@namewta/speculo 2.0.3 → 2.0.5

package/template/workflows/specdev/common/tools/delivery-artifacts.mjs

@@ -14,7 +14,7 @@ function check(value, rule, at, errors) {
   if (rule.type) {
     const types = Array.isArray(rule.type) ? rule.type : [rule.type];
     const t = value === null ? "null" : Array.isArray(value) ? "array" : typeof value;
-    if (!types.includes(t)) { errors.push(at + ": invalid type"); return; }
+    if (!types.includes(t) && !(types.includes("integer") && Number.isInteger(value))) { errors.push(at + ": invalid type"); return; }
   }
   if (typeof value === "string") {
     if (rule.minLength && value.trim().length < rule.minLength) errors.push(at + ": empty");
@@ -35,7 +35,6 @@ function check(value, rule, at, errors) {
 }
 const specs = {
   "pull-request": ["pull-request.schema.json", ["Summary","Evidence","Before / After","Merge Risk","Authorization","Receipt","Recovery"]],
-  retrospective: ["retrospective.schema.json", ["Scope","Evidence","Findings","Acceptance","Routes"]],
   "logic-prototype": ["logic-prototype.schema.json", ["Model","Scenarios","Evidence","Decisions","Handoff"]],
   "triage-run": ["triage-run.schema.json", ["Targets","Plan","Evidence","Authorization","Receipts","Recovery"]],
 };
@@ -54,7 +53,6 @@ export function validateRecord(path, kind, parse, expectedChange = null) {
     if (meta.status === "ready" && meta.verification !== "passed") errors.push(path + ": ready PR requires passed verification");
     if (["draft","ready"].includes(meta.status) && !new RegExp("^https://github\\.com/" + String(meta.repo).replaceAll(".","\\.") + "/pull/[1-9]\\d*$").test(meta.url ?? "")) errors.push(path + ": missing matching PR URL");
   }
-  if (kind === "retrospective" && (meta.sources ?? []).some(s => typeof s !== "string" || !s.trim() || /(?:[A-Za-z]:[\\/]|\b(?:token|secret)=)/i.test(s))) errors.push(path + ": unsafe source");
   if (kind === "triage-run" && meta.status === "completed" && meta.mode !== "ci-security") {
     if (meta.npm_target === "unknown") errors.push(path + ": completed release target cannot be unknown");
     if (!meta.commit_sha) errors.push(path + ": completed release requires fixed commit");
@@ -83,7 +81,7 @@ export function validateRecord(path, kind, parse, expectedChange = null) {
   return {errors,meta,body};
 }
 export function validateRecords(change, kind, parse) {
-  const folder = kind === "retrospective" ? "retro" : "pull-requests", root=join(change,folder);
+  const root=join(change,"pull-requests");
   const errors=[], records=[];
   if (!existsSync(root)) return {errors,records};
   if (lstatSync(root).isSymbolicLink() || !lstatSync(root).isDirectory()) return {errors:[root + ": unsafe directory"],records};
@@ -93,3 +91,5 @@ export function validateRecords(change, kind, parse) {
   }
   return {errors,records};
 }
+
+export { check as checkSchema };

