@planu/cli 4.13.0 → 5.0.0

package/dist/tools/update-status/dod-gates.js

@@ -1,15 +1,15 @@
-import { validateSpecFormat } from '../../core/spec-validator.js';
 import { validateSpec } from '../../engine/validator.js';
 import { generateDoD } from '../../engine/validator/dor-dod.js';
 import { addLesson, getLessons } from '../../storage/lessons-store.js';
 import { dispatchFeedbackEvent } from '../learn.js';
 import { auditDeps } from '../../engine/dep-auditor/index.js';
-import { getComplianceGateConfig } from '../../storage/compliance-gate-config-store.js';
 import { withEscalation } from '../../engine/escalator/with-escalation.js';
 import { writeImplementationReviewReport } from '../../engine/validator/validation-report-writer.js';
 import { writeSpecReviewFeedback } from '../../engine/validator/spec-review-writer.js';
 import { formatKeyValue } from '../output-formatter.js';
-import { recordForceDoneBypass } from './force-done-audit.js';
+import { reportClassifiedDegradation } from '../../errors/classified-degradation.js';
+import { verifyCurrentDoneReceipt } from './done-receipt-verifier.js';
+export { completedJobPublishesReceipt } from './done-receipt-verifier.js';
 /**
  * SPEC-721 / SPEC-222 Trigger 1: Run validate engine before marking done.
  *
@@ -50,8 +50,9 @@ export async function runValidateGate(spec, projectPath, forceStatus, forceStatu
                 observedScore = typeof r.score === 'number' ? r.score : null;
             }
         }
-        catch {
-            /* swallow — forced bypass must never throw */
+        catch (error) {
+            /* reliability-optional: FORCED_BYPASS_SCORE — bypass audit remains available without score */
+            reportClassifiedDegradation('FORCED_BYPASS_SCORE', error);
         }
         return {
             blocked: false,
@@ -165,7 +166,8 @@ export async function checkDodGate(spec, specId, projectId, projectPath, _force)
         timestamp: new Date().toISOString(),
         /* c8 ignore next */
     }).catch((err) => {
-        console.error('[planu] DoD feedback event failed:', err);
+        /* reliability-optional: DOD_FEEDBACK_EVENT — transition gate result remains authoritative */
+        reportClassifiedDegradation('DOD_FEEDBACK_EVENT', err);
     });
     return {
         content: [
@@ -245,11 +247,34 @@ export async function checkSecurityGate(projectPath, specId, force) {
             isError: true,
         };
     }
-    catch {
-        /* best-effort — never block transition due to audit errors */
+    catch (error) {
+        /* reliability-optional: FORCE_BYPASS_AUDIT_READ — explicit null disables bypass */
+        reportClassifiedDegradation('FORCE_BYPASS_AUDIT_READ', error);
         return null;
     }
 }
+function validationReceiptGateError(specId, reason) {
+    return {
+        content: [
+            {
+                type: 'text',
+                text: formatKeyValue({
+                    error: 'validation_receipt_invalid',
+                    specId,
+                    reason,
+                    fixHint: 'Run validate and wait for its durable job to publish a current receipt.',
+                }, 'Validation receipt gate failed'),
+            },
+        ],
+        isError: true,
+        structuredContent: {
+            error: 'validation_receipt_invalid',
+            code: 422,
+            context: { specId, reason },
+            fixHint: 'Run validate and wait for the durable validation operation to complete.',
+        },
+    };
+}
 /**
  * SPEC-725: Check the validation-report artifact gate before marking done.
  * SPEC-1050: Fail closed. A done transition requires a fresh validation-report
@@ -402,6 +427,8 @@ export async function checkSpecReviewGate(specId, projectId, _forceApprove) {
         return null;
     }
     catch (err) {
+        /* reliability-optional: SPEC_REVIEW_GATE_READ — typed gate error blocks approval */
+        reportClassifiedDegradation('SPEC_REVIEW_GATE_READ', err);
         return specReviewGateError({
             specId,
             error: 'spec_review_unreadable',
@@ -466,136 +493,33 @@ function specReviewGateError(args) {
  * When force=true, gates are not blocking but failing items are recorded in
  * the project's force-bypass-log.json for traceability (guard: done ≠ implemented).
