@planu/cli 5.3.26 → 5.3.28

package/dist/tools/update-status/dod-gates.js

@@ -12,11 +12,12 @@ import { addLesson, getLessons } from '../../storage/lessons-store.js';
 import { dispatchFeedbackEvent } from '../learn.js';
 import { auditDeps } from '../../engine/dep-auditor/index.js';
 import { withEscalation } from '../../engine/escalator/with-escalation.js';
-import { writeImplementationReviewReport } from '../../engine/validator/validation-report-writer.js';
+import { AUTOMATED_VALIDATOR_AGENT, writeImplementationReviewReport, } from '../../engine/validator/validation-report-writer.js';
 import { formatKeyValue } from '../output-formatter.js';
 import { reportClassifiedDegradation } from '../../errors/classified-degradation.js';
 import { verifyCurrentDoneReceipt } from './done-receipt-verifier.js';
 import { projectDataDir } from '../../storage/base-store.js';
+import { readTransitionLog } from '../../storage/transition-log.js';
 import { ValidationReportV1Schema } from '../../engine/handoff-artifacts/schemas.js';
 export { completedJobPublishesReceipt } from './done-receipt-verifier.js';
 /**
@@ -447,10 +448,10 @@ async function checkDoneReviewDigest(specId, projectId, implementationReviewDige
         !parsed.data.passed ||
         parsed.data.gates.some((gate) => !gate.passed) ||
         parsed.data.minimalityReport?.blocked === true ||
-        parsed.data.reviewer.kind !== 'implementation-review-agent' ||
-        parsed.data.reviewer.agent !== 'planu-implementation-reviewer' ||
+        parsed.data.reviewer.kind !== 'automation' ||
+        parsed.data.reviewer.agent !== AUTOMATED_VALIDATOR_AGENT ||
         parsed.data.reviewer.verdict !== 'approved') {
-        return doneReviewDigestError(specId, 'DONE_REVIEW_REPORT_UNSAFE', 'The validation report schema or independent reviewer evidence is invalid.');
+        return doneReviewDigestError(specId, 'DONE_REVIEW_REPORT_UNSAFE', 'The validation report schema or automated validator evidence is invalid.');
     }
     return null;
 }
@@ -616,6 +617,116 @@ export async function checkSpecReviewGate(specId, projectId, _forceApprove) {
         });
     }
 }
+export async function checkImplementationReviewGate(specId, projectId, _force) {
+    try {
+        const { readArtifact } = await import('../../engine/handoff-artifacts/io.js');
+        const result = await readArtifact({ projectId, specId, kind: 'implementation_review' });
+        if (!result.ok) {
+            const firstErr = result.errors[0];
+            return implementationReviewGateError({
+                specId,
+                error: firstErr?.code === 'ARTIFACT_NOT_FOUND'
+                    ? 'implementation_review_missing'
+                    : 'implementation_review_invalid',
+                message: firstErr?.code === 'ARTIFACT_NOT_FOUND'
+                    ? 'No implementation review exists for this spec. An independent planu-implementation-reviewer must review the implementation and write its own evidence before done.'
+                    : 'Implementation review evidence is malformed or uses an obsolete schema.',
+                blockers: [],
+                fixHint: firstErr?.code === 'ARTIFACT_NOT_FOUND'
+                    ? 'Have planu-implementation-reviewer write implementation_review.json (ImplementationReviewV1) into the handoff store, then retry update_status(done).'
+                    : 'Have planu-implementation-reviewer rewrite implementation_review.json as valid ImplementationReviewV1 evidence, then retry done.',
+            });
+        }
+        const review = result.payload;
+        if (isLifecycleStubBody(specId, review.body)) {
+            return implementationReviewGateError({
+                specId,
+                error: 'implementation_review_stub',
+                message: 'Implementation review evidence is a lifecycle-generated stub, not evidence from a real reviewer.',
+                blockers: [],
+                fixHint: 'Replace the stub with genuine planu-implementation-reviewer evidence in the handoff store, then retry done.',
+            });
+        }
+        if (review.verdict !== 'approved' || review.reviewer.verdict !== 'approved') {
+            return implementationReviewGateError({
+                specId,
+                error: 'implementation_review_changes_requested',
+                message: 'Implementation reviewer requested changes. Done is blocked until the review passes.',
