@ngockhoale/ukit 3.0.2 → 3.0.4

package/src/core/memory/storeV2.js

@@ -3,11 +3,11 @@
 // ({ schemaVersion: 2, records: [...] }); writes via fileOps.writeJson (tmp+rename).
 // Read ops call ensureMigrated() first so every consumer triggers the lazy
 // v1→v2 migration (SPEC §4); migrate.js is lazy-imported to break the
-// storeV2↔migrate import cycle (runMigration writes via saveRecords).
-// The record-document read/write core lives in recordStore.js (FR-007) so the
-// user-level store (userMemory.js) shares it without the migration flow.
+// storeV2↔migrate import cycle. The record-document read/write core lives in
+// recordStore.js (FR-007) so the user-level store (userMemory.js) shares it
+// without the migration flow; mutations go through mutateRecordStore, which
+// serializes read-modify-write under the shared file lock.
 
-import fs from 'node:fs/promises';
 import { buildRuntimePaths } from '../runtimePaths.js';
 import { loadRuntimeConfig } from '../runtimeConfig.js';
 import { createRecord, normalizeRecord } from './records.js';
@@ -16,35 +16,44 @@ import {
   writeRecordStore,
   applyRecordPatch,
   isRawRecord,
+  mutateRecordStore,
 } from './recordStore.js';
 
-// Per-process memoization for ensureMigrated — one-shot check per projectRoot.
-const migratedRoots = new Set();
+// Per-process memoization for ensureMigrated — one in-flight migration per
+// projectRoot. The PROMISE is cached (not a done-flag): concurrent callers
+// during a migration must await the same run — a done-flag set up front let
+// a second reader see an empty store mid-migration, and a writer could create
+// records.json which the in-flight migration then clobbered.
+const migrationPromises = new Map();
+
+
 
 async function ensureMigrated(projectRoot) {
   const key = String(projectRoot);
-  if (migratedRoots.has(key)) return;
-  migratedRoots.add(key); // mark first: a failed/again migration must not loop
-  try {
-    const paths = buildRuntimePaths(projectRoot);
-    let recordsExists = false;
-    try {
-      await fs.access(paths.memoryV2RecordsPath);
-      recordsExists = true;
-    } catch {
-      recordsExists = false;
-    }
-    if (recordsExists) return;
+  const existing = migrationPromises.get(key);
+  if (existing) return existing;
 
-    const config = await loadRuntimeConfig(projectRoot);
-    if (config?.memoryV2?.autoMigrate === false) return;
+  const promise = (async () => {
+    try {
+      const config = await loadRuntimeConfig(projectRoot);
+      if (config?.memoryV2?.autoMigrate === false) return;
 
-    const migrate = await import('./migrate.js');
-    if (await migrate.needsMigration(projectRoot)) {
-      await migrate.runMigration(projectRoot);
+      const migrate = await import('./migrate.js');
+      // needsMigration checks the marker — NOT records.json. Gating on
+      // records.json stranded v1 data forever whenever the file existed
+      // without the marker (a pre-migration write, a crashed first run).
+      if (await migrate.needsMigration(projectRoot)) {
+        await migrate.runMigration(projectRoot);
+      }
+    } catch {
+      // Lazy migration is best-effort: a failed auto-run must not break reads.
     }
-  } catch {
-    // Lazy migration is best-effort: a failed auto-run must not break reads.
+  })();
+  migrationPromises.set(key, promise);
+  try {
+    await promise;
+  } finally {
+    migrationPromises.delete(key);
   }
 }
 
@@ -73,6 +82,8 @@ export async function saveRecords(projectRoot, records) {
 /**
  * addRecord(projectRoot, recordInput) → record
  * Accepts either createRecord-style input or a full raw record (normalized).
+ * Runs ensureMigrated first — a first v2 write must not create records.json
+ * ahead of the v1→v2 migration and strand legacy data.
  */
 export async function addRecord(projectRoot, recordInput) {
   const record = isRawRecord(recordInput)
@@ -81,9 +92,13 @@ export async function addRecord(projectRoot, recordInput) {
   if (!record) {
     throw new Error('addRecord: input could not be normalized into a valid record');
   }
-  const { records } = await readStore(projectRoot);
-  await saveRecords(projectRoot, [...records, record]);
-  return record;
+  await ensureMigrated(projectRoot);
+  const paths = buildRuntimePaths(projectRoot);
+  const stored = await mutateRecordStore(paths.memoryV2RecordsPath, (records) => ({
+    result: record,
+    records: [...records, record],
+  }));
+  return stored ?? record;
 }
 