  */
-export async function checkDoneGates(spec, specId, projectId, projectPath, force, forceReason = 'No force reason provided') {
-    if (!force) {
-        const dodError = await checkDodGate(spec, specId, projectId, projectPath, false);
-        if (dodError) {
-            return { blocked: dodError, forcedBypassWarning: null };
-        }
-        const secError = await checkSecurityGate(projectPath, specId, false);
-        if (secError) {
-            return { blocked: secError, forcedBypassWarning: null };
-        }
-        return { blocked: null, forcedBypassWarning: null };
-    }
-    // force=true: run DoD in audit mode — collect results but do not block
-    let forcedBypassWarning = null;
+export async function checkDoneGates(spec, specId, projectId, projectPath, _force, _forceReason = 'No force reason provided', verifyReceipt = verifyCurrentDoneReceipt) {
     try {
-        const dod = await generateDoD(spec, undefined, undefined, projectPath);
-        const failingItems = dod.items
-            .filter((i) => i.required && i.status === 'failed')
-            .map((i) => i.description);
-        const warningItems = dod.items
-            .filter((i) => !i.required && i.status !== 'passed')
-            .map((i) => i.description);
-        if (failingItems.length > 0) {
-            // Record bypass in audit log (fire-and-forget)
-            void recordForceDoneBypass(specId, projectId, forceReason, failingItems, warningItems);
-            forcedBypassWarning =
-                `⚠️ force bypass: ${String(failingItems.length)} DoD item(s) were failing ` +
-                    `(${failingItems.slice(0, 2).join('; ')}${failingItems.length > 2 ? '…' : ''}). ` +
-                    `Recorded in force-bypass-log.json. Ensure real implementation follows.`;
-        }
-    }
-    catch {
-        /* best-effort — never block transition */
-    }
-    return { blocked: null, forcedBypassWarning };
-}
-/**
- * SPEC-447: Runs the compliance check when transitioning to 'review'.
- * Never blocks the transition if the compliance engine is unavailable or fails.
- */
-export async function checkComplianceGate(specId, projectId, projectPath) {
-    if (!projectPath) {
-        return { skipped: true, score: null, issues: [], blocked: false };
-    }
-    try {
-        const { scoreCompliance } = await import('../../engine/verifier/compliance-scorer.js');
-        const result = await scoreCompliance(specId, projectPath);
-        const score = result.score;
-        const issues = result.criteriaDetails
-            .filter((d) => d.status === 'unverified')
-            .map((d) => d.criterion)
-            .slice(0, 5);
-        const config = await getComplianceGateConfig(projectId);
-        const mode = config?.mode ?? 'soft';
-        const threshold = config?.threshold ?? 90;
-        const blocked = mode === 'hard' && score < threshold;
-        return { skipped: false, score, issues, blocked };
+        const result = await verifyReceipt({ projectId, specId, projectPath, specPath: spec.specPath });
+        return result.valid
+            ? {
+                blocked: null,
+                forcedBypassWarning: null,
+                freshnessLease: result.freshnessLease ?? null,
+            }
+            : {
+                blocked: validationReceiptGateError(specId, result.reason ?? 'invalid-receipt'),
+                forcedBypassWarning: null,
+                freshnessLease: null,
+            };
     }
-    catch {
-        /* best-effort — never block transition if compliance check fails */
-        return { skipped: true, score: null, issues: [], blocked: false };
+    catch (error) {
+        /* reliability-optional: VALIDATION_RECEIPT_GATE — typed blocked result fails closed */
+        reportClassifiedDegradation('VALIDATION_RECEIPT_GATE', error);
+        return {
+            blocked: validationReceiptGateError(specId, error instanceof Error ? error.message : 'receipt-verification-failed'),
+            forcedBypassWarning: null,
+            freshnessLease: null,
+        };
     }
 }
 export { checkQaGate } from './qa-gate.js';
-/**
- * SPEC-716 / SPEC-780: Format gate for transition to 'approved'.
