@planu/cli 5.3.16 → 5.3.17

package/CHANGELOG.md

@@ -1,3 +1,14 @@
+## [5.3.17] - 2026-08-11
+
+### Bug Fixes
+- fix(spec-1487): normalize spec paths in toRepoRelativePath per implementation-review arbitration
+- fix(spec-1487): exclude Planu bookkeeping paths from traceability autofill and done drift gate
+
+### Chores
+- chore(specs): record SPEC-1487 done transition
+- chore(spec-1487): record implementation-review round and approved scope amendment
+
+
 ## [5.3.16] - 2026-08-11
 
 ### Bug Fixes

package/dist/engine/evidence-gates/evidence-autofill.d.ts

@@ -1,4 +1,9 @@
 import type { AutofillTraceabilityMatrixArgs, AutofillTraceabilityMatrixResult } from '../../types/evidence-autofill.js';
+/** Exact Planu lifecycle files every spec branch mutates; never counted as implementation drift. */
+export declare const PLANU_BOOKKEEPING_FILES: readonly ['planu/context.md', 'planu/session-context.md', 'planu/session.json', 'planu/status.json', 'planu/releases/pending.json', 'planu/conventions.json'];
+/** Normalizes a spec.md path (absolute or already repo-relative) to a repo-relative,
+ * forward-slash path so it can be compared against `git diff` output. */
+export declare function toRepoRelativePath(specPath: string, projectPath?: string): string;
 /**
  * Generate `traceability-matrix.json` in the handoff evidence store when it does
  * not already exist. Never overwrites an existing file — if one is present this

package/dist/engine/evidence-gates/evidence-autofill.js

@@ -19,7 +19,7 @@
 // legacy harnesses, etc.).
 import { execFile } from 'node:child_process';
 import { existsSync } from 'node:fs';
-import { isAbsolute, join, resolve } from 'node:path';
+import { isAbsolute, join, relative, resolve } from 'node:path';
 import { promisify } from 'node:util';
 import { extractAcceptanceCriteriaTexts } from '../spec-format/acceptance-criteria.js';
 import { parseFrontmatterScenarios } from '../validator/spec-compliance-runner.js';
@@ -35,7 +35,28 @@ const defaultExec = async (command, args, options) => {
     const { stdout } = await execFileAsync(command, args, { cwd: options.cwd, encoding: 'utf-8' });
     return stdout;
 };
-/** Best-effort `git diff --name-only <mergeBase>...HEAD`; never throws. */
+/** Exact Planu lifecycle files every spec branch mutates; never counted as implementation drift. */
+export const PLANU_BOOKKEEPING_FILES = [
+    'planu/context.md',
+    'planu/session-context.md',
+    'planu/session.json',
+    'planu/status.json',
+    'planu/releases/pending.json',
+    'planu/conventions.json',
+];
+const OTHER_SPEC_MD_PATTERN = /^planu\/specs\/[^/]+\/spec\.md$/;
+/** Normalizes a spec.md path (absolute or already repo-relative) to a repo-relative,
+ * forward-slash path so it can be compared against `git diff` output. */
+export function toRepoRelativePath(specPath, projectPath) {
+    if (isAbsolute(specPath) && !projectPath) {
+        const normalized = specPath.replace(/\\/g, '/');
+        const specsIndex = normalized.lastIndexOf('planu/specs/');
+        return specsIndex === -1 ? normalized : normalized.slice(specsIndex);
+    }
+    const relativePath = isAbsolute(specPath) && projectPath ? relative(projectPath, specPath) : specPath;
+    return relativePath.replace(/\\/g, '/').replace(/^(\.\/)+/, '');
+}
+/** Best-effort `git diff --name-status <mergeBase>...HEAD`; never throws. */
 async function computeChangedFilesFromGit(projectPath, exec, baseBranch) {
     try {
         const mergeBaseOut = await exec('git', ['merge-base', 'HEAD', baseBranch], {
@@ -45,13 +66,20 @@ async function computeChangedFilesFromGit(projectPath, exec, baseBranch) {
         if (!mergeBase) {
             return [];
         }
-        const diffOut = await exec('git', ['diff', '--name-only', `${mergeBase}...HEAD`], {
+        const diffOut = await exec('git', ['diff', '--name-status', `${mergeBase}...HEAD`], {
             cwd: projectPath,
         });
         return diffOut
             .split('\n')
             .map((line) => line.trim())
-            .filter((line) => line.length > 0);
+            .filter((line) => line.length > 0)
+            .map((line) => {
+            const fields = line.split('\t');
+            const path = fields[fields.length - 1] ?? '';
+            const status = (fields[0] ?? '').startsWith('A') ? 'Added' : 'Other';
+            return { status, path };
+        })
+            .filter((entry) => entry.path.length > 0);
     }
     catch (error) {
         /* reliability-optional: EVIDENCE_AUTOFILL_GIT_DIFF — falls back to ## Files ownership */
@@ -59,6 +87,18 @@ async function computeChangedFilesFromGit(projectPath, exec, baseBranch) {
         return [];
     }
 }
+/** Drops Planu bookkeeping paths, this spec's own spec.md, and newly Added other-spec
+ * spec.md files — the diff still surfaces unowned src/ paths and Modified other-spec
+ * contracts so the done drift gate can flag genuine scope drift. */
+function excludeBookkeepingChanges(entries, ownSpecMdPath) {
+    const bookkeeping = new Set(PLANU_BOOKKEEPING_FILES);
+    const kept = entries
+        .filter((entry) => !bookkeeping.has(entry.path))
+        .filter((entry) => entry.path !== ownSpecMdPath)
+        .filter((entry) => !(entry.status === 'Added' && OTHER_SPEC_MD_PATTERN.test(entry.path)))
+        .map((entry) => entry.path);
+    return [...new Set(kept)];
+}
 function filterExistingRepoFiles(projectPath, paths) {
     return paths.filter((path) => {
         if (isAbsolute(path)) {
@@ -111,15 +151,18 @@ export async function autofillTraceabilityMatrix(args) {
         const scenarios = parseFrontmatterScenarios(args.specBody);
         const exec = args.exec ?? defaultExec;
         const baseBranch = args.baseBranch ?? 'main';
-        const gitChangedFiles = args.projectPath
+        const gitEntries = args.projectPath
             ? await computeChangedFilesFromGit(args.projectPath, exec, baseBranch)
             : [];
+        const gitChangedFiles = excludeBookkeepingChanges(gitEntries, args.ownSpecMdPath);
         const ownership = extractCanonicalFileOwnership(args.specBody);
         const ownershipFiles = [...ownership.toCreate, ...ownership.toModify, ...ownership.toTest];
         const rawChangedFiles = gitChangedFiles.length > 0 ? gitChangedFiles : ownershipFiles;
-        const changedFiles = args.projectPath
-            ? filterExistingRepoFiles(args.projectPath, rawChangedFiles)
-            : rawChangedFiles;
+        const changedFiles = [
+            ...new Set(args.projectPath
+                ? filterExistingRepoFiles(args.projectPath, rawChangedFiles)
+                : rawChangedFiles),
+        ];
         const { validationEvidence, reviewerEvidence } = await readValidationReportSummary(args.projectId, args.specId);
         const rows = criteria.map((acceptanceCriterion, index) => {
             const testPaths = scenarios[index]?.tests?.map((test) => test.path) ?? [];

