@planu/cli 4.12.3 → 4.14.1

package/dist/engine/validation/validation-receipt.js

@@ -0,0 +1,282 @@
+import { createHmac, randomBytes } from 'node:crypto';
+import { chmod, mkdir, open, readFile, rename, unlink } from 'node:fs/promises';
+import { join } from 'node:path';
+import { TextDecoder } from 'node:util';
+import { reportClassifiedDegradation } from '../../errors/classified-degradation.js';
+import { resolvedStorageArtifactPath, } from '../../storage/storage-catalog.js';
+import { formatSecretReference, getSecretProvider, parseSecretReference, SecretProviderError, } from '../../security/secret-provider.js';
+import { redactText } from '../../security/redactor.js';
+import { canonicalize, DIGEST, ISSUER_ID, PROJECT_ID, receiptCore, safeProof, sha256, SPEC_ID, validBindings, validReceiptShape, } from './validation-receipt-codec.js';
+export { normalizeValidationCommand } from './validation-receipt-codec.js';
+export const LOCAL_VALIDATION_RECEIPT_ISSUER = 'planu-local-validator';
+export class ValidationIssuerKeyError extends Error {
+    code = 'VALIDATION_ISSUER_KEY_NOT_CONFIGURED';
+    constructor() {
+        super('[Planu] Validation issuer key is not configured in the explicit environment adapter');
+        this.name = 'ValidationIssuerKeyError';
+    }
+}
+export class ValidationReceiptStore {
+    options;
+    logDirectory;
+    constructor(options) {
+        this.options = options;
+        this.logDirectory = resolvedStorageArtifactPath('validation-logs', options.catalogContext);
+    }
+    logPath(logDigest) {
+        if (!DIGEST.test(logDigest)) {
+            throw new Error('[Planu] Invalid validation log digest');
+        }
+        return join(this.logDirectory, `${logDigest.slice('sha256:'.length)}.log`);
+    }
+    async persist(receipt, log) {
+        if (sha256(log) !== receipt.logDigest) {
+            throw new Error('[Planu] Validation log digest mismatch');
+        }
+        await this.writeLog(receipt.logDigest, log);
+        this.options.database.transaction(() => {
+            this.options.database.putRecord({
+                projectId: receipt.bindings.projectId,
+                workspaceId: this.options.workspaceId,
+                kind: 'audit-state',
+                key: `validation-receipt:${receipt.receiptId.slice('sha256:'.length)}`,
+                value: receipt,
+                sourceDigest: receipt.receiptId,
+            });
+            this.options.database.putRecord({
+                projectId: receipt.bindings.projectId,
+                workspaceId: this.options.workspaceId,
+                kind: 'audit-state',
+                key: `validation-current:${receipt.bindings.specId}`,
+                value: receipt,
+                sourceDigest: receipt.receiptId,
+            });
+            this.options.database.putRecord({
+                projectId: receipt.bindings.projectId,
+                workspaceId: this.options.workspaceId,
+                kind: 'audit-state',
+                key: `validation-bindings-current:${receipt.bindings.specId}`,
+                value: receipt.bindings,
+                sourceDigest: receipt.receiptId,
+            });
+        });
+    }
+    readReceipt(projectId, receiptId) {
+        if (!PROJECT_ID.test(projectId) || !DIGEST.test(receiptId)) {
+            return Promise.resolve(undefined);
+        }
+        const record = this.options.database.getRecord(projectId, this.options.workspaceId, 'audit-state', `validation-receipt:${receiptId.slice('sha256:'.length)}`);
+        return Promise.resolve(validReceiptShape(record?.value) ? record.value : undefined);
+    }
+    readCurrent(projectId, specId) {
+        if (!PROJECT_ID.test(projectId) || !SPEC_ID.test(specId)) {
+            return Promise.resolve(undefined);
+        }
+        const record = this.options.database.getRecord(projectId, this.options.workspaceId, 'audit-state', `validation-current:${specId}`);
+        return Promise.resolve(validReceiptShape(record?.value) ? record.value : undefined);
+    }
+    readCurrentBindings(projectId, specId) {
+        if (!PROJECT_ID.test(projectId) || !SPEC_ID.test(specId)) {
