@planu/cli 4.13.0 → 4.14.1

package/dist/engine/doc-generator/portal/portal-regenerator.js

@@ -25,10 +25,7 @@ export function scheduleRegeneration(projectPath, changedStores) {
         const stores = [...pending];
         pendingStoresPerProject.delete(projectPath);
         debounceTimers.delete(projectPath);
-        regeneratePages(projectPath, stores).catch((err) => {
-            const message = err instanceof Error ? err.message : String(err);
-            console.error('[Planu] Portal regeneration failed for', projectPath, ':', message);
-        });
+        void regeneratePages(projectPath, stores);
     }, 500);
     debounceTimers.set(projectPath, timer);
 }
@@ -76,64 +73,23 @@ async function generatePage(projectPath, page) {
     try {
         const { listSpecs } = await import('../../../storage/spec-store.js');
         const specs = await listSpecs(projectId);
-        return await dispatchPageGenerator(projectPath, projectId, page, specs);
+        return await dispatchPageGenerator(projectPath, page, specs);
     }
     catch {
         return null;
     }
 }
-async function dispatchPageGenerator(projectPath, projectId, page, specs) {
+async function dispatchPageGenerator(projectPath, page, specs) {
     switch (page) {
         case 'index': {
             const { regenerateSpecSummaryHtml } = await import('../../spec-summary-html.js');
             await regenerateSpecSummaryHtml(projectPath, specs);
             return null; // regenerateSpecSummaryHtml writes directly
         }
-        case 'executive-summary': {
-            const { getKnowledge } = await import('../../../storage/knowledge-store.js');
-            const { generateExecutiveSummary } = await import('../executive-summary/executive-summary-generator.js');
-            const knowledge = await getKnowledge(projectId);
-            if (!knowledge) {
-                return null;
-            }
-            const doc = generateExecutiveSummary(knowledge, specs, 'en');
-            return doc.content;
-        }
-        case 'analytics': {
-            const { generateAnalyticsPage } = await import('./analytics-page.js');
-            return generateAnalyticsPage(specs);
-        }
         case 'roadmap': {
             const { generateRoadmapPage } = await import('./roadmap-page.js');
             return generateRoadmapPage(specs);
         }
-        case 'risks': {
-            const { loadAllRiskRegisters } = await import('../../../storage/risk-store.js');
-            const { generateRiskPage } = await import('./risk-page.js');
-            const { projectDataDir } = await import('../../../storage/base-store.js');
-            const dataDir = projectDataDir(projectId);
-            const risks = await loadAllRiskRegisters(dataDir);
-            return generateRiskPage(risks, specs);
-        }
-        case 'decisions': {
-            const { getDecisions } = await import('../../../storage/decision-store.js');
-            const { generateDecisionPage } = await import('./decision-page.js');
-            const decisions = await getDecisions(projectId);
-            return generateDecisionPage(decisions);
-        }
-        case 'architecture': {
-            const { getKnowledge } = await import('../../../storage/knowledge-store.js');
-            const { generateArchitecturePage } = await import('./architecture-page.js');
-            const knowledge = await getKnowledge(projectId);
-            if (!knowledge) {
-                return null;
-            }
-            return generateArchitecturePage(knowledge);
-        }
-        case 'changelog': {
-            const { generateChangelogPage } = await import('./changelog-page.js');
-            return generateChangelogPage(specs);
-        }
     }
 }
 //# sourceMappingURL=portal-regenerator.js.map

package/dist/engine/domain-detector.js

@@ -1,14 +1,11 @@
-// engine/domain-detector.ts — Detects spec domains from title + description (SPEC-290)
-//
-// Analyzes spec text to identify which technical domains apply.
-// Detection is keyword-based and returns evidence for each domain found.
+import { technologyValue } from './technology-registry.js';
 const DOMAIN_KEYWORDS = [
     {
         domain: 'payments',
         keywords: [
             'payment',
             'payments',
-            'stripe',
+            technologyValue('technology-stripe-2bed20'),
             'paypal',
             'billing',
             'invoice',
@@ -168,7 +165,7 @@ const DOMAIN_KEYWORDS = [
             'cron',
             'scheduled task',
             'bull',
-            'celery',
+            technologyValue('technology-celery-ddc517'),
             'sidekiq',
             'job processor',
             'async job',

