@planu/cli 4.13.0 → 5.0.0

package/dist/engine/validation/validation-source-policy.js

@@ -0,0 +1,16 @@
+/** Generated/runtime roots are not validation source, even when accidentally tracked. */
+export const SOURCE_IGNORED_ROOTS = new Set([
+    '.git',
+    '.next',
+    '.turbo',
+    'build',
+    'coverage',
+    'dist',
+    'node_modules',
+]);
+export function isValidationSourcePath(path) {
+    const normalized = path.replaceAll('\\', '/').normalize('NFC');
+    const root = normalized.split('/')[0];
+    return root !== undefined && !SOURCE_IGNORED_ROOTS.has(root);
+}
+//# sourceMappingURL=validation-source-policy.js.map

package/dist/engine/validation/validation-submission.d.ts

@@ -0,0 +1,37 @@
+import type { DurableJobRuntime } from '../execution/job-runtime.js';
+import type { DurableJobRecord } from '../../storage/runtime-db.js';
+import type { DurableValidationBindings } from '../../types/durable-validation.js';
+import type { ValidationArtifactDigests, ValidationFreshnessLease } from '../../types/validation-receipt.js';
+/** Stable identity for exactly one immutable validation input tuple. */
+export declare function validationOperationId(bindings: DurableValidationBindings, validationRootId: string): string;
+/** Stable identity used to acknowledge before repository-wide bindings are computed. */
+export declare function validationSubmissionOperationId(projectId: string, specId: string, validationRootId: string): string;
+/** Accept one pre-bound durable validation for internal and compatibility callers. */
+export declare function createValidationSubmission(input: {
+    readonly runtime: DurableJobRuntime;
+    readonly canonicalProjectId: string;
+    readonly spec: {
+        readonly id: string;
+        readonly projectId?: string;
+        readonly specPath?: string;
+        readonly projectPath?: string;
+        readonly validationRootId: string;
+    };
+    readonly bindings: DurableValidationBindings;
+    readonly artifactDigests?: ValidationArtifactDigests;
+    readonly freshnessLease?: ValidationFreshnessLease;
+    readonly deadlineAt: number;
+}): DurableJobRecord;
+/** Persist validation immediately; the worker computes and binds the source snapshot. */
+export declare function createPendingValidationSubmission(input: {
+    readonly runtime: DurableJobRuntime;
+    readonly canonicalProjectId: string;
+    readonly spec: {
+        readonly id: string;
+        readonly specPath: string;
+        readonly projectPath: string;
+        readonly validationRootId: string;
+    };
+    readonly deadlineAt: number;
+}): DurableJobRecord;
+//# sourceMappingURL=validation-submission.d.ts.map

