@planu/cli 5.3.18 → 5.3.20

package/CHANGELOG.md

@@ -1,3 +1,29 @@
+## [5.3.20] - 2026-08-12
+
+### Bug Fixes
+- fix(release): unblock validate and privacy gates for v5.3.20
+- fix(spec-1495): ground the outOfScope recommendation in the spec document
+- fix(spec-1483): fail the native build on a version-mismatched artifact
+
+
+## [5.3.19] - 2026-08-11
+
+### Bug Fixes
+- fix(spec-1492): size release budgets to the longest child chain per test
+- fix(spec-1492): coordinate release-harness spawn and test budgets
+- fix(spec-1486): raise load-tolerant timeout budgets in script-gate and heartbeat tests
+- fix(spec-1482): update validate.test.ts lint timeout and message assertions per review
+- fix(spec-1482): honor mid-run lint evidence on timeout and right-size lint caps
+
+### Chores
+- chore(spec-1492): record done transition with review and traceability evidence
+- chore(spec-1486): record done transition with traceability and validation evidence
+- chore(spec-1486): approve arbitrated script-gate timeout spec with dual-review evidence
+- chore(spec-1486): add durable-job-heartbeat beforeAll hookTimeout reproducer
+- chore(spec-1482): record done transition with traceability and validation evidence
+- chore(spec-1482): approve arbitrated lint-gate timeout spec with dual-review evidence
+
+
 ## [5.3.18] - 2026-08-11
 
 ### Bug Fixes

package/dist/config/runtime-policy.json

@@ -14,7 +14,7 @@
     "maximumOutputBufferBytes": 67108864
   },
   "lintValidation": {
-    "defaultTimeoutMs": 90000,
+    "defaultTimeoutMs": 180000,
     "minimumTimeoutMs": 1000,
     "maximumTimeoutMs": 1800000
   },
@@ -28,7 +28,7 @@
   },
   "validation": {
     "defaultDeadlineMs": 1800000,
-    "durableLintTimeoutMs": 150000,
+    "durableLintTimeoutMs": 170000,
     "perGateTimeoutMs": 180000,
     "complianceCommandTimeoutMs": 900000,
     "noProgressTimeoutMs": 960000,

package/dist/engine/core-bridge.js

@@ -187,7 +187,7 @@ function loadNative() {
             return mod;
         }
     }
-    loadDiagnostic = { attempted: attempts, errors };
+    loadDiagnostic = { ...loadDiagnostic, attempted: attempts, errors };
     return null;
 }
 function refreshNativeCapabilityDiagnostic() {
@@ -223,7 +223,7 @@ export function requireMacOSKeychainNativePort() {
     const keychainNative = loadNative();
     refreshNativeCapabilityDiagnostic();
     return createMacOSKeychainNativePort(process.platform, process.env.PLANU_NATIVE_PATH !== undefined ||
-        process.env.NAPI_RS_NATIVE_LIBRARY_PATH !== undefined, process.env.DISABLE_NATIVE_CORE === '1', keychainNative, loadDiagnostic.origin, loadDiagnostic.compatibility?.handshake?.capabilities);
+        process.env.NAPI_RS_NATIVE_LIBRARY_PATH !== undefined, process.env.DISABLE_NATIVE_CORE === '1', keychainNative, loadDiagnostic.origin, loadDiagnostic.compatibility?.handshake?.capabilities, loadDiagnostic.compatibility);
 }
 // TypeScript fallbacks -------------------------------------------------------
 // These keep the surface area working when the native binary is unavailable

package/dist/engine/macos-keychain-native-port.d.ts

@@ -1,10 +1,10 @@
-import type { PlanuCore } from '../types/core-bridge.js';
+import type { NativeRuntimeCompatibility, PlanuCore } from '../types/core-bridge.js';
 import type { MacOSKeychainNativePort } from '../types/security.js';
 export declare class ValidationReceiptSignerUnavailableError extends Error {
-    readonly reason: 'PLATFORM_UNSUPPORTED' | 'NATIVE_DISABLED' | 'ARTIFACT_MISSING' | 'NONCANONICAL_ORIGIN' | 'CAPABILITY_MISSING' | 'PORT_INCOMPLETE' | 'OVERRIDE_REJECTED' | 'PROVIDER_NONCANONICAL' | 'PROVIDER_UNAVAILABLE';
+    readonly reason: 'PLATFORM_UNSUPPORTED' | 'NATIVE_DISABLED' | 'ARTIFACT_MISSING' | 'STALE_ARTIFACT' | 'NONCANONICAL_ORIGIN' | 'CAPABILITY_MISSING' | 'PORT_INCOMPLETE' | 'OVERRIDE_REJECTED' | 'PROVIDER_NONCANONICAL' | 'PROVIDER_UNAVAILABLE';
     readonly code: 'VALIDATION_RECEIPT_SIGNER_UNAVAILABLE';
-    constructor(reason: 'PLATFORM_UNSUPPORTED' | 'NATIVE_DISABLED' | 'ARTIFACT_MISSING' | 'NONCANONICAL_ORIGIN' | 'CAPABILITY_MISSING' | 'PORT_INCOMPLETE' | 'OVERRIDE_REJECTED' | 'PROVIDER_NONCANONICAL' | 'PROVIDER_UNAVAILABLE');
+    constructor(reason: 'PLATFORM_UNSUPPORTED' | 'NATIVE_DISABLED' | 'ARTIFACT_MISSING' | 'STALE_ARTIFACT' | 'NONCANONICAL_ORIGIN' | 'CAPABILITY_MISSING' | 'PORT_INCOMPLETE' | 'OVERRIDE_REJECTED' | 'PROVIDER_NONCANONICAL' | 'PROVIDER_UNAVAILABLE', remediation?: string);
 }
 /** Build the privileged main-thread port only from a canonical, verified native module. */
-export declare function createMacOSKeychainNativePort(platform: NodeJS.Platform, overrideDefined: boolean, disabled: boolean, nativeModule: PlanuCore | null, origin: 'override' | 'local' | 'package' | undefined, capabilities: readonly string[] | undefined): MacOSKeychainNativePort;
+export declare function createMacOSKeychainNativePort(platform: NodeJS.Platform, overrideDefined: boolean, disabled: boolean, nativeModule: PlanuCore | null, origin: 'override' | 'local' | 'package' | undefined, capabilities: readonly string[] | undefined, compatibility?: NativeRuntimeCompatibility): MacOSKeychainNativePort;
 //# sourceMappingURL=macos-keychain-native-port.d.ts.map

