@planu/cli 4.2.1 → 4.2.3

package/CHANGELOG.md

@@ -1,3 +1,21 @@
+## [4.2.3] - 2026-05-22
+
+**Tarball SHA-256:** `6d23ef6f7bd12e2a94eb9984e272beb37cd0d9b54ad12170529f95ca870e46a4`
+
+### Features
+- feat(planu): require implementation reviewer gate
+
+
+## [4.2.2] - 2026-05-21
+
+**Tarball SHA-256:** `83193f54dc2fc5f461ef38b8bf2a9931d5d587ece50c77836942351e39b3c415`
+
+### Bug Fixes
+- fix(release): isolate npm publish cache
+- fix(release): sync native lockfile without moving dev dependencies
+- fix(ci): harden dependency freshness parsing
+
+
 ## [4.2.1] - 2026-05-21
 
 **Tarball SHA-256:** `9ff8a396e25eba3e4941bbef80ee19cc41bae46eaafa703cd32092c7ffbfdf2e`

package/dist/engine/handoff-artifacts/schemas.d.ts

@@ -57,6 +57,31 @@ export declare const ValidationReportV1Schema: z.ZodObject<{
         passed: z.ZodBoolean;
         reason: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>>;
+    reviewer: z.ZodObject<{
+        kind: z.ZodEnum<{
+            human: "human";
+            "implementation-review-agent": "implementation-review-agent";
+            automation: "automation";
+        }>;
+        agent: z.ZodString;
+        verdict: z.ZodEnum<{
+            approved: "approved";
+            "changes-requested": "changes-requested";
+        }>;
+    }, z.core.$strip>;
+    specCompliance: z.ZodOptional<z.ZodObject<{
+        score: z.ZodNumber;
+        command: z.ZodString;
+        scenarios: z.ZodArray<z.ZodObject<{
+            title: z.ZodString;
+            verdict: z.ZodEnum<{
+                fail: "fail";
+                missing: "missing";
+                pass: "pass";
+            }>;
+            evidence: z.ZodArray<z.ZodString>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
     score: z.ZodOptional<z.ZodNumber>;
     completedAt: z.ZodISODateTime;
 }, z.core.$strip>;
@@ -116,6 +141,31 @@ export declare const ARTIFACT_SCHEMAS: {
             passed: z.ZodBoolean;
             reason: z.ZodOptional<z.ZodString>;
         }, z.core.$strip>>;
+        reviewer: z.ZodObject<{
+            kind: z.ZodEnum<{
+                human: "human";
+                "implementation-review-agent": "implementation-review-agent";
+                automation: "automation";
+            }>;
+            agent: z.ZodString;
+            verdict: z.ZodEnum<{
+                approved: "approved";
+                "changes-requested": "changes-requested";
+            }>;
+        }, z.core.$strip>;
+        specCompliance: z.ZodOptional<z.ZodObject<{
+            score: z.ZodNumber;
+            command: z.ZodString;
+            scenarios: z.ZodArray<z.ZodObject<{
+                title: z.ZodString;
+                verdict: z.ZodEnum<{
+                    fail: "fail";
+                    missing: "missing";
+                    pass: "pass";
+                }>;
+                evidence: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>;
+        }, z.core.$strip>>;
         score: z.ZodOptional<z.ZodNumber>;
         completedAt: z.ZodISODateTime;
     }, z.core.$strip>;

package/dist/engine/handoff-artifacts/schemas.js

@@ -50,6 +50,22 @@ export const ValidationReportV1Schema = z.object({
         passed: z.boolean(),
         reason: z.string().optional(),
     })),
+    reviewer: z.object({
+        kind: z.enum(['implementation-review-agent', 'human', 'automation']),
+        agent: z.string().min(1),
+        verdict: z.enum(['approved', 'changes-requested']),
+    }),
+    specCompliance: z
+        .object({
+        score: z.number().min(0).max(100),
+        command: z.string(),
+        scenarios: z.array(z.object({
+            title: z.string(),
+            verdict: z.enum(['pass', 'fail', 'missing']),
+            evidence: z.array(z.string()),
+        })),
+    })
+        .optional(),
     score: z.number().optional(),
     completedAt: z.iso.datetime(),
 });

