@planu/cli 4.14.1 → 5.0.0

package/dist/engine/validation/validation-source-digest.js

@@ -0,0 +1,86 @@
+import { execFile } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { lstat, readFile, readlink } from 'node:fs/promises';
+import { join } from 'node:path';
+import { promisify } from 'node:util';
+import { isValidationSourcePath } from './validation-source-policy.js';
+const execFileAsync = promisify(execFile);
+const SOURCE_DIGEST_MAX_CONCURRENCY = 8;
+async function mapWithConcurrency(values, concurrency, worker) {
+    const results = new Array(values.length);
+    let cursor = 0;
+    const runners = Array.from({ length: Math.min(concurrency, values.length) }, async () => {
+        for (;;) {
+            const index = cursor;
+            cursor += 1;
+            if (index >= values.length) {
+                return;
+            }
+            results[index] = await worker(values[index]);
+        }
+    });
+    await Promise.all(runners);
+    return results;
+}
+export async function gitSourceTreeDigest(projectPath) {
+    try {
+        const gitOptions = { cwd: projectPath, encoding: 'utf8', maxBuffer: 16 * 1024 * 1024 };
+        const [trackedResult, untrackedResult] = await Promise.all([
+            execFileAsync('git', ['ls-files', '--cached', '-z'], gitOptions),
+            execFileAsync('git', ['ls-files', '--others', '--exclude-standard', '-z'], gitOptions),
+        ]);
+        const sourceEntries = (stdout) => stdout
+            .split('\0')
+            .filter(Boolean)
+            .map((sourcePath) => ({ sourcePath, canonicalPath: sourcePath.normalize('NFC') }))
+            .filter(({ canonicalPath }) => isValidationSourcePath(canonicalPath));
+        const entriesToRead = [
+            ...sourceEntries(trackedResult.stdout),
+            ...sourceEntries(untrackedResult.stdout),
+        ].sort((left, right) => Buffer.compare(Buffer.from(left.canonicalPath), Buffer.from(right.canonicalPath)));
+        if (new Set(entriesToRead.map(({ canonicalPath }) => canonicalPath)).size !== entriesToRead.length) {
+            throw new Error('source paths collide after Unicode normalization');
+        }
+        const entries = await mapWithConcurrency(entriesToRead, SOURCE_DIGEST_MAX_CONCURRENCY, async (entry) => {
+            const { canonicalPath: path, sourcePath } = entry;
+            const absolutePath = join(projectPath, sourcePath);
+            try {
+                const stats = await lstat(absolutePath);
+                if (stats.isSymbolicLink()) {
+                    const target = (await readlink(absolutePath)).normalize('NFC');
+                    return { path, content: Buffer.from(`symlink\0${target}`, 'utf8') };
+                }
+                if (!stats.isFile()) {
+                    throw new Error(`unsupported source entry type: ${path}`);
+                }
+                return {
+                    path,
+                    content: Buffer.concat([Buffer.from('file\0'), await readFile(absolutePath)]),
+                };
+            }
+            catch (error) {
+                if (error.code === 'ENOENT') {
+                    return undefined;
+                }
+                throw error;
+            }
+        });
+        const hash = createHash('sha256');
+        hash.update('planu-source-v1\0');
+        for (const entry of entries) {
+            if (!entry) {
+                continue;
+            }
+            const pathBytes = Buffer.from(entry.path, 'utf8');
+            hash.update(`${pathBytes.length}:`);
+            hash.update(pathBytes);
+            hash.update(`${entry.content.length}:`);
+            hash.update(entry.content);
+        }
+        return `sha256:${hash.digest('hex')}`;
+    }
+    catch (error) {
+        throw new Error('[Planu] Unable to bind validation to the source tree', { cause: error });
+    }
+}
+//# sourceMappingURL=validation-source-digest.js.map