package/dist/engine/macos-keychain-native-port.js

@@ -1,14 +1,36 @@
+import { PLANU_VERSION } from '../config/version.js';
+const DEFAULT_REMEDIATION = 'Restart the MCP host and retry.';
+/** Recover the native target triple from a buildId shaped `<epoch>-<engineVersion>-<triple>`. */
+function deriveNativeTargetTriple(buildId, engineVersion) {
+    const separator = `-${engineVersion}-`;
+    const index = buildId.indexOf(separator);
+    if (index === -1) {
+        return null;
+    }
+    const triple = buildId.slice(index + separator.length);
+    return triple.length > 0 ? triple : null;
+}
+function staleArtifactRemediation(artifactVersion, buildId) {
+    const triple = buildId ? deriveNativeTargetTriple(buildId, artifactVersion) : null;
+    if (!triple) {
+        return (`Native artifact reports engineVersion ${artifactVersion}, expected ${PLANU_VERSION}. ` +
+            'Could not determine the native target triple from the artifact build id; run: ' +
+            'bash scripts/build-rust-local.sh --host after manually removing the stale native artifact for your platform.');
+    }
+    return (`Native artifact reports engineVersion ${artifactVersion}, expected ${PLANU_VERSION}. Run: ` +
+        `cargo clean -p planu-core --release --target ${triple} --manifest-path rust/planu-core/Cargo.toml && bash scripts/build-rust-local.sh --host`);
+}
 export class ValidationReceiptSignerUnavailableError extends Error {
     reason;
     code = 'VALIDATION_RECEIPT_SIGNER_UNAVAILABLE';
-    constructor(reason) {
-        super(`[Planu] VALIDATION_RECEIPT_SIGNER_UNAVAILABLE:${reason} Restart the MCP host and retry.`);
+    constructor(reason, remediation = DEFAULT_REMEDIATION) {
+        super(`[Planu] VALIDATION_RECEIPT_SIGNER_UNAVAILABLE:${reason} ${remediation}`);
         this.reason = reason;
         this.name = 'ValidationReceiptSignerUnavailableError';
     }
 }
 /** Build the privileged main-thread port only from a canonical, verified native module. */
-export function createMacOSKeychainNativePort(platform, overrideDefined, disabled, nativeModule, origin, capabilities) {
+export function createMacOSKeychainNativePort(platform, overrideDefined, disabled, nativeModule, origin, capabilities, compatibility) {
     if (platform !== 'darwin') {
         throw new ValidationReceiptSignerUnavailableError('PLATFORM_UNSUPPORTED');
     }
@@ -19,6 +41,10 @@ export function createMacOSKeychainNativePort(platform, overrideDefined, disable
         throw new ValidationReceiptSignerUnavailableError('NATIVE_DISABLED');
     }
     if (!nativeModule) {
+        if (compatibility && !compatibility.compatible) {
+            const artifactVersion = compatibility.handshake?.engineVersion ?? 'unknown';
+            throw new ValidationReceiptSignerUnavailableError('STALE_ARTIFACT', staleArtifactRemediation(artifactVersion, compatibility.handshake?.buildId));
+        }
         throw new ValidationReceiptSignerUnavailableError('ARTIFACT_MISSING');
     }
     if (origin !== 'local' && origin !== 'package') {