+            return Promise.resolve(undefined);
+        }
+        const record = this.options.database.getRecord(projectId, this.options.workspaceId, 'audit-state', `validation-bindings-current:${specId}`);
+        return Promise.resolve(validBindings(record?.value) ? record.value : undefined);
+    }
+    projectCurrentBindings(bindings) {
+        if (!validBindings(bindings)) {
+            throw new Error('[Planu] Current validation bindings are invalid');
+        }
+        this.options.database.putRecord({
+            projectId: bindings.projectId,
+            workspaceId: this.options.workspaceId,
+            kind: 'audit-state',
+            key: `validation-bindings-current:${bindings.specId}`,
+            value: bindings,
+            sourceDigest: sha256(canonicalize(bindings)),
+        });
+        return Promise.resolve();
+    }
+    invalidateCurrentBindings(projectId, specId) {
+        if (!PROJECT_ID.test(projectId) || !SPEC_ID.test(specId)) {
+            throw new Error('[Planu] Validation binding identity is invalid');
+        }
+        this.options.database.putRecord({
+            projectId,
+            workspaceId: this.options.workspaceId,
+            kind: 'audit-state',
+            key: `validation-bindings-current:${specId}`,
+            value: { invalidatedAt: new Date().toISOString() },
+        });
+        return Promise.resolve();
+    }
+    async readLog(logDigest) {
+        try {
+            return await readFile(this.logPath(logDigest));
+        }
+        catch (error) {
+            if (error.code === 'ENOENT') {
+                return undefined;
+            }
+            throw error;
+        }
+    }
+    async writeLog(logDigest, log) {
+        await mkdir(this.logDirectory, { recursive: true, mode: 0o700 });
+        await chmod(this.logDirectory, 0o700);
+        const target = this.logPath(logDigest);
+        const temporary = `${target}.tmp.${process.pid.toString()}.${randomBytes(4).toString('hex')}`;
+        try {
+            const handle = await open(temporary, 'wx', 0o600);
+            await handle.write(log);
+            await handle.datasync();
+            await handle.close();
+            await rename(temporary, target);
+            await chmod(target, 0o600);
+        }
+        catch (error) {
+            await unlink(temporary).catch((cleanupError) => {
+                /* reliability-cleanup: VALIDATION_TEMP_UNLINK — original persistence error remains authoritative */
+                reportClassifiedDegradation('VALIDATION_TEMP_UNLINK', cleanupError);
+            });
+            if (error.code !== 'EEXIST') {
+                throw error;
+            }
+            const existing = await readFile(target);
+            if (sha256(existing) !== logDigest) {
+                throw new Error('[Planu] Existing validation log failed digest verification', {
+                    cause: error,
+                });
+            }
+        }
+    }
+}
+export async function issueValidationReceipt(input, options) {
+    if (!ISSUER_ID.test(options.issuerId)) {
+        throw new Error('[Planu] Invalid validation receipt issuer');
+    }
+    const signingKey = await getSecretProvider().resolve(parseSecretReference(options.signingKeyReference));
+    if (Buffer.byteLength(signingKey) < 32) {
+        throw new Error('[Planu] Validation issuer key is too short');
+    }
+    const decodedLog = Buffer.isBuffer(input.log)
+        ? new TextDecoder('utf-8', { fatal: true }).decode(input.log)
+        : input.log;
+    const log = Buffer.from(redactText(decodedLog), 'utf8');
+    const core = receiptCore(input, options.issuerId, sha256(log));
+    const receiptId = sha256(canonicalize(core));
+    const unsigned = { ...core, receiptId };
+    const proof = createHmac('sha256', signingKey).update(canonicalize(unsigned)).digest('base64url');
+    const receipt = {
+        ...unsigned,
+        authenticity: { algorithm: 'hmac-sha256', proof },
+    };
+    await options.store.persist(receipt, log);
+    return receipt;
+}
+export async function verifyValidationReceipt(value, options) {
+    if (typeof value === 'object' &&
