@haposoft/cafekit 0.16.0-rc.7 → 0.16.0-rc.8

package/src/claude/hooks/__tests__/spec-gate.test.js

@@ -99,6 +99,10 @@ function makeWorkflowFixture(receiptLines = [], plannedCommand = 'node --test')
     '',
     'Status: done',
     '',
+    '## Dependencies',
+    '',
+    '- none',
+    '',
     '## Verification Plan',
     '',
     `- Command: ${plannedCommand}`,
@@ -1318,10 +1322,80 @@ test('32. process-v3 requires Receipt heading and runtime-bound provenance', ()
   }
 });
 
+test('32b. process-v3 ignores a Receipt heading and proof contained only in a fence', () => {
+  const dir = makeWorkflowFixture([
+    '~~~~markdown', '## Receipt', '', 'Verification: PASS', 'Command: node --test', 'Exit: 0',
+    `Base: ${VALID_BASE}`, `Head: ${VALID_HEAD}`, '```text', 'pass: 1', '```', '~~~~',
+  ]);
+  try {
+    clearCache();
+    const body = parseBlock(runHook({}, dir).stdout);
+    assert.ok(body, 'fenced-only process-v3 Receipt must block');
+    assert.strictEqual(body.decision, 'block');
+    assert.match(body.reason, /missing_receipt/);
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test('32c. process-v3 ignores canonical Receipt fields contained only in its output fence', () => {
+  const dir = makeWorkflowFixture([
+    '## Receipt', '', '```text', 'Verification: PASS', 'Command: node --test', 'Exit: 0',
+    `Base: ${VALID_BASE}`, `Head: ${VALID_HEAD}`, 'pass: 1', '```',
+  ]);
+  try {
+    clearCache();
+    const body = parseBlock(runHook({}, dir).stdout);
+    assert.ok(body, 'fenced-only canonical fields must block');
+    assert.strictEqual(body.decision, 'block');
+    assert.match(body.reason, /verification_state/);
+    assert.match(body.reason, /command/);
+    assert.match(body.reason, /provenance/);
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test('32d. process-v3 preserves explicit failures from the Receipt output fence', () => {
+  const dir = makeWorkflowFixture([
+    '## Receipt', '', 'Verification: PASS', 'Command: node --test', 'Exit: 0',
+    `Base: ${VALID_BASE}`, `Head: ${VALID_HEAD}`, '```text', '$ node --test',
+    'exit code: 1', 'FAIL', '```',
+  ]);
+  try {
+    clearCache();
+    const body = parseBlock(runHook({}, dir).stdout);
+    assert.ok(body, 'explicit fenced output failure must block');
+    assert.strictEqual(body.decision, 'block');
+    assert.match(body.reason, /verification_state/);
+    assert.match(body.reason, /exit_result/);
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test('32e. process-v3 rejects output whose closing fence is shorter than its opener', () => {
+  const dir = makeWorkflowFixture([
+    '## Receipt', '', 'Verification: PASS', 'Command: node --test', 'Exit: 0',
+    `Base: ${VALID_BASE}`, `Head: ${VALID_HEAD}`, '````text', '$ node --test',
+    'pass: 1', '```',
+  ]);
+  try {
+    clearCache();
+    const body = parseBlock(runHook({}, dir).stdout);
+    assert.ok(body, 'malformed output fence must block');
+    assert.strictEqual(body.decision, 'block');
+    assert.match(body.reason, /command_output/);
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
 test('33. process-v3 done task with canonical inline Receipt passes', () => {
   const dir = makeWorkflowFixture([
     '## Receipt', '', 'Verification: PASS', 'Command: node --test', 'Exit: 0',
-    `Base: ${VALID_BASE}`, `Head: ${VALID_HEAD}`, '```text', '$ node --test', 'pass: 1', '```',
+    `Base: ${VALID_BASE}`, `Head: ${VALID_HEAD}`, '```text', '$ node --test',
+    'Status: pending', '## Receipt', 'pass: 1', '```',
   ]);
   try {
     clearCache();
@@ -1360,6 +1434,7 @@ test('35. process-v3 Stop ignores a completed packet when one packet remains act
     fs.writeFileSync(path.join(activeDir, 'plan.md'), '# Active plan\n');
     fs.writeFileSync(path.join(activeDir, 'task-01-active.md'), [
       '# Task 01: active', '', 'Status: pending', '',
+      '## Dependencies', '', '- none', '',
       '## Verification Plan', '', '- Command: node --test', '',
     ].join('\n'));
     clearCache();
@@ -1389,6 +1464,7 @@ test('36. process-v3 Stop accepts two completed packets with valid Receipts', ()
     });
     fs.writeFileSync(path.join(otherDir, 'task-01-other.md'), [
       '# Task 01: other', '', 'Status: done', '',
+      '## Dependencies', '', '- none', '',
       '## Verification Plan', '', '- Command: node --test', '',
       '## Receipt', '',
       'Verification: PASS', 'Command: node --test', 'Exit: 0',