package/dist/engine/planu-core.darwin-arm64.node.manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
-  "cliVersion": "5.3.18",
-  "engineVersion": "5.3.18",
-  "buildId": "1-5.3.18-aarch64-apple-darwin",
+  "cliVersion": "5.3.20",
+  "engineVersion": "5.3.20",
+  "buildId": "1-5.3.20-aarch64-apple-darwin",
   "protocolAbi": 1,
   "capabilityAbi": 2,
   "nodeApiAbi": 4,
@@ -17,15 +17,15 @@
   "platform": "darwin",
   "arch": "arm64",
   "libc": null,
-  "artifactSha256": "5fed530a8afc4fe8dca40839db0eae5d27430c21291c7b4152204a67f69a0f07",
+  "artifactSha256": "e55efda88d366c03c6dedb2c606e5e085f9cb7b4b41950d0a59de891ca8e6e3e",
   "sbom": {
     "format": "CycloneDX-1.5",
     "path": "planu-core.darwin-arm64.node.sbom.json",
-    "sha256": "1667d84a334ea1d0a77aaa2a52fe09e4bddabae03012da6b8a60c36719a50eaf"
+    "sha256": "c6865313d06acb32d6999c0b56796fbb7f36a6160c9a7f42ad2c9c25e354cfda"
   },
   "provenance": {
     "builder": "scripts/build-rust-local.sh",
-    "sourceCommit": "3c1b6c73402a7d249e53f8805fe8429de38e43ac",
+    "sourceCommit": "b17b7f7133a1b83eacb1140de5138aa89c00f267",
     "sourceTreeDirty": false,
     "sourceDateEpoch": 1,
     "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -34,6 +34,6 @@
   "signature": {
     "algorithm": "Ed25519",
     "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
-    "value": "CK7fkEl65ZldoIdkXqxFNABEHNghZ2zt/7aIcmmwP2LiwhuYvYL8H4OHFM6aeojGqpgXoia4MXuC12WcACR3Dw=="
+    "value": "RUWNdjH6OhhIcCfdfPKR4jrxVbIgSynmnWCV8TAUP8OjP61pcXYBJ3Atoi3dFUbFKe5K5/PdXp0YR+2ypHmoDw=="
   }
 }

package/dist/engine/planu-core.darwin-arm64.node.sbom.json

@@ -4,14 +4,14 @@
   "version": 1,
   "metadata": {
     "component": {
-      "bom-ref": "pkg:cargo/planu-core@5.3.18",
+      "bom-ref": "pkg:cargo/planu-core@5.3.20",
       "type": "library",
       "name": "planu-core",
-      "version": "5.3.18",
+      "version": "5.3.20",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "5fed530a8afc4fe8dca40839db0eae5d27430c21291c7b4152204a67f69a0f07"
+          "content": "e55efda88d366c03c6dedb2c606e5e085f9cb7b4b41950d0a59de891ca8e6e3e"
         }
       ]
     }
@@ -1106,7 +1106,7 @@
       "dependsOn": []
     },
     {
-      "ref": "pkg:cargo/planu-core@5.3.18",
+      "ref": "pkg:cargo/planu-core@5.3.20",
       "dependsOn": [
         "pkg:cargo/core-foundation@0.10.1",
         "pkg:cargo/hmac@0.12.1",

package/dist/engine/planu-core.darwin-x64.node.manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
-  "cliVersion": "5.3.18",
-  "engineVersion": "5.3.18",
-  "buildId": "1-5.3.18-x86_64-apple-darwin",
+  "cliVersion": "5.3.20",
+  "engineVersion": "5.3.20",
+  "buildId": "1-5.3.20-x86_64-apple-darwin",
   "protocolAbi": 1,
   "capabilityAbi": 2,
   "nodeApiAbi": 4,
@@ -17,15 +17,15 @@
   "platform": "darwin",
   "arch": "x64",
   "libc": null,
-  "artifactSha256": "8287182c1b0be484146f92ee90db5423295e1bd00b8384660de534dc6e29c49d",
+  "artifactSha256": "f5b0bc55a024310b90e4273fee8302401e2ec83006a4410c95dadf087262ef87",
   "sbom": {
     "format": "CycloneDX-1.5",
     "path": "planu-core.darwin-x64.node.sbom.json",
-    "sha256": "9514dae23ab932c585e3fec8df947fc144d8f815b2680f2be34291ce97a07f07"
+    "sha256": "eed96de149c1340631b052fe4561bd8a768e39ae29ffca54d715183c2e4756da"
   },
   "provenance": {
     "builder": "scripts/build-rust-local.sh",
-    "sourceCommit": "3c1b6c73402a7d249e53f8805fe8429de38e43ac",
+    "sourceCommit": "b17b7f7133a1b83eacb1140de5138aa89c00f267",
     "sourceTreeDirty": false,
     "sourceDateEpoch": 1,
     "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -34,6 +34,6 @@
   "signature": {
     "algorithm": "Ed25519",
     "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
-    "value": "jxjKFUe/Z6Rnmk97m9rMwg8b0I7zQwOWmovYV50P0M0EAjQkaId91vUI76QQaY4DM1NeUgsnqvzj4UtUQrdZAQ=="
+    "value": "47S1SX1cvHc/E2jHlD7Mhagd3CiGdWbCdLiJmCFsCqP9yEWYBCkgw/jZoT3qUgTmExse+Hvzx8LDBc9fZl3RAA=="
   }
 }

package/dist/engine/planu-core.darwin-x64.node.sbom.json

@@ -4,14 +4,14 @@
   "version": 1,
   "metadata": {
     "component": {
-      "bom-ref": "pkg:cargo/planu-core@5.3.18",
+      "bom-ref": "pkg:cargo/planu-core@5.3.20",
       "type": "library",
       "name": "planu-core",
-      "version": "5.3.18",
+      "version": "5.3.20",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "8287182c1b0be484146f92ee90db5423295e1bd00b8384660de534dc6e29c49d"
+          "content": "f5b0bc55a024310b90e4273fee8302401e2ec83006a4410c95dadf087262ef87"
         }
       ]
     }
@@ -1106,7 +1106,7 @@
       "dependsOn": []
     },
     {
-      "ref": "pkg:cargo/planu-core@5.3.18",
+      "ref": "pkg:cargo/planu-core@5.3.20",
       "dependsOn": [
         "pkg:cargo/core-foundation@0.10.1",
         "pkg:cargo/hmac@0.12.1",