+        value !== null &&
+        'schemaVersion' in value &&
+        value.schemaVersion !== 1) {
+        return { valid: false, reason: 'unsupported-version' };
+    }
+    if (!validReceiptShape(value) || !validBindings(options.bindings)) {
+        return { valid: false, reason: 'invalid-schema' };
+    }
+    const keyReference = options.trustedIssuers[value.issuer];
+    if (!keyReference) {
+        return { valid: false, reason: 'unknown-issuer' };
+    }
+    let key;
+    try {
+        key = await getSecretProvider().resolve(parseSecretReference(keyReference));
+    }
+    catch {
+        return { valid: false, reason: 'invalid-authenticity' };
+    }
+    if (!safeProof(value, key)) {
+        return { valid: false, reason: 'invalid-authenticity' };
+    }
+    if (canonicalize(value.bindings) !== canonicalize(options.bindings)) {
+        return { valid: false, reason: 'stale-bindings' };
+    }
+    const persisted = await options.store.readReceipt(value.bindings.projectId, value.receiptId);
+    if (!persisted || canonicalize(persisted) !== canonicalize(value)) {
+        return { valid: false, reason: 'missing-receipt' };
+    }
+    const log = await options.store.readLog(value.logDigest);
+    if (!log) {
+        return { valid: false, reason: 'missing-log' };
+    }
+    if (sha256(log) !== value.logDigest) {
+        return { valid: false, reason: 'invalid-log' };
+    }
+    return { valid: true };
+}
+export function validationLogPath(store, logDigest) {
+    return store.logPath(logDigest);
+}
+export function readCurrentValidationReceipt(store, identity) {
+    return store.readCurrent(identity.projectId, identity.specId);
+}
+/** Trust bootstrap is explicit: construct once with locally provisioned opaque issuer references. */
+export class ValidationReceiptAuthority {
+    store;
+    trustedIssuers;
+    constructor(store, trustedIssuers) {
+        this.store = store;
+        this.trustedIssuers = trustedIssuers;
+    }
+    async verifyCurrent(bindings) {
+        const receipt = await this.store.readCurrent(bindings.projectId, bindings.specId);
+        if (!receipt) {
+            return { valid: false, reason: 'missing-receipt' };
+        }
+        return verifyValidationReceipt(receipt, {
+            bindings,
+            trustedIssuers: this.trustedIssuers,
+            store: this.store,
+        });
+    }
+}
+function validationIssuerReference(identity) {
+    if (!PROJECT_ID.test(identity.projectId)) {
+        throw new Error('[Planu] Validation issuer requires a canonical projectId');
+    }
+    if (!ISSUER_ID.test(identity.issuerId)) {
+        throw new Error('[Planu] Invalid validation receipt issuer');
+    }
+    return formatSecretReference(getSecretProvider().reference(`${identity.projectId}/validation/issuer/${identity.issuerId}`, 'validation-signing'));
+}
+/** Construct the production verifier from runtime/catalog context without exposing key material. */
+export function createValidationReceiptAuthority(options) {
+    const store = new ValidationReceiptStore(options);
+    const signingKeyReference = validationIssuerReference(options);
+    return {
+        store,
+        signingKeyReference,
+        authority: new ValidationReceiptAuthority(store, {
+            [options.issuerId]: signingKeyReference,
+        }),
+    };
+}
+/** Provision or resolve a machine-local issuer key without exposing raw key material. */
+export async function ensureValidationIssuerKey(identity) {
+    const provider = getSecretProvider();
+    const reference = parseSecretReference(validationIssuerReference(identity));
+    try {
+        await provider.resolve(reference);
+        return formatSecretReference(reference);
+    }
+    catch (error) {
+        if (!(error instanceof SecretProviderError) || error.code !== 'SECRET_NOT_FOUND') {
+            throw error;
+        }
+    }
+    if (provider.adapter.kind === 'environment') {
+        throw new ValidationIssuerKeyError();
+    }
+    await provider.store(reference, randomBytes(32).toString('base64url'));
+    return formatSecretReference(reference);
+}
+//# sourceMappingURL=validation-receipt.js.map