+                blockers: review.blockers,
+                fixHint: 'Resolve the implementation review blockers and have planu-implementation-reviewer write updated evidence, then retry done.',
+            });
+        }
+        if (review.reviewer.kind !== 'implementation-review-agent' ||
+            review.reviewer.agent !== 'planu-implementation-reviewer') {
+            return implementationReviewGateError({
+                specId,
+                error: 'implementation_review_wrong_reviewer',
+                message: 'Done requires the recognized independent implementation reviewer identity.',
+                blockers: [
+                    `Reviewer was ${review.reviewer.agent}. Expected planu-implementation-reviewer.`,
+                ],
+                fixHint: 'Have planu-implementation-reviewer (with the recognized identity) write the review artifact, then retry done.',
+            });
+        }
+        const implementerActor = await findImplementingActor(specId, projectId);
+        if (implementerActor !== undefined && implementerActor === review.reviewer.agent) {
+            return implementationReviewGateError({
+                specId,
+                error: 'implementation_review_self_review',
+                message: 'The implementation reviewer must be a different identity from the implementer. Self-review is blocked.',
+                blockers: [`Implementer and reviewer share the identity "${implementerActor}".`],
+                fixHint: 'Have a different, independent agent write the implementation review evidence, then retry done.',
+            });
+        }
+        return null;
+    }
+    catch (err) {
+        /* reliability-optional: IMPLEMENTATION_REVIEW_GATE_READ — typed gate error blocks done */
+        reportClassifiedDegradation('IMPLEMENTATION_REVIEW_GATE_READ', err);
+        return implementationReviewGateError({
+            specId,
+            error: 'implementation_review_unreadable',
+            message: `Could not read implementation review evidence: ${err instanceof Error ? err.message : String(err)}`,
+            blockers: [],
+            fixHint: 'Fix the artifact store issue so implementation_review.json is readable, then retry update_status(done).',
+        });
+    }
+}
+async function findImplementingActor(specId, projectId) {
+    const entries = await readTransitionLog(projectId, specId);
+    for (let i = entries.length - 1; i >= 0; i--) {
+        const entry = entries[i];
+        if (entry?.to === 'implementing' && entry.actor) {
+            return entry.actor;
+        }
+    }
+    return undefined;
+}
+function implementationReviewGateError(args) {
+    const artifactPath = `external Planu project data: handoffs/${args.specId}/implementation_review.json`;
+    return {
+        content: [
+            {
+                type: 'text',
+                text: formatKeyValue({
+                    error: args.error,
+                    message: args.message,
+                    artifactPath,
+                    blockers: args.blockers.length,
+                    firstBlocker: args.blockers[0],
+                    fixHint: args.fixHint,
+                }, 'Implementation review gate failed'),
+            },
+        ],
+        isError: true,
+        structuredContent: {
+            error: args.error,
+            code: 422,
+            context: { specId: args.specId, artifactPath, blockers: args.blockers },
+            fixHint: args.fixHint,
+        },
+    };
+}
 function validationReportGateError(args) {
     const artifactPath = `external Planu project data: handoffs/${args.specId}/validation-report.json`;
     return {
@@ -673,6 +784,14 @@ function specReviewGateError(args) {
  */
 export async function checkDoneGates(spec, specId, projectId, projectPath, _force, _forceReason = 'No force reason provided', verifyReceipt = verifyCurrentDoneReceipt, implementationReviewDigest) {
     try {
+        const reviewGateError = await checkImplementationReviewGate(specId, projectId, _force);
+        if (reviewGateError) {
+            return {
+                blocked: reviewGateError,
+                forcedBypassWarning: null,
+                freshnessLease: null,
+            };
+        }
         if (implementationReviewDigest !== undefined) {
             const digestError = await checkDoneReviewDigest(specId, projectId, implementationReviewDigest);
             if (digestError) {