package/dist/engine/planu-core.linux-arm64-gnu.node.manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
-  "cliVersion": "5.3.18",
-  "engineVersion": "5.3.18",
-  "buildId": "1-5.3.18-aarch64-unknown-linux-gnu",
+  "cliVersion": "5.3.20",
+  "engineVersion": "5.3.20",
+  "buildId": "1-5.3.20-aarch64-unknown-linux-gnu",
   "protocolAbi": 1,
   "capabilityAbi": 2,
   "nodeApiAbi": 4,
@@ -16,15 +16,15 @@
   "platform": "linux",
   "arch": "arm64",
   "libc": "glibc",
-  "artifactSha256": "2fe96f2baf1f4b811d038cb004bdb59436f6bb18c38cbc0936adf2f3d776f1e0",
+  "artifactSha256": "2ea9228381585e0867fa1744ce15a50a1406217925c18d61ca86ef46045ab341",
   "sbom": {
     "format": "CycloneDX-1.5",
     "path": "planu-core.linux-arm64-gnu.node.sbom.json",
-    "sha256": "aaa7a6dc91c4720a456807fc76edc5293e01bb328d4830866500b197661b00c3"
+    "sha256": "8dfab3a92f1a20f69d26ab5bcd73cd218b622a82ed02c7bc6cc9c800937b9696"
   },
   "provenance": {
     "builder": "scripts/build-rust-local.sh",
-    "sourceCommit": "3c1b6c73402a7d249e53f8805fe8429de38e43ac",
+    "sourceCommit": "b17b7f7133a1b83eacb1140de5138aa89c00f267",
     "sourceTreeDirty": false,
     "sourceDateEpoch": 1,
     "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -33,6 +33,6 @@
   "signature": {
     "algorithm": "Ed25519",
     "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
-    "value": "OZu14HADvXX9A0jSQYjeOqU0dI4MczkRXSHbUfGrKKOY/pLLJkfBDsnsLbs5XgSp/V1oSQQDQ0rsDOCRl2WhBg=="
+    "value": "yOcMzbe+aaTbIFqSbUKv5azScjk4Fs/e2th78DhaQdP287O5UOsGxxhv5w54gmwB//Lm6tXdzgbWK77g37SbAg=="
   }
 }

package/dist/engine/planu-core.linux-arm64-gnu.node.sbom.json

@@ -4,14 +4,14 @@
   "version": 1,
   "metadata": {
     "component": {
-      "bom-ref": "pkg:cargo/planu-core@5.3.18",
+      "bom-ref": "pkg:cargo/planu-core@5.3.20",
       "type": "library",
       "name": "planu-core",
-      "version": "5.3.18",
+      "version": "5.3.20",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "2fe96f2baf1f4b811d038cb004bdb59436f6bb18c38cbc0936adf2f3d776f1e0"
+          "content": "2ea9228381585e0867fa1744ce15a50a1406217925c18d61ca86ef46045ab341"
         }
       ]
     }
@@ -1106,7 +1106,7 @@
       "dependsOn": []
     },
     {
-      "ref": "pkg:cargo/planu-core@5.3.18",
+      "ref": "pkg:cargo/planu-core@5.3.20",
       "dependsOn": [
         "pkg:cargo/core-foundation@0.10.1",
         "pkg:cargo/hmac@0.12.1",

package/dist/engine/planu-core.linux-arm64-musl.node.manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
-  "cliVersion": "5.3.18",
-  "engineVersion": "5.3.18",
-  "buildId": "1-5.3.18-aarch64-unknown-linux-musl",
+  "cliVersion": "5.3.20",
+  "engineVersion": "5.3.20",
+  "buildId": "1-5.3.20-aarch64-unknown-linux-musl",
   "protocolAbi": 1,
   "capabilityAbi": 2,
   "nodeApiAbi": 4,
@@ -16,15 +16,15 @@
   "platform": "linux",
   "arch": "arm64",
   "libc": "musl",
-  "artifactSha256": "5749d44caef4716e9def75bb6d9bf630d6a14bbf2f1630d483036b9a0f7fb244",
+  "artifactSha256": "820652ed60481ecf6291c64f2a2720d52410bd06b27268b24881e95f45ac4fb5",
   "sbom": {
     "format": "CycloneDX-1.5",
     "path": "planu-core.linux-arm64-musl.node.sbom.json",
-    "sha256": "206a3e0d16affa390afee3880296b9822d98f31dbd9f2d02e560b14419ecb41c"
+    "sha256": "709feb9088507693ac37ea745921e1f93ff3e1d342fb376ba3f7bb7e900d7799"
   },
   "provenance": {
     "builder": "scripts/build-rust-local.sh",
-    "sourceCommit": "3c1b6c73402a7d249e53f8805fe8429de38e43ac",
+    "sourceCommit": "b17b7f7133a1b83eacb1140de5138aa89c00f267",
     "sourceTreeDirty": false,
     "sourceDateEpoch": 1,
     "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -33,6 +33,6 @@
   "signature": {
     "algorithm": "Ed25519",
     "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
-    "value": "cJ2vBlGhEl/fnE+iYdmGff9ghJujeqt77VGbZZJeQWfyB3YcZdf298M9REEQfr7QgQeExyjJHE3l9AExHo3aAg=="
+    "value": "Clj0B7s1KmADZoERbK4C9DcJX3Y7B4572h/Key3t6oDNEdqIbaff4XJ47TIBTuDW1RICr5myVcQJQlOL1m+oDA=="
   }
 }