package/dist/engine/validation/validation-submission.d.ts

@@ -1,12 +1,11 @@
 import type { DurableJobRuntime } from '../execution/job-runtime.js';
 import type { DurableJobRecord } from '../../storage/runtime-db.js';
 import type { DurableValidationBindings } from '../../types/durable-validation.js';
-import type { ValidationArtifactDigests } from '../../types/validation-receipt.js';
-import type { ValidationFreshnessLease } from './validation-freshness.js';
+import type { ValidationArtifactDigests, ValidationFreshnessLease } from '../../types/validation-receipt.js';
 /** Stable identity for exactly one immutable validation input tuple. */
-export declare function validationOperationId(bindings: DurableValidationBindings): string;
+export declare function validationOperationId(bindings: DurableValidationBindings, validationRootId: string): string;
 /** Stable identity used to acknowledge before repository-wide bindings are computed. */
-export declare function validationSubmissionOperationId(projectId: string, specId: string): string;
+export declare function validationSubmissionOperationId(projectId: string, specId: string, validationRootId: string): string;
 /** Accept one pre-bound durable validation for internal and compatibility callers. */
 export declare function createValidationSubmission(input: {
     readonly runtime: DurableJobRuntime;
@@ -16,6 +15,7 @@ export declare function createValidationSubmission(input: {
         readonly projectId?: string;
         readonly specPath?: string;
         readonly projectPath?: string;
+        readonly validationRootId: string;
     };
     readonly bindings: DurableValidationBindings;
     readonly artifactDigests?: ValidationArtifactDigests;
@@ -30,6 +30,7 @@ export declare function createPendingValidationSubmission(input: {
         readonly id: string;
         readonly specPath: string;
         readonly projectPath: string;
+        readonly validationRootId: string;
     };
     readonly deadlineAt: number;
 }): DurableJobRecord;

