@quolu/lattice 0.59.0 → 0.60.0

package/bin/lattice.mjs

@@ -73,6 +73,26 @@ if (sensorRelaunchStatus !== null) {
   } catch (error) {
     process.exitCode = projectCliFailure(process.stderr, error);
   }
+} else if (args.length === 7 && args[0] === 'plan' && args[1] === 'scope-review'
+  && args[2] === '--plan-input' && args[4] === '--review' && args[6] === '--json') {
+  const { runPlanScopeReview } = await import('../src/plan-scope-review.mjs');
+  const { projectCliFailure } = await import('../src/project-cli.mjs');
+  try {
+    process.exitCode = await runPlanScopeReview({
+      cwd: process.cwd(), planInputRef: args[3], reviewRef: args[5], stdout: process.stdout,
+    });
+  } catch (error) {
+    process.exitCode = projectCliFailure(process.stderr, error);
+  }
+} else if (args.length === 4 && args[0] === 'plan' && args[1] === 'scope-review'
+  && args[2] === '--schema' && args[3] === '--json') {
+  const { runPlanScopeReviewSchema } = await import('../src/plan-scope-review.mjs');
+  const { projectCliFailure } = await import('../src/project-cli.mjs');
+  try {
+    process.exitCode = await runPlanScopeReviewSchema({ stdout: process.stdout });
+  } catch (error) {
+    process.exitCode = projectCliFailure(process.stderr, error);
+  }
 } else if (args.length === 2 && args[0] === 'factory-diagnostics' && args[1] === '--json') {
   const { buildFactoryDiagnostics } = await import('../src/factory-diagnostics.mjs');
   const diagnostics = await buildFactoryDiagnostics();

package/docs/schemas/lattice.executor_packet.v1.schema.json

@@ -39,9 +39,9 @@
     },
     "forbidden_operations": {
       "type": "array",
-      "minItems": 1,
       "maxItems": 256,
-      "items": { "type": "string" }
+      "items": { "type": "string" },
+      "description": "Compatibility field. Lattice-produced packets use an empty array; operation authority belongs to the host."
     },
     "context_content_digest": { "$ref": "#/$defs/digest" },
     "packet_digest": { "$ref": "#/$defs/digest" }

package/docs/schemas/lattice.plan_create_input.v4.schema.json

@@ -2,7 +2,7 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://github.com/kitepon-rgb/Lattice/blob/main/docs/schemas/lattice.plan_create_input.v4.schema.json",
   "title": "lattice.plan_create_input.v4",
-  "description": "Canonical initial authoring input for a phase-audited plan. Every task requires a design memo. あなたがこのToDoに対して、何も考えていないならば、設計メモに `NO_PLAN` と書いてください",
+  "description": "Canonical initial authoring input for a phase-audited plan. Every task requires a design memo. After the complete plan is written, run `lattice plan scope-review` and confirm that every task preserves an owner-supplied work specification without adding a product purpose. あなたがこのToDoに対して、何も考えていないならば、設計メモに `NO_PLAN` と書いてください",
   "$comment": "Runtime validation additionally enforces canonical JSON+LF bytes, sorted identifiers and edges, unique ids, combined task/phase acyclicity, byte bounds, non-empty design_memo, and input_digest.",
   "type": "object",
   "additionalProperties": false,

