@planu/cli 4.13.0 → 5.0.0

package/dist/engine/evidence-gates/artifact-reader.js

@@ -1,36 +1,84 @@
+import { technologyValue } from '../technology-registry.js';
 import { readFile } from 'node:fs/promises';
-import { join } from 'node:path';
+import { lstatSync, realpathSync } from 'node:fs';
+import { createHash } from 'node:crypto';
+import { isAbsolute, join, relative, resolve } from 'node:path';
 import { z } from 'zod';
 import { projectDataDir } from '../../storage/base-store.js';
-const DiscoverySchema = z.object({
+import { computeValidationEvidenceIdentity, computeValidationEvidenceKey, normalizeValidationCommand, readMatchingValidationEvidence, } from '../validation-evidence-ledger.js';
+import { VALIDATION_COMMANDS } from '../validation-impact-planner.js';
+const DIGEST = /^sha256:[a-f0-9]{64}$/u;
+const SPEC_ID = /^SPEC-[1-9]\d*$/u;
+const ISSUER_ID = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u;
+const EVIDENCE_KEY = /^[a-f0-9]{64}$/u;
+const ValidationGateCapabilitySchema = z.enum([
+    'typecheck',
+    'lint',
+    'test-related',
+    'test-full',
+    'contract',
+    'coverage',
+    'migration',
+    'fault-injection',
+    'security',
+    'native',
+    'website',
+    'reproducibility',
+]);
+const ProvenanceSchema = z
+    .object({
+    receiptId: z.string().regex(DIGEST),
+    artifactDigest: z.string().regex(DIGEST),
+    specId: z.string().regex(SPEC_ID),
+    issuerId: z.string().regex(ISSUER_ID),
+})
+    .strict();
+const DiscoverySchema = z
+    .object({
     version: z.literal(1),
+    provenance: ProvenanceSchema.optional(),
     rules: z.array(z.string().min(1)).max(200),
-    examples: z.array(z.object({ rule: z.string().min(1), example: z.string().min(1) })).max(500),
+    examples: z
+        .array(z.object({ rule: z.string().min(1), example: z.string().min(1) }).strict())
+        .max(500),
     openQuestions: z
-        .array(z.object({
+        .array(z
+        .object({
         question: z.string().min(1),
         status: z.enum(['open', 'resolved', 'out_of_scope']),
         resolution: z.string().optional(),
-    }))
+    })
+        .strict())
         .max(200),
     outOfScope: z.array(z.string()).max(200),
-    glossary: z.array(z.object({ term: z.string().min(1), meaning: z.string().min(1) })).max(200),
-});
-const TaskPlanSchema = z.object({
+    glossary: z
+        .array(z.object({ term: z.string().min(1), meaning: z.string().min(1) }).strict())
+        .max(200),
+})
+    .strict();
+const TaskPlanSchema = z
+    .object({
     version: z.literal(1),
+    provenance: ProvenanceSchema.optional(),
     tasks: z
-        .array(z.object({
+        .array(z
+        .object({
         id: z.string().min(1).max(120),
         title: z.string().min(1).max(500),
         acceptanceCriteria: z.array(z.string().min(1)).max(200),
         status: z.enum(['pending', 'doing', 'done']),
-    }))
+    })
+        .strict())
         .max(500),
-});
-const TraceabilityMatrixSchema = z.object({
+})
+    .strict();
+const TraceabilityMatrixSchema = z
+    .object({
     version: z.literal(1),
+    provenance: ProvenanceSchema.optional(),
     rows: z
-        .array(z.object({
+        .array(z
+        .object({
         acceptanceCriterion: z.string().min(1),
         scenario: z.string().optional(),
         testEvidence: z.array(z.string().min(1)).optional(),
@@ -39,20 +87,154 @@ const TraceabilityMatrixSchema = z.object({
         changedFiles: z.array(z.string().min(1)).max(200),
         validationEvidence: z.string().optional(),
         reviewerEvidence: z.string().optional(),
-    }))
+        commandEvidence: z
+            .object({
+            capability: ValidationGateCapabilitySchema,
+            command: z.string().min(1),
+            scope: z.array(z.string().min(1)).min(1).max(200),
+            relevantPaths: z.array(z.string().min(1)).min(1).max(200).optional(),
+            evidenceKey: z.string().regex(EVIDENCE_KEY),
+        })
+            .strict()
+            .optional(),
+    })
+        .strict())
         .max(1000),
-});
-const ContractValidationSchema = z.object({
+})
+    .strict();
+const ContractValidationSchema = z
+    .object({
     version: z.literal(1),
-    kind: z.enum(['api', 'graphql', 'event', 'ui', 'mcp']),
+    provenance: ProvenanceSchema.optional(),
+    kind: z.enum(['api', technologyValue('technology-graphql-aed31c'), 'event', 'ui', 'mcp']),