 /**
@@ -92,11 +107,11 @@ export async function addRecord(projectRoot, recordInput) {
 export async function updateRecord(projectRoot, id, patch = {}) {
   await ensureMigrated(projectRoot);
   const paths = buildRuntimePaths(projectRoot);
-  const { records } = await readRecordStore(paths.memoryV2RecordsPath);
-  const result = applyRecordPatch(records, id, patch);
-  if (!result) return null;
-  await writeRecordStore(paths.memoryV2RecordsPath, result.records);
-  return result.record;
+  return mutateRecordStore(paths.memoryV2RecordsPath, (records) => {
+    const result = applyRecordPatch(records, id, patch);
+    if (!result) return null;
+    return { result: result.record, records: result.records };
+  });
 }
 
 /**

package/src/core/memory/userMemory.js

@@ -11,6 +11,7 @@ import {
   writeRecordStore,
   applyRecordPatch,
   isRawRecord,
+  mutateRecordStore,
 } from './recordStore.js';
 import { loadRecords } from './storeV2.js';
 
@@ -44,22 +45,22 @@ export async function addUserRecord(recordInput, { homeDir } = {}) {
   if (!record) {
     throw new Error('addUserRecord: input could not be normalized into a valid record');
   }
-  const recordsPath = userRecordsPath(homeDir);
-  const { records } = await readRecordStore(recordsPath);
-  await writeRecordStore(recordsPath, [...records, record]);
-  return record;
+  const stored = await mutateRecordStore(userRecordsPath(homeDir), (records) => ({
+    result: record,
+    records: [...records, record],
+  }));
+  return stored ?? record;
 }
 
 /**
  * updateUserRecord(id, patch, {homeDir}={}) → record | null
  */
 export async function updateUserRecord(id, patch = {}, { homeDir } = {}) {
-  const recordsPath = userRecordsPath(homeDir);
-  const { records } = await readRecordStore(recordsPath);
-  const result = applyRecordPatch(records, id, patch);
-  if (!result) return null;
-  await writeRecordStore(recordsPath, result.records);
-  return result.record;
+  return mutateRecordStore(userRecordsPath(homeDir), (records) => {
+    const result = applyRecordPatch(records, id, patch);
+    if (!result) return null;
+    return { result: result.record, records: result.records };
+  });
 }
 
 /**

package/src/core/output/index.js

@@ -1,6 +1,6 @@
 import fs from 'node:fs/promises';
 import path from 'node:path';
-import { readJsonIfExists, writeJson, withFileLock } from '../fileOps.js';
+import { readJsonIfExists, writeJson, withFileLock, escapeRegExp } from '../fileOps.js';
 import { recordCompaction } from '../compact/index.js';
 import { buildRuntimePaths } from '../runtimePaths.js';
 import {
@@ -202,9 +202,6 @@ function detectOutputProfile(command) {
   return OUTPUT_PROFILES.find((profile) => matchesAnyPattern(commandText, profile.commandPatterns)) ?? null;
 }
 
-function escapeRegExp(value) {
-  return String(value ?? '').replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-}
 
 function buildProjectRootVariants(projectRoot) {
   const trimmed = String(projectRoot ?? '').trim();
@@ -381,16 +378,24 @@ export async function sweepTeeCache(dir, {
   maxEntries = TEE_SWEEP_MAX_ENTRIES,
   maxRemovals = TEE_SWEEP_MAX_REMOVALS,
 } = {}) {
-  let names;
+  let dirents;
   try {
-    names = await fs.readdir(dir);
+    dirents = await fs.readdir(dir, { withFileTypes: true });
   } catch {
     return { sampled: true, scanned: 0, removed: 0 };
   }
+  // Eligible-file count comes from the dirents (one bounded readdir, no per-name
+  // stat) so the count cap is enforceable even when maxFiles > maxEntries —
+  // mirror of BUG-C22-10 in the runtime twin: capping `scanned` at maxEntries
+  // made `entries.length` an under-count and `overflow` was always 0.
+  const eligibleNames = [];
+  for (const dirent of dirents) {
+    if (dirent.isFile()) eligibleNames.push(dirent.name);
+  }
   const cutoff = now() - maxAgeMs;
   const entries = [];
   let scanned = 0;
-  for (const name of names) {
+  for (const name of eligibleNames) {
     if (scanned >= maxEntries) break;
     scanned += 1;
     try {
@@ -400,9 +405,9 @@ export async function sweepTeeCache(dir, {
   }
   entries.sort((a, b) => a.mtimeMs - b.mtimeMs);
   // Overflow counts eligible FILES only — foreign entries (non-matching names,
-  // dirs) inflate `names.length` and would evict real entries while the dir is
+  // dirs) inflate the dir listing and would evict real entries while the dir is
   // actually under the cap.
-  const overflow = Math.max(0, entries.length - maxFiles);
+  const overflow = Math.max(0, eligibleNames.length - maxFiles);
   let removed = 0;
   for (const entry of entries) {
     if (removed >= maxRemovals) break;
@@ -1148,7 +1153,7 @@ export async function readOutputHistory(projectRoot, options = {}) {
 
