@sdd-method/author-cli 0.11.0 → 0.12.1

package/dist/lib/structure/view.js

@@ -0,0 +1,301 @@
+import { elementKey, revision } from "./model.js";
+export const STRUCTURE = "structure";
+export function catalogueOf(schema, name) {
+    return schema.catalogues.find((c) => c.name === name);
+}
+/** The model's elements as one view, reporting an id held twice. */
+export function viewOf(files, problems) {
+    const view = new Map();
+    for (const f of files) {
+        for (const e of f.elements) {
+            const byId = view.get(e.catalogue) ?? new Map();
+            const prior = byId.get(e.id);
+            if (prior) {
+                problems.push(`${e.file}: ${elementKey(e.catalogue, e.id)} is also in ${prior.file}; an element is owned by one partition, and an id is held once`);
+                continue;
+            }
+            byId.set(e.id, e);
+            view.set(e.catalogue, byId);
+        }
+    }
+    return view;
+}
+export function revisionOf(e) {
+    return revision(e.catalogue, e.id, e.columns);
+}
+function typeOk(type, v) {
+    switch (type) {
+        case "int":
+        case "integer":
+            return typeof v === "number" && Number.isInteger(v);
+        case "number":
+            return typeof v === "number";
+        case "boolean":
+            return typeof v === "boolean";
+        case "date":
+            return typeof v === "string" && /^\d{4}-\d{2}-\d{2}$/.test(v);
+        default:
+            return typeof v === "string";
+    }
+}
+/** The element's own shape against its catalogue: class, columns, required columns, types, vocabularies. */
+export function checkElementShape(schema, e, where, problems) {
+    const key = elementKey(e.catalogue, e.id);
+    const cat = catalogueOf(schema, e.catalogue);
+    if (!cat) {
+        problems.push(`${where}: ${key}: the metamodel declares no catalogue ${e.catalogue}`);
+        return;
+    }
+    if (cat.sourceOfTruth !== STRUCTURE) {
+        problems.push(`${where}: ${key}: ${e.catalogue} is of class ${cat.sourceOfTruth ?? "(none)"}, not structure; it is authored elsewhere`);
+        return;
+    }
+    for (const [col, v] of Object.entries(e.columns)) {
+        const def = cat.columns.find((c) => c.name === col);
+        if (!def) {
+            problems.push(`${where}: ${key}: ${e.catalogue} has no column ${col}`);
+            continue;
+        }
+        if (def.sourceOfTruth !== STRUCTURE) {
+            problems.push(`${where}: ${key}: ${e.catalogue}.${col} is of class ${def.sourceOfTruth ?? "(none)"}, not structure; it is never written in the model`);
+            continue;
+        }
+        if (v === "")
+            problems.push(`${where}: ${key}: ${col} is empty; omit an empty value`);
+        else if (!typeOk(def.type, v))
+            problems.push(`${where}: ${key}: ${col} must be of type ${def.type}`);
+        const en = cat.columnEnums[col];
+        if (en !== undefined && typeof v === "string" && v !== "") {
+            const values = schema.enums[en.replace(/^enums\./, "")]?.values.map((x) => x.value) ?? [];
+            if (!values.includes(v))
+                problems.push(`${where}: ${key}: ${col} ${JSON.stringify(v)} is not a value of ${en}`);
+        }
+    }
+    for (const def of cat.columns) {
+        if (def.name === cat.primaryKey || def.nullable || def.sourceOfTruth !== STRUCTURE)
+            continue;
+        if (e.columns[def.name] === undefined)
+            problems.push(`${where}: ${key}: required column ${def.name} is missing`);
+    }
+}
+function find(view, catalogue, column, value) {
+    const byId = view.get(catalogue);
+    if (!byId)
+        return undefined;
+    if (column === "id")
+        return byId.get(value);
+    for (const e of byId.values())
+        if (String(e.columns[column] ?? "") === value)
+            return e;
+    return undefined;
+}
+/** The element's references: each non-external foreign key with a value. */
+export function referencesOf(schema, e) {
+    const cat = catalogueOf(schema, e.catalogue);
+    if (!cat)
+        return [];
+    const out = [];
+    for (const fk of cat.foreignKeys) {
+        if (fk.external)
+            continue;
+        const v = e.columns[fk.column];
+        if (v === undefined || v === "")
+            continue;
+        const [target, targetColumn] = fk.references.split(".");
+        out.push({ column: fk.column, catalogue: target, targetColumn: targetColumn ?? "id", value: String(v), structural: catalogueOf(schema, target)?.sourceOfTruth === STRUCTURE });
+    }
+    return out;
+}
+/** The natural key's value for an element, or null when the catalogue declares none or the element lacks a part. */
+function naturalKey(cat, e) {
+    const nk = cat.naturalKey;
+    if (!nk || nk.length === 0)
+        return null;
+    const parts = nk.map((c) => (c === "id" ? e.id : e.columns[c]));
+    if (parts.some((p) => p === undefined || p === ""))
+        return null;
+    return parts.map(String).join("\u0000");
+}
+/**
+ * The checks a view must satisfy on its own: every element's shape, references resolved within the view (or, into a
+ * catalogue of another class, against its built rows), no cycle through a self-reference, natural keys unique, and
+ * domain invariants naming their entity's own attributes and relationships.