package/dist/engine/validator/validation-report-writer.d.ts

@@ -0,0 +1,21 @@
+import type { Spec } from '../../types/index.js';
+import type { ValidationReportV1 } from '../../types/handoff-artifacts.js';
+export declare function writeImplementationReviewReport(input: {
+    projectId: string;
+    specId: string;
+    spec: Spec;
+    projectPath: string;
+    score: number | null;
+    lintPassed?: boolean;
+    conventionRegression?: boolean;
+}): Promise<{
+    written: boolean;
+    path?: string;
+    sha?: string;
+    error?: string;
+    reviewer: ValidationReportV1['reviewer'];
+    passed: boolean;
+    gates: ValidationReportV1['gates'];
+    specCompliance: NonNullable<ValidationReportV1['specCompliance']>;
+}>;
+//# sourceMappingURL=validation-report-writer.d.ts.map

package/dist/engine/validator/validation-report-writer.js

@@ -0,0 +1,106 @@
+import { appendArtifact } from '../handoff-artifacts/io.js';
+import { runSpecCompliance, } from './spec-compliance-runner.js';
+export async function writeImplementationReviewReport(input) {
+    const specCompliance = await runSpecCompliance(input.spec, input.projectPath);
+    const gates = buildGates({
+        score: input.score,
+        lintPassed: input.lintPassed ?? true,
+        conventionRegression: input.conventionRegression ?? false,
+        specCompliance,
+    });
+    const passed = gates.every((gate) => gate.passed);
+    const reviewer = {
+        kind: 'implementation-review-agent',
+        agent: 'planu-implementation-reviewer',
+        verdict: passed ? 'approved' : 'changes-requested',
+    };
+    const reportCompliance = toValidationReportCompliance(specCompliance);
+    const payload = {
+        schema_version: '1.0.0',
+        specId: input.specId,
+        passed,
+        gates,
+        reviewer,
+        specCompliance: reportCompliance,
+        score: input.score ?? undefined,
+        completedAt: new Date().toISOString(),
+    };
+    try {
+        const artifact = await appendArtifact({
+            projectId: input.projectId,
+            specId: input.specId,
+            kind: 'validation-report',
+            payload,
+        });
+        return {
+            written: true,
+            path: artifact.path,
+            sha: artifact.sha,
+            reviewer,
+            passed,
+            gates,
+            specCompliance: reportCompliance,
+        };
+    }
+    catch (err) {
+        return {
+            written: false,
+            error: err instanceof Error ? err.message : String(err),
+            reviewer,
+            passed,
+            gates,
+            specCompliance: reportCompliance,
+        };
+    }
+}
+function buildGates(args) {
+    return [
+        {
+            name: 'validate-score',
+            passed: args.score === 100,
+            reason: args.score === 100
+                ? undefined
+                : `Expected validation score 100 before done, got ${String(args.score ?? 'unscored')}.`,
+        },
+        {
+            name: 'lint',
+            passed: args.lintPassed,
+            reason: args.lintPassed ? undefined : 'Configured lint command failed.',
+        },
+        {
+            name: 'convention-regression',
+            passed: !args.conventionRegression,
+            reason: args.conventionRegression ? 'Convention baseline regression detected.' : undefined,
+        },
+        buildSpecComplianceGate(args.specCompliance),
+    ];
+}
+function buildSpecComplianceGate(result) {
+    if (result.perScenario.length === 0) {
+        return {
+            name: 'spec-compliance',
+            passed: true,
+            reason: 'No executable scenarios declared; spec-compliance runner skipped.',
+        };
+    }
+    const passed = result.dimensionScore === 100;
+    return {
+        name: 'spec-compliance',
+        passed,
+        reason: passed
+            ? undefined
+            : `Expected all executable scenarios to pass, got ${String(result.dimensionScore)}.`,
+    };
+}
+function toValidationReportCompliance(result) {
+    return {
+        score: result.dimensionScore,
+        command: result.command,
+        scenarios: result.perScenario.map((scenario) => ({
+            title: scenario.title,
+            verdict: scenario.verdict,
+            evidence: scenario.evidence,
+        })),
+    };
+}
+//# sourceMappingURL=validation-report-writer.js.map