 export async function appendOutputHistory(projectRoot, entry, options = {}) {
   const normalizedEntry = normalizeOutputHistoryEntry(entry);
-  if (!normalizedEntry || !normalizedEntry.command || !normalizedEntry.summary) {
+  if (!normalizedEntry || !normalizedEntry.summary) {
     return readOutputHistory(projectRoot, options);
   }
 

package/src/core/permissionPolicy.js

@@ -102,6 +102,14 @@ export function compilePermissionPolicy(input = {}) {
   if (surfaces === null || typeof surfaces !== 'object' || Array.isArray(surfaces)) {
     throw policyError('surfaces must be an object when provided');
   }
+  // Fail closed on malformed surface lists: a string iterates into per-char
+  // rules and a number throws a bare TypeError — both bypass the policy
+  // contract. Only arrays (or absent keys) are legal.
+  for (const key of ['protect', 'deny', 'allow', 'ask']) {
+    if (surfaces[key] !== undefined && !Array.isArray(surfaces[key])) {
+      throw policyError(`surfaces.${key} must be an array when provided, got: ${JSON.stringify(surfaces[key])}`);
+    }
+  }
 
   const mode = permissionMode;
   const effectiveMode = mode;

package/src/core/runtimeConfig.js

@@ -183,6 +183,36 @@ function pushNonEmptyStringError(errors, value, label) {
   }
 }
 
+// Reserved rollout stages for every feature-stage key (routing.*, decisionPlane.*,
+// continuity.*, learning.*). Stages promote off → shadow → canary → default;
+// absence always means 'off'. Single source of truth — validators and stage
+// resolvers share this set.
+export const VALID_ROUTE_STAGES = new Set(['off', 'shadow', 'canary', 'default']);
+
+// Generic stage resolver for dotted paths like 'decisionPlane.stage' or
+// 'continuity.resumableRun.stage'. Absent config, absent key, non-object
+// intermediate, or malformed stage value all resolve to 'off' — a bad config
+// can never promote a feature. The validator reports the same malformed value
+// as an error, so 'off' here is the safe fallback, not silent acceptance.
+export function resolveConfigStage(config = null, path) {
+  const keys = String(path ?? '').split('.');
+  let node = config;
+  for (const key of keys) {
+    if (!isPlainObject(node)) return 'off';
+    node = node[key];
+  }
+  return VALID_ROUTE_STAGES.has(node) ? node : 'off';
+}
+
+// Pushes a stage-enum error when `node.stage` is present but not reserved.
+// Absent stage is valid (absence = 'off'); a non-object node is reported by
+// the caller's own "must be an object" check.
+function pushStageError(errors, node, label) {
+  if (node.stage !== undefined && !VALID_ROUTE_STAGES.has(node.stage)) {
+    errors.push(`${label}.stage must be one of: ${[...VALID_ROUTE_STAGES].join(', ')}.`);
+  }
+}
+
 export function buildDefaultRuntimeConfig(overrides = {}) {
   const safeOverrides = isPlainObject(overrides) ? overrides : {};
 
