@planu/cli 4.12.3 → 4.14.1

package/dist/engine/registry/matcher.js

@@ -1,22 +1,92 @@
-// SPEC-597-EXEMPT: canonical mapping (npm-package↔framework, keyword catalogue)
-// — must enumerate framework names by design; no detection logic to migrate.
-// engine/registry/matcher.ts — Detects framework mentions and API references in spec text
-// Uses registry-aware keywords to avoid false positives on plain English words.
+import { technologyValue } from '../technology-registry.js';
 /** Mapping of framework ID → detection keywords (aliases / common spellings). */
 const FRAMEWORK_ALIASES = {
-    nextjs: ['next.js', 'nextjs', 'next js', 'next/navigation', 'next/router', 'app router'],
-    react: ['react', 'react dom', 'reactdom', 'jsx', 'useState', 'useEffect', 'useCallback'],
-    vue: ['vue', 'vue 3', 'vue.js', 'vuejs', 'composition api', 'script setup'],
-    nuxt: ['nuxt', 'nuxt 3', 'nuxt.js', 'usefetch', 'definepageeta'],
-    angular: ['angular', 'angular 17', '@angular', 'standalone component', 'angularjs'],
-    sveltekit: ['sveltekit', 'svelte kit', 'svelte', '+page.server.ts', 'use:enhance'],
-    astro: ['astro', 'astro.js', 'astro 4', 'client:load', 'getcollection'],
-    remix: ['remix', 'remix 2', '@remix-run', 'useloaderdata', 'useactiondata'],
-    express: ['express', 'express.js', 'expressjs', 'express.router', 'app.get(', 'app.use('],
-    nestjs: ['nestjs', 'nest.js', '@nestjs', '@injectable', '@controller', '@module'],
-    django: ['django', 'django 5', 'django orm', 'models.model', 'views.py', 'urls.py'],
+    nextjs: [
+        technologyValue('technology-next-js-0d857f'),
+        technologyValue('technology-nextjs-c93379'),
+        'next js',
+        'next/navigation',
+        'next/router',
+        'app router',
+    ],
+    react: [
+        technologyValue('technology-react-275976'),
+        'react dom',
+        'reactdom',
+        'jsx',
+        'useState',
+        'useEffect',
+        'useCallback',
+    ],
+    vue: [
+        technologyValue('technology-vue-564382'),
+        'vue 3',
+        'vue.js',
+        'vuejs',
+        'composition api',
+        'script setup',
+    ],
+    nuxt: [
+        technologyValue('technology-nuxt-22c407'),
+        'nuxt 3',
+        'nuxt.js',
+        'usefetch',
+        'definepageeta',
+    ],
+    angular: [
+        technologyValue('technology-angular-a39f89'),
+        'angular 17',
+        '@angular',
+        'standalone component',
+        'angularjs',
+    ],
+    sveltekit: [
+        technologyValue('technology-sveltekit-eefb03'),
+        'svelte kit',
+        technologyValue('technology-svelte-c190ac'),
+        '+page.server.ts',
+        'use:enhance',
+    ],
+    astro: [
+        technologyValue('technology-astro-23661e'),
+        'astro.js',
+        'astro 4',
+        'client:load',
+        'getcollection',
+    ],
+    remix: [
+        technologyValue('technology-remix-0c5d96'),
+        'remix 2',
+        '@remix-run',
+        'useloaderdata',
