@planu/cli 5.7.0 → 5.7.1

package/CHANGELOG.md

@@ -1,3 +1,24 @@
+## [5.7.1] - 2026-08-31
+
+### Bug Fixes
+- fix(release): classify cherry-pick abort cleanup for reliability gate
+- fix(test): serialize validate-execute.branches and git-setup suites to avoid full-load spawn flakes
+- fix(test): pin reliability-gate suite in serial inventory snapshot
+- fix(test): mock reliability policies output in lifecycle e2e and serialize reliability-gate suite
+- fix: ignore and untrack runtime index backup files
+- fix: untrack runtime housekeeping history leaked by runtime migration
+- fix(test-infra): address SPEC-1707 review findings in spawn retry helper and lint
+- fix(detectors): resolve datastore claims from runtime dependencies only (SPEC-1700)
+- fix(test-infra): allowlist SPEC-1706 release harness spawner in child_process lint
+- fix(test-infra): add transient spawn retry classifier and child_process lint (SPEC-1707)
+- fix: address SPEC-1706 review findings in release.sh --abort repair
+- fix: repair buried phantom bump commits in release.sh --abort (SPEC-1706)
+- fix(validate): audit spec-declared files and dedupe reliability allowlist
+- fix(validate): run reliability gate on spec-listed files before done (SPEC-1705)
+- fix(storage): exclude atomic-write temp files and tolerate vanish races in inventoryStorageRoot
+- fix: retire completed canonical migration journal on unchanged roots (SPEC-1711)
+
+
 ## [5.7.0] - 2026-08-31
 
 ### Features

package/dist/.planu-build.json

@@ -1 +1 @@
-{"schemaVersion":1,"commit":"e145c9f04adb18813ddff699db636c390b20a776"}
+{"schemaVersion":1,"commit":"04661e53067d139151a01671e92fec0f4f2ddfc1"}

package/dist/engine/detectors/cache-db-detector.js

@@ -1,5 +1,5 @@
 import { technologyValue } from '../technology-registry.js';
-import { collectDependencies, hasAnyFile } from '../detection-utils.js';
+import { collectRuntimeDependencies, hasAnyFile } from '../detection-utils.js';
 const VALKEY_DEPS = ['valkey', '@valkey/client', 'iovalkey'];
 const REDIS_DEPS = [
     technologyValue('technology-redis-34fb46'),
@@ -17,7 +17,7 @@ const REDIS_DEPS = [
 ];
 const MEMCACHED_DEPS = ['memcached', 'memcachier', 'pymemcache', 'gomemcache', 'memcache', 'dalli'];
 export async function detectCacheEngine(projectPath) {
-    const deps = await collectDependencies(projectPath);
+    const deps = await collectRuntimeDependencies(projectPath);
     // Valkey first (Redis fork — more specific)
     if (VALKEY_DEPS.some((d) => deps.has(d))) {
         return 'valkey';

package/dist/engine/detectors/newsql-db-detector.js

@@ -1,4 +1,4 @@
-import { collectDependencies } from '../detection-utils.js';
+import { collectRuntimeDependencies } from '../detection-utils.js';
 const PLANETSCALE_DEPS = ['@planetscale/database', 'planetscale-go'];
 const NEON_DEPS = ['@neondatabase/serverless', 'neon-serverless'];
 const SPANNER_DEPS = [
@@ -10,7 +10,7 @@ const ALLOYDB_DEPS = ['@google-cloud/alloydb', 'google-cloud-alloydb-connector']
 const COCKROACH_DEPS = ['cockroachdb', '@cockroachlabs/serverless'];
 const TIDB_DEPS = ['tidb', 'tidb-serverless', '@tidbcloud/serverless'];
 export async function detectNewSqlDb(projectPath) {
-    const deps = await collectDependencies(projectPath);
+    const deps = await collectRuntimeDependencies(projectPath);
     // PlanetScale (specific SDK)
     if (PLANETSCALE_DEPS.some((d) => deps.has(d))) {
         return 'planetscale';

