@planu/cli 5.3.22 → 5.3.24

package/CHANGELOG.md

@@ -1,3 +1,27 @@
+## [5.3.24] - 2026-08-18
+
+### Bug Fixes
+- fix(spec-1558): regenerate source-quality receipt bound to the amended release commit
+- fix(spec-1553): declare attachedAt in the published validate output schema
+- fix(spec-1553): name the receipt publication cause instead of one flat string
+- fix(spec-1554): bound the Technical extractor to the section heading level
+- fix(spec-1552): surface the stored rejection reason in done-drift diagnostics
+- fix(spec-1549): resolve out-of-scope items from the spec document, not the cache
+- fix(spec-1525): admit prose file paths outside src/ and tests/ without truncating them
+- fix(spec-1540): scope the native lockfile mask to a version-controlled lockfile
+- fix(spec-1524): bind the source-quality receipt to a mask-normalized tree digest
+
+### Chores
+- chore(spec-1553): close lifecycle with reconciled scope and done evidence
+- chore(spec-1524): close lifecycle with reconciled scope and done evidence
+
+
+## [5.3.23] - 2026-08-13
+
+### Bug Fixes
+- fix(spec-1520): exclude paths whose only mention negates the work from grounded modify targets
+
+
 ## [5.3.22] - 2026-08-13
 
 ### Bug Fixes

package/dist/engine/evidence-index/done-drift.js

@@ -4,6 +4,20 @@ function normalizedChangedFile(value) {
     const normalized = normalizeChangedFilePath(value);
     return normalized.status === 'valid' ? normalized.path : null;
 }
+function withReason(status, reason) {
+    return reason ? `${status}: ${reason}` : status;
+}
+function formatStaleOrInvalidRecord(entry, record) {
+    if (record.kind !== 'changed-file') {
+        return `${entry.criterion}: ${record.value} (${withReason(record.status, record.reason)})`;
+    }
+    const normalized = normalizedChangedFile(record.value);
+    if (!normalized) {
+        return `${entry.criterion}: invalid changed-file (${record.status})`;
+    }
+    const normalizedReason = record.reason?.split(record.value).join(normalized);
+    return `${entry.criterion}: ${normalized} (${withReason(record.status, normalizedReason)})`;
+}
 function buildNeverDriftPaths(ownSpecMdPath) {
     const neverDriftPaths = new Set(PLANU_BOOKKEEPING_FILES);
     const normalizedOwnSpecMdPath = ownSpecMdPath ? normalizedChangedFile(ownSpecMdPath) : null;
@@ -49,15 +63,7 @@ export function checkDoneDriftContract(args) {
     }
     const staleOrInvalid = args.index.criteria.flatMap((entry) => entry.evidence
         .filter((record) => record.status === 'stale' || record.status === 'invalid')
-        .map((record) => {
-        if (record.kind !== 'changed-file') {
-            return `${entry.criterion}: ${record.value} (${record.status})`;
-        }
-        const normalized = normalizedChangedFile(record.value);
-        return normalized
-            ? `${entry.criterion}: ${normalized} (${record.status})`
-            : `${entry.criterion}: invalid changed-file (${record.status})`;
-    }));
+        .map((record) => formatStaleOrInvalidRecord(entry, record)));
     if (staleOrInvalid.length > 0) {
         issues.push({
             code: 'done_drift_stale_evidence',

package/dist/engine/execution/validate-job-executor.js

@@ -22,7 +22,11 @@ import { MacOSKeychainOperationError } from '../../security/adapters/macos-keych
 import { createDurableJobHeartbeat } from './durable-job-heartbeat-runtime.js';
 const WORKSPACE_ID = 'global';
 const activeScopes = new Map();
-const RECEIPT_PENDING_ERROR = '[Planu] VALIDATION_RECEIPT_PENDING action=restart_job';
+const RECEIPT_PUBLICATION_FAILURE_MESSAGES = {
+    keychain_timeout: '[Planu] VALIDATION_RECEIPT_PENDING action=restart_job cause=keychain_timeout: the signing key could not be read from the keychain before the read timed out',
+    publication_deadline_elapsed: '[Planu] VALIDATION_RECEIPT_PENDING action=restart_job cause=publication_deadline_elapsed: the receipt publication deadline elapsed before the receipt was signed',
+    publication_interrupted: '[Planu] VALIDATION_RECEIPT_PENDING action=restart_job cause=publication_interrupted: receipt publication was interrupted after the receipt was signed and persisted; check the provenance files under handoffs/<spec>/*.provenance.json for an already-persisted receiptId before restarting',
+};
 class ReceiptPublicationTimeoutError extends Error {
     constructor() {
         super('[Planu] Receipt publication deadline elapsed');
@@ -43,10 +47,17 @@ class ValidationAuthorityLostError extends Error {
         this.name = 'ValidationAuthorityLostError';
     }
 }
-function recoverableReceiptError(error) {
-    return (error instanceof ReceiptPublicationTimeoutError ||
-        error instanceof ReceiptPublicationInterruptedError ||
-        (error instanceof MacOSKeychainOperationError && error.code === 'KEYCHAIN_TIMEOUT'));
+function classifyReceiptPublicationFailure(error) {
+    if (error instanceof ReceiptPublicationTimeoutError) {
+        return 'publication_deadline_elapsed';
+    }
+    if (error instanceof ReceiptPublicationInterruptedError) {
+        return 'publication_interrupted';
+    }
+    if (error instanceof MacOSKeychainOperationError && error.code === 'KEYCHAIN_TIMEOUT') {
+        return 'keychain_timeout';
+    }
+    return undefined;
 }
 function decodeUtf8Prefix(encoded, prefixLength) {
     try {
@@ -321,13 +332,14 @@ export class ValidateJobExecutor {
             if (current.state === 'cancelled') {
                 return current;
             }
-            if (recoverableReceiptError(error) &&
+            const receiptFailureCause = classifyReceiptPublicationFailure(error);
+            if (receiptFailureCause &&
                 parseValidationReceiptPendingCheckpoint(current.checkpoint, this.receiptCheckpointLimits())) {
                 return this.runtime.fail({
                     ...identity,
                     workerId: this.workerId,
                     fencingToken,
-                    error: RECEIPT_PENDING_ERROR,
+                    error: RECEIPT_PUBLICATION_FAILURE_MESSAGES[receiptFailureCause],
                 });
             }
             if (parseValidationReceiptPendingCheckpoint(current.checkpoint, this.receiptCheckpointLimits())) {
@@ -430,12 +442,13 @@ export class ValidateJobExecutor {
             if (current.state === 'cancelled') {
                 return current;
             }
-            if (recoverableReceiptError(error)) {
+            const receiptFailureCause = classifyReceiptPublicationFailure(error);
+            if (receiptFailureCause) {
                 return this.runtime.fail({
                     ...identity,
                     workerId: this.workerId,
                     fencingToken,
-                    error: RECEIPT_PENDING_ERROR,
+                    error: RECEIPT_PUBLICATION_FAILURE_MESSAGES[receiptFailureCause],
                 });
             }
             this.recordFencedProgress(identity, fencingToken, {

