@planu/cli 5.3.29 → 5.3.31

package/CHANGELOG.md

@@ -1,3 +1,23 @@
+## [5.3.31] - 2026-08-21
+
+### Bug Fixes
+- fix(spec-1584): exclude .claude/worktrees from Stryker sandbox to survive residual worktrees
+
+### Chores
+- chore(planu): file SPEC-1584 (Stryker worktree dangling-symlink) draft
+
+
+## [5.3.30] - 2026-08-20
+
+### Bug Fixes
+- fix(spec-1583): drop redundant access() precheck that TCC-fails website-proof
+- fix(spec-1581): re-verify receipt+log integrity on evidence-only drift
+- fix(spec-1581): done gate rebinds evidence-only traceability drift
+
+### Chores
+- chore(planu): SPEC-1581 done + SPEC-1582 draft filed
+
+
 ## [5.3.29] - 2026-08-20
 
 ### Bug Fixes

package/dist/engine/evidence-gates/lifecycle-gate.d.ts

@@ -10,5 +10,5 @@ export declare function checkLifecycleEvidenceGate(args: {
     criteria: string[];
     artifacts: EvidenceArtifacts;
     receiptContext?: EvidenceReceiptContext;
-}): EvidenceGateResult;
+}): Promise<EvidenceGateResult>;
 //# sourceMappingURL=lifecycle-gate.d.ts.map

