@planu/cli 4.10.3 → 4.10.5

package/CHANGELOG.md

@@ -1,3 +1,20 @@
+## [4.10.5] - 2026-07-07
+
+### Bug Fixes
+- fix(SPEC-1109): resolve audit backlog
+
+
+## [4.10.4] - 2026-07-06
+
+### Bug Fixes
+- fix: resolve Supabase testimonials and Planu bug backlog
+
+### Chores
+- chore(deps): update tsc-alias
+- chore(planu): clear released pending specs
+- chore(format): apply prettier baseline
+
+
 ## [4.10.3] - 2026-07-02
 
 ### Bug Fixes

package/dist/config/version.js

@@ -1,4 +1,4 @@
-// version.ts — reads from package.json at runtime; updated automatically by semantic-release
+// version.ts — reads from package.json at runtime; updated by the local release flow
 import { readFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';

package/dist/config/version.ts

@@ -1,4 +1,4 @@
-// version.ts — reads from package.json at runtime; updated automatically by semantic-release
+// version.ts — reads from package.json at runtime; updated by the local release flow
 
 import { readFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';

package/dist/engine/project-graph/extractors/decision-store-extractor.js

@@ -1,6 +1,6 @@
 import { safeJsonParse } from '../../../storage/base-store.js';
 import { hashText } from '../cache.js';
-import { redactGraphText } from '../query.js';
+import { redactGraphText } from '../redaction.js';
 function isDecision(value) {
     return (value !== null &&
         typeof value === 'object' &&

package/dist/engine/project-graph/extractors/git-extractor.js

@@ -1,6 +1,6 @@
 import { promisify } from 'node:util';
 import { hashText } from '../cache.js';
-import { redactGraphText } from '../query.js';
+import { redactGraphText } from '../redaction.js';
 export async function extractGitGraph(args) {
     try {
         const childProcess = await import('node:child_process');

package/dist/engine/project-graph/extractors/handoff-extractor.js

@@ -1,5 +1,5 @@
 import { hashText } from '../cache.js';
-import { redactGraphText } from '../query.js';
+import { redactGraphText } from '../redaction.js';
 function specIdFromPath(path) {
     return path.split('/').find((part) => /^SPEC-\d+$/i.test(part));
 }

package/dist/engine/project-graph/extractors/spec-extractor.js

@@ -1,6 +1,6 @@
 import YAML from 'yaml';
 import { hashText } from '../cache.js';
-import { redactGraphText } from '../query.js';
+import { redactGraphText } from '../redaction.js';
 function frontmatter(content) {
     if (!content.startsWith('---')) {
         return {};

package/dist/engine/project-graph/extractors/validation-extractor.js

@@ -1,5 +1,5 @@
 import { hashText } from '../cache.js';
-import { redactGraphText } from '../query.js';
+import { redactGraphText } from '../redaction.js';
 function specIdFromPath(path) {
     return path.split('/').find((part) => /^SPEC-\d+$/i.test(part));
 }

package/dist/engine/project-graph/index.d.ts

@@ -1,4 +1,5 @@
 export { buildProjectKnowledgeGraph } from './builder.js';
-export { queryProjectGraphSlice, formatProjectGraphContext, getProjectGraphFreshnessHint, redactGraphText, } from './query.js';
+export { queryProjectGraphSlice, formatProjectGraphContext, getProjectGraphFreshnessHint, } from './query.js';
+export { redactGraphText } from './redaction.js';
 export { getProjectGraphFreshness, loadProjectGraphPolicy, projectGraphPath, projectGraphCachePath, } from './cache.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/engine/project-graph/index.js

@@ -1,4 +1,5 @@
 export { buildProjectKnowledgeGraph } from './builder.js';
-export { queryProjectGraphSlice, formatProjectGraphContext, getProjectGraphFreshnessHint, redactGraphText, } from './query.js';
+export { queryProjectGraphSlice, formatProjectGraphContext, getProjectGraphFreshnessHint, } from './query.js';
+export { redactGraphText } from './redaction.js';
 export { getProjectGraphFreshness, loadProjectGraphPolicy, projectGraphPath, projectGraphCachePath, } from './cache.js';
 //# sourceMappingURL=index.js.map

package/dist/engine/project-graph/query.d.ts

@@ -1,5 +1,4 @@
-import type { ProjectGraphPolicy, ProjectGraphQueryInput, ProjectGraphSlice } from '../../types/project-knowledge-graph.js';
-export declare function redactGraphText(text: string, policy: ProjectGraphPolicy, maxChars?: number): string;
+import type { ProjectGraphQueryInput, ProjectGraphSlice } from '../../types/project-knowledge-graph.js';
 export declare function queryProjectGraphSlice(input: ProjectGraphQueryInput): Promise<ProjectGraphSlice | null>;
 export declare function formatProjectGraphContext(slice: ProjectGraphSlice): Promise<string>;
 export declare function getProjectGraphFreshnessHint(args: {