package/dist/engine/planu-core.linux-arm64-musl.node.sbom.json

@@ -4,14 +4,14 @@
   "version": 1,
   "metadata": {
     "component": {
-      "bom-ref": "pkg:cargo/planu-core@5.3.18",
+      "bom-ref": "pkg:cargo/planu-core@5.3.20",
       "type": "library",
       "name": "planu-core",
-      "version": "5.3.18",
+      "version": "5.3.20",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "5749d44caef4716e9def75bb6d9bf630d6a14bbf2f1630d483036b9a0f7fb244"
+          "content": "820652ed60481ecf6291c64f2a2720d52410bd06b27268b24881e95f45ac4fb5"
         }
       ]
     }
@@ -1106,7 +1106,7 @@
       "dependsOn": []
     },
     {
-      "ref": "pkg:cargo/planu-core@5.3.18",
+      "ref": "pkg:cargo/planu-core@5.3.20",
       "dependsOn": [
         "pkg:cargo/core-foundation@0.10.1",
         "pkg:cargo/hmac@0.12.1",

package/dist/engine/planu-core.linux-x64-gnu.node.manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
-  "cliVersion": "5.3.18",
-  "engineVersion": "5.3.18",
-  "buildId": "1-5.3.18-x86_64-unknown-linux-gnu",
+  "cliVersion": "5.3.20",
+  "engineVersion": "5.3.20",
+  "buildId": "1-5.3.20-x86_64-unknown-linux-gnu",
   "protocolAbi": 1,
   "capabilityAbi": 2,
   "nodeApiAbi": 4,
@@ -16,15 +16,15 @@
   "platform": "linux",
   "arch": "x64",
   "libc": "glibc",
-  "artifactSha256": "ddcf0b909005c6dd5b5833ca2380979f50b11a081b883e449ce044476ef4da90",
+  "artifactSha256": "480558ee13c36ac1382a265cb156eb9f966ded72e144a209052e7098ee61af47",
   "sbom": {
     "format": "CycloneDX-1.5",
     "path": "planu-core.linux-x64-gnu.node.sbom.json",
-    "sha256": "26c6d0f0dd9558bd863fb3bcdc092cb8821ae6635495503d1ca513595a830ed6"
+    "sha256": "4ad75195c8a05b860c309208c7ad45361c0eea7cc107d85500805e93ce04e687"
   },
   "provenance": {
     "builder": "scripts/build-rust-local.sh",
-    "sourceCommit": "3c1b6c73402a7d249e53f8805fe8429de38e43ac",
+    "sourceCommit": "b17b7f7133a1b83eacb1140de5138aa89c00f267",
     "sourceTreeDirty": false,
     "sourceDateEpoch": 1,
     "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -33,6 +33,6 @@
   "signature": {
     "algorithm": "Ed25519",
     "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
-    "value": "DHqxCc8X0fG9/Obugix+X+KLWWAxiVaw//r9ba1EgVA+kaE2C4nQbFGp+qcYa+XDcjmfHRJudQrf0dTwXI4QCg=="
+    "value": "j6srf3XwnCHHrmF00S8IerExJd/Pov1K9oInF/jL/PkhGnknti6GYgm73GxfryUBK5FrsT7nTWXqXrmY2GHQDw=="
   }
 }

package/dist/engine/planu-core.linux-x64-gnu.node.sbom.json

@@ -4,14 +4,14 @@
   "version": 1,
   "metadata": {
     "component": {
-      "bom-ref": "pkg:cargo/planu-core@5.3.18",
+      "bom-ref": "pkg:cargo/planu-core@5.3.20",
       "type": "library",
       "name": "planu-core",
-      "version": "5.3.18",
+      "version": "5.3.20",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "ddcf0b909005c6dd5b5833ca2380979f50b11a081b883e449ce044476ef4da90"
+          "content": "480558ee13c36ac1382a265cb156eb9f966ded72e144a209052e7098ee61af47"
         }
       ]
     }
@@ -1106,7 +1106,7 @@
       "dependsOn": []
     },
     {
-      "ref": "pkg:cargo/planu-core@5.3.18",
+      "ref": "pkg:cargo/planu-core@5.3.20",
       "dependsOn": [
         "pkg:cargo/core-foundation@0.10.1",
         "pkg:cargo/hmac@0.12.1",