package/dist/engine/evidence-gates/lifecycle-gate.js

@@ -1,6 +1,8 @@
+import { isAbsolute, join } from 'node:path';
 import { evidenceArtifactCollectionDigest, evidenceArtifactDigest } from './artifact-reader.js';
 import { hasAnyAffirmedMatch, stripMetaAnalysisText, stripNonContractText, } from '../text-signal-boundaries.js';
 import { createCriterionIdentity } from '../criterion-identity.js';
+import { computeDurableValidationBindings, doneReceiptBindingsDifferOnlyInEvidence, toValidationReceiptBindings, writeValidationArtifactProvenance, } from '../validation/durable-validation.js';
 const CONTRACT_HINTS = {
     api: [
         /\b(?:public|external|rest|http)[ -]?api\b/i,
@@ -26,55 +28,107 @@ function isNonTrivial(spec) {
 function hasText(value) {
     return value !== undefined && value.trim().length > 0;
 }
-function provenanceIssues(artifacts, context) {
-    const receipt = context.receipt;
+function collectProvenanceCandidates(artifacts) {
     const candidates = [];
     if (artifacts.discovery) {
-        candidates.push({
-            label: 'discovery',
-            artifact: artifacts.discovery,
-            expectedDigest: receipt.bindings.artifactDigests.discovery,
-        });
+        candidates.push({ label: 'discovery', artifact: artifacts.discovery, digestKey: 'discovery' });
     }
     if (artifacts.taskPlan) {
-        candidates.push({
-            label: 'task plan',
-            artifact: artifacts.taskPlan,
-            expectedDigest: receipt.bindings.artifactDigests.taskPlan,
-        });
+        candidates.push({ label: 'task plan', artifact: artifacts.taskPlan, digestKey: 'taskPlan' });
     }
     if (artifacts.traceabilityMatrix) {
         candidates.push({
             label: 'traceability matrix',
             artifact: artifacts.traceabilityMatrix,
-            expectedDigest: receipt.bindings.artifactDigests.traceability,
+            digestKey: 'traceability',
         });
     }
     for (const artifact of artifacts.contractValidations.slice(0, 1)) {
         candidates.push({
             label: 'contract validation collection',
             artifact,
-            expectedDigest: receipt.bindings.artifactDigests.contractValidation,
+            digestKey: 'contractValidation',
             actualDigest: evidenceArtifactCollectionDigest(artifacts.contractValidations),
         });
     }
-    return candidates.flatMap(({ label, artifact, expectedDigest, actualDigest }) => {
-        const provenance = artifact.provenance;
-        const observedDigest = actualDigest ?? evidenceArtifactDigest(artifact);
-        const valid = provenance?.receiptId === receipt.receiptId &&
-            provenance.specId === receipt.bindings.specId &&
-            provenance.issuerId === receipt.issuer &&
-            provenance.artifactDigest === observedDigest &&
-            provenance.artifactDigest === expectedDigest;
-        return valid
-            ? []
-            : [
-                {
-                    code: 'evidence_provenance_invalid',
-                    message: `${label} is not bound to the current Planu validation receipt.`,
-                },
-            ];
-    });
+    return candidates;
+}
+function observedDigestOf(candidate) {
+    return candidate.actualDigest ?? evidenceArtifactDigest(candidate.artifact);
+}
+function candidateMatchesReceipt(candidate, receipt) {
+    const provenance = candidate.artifact.provenance;
+    const observedDigest = observedDigestOf(candidate);
+    const expectedDigest = receipt.bindings.artifactDigests[candidate.digestKey];
+    return (provenance?.receiptId === receipt.receiptId &&
+        provenance.specId === receipt.bindings.specId &&
+        provenance.issuerId === receipt.issuer &&
+        provenance.artifactDigest === observedDigest &&
+        provenance.artifactDigest === expectedDigest);
+}
+function candidateIdentityMatchesReceipt(candidate, receipt) {
+    const provenance = candidate.artifact.provenance;
+    return (provenance?.receiptId === receipt.receiptId &&
+        provenance.specId === receipt.bindings.specId &&
+        provenance.issuerId === receipt.issuer);
+}
+async function resolveObservedBindings(receipt, context) {
+    if (!context.projectPath || !context.specPath) {
+        return undefined;
+    }
+    try {
+        const projectPath = context.projectPath;
+        const specPath = isAbsolute(context.specPath)
+            ? context.specPath
+            : join(projectPath, context.specPath);
+        const observed = await computeDurableValidationBindings({
+            canonicalProjectId: receipt.bindings.projectId,
+            specId: receipt.bindings.specId,
+            projectPath,
+            specPath,
+        });
+        return toValidationReceiptBindings(observed.bindings, observed.artifactDigests);
+    }
+    catch {
+        return undefined;
+    }
+}
+async function provenanceIssues(artifacts, context) {
+    const receipt = context.receipt;
+    const candidates = collectProvenanceCandidates(artifacts);
+    const failing = candidates.filter((candidate) => !candidateMatchesReceipt(candidate, receipt));
+    if (failing.length === 0) {
+        return [];
+    }
+    const observedBindings = await resolveObservedBindings(receipt, context);
+    const reconcilable = observedBindings && doneReceiptBindingsDifferOnlyInEvidence(observedBindings, receipt.bindings)
+        ? observedBindings
+        : undefined;
+    const issues = [];
+    let reconciled = false;
+    for (const candidate of failing) {
+        const canReconcile = reconcilable !== undefined &&
+            candidateIdentityMatchesReceipt(candidate, receipt) &&
+            observedDigestOf(candidate) === reconcilable.artifactDigests[candidate.digestKey];
+        if (!canReconcile) {
+            issues.push({
+                code: 'evidence_provenance_invalid',
+                message: `${candidate.label} is not bound to the current Planu validation receipt.`,
+            });
+            continue;
+        }
+        if (!reconciled) {
+            await writeValidationArtifactProvenance({
+                canonicalProjectId: receipt.bindings.projectId,
+                specId: receipt.bindings.specId,
+                receiptId: receipt.receiptId,
+                issuerId: receipt.issuer,
+                artifactDigests: reconcilable.artifactDigests,
+            });
+            reconciled = true;
+        }
+    }
+    return issues;
 }
 export function inferRequiredContractEvidence(spec, criteria) {
     const text = stripMetaAnalysisText(stripNonContractText([spec.title, ...spec.tags, ...criteria].join('\n')));
@@ -205,13 +259,13 @@ export function checkDoneEvidenceGate(spec, criteria, artifacts) {
     }
     return issues;
 }
-export function checkLifecycleEvidenceGate(args) {
+export async function checkLifecycleEvidenceGate(args) {
     const issues = args.artifacts.invalidArtifacts.map((artifact) => ({
         code: 'evidence_artifact_invalid',
         message: artifact,
     }));
     if (args.receiptContext) {
-        issues.push(...provenanceIssues(args.artifacts, args.receiptContext));
+        issues.push(...(await provenanceIssues(args.artifacts, args.receiptContext)));
     }
     if (args.transition === 'approved') {
         issues.push(...checkDiscoveryGate(args.spec, args.artifacts));