+ */
+export function validateView(schema, view, built, problems, unresolved) {
+    for (const [catalogue, byId] of view) {
+        const cat = catalogueOf(schema, catalogue);
+        for (const e of byId.values()) {
+            const shape = [];
+            checkElementShape(schema, e, e.file, shape);
+            problems.push(...shape);
+            if (!cat || cat.sourceOfTruth !== STRUCTURE)
+                continue;
+            for (const r of referencesOf(schema, e)) {
+                if (r.structural) {
+                    if (!find(view, r.catalogue, r.targetColumn, r.value))
+                        problems.push(`${e.file}: ${elementKey(catalogue, e.id)}: ${r.column} ${JSON.stringify(r.value)} names no ${r.catalogue} element in this view (${elementKey(r.catalogue, r.value)})`);
+                }
+                else {
+                    const rows = built(r.catalogue, r.targetColumn);
+                    if (rows === null)
+                        unresolved.add(r.catalogue);
+                    else if (!rows.has(r.value))
+                        problems.push(`${e.file}: ${elementKey(catalogue, e.id)}: ${r.column} ${JSON.stringify(r.value)} names no row of ${r.catalogue} as built`);
+                }
+            }
+        }
+        if (!cat || cat.sourceOfTruth !== STRUCTURE)
+            continue;
+        // Hierarchies through a self-reference stay acyclic.
+        for (const fk of cat.foreignKeys.filter((f) => f.references.split(".")[0] === catalogue && !f.external)) {
+            const reported = new Set();
+            for (const start of byId.values()) {
+                const path = [];
+                const onPath = new Set();
+                let cur = start;
+                while (cur && !onPath.has(cur.id)) {
+                    onPath.add(cur.id);
+                    path.push(cur.id);
+                    const next = cur.columns[fk.column];
+                    cur = next === undefined || next === "" ? undefined : byId.get(String(next));
+                }
+                if (cur && onPath.has(cur.id)) {
+                    const cycle = path.slice(path.indexOf(cur.id));
+                    const sig = [...cycle].sort().join(",");
+                    if (!reported.has(sig)) {
+                        reported.add(sig);
+                        problems.push(`${start.file}: ${catalogue}.${fk.column} forms a cycle: ${[...cycle, cur.id].map((id) => elementKey(catalogue, id)).join(" -> ")}`);
+                    }
+                }
+            }
+        }
+        // Natural keys are unique.
+        const seen = new Map();
+        for (const e of byId.values()) {
+            const k = naturalKey(cat, e);
+            if (k === null)
+                continue;
+            const prior = seen.get(k);
+            if (prior)
+                problems.push(`${e.file}: ${elementKey(catalogue, e.id)} and ${elementKey(catalogue, prior.id)} share the natural key (${cat.naturalKey.join(", ")}) ${JSON.stringify(k.split("\u0000").join(", "))}`);
+            else
+                seen.set(k, e);
+        }
+    }
+    // Domain invariants name their own entity's attributes and relationships.
