@planu/cli 4.13.0 → 5.0.0

package/dist/tools/tool-registry/group-quality-compliance.js

@@ -1,13 +1,6 @@
-/* eslint-disable max-lines -- thematic registry group consolidated by SPEC refactor-phase3 (commit aafeea60); each block is a declarative tool registration ~20 lines, split would re-create the ~120 register-*.ts files this phase intentionally collapsed */
-// tools/tool-registry/group-quality-compliance.ts — Declarative registry: quality & compliance tools.
-//
-// Phase 3 (refactor/registry-phase3): consolidates register-*.ts files for:
-//   compliance, compliance-audit, compliance-gate, compliance-test,
-//   security, audit-trail, schema-parity, schema-generator,
-//   tdd, coverage, eval-skill, ears, spec-lint, readiness, approval,
-//   governance, spec-322 (api contract), spec-323 (tdd scaffold), spec-331 (orchestration plan)
+import { technologyValue } from '../../engine/technology-registry.js';
 import { z } from 'zod';
-import { safeLicensed, safeTracked } from '../safe-handler.js';
+import { safeGoverned, safeTracked } from '../safe-handler.js';
 import { projectIdSchema, withProject } from '../tool-registry-helpers.js';
 import { t } from '../../i18n/index.js';
 import { makeDeprecationStub } from './deprecated-stubs.js';
@@ -276,7 +269,7 @@ export function registerQualityComplianceGroupTools(s) {
             outputFormat: z.enum(['html', 'json']).optional().describe(FORMAT_DESCRIBE),
         },
         annotations: { title: 'Generate Compliance Report', readOnlyHint: true },
-    }, safeLicensed('generate_compliance_report', (args) => Promise.resolve(handleGenerateComplianceReport(args))));
+    }, safeGoverned('generate_compliance_report', (args) => Promise.resolve(handleGenerateComplianceReport(args))));
     s.registerTool('audit_log_export', {
         description: 'Export the project audit trail in CSV, JSON, or JSON-LD format. ' +
             'Supports optional date range filtering. ' +
@@ -297,7 +290,7 @@ export function registerQualityComplianceGroupTools(s) {
                 .describe('Optional date range filter for audit entries'),
         },
         annotations: { title: 'Export Audit Log', readOnlyHint: true },
-    }, safeLicensed('audit_log_export', async (args) => handleAuditLogExport(args)));
+    }, safeGoverned('audit_log_export', async (args) => handleAuditLogExport(args)));
     s.registerTool('data_retention_policy', {
         description: 'Configure the data retention policy for the project. ' +
             'Specifies how long data should be retained and whether auto-deletion is enabled. ' +
@@ -327,7 +320,7 @@ export function registerQualityComplianceGroupTools(s) {
                 .describe('Days before deletion to notify (default: 7)'),
         },
         annotations: { title: 'Configure Data Retention Policy', readOnlyHint: false },
-    }, safeLicensed('data_retention_policy', async (args) => handleDataRetentionPolicy(args)));
+    }, safeGoverned('data_retention_policy', async (args) => handleDataRetentionPolicy(args)));
     // ── Compliance gate ───────────────────────────────────────────────────────────
     s.registerTool('configure_compliance_gate', {
         description: 'Configure the compliance gate that runs automatically when a spec is sent to review. ' +
@@ -336,9 +329,9 @@ export function registerQualityComplianceGroupTools(s) {
             'Pro feature.',
         inputSchema: ConfigureComplianceGateSchema.shape,
         annotations: { title: 'Configure Compliance Gate', destructiveHint: false },
-    }, safeLicensed('configure_compliance_gate', async (args) => handleConfigureComplianceGate(args)));
+    }, safeGoverned('configure_compliance_gate', async (args) => handleConfigureComplianceGate(args)));
     s.registerTool('compliance_gate_status', {
-        description: 'Check the compliance gate configuration for this project. Returns the current mode and threshold. Free tool — no license required.',
+        description: 'Check the compliance gate configuration for this project. Returns the current mode and threshold.',
         inputSchema: {
             projectPath: z.string().describe('Absolute path to the project root'),
         },
@@ -365,12 +358,12 @@ export function registerQualityComplianceGroupTools(s) {
                 .min(1)
                 .describe(COMPLIANCE_TEST_FRAMEWORK_DESCRIBE),
             outputFormat: z
-                .enum(['jest', 'gherkin', 'markdown'])
+                .enum([technologyValue('technology-jest-35e99f'), 'gherkin', 'markdown'])
                 .optional()
                 .describe(TEST_FORMAT_DESCRIBE),
         },
         annotations: { title: 'Generate Compliance Tests', readOnlyHint: true },
-    }, safeLicensed('generate_compliance_tests', async (args) => handleGenerateComplianceTests(args)));