package/dist/engine/project-graph/query.js

@@ -1,16 +1,7 @@
 import { hashProjectPath } from '../../storage/base-store.js';
 import { buildProjectKnowledgeGraph } from './builder.js';
 import { getProjectGraphFreshness, loadProjectGraphPolicy, readProjectGraph } from './cache.js';
-function escapeInert(text) {
-    return text.replace(/</g, '&lt;').replace(/>/g, '&gt;');
-}
-export function redactGraphText(text, policy, maxChars = policy.redaction.maxSnippetChars) {
-    const truncated = text.slice(0, maxChars);
-    return policy.redaction.redactPatterns.reduce((current, pattern) => {
-        const re = new RegExp(pattern, 'gi');
-        return current.replace(re, '[redacted]');
-    }, truncated);
-}
+import { escapeInert, redactGraphText } from './redaction.js';
 function sanitizeLabel(label, policy) {
     return escapeInert(redactGraphText(label, policy));
 }

package/dist/engine/project-graph/redaction.d.ts

@@ -0,0 +1,4 @@
+import type { ProjectGraphPolicy } from '../../types/project-knowledge-graph.js';
+export declare function escapeInert(text: string): string;
+export declare function redactGraphText(text: string, policy: ProjectGraphPolicy, maxChars?: number): string;
+//# sourceMappingURL=redaction.d.ts.map

package/dist/engine/project-graph/redaction.js

@@ -0,0 +1,11 @@
+export function escapeInert(text) {
+    return text.replace(/</g, '&lt;').replace(/>/g, '&gt;');
+}
+export function redactGraphText(text, policy, maxChars = policy.redaction.maxSnippetChars) {
+    const truncated = text.slice(0, maxChars);
+    return policy.redaction.redactPatterns.reduce((current, pattern) => {
+        const re = new RegExp(pattern, 'gi');
+        return current.replace(re, '[redacted]');
+    }, truncated);
+}
+//# sourceMappingURL=redaction.js.map

package/dist/engine/spec-format/lean-spec-generator.js

@@ -2,7 +2,6 @@
 // Output: ~30-50 lines. No generic sections, no OWASP, no STRIDE, no resilience criteria.
 import { parseBddScenarios, renderBddScenariosYaml, convertCheckboxToBdd } from './bdd-parser.js';
 import { deriveModelBudget } from './model-budget-deriver.js';
-import { renderHistoryYaml } from '../spec-versioning/render-history.js';
 import { renderGroundingFrontmatter, renderTechnicalReferenceGroundingFrontmatter, } from '../spec-grounding/contract.js';
 /** Strip redundant "SPEC-XXX — " or "SPEC-XXX: " prefix from spec titles.
  * Titles must not repeat the ID since it is already stored in the `id` field. */
@@ -60,15 +59,11 @@ export function generateLeanSpecContent(input) {
     else {
         acLines = buildCheckboxLines(description, extraCriteria, input.criteriaOverride);
     }
-    // SPEC-717: render empty version history for new specs
-    const historyYaml = renderHistoryYaml([]);
     const lines = [
         ...frontmatterBase,
         ...acLines,
         'history:',
         ...history.map((h) => `  - date: ${h.date}\n    event: ${h.event}`),
-        // SPEC-717: version history (empty for new specs)
-        historyYaml,
         '---',
         '',
         description.trim(),