package/dist/engine/validation/durable-validation.d.ts

@@ -4,6 +4,13 @@ export type { DurableValidationBindings } from '../../types/durable-validation.j
 export { gitSourceTreeDigest } from './validation-source-digest.js';
 export { createPendingValidationSubmission, createValidationSubmission, validationOperationId, validationSubmissionOperationId, } from './validation-submission.js';
 export declare function toValidationReceiptBindings(bindings: DurableValidationBindings, artifactDigests: ValidationArtifactDigests): ValidationReceiptBindings;
+/**
+ * Evidence artifacts (discovery/task-plan/traceability/contract-validation) may legitimately
+ * be regenerated after a receipt was issued (e.g. autopilot skeleton fill). If ONLY the evidence
+ * digests changed while every code-facing binding stayed byte-identical, the receipt is rebound
+ * to the freshly observed evidence digests instead of being rejected as stale.
+ */
+export declare function doneReceiptBindingsDifferOnlyInEvidence(observed: ValidationReceiptBindings | undefined, stored: ValidationReceiptBindings | undefined): boolean;
 /** Compute immutable validation and lifecycle-artifact bindings without trusting spec metadata. */
 export declare function computeDurableValidationBindings(input: {
     readonly canonicalProjectId: string;

package/dist/engine/validation/durable-validation.js

@@ -46,6 +46,31 @@ export function toValidationReceiptBindings(bindings, artifactDigests) {
         artifactDigests,
     };
 }
+/**
+ * Evidence artifacts (discovery/task-plan/traceability/contract-validation) may legitimately
+ * be regenerated after a receipt was issued (e.g. autopilot skeleton fill). If ONLY the evidence
+ * digests changed while every code-facing binding stayed byte-identical, the receipt is rebound
+ * to the freshly observed evidence digests instead of being rejected as stale.
+ */
+export function doneReceiptBindingsDifferOnlyInEvidence(observed, stored) {
+    if (!observed?.artifactDigests || !stored?.artifactDigests) {
+        return false;
+    }
+    const codeBindingsMatch = observed.projectId === stored.projectId &&
+        observed.specId === stored.specId &&
+        observed.sourceDigest === stored.sourceDigest &&
+        observed.specDigest === stored.specDigest &&
+        observed.policyDigest === stored.policyDigest &&
+        observed.toolchainDigest === stored.toolchainDigest &&
+        observed.artifactDigests.approvedSpec === stored.artifactDigests.approvedSpec;
+    if (!codeBindingsMatch) {
+        return false;
+    }
+    return (observed.artifactDigests.discovery !== stored.artifactDigests.discovery ||
+        observed.artifactDigests.taskPlan !== stored.artifactDigests.taskPlan ||
+        observed.artifactDigests.traceability !== stored.artifactDigests.traceability ||
+        observed.artifactDigests.contractValidation !== stored.artifactDigests.contractValidation);
+}
 async function digestFile(path, missingLabel) {
     try {
         return digest(await readFile(path));