- *
- * - newStatus !== 'approved' → returns `{ blockResult: null, qualityWarnings: [] }` (gate inert)
- * - validateSpecFormat returns valid → `{ blockResult: null, qualityWarnings: [] }`
- * - validateSpecFormat returns invalid AND `forceApprove !== true` → `{ blockResult: <SPEC_FORMAT_INVALID>, qualityWarnings: [] }` (block, legacy behavior)
- * - validateSpecFormat returns invalid AND `forceApprove === true` → `{ blockResult: null, qualityWarnings: <serialized errors> }` (proceed; warnings written to spec frontmatter by caller, mirroring SPEC-769 readiness gate)
- *
- * Best-effort: never throws — gate is skipped on unexpected errors.
- */
-export async function checkApprovedFormatGate(spec, newStatus, forceApprove = false) {
-    if (newStatus !== 'approved') {
-        return { blockResult: null, qualityWarnings: [] };
-    }
-    let result;
-    try {
-        result = await validateSpecFormat(spec, {
-            readinessMode: 'strict',
-            bypassReason: forceApprove ? 'forceApprove' : undefined,
-        });
-    }
-    catch {
-        /* best-effort — never block transition due to unexpected errors */
-        return { blockResult: null, qualityWarnings: [] };
-    }
-    if (result.valid) {
-        // If it was bypassed, the errors are now in warnings
-        const qualityWarnings = result.warnings
-            .filter((w) => w.message.includes('[BYPASSED: forceApprove]'))
-            .map((w) => `[${w.code}] ${w.message.replace('[BYPASSED: forceApprove] ', '')} (path: ${w.path})`);
-        return { blockResult: null, qualityWarnings };
-    }
-    // forceApprove not set → block as before (SPEC-716 legacy contract).
-    const blockResult = {
-        content: [
-            {
-                type: 'text',
-                text: formatKeyValue({
-                    error: 'SPEC_FORMAT_INVALID',
-                    message: `Spec format validation failed with ${String(result.errors.length)} error(s) — fix before approving, or pass forceApprove: true to bypass with warnings.`,
-                    errors: result.errors.length,
-                    warnings: result.warnings.length,
-                    firstError: result.errors[0]?.message,
-                    firstErrorPath: result.errors[0]?.path,
-                }, 'Spec format invalid'),
-            },
-        ],
-        isError: true,
-        structuredContent: {
-            error: 'SPEC_FORMAT_INVALID',
-            message: `Spec format validation failed with ${String(result.errors.length)} error(s) — fix before approving, or pass forceApprove: true to bypass with warnings.`,
-            errors: result.errors,
-            warnings: result.warnings,
-            code: 422,
-            context: {
-                specId: spec.id,
-                errors: result.errors,
-                warnings: result.warnings,
-            },
-            fixHint: result.errors[0]
-                ? `Fix: ${result.errors[0].message}. Path: ${result.errors[0].path}. Or pass forceApprove: true.`
-                : 'Fix all format errors before approving, or pass forceApprove: true to bypass with warnings.',
-        },
-    };
-    return { blockResult, qualityWarnings: [] };
-}
+export { checkApprovedFormatGate, checkComplianceGate, } from './approval-gates.js';
 async function autoCaptureLessonDodGate(spec, specId, projectId, projectPath) {
     try {
         const existing = await getLessons(projectPath, {
@@ -617,8 +541,9 @@ async function autoCaptureLessonDodGate(spec, specId, projectId, projectPath) {
             tags: [...spec.tags, 'auto-captured', 'dod-gate'],
         });
     }
-    catch {
-        /* best-effort — never throw */
+    catch (error) {
+        /* reliability-optional: DOD_GAP_CAPTURE — transition result remains authoritative */
+        reportClassifiedDegradation('DOD_GAP_CAPTURE', error);
     }
 }
 // ---------------------------------------------------------------------------