package/dist/engine/validator/validation-report-writer.js

@@ -1,15 +1,16 @@
-import { appendArtifact } from '../handoff-artifacts/io.js';
+import { appendArtifact, readArtifact } from '../handoff-artifacts/io.js';
 import { runSpecCompliance, } from './spec-compliance-runner.js';
 export async function writeImplementationReviewReport(input) {
     const specCompliance = await runSpecCompliance(input.spec, input.projectPath);
     const gates = buildGates({
         score: input.score,
-        lintPassed: input.lintPassed ?? true,
+        lintPassed: input.lintPassed,
         conventionRegression: input.conventionRegression ?? false,
         specCompliance,
         minimalityReport: input.minimalityReport,
     });
-    const passed = gates.every((gate) => gate.passed);
+    const mergedGates = await preserveUnobservedBlockingGates(input, gates);
+    const passed = mergedGates.every((gate) => gate.passed);
     const reviewer = {
         kind: 'implementation-review-agent',
         agent: 'planu-implementation-reviewer',
@@ -20,7 +21,7 @@ export async function writeImplementationReviewReport(input) {
         schema_version: '1.0.0',
         specId: input.specId,
         passed,
-        gates,
+        gates: mergedGates,
         reviewer,
         specCompliance: reportCompliance,
         minimalityReport: input.minimalityReport,
@@ -40,7 +41,7 @@ export async function writeImplementationReviewReport(input) {
             sha: artifact.sha,
             reviewer,
             passed,
-            gates,
+            gates: mergedGates,
             specCompliance: reportCompliance,
         };
     }
@@ -50,11 +51,38 @@ export async function writeImplementationReviewReport(input) {
             error: err instanceof Error ? err.message : String(err),
             reviewer,
             passed,
-            gates,
+            gates: mergedGates,
             specCompliance: reportCompliance,
         };
     }
 }
+async function preserveUnobservedBlockingGates(input, nextGates) {
+    const currentGateNames = new Set(nextGates.map((gate) => gate.name));
+    const explicitlyObserved = new Set([
+        ...(input.lintPassed !== undefined ? ['lint'] : []),
+        ...(input.conventionRegression !== undefined ? ['convention-regression'] : []),
+        ...(input.minimalityReport !== undefined ? ['minimal-implementation'] : []),
+    ]);
+    const existing = await readArtifact({
+        projectId: input.projectId,
+        specId: input.specId,
+        kind: 'validation-report',
+    }).catch(() => null);
+    if (!existing?.ok) {
+        return nextGates;
+    }
+    const preserved = existing.payload.gates.filter((gate) => !gate.passed &&
+        currentGateNames.has(gate.name) &&
+        !explicitlyObserved.has(gate.name) &&
+        (gate.name === 'lint' ||
+            gate.name === 'convention-regression' ||
+            gate.name === 'minimal-implementation'));
+    if (preserved.length === 0) {
+        return nextGates;
+    }
+    const preservedByName = new Map(preserved.map((gate) => [gate.name, gate]));
+    return nextGates.map((gate) => preservedByName.get(gate.name) ?? gate);
+}
 function buildGates(args) {
     return [
         {
@@ -66,8 +94,12 @@ function buildGates(args) {
         },
         {
             name: 'lint',
-            passed: args.lintPassed,
-            reason: args.lintPassed ? undefined : 'Configured lint command failed.',
+            passed: args.lintPassed === true,
+            reason: args.lintPassed === true
+                ? undefined
+                : args.lintPassed === false
+                    ? 'Configured lint command failed.'
+                    : 'Lint result was not provided; report cannot claim lint passed.',
         },
         {
             name: 'convention-regression',

package/dist/tools/design-schema-sql/migrations.js

@@ -62,11 +62,17 @@ export function generateMigrations(tables, indexes, rlsPolicies, engine) {
             });
         }
         for (const policy of rlsPolicies) {
-            const usingClause = `USING (${policy.using})`;
-            const withCheckClause = policy.withCheck ? ` WITH CHECK (${policy.withCheck})` : '';
+            const rolesClause = policy.roles?.length ? ` TO ${policy.roles.join(', ')}` : '';
+            const usingClause = policy.operation === 'INSERT' ? '' : ` USING (${policy.using})`;
+            const withCheckClause = policy.withCheck || policy.operation === 'INSERT'
+                ? ` WITH CHECK (${policy.withCheck ?? policy.using})`
+                : '';
+            const policyClauses = [rolesClause, usingClause, withCheckClause]
+                .filter((clause) => clause.length > 0)
+                .join('');
             migrations.push({
                 order: order++,
-                sql: `CREATE POLICY ${policy.name} ON ${policy.table} FOR ${policy.operation} ${usingClause}${withCheckClause};`,
+                sql: `CREATE POLICY ${policy.name} ON ${policy.table} FOR ${policy.operation}${policyClauses};`,
                 reversible: true,
                 reverseSql: `DROP POLICY IF EXISTS ${policy.name} ON ${policy.table};`,
                 dataLoss: false,