package/dist/engine/evidence-index/done-drift.d.ts

@@ -2,5 +2,6 @@ import type { EvidenceGateIssue, SpecEvidenceIndex } from '../../types/index.js'
 export declare function checkDoneDriftContract(args: {
     index: SpecEvidenceIndex;
     approvedScopePaths: readonly string[];
+    ownSpecMdPath?: string;
 }): EvidenceGateIssue[];
 //# sourceMappingURL=done-drift.d.ts.map

package/dist/engine/evidence-index/done-drift.js

@@ -1,8 +1,38 @@
 import { normalizeChangedFilePath } from '../handoff-packager.js';
+import { PLANU_BOOKKEEPING_FILES } from '../evidence-gates/evidence-autofill.js';
 function normalizedChangedFile(value) {
     const normalized = normalizeChangedFilePath(value);
     return normalized.status === 'valid' ? normalized.path : null;
 }
+function buildNeverDriftPaths(ownSpecMdPath) {
+    const neverDriftPaths = new Set(PLANU_BOOKKEEPING_FILES);
+    const normalizedOwnSpecMdPath = ownSpecMdPath ? normalizedChangedFile(ownSpecMdPath) : null;
+    if (normalizedOwnSpecMdPath) {
+        neverDriftPaths.add(normalizedOwnSpecMdPath);
+    }
+    return neverDriftPaths;
+}
+function findUnapprovedChangedFiles(index, approved, neverDriftPaths) {
+    return index.criteria.flatMap((entry) => {
+        const hasScopeAmendment = entry.evidence.some((record) => record.kind === 'reviewer' && /scope amendment|approved scope/i.test(record.value));
+        if (hasScopeAmendment) {
+            return [];
+        }
+        return entry.evidence.flatMap((record) => {
+            if (record.kind !== 'changed-file' ||
+                (record.status !== 'valid' && record.status !== 'missing')) {
+                return [];
+            }
+            const normalized = normalizedChangedFile(record.value);
+            if (normalized && neverDriftPaths.has(normalized)) {
+                return [];
+            }
+            return normalized && approved.has(normalized)
+                ? []
+                : [`${entry.criterion}: ${normalized ?? 'invalid changed-file path'}`];
+        });
+    });
+}
 export function checkDoneDriftContract(args) {
     const issues = [];
     const uncovered = args.index.criteria.filter((entry) => {
@@ -39,22 +69,8 @@ export function checkDoneDriftContract(args) {
         return normalized ? [normalized] : [];
     });
     const approved = new Set(approvedScopePaths);
-    const unapproved = args.index.criteria.flatMap((entry) => {
-        const hasScopeAmendment = entry.evidence.some((record) => record.kind === 'reviewer' && /scope amendment|approved scope/i.test(record.value));
-        if (hasScopeAmendment) {
-            return [];
-        }
-        return entry.evidence.flatMap((record) => {
-            if (record.kind !== 'changed-file' ||
-                (record.status !== 'valid' && record.status !== 'missing')) {
-                return [];
-            }
-            const normalized = normalizedChangedFile(record.value);
-            return normalized && approved.has(normalized)
-                ? []
-                : [`${entry.criterion}: ${normalized ?? 'invalid changed-file path'}`];
-        });
-    });
+    const neverDriftPaths = buildNeverDriftPaths(args.ownSpecMdPath);
+    const unapproved = findUnapprovedChangedFiles(args.index, approved, neverDriftPaths);
     if (unapproved.length > 0) {
         const approvedHint = approvedScopePaths.length > 0
             ? ` Approved canonical paths: ${approvedScopePaths.join(', ')}.`

