@devflow-tools/delivery-line 0.18.33 → 0.18.35

package/dist/facade/delivery-line-facade.js

@@ -45,6 +45,9 @@ function normalizeDecisionOptions(options) {
         return true;
     }).map(option => ({ id: option.id.trim(), label: option.label.trim(), ...(option.recommended ? { recommended: true } : {}) }));
 }
+function normalizeDecisionText(value) {
+    return value.replace(/[\u0000-\u001f\u007f\ufffd]+/gu, ' ').replace(/\s+/gu, ' ').trim();
+}
 function optionsForExistingImplementations(paths) {
     return [
         { id: 'create-new', label: 'Create a new implementation' },
@@ -63,7 +66,16 @@ function nextActionsFor(record) {
         nextActions.push('revise');
     if (record.stage === 'intent_approved' || record.stage === 'designing')
         nextActions.push('compare_options');
-    if (['clarifying', 'spec_ready', 'plan_ready', 'reviewed'].includes(record.stage))
+    const approvalReady = (record.stage === 'clarifying'
+        && record.interaction.openQuestions.length === 0
+        && record.interaction.blockingUnknowns.length === 0
+        && record.artifacts.some(artifact => artifact.type === 'intent'))
+        || (record.stage === 'spec_ready' && record.artifacts.some(artifact => artifact.type === 'spec'))
+        || (record.stage === 'plan_ready' && record.artifacts.some(artifact => artifact.type === 'plan'))
+        || record.stage === 'reviewed';
+    if (record.stage === 'plan_ready' && !record.artifacts.some(artifact => artifact.type === 'plan'))
+        nextActions.push('prepare_plan');
+    if (approvalReady)
         nextActions.push('approve');
     if (record.blockers?.some(blocker => blocker.code === 'WORKTREE_ADMISSION_REQUIRED'))
         nextActions.push('admit_worktree');
@@ -112,6 +124,52 @@ function releaseBindingHash(record) {
         recipients: record.recipients ?? [],
     });
 }
+function artifactApprovalDecision(record) {
+    let stage;
+    let artifact;
+    let artifactContentHash;
+    if (record.stage === 'clarifying' && record.interaction.blockingUnknowns.length === 0 && record.interaction.openQuestions.length === 0) {
+        stage = 'intent';
+        artifact = [...record.artifacts].reverse().find(item => item.type === 'intent');
+        artifactContentHash = artifact?.contentHash;
+    }
+    else if (record.stage === 'spec_ready') {
+        stage = 'spec';
+        artifact = [...record.artifacts].reverse().find(item => item.type === 'spec');
+        artifactContentHash = artifact?.contentHash;
+    }
+    else if (record.stage === 'plan_ready') {
+        stage = 'plan';
+        artifact = [...record.artifacts].reverse().find(item => item.type === 'plan');
+        artifactContentHash = artifact?.contentHash;
+    }
+    else if (record.stage === 'reviewed') {
+        stage = 'release';
+        artifactContentHash = releaseBindingHash(record);
+    }
+    if (!stage || !artifactContentHash)
+        return undefined;
+    const approval = {
+        stage,
+        ...(artifact ? { artifactId: artifact.id, artifactVersion: artifact.version } : {}),
+        artifactContentHash,
+    };
+    const identity = artifact?.id ?? artifactContentHash.slice(0, 16);
+    return {
+        id: `${record.id}:approval:${stage}:v${record.version}:${identity}`,
+        caseId: record.id,
+        kind: 'artifact_approval',
+        caseVersion: record.version,
+        turn: record.interaction.turn,
+        targetDecisionHash: hash({ caseId: record.id, caseVersion: record.version, turn: record.interaction.turn, approval }),
+        options: stage === 'release'
+            ? [{ id: 'approve', label: 'Approve release' }, { id: 'reject', label: 'Reject release' }]
+            : [{ id: 'approve', label: `Approve ${stage} and continue` }, { id: 'reject', label: `Request changes to ${stage}` }],
+        approval,
+        status: 'pending',
+        createdAt: Date.now(),
+    };
+}
 export class DeliveryLineFacade {
     ports;
     projectRoot;
@@ -224,7 +282,10 @@ export class DeliveryLineFacade {
         return this.view(record);
     }
     async status(caseId) { return this.view(await this.ports.store.get(caseId)); }
-    async pendingDecision(caseId) { return this.ports.store.getPendingDecision?.(caseId); }
+    async pendingDecision(caseId) {
+        const record = await this.ports.store.get(caseId);
+        return this.ensurePendingDecision(record);
+    }
     async resolveTrustedDecision(input) {
         const evidence = input.evidence;
         const record = await this.ports.store.get(evidence.caseId);