package/dist/engine/dynamic-knowledge/knowledge-cache.js

@@ -3,13 +3,12 @@
 // Reads/writes data/knowledge/cache.json with per-category TTL
 import { CATEGORY_TTL, } from '../../types/index.js';
 import { readFile, writeFile, mkdir } from 'node:fs/promises';
-import { join, dirname } from 'node:path';
-const CACHE_DIR = 'data/knowledge';
-const CACHE_FILE = 'cache.json';
+import { dirname } from 'node:path';
+import { resolvedStorageArtifactPath } from '../../storage/storage-catalog.js';
 const MAX_ENTRIES = 200;
 const PRUNE_THRESHOLD_DAYS = 30;
 function getCachePath() {
-    return join(process.cwd(), CACHE_DIR, CACHE_FILE);
+    return resolvedStorageArtifactPath('dynamic-knowledge-cache');
 }
 function createEmptyStore() {
     return { version: 1, entries: [], lastPruned: new Date().toISOString() };

package/dist/engine/dynamic-knowledge/knowledge-merger.js

@@ -1,5 +1,6 @@
 import { readFile } from 'node:fs/promises';
 import { join } from 'node:path';
+import { loadTechnologyRegistry } from '../technology-registry.js';
 /** Safely convert an unknown value to string, falling back to a default. */
 function toStr(val, fallback) {
     if (typeof val === 'string') {
@@ -12,7 +13,7 @@ function toStr(val, fallback) {
 }
 /** Map categories to their static fallback JSON files in src/config/ */
 const STATIC_FALLBACK_MAP = {
-    frameworks: ['framework-registry/index.json', 'build-tools-catalog.json'],
+    frameworks: ['build-tools-catalog.json'],
     security: ['known-cves.json', 'security-patterns.json'],
     pricing: ['ai-model-pricing.json', 'llm-providers.json'],
     tooling: ['saas-registry.json', 'mcp-catalog.json'],
@@ -26,7 +27,7 @@ const STATIC_FALLBACK_MAP = {
  */
 export async function loadStaticFallback(category) {
     const files = STATIC_FALLBACK_MAP[category];
-    const items = [];
+    const items = category === 'frameworks' ? technologyKnowledgeItems() : [];
     for (const file of files) {
         try {
             const configDir = join(import.meta.dirname, '../../config');
@@ -41,6 +42,20 @@ export async function loadStaticFallback(category) {
     }
     return items;
 }
+function technologyKnowledgeItems() {
+    const fetchedAt = new Date().toISOString();
+    return loadTechnologyRegistry().frameworks.map((framework) => ({
+        id: `static-frameworks-${framework.id}`,
+        category: 'frameworks',
+        title: framework.displayName,
+        description: `${framework.displayName} ${framework.frameworkVersion}`,
+        sourceUrl: undefined,
+        applicableTargets: ['fullstack'],
+        severity: 'recommended',
+        tags: [framework.ecosystem],
+        fetchedAt,
+    }));
+}
 /**
  * Convert a static JSON config into KnowledgeItem format.
  * Handles various JSON structures found in src/config/.