package/dist/engine/planu-core.linux-x64-musl.node.manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
-  "cliVersion": "5.3.18",
-  "engineVersion": "5.3.18",
-  "buildId": "1-5.3.18-x86_64-unknown-linux-musl",
+  "cliVersion": "5.3.20",
+  "engineVersion": "5.3.20",
+  "buildId": "1-5.3.20-x86_64-unknown-linux-musl",
   "protocolAbi": 1,
   "capabilityAbi": 2,
   "nodeApiAbi": 4,
@@ -16,15 +16,15 @@
   "platform": "linux",
   "arch": "x64",
   "libc": "musl",
-  "artifactSha256": "7d251de39b960c7bcdbfd2770c7a778bdb8fe532a45def6206a5ac4ba349bf89",
+  "artifactSha256": "4d49cab5c5a4acd877e594cab33c0aa0c2a1e3cc153598d500491c7980415d8e",
   "sbom": {
     "format": "CycloneDX-1.5",
     "path": "planu-core.linux-x64-musl.node.sbom.json",
-    "sha256": "c826c2dabe78e17d3e83788eb69548ff0f06a0c29c1a95d215956562fd63e0ab"
+    "sha256": "0df31770a702f024c54991719dc402e0c581652cac146a389fb03d1322d40456"
   },
   "provenance": {
     "builder": "scripts/build-rust-local.sh",
-    "sourceCommit": "3c1b6c73402a7d249e53f8805fe8429de38e43ac",
+    "sourceCommit": "b17b7f7133a1b83eacb1140de5138aa89c00f267",
     "sourceTreeDirty": false,
     "sourceDateEpoch": 1,
     "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -33,6 +33,6 @@
   "signature": {
     "algorithm": "Ed25519",
     "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
-    "value": "W8mvPSxXSz7L0Ce0N+xQeeqMy0Nx87dcW53m1QmdR7dqSo2S5MsB26XVHn/Yn/QmD4bP2vjEdG1RAYVgh4XgCQ=="
+    "value": "KYrdMvuUvSOezgBWK84rqhv4NstKjCq4f0iEoe2E6h3iV2e2uDhXT5WQyXeeV+9/fNKLKfTcSkepeSW1347YDg=="
   }
 }

package/dist/engine/planu-core.linux-x64-musl.node.sbom.json

@@ -4,14 +4,14 @@
   "version": 1,
   "metadata": {
     "component": {
-      "bom-ref": "pkg:cargo/planu-core@5.3.18",
+      "bom-ref": "pkg:cargo/planu-core@5.3.20",
       "type": "library",
       "name": "planu-core",
-      "version": "5.3.18",
+      "version": "5.3.20",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "7d251de39b960c7bcdbfd2770c7a778bdb8fe532a45def6206a5ac4ba349bf89"
+          "content": "4d49cab5c5a4acd877e594cab33c0aa0c2a1e3cc153598d500491c7980415d8e"
         }
       ]
     }
@@ -1106,7 +1106,7 @@
       "dependsOn": []
     },
     {
-      "ref": "pkg:cargo/planu-core@5.3.18",
+      "ref": "pkg:cargo/planu-core@5.3.20",
       "dependsOn": [
         "pkg:cargo/core-foundation@0.10.1",
         "pkg:cargo/hmac@0.12.1",

package/dist/engine/planu-core.win32-arm64-msvc.node.manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
-  "cliVersion": "5.3.18",
-  "engineVersion": "5.3.18",
-  "buildId": "1-5.3.18-aarch64-pc-windows-msvc",
+  "cliVersion": "5.3.20",
+  "engineVersion": "5.3.20",
+  "buildId": "1-5.3.20-aarch64-pc-windows-msvc",
   "protocolAbi": 1,
   "capabilityAbi": 2,
   "nodeApiAbi": 4,
@@ -16,15 +16,15 @@
   "platform": "win32",
   "arch": "arm64",
   "libc": null,
-  "artifactSha256": "43386818ebe7d5acac484fa8e4a38a8508b7b2baa17b421d1720a5133ae25022",
+  "artifactSha256": "af8d4bc6ff629838c2dc4ec1585fddb34ff746c7a655d17f330d1f948a9f88fa",
   "sbom": {
     "format": "CycloneDX-1.5",
     "path": "planu-core.win32-arm64-msvc.node.sbom.json",
-    "sha256": "b4571ec45d947374617a7f4315c1be522111e9ad49f63023febdef3d4c6e3fb1"
+    "sha256": "cb68d92f6c73d1a1761d6bf3dca51cd2d7ed4c777eaf21bbabaa10bd860c5bb1"
   },
   "provenance": {
     "builder": "scripts/build-rust-local.sh",
-    "sourceCommit": "3c1b6c73402a7d249e53f8805fe8429de38e43ac",
+    "sourceCommit": "b17b7f7133a1b83eacb1140de5138aa89c00f267",
     "sourceTreeDirty": false,
     "sourceDateEpoch": 1,
     "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -33,6 +33,6 @@
   "signature": {
     "algorithm": "Ed25519",
     "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
-    "value": "kWkreQpknVVatNtjxmRVdggvQnemK2iIIrcHwZqwISsdPfmnXLHv+X0LmJlpOs1rqXh85FIAJmm2Z6Dz+9YkAw=="
+    "value": "Es/39B5KADPs6wEf4GX2YjN5WA+nqJzGHtltz8VoVS6dsSJKFVKX3RfHiVSldTAv7Lw1k+A+MfmVbarQX3yYBA=="
   }
 }