package/docs/schemas/lattice.plan_scope_review.v1.schema.json

@@ -0,0 +1,55 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/kitepon-rgb/Lattice/blob/main/docs/schemas/lattice.plan_scope_review.v1.schema.json",
+  "title": "lattice.plan_scope_review.v1",
+  "description": "AI-authored review performed after the complete plan is written and before it is registered. Every planned task is judged against the owner-supplied work specifications; task splitting and parallelization are allowed, but a new product purpose is not.",
+  "$comment": "Lattice validates complete task coverage, known work-spec references, verdict consistency, and digest binding. The operating AI owns the semantic judgment.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema", "authoring_digest", "work_specs", "task_assessments", "verdict", "review_digest"
+  ],
+  "properties": {
+    "schema": { "const": "lattice.plan_scope_review.v1" },
+    "authoring_digest": { "$ref": "#/$defs/digest" },
+    "work_specs": {
+      "type": "array", "minItems": 1, "maxItems": 512,
+      "description": "The owner-supplied work specifications. Do not add inferred improvements as work specifications.",
+      "items": { "$ref": "#/$defs/workSpec" }
+    },
+    "task_assessments": {
+      "type": "array", "minItems": 1, "maxItems": 512,
+      "description": "Exactly one assessment for every task that will be registered. Use out_of_scope when the task creates a purpose not required by any work specification.",
+      "items": { "$ref": "#/$defs/taskAssessment" }
+    },
+    "verdict": { "enum": ["scope_preserved", "scope_mismatch"] },
+    "review_digest": { "$ref": "#/$defs/digest" }
+  },
+  "$defs": {
+    "identifier": { "type": "string", "pattern": "^[0-9A-Za-z](?:[0-9A-Za-z._-]{0,127})$" },
+    "digest": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
+    "text": { "type": "string", "minLength": 1, "maxLength": 16384, "pattern": "\\S" },
+    "workSpec": {
+      "type": "object", "additionalProperties": false,
+      "required": ["work_spec_id", "requirement", "acceptance"],
+      "properties": {
+        "work_spec_id": { "$ref": "#/$defs/identifier" },
+        "requirement": { "$ref": "#/$defs/text" },
+        "acceptance": { "$ref": "#/$defs/text" }
+      }
+    },
+    "taskAssessment": {
+      "type": "object", "additionalProperties": false,
+      "required": ["task_id", "work_spec_ids", "judgment", "reason"],
+      "properties": {
+        "task_id": { "$ref": "#/$defs/identifier" },
+        "work_spec_ids": {
+          "type": "array", "maxItems": 512, "uniqueItems": true,
+          "items": { "$ref": "#/$defs/identifier" }
+        },
+        "judgment": { "enum": ["required", "out_of_scope"] },
+        "reason": { "$ref": "#/$defs/text" }
+      }
+    }
+  }
+}

package/docs/schemas/lattice.todo_extraction.v3.schema.json

@@ -2,7 +2,7 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://github.com/kitepon-rgb/Lattice/blob/main/docs/schemas/lattice.todo_extraction.v3.schema.json",
   "title": "lattice.todo_extraction.v3",
-  "description": "AI-authored ToDo migration artifact. Every task carries a non-blank Markdown design_memo. If no plan exists, write NO_PLAN explicitly.",
+  "description": "AI-authored ToDo migration artifact. Every task carries a non-blank Markdown design_memo. After the complete plan is written, run `lattice plan scope-review` and confirm that every registered task preserves an owner-supplied work specification without adding a product purpose. If no plan exists, write NO_PLAN explicitly.",
   "$comment": "あなたがこのToDoに対して、何も考えていないならば、設計メモに `NO_PLAN` と書いてください。Runtime validation also enforces UTF-8 byte bounds, exact keys, strict sort order, referential integrity, disposition consistency, and the canonical self-digest.",
   "type": "object",
   "additionalProperties": false,
@@ -22,7 +22,11 @@
       "type": "array", "maxItems": 2048,
       "items": {
         "type": "object", "additionalProperties": false, "required": ["from", "to"],
-        "properties": { "from": { "$ref": "#/$defs/nodeRef" }, "to": { "$ref": "#/$defs/nodeRef" } }
+        "properties": {
+          "from": { "$ref": "#/$defs/nodeRef" },
+          "to": { "$ref": "#/$defs/nodeRef" },
+          "reason": { "$ref": "#/$defs/text" }
+        }
       }
     },
     "joins": {