package/src/claude/hooks/__tests__/state.test.js

@@ -7,7 +7,253 @@ const fs = require('node:fs');
 const os = require('node:os');
 const path = require('node:path');
 
-const HOOK = path.join(__dirname, '..', 'state.cjs');
+const CLAUDE_ROOT = path.join(__dirname, '..', '..');
+const STATE_HOOK = path.join(CLAUDE_ROOT, 'hooks', 'state.cjs');
+const POLICY = require(path.join(CLAUDE_ROOT, 'scripts', 'workflow-policy.cjs'));
+
+function processTaskContent(title, status, dependency = 'none') {
+  return [
+    `# ${title}`, '', `Status: ${status}`, '',
+    '## Dependencies', '', `- ${dependency}`, '',
+    '## Verification Plan', '', '- Command: node --test', '',
+  ].join('\n');
+}
+
+function canonicalProcessTask(root, title, dependency = 'none') {
+  const context = POLICY.deriveRuntimeContext({
+    projectRoot: root,
+    specsRoot: path.join(root, 'specs'),
+    specFile: path.join(root, 'specs', 'auth', 'plan.md'),
+    featureName: 'auth',
+    runtimeSession: 'session-auth-state',
+  });
+  return [
+    processTaskContent(title, 'done', dependency),
+    '## Receipt', '', 'Verification: PASS', 'Command: node --test', 'Exit: 0',
+    `Base: ${context.base}`, `Head: ${context.head}`,
+    '```text', 'node --test', '1 test passed', '```', '',
+  ].join('\n');
+}
+
+function inInstalledProcessSpecStateFixture(run) {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'ck-spec-state-'));
+  try {
+    const hooks = path.join(dir, '.claude', 'hooks');
+    const scripts = path.join(dir, '.claude', 'scripts');
+    fs.mkdirSync(hooks, { recursive: true });
+    fs.mkdirSync(scripts, { recursive: true });
+    fs.copyFileSync(path.join(CLAUDE_ROOT, 'hooks', 'spec-state.cjs'), path.join(hooks, 'spec-state.cjs'));
+    for (const file of [
+      'provenance.cjs',
+      'spec-receipt.cjs',
+      'spec-resolver.cjs',
+      'workflow-policy.cjs',
+    ]) {
+      fs.copyFileSync(path.join(CLAUDE_ROOT, 'scripts', file), path.join(scripts, file));
+    }
+
+    const feature = path.join(dir, 'specs', 'auth');
+    fs.mkdirSync(feature, { recursive: true });
+    fs.writeFileSync(path.join(feature, 'plan.md'), '# Auth plan\nSpecs-Contract: process-first-ready-v1\n');
+
+    for (const args of [
+      ['init', '-q'],
+      ['config', 'user.email', 'cafekit@example.invalid'],
+      ['config', 'user.name', 'CafeKit Test'],
+      ['commit', '--allow-empty', '-qm', 'fixture'],
+    ]) {
+      const git = spawnSync('git', ['-C', dir, ...args], { encoding: 'utf8' });
+      assert.strictEqual(git.status, 0, git.stderr);
+    }
+
+    const writeTask = (basename, title, status, dependency = 'none') => {
+      fs.writeFileSync(
+        path.join(feature, basename),
+        processTaskContent(title, status, dependency),
+      );
+    };
+    const runState = () => spawnSync(process.execPath, [path.join(hooks, 'spec-state.cjs')], {
+      cwd: dir,
+      env: { ...process.env, PROJECT_ROOT: dir },
+      input: JSON.stringify({
+        cwd: dir,
+        featureName: 'auth',
+        session_id: 'session-auth-state',
+        hook_event_name: 'UserPromptSubmit',
+        prompt: 'Continue',
+      }),
+      encoding: 'utf8',
+    });
+    return run({
+      cacheFile: path.join(hooks, '.logs', 'tollgate-last.txt'),
+      dir,