+        'useactiondata',
+    ],
+    express: [
+        technologyValue('technology-express-008231'),
+        'express.js',
+        'expressjs',
+        'express.router',
+        'app.get(',
+        'app.use(',
+    ],
+    nestjs: [
+        technologyValue('technology-nestjs-2d0087'),
+        'nest.js',
+        '@nestjs',
+        '@injectable',
+        '@controller',
+        '@module',
+    ],
+    django: [
+        technologyValue('technology-django-7d8a08'),
+        'django 5',
+        'django orm',
+        'models.model',
+        'views.py',
+        'urls.py',
+    ],
     fastapi: [
-        'fastapi',
+        technologyValue('technology-fastapi-6aee0e'),
         'fast api',
         'fastapi route',
         '@app.get',
@@ -25,26 +95,61 @@ const FRAMEWORK_ALIASES = {
         'basemodel',
     ],
     springboot: [
-        'spring boot',
-        'springboot',
+        technologyValue('technology-spring-boot-9c3c05'),
+        technologyValue('technology-springboot-7e901d'),
         '@springbootapplication',
         '@restcontroller',
         'jparepository',
     ],
-    rails: ['rails', 'ruby on rails', 'activerecord', 'activesupport', 'hotwire', 'turbo'],
-    laravel: ['laravel', 'laravel 11', 'eloquent', 'artisan', 'blade template'],
+    rails: [
+        technologyValue('technology-rails-2e1d59'),
+        'ruby on rails',
+        technologyValue('technology-activerecord-97a448'),
+        'activesupport',
+        'hotwire',
+        'turbo',
+    ],
+    laravel: [
+        technologyValue('technology-laravel-c34cfa'),
+        'laravel 11',
+        technologyValue('technology-eloquent-b89f45'),
+        'artisan',
+        'blade template',
+    ],
     gin: ['gin framework', 'gin.new()', 'gin.default()', 'c.json(', 'gin.h{', 'c.shouldbindjson'],
-    actix: ['actix-web', 'actix web', 'actix 4', 'web::data', 'httpresponse', 'web::path'],
-    aspnet: ['asp.net', 'aspnet', '.net core', 'dotnet', '@controller', 'iactionresult', 'blazor'],
+    actix: [
+        technologyValue('technology-actix-web-ab3e35'),
+        'actix web',
+        'actix 4',
+        'web::data',
+        'httpresponse',
+        'web::path',
+    ],
+    aspnet: [
+        'asp.net',
+        technologyValue('technology-aspnet-cc66fa'),
+        '.net core',
+        'dotnet',
+        '@controller',
+        'iactionresult',
+        'blazor',
+    ],
     flutter: [
-        'flutter',
+        technologyValue('technology-flutter-be1396'),
         'dart flutter',
         'statefulwidget',
         'statelesswidget',
         'buildcontext',
         'scaffold(',
     ],
-    swiftui: ['swiftui', 'swift ui', '@state', '@observedobject', '@stateobject', 'navigationstack'],
+    swiftui: [
+        technologyValue('technology-swiftui-b63400'),
+        'swift ui',
+        '@state',
+        '@observedobject',
+        '@stateobject',
+        'navigationstack',
+    ],
 };
 /** Regex patterns to detect API/pattern references in text. */
 const API_PATTERNS = [