package/dist/engine/validation/validation-submission.js

@@ -0,0 +1,142 @@
+import { createHash } from 'node:crypto';
+import { DIGEST, PROJECT_ID as CANONICAL_PROJECT_ID, SPEC_ID as CANONICAL_SPEC_ID, } from './validation-receipt-codec.js';
+import { isValidationRootId } from './validation-worktree.js';
+function assertBindings(bindings) {
+    if (!CANONICAL_PROJECT_ID.test(bindings.projectId)) {
+        throw new Error('[Planu] Durable validation requires a canonical projectId');
+    }
+    if (!CANONICAL_SPEC_ID.test(bindings.specId)) {
+        throw new Error('[Planu] Durable validation requires a valid specId');
+    }
+    if (![
+        bindings.sourceTreeHash,
+        bindings.specHash,
+        bindings.policyHash,
+        bindings.toolchainHash,
+    ].every((value) => DIGEST.test(value))) {
+        throw new Error('[Planu] Durable validation requires four sha256 bindings');
+    }
+}
+/** Stable identity for exactly one immutable validation input tuple. */
+export function validationOperationId(bindings, validationRootId) {
+    assertBindings(bindings);
+    if (!isValidationRootId(validationRootId)) {
+        throw new Error('[Planu] Durable validation requires a valid validationRootId');
+    }
+    const operationDigest = createHash('sha256')
+        .update(JSON.stringify([
+        'planu-validation-v2',
+        validationRootId,
+        bindings.projectId,
+        bindings.specId,
+        bindings.sourceTreeHash,
+        bindings.specHash,
+        bindings.policyHash,
+        bindings.toolchainHash,
+    ]))
+        .digest('hex');
+    return `validation-${operationDigest}`;
+}
+/** Stable identity used to acknowledge before repository-wide bindings are computed. */
+export function validationSubmissionOperationId(projectId, specId, validationRootId) {
+    if (!CANONICAL_PROJECT_ID.test(projectId) ||
+        !CANONICAL_SPEC_ID.test(specId) ||
+        !isValidationRootId(validationRootId)) {
+        throw new Error('[Planu] Invalid durable validation submission identity');
+    }
+    const operationDigest = createHash('sha256')
+        .update(JSON.stringify(['planu-validation-submission-v2', projectId, specId, validationRootId]))
+        .digest('hex');
+    return `validation-${operationDigest}`;
+}
+function existingOrAccept(input) {
+    try {
+        const existing = input.runtime.get({
+            operationId: input.operationId,
+            projectId: input.projectId,
+        });
+        return ['completed', 'failed', 'dead-letter', 'cancelled'].includes(existing.state)
+            ? input.runtime.restartWithPayload({
+                operationId: input.operationId,
+                projectId: input.projectId,
+                payload: input.payload,
+            })
+            : existing;
+    }
+    catch (error) {
+        if (!(error instanceof Error) || error.name !== 'DurableJobNotFoundError') {
+            throw error;
+        }
+    }
+    return input.runtime.accept({
+        projectId: input.projectId,
+        operationId: input.operationId,
+        payload: input.payload,
+    });
+}
+/** Accept one pre-bound durable validation for internal and compatibility callers. */
+export function createValidationSubmission(input) {
+    assertBindings(input.bindings);
+    if (!isValidationRootId(input.spec.validationRootId) || !input.spec.specPath) {
+        throw new Error('[Planu] Durable validation requires a verified validation root and spec path');
+    }
+    if (input.canonicalProjectId !== input.bindings.projectId ||
+        input.spec.id !== input.bindings.specId) {
+        throw new Error('[Planu] Durable validation binding identity mismatch');
+    }
+    if (!Number.isSafeInteger(input.deadlineAt) || input.deadlineAt <= Date.now()) {
+        throw new Error('[Planu] Durable validation requires a future absolute deadline');
+    }
+    const payload = {
+        kind: 'validate',
+        schemaVersion: 2,
+        validationRootId: input.spec.validationRootId,
+        input: {
+            specId: input.spec.id,
+            projectId: input.canonicalProjectId,
+            ...(input.spec.projectPath === undefined ? {} : { projectPath: input.spec.projectPath }),
+        },
+        bindings: input.bindings,
+        ...(input.artifactDigests === undefined ? {} : { artifactDigests: input.artifactDigests }),
+        ...(input.freshnessLease === undefined ? {} : { freshnessLease: input.freshnessLease }),
+        specPath: input.spec.specPath ?? '',
+        deadlineAt: input.deadlineAt,
+    };
+    return existingOrAccept({
+        runtime: input.runtime,
+        projectId: input.canonicalProjectId,
+        operationId: validationOperationId(input.bindings, input.spec.validationRootId),
+        payload,
+    });
+}
+/** Persist validation immediately; the worker computes and binds the source snapshot. */
+export function createPendingValidationSubmission(input) {
+    if (!CANONICAL_PROJECT_ID.test(input.canonicalProjectId) ||
+        !CANONICAL_SPEC_ID.test(input.spec.id) ||
+        !isValidationRootId(input.spec.validationRootId) ||
+        !input.spec.specPath) {
+        throw new Error('[Planu] Invalid durable validation submission identity');
+    }
+    if (!Number.isSafeInteger(input.deadlineAt) || input.deadlineAt <= Date.now()) {
+        throw new Error('[Planu] Durable validation requires a future absolute deadline');
+    }
+    const payload = {
+        kind: 'validate',
+        schemaVersion: 2,
+        validationRootId: input.spec.validationRootId,
+        input: {
+            specId: input.spec.id,
+            projectId: input.canonicalProjectId,
+            projectPath: input.spec.projectPath,
+        },
+        specPath: input.spec.specPath,
+        deadlineAt: input.deadlineAt,
+    };
+    return existingOrAccept({
+        runtime: input.runtime,
+        projectId: input.canonicalProjectId,
+        operationId: validationSubmissionOperationId(input.canonicalProjectId, input.spec.id, input.spec.validationRootId),
+        payload,
+    });
+}
+//# sourceMappingURL=validation-submission.js.map