@@ -242,42 +303,73 @@ export class DeliveryLineFacade {
         });
         if (!signature.valid)
             throw new DeliveryLineError('USER_DECISION_REQUIRES_TRUSTED_CHANNEL', 'trusted user evidence is invalid', { reason: signature.reason, recoveryAction: 'Submit the decision again through the host trusted user command.' });
-        if (evidence.purpose !== 'resolve_clarification' || !['clarification', 'option_selection'].includes(pending.kind))
-            throw new DeliveryLineError('INVALID_TRANSITION', 'this trusted command is not a clarification decision', { purpose: evidence.purpose, pendingKind: pending.kind, recoveryAction: 'Use /devflow:decide for the current pending clarification, or use the gated approval operation for an approval.' });
         if (evidence.sessionId !== record.sessionId || !record.executionId || !record.contextReceipt)
             throw new DeliveryLineError('UNAUTHORIZED_ROLE', 'trusted decision authority does not match the case session');
-        if (record.authorities?.decisionAuthority && record.authorities.decisionAuthority.id !== evidence.actorId)
+        const expectedAuthority = pending.kind === 'artifact_approval' ? record.authorities?.approvalAuthority : record.authorities?.decisionAuthority;
+        if (expectedAuthority && expectedAuthority.id !== evidence.actorId)
             throw new DeliveryLineError('UNAUTHORIZED_ROLE', 'trusted decision authority does not match the case authority');
         if (evidence.targetDecisionHash !== pending.targetDecisionHash)
             throw new DeliveryLineError('ARTIFACT_HASH_MISMATCH', 'trusted decision does not match the pending proposal');
         const parsed = parseTrustedDecisionCommand(evidence.rawUserEvent, pending.options.map(option => option.id));
+        const trustedDecision = { evidenceHash: evidence.attestation, pendingDecisionId: pending.id, pendingCaseVersion: pending.caseVersion, nonce: evidence.nonce };
+        const identity = {
+            actor: { id: evidence.actorId, kind: 'human' },
+            sessionId: record.sessionId, executionId: record.executionId,
+            idempotencyKey: `trusted-decision:${evidence.nonce}`, contextReceipt: record.contextReceipt,
+            trustedDecision,
+        };
+        if (pending.kind === 'artifact_approval') {
+            if (!pending.approval)
+                throw new DeliveryLineError('MISSING_PREREQUISITE', 'artifact approval binding is missing');
+            if (parsed.purpose === 'approve_artifact')
+                return this.approve(evidence.caseId, {
+                    ...identity, turn: pending.turn, stage: pending.approval.stage,
+                    artifactId: pending.approval.artifactId, expectedVersion: pending.approval.artifactVersion,
+                    expectedContentHash: pending.approval.artifactContentHash,
+                    artifactHash: pending.approval.artifactContentHash,
+                });
+            if (parsed.purpose === 'reject_artifact')
+                return this.reject(evidence.caseId, {
+                    ...identity, turn: pending.turn, stage: pending.approval.stage, reason: String(parsed.value),
+                });
+            throw new DeliveryLineError('INVALID_TRANSITION', 'the pending artifact requires /devflow:approve or /devflow:reject');
+        }
+        if (parsed.purpose !== 'resolve_clarification' || !['clarification', 'option_selection'].includes(pending.kind))
+            throw new DeliveryLineError('INVALID_TRANSITION', 'this trusted command does not match the pending decision');
         const selectedOption = pending.options.find(option => option.id === parsed.value);
         const selectedLabel = selectedOption?.label ?? String(parsed.value);
-        const answered = await this.answer(evidence.caseId, {
-            actor: { id: evidence.actorId, kind: 'human' },
-            sessionId: record.sessionId,
-            executionId: record.executionId,
-            idempotencyKey: `trusted-decision:${evidence.nonce}`,
-            contextReceipt: record.contextReceipt,
-            trustedDecision: { evidenceHash: evidence.attestation, pendingDecisionId: pending.id, pendingCaseVersion: pending.caseVersion, nonce: evidence.nonce },
+        if (pending.kind === 'option_selection' && record.stage === 'designing')
+            return this.compareOptions(evidence.caseId, {
+                ...identity, turn: pending.turn, questionId: pending.id, optionId: String(parsed.value), selectedLabel, optionsSnapshot: pending.options,
