@mmerterden/multi-agent-pipeline 20.33.0 → 20.35.0

package/pipeline/scripts/office-remote-client.mjs

@@ -0,0 +1,463 @@
+#!/usr/bin/env node
+/**
+ * @file office-remote-client.mjs  -  the machine end of the office remote
+ * layer (features/office-remote-protocol.md).
+ *
+ * It polls the relay for frames, opens each with the paired device's key,
+ * checks the passkey tier of the request inside, forwards an accepted request
+ * to the local server's phone routes and seals the response back. The local
+ * server still verifies the device signature, window, nonce and scopes; this
+ * file adds what the relay path needs on top:
+ *
+ *   - a frame opens only with its device's key, in its direction, with a
+ *     counter above the last one accepted from that device;
+ *   - the target is a phone route (`/v1/phone/`), the method GET or POST, the
+ *     device header names the device the frame came from;
+ *   - the tier: `read` (GET) needs a passkey session that has not been idle for
+ *     more than READ_IDLE_MS; `low` (an answer) needs a passkey within
+ *     LOW_WINDOW_MS; `high` (launch and every other POST) needs a passkey
+ *     assertion bound to this very request (its challenge is SHA-256 of the
+ *     request's canonical signed text);
+ *   - no `Authorization` header is ever added, and `Host` is the loopback.
+ *
+ * A refused frame still gets a sealed reply with the reason, so the phone can
+ * show it. One audit line per frame: time, device, counter, path without
+ * query, tier, verdict and reason; never a body, header value or signature.
+ *
+ * Config: <phone dir>/remote.json (0600), written by office-pair. Remote is off
+ * unless that file exists and the office server is running.
+ *
+ * Usage: office-remote-client.mjs once | loop
+ *
+ * @module pipeline/scripts/office-remote-client
+ */
+
+import { createHash } from "node:crypto";
+import {
+  appendFileSync,
+  chmodSync,
+  closeSync,
+  existsSync,
+  mkdirSync,
+  openSync,
+  readFileSync,
+  renameSync,
+  rmSync,
+  statSync,
+  writeFileSync,
+} from "node:fs";
+import { request as httpRequest } from "node:http";
+import { dirname, join } from "node:path";
+
+import { directionKeys, openFrame, sealFrame, verifyPasskey } from "../lib/office-remote.mjs";
+import { invokedDirectly } from "../lib/invoked-directly.mjs";
+import {
+  bodyDigest,
+  canonicalPayload,
+  DEVICE_ID,
+  HEADERS,
+  PHONE_PREFIX,
+  phoneDir,
+} from "./_phone-auth.mjs";
+
+export const READ_IDLE_MS = 5 * 60_000;
+export const LOW_WINDOW_MS = 2 * 60_000;
+const POLL_TIMEOUT_MS = 30_000;
+const MAX_BODY = 256 * 1024;
+const PASSKEY_HEADER = "x-ma-passkey";
+const FORWARDED = new Set([...Object.values(HEADERS), "content-type", "accept"]);
+const AUDIT_MAX_BYTES = 1024 * 1024;
+
+export const configPath = (env = process.env) => join(phoneDir(env), "remote.json");
+export const framesLogPath = (env = process.env) => join(phoneDir(env), "remote-frames.jsonl");
+export const lockPath = (env = process.env) => join(phoneDir(env), "remote-client.lock");
+
+/**
+ * The target's path when it is already in the canonical form the local
+ * server routes on, else null. The server parses the target as a URL, which
+ * decodes dot segments (`%2e%2e`), turns `\` into `/` and drops a fragment;
+ * a target those steps would change is refused here, so the tier and the