+    for (const inv of view.get("domain_invariants")?.values() ?? []) {
+        const key = elementKey("domain_invariants", inv.id);
+        const entity = String(inv.columns["entity_id"] ?? "");
+        const kind = String(inv.columns["kind"] ?? "");
+        const attrs = String(inv.columns["attribute_ids"] ?? "").split(";").map((s) => s.trim()).filter(Boolean);
+        const rel = String(inv.columns["relationship_id"] ?? "");
+        if ((kind === "unique" || kind === "required") && attrs.length === 0)
+            problems.push(`${inv.file}: ${key}: a ${kind} invariant names its attributes (attribute_ids)`);
+        if (kind === "cardinality" && rel === "")
+            problems.push(`${inv.file}: ${key}: a cardinality invariant names its relationship (relationship_id)`);
+        for (const a of attrs) {
+            const at = view.get("entity_attributes")?.get(a);
+            if (!at)
+                problems.push(`${inv.file}: ${key}: attribute ${elementKey("entity_attributes", a)} is not in this view`);
+            else if (String(at.columns["entity_id"] ?? "") !== entity)
+                problems.push(`${inv.file}: ${key}: attribute ${elementKey("entity_attributes", a)} belongs to ${String(at.columns["entity_id"] ?? "")}, not ${entity}`);
+        }
+        if (rel !== "") {
+            const r = view.get("entity_relationships")?.get(rel);
+            if (r && String(r.columns["from_entity_id"] ?? "") !== entity)
+                problems.push(`${inv.file}: ${key}: relationship ${elementKey("entity_relationships", rel)} is ${String(r.columns["from_entity_id"] ?? "")}'s, not ${entity}'s`);
+        }
+    }
+}
+/**
+ * One change's deltas against the current view (M-ADR 0230 §4.4): each element's shape, ADDED ids new, MODIFIED and
+ * REMOVED ids held by the delta's partition, and a base revision for every element it modifies, removes or reads.
+ * A base revision that no longer matches the current element is reported as moved: the change is revalidated.
+ * `addedElsewhere` holds the elements other open changes add, for a reference into one of them.
+ */
+export function validateDeltas(schema, current, deltas, addedElsewhere, problems) {
+    const ownAdded = new Set();
+    const dependsOn = new Set();
+    for (const d of deltas) {
+        for (const e of d.added)
+            ownAdded.add(elementKey(e.catalogue, e.id));
+        for (const c of d.dependsOn)
+            dependsOn.add(c);
+    }
+    const seenWrite = new Map();
+    for (const d of deltas) {
+        const write = (key, op) => {
+            const prior = seenWrite.get(key);
+            if (prior)
+                problems.push(`${d.file}: ${op} ${key}, which this change also writes in ${prior}`);
+            else
+                seenWrite.set(key, `${d.file} (${op})`);
+        };
+        const needBase = (key, why) => {
+            const b = d.base.get(key);
+            if (b === undefined) {
+                problems.push(`${d.file}: no base revision for ${key}, which it ${why}`);
+                return;
+            }
+            const [catalogue, ...rest] = key.split("/");
+            const cur = current.get(catalogue)?.get(rest.join("/"));
+            if (cur && revisionOf(cur) !== b)
+                problems.push(`${d.file}: base revision of ${key} has moved since the change was written (${b.slice(0, 19)}… now ${revisionOf(cur).slice(0, 19)}…): revalidate the change`);
+        };
+        for (const e of d.added) {
+            const key = elementKey(e.catalogue, e.id);
+            checkElementShape(schema, e, `${d.file}: ADDED`, problems);
+            if (current.get(e.catalogue)?.has(e.id))
+                problems.push(`${d.file}: ADDED ${key}, which the model already holds; an added id is new`);
+            write(key, "ADDED");
+        }
+        for (const e of d.modified) {
+            const key = elementKey(e.catalogue, e.id);
+            checkElementShape(schema, e, `${d.file}: MODIFIED`, problems);
+            const cur = current.get(e.catalogue)?.get(e.id);
+            if (!cur)
+                problems.push(`${d.file}: MODIFIED ${key}, which the model does not hold`);
+            else {
+                if (cur.partition !== d.partition)
+                    problems.push(`${d.file}: MODIFIED ${key}, which partition ${cur.partition} owns, not ${d.partition}`);
+                needBase(key, "modifies");
+            }
+            write(key, "MODIFIED");
+        }
+        for (const r of d.removed) {
+            const key = elementKey(r.catalogue, r.id);
+            const cur = current.get(r.catalogue)?.get(r.id);
+            if (!cur)
+                problems.push(`${d.file}: REMOVED ${key}, which the model does not hold`);
+            else {
+                if (cur.partition !== d.partition)
+                    problems.push(`${d.file}: REMOVED ${key}, which partition ${cur.partition} owns, not ${d.partition}`);
+                needBase(key, "removes");
+            }
+            write(key, "REMOVED");
+        }
+        // Reads: every element an added or modified element references.