+      feature,
+      hooks,
+      runState,
+      writePlan: (content) => fs.writeFileSync(path.join(feature, 'plan.md'), content),
+      writeTask,
+    });
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+}
+
+test('Claude installed spec-state re-evaluates a standalone task when blocked becomes pending', () => {
+  inInstalledProcessSpecStateFixture(({ cacheFile, hooks, runState, writeTask }) => {
+    writeTask('task-01-auth.md', 'Task 01: auth', 'blocked');
+
+    const blocked = runState();
+    assert.strictEqual(blocked.status, 0, blocked.stderr);
+    assert.match(blocked.stdout, /0 pending, 1 blocked/);
+    assert.doesNotMatch(blocked.stdout, /Next unblocked/);
+    assert.ok(cacheFile.startsWith(`${hooks}${path.sep}`), 'cache must stay inside temporary installed hooks');
+    assert.strictEqual(fs.existsSync(cacheFile), true, 'installed cache must be created');
+    const blockedCache = fs.readFileSync(cacheFile, 'utf8');
+
+    writeTask('task-01-auth.md', 'Task 01: auth', 'pending');
+    const pending = runState();
+    assert.strictEqual(pending.status, 0, pending.stderr);
+    assert.match(pending.stdout, /Spec state changed: `auth`/);
+    assert.match(pending.stdout, /1 pending, 0 blocked/);
+    assert.match(pending.stdout, /Next unblocked: `task-01-auth\.md`/);
+    assert.notStrictEqual(fs.readFileSync(cacheFile, 'utf8'), blockedCache, 'state cache must change');
+  });
+});
+
+test('Claude installed spec-state requires current canonical dependency proof and keys receipt mutations', () => {
+  inInstalledProcessSpecStateFixture(({ cacheFile, dir, feature, hooks, runState, writeTask }) => {
+    const predecessor = 'task-01-semantic-review.md';
+    const dependent = 'task-02-implementation.md';
+    writeTask(predecessor, 'Task 01: semantic review', 'blocked');
+    writeTask(dependent, 'Task 02: implementation', 'pending', predecessor);
+    const dependentPath = path.join(feature, dependent);
+    const unchangedDependent = fs.readFileSync(dependentPath, 'utf8');
+
+    const blocked = runState();
+    assert.strictEqual(blocked.status, 0, blocked.stderr);
+    assert.match(blocked.stdout, /0 done \/ 2 total \(0 in_progress, 1 pending, 1 blocked\)/);
+    assert.doesNotMatch(blocked.stdout, /Next unblocked/);
+    assert.ok(cacheFile.startsWith(`${hooks}${path.sep}`), 'cache must stay inside temporary installed hooks');
+    assert.strictEqual(fs.existsSync(cacheFile), true, 'installed cache must be created');
+    const blockedCache = fs.readFileSync(cacheFile, 'utf8');
+
+    writeTask(predecessor, 'Task 01: semantic review', 'done');
+    const missing = runState();
+    assert.strictEqual(missing.status, 0, missing.stderr);
+    assert.doesNotMatch(missing.stdout, /Next unblocked/);
+    const missingCache = fs.readFileSync(cacheFile, 'utf8');
+    assert.notStrictEqual(missingCache, blockedCache, 'done without proof must change cached proof state');
+
+    fs.appendFileSync(path.join(feature, predecessor), '\n## Receipt\n\nVerification: PASS\n');
+    const malformed = runState();
+    assert.strictEqual(malformed.status, 0, malformed.stderr);
+    assert.doesNotMatch(malformed.stdout, /Next unblocked/);
+
+    fs.writeFileSync(path.join(feature, predecessor), canonicalProcessTask(dir, 'Task 01: semantic review'));
