@planu/cli 5.3.16 → 5.3.18

package/CHANGELOG.md

@@ -1,3 +1,24 @@
+## [5.3.18] - 2026-08-11
+
+### Bug Fixes
+- fix(spec-1476): phrase-bind data-consistency scenario signals and drop dead catalog
+
+### Chores
+- chore(spec-1476): record done transition with validation and review evidence
+- chore(spec-1476): approve spec with arbitrated dual-review evidence and start implementing
+
+
+## [5.3.17] - 2026-08-11
+
+### Bug Fixes
+- fix(spec-1487): normalize spec paths in toRepoRelativePath per implementation-review arbitration
+- fix(spec-1487): exclude Planu bookkeeping paths from traceability autofill and done drift gate
+
+### Chores
+- chore(specs): record SPEC-1487 done transition
+- chore(spec-1487): record implementation-review round and approved scope amendment
+
+
 ## [5.3.16] - 2026-08-11
 
 ### Bug Fixes

package/dist/engine/evidence-gates/evidence-autofill.d.ts

@@ -1,4 +1,9 @@
 import type { AutofillTraceabilityMatrixArgs, AutofillTraceabilityMatrixResult } from '../../types/evidence-autofill.js';
+/** Exact Planu lifecycle files every spec branch mutates; never counted as implementation drift. */
+export declare const PLANU_BOOKKEEPING_FILES: readonly ['planu/context.md', 'planu/session-context.md', 'planu/session.json', 'planu/status.json', 'planu/releases/pending.json', 'planu/conventions.json'];
+/** Normalizes a spec.md path (absolute or already repo-relative) to a repo-relative,
+ * forward-slash path so it can be compared against `git diff` output. */
+export declare function toRepoRelativePath(specPath: string, projectPath?: string): string;
 /**
  * Generate `traceability-matrix.json` in the handoff evidence store when it does
  * not already exist. Never overwrites an existing file — if one is present this

package/dist/engine/evidence-gates/evidence-autofill.js

@@ -19,7 +19,7 @@
 // legacy harnesses, etc.).
 import { execFile } from 'node:child_process';
 import { existsSync } from 'node:fs';
-import { isAbsolute, join, resolve } from 'node:path';
+import { isAbsolute, join, relative, resolve } from 'node:path';
 import { promisify } from 'node:util';
 import { extractAcceptanceCriteriaTexts } from '../spec-format/acceptance-criteria.js';
 import { parseFrontmatterScenarios } from '../validator/spec-compliance-runner.js';
@@ -35,7 +35,28 @@ const defaultExec = async (command, args, options) => {
     const { stdout } = await execFileAsync(command, args, { cwd: options.cwd, encoding: 'utf-8' });
     return stdout;
 };
-/** Best-effort `git diff --name-only <mergeBase>...HEAD`; never throws. */
+/** Exact Planu lifecycle files every spec branch mutates; never counted as implementation drift. */
+export const PLANU_BOOKKEEPING_FILES = [
+    'planu/context.md',
+    'planu/session-context.md',
+    'planu/session.json',
+    'planu/status.json',
+    'planu/releases/pending.json',
+    'planu/conventions.json',
+];
+const OTHER_SPEC_MD_PATTERN = /^planu\/specs\/[^/]+\/spec\.md$/;
+/** Normalizes a spec.md path (absolute or already repo-relative) to a repo-relative,
+ * forward-slash path so it can be compared against `git diff` output. */
+export function toRepoRelativePath(specPath, projectPath) {
+    if (isAbsolute(specPath) && !projectPath) {
+        const normalized = specPath.replace(/\\/g, '/');
+        const specsIndex = normalized.lastIndexOf('planu/specs/');
+        return specsIndex === -1 ? normalized : normalized.slice(specsIndex);
+    }
+    const relativePath = isAbsolute(specPath) && projectPath ? relative(projectPath, specPath) : specPath;
+    return relativePath.replace(/\\/g, '/').replace(/^(\.\/)+/, '');
+}
+/** Best-effort `git diff --name-status <mergeBase>...HEAD`; never throws. */
 async function computeChangedFilesFromGit(projectPath, exec, baseBranch) {
     try {
         const mergeBaseOut = await exec('git', ['merge-base', 'HEAD', baseBranch], {
@@ -45,13 +66,20 @@ async function computeChangedFilesFromGit(projectPath, exec, baseBranch) {
         if (!mergeBase) {
             return [];
         }
-        const diffOut = await exec('git', ['diff', '--name-only', `${mergeBase}...HEAD`], {
+        const diffOut = await exec('git', ['diff', '--name-status', `${mergeBase}...HEAD`], {
             cwd: projectPath,
         });
         return diffOut
             .split('\n')
             .map((line) => line.trim())
-            .filter((line) => line.length > 0);
+            .filter((line) => line.length > 0)
+            .map((line) => {
+            const fields = line.split('\t');
+            const path = fields[fields.length - 1] ?? '';
+            const status = (fields[0] ?? '').startsWith('A') ? 'Added' : 'Other';
+            return { status, path };
+        })
+            .filter((entry) => entry.path.length > 0);
     }
     catch (error) {
         /* reliability-optional: EVIDENCE_AUTOFILL_GIT_DIFF — falls back to ## Files ownership */
@@ -59,6 +87,18 @@ async function computeChangedFilesFromGit(projectPath, exec, baseBranch) {
         return [];
     }
 }
+/** Drops Planu bookkeeping paths, this spec's own spec.md, and newly Added other-spec
+ * spec.md files — the diff still surfaces unowned src/ paths and Modified other-spec
+ * contracts so the done drift gate can flag genuine scope drift. */
+function excludeBookkeepingChanges(entries, ownSpecMdPath) {
+    const bookkeeping = new Set(PLANU_BOOKKEEPING_FILES);
+    const kept = entries
+        .filter((entry) => !bookkeeping.has(entry.path))
+        .filter((entry) => entry.path !== ownSpecMdPath)
+        .filter((entry) => !(entry.status === 'Added' && OTHER_SPEC_MD_PATTERN.test(entry.path)))
+        .map((entry) => entry.path);
+    return [...new Set(kept)];
+}
 function filterExistingRepoFiles(projectPath, paths) {
     return paths.filter((path) => {
         if (isAbsolute(path)) {
@@ -111,15 +151,18 @@ export async function autofillTraceabilityMatrix(args) {
         const scenarios = parseFrontmatterScenarios(args.specBody);
         const exec = args.exec ?? defaultExec;
         const baseBranch = args.baseBranch ?? 'main';
-        const gitChangedFiles = args.projectPath
+        const gitEntries = args.projectPath
             ? await computeChangedFilesFromGit(args.projectPath, exec, baseBranch)
             : [];
+        const gitChangedFiles = excludeBookkeepingChanges(gitEntries, args.ownSpecMdPath);
         const ownership = extractCanonicalFileOwnership(args.specBody);
         const ownershipFiles = [...ownership.toCreate, ...ownership.toModify, ...ownership.toTest];
         const rawChangedFiles = gitChangedFiles.length > 0 ? gitChangedFiles : ownershipFiles;
-        const changedFiles = args.projectPath
-            ? filterExistingRepoFiles(args.projectPath, rawChangedFiles)
-            : rawChangedFiles;
+        const changedFiles = [
+            ...new Set(args.projectPath
+                ? filterExistingRepoFiles(args.projectPath, rawChangedFiles)
+                : rawChangedFiles),
+        ];
         const { validationEvidence, reviewerEvidence } = await readValidationReportSummary(args.projectId, args.specId);
         const rows = criteria.map((acceptanceCriterion, index) => {
             const testPaths = scenarios[index]?.tests?.map((test) => test.path) ?? [];

