@quolu/lattice 0.12.19 → 0.12.21

package/README.md

@@ -95,6 +95,12 @@ LANや外部reverse proxyから閲覧するoptional bridgeは既定で無効で
 凡例の件数バッジを押すと全工程を描いた図へ切り替わり、`lattice todo gantt --scope all`は最初から全件を
 描きます。表示規約は[ADR 0066](docs/adr/0066-gantt-live-scope-drops-finished-work.md)が正です。
 
+右ペインは概要・選択工程・全工程の3面で、いずれもToDo storeを表示します（元plan Markdown本文は
+再表示しません。元文書へは各工程の詳細が持つ行対応から辿ります）。全工程一覧は動いているplanを
+最終活動の新しい順で上に、全工程が図から外れた完走planを古い順で下にまとめ、plan内は登録順です。
+決着済みPhaseと図から外した工程は既定で畳み、開けば読めます。規約は
+[ADR 0067](docs/adr/0067-right-pane-shows-the-store-and-orders-by-activity.md)が正です。
+
 静的工程表は`lattice todo gantt status`で`current / stale / missing`を確認でき、HTMLまたは
 digest付きsidecarの欠落・改ざんはtyped failureになります。
 dashboard daemonは起動時に読み込んだ版数をhealthで名乗り、installされた版と食い違えば`lattice status`の

package/docs/schemas/lattice.executor_packet.v1.schema.json

@@ -0,0 +1,57 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/kitepon-rgb/Lattice/blob/main/docs/schemas/lattice.executor_packet.v1.schema.json",
+  "title": "lattice.executor_packet.v1",
+  "description": "The single context packet issued at dispatch. It is the machine record of the context an executor received.",
+  "$comment": "Runtime validation additionally enforces canonical JSON bytes, the self-digest rule for `packet_digest`, and that `context_content_digest` equals the SHA-256 of the canonical JSON projection of exactly {todo_id, task_ref, scope, base_sha, verifier_refs, forbidden_operations} — plan attribution fields are excluded so that an epoch rebind is provably content-preserving.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema",
+    "packet_id",
+    "todo_id",
+    "task_ref",
+    "scope",
+    "base_sha",
+    "plan_ref",
+    "plan_epoch",
+    "verifier_refs",
+    "forbidden_operations",
+    "context_content_digest",
+    "packet_digest"
+  ],
+  "properties": {
+    "schema": { "const": "lattice.executor_packet.v1" },
+    "packet_id": { "$ref": "#/$defs/identifier" },
+    "todo_id": {
+      "$ref": "#/$defs/identifier",
+      "$comment": "Carried through from `run_request.v1`. It is not qualified by any TODO store project/plan/revision identity."
+    },
+    "task_ref": { "$ref": "#/$defs/identifier" },
+    "scope": { "type": "object" },
+    "base_sha": { "$ref": "#/$defs/gitSha" },
+    "plan_ref": { "$ref": "#/$defs/identifier" },
+    "plan_epoch": { "type": "integer", "minimum": 0 },
+    "verifier_refs": {
+      "type": "array",
+      "maxItems": 256,
+      "items": { "type": "string" }
+    },
+    "forbidden_operations": {
+      "type": "array",
+      "minItems": 1,
+      "maxItems": 256,
+      "items": { "type": "string" }
+    },
+    "context_content_digest": { "$ref": "#/$defs/digest" },
+    "packet_digest": { "$ref": "#/$defs/digest" }
+  },
+  "$defs": {
+    "identifier": {
+      "type": "string",
+      "pattern": "^[0-9A-Za-z](?:[0-9A-Za-z._-]{0,127})$"
+    },
+    "digest": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
+    "gitSha": { "type": "string", "pattern": "^[0-9a-f]{40}$" }
+  }
+}

