@deksden-com/dd-flow-cli 0.9.0-beta.31 → 0.9.0-beta.32

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @deksden-com/dd-flow-cli
 
+## 0.9.0-beta.32
+
+### Patch Changes
+
+- Reject reviewer results without per-aspect evidence when the Work is finished, and distinguish missing evidence from an aspect-coverage mismatch in legacy stage validation.
+
 ## 0.9.0-beta.31
 
 ### Patch Changes

package/dist/build-info.json

@@ -1,8 +1,8 @@
 {
   "cli_package": "@deksden-com/dd-flow-cli",
-  "cli_version": "0.9.0-beta.31",
-  "cli_commit": "f21c8317e762f978272536faff6822921dffeff5",
-  "built_at": "2026-09-07T16:20:23.716Z",
+  "cli_version": "0.9.0-beta.32",
+  "cli_commit": "2d5d953e65e996d9f57d1d4edec97a730c578acb",
+  "built_at": "2026-09-07T18:27:14.770Z",
   "built_with_canon": {
     "version": "4.0.6",
     "commit": "c6fc50cb3b5526ea0162ee4454d1ee36f17be2da",

package/dist/schemas/code-review-result.schema.json

@@ -8,7 +8,7 @@
     "schema_id": {"const": "dd-flow/code-review-result@1"},
     "verdict": {"enum": ["pass", "findings", "blocked"]},
     "summary": {"type": "string", "minLength": 1},
-    "aspects": {"type": "array", "items": {"type": "object", "additionalProperties": false, "required": ["aspect_id", "verdict", "summary", "evidence_refs"], "properties": {"aspect_id": {"type": "string", "minLength": 1}, "verdict": {"enum": ["pass", "findings", "blocked"]}, "summary": {"type": "string", "minLength": 1}, "evidence_refs": {"type": "array", "items": {"type": "string"}}}}},
+    "aspects": {"type": "array", "items": {"type": "object", "additionalProperties": false, "required": ["aspect_id", "verdict", "summary", "evidence_refs"], "properties": {"aspect_id": {"type": "string", "minLength": 1}, "verdict": {"enum": ["pass", "findings", "blocked"]}, "summary": {"type": "string", "minLength": 1}, "evidence_refs": {"type": "array", "minItems": 1, "items": {"type": "string", "minLength": 1}}}}},
     "findings": {"type": "array", "items": {"type": "object", "additionalProperties": false, "required": ["finding_id", "aspect_id", "priority", "problem", "impact", "required_outcome", "evidence_refs", "obligation_refs"], "properties": {"finding_id": {"type": "string", "pattern": "^FIND-[0-9]{3}$"}, "aspect_id": {"type": "string", "minLength": 1}, "priority": {"enum": ["p0", "p1", "p2", "p3"]}, "problem": {"type": "string", "minLength": 1}, "impact": {"type": "string", "minLength": 1}, "required_outcome": {"type": "string", "minLength": 1}, "evidence_refs": {"type": "array", "minItems": 1, "items": {"type": "string", "minLength": 1}}, "obligation_refs": {"type": "array", "minItems": 1, "items": {"type": "string", "minLength": 1}}}}}
   }
 }

package/dist/schemas/plan-review-result.schema.json

@@ -20,7 +20,7 @@
           "aspect_id": {"type": "string", "minLength": 1},
           "verdict": {"enum": ["pass", "watch", "needs_changes", "blocked"]},
           "summary": {"type": "string", "minLength": 1},
-          "evidence_refs": {"type": "array", "items": {"type": "string", "minLength": 1}},
+          "evidence_refs": {"type": "array", "minItems": 1, "items": {"type": "string", "minLength": 1}},
           "findings": {
             "type": "array",
             "items": {
@@ -31,7 +31,7 @@
                 "finding_id": {"type": "string", "pattern": "^FIND-[0-9]{3}$"},
                 "severity": {"enum": ["blocker", "high", "medium", "low", "info"]},
                 "summary": {"type": "string", "minLength": 1},
-                "evidence_refs": {"type": "array", "items": {"type": "string", "minLength": 1}}
+                "evidence_refs": {"type": "array", "minItems": 1, "items": {"type": "string", "minLength": 1}}
               }
             }
           }