+        for (const e of [...d.added, ...d.modified]) {
+            for (const r of referencesOf(schema, e)) {
+                if (!r.structural)
+                    continue;
+                const target = r.targetColumn === "id" ? r.value : find(current, r.catalogue, r.targetColumn, r.value)?.id;
+                const key = elementKey(r.catalogue, target ?? r.value);
+                if (target !== undefined && current.get(r.catalogue)?.has(target)) {
+                    needBase(key, `reads (${elementKey(e.catalogue, e.id)}.${r.column})`);
+                    continue;
+                }
+                if (ownAdded.has(key))
+                    continue;
+                const by = addedElsewhere.get(key);
+                if (by !== undefined && dependsOn.has(by))
+                    continue;
+                if (by !== undefined)
+                    problems.push(`${d.file}: ${elementKey(e.catalogue, e.id)}.${r.column} names ${key}, which open change ${by} adds; declare it in depends_on`);
+                else
+                    problems.push(`${d.file}: ${elementKey(e.catalogue, e.id)}.${r.column} names ${key}, which is in neither the model nor an open change`);
+            }
+        }
+    }
+}
+//# sourceMappingURL=view.js.map

package/dist/lib/validate/agreement-evidence.js

@@ -1,8 +1,9 @@
 // What an agreement binds and what a verdict must show (M-ADR 0222 §4.6, M-ADR 0223 §4.4-§4.6).
 // Pure text helpers; behaviour-store.ts runs them against git.
 //
-//   agreed content   the change's proposal, deltas, Gate 0, design, tasks (checkboxes ignored) and the test plan's
-//                    scenario-to-test rows (its Before and After cells ignored) are what was approved. Each is compared
+//   agreed content   the change's proposal, deltas, Gate 0, design, tasks (checkboxes ignored), the test plan's
+//                    scenario-to-test rows (its Before and After cells ignored) and its structural deltas with their
+//                    base revisions (M-ADR 0230 §4.4, Proposed; report only until it is accepted) are what was approved. Each is compared
 //                    with its state at the record's pinned commit: the latest amendment's commit, else sdd.commit.
 //   requirement      a requirement's block in a spec: its heading to the next requirement or section heading. The
 //                    stale check compares the blocks a change targets, not the whole file.
@@ -12,7 +13,15 @@
 //   verdict line     verdict.md's own verdict: `Verdict: PASS|FAIL` or a leading `**PASS**`/`**FAIL**`.
 /** The files under a change directory that agreement binds, relative to the change directory. */
 export function boundFile(rel) {
-    return /^(proposal|design|gate-0|tasks|test-plan)\.md$/.test(rel) || /^specs\/.+\/spec\.md$/.test(rel);
+    return /^(proposal|design|gate-0|tasks|test-plan)\.md$/.test(rel) || /^specs\/.+\/spec\.md$/.test(rel) || structuralFile(rel);
+}
+/**
+ * A change's structural artifact (M-ADR 0230 §4.4, Proposed): a partition delta or the no-op claim, both agreed
+ * content, so a delta's base revisions are pinned with it. The effect record (structure/applied.yaml) is written by
+ * the archive, after agreement, and is not.