package/docs/schemas/lattice.executor_receipt.v1.schema.json

@@ -0,0 +1,66 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/kitepon-rgb/Lattice/blob/main/docs/schemas/lattice.executor_receipt.v1.schema.json",
+  "title": "lattice.executor_receipt.v1",
+  "description": "The receipt an executor returns for one dispatched packet. `packet_digest` is what attributes it to the packet it received.",
+  "$comment": "Runtime validation additionally enforces canonical JSON bytes and the self-digest rule for `receipt_digest`. Acceptance is decided by event order, not by the receipt's own claims: the binding is checked against the `executor_dispatched` / `epoch_rebound` event that recorded the handle, worktree and packet digest for that TODO.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema",
+    "receipt_id",
+    "executor_handle",
+    "worktree_id",
+    "base_sha",
+    "plan_epoch",
+    "packet_digest",
+    "todo_id",
+    "checkpoint_digest",
+    "observed_diff",
+    "receipt_digest"
+  ],
+  "properties": {
+    "schema": { "const": "lattice.executor_receipt.v1" },
+    "receipt_id": { "$ref": "#/$defs/identifier" },
+    "executor_handle": { "$ref": "#/$defs/identifier" },
+    "worktree_id": { "$ref": "#/$defs/identifier" },
+    "base_sha": { "$ref": "#/$defs/gitSha" },
+    "plan_epoch": { "type": "integer", "minimum": 0 },
+    "packet_digest": {
+      "$ref": "#/$defs/digest",
+      "$comment": "Attribution to the received `executor_packet.v1`. This is the only link back to the dispatch."
+    },
+    "todo_id": {
+      "$ref": "#/$defs/identifier",
+      "$comment": "Carried through from `run_request.v1`. It is not qualified by any TODO store project/plan/revision identity, so a receipt alone does not prove which TODO store task it belongs to."
+    },
+    "checkpoint_digest": { "$ref": "#/$defs/digest" },
+    "observed_diff": {
+      "type": "array",
+      "maxItems": 256,
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["path", "change"],
+        "properties": {
+          "path": { "$ref": "#/$defs/repoRelativePath" },
+          "change": { "enum": ["added", "modified", "deleted"] }
+        }
+      }
+    },
+    "receipt_digest": { "$ref": "#/$defs/digest" }
+  },
+  "$defs": {
+    "identifier": {
+      "type": "string",
+      "pattern": "^[0-9A-Za-z](?:[0-9A-Za-z._-]{0,127})$"
+    },
+    "digest": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
+    "gitSha": { "type": "string", "pattern": "^[0-9a-f]{40}$" },
+    "repoRelativePath": {
+      "type": "string",
+      "minLength": 1,
+      "pattern": "^(?!/)(?!.*(?:^|/)\\.\\.?(?:/|$))[^\\u0000-\\u001f\\u007f\\\\]+$"
+    }
+  }
+}