package/template/workflows/specdev/common/tools/execution-context.mjs

@@ -0,0 +1,104 @@
+/** Change workspace and Ticket scheduling contracts. Inspection only; never creates worktrees or agents. */
+import { readFileSync, realpathSync } from 'node:fs';
+import { execFileSync } from 'node:child_process';
+import { basename, join, relative, resolve } from 'node:path';
+import * as runtime from '../../../../lib/speculo-runtime.mjs';
+import { validateIndependentReview } from './review-evidence.mjs';
+
+export const EXECUTION_VERSION = 1;
+export const EXECUTION_CONTEXT = 'README.md#execution-context';
+const object = value => value !== null && typeof value === 'object' && !Array.isArray(value);
+const text = value => typeof value === 'string' && value.trim().length > 0;
+const sha = value => /^[a-f0-9]{40}(?:[a-f0-9]{24})?$/.test(value ?? '');
+const positive = value => Number.isInteger(value) && value > 0;
+const git = (root, args) => execFileSync('git', ['-C', root, ...args], {encoding:'utf8',stdio:['ignore','pipe','pipe']}).trim();
+
+export function readExecutionContext(change) {
+  const path = runtime.safeWorkPathSync(change, 'README.md', {mustExist:true,type:'file'});
+  const source = readFileSync(path, 'utf8');
+  const headings = runtime.markdownBodyLines(source, path).filter(line => line.text === '## Execution Context');
+  if (!headings.length) return null;
+  if (headings.length !== 1) throw new Error('duplicate Execution Context');
+  const section = runtime.readArtifactSectionSync(path, 'execution-context').text;
+  const blocks = [...section.matchAll(/```json\s*\n([\s\S]*?)\n```/g)];
+  if (blocks.length !== 1) throw new Error('Execution Context requires one JSON object');
+  const value = JSON.parse(blocks[0][1]);
+  const required = ['schema_version','change','workspace_policy','workspace_ref','branch','base_sha','owner','ticket_execution'];
+  const allowed = [...required,'max_parallel_tickets','concurrent_implementation_limit','integration_attempt_limit'];
+  if (!object(value) || required.some(key => !(key in value)) || Object.keys(value).some(key => !allowed.includes(key))) throw new Error('invalid Execution Context fields');
+  if (value.schema_version !== EXECUTION_VERSION || value.change !== basename(change)) throw new Error('Execution Context version/change mismatch; explicit reconciliation required');
+  if (!['current','worktree'].includes(value.workspace_policy) || !['auto','serial','parallel'].includes(value.ticket_execution)) throw new Error('invalid workspace_policy or ticket_execution');
+  if (!text(value.branch) || !text(value.owner) || !sha(value.base_sha)) throw new Error('Execution Context requires branch, owner and immutable base_sha');
+  for (const key of ['max_parallel_tickets','concurrent_implementation_limit','integration_attempt_limit']) if (key in value && !positive(value[key])) throw new Error(`${key} must be a positive integer`);
+  if (value.workspace_policy === 'current' ? value.workspace_ref !== 'current' : !text(value.workspace_ref) || value.workspace_ref === 'current' || /[\\:\x00-\x1f]/.test(value.workspace_ref) || value.workspace_ref.split('/').some(part => !part || part === '.' || part === '..' || part === '.git')) throw new Error('workspace_ref must identify the selected portable change workspace');
+  return value;
+}
+
+/** Defaults do not impose an Agent count. Parent and child Ticket caps remain separate from it. */
+export function ticketPolicy(...sources) {
+  const values = sources.filter(Boolean);
+  const modes = values.map(value => value.ticket_execution).filter(Boolean);
+  const limits = values.map(value => value.max_parallel_tickets).filter(value => value !== undefined);
+  if (modes.some(mode => !['auto','serial','parallel'].includes(mode)) || limits.some(limit => !positive(limit))) throw new Error('invalid Ticket scheduling policy');
+  return {ticket_execution:modes.includes('serial') ? 'serial' : modes[0] ?? 'auto', max_parallel_tickets:modes.includes('serial') ? 1 : limits.length ? Math.min(...limits) : null};
+}
+
+export function resolveExecutionWorkspace(repoRoot, context) {
+  if (!context || !repoRoot) return repoRoot;
+  const root = realpathSync.native(repoRoot);
+  const workspace = context.workspace_ref === 'current' ? root : runtime.safeWorkPathSync(root, context.workspace_ref, {mustExist:true,type:'directory'});
+  if (relative(realpathSync.native(workspace), realpathSync.native(git(workspace,['rev-parse','--show-toplevel']))) !== '') throw new Error('selected workspace is not a real Git checkout');
+  const common = cwd => realpathSync.native(resolve(cwd, git(cwd,['rev-parse','--git-common-dir'])));
+  if (common(root) !== common(workspace)) throw new Error('selected workspace belongs to another repository');
+  if (git(workspace,['symbolic-ref','--short','HEAD']) !== context.branch) throw new Error('selected workspace branch drifted');
+  git(workspace,['cat-file','-e',`${context.base_sha}^{commit}`]);
+  git(workspace,['merge-base','--is-ancestor',context.base_sha,'HEAD']);
+  if (context.workspace_policy === 'worktree') {