package/dist/engine/validation/validation-worktree.d.ts

@@ -0,0 +1,21 @@
+import type { ResolvedValidationWorktree, ValidationWorktreeErrorCode } from '../../types/durable-validation.js';
+export declare class ValidationWorktreeError extends Error {
+    readonly code: ValidationWorktreeErrorCode;
+    readonly specId: string;
+    readonly relativeSpecPath?: string;
+    constructor(code: ValidationWorktreeErrorCode, specId: string, relativeSpecPath?: string);
+}
+export declare function resolveValidationWorktree(input: {
+    requestedProjectPath: string;
+    canonicalProjectPath: string;
+    canonicalSpecPath: string;
+    specId: string;
+}): Promise<ResolvedValidationWorktree>;
+export declare function revalidateValidationWorktree(input: {
+    projectPath: string;
+    specPath: string;
+    specId: string;
+    validationRootId: string;
+}): Promise<ResolvedValidationWorktree>;
+export declare function isValidationRootId(value: unknown): value is string;
+//# sourceMappingURL=validation-worktree.d.ts.map

package/dist/engine/validation/validation-worktree.js

@@ -0,0 +1,260 @@
+import { execFile } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { lstat, readFile, realpath } from 'node:fs/promises';
+import { basename, dirname, isAbsolute, relative, resolve, sep } from 'node:path';
+import { promisify } from 'node:util';
+import { reportClassifiedDegradation } from '../../errors/classified-degradation.js';
+import { parseFrontmatter } from '../frontmatter-parser.js';
+const runFile = promisify(execFile);
+const ROOT_ID = /^[a-f0-9]{64}$/u;
+const SAFE_SPEC_ID = /^SPEC-[1-9]\d*$/u;
+const PORTABLE_SPEC = /^planu\/specs\/(SPEC-\d{3,}(?:-[^/]+)?)\/spec\.md$/u;
+export class ValidationWorktreeError extends Error {
+    code;
+    specId;
+    relativeSpecPath;
+    constructor(code, specId, relativeSpecPath) {
+        const safeSpecId = SAFE_SPEC_ID.test(specId) ? specId : 'SPEC-unknown';
+        const safeRelativeSpecPath = relativeSpecPath !== undefined && PORTABLE_SPEC.test(relativeSpecPath)
+            ? relativeSpecPath
+            : undefined;
+        super(`[Planu] ${code} spec=${safeSpecId}${safeRelativeSpecPath ? ` path=${safeRelativeSpecPath}` : ''}`);
+        this.code = code;
+        this.name = 'ValidationWorktreeError';
+        this.specId = safeSpecId;
+        this.relativeSpecPath = safeRelativeSpecPath;
+    }
+}
+function fail(code, specId, relativeSpecPath) {
+    throw new ValidationWorktreeError(code, specId, relativeSpecPath);
+}
+function isEnoent(error) {
+    return error.code === 'ENOENT';
+}
+async function gitPath(projectPath, argument) {
+    try {
+        const result = await runFile('git', ['-C', projectPath, 'rev-parse', argument], {
+            encoding: 'utf8',
+            timeout: 10_000,
+            maxBuffer: 64 * 1024,
+        });
+        const output = result.stdout.trim();
+        return await realpath(isAbsolute(output) ? output : resolve(projectPath, output));
+    }
+    catch (error) {
+        reportClassifiedDegradation('VALIDATION_GIT_PATH_PROBE', error);
+        return null;
+    }
+}
+async function resolveGitMembership(projectPath, specId) {
+    let requestedRoot;
+    try {
+        requestedRoot = await realpath(projectPath);
+    }
+    catch (error) {
+        reportClassifiedDegradation('VALIDATION_ROOT_REALPATH', error);
+    }
+    if (requestedRoot === undefined) {
+        fail('VALIDATION_ROOT_NOT_GIT_WORKTREE', specId);
+    }
+    const [topLevel, commonDir] = await Promise.all([
+        gitPath(requestedRoot, '--show-toplevel'),
+        gitPath(requestedRoot, '--git-common-dir'),
+    ]);
+    if (topLevel === null || commonDir === null) {