package/dist/services/eval-snapshots.js

@@ -8,6 +8,7 @@ import { resolveProjectRoot } from "../storage/paths.js";
 import { registerProject, requireProjectByRoot } from "./projects.js";
 import { getFlowRunStatus, startFlowRun } from "./runs.js";
 import { readVnextFlowDefinition } from "./vnext-specify.js";
+import { assertRunWorkResultArtifacts } from "./work-registry.js";
 /** Capture the only flow boundary which exists before `stage start --bootstrap` creates a RUN. */
 export function createEvalBootstrapSnapshot(context, input) {
     const projectRoot = resolveProjectRoot(input.projectRoot);
@@ -80,6 +81,7 @@ function captureEvalRunSnapshot(context, input) {
     const project = requireProjectByRoot(context, projectRoot);
     const status = getFlowRunStatus(context, { projectRoot, runId: input.runId });
     assertDedicatedHome(context, project.id, input.runId);
+    assertRunWorkResultArtifacts(context, project.id, input.runId);
     const recovery = typeof input.recoveryId === "string";
     if (recovery) {
         const guard = context.db.get("SELECT status, recovery_id FROM run_recovery_guards WHERE project_id = ? AND run_id = ? AND recovery_id = ?", [project.id, input.runId, input.recoveryId]);

package/dist/services/vnext-plan-review.js

@@ -423,8 +423,11 @@ function reviewerEvidenceFailures(context, input) {
             continue;
         }
         const actual = result.aspects.map((item) => item.aspect_id);
-        if (actual.length !== group.aspect_ids.length || new Set(actual).size !== actual.length || group.aspect_ids.some((id) => !actual.includes(id)) || result.aspects.some((item) => item.evidence_refs.length === 0))
+        if (actual.length !== group.aspect_ids.length || new Set(actual).size !== actual.length || group.aspect_ids.some((id) => !actual.includes(id)))
             failures.push({ group: group.key, work_id: child.work_id, error: "reviewer_aspect_coverage_invalid", expected_aspects: group.aspect_ids, actual_aspects: actual });
+        const missingEvidence = result.aspects.filter((item) => item.evidence_refs.length === 0).map((item) => item.aspect_id);
+        if (missingEvidence.length)
+            failures.push({ group: group.key, work_id: child.work_id, error: "reviewer_aspect_evidence_missing", missing_aspects: missingEvidence });
         for (const ref of result.aspects.flatMap((item) => [...item.evidence_refs, ...item.findings.flatMap((finding) => finding.evidence_refs)])) {
             try {
                 assertPortableArtifactRef(ref, { workspaceRoot: input.workspaceRoot, runHome: input.runHome, runId: input.runId });