+    const ready = runState();
+    assert.strictEqual(ready.status, 0, ready.stderr);
+    assert.match(ready.stdout, /Next unblocked: `task-02-implementation\.md`/);
+    const readyCache = fs.readFileSync(cacheFile, 'utf8');
+    assert.notStrictEqual(readyCache, missingCache, 'canonical proof must change cached proof state');
+
+    fs.writeFileSync(
+      path.join(feature, predecessor),
+      fs.readFileSync(path.join(feature, predecessor), 'utf8').replace('Verification: PASS', 'Verification: FAIL'),
+    );
+    const mutated = runState();
+    assert.strictEqual(mutated.status, 0, mutated.stderr);
+    assert.doesNotMatch(mutated.stdout, /Next unblocked/);
+    assert.notStrictEqual(fs.readFileSync(cacheFile, 'utf8'), readyCache, 'receipt-only mutation must change cache');
+    assert.strictEqual(fs.readFileSync(dependentPath, 'utf8'), unchangedDependent, 'dependent must remain pending');
+  });
+});
+
+test('Claude installed spec-state keeps unversioned pending packets out of Next with migration guidance', () => {
+  inInstalledProcessSpecStateFixture(({ feature, runState, writePlan, writeTask }) => {
+    const fencedMarkerPlan = '# Auth plan\n\n```markdown\nSpecs-Contract: process-first-ready-v1\n```\n';
+    writePlan(fencedMarkerPlan);
+    writeTask('task-01-auth.md', 'Task 01: auth', 'pending');
+    const taskBytes = fs.readFileSync(path.join(feature, 'task-01-auth.md'));
+    const result = runState();
+    assert.strictEqual(result.status, 0, result.stderr);
+    assert.doesNotMatch(result.stdout, /Next unblocked/);
+    assert.match(result.stdout, /Migration required: add `Specs-Contract: process-first-ready-v1`/);
+    const cached = runState();
+    assert.strictEqual(cached.status, 0, cached.stderr);
+    assert.doesNotMatch(cached.stdout, /Next unblocked/);
+    assert.match(cached.stdout, /Add `Specs-Contract: process-first-ready-v1`/);
+
+    writePlan(fencedMarkerPlan.replace('# Auth plan\n', '# Auth plan\nSpecs-Contract: process-first-ready-v1\n'));
+    const marked = runState();
+    assert.strictEqual(marked.status, 0, marked.stderr);
+    assert.match(marked.stdout, /Spec state changed: `auth`/);
+    assert.match(marked.stdout, /Next unblocked: `task-01-auth\.md`/);
+    assert.deepStrictEqual(fs.readFileSync(path.join(feature, 'task-01-auth.md')), taskBytes, 'marker-only transition must not change task bytes');
+  });
+});
+
+test('Claude resolver ignores fenced workflow annotations and rejects fenced-only Status', () => {
+  inInstalledProcessSpecStateFixture(({ dir, feature, runState, writePlan, writeTask }) => {
+    const resolver = require(path.join(dir, '.claude', 'scripts', 'spec-resolver.cjs'));
+    const trailingFence = resolver.annotatedMarkdownLines([
+      '```markdown', '``` trailing', 'Specs-Contract: process-first-ready-v1',
+      'Status: done', '## Receipt', '```',
+    ].join('\n'));
+    assert.deepStrictEqual(trailingFence.slice(2, 5).map(({ outsideFence }) => outsideFence), [false, false, false]);
+    const fourSpaceFence = resolver.annotatedMarkdownLines('    ```markdown\nStatus: pending');
+    assert.strictEqual(fourSpaceFence[1].outsideFence, true);
+    writePlan('# Auth plan\nSpecs-Contract: process-first-ready-v1\n');