package/dist/types/atomic-upgrade.d.ts

@@ -21,9 +21,7 @@ export interface UpgradeJournal {
 export interface ReleaseVerificationReport {
     version: string;
     cliPackage: string;
-    nativePackage: string;
     cliVerified: true;
-    nativeVerified: true;
     mcpSmokeVerified: true;
     canaryVerified: true;
     verifiedAt: string;

package/dist/types/core-bridge.d.ts

@@ -1,4 +1,3 @@
-import type { SpecAnnotation } from './living-spec/annotations.js';
 export type { SpecAnnotation } from './living-spec/annotations.js';
 export interface FileHash {
     path: string;
@@ -9,79 +8,6 @@ export interface FileMetadata {
     mtime: number;
     size: number;
 }
-/** Versioned contract returned by a native runtime before it may execute work. */
-export interface NativeRuntimeHandshake {
-    engineVersion: string;
-    buildId: string;
-    protocolAbi: number;
-    capabilityAbi: number;
-    nodeApiAbi: number;
-    capabilities: string[];
-    storageSchemaMin: number;
-    storageSchemaMax: number;
-    target: string;
-}
-/** Externally generated release metadata stored next to the native artifact. */
-export interface NativeArtifactManifest extends NativeRuntimeHandshake {
-    schemaVersion: 2;
-    cliVersion: string;
-    artifactSha256: string;
-    platform: NodeJS.Platform;
-    arch: string;
-    libc: 'glibc' | 'musl' | null;
-    sbom: {
-        format: 'CycloneDX-1.5';
-        path: string;
-        sha256: string;
-    };
-    provenance: {
-        builder: string;
-        sourceCommit: string;
-        sourceTreeDirty: boolean;
-        sourceDateEpoch: number;
-        rustToolchain: string;
-        zigVersion: string | null;
-    };
-    signature: {
-        algorithm: 'Ed25519';
-        keyId: string;
-        value: string;
-    };
-}
-export interface NativeRuntimeCompatibility {
-    compatible: boolean;
-    reasons: string[];
-    handshake: NativeRuntimeHandshake | null;
-}
-export type NativeFallbackClass = 'optimization' | 'correctness-critical';
-export type NativeFallbackMode = 'typescript-visible-degradation' | 'fail-closed';
-export interface NativeCapabilityPolicy {
-    readonly capability: string;
-    readonly classification: NativeFallbackClass;
-    readonly fallback: NativeFallbackMode;
-    readonly parityContract: string;
-}
-export interface NativeCapabilityDiagnostic {
-    capability: string;
-    state: 'available' | 'degraded' | 'unavailable';
-    fallback: NativeFallbackMode;
-}
-export interface NativeLoadDiagnostic {
-    attempted: string[];
-    errors: string[];
-    loaded?: string;
-    artifactSha256?: string;
-    origin?: 'local' | 'package';
-    compatibility?: NativeRuntimeCompatibility;
-    rejectedOverrides?: string[];
-    capabilities?: NativeCapabilityDiagnostic[];
-    executionScope?: 'isolated-worker-and-keychain-port';
-}
-export interface NativePlatformInfo {
-    platform: NodeJS.Platform;
-    arch: string;
-    libc: 'glibc' | 'musl' | null;
-}
 export interface DriftResult {
     foundKeywords: string[];
     fileCount: number;
@@ -207,38 +133,4 @@ export interface ProjectGraphNeighborRs {
     edgeId: string;
     relation: string;
 }
-export interface PlanuCore {
-    /** Mandatory for runtimes loaded by the versioned bridge. */
-    planuRuntimeHandshake?(): NativeRuntimeHandshake;
-    hashProjectPath(projectPath: string): string;
-    isSafeProjectId(projectId: string): boolean;
-    getProjectDataPath(baseDir: string, project_id: string): string | null;
-    scanAndHashFiles(rootPath: string): FileHash[];
-    scanProjectMetadata(rootPath: string): FileMetadata[];
-    scanSpecAnnotations(rootPath: string): SpecAnnotation[];
-    checkAcCoverage(filePaths: string[], keywords: string[]): string[];
-    fastDetectDriftParallel(rootPath: string, keywords: string[]): DriftResult;
-    fastFindDuplicateBlocks(paths: string[], minLines: number): DuplicateRawBlockRs[];
-    fastFindPatterns(rootPath: string, patterns: string[], extensions: string[], exclude: string[]): FastGrepMatch[];
-    fastFindFilesByName(rootPath: string, names: string[]): string[];
-    fastFindFilesByExt(rootPath: string, extensions: string[]): string[];
-    fastReadFiles(paths: string[]): FileContent[];
-    fastScanSpecs(rootPath: string): SpecBriefRs[];
-    fastVerifyGapsChain(filePath: string): GapsLogChainResultRs;
-    fastAppendGapEntry(filePath: string, id: string, timestamp: string, specId: string, description: string, severity: string, affectedSpecs: string[]): string;
-    fastCosineSimilarity(v1: number[], v2: number[]): number;
-    fastHnswSearchFlat(query: number[], nodes: VectorNode[], topK: number): NativeVectorSearchResult[];
-    fastHmacSign(secret: string, data: string): string;
-    fastHmacVerify(secret: string, data: string, signature: string): boolean;
-    macosKeychainSet?(account: string, secret: Buffer): Promise<void>;
-    macosKeychainGet?(account: string): Promise<Buffer | null>;
-    macosKeychainDelete?(account: string): Promise<void>;
-    scanProjectGraphSources?(rootPath: string, limits: ResolvedProjectGraphLimitsRs): ProjectGraphSourceFileRs[];
-    extractTsRelations?(rootPath: string, paths: string[], limits: ResolvedProjectGraphLimitsRs): TsRelationRs[];
-    queryAffectedNodes?(seed: string, edges: GraphEdgeInputRs[], relationFilter: string[], limits: ResolvedProjectGraphLimitsRs): AffectedNodeRs[];
-    queryAffectedNodesCompact?(seed: string, edges: CompactGraphEdgesRs, relationFilter: string[], limits: ResolvedProjectGraphLimitsRs): AffectedNodeRs[];
-    queryShortestPath?(from: string, to: string, edges: GraphEdgeInputRs[], relationFilter: string[], limits: ResolvedProjectGraphLimitsRs): ShortestPathResultRs;
-    selectCompactGraphSlice?(seeds: string[], nodes: GraphNodeInputRs[], edges: GraphEdgeInputRs[], limits: ResolvedProjectGraphLimitsRs): CompactGraphSliceRs;
-    selectCompactGraphSliceCompact?(seeds: string[], nodeIds: string[], edges: CompactGraphEdgesRs, limits: ResolvedProjectGraphLimitsRs): CompactGraphSliceRs;
-}
 //# sourceMappingURL=core-bridge.d.ts.map