package/dist/engine/resilience-detector/concurrency-detector.js

@@ -1,6 +1,4 @@
-// SPEC-597-EXEMPT: canonical mapping (npm-package↔framework, keyword catalogue)
-// — must enumerate framework names by design; no detection logic to migrate.
-// engine/resilience-detector/concurrency-detector.ts — Concurrency model & resilience detection (SPEC-034)
+import { technologyValue } from '../technology-registry.js';
 /**
  * Detects concurrency model based on language and runtime.
  */
@@ -28,7 +26,9 @@ export function detectConcurrencyModel(language, deps) {
         }
         return 'threads-locks';
     }
-    if (langLower === 'typescript' || langLower === 'javascript' || langLower === 'nodejs') {
+    if (langLower === technologyValue('technology-typescript-969545') ||
+        langLower === 'javascript' ||
+        langLower === 'nodejs') {
         if (depsLower.some((d) => d.includes('rxjs'))) {
             return 'reactive-streams';
         }

package/dist/engine/resilience-detector/middleware-detector.js

@@ -1,16 +1,14 @@
-// SPEC-597-EXEMPT: canonical mapping (npm-package↔framework, keyword catalogue)
-// — must enumerate framework names by design; no detection logic to migrate.
-// engine/resilience-detector/middleware-detector.ts — Middleware framework detection (SPEC-034)
+import { technologyValue } from '../technology-registry.js';
 const FRAMEWORK_SIGNALS = [
     {
-        name: 'express',
-        pattern: 'express',
+        name: technologyValue('technology-express-008231'),
+        pattern: technologyValue('technology-express-008231'),
         language: 'nodejs',
         chain: ['cors', 'body-parser', 'auth', 'rate-limit', 'validation', 'handler'],
     },
     {
-        name: 'fastify',
-        pattern: 'fastify',
+        name: technologyValue('technology-fastify-cbe57e'),
+        pattern: technologyValue('technology-fastify-cbe57e'),
         language: 'nodejs',
         chain: ['onRequest', 'preValidation', 'preHandler', 'handler', 'onSend'],
     },
@@ -21,7 +19,7 @@ const FRAMEWORK_SIGNALS = [
         chain: ['auth', 'rate-limit', 'handler'],
     },
     {
-        name: 'nestjs',
+        name: technologyValue('technology-nestjs-2d0087'),
         pattern: '@nestjs/core',
         language: 'nodejs',
         chain: ['Guards', 'Interceptors', 'Pipes', 'handler', 'Filters'],
@@ -33,14 +31,14 @@ const FRAMEWORK_SIGNALS = [
         chain: ['error-handler', 'auth', 'logger', 'handler'],
     },
     {
-        name: 'django',
-        pattern: 'django',
+        name: technologyValue('technology-django-7d8a08'),
+        pattern: technologyValue('technology-django-7d8a08'),
         language: 'python',
         chain: ['SecurityMiddleware', 'SessionMiddleware', 'AuthenticationMiddleware', 'handler'],
     },
     {
-        name: 'fastapi',
-        pattern: 'fastapi',
+        name: technologyValue('technology-fastapi-6aee0e'),
+        pattern: technologyValue('technology-fastapi-6aee0e'),
         language: 'python',
         chain: ['CORSMiddleware', 'auth-dependency', 'validation', 'handler'],
     },
@@ -57,7 +55,7 @@ const FRAMEWORK_SIGNALS = [
         chain: ['ExceptionHandler', 'HTTPS', 'Auth', 'RateLimiting', 'Endpoint'],
     },
     {
-        name: 'gin',
+        name: technologyValue('technology-gin-985adc'),
         pattern: 'gin-gonic/gin',
         language: 'go',
         chain: ['recovery', 'logger', 'auth', 'handler'],

package/dist/engine/resilience-detector/validation-detector.js

@@ -1,3 +1,4 @@
+import { technologyValue } from '../technology-registry.js';
 // engine/resilience-detector/validation-detector.ts — Validation library detection (SPEC-034)
 /**
  * Detects validation library in use for the given language and dependency set.
@@ -5,9 +6,21 @@
 export function detectValidationLibrary(deps, language) {
     const depsLower = deps.map((d) => d.toLowerCase());
     const patterns = {
-        typescript: ['zod', 'joi', 'yup', 'valibot', 'ajv', 'class-validator'],
-        javascript: ['zod', 'joi', 'yup', 'valibot', 'ajv'],
-        python: ['pydantic', 'marshmallow', 'cerberus', 'voluptuous'],
+        typescript: [
+            technologyValue('technology-zod-4f63cf'),
+            'joi',
+            'yup',
+            'valibot',
+            'ajv',
+            'class-validator',
+        ],
+        javascript: [technologyValue('technology-zod-4f63cf'), 'joi', 'yup', 'valibot', 'ajv'],
+        python: [
+            technologyValue('technology-pydantic-636623'),
+            'marshmallow',
+            'cerberus',
+            'voluptuous',
+        ],
         java: ['jakarta.validation', 'javax.validation', 'hibernate-validator', 'spring-validation'],
         go: ['go-playground/validator', 'go-ozzo/ozzo-validation', 'asaskevich/govalidator'],
         dotnet: ['FluentValidation', 'MiniValidation'],
@@ -20,7 +33,7 @@ export function detectValidationLibrary(deps, language) {
         const found = depsLower.some((d) => d.includes(patternLower));
         if (found) {
             const isPydanticMigration = language === 'python' &&
-                pattern === 'pydantic' &&
+                pattern === technologyValue('technology-pydantic-636623') &&
                 depsLower.some((d) => d.includes('pydantic.v1') || d.includes('pydantic-v1'));
             return { library: pattern, version: null, isPydanticMigration };
         }