+    const paths = git(root,['worktree','list','--porcelain','-z']).split('\0').filter(row=>row.startsWith('worktree ')).map(row=>realpathSync.native(row.slice(9)));
+    if (!paths.includes(realpathSync.native(workspace)) || realpathSync.native(workspace) === root) throw new Error('selected change worktree is not registered');
+  }
+  return workspace;
+}
+
+function evidenceText(change, locator) {
+  if (!text(locator) || !locator.includes('#')) throw new Error('verification evidence requires an explicit artifact anchor');
+  const [file, anchor, extra] = locator.split('#');
+  if (!anchor || extra !== undefined) throw new Error('invalid evidence locator');
+  const path = runtime.safeWorkPathSync(change, file, {mustExist:true,type:'file'});
+  return runtime.readArtifactSectionSync(path, anchor).text;
+}
+
+export function validateExecutionRecord(change, record, context, {repoRoot=null, sourceRoot=repoRoot, checkCurrent=false} = {}) {
+  const errors = [], unit = record.ticket_id ?? record.purpose;
+  try {
+    const identity = record.ticket_id ? ['ticket_id'] : ['purpose','change'];
+    const keys = ['schema_version',...identity,'workspace_context','implementation_owners','status','checkpoint','verification','attempts'];
+    if (record.schema_version !== EXECUTION_VERSION || keys.some(key=>!(key in record)) || Object.keys(record).some(key=>!keys.includes(key))) throw new Error('legacy or invalid execution record; explicit reconciliation required');
+    if (record.ticket_id ? !/^T-\d{2,}$/.test(record.ticket_id) : record.purpose !== 'direct-spec' || record.change !== basename(change)) throw new Error('execution identity does not match this change');
+    if (!context || record.workspace_context !== EXECUTION_CONTEXT) throw new Error('execution must reference the unique change Execution Context');
+    if (!['active','review','verified','blocked','cancelled'].includes(record.status)) throw new Error('invalid execution status');
+    if (!Array.isArray(record.implementation_owners) || !record.implementation_owners.length || record.implementation_owners.some(owner=>!text(owner)) || new Set(record.implementation_owners).size !== record.implementation_owners.length) throw new Error('implementation_owners must list the actual distinct implementers');
+    if (!Number.isInteger(record.attempts) || record.attempts < 0 || record.attempts > (context.integration_attempt_limit ?? 3)) throw new Error('verification attempts exceed the effective limit');
+    if (record.checkpoint !== null && !text(record.checkpoint)) throw new Error('checkpoint must be null or a frozen review input locator');
+    const verification = record.verification;
+    if (!object(verification) || Object.keys(verification).sort().join(',') !== 'e2e,evidence,status' || !['pending','passed','failed'].includes(verification.status)) throw new Error('invalid workspace verification');
+    const e2e = verification.e2e;
+    if (!object(e2e) || Object.keys(e2e).sort().join(',') !== 'evidence,reason,required,status' || typeof e2e.required !== 'boolean' || !['pending','passed','failed','not-required'].includes(e2e.status)) throw new Error('invalid E2E disposition');
+    for (const value of [verification.evidence,e2e.evidence,e2e.reason]) if (value !== null && !text(value)) throw new Error('evidence/reason must be null or non-empty text');
+    if (!e2e.required && (e2e.status !== 'not-required' || !text(e2e.reason)) || e2e.required && e2e.status === 'not-required') throw new Error('E2E disposition needs a truthful result/reason');
+    if (record.status === 'verified') {
+      if (verification.status !== 'passed' || !['passed','not-required'].includes(e2e.status) || !record.checkpoint) throw new Error('verified execution requires passed checks, E2E and a frozen checkpoint');
+      const observed = evidenceText(change,verification.evidence);
+      if (!/^Result: passed\s*$/m.test(observed) || !/^Observed: \S/m.test(observed) || /^Command: /m.test(observed) && !/^Exit: 0\s*$/m.test(observed)) throw new Error('verification requires actual observations and successful command exits');
+      if (e2e.required) {
+        const result = evidenceText(change,e2e.evidence);
+        if (!/^Result: passed\s*$/m.test(result) || !/^Observed: \S/m.test(result) || /^Command: /m.test(result) && !/^Exit: 0\s*$/m.test(result) || !result.split('\n').some(line=>line.trim() === `Owner: ${context.owner}`)) throw new Error('required E2E needs observed passing evidence owned by the Lead');
+      }
+      const artifact = `evidence/${record.ticket_id ?? 'direct-spec'}.md`;
+      const source = readFileSync(runtime.safeWorkPathSync(change,artifact,{mustExist:true,type:'file'}),'utf8');
+      if (!source.split('\n').some(line=>line.trim() === `Input: ${record.checkpoint}`)) throw new Error('checkpoint must match the actual Independent Review input');
+      errors.push(...validateIndependentReview(change,artifact,{repoRoot,sourceRoot,requiredImplementers:record.implementation_owners,checkCurrent,requireDelivery:checkCurrent}));
+    }
+  } catch(error) { errors.push(`${unit}: ${error.message}`); }
+  return errors;
+}