package/dist/engine/evidence-index/done-drift.d.ts

@@ -2,5 +2,6 @@ import type { EvidenceGateIssue, SpecEvidenceIndex } from '../../types/index.js'
 export declare function checkDoneDriftContract(args: {
     index: SpecEvidenceIndex;
     approvedScopePaths: readonly string[];
+    ownSpecMdPath?: string;
 }): EvidenceGateIssue[];
 //# sourceMappingURL=done-drift.d.ts.map

package/dist/engine/evidence-index/done-drift.js

@@ -1,8 +1,38 @@
 import { normalizeChangedFilePath } from '../handoff-packager.js';
+import { PLANU_BOOKKEEPING_FILES } from '../evidence-gates/evidence-autofill.js';
 function normalizedChangedFile(value) {
     const normalized = normalizeChangedFilePath(value);
     return normalized.status === 'valid' ? normalized.path : null;
 }
+function buildNeverDriftPaths(ownSpecMdPath) {
+    const neverDriftPaths = new Set(PLANU_BOOKKEEPING_FILES);
+    const normalizedOwnSpecMdPath = ownSpecMdPath ? normalizedChangedFile(ownSpecMdPath) : null;
+    if (normalizedOwnSpecMdPath) {
+        neverDriftPaths.add(normalizedOwnSpecMdPath);
+    }
+    return neverDriftPaths;
+}
+function findUnapprovedChangedFiles(index, approved, neverDriftPaths) {
+    return index.criteria.flatMap((entry) => {
+        const hasScopeAmendment = entry.evidence.some((record) => record.kind === 'reviewer' && /scope amendment|approved scope/i.test(record.value));
+        if (hasScopeAmendment) {
+            return [];
+        }
+        return entry.evidence.flatMap((record) => {
+            if (record.kind !== 'changed-file' ||
+                (record.status !== 'valid' && record.status !== 'missing')) {
+                return [];
+            }
+            const normalized = normalizedChangedFile(record.value);
+            if (normalized && neverDriftPaths.has(normalized)) {
+                return [];
+            }
+            return normalized && approved.has(normalized)
+                ? []
+                : [`${entry.criterion}: ${normalized ?? 'invalid changed-file path'}`];
+        });
+    });
+}
 export function checkDoneDriftContract(args) {
     const issues = [];
     const uncovered = args.index.criteria.filter((entry) => {
@@ -39,22 +69,8 @@ export function checkDoneDriftContract(args) {
         return normalized ? [normalized] : [];
     });
     const approved = new Set(approvedScopePaths);
-    const unapproved = args.index.criteria.flatMap((entry) => {
-        const hasScopeAmendment = entry.evidence.some((record) => record.kind === 'reviewer' && /scope amendment|approved scope/i.test(record.value));
-        if (hasScopeAmendment) {
-            return [];
-        }
-        return entry.evidence.flatMap((record) => {
-            if (record.kind !== 'changed-file' ||
-                (record.status !== 'valid' && record.status !== 'missing')) {
-                return [];
-            }
-            const normalized = normalizedChangedFile(record.value);
-            return normalized && approved.has(normalized)
-                ? []
-                : [`${entry.criterion}: ${normalized ?? 'invalid changed-file path'}`];
-        });
-    });
+    const neverDriftPaths = buildNeverDriftPaths(args.ownSpecMdPath);
+    const unapproved = findUnapprovedChangedFiles(args.index, approved, neverDriftPaths);
     if (unapproved.length > 0) {
         const approvedHint = approvedScopePaths.length > 0
             ? ` Approved canonical paths: ${approvedScopePaths.join(', ')}.`

package/dist/engine/planu-core.darwin-arm64.node.manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
-  "cliVersion": "5.3.16",
-  "engineVersion": "5.3.16",
-  "buildId": "1-5.3.16-aarch64-apple-darwin",
+  "cliVersion": "5.3.18",
+  "engineVersion": "5.3.18",
+  "buildId": "1-5.3.18-aarch64-apple-darwin",
   "protocolAbi": 1,
   "capabilityAbi": 2,
   "nodeApiAbi": 4,
@@ -17,15 +17,15 @@
   "platform": "darwin",
   "arch": "arm64",
   "libc": null,
-  "artifactSha256": "2a6db4c53e8d2e492a44dc8c276b3f1ec9e00f20056225221aa142752a9dfb4b",
+  "artifactSha256": "5fed530a8afc4fe8dca40839db0eae5d27430c21291c7b4152204a67f69a0f07",
   "sbom": {
     "format": "CycloneDX-1.5",
     "path": "planu-core.darwin-arm64.node.sbom.json",
-    "sha256": "6bfb518a006ae80f0a94328c6fc0be1fa7d86b9a5bab2d7476a80fc8171dfd71"
+    "sha256": "1667d84a334ea1d0a77aaa2a52fe09e4bddabae03012da6b8a60c36719a50eaf"
   },
   "provenance": {
     "builder": "scripts/build-rust-local.sh",
-    "sourceCommit": "0cde0ff71b6b07e6bb7c059c7f03a7a58910e221",
+    "sourceCommit": "3c1b6c73402a7d249e53f8805fe8429de38e43ac",
     "sourceTreeDirty": false,
     "sourceDateEpoch": 1,
     "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -34,6 +34,6 @@
   "signature": {
     "algorithm": "Ed25519",
     "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
-    "value": "6QDQPYqy6xJ4RHk+SGv1DdPTxgQDQCG63NMTaK2Kk72npIDR7g6h/mCKNLhFDXPALcS7kjqKRijf/PzRqnmCBQ=="
+    "value": "CK7fkEl65ZldoIdkXqxFNABEHNghZ2zt/7aIcmmwP2LiwhuYvYL8H4OHFM6aeojGqpgXoia4MXuC12WcACR3Dw=="
   }
 }

package/dist/engine/planu-core.darwin-arm64.node.sbom.json

@@ -4,14 +4,14 @@
   "version": 1,
   "metadata": {
     "component": {
-      "bom-ref": "pkg:cargo/planu-core@5.3.16",
+      "bom-ref": "pkg:cargo/planu-core@5.3.18",
       "type": "library",
       "name": "planu-core",
-      "version": "5.3.16",
+      "version": "5.3.18",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "2a6db4c53e8d2e492a44dc8c276b3f1ec9e00f20056225221aa142752a9dfb4b"
+          "content": "5fed530a8afc4fe8dca40839db0eae5d27430c21291c7b4152204a67f69a0f07"
         }
       ]
     }
@@ -1106,7 +1106,7 @@
       "dependsOn": []
     },
     {
-      "ref": "pkg:cargo/planu-core@5.3.16",
+      "ref": "pkg:cargo/planu-core@5.3.18",
       "dependsOn": [
         "pkg:cargo/core-foundation@0.10.1",
         "pkg:cargo/hmac@0.12.1",