+            });
+        return this.answer(evidence.caseId, {
+            ...identity,
             turn: pending.turn,
             questionId: pending.id,
             ...(pending.options.length ? { optionId: String(parsed.value), optionsSnapshot: pending.options } : {}),
             selectedLabel,
             value: selectedLabel,
         });
-        return answered;
     }
     async proposeClarification(caseId, input) {
         requireIdentity(input);
         if (input.actor.kind !== 'agent')
             throw new DeliveryLineError('UNAUTHORIZED_ROLE', 'only an agent may propose clarification; a trusted user must resolve it');
+        const current = await this.ports.store.get(caseId);
+        const pending = await this.ports.store.getPendingDecision?.(caseId);
+        const options = normalizeDecisionOptions(input.options);
+        if (pending?.status === 'pending') {
+            const sameQuestion = normalizeDecisionText(current.interaction.openQuestions[0] ?? '') === normalizeDecisionText(input.question);
+            const sameOptions = JSON.stringify(pending.options) === JSON.stringify(options);
+            if (sameQuestion && sameOptions)
+                return this.view(current);
+            throw new DeliveryLineError('INVALID_TRANSITION', 'a user decision is already pending', { pendingDecisionId: pending.id, currentTurn: pending.turn, recoveryAction: 'Render and resolve the current pending decision before proposing another question.' });
+        }
         return this.mutate(caseId, input, 'proposal.clarification', async (record) => {
             if (!input.question.trim())
                 throw new DeliveryLineError('MISSING_PREREQUISITE', 'clarification question is required');
             const nextTurn = record.interaction.turn + 1;
             record.interaction = { ...record.interaction, status: 'awaiting_user', turn: nextTurn, openQuestions: [input.question], blockingUnknowns: [input.question] };
-            const options = normalizeDecisionOptions(input.options);
             await this.ports.store.createPendingDecision?.({ id: `${record.id}:decision:${nextTurn}`, caseId: record.id, kind: 'clarification', caseVersion: record.version + 1, turn: nextTurn, targetDecisionHash: hash({ caseId: record.id, question: input.question, options }), options, status: 'pending', createdAt: Date.now() });
             return record;
         });
@@ -292,6 +384,13 @@ export class DeliveryLineFacade {
         const options = normalizeDecisionOptions(input.options);
         if (!input.question.trim() || options.length < 2)
             throw new DeliveryLineError('MISSING_PREREQUISITE', 'at least two materially different options are required');
+        if (pending?.status === 'pending' && !enrichesInitialDecision) {
+            const sameQuestion = normalizeDecisionText(current.interaction.openQuestions[0] ?? '') === normalizeDecisionText(input.question);
+            const sameOptions = JSON.stringify(pending.options) === JSON.stringify(options);
+            if (sameQuestion && sameOptions)
+                return this.view(current);
+            throw new DeliveryLineError('INVALID_TRANSITION', 'a user decision is already pending', { pendingDecisionId: pending.id, currentTurn: pending.turn, recoveryAction: 'Render and resolve the current pending decision before proposing another option set.' });
+        }
         return this.mutate(caseId, input, 'proposal.options', async (record) => {
             const nextTurn = enrichesInitialDecision ? record.interaction.turn : record.interaction.turn + 1;
             record.interaction = { ...record.interaction, status: 'awaiting_user', turn: nextTurn, openQuestions: [input.question], blockingUnknowns: [input.question] };
@@ -348,6 +447,10 @@ export class DeliveryLineFacade {
             if (acceptanceCriteria.length === 0)
                 acceptanceCriteria.push(rawAnswer);
             record.interaction = answerInteraction(record.interaction, input.turn);
+            if (record.unknownRegistry) {
+                const answeredQuestion = normalizeDecisionText(question);
+                record.unknownRegistry = record.unknownRegistry.map(item => normalizeDecisionText(item.question) === answeredQuestion ? { ...item, blocking: false } : item);
+            }
             if (input.trustedDecision) {
                 const authority = { id: input.actor.id, kind: 'human' };
                 record.authorities = { ...record.authorities, decisionAuthority: record.authorities?.decisionAuthority ?? authority, approvalAuthority: record.authorities?.approvalAuthority ?? authority };