+    }, safeGoverned('generate_compliance_tests', async (args) => handleGenerateComplianceTests(args)));
     s.registerTool('compliance_coverage_report', {
         description: 'List all compliance controls for the requested frameworks, showing their IDs, ' +
             'titles, descriptions, and matching keywords. ' +
@@ -387,7 +380,7 @@ export function registerQualityComplianceGroupTools(s) {
                 .describe(COMPLIANCE_TEST_FRAMEWORK_DESCRIBE),
         },
         annotations: { title: 'Compliance Coverage Report', readOnlyHint: true },
-    }, safeLicensed('compliance_coverage_report', (args) => Promise.resolve(handleComplianceCoverageReport(args))));
+    }, safeGoverned('compliance_coverage_report', (args) => Promise.resolve(handleComplianceCoverageReport(args))));
     // ── Security ─────────────────────────────────────────────────────────────────
     s.registerTool('security_check', {
         description: t('tools.security_check.description'),
@@ -405,7 +398,7 @@ export function registerQualityComplianceGroupTools(s) {
                 .optional()
                 .describe('Absolute paths to code files to scan for insecure patterns'),
         },
-    }, safeLicensed('security_check', withProject((args) => handleSecurityCheck(args))));
+    }, safeGoverned('security_check', withProject((args) => handleSecurityCheck(args))));
     // ── Audit trail ──────────────────────────────────────────────────────────────
     s.registerTool('audit_trail', {
         description: 'Query the immutable audit log for a project. Supports filtering by specId, userId, eventType, and date range. Returns events with SHA-256 chain integrity status.',
@@ -437,7 +430,7 @@ export function registerQualityComplianceGroupTools(s) {
                 .optional()
                 .describe('Maximum number of events to return (default: 100, max: 1000).'),
         },
-    }, safeLicensed('audit_trail', withProject((args) => handleAuditTrail(args))));
+    }, safeGoverned('audit_trail', withProject((args) => handleAuditTrail(args))));
     s.registerTool('generate_attestation', {
         description: 'Generate a compliance attestation document for a specific spec. Includes full audit history, chain integrity verification, and event summary for SOC2/HIPAA/ISO27001 audits.',
         annotations: { readOnlyHint: true },
@@ -449,7 +442,7 @@ export function registerQualityComplianceGroupTools(s) {
                 .max(500)
                 .describe('Spec ID to generate attestation for (e.g. SPEC-042).'),
         },
-    }, safeLicensed('generate_attestation', withProject((args) => handleGenerateAttestation(args))));
+    }, safeGoverned('generate_attestation', withProject((args) => handleGenerateAttestation(args))));
     s.registerTool('export_audit_trail', {
         description: 'Export the EU AI Act Article 12 immutable audit trail for every Planu tool invocation. ' +
             'Supports filtering by project, date range, or spec. Verifies SHA-256 chain integrity. ' +
@@ -485,7 +478,7 @@ export function registerQualityComplianceGroupTools(s) {
                 .optional()
                 .describe('Maximum number of entries to return.'),
         },
-    }, safeLicensed('export_audit_trail', (args) => Promise.resolve(handleExportAuditTrail(args))));
+    }, safeGoverned('export_audit_trail', (args) => Promise.resolve(handleExportAuditTrail(args))));
     // ── Schema parity ────────────────────────────────────────────────────────────
     s.registerTool('audit_schema_type_parity', {
         description: 'Scans all register-*.ts tool files in the project for mismatches between Zod optional ' +
@@ -500,7 +493,7 @@ export function registerQualityComplianceGroupTools(s) {
                 .max(4096)
                 .describe('Absolute path to the project root to scan. The auditor will look for src/tools/register-*.ts and src/types/**/*.ts.'),
         },
-    }, safeLicensed('audit_schema_type_parity', async (args) => handleAuditSchemaParity(args)));
+    }, safeGoverned('audit_schema_type_parity', async (args) => handleAuditSchemaParity(args)));
     s.registerTool('fix_schema_type_parity', {
         description: 'Automatically fixes Zod/TypeScript optional parity issues found by audit_schema_type_parity. ' +
             'Adds "?" to TypeScript type definitions for fields that are marked .optional() in Zod schemas. ' +
@@ -517,7 +510,7 @@ export function registerQualityComplianceGroupTools(s) {
                 .default(true)
                 .describe('When true (default), shows what would change without writing any files. Set to false to apply the fixes.'),
         },
-    }, safeLicensed('fix_schema_type_parity', async (args) => handleFixSchemaParity(args)));