package/dist/engine/validation/validation-submission.js

@@ -1,5 +1,6 @@
 import { createHash } from 'node:crypto';
 import { DIGEST, PROJECT_ID as CANONICAL_PROJECT_ID, SPEC_ID as CANONICAL_SPEC_ID, } from './validation-receipt-codec.js';
+import { isValidationRootId } from './validation-worktree.js';
 function assertBindings(bindings) {
     if (!CANONICAL_PROJECT_ID.test(bindings.projectId)) {
         throw new Error('[Planu] Durable validation requires a canonical projectId');
@@ -17,11 +18,15 @@ function assertBindings(bindings) {
     }
 }
 /** Stable identity for exactly one immutable validation input tuple. */
-export function validationOperationId(bindings) {
+export function validationOperationId(bindings, validationRootId) {
     assertBindings(bindings);
+    if (!isValidationRootId(validationRootId)) {
+        throw new Error('[Planu] Durable validation requires a valid validationRootId');
+    }
     const operationDigest = createHash('sha256')
         .update(JSON.stringify([
-        'planu-validation-v1',
+        'planu-validation-v2',
+        validationRootId,
         bindings.projectId,
         bindings.specId,
         bindings.sourceTreeHash,
@@ -33,12 +38,14 @@ export function validationOperationId(bindings) {
     return `validation-${operationDigest}`;
 }
 /** Stable identity used to acknowledge before repository-wide bindings are computed. */
-export function validationSubmissionOperationId(projectId, specId) {
-    if (!CANONICAL_PROJECT_ID.test(projectId) || !CANONICAL_SPEC_ID.test(specId)) {
+export function validationSubmissionOperationId(projectId, specId, validationRootId) {
+    if (!CANONICAL_PROJECT_ID.test(projectId) ||
+        !CANONICAL_SPEC_ID.test(specId) ||
+        !isValidationRootId(validationRootId)) {
         throw new Error('[Planu] Invalid durable validation submission identity');
     }
     const operationDigest = createHash('sha256')
-        .update(JSON.stringify(['planu-validation-submission-v1', projectId, specId]))
+        .update(JSON.stringify(['planu-validation-submission-v2', projectId, specId, validationRootId]))
         .digest('hex');
     return `validation-${operationDigest}`;
 }
@@ -70,6 +77,9 @@ function existingOrAccept(input) {
 /** Accept one pre-bound durable validation for internal and compatibility callers. */
 export function createValidationSubmission(input) {
     assertBindings(input.bindings);
+    if (!isValidationRootId(input.spec.validationRootId) || !input.spec.specPath) {
+        throw new Error('[Planu] Durable validation requires a verified validation root and spec path');
+    }
     if (input.canonicalProjectId !== input.bindings.projectId ||
         input.spec.id !== input.bindings.specId) {
         throw new Error('[Planu] Durable validation binding identity mismatch');
@@ -79,7 +89,8 @@ export function createValidationSubmission(input) {
     }
     const payload = {
         kind: 'validate',
-        schemaVersion: 1,
+        schemaVersion: 2,
+        validationRootId: input.spec.validationRootId,
         input: {
             specId: input.spec.id,
             projectId: input.canonicalProjectId,
@@ -88,20 +99,22 @@ export function createValidationSubmission(input) {
         bindings: input.bindings,
         ...(input.artifactDigests === undefined ? {} : { artifactDigests: input.artifactDigests }),
         ...(input.freshnessLease === undefined ? {} : { freshnessLease: input.freshnessLease }),
-        ...(input.spec.specPath === undefined ? {} : { specPath: input.spec.specPath }),
+        specPath: input.spec.specPath ?? '',
         deadlineAt: input.deadlineAt,
     };
     return existingOrAccept({
         runtime: input.runtime,
         projectId: input.canonicalProjectId,
-        operationId: validationOperationId(input.bindings),
+        operationId: validationOperationId(input.bindings, input.spec.validationRootId),
         payload,
     });
 }
 /** Persist validation immediately; the worker computes and binds the source snapshot. */
 export function createPendingValidationSubmission(input) {
     if (!CANONICAL_PROJECT_ID.test(input.canonicalProjectId) ||
-        !CANONICAL_SPEC_ID.test(input.spec.id)) {
+        !CANONICAL_SPEC_ID.test(input.spec.id) ||
+        !isValidationRootId(input.spec.validationRootId) ||
+        !input.spec.specPath) {
         throw new Error('[Planu] Invalid durable validation submission identity');
     }
     if (!Number.isSafeInteger(input.deadlineAt) || input.deadlineAt <= Date.now()) {
@@ -109,7 +122,8 @@ export function createPendingValidationSubmission(input) {
     }
     const payload = {
         kind: 'validate',
-        schemaVersion: 1,
+        schemaVersion: 2,
+        validationRootId: input.spec.validationRootId,
         input: {
             specId: input.spec.id,
             projectId: input.canonicalProjectId,
@@ -121,7 +135,7 @@ export function createPendingValidationSubmission(input) {
     return existingOrAccept({
         runtime: input.runtime,
         projectId: input.canonicalProjectId,
-        operationId: validationSubmissionOperationId(input.canonicalProjectId, input.spec.id),
+        operationId: validationSubmissionOperationId(input.canonicalProjectId, input.spec.id, input.spec.validationRootId),
         payload,
     });
 }

package/dist/engine/validation/validation-worktree.d.ts

@@ -0,0 +1,21 @@
+import type { ResolvedValidationWorktree, ValidationWorktreeErrorCode } from '../../types/durable-validation.js';
+export declare class ValidationWorktreeError extends Error {
+    readonly code: ValidationWorktreeErrorCode;
+    readonly specId: string;
+    readonly relativeSpecPath?: string;
+    constructor(code: ValidationWorktreeErrorCode, specId: string, relativeSpecPath?: string);
+}
+export declare function resolveValidationWorktree(input: {
+    requestedProjectPath: string;
+    canonicalProjectPath: string;
+    canonicalSpecPath: string;
+    specId: string;
+}): Promise<ResolvedValidationWorktree>;
+export declare function revalidateValidationWorktree(input: {
+    projectPath: string;
+    specPath: string;
+    specId: string;
+    validationRootId: string;
+}): Promise<ResolvedValidationWorktree>;
+export declare function isValidationRootId(value: unknown): value is string;
+//# sourceMappingURL=validation-worktree.d.ts.map