package/dist/engine/planu-core.darwin-arm64.node.manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
-  "cliVersion": "5.3.16",
-  "engineVersion": "5.3.16",
-  "buildId": "1-5.3.16-aarch64-apple-darwin",
+  "cliVersion": "5.3.17",
+  "engineVersion": "5.3.17",
+  "buildId": "1-5.3.17-aarch64-apple-darwin",
   "protocolAbi": 1,
   "capabilityAbi": 2,
   "nodeApiAbi": 4,
@@ -17,15 +17,15 @@
   "platform": "darwin",
   "arch": "arm64",
   "libc": null,
-  "artifactSha256": "2a6db4c53e8d2e492a44dc8c276b3f1ec9e00f20056225221aa142752a9dfb4b",
+  "artifactSha256": "bdc99fce3b870c27eafdd54b37d2822c37255eb3694c425ad6b651c6f5b97ac8",
   "sbom": {
     "format": "CycloneDX-1.5",
     "path": "planu-core.darwin-arm64.node.sbom.json",
-    "sha256": "6bfb518a006ae80f0a94328c6fc0be1fa7d86b9a5bab2d7476a80fc8171dfd71"
+    "sha256": "11343948562c3b7f3bd3c819a0656a2fa9321431e1022850cda9e9ba5320f90c"
   },
   "provenance": {
     "builder": "scripts/build-rust-local.sh",
-    "sourceCommit": "0cde0ff71b6b07e6bb7c059c7f03a7a58910e221",
+    "sourceCommit": "903b141393635e71607722637a08977e153b8b56",
     "sourceTreeDirty": false,
     "sourceDateEpoch": 1,
     "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -34,6 +34,6 @@
   "signature": {
     "algorithm": "Ed25519",
     "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
-    "value": "6QDQPYqy6xJ4RHk+SGv1DdPTxgQDQCG63NMTaK2Kk72npIDR7g6h/mCKNLhFDXPALcS7kjqKRijf/PzRqnmCBQ=="
+    "value": "VfCh5vWrZxDxMM6pCO1dpKf/FxS8hZDqFZlvpwtTd6GweAYf2mzdaWMZkNA/a6r0y7gzGfUVuzplXQ64t2w3Cg=="
   }
 }

package/dist/engine/planu-core.darwin-arm64.node.sbom.json

@@ -4,14 +4,14 @@
   "version": 1,
   "metadata": {
     "component": {
-      "bom-ref": "pkg:cargo/planu-core@5.3.16",
+      "bom-ref": "pkg:cargo/planu-core@5.3.17",
       "type": "library",
       "name": "planu-core",
-      "version": "5.3.16",
+      "version": "5.3.17",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "2a6db4c53e8d2e492a44dc8c276b3f1ec9e00f20056225221aa142752a9dfb4b"
+          "content": "bdc99fce3b870c27eafdd54b37d2822c37255eb3694c425ad6b651c6f5b97ac8"
         }
       ]
     }
@@ -1106,7 +1106,7 @@
       "dependsOn": []
     },
     {
-      "ref": "pkg:cargo/planu-core@5.3.16",
+      "ref": "pkg:cargo/planu-core@5.3.17",
       "dependsOn": [
         "pkg:cargo/core-foundation@0.10.1",
         "pkg:cargo/hmac@0.12.1",

package/dist/engine/planu-core.darwin-x64.node.manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
-  "cliVersion": "5.3.16",
-  "engineVersion": "5.3.16",
-  "buildId": "1-5.3.16-x86_64-apple-darwin",
+  "cliVersion": "5.3.17",
+  "engineVersion": "5.3.17",
+  "buildId": "1-5.3.17-x86_64-apple-darwin",
   "protocolAbi": 1,
   "capabilityAbi": 2,
   "nodeApiAbi": 4,
@@ -17,15 +17,15 @@
   "platform": "darwin",
   "arch": "x64",
   "libc": null,
-  "artifactSha256": "be5de1bbcd0f9b4989aa82c5b51f0a7425c3eb1fa9dfd772cc362f476db433f5",
+  "artifactSha256": "bae60566a531f74f27a61531acb737a62c0b4d2c5d748cd8619421452c355d5e",
   "sbom": {
     "format": "CycloneDX-1.5",
     "path": "planu-core.darwin-x64.node.sbom.json",
-    "sha256": "38a7cc4b3d77c4414c58fd23af446914e84db52dd937e13b763da35b1962ab1e"
+    "sha256": "817d459d6609a5434eb192614d137f2fa63e3fd9908587d05207b584eba246eb"
   },
   "provenance": {
     "builder": "scripts/build-rust-local.sh",
-    "sourceCommit": "0cde0ff71b6b07e6bb7c059c7f03a7a58910e221",
+    "sourceCommit": "903b141393635e71607722637a08977e153b8b56",
     "sourceTreeDirty": false,
     "sourceDateEpoch": 1,
     "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -34,6 +34,6 @@
   "signature": {
     "algorithm": "Ed25519",
     "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
-    "value": "7X8ph1LL1pB4hXlWcXD109sTeHzyRTa94ozW52TdCg6y1LIH1kNwuz4rU0g0KK4CLpnanRpeLpu7NODRGiP2AQ=="
+    "value": "HYqjCJjOvAVvkaW7hxI5rJ57eE+48Dd58M+y2/+RU+Qt+ddPDofOh1syhVCQmAHb/1IqORN+/sHSFy/bLK/bAg=="
   }
 }