+    }, safeGoverned('fix_schema_type_parity', async (args) => handleFixSchemaParity(args)));
     // ── Schema generator ─────────────────────────────────────────────────────────
     s.registerTool('generate_validation_schema', {
         description: 'Analyze a spec and generate validation schema code (Zod, Yup, or Valibot). ' +
@@ -528,10 +521,10 @@ export function registerQualityComplianceGroupTools(s) {
             projectPath: z.string().min(1).max(4096).describe('Absolute path to the project root.'),
             specId: SpecIdSchema.describe('Spec ID to analyze (e.g. SPEC-042).'),
             library: z
-                .enum(['zod', 'yup', 'valibot', 'all'])
+                .enum([technologyValue('technology-zod-4f63cf'), 'yup', 'valibot', 'all'])
                 .describe('Schema library. Values: zod, yup, valibot, all.'),
             outputFormat: z
-                .enum(['typescript', 'javascript'])
+                .enum([technologyValue('technology-typescript-969545'), 'javascript'])
                 .describe('Output format. Values: typescript, javascript.'),
             outputPath: z
                 .string()
@@ -612,7 +605,7 @@ export function registerQualityComplianceGroupTools(s) {
                 .describe('Spec ID to analyze (e.g., "SPEC-001"), or "all" to analyze every spec in the project'),
         },
         annotations: { title: 'Spec Test Coverage', readOnlyHint: true },
-    }, safeLicensed('spec_coverage', withProject((args) => handleSpecCoverage(args))));
+    }, safeGoverned('spec_coverage', withProject((args) => handleSpecCoverage(args))));
     // ── Eval skill ───────────────────────────────────────────────────────────────
     s.registerTool('eval_skill', {
         description: 'Evaluate the quality of a Claude skill file against a set of test scenarios. ' +
@@ -845,7 +838,7 @@ export function registerQualityComplianceGroupTools(s) {
                 .describe('Evaluation mode: strict (default) requires score >=70; lenient requires >=60'),
         },
         outputSchema: CheckReadinessOutputSchema,
-    }, safeLicensed('check_readiness', withProject((args) => handleCheckReadiness(args))));
+    }, safeGoverned('check_readiness', withProject((args) => handleCheckReadiness(args))));
     // ── SPEC-961: Architecture lint ─────────────────────────────────────────────
     s.registerTool('architecture_lint', {
         description: 'Scan project codebase for Clean Architecture and SOLID principle violations. Reports handler bloat, layer violations, and missing repository patterns.',
@@ -864,7 +857,7 @@ export function registerQualityComplianceGroupTools(s) {
                 .describe('Glob patterns to exclude (default: node_modules, .git, dist)'),
             failFast: z.boolean().optional().describe('Stop on first error (default: false)'),
         },
-    }, safeLicensed('architecture_lint', withProject((args) => handleArchitectureLint(args))));
+    }, safeGoverned('architecture_lint', withProject((args) => handleArchitectureLint(args))));
     // ── SPEC-962: SOLID check ───────────────────────────────────────────────────
     s.registerTool('solid_check', {
         description: 'Scan project codebase for SOLID principle violations. Reports SRP, OCP, LSP, ISP, and DIP issues with a scored report (0-100) and per-principle breakdown.',
@@ -877,7 +870,7 @@ export function registerQualityComplianceGroupTools(s) {
                 .describe('Glob patterns to exclude (default: node_modules, .git, dist)'),
             failFast: z.boolean().optional().describe('Stop on first error (default: false)'),
         },
-    }, safeLicensed('solid_check', withProject((args) => handleSolidCheck({
+    }, safeGoverned('solid_check', withProject((args) => handleSolidCheck({
         projectPath: args.projectPath,
         exclude: args.exclude,
         failFast: args.failFast,
@@ -924,7 +917,7 @@ export function registerQualityComplianceGroupTools(s) {
                 .optional()
                 .describe('Fail on first failing endpoint (default: false)'),
         },
-    }, safeLicensed('verify_integrations', withProject((args) => handleVerifyIntegrations({
+    }, safeGoverned('verify_integrations', withProject((args) => handleVerifyIntegrations({
         projectPath: args.projectPath,
         endpoints: args.endpoints,
         timeout: args.timeout,
@@ -961,7 +954,7 @@ export function registerQualityComplianceGroupTools(s) {
             ...projectIdSchema,
             specId: SpecIdSchema.describe('Spec ID to generate handoff package for'),
         },
-    }, safeLicensed('package_handoff', withProject((args) => handlePackageHandoff(args))));
+    }, safeGoverned('package_handoff', withProject((args) => handlePackageHandoff(args))));