package/dist/services/work-registry.js

@@ -182,6 +182,17 @@ export function listWorks(context, input) {
         }) };
 }
 export function showWork(context, id) { const work = requireWork(context, id); const sessions = context.db.all("SELECT ws.id, ws.work_id, ws.session_id, ws.hook_event_id, ws.status, ws.prompt_path, ws.result_path, ws.created_at, ws.completed_at, s.harness AS harness_id, COALESCE(s.provider_session_id, s.session_id) AS native_session_id FROM work_sessions ws LEFT JOIN sessions s ON s.project_id = ? AND s.session_id = ws.session_id WHERE ws.work_id = ? ORDER BY ws.created_at", [work.project_id, work.work_id]); return { work: { ...work, short_id: shortWorkId(work.work_id), payload: parsePayload(work), payload_json: undefined, depends_on: parseDependencies(work), sessions: sessions.map(({ session_id, harness_id, native_session_id, ...session }) => ({ ...session, ...(harness_id && native_session_id ? { session: publicSessionIdentity({ harness: harness_id, provider_session_id: native_session_id, session_id }) } : {}) })) } }; }
+/** DB rows are authoritative; reject snapshots that would preserve a rewritten Work receipt. */
+export function assertRunWorkResultArtifacts(context, projectId, runId) {
+    const works = context.db.all(`SELECT w.work_id, w.result, (SELECT ws.result_path FROM work_sessions ws WHERE ws.work_id = w.work_id ORDER BY ws.created_at DESC LIMIT 1) AS result_path FROM works w WHERE w.project_id = ? AND w.run_id = ? AND w.result_schema IS NOT NULL AND w.result IS NOT NULL AND w.status = 'completed'`, [projectId, runId]);
+    for (const work of works) {
+        if (!work.result_path || !fs.existsSync(work.result_path))
+            throw new AppError("work_result_artifact_missing", "Completed structured Work has no retained result artifact", 1, { work_id: work.work_id, result_path: work.result_path });
+        const actual = fs.readFileSync(work.result_path, "utf8");
+        if (actual !== work.result)
+            throw new AppError("work_result_artifact_drift", "Completed Work result artifact no longer matches its authoritative receipt", 1, { work_id: work.work_id, result_path: work.result_path, expected_sha256: crypto.createHash("sha256").update(work.result).digest("hex"), actual_sha256: crypto.createHash("sha256").update(actual).digest("hex") });
+    }
+}
 export function mutateWorkDeps(context, input) {
     const work = requireWork(context, input.workId);
     if (input.action === "list")
@@ -619,11 +630,11 @@ export function resultSchemaGuidance(work, runId) {
             "Each evidence entry has exactly obligation_ref (one assigned ref) and refs (nonempty list of existing evidence paths). Each resolution has finding_ref, summary and nonempty evidence_refs. Do not invent file names or finding ids."];
     }
     if (schema === "dd-flow/code-review-result@1") {
-        return [refs, "Assess every assigned aspect exactly once. Number findings locally inside this reviewer Work as FIND-001, FIND-002, ...; dd-flow adds the Work id to form the canonical reference.", "This is a shape template: replace labels with assigned ids and observed verdicts, fill evidence_refs using existing files from the task packet, and remove findings when none exist. Report only material, direct-evidence findings; taste and cosmetics are not findings:", "```json", JSON.stringify({ schema_id: schema, verdict: "pass | findings | blocked", summary: "Concise evidence-backed conclusion.", aspects: [{ aspect_id: "assigned_aspect_id", verdict: "pass | findings | blocked", summary: "Conclusion.", evidence_refs: [] }], findings: [{ finding_id: "FIND-001", aspect_id: "assigned_aspect_id", priority: "p0 | p1 | p2 | p3", problem: "Violated obligation or rule.", impact: "Concrete risk or failure.", required_outcome: "Smallest observable result that closes the defect.", evidence_refs: ["path/to/file"], obligation_refs: ["R-001 | AC-001 | policy ref"] }] }, null, 2), "```"];
+        return [refs, "Assess every assigned aspect exactly once. Number findings locally inside this reviewer Work as FIND-001, FIND-002, ...; dd-flow adds the Work id to form the canonical reference.", "This is a shape template: replace labels with assigned ids and observed verdicts, fill evidence_refs using existing files from the task packet, and remove findings when none exist. Report only material, direct-evidence findings; taste and cosmetics are not findings:", "```json", JSON.stringify({ schema_id: schema, verdict: "pass | findings | blocked", summary: "Concise evidence-backed conclusion.", aspects: [{ aspect_id: "assigned_aspect_id", verdict: "pass | findings | blocked", summary: "Conclusion.", evidence_refs: ["path/to/evidence"] }], findings: [{ finding_id: "FIND-001", aspect_id: "assigned_aspect_id", priority: "p0 | p1 | p2 | p3", problem: "Violated obligation or rule.", impact: "Concrete risk or failure.", required_outcome: "Smallest observable result that closes the defect.", evidence_refs: ["path/to/file"], obligation_refs: ["R-001 | AC-001 | policy ref"] }] }, null, 2), "```"];