package/dist/engine/reverse-engineer/config-analyzer.js

@@ -1,3 +1,4 @@
+import { technologyValue } from '../technology-registry.js';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 const ENV_VAR_PATTERNS = [
@@ -27,22 +28,22 @@ const FEATURE_FLAG_PATTERNS = [
     /flagsmith\.hasFeature\s*\(\s*['"]([^'"]+)['"]/g,
 ];
 const INFRA_INDICATORS = {
-    Dockerfile: 'Docker',
+    Dockerfile: technologyValue('technology-docker-e6169e'),
     'docker-compose.yml': 'Docker Compose',
     'docker-compose.yaml': 'Docker Compose',
-    kubernetes: 'Kubernetes',
-    k8s: 'Kubernetes',
+    kubernetes: technologyValue('technology-kubernetes-a37d07'),
+    k8s: technologyValue('technology-kubernetes-a37d07'),
     helm: 'Helm',
-    terraform: 'Terraform',
-    '.terraform': 'Terraform',
+    terraform: technologyValue('technology-terraform-05b073'),
+    '.terraform': technologyValue('technology-terraform-05b073'),
     pulumi: 'Pulumi',
     'serverless.yml': 'Serverless Framework',
     'serverless.yaml': 'Serverless Framework',
-    'vercel.json': 'Vercel',
-    'netlify.toml': 'Netlify',
+    'vercel.json': technologyValue('technology-vercel-68edc7'),
+    'netlify.toml': technologyValue('technology-netlify-55c13c'),
     'fly.toml': 'Fly.io',
     'render.yaml': 'Render',
-    'railway.json': 'Railway',
+    'railway.json': technologyValue('technology-railway-3e12c4'),
     Procfile: 'Heroku',
     'app.yaml': 'Google App Engine',
     '.github/workflows': 'GitHub Actions',

package/dist/engine/reverse-engineer/orchestrator.js

@@ -1,8 +1,4 @@
-// SPEC-597-EXEMPT: canonical mapping (npm-package↔framework, keyword catalogue)
-// — must enumerate framework names by design; no detection logic to migrate.
-// engine/reverse-engineer/orchestrator.ts — AC-7: Parallel analyzer orchestration
-// AC-9: Spec enrichment from analysis results
-// AC-10: Human-readable output summary
+import { technologyValue } from '../technology-registry.js';
 import { analyzeTestCoverage } from './test-analyzer.js';
 import { buildDependencyGraph } from './dependency-graph.js';
 import { detectApiRoutes } from './api-detector.js';
@@ -48,11 +44,11 @@ function detectTags(result) {
     const tagMap = {
         jest: 'vitest/jest',
         vitest: 'vitest/jest',
-        'next.config': 'nextjs',
+        'next.config': technologyValue('technology-nextjs-c93379'),
         'vite.config': 'vite',
-        tsconfig: 'typescript',
-        docker: 'docker',
-        Docker: 'docker',
+        tsconfig: technologyValue('technology-typescript-969545'),
+        docker: technologyValue('technology-docker-d548c5'),
+        Docker: technologyValue('technology-docker-d548c5'),
     };
     for (const cfg of result.configAnalysis.configFiles) {
         for (const [key, tag] of Object.entries(tagMap)) {

package/dist/engine/reverse-engineer/test-file-parser.js

@@ -1,3 +1,4 @@
+import { technologyValue } from '../technology-registry.js';
 // engine/reverse-engineer/test-file-parser.ts — Parse test files into spec ACs (SPEC-299)
 import { readFile } from 'node:fs/promises';
 import * as nodePath from 'node:path';
@@ -5,11 +6,13 @@ import * as nodePath from 'node:path';
  * Detect the test framework from file content.
  */
 export function detectFramework(content) {
-    const hasPlaywriterImport = content.toLowerCase().includes('playwright');
+    const hasPlaywriterImport = content
+        .toLowerCase()
+        .includes(technologyValue('technology-playwright-7827e8'));
     const hasTestDescribe = content.includes('test.describe');
     const hasPlaywright = hasPlaywriterImport || hasTestDescribe;
     if (hasPlaywright) {
-        return 'playwright';
+        return technologyValue('technology-playwright-7827e8');
     }
     const hasCyDot = content.includes('cy.');
     const hasCypress = hasCyDot;
@@ -21,7 +24,7 @@ export function detectFramework(content) {
     // hasCyDot and hasPlaywriterImport are already false here (early returns above)
     const hasJest = hasDescribe && hasItOrTest;
     if (hasJest) {
-        return 'jest';
+        return technologyValue('technology-jest-35e99f');
     }
     return 'unknown';
 }