+ * prefix are judged on the same path the server executes.
+ */
+export function canonicalPath(target) {
+  if (typeof target !== "string" || !target.startsWith("/") || /%2e|\\|#/i.test(target))
+    return null;
+  let u;
+  try {
+    u = new URL(target, "http://127.0.0.1");
+  } catch {
+    return null;
+  }
+  return u.pathname + u.search === target ? u.pathname : null;
+}
+
+/** The passkey tier of a phone route. Anything not known to be milder is high. */
+export function tierOf(method, pathname) {
+  if (method === "GET" && /^\/v1\/phone\/runs(\/[^/]+)?$/.test(pathname)) return "read";
+  if (method === "POST" && /^\/v1\/phone\/runs\/[^/]+\/answer$/.test(pathname)) return "low";
+  return "high";
+}
+
+const lower = (headers) =>
+  Object.fromEntries(
+    Object.entries(headers && typeof headers === "object" ? headers : {}).map(([k, v]) => [
+      String(k).toLowerCase(),
+      String(v),
+    ]),
+  );
+
+/** The challenge a passkey must sign for this request. */
+export function requestChallenge(req, headers, body) {
+  const text = canonicalPayload({
+    method: req.method,
+    target: req.target,
+    bodyDigest: bodyDigest(body),
+    deviceId: headers[HEADERS.device],
+    timestamp: headers[HEADERS.timestamp],
+    nonce: headers[HEADERS.nonce],
+  });
+  return createHash("sha256").update(text, "utf8").digest();
+}
+
+/**
+ * Whether the request's tier is satisfied, updating the device's passkey
+ * record when an assertion verifies.
+ *
+ * @returns {{ok: true} | {ok: false, reason: string}}
+ */
+export function passkeyDecision(device, tier, req, headers, body, now) {
+  const raw = headers[PASSKEY_HEADER];
+  if (raw) {
+    let assertion;
+    try {
+      assertion = JSON.parse(raw);
+    } catch {
+      return { ok: false, reason: "the passkey header is not JSON" };
+    }
+    let challenge;
+    try {
+      challenge = requestChallenge(req, headers, body);
+    } catch (err) {
+      return { ok: false, reason: err.message };
+    }
+    const pk = device.passkey || {};
+    const v = verifyPasskey({
+      assertion,
+      credential: pk.credential,
+      rpId: pk.rpId,
+      origin: pk.origin,
+      challenge,
+      prevSignCount: Number(pk.signCount) || 0,
+    });
+    if (!v.ok) return v;
+    device.passkey = { ...pk, signCount: v.signCount };
+    device.lastPasskeyAt = now;
+    device.lastActivityAt = now;
+    return { ok: true };
+  }
+  if (tier === "high") return { ok: false, reason: "this action needs a passkey for this request" };
+  const last = Number(device.lastPasskeyAt) || 0;
+  if (tier === "low" && now - last > LOW_WINDOW_MS) {
+    return { ok: false, reason: "confirm with the passkey again (the low-risk window has passed)" };
+  }
+  if (tier === "read" && (!last || now - (Number(device.lastActivityAt) || 0) > READ_IDLE_MS)) {
+    return { ok: false, reason: "the session is locked; open it with the passkey" };
+  }
+  device.lastActivityAt = now;
+  return { ok: true };
+}
+
+function keysFor(config, device) {
+  return directionKeys({
+    privatePem: config.machinePrivatePem,
+    peerPublic: device.sessionPublic,
+    pairingId: config.pairingId,
+    role: "machine",
+  });
+}
+
+function reply(config, device, inReplyTo, response) {
+  device.sendCounter = (Number(device.sendCounter) || 0) + 1;