package/dist/engine/planu-core.darwin-x64.node.sbom.json

@@ -4,14 +4,14 @@
   "version": 1,
   "metadata": {
     "component": {
-      "bom-ref": "pkg:cargo/planu-core@5.3.16",
+      "bom-ref": "pkg:cargo/planu-core@5.3.17",
       "type": "library",
       "name": "planu-core",
-      "version": "5.3.16",
+      "version": "5.3.17",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "be5de1bbcd0f9b4989aa82c5b51f0a7425c3eb1fa9dfd772cc362f476db433f5"
+          "content": "bae60566a531f74f27a61531acb737a62c0b4d2c5d748cd8619421452c355d5e"
         }
       ]
     }
@@ -1106,7 +1106,7 @@
       "dependsOn": []
     },
     {
-      "ref": "pkg:cargo/planu-core@5.3.16",
+      "ref": "pkg:cargo/planu-core@5.3.17",
       "dependsOn": [
         "pkg:cargo/core-foundation@0.10.1",
         "pkg:cargo/hmac@0.12.1",

package/dist/engine/planu-core.linux-arm64-gnu.node.manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
-  "cliVersion": "5.3.16",
-  "engineVersion": "5.3.16",
-  "buildId": "1-5.3.16-aarch64-unknown-linux-gnu",
+  "cliVersion": "5.3.17",
+  "engineVersion": "5.3.17",
+  "buildId": "1-5.3.17-aarch64-unknown-linux-gnu",
   "protocolAbi": 1,
   "capabilityAbi": 2,
   "nodeApiAbi": 4,
@@ -16,15 +16,15 @@
   "platform": "linux",
   "arch": "arm64",
   "libc": "glibc",
-  "artifactSha256": "01d8ce2cb696744dc58095e8ff7fb2be6afcbccf467b0cd0eb538b6be530e210",
+  "artifactSha256": "6079ee86b8ee1e650cfd2602f039eb28d3d91e15d8377e712eb851b3ec4746c4",
   "sbom": {
     "format": "CycloneDX-1.5",
     "path": "planu-core.linux-arm64-gnu.node.sbom.json",
-    "sha256": "5eb69bed870789d764c02f63f0371c51872314e22a888c60af9842c35f536a4b"
+    "sha256": "c0fd691552bdaa6095d5c8220a3d7e5679d6f38ddc22919a552c0e98ad53d734"
   },
   "provenance": {
     "builder": "scripts/build-rust-local.sh",
-    "sourceCommit": "0cde0ff71b6b07e6bb7c059c7f03a7a58910e221",
+    "sourceCommit": "903b141393635e71607722637a08977e153b8b56",
     "sourceTreeDirty": false,
     "sourceDateEpoch": 1,
     "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -33,6 +33,6 @@
   "signature": {
     "algorithm": "Ed25519",
     "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
-    "value": "EJcdFkXbSIapzhu002fZ/X4QRUCpbJjwj4AYsg0G2BiERBQjMavAeiXqVNLr75Jt84NRmcOqXhidCvaEV0snCQ=="
+    "value": "85bAzK82CMXtjrkBbdc3D8X+9wN4/tsyeTzr/MZ5BmyWAe1D4jikLwJ4SW+ioyS+dDshLRCUgrUXSIUsjj0PAg=="
   }
 }

package/dist/engine/planu-core.linux-arm64-gnu.node.sbom.json

@@ -4,14 +4,14 @@
   "version": 1,
   "metadata": {
     "component": {
-      "bom-ref": "pkg:cargo/planu-core@5.3.16",
+      "bom-ref": "pkg:cargo/planu-core@5.3.17",
       "type": "library",
       "name": "planu-core",
-      "version": "5.3.16",
+      "version": "5.3.17",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "01d8ce2cb696744dc58095e8ff7fb2be6afcbccf467b0cd0eb538b6be530e210"
+          "content": "6079ee86b8ee1e650cfd2602f039eb28d3d91e15d8377e712eb851b3ec4746c4"
         }
       ]
     }
@@ -1106,7 +1106,7 @@
       "dependsOn": []
     },
     {
-      "ref": "pkg:cargo/planu-core@5.3.16",
+      "ref": "pkg:cargo/planu-core@5.3.17",
       "dependsOn": [
         "pkg:cargo/core-foundation@0.10.1",
         "pkg:cargo/hmac@0.12.1",