package/dist/types/core-bridge.js

@@ -1,3 +1,3 @@
-// src/types/core-bridge.ts — Types for the native Rust engine
+// src/types/core-bridge.ts — Types for the TypeScript fallback engine
 export {};
 //# sourceMappingURL=core-bridge.js.map

package/dist/types/durable-job.d.ts

@@ -1,5 +1,3 @@
-import type { DurableJobRecord } from '../storage/runtime-db.js';
-import type { NativeWorkerCall, NativeWorkerOperation } from './native-worker.js';
 import type { ValidationArtifactDigests, ValidationFreshnessLease } from './validation-receipt.js';
 export interface DurableJobIdentity {
     readonly operationId: string;
@@ -15,13 +13,6 @@ export interface WatchJobInput extends DurableJobIdentity {
 export interface DurableJobRuntimeOptions {
     readonly databasePath?: string;
 }
-export interface NativeDurableJobPayload {
-    readonly kind: 'native-worker';
-    readonly operation: NativeWorkerOperation;
-    readonly payload: Readonly<Record<string, unknown>>;
-    readonly deadlineAt: number;
-    readonly cancellationId?: string;
-}
 export interface ValidateDurableJobPayload {
     readonly kind: 'validate';
     readonly schemaVersion: 2;
@@ -44,35 +35,4 @@ export interface ValidateDurableJobPayload {
     readonly freshnessLease?: ValidationFreshnessLease;
     readonly specPath: string;
 }
-export type NativeWorkerRunner = (call: NativeWorkerCall) => Promise<unknown>;
-export interface DurableJobExecutorOptions {
-    readonly runtime: {
-        list(projectId: string, workspaceId?: string): readonly DurableJobRecord[];
-        claim(input: DurableJobIdentity & {
-            readonly workerId: string;
-            readonly leaseMs: number;
-        }): DurableJobRecord | undefined;
-        renew(input: DurableJobIdentity & {
-            readonly workerId: string;
-            readonly leaseMs: number;
-            readonly fencingToken: number;
-        }): boolean;
-        get(input: DurableJobIdentity): DurableJobRecord;
-        complete(input: DurableJobIdentity & {
-            readonly workerId: string;
-            readonly fencingToken: number;
-            readonly result: unknown;
-        }): DurableJobRecord;
-        fail(input: DurableJobIdentity & {
-            readonly workerId: string;
-            readonly fencingToken: number;
-            readonly error: string;
-        }): DurableJobRecord;
-    };
-    readonly workerId: string;
-    readonly leaseMs?: number;
-    readonly heartbeatMs?: number;
-    readonly maxConcurrency?: number;
-    readonly runNative?: NativeWorkerRunner;
-}
 //# sourceMappingURL=durable-job.d.ts.map