package/dist/engine/planu-core.darwin-arm64.node.manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
-  "cliVersion": "5.3.22",
-  "engineVersion": "5.3.22",
-  "buildId": "1-5.3.22-aarch64-apple-darwin",
+  "cliVersion": "5.3.24",
+  "engineVersion": "5.3.24",
+  "buildId": "1-5.3.24-aarch64-apple-darwin",
   "protocolAbi": 1,
   "capabilityAbi": 2,
   "nodeApiAbi": 4,
@@ -17,15 +17,15 @@
   "platform": "darwin",
   "arch": "arm64",
   "libc": null,
-  "artifactSha256": "4730c8bca1ecd506f9332cfd7754a3b2705272b7cfead67ed8a4a857ea51af47",
+  "artifactSha256": "2df1b275f0d3987ef6fa75a7d46b274c798aece674ff001ab7fb7af169cfc1f3",
   "sbom": {
     "format": "CycloneDX-1.5",
     "path": "planu-core.darwin-arm64.node.sbom.json",
-    "sha256": "379172a509801b9bb9072e03b95da643218c75c02a8cc7e11719193f37f028aa"
+    "sha256": "9899ebee8d32c9b58992bd9a95647e85bd86ac76ee64c34f534f5ce18ec33c2c"
   },
   "provenance": {
     "builder": "scripts/build-rust-local.sh",
-    "sourceCommit": "faabf932259a10c5cabfeedf510c23d686b45e83",
+    "sourceCommit": "888ffb9504055a10ea38d0c31dd0c9881139e88c",
     "sourceTreeDirty": false,
     "sourceDateEpoch": 1,
     "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -34,6 +34,6 @@
   "signature": {
     "algorithm": "Ed25519",
     "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
-    "value": "a6pf9ANIEnE+aYR1QZVf9LJOna7hPvbCmKSUoAYas2JtKtY5HkBvE/9FyN7j3PaG7P8SGXgCPNbAhZ4umyq2Dg=="
+    "value": "0/ir1zotrdZMQ3fKgbpHGoU6fXXo8qZp+Ugs18Oslbxb6vVvRBuj2UoKofDsyPGjx2mHadvTUPX42B/EZd1SAg=="
   }
 }

package/dist/engine/planu-core.darwin-arm64.node.sbom.json

@@ -4,14 +4,14 @@
   "version": 1,
   "metadata": {
     "component": {
-      "bom-ref": "pkg:cargo/planu-core@5.3.22",
+      "bom-ref": "pkg:cargo/planu-core@5.3.24",
       "type": "library",
       "name": "planu-core",
-      "version": "5.3.22",
+      "version": "5.3.24",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "4730c8bca1ecd506f9332cfd7754a3b2705272b7cfead67ed8a4a857ea51af47"
+          "content": "2df1b275f0d3987ef6fa75a7d46b274c798aece674ff001ab7fb7af169cfc1f3"
         }
       ]
     }
@@ -1106,7 +1106,7 @@
       "dependsOn": []
     },
     {
-      "ref": "pkg:cargo/planu-core@5.3.22",
+      "ref": "pkg:cargo/planu-core@5.3.24",
       "dependsOn": [
         "pkg:cargo/core-foundation@0.10.1",
         "pkg:cargo/hmac@0.12.1",

package/dist/engine/planu-core.darwin-x64.node.manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
-  "cliVersion": "5.3.22",
-  "engineVersion": "5.3.22",
-  "buildId": "1-5.3.22-x86_64-apple-darwin",
+  "cliVersion": "5.3.24",
+  "engineVersion": "5.3.24",
+  "buildId": "1-5.3.24-x86_64-apple-darwin",
   "protocolAbi": 1,
   "capabilityAbi": 2,
   "nodeApiAbi": 4,
@@ -17,15 +17,15 @@
   "platform": "darwin",
   "arch": "x64",
   "libc": null,
-  "artifactSha256": "9204816afcda7990a7caa85991ced38335301a2db840a58d7c1017f72ad7fb44",
+  "artifactSha256": "136a1351ca4278942b7c5b0130eb7cdfee35b85b667888d4041bffcd0b213ace",
   "sbom": {
     "format": "CycloneDX-1.5",
     "path": "planu-core.darwin-x64.node.sbom.json",
-    "sha256": "ba853b859c2a9a22ff223d48566f616d05ab8479b3656c8912dd8cbee8617f53"
+    "sha256": "3f8f6cace3e98634bc5fb5b8debb71c45507b890b4aa918437358cf16b55d776"
   },
   "provenance": {
     "builder": "scripts/build-rust-local.sh",
-    "sourceCommit": "faabf932259a10c5cabfeedf510c23d686b45e83",
+    "sourceCommit": "888ffb9504055a10ea38d0c31dd0c9881139e88c",
     "sourceTreeDirty": false,
     "sourceDateEpoch": 1,
     "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -34,6 +34,6 @@
   "signature": {
     "algorithm": "Ed25519",
     "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
-    "value": "n8UTXIAzGoISDWY5vDfDxlQBqP5oso3K37jRE5+kTUnedRmCvVUwPlTedlxMKXI+JWaE/gyq5tOl5V8BNOtXBg=="
+    "value": "Aj0I1f16YmStyyCshvbh7h+leFhLBtGAOv5Jy8lCH5oXVc2RBirqfHNAU/4yQ1vFu3JTl3H5hIaa1Kc1LwQtCg=="
   }
 }

package/dist/engine/planu-core.darwin-x64.node.sbom.json

@@ -4,14 +4,14 @@
   "version": 1,
   "metadata": {
     "component": {
-      "bom-ref": "pkg:cargo/planu-core@5.3.22",
+      "bom-ref": "pkg:cargo/planu-core@5.3.24",
       "type": "library",
       "name": "planu-core",
-      "version": "5.3.22",
+      "version": "5.3.24",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "9204816afcda7990a7caa85991ced38335301a2db840a58d7c1017f72ad7fb44"
+          "content": "136a1351ca4278942b7c5b0130eb7cdfee35b85b667888d4041bffcd0b213ace"
         }
       ]
     }
@@ -1106,7 +1106,7 @@
       "dependsOn": []
     },
     {
-      "ref": "pkg:cargo/planu-core@5.3.22",
+      "ref": "pkg:cargo/planu-core@5.3.24",
       "dependsOn": [
         "pkg:cargo/core-foundation@0.10.1",
         "pkg:cargo/hmac@0.12.1",