package/dist/engine/planu-core.linux-arm64-musl.node.manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
-  "cliVersion": "5.3.16",
-  "engineVersion": "5.3.16",
-  "buildId": "1-5.3.16-aarch64-unknown-linux-musl",
+  "cliVersion": "5.3.17",
+  "engineVersion": "5.3.17",
+  "buildId": "1-5.3.17-aarch64-unknown-linux-musl",
   "protocolAbi": 1,
   "capabilityAbi": 2,
   "nodeApiAbi": 4,
@@ -16,15 +16,15 @@
   "platform": "linux",
   "arch": "arm64",
   "libc": "musl",
-  "artifactSha256": "9b0683851a369169cda5c0e4141df24a59f94da03fdf7b8fc1230da65e38eb36",
+  "artifactSha256": "e6ee0ad20445313dbed5b14cbd5333a49ae08197ba4fa642e7292ff23bcbb2cf",
   "sbom": {
     "format": "CycloneDX-1.5",
     "path": "planu-core.linux-arm64-musl.node.sbom.json",
-    "sha256": "463cb73768477635328836a2a13d34038a2c7aeb83de4d17212274135af77e9e"
+    "sha256": "e2a76a395f0d058a97fd17388b74530059c4c80800515463480c73849b01659a"
   },
   "provenance": {
     "builder": "scripts/build-rust-local.sh",
-    "sourceCommit": "0cde0ff71b6b07e6bb7c059c7f03a7a58910e221",
+    "sourceCommit": "903b141393635e71607722637a08977e153b8b56",
     "sourceTreeDirty": false,
     "sourceDateEpoch": 1,
     "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -33,6 +33,6 @@
   "signature": {
     "algorithm": "Ed25519",
     "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
-    "value": "LGOiA63xus7b3/9w0/8qTyrKDhkRV0y3EMRV7F5NHxj8oDGqLz81viGJvBU+iri4Xhh0Ku03hxoD377vhE4TBQ=="
+    "value": "LUWtVfzWce5DbAtjGkmxVudiKCoD8sqcxuzz7wG1uUCyrZ8rMN7foWoytKdNdID7if12WlSVvFDME63D9Ls/BA=="
   }
 }

package/dist/engine/planu-core.linux-arm64-musl.node.sbom.json

@@ -4,14 +4,14 @@
   "version": 1,
   "metadata": {
     "component": {
-      "bom-ref": "pkg:cargo/planu-core@5.3.16",
+      "bom-ref": "pkg:cargo/planu-core@5.3.17",
       "type": "library",
       "name": "planu-core",
-      "version": "5.3.16",
+      "version": "5.3.17",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "9b0683851a369169cda5c0e4141df24a59f94da03fdf7b8fc1230da65e38eb36"
+          "content": "e6ee0ad20445313dbed5b14cbd5333a49ae08197ba4fa642e7292ff23bcbb2cf"
         }
       ]
     }
@@ -1106,7 +1106,7 @@
       "dependsOn": []
     },
     {
-      "ref": "pkg:cargo/planu-core@5.3.16",
+      "ref": "pkg:cargo/planu-core@5.3.17",
       "dependsOn": [
         "pkg:cargo/core-foundation@0.10.1",
         "pkg:cargo/hmac@0.12.1",

package/dist/engine/planu-core.linux-x64-gnu.node.manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
-  "cliVersion": "5.3.16",
-  "engineVersion": "5.3.16",
-  "buildId": "1-5.3.16-x86_64-unknown-linux-gnu",
+  "cliVersion": "5.3.17",
+  "engineVersion": "5.3.17",
+  "buildId": "1-5.3.17-x86_64-unknown-linux-gnu",
   "protocolAbi": 1,
   "capabilityAbi": 2,
   "nodeApiAbi": 4,
@@ -16,15 +16,15 @@
   "platform": "linux",
   "arch": "x64",
   "libc": "glibc",
-  "artifactSha256": "2d8c9186e43c03eb451a9772c3dac7931039e5326997364bc2bcc5aa38726b48",
+  "artifactSha256": "b10b9708c07c07e43b9acc098dc7887b4940bedad5e4e85ac4062b554100cd59",
   "sbom": {
     "format": "CycloneDX-1.5",
     "path": "planu-core.linux-x64-gnu.node.sbom.json",
-    "sha256": "a27023f31bf2290b52d4e344d1859f3bbb49f5a19ce9998800987440ce834964"
+    "sha256": "b05d18430dca3a6fb1ba1c2e493326d2cd2f6072d469721c31088811efb6274d"
   },
   "provenance": {
     "builder": "scripts/build-rust-local.sh",
-    "sourceCommit": "0cde0ff71b6b07e6bb7c059c7f03a7a58910e221",
+    "sourceCommit": "903b141393635e71607722637a08977e153b8b56",
     "sourceTreeDirty": false,
     "sourceDateEpoch": 1,
     "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -33,6 +33,6 @@
   "signature": {
     "algorithm": "Ed25519",
     "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
-    "value": "FEn6GiPlQVBmOEc8zw6SxFzCxNF9OfYAakAa36oR0r5fbCQBFBgfbuuKGdLar7rdnaU3vcgiexCzHJIuYdwFCg=="
+    "value": "1R1IPcr3P53ndUQe0CtgdHIKbrMFWNMDTNiPjcabQavBBnisW6crL1EcueYHY+1hiMMcRRX8j3OXCrzteE/wAw=="
   }
 }