package/dist/engine/validation/validation-source-policy.d.ts

@@ -0,0 +1,4 @@
+/** Generated/runtime roots are not validation source, even when accidentally tracked. */
+export declare const SOURCE_IGNORED_ROOTS: Set<string>;
+export declare function isValidationSourcePath(path: string): boolean;
+//# sourceMappingURL=validation-source-policy.d.ts.map

package/dist/engine/validation/validation-source-policy.js

@@ -0,0 +1,16 @@
+/** Generated/runtime roots are not validation source, even when accidentally tracked. */
+export const SOURCE_IGNORED_ROOTS = new Set([
+    '.git',
+    '.next',
+    '.turbo',
+    'build',
+    'coverage',
+    'dist',
+    'node_modules',
+]);
+export function isValidationSourcePath(path) {
+    const normalized = path.replaceAll('\\', '/').normalize('NFC');
+    const root = normalized.split('/')[0];
+    return root !== undefined && !SOURCE_IGNORED_ROOTS.has(root);
+}
+//# sourceMappingURL=validation-source-policy.js.map

package/dist/engine/validation/validation-submission.d.ts

@@ -0,0 +1,36 @@
+import type { DurableJobRuntime } from '../execution/job-runtime.js';
+import type { DurableJobRecord } from '../../storage/runtime-db.js';
+import type { DurableValidationBindings } from '../../types/durable-validation.js';
+import type { ValidationArtifactDigests } from '../../types/validation-receipt.js';
+import type { ValidationFreshnessLease } from './validation-freshness.js';
+/** Stable identity for exactly one immutable validation input tuple. */
+export declare function validationOperationId(bindings: DurableValidationBindings): string;
+/** Stable identity used to acknowledge before repository-wide bindings are computed. */
+export declare function validationSubmissionOperationId(projectId: string, specId: string): string;
+/** Accept one pre-bound durable validation for internal and compatibility callers. */
+export declare function createValidationSubmission(input: {
+    readonly runtime: DurableJobRuntime;
+    readonly canonicalProjectId: string;
+    readonly spec: {
+        readonly id: string;
+        readonly projectId?: string;
+        readonly specPath?: string;
+        readonly projectPath?: string;
+    };
+    readonly bindings: DurableValidationBindings;
+    readonly artifactDigests?: ValidationArtifactDigests;
+    readonly freshnessLease?: ValidationFreshnessLease;
+    readonly deadlineAt: number;
+}): DurableJobRecord;
+/** Persist validation immediately; the worker computes and binds the source snapshot. */
+export declare function createPendingValidationSubmission(input: {
+    readonly runtime: DurableJobRuntime;
+    readonly canonicalProjectId: string;
+    readonly spec: {
+        readonly id: string;
+        readonly specPath: string;
+        readonly projectPath: string;
+    };
+    readonly deadlineAt: number;
+}): DurableJobRecord;
+//# sourceMappingURL=validation-submission.d.ts.map