@@ -263,6 +293,36 @@ export function buildDefaultRuntimeConfig(overrides = {}) {
       fastPath: { stage: 'off' },
       escalation: { stage: 'off' },
     },
+    // C52 M07 UNIC Decision Agent (docs/pstack/UNIC_DECISION_SPEC §17). All
+    // stages ship 'off' — zero outbound calls, deterministic policy stays
+    // authoritative. `enabled:false` is the global emergency disable.
+    decisionPlane: {
+      enabled: true,
+      stage: 'off',
+      logicalModel: 'unic-decision',
+      checkpoints: {
+        default: 'unic-decision/laya-multilingual',
+        english: 'unic-decision/laya',
+        unknownLanguage: 'unic-decision/auto',
+      },
+      timeoutMs: 5000,
+      maxStateTokens: { multilingual: 1024, english: 512 },
+      maxEnumLabels: 11,
+      maxBatchQuestions: 8,
+      preflightRequired: true,
+      portableReasoningEfforts: ['low', 'medium', 'high', 'max'],
+      leaseChoices: [1, 2, 5, 10],
+      cachePolicy: {
+        decideBeforeLane: true,
+        freezeCacheSensitiveFields: true,
+        requireVerifiedNativeUpdate: true,
+      },
+      circuitBreaker: { failureThreshold: 3, cooldownMs: 30_000 },
+      // Per-family stage overrides (preflight, route, capability, verify,
+      // resume, learn, …) — absence = 'off'; names are declared by the
+      // decision registry, not here.
+      families: {},
+    },
     // SPEC-model-roles: role→tier map injected into delegating-lane route output.
     // Values are tier names or 'inherit-parent' — never raw provider model IDs.
     modelRoles: {
@@ -360,6 +420,25 @@ export function buildDefaultRuntimeConfig(overrides = {}) {
       proposals: { minCount: 3, minSessions: 2 },
       episodes: { autoWrite: false },
       tuning: { enabled: true, applyMode: 'manual' },
+      // C52 M04.2 stage keys (SPEC §5 FR-016–FR-018). candidates: repeated
+      // corrections/suppressions/escalations promote to a LearningCandidate
+      // only after minOccurrences + cross-session evidence; report-only at
+      // 'shadow'. overlays: delta overlays on policy fields; base-version
+      // mismatch → conflict, never silent apply. Promotion stays manual.
+      candidates: { stage: 'off', minOccurrences: 3 },
+      overlays: { stage: 'off' },
+    },
+    // C52 M04.1 compact resumable state (SPEC §5 FR-012–FR-015). Stage 'off'
+    // → no resumable-run records written or consumed; resume falls back to
+    // the existing reinject path.
+    continuity: {
+      resumableRun: { stage: 'off' },
+    },
+    // C52 M06 experiments (SPEC §5 FR-021–FR-023). Disabled by default —
+    // zero calls and zero prompt content when off; no auto-promotion.
+    experiments: {
+      deliberation: { enabled: false },
+      dynamicWorkflow: { enabled: false, maxAttemptsPerFailure: 2, noProgressCap: 3 },
     },
     safePatch: {
       enabled: true,
@@ -539,7 +618,6 @@ export function validateRuntimeConfig(config) {
     if (!isPlainObject(config.routing)) {
       errors.push('routing must be an object.');
     } else {
-      const VALID_ROUTE_STAGES = new Set(['off', 'shadow', 'canary', 'default']);
       for (const key of ['routeSchema', 'rigor', 'fastPath', 'escalation']) {
         const stageKey = config.routing[key];
         if (stageKey === undefined) {
@@ -547,9 +625,133 @@ export function validateRuntimeConfig(config) {
         }
         if (!isPlainObject(stageKey)) {
           errors.push(`routing.${key} must be an object.`);
-        } else if (stageKey.stage !== undefined
-          && !VALID_ROUTE_STAGES.has(stageKey.stage)) {
-          errors.push(`routing.${key}.stage must be one of: ${[...VALID_ROUTE_STAGES].join(', ')}.`);
+        } else {
+          pushStageError(errors, stageKey, `routing.${key}`);
+        }
+      }
+    }
+  }
+
+  // C52 M07 decisionPlane — optional-present, additive-namespaced. Absent →
+  // valid (pre-C52 configs); present → stage keys must hold reserved stages,
+  // present fields must be well-typed. families.* accepts arbitrary family
+  // names (declared by the decision registry) but every family stage is
+  // enum-checked.
+  if (config.decisionPlane !== undefined) {
+    if (!isPlainObject(config.decisionPlane)) {
+      errors.push('decisionPlane must be an object.');
+    } else {
+      const decisionPlane = config.decisionPlane;
+      if (decisionPlane.enabled !== undefined) {
+        pushBooleanError(errors, decisionPlane.enabled, 'decisionPlane.enabled');
+      }
+      pushStageError(errors, decisionPlane, 'decisionPlane');
+      if (decisionPlane.timeoutMs !== undefined) {
+        pushPositiveNumberError(errors, decisionPlane.timeoutMs, 'decisionPlane.timeoutMs');
+      }
+      if (decisionPlane.maxEnumLabels !== undefined) {
+        pushPositiveNumberError(errors, decisionPlane.maxEnumLabels, 'decisionPlane.maxEnumLabels');
+      }
+      if (decisionPlane.maxBatchQuestions !== undefined) {
+        pushPositiveNumberError(errors, decisionPlane.maxBatchQuestions, 'decisionPlane.maxBatchQuestions');
+      }
+      if (decisionPlane.preflightRequired !== undefined) {
+        pushBooleanError(errors, decisionPlane.preflightRequired, 'decisionPlane.preflightRequired');
+      }
+      if (decisionPlane.maxStateTokens !== undefined) {
+        if (!isPlainObject(decisionPlane.maxStateTokens)) {
+          errors.push('decisionPlane.maxStateTokens must be an object.');
+        } else {
+          pushPositiveNumberError(errors, decisionPlane.maxStateTokens.multilingual, 'decisionPlane.maxStateTokens.multilingual');