package/dist/types/handoff-artifacts.d.ts

@@ -1,6 +1,6 @@
 import type { Spec } from './spec/core.js';
 /** Artifact kinds produced/consumed by each role transition */
-export type ArtifactKind = 'intake' | 'spec.lock' | 'review_feedback' | 'implementation-report' | 'validation-report';
+export type ArtifactKind = 'intake' | 'spec.lock' | 'review_feedback' | 'implementation-report' | 'validation-report' | 'implementation_review';
 /** Triagier → Elicitor: describes the intent to be elaborated */
 export interface IntakeV1 {
     schema_version: string;
@@ -39,6 +39,21 @@ export interface ReviewFeedbackV1 {
     body: string;
     reviewedAt: string;
 }
+/** Independent reviewer → Planner: evidence that an implementation review actually happened */
+export interface ImplementationReviewV1 {
+    schema_version: string;
+    specId: string;
+    verdict: 'approved' | 'changes-requested';
+    reviewer: {
+        kind: 'implementation-review-agent' | 'human';
+        agent: string;
+        verdict: 'approved' | 'changes-requested';
+    };
+    blockers: string[];
+    suggestions: string[];
+    body: string;
+    reviewedAt: string;
+}
 /** Implementer → Validator: result of implementation run */
 export interface ImplementationReportV1 {
     schema_version: string;
@@ -125,6 +140,7 @@ export interface ArtifactPayloadMap {
     review_feedback: ReviewFeedbackV1;
     'implementation-report': ImplementationReportV1;
     'validation-report': ValidationReportV1;
+    implementation_review: ImplementationReviewV1;
 }
 export type ArtifactPayload<K extends ArtifactKind> = ArtifactPayloadMap[K];
 import type { MinimalImplementationReport } from './minimal-implementation-gate.js';

package/dist/types/security.d.ts

@@ -97,11 +97,6 @@ export interface SecurityPatternsConfig {
     complianceCriteria: Record<string, string[]>;
 }
 export type SecretStoreKind = 'macos-keychain' | 'linux-secret-service' | 'windows-credential-manager' | 'environment';
-export interface MacOSKeychainNativePort {
-    set(account: string, secret: Buffer): Promise<void>;
-    get(account: string): Promise<Buffer | null>;
-    delete(account: string): Promise<void>;
-}
 export type MacOSKeychainOperation = 'get' | 'set' | 'delete';
 export interface MacOSKeychainPendingOperation {
     readonly fence: number;

package/dist/types/transition-log.d.ts

@@ -1,5 +1,5 @@
 /** Event types recorded in the transition log. */
-export type TransitionEventType = 'transitioned_to_terminal' | 'frontmatter_resealed' | 'reopen' | 'terminal_drift_detected' | 'transition' | 'handoff.intake' | 'handoff.spec.lock' | 'handoff.review_feedback' | 'handoff.implementation-report' | 'handoff.validation-report' | 'retro_audit' | 'tdd_red_locked' | 'tdd_green_achieved' | 'status_reconciled' | 'housekeeping' | 'ghost_spec_quarantined';
+export type TransitionEventType = 'transitioned_to_terminal' | 'frontmatter_resealed' | 'reopen' | 'terminal_drift_detected' | 'transition' | 'handoff.intake' | 'handoff.spec.lock' | 'handoff.review_feedback' | 'handoff.implementation-report' | 'handoff.validation-report' | 'handoff.implementation_review' | 'retro_audit' | 'tdd_red_locked' | 'tdd_green_achieved' | 'status_reconciled' | 'housekeeping' | 'ghost_spec_quarantined';
 /** SPEC-734: Outcome of a gate execution in a transition. */
 export type GateOutcome = 'pass' | 'fail' | 'skip' | 'forced';
 /** SPEC-734: Result of verifying the hash chain integrity of a project's transition log. */

