@guanlin4924/devflow-pi 0.1.39 → 0.1.47

package/plugins/devflow-core/skills/workflow-orchestrator/scripts/business_source_resolver.rb

@@ -0,0 +1,365 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+# Deterministically resolves business-model provenance against requirement
+# governance, source assertions, code-index snapshots, domain documents, and
+# Core-owned user decisions. AI-provided source labels are never trusted.
+require "digest"
+require "json"
+require "open3"
+require "optparse"
+require "pathname"
+require "yaml"
+require_relative "requirement_graph"
+
+module BusinessSourceResolver
+  SOURCE_TYPES = %w[requirement code domain_rule user_decision].freeze
+  REGISTRY_SCHEMA = File.expand_path("../contracts/business-source-registry.schema.yaml", __dir__)
+  REFERENCE_ID = /\A[A-Za-z][A-Za-z0-9_-]*\z/.freeze
+
+  module_function
+
+  def add(errors, code, message, source_id: nil, path: nil)
+    entry = { "code" => code, "message" => message }
+    entry["source_id"] = source_id if source_id
+    entry["path"] = path if path
+    errors << entry
+  end
+
+  def load_yaml(path)
+    value = YAML.safe_load(File.read(path), permitted_classes: [], aliases: false)
+    raise ArgumentError, "YAML root must be an object" unless value.is_a?(Hash)
+
+    value
+  rescue Psych::Exception => e
+    raise ArgumentError, "invalid YAML: #{e.message}"
+  end
+
+  def deep_sort(value)
+    case value
+    when Hash then value.keys.sort.to_h { |key| [key, deep_sort(value[key])] }
+    when Array then value.map { |item| deep_sort(item) }
+    else value
+    end
+  end
+
+  def fingerprint(value)
+    "sha256:#{Digest::SHA256.hexdigest(JSON.generate(deep_sort(value)))}"
+  end
+
+  def file_fingerprint(path)
+    "sha256:#{Digest::SHA256.file(path).hexdigest}"
+  end
+
+  def valid_feature?(feature)
+    RequirementGraph.valid_feature?(feature)
+  end
+
+  def safe_path(root, raw, kind, must_exist: true)
+    root_real = File.realpath(root)
+    value = raw.to_s
+    raise ArgumentError, "#{kind} path is required" if value.empty?
+    raise ArgumentError, "#{kind} path must be project-relative" if Pathname.new(value).absolute?
+    raise ArgumentError, "#{kind} path contains control characters" if value.match?(/[\x00-\x1F\x7F]/)
+
+    normalized = Pathname.new(value).cleanpath.to_s.tr("\\", "/")
+    raise ArgumentError, "#{kind} path traverses parent directories" if normalized == ".." || normalized.start_with?("../")
+    absolute = File.expand_path(normalized, root_real)
+    raise ArgumentError, "#{kind} path escapes project root" unless absolute.start_with?("#{root_real}#{File::SEPARATOR}")
+    raise ArgumentError, "#{kind} path is missing" if must_exist && !File.file?(absolute)
+
+    cursor = root_real
+    normalized.split("/").each do |segment|
+      cursor = File.join(cursor, segment)
+      next unless File.symlink?(cursor)
+
+      resolved = File.realpath(cursor)
+      raise ArgumentError, "#{kind} path escapes through symlink" unless resolved == root_real || resolved.start_with?("#{root_real}#{File::SEPARATOR}")
+    end
+    [absolute, normalized]
+  end
+
+  def command(root, *args)
+    stdout, _stderr, status = Open3.capture3(*args, chdir: root)
+    status.success? ? stdout.strip : ""
+  rescue Errno::ENOENT
+    ""
+  end
+
+  def command_success?(root, *args)
+    _stdout, _stderr, status = Open3.capture3(*args, chdir: root)
+    status.success?