package/dist/engine/detectors/search-engine-detector.js

@@ -1,4 +1,4 @@
-import { collectDependencies } from '../detection-utils.js';
+import { collectRuntimeDependencies } from '../detection-utils.js';
 const ALGOLIA_DEPS = [
     'algoliasearch',
     '@algolia/client-search',
@@ -25,7 +25,7 @@ const ELASTICSEARCH_DEPS = [
     'chewy',
 ];
 export async function detectSearchEngine(projectPath) {
-    const deps = await collectDependencies(projectPath);
+    const deps = await collectRuntimeDependencies(projectPath);
     // Algolia (most specific deps)
     if (ALGOLIA_DEPS.some((d) => deps.has(d))) {
         return 'algolia';

package/dist/engine/detectors/vector-db-detector.js

@@ -1,4 +1,4 @@
-import { collectDependencies } from '../detection-utils.js';
+import { collectRuntimeDependencies } from '../detection-utils.js';
 const PINECONE_DEPS = ['@pinecone-database/pinecone', 'pinecone-client', 'pinecone'];
 const WEAVIATE_DEPS = ['weaviate-client', 'weaviate-ts-client', 'weaviate'];
 const QDRANT_DEPS = ['@qdrant/js-client-rest', 'qdrant-client', 'qdrant_client'];
@@ -6,7 +6,7 @@ const MILVUS_DEPS = ['@zilliz/milvus2-sdk-node', 'pymilvus', 'milvus'];
 const CHROMA_DEPS = ['chromadb', 'chromadb-client'];
 const PGVECTOR_DEPS = ['pgvector', 'pgvector-node', 'pgvector-python'];
 export async function detectVectorDb(projectPath) {
-    const deps = await collectDependencies(projectPath);
+    const deps = await collectRuntimeDependencies(projectPath);
     if (PINECONE_DEPS.some((d) => deps.has(d))) {
         return 'pinecone';
     }

package/dist/engine/detectors/widecolumn-db-detector.js

@@ -1,4 +1,4 @@
-import { collectDependencies } from '../detection-utils.js';
+import { collectRuntimeDependencies } from '../detection-utils.js';
 const SCYLLA_DEPS = ['scylladb', '@scylladb/driver', 'scylla-driver'];
 const CASSANDRA_DEPS = [
     'cassandra-driver',
@@ -16,7 +16,7 @@ const CLICKHOUSE_DEPS = [
 ];
 const HBASE_DEPS = ['hbase', 'hbase-client', 'happybase', 'hbase-rpc-client'];
 export async function detectWideColumnDb(projectPath) {
-    const deps = await collectDependencies(projectPath);
+    const deps = await collectRuntimeDependencies(projectPath);
     // ScyllaDB (Cassandra-compatible but more specific)
     if (SCYLLA_DEPS.some((d) => deps.has(d))) {
         return 'scylladb';

package/dist/engine/validator/reliability-gate.d.ts

@@ -0,0 +1,4 @@
+import type { ReliabilityGateResult, ReliabilityGateViolation } from '../../types/index.js';
+export type { ReliabilityGateResult, ReliabilityGateViolation };
+export declare function runReliabilityGate(projectPath: string, specFiles: string[]): ReliabilityGateResult;
+//# sourceMappingURL=reliability-gate.d.ts.map

