@deksden-com/dd-flow-cli 0.9.0-beta.160 → 0.9.0-beta.161

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @deksden-com/dd-flow-cli
 
+## 0.9.0-beta.161
+
+### Patch Changes
+
+- Validate accepted CODE handoff through retained PLAN-REVIEW byte custody and exact PLAN/batch hashes, without reapplying historical input-file or mutable workspace admission checks after implementation and repair (plan 115).
+
 ## 0.9.0-beta.160
 
 ### Patch Changes

package/dist/build-info.json

@@ -1,8 +1,8 @@
 {
   "cli_package": "@deksden-com/dd-flow-cli",
-  "cli_version": "0.9.0-beta.160",
-  "cli_commit": "3d065fa9b570fdb25570e4c47d7c99a5d50d5574",
-  "built_at": "2026-10-29T15:12:42.101Z",
+  "cli_version": "0.9.0-beta.161",
+  "cli_commit": "367b9cb844aa34fd36d0a00cf059160377d10bdd",
+  "built_at": "2026-10-29T17:36:11.881Z",
   "built_with_canon": {
     "version": "4.1.4",
     "commit": "7cc415b3ef3ce37c9624c7cee51023e66f67cd57",

package/dist/services/vnext-plan.js

@@ -18,7 +18,7 @@ import { requireVnextWorkspaceRoute } from "./vnext-workspace-policy.js";
 import { readVnextSpecifyResult } from "./vnext-specify.js";
 import { nextWorkId } from "./ids.js";
 import { vnextStageDirectory } from "../domain/stage-catalog.js";
-import { acceptStageReport, prepareStageReport } from "./stage-report-renderer.js";
+import { acceptStageReport, prepareStageReport, readAcceptedStageData } from "./stage-report-renderer.js";
 import { currentStagePrompt, applyExternalStageContext, prepareExternalStageContext } from "./stage-context.js";
 import { subagentCapacityKey } from "./vnext-fanout.js";
 import { stageLifecycleInstruction, workStopConditionInstruction } from "../harness-runtime/lib/delegation-instructions.mjs";
@@ -318,12 +318,35 @@ export function prepareVnextPlanArtifacts(context, input) {
         }
     };
 }
-/** CODE entry validates the same PLAN closure without changing an accepted batch. */
+/** After PLAN-REVIEW, custody protects accepted intent; mutable Work inputs are
+ * admission conditions, not permanent invariants of the implementation tree. */
 export function validateVnextCodeHandoff(context, input) {
-    return validateVnextPlanArtifacts(context, {
-        ...input,
-        protocols: protocolIds(input.home)
-    });
+    const project = requireProjectByRoot(context, resolveProjectRoot(input.projectRoot));
+    const accepted = readAcceptedStageData(context, { projectId: project.id, runId: input.runId, stage: "plan-review" });
+    const report = JSON.parse(accepted.bytes.toString("utf8"));
+    const batch = path.join(input.home, "03-plan", "code-work-batch.json");
+    try {
+        if (!report.semantic?.batch_checksum || !fs.existsSync(batch) || checksum(batch) !== report.semantic.batch_checksum) {
+            throw new AppError("stale_code_work_batch", "CODE batch differs from accepted PLAN-REVIEW", 2, { batch });
+        }
+        const value = readJson(batch);
+        const ids = new Set();
+        if (!Array.isArray(value.sources) || !value.sources.length)
+            throw new AppError("validation", "Accepted CODE batch has no PLAN sources", 2);
+        for (const source of value.sources) {
+            if (typeof source.protocol_id !== "string" || !/^PRT-[^/\\\0]+$/.test(source.protocol_id) || ids.has(source.protocol_id) || !/^[a-f0-9]{64}$/.test(source.sha256)) {
+                throw new AppError("validation", "Accepted CODE batch has invalid PLAN sources", 2);
+            }
+            ids.add(source.protocol_id);
+            const file = path.join(input.workspaceRoot, ".memory-bank", "protocol", source.protocol_id, "plan.json");
+            if (!fs.existsSync(file) || checksum(file) !== source.sha256)
+                throw new AppError("stale_code_work_batch", "PLAN differs from accepted PLAN-REVIEW", 2, { file });
+        }
+        return [];
+    }
+    catch (error) {
+        return [validationFailure(batch, error)];
+    }
 }
 const planTask = "Produce accepted plan.json and aspect-map.json artifacts.";
 function planExample(protocolId) { return { schema_id: "dd-flow/protocol-plan@6", plan_id: "PLAN-001", protocol_id: protocolId, revision: 1, title: "Example", summary: "A compact executable plan.", source_refs: [{ kind: "specify", id: "SPECIFY", path: "run://RUN-000/01-specify/specify.json", requirement_ids: ["R-001", "AC-001"] }], goal: { outcome: "Deliver the accepted behavior.", constraints: ["Keep the accepted scope."], non_goals: [] }, assessment: { scope_breadth: { level: "narrow", surfaces: ["one surface"], reason: "One vertical slice." }, solution_novelty: { level: "established", surfaces: ["existing pattern"], reason: "Reuse project practice." }, solution_uncertainty: { level: "low", surfaces: ["known behavior"], reason: "No open technical question." }, failure_impact: { level: "low", surfaces: ["local feature"], reason: "Reversible local change." }, selected_depth: "compact_plan", depth_trigger: "none" }, decisions: [], document_updates: [], checks: [{ id: "CHK-P1-TEST", command: "pnpm test", purpose: "Proves the changed behavior.", run_at: "work", availability: "available" }], items: [{ id: "P1", title: "Implement behavior", summary: "Change the owning surface.", details: "Follow the accepted requirement and project conventions.", depends_on: [], requirement_refs: ["R-001", "AC-001"], semantic_spine: { user_outcome: "The requested behavior is available.", component_responsibility: "Own the behavior.", must_preserve: ["Existing behavior."], non_goals: [], acceptance_contribution: "Makes AC-001 observable." }, execution_context: { required_read: ["apps/api/src/example.ts"], discovery_boundary: ["Related tests only."], planned_write_areas: ["apps/api/src/"], stop_conditions: [] }, verification: { check_refs: ["CHK-P1-TEST"] } }], acceptance: [{ criterion_id: "AC-001", plan_item_ids: ["P1"], changed_surfaces: ["apps/api/src/example.ts"], path: "Exercise the accepted user path.", environment: "Local test environment.", fixtures: [], cleanup: "No persistent fixture.", check_refs: ["CHK-P1-TEST"], expected_evidence: ["Focused check passes."], proof_limits: ["Manual production evidence is not claimed."], gate: "work" }] }; }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deksden-com/dd-flow-cli",
-  "version": "0.9.0-beta.160",
+  "version": "0.9.0-beta.161",
   "description": "Mechanical runtime CLI for dd-flow workflows.",
   "type": "module",
   "packageManager": "pnpm@10.23.0",