+        fail('VALIDATION_ROOT_NOT_GIT_WORKTREE', specId);
+    }
+    return { projectPath: topLevel, gitCommonDir: commonDir };
+}
+async function resolveGitRoot(projectPath, specId) {
+    let requestedRoot;
+    try {
+        requestedRoot = await realpath(projectPath);
+    }
+    catch (error) {
+        reportClassifiedDegradation('VALIDATION_ROOT_REALPATH', error);
+    }
+    if (requestedRoot === undefined) {
+        fail('VALIDATION_ROOT_NOT_GIT_WORKTREE', specId);
+    }
+    const membership = await resolveGitMembership(requestedRoot, specId);
+    if (membership.projectPath !== requestedRoot) {
+        fail('VALIDATION_ROOT_NOT_GIT_WORKTREE', specId);
+    }
+    return membership;
+}
+async function resolveSpecSourceRoot(input) {
+    const specPath = isAbsolute(input.canonicalSpecPath)
+        ? input.canonicalSpecPath
+        : resolve(input.canonical.projectPath, input.canonicalSpecPath);
+    let source;
+    try {
+        source = await resolveGitMembership(dirname(specPath), input.specId);
+    }
+    catch {
+        throw new ValidationWorktreeError('VALIDATION_SPEC_PATH_TRAVERSAL', input.specId);
+    }
+    if (source.gitCommonDir !== input.canonical.gitCommonDir) {
+        fail('VALIDATION_COMMON_DIR_MISMATCH', input.specId);
+    }
+    return { projectPath: source.projectPath, specPath };
+}
+async function portableSpecPath(projectPath, submittedSpecPath, specId) {
+    const candidate = isAbsolute(submittedSpecPath)
+        ? submittedSpecPath
+        : resolve(projectPath, submittedSpecPath);
+    let stats;
+    try {
+        stats = await lstat(candidate);
+    }
+    catch (error) {
+        if (!isEnoent(error)) {
+            reportClassifiedDegradation('VALIDATION_SPEC_STAT_FAILED', error);
+        }
+    }
+    if (stats === undefined) {
+        const normalizedMissingPath = await resolveFromExistingAncestor(candidate);
+        if (!contained(projectPath, normalizedMissingPath)) {
+            fail('VALIDATION_SPEC_PATH_TRAVERSAL', specId);
+        }
+        fail('VALIDATION_SPEC_NOT_FOUND', specId);
+    }
+    if (stats.isSymbolicLink()) {
+        fail('VALIDATION_SPEC_PATH_SYMLINK', specId);
+    }
+    let canonicalPath;
+    try {
+        canonicalPath = await realpath(candidate);
+    }
+    catch (error) {
+        reportClassifiedDegradation('VALIDATION_SPEC_REALPATH_FAILED', error);
+    }
+    if (canonicalPath === undefined || !contained(projectPath, canonicalPath)) {
+        fail('VALIDATION_SPEC_PATH_TRAVERSAL', specId);
+    }
+    const portablePath = relative(projectPath, canonicalPath).replaceAll('\\', '/');
+    const match = PORTABLE_SPEC.exec(portablePath);
+    if (!match?.[1] || (match[1] !== specId && !match[1].startsWith(`${specId}-`))) {
+        fail('VALIDATION_SPEC_PATH_TRAVERSAL', specId);
+    }
+    return portablePath;
+}
+function contained(root, candidate) {
+    const path = relative(root, candidate);
+    return path.length > 0 && path !== '..' && !path.startsWith(`..${sep}`) && !isAbsolute(path);
+}
+async function resolveFromExistingAncestor(candidate) {
+    const suffix = [];
+    let cursor = candidate;
+    for (;;) {
+        let resolvedAncestor;
+        try {
+            resolvedAncestor = await realpath(cursor);
+        }
+        catch (error) {
+            if (!isEnoent(error)) {
+                reportClassifiedDegradation('VALIDATION_ANCESTOR_REALPATH_FAILED', error);
+            }
+        }
+        if (resolvedAncestor !== undefined) {
+            return resolve(resolvedAncestor, ...suffix.reverse());
+        }
+        const parent = dirname(cursor);
+        if (parent === cursor) {
+            return candidate;
+        }
+        suffix.push(basename(cursor));