package/dist/tools/design-schema-sql/tables.js

@@ -170,43 +170,68 @@ export function generateIndexes(tables, _engine) {
 export function generateRLSPolicies(tables) {
     const policies = [];
     for (const table of tables) {
+        const ownerCol = table.columns.find((c) => c.name === 'user_id' || c.name === 'owner_id' || c.name === 'created_by');
+        const ownerPredicate = ownerCol ? `(select auth.uid()) = ${ownerCol.name}` : 'true';
         policies.push({
             name: `${table.name}_select_authenticated`,
             table: table.name,
             operation: 'SELECT',
-            using: "auth.role() = 'authenticated'",
-            justification: 'Only authenticated users can read records',
+            roles: ['authenticated'],
+            using: ownerPredicate,
+            justification: ownerCol
+                ? 'Authenticated users can only read records they own'
+                : 'Only authenticated users can read records',
         });
-        const ownerCol = table.columns.find((c) => c.name === 'user_id' || c.name === 'owner_id' || c.name === 'created_by');
         if (ownerCol) {
             policies.push({
                 name: `${table.name}_insert_owner`,
                 table: table.name,
                 operation: 'INSERT',
+                roles: ['authenticated'],
                 using: 'true',
-                withCheck: `auth.uid() = ${ownerCol.name}`,
+                withCheck: ownerPredicate,
                 justification: 'Users can only insert records they own',
             }, {
                 name: `${table.name}_update_owner`,
                 table: table.name,
                 operation: 'UPDATE',
-                using: `auth.uid() = ${ownerCol.name}`,
+                roles: ['authenticated'],
+                using: ownerPredicate,
+                withCheck: ownerPredicate,
                 justification: 'Users can only update their own records',
             }, {
                 name: `${table.name}_delete_owner`,
                 table: table.name,
                 operation: 'DELETE',
-                using: `auth.uid() = ${ownerCol.name}`,
+                roles: ['authenticated'],
+                using: ownerPredicate,
                 justification: 'Users can only delete their own records',
             });
         }
         else {
             policies.push({
-                name: `${table.name}_all_authenticated`,
+                name: `${table.name}_insert_authenticated`,
+                table: table.name,
+                operation: 'INSERT',
+                roles: ['authenticated'],
+                using: 'true',
+                withCheck: 'true',
+                justification: 'Authenticated users can insert records',
+            }, {
+                name: `${table.name}_update_authenticated`,
                 table: table.name,
-                operation: 'ALL',
-                using: "auth.role() = 'authenticated'",
-                justification: 'All CRUD operations require authentication',
+                operation: 'UPDATE',
+                roles: ['authenticated'],
+                using: 'true',
+                withCheck: 'true',
+                justification: 'Authenticated users can update records',
+            }, {
+                name: `${table.name}_delete_authenticated`,
+                table: table.name,
+                operation: 'DELETE',
+                roles: ['authenticated'],
+                using: 'true',
+                justification: 'Authenticated users can delete records',
             });
         }
     }

package/dist/tools/init-project/result-builder.js

@@ -181,6 +181,8 @@ export function buildInitProjectResult(input) {
                 healthScore: input.healthReport.score,
                 healthSummary: input.healthReport.summary,
                 items: input.healthReport.items,
+                conventionScanStatus: input.conventionScanStatus ?? 'skipped',
+                conventionWarning: buildConventionHealthWarning(input),
             }
             : null,
         feedbackHint: 'Found a bug or have a suggestion? Just say "I want to report a bug" or "I have a suggestion" and Planu will track it for you.',
@@ -256,4 +258,15 @@ export function buildInitProjectResult(input) {
         },
     };
 }
+function buildConventionHealthWarning(input) {
+    const status = input.conventionScanStatus ?? 'skipped';
+    if (status === 'failed') {
+        return 'Convention scan failed; project health may not include all convention violations.';
+    }
+    const conventionItems = input.healthReport?.items.filter((item) => /convention|rule/i.test(item.category) || /convention|rule/i.test(item.message)) ?? [];
+    if (conventionItems.length === 0) {
+        return null;
+    }
+    return `${String(conventionItems.length)} convention-related health warning(s) detected.`;
+}
 //# sourceMappingURL=result-builder.js.map

package/dist/tools/testimonial-handler.js

@@ -13,6 +13,9 @@ function formatTestimonial(t) {
     const github = t.authorGithub ? ` (@${t.authorGithub})` : '';
     return `- "${t.quote}" — ${t.authorName}${github}, ${t.authorRole}${featured} (${t.rating}/5, ${t.locale})`;
 }
+function nonBlank(value) {
+    return typeof value === 'string' && value.trim().length > 0;
+}
 export async function handleApproveTestimonial(input) {
     const config = await getSupabaseConfig(input.projectPath);
     if (!config) {
@@ -26,23 +29,21 @@ export async function handleApproveTestimonial(input) {
             isError: true,
         };
     }
-    const hasFeedbackId = Boolean(input.feedbackId);
-    const hasManualData = Boolean(input.authorName) && Boolean(input.quote);
-    if (!hasFeedbackId && !hasManualData) {
+    if (!nonBlank(input.authorName) || !nonBlank(input.quote)) {
         return {
             content: [
                 {
                     type: 'text',
-                    text: 'Validation failed: either feedbackId or both authorName and quote are required.',
+                    text: 'Validation failed: authorName and quote are required before approving a testimonial. feedbackId-only approval is not supported yet.',
                 },
             ],
             isError: true,
         };
     }
     const payload = {
-        author_name: input.authorName ?? '',
-        author_role: input.authorRole ?? '',
-        quote: input.quote ?? '',
+        author_name: input.authorName.trim(),
+        author_role: input.authorRole?.trim() ?? '',
+        quote: input.quote.trim(),
         rating: input.rating ?? 5,
         source: input.source ?? 'manual',
         approved: true,
@@ -50,19 +51,19 @@ export async function handleApproveTestimonial(input) {
         locale: input.locale ?? 'en',
     };
     if (input.authorAvatarUrl !== undefined) {
-        payload.author_avatar_url = input.authorAvatarUrl;
+        payload.author_avatar_url = input.authorAvatarUrl.trim();
     }
     if (input.authorGithub !== undefined) {
-        payload.author_github = input.authorGithub;
+        payload.author_github = input.authorGithub.trim();
     }
     if (input.feedbackId !== undefined) {
-        payload.feedback_id = input.feedbackId;
+        payload.feedback_id = input.feedbackId.trim();
     }
     if (input.projectType !== undefined) {
-        payload.project_type = input.projectType;
+        payload.project_type = input.projectType.trim();
     }
     if (input.companySize !== undefined) {
-        payload.company_size = input.companySize;
+        payload.company_size = input.companySize.trim();
     }
     const response = await fetch(TESTIMONIALS_URL(config.projectUrl), {
         method: 'POST',