package/dist/engine/planu-core.linux-arm64-gnu.node.manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
-  "cliVersion": "5.3.22",
-  "engineVersion": "5.3.22",
-  "buildId": "1-5.3.22-aarch64-unknown-linux-gnu",
+  "cliVersion": "5.3.24",
+  "engineVersion": "5.3.24",
+  "buildId": "1-5.3.24-aarch64-unknown-linux-gnu",
   "protocolAbi": 1,
   "capabilityAbi": 2,
   "nodeApiAbi": 4,
@@ -16,15 +16,15 @@
   "platform": "linux",
   "arch": "arm64",
   "libc": "glibc",
-  "artifactSha256": "acfa6ff4ed2e68598b779cd84eeac69900fd6911893d2ff26414a47304b2ccde",
+  "artifactSha256": "5c16c2a04af25efc03e74eecfacaad43f5835dfb01f0a898f6d2b93efd9a3c33",
   "sbom": {
     "format": "CycloneDX-1.5",
     "path": "planu-core.linux-arm64-gnu.node.sbom.json",
-    "sha256": "cebfe96400b95cf97111e7f04e1992a9c7fbbd4071b44154d33ec10f1d3046ed"
+    "sha256": "48a3812ed288b4801a82bf40f37d02e48e014a90f58f7bc955c2b480749cd44e"
   },
   "provenance": {
     "builder": "scripts/build-rust-local.sh",
-    "sourceCommit": "faabf932259a10c5cabfeedf510c23d686b45e83",
+    "sourceCommit": "888ffb9504055a10ea38d0c31dd0c9881139e88c",
     "sourceTreeDirty": false,
     "sourceDateEpoch": 1,
     "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -33,6 +33,6 @@
   "signature": {
     "algorithm": "Ed25519",
     "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
-    "value": "Xyq0s76WcCzbKEu0nFqrYE0lzt5+UWllzUqcKnpFuXXSJhrvtEyTIW4N37ldPqEeZ4tTsfVAcWooxqpMT8aECA=="
+    "value": "ogNVi4bjUVYnZ3o32PbiLKjRM4FhpcRuLoWSBpHe+vMe/M+oL+aZAX3M86UdTHoxEtUm32rJJPBBXA3CpQzIBQ=="
   }
 }

package/dist/engine/planu-core.linux-arm64-gnu.node.sbom.json

@@ -4,14 +4,14 @@
   "version": 1,
   "metadata": {
     "component": {
-      "bom-ref": "pkg:cargo/planu-core@5.3.22",
+      "bom-ref": "pkg:cargo/planu-core@5.3.24",
       "type": "library",
       "name": "planu-core",
-      "version": "5.3.22",
+      "version": "5.3.24",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "acfa6ff4ed2e68598b779cd84eeac69900fd6911893d2ff26414a47304b2ccde"
+          "content": "5c16c2a04af25efc03e74eecfacaad43f5835dfb01f0a898f6d2b93efd9a3c33"
         }
       ]
     }
@@ -1106,7 +1106,7 @@
       "dependsOn": []
     },
     {
-      "ref": "pkg:cargo/planu-core@5.3.22",
+      "ref": "pkg:cargo/planu-core@5.3.24",
       "dependsOn": [
         "pkg:cargo/core-foundation@0.10.1",
         "pkg:cargo/hmac@0.12.1",

package/dist/engine/planu-core.linux-arm64-musl.node.manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
-  "cliVersion": "5.3.22",
-  "engineVersion": "5.3.22",
-  "buildId": "1-5.3.22-aarch64-unknown-linux-musl",
+  "cliVersion": "5.3.24",
+  "engineVersion": "5.3.24",
+  "buildId": "1-5.3.24-aarch64-unknown-linux-musl",
   "protocolAbi": 1,
   "capabilityAbi": 2,
   "nodeApiAbi": 4,
@@ -16,15 +16,15 @@
   "platform": "linux",
   "arch": "arm64",
   "libc": "musl",
-  "artifactSha256": "b102c6bec361271c98c9940b50a37c2110fd0a4e7c8e96f7b12e904e1162e2a2",
+  "artifactSha256": "8a4cd204fed117c35b4daea2d03d7f36c5ac2309967ed1d0f48e4291c19a705f",
   "sbom": {
     "format": "CycloneDX-1.5",
     "path": "planu-core.linux-arm64-musl.node.sbom.json",
-    "sha256": "6d912c7181d379ae613ffb00e2e70af7beade6da0890b892b801e31ed77074c7"
+    "sha256": "812aeaa48a5c2d31b1b108a005eb47586f8a3cf48de44ee7a43b356d7626a286"
   },
   "provenance": {
     "builder": "scripts/build-rust-local.sh",
-    "sourceCommit": "faabf932259a10c5cabfeedf510c23d686b45e83",
+    "sourceCommit": "888ffb9504055a10ea38d0c31dd0c9881139e88c",
     "sourceTreeDirty": false,
     "sourceDateEpoch": 1,
     "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -33,6 +33,6 @@
   "signature": {
     "algorithm": "Ed25519",
     "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
-    "value": "rdhGtK396/2ZwQtLhz9D+o6VvucindJmLidQT3Yjy+A0dXp8IyT1MJm7g+KzVD6b+SfqWu6HgubuEgGfhyH9CQ=="
+    "value": "3w2XPj4GH8F/UdRBJMNWiOacR+v5h2H/aof6SqdJDADu5S2sGg0IEolD9m7sB3HE/ZgPL7iulY4KPckXGMNnAQ=="
   }
 }

package/dist/engine/planu-core.linux-arm64-musl.node.sbom.json

@@ -4,14 +4,14 @@
   "version": 1,
   "metadata": {
     "component": {
-      "bom-ref": "pkg:cargo/planu-core@5.3.22",
+      "bom-ref": "pkg:cargo/planu-core@5.3.24",
       "type": "library",
       "name": "planu-core",
-      "version": "5.3.22",
+      "version": "5.3.24",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "b102c6bec361271c98c9940b50a37c2110fd0a4e7c8e96f7b12e904e1162e2a2"
+          "content": "8a4cd204fed117c35b4daea2d03d7f36c5ac2309967ed1d0f48e4291c19a705f"
         }
       ]
     }
@@ -1106,7 +1106,7 @@
       "dependsOn": []
     },
     {
-      "ref": "pkg:cargo/planu-core@5.3.22",
+      "ref": "pkg:cargo/planu-core@5.3.24",
       "dependsOn": [
         "pkg:cargo/core-foundation@0.10.1",
         "pkg:cargo/hmac@0.12.1",