+    fs.writeFileSync(path.join(feature, 'task-01-fenced-only.md'), [
+      '# Task 01', '', '```markdown', 'Status: done', '```', '',
+      '## Dependencies', '', '- none', '', '## Verification Plan', '', '- Command: node --test', '',
+    ].join('\n'));
+    const malformed = resolver.resolveWorkflowCandidate({ projectRoot: dir, runtime: {}, explicitFeature: 'auth' });
+    assert.strictEqual(malformed.error, 'explicit_malformed');
+    assert.match(malformed.reason, /must contain exactly one supported Status field/);
+
+    fs.rmSync(path.join(feature, 'task-01-fenced-only.md'));
+    writeTask('task-01-dependent.md', 'Task 01: dependent', 'pending', 'task-02-predecessor.md');
+    fs.writeFileSync(path.join(feature, 'task-02-predecessor.md'), [
+      '# Task 02', '', 'Status: pending', '', '## Dependencies', '', '- none', '',
+      '## Verification Plan', '', '- Command: node --test', '',
+      '~~~~markdown', 'Status: done', '## Dependencies', '- task-01-dependent.md', '## Receipt',
+      'Verification: PASS', 'Command: node --test', 'Exit: 0', '```text', 'fake pass', '```', '~~~~', '',
+    ].join('\n'));
+    const result = runState();
+    assert.strictEqual(result.status, 0, result.stderr);
+    assert.match(result.stdout, /Next unblocked: `task-02-predecessor\.md`/);
+    assert.doesNotMatch(result.stdout, /Next unblocked: `task-01-dependent\.md`/);
+  });
+});
+
+test('Claude resolver accepts unique legacy task numbers, rejects ambiguity, and rejects exact cycles', () => {
+  inInstalledProcessSpecStateFixture(({ dir, feature, writePlan, writeTask }) => {
+    const resolver = require(path.join(dir, '.claude', 'scripts', 'spec-resolver.cjs'));
+    writePlan('# Auth plan\n');
+    writeTask('task-01-a.md', 'Task 01: a', 'pending');
+    writeTask('task-02-b.md', 'Task 02: b', 'pending', 'Task 01');
+    fs.writeFileSync(path.join(feature, 'task-03-c.md'), '# Task 03: c\n\nStatus: pending\n');
+    const unique = resolver.resolveWorkflowCandidate({ projectRoot: dir, runtime: {}, explicitFeature: 'auth' });
+    assert.deepStrictEqual(unique.taskRegistry['task-02-b.md'].dependencies, ['task-01-a.md']);
+    assert.deepStrictEqual(unique.taskRegistry['task-03-c.md'].dependencies, []);
+    assert.strictEqual(unique.workflowContract, null);
+    assert.strictEqual(unique.queueReady, false);
+
+    writeTask('task-01-second.md', 'Task 01: second', 'pending');
+    const ambiguous = resolver.resolveWorkflowCandidate({ projectRoot: dir, runtime: {}, explicitFeature: 'auth' });
+    assert.strictEqual(ambiguous.error, 'explicit_malformed');
+    assert.match(ambiguous.reason, /legacy dependency Task 01 maps to 2 task basenames/);
+
+    fs.rmSync(path.join(feature, 'task-01-second.md'));
+    fs.rmSync(path.join(feature, 'task-03-c.md'));
+    writePlan('# Auth plan\nSpecs-Contract: process-first-ready-v1\n');
+    writeTask('task-01-a.md', 'Task 01: a', 'pending', 'task-02-b.md');
+    writeTask('task-02-b.md', 'Task 02: b', 'pending', 'task-01-a.md');
+    const cycle = resolver.resolveWorkflowCandidate({ projectRoot: dir, runtime: {}, explicitFeature: 'auth' });
+    assert.strictEqual(cycle.error, 'explicit_malformed');
+    assert.match(cycle.reason, /dependency cycle detected: task-01-a\.md -> task-02-b\.md -> task-01-a\.md/);
+  });
+});
 