package/docs/schemas/lattice.run_request.v1.schema.json

@@ -0,0 +1,238 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/kitepon-rgb/Lattice/blob/main/docs/schemas/lattice.run_request.v1.schema.json",
+  "title": "lattice.run_request.v1",
+  "description": "Canonical run request accepted by `lattice plan compile --request` and `lattice run start --request`.",
+  "$comment": "Runtime validation additionally enforces canonical JSON bytes and the self-digest rule: `request_digest` is the SHA-256 of the canonical JSON of the request with `request_digest` removed. Rejections are reported as `lattice.cli_error.v2` with `detail.reason` and `detail.path`.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema",
+    "request_id",
+    "repo",
+    "capacity",
+    "todos",
+    "manual_witness",
+    "sensor_query_set",
+    "executor_capability",
+    "claim_mode",
+    "request_digest"
+  ],
+  "properties": {
+    "schema": { "const": "lattice.run_request.v1" },
+    "request_id": { "$ref": "#/$defs/identifier" },
+    "repo": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["base_sha", "root_kind"],
+      "properties": {
+        "base_sha": { "$ref": "#/$defs/gitSha" },
+        "root_kind": { "$ref": "#/$defs/identifier" }
+      }
+    },
+    "capacity": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["executors"],
+      "properties": { "executors": { "type": "integer", "minimum": 1 } }
+    },
+    "todos": {
+      "type": "array",
+      "minItems": 1,
+      "maxItems": 256,
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["todo_id"],
+        "properties": { "todo_id": { "$ref": "#/$defs/identifier" } }
+      },
+      "$comment": "`todo_id` is chosen by the host. It is not qualified by any TODO store project/plan/revision identity."
+    },
+    "manual_witness": {
+      "type": "object",
+      "description": "Keys must be exactly the `todo_id` values listed in `todos`.",
+      "additionalProperties": { "$ref": "#/$defs/manualWitness" }
+    },
+    "sensor_query_set": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["queries"],
+      "properties": {
+        "queries": {
+          "type": "array",
+          "maxItems": 256,
+          "items": { "$ref": "#/$defs/sensorQuery" }
+        }
+      }
+    },
+    "executor_capability": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["adapters"],
+      "properties": {
+        "adapters": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 256,
+          "uniqueItems": true,
+          "items": { "$ref": "#/$defs/identifier" }
+        }
+      }
+    },
+    "claim_mode": { "const": "exact_minimum" },
+    "request_digest": { "$ref": "#/$defs/digest" }
+  },
+  "$defs": {
+    "identifier": {
+      "type": "string",
+      "pattern": "^[0-9A-Za-z](?:[0-9A-Za-z._-]{0,127})$"
+    },
+    "digest": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
+    "gitSha": { "type": "string", "pattern": "^[0-9a-f]{40}$" },
+    "repoRelativePath": {
+      "type": "string",
+      "minLength": 1,
+      "description": "Repo-relative path. Absolute paths, `..` traversal, empty segments, control characters and `\\` separators are rejected.",
+      "pattern": "^(?!/)(?!.*(?:^|/)\\.\\.?(?:/|$))[^\\u0000-\\u001f\\u007f\\\\]+$"
+    },
+    "repoRelativePathOrPrefix": {
+      "type": "string",
+      "minLength": 1,
+      "description": "Same as `repoRelativePath` but a trailing `/` is allowed to declare a directory write prefix.",
+      "pattern": "^(?!/)(?!.*(?:^|/)\\.\\.?(?:/|$))[^\\u0000-\\u001f\\u007f\\\\]+/?$"
+    },
+    "sensorQuery": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id", "operation"],
+      "properties": {
+        "id": { "$ref": "#/$defs/identifier" },
+        "operation": {
+          "enum": ["status", "query", "callers", "callees", "impact", "affected"]
+        },
+        "target": { "type": "string", "minLength": 1 }
+      },
+      "$comment": "`id` must be unique across the query set."
+    },
+    "sensorExpect": {
+      "oneOf": [
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["kind", "name", "path"],
+          "properties": {
+            "kind": { "const": "symbol" },
+            "name": { "type": "string", "minLength": 1 },
+            "path": { "$ref": "#/$defs/repoRelativePath" }
+          }
+        },
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["kind", "path"],
+          "properties": {
+            "kind": { "enum": ["path", "affected"] },
+            "path": { "$ref": "#/$defs/repoRelativePath" }
+          }
+        }
+      ]
+    },
+    "manualWitness": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "owns",
+        "reads",
+        "writes",
+        "resources",
+        "state_effects",
+        "sensor_provenance",
+        "affected_tests",
+        "unknowns"
+      ],
+      "properties": {
+        "owns": {
+          "type": "array",
+          "maxItems": 256,
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["kind", "target"],
+            "properties": {
+              "kind": { "enum": ["symbol", "path"] },
+              "target": { "type": "string", "minLength": 1, "maxLength": 1024 }
+            }
+          }
+        },
+        "reads": {
+          "type": "array",
+          "maxItems": 256,
+          "items": { "$ref": "#/$defs/repoRelativePath" }
+        },
+        "writes": {
+          "type": "array",
+          "maxItems": 256,
+          "items": { "$ref": "#/$defs/repoRelativePathOrPrefix" }
+        },
+        "resources": {
+          "type": "array",
+          "maxItems": 256,
+          "items": { "$ref": "#/$defs/identifier" }
+        },
+        "state_effects": {
+          "type": "array",
+          "maxItems": 256,
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["resource_id", "kind"],
+            "properties": {
+              "resource_id": { "$ref": "#/$defs/identifier" },
+              "kind": {
+                "enum": ["state", "schema", "invariant", "effect", "external_effect"]
+              }
+            }
+          }
+        },
+        "sensor_provenance": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["queries"],
+          "properties": {
+            "queries": {
+              "type": "array",
+              "maxItems": 256,
+              "items": {
+                "type": "object",
+                "additionalProperties": false,
+                "required": ["query_id", "expect"],
+                "properties": {
+                  "query_id": { "$ref": "#/$defs/identifier" },
+                  "expect": { "$ref": "#/$defs/sensorExpect" }
+                }
+              }
+            }
+          }
+        },
+        "affected_tests": {
+          "type": "array",
+          "maxItems": 256,
+          "items": { "$ref": "#/$defs/repoRelativePath" }
+        },
+        "unknowns": {
+          "type": "array",
+          "maxItems": 256,
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["kind", "ref"],
+            "properties": {
+              "kind": { "$ref": "#/$defs/identifier" },
+              "ref": { "type": "string", "minLength": 1 }
+            }
+          }
+        }
+      }
+    }
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@quolu/lattice",
-  "version": "0.12.19",
+  "version": "0.12.21",
   "description": "Lattice — phase-aware TODO graph compiler and conflict-aware orchestration runtime",
   "type": "module",
   "license": "MIT",
@@ -21,6 +21,9 @@
     "docs/schemas/lattice.plan_create_input.v1.schema.json",
     "docs/schemas/lattice.plan_create_input.v2.schema.json",
     "docs/schemas/lattice.plan_create_input.v3.schema.json",
+    "docs/schemas/lattice.run_request.v1.schema.json",
+    "docs/schemas/lattice.executor_packet.v1.schema.json",
+    "docs/schemas/lattice.executor_receipt.v1.schema.json",
     "docs/bridge-setup.md",
     "sensor/dist",
     "!sensor/dist/bin/lattice-sensor.*",

package/src/cli-help.mjs

@@ -24,12 +24,14 @@ Commands:
   create --schema --json
   create --schema-version <2|3> --json
   compile --request <request.json>
+  compile --schema --json            # lattice.run_request.v1 の JSON Schema を出す
   verify --request <request.json> --plan <plan.json>
 `,
   run: `Usage: lattice run <command> [options]
 
