@fro.bot/systematic 3.13.7 → 3.14.0

package/dist/cli.js

@@ -1991,7 +1991,8 @@ var REVIEW_ARTIFACT_CUSTOM_MESSAGES = [
   "filtered findings require a validation reason",
   "risk-critical dispatches require a non-empty selection surface",
   "satisfied risk coverage requires a citing input finding ID",
-  "unsatisfied risk coverage must not cite an input finding ID"
+  "unsatisfied risk coverage must not cite an input finding ID",
+  "passed validation must not include a reason; non-passed validation requires a reason"
 ];
 var boundedText = (maxLength) => exports_external.string().min(1).max(maxLength).regex(/\S/);
 var DispatchOutcomeSchema = exports_external.enum([
@@ -2142,6 +2143,30 @@ var DeclinedMergeSchema = exports_external.object({
   input_finding_ids: exports_external.array(boundedText(MAX_INPUT_ID_LENGTH)).min(2).max(MAX_FINDINGS),
   reason: ReasonSchema
 }).strict();
+var ValidationSchema = exports_external.object({
+  status: exports_external.enum([
+    "passed",
+    "failed",
+    "unavailable",
+    "not_attempted"
+  ]),
+  reason: ReasonSchema.optional()
+}).strict().superRefine((validation, ctx) => {
+  if (validation.status === "passed" && validation.reason !== undefined) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["reason"],
+      message: REVIEW_ARTIFACT_CUSTOM_MESSAGES[5]
+    });
+  }
+  if (validation.status !== "passed" && validation.reason === undefined) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["reason"],
+      message: REVIEW_ARTIFACT_CUSTOM_MESSAGES[5]
+    });
+  }
+});
 var RiskCoverageSchema = exports_external.object({
   persona: RiskCriticalPersonaSchema,
   satisfied: exports_external.boolean(),
@@ -2186,7 +2211,8 @@ var ReviewArtifactSchema = exports_external.object({
   applied_fixes: exports_external.array(ReasonSchema).max(MAX_FINDINGS),
   residual_actionable_work: exports_external.array(ReasonSchema).max(MAX_FINDINGS),
   advisory_outputs: exports_external.array(ReasonSchema).max(MAX_FINDINGS),
-  coverage: CoverageSchema
+  coverage: CoverageSchema,
+  validation: ValidationSchema.optional()
 }).strict();
 
 // src/lib/setup.ts

package/dist/lib/review-artifact-schema.d.ts

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-export declare const REVIEW_ARTIFACT_CUSTOM_MESSAGES: readonly ['severity count must match rejected finding count', 'filtered findings require a validation reason', 'risk-critical dispatches require a non-empty selection surface', 'satisfied risk coverage requires a citing input finding ID', 'unsatisfied risk coverage must not cite an input finding ID'];
+export declare const REVIEW_ARTIFACT_CUSTOM_MESSAGES: readonly ['severity count must match rejected finding count', 'filtered findings require a validation reason', 'risk-critical dispatches require a non-empty selection surface', 'satisfied risk coverage requires a citing input finding ID', 'unsatisfied risk coverage must not cite an input finding ID', 'passed validation must not include a reason; non-passed validation requires a reason'];
 export declare const DispatchOutcomeSchema: z.ZodEnum<{
     empty: "empty";
     findings: "findings";
@@ -255,6 +255,15 @@ export declare const ReviewArtifactSchema: z.ZodObject<{
         validator_failures: z.ZodArray<z.ZodString>;
         intent_uncertainty: z.ZodArray<z.ZodString>;
     }, z.core.$strict>;
+    validation: z.ZodOptional<z.ZodObject<{
+        status: z.ZodEnum<{
+            failed: "failed";
+            not_attempted: "not_attempted";
+            passed: "passed";
+            unavailable: "unavailable";
+        }>;
+        reason: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
 }, z.core.$strict>;
 export type ReviewArtifact = z.infer<typeof ReviewArtifactSchema>;
 export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fro.bot/systematic",
-  "version": "3.13.7",
+  "version": "3.14.0",
   "description": "Compound-engineering loops for OpenCode, Pi, and Claude Code",
   "type": "module",
   "homepage": "https://fro.bot/systematic",

package/skills/ce-review/references/review-summary-schema.json

@@ -606,6 +606,23 @@
         "intent_uncertainty"
       ],
       "additionalProperties": false
+    },
+    "validation": {
+      "type": "object",
+      "properties": {
+        "status": {
+          "type": "string",
+          "enum": ["passed", "failed", "unavailable", "not_attempted"]
+        },
+        "reason": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 2048,
+          "pattern": "\\S"
+        }
+      },
+      "required": ["status"],
+      "additionalProperties": false
     }
   },
   "required": [

package/skills/ce-review/references/synthesis-artifact-contract.md

@@ -216,12 +216,18 @@ When it is available, the parent runs
 `systematic validate-review-artifact <path>` against it. The executable ships
 through the npm package's `bin` entry; a harness that installs bundled
 markdown without that package will not have it. When it is unavailable, the
-parent records that validation did not run and why in the run record.
-Unavailable validation is distinct from skipped validation, and the parent
-does not represent the artifact as validated. A nonzero exit means the run is
-not complete. The [executable schema](./review-summary-schema.json) is
-generated from a Zod source and is the machine-checkable form of the shape
-described here.
+parent records `validation.status: "unavailable"` and a `validation.reason` in
+the run record. When the executable is available and the parent does not run
+it, that is `validation.status: "not_attempted"`, also with a reason. The
+`validation.status` values are `passed`, `failed`, `unavailable`, and
+`not_attempted`; `validation.reason` is required for every status except
+`passed`, where it is forbidden.
+
+Unavailable validation is distinct from skipped validation — `unavailable`
+versus `not_attempted` — and in neither case does the parent represent the
+artifact as validated. A nonzero exit means the run is not complete. The
+[executable schema](./review-summary-schema.json) is generated from a Zod
+source and is the machine-checkable form of the shape described here.
 
 On validation failure, the parent repairs the artifact and re-runs the
 validator. It does not report a verdict over an artifact that failed
@@ -235,6 +241,11 @@ in either direction. That is why the command exists as an independently
 runnable check rather than as a self-validation instruction, and why its result
 belongs in the run record. An unavailable validator is recorded as unavailable,
 not as skipped or validated.
+The `validation` field is self-reported: an agent can write `status: passed`
+without running anything, so it is a claim rather than evidence. Its value is
+that it distinguishes states that were previously one indistinguishable
+silence: a check that passed, one that failed, one that could not run, and one
+that was skipped.
 
 `mode:report-only` writes no artifact and therefore performs no validation.