+  const sealed = sealFrame(keysFor(config, device).send, device.sendCounter, "machine-to-phone", {
+    inReplyTo,
+    ...response,
+  });
+  return { deviceId: device.id, ...sealed };
+}
+
+const refuse = (status, reason) => ({
+  status,
+  headers: { "content-type": "application/json" },
+  body: Buffer.from(JSON.stringify({ error: "remote-refused", reason })).toString("base64url"),
+});
+
+/**
+ * Open, judge and forward one frame. Mutates the device's counters and passkey
+ * record in `config`; returns the sealed reply (or null for a frame that could
+ * not be opened at all) and the audit row.
+ */
+export async function handleFrame(config, frame, { forward, now = Date.now() }) {
+  const id =
+    typeof frame?.deviceId === "string" && DEVICE_ID.test(frame.deviceId) ? frame.deviceId : null;
+  const device =
+    id && config.devices && Object.hasOwn(config.devices, id) ? config.devices[id] : null;
+  const row = {
+    at: new Date(now).toISOString(),
+    device: id,
+    counter: Number.isSafeInteger(frame?.counter) ? frame.counter : null,
+  };
+  if (!device || device.revoked)
+    return {
+      reply: null,
+      row: { ...row, verdict: "dropped", reason: "unknown or revoked device" },
+    };
+  const opened = openFrame(
+    keysFor(config, device).recv,
+    frame,
+    "phone-to-machine",
+    device.recvCounter,
+  );
+  if (!opened.ok)
+    return { reply: null, row: { ...row, verdict: "dropped", reason: opened.reason } };
+  device.recvCounter = opened.counter;
+  const req = opened.value || {};
+  const target = typeof req.target === "string" ? req.target : "";
+  const canonical = canonicalPath(target);
+  const path = canonical ?? "(not canonical)";
+  const out = (status, reason, extra = {}) => ({
+    reply: reply(config, device, opened.counter, refuse(status, reason)),
+    row: { ...row, path, verdict: "refused", reason, ...extra },
+  });
+  if (!["GET", "POST"].includes(req.method)) return out(405, "only GET and POST are carried");
+  if (canonical === null) return out(400, "the target is not in canonical form");
+  if (!canonical.startsWith(PHONE_PREFIX)) return out(403, "only phone routes are carried");
+  const headers = lower(req.headers);
+  if (headers[HEADERS.device] !== device.id)
+    return out(403, "the signed device is not the paired device");
+  const body = Buffer.from(typeof req.body === "string" ? req.body : "", "base64url");
+  if (body.length > MAX_BODY) return out(413, "the body is too large");
+  const tier = tierOf(req.method, path);
+  const pass = passkeyDecision(device, tier, req, headers, body, now);
+  if (!pass.ok) return out(401, pass.reason, { tier });
+  const forwarded = Object.fromEntries(Object.entries(headers).filter(([k]) => FORWARDED.has(k)));
+  const response = await forward({ method: req.method, target, headers: forwarded, body });
+  return {
+    reply: reply(config, device, opened.counter, response),
+    row: { ...row, path, tier, verdict: "forwarded", status: response.status },
+  };
+}
+
+/** Forward to the local server: loopback Host, no Authorization, body bytes untouched. */
+export function localForwarder(baseUrl) {
+  const base = new URL(baseUrl);
+  return ({ method, target, headers, body }) =>
+    new Promise((resolve) => {
+      const req = httpRequest(
+        {
+          host: "127.0.0.1",