package/dist/engine/planu-core.linux-x64-gnu.node.manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
-  "cliVersion": "5.3.22",
-  "engineVersion": "5.3.22",
-  "buildId": "1-5.3.22-x86_64-unknown-linux-gnu",
+  "cliVersion": "5.3.24",
+  "engineVersion": "5.3.24",
+  "buildId": "1-5.3.24-x86_64-unknown-linux-gnu",
   "protocolAbi": 1,
   "capabilityAbi": 2,
   "nodeApiAbi": 4,
@@ -16,15 +16,15 @@
   "platform": "linux",
   "arch": "x64",
   "libc": "glibc",
-  "artifactSha256": "5d2c48ac0de6d60629345143648c78e291a4cba707756face2957f27afb7d36b",
+  "artifactSha256": "a9158723fa6e3e5972ffc03b6115035c1f0dd6be8b109b4ae1f7f5dad54f9062",
   "sbom": {
     "format": "CycloneDX-1.5",
     "path": "planu-core.linux-x64-gnu.node.sbom.json",
-    "sha256": "d6125400832c0bdee2823af553d4e6b717b15cba47133ca88aaf91e2183ef6e1"
+    "sha256": "34a5c6540f4234a5ac3d4b3d1be2ff50e28b294161a4b4190996e28b3defc899"
   },
   "provenance": {
     "builder": "scripts/build-rust-local.sh",
-    "sourceCommit": "faabf932259a10c5cabfeedf510c23d686b45e83",
+    "sourceCommit": "888ffb9504055a10ea38d0c31dd0c9881139e88c",
     "sourceTreeDirty": false,
     "sourceDateEpoch": 1,
     "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -33,6 +33,6 @@
   "signature": {
     "algorithm": "Ed25519",
     "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
-    "value": "Cb1ueFKWd9mC0uzyo/kPIexFGBTxuVsJTk8knsTODmsR2ooH4rG/fqCqN2M1ZCO1kC7Zrpn5LwiifEcbUhUQBw=="
+    "value": "Gz3e+x1vn4R0ppFCaBwO4vQH1RqrV3PvTp7/Zi6V0mu3u6o1GYmo7JrLvlmR4I34IWkfO+cG6Hk/Ls++j7dnBw=="
   }
 }

package/dist/engine/planu-core.linux-x64-gnu.node.sbom.json

@@ -4,14 +4,14 @@
   "version": 1,
   "metadata": {
     "component": {
-      "bom-ref": "pkg:cargo/planu-core@5.3.22",
+      "bom-ref": "pkg:cargo/planu-core@5.3.24",
       "type": "library",
       "name": "planu-core",
-      "version": "5.3.22",
+      "version": "5.3.24",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "5d2c48ac0de6d60629345143648c78e291a4cba707756face2957f27afb7d36b"
+          "content": "a9158723fa6e3e5972ffc03b6115035c1f0dd6be8b109b4ae1f7f5dad54f9062"
         }
       ]
     }
@@ -1106,7 +1106,7 @@
       "dependsOn": []
     },
     {
-      "ref": "pkg:cargo/planu-core@5.3.22",
+      "ref": "pkg:cargo/planu-core@5.3.24",
       "dependsOn": [
         "pkg:cargo/core-foundation@0.10.1",
         "pkg:cargo/hmac@0.12.1",

package/dist/engine/planu-core.linux-x64-musl.node.manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
-  "cliVersion": "5.3.22",
-  "engineVersion": "5.3.22",
-  "buildId": "1-5.3.22-x86_64-unknown-linux-musl",
+  "cliVersion": "5.3.24",
+  "engineVersion": "5.3.24",
+  "buildId": "1-5.3.24-x86_64-unknown-linux-musl",
   "protocolAbi": 1,
   "capabilityAbi": 2,
   "nodeApiAbi": 4,
@@ -16,15 +16,15 @@
   "platform": "linux",
   "arch": "x64",
   "libc": "musl",
-  "artifactSha256": "43926c2400637b9670c3c869da140fedfa85dd786da4de04122c8f5022d3c5cc",
+  "artifactSha256": "165e48d9d7bb68965782b9f690af378cee9651c9c1b9ab31e6b9fa4bedad514a",
   "sbom": {
     "format": "CycloneDX-1.5",
     "path": "planu-core.linux-x64-musl.node.sbom.json",
-    "sha256": "5db161ed910755ad5fe11ebc10d190f81fdf6b69779f21c048819f3be7bcb34e"
+    "sha256": "101e2eca5854d33b36a9570a10e8f4816f43961ad899863110ba4d2596cf89dc"
   },
   "provenance": {
     "builder": "scripts/build-rust-local.sh",
-    "sourceCommit": "faabf932259a10c5cabfeedf510c23d686b45e83",
+    "sourceCommit": "888ffb9504055a10ea38d0c31dd0c9881139e88c",
     "sourceTreeDirty": false,
     "sourceDateEpoch": 1,
     "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -33,6 +33,6 @@
   "signature": {
     "algorithm": "Ed25519",
     "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
-    "value": "0NDYIwRlP6yJ/LWIt3in/B9XD367mRJM0WRoX5H4eERYz4/jtuyKA9yPXUh0sYnnY3roOFctTkbd4eLtFmtqBQ=="
+    "value": "bHo9hflPuXFXSTyWqcxf2rV+OlBmqGvUMOgp4WV7TfKOC1nCUV7Ay/1LJXlgqN/XykbfHC8821FpHWLXQSnJDQ=="
   }
 }

package/dist/engine/planu-core.linux-x64-musl.node.sbom.json

@@ -4,14 +4,14 @@
   "version": 1,
   "metadata": {
     "component": {
-      "bom-ref": "pkg:cargo/planu-core@5.3.22",
+      "bom-ref": "pkg:cargo/planu-core@5.3.24",
       "type": "library",
       "name": "planu-core",
-      "version": "5.3.22",
+      "version": "5.3.24",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "43926c2400637b9670c3c869da140fedfa85dd786da4de04122c8f5022d3c5cc"
+          "content": "165e48d9d7bb68965782b9f690af378cee9651c9c1b9ab31e6b9fa4bedad514a"
         }
       ]
     }
@@ -1106,7 +1106,7 @@
       "dependsOn": []
     },
     {
-      "ref": "pkg:cargo/planu-core@5.3.22",
+      "ref": "pkg:cargo/planu-core@5.3.24",
       "dependsOn": [
         "pkg:cargo/core-foundation@0.10.1",
         "pkg:cargo/hmac@0.12.1",