package/dist/engine/validation/validation-worktree.js

@@ -0,0 +1,260 @@
+import { execFile } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { lstat, readFile, realpath } from 'node:fs/promises';
+import { basename, dirname, isAbsolute, relative, resolve, sep } from 'node:path';
+import { promisify } from 'node:util';
+import { reportClassifiedDegradation } from '../../errors/classified-degradation.js';
+import { parseFrontmatter } from '../frontmatter-parser.js';
+const runFile = promisify(execFile);
+const ROOT_ID = /^[a-f0-9]{64}$/u;
+const SAFE_SPEC_ID = /^SPEC-[1-9]\d*$/u;
+const PORTABLE_SPEC = /^planu\/specs\/(SPEC-\d{3,}(?:-[^/]+)?)\/spec\.md$/u;
+export class ValidationWorktreeError extends Error {
+    code;
+    specId;
+    relativeSpecPath;
+    constructor(code, specId, relativeSpecPath) {
+        const safeSpecId = SAFE_SPEC_ID.test(specId) ? specId : 'SPEC-unknown';
+        const safeRelativeSpecPath = relativeSpecPath !== undefined && PORTABLE_SPEC.test(relativeSpecPath)
+            ? relativeSpecPath
+            : undefined;
+        super(`[Planu] ${code} spec=${safeSpecId}${safeRelativeSpecPath ? ` path=${safeRelativeSpecPath}` : ''}`);
+        this.code = code;
+        this.name = 'ValidationWorktreeError';
+        this.specId = safeSpecId;
+        this.relativeSpecPath = safeRelativeSpecPath;
+    }
+}
+function fail(code, specId, relativeSpecPath) {
+    throw new ValidationWorktreeError(code, specId, relativeSpecPath);
+}
+function isEnoent(error) {
+    return error.code === 'ENOENT';
+}
+async function gitPath(projectPath, argument) {
+    try {
+        const result = await runFile('git', ['-C', projectPath, 'rev-parse', argument], {
+            encoding: 'utf8',
+            timeout: 10_000,
+            maxBuffer: 64 * 1024,
+        });
+        const output = result.stdout.trim();
+        return await realpath(isAbsolute(output) ? output : resolve(projectPath, output));
+    }
+    catch (error) {
+        reportClassifiedDegradation('VALIDATION_GIT_PATH_PROBE', error);
+        return null;
+    }
+}
+async function resolveGitMembership(projectPath, specId) {
+    let requestedRoot;
+    try {
+        requestedRoot = await realpath(projectPath);
+    }
+    catch (error) {
+        reportClassifiedDegradation('VALIDATION_ROOT_REALPATH', error);
+    }
+    if (requestedRoot === undefined) {
+        fail('VALIDATION_ROOT_NOT_GIT_WORKTREE', specId);
+    }
+    const [topLevel, commonDir] = await Promise.all([
+        gitPath(requestedRoot, '--show-toplevel'),
+        gitPath(requestedRoot, '--git-common-dir'),
+    ]);
+    if (topLevel === null || commonDir === null) {
+        fail('VALIDATION_ROOT_NOT_GIT_WORKTREE', specId);
+    }
+    return { projectPath: topLevel, gitCommonDir: commonDir };
+}
+async function resolveGitRoot(projectPath, specId) {
+    let requestedRoot;
+    try {
+        requestedRoot = await realpath(projectPath);
+    }
+    catch (error) {
+        reportClassifiedDegradation('VALIDATION_ROOT_REALPATH', error);
+    }
+    if (requestedRoot === undefined) {
+        fail('VALIDATION_ROOT_NOT_GIT_WORKTREE', specId);
+    }
+    const membership = await resolveGitMembership(requestedRoot, specId);
+    if (membership.projectPath !== requestedRoot) {
+        fail('VALIDATION_ROOT_NOT_GIT_WORKTREE', specId);
+    }
+    return membership;