+  rescue Errno::ENOENT
+    false
+  end
+
+  def repository_revision(root)
+    command(root, "git", "rev-parse", "HEAD")
+  end
+
+  def worktree_signature(root)
+    output = command(root, "git", "status", "--porcelain=v1", "--untracked-files=all")
+    lines = output.lines.map(&:rstrip).reject do |line|
+      path = line.length > 3 ? line[3..].to_s.strip : ""
+      path.start_with?(".planning/", ".context/")
+    end
+    "sha256:#{Digest::SHA256.hexdigest(lines.join("\n"))}"
+  end
+
+  def validate_shape(registry, schema, feature, errors)
+    top = schema.fetch("top_level")
+    allowed = top.fetch("properties").keys
+    registry.keys.each { |key| add(errors, "BUSINESS_SOURCE_SCHEMA_INVALID", "unknown registry field #{key}", path: key) unless allowed.include?(key) }
+    top.fetch("required").each { |key| add(errors, "BUSINESS_SOURCE_SCHEMA_INVALID", "required registry field #{key} is missing", path: key) unless registry.key?(key) }
+    add(errors, "BUSINESS_SOURCE_SCHEMA_INVALID", "schema_version must be 1", path: "schema_version") unless registry["schema_version"] == 1
+    add(errors, "BUSINESS_SOURCE_SCHEMA_INVALID", "feature does not match", path: "feature") unless registry["feature"] == feature
+    add(errors, "BUSINESS_SOURCE_SCHEMA_INVALID", "registry_revision must be a non-negative integer", path: "registry_revision") unless registry["registry_revision"].is_a?(Integer) && registry["registry_revision"] >= 0
+    add(errors, "BUSINESS_SOURCE_SCHEMA_INVALID", "sources must be an array", path: "sources") unless registry["sources"].is_a?(Array)
+  end
+
+  def validate_source_shape(source, schema, errors, seen)
+    unless source.is_a?(Hash)
+      add(errors, "BUSINESS_SOURCE_SCHEMA_INVALID", "source must be an object")
+      return false
+    end
+    id = source["id"].to_s
+    pattern = Regexp.new(schema.fetch("id_pattern"))
+    add(errors, "BUSINESS_SOURCE_SCHEMA_INVALID", "source ID is invalid", source_id: id) unless id.match?(pattern)
+    if seen.include?(id)
+      add(errors, "BUSINESS_SOURCE_DUPLICATE_ID", "duplicate source ID", source_id: id)
+    else
+      seen << id
+    end
+    type = source["type"].to_s
+    variant = schema.fetch("source_variants", {})[type]
+    unless SOURCE_TYPES.include?(type) && variant.is_a?(Hash)
+      add(errors, "BUSINESS_SOURCE_SCHEMA_INVALID", "unsupported source type #{type}", source_id: id)
+      return false
+    end
+    allowed = variant.fetch("properties").keys
+    source.keys.each do |key|
+      add(errors, "BUSINESS_SOURCE_SCHEMA_INVALID", "field #{key} is not valid for #{type}", source_id: id, path: key) unless allowed.include?(key)
+    end
+    variant.fetch("required").each do |key|
+      add(errors, "BUSINESS_SOURCE_SCHEMA_INVALID", "required field #{key} is missing", source_id: id, path: key) unless source.key?(key)
+    end
+    variant.fetch("properties").each do |key, property|
+      validate_contract_value(source[key], property, errors, id, key) if source.key?(key)
+    end
+    source["locator"].is_a?(Hash) || add(errors, "BUSINESS_SOURCE_SCHEMA_INVALID", "locator must be an object", source_id: id, path: "locator")
+    locator = source["locator"]
+    locator_variant = schema.fetch("locator_variants", {})[type]
+    if locator.is_a?(Hash) && locator_variant.is_a?(Hash)
+      locator_allowed = locator_variant.fetch("properties").keys
+      locator.keys.each do |key|
+        add(errors, "BUSINESS_SOURCE_SCHEMA_INVALID", "locator field #{key} is not valid for #{type}", source_id: id, path: "locator.#{key}") unless locator_allowed.include?(key)
+      end
+      locator_variant.fetch("required", []).each do |key|
+        add(errors, "BUSINESS_SOURCE_SCHEMA_INVALID", "required locator field #{key} is missing", source_id: id, path: "locator.#{key}") unless locator.key?(key)
+      end
+      locator_variant.fetch("properties").each do |key, property|
+        validate_contract_value(locator[key], property, errors, id, "locator.#{key}") if locator.key?(key)
+      end
+      alternatives = locator_variant.fetch("at_least_one", [])
+      if alternatives.any? && alternatives.none? { |key| locator.key?(key) }
+        add(errors, "BUSINESS_SOURCE_SCHEMA_INVALID", "locator requires at least one of #{alternatives.join(', ')}", source_id: id, path: "locator")
+      end
+    end
+    true
+  end
+
+  def validate_contract_value(value, property, errors, source_id, path)
+    return unless property.is_a?(Hash)
+
+    if property.key?("const") && value != property["const"]
+      add(errors, "BUSINESS_SOURCE_SCHEMA_INVALID", "value must equal #{property['const']}", source_id: source_id, path: path)
+      return
+    end
+    valid = case property["type"]
+            when "string" then value.is_a?(String) && (!property["non_empty"] || !value.strip.empty?)