@@ -433,6 +536,43 @@ export class DeliveryLineFacade {
             const requiredContextChannels = [...new Set(Object.values(selectedCapabilities?.selected ?? {}).flatMap(manifest => manifest.requiredContextChannels))]
                 .filter((channel) => ['code', 'memory', 'knowledge'].includes(channel));
             record.pluginSelection = { selectedManifestHash: pluginSelectionHash, stackFactsHash, decisionRefs: [decisionHash], selectionReason: selectedCapabilities?.selectionReason ?? 'selected by current user decision', rejectedAlternatives: [...new Set([...(selectedCapabilities?.rejectedAlternatives ?? []), ...optionsSnapshot.filter(option => option.id !== optionId).map(option => option.id)])], ...(requiredContextChannels.length ? { requiredContextChannels } : {}), ...(selectedCapabilities ? { selectedByRole: Object.fromEntries(Object.entries(selectedCapabilities.selected).map(([role, manifest]) => [role, { pluginName: manifest.name, version: manifest.version, manifestHash: hash(manifest) }])), ...(selectedCapabilities.hostWorkerFallback ? { hostWorkerFallback: true } : {}) } : {}), selectedAt: Date.now() };
+            if (selectedCapabilities && this.ports.capabilities) {
+                const stackFactsFingerprint = record.stackFacts?.fingerprint ?? record.stackFactsHash ?? hash({ projectRoot: record.projectRoot, baseRef: record.baseRef, targetRef: record.targetRef });
+                for (const role of ['analyzer', 'designer']) {
+                    const selected = selectedCapabilities.selected[role];
+                    if (!selected || selected.kind !== 'runner')
+                        continue;
+                    const runtimeManifest = await this.ports.capabilities.manifest(selected.name, role);
+                    const receipt = await this.ports.capabilities.run({
+                        caseId: record.id,
+                        taskId: `${record.id}:${role}:${record.interaction.turn}`,
+                        role,
+                        pluginName: runtimeManifest.pluginName,
+                        capability: runtimeManifest.capability,
+                        manifestHash: runtimeManifest.manifestHash,
+                        stackFactsFingerprint,
+                        allowedFiles: [],
+                        payload: {
+                            changedFiles: [],
+                            role,
+                            request: record.originalRequest ?? record.title,
+                            componentName: record.taskSemantics?.entities[0] ?? selectedLabel,
+                            contextReceiptHash: record.contextReceipt ?? input.contextReceipt,
+                            decisionHash,
+                            optionsSnapshot,
+                        },
+                    });
+                    if (receipt.manifestHash !== runtimeManifest.manifestHash || receipt.verified !== true)
+                        throw new DeliveryLineError('ARTIFACT_HASH_MISMATCH', `plugin ${role} receipt is not verified`);
+                    record.evidence.push({
+                        id: randomUUID(),
+                        kind: 'tool',
+                        hash: hash({ role, pluginName: runtimeManifest.pluginName, pluginVersion: receipt.pluginVersion, manifestHash: receipt.manifestHash, outputHash: receipt.outputHash, contextReceiptHash: record.contextReceipt ?? input.contextReceipt, decisionHash }),
+                        createdAt: Date.now(),
+                        metadata: { role, pluginName: runtimeManifest.pluginName, pluginVersion: receipt.pluginVersion, manifestHash: receipt.manifestHash, outputHash: receipt.outputHash, stackFactsFingerprint, contextReceiptHash: record.contextReceipt ?? input.contextReceipt, decisionHash, verified: receipt.verified },
+                    });
+                }
+            }
             await this.createProjectionArtifact(record, 'plugin-selection.md', 'Plugin selection', 'Capability providers selected by Delivery from stack facts and the current decision.', record.pluginSelection, input.actor);
             record.stage = 'spec_ready';
             record.interaction = { ...record.interaction, phase: 'design', status: 'awaiting_approval', openQuestions: [], blockingUnknowns: [] };
@@ -440,6 +580,61 @@ export class DeliveryLineFacade {
             return record;
         });
     }
+    /**
+     * Compile and persist a plan proposal before asking the user to approve it.