+ */
+export function structuralFile(rel) {
+    return /^structure\/[^/]+\.yaml$/.test(rel) && rel !== "structure/applied.yaml";
 }
 /** A bound file's content as agreement compares it: all of it, with only the fields execution fills in masked. */
 export function normaliseBound(rel, text) {
@@ -24,8 +33,8 @@ export function normaliseBound(rel, text) {
 }
 /**
  * The test plan as agreed. Masked, because execution fills them in: the last two cells (Before and After) of each
- * row of the scenario table, the whole Ledger section, and the last two cells (Killed by and Result) of each row of
- * the Mutants table. Everything else, the stand-ins and any strategy or limitation stated, stays bound.
+ * row of the scenario table, and the whole Ledger and Mutants sections. Everything else, the stand-ins and any
+ * strategy or limitation stated, stays bound.
  */
 export function normaliseTestPlan(text) {
     const out = [];
@@ -34,12 +43,15 @@ export function normaliseTestPlan(text) {
         const h = /^##\s+(.+?)\s*$/.exec(line);
         if (h) {
             section = h[1].toLowerCase();
-            out.push(line);
+            if (section !== "mutants")
+                out.push(line);
             continue;
         }
-        if (section === "ledger")
+        // The ledger and the mutants are what apply records: the mutants are written against guards that exist only once
+        // the change is applied, and the judge writes its own for any guard they miss (M-ADR 0228 §4.1, Proposed).
+        if (section === "ledger" || section === "mutants")
             continue;
-        if ((section === "" || section === "mutants") && /^\s*\|/.test(line)) {
+        if (section === "" && /^\s*\|/.test(line)) {
             const cells = line.trim().replace(/^\||\|$/g, "").split("|").map((c) => c.trim());
             out.push(cells.slice(0, Math.max(0, cells.length - 2)).join(" | "));
             continue;

package/dist/lib/validate/behaviour-store.js

@@ -14,8 +14,9 @@
 //                 block, as it was at the agreed commit (the latest amendment's, else sdd.commit; M-ADR 0223
 //                 §4.5). Another requirement of the same spec moving does not stale it. With no targets the
 //                 check is vacuous, and says so.
-//      agreed content: the change's proposal, deltas, Gate 0, design, tasks (checkboxes ignored) and test
-//                 plan (its execution results ignored) equal their state at that commit (M-ADR 0222 §4.6).
+//      agreed content: the change's proposal, deltas, Gate 0, design, tasks (checkboxes ignored), test
+//                 plan (its execution results ignored) and structural deltas equal their state at that commit
+//                 (M-ADR 0222 §4.6; a structural delta's change is a [WARN] while M-ADR 0230 is Proposed).
 //      kinds:    on a record held to 1.1.0, each test-plan row's Kind (changed or carried) is the one computed
 //                 from the deltas and the living spec, a row naming no scenario of the deltas fails, and a
 //                 filled Before is a fail for changed and a pass for carried (M-ADR 0223 §4.4).