package/dist/engine/planu-core.win32-arm64-msvc.node.manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
-  "cliVersion": "5.3.22",
-  "engineVersion": "5.3.22",
-  "buildId": "1-5.3.22-aarch64-pc-windows-msvc",
+  "cliVersion": "5.3.24",
+  "engineVersion": "5.3.24",
+  "buildId": "1-5.3.24-aarch64-pc-windows-msvc",
   "protocolAbi": 1,
   "capabilityAbi": 2,
   "nodeApiAbi": 4,
@@ -16,15 +16,15 @@
   "platform": "win32",
   "arch": "arm64",
   "libc": null,
-  "artifactSha256": "2895b0fa8aad3dd46ad59f9b1e8a327dcbbaffe7357ea78830e232a292944920",
+  "artifactSha256": "363abf41c92e4a6d5e4f7cc821185cca9a84fe5fb99006b8e01d16d106bbfa52",
   "sbom": {
     "format": "CycloneDX-1.5",
     "path": "planu-core.win32-arm64-msvc.node.sbom.json",
-    "sha256": "2e14b8772ac8aa9ec07793b8e1db4e72dd23541ed338a1fbe728884082fbe796"
+    "sha256": "5f31abd4a8f741b8a72701f428fa777b41a504c1c095f903bdf54b5ccd93b74e"
   },
   "provenance": {
     "builder": "scripts/build-rust-local.sh",
-    "sourceCommit": "faabf932259a10c5cabfeedf510c23d686b45e83",
+    "sourceCommit": "888ffb9504055a10ea38d0c31dd0c9881139e88c",
     "sourceTreeDirty": false,
     "sourceDateEpoch": 1,
     "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -33,6 +33,6 @@
   "signature": {
     "algorithm": "Ed25519",
     "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
-    "value": "r0Wa9w/3KI0OAHWMTjGqerm90i5pEtHM8VWAKrEb4oqqtxjUQaYhPhKubZfTE4YOdrvn+1RXdoVaU8jMScdSAA=="
+    "value": "Dj6P860+E1Yi4MGQd3lnA6OmAmf5EvL8mZqfiI81OwYH19GQwnKnBUi5vjh64I781B1lyOwUOPjU+jLpJ8lhCQ=="
   }
 }

package/dist/engine/planu-core.win32-arm64-msvc.node.sbom.json

@@ -4,14 +4,14 @@
   "version": 1,
   "metadata": {
     "component": {
-      "bom-ref": "pkg:cargo/planu-core@5.3.22",
+      "bom-ref": "pkg:cargo/planu-core@5.3.24",
       "type": "library",
       "name": "planu-core",
-      "version": "5.3.22",
+      "version": "5.3.24",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "2895b0fa8aad3dd46ad59f9b1e8a327dcbbaffe7357ea78830e232a292944920"
+          "content": "363abf41c92e4a6d5e4f7cc821185cca9a84fe5fb99006b8e01d16d106bbfa52"
         }
       ]
     }
@@ -1106,7 +1106,7 @@
       "dependsOn": []
     },
     {
-      "ref": "pkg:cargo/planu-core@5.3.22",
+      "ref": "pkg:cargo/planu-core@5.3.24",
       "dependsOn": [
         "pkg:cargo/core-foundation@0.10.1",
         "pkg:cargo/hmac@0.12.1",

package/dist/engine/planu-core.win32-x64-msvc.node.manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
-  "cliVersion": "5.3.22",
-  "engineVersion": "5.3.22",
-  "buildId": "1-5.3.22-x86_64-pc-windows-msvc",
+  "cliVersion": "5.3.24",
+  "engineVersion": "5.3.24",
+  "buildId": "1-5.3.24-x86_64-pc-windows-msvc",
   "protocolAbi": 1,
   "capabilityAbi": 2,
   "nodeApiAbi": 4,
@@ -16,15 +16,15 @@
   "platform": "win32",
   "arch": "x64",
   "libc": null,
-  "artifactSha256": "832a639657313dad460661ba34672d01ac1fc5674a655362f7d936e48353c0e5",
+  "artifactSha256": "0b6374ac67d414e13e2e02be6be96a388ed9096f517587f812c533c5fb37992f",
   "sbom": {
     "format": "CycloneDX-1.5",
     "path": "planu-core.win32-x64-msvc.node.sbom.json",
-    "sha256": "2fac480bb810bb3201adc6a82859ace5aeb0b46e62da7cd257fb8089d1ade10f"
+    "sha256": "aaaafe7c267638012a520782ad059014a0641b55005e2a09a5bace53a00d3d3e"
   },
   "provenance": {
     "builder": "scripts/build-rust-local.sh",
-    "sourceCommit": "faabf932259a10c5cabfeedf510c23d686b45e83",
+    "sourceCommit": "888ffb9504055a10ea38d0c31dd0c9881139e88c",
     "sourceTreeDirty": false,
     "sourceDateEpoch": 1,
     "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -33,6 +33,6 @@
   "signature": {
     "algorithm": "Ed25519",
     "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
-    "value": "MudkeMsYJwviSCoe775V8V4/N8d1dgRiQNRBlaGGrozpQb/cavJjNWpL8CoQEVsjX9n1CwjOeTVPu45gDzqqDQ=="
+    "value": "zUMqIwI3WSWZ0QbesWdiZfnIlwAnwkhfwN2Us0lmUCtoKOtQEkqckxNZCY7tuxbzhS091T5LUp7Y+HOUeUViCg=="
   }
 }

package/dist/engine/planu-core.win32-x64-msvc.node.sbom.json

@@ -4,14 +4,14 @@
   "version": 1,
   "metadata": {
     "component": {
-      "bom-ref": "pkg:cargo/planu-core@5.3.22",
+      "bom-ref": "pkg:cargo/planu-core@5.3.24",
       "type": "library",
       "name": "planu-core",
-      "version": "5.3.22",
+      "version": "5.3.24",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "832a639657313dad460661ba34672d01ac1fc5674a655362f7d936e48353c0e5"
+          "content": "0b6374ac67d414e13e2e02be6be96a388ed9096f517587f812c533c5fb37992f"
         }
       ]
     }
@@ -1106,7 +1106,7 @@
       "dependsOn": []
     },
     {
-      "ref": "pkg:cargo/planu-core@5.3.22",
+      "ref": "pkg:cargo/planu-core@5.3.24",
       "dependsOn": [
         "pkg:cargo/core-foundation@0.10.1",
         "pkg:cargo/hmac@0.12.1",

package/dist/engine/readiness-checker.d.ts

@@ -17,6 +17,11 @@ import type { Spec, ReadinessReport } from '../types/index.js';
  * paragraphs inside the AC section are visible to checkSpecificityGate.
  */
 export declare function extractCriteriaLines(huContent: string): string[];
+/**
+ * Extract the content of the `## Technical` section from a spec body.
+ * Returns an empty string when the section is absent.
+ */
+export declare function extractTechnicalSection(body: string): string;
 /**
  * SPEC-784: Returns true when the ## Technical body contains a pointer
  * like "See technical.md" or "See `some-file` spec.md" — a placeholder

package/dist/engine/readiness-checker.js

@@ -205,17 +205,16 @@ function buildRecommendations(score, huPoints, criteriaPoints, filesPoints, deps
  * Extract the content of the `## Technical` section from a spec body.
  * Returns an empty string when the section is absent.
  */
-function extractTechnicalSection(body) {
-    // Match ## Technical (case-insensitive, optional trailing whitespace)
-    const sectionRe = /^#{1,6}\s+technical\b[^\n]*/im;
+export function extractTechnicalSection(body) {
+    const sectionRe = /^(#{1,6})\s+technical\b[^\n]*/im;
     const match = sectionRe.exec(body);
-    if (!match) {
+    const headingHashes = match?.[1];
+    if (!match || !headingHashes) {
         return '';
     }
     const afterHeader = body.slice(match.index + match[0].length);
-    // Content ends at the next same-or-higher heading or end of string
-    const nextHeadingRe = /^#{1,6}\s+/m;
-    const nextMatch = nextHeadingRe.exec(afterHeader);
+    const sameOrHigherHeadingRe = new RegExp(`^#{1,${String(headingHashes.length)}}\\s+`, 'm');
+    const nextMatch = sameOrHigherHeadingRe.exec(afterHeader);
     return nextMatch ? afterHeader.slice(0, nextMatch.index) : afterHeader;
 }
 /**