 Commands:
   start --request <request.json> --executor <adapter>
+  start --schema --json              # lattice.run_request.v1 の JSON Schema を出す
   observe --run .lattice/runs/<id>
   status --run .lattice/runs/<id>
   resume --run .lattice/runs/<id>
@@ -97,9 +99,9 @@ registerはLATTICE_BRIDGE_REGISTRAR_SSH_HOSTとLATTICE_BRIDGE_REGISTRAR_SCRIPT
 
 const SUBCOMMAND_USAGE = Object.freeze({
   'plan create': 'plan create --input <file> | --schema --json | --schema-version <2|3> --json',
-  'plan compile': 'plan compile --request <request.json>',
+  'plan compile': 'plan compile --request <request.json> | --schema --json',
   'plan verify': 'plan verify --request <request.json> --plan <plan.json>',
-  'run start': 'run start --request <request.json> --executor <adapter>',
+  'run start': 'run start --request <request.json> --executor <adapter> | --schema --json',
   'run observe': 'run observe --run .lattice/runs/<id>',
   'run status': 'run status --run .lattice/runs/<id>',
   'run resume': 'run resume --run .lattice/runs/<id>',

package/src/runtime-cli.mjs

@@ -24,6 +24,7 @@ import {
   evidenceFromCollectedOutcomes,
 } from './runtime-front-end.mjs';
 import {
+  explainRunRequest,
   validateRunRequest,
   validateRuntimeBoundaryManifest,
   validateRuntimePlan,
@@ -247,10 +248,31 @@ function canonicalNow() {
   return new Date().toISOString();
 }
 
+/**
+ * 同梱の`lattice.run_request.v1` JSON Schemaをstdoutへ出す（ADR 0123）。
+ * hostがrequestを推測で組まずに済むよう、契約を配布物から直接取れるようにする。
+ */
+async function runRequestSchema({ stdout }) {
+  const schemaUrl = new URL('../docs/schemas/lattice.run_request.v1.schema.json', import.meta.url);
+  const schema = JSON.parse(await readFile(schemaUrl, 'utf8'));
+  if (schema?.title !== 'lattice.run_request.v1') {
+    throw new CliContractError('CONTRACT_VIOLATION', '同梱run_request schemaが不正');
+  }
+  stdout.write(`${JSON.stringify(schema)}\n`);
+  return 0;
+}
+
 async function loadRequest(requestPath) {
   const request = await readBoundedJson(requestPath, 'run request');
-  if (!validateRunRequest(request)) {
-    throw new CliContractError('INVALID_RUN_REQUEST', 'run_request.v1 contractを満たさない');
+  const verdict = explainRunRequest(request);
+  if (!verdict.valid) {
+    // 拒否理由と違反箇所を返す（ADR 0123）。TODO面と同じdiagnosabilityへ揃え、
+    // hostがschemaを推測せずにrequestを直せるようにする。
+    throw new CliContractError(
+      'INVALID_RUN_REQUEST',
+      'run_request.v1 contractを満たさない',
+      { reason: verdict.reason, path: verdict.path },
+    );
   }
   return request;
 }
@@ -2753,6 +2775,14 @@ export async function runRuntimeCli({ argv, cwd, stdout, stderr }) {
   }
   let action = null;
   if (argv.length === 4
+    && argv[0] === 'plan' && argv[1] === 'compile'
+    && argv[2] === '--schema' && argv[3] === '--json') {
+    action = () => runRequestSchema({ stdout });
+  } else if (argv.length === 4
+    && argv[0] === 'run' && argv[1] === 'start'
+    && argv[2] === '--schema' && argv[3] === '--json') {
+    action = () => runRequestSchema({ stdout });
+  } else if (argv.length === 4
     && argv[0] === 'plan' && argv[1] === 'compile' && argv[2] === '--request'
     && typeof argv[3] === 'string' && argv[3].length > 0) {
     action = () => planCompile({ requestPath: path.resolve(cwd, argv[3]), cwd, stdout });

package/src/runtime-contracts.mjs

@@ -164,7 +164,7 @@ function unknownEntry(value) {
     && value.ref.length > 0;
 }
 
-const MANUAL_WITNESS_FIELDS = Object.freeze([
+export const MANUAL_WITNESS_FIELDS = Object.freeze([
   'owns',
   'reads',
   'writes',
@@ -175,18 +175,8 @@ const MANUAL_WITNESS_FIELDS = Object.freeze([
   'unknowns',
 ]);
 