package/dist/engine/dynamic-knowledge/web-researcher.js

@@ -1,3 +1,4 @@
+import { technologyValue } from '../technology-registry.js';
 /**
  * Perform a web search query and return parsed results.
  * Uses DuckDuckGo HTML search as a free, no-API-key source.
@@ -149,18 +150,18 @@ function extractTags(snippet) {
     const lower = snippet.toLowerCase();
     const tags = [];
     const techKeywords = [
-        'react',
-        'vue',
-        'angular',
-        'svelte',
+        technologyValue('technology-react-275976'),
+        technologyValue('technology-vue-564382'),
+        technologyValue('technology-angular-a39f89'),
+        technologyValue('technology-svelte-c190ac'),
         'next',
-        'nuxt',
-        'express',
-        'nestjs',
-        'django',
-        'fastapi',
-        'rails',
-        'typescript',
+        technologyValue('technology-nuxt-22c407'),
+        technologyValue('technology-express-008231'),
+        technologyValue('technology-nestjs-2d0087'),
+        technologyValue('technology-django-7d8a08'),
+        technologyValue('technology-fastapi-6aee0e'),
+        technologyValue('technology-rails-2e1d59'),
+        technologyValue('technology-typescript-969545'),
         'python',
         'go',
         'rust',
@@ -168,9 +169,9 @@ function extractTags(snippet) {
         'postgres',
         'mysql',
         'mongodb',
-        'redis',
-        'docker',
-        'kubernetes',
+        technologyValue('technology-redis-34fb46'),
+        technologyValue('technology-docker-d548c5'),
+        technologyValue('technology-kubernetes-94abcb'),
         'aws',
         'gcp',
         'azure',

package/dist/engine/dynamic-migration-detector/manifest-readers-extended.js

@@ -1,5 +1,3 @@
-// SPEC-597-EXEMPT: canonical mapping (npm-package↔framework, keyword catalogue)
-// — must enumerate framework names by design; no detection logic to migrate.
 // Planu — Extended manifest readers: rubygems, nuget, pub, swiftpm (SPEC-054)
 // All file I/O via node:fs/promises — no live API calls.
 import { readFile } from 'node:fs/promises';

package/dist/engine/e2e-test-generator.js

@@ -1,3 +1,4 @@
+import { technologyValue } from './technology-registry.js';
 // Planu — E2E Test Generator engine (SPEC-381)
 // Pure functions for generating E2E tests from spec acceptance criteria.
 import { readFile, readdir, mkdir, writeFile } from 'node:fs/promises';
@@ -78,7 +79,7 @@ export function getFrameworkExtension(framework) {
     switch (framework) {
         case 'gherkin':
             return 'feature';
-        case 'playwright':
+        case technologyValue('technology-playwright-7827e8'):
             return 'spec.ts';
         case 'testRigor':
             return 'txt';
@@ -131,7 +132,7 @@ export async function generateE2eTests(specId, projectPath, framework = 'gherkin
         case 'gherkin':
             content = generateGherkin(title, description, criteria);
             break;
-        case 'playwright':
+        case technologyValue('technology-playwright-7827e8'):
             content = generatePlaywright(title, criteria);
             break;
         case 'testRigor':
@@ -198,7 +199,7 @@ export async function getE2eTestStatus(projectPath) {
             framework = 'gherkin';
         }
         else if (ext === '.ts') {
-            framework = 'playwright';
+            framework = technologyValue('technology-playwright-7827e8');
         }
         else {
             framework = 'unknown';

package/dist/engine/ecosystem-absorber/knowledge-cache.js

@@ -1,9 +1,10 @@
 // engine/ecosystem-absorber/knowledge-cache.ts — Reads/writes ecosystem capability cache
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
+import { resolveStorageLayout } from '../../storage/storage-layout.js';
 const CACHE_VERSION = '1';
 const PRUNE_DAYS = 30;
-const DATA_DIR = join(process.cwd(), 'data', 'ecosystem');
+const DATA_DIR = join(resolveStorageLayout().cache, 'ecosystem');
 const CACHE_FILE = join(DATA_DIR, 'capabilities.json');
 function emptyCache() {
     return { lastCrawled: {}, capabilities: [], version: CACHE_VERSION };