package/dist/tools/update-status/done-receipt-verifier.d.ts

@@ -0,0 +1,15 @@
+import { type DurableJobRecord } from '../../storage/runtime-db.js';
+import { type ValidationFreshnessLease } from '../../engine/validation/validation-freshness.js';
+export type DoneReceiptVerifier = (identity: {
+    projectId: string;
+    specId: string;
+    projectPath?: string;
+    specPath?: string;
+}) => Promise<{
+    valid: boolean;
+    reason?: string;
+    freshnessLease?: ValidationFreshnessLease;
+}>;
+export declare function completedJobPublishesReceipt(job: DurableJobRecord | undefined, receiptId: string): boolean;
+export declare function verifyCurrentDoneReceipt(identity: Parameters<DoneReceiptVerifier>[0]): ReturnType<DoneReceiptVerifier>;
+//# sourceMappingURL=done-receipt-verifier.d.ts.map

package/dist/tools/update-status/done-receipt-verifier.js

@@ -0,0 +1,158 @@
+var __addDisposableResource = (this && this.__addDisposableResource) || function (env, value, async) {
+    if (value !== null && value !== void 0) {
+        if (typeof value !== "object" && typeof value !== "function") throw new TypeError("Object expected.");
+        var dispose, inner;
+        if (async) {
+            if (!Symbol.asyncDispose) throw new TypeError("Symbol.asyncDispose is not defined.");
+            dispose = value[Symbol.asyncDispose];
+        }
+        if (dispose === void 0) {
+            if (!Symbol.dispose) throw new TypeError("Symbol.dispose is not defined.");
+            dispose = value[Symbol.dispose];
+            if (async) inner = dispose;
+        }
+        if (typeof dispose !== "function") throw new TypeError("Object not disposable.");
+        if (inner) dispose = function() { try { inner.call(this); } catch (e) { return Promise.reject(e); } };
+        env.stack.push({ value: value, dispose: dispose, async: async });
+    }
+    else if (async) {
+        env.stack.push({ async: true });
+    }
+    return value;
+};
+var __disposeResources = (this && this.__disposeResources) || (function (SuppressedError) {
+    return function (env) {
+        function fail(e) {
+            env.error = env.hasError ? new SuppressedError(e, env.error, "An error was suppressed during disposal.") : e;
+            env.hasError = true;
+        }
+        var r, s = 0;
+        function next() {
+            while (r = env.stack.pop()) {
+                try {
+                    if (!r.async && s === 1) return s = 0, env.stack.push(r), Promise.resolve().then(next);
+                    if (r.dispose) {
+                        var result = r.dispose.call(r.value);
+                        if (r.async) return s |= 2, Promise.resolve(result).then(next, function(e) { fail(e); return next(); });
+                    }
+                    else s |= 1;
+                }
+                catch (e) {
+                    fail(e);
+                }
+            }
+            if (s === 1) return env.hasError ? Promise.reject(env.error) : Promise.resolve();
+            if (env.hasError) throw env.error;
+        }
+        return next();
+    };
+})(typeof SuppressedError === "function" ? SuppressedError : function (error, suppressed, message) {
+    var e = new Error(message);
+    return e.name = "SuppressedError", e.error = error, e.suppressed = suppressed, e;
+});
+import { isAbsolute, join } from 'node:path';
+import { RuntimeDatabase } from '../../storage/runtime-db.js';
+import { resolveStorageLayout } from '../../storage/storage-layout.js';
+import { projectDataDir } from '../../storage/base-store.js';
+import { reportClassifiedDegradation } from '../../errors/classified-degradation.js';
+import { ValidationReceiptStore, LOCAL_VALIDATION_RECEIPT_ISSUER, createValidationReceiptAuthority, readCurrentValidationReceipt, } from '../../engine/validation/validation-receipt.js';
+import { beginValidationFreshnessBarrier, bindValidationFreshnessLease, captureValidationFreshnessLease, closeValidationFreshnessLease, } from '../../engine/validation/validation-freshness.js';