package/dist/engine/planu-core.darwin-x64.node.manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
-  "cliVersion": "5.3.16",
-  "engineVersion": "5.3.16",
-  "buildId": "1-5.3.16-x86_64-apple-darwin",
+  "cliVersion": "5.3.18",
+  "engineVersion": "5.3.18",
+  "buildId": "1-5.3.18-x86_64-apple-darwin",
   "protocolAbi": 1,
   "capabilityAbi": 2,
   "nodeApiAbi": 4,
@@ -17,15 +17,15 @@
   "platform": "darwin",
   "arch": "x64",
   "libc": null,
-  "artifactSha256": "be5de1bbcd0f9b4989aa82c5b51f0a7425c3eb1fa9dfd772cc362f476db433f5",
+  "artifactSha256": "8287182c1b0be484146f92ee90db5423295e1bd00b8384660de534dc6e29c49d",
   "sbom": {
     "format": "CycloneDX-1.5",
     "path": "planu-core.darwin-x64.node.sbom.json",
-    "sha256": "38a7cc4b3d77c4414c58fd23af446914e84db52dd937e13b763da35b1962ab1e"
+    "sha256": "9514dae23ab932c585e3fec8df947fc144d8f815b2680f2be34291ce97a07f07"
   },
   "provenance": {
     "builder": "scripts/build-rust-local.sh",
-    "sourceCommit": "0cde0ff71b6b07e6bb7c059c7f03a7a58910e221",
+    "sourceCommit": "3c1b6c73402a7d249e53f8805fe8429de38e43ac",
     "sourceTreeDirty": false,
     "sourceDateEpoch": 1,
     "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -34,6 +34,6 @@
   "signature": {
     "algorithm": "Ed25519",
     "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
-    "value": "7X8ph1LL1pB4hXlWcXD109sTeHzyRTa94ozW52TdCg6y1LIH1kNwuz4rU0g0KK4CLpnanRpeLpu7NODRGiP2AQ=="
+    "value": "jxjKFUe/Z6Rnmk97m9rMwg8b0I7zQwOWmovYV50P0M0EAjQkaId91vUI76QQaY4DM1NeUgsnqvzj4UtUQrdZAQ=="
   }
 }

package/dist/engine/planu-core.darwin-x64.node.sbom.json

@@ -4,14 +4,14 @@
   "version": 1,
   "metadata": {
     "component": {
-      "bom-ref": "pkg:cargo/planu-core@5.3.16",
+      "bom-ref": "pkg:cargo/planu-core@5.3.18",
       "type": "library",
       "name": "planu-core",
-      "version": "5.3.16",
+      "version": "5.3.18",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "be5de1bbcd0f9b4989aa82c5b51f0a7425c3eb1fa9dfd772cc362f476db433f5"
+          "content": "8287182c1b0be484146f92ee90db5423295e1bd00b8384660de534dc6e29c49d"
         }
       ]
     }
@@ -1106,7 +1106,7 @@
       "dependsOn": []
     },
     {
-      "ref": "pkg:cargo/planu-core@5.3.16",
+      "ref": "pkg:cargo/planu-core@5.3.18",
       "dependsOn": [
         "pkg:cargo/core-foundation@0.10.1",
         "pkg:cargo/hmac@0.12.1",

package/dist/engine/planu-core.linux-arm64-gnu.node.manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
-  "cliVersion": "5.3.16",
-  "engineVersion": "5.3.16",
-  "buildId": "1-5.3.16-aarch64-unknown-linux-gnu",
+  "cliVersion": "5.3.18",
+  "engineVersion": "5.3.18",
+  "buildId": "1-5.3.18-aarch64-unknown-linux-gnu",
   "protocolAbi": 1,
   "capabilityAbi": 2,
   "nodeApiAbi": 4,
@@ -16,15 +16,15 @@
   "platform": "linux",
   "arch": "arm64",
   "libc": "glibc",
-  "artifactSha256": "01d8ce2cb696744dc58095e8ff7fb2be6afcbccf467b0cd0eb538b6be530e210",
+  "artifactSha256": "2fe96f2baf1f4b811d038cb004bdb59436f6bb18c38cbc0936adf2f3d776f1e0",
   "sbom": {
     "format": "CycloneDX-1.5",
     "path": "planu-core.linux-arm64-gnu.node.sbom.json",
-    "sha256": "5eb69bed870789d764c02f63f0371c51872314e22a888c60af9842c35f536a4b"
+    "sha256": "aaa7a6dc91c4720a456807fc76edc5293e01bb328d4830866500b197661b00c3"
   },
   "provenance": {
     "builder": "scripts/build-rust-local.sh",
-    "sourceCommit": "0cde0ff71b6b07e6bb7c059c7f03a7a58910e221",
+    "sourceCommit": "3c1b6c73402a7d249e53f8805fe8429de38e43ac",
     "sourceTreeDirty": false,
     "sourceDateEpoch": 1,
     "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -33,6 +33,6 @@
   "signature": {
     "algorithm": "Ed25519",
     "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
-    "value": "EJcdFkXbSIapzhu002fZ/X4QRUCpbJjwj4AYsg0G2BiERBQjMavAeiXqVNLr75Jt84NRmcOqXhidCvaEV0snCQ=="
+    "value": "OZu14HADvXX9A0jSQYjeOqU0dI4MczkRXSHbUfGrKKOY/pLLJkfBDsnsLbs5XgSp/V1oSQQDQ0rsDOCRl2WhBg=="
   }
 }

package/dist/engine/planu-core.linux-arm64-gnu.node.sbom.json

@@ -4,14 +4,14 @@
   "version": 1,
   "metadata": {
     "component": {
-      "bom-ref": "pkg:cargo/planu-core@5.3.16",
+      "bom-ref": "pkg:cargo/planu-core@5.3.18",
       "type": "library",
       "name": "planu-core",
-      "version": "5.3.16",
+      "version": "5.3.18",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "01d8ce2cb696744dc58095e8ff7fb2be6afcbccf467b0cd0eb538b6be530e210"
+          "content": "2fe96f2baf1f4b811d038cb004bdb59436f6bb18c38cbc0936adf2f3d776f1e0"
         }
       ]
     }
@@ -1106,7 +1106,7 @@
       "dependsOn": []
     },
     {
-      "ref": "pkg:cargo/planu-core@5.3.16",
+      "ref": "pkg:cargo/planu-core@5.3.18",
       "dependsOn": [
         "pkg:cargo/core-foundation@0.10.1",
         "pkg:cargo/hmac@0.12.1",