-function manualWitnessEntry(value) {
-  return plainObject(value)
-    && exactRecord(value, MANUAL_WITNESS_FIELDS)
-    && boundedArray(value.owns, ownEntry)
-    && repoPathArray(value.reads)
-    && repoPathArray(value.writes, { allowPrefix: true })
-    && boundedArray(value.resources, identifier)
-    && boundedArray(value.state_effects, stateEffectEntry)
-    && plainObject(value.sensor_provenance)
-    && repoPathArray(value.affected_tests)
-    && boundedArray(value.unknowns, unknownEntry);
-}
+// manual witness entryの判定は`explainRunRequest`だけが所有する。
+// 同じ規則をbooleanと診断の二箇所へ持たないための単一正本化（ADR 0123）。
 
 function boundedArray(value, predicate, { min = 0, max = MAX_COLLECTION } = {}) {
   return Array.isArray(value)
@@ -231,43 +221,139 @@ const WITNESS_PROVENANCE = Object.freeze([
   'manual_state_effect',
 ]);
 
+export const RUN_REQUEST_FIELDS = Object.freeze([
+  'schema',
+  'request_id',
+  'repo',
+  'capacity',
+  'todos',
+  'manual_witness',
+  'sensor_query_set',
+  'executor_capability',
+  'claim_mode',
+  'request_digest',
+]);
+
+export const RUN_REQUEST_CLAIM_MODE = 'exact_minimum';
+
+/**
+ * `sensor_query_set.queries[].operation`のclosed set。
+ * runtime front-endはこの定数を輸入して使う（同じ閉集合を二箇所へ持たない）。
+ */
+export const SENSOR_QUERY_OPERATIONS = Object.freeze([
+  'status',
+  'query',
+  'callers',
+  'callees',
+  'impact',
+  'affected',
+]);
+
+/** `manual_witness[].sensor_provenance.queries[].expect.kind`のclosed set。 */
+export const SENSOR_EXPECT_KINDS = Object.freeze(['symbol', 'path', 'affected']);
+
+/** `sensor_provenance` entryのexpectを検査する（front-end adapter契約と同一規則）。 */
+function sensorExpect(value) {
+  if (!plainObject(value) || !SENSOR_EXPECT_KINDS.includes(value.kind)) return false;
+  if (value.kind === 'symbol') {
+    return exactRecord(value, ['kind', 'name', 'path'])
+      && typeof value.name === 'string' && value.name.length > 0
+      && repoRelativePath(value.path);
+  }
+  return exactRecord(value, ['kind', 'path']) && repoRelativePath(value.path);
+}
+
+/**
+ * `lattice.run_request.v1`の唯一の判定正本（ADR 0123）。
+ * 受理は`{ valid: true }`、拒否は最初の違反の`reason`と`path`を返す。
+ * `validateRunRequest`は本関数へ委譲するため、boolean判定と診断が乖離しない。
+ */
+export function explainRunRequest(value) {
+  const reject = (reason, at) => ({ valid: false, reason, path: at });
+  try {
+    canonicalizeArtifact(value);
+  } catch {
+    return reject('non_canonical_request_bytes', '');
+  }
+  if (!exactRecord(value, RUN_REQUEST_FIELDS)) return reject('unexpected_or_missing_top_level_keys', '');
+  if (value.schema !== 'lattice.run_request.v1') return reject('schema_mismatch', '/schema');
+  if (!identifier(value.request_id)) return reject('invalid_identifier', '/request_id');
+  if (!exactRecord(value.repo, ['base_sha', 'root_kind'])) return reject('unexpected_or_missing_keys', '/repo');
+  if (!gitSha(value.repo.base_sha)) return reject('invalid_git_sha', '/repo/base_sha');
+  if (!identifier(value.repo.root_kind)) return reject('invalid_identifier', '/repo/root_kind');
+  if (!exactRecord(value.capacity, ['executors'])) return reject('unexpected_or_missing_keys', '/capacity');
+  if (!positiveInteger(value.capacity.executors)) return reject('not_a_positive_integer', '/capacity/executors');
+  if (!Array.isArray(value.todos) || value.todos.length < 1 || value.todos.length > MAX_COLLECTION) {
+    return reject('bounded_collection_violation', '/todos');
+  }
+  for (const [index, todo] of value.todos.entries()) {
+    if (!exactRecord(todo, ['todo_id'])) return reject('unexpected_or_missing_keys', `/todos/${index}`);
+    if (!identifier(todo.todo_id)) return reject('invalid_identifier', `/todos/${index}/todo_id`);
+  }
+  const todoIds = value.todos.map((todo) => todo.todo_id);
+  if (new Set(todoIds).size !== todoIds.length) return reject('duplicate_todo_id', '/todos');
+  if (!plainObject(value.manual_witness)) return reject('not_an_object', '/manual_witness');
+  if (!exactRecord(value.manual_witness, todoIds)) {
+    return reject('manual_witness_keys_must_equal_todo_ids', '/manual_witness');
+  }
+  for (const todoId of todoIds) {
+    const witness = value.manual_witness[todoId];
+    const at = `/manual_witness/${todoId}`;
+    if (!plainObject(witness)) return reject('not_an_object', at);
+    if (!exactRecord(witness, MANUAL_WITNESS_FIELDS)) return reject('unexpected_or_missing_keys', at);
+    if (!boundedArray(witness.owns, ownEntry)) return reject('invalid_own_entries', `${at}/owns`);
+    if (!repoPathArray(witness.reads)) return reject('invalid_repo_relative_paths', `${at}/reads`);
+    if (!repoPathArray(witness.writes, { allowPrefix: true })) return reject('invalid_repo_relative_paths', `${at}/writes`);
+    if (!boundedArray(witness.resources, identifier)) return reject('invalid_identifier', `${at}/resources`);