@@ -68,7 +69,8 @@ import { promisify } from "node:util";
 import { parseDocument } from "yaml";
 import { observedIn, orderArchives, parseRequirements, parseSurfaces, renamedFrom, renamePairs, resolveImplements, surfaceMatches } from "../behaviour-store/archive.js";
 import { parseCatalogueCsv } from "../catalogue/csv-reader.js";
-import { boundFile, conditionProblems, isCommit, normaliseBound, requirementBlock, sameCommit, scenarioKind, taskGroups, testPlanHeader, testPlanMapping, verdictLine, versionAtLeast } from "./agreement-evidence.js";
+import { boundFile, conditionProblems, structuralFile, isCommit, normaliseBound, requirementBlock, sameCommit, scenarioKind, taskGroups, testPlanHeader, testPlanMapping, verdictLine, versionAtLeast } from "./agreement-evidence.js";
+import { ENFORCED as STRUCTURE_ENFORCED } from "./structural-model.js";
 import { compareStoreSchema, SCHEMA_NAME, SHIPPED_SCHEMA_DIR, STORE_CONFIG, STORE_SCHEMA_DIR, storeSchemaName } from "../behaviour-store/schema.js";
 const execFileAsync = promisify(execFile);
 /** The OpenSpec release the method depends on (M-ADR 0223 ruling 2). The module installs exactly this. */
@@ -171,6 +173,19 @@ export function parseAgreementRecord(file, text) {
     const conditions = Array.isArray(r.conditions) ? r.conditions : [];
     if (r.conditions !== undefined && !Array.isArray(r.conditions))
         problems.push(`${file}: conditions must be a list`);
+    const noLongerImplements = [];
+    if (r.no_longer_implements !== undefined) {
+        if (!Array.isArray(r.no_longer_implements))
+            problems.push(`${file}: no_longer_implements must be a list of {repo, requirement}`);
+        else
+            for (const [i, x] of r.no_longer_implements.entries()) {
+                const e = x;
+                if (!e || typeof e.repo !== "string" || typeof e.requirement !== "string")
+                    problems.push(`${file}: no_longer_implements[${i}] names a repo and a requirement`);
+                else
+                    noLongerImplements.push({ repo: e.repo, requirement: e.requirement });
+            }
+    }
     if (problems.length > 0)
         return { problems };
     return {
@@ -185,6 +200,7 @@ export function parseAgreementRecord(file, text) {
             ...(verdict ? { verdict } : {}),
             workOrders,
             conditions,
+            noLongerImplements,
         },
         problems,
     };
@@ -335,9 +351,17 @@ async function listFiles(dir, rel = "") {
     }
     return out;
 }
-/** A code repository's checkout beside the SDD (../<repo>), when there is one. */
-async function codeCheckout(sddRepo, codeRepo) {
-    const dir = join(sddRepo, "..", codeRepo);
+/**
+ * Where a work order's repository is checked out: the SDD itself for the SDD's own work order (its repository id is
+ * the SDD's sdd_id), else a checkout beside the SDD (../<repo>). The SDD's own commits are always at hand, wherever
+ * the SDD is mounted, so its work order never depends on a sibling directory's name.
+ */
+function checkoutDir(sddRepo, codeRepo, ownId) {
+    return ownId !== "" && codeRepo === ownId ? sddRepo : join(sddRepo, "..", codeRepo);
+}
+/** A work order repository's checkout, when there is one. */
+async function codeCheckout(sddRepo, codeRepo, ownId) {
+    const dir = checkoutDir(sddRepo, codeRepo, ownId);
     try {
         await execFileAsync("git", ["-C", dir, "rev-parse", "--git-dir"]);
         return dir;
@@ -346,9 +370,9 @@ async function codeCheckout(sddRepo, codeRepo) {
         return null;
     }
 }
-/** Whether two commits of a code repository checked out beside the SDD (../<repo>) have one tree. */
-async function sameTree(sddRepo, codeRepo, a, b) {
-    const dir = join(sddRepo, "..", codeRepo);
+/** Whether two commits of a work order's repository, in its checkout, have one tree. */
+async function sameTree(sddRepo, codeRepo, ownId, a, b) {
+    const dir = checkoutDir(sddRepo, codeRepo, ownId);
     try {
         const [x, y] = await Promise.all([a, b].map(async (c) => (await execFileAsync("git", ["-C", dir, "rev-parse", `${c}^{tree}`])).stdout.trim()));
         return x === y ? "same" : "differs";
@@ -365,6 +389,15 @@ export async function checkBehaviourStore(repo, options = {}) {
     const lines = [];
     const failures = [];
     const warnings = [];
+    // The SDD's own id: a work order for the SDD's own repository is checked in the SDD itself.