package/dist/engine/planu-core.linux-arm64-musl.node.manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
-  "cliVersion": "5.3.16",
-  "engineVersion": "5.3.16",
-  "buildId": "1-5.3.16-aarch64-unknown-linux-musl",
+  "cliVersion": "5.3.18",
+  "engineVersion": "5.3.18",
+  "buildId": "1-5.3.18-aarch64-unknown-linux-musl",
   "protocolAbi": 1,
   "capabilityAbi": 2,
   "nodeApiAbi": 4,
@@ -16,15 +16,15 @@
   "platform": "linux",
   "arch": "arm64",
   "libc": "musl",
-  "artifactSha256": "9b0683851a369169cda5c0e4141df24a59f94da03fdf7b8fc1230da65e38eb36",
+  "artifactSha256": "5749d44caef4716e9def75bb6d9bf630d6a14bbf2f1630d483036b9a0f7fb244",
   "sbom": {
     "format": "CycloneDX-1.5",
     "path": "planu-core.linux-arm64-musl.node.sbom.json",
-    "sha256": "463cb73768477635328836a2a13d34038a2c7aeb83de4d17212274135af77e9e"
+    "sha256": "206a3e0d16affa390afee3880296b9822d98f31dbd9f2d02e560b14419ecb41c"
   },
   "provenance": {
     "builder": "scripts/build-rust-local.sh",
-    "sourceCommit": "0cde0ff71b6b07e6bb7c059c7f03a7a58910e221",
+    "sourceCommit": "3c1b6c73402a7d249e53f8805fe8429de38e43ac",
     "sourceTreeDirty": false,
     "sourceDateEpoch": 1,
     "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -33,6 +33,6 @@
   "signature": {
     "algorithm": "Ed25519",
     "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
-    "value": "LGOiA63xus7b3/9w0/8qTyrKDhkRV0y3EMRV7F5NHxj8oDGqLz81viGJvBU+iri4Xhh0Ku03hxoD377vhE4TBQ=="
+    "value": "cJ2vBlGhEl/fnE+iYdmGff9ghJujeqt77VGbZZJeQWfyB3YcZdf298M9REEQfr7QgQeExyjJHE3l9AExHo3aAg=="
   }
 }

package/dist/engine/planu-core.linux-arm64-musl.node.sbom.json

@@ -4,14 +4,14 @@
   "version": 1,
   "metadata": {
     "component": {
-      "bom-ref": "pkg:cargo/planu-core@5.3.16",
+      "bom-ref": "pkg:cargo/planu-core@5.3.18",
       "type": "library",
       "name": "planu-core",
-      "version": "5.3.16",
+      "version": "5.3.18",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "9b0683851a369169cda5c0e4141df24a59f94da03fdf7b8fc1230da65e38eb36"
+          "content": "5749d44caef4716e9def75bb6d9bf630d6a14bbf2f1630d483036b9a0f7fb244"
         }
       ]
     }
@@ -1106,7 +1106,7 @@
       "dependsOn": []
     },
     {
-      "ref": "pkg:cargo/planu-core@5.3.16",
+      "ref": "pkg:cargo/planu-core@5.3.18",
       "dependsOn": [
         "pkg:cargo/core-foundation@0.10.1",
         "pkg:cargo/hmac@0.12.1",

package/dist/engine/planu-core.linux-x64-gnu.node.manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
-  "cliVersion": "5.3.16",
-  "engineVersion": "5.3.16",
-  "buildId": "1-5.3.16-x86_64-unknown-linux-gnu",
+  "cliVersion": "5.3.18",
+  "engineVersion": "5.3.18",
+  "buildId": "1-5.3.18-x86_64-unknown-linux-gnu",
   "protocolAbi": 1,
   "capabilityAbi": 2,
   "nodeApiAbi": 4,
@@ -16,15 +16,15 @@
   "platform": "linux",
   "arch": "x64",
   "libc": "glibc",
-  "artifactSha256": "2d8c9186e43c03eb451a9772c3dac7931039e5326997364bc2bcc5aa38726b48",
+  "artifactSha256": "ddcf0b909005c6dd5b5833ca2380979f50b11a081b883e449ce044476ef4da90",
   "sbom": {
     "format": "CycloneDX-1.5",
     "path": "planu-core.linux-x64-gnu.node.sbom.json",
-    "sha256": "a27023f31bf2290b52d4e344d1859f3bbb49f5a19ce9998800987440ce834964"
+    "sha256": "26c6d0f0dd9558bd863fb3bcdc092cb8821ae6635495503d1ca513595a830ed6"
   },
   "provenance": {
     "builder": "scripts/build-rust-local.sh",
-    "sourceCommit": "0cde0ff71b6b07e6bb7c059c7f03a7a58910e221",
+    "sourceCommit": "3c1b6c73402a7d249e53f8805fe8429de38e43ac",
     "sourceTreeDirty": false,
     "sourceDateEpoch": 1,
     "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -33,6 +33,6 @@
   "signature": {
     "algorithm": "Ed25519",
     "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
-    "value": "FEn6GiPlQVBmOEc8zw6SxFzCxNF9OfYAakAa36oR0r5fbCQBFBgfbuuKGdLar7rdnaU3vcgiexCzHJIuYdwFCg=="
+    "value": "DHqxCc8X0fG9/Obugix+X+KLWWAxiVaw//r9ba1EgVA+kaE2C4nQbFGp+qcYa+XDcjmfHRJudQrf0dTwXI4QCg=="
   }
 }

package/dist/engine/planu-core.linux-x64-gnu.node.sbom.json

@@ -4,14 +4,14 @@
   "version": 1,
   "metadata": {
     "component": {
-      "bom-ref": "pkg:cargo/planu-core@5.3.16",
+      "bom-ref": "pkg:cargo/planu-core@5.3.18",
       "type": "library",
       "name": "planu-core",
-      "version": "5.3.16",
+      "version": "5.3.18",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "2d8c9186e43c03eb451a9772c3dac7931039e5326997364bc2bcc5aa38726b48"
+          "content": "ddcf0b909005c6dd5b5833ca2380979f50b11a081b883e449ce044476ef4da90"
         }
       ]
     }
@@ -1106,7 +1106,7 @@
       "dependsOn": []
     },
     {
-      "ref": "pkg:cargo/planu-core@5.3.16",
+      "ref": "pkg:cargo/planu-core@5.3.18",
       "dependsOn": [
         "pkg:cargo/core-foundation@0.10.1",
         "pkg:cargo/hmac@0.12.1",

package/dist/engine/planu-core.linux-x64-musl.node.manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
-  "cliVersion": "5.3.16",
-  "engineVersion": "5.3.16",
-  "buildId": "1-5.3.16-x86_64-unknown-linux-musl",
+  "cliVersion": "5.3.18",
+  "engineVersion": "5.3.18",
+  "buildId": "1-5.3.18-x86_64-unknown-linux-musl",
   "protocolAbi": 1,
   "capabilityAbi": 2,
   "nodeApiAbi": 4,
@@ -16,15 +16,15 @@
   "platform": "linux",
   "arch": "x64",
   "libc": "musl",
-  "artifactSha256": "50547de5b23c0671447358eebc95d3841a2ce278236f5000655182ffb998d547",
+  "artifactSha256": "7d251de39b960c7bcdbfd2770c7a778bdb8fe532a45def6206a5ac4ba349bf89",
   "sbom": {
     "format": "CycloneDX-1.5",
     "path": "planu-core.linux-x64-musl.node.sbom.json",
-    "sha256": "a074e28e92546729d7347be57236bd8a0678ea1396fd756770915db6efecfa18"
+    "sha256": "c826c2dabe78e17d3e83788eb69548ff0f06a0c29c1a95d215956562fd63e0ab"
   },
   "provenance": {
     "builder": "scripts/build-rust-local.sh",
-    "sourceCommit": "0cde0ff71b6b07e6bb7c059c7f03a7a58910e221",
+    "sourceCommit": "3c1b6c73402a7d249e53f8805fe8429de38e43ac",
     "sourceTreeDirty": false,
     "sourceDateEpoch": 1,
     "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -33,6 +33,6 @@
   "signature": {
     "algorithm": "Ed25519",
     "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
-    "value": "qvTXfNiZUTxm+mdb2A7/P6wjxEhdCr9WIVZkzDDOoxu4k4NgFeBmrSGKdRays0RSEivQ9f23gnvhS1myJ+DIAQ=="
+    "value": "W8mvPSxXSz7L0Ce0N+xQeeqMy0Nx87dcW53m1QmdR7dqSo2S5MsB26XVHn/Yn/QmD4bP2vjEdG1RAYVgh4XgCQ=="
   }
 }