package/dist/engine/ecosystem-absorber/platform-crawler.js

@@ -1,7 +1,7 @@
-// engine/ecosystem-absorber/platform-crawler.ts — Crawls external sources for capability signals
+import { technologyValue } from '../technology-registry.js';
 const GITHUB_API_BASE = 'https://api.github.com';
 const CAPABILITY_SIGNALS = {
-    api: ['endpoint', 'api', 'rest', 'graphql', 'webhook', 'http'],
+    api: ['endpoint', 'api', 'rest', technologyValue('technology-graphql-aed31c'), 'webhook', 'http'],
     sdk: ['sdk', 'library', 'package', 'client', 'integration'],
     'tool-use': ['tool', 'function calling', 'tool_use', 'mcp', 'tool call'],
     agent: ['agent', 'autonomous', 'agentic', 'multi-agent', 'swarm'],

package/dist/engine/escalator/retry-counter.js

@@ -3,6 +3,7 @@
 import { join } from 'node:path';
 import { readFile } from 'node:fs/promises';
 import { atomicWriteFile } from '../safety/atomic-write-file.js';
+import { projectDataDir } from '../../storage/base-store.js';
 // ---------------------------------------------------------------------------
 // Constants
 // ---------------------------------------------------------------------------
@@ -12,7 +13,7 @@ const PURGE_TTL_MS = 7 * 24 * 60 * 60 * 1000;
 // Path helpers
 // ---------------------------------------------------------------------------
 function storePath(projectId) {
-    return join('planu', 'data', 'projects', projectId, 'retry-counters.json');
+    return join(projectDataDir(projectId), 'retry-counters.json');
 }
 function storeKey(k) {
     return `${k.role}::${k.specId}::${k.frontmatterSha}`;

package/dist/engine/evidence-gates/artifact-reader.d.ts

@@ -1,5 +1,11 @@
 import type { Spec } from '../../types/spec/core.js';
 import type { EvidenceArtifacts } from '../../types/evidence-gates.js';
+/** Digest of canonical artifact content; the provenance envelope is excluded. */
+export declare function evidenceArtifactDigest(artifact: unknown): string;
+export declare function evidenceArtifactCollectionDigest(artifacts: readonly {
+    kind: string;
+    provenance?: unknown;
+}[]): string;
 export declare function readEvidenceArtifacts(args: {
     spec: Spec;
     projectId: string;