package/dist/engine/planu-core.linux-x64-gnu.node.sbom.json

@@ -4,14 +4,14 @@
   "version": 1,
   "metadata": {
     "component": {
-      "bom-ref": "pkg:cargo/planu-core@5.3.16",
+      "bom-ref": "pkg:cargo/planu-core@5.3.17",
       "type": "library",
       "name": "planu-core",
-      "version": "5.3.16",
+      "version": "5.3.17",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "2d8c9186e43c03eb451a9772c3dac7931039e5326997364bc2bcc5aa38726b48"
+          "content": "b10b9708c07c07e43b9acc098dc7887b4940bedad5e4e85ac4062b554100cd59"
         }
       ]
     }
@@ -1106,7 +1106,7 @@
       "dependsOn": []
     },
     {
-      "ref": "pkg:cargo/planu-core@5.3.16",
+      "ref": "pkg:cargo/planu-core@5.3.17",
       "dependsOn": [
         "pkg:cargo/core-foundation@0.10.1",
         "pkg:cargo/hmac@0.12.1",

package/dist/engine/planu-core.linux-x64-musl.node.manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
-  "cliVersion": "5.3.16",
-  "engineVersion": "5.3.16",
-  "buildId": "1-5.3.16-x86_64-unknown-linux-musl",
+  "cliVersion": "5.3.17",
+  "engineVersion": "5.3.17",
+  "buildId": "1-5.3.17-x86_64-unknown-linux-musl",
   "protocolAbi": 1,
   "capabilityAbi": 2,
   "nodeApiAbi": 4,
@@ -16,15 +16,15 @@
   "platform": "linux",
   "arch": "x64",
   "libc": "musl",
-  "artifactSha256": "50547de5b23c0671447358eebc95d3841a2ce278236f5000655182ffb998d547",
+  "artifactSha256": "e32cde49858959e41c0df273dcb2e7c49412c4432ae983f358c19c6f8f705796",
   "sbom": {
     "format": "CycloneDX-1.5",
     "path": "planu-core.linux-x64-musl.node.sbom.json",
-    "sha256": "a074e28e92546729d7347be57236bd8a0678ea1396fd756770915db6efecfa18"
+    "sha256": "2d4f452d04f8d5e536ae26d5e0321d0bc3d61a87b62b4833edd80ed2a6a5e98f"
   },
   "provenance": {
     "builder": "scripts/build-rust-local.sh",
-    "sourceCommit": "0cde0ff71b6b07e6bb7c059c7f03a7a58910e221",
+    "sourceCommit": "903b141393635e71607722637a08977e153b8b56",
     "sourceTreeDirty": false,
     "sourceDateEpoch": 1,
     "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -33,6 +33,6 @@
   "signature": {
     "algorithm": "Ed25519",
     "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
-    "value": "qvTXfNiZUTxm+mdb2A7/P6wjxEhdCr9WIVZkzDDOoxu4k4NgFeBmrSGKdRays0RSEivQ9f23gnvhS1myJ+DIAQ=="
+    "value": "hl7v/J/DAlDB3yKZ6KPCBz78JEXS6/Y77mT7dM3Q5xABC13P6gTFl4/ts6HFQBC/ILPBJAIe+M2jjNVXPTJRAg=="
   }
 }

package/dist/engine/planu-core.linux-x64-musl.node.sbom.json

@@ -4,14 +4,14 @@
   "version": 1,
   "metadata": {
     "component": {
-      "bom-ref": "pkg:cargo/planu-core@5.3.16",
+      "bom-ref": "pkg:cargo/planu-core@5.3.17",
       "type": "library",
       "name": "planu-core",
-      "version": "5.3.16",
+      "version": "5.3.17",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "50547de5b23c0671447358eebc95d3841a2ce278236f5000655182ffb998d547"
+          "content": "e32cde49858959e41c0df273dcb2e7c49412c4432ae983f358c19c6f8f705796"
         }
       ]
     }
@@ -1106,7 +1106,7 @@
       "dependsOn": []
     },
     {
-      "ref": "pkg:cargo/planu-core@5.3.16",
+      "ref": "pkg:cargo/planu-core@5.3.17",
       "dependsOn": [
         "pkg:cargo/core-foundation@0.10.1",
         "pkg:cargo/hmac@0.12.1",

package/dist/engine/planu-core.win32-arm64-msvc.node.manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
-  "cliVersion": "5.3.16",
-  "engineVersion": "5.3.16",
-  "buildId": "1-5.3.16-aarch64-pc-windows-msvc",
+  "cliVersion": "5.3.17",
+  "engineVersion": "5.3.17",
+  "buildId": "1-5.3.17-aarch64-pc-windows-msvc",
   "protocolAbi": 1,
   "capabilityAbi": 2,
   "nodeApiAbi": 4,
@@ -16,15 +16,15 @@
   "platform": "win32",
   "arch": "arm64",
   "libc": null,
-  "artifactSha256": "151f0906eac861f554ce19ede7347d8267048f67aeb71b5f2521c7eaf8fbc034",
+  "artifactSha256": "abe713832d59d280780993de17bfe271501f3c6e368cc7660fd73cfe448f855b",
   "sbom": {
     "format": "CycloneDX-1.5",
     "path": "planu-core.win32-arm64-msvc.node.sbom.json",
-    "sha256": "2acb3f0615fee3f77ca7be0110f41c245b760d81811c0299a57aac2f7aa15fc9"
+    "sha256": "fedb07ccec7d0db216ee7cf665995024312f4222579437d1b2f4dd99f024f6d9"
   },
   "provenance": {
     "builder": "scripts/build-rust-local.sh",
-    "sourceCommit": "0cde0ff71b6b07e6bb7c059c7f03a7a58910e221",
+    "sourceCommit": "903b141393635e71607722637a08977e153b8b56",
     "sourceTreeDirty": false,
     "sourceDateEpoch": 1,
     "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -33,6 +33,6 @@
   "signature": {
     "algorithm": "Ed25519",
     "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
-    "value": "qMuwIDaEU/3JJj3BuHx/uv8ZCDScOhZGUSHuIKSS64I31OESsH7QuSd6+7QYT9THm5hb0nxuol3BtyyQ3AX3Dg=="
+    "value": "cvRigJR42Bz/XnqcHBVMdkfCDTUK3468XFQxFJfwA+dgdffXXne/hZYvu2+Qtc5VDPh+VI/gDgy4S+JjNjXIAw=="
   }
 }