 test('Stop snapshot includes tracked modifications and untracked files', () => {
   const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'ck-state-'));
@@ -22,7 +268,7 @@ test('Stop snapshot includes tracked modifications and untracked files', () => {
 
     fs.writeFileSync(path.join(dir, 'tracked.txt'), 'after\n');
     fs.writeFileSync(path.join(dir, 'new-untracked.json'), '{}\n');
-    const result = spawnSync(process.execPath, [HOOK], {
+    const result = spawnSync(process.execPath, [STATE_HOOK], {
       cwd: dir,
       input: JSON.stringify({ hook_event_name: 'Stop', cwd: dir }),
       encoding: 'utf8',
@@ -47,7 +293,7 @@ test('Stop snapshot includes untracked files before the first commit', () => {
     spawnSync('git', ['init', '-q'], { cwd: dir });
     fs.writeFileSync(path.join(dir, 'first-untracked.txt'), 'new\n');
 
-    const result = spawnSync(process.execPath, [HOOK], {
+    const result = spawnSync(process.execPath, [STATE_HOOK], {
       cwd: dir,
       input: JSON.stringify({ hook_event_name: 'Stop', cwd: dir }),
       encoding: 'utf8',

package/src/claude/hooks/spec-state.cjs

@@ -132,13 +132,30 @@ try {
     acc[status] = (acc[status] || 0) + 1;
     return acc;
   }, {});
+  const featureDir = path.join(specsPath, featureName);
   const taskStatusByPath = new Map(taskEntries.map(([taskPath, task]) => [taskPath, task?.status || 'pending']));
+  const dependencyProof = processWorkflow
+    ? RECEIPT.workflowDependencyProofState(featureDir, taskRegistry, runtimeContext, POLICY)
+    : {};
+  const taskState = taskEntries.map(([taskPath, task]) => [
+    taskPath,
+    task?.status || 'pending',
+    [...(Array.isArray(task?.dependencies) ? task.dependencies : [])].sort(),
+  ]).sort(([left], [right]) => left.localeCompare(right));
+  const proofState = Object.entries(dependencyProof).map(([taskPath, proof]) => [
+    taskPath,
+    proof.done,
+    proof.valid,
+    proof.eligible,
+    proof.signature,
+  ]);
   const nextUnblocked = taskEntries.find(([, task]) => {
     const status = task?.status || 'pending';
     const deps = Array.isArray(task?.dependencies) ? task.dependencies : [];
-    return status === 'pending' && deps.every((dep) => taskStatusByPath.get(dep) === 'done');
+    return resolved.queueReady !== false && status === 'pending' && deps.every((dep) => (
+      processWorkflow ? dependencyProof[dep]?.eligible === true : taskStatusByPath.get(dep) === 'done'
+    ));
   });
-  const featureDir = path.join(specsPath, featureName);
   const featureReceiptPresent = !processWorkflow
     && RECEIPT.safeRead(featureDir, 'feature-receipt.md').status === 'ok';
 
@@ -157,6 +174,10 @@ try {
     Head: runtimeContext.head,
     contextId: runtimeContext.context_id,
     phase,
+    workflowContract: resolved.workflowContract || null,
+    queueReady: resolved.queueReady !== false,
+    taskState,
+    proofState,
     done: taskCounts.done || 0,
     total: taskEntries.length,
     featureReceiptPresent,
@@ -170,7 +191,10 @@ try {
 
   if (stateKey && lastKey === stateKey) {
     const stateTarget = processWorkflow ? 'task Markdown' : '`spec.json`';
-    console.log(`\n> 🔵 Spec \`${featureName}\` @ \`${phase}\` (${taskCounts.done || 0}/${taskEntries.length} tasks done). Tollgate active — sync ${stateTarget} when state changes.\n`);
+    const migration = processWorkflow && resolved.queueReady === false
+      ? ' Add `Specs-Contract: process-first-ready-v1` after the plan title before tasks can enter Next.'
+      : '';
+    console.log(`\n> 🔵 Spec \`${featureName}\` @ \`${phase}\` (${taskCounts.done || 0}/${taskEntries.length} tasks done). Tollgate active — sync ${stateTarget} when state changes.${migration}\n`);
     process.exit(0);
   }
 