package/dist/engine/validator/reliability-gate.js

@@ -0,0 +1,93 @@
+import { execFileSync } from 'node:child_process';
+import { relative, resolve } from 'node:path';
+let cachedProtectedDirectories;
+function fetchProtectedDirectories() {
+    if (cachedProtectedDirectories !== undefined) {
+        return cachedProtectedDirectories;
+    }
+    const stdout = execFileSync(process.execPath, ['scripts/check-reliability-policies.mjs', '--print-protected-dirs'], { cwd: process.cwd(), encoding: 'utf-8', stdio: ['ignore', 'pipe', 'pipe'] });
+    const parsed = JSON.parse(stdout);
+    if (!Array.isArray(parsed) || !parsed.every((entry) => typeof entry === 'string')) {
+        throw new Error('reliability gate protected-directories output is not a string array');
+    }
+    cachedProtectedDirectories = parsed;
+    return parsed;
+}
+function normalizeToProjectRelative(projectPath, file) {
+    return relative(projectPath, resolve(projectPath, file));
+}
+function isProtected(protectedDirectories, file) {
+    return protectedDirectories.some((directory) => file === directory || file.startsWith(`${directory}/`));
+}
+function parseViolations(stdout) {
+    const parsed = JSON.parse(stdout);
+    if (!Array.isArray(parsed)) {
+        throw new Error('reliability gate output is not a JSON array');
+    }
+    return parsed.map((entry) => {
+        if (typeof entry !== 'object' ||
+            entry === null ||
+            typeof entry.file !== 'string' ||
+            typeof entry.line !== 'number' ||
+            typeof entry.rule !== 'string') {
+            throw new Error('reliability gate output entry is malformed');
+        }
+        return entry;
+    });
+}
+export function runReliabilityGate(projectPath, specFiles) {
+    const normalizedSpecFiles = new Set(specFiles.map((file) => normalizeToProjectRelative(projectPath, file)));
+    if (normalizedSpecFiles.size === 0) {
+        return { skipped: true, passed: true, failures: [], warnings: [] };
+    }
+    let protectedDirectories;
+    try {
+        protectedDirectories = fetchProtectedDirectories();
+    }
+    catch (error) {
+        return {
+            skipped: false,
+            passed: false,
+            failures: [],
+            warnings: [],
+            executionError: `could not resolve protected-directory allowlist: ${error instanceof Error ? error.message : String(error)}`,
+        };
+    }
+    if (![...normalizedSpecFiles].some((file) => isProtected(protectedDirectories, file))) {
+        return { skipped: true, passed: true, failures: [], warnings: [] };
+    }
+    let stdout;
+    try {
+        stdout = execFileSync(process.execPath, ['scripts/check-reliability-policies.mjs', '--root', projectPath, '--json'], { cwd: process.cwd(), encoding: 'utf-8', stdio: ['ignore', 'pipe', 'pipe'] });
+    }
+    catch (error) {
+        const stdoutFromError = error.stdout;
+        if (typeof stdoutFromError !== 'string' || stdoutFromError.trim().length === 0) {
+            return {
+                skipped: false,
+                passed: false,
+                failures: [],
+                warnings: [],
+                executionError: error instanceof Error ? error.message : String(error),
+            };
+        }
+        stdout = stdoutFromError;
+    }
+    let violations;
+    try {
+        violations = parseViolations(stdout);
+    }
+    catch (error) {
+        return {
+            skipped: false,
+            passed: false,
+            failures: [],
+            warnings: [],
+            executionError: `unparseable reliability gate output: ${error instanceof Error ? error.message : String(error)}`,
+        };
+    }
+    const failures = violations.filter((violation) => normalizedSpecFiles.has(violation.file));
+    const warnings = violations.filter((violation) => !normalizedSpecFiles.has(violation.file));
+    return { skipped: false, passed: failures.length === 0, failures, warnings };
+}
+//# sourceMappingURL=reliability-gate.js.map

package/dist/storage/migrations/canonical-storage.js

@@ -61,6 +61,7 @@ async function listFiles(root, current = root) {
     }
     return files;
 }
+const ATOMIC_WRITE_TEMP_SUFFIX = /\.tmp\.\d+\.[0-9a-f]{8}$/;
 export async function inventoryStorageRoot(rootInput) {
     const root = assertAbsolute(rootInput, 'inventory root');
     const info = await lstat(root);
@@ -70,7 +71,19 @@ export async function inventoryStorageRoot(rootInput) {
     const files = [];
     let totalBytes = 0;
     for (const path of await listFiles(root)) {
-        const content = await readFile(path);
+        if (ATOMIC_WRITE_TEMP_SUFFIX.test(path)) {
+            continue;
+        }
+        let content;
+        try {
+            content = await readFile(path);
+        }
+        catch (error) {
+            if (error instanceof Error && 'code' in error && error.code === 'ENOENT') {
+                continue;
+            }
+            throw error;
+        }
         const relativePath = relative(root, path).split(sep).join('/');
         files.push({ relativePath, size: content.byteLength, sha256: sha256(content) });
         totalBytes += content.byteLength;
@@ -218,17 +231,17 @@ async function retireCompletedJournalForNewSources(journalPath, expected) {
     }
     try {
         const previous = validateJournal(parsed, { ...expected, legacyRoots: previousRoots });
-        if (!rootsChanged) {
+        if (previous.phase === 'completed') {
+            if (rootsChanged) {
+                await inventoryStorageRoot(expected.destinationRoot);
+            }
+            await rm(journalPath, { force: true });
             return;
         }
-        if (previous.phase !== 'completed') {
-            throw new Error('[Planu] Active migration journal does not match requested roots');
+        if (!rootsChanged) {
+            return;
         }
-        // A completed destination remains live and may legitimately receive newer
-        // canonical records. Re-inventory its real directory instead of requiring
-        // the historical generation digest to remain frozen forever.
-        await inventoryStorageRoot(expected.destinationRoot);
-        await rm(journalPath, { force: true });
+        throw new Error('[Planu] Active migration journal does not match requested roots');
     }
     catch (error) {
         if (!isTerminalPhaseValue(record.phase)) {