+            when "integer" then value.is_a?(Integer) && (!property.key?("minimum") || value >= property["minimum"])
+            when "id" then value.is_a?(String) && value.match?(REFERENCE_ID)
+            when "requirement_locator", "code_locator", "domain_locator", "decision_locator" then value.is_a?(Hash)
+            else true
+            end
+    add(errors, "BUSINESS_SOURCE_SCHEMA_INVALID", "value does not satisfy #{property['type'] || 'contract'}", source_id: source_id, path: path) unless valid
+  end
+
+  def verify_file_fingerprint(root, source, field, errors)
+    path, relative = safe_path(root, source[field], field)
+    actual = file_fingerprint(path)
+    if source["source_fingerprint"].to_s != actual
+      add(errors, "BUSINESS_SOURCE_FINGERPRINT_MISMATCH", "registered fingerprint does not match current file", source_id: source["id"], path: relative)
+    end
+    [path, relative, actual]
+  rescue ArgumentError => e
+    add(errors, "BUSINESS_SOURCE_NOT_FOUND", e.message, source_id: source["id"], path: source[field].to_s)
+    nil
+  end
+
+  def verify_requirement(root, feature, source, errors)
+    file_info = verify_file_fingerprint(root, source, "document", errors)
+    locator = source["locator"]
+    requirement_ref = locator.is_a?(Hash) ? locator["requirement_ref"].to_s : ""
+    assertion_id = locator.is_a?(Hash) ? locator["assertion_id"].to_s : ""
+    begin
+      graph, = RequirementGraph.load_graph(root, feature)
+      requirement = Array(graph["nodes"]).find { |node| node.is_a?(Hash) && node["id"] == requirement_ref && node["kind"] == "requirement" }
+      unless requirement && %w[confirmed approved].include?(requirement["status"].to_s)
+        add(errors, "BUSINESS_REQUIREMENT_REF_INVALID", "requirement_ref must resolve to a confirmed/approved requirement", source_id: source["id"], path: requirement_ref)
+      end
+    rescue ArgumentError => e
+      add(errors, "BUSINESS_REQUIREMENT_REF_INVALID", e.message, source_id: source["id"], path: requirement_ref)
+    end
+    units_path = File.join(RequirementGraph.feature_dir(root, feature), "source_units.yaml")
+    unless File.file?(units_path)
+      add(errors, "BUSINESS_ASSERTION_NOT_FOUND", "source_units.yaml is missing", source_id: source["id"], path: units_path)
+      return
+    end
+    units = load_yaml(units_path)
+    assertions = Array(units["units"]).flat_map { |unit| Array(unit["required_assertions"]) }
+    add(errors, "BUSINESS_ASSERTION_NOT_FOUND", "assertion locator is not present in source_units", source_id: source["id"], path: assertion_id) unless assertions.any? { |item| item.is_a?(Hash) && item["assertion_id"].to_s == assertion_id }
+    if file_info && units["source_document_fingerprint"].to_s != file_info[2]
+      add(errors, "BUSINESS_SOURCE_FINGERPRINT_MISMATCH", "source_units fingerprint does not match the requirement document", source_id: source["id"], path: units_path)
+    end
+  rescue ArgumentError => e
+    add(errors, "BUSINESS_SOURCE_SCHEMA_INVALID", e.message, source_id: source["id"])
+  end
+
+  def verify_code(root, source, errors)
+    id = source["id"]
+    path_info = safe_path(root, source["path"], "code")
+    path, relative = path_info
+    actual_hash = file_fingerprint(path)
+    add(errors, "BUSINESS_CODE_CONTENT_MISMATCH", "code content_hash is stale", source_id: id, path: relative) unless source["content_hash"].to_s == actual_hash
+    current_revision = repository_revision(root)
+    add(errors, "BUSINESS_CODE_REVISION_MISMATCH", "repository revision is stale", source_id: id) unless !current_revision.empty? && source["repository_revision"].to_s == current_revision
+    current_signature = worktree_signature(root)
+    add(errors, "BUSINESS_WORKTREE_SIGNATURE_MISMATCH", "worktree signature is stale", source_id: id) unless source["worktree_signature"].to_s == current_signature
+