@@ -194,6 +218,9 @@ try {
     lines.push(`- Flash verification pending: ${flashTasks.map((taskPath) => `\`${taskPath}\``).join(', ')}. A PASS proof keeps the persisted task in_progress until explicit sync-finalize.`);
   }
   if (processWorkflow) {
+    if (resolved.queueReady === false) {
+      lines.push('- Migration required: add `Specs-Contract: process-first-ready-v1` after the plan title before tasks can enter Next.');
+    }
     lines.push('- Sync each flat task `Status:` only after verified work; task proof belongs in that task\'s inline `## Receipt`.');
     lines.push(`- Workflow source: \`specs/${featureName}/plan.md\`; Stop revalidates every task currently marked done.`);
   } else {

package/src/claude/scripts/spec-receipt.cjs

@@ -3,6 +3,7 @@
 const crypto = require('crypto');
 const fs = require('fs');
 const path = require('path');
+const { annotatedMarkdownLines } = require('./spec-resolver.cjs');
 
 const EVIDENCE_HEADINGS = new Set([
   'Evidence',
@@ -67,21 +68,46 @@ function evidenceBody(text, policy = {}) {
 }
 
 function workflowReceiptBody(text, policy = {}) {
-  const lines = String(text || '').split('\n');
+  const lines = annotatedMarkdownLines(text);
   const starts = [];
   for (let index = 0; index < lines.length; index += 1) {
-    if (/^##\s+Receipt\s*$/.test(lines[index])) starts.push(index + 1);
+    if (lines[index].outsideFence && /^##\s+Receipt\s*$/.test(lines[index].line)) starts.push(index + 1);
   }
   if (starts.length !== 1) return null;
 
   const start = starts[0];
   let end = lines.length;
   for (let index = start; index < lines.length; index += 1) {
-    const heading = lines[index].match(/^(#{1,6})\s+/);
-    const tap = typeof policy.isTapMetadataHeading === 'function' && policy.isTapMetadataHeading(lines[index]);
+    if (!lines[index].outsideFence) continue;
+    const heading = lines[index].line.match(/^(#{1,6})\s+/);
+    const tap = typeof policy.isTapMetadataHeading === 'function' && policy.isTapMetadataHeading(lines[index].line);
     if (heading && heading[1].length <= 2 && !tap) { end = index; break; }
   }
-  return lines.slice(start, end).join('\n');
+  return lines.slice(start, end).map(({ line }) => line).join('\n');
+}
+
+function workflowCanonicalValidationBody(body) {
+  return annotatedMarkdownLines(body)
+    .filter(({ outsideFence }) => outsideFence)
+    .map(({ line }) => line)
+    .join('\n');
+}
+
+function hasNonEmptyFencedBlock(body) {
+  let open = false;
+  let nonEmpty = false;
+  for (const { line, fenceEvent } of annotatedMarkdownLines(body)) {
+    if (fenceEvent === 'open') {
+      open = true;
+      nonEmpty = false;
+    } else if (fenceEvent === 'close') {
+      if (open && nonEmpty) return true;
+      open = false;
+    } else if (open && line.trim() !== '') {
+      nonEmpty = true;
+    }
+  }
+  return false;
 }
 
 function fieldValues(body, name) {
@@ -105,22 +131,14 @@ function normalizedCommand(value) {
 function workflowVerificationCommand(taskText) {
   const sections = [];
   let current = null;
-  let fence = null;
-  for (const line of String(taskText || '').split('\n')) {
-    const marker = line.match(/^\s{0,3}(`{3,}|~{3,})/);
-    if (marker) {
-      const kind = marker[1][0];
-      if (fence === null) fence = kind;
-      else if (fence === kind) fence = null;
-      continue;
-    }
-    if (fence !== null) continue;
-    if (fence === null && /^##\s+Verification Plan\s*$/.test(line)) {
+  for (const { line, outsideFence } of annotatedMarkdownLines(taskText)) {
+    if (!outsideFence) continue;
+    if (/^##\s+Verification Plan\s*$/.test(line)) {
       current = [];
       sections.push(current);
       continue;
     }
-    if (fence === null && current && /^#{1,2}\s+/.test(line)) {
+    if (current && /^#{1,2}\s+/.test(line)) {
       current = null;
       continue;
     }
@@ -227,7 +245,10 @@ function checkWorkflowTaskReceipt(featureDir, taskPath, runtimeContext, policy)
   }
 