+          pushPositiveNumberError(errors, decisionPlane.maxStateTokens.english, 'decisionPlane.maxStateTokens.english');
+        }
+      }
+      if (decisionPlane.checkpoints !== undefined) {
+        if (!isPlainObject(decisionPlane.checkpoints)) {
+          errors.push('decisionPlane.checkpoints must be an object.');
+        } else {
+          for (const key of ['default', 'english', 'unknownLanguage']) {
+            if (decisionPlane.checkpoints[key] !== undefined) {
+              pushNonEmptyStringError(errors, decisionPlane.checkpoints[key], `decisionPlane.checkpoints.${key}`);
+            }
+          }
+        }
+      }
+      if (decisionPlane.leaseChoices !== undefined && !Array.isArray(decisionPlane.leaseChoices)) {
+        errors.push('decisionPlane.leaseChoices must be an array.');
+      }
+      if (decisionPlane.portableReasoningEfforts !== undefined
+        && !Array.isArray(decisionPlane.portableReasoningEfforts)) {
+        errors.push('decisionPlane.portableReasoningEfforts must be an array.');
+      }
+      if (decisionPlane.cachePolicy !== undefined && !isPlainObject(decisionPlane.cachePolicy)) {
+        errors.push('decisionPlane.cachePolicy must be an object.');
+      }
+      if (decisionPlane.circuitBreaker !== undefined) {
+        if (!isPlainObject(decisionPlane.circuitBreaker)) {
+          errors.push('decisionPlane.circuitBreaker must be an object.');
+        } else {
+          if (decisionPlane.circuitBreaker.failureThreshold !== undefined) {
+            pushPositiveNumberError(errors, decisionPlane.circuitBreaker.failureThreshold, 'decisionPlane.circuitBreaker.failureThreshold');
+          }
+          if (decisionPlane.circuitBreaker.cooldownMs !== undefined) {
+            pushPositiveNumberError(errors, decisionPlane.circuitBreaker.cooldownMs, 'decisionPlane.circuitBreaker.cooldownMs');
+          }
+        }
+      }
+      if (decisionPlane.families !== undefined) {
+        if (!isPlainObject(decisionPlane.families)) {
+          errors.push('decisionPlane.families must be an object.');
+        } else {
+          for (const [family, familyConfig] of Object.entries(decisionPlane.families)) {
+            if (!isPlainObject(familyConfig)) {
+              errors.push(`decisionPlane.families.${family} must be an object.`);
+            } else {
+              pushStageError(errors, familyConfig, `decisionPlane.families.${family}`);
+            }
+          }
+        }
+      }
+    }
+  }
+
+  // C52 M04.1 continuity — optional-present; resumableRun carries one stage key.
+  if (config.continuity !== undefined) {
+    if (!isPlainObject(config.continuity)) {
+      errors.push('continuity must be an object.');
+    } else if (config.continuity.resumableRun !== undefined) {
+      if (!isPlainObject(config.continuity.resumableRun)) {
+        errors.push('continuity.resumableRun must be an object.');
+      } else {
+        pushStageError(errors, config.continuity.resumableRun, 'continuity.resumableRun');
+      }
+    }
+  }
+
+  // C52 M06 experiments — optional-present; both experiments are
+  // disabled-by-default booleans plus bounded breakers.
+  if (config.experiments !== undefined) {
+    if (!isPlainObject(config.experiments)) {
+      errors.push('experiments must be an object.');
+    } else {
+      if (config.experiments.deliberation !== undefined) {
+        if (!isPlainObject(config.experiments.deliberation)) {
+          errors.push('experiments.deliberation must be an object.');
+        } else {
+          pushBooleanError(errors, config.experiments.deliberation.enabled, 'experiments.deliberation.enabled');
+        }
+      }
+      if (config.experiments.dynamicWorkflow !== undefined) {
+        if (!isPlainObject(config.experiments.dynamicWorkflow)) {
+          errors.push('experiments.dynamicWorkflow must be an object.');
+        } else {
+          pushBooleanError(errors, config.experiments.dynamicWorkflow.enabled, 'experiments.dynamicWorkflow.enabled');
+          if (config.experiments.dynamicWorkflow.maxAttemptsPerFailure !== undefined) {
+            pushPositiveNumberError(errors, config.experiments.dynamicWorkflow.maxAttemptsPerFailure, 'experiments.dynamicWorkflow.maxAttemptsPerFailure');
+          }
+          if (config.experiments.dynamicWorkflow.noProgressCap !== undefined) {
+            pushPositiveNumberError(errors, config.experiments.dynamicWorkflow.noProgressCap, 'experiments.dynamicWorkflow.noProgressCap');
+          }
         }
       }
     }
@@ -797,6 +999,24 @@ export function validateRuntimeConfig(config) {
           }
         }
       }
+      // C52 M04.2 stage keys — same optional-present contract as routing.*.
+      if (learning.candidates !== undefined) {
+        if (!isPlainObject(learning.candidates)) {
+          errors.push('learning.candidates must be an object.');
+        } else {
+          pushStageError(errors, learning.candidates, 'learning.candidates');
+          if (learning.candidates.minOccurrences !== undefined) {
+            pushPositiveNumberError(errors, learning.candidates.minOccurrences, 'learning.candidates.minOccurrences');
+          }
+        }
+      }
+      if (learning.overlays !== undefined) {
+        if (!isPlainObject(learning.overlays)) {
+          errors.push('learning.overlays must be an object.');
+        } else {
+          pushStageError(errors, learning.overlays, 'learning.overlays');
+        }
+      }
     }
   }
 