+     * Approval must consume this immutable draft by hash; it must never depend on
+     * the model being able to submit a plan object through a trusted command.
+     */
+    async preparePlan(caseId, input) {
+        requireIdentity(input);
+        if (input.actor.kind !== 'agent')
+            throw new DeliveryLineError('UNAUTHORIZED_ROLE', 'only an agent may propose an executable plan; a trusted user must approve it');
+        return this.mutate(caseId, input, 'plan.prepared', async (record) => {
+            if (input.turn !== record.interaction.turn)
+                throw staleTurnError(record, input.turn);
+            if (record.stage !== 'plan_ready')
+                throw new DeliveryLineError('INVALID_TRANSITION', 'plan preparation requires a ready plan stage', { currentStage: record.stage, recoveryAction: 'Refresh delivery_status and follow its nextActions.' });
+            if (record.artifacts.some(artifact => artifact.type === 'plan'))
+                throw new DeliveryLineError('IDEMPOTENCY_CONFLICT', 'a plan draft is already prepared; refresh delivery_status and approve the pending plan decision');
+            if (this.ports.context) {
+                const plannerReceipt = await this.ports.context.build({
+                    role: 'planner',
+                    ...(record.pluginSelection?.requiredContextChannels?.length ? { requiredChannels: record.pluginSelection.requiredContextChannels } : {}),
+                    retrieval: {
+                        taskRevision: record.version + 1,
+                        projectRoot: record.projectRoot,
+                        query: `${record.originalRequest ?? record.title} implementation plan`,
+                        sessionId: input.sessionId,
+                        executionId: input.executionId,
+                        requestId: `delivery:plan:${record.id}:${record.version}`,
+                        turnId: `delivery:plan:${record.id}:${record.interaction.turn}`,
+                    },
+                });
+                record.contextReceipt = plannerReceipt.receiptHash;
+                if (plannerReceipt.channelStatus && plannerReceipt.gaps && plannerReceipt.attribution)
+                    record.contextQuality = { blocking: plannerReceipt.blocking ?? false, ...(plannerReceipt.channelAvailability ? { channelAvailability: plannerReceipt.channelAvailability } : {}), channelStatus: plannerReceipt.channelStatus, gaps: plannerReceipt.gaps, attribution: plannerReceipt.attribution, ...('quality' in plannerReceipt && plannerReceipt.quality ? { quality: plannerReceipt.quality } : {}) };
+            }
+            const planContent = renderPlanMarkdown(input.plan);
+            const planHash = contentHash(planContent);
+            new PlanCompiler().compile({
+                caseId: record.id,
+                projectRoot: record.projectRoot,
+                baseRevision: record.baseRef,
+                planHash,
+                contextReceiptHash: record.contextReceipt ?? input.contextReceipt,
+                hostSelectionSnapshotHash: hash({ mode: 'manual-plan', actor: input.actor, sessionId: input.sessionId, executionId: input.executionId }),
+                executionAuthority: hash({ caseId: record.id, stage: 'plan', planHash }),
+                plan: input.plan,
+            });
+            const artifact = await this.createArtifact(record, 'plan', planContent, input.actor, { path: 'plan.json', content: renderPlanJson(input.plan) });
+            if (artifact.contentHash !== planHash)
+                throw new DeliveryLineError('ARTIFACT_HASH_MISMATCH', 'plan artifact hash changed while persisting the proposal');
+            record.planDraft = structuredClone(input.plan);
+            record.artifacts.push(artifact);
+            record.interaction = { ...record.interaction, status: 'awaiting_approval' };
+            return record;
+        });
+    }
     async approve(caseId, input) {
         requireIdentity(input);
         requireTrustedUserDecision(input);
@@ -452,31 +647,17 @@ export class DeliveryLineFacade {