     }
     if (schema !== "dd-flow/plan-review-result@1")
         return [];
-    return [refs, "This is a shape template: replace labels with assigned ids and observed verdicts, fill evidence_refs using existing files from the task packet, and remove findings when none exist. Do not add fields. Number findings locally inside this reviewer Work as FIND-001, FIND-002, ...; dd-flow adds the Work id when the coordinator classifies them:", "```json", JSON.stringify({ schema_id: schema, plan_revision: 1, overall_verdict: "pass | watch | needs_changes | blocked", summary: "Concise evidence-backed conclusion.", aspects: [{ aspect_id: "assigned_aspect_id", verdict: "pass | watch | needs_changes | blocked", summary: "Conclusion for this aspect.", evidence_refs: [], findings: [{ finding_id: "FIND-001", severity: "high | medium | low | info", summary: "Problem, if any.", evidence_refs: ["path/to/file"] }] }] }, null, 2), "```"];
+    return [refs, "This is a shape template: replace labels with assigned ids and observed verdicts, fill evidence_refs using existing files from the task packet, and remove findings when none exist. Do not add fields. Number findings locally inside this reviewer Work as FIND-001, FIND-002, ...; dd-flow adds the Work id when the coordinator classifies them:", "```json", JSON.stringify({ schema_id: schema, plan_revision: 1, overall_verdict: "pass | watch | needs_changes | blocked", summary: "Concise evidence-backed conclusion.", aspects: [{ aspect_id: "assigned_aspect_id", verdict: "pass | watch | needs_changes | blocked", summary: "Conclusion for this aspect.", evidence_refs: ["path/to/evidence"], findings: [{ finding_id: "FIND-001", severity: "high | medium | low | info", summary: "Problem, if any.", evidence_refs: ["path/to/file"] }] }] }, null, 2), "```"];
 }
 export function validateCodeReviewResultIdentity(work, value) {
     const group = codeReviewGroup(work);
@@ -652,6 +663,7 @@ export function validateCodeReviewResultIdentity(work, value) {
 function validateCodeReviewResult(work, value, input) {
     validateCodeReviewResultIdentity(work, value);
     const result = value;
+    assertReviewAspectEvidence(work, result.aspects ?? [], "CODE");
     const findings = result.findings ?? [];
     // A reviewer is a child Work and cannot pause its coordinator-owned Stage.
     // Its structured blocked result is evidence for the coordinator, which then
@@ -681,6 +693,7 @@ export function validatePlanReviewResult(work, value, input) {
     const unexpected = ids.filter((id) => !expected.has(id));
     if (new Set(ids).size !== ids.length || missing.length || unexpected.length)
         throw new AppError("review_evidence_invalid", "PLAN reviewer result must assess every assigned aspect exactly once", 2, { work_id: work.work_id, group: group.key, missing, unexpected });
+    assertReviewAspectEvidence(work, aspects, "PLAN");
     const findingIds = aspects.flatMap((aspect) => aspect.findings ?? []).map((finding) => finding.finding_id ?? "");
     const invalid = findingIds.filter((id) => !/^FIND-\d{3}$/.test(id));
     if (new Set(findingIds).size !== findingIds.length || invalid.length)
@@ -695,6 +708,11 @@ export function validatePlanReviewResult(work, value, input) {
         assertPortableArtifactRef(ref, input);
     }
 }
+function assertReviewAspectEvidence(work, aspects, stage) {
+    const missing = aspects.filter((aspect) => !Array.isArray(aspect.evidence_refs) || aspect.evidence_refs.length === 0).map((aspect) => aspect.aspect_id ?? "");
+    if (missing.length)
+        throw new AppError("review_evidence_invalid", `${stage} reviewer result requires non-empty evidence_refs for every assigned aspect`, 2, { work_id: work.work_id, missing_aspects: missing });
+}
 function codeReviewGroup(work) {
     const payload = parsePayload(work);
     const group = payload?.group;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deksden-com/dd-flow-cli",
-  "version": "0.9.0-beta.31",
+  "version": "0.9.0-beta.32",
   "description": "Mechanical runtime CLI for dd-flow workflows.",
   "type": "module",
   "bin": {