+          port: base.port,
+          method,
+          path: target,
+          headers: { ...headers, host: `127.0.0.1:${base.port}`, "content-length": body.length },
+          timeout: POLL_TIMEOUT_MS,
+        },
+        (res) => {
+          const chunks = [];
+          let size = 0;
+          res.on("data", (c) => {
+            size += c.length;
+            if (size <= MAX_BODY) chunks.push(c);
+          });
+          res.on("end", () =>
+            resolve({
+              status: res.statusCode || 502,
+              headers: { "content-type": res.headers["content-type"] || "application/json" },
+              body: Buffer.concat(chunks).toString("base64url"),
+            }),
+          );
+        },
+      );
+      req.on("error", () => resolve(refuse(502, "the local server did not answer")));
+      req.on("timeout", () => req.destroy());
+      req.end(body);
+    });
+}
+
+export function readConfig(env = process.env) {
+  try {
+    return JSON.parse(readFileSync(configPath(env), "utf8"));
+  } catch {
+    return null;
+  }
+}
+
+export function writeConfig(config, env = process.env) {
+  const file = configPath(env);
+  mkdirSync(dirname(file), { recursive: true, mode: 0o700 });
+  const tmp = `${file}.${process.pid}.tmp`;
+  writeFileSync(tmp, JSON.stringify(config, null, 2) + "\n", { mode: 0o600 });
+  chmodSync(tmp, 0o600);
+  renameSync(tmp, file);
+}
+
+function audit(row, env) {
+  try {
+    const file = framesLogPath(env);
+    mkdirSync(dirname(file), { recursive: true, mode: 0o700 });
+    if (existsSync(file) && statSync(file).size > AUDIT_MAX_BYTES) renameSync(file, `${file}.1`);
+    appendFileSync(file, JSON.stringify(row) + "\n", { mode: 0o600 });
+  } catch {
+    /* an audit line that cannot be written never changes a verdict */
+  }
+}
+
+/**
+ * Write this poll's counters and passkey records onto the config as it is on
+ * disk now, so a revoke or a new pairing made while the poll ran is kept: a
+ * device that is gone from the file stays gone, and a different pairing id
+ * means the file was re-paired and this poll's state is dropped.
+ */
+function persist(config, env) {
+  const fresh = readConfig(env);
+  if (!fresh || fresh.pairingId !== config.pairingId) return;
+  for (const [id, d] of Object.entries(config.devices ?? {})) {
+    if (!fresh.devices || !Object.hasOwn(fresh.devices, id)) continue;
+    const { recvCounter, sendCounter, passkey, lastPasskeyAt, lastActivityAt } = d;
+    fresh.devices[id] = {
+      ...fresh.devices[id],
+      recvCounter,
+      sendCounter,
+      passkey: { ...fresh.devices[id].passkey, signCount: passkey?.signCount ?? 0 },
+      lastPasskeyAt,
+      lastActivityAt,
+    };
+  }
+  writeConfig(fresh, env);
+}
+
+function holderAlive(pid) {
+  if (!Number.isInteger(pid) || pid <= 0) return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (e) {
+    return e.code === "EPERM";
+  }
+}
+
+/**
+ * Hold the single-instance lock: two clients would seal replies from the same
+ * counter, reusing an AES-GCM nonce. A lock whose process is gone is taken over.
+ *
+ * @returns {(() => void) | null} the release function, or null when another client holds it
+ */
+export function acquireLock(env = process.env) {
+  const file = lockPath(env);
+  mkdirSync(dirname(file), { recursive: true, mode: 0o700 });