+        cursor = parent;
+    }
+}
+async function resolveSpec(projectPath, relativeSpecPath, specId) {
+    const candidate = resolve(projectPath, relativeSpecPath);
+    if (!contained(projectPath, candidate)) {
+        fail('VALIDATION_SPEC_PATH_TRAVERSAL', specId, relativeSpecPath);
+    }
+    let stats;
+    try {
+        stats = await lstat(candidate);
+    }
+    catch (error) {
+        if (!isEnoent(error)) {
+            reportClassifiedDegradation('VALIDATION_SPEC_STAT_FAILED', error);
+        }
+    }
+    if (stats === undefined) {
+        fail('VALIDATION_SPEC_NOT_FOUND', specId, relativeSpecPath);
+    }
+    if (stats.isSymbolicLink()) {
+        fail('VALIDATION_SPEC_PATH_SYMLINK', specId, relativeSpecPath);
+    }
+    if (!stats.isFile()) {
+        fail('VALIDATION_SPEC_NOT_FOUND', specId, relativeSpecPath);
+    }
+    let specPath;
+    try {
+        specPath = await realpath(candidate);
+    }
+    catch (error) {
+        reportClassifiedDegradation('VALIDATION_SPEC_REALPATH_FAILED', error);
+    }
+    if (specPath === undefined || !contained(projectPath, specPath)) {
+        fail('VALIDATION_SPEC_PATH_TRAVERSAL', specId, relativeSpecPath);
+    }
+    let content;
+    try {
+        content = await readFile(specPath, 'utf8');
+    }
+    catch (error) {
+        if (!isEnoent(error)) {
+            reportClassifiedDegradation('VALIDATION_SPEC_READ_FAILED', error);
+        }
+    }
+    const parsedId = content === undefined ? undefined : parseFrontmatter(content).metadata.id;
+    if (parsedId !== specId) {
+        fail('VALIDATION_SPEC_ID_MISMATCH', specId, relativeSpecPath);
+    }
+    return { specPath, relativeSpecPath };
+}
+function buildValidationRootId(projectPath, gitCommonDir) {
+    return createHash('sha256')
+        .update(`validation-root/v1\0${projectPath}\0${gitCommonDir}`)
+        .digest('hex');
+}
+export async function resolveValidationWorktree(input) {
+    const [requested, canonical] = await Promise.all([
+        resolveGitRoot(input.requestedProjectPath, input.specId),
+        resolveGitRoot(input.canonicalProjectPath, input.specId),
+    ]);
+    if (requested.gitCommonDir !== canonical.gitCommonDir) {
+        fail('VALIDATION_COMMON_DIR_MISMATCH', input.specId);
+    }
+    const source = await resolveSpecSourceRoot({
+        canonical,
+        canonicalSpecPath: input.canonicalSpecPath,
+        specId: input.specId,
+    });
+    const relativeSpecPath = await portableSpecPath(source.projectPath, source.specPath, input.specId);
+    const spec = await resolveSpec(requested.projectPath, relativeSpecPath, input.specId);
+    return {
+        ...requested,
+        ...spec,
+        validationRootId: buildValidationRootId(requested.projectPath, requested.gitCommonDir),
+    };
+}
+export async function revalidateValidationWorktree(input) {
+    if (!ROOT_ID.test(input.validationRootId)) {
+        fail('VALIDATION_ROOT_ID_MALFORMED', input.specId);
+    }
+    const root = await resolveGitRoot(input.projectPath, input.specId);
+    const relativeSpecPath = await portableSpecPath(root.projectPath, input.specPath, input.specId);
+    const spec = await resolveSpec(root.projectPath, relativeSpecPath, input.specId);
+    const observedRootId = buildValidationRootId(root.projectPath, root.gitCommonDir);
+    if (observedRootId !== input.validationRootId) {
+        fail('VALIDATION_ROOT_ID_MISMATCH', input.specId, spec.relativeSpecPath);
+    }
+    return { ...root, ...spec, validationRootId: observedRootId };
+}
+export function isValidationRootId(value) {
+    return typeof value === 'string' && ROOT_ID.test(value);
+}
+//# sourceMappingURL=validation-worktree.js.map