package/dist/engine/planu-core.linux-x64-musl.node.sbom.json

@@ -4,14 +4,14 @@
   "version": 1,
   "metadata": {
     "component": {
-      "bom-ref": "pkg:cargo/planu-core@5.3.16",
+      "bom-ref": "pkg:cargo/planu-core@5.3.18",
       "type": "library",
       "name": "planu-core",
-      "version": "5.3.16",
+      "version": "5.3.18",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "50547de5b23c0671447358eebc95d3841a2ce278236f5000655182ffb998d547"
+          "content": "7d251de39b960c7bcdbfd2770c7a778bdb8fe532a45def6206a5ac4ba349bf89"
         }
       ]
     }
@@ -1106,7 +1106,7 @@
       "dependsOn": []
     },
     {
-      "ref": "pkg:cargo/planu-core@5.3.16",
+      "ref": "pkg:cargo/planu-core@5.3.18",
       "dependsOn": [
         "pkg:cargo/core-foundation@0.10.1",
         "pkg:cargo/hmac@0.12.1",

package/dist/engine/planu-core.win32-arm64-msvc.node.manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
-  "cliVersion": "5.3.16",
-  "engineVersion": "5.3.16",
-  "buildId": "1-5.3.16-aarch64-pc-windows-msvc",
+  "cliVersion": "5.3.18",
+  "engineVersion": "5.3.18",
+  "buildId": "1-5.3.18-aarch64-pc-windows-msvc",
   "protocolAbi": 1,
   "capabilityAbi": 2,
   "nodeApiAbi": 4,
@@ -16,15 +16,15 @@
   "platform": "win32",
   "arch": "arm64",
   "libc": null,
-  "artifactSha256": "151f0906eac861f554ce19ede7347d8267048f67aeb71b5f2521c7eaf8fbc034",
+  "artifactSha256": "43386818ebe7d5acac484fa8e4a38a8508b7b2baa17b421d1720a5133ae25022",
   "sbom": {
     "format": "CycloneDX-1.5",
     "path": "planu-core.win32-arm64-msvc.node.sbom.json",
-    "sha256": "2acb3f0615fee3f77ca7be0110f41c245b760d81811c0299a57aac2f7aa15fc9"
+    "sha256": "b4571ec45d947374617a7f4315c1be522111e9ad49f63023febdef3d4c6e3fb1"
   },
   "provenance": {
     "builder": "scripts/build-rust-local.sh",
-    "sourceCommit": "0cde0ff71b6b07e6bb7c059c7f03a7a58910e221",
+    "sourceCommit": "3c1b6c73402a7d249e53f8805fe8429de38e43ac",
     "sourceTreeDirty": false,
     "sourceDateEpoch": 1,
     "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -33,6 +33,6 @@
   "signature": {
     "algorithm": "Ed25519",
     "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
-    "value": "qMuwIDaEU/3JJj3BuHx/uv8ZCDScOhZGUSHuIKSS64I31OESsH7QuSd6+7QYT9THm5hb0nxuol3BtyyQ3AX3Dg=="
+    "value": "kWkreQpknVVatNtjxmRVdggvQnemK2iIIrcHwZqwISsdPfmnXLHv+X0LmJlpOs1rqXh85FIAJmm2Z6Dz+9YkAw=="
   }
 }

package/dist/engine/planu-core.win32-arm64-msvc.node.sbom.json

@@ -4,14 +4,14 @@
   "version": 1,
   "metadata": {
     "component": {
-      "bom-ref": "pkg:cargo/planu-core@5.3.16",
+      "bom-ref": "pkg:cargo/planu-core@5.3.18",
       "type": "library",
       "name": "planu-core",
-      "version": "5.3.16",
+      "version": "5.3.18",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "151f0906eac861f554ce19ede7347d8267048f67aeb71b5f2521c7eaf8fbc034"
+          "content": "43386818ebe7d5acac484fa8e4a38a8508b7b2baa17b421d1720a5133ae25022"
         }
       ]
     }
@@ -1106,7 +1106,7 @@
       "dependsOn": []
     },
     {
-      "ref": "pkg:cargo/planu-core@5.3.16",
+      "ref": "pkg:cargo/planu-core@5.3.18",
       "dependsOn": [
         "pkg:cargo/core-foundation@0.10.1",
         "pkg:cargo/hmac@0.12.1",

package/dist/engine/planu-core.win32-x64-msvc.node.manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
-  "cliVersion": "5.3.16",
-  "engineVersion": "5.3.16",
-  "buildId": "1-5.3.16-x86_64-pc-windows-msvc",
+  "cliVersion": "5.3.18",
+  "engineVersion": "5.3.18",
+  "buildId": "1-5.3.18-x86_64-pc-windows-msvc",
   "protocolAbi": 1,
   "capabilityAbi": 2,
   "nodeApiAbi": 4,
@@ -16,15 +16,15 @@
   "platform": "win32",
   "arch": "x64",
   "libc": null,
-  "artifactSha256": "b002099edf523c6aa0ca6f658a19514ff0a20ccf154bd88e4e205d49d9135590",
+  "artifactSha256": "017329ba941530655f52d8bfda224dc64da19fd998af72a4047e4f8837116b81",
   "sbom": {
     "format": "CycloneDX-1.5",
     "path": "planu-core.win32-x64-msvc.node.sbom.json",
-    "sha256": "c1b0d2ac50e19c7133dccb297d19f3a317125bfd88e87508ae0743acba413c5f"
+    "sha256": "5f6b8d9d3df9dac089f07f3e96c6e8c3d456db7f23fba6f051bea23bdb463e20"
   },
   "provenance": {
     "builder": "scripts/build-rust-local.sh",
-    "sourceCommit": "0cde0ff71b6b07e6bb7c059c7f03a7a58910e221",
+    "sourceCommit": "3c1b6c73402a7d249e53f8805fe8429de38e43ac",
     "sourceTreeDirty": false,
     "sourceDateEpoch": 1,
     "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -33,6 +33,6 @@
   "signature": {
     "algorithm": "Ed25519",
     "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
-    "value": "wQa0ygTquWBg4jFcHX8+sVqOETbJGfViThB7wyshllPFfdCF8s8chApggB+dgjCJd6qz2JaI1aJyifFFsIF9BQ=="
+    "value": "n05uJoOniOELxpoTVp25r7wDI1U+Z2hu6VI9mkxXLvBFGcPhWeoGJ1W+igcNkEiOA26Ihn88fGsT04ALFHntCQ=="
   }
 }