     // ── Approval ─────────────────────────────────────────────────────────────────
     s.registerTool('configure_approval_policy', {
         description: 'Define the approval policy for a project: how many approvals are required, ' +
@@ -987,7 +980,7 @@ export function registerQualityComplianceGroupTools(s) {
                 .describe('Roles allowed to approve specs. If empty or omitted, any reviewer can approve.'),
         },
         annotations: { title: 'Configure Approval Policy', destructiveHint: false },
-    }, safeLicensed('configure_approval_policy', (args) => handleConfigureApprovalPolicy(args)));
+    }, safeGoverned('configure_approval_policy', (args) => handleConfigureApprovalPolicy(args)));
     s.registerTool('issue_reviewer_token', {
         description: '[SPEC-722] Issue a signed reviewer token for approve_spec. ' +
             'Must be called from a DIFFERENT session than the one that created the spec. ' +
@@ -1009,7 +1002,7 @@ export function registerQualityComplianceGroupTools(s) {
                 .describe('Host/agent platform identifier (e.g. "claude-code", "cursor").'),
         },
         annotations: { title: 'Issue Reviewer Token', destructiveHint: false },
-    }, safeLicensed('issue_reviewer_token', (args) => handleIssueReviewerToken(args)));
+    }, safeGoverned('issue_reviewer_token', (args) => handleIssueReviewerToken(args)));
     s.registerTool('approve_spec', {
         description: '[SPEC-722] Record that a reviewer has approved a spec. ' +
             'Requires a signed reviewerToken (from issue_reviewer_token) and the plannerToken ' +
@@ -1043,7 +1036,7 @@ export function registerQualityComplianceGroupTools(s) {
                 'Allows approval from the same model if the panel was heterogeneous.'),
         },
         annotations: { title: 'Approve Spec', destructiveHint: true },
-    }, safeLicensed('approve_spec', (args) => handleApproveSpec(args)));
+    }, safeGoverned('approve_spec', (args) => handleApproveSpec(args)));
     s.registerTool('request_changes', {
         description: 'Request changes on a spec. The spec is moved back to draft and prior approvals are cleared. ' +
             'A comment explaining the required changes is mandatory.',
@@ -1075,7 +1068,7 @@ export function registerQualityComplianceGroupTools(s) {
                 .describe('Role of the reviewer (e.g. "tech-lead", "qa").'),
         },
         annotations: { title: 'Request Changes', destructiveHint: true },
-    }, safeLicensed('request_changes', (args) => handleRequestChanges(args)));
+    }, safeGoverned('request_changes', (args) => handleRequestChanges(args)));
     s.registerTool('approval_status', {
         description: 'Show the current approval status for a spec: who approved, how many are needed, ' +
             'time in review, and SLA breach warning if applicable.',
@@ -1110,7 +1103,7 @@ export function registerQualityComplianceGroupTools(s) {
                 .optional()
                 .describe('Raw spec content to analyze when specId is not available'),
         },
-    }, safeLicensed('data_governance', withProject((args) => handleDataGovernance(args))));
+    }, safeGoverned('data_governance', withProject((args) => handleDataGovernance(args))));
     s.registerTool('legal_compliance_report', {
         description: 'Generate a legal compliance report for the project. ' +
             'Shows detected legal domains, applicable regulations by country, ' +
@@ -1120,7 +1113,7 @@ export function registerQualityComplianceGroupTools(s) {
         inputSchema: {
             ...projectIdSchema,
         },
-    }, safeLicensed('legal_compliance_report', withProject((args) => handleLegalComplianceReport(args))));
+    }, safeGoverned('legal_compliance_report', withProject((args) => handleLegalComplianceReport(args))));
     // ── SPEC-322: API Contract Validation ────────────────────────────────────────
     s.registerTool('validate_api_contract', {
         description: 'Validate an OpenAPI 3.x/Swagger or GraphQL SDL contract against the actual implementation in a project. ' +
@@ -1144,7 +1137,7 @@ export function registerQualityComplianceGroupTools(s) {
                 .max(4096)
                 .describe('Absolute path to the API contract file. For OpenAPI: .json or .yaml file. For GraphQL: .graphql, .gql, or .sdl file.'),
             contractFormat: z
-                .enum(['openapi', 'graphql', 'auto'])
+                .enum(['openapi', technologyValue('technology-graphql-aed31c'), 'auto'])
                 .optional()
                 .describe('Format of the contract file. Valid values: openapi, graphql, auto. auto (default) detects format from the file extension: .json/.yaml → openapi, .graphql/.gql/.sdl → graphql.'),
         },