package/dist/engine/validation-evidence-ledger.js

@@ -11,6 +11,10 @@ const LOCK_PATHS = {
     lint: PACKAGE_LOCKS,
     'test-related': PACKAGE_LOCKS,
     'test-full': PACKAGE_LOCKS,
+    contract: PACKAGE_LOCKS,
+    coverage: PACKAGE_LOCKS,
+    migration: PACKAGE_LOCKS,
+    'fault-injection': [...PACKAGE_LOCKS, 'Cargo.lock'],
     security: [...PACKAGE_LOCKS, 'Cargo.lock'],
     native: [...PACKAGE_LOCKS, 'Cargo.lock'],
     website: PACKAGE_LOCKS,
@@ -21,6 +25,16 @@ const CONFIG_PATHS = {
     lint: ['package.json', 'eslint.config.js', 'eslint.config.mjs', 'eslint.config.cjs'],
     'test-related': ['package.json', 'vitest.config.ts', 'vitest.config.mts', 'vitest.config.js'],
     'test-full': ['package.json', 'vitest.config.ts', 'vitest.config.mts', 'vitest.config.js'],
+    contract: ['package.json', 'vitest.config.ts', 'vitest.config.mts', 'vitest.config.js'],
+    coverage: ['package.json', 'vitest.config.ts', 'vitest.config.mts', 'vitest.config.js'],
+    migration: ['package.json', 'vitest.config.ts', 'vitest.config.mts', 'vitest.config.js'],
+    'fault-injection': [
+        'package.json',
+        'vitest.config.ts',
+        'vitest.config.mts',
+        'vitest.config.js',
+        'Cargo.toml',
+    ],
     security: ['package.json', 'pnpm-workspace.yaml', 'Cargo.toml'],
     native: ['package.json', 'pnpm-workspace.yaml', 'Cargo.toml'],
     website: ['package.json', 'website/package.json'],
@@ -38,6 +52,33 @@ const CAPABILITY_PATHS = {
     lint: ['src', 'tests', 'package.json', 'pnpm-lock.yaml', 'eslint.config.js', 'eslint.config.mjs'],
     'test-related': ['src', 'tests', 'package.json', 'pnpm-lock.yaml', 'vitest.config.ts'],
     'test-full': ['src', 'tests', 'package.json', 'pnpm-lock.yaml', 'vitest.config.ts'],
+    contract: [
+        'src',
+        'tests/contracts',
+        'tests/integration',
+        'package.json',
+        'pnpm-lock.yaml',
+        'vitest.config.ts',
+    ],
+    coverage: ['src', 'tests', 'package.json', 'pnpm-lock.yaml', 'vitest.config.ts'],
+    migration: [
+        'src/storage',
+        'src/types/migration',
+        'tests/storage',
+        'tests/integration',
+        'package.json',
+        'pnpm-lock.yaml',
+    ],
+    'fault-injection': [
+        'src/engine/execution',
+        'src/engine/auto-updater',
+        'src/storage/runtime-db.ts',
+        'tests/engine',
+        'tests/integration',
+        'package.json',
+        'pnpm-lock.yaml',
+        'rust',
+    ],
     security: [
         'package.json',
         'pnpm-lock.yaml',