+    snapshot_path = File.join(root, ".planning", "code-index", "SNAPSHOT.json")
+    unless File.file?(snapshot_path)
+      add(errors, "BUSINESS_CODE_INDEX_STALE", "code index snapshot is missing", source_id: id, path: snapshot_path)
+      return
+    end
+    snapshot = JSON.parse(File.read(snapshot_path))
+    if snapshot["generation"].to_s != source["index_generation"].to_s || snapshot.dig("workspace", "repositoryRevision").to_s != current_revision
+      add(errors, "BUSINESS_CODE_INDEX_STALE", "code index generation or repository revision is stale", source_id: id, path: snapshot_path)
+    end
+    symbol = source.dig("locator", "symbol").to_s
+    line_start = source.dig("locator", "line_start")
+    if symbol.empty? && !line_start.is_a?(Integer)
+      add(errors, "BUSINESS_CODE_LOCATOR_INVALID", "code locator requires symbol or line_start", source_id: id)
+      return
+    end
+    if line_start.is_a?(Integer)
+      line_count = File.foreach(path).count
+      add(errors, "BUSINESS_CODE_LOCATOR_INVALID", "line_start is outside the current file", source_id: id, path: relative) unless line_start.positive? && line_start <= line_count
+    end
+    return if symbol.empty?
+
+    symbols_path = File.join(root, ".planning", "code-index", "symbols.jsonl")
+    unless File.file?(symbols_path)
+      add(errors, "BUSINESS_CODE_SYMBOL_NOT_FOUND", "symbols index is missing", source_id: id, path: symbols_path)
+      return
+    end
+    symbols = File.readlines(symbols_path, chomp: true).map do |line|
+      JSON.parse(line)
+    rescue JSON::ParserError
+      nil
+    end.compact
+    match = symbols.find do |entry|
+      entry["path"].to_s == relative && [entry["name"].to_s, entry["qualified_name"].to_s].include?(symbol) &&
+        (!line_start.is_a?(Integer) || (entry["line_start"].to_i <= line_start && entry["line_end"].to_i >= line_start))
+    end
+    add(errors, "BUSINESS_CODE_SYMBOL_NOT_FOUND", "symbol/line is not present in the current index", source_id: id, path: relative) unless match
+
+    return unless source["commit"]
+
+    unless command_success?(root, "git", "cat-file", "-e", "#{source['commit']}:#{relative}")
+      add(errors, "BUSINESS_CODE_COMMIT_INVALID", "commit does not contain the registered code path", source_id: id, path: relative)
+    end
+  rescue ArgumentError => e
+    add(errors, "BUSINESS_CODE_PATH_INVALID", e.message, source_id: source["id"], path: source["path"].to_s)
+  rescue JSON::ParserError => e
+    add(errors, "BUSINESS_CODE_INDEX_STALE", "invalid code index snapshot: #{e.message}", source_id: source["id"])
+  end
+
+  def verify_domain_rule(root, source, errors)
+    file_info = verify_file_fingerprint(root, source, "document", errors)
+    return unless file_info
+
+    clause = source.dig("locator", "clause_id").to_s
+    if clause.empty? || !File.readlines(file_info[0], chomp: true).any? { |line| line.include?(clause) }
+      add(errors, "BUSINESS_DOMAIN_RULE_INVALID", "domain clause locator is not present in the document", source_id: source["id"], path: clause)
+    end
+  end
+
+  def verify_user_decision(root, feature, source, errors)
+    path = File.join(RequirementGraph.feature_dir(root, feature), "business-decisions.json")
+    unless File.file?(path)
+      add(errors, "BUSINESS_DECISION_INVALID", "Core decision registry is missing", source_id: source["id"], path: path)
+      return
+    end
+    registry = JSON.parse(File.read(path))
+    stored_fingerprint = registry["fingerprint"].to_s
+    payload = registry.reject { |key, _| key == "fingerprint" }
+    actual_fingerprint = fingerprint(payload)
+    decision_id = source.dig("locator", "decision_id").to_s
+    valid = registry["feature"] == feature && registry["revision"] == source["decision_revision"] &&
+            stored_fingerprint == actual_fingerprint && source["decision_fingerprint"].to_s == actual_fingerprint &&