+    if (!boundedArray(witness.state_effects, stateEffectEntry)) return reject('invalid_state_effect_entries', `${at}/state_effects`);
+    // sensor_provenanceもfront-end adapter契約のshapeまで検査する（ADR 0123）。
+    const provenanceAt = `${at}/sensor_provenance`;
+    if (!exactRecord(witness.sensor_provenance, ['queries'])) return reject('unexpected_or_missing_keys', provenanceAt);
+    if (!Array.isArray(witness.sensor_provenance.queries)
+      || witness.sensor_provenance.queries.length > MAX_COLLECTION) {
+      return reject('bounded_collection_violation', `${provenanceAt}/queries`);
+    }
+    for (const [index, entry] of witness.sensor_provenance.queries.entries()) {
+      const entryAt = `${provenanceAt}/queries/${index}`;
+      if (!exactRecord(entry, ['query_id', 'expect'])) return reject('unexpected_or_missing_keys', entryAt);
+      if (!identifier(entry.query_id)) return reject('invalid_identifier', `${entryAt}/query_id`);
+      if (!sensorExpect(entry.expect)) return reject('invalid_sensor_expect', `${entryAt}/expect`);
+    }
+    if (!repoPathArray(witness.affected_tests)) return reject('invalid_repo_relative_paths', `${at}/affected_tests`);
+    if (!boundedArray(witness.unknowns, unknownEntry)) return reject('invalid_unknown_entries', `${at}/unknowns`);
+  }
+  // sensor_query_set／executor_capabilityは、runtime front-endとrun startが実際に要求する
+  // shapeまで検査する。schemaで通ってから後段で落ちる契約分裂を残さない（ADR 0123）。
+  if (!exactRecord(value.sensor_query_set, ['queries'])) return reject('unexpected_or_missing_keys', '/sensor_query_set');
+  if (!Array.isArray(value.sensor_query_set.queries) || value.sensor_query_set.queries.length > MAX_COLLECTION) {
+    return reject('bounded_collection_violation', '/sensor_query_set/queries');
+  }
+  const queryIds = new Set();
+  for (const [index, query] of value.sensor_query_set.queries.entries()) {
+    const at = `/sensor_query_set/queries/${index}`;
+    const keys = plainObject(query) && Object.hasOwn(query, 'target')
+      ? ['id', 'operation', 'target'] : ['id', 'operation'];
+    if (!exactRecord(query, keys)) return reject('unexpected_or_missing_keys', at);
+    if (!identifier(query.id)) return reject('invalid_identifier', `${at}/id`);
+    if (!SENSOR_QUERY_OPERATIONS.includes(query.operation)) return reject('unknown_sensor_query_operation', `${at}/operation`);
+    if (keys.includes('target') && (typeof query.target !== 'string' || query.target.length === 0)) {
+      return reject('empty_query_target', `${at}/target`);
+    }
+    if (queryIds.has(query.id)) return reject('duplicate_query_id', `${at}/id`);
+    queryIds.add(query.id);
+  }
+  if (!exactRecord(value.executor_capability, ['adapters'])) return reject('unexpected_or_missing_keys', '/executor_capability');
+  if (!uniqueIdentifierArray(value.executor_capability.adapters, { min: 1 })) {
+    return reject('invalid_adapter_identifiers', '/executor_capability/adapters');
+  }
+  if (value.claim_mode !== RUN_REQUEST_CLAIM_MODE) return reject('claim_mode_must_be_exact_minimum', '/claim_mode');
+  if (!selfDigestValid(value, 'request_digest')) return reject('request_digest_mismatch', '/request_digest');
+  return { valid: true };
+}
+
 /** `lattice.run_request.v1`。manual witnessはTODOごとに完備でなければならない。 */
 export function validateRunRequest(value) {
-  return validateSafely(value, (request) => {
-    if (!exactRecord(request, [
-      'schema',
-      'request_id',
-      'repo',
-      'capacity',
-      'todos',
-      'manual_witness',
-      'sensor_query_set',
-      'executor_capability',
-      'claim_mode',
-      'request_digest',
-    ])
-      || request.schema !== 'lattice.run_request.v1'
-      || !identifier(request.request_id)
-      || !exactRecord(request.repo, ['base_sha', 'root_kind'])
-      || !gitSha(request.repo.base_sha)
-      || !identifier(request.repo.root_kind)
-      || !exactRecord(request.capacity, ['executors'])
-      || !positiveInteger(request.capacity.executors)
-      || !boundedArray(request.todos, (todo) => (
-        exactRecord(todo, ['todo_id']) && identifier(todo.todo_id)
-      ), { min: 1 })) {
-      return false;
-    }
-    const todoIds = request.todos.map((todo) => todo.todo_id);
-    if (new Set(todoIds).size !== todoIds.length) return false;
-    return plainObject(request.manual_witness)
-      && exactRecord(request.manual_witness, todoIds)
-      && Object.values(request.manual_witness).every(manualWitnessEntry)
-      && plainObject(request.sensor_query_set)
-      && plainObject(request.executor_capability)
-      && request.claim_mode === 'exact_minimum'
-      && selfDigestValid(request, 'request_digest');
-  });
+  return explainRunRequest(value).valid;
 }
 