package/dist/engine/validation-impact-planner.d.ts

@@ -1,4 +1,16 @@
-import type { ValidationGateCapability, ValidationImpactPlan } from '../types/validation-evidence.js';
-export declare const VALIDATION_COMMANDS: Readonly<Record<ValidationGateCapability, string>>;
+import type { ValidationImpactPlan } from '../types/validation-evidence.js';
+export declare const VALIDATION_COMMANDS: {
+    readonly typecheck: 'pnpm typecheck';
+    readonly lint: 'pnpm lint';
+    readonly 'test-related': 'pnpm test --run --changed';
+    readonly 'test-full': 'pnpm test';
+    readonly contract: 'pnpm test:contracts';
+    readonly coverage: 'pnpm test:coverage';
+    readonly migration: 'pnpm test:migrations';
+    readonly 'fault-injection': 'pnpm test:fault-injection';
+    readonly security: 'pnpm check:deps:fresh';
+    readonly native: 'pnpm native:project-graph:e2e';
+    readonly website: 'pnpm --dir website build';
+};
 export declare function planValidationImpact(paths: readonly string[]): ValidationImpactPlan;
 //# sourceMappingURL=validation-impact-planner.d.ts.map

package/dist/engine/validation-impact-planner.js

@@ -3,15 +3,19 @@ export const VALIDATION_COMMANDS = {
     lint: 'pnpm lint',
     'test-related': 'pnpm test --run --changed',
     'test-full': 'pnpm test',
+    contract: 'pnpm test:contracts',
+    coverage: 'pnpm test:coverage',
+    migration: 'pnpm test:migrations',
+    'fault-injection': 'pnpm test:fault-injection',
     security: 'pnpm check:deps:fresh',
     native: 'pnpm native:project-graph:e2e',
     website: 'pnpm --dir website build',
-    reproducibility: 'bash scripts/check-reproducibility.sh',
 };
 const LIFECYCLE_RE = /^(?:planu\/|docs\/|README(?:\.|$)|CHANGELOG\.md$|[^/]+\.md$)/;
 const SOURCE_RE = /^(?:src\/|tests\/)/;
+const CORE_RE = /^(?:src\/|rust\/planu-core\/|tests\/(?:contracts|engine|integration|storage|tools)\/)/;
 const DEPENDENCY_RE = /^(?:package\.json|pnpm-lock\.yaml|pnpm-workspace\.yaml|npm\/[^/]+\/package\.json)/;
-const NATIVE_RE = /^(?:rust\/|Cargo\.(?:toml|lock)$|npm\/core-)/;
+const NATIVE_RE = /^(?:rust\/|Cargo\.(?:toml|lock)$|npm\/(?:core-|(?:darwin|linux|win32)-))/;
 const SHARED_RE = /^(?:\.github\/|\.husky\/|scripts\/|tsconfig(?:\.[^/]+)?\.json$|eslint\.config\.[^/]+$|vitest\.config\.[^/]+$)/;
 export function planValidationImpact(paths) {
     const changedPaths = [...new Set(paths.map(normalizePath).filter(Boolean))].sort();
@@ -21,6 +25,9 @@ export function planValidationImpact(paths) {
     if (changedPaths.every((path) => LIFECYCLE_RE.test(path))) {
         return plan('lifecycle', [], false, 'Lifecycle/documentation-only change.', changedPaths);
     }
+    if (changedPaths.some((path) => CORE_RE.test(path))) {
+        return fullPlan('Core behavior changed; every reliability gate is mandatory.', changedPaths);
+    }
     if (changedPaths.some((path) => SHARED_RE.test(path))) {
         return fullPlan('Shared validation, workflow, hook, or unknown infrastructure changed.', changedPaths);
     }
@@ -33,18 +40,14 @@ export function planValidationImpact(paths) {
             gates.add('lint');