+import { computeDurableValidationBindings, toValidationReceiptBindings, } from '../../engine/validation/durable-validation.js';
+export function completedJobPublishesReceipt(job, receiptId) {
+    if (job?.state !== 'completed' || !job.result || typeof job.result !== 'object') {
+        return false;
+    }
+    const structuredContent = job.result.structuredContent;
+    if (!structuredContent || typeof structuredContent !== 'object') {
+        return false;
+    }
+    const published = structuredContent;
+    return (published.receiptId === receiptId &&
+        published.receiptKey === `validation-receipt:${receiptId.slice('sha256:'.length)}`);
+}
+export async function verifyCurrentDoneReceipt(identity) {
+    const env_1 = { stack: [], error: void 0, hasError: false };
+    try {
+        const database = __addDisposableResource(env_1, new RuntimeDatabase({ path: resolveStorageLayout().runtimeDatabase }), false);
+        const store = new ValidationReceiptStore({ database, workspaceId: 'global' });
+        const receipt = await readCurrentValidationReceipt(store, identity);
+        if (!receipt) {
+            return { valid: false, reason: 'missing-receipt' };
+        }
+        if (receipt.issuer !== LOCAL_VALIDATION_RECEIPT_ISSUER) {
+            return { valid: false, reason: 'unknown-issuer' };
+        }
+        const currentBindings = await store.readCurrentBindings(identity.projectId, identity.specId);
+        if (!currentBindings) {
+            return { valid: false, reason: 'stale-bindings' };
+        }
+        const { authority } = createValidationReceiptAuthority({
+            database,
+            workspaceId: 'global',
+            projectId: identity.projectId,
+            issuerId: LOCAL_VALIDATION_RECEIPT_ISSUER,
+        });
+        const verification = await authority.verifyCurrent({
+            ...currentBindings,
+            projectId: identity.projectId,
+            specId: identity.specId,
+        });
+        if (!verification.valid) {
+            return verification;
+        }
+        const receiptJobExists = database
+            .listJobs(identity.projectId, 'global')
+            .some((job) => completedJobPublishesReceipt(job, receipt.receiptId));
+        if (!receiptJobExists) {
+            return { valid: false, reason: 'missing-receipt' };
+        }
+        let ownedLease = await captureValidationFreshnessLease(identity, currentBindings);
+        try {
+            if (!ownedLease && identity.projectPath && identity.specPath) {
+                const projectPath = identity.projectPath;
+                const specPath = isAbsolute(identity.specPath)
+                    ? identity.specPath
+                    : join(projectPath, identity.specPath);
+                ownedLease = await beginValidationFreshnessBarrier({
+                    projectId: identity.projectId,
+                    specId: identity.specId,
+                    projectPath,
+                    handoffPath: join(projectDataDir(identity.projectId), 'handoffs', identity.specId),
+                    invalidateCurrentBindings: false,
+                });
+                const observed = await computeDurableValidationBindings({
+                    canonicalProjectId: identity.projectId,
+                    specId: identity.specId,
+                    projectPath,
+                    specPath,
+                });
+                const observedBindings = toValidationReceiptBindings(observed.bindings, observed.artifactDigests);
+                if (JSON.stringify(observedBindings) !== JSON.stringify(currentBindings) ||
+                    !(await bindValidationFreshnessLease(ownedLease, observedBindings))) {
+                    return { valid: false, reason: 'stale-bindings' };
+                }
+            }
+            if (!ownedLease) {
+                return { valid: false, reason: 'stale-bindings' };