+}
+async function resolveSpecSourceRoot(input) {
+    const specPath = isAbsolute(input.canonicalSpecPath)
+        ? input.canonicalSpecPath
+        : resolve(input.canonical.projectPath, input.canonicalSpecPath);
+    let source;
+    try {
+        source = await resolveGitMembership(dirname(specPath), input.specId);
+    }
+    catch {
+        throw new ValidationWorktreeError('VALIDATION_SPEC_PATH_TRAVERSAL', input.specId);
+    }
+    if (source.gitCommonDir !== input.canonical.gitCommonDir) {
+        fail('VALIDATION_COMMON_DIR_MISMATCH', input.specId);
+    }
+    return { projectPath: source.projectPath, specPath };
+}
+async function portableSpecPath(projectPath, submittedSpecPath, specId) {
+    const candidate = isAbsolute(submittedSpecPath)
+        ? submittedSpecPath
+        : resolve(projectPath, submittedSpecPath);
+    let stats;
+    try {
+        stats = await lstat(candidate);
+    }
+    catch (error) {
+        if (!isEnoent(error)) {
+            reportClassifiedDegradation('VALIDATION_SPEC_STAT_FAILED', error);
+        }
+    }
+    if (stats === undefined) {
+        const normalizedMissingPath = await resolveFromExistingAncestor(candidate);
+        if (!contained(projectPath, normalizedMissingPath)) {
+            fail('VALIDATION_SPEC_PATH_TRAVERSAL', specId);
+        }
+        fail('VALIDATION_SPEC_NOT_FOUND', specId);
+    }
+    if (stats.isSymbolicLink()) {
+        fail('VALIDATION_SPEC_PATH_SYMLINK', specId);
+    }
+    let canonicalPath;
+    try {
+        canonicalPath = await realpath(candidate);
+    }
+    catch (error) {
+        reportClassifiedDegradation('VALIDATION_SPEC_REALPATH_FAILED', error);
+    }
+    if (canonicalPath === undefined || !contained(projectPath, canonicalPath)) {
+        fail('VALIDATION_SPEC_PATH_TRAVERSAL', specId);
+    }
+    const portablePath = relative(projectPath, canonicalPath).replaceAll('\\', '/');
+    const match = PORTABLE_SPEC.exec(portablePath);
+    if (!match?.[1] || (match[1] !== specId && !match[1].startsWith(`${specId}-`))) {
+        fail('VALIDATION_SPEC_PATH_TRAVERSAL', specId);
+    }
+    return portablePath;
+}
+function contained(root, candidate) {
+    const path = relative(root, candidate);
+    return path.length > 0 && path !== '..' && !path.startsWith(`..${sep}`) && !isAbsolute(path);
+}
+async function resolveFromExistingAncestor(candidate) {
+    const suffix = [];
+    let cursor = candidate;
+    for (;;) {
+        let resolvedAncestor;
+        try {
+            resolvedAncestor = await realpath(cursor);
+        }
+        catch (error) {
+            if (!isEnoent(error)) {
+                reportClassifiedDegradation('VALIDATION_ANCESTOR_REALPATH_FAILED', error);
+            }
+        }
+        if (resolvedAncestor !== undefined) {
+            return resolve(resolvedAncestor, ...suffix.reverse());
+        }
+        const parent = dirname(cursor);
+        if (parent === cursor) {
+            return candidate;
+        }
+        suffix.push(basename(cursor));
+        cursor = parent;
+    }
+}
+async function resolveSpec(projectPath, relativeSpecPath, specId) {
+    const candidate = resolve(projectPath, relativeSpecPath);
+    if (!contained(projectPath, candidate)) {
+        fail('VALIDATION_SPEC_PATH_TRAVERSAL', specId, relativeSpecPath);
+    }
+    let stats;
+    try {