+            Array(registry["decisions"]).any? { |entry| entry.is_a?(Hash) && entry["id"].to_s == decision_id }
+    add(errors, "BUSINESS_DECISION_INVALID", "decision revision/fingerprint/locator is not current", source_id: source["id"], path: decision_id) unless valid
+  rescue JSON::ParserError => e
+    add(errors, "BUSINESS_DECISION_INVALID", "invalid decision registry: #{e.message}", source_id: source["id"], path: path)
+  end
+
+  def validate(root:, feature:, registry_path: nil)
+    raise ArgumentError, "invalid feature" unless valid_feature?(feature)
+    root = File.realpath(root)
+    schema = load_yaml(REGISTRY_SCHEMA)
+    raw_registry = registry_path || File.join(".planning", "business-model", feature, "source-registry.yaml")
+    registry_absolute, registry_relative = safe_path(root, raw_registry, "source registry")
+    registry = load_yaml(registry_absolute)
+    errors = []
+    validate_shape(registry, schema, feature, errors)
+    sources = registry["sources"].is_a?(Array) ? registry["sources"] : []
+    seen = []
+    sources.each do |source|
+      next unless validate_source_shape(source, schema, errors, seen)
+
+      case source["type"]
+      when "requirement" then verify_requirement(root, feature, source, errors)
+      when "code" then verify_code(root, source, errors)
+      when "domain_rule" then verify_domain_rule(root, source, errors)
+      when "user_decision" then verify_user_decision(root, feature, source, errors)
+      end
+    end
+    registry_fingerprint = fingerprint(registry)
+    {
+      "ok" => errors.empty?,
+      "verdict" => errors.empty? ? "allow" : "block_unsafe",
+      "errors" => errors,
+      "warnings" => [],
+      "source_registry_path" => registry_relative,
+      "source_registry_fingerprint" => registry_fingerprint,
+      "resolved_source_ids" => errors.empty? ? sources.map { |source| source["id"] } : []
+    }
+  rescue ArgumentError, Errno::ENOENT => e
+    { "ok" => false, "verdict" => "block_unsafe", "errors" => [{ "code" => "BUSINESS_SOURCE_SCHEMA_INVALID", "message" => e.message }], "warnings" => [] }
+  end
+end
+
+if $PROGRAM_NAME == __FILE__
+  options = {}
+  OptionParser.new do |opts|
+    opts.on("--root PATH") { |value| options[:root] = value }
+    opts.on("--feature NAME") { |value| options[:feature] = value }
+    opts.on("--registry PATH") { |value| options[:registry_path] = value }
+    opts.on("--json") { options[:json] = true }
+  end.parse!
+  abort("--root and --feature are required") unless options[:root] && options[:feature]
+  payload = BusinessSourceResolver.validate(root: options[:root], feature: options[:feature], registry_path: options[:registry_path])
+  puts JSON.pretty_generate(payload)
+  exit(payload["ok"] ? 0 : 1)
+end

package/plugins/devflow-core/skills/workflow-orchestrator/scripts/checker_registry.rb

@@ -7,6 +7,8 @@ module CheckerRegistry
     api-test-schema-check contract-coverage-check api-test-matrix-check
     test-coverage-check test-obligation-check acceptance-test-results-check
     change-impact-check tdd-evidence-check test-task-binding-check
+    cross-track-consistency-check business-closure-check business-claim-reference-check
+    business-cross-model-check business-invalidation-check
   ].freeze
   EMBEDDED = %w[requirement-coverage-check source-authority-check traceability-check].freeze
 

package/plugins/devflow-core/skills/workflow-orchestrator/scripts/cross_track_consistency_check.rb

@@ -0,0 +1,94 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+require "json"
+require "optparse"
+require "yaml"
+
+options = { feature: nil, json: false }
+OptionParser.new do |opts|
+  opts.on("--feature FEATURE") { |value| options[:feature] = value }
+  opts.on("--json") { options[:json] = true }
+end.parse!
+
+raise ArgumentError, "--feature is required" if options[:feature].to_s.empty?
