).filter((id) => Boolean(id)));
     if (ids.size !== items.length)
@@ -608,6 +613,8 @@ function validatePlanSemantics(file, plan, ownedRefs, acceptedRefs) {
     for (const check of plan.checks ?? []) {
         if (checks.has(check.id))
             throw new AppError("validation", "PLAN check ids must be unique", 2, { file, check_id: check.id });
+        if (mergeEnding && check.run_at === "release")
+            throw new AppError("check_gate_unreachable", "A RUN ending at MERGE cannot execute RELEASE checks", 2, { file, check_id: check.id });
         if (check.availability === "planned" && (!check.provided_by || !ids.has(check.provided_by)))
             throw new AppError("planned_check_provider_missing", "A planned check must name a PLAN item that provides it", 2, { file, check_id: check.id, provided_by: check.provided_by ?? null });
         if (check.availability === "planned" && !check.command.startsWith("@check/"))
@@ -616,6 +623,8 @@ function validatePlanSemantics(file, plan, ownedRefs, acceptedRefs) {
             throw new AppError("planned_check_definition_missing", "A planned check must declare its exact alias definition", 2, { file, check_id: check.id });
         checks.set(check.id, check);
     }
+    const localChecks = new Set(items.flatMap((item) => item.verification.check_refs));
+    const acceptanceIds = new Set();
     const ancestors = (itemId, seen = new Set()) => {
         for (const dependency of items.find((item) => item.id === itemId)?.depends_on ?? [])
             if (!seen.has(dependency)) {
@@ -639,7 +648,7 @@ function validatePlanSemantics(file, plan, ownedRefs, acceptedRefs) {
             const check = checks.get(checkId);
             if (!check)
                 throw new AppError("check_reference_unknown", "PLAN item references an unknown check", 2, { file, item: item.id, check_id: checkId });
-            if (check.availability === "planned" && check.provided_by !== item.id && !ancestors(item.id).has(check.provided_by))
+            if (check.run_at === "work" && check.availability === "planned" && check.provided_by !== item.id && !ancestors(item.id).has(check.provided_by))
                 throw new AppError("check_consumer_not_ordered_after_provider", "A Work may consume a planned check only after its provider", 2, { file, item: item.id, check_id: checkId, provider: check.provided_by });
         }
     }
@@ -655,6 +664,11 @@ function validatePlanSemantics(file, plan, ownedRefs, acceptedRefs) {
     for (const acceptance of plan.acceptance ?? []) {
         if (!acceptance.criterion_id || !acceptance.criterion_id.startsWith("AC-") || !ownedRefs.has(acceptance.criterion_id))
             throw new AppError("validation", "PLAN acceptance references an AC-* owned by this protocol", 2, { file, criterion_id: acceptance.criterion_id });
+        if (acceptanceIds.has(acceptance.criterion_id))
+            throw new AppError("duplicate_plan_criterion", "PLAN acceptance criterion ids must be unique within a protocol", 2, { file, criterion_id: acceptance.criterion_id });
+        acceptanceIds.add(acceptance.criterion_id);
+        if (mergeEnding && acceptance.gate === "release")
+            throw new AppError("check_gate_unreachable", "A RUN ending at MERGE cannot prove RELEASE acceptance", 2, { file, criterion_id: acceptance.criterion_id });
         for (const id of acceptance.plan_item_ids ?? [])
             if (!ids.has(id))
                 throw new AppError("validation", "PLAN acceptance references an unknown item", 2, { file, criterion_id: acceptance.criterion_id, plan_item_id: id });
@@ -662,9 +676,10 @@ function validatePlanSemantics(file, plan, ownedRefs, acceptedRefs) {
             const check = checks.get(id);
             if (!check)
                 throw new AppError("check_reference_unknown", "PLAN acceptance references an unknown check", 2, { file, criterion_id: acceptance.criterion_id, check_id: id });
-            for (const itemId of acceptance.plan_item_ids ?? [])
-                if (check.availability === "planned" && check.provided_by !== itemId && !ancestors(itemId).has(check.provided_by))
-                    throw new AppError("check_consumer_not_ordered_after_provider", "Acceptance may consume a planned check only after its provider", 2, { file, criterion_id: acceptance.criterion_id, item: itemId, check_id: id, provider: check.provided_by });
+            if ((acceptance.gate !== "release" && check.run_at === "release") || (!["merge", "release"].includes(acceptance.gate) && check.run_at === "merge"))
+                throw new AppError("check_gate_unreachable", "PLAN acceptance references a check after its gate", 2, { file, criterion_id: acceptance.criterion_id, check_id: id, gate: acceptance.gate, run_at: check.run_at });
+            if (check.run_at === "work" && !localChecks.has(id))
+                throw new AppError("work_check_unassigned", "A work check referenced by acceptance needs an explicit verifying PLAN item", 2, { file, criterion_id: acceptance.criterion_id, check_id: id });
         }
     }
     for (const obligation of ownedRefs)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deksden-com/dd-flow-cli",
-  "version": "0.9.0-beta.119",
+  "version": "0.9.0-beta.121",
   "description": "Mechanical runtime CLI for dd-flow workflows.",
   "type": "module",
   "bin": {