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@planu/cli",
-  "version": "5.3.26",
-  "description": "Planu — MCP Server for Spec Driven Development with native Rust acceleration for hot paths. Cross-platform (Linux/macOS/Windows, x64/arm64, glibc/musl).",
+  "version": "5.3.28",
+  "description": "Planu — MCP Server for Spec Driven Development. Cross-platform (Linux/macOS/Windows, x64/arm64).",
   "type": "module",
   "main": "dist/index.js",
   "bin": {
@@ -11,57 +11,25 @@
   "files": [
     "dist/",
     "!dist/**/*.map",
-    "!dist/engine/*.node",
     "scripts/lib/pending-release-file.mjs",
     "scripts/lib/portable-paths.mjs",
     "src/i18n/messages/",
-    "planu-native.json",
     "planu-plugin.json",
     "README.md",
     "CHANGELOG.md",
     "LICENSE"
   ],
-  "napi": {
-    "binaryName": "planu-core",
-    "targets": [
-      "aarch64-apple-darwin",
-      "x86_64-apple-darwin",
-      "aarch64-unknown-linux-gnu",
-      "aarch64-unknown-linux-musl",
-      "x86_64-unknown-linux-gnu",
-      "x86_64-unknown-linux-musl",
-      "aarch64-pc-windows-msvc",
-      "x86_64-pc-windows-msvc"
-    ],
-    "packageName": "@planu/core"
-  },
-  "optionalDependencies": {
-    "@planu/core-darwin-arm64": "5.3.26",
-    "@planu/core-darwin-x64": "5.3.26",
-    "@planu/core-linux-arm64-gnu": "5.3.26",
-    "@planu/core-linux-arm64-musl": "5.3.26",
-    "@planu/core-linux-x64-gnu": "5.3.26",
-    "@planu/core-linux-x64-musl": "5.3.26",
-    "@planu/core-win32-arm64-msvc": "5.3.26",
-    "@planu/core-win32-x64-msvc": "5.3.26"
-  },
   "engines": {
     "node": ">=24.0.0"
   },
   "packageManager": "pnpm@11.9.0+sha512.bd682d5d03fe525ef7c9fd6780c6884d1e756ac4c9c9fe00c538782824310dcf90e3ddc4f53835f06dfaebd5085e41855e0bcbb3b60de2ac5bbab89e5036f03b",
   "scripts": {
-    "build:rust": "bash scripts/build-rust-local.sh --host",
-    "build:rust:all": "bash scripts/build-rust-local.sh --all",
-    "build:rust:check-tools": "bash scripts/build-rust-local.sh --check-tools",
-    "check:native-version-parity": "node scripts/check-native-version-parity.mjs",
-    "check:release-authorities": "node scripts/check-release-authorities.mjs",
     "check:commercial-surfaces": "node scripts/check-commercial-surfaces.mjs",
     "check:tool-registration": "bash scripts/check-tool-registration.sh",
     "generate:host-tool-registry": "node scripts/generate-host-tool-registry.mjs",
     "release:local": "bash scripts/release-local.sh",
-    "release:local:all": "bash scripts/release-local.sh --all",
-    "release:publish": "bash scripts/release-local.sh --all --publish",
-    "build": "pnpm clean && pnpm build:rust && pnpm build:ts",
+    "release:publish": "bash scripts/release-local.sh --publish",
+    "build": "pnpm clean && pnpm build:ts",
     "build:ts": "pnpm clean && tsc -p tsconfig.build.json && tsc-alias -p tsconfig.build.json && node scripts/copy-runtime-assets.mjs",
     "build:obfuscated": "pnpm build && node scripts/obfuscate.mjs",
     "dev": "tsc --watch",
@@ -85,12 +53,9 @@
     "test:website:browser": "playwright test --config playwright.website.config.ts",
     "test:website:lighthouse": "lhci autorun --config=.lighthouserc.cjs",