package/template/workflows/specdev/common/tools/plan-contract.mjs

@@ -319,7 +319,9 @@ export function readSpecification(changeRoot, { allowLightweight = false, requir
 export function validateExecutionPolicy(plan, config = null) {
   const errors = [];
   const meta = plan.meta;
-  if (!Number.isInteger(meta.concurrent_implementation_limit) || meta.concurrent_implementation_limit < 1 || !Number.isInteger(meta.integration_attempt_limit) || meta.integration_attempt_limit < 1) return ['plan must declare positive execution limits'];
+  if (!['auto','serial','parallel'].includes(meta.ticket_execution)) errors.push('plan must declare ticket_execution: auto, serial or parallel');
+  for (const key of ['concurrent_implementation_limit','max_parallel_tickets']) if (meta[key] !== undefined && (!Number.isInteger(meta[key]) || meta[key] < 1)) errors.push(`${key} must be a positive integer when specified`);
+  if (!Number.isInteger(meta.integration_attempt_limit) || meta.integration_attempt_limit < 1) errors.push('plan must declare a positive integration_attempt_limit');
   if (config) {
     if (config.schema_version !== 7 || !Number.isInteger(config.execution?.max_concurrent_implementations) || !Number.isInteger(config.execution?.max_integration_attempts)) return ['existing tool config requires schema v7 and explicit execution limits'];
     if (meta.concurrent_implementation_limit > config.execution.max_concurrent_implementations) errors.push(`concurrent_implementation_limit ${meta.concurrent_implementation_limit} exceeds config max_concurrent_implementations ${config.execution.max_concurrent_implementations}`);

package/template/workflows/specdev/common/tools/review-evidence.mjs

@@ -34,7 +34,7 @@ function readLocator(root, locator) {
 export function reviewInputDigest(input) { return hash(JSON.stringify(input)); }
 
 /** Sources use project-relative locators; an anchor avoids a README hashing itself. */
-export function validateIndependentReview(root, artifact, {repoRoot=null, requirePassed=true, expectedHead=null, expectedBase=null, expectedResults=null, requiredImplementers=[], requiredSpecifications=[], checkCurrent=false, requireDelivery=false, allowSourceFiles=false} = {}) {
+export function validateIndependentReview(root, artifact, {repoRoot=null, sourceRoot=repoRoot, requirePassed=true, expectedHead=null, expectedBase=null, expectedResults=null, requiredImplementers=[], requiredSpecifications=[], checkCurrent=false, requireDelivery=false, allowSourceFiles=false} = {}) {
   const errors = [], label = `independent-review: ${artifact}`;
   try {
     const path = safeWorkPathSync(root, artifact, {mustExist:true, type:'file'});
@@ -54,7 +54,7 @@ export function validateIndependentReview(root, artifact, {repoRoot=null, requir
     for (const source of input.sources) {
       if (!['standards','specification','instructions'].includes(source.kind) || !real(source.locator) || !/^[a-f0-9]{64}$/.test(source.sha256 ?? '')) throw new Error('invalid review source');
       sourceKinds.add(source.kind);
-      if (repoRoot && checkCurrent && hash(readLocator(repoRoot,source.locator).text) !== source.sha256) throw new Error(`source drift: ${source.locator}`);
+      if (repoRoot && checkCurrent && hash(readLocator(sourceRoot,source.locator).text) !== source.sha256) throw new Error(`source drift: ${source.locator}`);
     }
     if (!sourceKinds.has('standards') || requirePassed && !sourceKinds.has('specification')) throw new Error('missing required review sources');
     if (requiredSpecifications.some(locator=>!input.sources.some(source=>source.kind === 'specification' && source.locator === locator))) throw new Error('review omits the authoritative specification/acceptance source');

package/template/workflows/specdev/common/tools/review-scope.mjs

@@ -43,8 +43,10 @@ function workingFile(root, path) {
 
 function workingTree(options) {
   if (['head','commit','parent'].some(key => options[key] !== undefined)) throw new Error('review-scope: working-tree accepts base, not head/commit/parent');
-  const root = realpathSync(resolve(options.repo));
-  if (realpathSync(git(root, ['rev-parse','--show-toplevel']).trim()) !== root) throw new Error('review-scope: working-tree requires the actual project Git root');
+  // Native realpath expands Windows short names; relative also handles drive
+  // casing without admitting a nested directory that borrows its parent's Git.
+  const root = realpathSync.native(resolve(options.repo));
+  if (relative(root,realpathSync.native(git(root, ['rev-parse','--show-toplevel']).trim())) !== '') throw new Error('review-scope: working-tree requires the actual project Git root');
   const base = commit(root, options.base, 'base');
   const files = options.files?.map(portableFile);
   if (files && (!files.length || new Set(files).size !== files.length)) throw new Error('review-scope: empty or duplicate working-tree scope');