package/dist/tools/tool-registry/inventory.d.ts

@@ -0,0 +1,2 @@
+export { OFFICIAL_SDD_TOOL_NAMES, readCanonicalToolNames, } from '../../config/official-sdd-tools.js';
+//# sourceMappingURL=inventory.d.ts.map

package/dist/tools/tool-registry/inventory.js

@@ -0,0 +1,2 @@
+export { OFFICIAL_SDD_TOOL_NAMES, readCanonicalToolNames, } from '../../config/official-sdd-tools.js';
+//# sourceMappingURL=inventory.js.map

package/dist/tools/tool-registry-helpers.d.ts

@@ -14,17 +14,17 @@ interface MaybeProjectArgs {
  * Wraps a handler that requires a resolved projectId.
  * Resolves projectId from projectId or projectPath; returns missingProjectIdError if neither.
  *
- * Usage (replaces the 5-line resolveProjectId block in each safeTracked/safeLicensed callback):
+ * Usage (replaces the 5-line resolveProjectId block in each safeTracked/safeGoverned callback):
  * ```ts
  * // Before:
- * safeLicensed('tool', async (args) => {
+ * safeGoverned('tool', async (args) => {
  *   const pid = resolveProjectId(args as { projectId?: string; projectPath?: string });
  *   if (!pid) return missingProjectIdError;
  *   return handleFoo({ ...args, projectId: pid } as FooInput);
  * })
  *
  * // After:
- * safeLicensed('tool', withProject((args) => handleFoo(args as never)))
+ * safeGoverned('tool', withProject((args) => handleFoo(args as never)))
  * ```
  */
 export declare function withProject<T extends MaybeProjectArgs>(handler: (args: T & {