+            }
+            const transferred = ownedLease;
+            ownedLease = undefined;
+            return { ...verification, freshnessLease: transferred };
+        }
+        finally {
+            if (ownedLease) {
+                await closeValidationFreshnessLease(ownedLease).catch((error) => {
+                    reportClassifiedDegradation('VALIDATION_FRESHNESS_CHECK_FAILED', error);
+                });
+            }
+        }
+    }
+    catch (e_1) {
+        env_1.error = e_1;
+        env_1.hasError = true;
+    }
+    finally {
+        __disposeResources(env_1);
+    }
+}
+//# sourceMappingURL=done-receipt-verifier.js.map

package/dist/tools/update-status/evidence-gate.js

@@ -1,3 +1,55 @@
+var __addDisposableResource = (this && this.__addDisposableResource) || function (env, value, async) {
+    if (value !== null && value !== void 0) {
+        if (typeof value !== "object" && typeof value !== "function") throw new TypeError("Object expected.");
+        var dispose, inner;
+        if (async) {
+            if (!Symbol.asyncDispose) throw new TypeError("Symbol.asyncDispose is not defined.");
+            dispose = value[Symbol.asyncDispose];
+        }
+        if (dispose === void 0) {
+            if (!Symbol.dispose) throw new TypeError("Symbol.dispose is not defined.");
+            dispose = value[Symbol.dispose];
+            if (async) inner = dispose;
+        }
+        if (typeof dispose !== "function") throw new TypeError("Object not disposable.");
+        if (inner) dispose = function() { try { inner.call(this); } catch (e) { return Promise.reject(e); } };
+        env.stack.push({ value: value, dispose: dispose, async: async });
+    }
+    else if (async) {
+        env.stack.push({ async: true });
+    }
+    return value;
+};
+var __disposeResources = (this && this.__disposeResources) || (function (SuppressedError) {
+    return function (env) {
+        function fail(e) {
+            env.error = env.hasError ? new SuppressedError(e, env.error, "An error was suppressed during disposal.") : e;
+            env.hasError = true;
+        }
+        var r, s = 0;
+        function next() {
+            while (r = env.stack.pop()) {
+                try {
+                    if (!r.async && s === 1) return s = 0, env.stack.push(r), Promise.resolve().then(next);
+                    if (r.dispose) {
+                        var result = r.dispose.call(r.value);
+                        if (r.async) return s |= 2, Promise.resolve(result).then(next, function(e) { fail(e); return next(); });
+                    }
+                    else s |= 1;
+                }
+                catch (e) {
+                    fail(e);
+                }
+            }
+            if (s === 1) return env.hasError ? Promise.reject(env.error) : Promise.resolve();
+            if (env.hasError) throw env.error;
+        }
+        return next();
+    };
+})(typeof SuppressedError === "function" ? SuppressedError : function (error, suppressed, message) {
+    var e = new Error(message);
+    return e.name = "SuppressedError", e.error = error, e.suppressed = suppressed, e;
+});
 import { readFile } from 'node:fs/promises';
 import { isAbsolute, join } from 'node:path';
 import { extractCriteria } from '../../engine/validator/extractors.js';
@@ -8,8 +60,31 @@ import { checkDoneDriftContract } from '../../engine/evidence-index/done-drift.j
 import { parseGroundedTechnicalPaths } from '../../engine/spec-grounding/contract.js';
 import { extractAcceptanceCriteriaTexts } from '../../engine/spec-format/acceptance-criteria.js';
 import { formatKeyValue } from '../output-formatter.js';
+import { RuntimeDatabase } from '../../storage/runtime-db.js';
+import { resolveStorageLayout } from '../../storage/storage-layout.js';
+import { ValidationReceiptStore, LOCAL_VALIDATION_RECEIPT_ISSUER, createValidationReceiptAuthority, readCurrentValidationReceipt, } from '../../engine/validation/validation-receipt.js';