package/template/workflows/specdev/common/tools/tests/engineering.test.mjs

@@ -223,11 +223,11 @@ test('range comparison and merge-base comparison have distinct semantics', t =>
   const range = resolveReviewScope({ repo: r.root, mode: 'range', base: r.c, head: side });
   assert.deepEqual(baseline.changed_paths, ['side.txt']); assert.deepEqual(range.changed_paths, ['b.txt', 'c.txt', 'side.txt']);
 });
-test('fifteen Work IDs match the current registry and persisted schema versions remain unchanged', () => {
+test('fifteen Work IDs match the current registry and persisted schema versions match their contracts', () => {
   const entries = readdirSync(workflow).filter(name => /^specdev-[a-z]-/.test(name)); assert.equal(entries.length, 15);
   const ids = entries.map(name => /speculo-id: (.+)$/m.exec(readFileSync(join(workflow, name, 'SKILL.md'), 'utf8'))?.[1]);
   assert.deepEqual(ids.sort(), ['archive-and-consolidate','code-review','diagnose-bugs','goal-plan','grill-with-docs','implement','init-setup','learn','prototype','retro','review-architecture','spec','tickets','triage','wayfinder'].map(id => 'specdev/' + id).sort());
-  for (const [file, version] of [['config', 7], ['status', 5], ['change-status', 6], ['goal-plan', 7]]) {
+  for (const [file, version] of [['config', 7], ['status', 5], ['change-status', 6], ['goal-plan', 8], ['implementation-plan', 3], ['execution-context', 1], ['execution-record', 1]]) {
     const schema = JSON.parse(readFileSync(join(workflow, 'common/schemas', `${file}.schema.json`), 'utf8'));
     assert.equal(schema.properties.schema_version.const, version);
   }

package/template/workflows/specdev/common/tools/tests/review-fixture.mjs

@@ -6,7 +6,7 @@ import {resolveReviewScope} from '../review-scope.mjs';
 import {reviewInputDigest} from '../review-evidence.mjs';
 import {readArtifactSectionSync} from '../../../../../lib/speculo-runtime.mjs';
 const hash=text=>createHash('sha256').update(text).digest('hex');
-export function appendReviewFixture({repo,root,artifact='evidence/direct-spec.md',base,head=null,files=['value.txt'],mode='native',reviewer='native:reviewer',implementers=['native:implementer'],spec=null,sourceLocators=null}) {
+export function appendReviewFixture({repo,sourceRoot=repo,root,artifact='evidence/direct-spec.md',base,head=null,files=['value.txt'],sourceFiles=false,mode='native',reviewer='native:reviewer',implementers=['native:implementer'],spec=null,sourceLocators=null}) {
   const path=join(root,artifact);mkdirSync(dirname(path),{recursive:true});
   let prior=existsSync(path)?readFileSync(path,'utf8'):'';
   prior=prior.split('\n<!-- synthetic-independent-review -->')[0];
@@ -14,14 +14,14 @@ export function appendReviewFixture({repo,root,artifact='evidence/direct-spec.md
   let sources;
   if(sourceLocators) sources=sourceLocators.map(({kind,locator})=>{
     const [file,anchor]=locator.split('#');
-    return {kind,locator,sha256:hash(anchor?readArtifactSectionSync(join(repo,file),anchor).text:readFileSync(join(repo,file),'utf8'))};
+    return {kind,locator,sha256:hash(anchor?readArtifactSectionSync(join(sourceRoot,file),anchor).text:readFileSync(join(sourceRoot,file),'utf8'))};
   });
   else {
     const standards=join(root,'evidence/fixture-standards.md');mkdirSync(dirname(standards),{recursive:true});writeFileSync(standards,'# Fixture standards\nPreserve existing behavior and test changes.\n');
     if(!spec) {spec=join(root,'evidence/fixture-spec.md');writeFileSync(spec,'# Fixture Spec\nAC-001: deliver the accepted behavior.\n');}
-    sources=[['standards',standards],['specification',spec]].map(([kind,file])=>({kind,locator:relative(repo,file).split('\\').join('/'),sha256:hash(readFileSync(file,'utf8'))}));
+    sources=[['standards',standards],['specification',spec]].map(([kind,file])=>({kind,locator:relative(sourceRoot,file).split('\\').join('/'),sha256:hash(readFileSync(file,'utf8'))}));
   }
-  const scope=resolveReviewScope(head?{repo,mode:'range',base,head}:{repo,mode:'working-tree',base,files});
+  const scope=resolveReviewScope(sourceFiles?{repo,mode:'source-files',files}:head?{repo,mode:'range',base,head}:{repo,mode:'working-tree',base,files});
   const input={scope,sources,exclusions:'Fixture-only records and unrelated inputs are outside the implementation scope.'};
   const digest=reviewInputDigest(input);
   const report=axis=>`<a id="${axis}-output"></a>\n## Original ${axis} output\nReviewer: ${reviewer}\nAxis: ${axis}\nResult: pass\nInput-SHA256: ${digest}\nObserved: synthetic fixture reviewer inspected the fixed inputs; no blocking findings.\n`;

package/template/workflows/specdev/common/tools/tests/review-working-tree.test.mjs