package/dist/tools/update-status/dod-gates.d.ts

@@ -45,7 +45,10 @@ export type ValidateGateResult = {
  * @param forceStatusReason  Why — required and ≥100 chars when forceStatus=true.
  * @param budgetMs        Max milliseconds to wait for validate. Default: 9000.
  */
-export declare function runValidateGate(spec: Spec, projectPath: string, forceStatus: boolean, forceStatusReason: string | undefined, budgetMs?: number): Promise<ValidateGateResult>;
+export declare function runValidateGate(spec: Spec, projectPath: string, forceStatus: boolean, forceStatusReason: string | undefined, budgetMs?: number, reviewContext?: {
+    projectId: string;
+    specId: string;
+}): Promise<ValidateGateResult>;
 /**
  * Checks the DoD gate before transitioning to 'done'.
  * Returns an error ToolResult if blocked (unless force=true), null if passed.
@@ -71,9 +74,8 @@ export interface DoneGateResult {
 }
 /**
  * SPEC-725: Check the validation-report artifact gate before marking done.
- * If a validation-report.json exists and payload.passed === false, block transition.
- * If the artifact is absent, allow (backward compat).
- * Never throws — always best-effort.
+ * SPEC-1050: Fail closed. A done transition requires a fresh validation-report
+ * with reviewer evidence and all validation gates passing.
  */
 export declare function checkValidationReportGate(specId: string, projectId: string, force: boolean | undefined): Promise<ToolResult | null>;
 /**