package/dist/engine/planu-core.win32-x64-msvc.node.sbom.json

@@ -4,14 +4,14 @@
   "version": 1,
   "metadata": {
     "component": {
-      "bom-ref": "pkg:cargo/planu-core@5.3.16",
+      "bom-ref": "pkg:cargo/planu-core@5.3.18",
       "type": "library",
       "name": "planu-core",
-      "version": "5.3.16",
+      "version": "5.3.18",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "b002099edf523c6aa0ca6f658a19514ff0a20ccf154bd88e4e205d49d9135590"
+          "content": "017329ba941530655f52d8bfda224dc64da19fd998af72a4047e4f8837116b81"
         }
       ]
     }
@@ -1106,7 +1106,7 @@
       "dependsOn": []
     },
     {
-      "ref": "pkg:cargo/planu-core@5.3.16",
+      "ref": "pkg:cargo/planu-core@5.3.18",
       "dependsOn": [
         "pkg:cargo/core-foundation@0.10.1",
         "pkg:cargo/hmac@0.12.1",

package/dist/tools/challenge-spec/scenarios-data.js

@@ -1,12 +1,25 @@
 // tools/challenge-spec/scenarios-data.ts — Data consistency and partial write scenarios
 import { contentMentions, hasAnyAffirmedMatch } from './scenarios-utils.js';
+const GIT_CHECKOUT_PREFIX = '(?<!\\b(?:git|branch|worktree|main)\\s)';
 const WRITE_SIGNALS = [
     /\b(transaction|persist|database write|save record|create record|update record|delete record)\b/i,
-    /\b(order|checkout|submit form|mutation|multi-step write)\b/i,
+    /\bsubmit\s+form\b/i,
+    /\bmulti-step\s+write\b/i,
+    /\bdata\s+mutation\b/i,
+    /\bplaces?\s+an\s+order\b/i,
+    new RegExp(`${GIT_CHECKOUT_PREFIX}\\bcheckout\\s+(?:flow|process|order|endpoint)\\b`, 'i'),
 ];
 const CACHE_SIGNALS = [/\b(cache|cached|real-time|realtime|websocket|stale data)\b/i];
 const DUPLICATE_OPERATION_SIGNALS = [
-    /\b(submit|form|checkout|order|payment|create record|mutation|button click)\b/i,
+    /\bsubmit(?:s|ted|ting)?\s+(?:a\s+|the\s+)?form\b/i,
+    /\bform\s+submission\b/i,
+    /\bbutton\s+click\b/i,
+    /\bdouble[ -]?click\b/i,
+    /\buser\s+submits?\b/i,
+    /\b(?:order|submit|checkout|payment|purchase)\s+button\b/i,
+    /\bplaces?\s+an\s+order\b/i,
+    new RegExp(`${GIT_CHECKOUT_PREFIX}\\bcheckout\\s+(?:flow|page|process|endpoint|order)\\b`, 'i'),
+    /\bpayment\s+(?:flow|submission|mutation)\b/i,
     /\bduplicate\s+(?:request|submission|operation|record)\b/i,
 ];
 export function generateDataConsistencyScenarios(_spec, content, _knowledge) {

package/dist/tools/update-status/evidence-gate.js

@@ -57,6 +57,7 @@ import { readEvidenceArtifacts } from '../../engine/evidence-gates/artifact-read
 import { checkLifecycleEvidenceGate } from '../../engine/evidence-gates/lifecycle-gate.js';
 import { buildSpecEvidenceIndex } from '../../engine/evidence-index/index-builder.js';
 import { checkDoneDriftContract } from '../../engine/evidence-index/done-drift.js';
+import { toRepoRelativePath } from '../../engine/evidence-gates/evidence-autofill.js';
 import { parseGroundedTechnicalPaths } from '../../engine/spec-grounding/contract.js';
 import { extractAcceptanceCriteriaTexts } from '../../engine/spec-format/acceptance-criteria.js';
 import { formatKeyValue } from '../output-formatter.js';
@@ -168,7 +169,11 @@ export async function checkLifecycleEvidenceTransitionGate(args) {
                 message: `Approved canonical ownership is invalid: ${[...new Set(safeBlockers)].join(', ')}.`,
             });
         }
-        result.issues.push(...checkDoneDriftContract({ index, approvedScopePaths }));
+        result.issues.push(...checkDoneDriftContract({
+            index,
+            approvedScopePaths,
+            ownSpecMdPath: toRepoRelativePath(args.spec.specPath, args.projectPath),
+        }));
     }
     if (result.issues.length === 0) {
         return null;

package/dist/tools/update-status/index.js

@@ -17,7 +17,7 @@ import { withApprovalSpecLock } from '../../storage/approval-operation-lock.js';
 import { isLocked, getLock } from '../../storage/spec-lock-store.js';
 import { checkDoneGates, checkComplianceGate, checkApprovedFormatGate, checkSpecReviewGate, deriveDoneReviewDigest, } from './dod-gates.js';
 import { checkLifecycleEvidenceTransitionGate } from './evidence-gate.js';
-import { autofillTraceabilityMatrix } from '../../engine/evidence-gates/evidence-autofill.js';
+import { autofillTraceabilityMatrix, toRepoRelativePath, } from '../../engine/evidence-gates/evidence-autofill.js';
 import { buildStatusResponse, buildDryRunResponse } from './response-builder.js';
 import { recordDoneMetrics, syncSpecFiles, tryReconcile, recordTerminalTransitionEvent, } from './file-sync.js';
 import { appendEntry, getLastHash } from '../../storage/audit-trail-store.js';
@@ -165,6 +165,7 @@ async function runTraceabilityAutofillGate(args) {
             specId: args.specId,
             projectPath: args.projectPath,
             specBody,
+            ownSpecMdPath: toRepoRelativePath(args.spec.specPath, args.projectPath),
         });
         if (!result.written) {
             return null;

package/dist/types/evidence-autofill.d.ts

@@ -21,6 +21,8 @@ export interface AutofillTraceabilityMatrixArgs {
     exec?: EvidenceAutofillExec;
     /** Branch to diff against for changed-files detection. Defaults to `main`. */
     baseBranch?: string;
+    /** Repo-relative path of this spec's own spec.md, excluded from changedFiles as lifecycle bookkeeping. */
+    ownSpecMdPath?: string;
 }
 export type AutofillTraceabilityMatrixResult = {
     written: true;