     passed: z.boolean(),
     reportPath: z.string().optional(),
     summary: z.string().optional(),
-});
+})
+    .strict();
+function canonicalize(value) {
+    if (value === null || typeof value === 'string' || typeof value === 'boolean') {
+        return JSON.stringify(typeof value === 'string' ? value.normalize('NFC') : value);
+    }
+    if (typeof value === 'number' && Number.isFinite(value)) {
+        return JSON.stringify(value);
+    }
+    if (Array.isArray(value)) {
+        return `[${value.map(canonicalize).join(',')}]`;
+    }
+    if (typeof value === 'object') {
+        const record = value;
+        const keys = Object.keys(record)
+            .filter((key) => key !== 'provenance')
+            .map((key) => ({ raw: key, normalized: key.normalize('NFC') }))
+            .sort((left, right) => left.normalized.localeCompare(right.normalized));
+        if (new Set(keys.map((key) => key.normalized)).size !== keys.length) {
+            throw new Error('[Planu] Evidence artifact has duplicate normalized keys');
+        }
+        return `{${keys
+            .map(({ raw, normalized }) => `${JSON.stringify(normalized)}:${canonicalize(record[raw])}`)
+            .join(',')}}`;
+    }
+    throw new Error('[Planu] Evidence artifact must be canonical JSON');
+}
+/** Digest of canonical artifact content; the provenance envelope is excluded. */
+export function evidenceArtifactDigest(artifact) {
+    return `sha256:${createHash('sha256').update(canonicalize(artifact)).digest('hex')}`;
+}
+export function evidenceArtifactCollectionDigest(artifacts) {
+    return evidenceArtifactDigest(artifacts
+        .map((artifact) => ({ kind: artifact.kind, digest: evidenceArtifactDigest(artifact) }))
+        .sort((left, right) => left.kind.localeCompare(right.kind)));
+}
+function safeRepositoryPath(path) {
+    const normalized = path.trim().replaceAll('\\', '/').replace(/^\.\//u, '');
+    return (normalized.length > 0 &&
+        !normalized.startsWith('/') &&
+        !/^[A-Za-z]:/u.test(normalized) &&
+        normalized
+            .split('/')
+            .every((segment) => segment.length > 0 && segment !== '.' && segment !== '..'));
+}
+function repositoryEvidencePathsAreCurrent(row, projectPath, additionalPaths = []) {
+    let repositoryRoot;
+    try {
+        repositoryRoot = realpathSync(projectPath);
+    }
+    catch {
+        return false;
+    }
+    const paths = [
+        ...row.changedFiles,
+        ...(row.testEvidence ?? []),
+        ...(row.contractEvidence ?? []),
+        ...additionalPaths,
+    ];
+    return (paths.length > 0 &&
+        paths.every((path) => {
+            if (!safeRepositoryPath(path)) {
+                return false;
+            }
+            const candidate = resolve(repositoryRoot, path);
+            try {
+                if (lstatSync(candidate).isSymbolicLink()) {
+                    return false;
+                }
+                const realPath = realpathSync(candidate);
+                const relativePath = relative(repositoryRoot, realPath);
+                return (relativePath.length > 0 &&
+                    relativePath.split(/[\\/]/u)[0] !== '..' &&
+                    !isAbsolute(relativePath));
+            }
+            catch {
+                return false;
+            }
+        }));
+}
+function isExecutableTestPath(path) {
+    return /(?:^|\/)[^/]+\.(?:test|spec)\.[cm]?[jt]sx?$/u.test(path.replaceAll('\\', '/'));
+}
+/** Verify legacy test-backed evidence without admitting prose-only traceability rows. */
+export function traceabilityRowHasCurrentTestEvidence(row, args) {
+    return (row.commandEvidence === undefined &&
+        row.changedFiles.length > 0 &&
+        (row.testEvidence?.length ?? 0) > 0 &&
+        row.testEvidence?.every(isExecutableTestPath) === true &&
+        Boolean(row.validationEvidence?.trim()) &&
+        Boolean(row.reviewerEvidence?.trim()) &&
+        repositoryEvidencePathsAreCurrent(row, args.projectPath));
+}
+/** Verify strict command evidence against current repository inputs and the validation ledger. */
+export function traceabilityRowHasCurrentCommandEvidence(row, args) {
+    const evidence = row.commandEvidence;
+    const expectedCommand = evidence
+        ? VALIDATION_COMMANDS[evidence.capability]
+        : undefined;
+    if (!evidence ||