package/dist/tools/update-status/dod-gates.d.ts

@@ -87,7 +87,7 @@ export declare function checkSpecReviewGate(specId: string, projectId: string, _
  * When force=true, gates are not blocking but failing items are recorded in
  * the project's force-bypass-log.json for traceability (guard: done ≠ implemented).
  */
-export declare function checkDoneGates(spec: Spec, specId: string, projectId: string, projectPath: string | undefined, force: boolean | undefined): Promise<DoneGateResult>;
+export declare function checkDoneGates(spec: Spec, specId: string, projectId: string, projectPath: string | undefined, force: boolean | undefined, forceReason?: string): Promise<DoneGateResult>;
 export interface ComplianceGateResult {
     skipped: boolean;
     score: number | null;

package/dist/tools/update-status/dod-gates.js

@@ -240,7 +240,7 @@ function forceDoneBypassLogPath(projectId) {
  * Writes an audit record when force=true bypasses DoD gates on 'done' transition.
  * Never throws — audit failures must not block transitions.
  */
-async function recordForceDoneBypass(specId, projectId, failingItems, warningItems) {
+async function recordForceDoneBypass(specId, projectId, reason, failingItems, warningItems) {
     try {
         const logPath = forceDoneBypassLogPath(projectId);
         const entries = await readJson(logPath, []);
@@ -250,6 +250,7 @@ async function recordForceDoneBypass(specId, projectId, failingItems, warningIte
             action: 'force_done_bypass',
             specId,
             projectId,
+            reason,
             failingItems,
             warningItems,
         });
@@ -448,7 +449,7 @@ function specReviewGateError(args) {
  * When force=true, gates are not blocking but failing items are recorded in
  * the project's force-bypass-log.json for traceability (guard: done ≠ implemented).
  */
-export async function checkDoneGates(spec, specId, projectId, projectPath, force) {
+export async function checkDoneGates(spec, specId, projectId, projectPath, force, forceReason = 'No force reason provided') {
     if (!force) {
         const dodError = await checkDodGate(spec, specId, projectId, projectPath, false);
         if (dodError) {
@@ -472,7 +473,7 @@ export async function checkDoneGates(spec, specId, projectId, projectPath, force
             .map((i) => i.description);
         if (failingItems.length > 0) {
             // Record bypass in audit log (fire-and-forget)
-            void recordForceDoneBypass(specId, projectId, failingItems, warningItems);
+            void recordForceDoneBypass(specId, projectId, forceReason, failingItems, warningItems);
             forcedBypassWarning =
                 `⚠️ force bypass: ${String(failingItems.length)} DoD item(s) were failing ` +
                     `(${failingItems.slice(0, 2).join('; ')}${failingItems.length > 2 ? '…' : ''}). ` +

package/dist/tools/update-status/index.js

@@ -481,7 +481,7 @@ export async function handleUpdateStatus(params, server) {
                         : Promise.resolve(null),
                     // Done gates: only relevant for 'done'
                     newStatus === 'done'
-                        ? checkDoneGates(spec, specId, projectId, effectiveGatePath, params.force)
+                        ? checkDoneGates(spec, specId, projectId, effectiveGatePath, params.force, params.forceStatusReason ?? params.reason ?? 'No force reason provided')
                         : Promise.resolve(null),
                 ]);
                 // Process code reality result