+feature = options[:feature].to_s
+raise ArgumentError, "feature contains path separators" if feature.include?("/") || feature.include?("\\")
+
+root = Dir.pwd
+base = File.join(root, ".planning", "features", feature)
+files = {
+  "api_contract" => File.join(base, "api-contract.md"),
+  "api_call_guide" => File.join(base, "api-call-guide.md"),
+  "frontend_spec" => File.join(base, "前端技术方案.md"),
+  "backend_spec" => File.join(base, "后端技术方案.md"),
+  "api_supplement" => File.join(base, "api-supplement-requests.md"),
+}
+errors = []
+missing = files.select { |_, path| !File.file?(path) }.keys
+errors << { "code" => "CROSS_TRACK_ARTIFACT_MISSING", "files" => missing } unless missing.empty?
+
+read = lambda do |key|
+  path = files.fetch(key)
+  File.file?(path) ? File.read(path) : ""
+end
+contract = read.call("api_contract")
+guide = read.call("api_call_guide")
+frontend = read.call("frontend_spec")
+
+# Endpoint references are deliberately extracted from the authoritative API
+# contract and checked for textual closure in both consumers. This is a
+# deterministic reference-closure check; an AI integration summary is not used.
+endpoint_pattern = %r{\b(?:GET|POST|PUT|PATCH|DELETE)\s+(/[A-Za-z0-9_./:-]+(?:\{[A-Za-z0-9_]+\})*)}
+endpoints = contract.scan(endpoint_pattern).flatten.uniq
+unreferenced = endpoints.reject { |endpoint| guide.include?(endpoint) && frontend.include?(endpoint) }
+unless unreferenced.empty?
+  errors << { "code" => "CROSS_TRACK_ENDPOINT_REFERENCE_MISSING", "endpoints" => unreferenced }
+end
+
+contract_set = endpoints.to_h { |endpoint| [endpoint, true] }
+{
+  "api_call_guide" => guide.scan(endpoint_pattern).flatten.uniq,
+  "frontend_spec" => frontend.scan(endpoint_pattern).flatten.uniq,
+}.each do |consumer, references|
+  ghosts = references.reject { |endpoint| contract_set[endpoint] }
+  errors << { "code" => "CROSS_TRACK_ENDPOINT_NOT_IN_CONTRACT", "consumer" => consumer, "endpoints" => ghosts } unless ghosts.empty?
+end
+
+supplement = read.call("api_supplement")
+supplement_endpoints = supplement.scan(endpoint_pattern).flatten.uniq
+supplement_ghosts = supplement_endpoints.reject { |endpoint| contract_set[endpoint] }
+errors << { "code" => "CROSS_TRACK_SUPPLEMENT_ENDPOINT_NOT_IN_CONTRACT", "endpoints" => supplement_ghosts } unless supplement_ghosts.empty?
+supplement_unconsumed = supplement_endpoints.reject { |endpoint| guide.include?(endpoint) }
+errors << { "code" => "CROSS_TRACK_SUPPLEMENT_GUIDE_MISMATCH", "endpoints" => supplement_unconsumed } unless supplement_unconsumed.empty?
+
+meta_path = File.join(base, "api-call-guide.meta.json")
+if File.file?(meta_path)
+  begin
+    meta = JSON.parse(File.read(meta_path))
+    errors << { "code" => "CROSS_TRACK_API_GUIDE_NOT_CONSUMABLE" } unless meta["frontend_consumable"] == true && meta["mock_ready"] == true
+    pending = meta["pending_items"]
+    errors << { "code" => "CROSS_TRACK_API_GUIDE_PENDING_ITEMS", "pending_items" => pending } unless pending.is_a?(Array) && pending.empty?