 /**

package/src/runtime-front-end.mjs

@@ -6,6 +6,8 @@ import { portableSensorOutcome } from './sensor-adapter.mjs';
 import { compileSchedulabilityGraphV2 } from './schedulability-compiler-v2.mjs';
 import { verifySchedulabilityPlanV2 } from './schedulability-verifier-v2.mjs';
 import {
+  SENSOR_EXPECT_KINDS,
+  SENSOR_QUERY_OPERATIONS,
   selfDigest,
   validateRunRequest,
   validateRuntimeBoundaryManifest,
@@ -36,16 +38,10 @@ import {
  * portable outcome projectionのcanonical digestだけを入れる（Decision 10.4）。
  */
 
-const QUERY_OPERATIONS = Object.freeze([
-  'status',
-  'query',
-  'callers',
-  'callees',
-  'impact',
-  'affected',
-]);
+// 閉集合の正本はruntime-contracts。ここでは輸入して使う。
+const QUERY_OPERATIONS = SENSOR_QUERY_OPERATIONS;
 const STRUCTURE_OPERATIONS = new Set(['query', 'callers', 'callees', 'impact']);
-const EXPECT_KINDS = new Set(['symbol', 'path', 'affected']);
+const EXPECT_KINDS = new Set(SENSOR_EXPECT_KINDS);
 const IDENTIFIER = /^[0-9A-Za-z](?:[0-9A-Za-z._-]{0,127})$/;
 const STATE_KIND_MAP = Object.freeze({
   state: 'state',

package/src/todo-gantt-html.mjs

@@ -3,7 +3,7 @@ import { createHash } from 'node:crypto';
 import { serializeJsonForScript } from './todo-markdown-renderer.mjs';
 import { renderTodoGanttSvg, TODO_GANTT_STATUS_PRESENTATION } from './todo-gantt-svg.mjs';
 
-export const TODO_GANTT_RENDERER_VERSION = 'lattice.todo_gantt_renderer.v15';
+export const TODO_GANTT_RENDERER_VERSION = 'lattice.todo_gantt_renderer.v16';
 export const TODO_GANTT_PROSE_MAX_BYTES = 8 * 1024 * 1024;
 export const TODO_GANTT_HTML_MAX_BYTES = 24 * 1024 * 1024;
 
@@ -43,6 +43,10 @@ function refKey(ref) {
   return JSON.stringify([ref.project_id, ref.plan_key, ref.task_id]);
 }
 
+function compareText(left, right) {
+  return left < right ? -1 : left > right ? 1 : 0;
+}
+
 function digest(value) {
   return createHash('sha256').update(value, 'utf8').digest('hex');
 }
@@ -108,16 +112,37 @@ function renderTaskIndexEntry(section, lookup) {
   return `<li><button type="button" data-select-node-key="${escapeHtmlAttribute(selectKey)}"><span class="task-index-status status-${escapeHtmlAttribute(section.state.status)}" role="img" aria-label="${escapeHtmlAttribute(status.label)}">${escapeHtmlText(status.mark)}</span><span class="task-index-reference">${escapeHtmlText(taskReference(section, lookup))}</span><strong>${escapeHtmlText(section.task.title)}</strong>${blockedReason}</button></li>`;
 }
 