     "test:website:lighthouse:production": "PLANU_LIGHTHOUSE_PRODUCTION=1 lhci autorun --config=.lighthouserc.cjs",
-    "native:project-graph:e2e": "PLANU_NATIVE_E2E=1 vitest run tests/integration/native-project-graph-e2e.test.ts",
-    "native:project-graph:benchmark": "node scripts/benchmark-native-performance.mjs --operation project_graph_query --samples 30 --warmups 5 --project-path . --spec-id SPEC-1119 --json",
-    "benchmark:execution-kernel": "pnpm build && node scripts/benchmark-execution-kernel.mjs",
-    "check": "pnpm typecheck && pnpm lint:gate && pnpm format:check && pnpm check:destructive-ops && pnpm check:release-authorities && pnpm check:commercial-surfaces && pnpm check:tool-registration && pnpm check:public-privacy && pnpm check:website-proof && pnpm check:donation-assets && pnpm check:website-public-assets",
+    "check": "pnpm typecheck && pnpm lint:gate && pnpm format:check && pnpm check:destructive-ops && pnpm check:commercial-surfaces && pnpm check:tool-registration && pnpm check:public-privacy && pnpm check:website-proof && pnpm check:donation-assets && pnpm check:website-public-assets",
     "check:destructive-ops": "bash scripts/check-no-automatic-destructive-ops.sh",
-    "check:strict": "pnpm check && pnpm generate:host-tool-registry -- --check && pnpm check:native-version-parity && pnpm check:environment-schema && pnpm audit:hardcodes && pnpm audit:deadcode && pnpm audit:circular && pnpm audit:types && pnpm audit:security && pnpm audit:i18n",
+    "check:strict": "pnpm check && pnpm generate:host-tool-registry -- --check && pnpm check:environment-schema && pnpm audit:hardcodes && pnpm audit:deadcode && pnpm audit:circular && pnpm audit:types && pnpm audit:security && pnpm audit:i18n",
     "check:preflight": "pnpm typecheck && pnpm lint:gate && pnpm format:check && node scripts/check-public-privacy.mjs && node scripts/check-preflight.mjs",
     "check:reliability": "node scripts/check-reliability-policies.mjs",
     "check:environment-schema": "node scripts/check-environment-schema.mjs",
@@ -98,7 +63,7 @@
     "test:migrations": "vitest run tests/storage/corruption-contract.test.ts tests/integration/runtime-storage.test.ts tests/integration/canonical-storage-migration.test.ts",
     "test:fault-injection": "vitest run tests/engine/auto-updater/atomic-upgrade.test.ts tests/integration/durable-job-runtime.test.ts tests/integration/idempotent-operations.test.ts",
     "check:website-public-assets": "node scripts/check-website-public-assets.mjs",
-    "check:public-privacy": "node scripts/check-public-privacy.mjs && node scripts/check-native-signing-privacy.mjs",
+    "check:public-privacy": "node scripts/check-public-privacy.mjs",
     "check:readme-parity": "node scripts/check-readme-parity.mjs --package-root .",
     "privacy:prepublish": "node scripts/check-prepublish-privacy.mjs --package-root .",
     "generate:website-proof": "node scripts/generate-website-proof.mjs",
@@ -176,7 +141,6 @@
     "@commitlint/config-conventional": "^21.2.0",
     "@eslint/js": "^10.0.1",
     "@lhci/cli": "0.15.1",
-    "@napi-rs/cli": "3.8.2",
     "@noble/hashes": "2.2.0",
     "@playwright/test": "1.62.1",
     "@scure/base": "2.2.0",