package/dist/tools/tool-registry-helpers.js

@@ -16,17 +16,17 @@ export const projectIdSchema = {
  * Wraps a handler that requires a resolved projectId.
  * Resolves projectId from projectId or projectPath; returns missingProjectIdError if neither.
  *
- * Usage (replaces the 5-line resolveProjectId block in each safeTracked/safeLicensed callback):
+ * Usage (replaces the 5-line resolveProjectId block in each safeTracked/safeGoverned callback):
  * ```ts
  * // Before:
- * safeLicensed('tool', async (args) => {
+ * safeGoverned('tool', async (args) => {
  *   const pid = resolveProjectId(args as { projectId?: string; projectPath?: string });
  *   if (!pid) return missingProjectIdError;
  *   return handleFoo({ ...args, projectId: pid } as FooInput);
  * })
  *
  * // After:
- * safeLicensed('tool', withProject((args) => handleFoo(args as never)))
+ * safeGoverned('tool', withProject((args) => handleFoo(args as never)))
  * ```
  */
 export function withProject(handler) {

package/dist/tools/tool-usage-report/registered-tools.d.ts

@@ -1,5 +1,5 @@
 /**
- * Returns a deduplicated list of all tool names registered in license-plans.json.
+ * Returns the live tool inventory captured by the canonical registry.
  */
 export declare function readRegisteredToolNames(): Promise<string[]>;
 //# sourceMappingURL=registered-tools.d.ts.map

package/dist/tools/tool-usage-report/registered-tools.js

@@ -1,21 +1,9 @@
 // tools/tool-usage-report/registered-tools.ts — SPEC-574
-// Reads all tool names registered in license-plans.json (freeTools + proTools + alwaysAllowed).
-import { readFileSync } from 'node:fs';
-import { fileURLToPath } from 'node:url';
-import { dirname, join } from 'node:path';
-function loadLicensePlans() {
-    const __filename = fileURLToPath(import.meta.url);
-    const __dirname = dirname(__filename);
-    const configPath = join(__dirname, '../../config/license-plans.json');
-    const raw = readFileSync(configPath, 'utf-8');
-    return JSON.parse(raw);
-}
+import { readCanonicalToolNames } from '../tool-registry/inventory.js';
 /**
- * Returns a deduplicated list of all tool names registered in license-plans.json.
+ * Returns the live tool inventory captured by the canonical registry.
  */
 export function readRegisteredToolNames() {
-    const plans = loadLicensePlans();
-    const allTools = new Set([...plans.freeTools, ...plans.proTools, ...plans.alwaysAllowed]);
-    return Promise.resolve([...allTools].sort());
+    return Promise.resolve(readCanonicalToolNames().sort());
 }
 //# sourceMappingURL=registered-tools.js.map

package/dist/tools/update-status/approval-gates.d.ts

@@ -0,0 +1,13 @@
+import type { FormatGateOutput } from '../../types/spec/inputs.js';
+import type { Spec } from '../../types/spec/core.js';
+export interface ComplianceGateResult {
+    skipped: boolean;
+    score: number | null;
+    issues: string[];
+    blocked: boolean;
+}
+/** Run the optional compliance check for a transition into review. */
+export declare function checkComplianceGate(specId: string, projectId: string, projectPath: string | undefined): Promise<ComplianceGateResult>;
+/** Validate canonical spec format before approval, preserving audited bypass warnings. */
+export declare function checkApprovedFormatGate(spec: Spec, newStatus: string, forceApprove?: boolean | undefined): Promise<FormatGateOutput>;
+//# sourceMappingURL=approval-gates.d.ts.map