+import { reportClassifiedDegradation } from '../../errors/classified-degradation.js';
+import { captureValidationFreshnessLease } from '../../engine/validation/validation-freshness.js';
+import { computeDurableValidationBindings, toValidationReceiptBindings, } from '../../engine/validation/durable-validation.js';
+import { checkReconciliationFreshness } from '../../engine/evidence-gates/reconciliation-freshness.js';
+import { extractCanonicalFileOwnership } from '../../engine/handoff-packager.js';
 /** SPEC-1054: BDD/SDD lifecycle evidence gate. */
 export async function checkLifecycleEvidenceTransitionGate(args) {
+    const staleReconciliationEvidence = await checkReconciliationFreshness({
+        projectId: args.projectId,
+        specId: args.specId,
+    });
+    if (staleReconciliationEvidence.length > 0) {
+        return evidenceGateError({
+            specId: args.specId,
+            transition: args.transition,
+            issues: staleReconciliationEvidence.map(({ artifactId }) => ({
+                code: 'SUPERSEDED_RECONCILIATION_EVIDENCE',
+                message: artifactId,
+            })),
+            requiredContractKinds: [],
+        });
+    }
     const [criteriaResult, artifacts] = await Promise.all([
         extractLifecycleGateCriteriaAndBody(args.spec, args.projectPath),
         readEvidenceArtifacts({
@@ -19,12 +94,29 @@ export async function checkLifecycleEvidenceTransitionGate(args) {
             projectPath: args.projectPath,
         }),
     ]);
+    const receiptResult = args.transition === 'done'
+        ? await readVerifiedCurrentReceipt({
+            projectId: args.projectId,
+            specId: args.specId,
+            projectPath: args.projectPath,
+            specPath: args.spec.specPath,
+        })
+        : null;
+    if (receiptResult && !receiptResult.ok) {
+        return evidenceGateError({
+            specId: args.specId,
+            transition: args.transition,
+            issues: [{ code: 'evidence_provenance_invalid', message: receiptResult.reason }],
+            requiredContractKinds: [],
+        });
+    }
     const { criteria, body } = criteriaResult;
     const result = checkLifecycleEvidenceGate({
         transition: args.transition,
         spec: args.spec,
         criteria,
         artifacts,
+        ...(receiptResult?.ok ? { receiptContext: { receipt: receiptResult.receipt } } : {}),
     });
     if (args.transition === 'done') {
         const index = await buildSpecEvidenceIndex({
@@ -33,8 +125,26 @@ export async function checkLifecycleEvidenceTransitionGate(args) {
             artifacts,
             projectPath: args.projectPath,
         });
+        const canonicalOwnership = body
+            ? extractCanonicalFileOwnership(body)
+            : { present: false, toCreate: [], toModify: [], toTest: [], blockers: [] };
         const groundedTechnicalPaths = body ? parseGroundedTechnicalPaths(body) : [];
-        result.issues.push(...checkDoneDriftContract({ index, groundedTechnicalPaths }));
+        const approvedScopePaths = [
+            ...new Set([
+                ...canonicalOwnership.toCreate,
+                ...canonicalOwnership.toModify,
+                ...canonicalOwnership.toTest,
+                ...groundedTechnicalPaths,
+            ]),
+        ];
+        if (canonicalOwnership.blockers.length > 0) {
+            const safeBlockers = canonicalOwnership.blockers.map((blocker) => blocker.startsWith('CONFLICTING_FILE_OWNERSHIP:') ? blocker : 'INVALID_FILE_OWNERSHIP');
+            result.issues.push({
+                code: 'done_drift_unapproved_scope',
+                message: `Approved canonical ownership is invalid: ${[...new Set(safeBlockers)].join(', ')}.`,
+            });
+        }
+        result.issues.push(...checkDoneDriftContract({ index, approvedScopePaths }));
     }
     if (result.issues.length === 0) {
         return null;