package/dist/tools/update-status/done-receipt-verifier.d.ts

@@ -1,6 +1,6 @@
 import { type DurableJobRecord } from '../../storage/runtime-db.js';
 import { type ValidationFreshnessLease } from '../../engine/validation/validation-freshness.js';
-import type { ValidationReceiptBindings } from '../../types/validation-receipt.js';
+export { doneReceiptBindingsDifferOnlyInEvidence } from '../../engine/validation/durable-validation.js';
 export type DoneReceiptVerifier = (identity: {
     projectId: string;
     specId: string;
@@ -12,12 +12,5 @@ export type DoneReceiptVerifier = (identity: {
     freshnessLease?: ValidationFreshnessLease;
 }>;
 export declare function completedJobPublishesReceipt(job: DurableJobRecord | undefined, receiptId: string): boolean;
-/**
- * Evidence artifacts (discovery/task-plan/traceability/contract-validation) may legitimately
- * be regenerated after a receipt was issued (e.g. autopilot skeleton fill). If ONLY the evidence
- * digests changed while every code-facing binding stayed byte-identical, the receipt is rebound
- * to the freshly observed evidence digests instead of being rejected as stale.
- */
-export declare function doneReceiptBindingsDifferOnlyInEvidence(observed: ValidationReceiptBindings | undefined, stored: ValidationReceiptBindings | undefined): boolean;
 export declare function verifyCurrentDoneReceipt(identity: Parameters<DoneReceiptVerifier>[0]): ReturnType<DoneReceiptVerifier>;
 //# sourceMappingURL=done-receipt-verifier.d.ts.map

package/dist/tools/update-status/done-receipt-verifier.js

@@ -57,7 +57,8 @@ import { projectDataDir } from '../../storage/base-store.js';
 import { reportClassifiedDegradation } from '../../errors/classified-degradation.js';
 import { ValidationReceiptStore, LOCAL_VALIDATION_RECEIPT_ISSUER, createValidationReceiptAuthority, readCurrentValidationReceipt, } from '../../engine/validation/validation-receipt.js';
 import { beginValidationFreshnessBarrier, bindValidationFreshnessLease, captureValidationFreshnessLease, closeValidationFreshnessLease, } from '../../engine/validation/validation-freshness.js';
-import { computeDurableValidationBindings, toValidationReceiptBindings, } from '../../engine/validation/durable-validation.js';
+import { computeDurableValidationBindings, doneReceiptBindingsDifferOnlyInEvidence, toValidationReceiptBindings, } from '../../engine/validation/durable-validation.js';
+export { doneReceiptBindingsDifferOnlyInEvidence } from '../../engine/validation/durable-validation.js';
 export function completedJobPublishesReceipt(job, receiptId) {
     if (job?.state !== 'completed' || !job.result || typeof job.result !== 'object') {
         return false;
@@ -70,31 +71,6 @@ export function completedJobPublishesReceipt(job, receiptId) {
     return (published.receiptId === receiptId &&
         published.receiptKey === `validation-receipt:${receiptId.slice('sha256:'.length)}`);
 }
-/**
- * Evidence artifacts (discovery/task-plan/traceability/contract-validation) may legitimately
- * be regenerated after a receipt was issued (e.g. autopilot skeleton fill). If ONLY the evidence
- * digests changed while every code-facing binding stayed byte-identical, the receipt is rebound
- * to the freshly observed evidence digests instead of being rejected as stale.
- */
-export function doneReceiptBindingsDifferOnlyInEvidence(observed, stored) {
-    if (!observed?.artifactDigests || !stored?.artifactDigests) {
-        return false;
-    }
-    const codeBindingsMatch = observed.projectId === stored.projectId &&
-        observed.specId === stored.specId &&
-        observed.sourceDigest === stored.sourceDigest &&
-        observed.specDigest === stored.specDigest &&
-        observed.policyDigest === stored.policyDigest &&
-        observed.toolchainDigest === stored.toolchainDigest &&
-        observed.artifactDigests.approvedSpec === stored.artifactDigests.approvedSpec;
-    if (!codeBindingsMatch) {
-        return false;
-    }
-    return (observed.artifactDigests.discovery !== stored.artifactDigests.discovery ||
-        observed.artifactDigests.taskPlan !== stored.artifactDigests.taskPlan ||
-        observed.artifactDigests.traceability !== stored.artifactDigests.traceability ||
-        observed.artifactDigests.contractValidation !== stored.artifactDigests.contractValidation);
-}
 export async function verifyCurrentDoneReceipt(identity) {
     const env_1 = { stack: [], error: void 0, hasError: false };
     try {
@@ -117,11 +93,20 @@ export async function verifyCurrentDoneReceipt(identity) {
             projectId: identity.projectId,
             issuerId: LOCAL_VALIDATION_RECEIPT_ISSUER,
         });
-        const verification = await authority.verifyCurrent({
+        let verification = await authority.verifyCurrent({
             ...currentBindings,
             projectId: identity.projectId,
             specId: identity.specId,
         });
+        const evidenceOnlyDrift = verification.reason === 'stale-bindings' &&
+            doneReceiptBindingsDifferOnlyInEvidence(currentBindings, receipt.bindings);
+        if (evidenceOnlyDrift) {
+            verification = await authority.verifyCurrent({
+                ...receipt.bindings,
+                projectId: identity.projectId,
+                specId: identity.specId,
+            });
+        }
         if (!verification.valid) {
             return verification;
         }