package/dist/engine/evidence-gates/artifact-reader.js

@@ -1,36 +1,66 @@
+import { technologyValue } from '../technology-registry.js';
 import { readFile } from 'node:fs/promises';
+import { createHash } from 'node:crypto';
 import { join } from 'node:path';
 import { z } from 'zod';
 import { projectDataDir } from '../../storage/base-store.js';
-const DiscoverySchema = z.object({
+const DIGEST = /^sha256:[a-f0-9]{64}$/u;
+const SPEC_ID = /^SPEC-[1-9]\d*$/u;
+const ISSUER_ID = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u;
+const ProvenanceSchema = z
+    .object({
+    receiptId: z.string().regex(DIGEST),
+    artifactDigest: z.string().regex(DIGEST),
+    specId: z.string().regex(SPEC_ID),
+    issuerId: z.string().regex(ISSUER_ID),
+})
+    .strict();
+const DiscoverySchema = z
+    .object({
     version: z.literal(1),
+    provenance: ProvenanceSchema.optional(),
     rules: z.array(z.string().min(1)).max(200),
-    examples: z.array(z.object({ rule: z.string().min(1), example: z.string().min(1) })).max(500),
+    examples: z
+        .array(z.object({ rule: z.string().min(1), example: z.string().min(1) }).strict())
+        .max(500),
     openQuestions: z
-        .array(z.object({
+        .array(z
+        .object({
         question: z.string().min(1),
         status: z.enum(['open', 'resolved', 'out_of_scope']),
         resolution: z.string().optional(),
-    }))
+    })
+        .strict())
         .max(200),
     outOfScope: z.array(z.string()).max(200),
-    glossary: z.array(z.object({ term: z.string().min(1), meaning: z.string().min(1) })).max(200),
-});
-const TaskPlanSchema = z.object({
+    glossary: z
+        .array(z.object({ term: z.string().min(1), meaning: z.string().min(1) }).strict())
+        .max(200),
+})
+    .strict();
+const TaskPlanSchema = z
+    .object({
     version: z.literal(1),
+    provenance: ProvenanceSchema.optional(),
     tasks: z
-        .array(z.object({
+        .array(z
+        .object({
         id: z.string().min(1).max(120),
         title: z.string().min(1).max(500),
         acceptanceCriteria: z.array(z.string().min(1)).max(200),
         status: z.enum(['pending', 'doing', 'done']),
-    }))
+    })
+        .strict())
         .max(500),
-});
-const TraceabilityMatrixSchema = z.object({
+})
+    .strict();
+const TraceabilityMatrixSchema = z
+    .object({
     version: z.literal(1),
+    provenance: ProvenanceSchema.optional(),
     rows: z
-        .array(z.object({
+        .array(z
+        .object({
         acceptanceCriterion: z.string().min(1),
         scenario: z.string().optional(),
         testEvidence: z.array(z.string().min(1)).optional(),
@@ -39,16 +69,55 @@ const TraceabilityMatrixSchema = z.object({
         changedFiles: z.array(z.string().min(1)).max(200),
         validationEvidence: z.string().optional(),
         reviewerEvidence: z.string().optional(),
-    }))
+    })
+        .strict())
         .max(1000),
-});
-const ContractValidationSchema = z.object({
+})
+    .strict();
+const ContractValidationSchema = z
+    .object({
     version: z.literal(1),
-    kind: z.enum(['api', 'graphql', 'event', 'ui', 'mcp']),
+    provenance: ProvenanceSchema.optional(),
+    kind: z.enum(['api', technologyValue('technology-graphql-aed31c'), 'event', 'ui', 'mcp']),
     passed: z.boolean(),
     reportPath: z.string().optional(),
     summary: z.string().optional(),
-});
+})
+    .strict();
+function canonicalize(value) {
+    if (value === null || typeof value === 'string' || typeof value === 'boolean') {
+        return JSON.stringify(typeof value === 'string' ? value.normalize('NFC') : value);
+    }
+    if (typeof value === 'number' && Number.isFinite(value)) {
+        return JSON.stringify(value);
+    }
+    if (Array.isArray(value)) {
+        return `[${value.map(canonicalize).join(',')}]`;
+    }
+    if (typeof value === 'object') {
+        const record = value;
+        const keys = Object.keys(record)
+            .filter((key) => key !== 'provenance')
+            .map((key) => ({ raw: key, normalized: key.normalize('NFC') }))
+            .sort((left, right) => left.normalized.localeCompare(right.normalized));
+        if (new Set(keys.map((key) => key.normalized)).size !== keys.length) {
+            throw new Error('[Planu] Evidence artifact has duplicate normalized keys');
+        }
+        return `{${keys
+            .map(({ raw, normalized }) => `${JSON.stringify(normalized)}:${canonicalize(record[raw])}`)
+            .join(',')}}`;
+    }
+    throw new Error('[Planu] Evidence artifact must be canonical JSON');
+}
+/** Digest of canonical artifact content; the provenance envelope is excluded. */
+export function evidenceArtifactDigest(artifact) {
+    return `sha256:${createHash('sha256').update(canonicalize(artifact)).digest('hex')}`;
+}
+export function evidenceArtifactCollectionDigest(artifacts) {
+    return evidenceArtifactDigest(artifacts
+        .map((artifact) => ({ kind: artifact.kind, digest: evidenceArtifactDigest(artifact) }))
+        .sort((left, right) => left.kind.localeCompare(right.kind)));
+}
 const ARTIFACT_HINTS = {
     'Discovery evidence': 'Expected discovery.json with { version: 1, rules: string[], examples: [{ rule, example }], openQuestions: [{ question, status, resolution? }], outOfScope: string[], glossary: [{ term, meaning }] }.',
     'Task plan evidence': 'Expected task-plan.json with { version: 1, tasks: [{ id, title, acceptanceCriteria: string[], status: "pending"|"doing"|"done" }] }. Acceptance criteria may be full text or stable IDs such as AC1 when they map to the canonical criteria order.',
@@ -121,6 +190,17 @@ export async function readEvidenceArtifacts(args) {
         schema: TraceabilityMatrixSchema,
         paths: [handoffEvidencePath(args.projectId, args.specId, 'traceability-matrix.json')],
     });
+    const [discoveryProvenance, taskPlanProvenance, traceabilityProvenance, contractProvenance] = await Promise.all([
+        'discovery.provenance.json',
+        'task-plan.provenance.json',
+        'traceability-matrix.provenance.json',
+        'contract-validation.provenance.json',
+    ].map((filename) => readOptional({
+        label: filename,
+        invalidArtifacts,
+        schema: ProvenanceSchema,
+        paths: [handoffEvidencePath(args.projectId, args.specId, filename)],
+    })));
     const contractValidations = [];
     for (const filename of [
         'contract-validation-api.json',
@@ -136,13 +216,17 @@ export async function readEvidenceArtifacts(args) {
             paths: [handoffEvidencePath(args.projectId, args.specId, filename)],
         });
         if (evidence) {
-            contractValidations.push(evidence);
+            contractValidations.push(contractProvenance ? { ...evidence, provenance: contractProvenance } : evidence);
         }
     }
     return {
-        discovery,
-        taskPlan,
-        traceabilityMatrix,
+        discovery: discovery && discoveryProvenance
+            ? { ...discovery, provenance: discoveryProvenance }
+            : discovery,
+        taskPlan: taskPlan && taskPlanProvenance ? { ...taskPlan, provenance: taskPlanProvenance } : taskPlan,
+        traceabilityMatrix: traceabilityMatrix && traceabilityProvenance
+            ? { ...traceabilityMatrix, provenance: traceabilityProvenance }
+            : traceabilityMatrix,
         contractValidations,
         invalidArtifacts,
     };