+        !expectedCommand ||
+        normalizeValidationCommand(evidence.command) !== normalizeValidationCommand(expectedCommand)) {
+        return false;
+    }
+    const repositoryPaths = [...(evidence.relevantPaths ?? [])];
+    if (row.changedFiles.length === 0 ||
+        !repositoryEvidencePathsAreCurrent(row, args.projectPath, repositoryPaths) ||
+        evidence.scope.some((path) => !safeRepositoryPath(path))) {
+        return false;
+    }
+    const input = {
+        projectPath: args.projectPath,
+        capability: evidence.capability,
+        command: evidence.command,
+        scope: evidence.scope,
+        ...(evidence.relevantPaths === undefined ? {} : { relevantPaths: evidence.relevantPaths }),
+    };
+    const currentKey = computeValidationEvidenceKey(computeValidationEvidenceIdentity(input));
+    return (currentKey === evidence.evidenceKey &&
+        readMatchingValidationEvidence(args.projectId, input)?.status === 'passed');
+}
 const ARTIFACT_HINTS = {
     'Discovery evidence': 'Expected discovery.json with { version: 1, rules: string[], examples: [{ rule, example }], openQuestions: [{ question, status, resolution? }], outOfScope: string[], glossary: [{ term, meaning }] }.',
     'Task plan evidence': 'Expected task-plan.json with { version: 1, tasks: [{ id, title, acceptanceCriteria: string[], status: "pending"|"doing"|"done" }] }. Acceptance criteria may be full text or stable IDs such as AC1 when they map to the canonical criteria order.',
-    'Traceability matrix evidence': 'Expected traceability-matrix.json with { version: 1, rows: [{ acceptanceCriterion, scenario?, testEvidence?, contractEvidence?, manualEvidence?, changedFiles: string[], validationEvidence?, reviewerEvidence? }] }.',
+    'Traceability matrix evidence': 'Expected traceability-matrix.json with { version: 1, rows: [{ acceptanceCriterion, scenario?, testEvidence?, contractEvidence?, manualEvidence?, changedFiles: string[], validationEvidence?, reviewerEvidence?, commandEvidence?: { capability, command, scope, relevantPaths?, evidenceKey } }] }.',
     'contract-validation-api.json': 'Expected filename contract-validation-api.json with { version: 1, kind: "api", passed: boolean, reportPath?, summary? }.',
     'contract-validation-graphql.json': 'Expected filename contract-validation-graphql.json with { version: 1, kind: "graphql", passed: boolean, reportPath?, summary? }.',
     'contract-validation-event.json': 'Expected filename contract-validation-event.json with { version: 1, kind: "event", passed: boolean, reportPath?, summary? }.',
@@ -121,6 +303,17 @@ export async function readEvidenceArtifacts(args) {
         schema: TraceabilityMatrixSchema,
         paths: [handoffEvidencePath(args.projectId, args.specId, 'traceability-matrix.json')],
     });
+    const [discoveryProvenance, taskPlanProvenance, traceabilityProvenance, contractProvenance] = await Promise.all([
+        'discovery.provenance.json',
+        'task-plan.provenance.json',
+        'traceability-matrix.provenance.json',
+        'contract-validation.provenance.json',
+    ].map((filename) => readOptional({
+        label: filename,
+        invalidArtifacts,
+        schema: ProvenanceSchema,
+        paths: [handoffEvidencePath(args.projectId, args.specId, filename)],
+    })));
     const contractValidations = [];
     for (const filename of [
         'contract-validation-api.json',
@@ -136,13 +329,17 @@ export async function readEvidenceArtifacts(args) {
             paths: [handoffEvidencePath(args.projectId, args.specId, filename)],
         });
         if (evidence) {
-            contractValidations.push(evidence);
+            contractValidations.push(contractProvenance ? { ...evidence, provenance: contractProvenance } : evidence);
         }
     }
     return {
-        discovery,
-        taskPlan,
-        traceabilityMatrix,
+        discovery: discovery && discoveryProvenance
+            ? { ...discovery, provenance: discoveryProvenance }
+            : discovery,
+        taskPlan: taskPlan && taskPlanProvenance ? { ...taskPlan, provenance: taskPlanProvenance } : taskPlan,
+        traceabilityMatrix: traceabilityMatrix && traceabilityProvenance
+            ? { ...traceabilityMatrix, provenance: traceabilityProvenance }
+            : traceabilityMatrix,
         contractValidations,
         invalidArtifacts,
     };