             let planContent;
             let proposedArtifactHash;
             if (input.stage === 'plan') {
-                if (!input.plan)
-                    throw new DeliveryLineError('PLAN_NOT_EXECUTABLE', 'plan approval requires an executable plan');
-                if (this.ports.context) {
-                    const plannerReceipt = await this.ports.context.build({
-                        role: 'planner',
-                        ...(record.pluginSelection?.requiredContextChannels?.length ? { requiredChannels: record.pluginSelection.requiredContextChannels } : {}),
-                        retrieval: {
-                            taskRevision: record.version + 1,
-                            projectRoot: record.projectRoot,
-                            query: `${record.title} implementation plan`,
-                            sessionId: input.sessionId,
-                            executionId: input.executionId,
-                            requestId: `delivery:plan:${record.id}:${record.version}`,
-                            turnId: `delivery:plan:${record.id}:${record.interaction.turn}`,
-                        },
-                    });
-                    record.contextReceipt = plannerReceipt.receiptHash;
-                    if (plannerReceipt.channelStatus && plannerReceipt.gaps && plannerReceipt.attribution)
-                        record.contextQuality = { blocking: plannerReceipt.blocking ?? false, ...(plannerReceipt.channelAvailability ? { channelAvailability: plannerReceipt.channelAvailability } : {}), channelStatus: plannerReceipt.channelStatus, gaps: plannerReceipt.gaps, attribution: plannerReceipt.attribution, ...('quality' in plannerReceipt && plannerReceipt.quality ? { quality: plannerReceipt.quality } : {}) };
-                }
-                planContent = renderPlanMarkdown(input.plan);
+                const proposedPlan = record.planDraft;
+                if (!proposedPlan)
+                    throw new DeliveryLineError('PLAN_NOT_EXECUTABLE', 'plan approval requires a prepared executable plan');
+                planContent = renderPlanMarkdown(proposedPlan);
                 proposedArtifactHash = contentHash(planContent);
+                const preparedArtifact = [...record.artifacts].reverse().find(item => item.type === 'plan');
+                if (preparedArtifact && preparedArtifact.contentHash !== proposedArtifactHash)
+                    throw new DeliveryLineError('ARTIFACT_HASH_MISMATCH', 'prepared plan does not match the approval artifact');
             }
             let artifact = [...record.artifacts].reverse().find(item => item.type === artifactType);
-            if (input.stage !== 'plan') {
+            if (input.stage !== 'release') {
                 if (input.artifactId && artifact?.id !== input.artifactId)
                     throw new DeliveryLineError('ARTIFACT_VERSION_CONFLICT', 'approval artifact id is stale');
                 if (input.expectedVersion !== undefined && artifact?.version !== input.expectedVersion)
@@ -489,7 +670,7 @@ export class DeliveryLineFacade {
                 throw new DeliveryLineError('MISSING_PREREQUISITE', `${artifactType} artifact is required`);
             if (input.artifactHash && input.artifactHash !== approvalArtifactHash)
                 throw new DeliveryLineError('ARTIFACT_HASH_MISMATCH', 'approval artifact hash is stale');
-            if (input.stage === 'intent' && (record.stage !== 'clarifying' || record.interaction.blockingUnknowns.length > 0 || (record.taskSemantics && record.taskSemantics.confidence > 0 && record.unknownRegistry?.some(item => item.blocking))))
+            if (input.stage === 'intent' && (record.stage !== 'clarifying' || record.interaction.blockingUnknowns.length > 0 || record.interaction.openQuestions.length > 0))
                 throw new DeliveryLineError('MISSING_PREREQUISITE', 'clarification must be complete before intent approval');
             if (input.stage === 'spec' && record.stage !== 'spec_ready')
                 throw new DeliveryLineError('INVALID_TRANSITION', 'spec approval requires a ready spec');