+  for (let attempt = 0; attempt < 2; attempt++) {
+    try {
+      const fd = openSync(file, "wx", 0o600);
+      writeFileSync(fd, String(process.pid));
+      closeSync(fd);
+      return () => rmSync(file, { force: true });
+    } catch (err) {
+      if (err.code !== "EEXIST") throw err;
+      if (holderAlive(Number(readFileSync(file, "utf8")))) return null;
+      rmSync(file, { force: true });
+    }
+  }
+  return null;
+}
+
+/**
+ * One poll: fetch frames, handle each, post the replies, persist counters.
+ *
+ * @returns {Promise<{handled: number}>}
+ */
+export async function runOnce({
+  config,
+  fetchImpl = fetch,
+  forward,
+  env = process.env,
+  now = Date.now,
+}) {
+  const base = String(config.relayUrl).replace(/\/+$/, "");
+  const auth = { Authorization: `Bearer ${config.relayToken}` };
+  const res = await fetchImpl(
+    `${base}/api/office/relay/machine?pairing=${encodeURIComponent(config.pairingId)}`,
+    {
+      headers: auth,
+      signal: AbortSignal.timeout(POLL_TIMEOUT_MS),
+    },
+  );
+  if (!res.ok) throw new Error(`the relay answered ${res.status}`);
+  const { frames = [] } = await res.json();
+  const replies = [];
+  for (const frame of Array.isArray(frames) ? frames : []) {
+    const { reply: r, row } = await handleFrame(config, frame, { forward, now: now() });
+    audit(row, env);
+    if (r) replies.push(r);
+  }
+  persist(config, env);
+  if (replies.length) {
+    const post = await fetchImpl(
+      `${base}/api/office/relay/machine?pairing=${encodeURIComponent(config.pairingId)}`,
+      {
+        method: "POST",
+        headers: { ...auth, "content-type": "application/json" },
+        body: JSON.stringify({ frames: replies }),
+        signal: AbortSignal.timeout(POLL_TIMEOUT_MS),
+      },
+    );
+    if (!post.ok) throw new Error(`the relay refused the replies (${post.status})`);
+  }
+  return { handled: Array.isArray(frames) ? frames.length : 0 };
+}
+
+async function main(argv) {
+  const mode = argv[0] || "once";
+  if (!readConfig() || !existsSync(configPath())) {
+    process.stderr.write("office-remote-client: not paired (run office-pair first)\n");
+    return 1;
+  }
+  const { current } = await import("./office-control.mjs");
+  const server = current();
+  if (!server) {
+    process.stderr.write("office-remote-client: the office is not running (office-on)\n");
+    return 1;
+  }
+  const release = acquireLock();
+  if (!release) {
+    process.stderr.write("office-remote-client: another client is already running\n");
+    return 1;
+  }
+  const forward = localForwarder(server.url);
+  try {
+    do {
+      const config = readConfig();
+      if (!config?.pairingId) return 1;
+      try {
+        await runOnce({ config, forward });
+      } catch (err) {
+        process.stderr.write(`office-remote-client: ${err.message}\n`);
+        if (mode !== "loop") return 1;
+        await new Promise((r) => setTimeout(r, 5000));
+      }
+    } while (mode === "loop" && current());
+    return 0;
+  } finally {
+    release();
+  }
+}
+
+if (invokedDirectly(import.meta.url)) {
+  main(process.argv.slice(2)).then(
+    (code) => {
+      process.exitCode = code;
+    },
+    (err) => {
+      process.stderr.write(`office-remote-client: ${err.message}\n`);
+      process.exitCode = 1;
+    },
+  );
+}