package/dist/engine/planu-core.win32-arm64-msvc.node.sbom.json

@@ -4,14 +4,14 @@
   "version": 1,
   "metadata": {
     "component": {
-      "bom-ref": "pkg:cargo/planu-core@5.3.18",
+      "bom-ref": "pkg:cargo/planu-core@5.3.20",
       "type": "library",
       "name": "planu-core",
-      "version": "5.3.18",
+      "version": "5.3.20",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "43386818ebe7d5acac484fa8e4a38a8508b7b2baa17b421d1720a5133ae25022"
+          "content": "af8d4bc6ff629838c2dc4ec1585fddb34ff746c7a655d17f330d1f948a9f88fa"
         }
       ]
     }
@@ -1106,7 +1106,7 @@
       "dependsOn": []
     },
     {
-      "ref": "pkg:cargo/planu-core@5.3.18",
+      "ref": "pkg:cargo/planu-core@5.3.20",
       "dependsOn": [
         "pkg:cargo/core-foundation@0.10.1",
         "pkg:cargo/hmac@0.12.1",

package/dist/engine/planu-core.win32-x64-msvc.node.manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
-  "cliVersion": "5.3.18",
-  "engineVersion": "5.3.18",
-  "buildId": "1-5.3.18-x86_64-pc-windows-msvc",
+  "cliVersion": "5.3.20",
+  "engineVersion": "5.3.20",
+  "buildId": "1-5.3.20-x86_64-pc-windows-msvc",
   "protocolAbi": 1,
   "capabilityAbi": 2,
   "nodeApiAbi": 4,
@@ -16,15 +16,15 @@
   "platform": "win32",
   "arch": "x64",
   "libc": null,
-  "artifactSha256": "017329ba941530655f52d8bfda224dc64da19fd998af72a4047e4f8837116b81",
+  "artifactSha256": "662110578e520cfda4c20f3e99b3ae02f12b62fe4af3df0ddca993137144ec4c",
   "sbom": {
     "format": "CycloneDX-1.5",
     "path": "planu-core.win32-x64-msvc.node.sbom.json",
-    "sha256": "5f6b8d9d3df9dac089f07f3e96c6e8c3d456db7f23fba6f051bea23bdb463e20"
+    "sha256": "2a840b84b97ba7dcce0240fb82033dd2a88d4d9db4698ac7a0e75802f0093154"
   },
   "provenance": {
     "builder": "scripts/build-rust-local.sh",
-    "sourceCommit": "3c1b6c73402a7d249e53f8805fe8429de38e43ac",
+    "sourceCommit": "b17b7f7133a1b83eacb1140de5138aa89c00f267",
     "sourceTreeDirty": false,
     "sourceDateEpoch": 1,
     "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -33,6 +33,6 @@
   "signature": {
     "algorithm": "Ed25519",
     "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
-    "value": "n05uJoOniOELxpoTVp25r7wDI1U+Z2hu6VI9mkxXLvBFGcPhWeoGJ1W+igcNkEiOA26Ihn88fGsT04ALFHntCQ=="
+    "value": "RzsxC6qOLporNXgL8gFU0tSNJPRYuKZE4N5Afi7vixhyzHtW5e96Afpv608/uvuEaPXiFBwbQPSVa7Ev9jlDAg=="
   }
 }

package/dist/engine/planu-core.win32-x64-msvc.node.sbom.json

@@ -4,14 +4,14 @@
   "version": 1,
   "metadata": {
     "component": {
-      "bom-ref": "pkg:cargo/planu-core@5.3.18",
+      "bom-ref": "pkg:cargo/planu-core@5.3.20",
       "type": "library",
       "name": "planu-core",
-      "version": "5.3.18",
+      "version": "5.3.20",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "017329ba941530655f52d8bfda224dc64da19fd998af72a4047e4f8837116b81"
+          "content": "662110578e520cfda4c20f3e99b3ae02f12b62fe4af3df0ddca993137144ec4c"
         }
       ]
     }
@@ -1106,7 +1106,7 @@
       "dependsOn": []
     },
     {
-      "ref": "pkg:cargo/planu-core@5.3.18",
+      "ref": "pkg:cargo/planu-core@5.3.20",
       "dependsOn": [
         "pkg:cargo/core-foundation@0.10.1",
         "pkg:cargo/hmac@0.12.1",

package/dist/tools/check-readiness.js

@@ -8,6 +8,13 @@ const MAX_VISIBLE_BLOCKERS = 8;
 const MAX_VISIBLE_WARNINGS = 8;
 const MAX_VISIBLE_RECOMMENDATIONS = 5;
 const CANONICAL_CRITERIA_MISSING = 'CANONICAL_CRITERIA_MISSING';
+const OUT_OF_SCOPE_SECTION_PATH = 'body.out_of_scope';
+const SPEC_PATH_FIELD = 'specPath';
+function scopeBoundariesUnverified(validationResult) {
+    const specUnreadable = validationResult.errors.some((error) => error.code === 'MISSING_FRONTMATTER' && error.path === SPEC_PATH_FIELD);
+    const outOfScopeSectionAbsent = validationResult.warnings.some((warning) => warning.code === 'OPTIONAL_SECTION_MISSING' && warning.path === OUT_OF_SCOPE_SECTION_PATH);
+    return specUnreadable || outOfScopeSectionAbsent;
+}
 function formatScore(score) {
     if (score >= 90) {
         return `${score}/100 (Excellent)`;
@@ -166,8 +173,7 @@ export async function handleCheckReadiness(args) {
         // canonical validation result as an implementation-ready pass.
         report.ready = false;
     }
-    // SPEC-612: recommend adding outOfScope items when none are declared
-    if (spec.outOfScope === undefined || spec.outOfScope.length === 0) {
+    if (scopeBoundariesUnverified(vr)) {
         report.recommendations.push('Add outOfScope items to the spec frontmatter to declare explicit scope boundaries (SPEC-612). This reduces scope creep during implementation.');
     }
     const qualityScore = vr.qualityReport?.score;