package/dist/engine/evidence-gates/lifecycle-gate.d.ts

@@ -1,5 +1,5 @@
 import type { Spec } from '../../types/spec/core.js';
-import type { ContractValidationEvidence, EvidenceArtifacts, EvidenceGateIssue, EvidenceGateResult, EvidenceGateTransition } from '../../types/evidence-gates.js';
+import type { ContractValidationEvidence, EvidenceArtifacts, EvidenceGateIssue, EvidenceGateResult, EvidenceReceiptContext, EvidenceGateTransition } from '../../types/evidence-gates.js';
 export declare function inferRequiredContractEvidence(spec: Spec, criteria: string[]): ContractValidationEvidence['kind'][];
 export declare function checkDiscoveryGate(spec: Spec, artifacts: EvidenceArtifacts): EvidenceGateIssue[];
 export declare function checkTaskPlanGate(spec: Spec, criteria: string[], artifacts: EvidenceArtifacts): EvidenceGateIssue[];
@@ -9,5 +9,6 @@ export declare function checkLifecycleEvidenceGate(args: {
     spec: Spec;
     criteria: string[];
     artifacts: EvidenceArtifacts;
+    receiptContext?: EvidenceReceiptContext;
 }): EvidenceGateResult;
 //# sourceMappingURL=lifecycle-gate.d.ts.map