package/dist/engine/validation/validation-submission.js

@@ -0,0 +1,128 @@
+import { createHash } from 'node:crypto';
+import { DIGEST, PROJECT_ID as CANONICAL_PROJECT_ID, SPEC_ID as CANONICAL_SPEC_ID, } from './validation-receipt-codec.js';
+function assertBindings(bindings) {
+    if (!CANONICAL_PROJECT_ID.test(bindings.projectId)) {
+        throw new Error('[Planu] Durable validation requires a canonical projectId');
+    }
+    if (!CANONICAL_SPEC_ID.test(bindings.specId)) {
+        throw new Error('[Planu] Durable validation requires a valid specId');
+    }
+    if (![
+        bindings.sourceTreeHash,
+        bindings.specHash,
+        bindings.policyHash,
+        bindings.toolchainHash,
+    ].every((value) => DIGEST.test(value))) {
+        throw new Error('[Planu] Durable validation requires four sha256 bindings');
+    }
+}
+/** Stable identity for exactly one immutable validation input tuple. */
+export function validationOperationId(bindings) {
+    assertBindings(bindings);
+    const operationDigest = createHash('sha256')
+        .update(JSON.stringify([
+        'planu-validation-v1',
+        bindings.projectId,
+        bindings.specId,
+        bindings.sourceTreeHash,
+        bindings.specHash,
+        bindings.policyHash,
+        bindings.toolchainHash,
+    ]))
+        .digest('hex');
+    return `validation-${operationDigest}`;
+}
+/** Stable identity used to acknowledge before repository-wide bindings are computed. */
+export function validationSubmissionOperationId(projectId, specId) {
+    if (!CANONICAL_PROJECT_ID.test(projectId) || !CANONICAL_SPEC_ID.test(specId)) {
+        throw new Error('[Planu] Invalid durable validation submission identity');
+    }
+    const operationDigest = createHash('sha256')
+        .update(JSON.stringify(['planu-validation-submission-v1', projectId, specId]))
+        .digest('hex');
+    return `validation-${operationDigest}`;
+}
+function existingOrAccept(input) {
+    try {
+        const existing = input.runtime.get({
+            operationId: input.operationId,
+            projectId: input.projectId,
+        });
+        return ['completed', 'failed', 'dead-letter', 'cancelled'].includes(existing.state)
+            ? input.runtime.restartWithPayload({
+                operationId: input.operationId,
+                projectId: input.projectId,
+                payload: input.payload,
+            })
+            : existing;
+    }
+    catch (error) {
+        if (!(error instanceof Error) || error.name !== 'DurableJobNotFoundError') {
+            throw error;
+        }
+    }
+    return input.runtime.accept({
+        projectId: input.projectId,
+        operationId: input.operationId,
+        payload: input.payload,
+    });
+}
+/** Accept one pre-bound durable validation for internal and compatibility callers. */
+export function createValidationSubmission(input) {
+    assertBindings(input.bindings);
+    if (input.canonicalProjectId !== input.bindings.projectId ||
+        input.spec.id !== input.bindings.specId) {
+        throw new Error('[Planu] Durable validation binding identity mismatch');
+    }
+    if (!Number.isSafeInteger(input.deadlineAt) || input.deadlineAt <= Date.now()) {
+        throw new Error('[Planu] Durable validation requires a future absolute deadline');
+    }
+    const payload = {
+        kind: 'validate',
+        schemaVersion: 1,
+        input: {
+            specId: input.spec.id,
+            projectId: input.canonicalProjectId,
+            ...(input.spec.projectPath === undefined ? {} : { projectPath: input.spec.projectPath }),
+        },
+        bindings: input.bindings,
+        ...(input.artifactDigests === undefined ? {} : { artifactDigests: input.artifactDigests }),
+        ...(input.freshnessLease === undefined ? {} : { freshnessLease: input.freshnessLease }),
+        ...(input.spec.specPath === undefined ? {} : { specPath: input.spec.specPath }),
+        deadlineAt: input.deadlineAt,
+    };
+    return existingOrAccept({
+        runtime: input.runtime,
+        projectId: input.canonicalProjectId,
+        operationId: validationOperationId(input.bindings),
+        payload,
+    });
+}
+/** Persist validation immediately; the worker computes and binds the source snapshot. */
+export function createPendingValidationSubmission(input) {
+    if (!CANONICAL_PROJECT_ID.test(input.canonicalProjectId) ||
+        !CANONICAL_SPEC_ID.test(input.spec.id)) {
+        throw new Error('[Planu] Invalid durable validation submission identity');
+    }
+    if (!Number.isSafeInteger(input.deadlineAt) || input.deadlineAt <= Date.now()) {
+        throw new Error('[Planu] Durable validation requires a future absolute deadline');
+    }
+    const payload = {
+        kind: 'validate',
+        schemaVersion: 1,
+        input: {
+            specId: input.spec.id,
+            projectId: input.canonicalProjectId,
+            projectPath: input.spec.projectPath,
+        },
+        specPath: input.spec.specPath,
+        deadlineAt: input.deadlineAt,
+    };
+    return existingOrAccept({
+        runtime: input.runtime,
+        projectId: input.canonicalProjectId,
+        operationId: validationSubmissionOperationId(input.canonicalProjectId, input.spec.id),
+        payload,
+    });
+}
+//# sourceMappingURL=validation-submission.js.map