package/dist/engine/evidence-gates/lifecycle-gate.d.ts

@@ -1,5 +1,5 @@
 import type { Spec } from '../../types/spec/core.js';
-import type { ContractValidationEvidence, EvidenceArtifacts, EvidenceGateIssue, EvidenceGateResult, EvidenceGateTransition } from '../../types/evidence-gates.js';
+import type { ContractValidationEvidence, EvidenceArtifacts, EvidenceGateIssue, EvidenceGateResult, EvidenceReceiptContext, EvidenceGateTransition } from '../../types/evidence-gates.js';
 export declare function inferRequiredContractEvidence(spec: Spec, criteria: string[]): ContractValidationEvidence['kind'][];
 export declare function checkDiscoveryGate(spec: Spec, artifacts: EvidenceArtifacts): EvidenceGateIssue[];
 export declare function checkTaskPlanGate(spec: Spec, criteria: string[], artifacts: EvidenceArtifacts): EvidenceGateIssue[];
@@ -9,5 +9,6 @@ export declare function checkLifecycleEvidenceGate(args: {
     spec: Spec;
     criteria: string[];
     artifacts: EvidenceArtifacts;
+    receiptContext?: EvidenceReceiptContext;
 }): EvidenceGateResult;
 //# sourceMappingURL=lifecycle-gate.d.ts.map