package/dist/engine/evidence-gates/lifecycle-gate.js

@@ -1,4 +1,5 @@
-import { hasAnyAffirmedMatch } from '../text-signal-boundaries.js';
+import { evidenceArtifactCollectionDigest, evidenceArtifactDigest } from './artifact-reader.js';
+import { hasAnyAffirmedMatch, stripMetaAnalysisText, stripNonContractText, } from '../text-signal-boundaries.js';
 import { createCriterionIdentity } from '../criterion-identity.js';
 const CONTRACT_HINTS = {
     api: [
@@ -9,7 +10,8 @@ const CONTRACT_HINTS = {
     ],
     graphql: [/\b(?:graphql|gql)\s+(?:api|schema|resolver|contract)\b/i, /\bschema\.graphql\b/i],
     event: [
-        /\b(?:event|message)\s+(?:contract|schema|producer|consumer|handler|queue|topic)\b/i,
+        /\bevent\s+(?:contract|schema|producer|consumer|handler|queue|topic)\b/i,
+        /\bmessage\s+(?:schema|producer|consumer|handler|queue|topic)\b/i,
         /\b(?:message\s+broker|kafka|rabbitmq|pubsub|webhook\s+(?:delivery|contract|payload))\b/i,
     ],
     ui: [/\b(?:ui|component|screen|design)\s+contract\b/i],
@@ -24,8 +26,58 @@ function isNonTrivial(spec) {
 function hasText(value) {
     return value !== undefined && value.trim().length > 0;
 }
+function provenanceIssues(artifacts, context) {
+    const receipt = context.receipt;
+    const candidates = [];
+    if (artifacts.discovery) {
+        candidates.push({
+            label: 'discovery',
+            artifact: artifacts.discovery,
+            expectedDigest: receipt.bindings.artifactDigests.discovery,
+        });
+    }
+    if (artifacts.taskPlan) {
+        candidates.push({
+            label: 'task plan',
+            artifact: artifacts.taskPlan,
+            expectedDigest: receipt.bindings.artifactDigests.taskPlan,
+        });
+    }
+    if (artifacts.traceabilityMatrix) {
+        candidates.push({
+            label: 'traceability matrix',
+            artifact: artifacts.traceabilityMatrix,
+            expectedDigest: receipt.bindings.artifactDigests.traceability,
+        });
+    }
+    for (const artifact of artifacts.contractValidations.slice(0, 1)) {
+        candidates.push({
+            label: 'contract validation collection',
+            artifact,
+            expectedDigest: receipt.bindings.artifactDigests.contractValidation,
+            actualDigest: evidenceArtifactCollectionDigest(artifacts.contractValidations),
+        });
+    }
+    return candidates.flatMap(({ label, artifact, expectedDigest, actualDigest }) => {
+        const provenance = artifact.provenance;
+        const observedDigest = actualDigest ?? evidenceArtifactDigest(artifact);
+        const valid = provenance?.receiptId === receipt.receiptId &&
+            provenance.specId === receipt.bindings.specId &&
+            provenance.issuerId === receipt.issuer &&
+            provenance.artifactDigest === observedDigest &&
+            provenance.artifactDigest === expectedDigest;
+        return valid
+            ? []
+            : [
+                {
+                    code: 'evidence_provenance_invalid',
+                    message: `${label} is not bound to the current Planu validation receipt.`,
+                },
+            ];
+    });
+}
 export function inferRequiredContractEvidence(spec, criteria) {
-    const text = `${spec.title} ${spec.tags.join(' ')} ${criteria.join(' ')}`;
+    const text = stripMetaAnalysisText(stripNonContractText([spec.title, ...spec.tags, ...criteria].join('\n')));
     const required = [];
     for (const [kind, patterns] of Object.entries(CONTRACT_HINTS)) {
         if (hasAnyAffirmedMatch(text, [...patterns])) {
@@ -158,6 +210,9 @@ export function checkLifecycleEvidenceGate(args) {
         code: 'evidence_artifact_invalid',
         message: artifact,
     }));
+    if (args.receiptContext) {
+        issues.push(...provenanceIssues(args.artifacts, args.receiptContext));
+    }
     if (args.transition === 'approved') {
         issues.push(...checkDiscoveryGate(args.spec, args.artifacts));
     }

package/dist/engine/evidence-gates/reconciliation-freshness.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Returns only project-relative IDs. Old evidence is rejected cumulatively: a
+ * later receipt cannot revive a digest superseded by an earlier receipt.
+ */
+export declare function checkReconciliationFreshness(args: {
+    projectId: string;
+    specId: string;
+}): Promise<{
+    artifactId: string;
+}[]>;
+//# sourceMappingURL=reconciliation-freshness.d.ts.map