package/planu-plugin.json

@@ -2,7 +2,7 @@
   "name": "dev.planu.cli",
   "displayName": "Planu — Spec Driven Development",
   "description": "Manage software specs, estimations, and autonomous SDD workflows. Language-agnostic MCP server for Claude Code.",
-  "version": "5.3.26",
+  "version": "5.3.28",
   "icon": "assets/plugin/icon.svg",
   "command": ["npx", "@planu/cli@latest"],
   "packageName": "@planu/cli",

package/dist/config/native-release-public-key.pem

@@ -1,3 +0,0 @@
------BEGIN PUBLIC KEY-----
-MCowBQYDK2VwAyEAxEphEcoGPysItgE7nFfqo8pDvXOlNcKKt0KkJ3wiqz4=
------END PUBLIC KEY-----

package/dist/config/native-targets.json

@@ -1,87 +0,0 @@
-{
-  "schemaVersion": 1,
-  "binaryName": "planu-core",
-  "packageScope": "@planu/core",
-  "targets": [
-    {
-      "directory": "darwin-arm64",
-      "package": "@planu/core-darwin-arm64",
-      "rustTarget": "aarch64-apple-darwin",
-      "runtimeTarget": "darwin-arm64",
-      "platform": "darwin",
-      "arch": "arm64",
-      "libc": null,
-      "runner": "macos-15"
-    },
-    {
-      "directory": "darwin-x64",
-      "package": "@planu/core-darwin-x64",
-      "rustTarget": "x86_64-apple-darwin",
-      "runtimeTarget": "darwin-x64",
-      "platform": "darwin",
-      "arch": "x64",
-      "libc": null,
-      "runner": "macos-15-intel"
-    },
-    {
-      "directory": "linux-arm64-gnu",
-      "package": "@planu/core-linux-arm64-gnu",
-      "rustTarget": "aarch64-unknown-linux-gnu",
-      "runtimeTarget": "linux-arm64-glibc",
-      "platform": "linux",
-      "arch": "arm64",
-      "libc": "glibc",
-      "runner": "ubuntu-24.04-arm"
-    },
-    {
-      "directory": "linux-arm64-musl",
-      "package": "@planu/core-linux-arm64-musl",
-      "rustTarget": "aarch64-unknown-linux-musl",
-      "runtimeTarget": "linux-arm64-musl",
-      "platform": "linux",
-      "arch": "arm64",
-      "libc": "musl",
-      "runner": "ubuntu-24.04-arm"
-    },
-    {
-      "directory": "linux-x64-gnu",
-      "package": "@planu/core-linux-x64-gnu",
-      "rustTarget": "x86_64-unknown-linux-gnu",
-      "runtimeTarget": "linux-x64-glibc",
-      "platform": "linux",
-      "arch": "x64",
-      "libc": "glibc",
-      "runner": "ubuntu-24.04"
-    },
-    {
-      "directory": "linux-x64-musl",
-      "package": "@planu/core-linux-x64-musl",
-      "rustTarget": "x86_64-unknown-linux-musl",
-      "runtimeTarget": "linux-x64-musl",
-      "platform": "linux",
-      "arch": "x64",
-      "libc": "musl",
-      "runner": "ubuntu-24.04"
-    },
-    {
-      "directory": "win32-arm64-msvc",
-      "package": "@planu/core-win32-arm64-msvc",
-      "rustTarget": "aarch64-pc-windows-msvc",
-      "runtimeTarget": "win32-arm64",
-      "platform": "win32",
-      "arch": "arm64",
-      "libc": null,
-      "runner": "windows-11-arm"
-    },
-    {
-      "directory": "win32-x64-msvc",
-      "package": "@planu/core-win32-x64-msvc",
-      "rustTarget": "x86_64-pc-windows-msvc",
-      "runtimeTarget": "win32-x64",
-      "platform": "win32",
-      "arch": "x64",
-      "libc": null,
-      "runner": "windows-2025"
-    }
-  ]
-}

package/dist/engine/execution/job-executor.d.ts

@@ -1,16 +0,0 @@
-import type { DurableJobExecutorOptions } from '../../types/durable-job.js';
-import type { DurableJobRecord } from '../../storage/runtime-db.js';
-/** Claims and executes allowlisted native jobs while preserving lease and cancellation fencing. */
-export declare class DurableJobExecutor {
-    private readonly runtime;
-    private readonly workerId;
-    private readonly leaseMs;
-    private readonly heartbeatMs;
-    private readonly maxConcurrency;
-    private readonly runNative;
-    constructor(options: DurableJobExecutorOptions);
-    /** Execute one bounded batch. Jobs not claimed by this worker remain untouched. */
-    runOnce(projectId: string, workspaceId?: string): Promise<readonly DurableJobRecord[]>;
-    private execute;
-}
-//# sourceMappingURL=job-executor.d.ts.map