package/docs/schemas/lattice.todo_extraction.v4.schema.json

@@ -0,0 +1,161 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/kitepon-rgb/Lattice/blob/main/docs/schemas/lattice.todo_extraction.v4.schema.json",
+  "title": "lattice.todo_extraction.v4",
+  "description": "AI-authored ToDo migration artifact. Every task carries a non-blank Markdown design_memo. After the complete plan is written, run `lattice plan scope-review` and confirm that every registered task preserves an owner-supplied work specification without adding a product purpose. If no plan exists, write NO_PLAN explicitly. Runtime validation accepts at most one explicit, reasoned cross-plan dependency; an empty tasks array is reserved for that one dependency between existing tasks, with the top-level plan identity naming the source plan and both endpoint topology digests.",
+  "$comment": "あなたがこのToDoに対して、何も考えていないならば、設計メモに `NO_PLAN` と書いてください。Runtime validation also enforces UTF-8 byte bounds, exact keys, strict sort order, referential integrity, disposition consistency, the cross-plan dependency limit, and the canonical self-digest.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema", "project_id", "plan_key", "plan_version", "actor", "recorded_at",
+    "tasks", "hard_dependencies", "joins", "extraction_digest"
+  ],
+  "properties": {
+    "schema": { "const": "lattice.todo_extraction.v4" },
+    "project_id": { "$ref": "#/$defs/identifier" },
+    "plan_key": { "$ref": "#/$defs/identifier" },
+    "plan_version": { "$ref": "#/$defs/identifier" },
+    "actor": { "$ref": "#/$defs/actor" },
+    "recorded_at": { "$ref": "#/$defs/strictTimestamp" },
+    "tasks": { "type": "array", "minItems": 0, "maxItems": 512, "items": { "$ref": "#/$defs/task" } },
+    "hard_dependencies": {
+      "type": "array", "maxItems": 2048,
+      "items": {
+        "type": "object", "additionalProperties": false, "required": ["from", "to"],
+        "properties": {
+          "from": { "$ref": "#/$defs/nodeRef" },
+          "to": { "$ref": "#/$defs/nodeRef" },
+          "reason": { "$ref": "#/$defs/text" }
+        }
+      }
+    },
+    "joins": {
+      "type": "array", "maxItems": 128,
+      "items": {
+        "type": "object", "additionalProperties": false, "required": ["id", "after", "before"],
+        "properties": {
+          "id": { "$ref": "#/$defs/identifier" },
+          "after": { "type": "array", "minItems": 1, "maxItems": 512, "items": { "$ref": "#/$defs/nodeRef" } },
+          "before": { "$ref": "#/$defs/nodeRef" }
+        }
+      }
+    },
+    "extraction_digest": { "$ref": "#/$defs/digest" }
+  },
+  "allOf": [
+    {
+      "if": { "properties": { "tasks": { "maxItems": 0 } }, "required": ["tasks"] },
+      "then": {
+        "properties": {
+          "hard_dependencies": { "minItems": 1, "maxItems": 1 },
+          "joins": { "maxItems": 0 }
+        }
+      }
+    }
+  ],
+  "$defs": {
+    "identifier": { "type": "string", "pattern": "^[0-9A-Za-z](?:[0-9A-Za-z._-]{0,127})$" },
+    "digest": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
+    "repoRef": {
+      "type": "string", "minLength": 1, "maxLength": 1024,
+      "pattern": "^(?!/)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*\\\\)(?!.*[\\u0000-\\u001f\\u007f])[^/]+(?:/[^/]+)*$"
+    },
+    "text": { "type": "string", "minLength": 1, "maxLength": 16384 },
+    "designMemo": {
+      "type": "string", "minLength": 1, "maxLength": 16384, "pattern": "\\S",
+      "description": "Markdown design memo. Use the literal NO_PLAN only when no plan exists."
+    },
+    "nullableText": { "oneOf": [{ "type": "null" }, { "$ref": "#/$defs/text" }] },
+    "strictTimestamp": {
+      "type": "string",
+      "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}\\.[0-9]{3}Z$"
+    },
+    "actor": {
+      "type": "object", "additionalProperties": false, "required": ["host", "session", "agent"],
+      "properties": {
+        "host": { "$ref": "#/$defs/identifier" },
+        "session": { "$ref": "#/$defs/identifier" },
+        "agent": { "$ref": "#/$defs/identifier" }
+      }
+    },
+    "nodeRef": {
+      "type": "object", "additionalProperties": false, "required": ["project_id", "plan_key", "task_id"],
+      "properties": {
+        "project_id": { "$ref": "#/$defs/identifier" },
+        "plan_key": { "$ref": "#/$defs/identifier" },
+        "task_id": { "$ref": "#/$defs/identifier" },
+        "expected_topology_digest": { "$ref": "#/$defs/digest" }
+      }
+    },
+    "sourceLocation": {
+      "type": "object", "additionalProperties": false,
+      "required": ["origin_plan_ref", "origin_line", "source_commit", "heading_path", "markdown_depth", "parent_task_id", "checkbox_state"],
+      "properties": {
+        "origin_plan_ref": { "$ref": "#/$defs/repoRef" },
+        "origin_line": { "type": "integer", "minimum": 1 },
+        "source_commit": { "type": "string", "pattern": "^(?:[0-9a-f]{40}|[0-9a-f]{64})$" },