package/dist/engine/evidence-gates/reconciliation-freshness.js

@@ -0,0 +1,72 @@
+import { createHash } from 'node:crypto';
+import { lstat, readFile, readdir } from 'node:fs/promises';
+import { join } from 'node:path';
+import { projectDataDir } from '../../storage/base-store.js';
+import { readCommittedReconciliations } from '../lifecycle-reconciliation.js';
+const BASE_ARTIFACTS = [
+    'spec.lock.json',
+    'review_feedback.md',
+    'task-plan.json',
+    'implementation-report.json',
+    'validation-report.json',
+    'traceability-matrix.json',
+    'context-package.json',
+];
+function sha256(bytes) {
+    return `sha256:${createHash('sha256').update(bytes).digest('hex')}`;
+}
+/**
+ * Returns only project-relative IDs. Old evidence is rejected cumulatively: a
+ * later receipt cannot revive a digest superseded by an earlier receipt.
+ */
+export async function checkReconciliationFreshness(args) {
+    const receipts = await readCommittedReconciliations(args.projectId, args.specId);
+    const tombstones = new Set(receipts.flatMap((receipt) => receipt.supersededArtifacts.flatMap((artifact) => artifact.sha256 ? [`${artifact.artifactId}\0${artifact.sha256}`] : [])));
+    if (tombstones.size === 0) {
+        return [];
+    }
+    const root = projectDataDir(args.projectId);
+    const handoff = join(root, 'handoffs', args.specId);
+    const candidates = [
+        ...BASE_ARTIFACTS.map((name) => ({
+            artifactId: `handoffs/${args.specId}/${name}`,
+            path: join(handoff, name),
+        })),
+        { artifactId: `handoffs/${args.specId}.md`, path: join(root, 'handoffs', `${args.specId}.md`) },
+    ];
+    try {
+        const names = await readdir(handoff);
+        for (const artifactName of names) {
+            if (/^contract-validation-[A-Za-z0-9_-]+\.json$/u.test(artifactName)) {
+                candidates.push({
+                    artifactId: `handoffs/${args.specId}/${artifactName}`,
+                    path: join(handoff, artifactName),
+                });
+            }
+        }
+    }
+    catch (error) {
+        if (!(error instanceof Error && 'code' in error && error.code === 'ENOENT')) {
+            throw error;
+        }
+    }
+    const stale = [];
+    for (const candidate of candidates) {
+        try {
+            const stat = await lstat(candidate.path);
+            if (stat.isSymbolicLink() || !stat.isFile()) {
+                continue;
+            }
+            if (tombstones.has(`${candidate.artifactId}\0${sha256(await readFile(candidate.path))}`)) {
+                stale.push({ artifactId: candidate.artifactId });
+            }
+        }
+        catch (error) {
+            if (!(error instanceof Error && 'code' in error && error.code === 'ENOENT')) {
+                throw error;
+            }
+        }
+    }
+    return stale;
+}
+//# sourceMappingURL=reconciliation-freshness.js.map

package/dist/engine/evidence-index/done-drift.d.ts

@@ -1,6 +1,6 @@
 import type { EvidenceGateIssue, SpecEvidenceIndex } from '../../types/index.js';
 export declare function checkDoneDriftContract(args: {
     index: SpecEvidenceIndex;
-    groundedTechnicalPaths: readonly string[];
+    approvedScopePaths: readonly string[];
 }): EvidenceGateIssue[];
 //# sourceMappingURL=done-drift.d.ts.map