+  rescue JSON::ParserError => error
+    errors << { "code" => "CROSS_TRACK_META_INVALID", "detail" => error.message }
+  end
+end
+
+supplement_meta = File.join(base, "api-supplement-requests.meta.json")
+if File.file?(supplement_meta)
+  begin
+    meta = JSON.parse(File.read(supplement_meta))
+    unresolved = meta["unresolved_supplement_count"]
+    errors << { "code" => "CROSS_TRACK_SUPPLEMENT_UNRESOLVED", "count" => unresolved } unless unresolved == 0
+  rescue JSON::ParserError => error
+    errors << { "code" => "CROSS_TRACK_META_INVALID", "detail" => error.message }
+  end
+end
+
+result = {
+  "ok" => errors.empty?,
+  "checker_id" => "cross-track-consistency-check",
+  "errors" => errors,
+  "evidence" => { "endpoint_count" => endpoints.length, "checked_files" => files.values.map { |path| path.sub("#{root}/", "") } },
+}
+puts(options[:json] ? JSON.generate(result) : result.to_yaml)

package/plugins/devflow-core/skills/workflow-orchestrator/scripts/execution_contract.rb

@@ -11,10 +11,10 @@ require_relative "control_io"
 require_relative "requirement_graph"
 
 POLICY = {
-  "requirement-baseline" => { "checkers" => %w[requirement-graph-check slice-independence-check acceptance-coverage-check change-impact-check], "agents" => [], "budget" => 0, "allowed_graph_delta" => %w[requirement rule boundary slice acceptance] },
+  "requirement-baseline" => { "checkers" => %w[requirement-graph-check business-closure-check slice-independence-check acceptance-coverage-check change-impact-check], "agents" => [], "budget" => 0, "allowed_graph_delta" => %w[requirement rule boundary slice acceptance] },
   "api-contract" => { "checkers" => %w[requirement-graph-check contract-coverage-check api-test-schema-check change-impact-check], "agents" => [], "budget" => 0, "allowed_graph_delta" => %w[api] },
   "architecture-feasibility" => { "checkers" => %w[requirement-graph-check change-impact-check], "agents" => [], "budget" => 0, "allowed_graph_delta" => %w[workload_shape workload_constraint decision risk metric read_model] },
-  "integration-verify" => { "checkers" => %w[requirement-graph-check slice-independence-check contract-coverage-check change-impact-check], "agents" => ["verification-runner"], "budget" => 1, "allowed_graph_delta" => %w[requirement risk decision] },
+  "integration-verify" => { "checkers" => %w[requirement-graph-check slice-independence-check contract-coverage-check change-impact-check cross-track-consistency-check business-claim-reference-check business-cross-model-check], "agents" => ["verification-runner"], "budget" => 1, "allowed_graph_delta" => %w[requirement risk decision] },
   "acceptance-test-design" => { "checkers" => %w[requirement-graph-check contract-coverage-check acceptance-coverage-check api-test-matrix-check test-coverage-check test-obligation-check change-impact-check], "agents" => [], "budget" => 0, "allowed_graph_delta" => %w[test_case] },
   "change-plan" => { "checkers" => %w[requirement-graph-check slice-independence-check contract-coverage-check api-test-matrix-check test-coverage-check test-obligation-check test-task-binding-check change-impact-check], "agents" => [], "budget" => 0, "allowed_graph_delta" => %w[acceptance] },
   "execute" => { "checkers" => %w[tdd-evidence-check change-impact-check], "agents" => ["implementation-worker"], "budget" => 1, "allowed_graph_delta" => %w[requirement rule boundary behavior] },
@@ -69,7 +69,7 @@ begin
     "state_revision" => state["revision"], "graph_revision" => graph["revision"], "workflow_path" => workflow_relative,
     "workflow_fingerprint" => Digest::SHA256.hexdigest(workflow_raw), "manifest_id" => "devflow-core-execution-policy-v2",
     "allowed_paths" => paths, "allowed_agents" => policy["agents"], "checker_ids" => policy["checkers"],
-    "allowed_tools" => %w[read grep find glob lsp search write edit apply_patch bash shell exec_command task devflow_api_test_matrix devflow_tdd_evidence devflow_run_acceptance_tests],
+    "allowed_tools" => %w[read grep find glob lsp search write edit apply_patch bash shell exec_command task devflow_api_test_matrix devflow_tdd_evidence devflow_run_acceptance_tests devflow_mainflow],
     "tool_budget" => policy["budget"], "acceptance" => Array(graph["nodes"]).select { |node| node["kind"] == "acceptance" }.map { |node| node["id"] },
     "allowed_graph_delta" => Array(policy["allowed_graph_delta"]),
     "on_unknown" => "block_and_escalate"

package/plugins/devflow-core/skills/workflow-orchestrator/scripts/gate_contract.rb

@@ -24,6 +24,9 @@ module GateContract
     %w[allowed_tracks allowed_predecessors].each do |field|
       raise ArgumentError, "#{field} must be an array" unless topology[field].is_a?(Array)
     end
+    if topology.key?("allowed_intervening_predecessors") && !topology["allowed_intervening_predecessors"].is_a?(Array)
+      raise ArgumentError, "allowed_intervening_predecessors must be an array"
+    end
     raise ArgumentError, "allowed_reentry must be an array" unless topology["allowed_reentry"].is_a?(Array)
     validate_reentries!(topology["allowed_reentry"])
     checkpoint = topology["checkpoint"]