@@ -11,6 +11,7 @@ function fixture(t) {
   t.after(()=>rmSync(root,{recursive:true,force:true}));
   const git=(...args)=>execFileSync('git',['-C',root,...args],{encoding:'utf8',stdio:['ignore','pipe','pipe']}).trim();
   git('init','-b','main');git('config','user.name','Fixture');git('config','user.email','test@example.invalid');
+  git('config','core.autocrlf','false');
   for(const path of ['one.txt','removed.txt','renamed.txt']) writeFileSync(join(root,path),'original\n');
   writeFileSync(join(root,'.gitignore'),'ignored/\n');git('add','.');git('-c','commit.gpgsign=false','commit','-m','base');
   const base=git('rev-parse','HEAD');
@@ -26,14 +27,14 @@ test('working-tree freezes staged, unstaged, added, deleted, renamed and mode ch
   const scope=f.scope();
   assert.equal(scope.outcome,'changes');assert.equal(scope.observed_head,f.base);assert.equal(scope.head_sha,undefined);
   assert.deepEqual(scope.changed_paths,['new-name.txt','new.bin','one.txt','removed.txt','renamed.txt']);
-  assert.equal(scope.working_snapshot.find(x=>x.path==='one.txt').after.mode,'100755');
+  assert.equal(scope.working_snapshot.find(x=>x.path==='one.txt').after.mode,process.platform === 'win32' ? '100644' : '100755');
   assert.equal(scope.working_snapshot.find(x=>x.path==='removed.txt').after,null);
   assert.equal(scope.working_snapshot.find(x=>x.path==='new.bin').after.bytes,3);
   assert.deepEqual(f.scope(),scope);assert.equal(f.git('status','--porcelain'),status);assert.deepEqual(readFileSync(join(f.root,'.git/index')),before);
   writeFileSync(join(f.root,'new.bin'),Buffer.from([0,255,8]));assert.notEqual(f.scope().input_sha256,scope.input_sha256);
 });
 test('explicit scopes are literal, expose exclusions and retain deleted files',t=>{
-  const f=fixture(t), path='literal [*] $(touch unsafe).txt';
+  const f=fixture(t), path='literal [abc] $(touch unsafe).txt';
   writeFileSync(join(f.root,path),'literal');rmSync(join(f.root,'removed.txt'));writeFileSync(join(f.root,'one.txt'),'changed');
   const scope=f.scope({files:[path,'removed.txt']});
   assert.deepEqual(scope.changed_paths,[path,'removed.txt']);assert.deepEqual(scope.excluded_paths,['one.txt']);
@@ -47,7 +48,7 @@ test('links are read as links and directory links never disclose outside bytes',
   t.after(()=>rmSync(outside,{recursive:true,force:true}));writeFileSync(join(outside,'secret'),'sensitive');
   symlinkSync(join(outside,'secret'),join(f.root,'link'));
   const scope=f.scope({files:['link']});assert.equal(scope.working_snapshot[0].after.kind,'symlink');
-  symlinkSync(outside,join(f.root,'directory'));
+  symlinkSync(outside,join(f.root,'directory'),process.platform === 'win32' ? 'junction' : 'dir');
   assert.throws(()=>f.scope({files:['directory/secret']}),/symlink directory/);
 });
 test('unmerged index and borrowed parent repository are rejected',t=>{

package/template/workflows/specdev/common/tools/ticket-control.mjs

@@ -5,6 +5,7 @@ import { basename, dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { parseFrontmatter, validateChange, pathsOverlap } from './validate-specdev.mjs';
 import { CHANGE_ID, digest, findGraphCycle, resolveProjectSource, validateGoalMap, resolveToolContext, validateExecutionPolicy, canonicalToolPath } from './plan-contract.mjs';
+import { readExecutionContext, ticketPolicy } from './execution-context.mjs';
 import * as runtime from '../../../../lib/speculo-runtime.mjs';
 