package/dist/engine/rules-generator/index.js

@@ -1,3 +1,4 @@
+import { technologyValue } from '../technology-registry.js';
 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
 import { join } from 'node:path';
 import { detectAiTools, getPrimaryAiTool } from '../ai-tool-detector/index.js';
@@ -120,15 +121,15 @@ export function detectArchitectureStack(projectPath) {
     if (existsSync(join(projectPath, 'next.config.js')) ||
         existsSync(join(projectPath, 'next.config.ts')) ||
         existsSync(join(projectPath, 'next.config.mjs'))) {
-        return 'nextjs';
+        return technologyValue('technology-nextjs-c93379');
     }
     // FastAPI detection
     const requirementsTxt = join(projectPath, 'requirements.txt');
     if (existsSync(requirementsTxt)) {
         try {
             const content = readFileSync(requirementsTxt, 'utf-8');
-            if (content.toLowerCase().includes('fastapi')) {
-                return 'fastapi';
+            if (content.toLowerCase().includes(technologyValue('technology-fastapi-6aee0e'))) {
+                return technologyValue('technology-fastapi-6aee0e');
             }
         }
         catch {
@@ -150,8 +151,8 @@ export function detectArchitectureStack(projectPath) {
                         ? pkg.devDependencies
                         : {}),
                 };
-                if ('express' in deps) {
-                    return 'express';
+                if (technologyValue('technology-express-008231') in deps) {
+                    return technologyValue('technology-express-008231');
                 }
             }
         }

package/dist/engine/runtime-policy.d.ts

@@ -0,0 +1,7 @@
+import type { BoundedDurationPolicy, RuntimePolicy } from '../types/runtime-policy.js';
+/** Load the validated bundled runtime authority once per process. */
+export declare function getRuntimePolicy(): RuntimePolicy;
+/** Resolve a numeric environment override without duplicating policy bounds. */
+export declare function boundedEnvironmentDuration(variableName: string, policy: BoundedDurationPolicy): number;
+export declare function resetRuntimePolicyCacheForTests(): void;
+//# sourceMappingURL=runtime-policy.d.ts.map