+        "heading_path": { "type": "array", "maxItems": 32, "items": { "type": "string", "minLength": 1, "maxLength": 1024 } },
+        "markdown_depth": { "type": "integer", "minimum": 0, "maximum": 64 },
+        "parent_task_id": { "oneOf": [{ "type": "null" }, { "$ref": "#/$defs/identifier" }] },
+        "checkbox_state": { "enum": ["checked", "unchecked", "absent", "ambiguous"] }
+      }
+    },
+    "migrationContext": {
+      "type": "object", "additionalProperties": false,
+      "required": ["external_canonical_ref", "carry_over_ref", "h_required", "condition", "evidence_refs", "notes"],
+      "properties": {
+        "external_canonical_ref": { "$ref": "#/$defs/nullableText" },
+        "carry_over_ref": { "$ref": "#/$defs/nullableText" },
+        "h_required": { "type": "boolean" },
+        "condition": { "$ref": "#/$defs/nullableText" },
+        "evidence_refs": { "type": "array", "maxItems": 64, "items": { "type": "string", "minLength": 1, "maxLength": 4096 } },
+        "notes": { "type": "array", "maxItems": 64, "items": { "type": "string", "minLength": 1, "maxLength": 4096 } }
+      }
+    },
+    "historicalStart": {
+      "type": "object", "additionalProperties": false, "required": ["start_mode", "status", "started_at"],
+      "properties": {
+        "start_mode": { "const": "historical_import" }, "status": { "const": "in-progress" },
+        "started_at": { "oneOf": [{ "const": "unknown_requires_evidence" }, { "$ref": "#/$defs/strictTimestamp" }] }
+      }
+    },
+    "historicalCompletion": {
+      "type": "object", "additionalProperties": false, "required": ["done_mode", "completed_at"],
+      "properties": {
+        "done_mode": { "const": "historical_import" },
+        "completed_at": { "oneOf": [{ "const": "unknown_requires_evidence" }, { "$ref": "#/$defs/strictTimestamp" }] }
+      }
+    },
+    "task": {
+      "type": "object", "additionalProperties": false,
+      "required": [
+        "task_id", "title", "lane", "design_memo", "narrative_ref", "compile_binding",
+        "disposition", "start", "completion", "source", "migration_context"
+      ],
+      "properties": {
+        "task_id": { "$ref": "#/$defs/identifier" },
+        "title": { "$ref": "#/$defs/text" },
+        "lane": { "$ref": "#/$defs/identifier" },
+        "design_memo": { "$ref": "#/$defs/designMemo" },
+        "narrative_ref": { "oneOf": [{ "type": "null" }, { "$ref": "#/$defs/repoRef" }] },
+        "compile_binding": { "type": "null" },
+        "disposition": { "enum": ["register_pending", "register_in_progress", "register_done", "exclude_superseded", "exclude_compatibility_record", "unknown_requires_evidence"] },
+        "start": { "oneOf": [{ "type": "null" }, { "$ref": "#/$defs/historicalStart" }] },
+        "completion": { "oneOf": [{ "type": "null" }, { "$ref": "#/$defs/historicalCompletion" }] },
+        "source": { "$ref": "#/$defs/sourceLocation" },
+        "migration_context": { "$ref": "#/$defs/migrationContext" }
+      },
+      "allOf": [
+        {
+          "if": { "properties": { "disposition": { "const": "register_in_progress" } }, "required": ["disposition"] },
+          "then": { "properties": { "start": { "$ref": "#/$defs/historicalStart" }, "completion": { "type": "null" } } },
+          "else": {
+            "if": { "properties": { "disposition": { "const": "register_done" } }, "required": ["disposition"] },
+            "then": { "properties": { "start": { "type": "null" }, "completion": { "$ref": "#/$defs/historicalCompletion" } } },
+            "else": { "properties": { "start": { "type": "null" }, "completion": { "type": "null" } } }
+          }
+        }
+      ]
+    }
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@quolu/lattice",
-  "version": "0.59.0",
+  "version": "0.60.0",
   "description": "Schedulability compiler for multi-agent development: observe real code boundaries, refactor the conflicting seam, recompile the plan for parallel execution",
   "author": {
     "name": "Quo / クオ at kitepon.dev",
@@ -29,11 +29,13 @@
     "docs/schemas/lattice.plan_create_input.v2.schema.json",
     "docs/schemas/lattice.plan_create_input.v3.schema.json",
     "docs/schemas/lattice.plan_create_input.v4.schema.json",
+    "docs/schemas/lattice.plan_scope_review.v1.schema.json",
     "docs/schemas/lattice.todo_revision.v2.schema.json",
     "docs/schemas/lattice.todo_revision_set.v3.schema.json",
     "docs/schemas/lattice.phase_todo_revision.v3.schema.json",
     "docs/schemas/lattice.todo_extraction.v2.schema.json",
     "docs/schemas/lattice.todo_extraction.v3.schema.json",
+    "docs/schemas/lattice.todo_extraction.v4.schema.json",
     "docs/schemas/lattice.todo_structure_set.v1.schema.json",
     "docs/schemas/lattice.todo_structure_realization.v1.schema.json",
     "docs/schemas/lattice.todo_structure_binding.v1.schema.json",