package/dist/tools/update-status/evidence-gate.js

@@ -134,12 +134,20 @@ export async function checkLifecycleEvidenceTransitionGate(args) {
             requiredContractKinds: [],
         });
     }
-    const result = checkLifecycleEvidenceGate({
+    const result = await checkLifecycleEvidenceGate({
         transition: args.transition,
         spec: args.spec,
         criteria,
         artifacts,
-        ...(receiptResult?.ok ? { receiptContext: { receipt: receiptResult.receipt } } : {}),
+        ...(receiptResult?.ok
+            ? {
+                receiptContext: {
+                    receipt: receiptResult.receipt,
+                    ...(args.projectPath === undefined ? {} : { projectPath: args.projectPath }),
+                    specPath: args.spec.specPath,
+                },
+            }
+            : {}),
     });
     if (args.transition === 'done') {
         const index = await buildSpecEvidenceIndex({

package/dist/types/evidence-gates.d.ts

@@ -1,4 +1,4 @@
-import type { ValidationArtifactProvenance, ValidationReceipt } from './validation-receipt.js';
+import type { ValidationArtifactDigests, ValidationArtifactProvenance, ValidationReceipt } from './validation-receipt.js';
 import type { ValidationGateCapability } from './validation-evidence.js';
 export type EvidenceGateTransition = 'approved' | 'implementing' | 'done';
 export interface DiscoveryEvidence {
@@ -68,6 +68,16 @@ export interface EvidenceArtifacts {
 }
 export interface EvidenceReceiptContext {
     receipt: ValidationReceipt;
+    projectPath?: string;
+    specPath?: string;
+}
+export interface ProvenanceCandidate {
+    label: string;
+    artifact: {
+        provenance?: ValidationArtifactProvenance;
+    };
+    digestKey: keyof ValidationArtifactDigests;
+    actualDigest?: string;
 }
 export interface EvidenceGateIssue {
     code: 'discovery_missing' | 'discovery_unresolved_questions' | 'task_plan_missing' | 'task_plan_uncovered_criteria' | 'traceability_missing' | 'traceability_uncovered_criteria' | 'traceability_incomplete_rows' | 'contract_validation_missing' | 'contract_validation_failed' | 'evidence_provenance_invalid' | 'done_drift_uncovered_criteria' | 'done_drift_stale_evidence' | 'done_drift_unapproved_scope' | 'evidence_artifact_invalid' | 'SUPERSEDED_RECONCILIATION_EVIDENCE';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@planu/cli",
-  "version": "5.3.29",
+  "version": "5.3.31",
   "description": "Planu — MCP Server for Spec Driven Development. Cross-platform (Linux/macOS/Windows, x64/arm64).",
   "type": "module",
   "main": "dist/index.js",

package/planu-plugin.json

@@ -2,7 +2,7 @@
   "name": "dev.planu.cli",
   "displayName": "Planu — Spec Driven Development",
   "description": "Manage software specs, estimations, and autonomous SDD workflows. Language-agnostic MCP server for Claude Code.",
-  "version": "5.3.29",
+  "version": "5.3.31",
   "icon": "assets/plugin/icon.svg",
   "command": ["npx", "@planu/cli@latest"],
   "packageName": "@planu/cli",