package/dist/engine/evidence-gates/lifecycle-gate.js

@@ -1,3 +1,4 @@
+import { evidenceArtifactCollectionDigest, evidenceArtifactDigest } from './artifact-reader.js';
 import { hasAnyAffirmedMatch } from '../text-signal-boundaries.js';
 import { createCriterionIdentity } from '../criterion-identity.js';
 const CONTRACT_HINTS = {
@@ -24,6 +25,56 @@ function isNonTrivial(spec) {
 function hasText(value) {
     return value !== undefined && value.trim().length > 0;
 }
+function provenanceIssues(artifacts, context) {
+    const receipt = context.receipt;
+    const candidates = [];
+    if (artifacts.discovery) {
+        candidates.push({
+            label: 'discovery',
+            artifact: artifacts.discovery,
+            expectedDigest: receipt.bindings.artifactDigests.discovery,
+        });
+    }
+    if (artifacts.taskPlan) {
+        candidates.push({
+            label: 'task plan',
+            artifact: artifacts.taskPlan,
+            expectedDigest: receipt.bindings.artifactDigests.taskPlan,
+        });
+    }
+    if (artifacts.traceabilityMatrix) {
+        candidates.push({
+            label: 'traceability matrix',
+            artifact: artifacts.traceabilityMatrix,
+            expectedDigest: receipt.bindings.artifactDigests.traceability,
+        });
+    }
+    for (const artifact of artifacts.contractValidations.slice(0, 1)) {
+        candidates.push({
+            label: 'contract validation collection',
+            artifact,
+            expectedDigest: receipt.bindings.artifactDigests.contractValidation,
+            actualDigest: evidenceArtifactCollectionDigest(artifacts.contractValidations),
+        });
+    }
+    return candidates.flatMap(({ label, artifact, expectedDigest, actualDigest }) => {
+        const provenance = artifact.provenance;
+        const observedDigest = actualDigest ?? evidenceArtifactDigest(artifact);
+        const valid = provenance?.receiptId === receipt.receiptId &&
+            provenance.specId === receipt.bindings.specId &&
+            provenance.issuerId === receipt.issuer &&
+            provenance.artifactDigest === observedDigest &&
+            provenance.artifactDigest === expectedDigest;
+        return valid
+            ? []
+            : [
+                {
+                    code: 'evidence_provenance_invalid',
+                    message: `${label} is not bound to the current Planu validation receipt.`,
+                },
+            ];
+    });
+}
 export function inferRequiredContractEvidence(spec, criteria) {
     const text = `${spec.title} ${spec.tags.join(' ')} ${criteria.join(' ')}`;
     const required = [];
@@ -158,6 +209,9 @@ export function checkLifecycleEvidenceGate(args) {
         code: 'evidence_artifact_invalid',
         message: artifact,
     }));
+    if (args.receiptContext) {
+        issues.push(...provenanceIssues(args.artifacts, args.receiptContext));
+    }
     if (args.transition === 'approved') {
         issues.push(...checkDiscoveryGate(args.spec, args.artifacts));
     }

package/dist/engine/execution/context.d.ts

@@ -0,0 +1,19 @@
+import type { CancellationScope, CreateExecutionScopeOptions, RequestExecutionContext, RequestExecutionScope } from '../../types/execution.js';
+export declare class ExecutionCancelledError extends Error {
+    readonly code = "EXECUTION_CANCELLED";
+    constructor(message?: string);
+}
+export declare function getExecutionContext(): RequestExecutionContext | undefined;
+export declare function getExecutionSignal(): AbortSignal | undefined;
+export declare function remainingExecutionMs(): number;
+/**
+ * Must be called immediately before a mutation crosses its commit boundary.
+ * AsyncLocalStorage keeps the cancelled state visible to work that outlives its
+ * request, so abandoned handlers cannot commit after acknowledgement.
+ */
+export declare function assertExecutionCanCommit(signal?: AbortSignal): void;
+export declare function guardExecutionCommit<T>(commit: () => Promise<T>): Promise<T>;
+export declare function createExecutionScope(options: CreateExecutionScopeOptions): RequestExecutionScope;
+/** Creates a child cancellation node whose deadline never exceeds its parent. */
+export declare function createChildCancellationScope(requestedMs: number): CancellationScope;
+//# sourceMappingURL=context.d.ts.map