@@ -518,6 +699,9 @@ export class DeliveryLineFacade {
             if (input.stage === 'spec')
                 record.stage = 'plan_ready';
             if (input.stage === 'plan') {
+                const proposedPlan = record.planDraft;
+                if (!proposedPlan)
+                    throw new DeliveryLineError('PLAN_NOT_EXECUTABLE', 'plan approval requires a prepared executable plan');
                 const envelopes = new PlanCompiler().compile({
                     caseId: record.id,
                     projectRoot: record.projectRoot,
@@ -526,13 +710,8 @@ export class DeliveryLineFacade {
                     contextReceiptHash: record.contextReceipt ?? input.contextReceipt,
                     hostSelectionSnapshotHash: hash({ mode: 'manual-plan', actor: input.actor, sessionId: input.sessionId, executionId: input.executionId }),
                     executionAuthority: hash({ actor: input.actor, stage: input.stage, planHash: proposedArtifactHash }),
-                    plan: input.plan,
+                    plan: proposedPlan,
                 });
-                record.artifacts = record.artifacts.filter(item => item.type !== 'plan');
-                artifact = await this.createArtifact(record, 'plan', planContent, input.actor, { path: 'plan.json', content: renderPlanJson(input.plan) });
-                if (artifact.contentHash !== proposedArtifactHash)
-                    throw new DeliveryLineError('ARTIFACT_HASH_MISMATCH', 'plan artifact hash changed while persisting the approval artifact');
-                record.artifacts.push(artifact);
                 record.stage = 'plan_approved';
                 const decision = [...record.decisions].reverse().find(item => item.decisionHash);
                 if (decision && record.pluginSelection && record.stackFactsHash) {
@@ -582,6 +761,7 @@ export class DeliveryLineFacade {
     }
     async reject(caseId, input) {
         requireIdentity(input);
+        requireTrustedUserDecision(input);
         if (!stageApprovals.has(input.stage))
             throw new DeliveryLineError('INVALID_TRANSITION', `unsupported rejection stage: ${String(input.stage)}`, { requestedStage: input.stage, recoveryAction: 'Use intent, spec, plan, or release approval stages.' });
         return this.mutate(caseId, input, 'approval.rejected', async (record) => { if (input.turn !== record.interaction.turn)
@@ -885,7 +1065,8 @@ export class DeliveryLineFacade {
     } record.stage = 'cancelled'; return record; }); }
     async mutate(caseId, input, type, fn, pendingDecisionUpdate) {
         const record = await this.ports.store.get(caseId);
-        const pendingBeforeMutation = type === 'interaction.answered' ? await this.ports.store.getPendingDecision?.(caseId) : undefined;
+        const consumesPendingDecision = type === 'interaction.answered' || type === 'design.compared' || type.startsWith('approval.');
+        const pendingBeforeMutation = consumesPendingDecision ? await this.ports.store.getPendingDecision?.(caseId) : undefined;
         if (record.contextReceipt && record.contextReceipt !== input.contextReceipt)
             throw new DeliveryLineError('MISSING_PREREQUISITE', 'context receipt does not match case');
         if ((record.sessionId && record.sessionId !== input.sessionId) || (record.executionId && record.executionId !== input.executionId))
@@ -911,12 +1092,12 @@ export class DeliveryLineFacade {
         else if (input.trustedDecision) {
             if (!this.ports.store.saveAndConsumePendingDecision)
                 throw new DeliveryLineError('MISSING_PREREQUISITE', 'trusted decision storage transaction is unavailable', { recoveryAction: 'Use a Delivery store with atomic pending-decision consumption.' });
-            await this.ports.store.saveAndConsumePendingDecision(next, record.version, { decisionId: input.trustedDecision.pendingDecisionId, expectedCaseVersion: input.trustedDecision.pendingCaseVersion, nonce: input.trustedDecision.nonce });