package/dist/types/plugin-configs.d.ts

@@ -5,20 +5,6 @@ export interface AcGapKeywordGroup {
     language: string;
     keywords: string[];
 }
-export interface ChallengeScenarioPattern {
-    id: string;
-    category: string;
-    triggerKeywords: string[];
-    scenario: string;
-    probability: 'low' | 'medium' | 'high';
-    impact: 'low' | 'medium' | 'high' | 'critical';
-    handlingKeywords: string[];
-    handlingFound: string;
-    handlingMissing: string;
-    requiredHandling: string;
-    dataConsistency: string;
-    userExperience: string;
-}
 export interface CodeQualityThreshold {
     id: string;
     language: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@planu/cli",
-  "version": "5.3.16",
+  "version": "5.3.18",
   "description": "Planu — MCP Server for Spec Driven Development with native Rust acceleration for hot paths. Cross-platform (Linux/macOS/Windows, x64/arm64, glibc/musl).",
   "type": "module",
   "main": "dist/index.js",
@@ -35,14 +35,14 @@
     "packageName": "@planu/core"
   },
   "optionalDependencies": {
-    "@planu/core-darwin-arm64": "5.3.16",
-    "@planu/core-darwin-x64": "5.3.16",
-    "@planu/core-linux-arm64-gnu": "5.3.16",
-    "@planu/core-linux-arm64-musl": "5.3.16",
-    "@planu/core-linux-x64-gnu": "5.3.16",
-    "@planu/core-linux-x64-musl": "5.3.16",
-    "@planu/core-win32-arm64-msvc": "5.3.16",
-    "@planu/core-win32-x64-msvc": "5.3.16"
+    "@planu/core-darwin-arm64": "5.3.18",
+    "@planu/core-darwin-x64": "5.3.18",
+    "@planu/core-linux-arm64-gnu": "5.3.18",
+    "@planu/core-linux-arm64-musl": "5.3.18",
+    "@planu/core-linux-x64-gnu": "5.3.18",
+    "@planu/core-linux-x64-musl": "5.3.18",
+    "@planu/core-win32-arm64-msvc": "5.3.18",
+    "@planu/core-win32-x64-msvc": "5.3.18"
   },
   "engines": {
     "node": ">=24.0.0"

package/planu-native.json

@@ -1,7 +1,7 @@
 {
   "name": "dev.planu.native",
   "displayName": "Planu Native Lightweight Surface",
-  "version": "5.3.16",
+  "version": "5.3.18",
   "packageName": "@planu/cli",
   "modes": {
     "lightweight": {

package/planu-plugin.json

@@ -2,7 +2,7 @@
   "name": "dev.planu.cli",
   "displayName": "Planu — Spec Driven Development",
   "description": "Manage software specs, estimations, and autonomous SDD workflows. Language-agnostic MCP server for Claude Code.",
-  "version": "5.3.16",
+  "version": "5.3.18",
   "icon": "assets/plugin/icon.svg",
   "command": ["npx", "@planu/cli@latest"],
   "packageName": "@planu/cli",

package/dist/config/challenge-scenarios.json

@@ -1,114 +0,0 @@
-[
-  {
-    "id": "data-partial-write",
-    "category": "data-consistency",
-    "triggerKeywords": ["transaction", "update", "create", "modify", "save"],
-    "scenario": "Partial write: server crashes mid-transaction",
-    "probability": "low",
-    "impact": "critical",
-    "handlingKeywords": ["transaction", "atomic", "rollback"],
-    "handlingFound": "Transactions mentioned",
-    "handlingMissing": "Not addressed",
-    "requiredHandling": "Wrap multi-step writes in database transactions. Implement saga pattern for distributed operations.",
-    "dataConsistency": "ACID properties must be maintained. No orphaned records.",
-    "userExperience": "Transparent: user sees either success or clean failure with clear error message."
-  },
-  {
-    "id": "data-stale-cache",
-    "category": "data-consistency",
-    "triggerKeywords": ["cache", "real-time", "concurrent"],
-    "scenario": "Stale data served from cache after underlying data changes",
-    "probability": "high",
-    "impact": "medium",
-    "handlingKeywords": ["invalidat", "ttl", "websocket", "real-time"],
-    "handlingFound": "Some cache strategy mentioned",
-    "handlingMissing": "Not addressed",
-    "requiredHandling": "Implement cache invalidation on writes. Use TTL for time-sensitive data. Consider event-driven invalidation.",
-    "dataConsistency": "Define acceptable staleness window per data type. Document cache strategy.",
-    "userExperience": "Show \"last updated\" timestamp. Offer manual refresh option."
-  },
-  {
-    "id": "data-duplicate-submit",
-    "category": "data-consistency",
-    "triggerKeywords": [],
-    "scenario": "User double-clicks submit, causing duplicate records",
-    "probability": "high",
-    "impact": "medium",
-    "handlingKeywords": ["idempoten", "debounce", "disable", "lock"],
-    "handlingFound": "Some prevention mentioned",
-    "handlingMissing": "Not addressed",
-    "requiredHandling": "Implement idempotency keys for mutations. Disable submit button on click. Use unique constraints in DB.",
-    "dataConsistency": "No duplicate records from repeated submissions.",
-    "userExperience": "Button disabled during submission. Clear success/error feedback."
-  },
-  {
-    "id": "security-auth-bypass",
-    "category": "security",
-    "triggerKeywords": ["auth", "login", "user", "permission", "role"],
-    "scenario": "Unauthorized access attempt / authentication bypass",
-    "probability": "high",
-    "impact": "critical",
-    "handlingKeywords": ["auth", "jwt", "session", "middleware"],
-    "handlingFound": "Authentication mentioned",
-    "handlingMissing": "No explicit auth handling",
-    "requiredHandling": "Validate auth tokens on every request. Implement RBAC. Never trust client-side auth state.",
-    "dataConsistency": "Ensure RLS policies are enabled. No data leak through unauthorized queries.",
-    "userExperience": "Redirect to login on 401. Clear error messages without leaking implementation details."
-  },
-  {
-    "id": "security-injection",
-    "category": "security",
-    "triggerKeywords": ["input", "form", "query", "search", "user"],
-    "scenario": "SQL injection / XSS / command injection via user input",
-    "probability": "high",
-    "impact": "critical",
-    "handlingKeywords": ["sanitiz", "escap", "parameterized", "prepared"],
-    "handlingFound": "Some sanitization mentioned",
-    "handlingMissing": "Not explicitly addressed",
-    "requiredHandling": "Use parameterized queries (never string concatenation). Sanitize HTML output. Use CSP headers.",
-    "dataConsistency": "Injection can corrupt or exfiltrate data. Use least-privilege DB connections.",
-    "userExperience": "Transparent to user. Invalid input is silently sanitized."
-  },
-  {
-    "id": "scale-high-traffic",
-    "category": "scale",
-    "triggerKeywords": ["user", "request", "api", "endpoint"],
-    "scenario": "Traffic spike: 10x normal load in 60 seconds",
-    "probability": "medium",
-    "impact": "critical",
-    "handlingKeywords": ["rate-limit", "throttl", "queue", "cache", "cdn", "auto-scal"],
-    "handlingFound": "Some scaling strategy mentioned",
-    "handlingMissing": "No scaling strategy defined",
-    "requiredHandling": "Define rate limits per user and per IP. Implement request queuing for expensive operations. Use CDN for static assets.",
-    "dataConsistency": "Eventual consistency acceptable under load. No data loss.",
-    "userExperience": "Graceful degradation. Show 'service busy' instead of 500 errors."
-  },
-  {
-    "id": "failure-network-timeout",
-    "category": "failure",
-    "triggerKeywords": ["api", "external", "service", "http", "fetch"],
-    "scenario": "External API or service becomes unavailable / times out",
-    "probability": "medium",
-    "impact": "high",
-    "handlingKeywords": ["timeout", "retry", "fallback", "circuit-breaker", "circuit breaker"],
-    "handlingFound": "Timeout/retry strategy mentioned",
-    "handlingMissing": "No timeout or fallback defined",
-    "requiredHandling": "Set explicit timeouts on all external calls. Implement exponential backoff. Define fallback behavior (cached data, graceful degradation).",
-    "dataConsistency": "Operations that fail mid-way must be idempotent or rolled back.",
-    "userExperience": "Show cached/stale data with staleness indicator. Never hang indefinitely."
-  },
-  {
-    "id": "failure-disk-full",
-    "category": "failure",
-    "triggerKeywords": ["file", "upload", "storage", "media", "image"],
-    "scenario": "Storage exhaustion: disk full or quota exceeded",
-    "probability": "low",
-    "impact": "high",
-    "handlingKeywords": ["quota", "limit", "storage", "disk"],
-    "handlingFound": "Storage limits mentioned",
-    "handlingMissing": "No storage limit handling",
-    "requiredHandling": "Check available space before writes. Implement quota enforcement. Alert when approaching limits.",
-    "dataConsistency": "Partial uploads must be cleaned up. No orphaned files.",
-    "userExperience": "Clear error: 'Storage quota exceeded. Please free up space.' with actionable next step."
-  }
-]