package/dist/engine/validation-evidence-ledger.js

@@ -11,6 +11,10 @@ const LOCK_PATHS = {
     lint: PACKAGE_LOCKS,
     'test-related': PACKAGE_LOCKS,
     'test-full': PACKAGE_LOCKS,
+    contract: PACKAGE_LOCKS,
+    coverage: PACKAGE_LOCKS,
+    migration: PACKAGE_LOCKS,
+    'fault-injection': [...PACKAGE_LOCKS, 'Cargo.lock'],
     security: [...PACKAGE_LOCKS, 'Cargo.lock'],
     native: [...PACKAGE_LOCKS, 'Cargo.lock'],
     website: PACKAGE_LOCKS,
@@ -21,6 +25,16 @@ const CONFIG_PATHS = {
     lint: ['package.json', 'eslint.config.js', 'eslint.config.mjs', 'eslint.config.cjs'],
     'test-related': ['package.json', 'vitest.config.ts', 'vitest.config.mts', 'vitest.config.js'],
     'test-full': ['package.json', 'vitest.config.ts', 'vitest.config.mts', 'vitest.config.js'],
+    contract: ['package.json', 'vitest.config.ts', 'vitest.config.mts', 'vitest.config.js'],
+    coverage: ['package.json', 'vitest.config.ts', 'vitest.config.mts', 'vitest.config.js'],
+    migration: ['package.json', 'vitest.config.ts', 'vitest.config.mts', 'vitest.config.js'],
+    'fault-injection': [
+        'package.json',
+        'vitest.config.ts',
+        'vitest.config.mts',
+        'vitest.config.js',
+        'Cargo.toml',
+    ],
     security: ['package.json', 'pnpm-workspace.yaml', 'Cargo.toml'],
     native: ['package.json', 'pnpm-workspace.yaml', 'Cargo.toml'],
     website: ['package.json', 'website/package.json'],
@@ -38,6 +52,33 @@ const CAPABILITY_PATHS = {
     lint: ['src', 'tests', 'package.json', 'pnpm-lock.yaml', 'eslint.config.js', 'eslint.config.mjs'],
     'test-related': ['src', 'tests', 'package.json', 'pnpm-lock.yaml', 'vitest.config.ts'],
     'test-full': ['src', 'tests', 'package.json', 'pnpm-lock.yaml', 'vitest.config.ts'],
+    contract: [
+        'src',
+        'tests/contracts',
+        'tests/integration',
+        'package.json',
+        'pnpm-lock.yaml',
+        'vitest.config.ts',
+    ],
+    coverage: ['src', 'tests', 'package.json', 'pnpm-lock.yaml', 'vitest.config.ts'],
+    migration: [
+        'src/storage',
+        'src/types/migration',
+        'tests/storage',
+        'tests/integration',
+        'package.json',
+        'pnpm-lock.yaml',
+    ],
+    'fault-injection': [
+        'src/engine/execution',
+        'src/engine/auto-updater',
+        'src/storage/runtime-db.ts',
+        'tests/engine',
+        'tests/integration',
+        'package.json',
+        'pnpm-lock.yaml',
+        'rust',
+    ],
     security: [
         'package.json',
         'pnpm-lock.yaml',