package/dist/engine/planu-core.win32-arm64-msvc.node.sbom.json

@@ -4,14 +4,14 @@
   "version": 1,
   "metadata": {
     "component": {
-      "bom-ref": "pkg:cargo/planu-core@5.3.16",
+      "bom-ref": "pkg:cargo/planu-core@5.3.17",
       "type": "library",
       "name": "planu-core",
-      "version": "5.3.16",
+      "version": "5.3.17",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "151f0906eac861f554ce19ede7347d8267048f67aeb71b5f2521c7eaf8fbc034"
+          "content": "abe713832d59d280780993de17bfe271501f3c6e368cc7660fd73cfe448f855b"
         }
       ]
     }
@@ -1106,7 +1106,7 @@
       "dependsOn": []
     },
     {
-      "ref": "pkg:cargo/planu-core@5.3.16",
+      "ref": "pkg:cargo/planu-core@5.3.17",
       "dependsOn": [
         "pkg:cargo/core-foundation@0.10.1",
         "pkg:cargo/hmac@0.12.1",

package/dist/engine/planu-core.win32-x64-msvc.node.manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
-  "cliVersion": "5.3.16",
-  "engineVersion": "5.3.16",
-  "buildId": "1-5.3.16-x86_64-pc-windows-msvc",
+  "cliVersion": "5.3.17",
+  "engineVersion": "5.3.17",
+  "buildId": "1-5.3.17-x86_64-pc-windows-msvc",
   "protocolAbi": 1,
   "capabilityAbi": 2,
   "nodeApiAbi": 4,
@@ -16,15 +16,15 @@
   "platform": "win32",
   "arch": "x64",
   "libc": null,
-  "artifactSha256": "b002099edf523c6aa0ca6f658a19514ff0a20ccf154bd88e4e205d49d9135590",
+  "artifactSha256": "142bcb2e061e280bf04929920bd88189ad37b14913f39bdd499bf45e287a53eb",
   "sbom": {
     "format": "CycloneDX-1.5",
     "path": "planu-core.win32-x64-msvc.node.sbom.json",
-    "sha256": "c1b0d2ac50e19c7133dccb297d19f3a317125bfd88e87508ae0743acba413c5f"
+    "sha256": "e2345850af3b261c8eac493694d218e9b770c1deeac3131bf62e55655054b29f"
   },
   "provenance": {
     "builder": "scripts/build-rust-local.sh",
-    "sourceCommit": "0cde0ff71b6b07e6bb7c059c7f03a7a58910e221",
+    "sourceCommit": "903b141393635e71607722637a08977e153b8b56",
     "sourceTreeDirty": false,
     "sourceDateEpoch": 1,
     "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -33,6 +33,6 @@
   "signature": {
     "algorithm": "Ed25519",
     "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
-    "value": "wQa0ygTquWBg4jFcHX8+sVqOETbJGfViThB7wyshllPFfdCF8s8chApggB+dgjCJd6qz2JaI1aJyifFFsIF9BQ=="
+    "value": "IQNeo8h8MLaX/wTJMVV3zdR1F1gX7oV9gLw58botIZo4c/OKtyXpiTQ3iRhXu/hpNQ1rs+hSb7C0AWCt+u6nAA=="
   }
 }

package/dist/engine/planu-core.win32-x64-msvc.node.sbom.json

@@ -4,14 +4,14 @@
   "version": 1,
   "metadata": {
     "component": {
-      "bom-ref": "pkg:cargo/planu-core@5.3.16",
+      "bom-ref": "pkg:cargo/planu-core@5.3.17",
       "type": "library",
       "name": "planu-core",
-      "version": "5.3.16",
+      "version": "5.3.17",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "b002099edf523c6aa0ca6f658a19514ff0a20ccf154bd88e4e205d49d9135590"
+          "content": "142bcb2e061e280bf04929920bd88189ad37b14913f39bdd499bf45e287a53eb"
         }
       ]
     }
@@ -1106,7 +1106,7 @@
       "dependsOn": []
     },
     {
-      "ref": "pkg:cargo/planu-core@5.3.16",
+      "ref": "pkg:cargo/planu-core@5.3.17",
       "dependsOn": [
         "pkg:cargo/core-foundation@0.10.1",
         "pkg:cargo/hmac@0.12.1",