package/dist/tools/update-status/approval-gates.js

@@ -0,0 +1,84 @@
+import { validateSpecFormat } from '../../core/spec-validator.js';
+import { getComplianceGateConfig } from '../../storage/compliance-gate-config-store.js';
+import { formatKeyValue } from '../output-formatter.js';
+import { reportClassifiedDegradation } from '../../errors/classified-degradation.js';
+/** Run the optional compliance check for a transition into review. */
+export async function checkComplianceGate(specId, projectId, projectPath) {
+    if (!projectPath) {
+        return { skipped: true, score: null, issues: [], blocked: false };
+    }
+    try {
+        const { scoreCompliance } = await import('../../engine/verifier/compliance-scorer.js');
+        const result = await scoreCompliance(specId, projectPath);
+        if (result.totalCriteria === 0 && result.criteriaDetails.length === 0) {
+            return { skipped: true, score: null, issues: [], blocked: false };
+        }
+        const score = result.score;
+        const issues = result.criteriaDetails
+            .filter((detail) => detail.status === 'unverified')
+            .map((detail) => detail.criterion)
+            .slice(0, 5);
+        const config = await getComplianceGateConfig(projectId);
+        const blocked = (config?.mode ?? 'soft') === 'hard' && score < (config?.threshold ?? 90);
+        return { skipped: false, score, issues, blocked };
+    }
+    catch (error) {
+        /* reliability-optional: COMPLIANCE_GATE_UNAVAILABLE — optional gate is explicitly skipped */
+        reportClassifiedDegradation('COMPLIANCE_GATE_UNAVAILABLE', error);
+        return { skipped: true, score: null, issues: [], blocked: false };
+    }
+}
+/** Validate canonical spec format before approval, preserving audited bypass warnings. */
+export async function checkApprovedFormatGate(spec, newStatus, forceApprove = false) {
+    if (newStatus !== 'approved') {
+        return { blockResult: null, qualityWarnings: [] };
+    }
+    let result;
+    try {
+        result = await validateSpecFormat(spec, {
+            readinessMode: 'strict',
+            bypassReason: forceApprove ? 'forceApprove' : undefined,
+        });
+    }
+    catch (error) {
+        /* reliability-optional: FORMAT_GATE_UNAVAILABLE — caller receives explicit degraded result */
+        reportClassifiedDegradation('FORMAT_GATE_UNAVAILABLE', error);
+        return { blockResult: null, qualityWarnings: [] };
+    }
+    if (result.valid) {
+        const qualityWarnings = result.warnings
+            .filter((warning) => warning.message.includes('[BYPASSED: forceApprove]'))
+            .map((warning) => `[${warning.code}] ${warning.message.replace('[BYPASSED: forceApprove] ', '')} (path: ${warning.path})`);
+        return { blockResult: null, qualityWarnings };
+    }
+    const message = `Spec format validation failed with ${String(result.errors.length)} error(s) — fix before approving, or pass forceApprove: true to bypass with warnings.`;
+    const blockResult = {
+        content: [
+            {
+                type: 'text',
+                text: formatKeyValue({
+                    error: 'SPEC_FORMAT_INVALID',
+                    message,
+                    errors: result.errors.length,
+                    warnings: result.warnings.length,
+                    firstError: result.errors[0]?.message,
+                    firstErrorPath: result.errors[0]?.path,
+                }, 'Spec format invalid'),
+            },
+        ],
+        isError: true,
+        structuredContent: {
+            error: 'SPEC_FORMAT_INVALID',
+            message,
+            errors: result.errors,
+            warnings: result.warnings,
+            code: 422,
+            context: { specId: spec.id, errors: result.errors, warnings: result.warnings },
+            fixHint: result.errors[0]
+                ? `Fix: ${result.errors[0].message}. Path: ${result.errors[0].path}. Or pass forceApprove: true.`
+                : 'Fix all format errors before approving, or pass forceApprove: true to bypass with warnings.',
+        },
+    };
+    return { blockResult, qualityWarnings: [] };
+}
+//# sourceMappingURL=approval-gates.js.map