package/dist/engine/validation-impact-planner.js

@@ -3,6 +3,10 @@ export const VALIDATION_COMMANDS = {
     lint: 'pnpm lint',
     'test-related': 'pnpm test --run --changed',
     'test-full': 'pnpm test',
+    contract: 'pnpm test:contracts',
+    coverage: 'pnpm test:coverage',
+    migration: 'pnpm test:migrations',
+    'fault-injection': 'pnpm test:fault-injection',
     security: 'pnpm check:deps:fresh',
     native: 'pnpm native:project-graph:e2e',
     website: 'pnpm --dir website build',
@@ -10,8 +14,9 @@ export const VALIDATION_COMMANDS = {
 };
 const LIFECYCLE_RE = /^(?:planu\/|docs\/|README(?:\.|$)|CHANGELOG\.md$|[^/]+\.md$)/;
 const SOURCE_RE = /^(?:src\/|tests\/)/;
+const CORE_RE = /^(?:src\/|rust\/planu-core\/|tests\/(?:contracts|engine|integration|storage|tools)\/)/;
 const DEPENDENCY_RE = /^(?:package\.json|pnpm-lock\.yaml|pnpm-workspace\.yaml|npm\/[^/]+\/package\.json)/;
-const NATIVE_RE = /^(?:rust\/|Cargo\.(?:toml|lock)$|npm\/core-)/;
+const NATIVE_RE = /^(?:rust\/|Cargo\.(?:toml|lock)$|npm\/(?:core-|(?:darwin|linux|win32)-))/;
 const SHARED_RE = /^(?:\.github\/|\.husky\/|scripts\/|tsconfig(?:\.[^/]+)?\.json$|eslint\.config\.[^/]+$|vitest\.config\.[^/]+$)/;
 export function planValidationImpact(paths) {
     const changedPaths = [...new Set(paths.map(normalizePath).filter(Boolean))].sort();
@@ -21,6 +26,9 @@ export function planValidationImpact(paths) {
     if (changedPaths.every((path) => LIFECYCLE_RE.test(path))) {
         return plan('lifecycle', [], false, 'Lifecycle/documentation-only change.', changedPaths);
     }
+    if (changedPaths.some((path) => CORE_RE.test(path))) {
+        return fullPlan('Core behavior changed; every reliability gate is mandatory.', changedPaths);
+    }
     if (changedPaths.some((path) => SHARED_RE.test(path))) {
         return fullPlan('Shared validation, workflow, hook, or unknown infrastructure changed.', changedPaths);
     }
@@ -33,18 +41,15 @@ export function planValidationImpact(paths) {
             gates.add('lint');
             gates.add('test-related');
         }
-        else if (DEPENDENCY_RE.test(path)) {
-            kind = 'dependency';
-            gates.add('security');
-            gates.add('typecheck');
-            gates.add('lint');
-            gates.add('test-full');
-        }
         else if (NATIVE_RE.test(path)) {
             kind = 'native';
             gates.add('native');
+            gates.add('reproducibility');
             gates.add('test-full');
         }
+        else if (DEPENDENCY_RE.test(path)) {
+            return fullPlan('Dependency or lockfile change selects every reliability gate.', changedPaths);
+        }
         else if (path.startsWith('website/')) {
             kind = kind === 'none' ? 'website' : kind;
             gates.add('website');
@@ -56,7 +61,18 @@ export function planValidationImpact(paths) {
     return plan(kind, [...gates], gates.has('test-full'), `Selected by changed path class: ${kind}.`, changedPaths);
 }
 function fullPlan(reason, changedPaths) {
-    const gates = ['typecheck', 'lint', 'test-full', 'security'];
+    const gates = [
+        'typecheck',
+        'lint',
+        'test-full',
+        'contract',
+        'coverage',
+        'security',
+        'migration',
+        'fault-injection',
+        'native',
+        'reproducibility',
+    ];
     if (changedPaths.some((path) => path.startsWith('website/'))) {
         gates.push('website');
     }