package/dist/tools/validate-lint.js

@@ -55,7 +55,7 @@ export function runLintCheck(projectPath, lintCommand) {
             const output = `Lint command timed out after ${String(seconds)}s and was skipped so validate can complete within MCP request limits. ` +
                 `Run \`${plan.executedCommand}\` manually before marking the spec done.`;
             console.warn(`[Planu] lintCheck timed out: command="${plan.executedCommand}" cwd="${projectPath}" timeoutMs=${String(LINT_CHECK_TIMEOUT_MS)}`);
-            return { passed: true, command, issueCount: 0, output };
+            return { passed: false, command, issueCount: 1, output };
         }
         const raw = commandOutput(err);
         const output = formatLintFailureDiagnostics(plan, raw);

package/dist/tools/validate.js

@@ -76,30 +76,7 @@ export async function handleValidate(args, server) {
     const implementationQualityScore = calcQualityScore(result.qualityIssues);
     const auditedFiles = [...new Set(result.qualityIssues.map((i) => i.file))];
     // 6. SPEC-190: Convention compliance check
-    let conventionViolations = [];
-    let regressionDetected = false;
-    try {
-        const rules = parseConventions(projectPath);
-        if (rules.length > 0) {
-            conventionViolations = scanConventions(projectPath, rules);
-            // Check regression against baseline
-            const comparison = await compareWithBaseline(projectId, {
-                rules,
-                violations: conventionViolations,
-                summary: {
-                    totalRules: rules.length,
-                    totalViolations: conventionViolations.length,
-                    bySeverity: {},
-                    byCategory: {},
-                },
-                scannedAt: new Date().toISOString(),
-            });
-            regressionDetected = comparison.regressionDetected;
-        }
-    }
-    catch {
-        /* best-effort — don't fail validation */
-    }
+    const { conventionViolations, regressionDetected } = await scanProjectConventions(projectId, projectPath);
     // 7. Lint check (best-effort — non-blocking)
     const lintCheck = runLintCheck(projectPath, knowledge.lintCommand ?? null);
     const assuranceGates = runAssuranceGates(projectPath);
@@ -123,6 +100,14 @@ export async function handleValidate(args, server) {
         conventionRegression: regressionDetected,
         minimalityReport: minimalityReport ?? undefined,
     });
+    const qualityGateSummary = buildQualityGateSummary({
+        conventionViolations,
+        regressionDetected,
+        lintPassed: lintCheck.passed,
+        assurancePassed: assuranceGates.newCode.passed,
+        minimalityBlocked: minimalityReport?.blocked === true,
+        score: result.score,
+    });
     // 8. Build output
     const output = {
         specId,
@@ -198,6 +183,7 @@ export async function handleValidate(args, server) {
         },
         lintCheck,
         assuranceGates,
+        qualityGateSummary,
         validationReport,
         minimalityReport,
         graphCoverage,
@@ -304,11 +290,13 @@ export async function handleValidate(args, server) {
     const passedCount = result.fieldsImplemented;
     const failedCount = totalCriteria - passedCount;
     const indeterminate = result.indeterminate ?? [];
+    const effectiveScore = qualityGateSummary.effectiveScore ?? scoreValue;
     const compactText = buildCompactValidateText({
-        score: scoreValue,
+        score: effectiveScore,
         passedCount,
         failedCount,
         totalCriteria,
+        qualityFailures: qualityGateSummary.failures,
         missing: result.missing,
         indeterminate,
         commitReminder,
@@ -316,7 +304,7 @@ export async function handleValidate(args, server) {
     });
     const graphText = formatGraphCoverageText(graphCoverage);
     // SPEC-512: Compact structuredContent — essential fields only at top level
-    const compactSummary = buildCompactSummary(specId, result.score, passedCount, failedCount, totalCriteria);
+    const compactSummary = buildCompactSummary(specId, result.score === null ? null : effectiveScore, passedCount, failedCount + (qualityGateSummary.passed ? 0 : 1), totalCriteria);