package/dist/engine/spec-format/technical-md-populator.js

@@ -1,8 +1,8 @@
 // engine/spec-format/technical-md-populator.ts — SPEC-586: Parse spec body to populate ## Technical
 import { stat } from 'node:fs/promises';
-import { join } from 'node:path';
+import { dirname, extname, join } from 'node:path';
 import { findMarkdownSectionRange } from './markdown-sections.js';
-const FILE_PATH_RE = /\b(?:src|tests)\/[a-zA-Z0-9/_.-]+\.[a-z]+\b/g;
+const FILE_PATH_RE = /(?<![\w/.:-])\.?[\w-]+(?:\.[\w-]+)*(?:\/\.?[\w-]+(?:\.[\w-]+)*)+/g;
 function stripFencedBlocks(content) {
     const kept = [];
     let fence = null;
@@ -24,8 +24,8 @@ function stripFencedBlocks(content) {
     }
     return kept.join('\n');
 }
-const SLASH_PATH_BULLET_RE = /^-\s+`?((?:[\w.-]+\/)+[\w-][\w.-]*\.[a-zA-Z][a-zA-Z0-9]*)`?(?=[\s`]|$)/;
-const BARE_FILE_BULLET_RE = /^-\s+`?([\w-][\w.-]*\.[a-zA-Z][a-zA-Z0-9]*)`?\s*$/;
+const SLASH_PATH_BULLET_RE = /^-\s+`?((?:[\w.-]+\/)+[\w-][\w.-]*(?:\.[a-zA-Z][a-zA-Z0-9]*)?)`?(?=[\s`]|$)/;
+const BARE_FILE_BULLET_RE = /^-\s+`?([\w-][\w.-]*\.[a-zA-Z][a-zA-Z0-9]*|[\w-]+)`?\s*$/;
 function extractPathsFromSection(sectionText) {
     const paths = [];
     for (const line of sectionText.split('\n')) {
@@ -81,6 +81,32 @@ async function categorizeByExistence(paths, projectPath) {
     }
     return { create, modify, test };
 }
+function hasLetterInitialExtension(candidate) {
+    return /^[a-zA-Z]/.test(extname(candidate).slice(1));
+}
+async function isExistingFile(path) {
+    try {
+        return (await stat(path)).isFile();
+    }
+    catch {
+        return false;
+    }
+}
+async function isExistingDirectory(path) {
+    try {
+        return (await stat(path)).isDirectory();
+    }
+    catch {
+        return false;
+    }
+}
+async function isAdmissibleProseCandidate(candidate, projectPath) {
+    const full = join(projectPath, candidate);
+    if (await isExistingFile(full)) {
+        return true;
+    }
+    return hasLetterInitialExtension(candidate) && (await isExistingDirectory(dirname(full)));
+}
 /**
  * Attempt to extract file paths from spec body for auto-populating ## Technical.
  * Returns null when no structured file section is found (caller uses placeholder).
@@ -91,9 +117,15 @@ export async function extractFilesFromSpecBody(specBody, projectPath) {
         (structured.create.length > 0 || structured.modify.length > 0 || structured.test.length > 0)) {
         return structured;
     }
-    const allPaths = [
+    const candidates = [
         ...new Set(Array.from(stripFencedBlocks(specBody).matchAll(FILE_PATH_RE), (m) => m[0])),
     ];
+    const allPaths = [];
+    for (const candidate of candidates) {
+        if (await isAdmissibleProseCandidate(candidate, projectPath)) {
+            allPaths.push(candidate);
+        }
+    }
     if (allPaths.length === 0) {
         return null;
     }

package/dist/tools/challenge-spec.js

@@ -1,6 +1,7 @@
 // tools/challenge-spec.ts — Devil's advocate resilience testing (SPEC-595: elicitation added)
 // Analyzes a spec from adversarial perspectives: failure scenarios,
 // concurrency issues, scale limits, security holes, and data consistency.
+import { readFile } from 'node:fs/promises';
 import { specStore, knowledgeStore } from '../storage/index.js';
 // SPEC-1011 Bug F: fallback resolver using disk fingerprints
 import { resolveProjectFromPath } from '../storage/project-resolver.js';
@@ -27,6 +28,69 @@ const ALL_FOCUS_AREAS = [
     'security',
     'data-consistency',
 ];
+function extractOutOfScopeSection(content) {
+    const headingPattern = /^(#{1,6})[ \t]+(.+?)[ \t]*#*[ \t]*$/;
+    const fencePattern = /^[ \t]{0,3}(`{3,}|~{3,})/;
+    let fence = null;
+    let found = false;
+    let capturing = false;
+    const captured = [];
+    for (const line of content.split('\n')) {
+        const fenceMatch = fencePattern.exec(line);
+        if (fenceMatch?.[1]) {
+            const marker = fenceMatch[1].charAt(0);
+            if (fence === null) {
+                fence = { marker, length: fenceMatch[1].length };
+            }
+            else if (fence.marker === marker && fenceMatch[1].length >= fence.length) {
+                fence = null;
+            }
+            if (capturing) {
+                captured.push(line);
+            }
+            continue;
+        }
+        if (fence !== null) {
+            if (capturing) {
+                captured.push(line);
+            }
+            continue;
+        }
+        const heading = headingPattern.exec(line);
+        if (heading?.[1] && heading[2] !== undefined) {
+            if (capturing) {
+                break;
+            }
+            if (!found && heading[2].trim().toLowerCase() === 'out of scope') {
+                found = true;
+                capturing = true;
+            }
+            continue;
+        }
+        if (capturing) {
+            captured.push(line);
+        }
+    }
+    return found ? captured.join('\n') : null;
+}
+async function resolveDocumentOutOfScope(spec) {
+    if (!spec.specPath) {
+        return [];
+    }
+    let fileContent;
+    try {
+        fileContent = await readFile(spec.specPath, 'utf-8');
+    }
+    catch {
+        return [];
+    }
+    const sectionContent = extractOutOfScopeSection(fileContent);
+    return sectionContent === null ? [] : extractListItems(sectionContent);
+}
+async function resolveOutOfScopeItems(spec) {
+    const documentItems = await resolveDocumentOutOfScope(spec);
+    return documentItems.length > 0 ? documentItems : (spec.outOfScope ?? []);
+}
 /**
  * SPEC-615 AC3: detect contradictions between spec criteria and prior decisions.
  * Mutates failureScenarios in place. Best-effort — never throws.
@@ -150,12 +214,13 @@ export async function handleChallengeSpec(args, server) {
     }
     failureScenarios.push(...collectCapabilityScenarios({ spec, specContent, knowledge, focusAreas, capabilities }));
     // SPEC-612: Check for contradictions between outOfScope and acceptance criteria
-    if (spec.outOfScope !== undefined && spec.outOfScope.length > 0) {
+    const resolvedOutOfScope = await resolveOutOfScopeItems(spec);
+    if (resolvedOutOfScope.length > 0) {
         const criteriaRange = findMarkdownSectionRange(specContent, 'Acceptance Criteria');
         const criteriaTexts = criteriaRange === null
             ? []
             : extractListItems(specContent.slice(criteriaRange.contentStart, criteriaRange.end));
-        const contradictionResult = checkScopeContradictions(spec.outOfScope, criteriaTexts);
+        const contradictionResult = checkScopeContradictions(resolvedOutOfScope, criteriaTexts);
         for (const c of contradictionResult.contradictions) {
             failureScenarios.push({
                 scenario: `Criterion contradicts outOfScope declaration: "${c.contradicts}"`,