package/src/cli-help.mjs

@@ -91,7 +91,7 @@ Write commands:
   dashboard remove <project_id> --json  # 登録簿から1件外す（対象repoの外からも叩ける）
   note --plan <key> [--task <id>] (--message <text>|--input <file>)
       # ToDoへ作業継続に必要な方針・調査結果・注意をappend-onlyで追記する
-  migrate --input <extraction.json> [--serialization-reviewed]
+  migrate --input <extraction.json> [--serialization-reviewed] [--json]
   migrate --input <extraction.json> --dry-run --json [--serialization-reviewed]
       # 既存storeへplanを追加する（plan createは空store初期化専用）。
       # 依存グラフがほぼ一直線なら一度突き返し、再考後の --serialization-reviewed で通す
@@ -202,6 +202,7 @@ const SUBCOMMAND_USAGE = Object.freeze({
   'session-context': 'session-context --json',
   'plan create': 'plan create --input <file> [--serialization-reviewed] | --schema --json | --schema-version <1|2|3|4> --json',
   'plan show': 'plan show <plan_key> --json',
+  'plan scope-review': 'plan scope-review --plan-input <plan-create-or-extraction.json> --review <scope-review.json> --json | --schema --json',
   'plan compile': 'plan compile --request <request.json> | --schema --json',
   'plan verify': 'plan verify --request <request.json> --plan <plan.json>',
   'run start': 'run start --request <request.json> --executor <adapter>'
@@ -272,7 +273,7 @@ const SUBCOMMAND_USAGE = Object.freeze({
   'todo revise': 'todo revise --plan <key> --input <file> | --schema --json',
   'todo revise-phase': 'todo revise-phase --plan <key> --input <file> | --schema --json',
   'todo revise-set': 'todo revise-set --input <file> | --schema --json',
-  'todo migrate': 'todo migrate --input <extraction.json> [--serialization-reviewed] | --input <extraction.json> --dry-run --json [--serialization-reviewed] | --schema --json',
+  'todo migrate': 'todo migrate --input <extraction.json> [--serialization-reviewed] [--json] | --input <extraction.json> --dry-run --json [--serialization-reviewed] | --schema --json',
   'sensor init': 'sensor init [path] --json',
   'sensor sync': 'sensor sync [path] --json',
   'sensor diff': 'sensor diff <rootA> <rootB> [--subtree-a <rel>] [--subtree-b <rel>]'