package/dist/tools/update-status/dod-gates.js

@@ -8,6 +8,7 @@ import { getComplianceGateConfig } from '../../storage/compliance-gate-config-st
 import { readJson, writeJson, projectDataDir } from '../../storage/base-store.js';
 import { randomUUID } from 'node:crypto';
 import { withEscalation } from '../../engine/escalator/with-escalation.js';
+import { writeImplementationReviewReport } from '../../engine/validator/validation-report-writer.js';
 /**
  * SPEC-721 / SPEC-222 Trigger 1: Run validate engine before marking done.
  *
@@ -24,7 +25,7 @@ import { withEscalation } from '../../engine/escalator/with-escalation.js';
  * @param forceStatusReason  Why — required and ≥100 chars when forceStatus=true.
  * @param budgetMs        Max milliseconds to wait for validate. Default: 9000.
  */
-export async function runValidateGate(spec, projectPath, forceStatus, forceStatusReason, budgetMs = 9_000) {
+export async function runValidateGate(spec, projectPath, forceStatus, forceStatusReason, budgetMs = 9_000, reviewContext) {
     // ---- Path A: explicit force bypass ----------------------------------------
     if (forceStatus) {
         if (!forceStatusReason || forceStatusReason.trim().length < 100) {
@@ -96,13 +97,29 @@ export async function runValidateGate(spec, projectPath, forceStatus, forceStatu
         };
     }
     // ---- Normal score check — scoreValue is guaranteed number here (null/undefined filtered above) ---
-    if (scoreValue < 70) {
+    if (scoreValue < 100) {
+        if (reviewContext) {
+            await writeImplementationReviewReport({
+                ...reviewContext,
+                spec,
+                projectPath,
+                score: scoreValue,
+            });
+        }
         return {
             blocked: true,
             score: scoreValue,
             reason: 'validate_score_below_threshold',
         };
     }
+    if (reviewContext) {
+        await writeImplementationReviewReport({
+            ...reviewContext,
+            spec,
+            projectPath,
+            score: scoreValue,
+        });
+    }
     return { blocked: false, score: scoreValue, forced: false };
 }
 /**
@@ -243,9 +260,8 @@ async function recordForceDoneBypass(specId, projectId, failingItems, warningIte
 }
 /**
  * SPEC-725: Check the validation-report artifact gate before marking done.
- * If a validation-report.json exists and payload.passed === false, block transition.
- * If the artifact is absent, allow (backward compat).
- * Never throws — always best-effort.
+ * SPEC-1050: Fail closed. A done transition requires a fresh validation-report
+ * with reviewer evidence and all validation gates passing.
  */
 export async function checkValidationReportGate(specId, projectId, force) {
     if (force) {
@@ -254,46 +270,80 @@ export async function checkValidationReportGate(specId, projectId, force) {
     try {
         const { readArtifact } = await import('../../engine/handoff-artifacts/io.js');
         const result = await readArtifact({ projectId, specId, kind: 'validation-report' });
-        // If not found (ARTIFACT_NOT_FOUND), allow — backward compat
         if (!result.ok) {
             const firstErr = result.errors[0];
             if (firstErr?.code === 'ARTIFACT_NOT_FOUND') {
-                return null;
+                return validationReportGateError({
+                    specId,
+                    error: 'validation_report_missing',
+                    message: 'No validation-report artifact exists for this spec. Run validate to generate implementation-review evidence before marking done.',
+                    gates: [],
+                    fixHint: 'Run validate for this spec, fix any failing gates, then retry update_status(done). Use force:true only with an audited reason.',
+                });
             }
-            // Other errors (malformed file) — best-effort: allow
-            return null;
+            return validationReportGateError({
+                specId,
+                error: 'validation_report_invalid',
+                message: 'The validation-report artifact is malformed or uses an obsolete schema. Re-run validate so Planu can generate reviewer evidence.',
+                gates: [],
+                fixHint: 'Re-run validate for this spec. The report must include reviewer evidence and passing gates.',
+            });
         }
         if (!result.payload.passed) {
-            const artifactPath = `external Planu project data: handoffs/${specId}/validation-report.json`;
-            return {
-                content: [
-                    {
-                        type: 'text',
-                        text: JSON.stringify({
-                            error: 'validation_report_failed',
-                            message: `Validation report at ${artifactPath} has passed: false — fix all failing gates before marking done.`,
-                            artifactPath,
-                            gates: result.payload.gates,
-                            fixHint: 'Fix all failing gates and re-run validation, then retry update_status(done). Use force:true to bypass.',
-                        }, null, 2),
-                    },
-                ],
-                isError: true,
-                structuredContent: {
-                    error: 'validation_report_failed',
-                    code: 422,
-                    context: { specId, artifactPath, gates: result.payload.gates },
-                    fixHint: 'Fix failing gates and re-run validation. Use force:true to bypass.',
-                },
-            };
+            return validationReportGateError({
+                specId,
+                error: 'validation_report_failed',
+                message: 'Validation report has passed:false — fix all failing gates before marking done.',
+                gates: result.payload.gates,
+                fixHint: 'Fix failing gates and re-run validate before marking done.',
+            });
+        }
+        if (result.payload.reviewer.verdict !== 'approved' ||
+            result.payload.reviewer.agent.trim().length === 0) {
+            return validationReportGateError({
+                specId,
+                error: 'validation_report_reviewer_not_approved',
+                message: 'The implementation reviewer did not approve this spec. Fix the requested changes and re-run validate.',
+                gates: result.payload.gates,
+                fixHint: 'Fix reviewer findings and re-run validate before marking done.',
+            });
         }
         return null;
     }
-    catch {
-        /* best-effort — never block transition */
-        return null;
+    catch (err) {
+        return validationReportGateError({
+            specId,
+            error: 'validation_report_unreadable',
+            message: `Could not read validation-report artifact: ${err instanceof Error ? err.message : String(err)}`,
+            gates: [],
+            fixHint: 'Re-run validate for this spec, then retry update_status(done).',
+        });
     }
 }
+function validationReportGateError(args) {
+    const artifactPath = `external Planu project data: handoffs/${args.specId}/validation-report.json`;
+    return {
+        content: [
+            {
+                type: 'text',
+                text: JSON.stringify({
+                    error: args.error,
+                    message: args.message,
+                    artifactPath,
+                    gates: args.gates,
+                    fixHint: args.fixHint,
+                }, null, 2),
+            },
+        ],
+        isError: true,
+        structuredContent: {
+            error: args.error,
+            code: 422,
+            context: { specId: args.specId, artifactPath, gates: args.gates },
+            fixHint: args.fixHint,
+        },
+    };
+}
 /**
  * SPEC-335: Combined done-gates runner — DoD + security.
  * When force=true, gates are not blocking but failing items are recorded in
@@ -309,11 +359,6 @@ export async function checkDoneGates(spec, specId, projectId, projectPath, force
         if (secError) {
             return { blocked: secError, forcedBypassWarning: null };
         }
-        // SPEC-725: Check validation-report artifact gate
-        const validationReportError = await checkValidationReportGate(specId, projectId, false);
-        if (validationReportError) {
-            return { blocked: validationReportError, forcedBypassWarning: null };
-        }
         return { blocked: null, forcedBypassWarning: null };
     }
     // force=true: run DoD in audit mode — collect results but do not block