package/dist/engine/challenge-scenarios-loader.d.ts

@@ -1,46 +0,0 @@
-import { z } from 'zod';
-import type { ChallengeScenarioPattern } from '../types/index.js';
-export declare const ChallengeScenarioPatternSchema: z.ZodObject<{
-    id: z.ZodString;
-    category: z.ZodString;
-    triggerKeywords: z.ZodArray<z.ZodString>;
-    scenario: z.ZodString;
-    probability: z.ZodEnum<{
-        high: "high";
-        low: "low";
-        medium: "medium";
-    }>;
-    impact: z.ZodEnum<{
-        critical: "critical";
-        high: "high";
-        low: "low";
-        medium: "medium";
-    }>;
-    handlingKeywords: z.ZodArray<z.ZodString>;
-    handlingFound: z.ZodString;
-    handlingMissing: z.ZodString;
-    requiredHandling: z.ZodString;
-    dataConsistency: z.ZodString;
-    userExperience: z.ZodString;
-}, z.core.$strip>;
-export type { ChallengeScenarioPattern };
-/**
- * Load all challenge scenario patterns from the 3-layer config system.
- */
-export declare function loadScenarioPatterns(projectHash?: string): ChallengeScenarioPattern[];
-/**
- * Filter patterns that are triggered by content of the spec.
- * A pattern is triggered if ANY of its triggerKeywords appear in specContent,
- * OR if it has no trigger keywords (always-on scenarios).
- */
-export declare function getTriggeredPatterns(specContent: string, projectHash?: string): ChallengeScenarioPattern[];
-/**
- * Get patterns filtered by category.
- */
-export declare function getPatternsByCategory(category: string, projectHash?: string): ChallengeScenarioPattern[];
-/**
- * Determine currentHandling label based on whether the spec content
- * includes any of the pattern's handlingKeywords.
- */
-export declare function resolveHandlingLabel(pattern: ChallengeScenarioPattern, specContent: string): string;
-//# sourceMappingURL=challenge-scenarios-loader.d.ts.map

package/dist/engine/challenge-scenarios-loader.js

@@ -1,83 +0,0 @@
-// engine/challenge-scenarios-loader.ts — Challenge scenario pattern library (SPEC-214)
-//
-// Loads challenge scenario patterns from the 3-layer config system.
-// Source: src/config/challenge-scenarios.json (system defaults)
-// Override: data/global/challenge-scenarios-custom.json
-//           data/projects/{hash}/config/challenge-scenarios-overrides.json
-//
-// Scenarios can be extended via JSON without modifying TypeScript source files.
-import { z } from 'zod';
-import { ConfigLoader } from './config-loader.js';
-// ---------------------------------------------------------------------------
-// Schema
-// ---------------------------------------------------------------------------
-export const ChallengeScenarioPatternSchema = z.object({
-    id: z.string().min(1).describe('Unique scenario pattern identifier'),
-    category: z
-        .string()
-        .min(1)
-        .describe('Scenario category: data-consistency, security, scale, failure, etc.'),
-    triggerKeywords: z
-        .array(z.string())
-        .describe('Keywords in spec content that activate this scenario'),
-    scenario: z.string().min(1).describe('Short description of the failure scenario'),
-    probability: z.enum(['low', 'medium', 'high']).describe('Probability of this failure occurring'),
-    impact: z.enum(['low', 'medium', 'high', 'critical']).describe('Impact if this failure occurs'),
-    handlingKeywords: z
-        .array(z.string())
-        .describe('Keywords that indicate the spec already addresses this scenario'),
-    handlingFound: z.string().describe('Message when handling is detected in spec'),
-    handlingMissing: z.string().describe('Message when handling is absent from spec'),
-    requiredHandling: z.string().describe('What the spec should implement to handle this scenario'),
-    dataConsistency: z.string().describe('Data consistency requirements for this scenario'),
-    userExperience: z.string().describe('Expected user experience for this scenario'),
-});
-const patternsArraySchema = z.array(ChallengeScenarioPatternSchema);
-// ---------------------------------------------------------------------------
-// Loader singleton
-// ---------------------------------------------------------------------------
-let _loader = null;
-function getLoader() {
-    _loader ??= new ConfigLoader('challenge-scenarios', patternsArraySchema);
-    return _loader;
-}
-// ---------------------------------------------------------------------------
-// Public API
-// ---------------------------------------------------------------------------
-/**
- * Load all challenge scenario patterns from the 3-layer config system.
- */
-export function loadScenarioPatterns(projectHash) {
-    return getLoader().load(projectHash);
-}
-/**
- * Filter patterns that are triggered by content of the spec.
- * A pattern is triggered if ANY of its triggerKeywords appear in specContent,
- * OR if it has no trigger keywords (always-on scenarios).
- */
-export function getTriggeredPatterns(specContent, projectHash) {
-    const lower = specContent.toLowerCase();
-    const all = loadScenarioPatterns(projectHash);
-    return all.filter((pattern) => {
-        if (pattern.triggerKeywords.length === 0) {
-            return true; // always-on pattern
-        }
-        return pattern.triggerKeywords.some((kw) => lower.includes(kw.toLowerCase()));
-    });
-}
-/**
- * Get patterns filtered by category.
- */
-export function getPatternsByCategory(category, projectHash) {
-    return loadScenarioPatterns(projectHash).filter((p) => p.category === category);
-}
-/**
- * Determine currentHandling label based on whether the spec content
- * includes any of the pattern's handlingKeywords.
- */
-export function resolveHandlingLabel(pattern, specContent) {
-    const lower = specContent.toLowerCase();
-    const addressed = pattern.handlingKeywords.some((kw) => lower.includes(kw.toLowerCase()));
-    return addressed ? pattern.handlingFound : pattern.handlingMissing;
-}
-//# sourceMappingURL=challenge-scenarios-loader.js.map