+            await this.ports.store.saveAndConsumePendingDecision(next, record.version, { decisionId: input.trustedDecision.pendingDecisionId, expectedCaseVersion: input.trustedDecision.pendingCaseVersion, nonce: input.trustedDecision.nonce, replacement: artifactApprovalDecision(next) });
         }
         else {
             await this.ports.store.save(next, record.version);
         }
-        if (type === 'interaction.answered' && !input.trustedDecision && pendingBeforeMutation && this.ports.store.consumePendingDecision) {
+        if (consumesPendingDecision && !input.trustedDecision && pendingBeforeMutation && this.ports.store.consumePendingDecision) {
             await this.ports.store.consumePendingDecision({ caseId, decisionId: pendingBeforeMutation.id, expectedCaseVersion: pendingBeforeMutation.caseVersion, nonce: input.idempotencyKey });
         }
         await appendLedgerEvent(this.ports.store, { caseId, type, actor: input.actor, idempotencyKey: input.idempotencyKey, payload: { from: record.stage, to: next.stage } });
@@ -951,8 +1132,16 @@ export class DeliveryLineFacade {
     }
     evidence(kind, value) { return { id: randomUUID(), kind, hash: hash(value), createdAt: Date.now(), metadata: value }; }
     async view(record) {
-        const pending = await this.ports.store.getPendingDecision?.(record.id);
-        const pendingDecisions = record.interaction.openQuestions.map(question => ({
+        const pending = await this.ensurePendingDecision(record);
+        const pendingDecisions = pending?.kind === 'artifact_approval' && pending.approval ? [{
+                id: pending.id,
+                kind: pending.kind,
+                question: `Approve the current ${pending.approval.stage} artifact?`,
+                options: pending.options,
+                blocking: true,
+                turn: pending.turn,
+                command: `/devflow:approve ${pending.id}`,
+            }] : record.interaction.openQuestions.map(question => ({
             id: pending?.id ?? `${record.id}:decision:${record.interaction.turn}`,
             kind: 'product',
             question,
@@ -964,6 +1153,24 @@ export class DeliveryLineFacade {
         const blockers = record.blockers ?? (['held', 'failed', 'needs_changes', 'blocked'].includes(record.stage) ? [this.defaultBlocker(record)] : []);
         return { caseId: record.id, currentTurn: record.interaction.turn, contextReceipt: record.contextReceipt, ...(record.contextQuality ? { contextQuality: record.contextQuality } : {}), ...(record.sessionId && record.executionId ? { canonicalIdentity: { sessionId: record.sessionId, executionId: record.executionId, actorId: record.createdBy.id } } : {}), ...(record.runtimeActivation ? { runtimeActivationHash: record.runtimeActivation.snapshotHash } : {}), stage: record.stage, pendingDecisions, nextActions, blockers, artifactRefs: record.artifacts, evidenceRefs: record.evidence, taskSummaries: record.tasks.map(task => ({ taskId: task.id, status: task.status, attempt: task.attempt })), budget: { interactionsUsed: record.interaction.turn, taskAttemptsUsed: record.tasks.reduce((sum, task) => sum + task.attempt, 0), wallTimeMs: Math.max(0, Date.now() - (record.createdAt ?? record.updatedAt)), toolCalls: 0 } };
     }
+    async ensurePendingDecision(record) {
+        const current = await this.ports.store.getPendingDecision?.(record.id);
+        if (current)
+            return current;
+        const derived = artifactApprovalDecision(record);
+        if (!derived || !this.ports.store.createPendingDecision)
+            return undefined;
+        try {
+            await this.ports.store.createPendingDecision(derived);
+            return derived;
+        }
+        catch (error) {
+            const concurrent = await this.ports.store.getPendingDecision?.(record.id);
+            if (concurrent)
+                return concurrent;
+            throw error;
+        }
+    }
     defaultBlocker(record) {
         const task = record.tasks.find(item => ['blocked', 'failed', 'needs_changes'].includes(item.status));
         const code = record.stage === 'held' ? 'HELD' : record.stage.toUpperCase();