-function renderTaskIndex(sections, lookup, folds = new Set()) {
-  const plans = [];
+/** plan_key -> 最終活動時刻。journalの末尾eventが、そのplanが最後に動いた時点。 */
+function planActivity(readModel) {
+  return new Map((readModel?.members ?? []).map((member) => {
+    const events = member.journal?.events ?? [];
+    const last = events.at(-1)?.recorded_at ?? events[0]?.recorded_at ?? '';
+    return [member.plan.plan_key, last];
+  }));
+}
+
+function renderTaskIndex(sections, lookup, folds = new Set(), activity = new Map()) {
+  const byPlan = new Map();
   for (const section of sections) {
-    let plan = plans.at(-1);
-    if (plan === undefined || plan.planKey !== section.ref.plan_key) {
-      plan = { planKey: section.ref.plan_key, tasks: [] };
-      plans.push(plan);
-    }
-    plan.tasks.push(section);
+    if (!byPlan.has(section.ref.plan_key)) byPlan.set(section.ref.plan_key, []);
+    byPlan.get(section.ref.plan_key).push(section);
   }
+  // 全ToDoが図から外れたplanは終わった仕事。読む側が先に見たいのは動いているplanなので、
+  // 動いているものを最終活動の新しい順で上へ、終わったものを古い順で下へまとめる。
+  // plan内のToDo順は登録順のまま触らない。
+  const plans = [...byPlan.entries()].map(([planKey, tasks]) => ({
+    planKey,
+    tasks,
+    settled: tasks.every((section) => folds.has(refKey(section.ref))),
+    lastActivity: activity.get(planKey) ?? '',
+  }));
+  plans.sort((left, right) => {
+    if (left.settled !== right.settled) return left.settled ? 1 : -1;
+    const order = left.settled
+      ? compareText(left.lastActivity, right.lastActivity)
+      : compareText(right.lastActivity, left.lastActivity);
+    return order !== 0 ? order : compareText(left.planKey, right.planKey);
+  });
   return plans.map((plan) => {
     const drawn = plan.tasks.filter((section) => !folds.has(refKey(section.ref)));
     const folded = plan.tasks.filter((section) => folds.has(refKey(section.ref)));
@@ -247,8 +272,8 @@ function renderRightPane(sections, layout, presentation, readModel) {
       : '<p class="fold-note">完走済みのため図には描いていません。図に出すには <code>lattice todo gantt --scope all</code> を実行してください。</p>';
     return `<article class="task-detail" data-detail-key="${escapeHtmlAttribute(key)}" hidden><header><span class="detail-status status-${escapeHtmlAttribute(section.state.status)}">${escapeHtmlText(status.mark)} ${escapeHtmlText(status.label)}</span><span class="detail-reference">${escapeHtmlText(taskReference(section, lookup))}</span></header><h1>${escapeHtmlText(section.task.title)}</h1><p class="detail-category"><strong>カテゴリ:</strong> ${escapeHtmlText(category)}</p>${categoryDescription}<p><strong>正規ID:</strong> <code>${escapeHtmlText(`${section.ref.plan_key}/${section.task.task_id}`)}</code></p>${blockedReason}${readiness}${foldedNote}<section><h2>前提工程</h2>${renderRelationList(incoming.get(key), sectionByKey, lookup, '登録済みの前提工程はありません。', folds)}</section><section><h2>後続工程</h2>${renderRelationList(outgoing.get(key), sectionByKey, lookup, '登録済みの後続工程はありません。', folds)}</section><p class="anchor-status">${escapeHtmlText(anchorText)}</p><details class="task-diagnostics"><summary>開発者向け診断</summary><dl><dt>canonical ref</dt><dd><code>${escapeHtmlText(`${section.ref.project_id}/${section.ref.plan_key}/${section.task.task_id}`)}</code></dd><dt>anchor</dt><dd>${escapeHtmlText(section.anchorOutcome.anchored ? 'verified' : section.anchorOutcome.reason)}</dd></dl></details></article>`;
   }).join('');
-  const taskIndex = renderTaskIndex(sections, lookup, folds);
-  return `<div class="right-toolbar"><button type="button" data-show-overview>概要</button><button type="button" data-show-selected hidden>選択工程へ戻る</button><button type="button" data-show-task-index>全工程一覧</button></div><div class="right-content">${overview}<div data-right-panel="details" hidden>${details}</div><section class="task-index" data-right-panel="task-index" hidden><h1>全工程</h1><p>Latticeに登録された全工程を、現在の状態とともに登録順で表示しています。</p>${taskIndex}</section></div>`;
+  const taskIndex = renderTaskIndex(sections, lookup, folds, planActivity(readModel));
+  return `<div class="right-toolbar"><button type="button" data-show-overview>概要</button><button type="button" data-show-selected hidden>選択工程へ戻る</button><button type="button" data-show-task-index>全工程一覧</button></div><div class="right-content">${overview}<div data-right-panel="details" hidden>${details}</div><section class="task-index" data-right-panel="task-index" hidden><h1>全工程</h1><p>Latticeに登録された全工程を現在の状態とともに表示しています。planは動いているものを最終活動の新しい順で上に、完走したものを古い順で下にまとめ、plan内は登録順です。</p>${taskIndex}</section></div>`;
 }
 
 function renderDiagramLegend(presentation, layout = null, expandable = false) {