             gates.add('test-related');
         }
-        else if (DEPENDENCY_RE.test(path)) {
-            kind = 'dependency';
-            gates.add('security');
-            gates.add('typecheck');
-            gates.add('lint');
-            gates.add('test-full');
-        }
         else if (NATIVE_RE.test(path)) {
             kind = 'native';
             gates.add('native');
             gates.add('test-full');
         }
+        else if (DEPENDENCY_RE.test(path)) {
+            return fullPlan('Dependency or lockfile change selects every reliability gate.', changedPaths);
+        }
         else if (path.startsWith('website/')) {
             kind = kind === 'none' ? 'website' : kind;
             gates.add('website');
@@ -56,7 +59,17 @@ export function planValidationImpact(paths) {
     return plan(kind, [...gates], gates.has('test-full'), `Selected by changed path class: ${kind}.`, changedPaths);
 }
 function fullPlan(reason, changedPaths) {
-    const gates = ['typecheck', 'lint', 'test-full', 'security'];
+    const gates = [
+        'typecheck',
+        'lint',
+        'test-full',
+        'contract',
+        'coverage',
+        'security',
+        'migration',
+        'fault-injection',
+        'native',
+    ];
     if (changedPaths.some((path) => path.startsWith('website/'))) {
         gates.push('website');
     }

package/dist/engine/validator/dor-dod.d.ts

@@ -1,4 +1,5 @@
 import type { Spec, ValidateResult, DefinitionOfReady, DefinitionOfDone, CodeState } from '../../types/index.js';
+export declare function isBlockingQualitySeverity(severity: unknown): boolean;
 /**
  * Generate a Definition of Ready checklist for a spec.
  */

package/dist/engine/validator/dor-dod.js

@@ -5,6 +5,9 @@ import { runAllGates } from './gates/index.js';
 /** Minimum test file count that auto-passes test gates (batch-implementation heuristic). */
 const BATCH_TEST_THRESHOLD = 5;
 import { parseProgressActuals } from '../actuals/progress-parser.js';
+export function isBlockingQualitySeverity(severity) {
+    return severity !== 'info' && severity !== 'warning';
+}
 function buildDoRSpecItems(spec) {
     // Adapt description to actual file name (modern: spec.md, legacy: HU.md)
     const specFileName = spec.specPath ? basename(spec.specPath) : 'spec.md';
@@ -320,9 +323,8 @@ function gateCategory(gate) {
  */
 export async function generateDoD(spec, validationResult, codeState, projectPath) {
     const score = validationResult?.score ?? 0;
-    // Only errors and critical issues block DoD — warnings and info are non-blocking
-    const blockingSeverities = ['error', 'critical'];
-    const hasBlockingQualityIssues = validationResult?.qualityIssues.some((i) => blockingSeverities.includes(i.severity)) ?? false;
+    const hasBlockingQualityIssues = validationResult?.qualityIssues.some((issue) => isBlockingQualitySeverity(issue.severity)) ??
+        false;
     const hasTestFiles = await detectTestFiles(spec, codeState);
     const items = buildDoDItems(spec, score, hasBlockingQualityIssues, hasTestFiles);
     // Override actuals check with progress.md parsing