@@ -49,6 +159,82 @@ export async function checkLifecycleEvidenceTransitionGate(args) {
         requiredContractKinds: result.requiredContractKinds,
     });
 }
+async function readVerifiedCurrentReceipt(identity) {
+    try {
+        const env_1 = { stack: [], error: void 0, hasError: false };
+        try {
+            const database = __addDisposableResource(env_1, new RuntimeDatabase({ path: resolveStorageLayout().runtimeDatabase }), false);
+            const store = new ValidationReceiptStore({ database, workspaceId: 'global' });
+            const receipt = await readCurrentValidationReceipt(store, identity);
+            if (!receipt) {
+                return { ok: false, reason: 'missing-receipt' };
+            }
+            if (receipt.issuer !== LOCAL_VALIDATION_RECEIPT_ISSUER) {
+                return { ok: false, reason: 'unknown-issuer' };
+            }
+            const currentBindings = await store.readCurrentBindings(identity.projectId, identity.specId);
+            if (!currentBindings) {
+                return { ok: false, reason: 'stale-bindings' };
+            }
+            const { authority } = createValidationReceiptAuthority({
+                database,
+                workspaceId: 'global',
+                projectId: identity.projectId,
+                issuerId: LOCAL_VALIDATION_RECEIPT_ISSUER,
+            });
+            const verification = await authority.verifyCurrent({
+                ...currentBindings,
+                projectId: identity.projectId,
+                specId: identity.specId,
+            });
+            if (!verification.valid) {
+                return { ok: false, reason: verification.reason ?? 'invalid-receipt' };
+            }
+            if (!(await currentBindingsAreFresh(identity, currentBindings))) {
+                return { ok: false, reason: 'stale-bindings' };
+            }
+            return { ok: true, receipt };
+        }
+        catch (e_1) {
+            env_1.error = e_1;
+            env_1.hasError = true;
+        }
+        finally {
+            __disposeResources(env_1);
+        }
+    }
+    catch (error) {
+        return {
+            ok: false,
+            reason: error instanceof Error ? error.message : 'receipt-verification-failed',
+        };
+    }
+}
+async function currentBindingsAreFresh(identity, currentBindings) {
+    if (await captureValidationFreshnessLease(identity, currentBindings)) {
+        return true;
+    }
+    if (!identity.projectPath) {
+        return false;
+    }
+    try {
+        const specPath = isAbsolute(identity.specPath)
+            ? identity.specPath
+            : join(identity.projectPath, identity.specPath);
+        const observed = await computeDurableValidationBindings({
+            canonicalProjectId: identity.projectId,
+            specId: identity.specId,
+            projectPath: identity.projectPath,
+            specPath,
+        });
+        return (JSON.stringify(toValidationReceiptBindings(observed.bindings, observed.artifactDigests)) ===
+            JSON.stringify(currentBindings));
+    }
+    catch (error) {
+        reportClassifiedDegradation('VALIDATION_RECEIPT_RECOMPUTE_FAILED', error);
+        return false;
+    }
+}
 async function extractLifecycleGateCriteriaAndBody(spec, projectPath) {
     const specPath = isAbsolute(spec.specPath) || !projectPath ? spec.specPath : join(projectPath, spec.specPath);
     try {
@@ -58,8 +244,9 @@ async function extractLifecycleGateCriteriaAndBody(spec, projectPath) {
             return { criteria: [...new Set(criteria)], body: raw };
         }
     }
-    catch {
-        // Fall back to the broader validator extractor when the canonical file is unavailable.
+    catch (error) {
+        // reliability-compat: CANONICAL_CRITERIA_READ — fall back to the validator extractor
+        reportClassifiedDegradation('CANONICAL_CRITERIA_READ', error);
     }
     return { criteria: await extractCriteria(spec), body: null };
 }