package/src/plan-scope-review.mjs

@@ -0,0 +1,214 @@
+import { constants as fsConstants } from 'node:fs';
+import { lstat, open, realpath, readFile } from 'node:fs/promises';
+import path from 'node:path';
+
+import { gitSync } from './git-process.mjs';
+import {
+  exactRecord,
+  isTodoDigest,
+  isTodoIdentifier,
+  isTodoRef,
+  todoSelfDigest,
+} from './todo-contracts.mjs';
+import { TodoStoreError } from './todo-store.mjs';
+
+const REVIEW_SCHEMA = 'lattice.plan_scope_review.v1';
+const RESULT_SCHEMA = 'lattice.plan_scope_review_result.v1';
+const PLAN_CREATE_SCHEMA = 'lattice.plan_create_input.v4';
+const TODO_EXTRACTION_SCHEMAS = new Set([
+  'lattice.todo_extraction.v3',
+  'lattice.todo_extraction.v4',
+]);
+const MAX_INPUT_BYTES = 8_388_608;
+const JUDGMENTS = new Set(['required', 'out_of_scope']);
+
+function boundedText(value) {
+  return typeof value === 'string' && value.trim().length > 0
+    && Buffer.byteLength(value) <= 16_384;
+}
+
+function sortedStrictly(values, key = (value) => value) {
+  return values.every((value, index) => index === 0 || key(values[index - 1]) < key(value));
+}
+
+function within(root, candidate) {
+  return candidate.startsWith(`${root}${path.sep}`);
+}
+
+function resolveRepoRoot(cwd) {
+  try {
+    return path.resolve(gitSync(['rev-parse', '--show-toplevel'], {
+      cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'],
+    }).replace(/\r?\n$/u, ''));
+  } catch {
+    return null;
+  }
+}
+
+async function readJsonWithinRepo(repoRoot, inputRef) {
+  if (!isTodoRef(inputRef)) {
+    throw new TodoStoreError('INPUT_UNREADABLE', 'input_path_outside_repo', undefined,
+      { input_ref: inputRef });
+  }
+  const canonicalRoot = await realpath(repoRoot);
+  const absolute = path.resolve(canonicalRoot, inputRef);
+  if (!within(canonicalRoot, absolute)) {
+    throw new TodoStoreError('INPUT_UNREADABLE', 'input_path_outside_repo', undefined,
+      { input_ref: inputRef });
+  }
+  let stats;
+  try { stats = await lstat(absolute); } catch {
+    throw new TodoStoreError('INPUT_UNREADABLE', 'input_unreadable', undefined,
+      { input_ref: inputRef });
+  }
+  if (!stats.isFile() || stats.isSymbolicLink() || stats.size > MAX_INPUT_BYTES
+    || await realpath(absolute) !== absolute) {
+    throw new TodoStoreError('INPUT_UNREADABLE', 'input_path_unsafe', undefined,
+      { input_ref: inputRef });
+  }
+  let value;
+  try { value = JSON.parse(await readFile(absolute, 'utf8')); } catch {
+    throw new TodoStoreError('INPUT_INVALID', 'input_json_invalid', undefined,
+      { input_ref: inputRef });
+  }
+  return value;
+}
+
+function authoredPlan(value) {
+  const digestField = value?.schema === PLAN_CREATE_SCHEMA ? 'input_digest'
+    : TODO_EXTRACTION_SCHEMAS.has(value?.schema) ? 'extraction_digest' : null;
+  if (digestField === null) {
+    throw new TodoStoreError('PLAN_SCOPE_REVIEW_INVALID', 'authoring_schema_unsupported', undefined, {
+      pointer: '/schema', expected: [PLAN_CREATE_SCHEMA, ...TODO_EXTRACTION_SCHEMAS],
+      actual: typeof value?.schema === 'string' ? value.schema : null,
+    });
+  }
+  if (!isTodoDigest(value[digestField])
+    || value[digestField] !== todoSelfDigest(value, digestField)) {
+    throw new TodoStoreError('PLAN_SCOPE_REVIEW_INVALID', 'authoring_digest_mismatch', undefined, {
+      pointer: `/${digestField}`,
+    });
+  }
+  const selected = TODO_EXTRACTION_SCHEMAS.has(value.schema)
+    ? value.tasks?.filter((task) => typeof task?.disposition === 'string'
+      && task.disposition.startsWith('register_'))
+    : value.tasks;
+  if (!Array.isArray(selected) || selected.length === 0
+    || selected.some((task) => !isTodoIdentifier(task?.task_id))) {
+    throw new TodoStoreError('PLAN_SCOPE_REVIEW_INVALID', 'authoring_tasks_invalid', undefined, {
+      pointer: '/tasks',
+    });
+  }
+  const taskIds = selected.map(({ task_id: taskId }) => taskId).sort();
+  if (new Set(taskIds).size !== taskIds.length) {
+    throw new TodoStoreError('PLAN_SCOPE_REVIEW_INVALID', 'authoring_task_ids_duplicate', undefined, {
+      pointer: '/tasks',
+    });
+  }
+  return { schema: value.schema, digest: value[digestField], taskIds };
+}
+
+function invalid(reason, pointer, detail = {}) {
+  throw new TodoStoreError('PLAN_SCOPE_REVIEW_INVALID', reason, undefined, { pointer, ...detail });
+}
+
+function validateReview(review, authored) {
+  if (!exactRecord(review, [
+    'schema', 'authoring_digest', 'work_specs', 'task_assessments', 'verdict', 'review_digest',
+  ]) || review.schema !== REVIEW_SCHEMA) invalid('review_schema_invalid', '/schema');