package/dist/engine/validator/spec-compliance-runner.d.ts

@@ -40,7 +40,7 @@ export declare function parseFrontmatterScenarios(raw: string): FrontmatterScena
  * Run vitest-backed spec-compliance for the given spec.
  * Each frontmatter scenario must have a `tests` array; missing links count as `fail`.
  */
-export declare function runSpecCompliance(spec: Spec, projectPath: string, signal?: AbortSignal): Promise<SpecComplianceResult>;
+export declare function runSpecCompliance(spec: Spec, projectPath: string, signal?: AbortSignal, canonicalProjectId?: string): Promise<SpecComplianceResult>;
 /**
  * Returns a list of scenario titles that lack a `tests` array.
  * Used by check-readiness to block `approved` when scenarios are untested.

package/dist/engine/validator/spec-compliance-runner.js

@@ -1,3 +1,4 @@
+import { technologyValue } from '../technology-registry.js';
 // engine/validator/spec-compliance-runner.ts — SPEC-732: vitest-backed spec-compliance runner
 //
 // Replaces the text-matching approach in validateSpec with actual test execution.
@@ -125,7 +126,13 @@ export function parseFrontmatterScenarios(raw) {
  * Returns null on timeout or spawn error.
  */
 function runVitest(testPaths, projectPath, timeoutMs = 120_000, signal) {
-    const args = ['exec', 'vitest', '--reporter=json', '--run', ...testPaths];
+    const args = [
+        'exec',
+        technologyValue('technology-vitest-a9127f'),
+        '--reporter=json',
+        '--run',
+        ...testPaths,
+    ];
     return runAbortableProcess('pnpm', args, {
         cwd: projectPath,
         timeoutMs,
@@ -171,7 +178,7 @@ function resolveScenarioTestPath(link) {
  * Each frontmatter scenario must have a `tests` array; missing links count as `fail`.
  */
 // eslint-disable-next-line max-lines-per-function, complexity -- spec compliance runner: each section handles a discrete verification phase (file access, scenario parsing, test execution, verdict aggregation)
-export async function runSpecCompliance(spec, projectPath, signal) {
+export async function runSpecCompliance(spec, projectPath, signal, canonicalProjectId) {
     const { readFile } = await import('node:fs/promises');
     let raw;
     try {
@@ -213,12 +220,14 @@ export async function runSpecCompliance(spec, projectPath, signal) {
     // ── Phase 3: run vitest for existing paths ───────────────────────────────
     const existingPaths = [...allTestPaths].filter((p) => existenceMap.get(p) === true);
     let vitestResult = null;
-    const fullTestReceipt = readMatchingValidationEvidence(spec.projectId, {
-        projectPath,
-        capability: 'test-full',
-        command: 'pnpm test',
-        scope: ['src', 'tests'],
-    });
+    const fullTestReceipt = canonicalProjectId
+        ? readMatchingValidationEvidence(canonicalProjectId, {
+            projectPath,
+            capability: 'test-full',
+            command: 'pnpm test',
+            scope: ['src', 'tests'],
+        })
+        : null;
     if (existingPaths.length > 0 && !fullTestReceipt) {
         vitestResult = await runVitest(existingPaths, projectPath, 120_000, signal);
     }

package/dist/engine/validator/validation-report-writer.js

@@ -1,7 +1,7 @@
 import { appendArtifact, readArtifact } from '../handoff-artifacts/io.js';
 import { runSpecCompliance, } from './spec-compliance-runner.js';
 export async function writeImplementationReviewReport(input) {
-    const specCompliance = await runSpecCompliance(input.spec, input.projectPath, input.signal);
+    const specCompliance = await runSpecCompliance(input.spec, input.projectPath, input.signal, input.projectId);
     const reportScore = resolveExecutableValidationScore(input.score, specCompliance);
     const gates = buildGates({
         score: reportScore,