package/dist/tools/create-spec.d.ts

@@ -1,5 +1,26 @@
 import type { CreateSpecInput, ToolResult } from '../types/index.js';
 import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { type LeanFileEntry } from '../engine/spec-format/lean-technical-generator.js';
+import { type AutopilotAnalysis } from './create-spec/autopilot-analyzer.js';
+import type { TechnicalReferenceGroundingRecord } from '../types/spec-grounding.js';
+export declare function groundTechnicalFiles(input: {
+    files: {
+        create: LeanFileEntry[];
+        modify: LeanFileEntry[];
+        test: LeanFileEntry[];
+    };
+    projectPath: string;
+    userInput: string;
+    autopilot: AutopilotAnalysis;
+}): Promise<{
+    files: {
+        create: LeanFileEntry[];
+        modify: LeanFileEntry[];
+        test: LeanFileEntry[];
+    };
+    records: TechnicalReferenceGroundingRecord[];
+    advisoryFiles: LeanFileEntry[];
+}>;
 export declare function resolveGroundedVerificationCommands(projectPath: string, testPaths: string[]): Promise<string[]>;
 export declare function handleCreateSpec(inputParams: CreateSpecInput, server?: McpServer): Promise<ToolResult>;
 //# sourceMappingURL=create-spec.d.ts.map

package/dist/tools/create-spec.js

@@ -102,7 +102,7 @@ async function resolveTechnicalFiles(input) {
     }
     return { create: [], modify: [], test: [] };
 }
-async function groundTechnicalFiles(input) {
+export async function groundTechnicalFiles(input) {
     const userInput = input.userInput.toLowerCase();
     const autopilotPaths = new Set([
         ...input.autopilot.suggestedFiles.modify.map((file) => file.path),
@@ -118,7 +118,7 @@ async function groundTechnicalFiles(input) {
     const advisoryFiles = [];
     for (const section of ['create', 'modify', 'test']) {
         for (const file of input.files[section]) {
-            const pathInUserInput = userInput.includes(file.path.toLowerCase());
+            const pathInUserInput = pathSurvivesNegativeClauseCheck(userInput, file.path.toLowerCase());
             const exists = await pathExists(pathJoin(input.projectPath, file.path));
             const fromAutopilot = autopilotPaths.has(file.path);
             const derivedTest = section === 'test' && isDerivedFromGroundedSource(file.path, grounded.modify);
@@ -146,6 +146,96 @@ async function groundTechnicalFiles(input) {
     }
     return { files: grounded, records, advisoryFiles };
 }
+const NEGATIVE_WORK_CLAUSE_RE = /\b(?:remains? unchanged|is not touched|not touched|must not (?:change|be changed|be modified|touch|be touched)|unchanged|out of scope)\b/;
+const CLAUSE_DELIMITERS = ['\n', '. ', '; ', ', and ', ', but '];
+const SENTENCE_DELIMITERS = ['\n', '. '];
+const BACK_REFERENCE_SUBJECT_RE = /^(?:and\s+|but\s+)?(?:it|they|this|that|these|those)\s+(?:must|remains?|stays?|is|are|was|were|should|shall|will|cannot|can|does|do)\b/;
+const PATH_LIKE_TOKEN_RE = /\S+\/\S*\.\w+/;
+const CLAUSE_SPLIT_RE = new RegExp(CLAUSE_DELIMITERS.map((delimiter) => delimiter.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')).join('|'), 'g');
+function computeDelimitedBounds(text, matchIndex, matchLength, delimiters) {
+    const startCandidates = delimiters.map((delimiter) => {
+        const index = text.lastIndexOf(delimiter, matchIndex);
+        return index === -1 ? -1 : index + delimiter.length;
+    });
+    const start = Math.max(0, ...startCandidates);
+    const searchAfter = matchIndex + matchLength;
+    const endCandidates = delimiters
+        .map((delimiter) => text.indexOf(delimiter, searchAfter))
+        .filter((value) => value !== -1);
+    const end = endCandidates.length > 0 ? Math.min(...endCandidates) : text.length;
+    return [start, end];
+}
+function findClauseBounds(text, matchIndex, matchLength) {
+    return computeDelimitedBounds(text, matchIndex, matchLength, CLAUSE_DELIMITERS);
+}
+function findSentenceBounds(text, matchIndex, matchLength) {
+    return computeDelimitedBounds(text, matchIndex, matchLength, SENTENCE_DELIMITERS);
+}
+function splitClausesWithOffsets(sentence, sentenceStart) {
+    const clauses = [];
+    let cursor = 0;
+    CLAUSE_SPLIT_RE.lastIndex = 0;
+    let delimiterMatch = CLAUSE_SPLIT_RE.exec(sentence);
+    while (delimiterMatch !== null) {
+        clauses.push([sentence.slice(cursor, delimiterMatch.index), sentenceStart + cursor]);
+        cursor = delimiterMatch.index + delimiterMatch[0].length;
+        delimiterMatch = CLAUSE_SPLIT_RE.exec(sentence);
+    }
+    clauses.push([sentence.slice(cursor), sentenceStart + cursor]);
+    return clauses;
+}
+function sentenceHasBackReferencedNegation(userInput, matchIndex, matchLength) {
+    const [sentenceStart, sentenceEnd] = findSentenceBounds(userInput, matchIndex, matchLength);
+    const sentence = userInput.slice(sentenceStart, sentenceEnd);
+    const clauses = splitClausesWithOffsets(sentence, sentenceStart);
+    const matchEnd = matchIndex + matchLength;
+    const currentClauseIndex = clauses.findIndex(([clauseText, clauseStart]) => matchIndex >= clauseStart && matchEnd <= clauseStart + clauseText.length);
+    if (currentClauseIndex === -1) {
+        return false;
+    }
+    const currentClauseEntry = clauses[currentClauseIndex];
+    if (currentClauseEntry === undefined) {
+        return false;
+    }
+    const [currentClauseText, currentClauseStart] = currentClauseEntry;
+    const currentClauseTail = currentClauseText.slice(matchEnd - currentClauseStart);
+    if (PATH_LIKE_TOKEN_RE.test(currentClauseTail)) {
+        return false;
+    }
+    for (let index = currentClauseIndex + 1; index < clauses.length; index += 1) {
+        const clauseEntry = clauses[index];
+        if (clauseEntry === undefined) {
+            continue;
+        }
+        const [clauseText] = clauseEntry;
+        if (PATH_LIKE_TOKEN_RE.test(clauseText)) {
+            return false;
+        }
+        const trimmedClause = clauseText.replace(/^\s+/, '');
+        if (BACK_REFERENCE_SUBJECT_RE.test(trimmedClause) &&
+            NEGATIVE_WORK_CLAUSE_RE.test(trimmedClause)) {
+            return true;
+        }
+    }
+    return false;
+}
+function pathSurvivesNegativeClauseCheck(userInput, lowerPath) {
+    let searchFrom = 0;
+    for (;;) {
+        const matchIndex = userInput.indexOf(lowerPath, searchFrom);
+        if (matchIndex === -1) {
+            return false;
+        }
+        const [clauseStart, clauseEnd] = findClauseBounds(userInput, matchIndex, lowerPath.length);
+        const clause = userInput.slice(clauseStart, clauseEnd);
+        const ownClauseNegated = NEGATIVE_WORK_CLAUSE_RE.test(clause);
+        const backReferencedNegation = sentenceHasBackReferencedNegation(userInput, matchIndex, lowerPath.length);
+        if (!ownClauseNegated && !backReferencedNegation) {
+            return true;
+        }
+        searchFrom = matchIndex + lowerPath.length;
+    }
+}
 function isDerivedFromGroundedSource(testPath, modifyFiles) {
     return modifyFiles.some((file) => {
         const withoutSrc = file.path.startsWith('src/') ? file.path.slice(4) : file.path;