package/dist/tools/update-status/index.js

@@ -13,7 +13,7 @@ import { checkApprovedDepGate } from '../../engine/dep-guard/index.js';
 import { checkApprovalGate } from '../../engine/approval-workflow.js';
 import * as approvalStore from '../../storage/approval-store.js';
 import { isLocked, getLock } from '../../storage/spec-lock-store.js';
-import { runValidateGate, checkDoneGates, checkComplianceGate, checkQaGate, checkApprovedFormatGate, } from './dod-gates.js';
+import { runValidateGate, checkDoneGates, checkComplianceGate, checkQaGate, checkApprovedFormatGate, checkValidationReportGate, } from './dod-gates.js';
 import { buildStatusResponse, buildValidateBlockedResponse, buildDryRunResponse, } from './response-builder.js';
 import { getSuggestedMode } from './mode-hints.js';
 import { autoFillActuals, createDefaultActuals } from '../../engine/actuals-estimator.js';
@@ -477,7 +477,7 @@ export async function handleUpdateStatus(params, server) {
                     // SPEC-721: timeout lives inside runValidateGate (Promise.race) — do NOT wrap with
                     // withToolTimeout here, which would silently convert timeout into blocked:false (fail-open).
                     newStatus === 'done'
-                        ? runValidateGate(spec, effectiveGatePath ?? '', params.forceStatus ?? false, params.forceStatusReason, 9_000)
+                        ? runValidateGate(spec, effectiveGatePath ?? '', params.forceStatus ?? false, params.forceStatusReason, 9_000, { projectId, specId })
                         : Promise.resolve(null),
                     // Crash shield: only on 'done', skipped if rate-limited (SPEC-628)
                     newStatus === 'done' && effectiveGatePath && !crashShieldSkipReason
@@ -507,6 +507,12 @@ export async function handleUpdateStatus(params, server) {
                         };
                     }
                 }
+                if (newStatus === 'done' && !(params.force ?? params.forceStatus ?? false)) {
+                    const validationReportError = await checkValidationReportGate(specId, projectId, false);
+                    if (validationReportError) {
+                        return validationReportError;
+                    }
+                }
                 // Process crash shield result — record run timestamp on success (SPEC-628)
                 /* c8 ignore next */
                 if (crashRisksReport !== null) {
@@ -1033,7 +1039,7 @@ export async function handleUpdateStatus(params, server) {
                     result.cascadeFastResults = cascadeRunResult.fastHookResults;
                 }
                 // SPEC-772 Scenario 4: surface validate failure from cascade as explicit warning
-                const autopilotValidateWarning = validateScore !== null && validateScore < 70
+                const autopilotValidateWarning = validateScore !== null && validateScore < 100
                     ? `Validate score ${String(validateScore)}/100 — below threshold. Check workspace_alerts for cascade details.`
                     : null;
                 if (autopilotValidateWarning) {

package/dist/tools/update-status/response-builder.js

@@ -6,7 +6,7 @@ import { buildUpdateStatusSummary } from '../../engine/human-summary.js';
 // SPEC-721: Validate gate blocked response builder
 // ---------------------------------------------------------------------------
 const REASON_TO_FIX_HINT = {
-    validate_score_below_threshold: 'Fix failing acceptance criteria, then retry. Or use forceStatus:true + forceStatusReason (≥100 chars).',
+    validate_score_below_threshold: 'Reach 100/100 validation coverage for the spec, then retry. Or use forceStatus:true + forceStatusReason (≥100 chars).',
     validate_gate_no_criteria: 'Add `scenarios:` to the spec frontmatter (BDD format), or use check_readiness to inject ' +
         'criteria, then retry. Or use forceStatus:true + forceStatusReason (≥100 chars).',
     validate_gate_crash: 'The validate engine crashed. Inspect logs, fix the spec or engine, and retry. ' +