package/dist/tools/update-status/evidence-gate.js

@@ -57,6 +57,7 @@ import { readEvidenceArtifacts } from '../../engine/evidence-gates/artifact-read
 import { checkLifecycleEvidenceGate } from '../../engine/evidence-gates/lifecycle-gate.js';
 import { buildSpecEvidenceIndex } from '../../engine/evidence-index/index-builder.js';
 import { checkDoneDriftContract } from '../../engine/evidence-index/done-drift.js';
+import { toRepoRelativePath } from '../../engine/evidence-gates/evidence-autofill.js';
 import { parseGroundedTechnicalPaths } from '../../engine/spec-grounding/contract.js';
 import { extractAcceptanceCriteriaTexts } from '../../engine/spec-format/acceptance-criteria.js';
 import { formatKeyValue } from '../output-formatter.js';
@@ -168,7 +169,11 @@ export async function checkLifecycleEvidenceTransitionGate(args) {
                 message: `Approved canonical ownership is invalid: ${[...new Set(safeBlockers)].join(', ')}.`,
             });
         }
-        result.issues.push(...checkDoneDriftContract({ index, approvedScopePaths }));
+        result.issues.push(...checkDoneDriftContract({
+            index,
+            approvedScopePaths,
+            ownSpecMdPath: toRepoRelativePath(args.spec.specPath, args.projectPath),
+        }));
     }
     if (result.issues.length === 0) {
         return null;

package/dist/tools/update-status/index.js

@@ -17,7 +17,7 @@ import { withApprovalSpecLock } from '../../storage/approval-operation-lock.js';
 import { isLocked, getLock } from '../../storage/spec-lock-store.js';
 import { checkDoneGates, checkComplianceGate, checkApprovedFormatGate, checkSpecReviewGate, deriveDoneReviewDigest, } from './dod-gates.js';
 import { checkLifecycleEvidenceTransitionGate } from './evidence-gate.js';
-import { autofillTraceabilityMatrix } from '../../engine/evidence-gates/evidence-autofill.js';
+import { autofillTraceabilityMatrix, toRepoRelativePath, } from '../../engine/evidence-gates/evidence-autofill.js';
 import { buildStatusResponse, buildDryRunResponse } from './response-builder.js';
 import { recordDoneMetrics, syncSpecFiles, tryReconcile, recordTerminalTransitionEvent, } from './file-sync.js';
 import { appendEntry, getLastHash } from '../../storage/audit-trail-store.js';
@@ -165,6 +165,7 @@ async function runTraceabilityAutofillGate(args) {
             specId: args.specId,
             projectPath: args.projectPath,
             specBody,
+            ownSpecMdPath: toRepoRelativePath(args.spec.specPath, args.projectPath),
         });
         if (!result.written) {
             return null;

package/dist/types/evidence-autofill.d.ts

@@ -21,6 +21,8 @@ export interface AutofillTraceabilityMatrixArgs {
     exec?: EvidenceAutofillExec;
     /** Branch to diff against for changed-files detection. Defaults to `main`. */
     baseBranch?: string;
+    /** Repo-relative path of this spec's own spec.md, excluded from changedFiles as lifecycle bookkeeping. */
+    ownSpecMdPath?: string;
 }
 export type AutofillTraceabilityMatrixResult = {
     written: true;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@planu/cli",
-  "version": "5.3.16",
+  "version": "5.3.17",
   "description": "Planu — MCP Server for Spec Driven Development with native Rust acceleration for hot paths. Cross-platform (Linux/macOS/Windows, x64/arm64, glibc/musl).",
   "type": "module",
   "main": "dist/index.js",
@@ -35,14 +35,14 @@
     "packageName": "@planu/core"
   },
   "optionalDependencies": {
-    "@planu/core-darwin-arm64": "5.3.16",
-    "@planu/core-darwin-x64": "5.3.16",
-    "@planu/core-linux-arm64-gnu": "5.3.16",
-    "@planu/core-linux-arm64-musl": "5.3.16",
-    "@planu/core-linux-x64-gnu": "5.3.16",
-    "@planu/core-linux-x64-musl": "5.3.16",
-    "@planu/core-win32-arm64-msvc": "5.3.16",
-    "@planu/core-win32-x64-msvc": "5.3.16"
+    "@planu/core-darwin-arm64": "5.3.17",
+    "@planu/core-darwin-x64": "5.3.17",
+    "@planu/core-linux-arm64-gnu": "5.3.17",
+    "@planu/core-linux-arm64-musl": "5.3.17",
+    "@planu/core-linux-x64-gnu": "5.3.17",
+    "@planu/core-linux-x64-musl": "5.3.17",
+    "@planu/core-win32-arm64-msvc": "5.3.17",
+    "@planu/core-win32-x64-msvc": "5.3.17"
   },
   "engines": {
     "node": ">=24.0.0"

package/planu-native.json

@@ -1,7 +1,7 @@
 {
   "name": "dev.planu.native",
   "displayName": "Planu Native Lightweight Surface",
-  "version": "5.3.16",
+  "version": "5.3.17",
   "packageName": "@planu/cli",
   "modes": {
     "lightweight": {

package/planu-plugin.json

@@ -2,7 +2,7 @@
   "name": "dev.planu.cli",
   "displayName": "Planu — Spec Driven Development",
   "description": "Manage software specs, estimations, and autonomous SDD workflows. Language-agnostic MCP server for Claude Code.",
-  "version": "5.3.16",
+  "version": "5.3.17",
   "icon": "assets/plugin/icon.svg",
   "command": ["npx", "@planu/cli@latest"],
   "packageName": "@planu/cli",