package/dist/tools/schemas/validate-output-schema.d.ts

@@ -243,6 +243,7 @@ export declare const ValidateOutputSchema: {
         running: "running";
     }>;
     submittedAt: z.ZodISODateTime;
+    attachedAt: z.ZodISODateTime;
     cursor: z.ZodString;
     queue: z.ZodObject<{
         status: z.ZodEnum<{

package/dist/tools/schemas/validate-output-schema.js

@@ -194,6 +194,7 @@ export const ValidateOutputSchema = {
     workspaceId: z.string().min(1).max(128),
     state: z.enum(['accepted', 'running', 'checkpointed']),
     submittedAt: z.iso.datetime(),
+    attachedAt: z.iso.datetime(),
     cursor: z.string().regex(/^[a-f0-9]{64}$/),
     queue: z.object({
         status: z.enum(['active', 'queued', 'terminal']),

package/dist/tools/validate.js

@@ -212,7 +212,7 @@ export async function handleValidate(args) {
                 if (active.state === 'accepted' || active.state === 'checkpointed') {
                     scheduleValidateJobExecution(projectId, active.workspaceId);
                 }
-                return validationAcceptedResult(active, projectId, runtime);
+                return validationAcceptedResult(active, projectId, runtime, { justCreated: false });
             }
             const job = createPendingValidationSubmission({
                 runtime,
@@ -228,7 +228,7 @@ export async function handleValidate(args) {
             if (job.state === 'accepted' || job.state === 'checkpointed') {
                 scheduleValidateJobExecution(projectId, job.workspaceId);
             }
-            return validationAcceptedResult(job, projectId, runtime);
+            return validationAcceptedResult(job, projectId, runtime, { justCreated: true });
         }
         catch (e_1) {
             env_1.error = e_1;
@@ -276,7 +276,7 @@ async function acquireValidationSubmissionLock(projectId, specId) {
     }
     throw new Error('[Planu] Timed out waiting for the validation submission lock');
 }
-function validationAcceptedResult(job, projectId, runtime) {
+function validationAcceptedResult(job, projectId, runtime, { justCreated }) {
     const observation = runtime.observe(job);
     const accepted = {
         schemaVersion: 1,
@@ -285,6 +285,7 @@ function validationAcceptedResult(job, projectId, runtime) {
         workspaceId: job.workspaceId,
         state: job.state,
         submittedAt: job.createdAt,
+        attachedAt: justCreated ? job.createdAt : new Date().toISOString(),
         cursor: publicJobCursor(observation),
         queue: observation.queue,
         terminalStates: ['completed', 'failed', 'cancelled', 'dead-letter'],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@planu/cli",
-  "version": "5.3.22",
+  "version": "5.3.24",
   "description": "Planu — MCP Server for Spec Driven Development with native Rust acceleration for hot paths. Cross-platform (Linux/macOS/Windows, x64/arm64, glibc/musl).",
   "type": "module",
   "main": "dist/index.js",
@@ -36,14 +36,14 @@
     "packageName": "@planu/core"
   },
   "optionalDependencies": {
-    "@planu/core-darwin-arm64": "5.3.22",
-    "@planu/core-darwin-x64": "5.3.22",
-    "@planu/core-linux-arm64-gnu": "5.3.22",
-    "@planu/core-linux-arm64-musl": "5.3.22",
-    "@planu/core-linux-x64-gnu": "5.3.22",
-    "@planu/core-linux-x64-musl": "5.3.22",
-    "@planu/core-win32-arm64-msvc": "5.3.22",
-    "@planu/core-win32-x64-msvc": "5.3.22"
+    "@planu/core-darwin-arm64": "5.3.24",
+    "@planu/core-darwin-x64": "5.3.24",
+    "@planu/core-linux-arm64-gnu": "5.3.24",
+    "@planu/core-linux-arm64-musl": "5.3.24",
+    "@planu/core-linux-x64-gnu": "5.3.24",
+    "@planu/core-linux-x64-musl": "5.3.24",
+    "@planu/core-win32-arm64-msvc": "5.3.24",
+    "@planu/core-win32-x64-msvc": "5.3.24"
   },
   "engines": {
     "node": ">=24.0.0"

package/planu-native.json

@@ -1,7 +1,7 @@
 {
   "name": "dev.planu.native",
   "displayName": "Planu Native Lightweight Surface",
-  "version": "5.3.22",
+  "version": "5.3.24",
   "packageName": "@planu/cli",
   "modes": {
     "lightweight": {

package/planu-plugin.json

@@ -2,7 +2,7 @@
   "name": "dev.planu.cli",
   "displayName": "Planu — Spec Driven Development",
   "description": "Manage software specs, estimations, and autonomous SDD workflows. Language-agnostic MCP server for Claude Code.",
-  "version": "5.3.22",
+  "version": "5.3.24",
   "icon": "assets/plugin/icon.svg",
   "command": ["npx", "@planu/cli@latest"],
   "packageName": "@planu/cli",