package/dist/engine/runtime-policy.js

@@ -0,0 +1,101 @@
+import { z } from 'zod';
+import { createRequire } from 'node:module';
+const boundedDurationSchema = z
+    .object({
+    defaultTimeoutMs: z.number().int().positive(),
+    minimumTimeoutMs: z.number().int().positive(),
+    maximumTimeoutMs: z.number().int().positive(),
+})
+    .strict()
+    .refine((value) => value.minimumTimeoutMs <= value.defaultTimeoutMs, {
+    message: 'minimumTimeoutMs must not exceed defaultTimeoutMs',
+})
+    .refine((value) => value.defaultTimeoutMs <= value.maximumTimeoutMs, {
+    message: 'defaultTimeoutMs must not exceed maximumTimeoutMs',
+});
+const runtimePolicySchema = z
+    .object({
+    acknowledgementBudgetMs: z.number().int().positive(),
+    toolExecution: boundedDurationSchema
+        .extend({
+        safetyMarginRatio: z.number().positive().max(1),
+        safetyMarginMaximumMs: z.number().int().positive(),
+    })
+        .strict(),
+    qualityAssurance: boundedDurationSchema
+        .extend({ maximumOutputBufferBytes: z.number().int().positive() })
+        .strict(),
+    lintValidation: boundedDurationSchema,
+    createSpec: z
+        .object({
+        criticalTimeoutMs: z.number().int().positive(),
+        inlineAnalysisBudgetMs: z.number().int().positive(),
+        idempotencyClaimStaleMs: z.number().int().positive(),
+        idempotencyClaimWaitMs: z.number().int().positive(),
+        idempotencyClaimPollMs: z.number().int().positive(),
+        idempotencyMatchWindowMs: z.number().int().positive(),
+    })
+        .strict()
+        .refine((value) => value.inlineAnalysisBudgetMs < value.criticalTimeoutMs, {
+        message: 'inlineAnalysisBudgetMs must be below criticalTimeoutMs',
+    })
+        .refine((value) => value.idempotencyClaimPollMs < value.idempotencyClaimWaitMs, {
+        message: 'idempotencyClaimPollMs must be below idempotencyClaimWaitMs',
+    }),
+    validation: z
+        .object({
+        defaultDeadlineMs: z.number().int().positive(),
+        submissionLockWaitMs: z.number().int().positive(),
+        submissionLockPollMs: z.number().int().positive(),
+        workerLeaseMs: z.number().int().positive(),
+        workerHeartbeatMs: z.number().int().positive(),
+        workerConcurrency: z.number().int().positive(),
+    })
+        .strict()
+        .refine((value) => value.submissionLockPollMs < value.submissionLockWaitMs, {
+        message: 'submissionLockPollMs must be below submissionLockWaitMs',
+    })
+        .refine((value) => value.workerHeartbeatMs < value.workerLeaseMs, {
+        message: 'workerHeartbeatMs must be below workerLeaseMs',
+    }),
+    postCommit: z
+        .object({
+        defaultTaskTimeoutMs: z.number().int().positive(),
+        minimumLeaseMs: z.number().int().positive(),
+        leaseMultiplier: z.number().int().positive(),
+        maximumRememberedTransitions: z.number().int().positive(),
+        minimumHeartbeatMs: z.number().int().positive(),
+    })
+        .strict(),
+})
+    .strict();
+const require = createRequire(import.meta.url);
+let cachedPolicy;
+/** Load the validated bundled runtime authority once per process. */
+export function getRuntimePolicy() {
+    if (cachedPolicy === undefined) {
+        const raw = require('../config/runtime-policy.json');
+        const parsed = runtimePolicySchema.safeParse(raw);
+        if (!parsed.success) {
+            throw new Error(`Invalid bundled runtime-policy config: ${parsed.error.message}`);
+        }
+        cachedPolicy = parsed.data;
+    }
+    return cachedPolicy;
+}
+/** Resolve a numeric environment override without duplicating policy bounds. */
+export function boundedEnvironmentDuration(variableName, policy) {
+    const raw = process.env[variableName];
+    if (raw === undefined || raw.trim() === '') {
+        return policy.defaultTimeoutMs;
+    }
+    const parsed = Number.parseInt(raw, 10);
+    if (!Number.isFinite(parsed)) {
+        return policy.defaultTimeoutMs;
+    }
+    return Math.min(policy.maximumTimeoutMs, Math.max(policy.minimumTimeoutMs, parsed));
+}
+export function resetRuntimePolicyCacheForTests() {
+    cachedPolicy = undefined;
+}
+//# sourceMappingURL=runtime-policy.js.map

package/dist/engine/runtime-security/checkers/content-security.js

@@ -1,11 +1,26 @@
-// engine/runtime-security/checkers/content-security.ts — SPEC-084 AC-12
-// Detects insecure code patterns and unsafe configurations in generated content.
+import { technologyValue } from '../../technology-registry.js';
 const INSECURE_CODE_PATTERNS = [
     // TypeScript/JavaScript
-    { name: 'eval', regex: /\beval\s*\(/g, language: 'typescript' },
-    { name: 'innerHTML', regex: /\.innerHTML\s*=/g, language: 'typescript' },
-    { name: 'dangerouslySetInnerHTML', regex: /dangerouslySetInnerHTML/g, language: 'typescript' },
-    { name: 'document.write', regex: /document\.write\s*\(/g, language: 'typescript' },
+    {
+        name: 'eval',
+        regex: /\beval\s*\(/g,
+        language: technologyValue('technology-typescript-969545'),
+    },
+    {
+        name: 'innerHTML',
+        regex: /\.innerHTML\s*=/g,
+        language: technologyValue('technology-typescript-969545'),
+    },
+    {
+        name: 'dangerouslySetInnerHTML',
+        regex: /dangerouslySetInnerHTML/g,
+        language: technologyValue('technology-typescript-969545'),
+    },
+    {
+        name: 'document.write',
+        regex: /document\.write\s*\(/g,
+        language: technologyValue('technology-typescript-969545'),
+    },
     // Python
     { name: 'pickle.loads', regex: /pickle\.loads?\s*\(/g, language: 'python' },
     { name: 'yaml.load-unsafe', regex: /yaml\.load\s*\([^)]*(?!Loader)/g, language: 'python' },