package/src/core/sensitiveValueScanner.js

@@ -58,8 +58,12 @@ export function scanText(text, options = {}) {
   if (gateEnabled === false) return clean;
   if (typeof text !== 'string' || text.length === 0) return clean;
 
+  // sha256() emits lowercase hex; normalize caller/config digests so an
+  // uppercase-but-valid allowlist entry cannot silently fail to match.
   const allowed = new Set(
-    Array.isArray(allowlistHashes) ? allowlistHashes.filter((h) => typeof h === 'string') : [],
+    Array.isArray(allowlistHashes)
+      ? allowlistHashes.filter((h) => typeof h === 'string').map((h) => h.toLowerCase())
+      : [],
   );
 
   const labels = new Set();
@@ -114,5 +118,9 @@ export function loadSensitiveAllowlist(config) {
   if (Array.isArray(security.sensitiveDataAllowlist)) {
     candidates.push(...security.sensitiveDataAllowlist);
   }
-  return candidates.filter((v) => typeof v === 'string' && SHA256_HEX_RE.test(v));
+  // Normalize to lowercase: sha256() emits lowercase hex, and an
+  // uppercase-but-valid config digest must still match (audit D1).
+  return candidates
+    .filter((v) => typeof v === 'string' && SHA256_HEX_RE.test(v))
+    .map((v) => v.toLowerCase());
 }