     const structuredBase = { ...outputWithSuggestions, summary: compactSummary, indeterminate };
     // SPEC-595: Elicit next action when validation fails and a server is available
     if (server !== undefined && failedCount > 0) {
@@ -358,6 +346,50 @@ export async function handleValidate(args, server) {
         structuredContent: structuredBase,
     };
 }
+async function scanProjectConventions(projectId, projectPath) {
+    try {
+        const rules = parseConventions(projectPath);
+        if (rules.length === 0) {
+            return { conventionViolations: [], regressionDetected: false };
+        }
+        const conventionViolations = scanConventions(projectPath, rules);
+        const comparison = await compareWithBaseline(projectId, {
+            rules,
+            violations: conventionViolations,
+            summary: {
+                totalRules: rules.length,
+                totalViolations: conventionViolations.length,
+                bySeverity: {},
+                byCategory: {},
+            },
+            scannedAt: new Date().toISOString(),
+        });
+        return { conventionViolations, regressionDetected: comparison.regressionDetected };
+    }
+    catch {
+        return { conventionViolations: [], regressionDetected: false };
+    }
+}
+function buildQualityGateSummary(input) {
+    const blockingConventionViolations = input.conventionViolations.filter((violation) => violation.severity === 'critical');
+    const failures = [
+        ...(input.regressionDetected ? ['convention-regression'] : []),
+        ...(blockingConventionViolations.length > 0 ? ['blocking-convention-violations'] : []),
+        ...(!input.lintPassed ? ['lint'] : []),
+        ...(!input.assurancePassed ? ['assurance'] : []),
+        ...(input.minimalityBlocked ? ['minimality'] : []),
+    ];
+    return {
+        passed: failures.length === 0,
+        effectiveScore: failures.length === 0 ? input.score : Math.min(input.score ?? 0, 99),
+        failures,
+        conventionRegression: input.regressionDetected,
+        blockingConventionViolations: blockingConventionViolations.length,
+        lintPassed: input.lintPassed,
+        assurancePassed: input.assurancePassed,
+        minimalityPassed: !input.minimalityBlocked,
+    };
+}
 function buildCompactSummary(specId, score, passedCount, failedCount, totalCriteria) {
     return {
         specId,
@@ -369,13 +401,18 @@ function buildCompactSummary(specId, score, passedCount, failedCount, totalCrite
     };
 }
 function buildCompactValidateText(args) {
-    const { score, passedCount, failedCount, totalCriteria, missing, indeterminate, commitReminder, planuReminder, } = args;
-    if (failedCount === 0) {
+    const { score, passedCount, failedCount, totalCriteria, qualityFailures, missing, indeterminate, commitReminder, planuReminder, } = args;
+    if (failedCount === 0 && qualityFailures.length === 0) {
         // All passing — single line
         return (`✅ Validate: ${String(score)}/100 — ${String(passedCount)}/${String(totalCriteria)} criteria passing` +
             commitReminder +
             planuReminder);
     }
+    if (failedCount === 0) {
+        return (`❌ Validate: ${String(score)}/100 — failing; ${String(passedCount)}/${String(totalCriteria)} criteria passing; failing gates: ${qualityFailures.join(', ')}` +
+            commitReminder +
+            planuReminder);
+    }
     // Failures exist — list only the failing ones (max 5)
     const MAX_FAILURES = 5;
     const labelledFailures = [
@@ -392,7 +429,8 @@ function buildCompactValidateText(args) {
         .slice(0, 3)
         .map((failure) => `${failure.label}: ${failure.criterion}`)
         .join(', ');
-    const summaryLine = `❌ Validate: ${String(score)}/100 — ${String(failedCount)} failing: [${failNames}${remainingCount + shownFailures.length > 3 ? '...' : ''}]`;
+    const gateSuffix = qualityFailures.length > 0 ? `; failing gates: ${qualityFailures.join(', ')}` : '';
+    const summaryLine = `❌ Validate: ${String(score)}/100 — failing; ${String(failedCount)} failing criteria: [${failNames}${remainingCount + shownFailures.length > 3 ? '...' : ''}]${gateSuffix}`;
     return summaryLine + '\n' + failureList + moreLine + commitReminder + planuReminder;
 }
 function scoreToGrade(score) {