 const terminal = new Set(['done','cancelled']);
@@ -43,7 +44,7 @@ function contractHash(node) {
       }
     }
   }
-  return digest(JSON.stringify({ meta, body: node.artifact.body, spec: node.specDigest, goal: node.goalDigest, dependencies: node.dependencies, serializations: node.serializations, sources }));
+  return digest(JSON.stringify({ meta, body: node.artifact.body, spec: node.specDigest, goal: node.goalDigest, scheduling:node.policy, workspace:readExecutionContext(dirname(dirname(node.artifact.path))), dependencies: node.dependencies, serializations: node.serializations, sources }));
 }
 
 export function analyzeMap({ mapPath, repoRoot, methodRoot, stateRoot, context: suppliedContext, previous = null }) {
@@ -68,9 +69,9 @@ export function analyzeMap({ mapPath, repoRoot, methodRoot, stateRoot, context:
   if (!Array.isArray(members) || !members.length || (parent && members.length < 2) || new Set(members).size !== members.length || members.some(id => !CHANGE_ID.test(id))) return failure(['invalid/duplicate member change IDs']);
   const planFile = join(root,parent ? 'implementation-plan.md' : 'goal-plan.md');
   const plan = existsSync(planFile) ? readArtifact(planFile) : null;
-  const strategy = plan?.meta.ticket_workspace_policy ?? 'current';
-  let limit = strategy === 'current' ? 1 : plan?.meta.concurrent_implementation_limit;
-  if (!['current','required'].includes(strategy) || !Number.isInteger(limit) || limit < 1) errors.push('invalid workspace strategy or implementation limit');
+  const scopeContext = readExecutionContext(root);
+  const policy = ticketPolicy(plan?.meta,scopeContext);
+  const limit = policy.max_parallel_tickets;
   const configPath = join(context.specdevRoot, 'config.json');
   const config = existsSync(configPath) ? JSON.parse(readFileSync(runtime.safeWorkPathSync(context.specdevRoot, 'config.json', {mustExist:true,type:'file'}), 'utf8')) : null;
   if (plan) errors.push(...validateExecutionPolicy(plan, config));
@@ -81,6 +82,9 @@ export function analyzeMap({ mapPath, repoRoot, methodRoot, stateRoot, context:
     if (!existsSync(memberRoot) || lstatSync(memberRoot).isSymbolicLink() || !lstatSync(memberRoot).isDirectory()) { errors.push(`member must be a real change directory: ${member}`); continue; }
     memberRoots.set(member,memberRoot);
     const facts = runtime.readChangeFactsSync(context, member);
+    const childPlanPath = join(memberRoot,'goal-plan.md');
+    const childPlan = parent && existsSync(childPlanPath) ? readArtifact(childPlanPath) : null;
+    const memberPolicy = ticketPolicy(plan?.meta,childPlan?.meta,readExecutionContext(memberRoot));
     if (facts.location.root !== memberRoot) { errors.push(`member is not an active change: ${member}`); continue; }
     const specFile = join(memberRoot,'spec.md');
     const spec = readArtifact(specFile);
@@ -93,7 +97,7 @@ export function analyzeMap({ mapPath, repoRoot, methodRoot, stateRoot, context:
       const id = parent ? `${member}::${artifact.meta.id}` : artifact.meta.id;
       if (nodes.has(id)) { errors.push(`duplicate Ticket ${id}`); continue; }
       if (!Array.isArray(artifact.meta.blocked_by) || artifact.meta.blocked_by.some(value => !/^T-\d{2,}$/.test(value))) { errors.push(`invalid dependencies: ${id}`); continue; }
-      nodes.set(id, { id, member, repoRoot, artifact, specDigest, facts, dependencies: artifact.meta.blocked_by.map(value => parent ? `${member}::${value}` : value), reasons: [], validationErrors: [] });
+      nodes.set(id, { id, member, repoRoot, policy:memberPolicy, artifact, specDigest, facts, dependencies: artifact.meta.blocked_by.map(value => parent ? `${member}::${value}` : value), reasons: [], validationErrors: [] });
       if (spec.meta.ready_for_tickets !== true) nodes.get(id).reasons.push('source Spec is not Ready');
     }
   }
@@ -146,7 +150,7 @@ export function analyzeMap({ mapPath, repoRoot, methodRoot, stateRoot, context:
   }
   for (const node of nodes.values()) {
     node.reasons.push(...node.validationErrors);
-    if (!terminal.has(node.artifact.meta.status) && (!plan || plan.meta.ready_for_execution !== true)) node.reasons.push('Goal planning gate is not ready for execution');
+    if (!terminal.has(node.artifact.meta.status) && (plan && plan.meta.ready_for_execution !== true)) node.reasons.push('Goal planning gate is not ready for execution');