+  if (!isTodoDigest(review.authoring_digest) || review.authoring_digest !== authored.digest) {
+    invalid('review_authoring_digest_mismatch', '/authoring_digest', {
+      expected: authored.digest, actual: review.authoring_digest ?? null,
+    });
+  }
+  if (!isTodoDigest(review.review_digest)
+    || review.review_digest !== todoSelfDigest(review, 'review_digest')) {
+    invalid('review_digest_mismatch', '/review_digest');
+  }
+  if (!Array.isArray(review.work_specs) || review.work_specs.length === 0
+    || !review.work_specs.every((spec) => exactRecord(spec, [
+      'work_spec_id', 'requirement', 'acceptance',
+    ]) && isTodoIdentifier(spec.work_spec_id) && boundedText(spec.requirement)
+      && boundedText(spec.acceptance))
+    || !sortedStrictly(review.work_specs, ({ work_spec_id: id }) => id)) {
+    invalid('work_specs_invalid', '/work_specs');
+  }
+  const workSpecIds = new Set(review.work_specs.map(({ work_spec_id: id }) => id));
+  if (!Array.isArray(review.task_assessments)
+    || !review.task_assessments.every((assessment) => exactRecord(assessment, [
+      'task_id', 'work_spec_ids', 'judgment', 'reason',
+    ]) && isTodoIdentifier(assessment.task_id) && Array.isArray(assessment.work_spec_ids)
+      && assessment.work_spec_ids.every(isTodoIdentifier)
+      && sortedStrictly(assessment.work_spec_ids) && JUDGMENTS.has(assessment.judgment)
+      && boundedText(assessment.reason)
+      && (assessment.judgment === 'required'
+        ? assessment.work_spec_ids.length > 0 : assessment.work_spec_ids.length === 0)
+      && assessment.work_spec_ids.every((id) => workSpecIds.has(id)))
+    || !sortedStrictly(review.task_assessments, ({ task_id: id }) => id)) {
+    invalid('task_assessments_invalid', '/task_assessments');
+  }
+  const assessedTaskIds = review.task_assessments.map(({ task_id: id }) => id);
+  if (assessedTaskIds.length !== authored.taskIds.length
+    || assessedTaskIds.some((id, index) => id !== authored.taskIds[index])) {
+    invalid('task_assessments_incomplete', '/task_assessments', {
+      expected_task_ids: authored.taskIds, actual_task_ids: assessedTaskIds,
+    });
+  }
+  const outOfScopeTaskIds = review.task_assessments
+    .filter(({ judgment }) => judgment === 'out_of_scope')
+    .map(({ task_id: id }) => id);
+  const covered = new Set(review.task_assessments.flatMap(({ work_spec_ids: ids }) => ids));
+  const uncoveredWorkSpecIds = [...workSpecIds].filter((id) => !covered.has(id));
+  const expectedVerdict = outOfScopeTaskIds.length === 0 && uncoveredWorkSpecIds.length === 0
+    ? 'scope_preserved' : 'scope_mismatch';
+  if (review.verdict !== expectedVerdict) {
+    invalid('review_verdict_inconsistent', '/verdict', {
+      expected: expectedVerdict, actual: review.verdict ?? null,
+    });
+  }
+  return { outOfScopeTaskIds, uncoveredWorkSpecIds };
+}
+
+export function evaluatePlanScopeReview(planInput, review) {
+  const authored = authoredPlan(planInput);
+  const findings = validateReview(review, authored);
+  const result = {
+    schema: RESULT_SCHEMA,
+    authoring_schema: authored.schema,
+    authoring_digest: authored.digest,
+    work_spec_count: review.work_specs.length,
+    reviewed_task_count: review.task_assessments.length,
+    verdict: review.verdict,
+    accepted: review.verdict === 'scope_preserved',
+    out_of_scope_task_ids: findings.outOfScopeTaskIds,
+    uncovered_work_spec_ids: findings.uncoveredWorkSpecIds,
+    review_digest: review.review_digest,
+    result_digest: '',
+  };
+  result.result_digest = todoSelfDigest(result, 'result_digest');
+  return result;
+}
+
+export async function runPlanScopeReview({ cwd, planInputRef, reviewRef, stdout }) {
+  const repoRoot = resolveRepoRoot(cwd);
+  if (repoRoot === null) throw new TodoStoreError('REPO_UNRESOLVED', 'git_toplevel_unresolved');
+  const [planInput, review] = await Promise.all([
+    readJsonWithinRepo(repoRoot, planInputRef), readJsonWithinRepo(repoRoot, reviewRef),
+  ]);
+  const result = evaluatePlanScopeReview(planInput, review);
+  stdout.write(`${JSON.stringify(result)}\n`);
+  return result.accepted ? 0 : 1;
+}
+
+export async function runPlanScopeReviewSchema({ stdout }) {
+  const schemaUrl = new URL('../docs/schemas/lattice.plan_scope_review.v1.schema.json', import.meta.url);
+  const handle = await open(schemaUrl, fsConstants.O_RDONLY);
+  try {
+    const schema = JSON.parse(await handle.readFile('utf8'));
+    if (schema?.title !== REVIEW_SCHEMA) throw new TypeError('bundled plan scope review schema invalid');
+    stdout.write(`${JSON.stringify(schema)}\n`);
+    return 0;
+  } finally {
+    await handle.close();
+  }
+}