package/dist/tools/validate.js

@@ -58,6 +58,7 @@ import { compactObj } from '../engine/compact-obj.js';
 import { resolveProjectId, missingProjectIdError } from './resolve-project-id.js';
 import { specStore, knowledgeStore } from '../storage/index.js';
 import { validateSpec, generateDoR, generateDoD } from '../engine/validator.js';
+import { scanCodeForSpec } from '../engine/validator/analyzer.js';
 import { isBlockingQualitySeverity } from '../engine/validator/dor-dod.js';
 import { readVerifiedImplementationReview } from '../engine/handoff-artifacts/implementation-review-reader.js';
 import { calcQualityScore } from '../engine/auditor-scoring.js';
@@ -69,6 +70,7 @@ import { parseConventions, scanConventions } from '../engine/convention-scanner/
 import { validateScopeCompliance } from '../engine/scope-boundaries/index.js';
 import { compareWithBaseline } from '../storage/convention-baseline.js';
 import { writeImplementationReviewReport } from '../engine/validator/validation-report-writer.js';
+import { runReliabilityGate } from '../engine/validator/reliability-gate.js';
 import { buildGraphCoverageReport, formatGraphCoverageText } from './validate-graph-coverage.js';
 import { buildMinimalityReport } from './validate-minimality.js';
 import { buildValidateFailureFallback, validateStrictLayoutOrError } from './validate-helpers.js';
@@ -85,7 +87,7 @@ import { getRuntimePolicy } from '../engine/runtime-policy.js';
 import { resolveValidationWorktree, ValidationWorktreeError, } from '../engine/validation/validation-worktree.js';
 // Re-export for external use (SPEC-018)
 export { validateContractCompliance };
-const VALIDATION_GATE_TOTAL = 8;
+const VALIDATION_GATE_TOTAL = 9;
 const GATE_DEADLINE_EXEMPT_PHASES = new Set(['lint', 'compliance']);
 async function runWithGateDeadline(phase, command, work) {
     if (GATE_DEADLINE_EXEMPT_PHASES.has(phase)) {
@@ -360,6 +362,10 @@ export async function executeValidate(args, server, onProgress) {
     });
     const implementationQualityScore = calcQualityScore(result.qualityIssues);
     const auditedFiles = [...new Set(result.qualityIssues.map((i) => i.file))];
+    const reliabilityGate = await runStage('reliability', 'scripts/check-reliability-policies.mjs --json', async () => {
+        const codeState = await scanCodeForSpec(executionSpec, projectPath);
+        return runReliabilityGate(projectPath, codeState.affectedFiles);
+    });
     const { conventionViolations, regressionDetected } = await runStage('conventions', 'validate project conventions', () => scanProjectConventions(projectId, projectPath));
     const lintCheck = await runStage('lint', knowledge.lintCommand ?? 'pnpm lint', () => runLintCheck(projectPath, knowledge.lintCommand ?? null, {
         projectId,
@@ -397,6 +403,7 @@ export async function executeValidate(args, server, onProgress) {
         lintPassed: lintCheck.passed,
         assurancePassed: assuranceGates.newCode.passed,
         minimalityBlocked: minimalityReport?.blocked === true,
+        reliabilityPassed: reliabilityGate.passed,
         score: effectiveResult.score,
     });
     const output = {
@@ -492,6 +499,26 @@ export async function executeValidate(args, server, onProgress) {
             });
         }
     }
+    for (const failure of reliabilityGate.failures) {
+        output.qualityIssues.push({
+            file: failure.file,
+            line: failure.line,
+            severity: 'critical',
+            rule: failure.rule,
+            message: `Reliability gate violation: ${failure.rule}`,
+            suggestion: 'Fix the release-gate reliability violation before marking this spec done.',
+        });
+    }
+    for (const warning of reliabilityGate.warnings) {
+        output.qualityIssues.push({
+            file: warning.file,
+            line: warning.line,
+            severity: 'warning',
+            rule: warning.rule,
+            message: `Reliability gate violation in an unrelated file: ${warning.rule}`,
+            suggestion: 'Not blocking this spec — file is outside the spec Files section.',
+        });
+    }
     // Auto-suggest corrective actions based on validation results
     // score is null when no criteria can be extracted — treat as 0 for comparisons.
     const scoreValue = effectiveResult.score ?? 0;
@@ -523,6 +550,12 @@ export async function executeValidate(args, server, onProgress) {
     if (!lintCheck.passed) {
         suggestions.push(`Lint check failed: ${lintCheck.issueCount} issue(s) found via \`${lintCheck.command}\`. Fix before marking as done.`);
     }
+    if (reliabilityGate.executionError !== undefined) {
+        suggestions.push(`Reliability gate could not run: ${reliabilityGate.executionError}. Fix the gate before marking as done.`);
+    }
+    else if (!reliabilityGate.passed) {
+        suggestions.push(`Reliability gate failed: ${String(reliabilityGate.failures.length)} violation(s) in this spec's files. Fix before marking as done.`);
+    }
     if (!assuranceGates.newCode.passed) {
         suggestions.push(`Assurance gate failed: ${String(assuranceGates.newCode.findings.length)} new-code domain inference issue(s) found.`);
     }
@@ -673,6 +706,7 @@ function buildQualityGateSummary(input) {
         ...(!input.lintPassed ? ['lint'] : []),
         ...(!input.assurancePassed ? ['assurance'] : []),
         ...(input.minimalityBlocked ? ['minimality'] : []),
+        ...(!input.reliabilityPassed ? ['reliability'] : []),
     ];
     return {
         passed: failures.length === 0,
@@ -683,6 +717,7 @@ function buildQualityGateSummary(input) {
         lintPassed: input.lintPassed,
         assurancePassed: input.assurancePassed,
         minimalityPassed: !input.minimalityBlocked,
+        reliabilityPassed: input.reliabilityPassed,
     };
 }
 function buildExecutableCoverage(specCompliance) {