     if (node.artifact.meta.plan_contract_version !== 1) node.reasons.push('Ticket requires current plan_contract_version: 1');
   }
   const goalDigest = stableGoalContract(plan,entry);
@@ -157,7 +161,7 @@ export function analyzeMap({ mapPath, repoRoot, methodRoot, stateRoot, context:
   const contractDigests = Object.fromEntries([...nodes].map(([id,node]) => [id,contractHash(node)]));
   const invalidated = new Set();
   if (previous !== null) {
-    if (previous.schema_version !== 1 || !previous.contract_digests || typeof previous.contract_digests !== 'object' || Array.isArray(previous.contract_digests) || previous.scope !== basename(root)) errors.push('previous checkpoint schema/scope does not match this Goal');
+    if (previous.schema_version !== 2 || !previous.contract_digests || typeof previous.contract_digests !== 'object' || Array.isArray(previous.contract_digests) || previous.scope !== basename(root)) errors.push('previous checkpoint schema/scope does not match this Goal');
     else {
       for (const [id,value] of Object.entries(contractDigests)) if (previous.contract_digests[id] !== value) invalidated.add(id);
       for (const id of Object.keys(previous.contract_digests)) if (!nodes.has(id)) warnings.push(`previous node removed; check coverage before accepting replan: ${id}`);
@@ -183,7 +187,7 @@ export function analyzeMap({ mapPath, repoRoot, methodRoot, stateRoot, context:
       if (!prerequisite || prerequisite.artifact.meta.status !== 'done' || prerequisite.reasons.length) node.reasons.push(`dependency not successfully satisfied: ${dependency}`);
     }
     for (const other of active) {
-      const issue = strategy === 'current' ? 'current workspace already has an implementation writer' : conflicts(node,other,serializations);
+      const issue = conflicts(node,other,serializations);
       if (issue) node.reasons.push(`in-flight owner ${other.artifact.meta.owner ?? 'unknown'} (${other.id}): ${issue}`);
     }
     if (!node.reasons.length) candidates.push(node);
@@ -206,15 +210,16 @@ export function analyzeMap({ mapPath, repoRoot, methodRoot, stateRoot, context:
   for (const node of candidates.sort((a,b) => a.id.localeCompare(b.id))) {
     if (node.reasons.length) continue;
     const conflict = frontier.map(id => conflicts(node,nodes.get(id),serializations)).find(Boolean);
-    if (conflict || frontier.length >= Math.max(0,limit-active.length)) { deferred.push({id:node.id, reason:conflict ?? 'workspace/config concurrency limit'});continue; }
+    const memberActive = active.filter(other=>other.member === node.member).length + frontier.filter(id=>nodes.get(id).member === node.member).length;
+    if (conflict || limit !== null && frontier.length >= Math.max(0,limit-active.length) || node.policy.max_parallel_tickets !== null && memberActive >= node.policy.max_parallel_tickets) { deferred.push({id:node.id, reason:conflict ?? 'Ticket scheduling concurrency limit'});continue; }
     frontier.push(node.id);
   }
   const blocked = [...nodes.values()].filter(node => node.reasons.length).map(node => ({id:node.id,reasons:[...new Set(node.reasons)]}));
   const nodeErrors = [...nodes.values()].flatMap(node => node.validationErrors.map(message => ({id:node.id,message})));
   const result = {
-    schema_version:1, scope:basename(root), mode:'read-only-analysis',
+    schema_version:2, scope:basename(root), mode:'read-only-analysis',
     authorization_checked:false, transaction_gateway_checked:false,
-    workspace_policy:strategy, implementation_limit:limit,
+    ticket_execution:policy.ticket_execution, max_parallel_tickets:limit,
     input_digest:digest(JSON.stringify({entry:entry.meta,contracts:contractDigests})),
     goal_contract_digest:goalDigest, contract_digests:contractDigests, frontier:errors.length ? [] : frontier,
     deferred, in_flight:active.map(node => ({id:node.id,owner:node.artifact.meta.owner})),
@@ -226,7 +231,7 @@ export function analyzeMap({ mapPath, repoRoot, methodRoot, stateRoot, context:
   return result;
 }
 function failure(errors) {
-  return {schema_version:1,mode:'read-only-analysis',frontier:[],errors,validation_errors:[],eligible_for_final_verification:false};
+  return {schema_version:2,mode:'read-only-analysis',frontier:[],errors,validation_errors:[],eligible_for_final_verification:false};
 }
 function main(args) {
   const options = {};