+        stats = await lstat(candidate);
+    }
+    catch (error) {
+        if (!isEnoent(error)) {
+            reportClassifiedDegradation('VALIDATION_SPEC_STAT_FAILED', error);
+        }
+    }
+    if (stats === undefined) {
+        fail('VALIDATION_SPEC_NOT_FOUND', specId, relativeSpecPath);
+    }
+    if (stats.isSymbolicLink()) {
+        fail('VALIDATION_SPEC_PATH_SYMLINK', specId, relativeSpecPath);
+    }
+    if (!stats.isFile()) {
+        fail('VALIDATION_SPEC_NOT_FOUND', specId, relativeSpecPath);
+    }
+    let specPath;
+    try {
+        specPath = await realpath(candidate);
+    }
+    catch (error) {
+        reportClassifiedDegradation('VALIDATION_SPEC_REALPATH_FAILED', error);
+    }
+    if (specPath === undefined || !contained(projectPath, specPath)) {
+        fail('VALIDATION_SPEC_PATH_TRAVERSAL', specId, relativeSpecPath);
+    }
+    let content;
+    try {
+        content = await readFile(specPath, 'utf8');
+    }
+    catch (error) {
+        if (!isEnoent(error)) {
+            reportClassifiedDegradation('VALIDATION_SPEC_READ_FAILED', error);
+        }
+    }
+    const parsedId = content === undefined ? undefined : parseFrontmatter(content).metadata.id;
+    if (parsedId !== specId) {
+        fail('VALIDATION_SPEC_ID_MISMATCH', specId, relativeSpecPath);
+    }
+    return { specPath, relativeSpecPath };
+}
+function buildValidationRootId(projectPath, gitCommonDir) {
+    return createHash('sha256')
+        .update(`validation-root/v1\0${projectPath}\0${gitCommonDir}`)
+        .digest('hex');
+}
+export async function resolveValidationWorktree(input) {
+    const [requested, canonical] = await Promise.all([
+        resolveGitRoot(input.requestedProjectPath, input.specId),
+        resolveGitRoot(input.canonicalProjectPath, input.specId),
+    ]);
+    if (requested.gitCommonDir !== canonical.gitCommonDir) {
+        fail('VALIDATION_COMMON_DIR_MISMATCH', input.specId);
+    }
+    const source = await resolveSpecSourceRoot({
+        canonical,
+        canonicalSpecPath: input.canonicalSpecPath,
+        specId: input.specId,
+    });
+    const relativeSpecPath = await portableSpecPath(source.projectPath, source.specPath, input.specId);
+    const spec = await resolveSpec(requested.projectPath, relativeSpecPath, input.specId);
+    return {
+        ...requested,
+        ...spec,
+        validationRootId: buildValidationRootId(requested.projectPath, requested.gitCommonDir),
+    };
+}
+export async function revalidateValidationWorktree(input) {
+    if (!ROOT_ID.test(input.validationRootId)) {
+        fail('VALIDATION_ROOT_ID_MALFORMED', input.specId);
+    }
+    const root = await resolveGitRoot(input.projectPath, input.specId);
+    const relativeSpecPath = await portableSpecPath(root.projectPath, input.specPath, input.specId);
+    const spec = await resolveSpec(root.projectPath, relativeSpecPath, input.specId);
+    const observedRootId = buildValidationRootId(root.projectPath, root.gitCommonDir);
+    if (observedRootId !== input.validationRootId) {
+        fail('VALIDATION_ROOT_ID_MISMATCH', input.specId, spec.relativeSpecPath);
+    }
+    return { ...root, ...spec, validationRootId: observedRootId };
+}
+export function isValidationRootId(value) {
+    return typeof value === 'string' && ROOT_ID.test(value);
+}
+//# sourceMappingURL=validation-worktree.js.map