package/pipeline/scripts/phase-tracker.sh

@@ -1123,6 +1123,14 @@ case "$ACTION" in
     mkdir -p "$TRACKER_DIR" 2>/dev/null
     NOW=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
     acquire_state_lock
+    # A tracker that already holds phases is a run's history: a resume
+    # continues it, and only an explicit --force starts it over.
+    if [ "${2:-}" != "--force" ] && [ -f "$TRACKER_FILE" ] &&
+      [ "$(jq -r '(.phases // []) | length' "$TRACKER_FILE" 2>/dev/null || echo 0)" != "0" ]; then
+      release_state_lock
+      echo "init: $TRACKER_FILE already holds phases; resume the run, or pass --force to start the tracker over" >&2
+      exit 3
+    fi
     save_state "$(jq -nc --arg id "$TASK_ID" --arg ts "$NOW" \
       '{task_id:$id,started_at:$ts,phases:[]}')"
     release_state_lock

package/pipeline/scripts/phase0-exit-gate.mjs

@@ -1,43 +1,19 @@
 #!/usr/bin/env node
 /**
  * phase0-exit-gate.mjs  -  Phase 0 may not be marked completed until it has
- * actually produced its own output.
+ * produced its own output.
  *
- * Why this exists. Phase 0 Step 7 says to classify the task and "persist to
- * `agent-state.json.taskType`", and Phase 3 branches on that field to route a
- * Figma-driven task to the component skills (`create-screen` / `create-component`
- * in the stack plugin) instead of generic development. On a real run the tracker
- * showed Phase 0 `completed` while the task directory held only
- * `tracker-state.json`  -  no `agent-state.json` at all. With no `taskType`, the
- * dispatch could not fire, so a Figma-driven screen was built as generic work: no
- * token-compliance check, no Code Connect publish, no 14-item component review,
- * and spacing guessed at 16 where the frame said `Spacing/12`. Half the commits on
- * that branch were rework.
+ * Phase 0 owns decisions every later phase reads back out of agent-state.json:
+ * the task type (Phase 3 routes a Figma-driven task to the component skills on
+ * it), the repository and base branch with the evidence for how the branch was
+ * chosen (`baseBranchSource`, `baseBranchEvidence.refProvenance` agreeing with
+ * `baseFetchStatus`), the dev-context siblings, the Figma access tier when the
+ * input carries a Figma URL, and, through require-supported-version.sh, that
+ * the installed pipeline is not below the published floor.
  *
- * A second run then showed the other half of the same failure: a Jira task was
- * implemented without the repo or branch picker ever appearing, straight on whatever
- * the local checkout was pointing at. Step 3 and Step 8 own those decisions, and
- * `agent-state.json` is the only durable evidence they happened - so the gate asserts
- * their output too, not just `taskType`.
- *
- * A third run got past that, because `baseBranch` and `baseFetchStatus` can be filled
- * in by a branch that was never chosen. The remote had one PR-targetable branch, the
- * one-option `AskUserQuestion` was refused by the host (its schema needs two), and the
- * run announced "only candidate, continuing with it" and carried on. The branch was
- * right; nothing was asked. `baseBranchSource` is the field that separates those two,
- * and the dev-context picker never ran at all - no `siblings`, so Phase 4's parity
- * cross-check had nothing to read and could not tell an empty answer from no answer.
- *
- * A fourth showed the same shape one layer down: `git fetch origin` failed on a
- * restricted network, `git branch -r` printed the remote-tracking cache anyway, and a
- * weeks-old local list was presented as the remote's answer. Degrading to local refs is
- * correct; reporting them as remote is not, so `baseBranchEvidence.refProvenance` has to
- * agree with `baseFetchStatus`.
- *
- * A phase that reports success without its output is worse than one that fails:
- * every later phase then reasons from a field that is not there. So this is a
- * gate, not a lint  -  the spec already said what to write, and prose alone did
- * not make it happen.
+ * A phase that reports success without its output is worse than one that
+ * fails: later phases then reason from fields that are not there. So this is a
+ * gate on the output, not on the phase's status.
  *
  * Usage:
  *   node phase0-exit-gate.mjs <task_id> [--input "<original user input>"] [--json]
@@ -48,9 +24,10 @@
  */
 
 import { existsSync, readFileSync } from "fs";
-import { join } from "path";
+import { dirname, join } from "path";
 import { homedir } from "os";
-import { pathToFileURL } from "url";
+import { fileURLToPath, pathToFileURL } from "url";
+import { spawnSync } from "child_process";
 
 import { gatesActive } from "../lib/unattended.mjs";
 
@@ -337,6 +314,27 @@ export function evaluate(state, extraInput = "", { env = process.env } = {}) {
   return { ok: failures.length === 0, failures, taskType: taskType || undefined, figmaSeen };
 }
 