package/dist/types/validation-evidence.d.ts

@@ -110,4 +110,16 @@ export interface ExecutableEvidence {
     unmappedCriteria: string[];
     ignoredCriteriaTitles: string[];
 }
+export interface ReliabilityGateViolation {
+    file: string;
+    line: number;
+    rule: string;
+}
+export interface ReliabilityGateResult {
+    skipped: boolean;
+    passed: boolean;
+    failures: ReliabilityGateViolation[];
+    warnings: ReliabilityGateViolation[];
+    executionError?: string;
+}
 //# sourceMappingURL=validation-evidence.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@planu/cli",
-  "version": "5.7.0",
+  "version": "5.7.1",
   "description": "Planu — MCP Server for Spec Driven Development. Cross-platform (Linux/macOS/Windows, x64/arm64).",
   "type": "module",
   "main": "dist/index.js",

package/planu-plugin.json

@@ -2,7 +2,7 @@
   "name": "dev.planu.cli",
   "displayName": "Planu — Spec Driven Development",
   "description": "Manage software specs, estimations, and autonomous SDD workflows. Language-agnostic MCP server for Claude Code.",
-  "version": "5.7.0",
+  "version": "5.7.1",
   "icon": "assets/plugin/icon.svg",
   "command": ["npx", "@planu/cli@latest"],
   "packageName": "@planu/cli",