package/dist/tools/validate-lint.js

@@ -110,9 +110,21 @@ export async function runLintCheck(projectPath, lintCommand, context = {}) {
     catch (err) {
         if (isCommandTimeout(err)) {
             const seconds = Math.round(timeoutMs / 1000);
-            const output = `Lint command timed out after ${String(seconds)}s and was skipped so validate can complete within MCP request limits. ` +
-                `Run \`${plan.executedCommand}\` manually before marking the spec done, or set PLANU_VALIDATE_LINT_TIMEOUT_MS for an explicit full lint pass.`;
             console.warn(`[Planu] lintCheck timed out: command="${plan.executedCommand}" cwd="${projectPath}" timeoutMs=${String(timeoutMs)}`);
+            if (context.projectId) {
+                const receipt = readMatchingValidationEvidence(context.projectId, evidenceInput);
+                if (receipt) {
+                    return {
+                        passed: true,
+                        command,
+                        issueCount: 0,
+                        output: `(reused lint evidence ${receipt.key} recorded ${receipt.completedAt} after in-run timeout)`,
+                    };
+                }
+            }
+            const output = `Lint gate failed: lint timed out after ${String(seconds)}s and could not be verified. ` +
+                'Validate reuses recorded lint evidence for an unchanged tree on the next run, so re-running validate after a successful in-process lint pass clears the gate. ' +
+                'PLANU_VALIDATE_LINT_TIMEOUT_MS only applies when the MCP server process is started with it set.';
             if (context.projectId) {
                 recordValidationOutcome({
                     projectId: context.projectId,
@@ -123,8 +135,8 @@ export async function runLintCheck(projectPath, lintCommand, context = {}) {
                     durationMs: timeoutMs,
                     output,
                     reason: context.specId
-                        ? `Lint exceeded its deadline while validating ${context.specId}; the degraded result is non-blocking.`
-                        : 'Lint exceeded its canonical deadline; the degraded result is non-blocking.',
+                        ? `Lint exceeded its deadline while validating ${context.specId}; the gate remains failing until lint evidence exists.`
+                        : 'Lint exceeded its canonical deadline; the gate remains failing until lint evidence exists.',
                     source: 'local:planu-validate',
                 });
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@planu/cli",
-  "version": "5.3.18",
+  "version": "5.3.20",
   "description": "Planu — MCP Server for Spec Driven Development with native Rust acceleration for hot paths. Cross-platform (Linux/macOS/Windows, x64/arm64, glibc/musl).",
   "type": "module",
   "main": "dist/index.js",
@@ -35,14 +35,14 @@
     "packageName": "@planu/core"
   },
   "optionalDependencies": {
-    "@planu/core-darwin-arm64": "5.3.18",
-    "@planu/core-darwin-x64": "5.3.18",
-    "@planu/core-linux-arm64-gnu": "5.3.18",
-    "@planu/core-linux-arm64-musl": "5.3.18",
-    "@planu/core-linux-x64-gnu": "5.3.18",
-    "@planu/core-linux-x64-musl": "5.3.18",
-    "@planu/core-win32-arm64-msvc": "5.3.18",
-    "@planu/core-win32-x64-msvc": "5.3.18"
+    "@planu/core-darwin-arm64": "5.3.20",
+    "@planu/core-darwin-x64": "5.3.20",
+    "@planu/core-linux-arm64-gnu": "5.3.20",
+    "@planu/core-linux-arm64-musl": "5.3.20",
+    "@planu/core-linux-x64-gnu": "5.3.20",
+    "@planu/core-linux-x64-musl": "5.3.20",
+    "@planu/core-win32-arm64-msvc": "5.3.20",
+    "@planu/core-win32-x64-msvc": "5.3.20"
   },
   "engines": {
     "node": ">=24.0.0"

package/planu-native.json

@@ -1,7 +1,7 @@
 {
   "name": "dev.planu.native",
   "displayName": "Planu Native Lightweight Surface",
-  "version": "5.3.18",
+  "version": "5.3.20",
   "packageName": "@planu/cli",
   "modes": {
     "lightweight": {

package/planu-plugin.json

@@ -2,7 +2,7 @@
   "name": "dev.planu.cli",
   "displayName": "Planu — Spec Driven Development",
   "description": "Manage software specs, estimations, and autonomous SDD workflows. Language-agnostic MCP server for Claude Code.",
-  "version": "5.3.18",
+  "version": "5.3.20",
   "icon": "assets/plugin/icon.svg",
   "command": ["npx", "@planu/cli@latest"],
   "packageName": "@planu/cli",