package/dist/engine/validation-impact-planner.d.ts

@@ -1,4 +1,16 @@
-import type { ValidationGateCapability, ValidationImpactPlan } from '../types/validation-evidence.js';
-export declare const VALIDATION_COMMANDS: Readonly<Record<ValidationGateCapability, string>>;
+import type { ValidationImpactPlan } from '../types/validation-evidence.js';
+export declare const VALIDATION_COMMANDS: {
+    readonly typecheck: 'pnpm typecheck';
+    readonly lint: 'pnpm lint';
+    readonly 'test-related': 'pnpm test --run --changed';
+    readonly 'test-full': 'pnpm test';
+    readonly contract: 'pnpm test:contracts';
+    readonly coverage: 'pnpm test:coverage';
+    readonly migration: 'pnpm test:migrations';
+    readonly 'fault-injection': 'pnpm test:fault-injection';
+    readonly security: 'pnpm check:deps:fresh';
+    readonly native: 'pnpm native:project-graph:e2e';
+    readonly website: 'pnpm --dir website build';
+};
 export declare function planValidationImpact(paths: readonly string[]): ValidationImpactPlan;
 //# sourceMappingURL=validation-impact-planner.d.ts.map

package/dist/engine/validation-impact-planner.js

@@ -10,7 +10,6 @@ export const VALIDATION_COMMANDS = {
     security: 'pnpm check:deps:fresh',
     native: 'pnpm native:project-graph:e2e',
     website: 'pnpm --dir website build',
-    reproducibility: 'bash scripts/check-reproducibility.sh',
 };
 const LIFECYCLE_RE = /^(?:planu\/|docs\/|README(?:\.|$)|CHANGELOG\.md$|[^/]+\.md$)/;
 const SOURCE_RE = /^(?:src\/|tests\/)/;
@@ -44,7 +43,6 @@ export function planValidationImpact(paths) {
         else if (NATIVE_RE.test(path)) {
             kind = 'native';
             gates.add('native');
-            gates.add('reproducibility');
             gates.add('test-full');
         }
         else if (DEPENDENCY_RE.test(path)) {
@@ -71,7 +69,6 @@ function fullPlan(reason, changedPaths) {
         'migration',
         'fault-injection',
         'native',
-        'reproducibility',
     ];
     if (changedPaths.some((path) => path.startsWith('website/'))) {
         gates.push('website');

package/dist/engine/validator/dor-dod.d.ts

@@ -1,4 +1,5 @@
 import type { Spec, ValidateResult, DefinitionOfReady, DefinitionOfDone, CodeState } from '../../types/index.js';
+export declare function isBlockingQualitySeverity(severity: unknown): boolean;
 /**
  * Generate a Definition of Ready checklist for a spec.
  */

package/dist/engine/validator/dor-dod.js

@@ -5,6 +5,9 @@ import { runAllGates } from './gates/index.js';
 /** Minimum test file count that auto-passes test gates (batch-implementation heuristic). */
 const BATCH_TEST_THRESHOLD = 5;
 import { parseProgressActuals } from '../actuals/progress-parser.js';
+export function isBlockingQualitySeverity(severity) {
+    return severity !== 'info' && severity !== 'warning';
+}
 function buildDoRSpecItems(spec) {
     // Adapt description to actual file name (modern: spec.md, legacy: HU.md)
     const specFileName = spec.specPath ? basename(spec.specPath) : 'spec.md';
@@ -320,9 +323,8 @@ function gateCategory(gate) {
  */
 export async function generateDoD(spec, validationResult, codeState, projectPath) {
     const score = validationResult?.score ?? 0;
-    // Only errors and critical issues block DoD — warnings and info are non-blocking
-    const blockingSeverities = ['error', 'critical'];
-    const hasBlockingQualityIssues = validationResult?.qualityIssues.some((i) => blockingSeverities.includes(i.severity)) ?? false;
+    const hasBlockingQualityIssues = validationResult?.qualityIssues.some((issue) => isBlockingQualitySeverity(issue.severity)) ??
+        false;
     const hasTestFiles = await detectTestFiles(spec, codeState);
     const items = buildDoDItems(spec, score, hasBlockingQualityIssues, hasTestFiles);
     // Override actuals check with progress.md parsing

package/dist/engine/validator/extractors.d.ts

@@ -1,4 +1,5 @@
 import type { Spec, VerifyBlock } from '../../types/index.js';
+export { extractListItems, extractSection } from '../spec-format/markdown-sections.js';
 /**
  * Extract all acceptance criteria from a spec's source files.
  */
@@ -13,9 +14,4 @@ export declare function extractVerifyBlocks(content: string): Map<string, Verify
 /**
  * Extract the text content under a markdown heading that matches any of the given keywords.
  */
-export declare function extractSection(content: string, ...headingKeywords: string[]): string | null;
-/**
- * Extract bullet/numbered list items from a markdown text block.
- */
-export declare function extractListItems(content: string): string[];
 //# sourceMappingURL=extractors.d.ts.map