package/dist/tools/validate.js

@@ -14,6 +14,7 @@ import { validateContractCompliance } from '../engine/test-scaffold-generator.js
 import { parseConventions, scanConventions } from '../engine/convention-scanner/index.js';
 import { validateScopeCompliance } from '../engine/scope-boundaries/index.js';
 import { compareWithBaseline } from '../storage/convention-baseline.js';
+import { writeImplementationReviewReport } from '../engine/validator/validation-report-writer.js';
 // Re-export for external use (SPEC-018)
 export { validateContractCompliance };
 /** Build the fallback interactiveQuestion for validation failures. */
@@ -130,6 +131,16 @@ export async function handleValidate(args, server) {
     }
     // 7. Lint check (best-effort — non-blocking)
     const lintCheck = runLintCheck(projectPath, knowledge.lintCommand ?? null);
+    // SPEC-1050: Generate a mandatory implementation-review artifact.
+    const validationReport = await writeImplementationReviewReport({
+        projectId,
+        specId,
+        spec,
+        projectPath,
+        score: result.score,
+        lintPassed: lintCheck.passed,
+        conventionRegression: regressionDetected,
+    });
     // 8. Build output
     const output = {
         specId,
@@ -204,6 +215,7 @@ export async function handleValidate(args, server) {
             })),
         },
         lintCheck,
+        validationReport,
     };
     // SPEC-612: Scope boundary validation — warn if impl files match outOfScope items
     if (spec.outOfScope !== undefined && spec.outOfScope.length > 0) {

package/dist/types/handoff-artifacts.d.ts

@@ -51,6 +51,20 @@ export interface ValidationReportV1 {
         passed: boolean;
         reason?: string;
     }[];
+    reviewer: {
+        kind: 'implementation-review-agent' | 'human' | 'automation';
+        agent: string;
+        verdict: 'approved' | 'changes-requested';
+    };
+    specCompliance?: {
+        score: number;
+        command: string;
+        scenarios: {
+            title: string;
+            verdict: 'pass' | 'fail' | 'missing';
+            evidence: string[];
+        }[];
+    };
     score?: number;
     completedAt: string;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@planu/cli",
-  "version": "4.2.1",
+  "version": "4.2.3",
   "description": "Planu — MCP Server for Spec Driven Development with native Rust acceleration for hot paths. Cross-platform (Linux/macOS/Windows, x64/arm64, glibc/musl).",
   "type": "module",
   "main": "dist/index.js",
@@ -32,14 +32,14 @@
     "packageName": "@planu/core"
   },
   "optionalDependencies": {
-    "@planu/core-darwin-arm64": "4.2.1",
-    "@planu/core-darwin-x64": "4.2.1",
-    "@planu/core-linux-arm64-gnu": "4.2.1",
-    "@planu/core-linux-arm64-musl": "4.2.1",
-    "@planu/core-linux-x64-gnu": "4.2.1",
-    "@planu/core-linux-x64-musl": "4.2.1",
-    "@planu/core-win32-arm64-msvc": "4.2.1",
-    "@planu/core-win32-x64-msvc": "4.2.1"
+    "@planu/core-darwin-arm64": "4.2.3",
+    "@planu/core-darwin-x64": "4.2.3",
+    "@planu/core-linux-arm64-gnu": "4.2.3",
+    "@planu/core-linux-arm64-musl": "4.2.3",
+    "@planu/core-linux-x64-gnu": "4.2.3",
+    "@planu/core-linux-x64-musl": "4.2.3",
+    "@planu/core-win32-arm64-msvc": "4.2.3",
+    "@planu/core-win32-x64-msvc": "4.2.3"
   },
   "engines": {
     "node": ">=24.0.0"
@@ -189,7 +189,7 @@
     "happy-dom": "^20.9.0",
     "husky": "^9.1.7",
     "javascript-obfuscator": "^5.4.3",
-    "knip": "^6.14.1",
+    "knip": "^6.14.2",
     "lint-staged": "^17.0.5",
     "madge": "^8.0.0",
     "prettier": "^3.8.3",