package/dist/tools/update-status/batch.js

@@ -1,6 +1,7 @@
 // tools/update-status/batch.ts — SPEC-1017 batch status transitions
 import { handleUpdateStatus } from './index.js';
 import { resolveProjectIdOrAutoDetect } from '../resolve-project-id.js';
+import { reportClassifiedDegradation } from '../../errors/classified-degradation.js';
 function firstText(result) {
     const first = result.content[0];
     return first?.type === 'text' ? first.text : JSON.stringify(result.structuredContent ?? {});
@@ -76,8 +77,9 @@ export async function handleUpdateStatusBatch(input) {
         const { runStrictPlanuCleanup } = await import('../../engine/spec-migrator/index.js');
         await runStrictPlanuCleanup(resolved.projectPath);
     }
-    catch {
-        /* best-effort final pass */
+    catch (error) {
+        /* reliability-cleanup: POST_BATCH_STRICT_CLEANUP — validation remains fail-closed */
+        reportClassifiedDegradation('POST_BATCH_STRICT_CLEANUP', error);
     }
     const text = [
         `Batch status transition complete: ${input.status}`,

package/dist/tools/update-status/dod-gates.d.ts

@@ -1,7 +1,9 @@
 import type { ToolResult } from '../../types/index.js';
-import type { FormatGateOutput } from '../../types/spec/inputs.js';
 import type { Spec } from '../../types/spec/core.js';
 import type { EscalateResult } from '../../types/escalator.js';
+import type { ValidationFreshnessLease } from '../../engine/validation/validation-freshness.js';
+import { type DoneReceiptVerifier } from './done-receipt-verifier.js';
+export { completedJobPublishesReceipt } from './done-receipt-verifier.js';
 /**
  * The reason why the validate gate blocked a `done` transition.
  * Each reason maps to a specific fix-hint shown to the LLM.
@@ -79,6 +81,7 @@ export interface DoneGateResult {
      * Caller should surface this as a warning in the success response.
      */
     forcedBypassWarning: string | null;
+    freshnessLease: ValidationFreshnessLease | null;
 }
 /**
  * SPEC-725: Check the validation-report artifact gate before marking done.
@@ -96,30 +99,9 @@ export declare function checkSpecReviewGate(specId: string, projectId: string, _
  * When force=true, gates are not blocking but failing items are recorded in
  * the project's force-bypass-log.json for traceability (guard: done ≠ implemented).
  */
-export declare function checkDoneGates(spec: Spec, specId: string, projectId: string, projectPath: string | undefined, force: boolean | undefined, forceReason?: string): Promise<DoneGateResult>;
-export interface ComplianceGateResult {
-    skipped: boolean;
-    score: number | null;
-    issues: string[];
-    blocked: boolean;
-}
-/**
- * SPEC-447: Runs the compliance check when transitioning to 'review'.
- * Never blocks the transition if the compliance engine is unavailable or fails.
- */
-export declare function checkComplianceGate(specId: string, projectId: string, projectPath: string | undefined): Promise<ComplianceGateResult>;
+export declare function checkDoneGates(spec: Spec, specId: string, projectId: string, projectPath: string | undefined, _force: boolean | undefined, _forceReason?: string, verifyReceipt?: DoneReceiptVerifier): Promise<DoneGateResult>;
 export { checkQaGate } from './qa-gate.js';
-/**
- * SPEC-716 / SPEC-780: Format gate for transition to 'approved'.
- *
- * - newStatus !== 'approved' → returns `{ blockResult: null, qualityWarnings: [] }` (gate inert)
- * - validateSpecFormat returns valid → `{ blockResult: null, qualityWarnings: [] }`
- * - validateSpecFormat returns invalid AND `forceApprove !== true` → `{ blockResult: <SPEC_FORMAT_INVALID>, qualityWarnings: [] }` (block, legacy behavior)
- * - validateSpecFormat returns invalid AND `forceApprove === true` → `{ blockResult: null, qualityWarnings: <serialized errors> }` (proceed; warnings written to spec frontmatter by caller, mirroring SPEC-769 readiness gate)
- *
- * Best-effort: never throws — gate is skipped on unexpected errors.
- */
-export declare function checkApprovedFormatGate(spec: Spec, newStatus: string, forceApprove?: boolean | undefined): Promise<FormatGateOutput>;
+export { checkApprovedFormatGate, checkComplianceGate, type ComplianceGateResult, } from './approval-gates.js';
 /**
  * Run the validate gate wrapped in withEscalation for bounded retries.
  *