package/dist/engine/evidence-index/done-drift.js

@@ -1,3 +1,8 @@
+import { normalizeChangedFilePath } from '../handoff-packager.js';
+function normalizedChangedFile(value) {
+    const normalized = normalizeChangedFilePath(value);
+    return normalized.status === 'valid' ? normalized.path : null;
+}
 export function checkDoneDriftContract(args) {
     const issues = [];
     const uncovered = args.index.criteria.filter((entry) => {
@@ -14,33 +19,50 @@ export function checkDoneDriftContract(args) {
     }
     const staleOrInvalid = args.index.criteria.flatMap((entry) => entry.evidence
         .filter((record) => record.status === 'stale' || record.status === 'invalid')
-        .map((record) => `${entry.criterion}: ${record.value} (${record.status})`));
+        .map((record) => {
+        if (record.kind !== 'changed-file') {
+            return `${entry.criterion}: ${record.value} (${record.status})`;
+        }
+        const normalized = normalizedChangedFile(record.value);
+        return normalized
+            ? `${entry.criterion}: ${normalized} (${record.status})`
+            : `${entry.criterion}: invalid changed-file (${record.status})`;
+    }));
     if (staleOrInvalid.length > 0) {
         issues.push({
             code: 'done_drift_stale_evidence',
             message: `Done drift check found stale or invalid evidence: ${staleOrInvalid.join('; ')}`,
         });
     }
-    const grounded = new Set(args.groundedTechnicalPaths);
-    if (grounded.size > 0) {
-        const unapproved = args.index.criteria.flatMap((entry) => {
-            const hasScopeAmendment = entry.evidence.some((record) => record.kind === 'reviewer' && /scope amendment|approved scope/i.test(record.value));
-            if (hasScopeAmendment) {
+    const approvedScopePaths = args.approvedScopePaths.flatMap((path) => {
+        const normalized = normalizedChangedFile(path);
+        return normalized ? [normalized] : [];
+    });
+    const approved = new Set(approvedScopePaths);
+    const unapproved = args.index.criteria.flatMap((entry) => {
+        const hasScopeAmendment = entry.evidence.some((record) => record.kind === 'reviewer' && /scope amendment|approved scope/i.test(record.value));
+        if (hasScopeAmendment) {
+            return [];
+        }
+        return entry.evidence.flatMap((record) => {
+            if (record.kind !== 'changed-file' ||
+                (record.status !== 'valid' && record.status !== 'missing')) {
                 return [];
             }
-            return entry.evidence
-                .filter((record) => record.kind === 'changed-file' && !grounded.has(record.value))
-                .map((record) => `${entry.criterion}: ${record.value}`);
+            const normalized = normalizedChangedFile(record.value);
+            return normalized && approved.has(normalized)
+                ? []
+                : [`${entry.criterion}: ${normalized ?? 'invalid changed-file path'}`];
+        });
+    });
+    if (unapproved.length > 0) {
+        const approvedHint = approvedScopePaths.length > 0
+            ? ` Approved canonical paths: ${approvedScopePaths.join(', ')}.`
+            : ' No approved canonical paths were found in the approved spec.';
+        issues.push({
+            code: 'done_drift_unapproved_scope',
+            message: `Done drift check found changed files outside approved canonical scope: ${unapproved.join('; ')}.${approvedHint} Add the file to approved canonical ownership or include reviewerEvidence with an approved scope amendment.`,
         });
-        if (unapproved.length > 0) {
-            const groundedHint = args.groundedTechnicalPaths.length > 0
-                ? ` Grounded technical paths: ${args.groundedTechnicalPaths.join(', ')}.`
-                : ' No grounded technical paths were found in the approved spec.';
-            issues.push({
-                code: 'done_drift_unapproved_scope',
-                message: `Done drift check found changed files outside grounded spec scope: ${unapproved.join('; ')}.${groundedHint} Add the file to approved technical references or include reviewerEvidence with an approved scope amendment.`,
-            });
-        }
     }
     return issues;
 }

package/dist/engine/execution/context.d.ts

@@ -0,0 +1,19 @@
+import type { CancellationScope, CreateExecutionScopeOptions, RequestExecutionContext, RequestExecutionScope } from '../../types/execution.js';
+export declare class ExecutionCancelledError extends Error {
+    readonly code = "EXECUTION_CANCELLED";
+    constructor(message?: string);
+}
+export declare function getExecutionContext(): RequestExecutionContext | undefined;
+export declare function getExecutionSignal(): AbortSignal | undefined;
+export declare function remainingExecutionMs(): number;
+/**
+ * Must be called immediately before a mutation crosses its commit boundary.
+ * AsyncLocalStorage keeps the cancelled state visible to work that outlives its
+ * request, so abandoned handlers cannot commit after acknowledgement.
+ */
+export declare function assertExecutionCanCommit(signal?: AbortSignal): void;
+export declare function guardExecutionCommit<T>(commit: () => Promise<T>): Promise<T>;
+export declare function createExecutionScope(options: CreateExecutionScopeOptions): RequestExecutionScope;
+/** Creates a child cancellation node whose deadline never exceeds its parent. */
+export declare function createChildCancellationScope(requestedMs: number): CancellationScope;
+//# sourceMappingURL=context.d.ts.map