   const taskText = taskFile.bytes.toString('utf8');
-  const statusLines = [...taskText.matchAll(/^\s*(?:\*\*)?Status(?:\*\*)?\s*:\s*(?:\*\*)?\s*([A-Za-z_-]+)(?:\*\*)?\s*$/gim)];
+  const statusLines = annotatedMarkdownLines(taskText)
+    .filter(({ outsideFence }) => outsideFence)
+    .map(({ line }) => line.match(/^\s*(?:\*\*)?Status(?:\*\*)?\s*:\s*(?:\*\*)?\s*([A-Za-z_-]+)(?:\*\*)?\s*$/i))
+    .filter(Boolean);
   const body = workflowReceiptBody(taskText, policy);
   const failures = [];
   if (statusLines.length !== 1 || statusLines[0][1].toLowerCase().replaceAll('-', '_') !== 'done') {
@@ -236,12 +257,15 @@ function checkWorkflowTaskReceipt(featureDir, taskPath, runtimeContext, policy)
   if (body === null) {
     failures.push('missing_receipt');
   } else {
+    const canonicalBody = workflowCanonicalValidationBody(body);
     const options = typeof policy?.receiptValidatorOptions === 'function'
       ? policy.receiptValidatorOptions({}, { runtimeContext, requireProvenanceBinding: true })
       : { requireProvenanceBinding: true };
-    failures.push(...canonicalFailures(body, {}, runtimeContext, policy));
-    failures.push(...workflowCommandFailures(taskText, body));
-    if (!/```[^\n]*\n[\s\S]*?\S[\s\S]*?\n```/m.test(body)) failures.push('command_output');
+    failures.push(...canonicalFailures(canonicalBody, {}, runtimeContext, policy));
+    failures.push(...canonicalFailures(body, {}, runtimeContext, policy)
+      .filter((failure) => ['placeholder', 'verification_state', 'exit_result'].includes(failure)));
+    failures.push(...workflowCommandFailures(taskText, canonicalBody));
+    if (!hasNonEmptyFencedBlock(body)) failures.push('command_output');
     if (!options.expectedProvenance) failures.push('provenance');
   }
   return {
@@ -256,6 +280,36 @@ function checkWorkflowTaskReceipt(featureDir, taskPath, runtimeContext, policy)
   };
 }
 
+function workflowProofSignature(taskPath, proof) {
+  const hash = crypto.createHash('sha256');
+  hash.update('cafekit-workflow-proof-v1\0');
+  hash.update(String(taskPath));
+  hash.update('\0');
+  hash.update(proof.taskFile?.bytes || Buffer.alloc(0));
+  hash.update('\0');
+  hash.update(proof.receiptBytes || Buffer.alloc(0));
+  hash.update('\0');
+  hash.update(String(proof.status || 'unknown'));
+  return hash.digest('hex');
+}
+
+function workflowDependencyProofState(featureDir, taskRegistry, runtimeContext, policy) {
+  const tasks = {};
+  for (const taskPath of Object.keys(taskRegistry || {}).sort()) {
+    const done = taskRegistry[taskPath]?.status === 'done';
+    const proof = checkWorkflowTaskReceipt(featureDir, taskPath, runtimeContext, policy);
+    const valid = proof.failures.length === 0;
+    tasks[taskPath] = {
+      done,
+      valid,
+      eligible: done && valid,
+      signature: workflowProofSignature(taskPath, proof),
+      failures: [...proof.failures],
+    };
+  }
+  return tasks;
+}
+
 function checkWorkflowReceiptSet(candidates, projectRoot, runtimeSession, policy) {
   const failures = [];
   for (const candidate of Array.isArray(candidates) ? candidates : []) {
@@ -298,5 +352,6 @@ module.exports = {
   evidenceBody,
   readTaskProof,
   safeRead,
+  workflowDependencyProofState,
   workflowReceiptBody,
 };