+/**
+ * The failure line when the installed pipeline is below the published floor,
+ * or null. Asks require-supported-version.sh with --cache-only: the answer
+ * Step 0.6 cached, at any age, and never the network, so the gate costs no
+ * wait and passes when nothing is cached.
+ *
+ * @param {{env?: NodeJS.ProcessEnv}} [opts]
+ * @returns {string|null}
+ */
+export function versionFloorFailure({ env = process.env } = {}) {
+  const script = join(dirname(fileURLToPath(import.meta.url)), "require-supported-version.sh");
+  if (!existsSync(script)) return null;
+  const r = spawnSync("bash", [script, "--cache-only"], { env, encoding: "utf8", timeout: 10_000 });
+  if (r.status !== 3) return null;
+  const [, local = "?", latest = "?", required = "?"] = String(r.stdout).trim().split("|");
+  return (
+    `the installed pipeline v${local} is below the required v${required} (latest v${latest}). ` +
+    "Run /multi-agent:update, then start the command again."
+  );
+}
+
 /** @param {string} taskId */
 function statePathFor(taskId) {
   return join(homedir(), ".claude", "logs", "multi-agent", taskId, "agent-state.json");
@@ -365,6 +363,11 @@ function main(argv) {
   }
 
   const result = evaluate(state, extraInput);
+  const floor = versionFloorFailure();
+  if (floor) {
+    result.failures.push(floor);
+    result.ok = false;
+  }
 
   if (asJson) {
     console.log(JSON.stringify({ taskId, statePath: path, ...result }, null, 2));

package/pipeline/scripts/phone-devices.mjs

@@ -14,7 +14,9 @@
  *   launch  POST /v1/phone/launch, and only while `launch on` is set
  *
  * The registry is <autopilot root>/phone/devices.json (0600, directory 0700;
- * phone-devices.schema.json). An unattended run may not change it: every
+ * phone-devices.schema.json). `revoke` also drops the device's office remote
+ * keys (office-remote-client.mjs), so neither path reaches the machine any
+ * more. An unattended run may not change it: every
  * subcommand but `list` refuses under MULTI_AGENT_UNATTENDED=1, and the guard
  * blocks the same subcommands by name (unattended-policy.json).
  *
@@ -37,6 +39,7 @@ import { readFileSync } from "node:fs";
 import { runMain } from "../lib/fatal.mjs";
 import { invokedDirectly } from "../lib/invoked-directly.mjs";
 import { isUnattended } from "../lib/unattended.mjs";
+import { readConfig, writeConfig } from "./office-remote-client.mjs";
 import {
   DEVICE_ID,
   SCOPES,
@@ -197,6 +200,11 @@ function main(argv) {
       }
       d.revokedAt = new Date().toISOString();
       writeRegistry(reg);
+      const remote = readConfig();
+      if (remote?.devices?.[id]) {
+        delete remote.devices[id];
+        writeConfig(remote);
+      }
       process.stdout.write(JSON.stringify({ id, revokedAt: d.revokedAt }) + "\n");
       return 0;
     }

package/pipeline/scripts/plan-critique-gate.mjs

@@ -4,7 +4,9 @@
  * answer per objection, and a verdict decided by constitution rule id.
  *
  * At the end of Phase 1 the plan-critic persona writes objections to the plan
- * under four lenses (scope, feasibility, security, a cheaper alternative), and
+ * under six lenses (scope, feasibility, security, a cheaper alternative, an
+ * input the spec implies but no test exercises, a decision left to the
+ * implementer), and
  * the planner answers each one exactly once: accept and revise the plan, or
  * rebut with evidence. Both halves live in one file,
  * `<worktree>/.pipeline/plan-critique.json` (schemas/plan-critique.schema.json).
@@ -59,7 +61,14 @@ import { requirementIds } from "./spec-consistency-gate.mjs";
 import { resolveOne } from "./verify-citations.mjs";
 
 export const GATE = "plan-critique";
-export const LENSES = ["scope", "feasibility", "security", "alternative"];
+export const LENSES = [
+  "scope",
+  "feasibility",
+  "security",
+  "alternative",
+  "unstated-input",
+  "underspecified",
+];
 export const ANCHOR_KINDS = ["file", "plan", "analysis", "inference"];
 export const ACTIONS = ["accept", "rebut"];
 const OBJ_ID = /^OBJ-\d{2,3}$/;