package/src/project-cli.mjs

@@ -19,7 +19,10 @@ import { projectTodoStatus } from './todo-status.mjs';
 import { readTodoPlanNotesForStatus } from './todo-note-store.mjs';
 import { projectIndependenceFrontier } from './todo-independence.mjs';
 import { readTodoParallelCandidatesForStatus } from './todo-parallel-candidates.mjs';
-import { readTodoStructureFinalizationsForStatus } from './todo-structure-store.mjs';
+import {
+  readTodoStructureArtifactDiagnostics,
+  readTodoStructureFinalizationsForStatus,
+} from './todo-structure-store.mjs';
 import { isTodoIndependenceLegacyMarker } from './todo-independence-contracts.mjs';
 import { selectIndependenceGuidance } from './todo-independence-guidance.mjs';
 import { ensureTodoDashboardActivity } from './todo-dashboard-registry.mjs';
@@ -223,7 +226,7 @@ function invalidStatus({ cliVersion, repoRoot, reason, nextAction = null }) {
  * store読みはここでしか行わない——session開始経路が同じstoreを二度払っていたのが
  * ADR 0131で直した欠陥である。
  */
-async function resolveProjectState({ cwd, cliVersion }) {
+async function resolveProjectState({ cwd, cliVersion, diagnoseStructureArtifacts = false }) {
   const repoRoot = resolveRepoRoot(cwd);
   if (repoRoot === null) {
     return { exitCode: 1, repoRoot: null, store: null, todo: null,
@@ -271,6 +274,14 @@ async function resolveProjectState({ cwd, cliVersion }) {
   }
   try {
     const store = await readTodoStore({ repoRoot });
+    if (diagnoseStructureArtifacts) {
+      const diagnostics = await readTodoStructureArtifactDiagnostics({ repoRoot, store });
+      if (diagnostics.length > 0) {
+        throw new TodoStoreError(
+          'STRUCTURE_ARTIFACT_INVALID', diagnostics[0].reason, undefined, { diagnostics },
+        );
+      }
+    }
     const todo = projectTodoStatus(store, {
       planNotes: await readTodoPlanNotesForStatus({ repoRoot, store }),
       parallelCandidates: await readTodoParallelCandidatesForStatus({ repoRoot, store, gitHead }),
@@ -314,6 +325,7 @@ async function resolveProjectState({ cwd, cliVersion }) {
     });
     return { exitCode: 0, repoRoot, store, todo, result };
   } catch (error) {
+    if (error?.code === 'STRUCTURE_ARTIFACT_INVALID') throw error;
     const reason = error instanceof TodoStoreError
       ? `${error.code}:${error.detail?.reason ?? error.message}` : 'store_validation_failed';
     return invalid(reason);
@@ -322,7 +334,9 @@ async function resolveProjectState({ cwd, cliVersion }) {
 
 export async function runProjectStatus({ cwd, stdout, cliVersion, env = process.env,
   ensureDashboardActivity = ensureTodoDashboardActivity }) {
-  const state = await resolveProjectState({ cwd, cliVersion });
+  const state = await resolveProjectState({
+    cwd, cliVersion, diagnoseStructureArtifacts: true,
+  });
   // dashboard活動の登録はdiscovery面の副作用として維持する（ADR 0131 Decision 4で
   // session-context側だけが持たない、と決めた面である）。
   if (state.store !== null && env.LATTICE_DASHBOARD_AUTOSTART !== '0') {
@@ -680,6 +694,15 @@ export async function runPlanShow({ cwd, planKey, stdout }) {
 }
 
 export function projectStatusFailure({ cwd, stdout, cliVersion, error }) {
+  if (error?.code === 'STRUCTURE_ARTIFACT_INVALID') {
+    const payload = {
+      schema: 'lattice.cli_error.v2', code: error.code,
+      message: error.message ?? 'structure artifact invalid',
+      detail: error.detail,
+    };
+    stdout.write(`${JSON.stringify(payload)}\n`);
+    return 1;
+  }
   const projectRootConflict = error?.code === 'PROJECT_ROOT_CONFLICT';
   const result = invalidStatus({
     cliVersion, repoRoot: resolveRepoRoot(cwd),

package/src/runtime-contracts.mjs

@@ -642,7 +642,7 @@ export function validateExecutorPacket(value) {
     && identifier(packet.plan_ref)
     && nonNegativeInteger(packet.plan_epoch)
     && boundedArray(packet.verifier_refs, (entry) => typeof entry === 'string')
-    && boundedArray(packet.forbidden_operations, (entry) => typeof entry === 'string', { min: 1 })
+    && boundedArray(packet.forbidden_operations, (entry) => typeof entry === 'string')
     && packet.context_content_digest === computeContextContentDigest(packet)
     && selfDigestValid(packet, 'packet_digest')
   ));