package/src/core/taskBudgetValidator.js

@@ -116,24 +116,19 @@ function countTargetFiles(body) {
 // separator row `|---|-----|...` are both skipped.
 function countTestCases(body) {
   if (body == null) return 0;
-  const lines = body.split('\n');
-  let count = 0;
-  let sawHeader = false;
-  let sawSeparator = false;
-  for (const line of lines) {
-    const trimmed = line.trim();
-    if (!trimmed.startsWith('|')) continue;
-    if (!sawHeader) {
-      sawHeader = true;
-      continue;
-    }
-    if (!sawSeparator && /^\|[-\s|]+\|\s*$/.test(trimmed)) {
-      sawSeparator = true;
-      continue;
-    }
-    count += 1;
+  const rows = body
+    .split('\n')
+    .map((line) => line.trim())
+    .filter((line) => line.startsWith('|'));
+  const separatorIdx = rows.findIndex((r) => /^\|[-\s|]+\|\s*$/.test(r));
+  if (separatorIdx >= 0) {
+    // Header row + separator row precede the data rows.
+    return rows.length - (separatorIdx + 1);
   }
-  return count;
+  // No separator row: a leading canonical header (first cell '#') is still a
+  // header; every other pipe row is a test case — a headerless table counts
+  // every row, never silently dropping the first.
+  return rows[0] && /^\|\s*#\s*\|/.test(rows[0]) ? rows.length - 1 : rows.length;
 }
 
 // Extract the first ```bash ... ``` fence under `## Verification Commands` and split

package/src/core/taskProgressGuard.js

@@ -66,24 +66,74 @@ function sliceSection(markdown, headingRe) {
   return markdown.slice(start, end);
 }
 
+// Target-file entries may carry brace alternation (`src/core/{a,b}.js`) or glob
+// stars (`src/core/compact/*.js`) — planners write both. Expand them so a
+// progress entry naming a covered file is not a false undeclared-drift.
+function escapeRegExp(text) {
+  return text.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+
+function targetPatternToRegExp(pattern) {
+  // `{a,b}` → alternation; `**` → any path; `*` → any non-separator run.
+  let source = '';
+  for (let i = 0; i < pattern.length; i += 1) {
+    const ch = pattern[i];
+    if (ch === '*') {
+      if (pattern[i + 1] === '*') {
+        source += '.*';
+        i += 1;
+      } else {
+        source += '[^/]*';
+      }
+    } else if (ch === '{') {
+      const close = pattern.indexOf('}', i + 1);
+      if (close === -1) {
+        source += '\\{';
+      } else {
+        source += `(?:${pattern.slice(i + 1, close).split(',').map(escapeRegExp).join('|')})`;
+        i = close;
+      }
+    } else {
+      source += escapeRegExp(ch);
+    }
+  }
+  return new RegExp(`^${source}$`);
+}
+
 function collectTargetFiles(markdown) {
   const section = sliceSection(markdown, TARGET_HEADING);
-  if (!section) return new Set();
   const files = new Set();
-  for (const line of section.split('\n')) {
-    // Lines look like "- `path/to/file.js` — what changes"
-    const m = /^\s*-\s+`?([^`\s]+(?:\.[^`\s]+)?)`?/.exec(line);
-    if (m) files.add(m[1]);
+  const patterns = [];
+  if (section) {
+    for (const line of section.split('\n')) {
+      // Lines look like "- `path/to/file.js` — what changes"
+      const m = /^\s*-\s+`?([^`\s]+(?:\.[^`\s]+)?)`?/.exec(line);
+      if (!m) continue;
+      const target = m[1];
+      if (/[{*]/.test(target)) patterns.push(targetPatternToRegExp(target));
+      else files.add(target);
+    }
   }
-  return files;
+  return {
+    has(file) {
+      return files.has(file) || patterns.some((re) => re.test(file));
+    },
+  };
 }
 
 function collectProgressEntries(progressSection) {
   const entries = [];
   for (const line of progressSection.split('\n')) {
-    if (!line.trim().startsWith('- ')) continue;
-    const parsed = parseEntry(line.trim());
-    if (parsed) entries.push(parsed);
+    const trimmed = line.trim();
+    if (!trimmed.startsWith('- ')) continue;
+    const parsed = parseEntry(trimmed);
+    if (parsed) {
+      entries.push(parsed);
+    } else if (trimmed.includes('milestone:')) {
+      // A bullet that looks like a progress entry but fails the entry grammar is
+      // malformed — report it rather than silently dropping it.
+      entries.push({ ok: false, raw: trimmed });
+    }
   }
   return entries;
 }