package/dist/engine/runtime-security/checkers/file-permissions.js

@@ -7,8 +7,6 @@ function getDefaultAllowedDirs(projectPath) {
     if (projectPath) {
         dirs.push(path.resolve(projectPath));
     }
-    // data/ directory relative to process.cwd()
-    dirs.push(path.resolve(process.cwd(), 'data'));
     return dirs;
 }
 function isPathAllowed(filePath, allowedDirs) {

package/dist/engine/safety/atomic-write-file.js

@@ -7,6 +7,8 @@ import { dirname } from 'node:path';
 import { randomBytes } from 'node:crypto';
 import { isSpecMdPath, isSpecFrozenByPath } from '../freeze/freeze-checker.js';
 import { hasUnlockToken, consumeUnlock } from '../freeze/unlock-token.js';
+import { assertExecutionCanCommit } from '../execution/context.js';
+import { reportClassifiedDegradation } from '../../errors/classified-degradation.js';
 const IS_POSIX = process.platform !== 'win32';
 // ---------------------------------------------------------------------------
 // SPEC-747: Freeze-on-done error
@@ -95,6 +97,9 @@ export async function atomicWriteFile(targetPath, content, opts) {
         await tmpFd.datasync();
         await tmpFd.close();
         tmpFd = null;
+        // The temporary file is not externally visible. Cross the request commit
+        // fence immediately before the only externally visible mutation.
+        assertExecutionCanCommit();
         await rename(tmpPath, targetPath);
         if (fsyncParent) {
             await fsyncDirectory(dirname(targetPath));
@@ -106,16 +111,18 @@ export async function atomicWriteFile(targetPath, content, opts) {
             try {
                 await tmpFd.close();
             }
-            catch {
-                // ignore close error
+            catch (closeError) {
+                // reliability-cleanup: ATOMIC_TEMP_CLOSE — original write failure remains primary
+                reportClassifiedDegradation('ATOMIC_TEMP_CLOSE', closeError);
             }
         }
         // Best-effort cleanup of tmp file
         try {
             await unlink(tmpPath);
         }
-        catch {
-            // Ignore cleanup errors — tmp will be swept by cleanupOrphanTmps()
+        catch (cleanupError) {
+            // reliability-cleanup: ATOMIC_TEMP_UNLINK — startup scavenger removes orphan
+            reportClassifiedDegradation('ATOMIC_TEMP_UNLINK', cleanupError);
         }
         throw err;
     }
@@ -135,14 +142,17 @@ async function fsyncDirectory(dirPath) {
         await dirFd.close();
         dirFd = null;
     }
-    catch {
+    catch (error) {
+        // reliability-optional: DIRECTORY_FSYNC — target bytes are already durable
+        reportClassifiedDegradation('DIRECTORY_FSYNC', error);
         // Non-fatal — target file is already durable, only dir metadata may need recovery
         if (dirFd !== null) {
             try {
                 await dirFd.close();
             }
-            catch {
-                // ignore
+            catch (closeError) {
+                // reliability-cleanup: DIRECTORY_FD_CLOSE — no live mutation remains
+                reportClassifiedDegradation('DIRECTORY_FD_CLOSE', closeError);
             }
         }
     }
@@ -166,8 +176,9 @@ export async function cleanupOrphanTmps(dir) {
                 await unlink(full);
                 removed++;
             }
-            catch {
-                // ignore
+            catch (error) {
+                // reliability-cleanup: ORPHAN_TEMP_SWEEP — later sweep retries the orphan
+                reportClassifiedDegradation('ORPHAN_TEMP_SWEEP', error);
             }
         }
     }