package/dist/types/schema.d.ts

@@ -43,6 +43,7 @@ export interface RLSPolicy {
     name: string;
     table: string;
     operation: 'SELECT' | 'INSERT' | 'UPDATE' | 'DELETE' | 'ALL';
+    roles?: string[];
     using: string;
     withCheck?: string;
     justification: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@planu/cli",
-  "version": "4.10.3",
+  "version": "4.10.5",
   "description": "Planu — MCP Server for Spec Driven Development with native Rust acceleration for hot paths. Cross-platform (Linux/macOS/Windows, x64/arm64, glibc/musl).",
   "type": "module",
   "main": "dist/index.js",
@@ -34,19 +34,19 @@
     "packageName": "@planu/core"
   },
   "optionalDependencies": {
-    "@planu/core-darwin-arm64": "4.10.3",
-    "@planu/core-darwin-x64": "4.10.3",
-    "@planu/core-linux-arm64-gnu": "4.10.3",
-    "@planu/core-linux-arm64-musl": "4.10.3",
-    "@planu/core-linux-x64-gnu": "4.10.3",
-    "@planu/core-linux-x64-musl": "4.10.3",
-    "@planu/core-win32-arm64-msvc": "4.10.3",
-    "@planu/core-win32-x64-msvc": "4.10.3"
+    "@planu/core-darwin-arm64": "4.10.5",
+    "@planu/core-darwin-x64": "4.10.5",
+    "@planu/core-linux-arm64-gnu": "4.10.5",
+    "@planu/core-linux-arm64-musl": "4.10.5",
+    "@planu/core-linux-x64-gnu": "4.10.5",
+    "@planu/core-linux-x64-musl": "4.10.5",
+    "@planu/core-win32-arm64-msvc": "4.10.5",
+    "@planu/core-win32-x64-msvc": "4.10.5"
   },
   "engines": {
     "node": ">=24.0.0"
   },
-  "packageManager": "pnpm@10.28.2",
+  "packageManager": "pnpm@11.9.0+sha512.bd682d5d03fe525ef7c9fd6780c6884d1e756ac4c9c9fe00c538782824310dcf90e3ddc4f53835f06dfaebd5085e41855e0bcbb3b60de2ac5bbab89e5036f03b",
   "scripts": {
     "build:rust": "bash scripts/build-rust-local.sh --host",
     "build:rust:all": "bash scripts/build-rust-local.sh --all",
@@ -135,38 +135,6 @@
     "yaml": "^2.9.0",
     "zod": "^4.4.3"
   },
-  "pnpm": {
-    "overrides": {
-      "flatted": ">=3.4.2",
-      "path-to-regexp": ">=8.4.0",
-      "brace-expansion": ">=5.0.5",
-      "handlebars": ">=4.7.9",
-      "picomatch": ">=4.0.4",
-      "yaml": ">=2.8.3",
-      "lodash": ">=4.18.0",
-      "lodash-es": ">=4.18.0",
-      "hono": ">=4.12.14",
-      "postcss": ">=8.5.10",
-      "esbuild": "0.28.1",
-      "fast-uri": ">=3.1.2",
-      "qs": ">=6.15.2"
-    },
-    "supportedArchitectures": {
-      "os": [
-        "darwin",
-        "linux",
-        "win32"
-      ],
-      "cpu": [
-        "arm64",
-        "x64"
-      ],
-      "libc": [
-        "glibc",
-        "musl"
-      ]
-    }
-  },
   "devDependencies": {
     "@commitlint/cli": "^21.2.0",
     "@commitlint/config-conventional": "^21.2.0",
@@ -174,18 +142,12 @@
     "@napi-rs/cli": "^3.7.2",
     "@secretlint/secretlint-rule-no-homedir": "^13.0.2",
     "@secretlint/secretlint-rule-preset-recommend": "^13.0.2",
-    "@semantic-release/changelog": "^6.0.3",
-    "@semantic-release/commit-analyzer": "^13.0.1",
-    "@semantic-release/git": "^10.0.1",
-    "@semantic-release/github": "^12.0.9",
-    "@semantic-release/npm": "^13.1.5",
-    "@semantic-release/release-notes-generator": "^14.1.1",
     "@stryker-mutator/core": "^9.6.1",
     "@stryker-mutator/vitest-runner": "^9.6.1",
     "@supabase/supabase-js": "^2.110.0",
     "@types/node": "^26.1.0",
     "@vitejs/plugin-vue": "^6.0.7",
-    "@vitest/coverage-v8": "^4.1.9",
+    "@vitest/coverage-v8": "^4.1.10",
     "@vue/test-utils": "^2.4.11",
     "eslint": "^10.6.0",
     "eslint-config-prettier": "^10.1.8",
@@ -199,13 +161,12 @@
     "madge": "^8.0.0",
     "prettier": "^3.9.4",
     "secretlint": "^13.0.2",
-    "semantic-release": "^25.0.5",
-    "tsc-alias": "^1.8.17",
+    "tsc-alias": "^1.9.0",
     "type-coverage": "^2.29.7",
     "typescript": "^6.0.3",
     "typescript-eslint": "^8.62.1",
     "vite": "^8.1.3",
-    "vitest": "^4.1.9",
+    "vitest": "^4.1.10",
     "vue": "^3.5.39"
   }
 }

package/planu-native.json

@@ -1,7 +1,7 @@
 {
   "name": "dev.planu.native",
   "displayName": "Planu Native Lightweight Surface",
-  "version": "4.10.3",
+  "version": "4.10.5",
   "packageName": "@planu/cli",
   "modes": {
     "lightweight": {

package/planu-plugin.json

@@ -2,7 +2,7 @@
   "name": "dev.planu.cli",
   "displayName": "Planu — Spec Driven Development",
   "description": "Manage software specs, estimations, and autonomous SDD workflows. Language-agnostic MCP server for Claude Code.",
-  "version": "4.10.3",
+  "version": "4.10.5",
   "icon": "assets/plugin/icon.svg",
   "command": [
     "npx",

package/dist/engine/context-artifacts/index.d.ts

@@ -1,2 +0,0 @@
-export { getContextArtifactStats, retrieveContextArtifact, storeContextArtifact } from './store.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/engine/context-artifacts/index.js

@@ -1,2 +0,0 @@
-export { getContextArtifactStats, retrieveContextArtifact, storeContextArtifact } from './store.js';
-//# sourceMappingURL=index.js.map