+    let ownId = "";
+    try {
+        const m = parseDocument((await readText(join(repo, ".sdd", "sdd-manifest.yaml"))) ?? "").toJS();
+        ownId = String(m?.sdd_id ?? "");
+    }
+    catch {
+        // the manifest check reports an unreadable manifest
+    }
     // 1. records
     const records = new Map();
     let recordFiles = [];
@@ -454,7 +487,11 @@ export async function checkBehaviourStore(repo, options = {}) {
                         const a = await gitShow(repo, base, `${dir}/${f}`);
                         const b = await gitShow(repo, "HEAD", `${dir}/${f}`);
                         if (a === null || b === null || normaliseBound(f, a) !== normaliseBound(f, b)) {
-                            failures.push(`${dir}: AGREED CONTENT CHANGED: ${f} ${a === null ? "was added" : b === null ? "was removed" : "differs"} since ${base}, with no amendment recording a commit and an approver; amend the agreement or renew it (M-ADR 0222 §4.6)`);
+                            const what = `${dir}: AGREED CONTENT CHANGED: ${f} ${a === null ? "was added" : b === null ? "was removed" : "differs"} since ${base}, with no amendment recording a commit and an approver; amend the agreement or renew it (M-ADR 0222 §4.6)`;
+                            if (structuralFile(f) && !STRUCTURE_ENFORCED)
+                                warnings.push(`${what}; a structural delta, report only while M-ADR 0230 is Proposed`);
+                            else
+                                failures.push(what);
                         }
                     }
                 }
@@ -601,7 +638,11 @@ export async function checkBehaviourStore(repo, options = {}) {
                 const a = await gitShow(repo, base, `${openDir}/${f}`);
                 const b = await readText(join(repo, dir, f));
                 if (a === null || b === null || normaliseBound(f, a) !== normaliseBound(f, b)) {
-                    failures.push(`${dir}: AGREED CONTENT CHANGED: ${f} ${a === null ? "was added" : b === null ? "was removed" : "differs"} from what was agreed at ${base}, with no amendment recording a commit and an approver (M-ADR 0222 §4.6)`);
+                    const what = `${dir}: AGREED CONTENT CHANGED: ${f} ${a === null ? "was added" : b === null ? "was removed" : "differs"} from what was agreed at ${base}, with no amendment recording a commit and an approver (M-ADR 0222 §4.6)`;
+                    if (structuralFile(f) && !STRUCTURE_ENFORCED)
+                        warnings.push(`${what}; a structural delta, report only while M-ADR 0230 is Proposed`);
+                    else
+                        failures.push(what);
                 }
             }
             // Stale at archive: the requirements the change targets, just before it archived, are as they were agreed. After
@@ -681,7 +722,7 @@ export async function checkBehaviourStore(repo, options = {}) {
                 failures.push(`${record.file}: verdict.merged ${m === undefined ? "names no commit" : `names ${JSON.stringify(m)}, not a commit`} for ${wo.repo}`);
                 continue;
             }
-            const checkout = await codeCheckout(repo, wo.repo);
+            const checkout = await codeCheckout(repo, wo.repo, ownId);
             if (checkout) {
                 for (const c of [j, m])
                     if (!(await commitResolves(checkout, c)))
@@ -690,7 +731,7 @@ export async function checkBehaviourStore(repo, options = {}) {
             else if (sameCommit(j, m))
                 pinsUnverified++;
             if (!sameCommit(j, m)) {
-                const cmp = await sameTree(repo, wo.repo, j, m);
+                const cmp = await sameTree(repo, wo.repo, ownId, j, m);
                 if (cmp === "differs")
                     failures.push(`${record.file}: ${wo.repo} merged ${m}, whose tree differs from the judged ${j}: what merged is not what was judged`);
                 if (cmp === "unresolved")

package/dist/lib/validate/dispatch.js

@@ -4,6 +4,7 @@ import { checkBundleCoherence } from "./bundle-coherence.js";
 import { checkFeatureSpecPointers } from "./feature-spec-pointers.js";
 import { checkIntents } from "./intents.js";
 import { checkJourneyImpact } from "./journey-impact.js";
+import { checkStructuralModel } from "./structural-model.js";
 import { checkYamlParse } from "./yaml-parse.js";
 // The behaviour store (M-ADR 0221-0223) can sit in an SDD of any profile, so every profile carries
 // its two checks; without a store both report [N/A], an empty population, not a pass.
@@ -42,6 +43,12 @@ const BEHAVIOUR_STORE_VALIDATORS = [
         source: { kind: "native", run: async (ctx) => checkJourneyImpact(ctx.targetRepo) },
         build: () => ({ status: "run", args: [] }),
     },
+    // The structural model and each open change's structural artifact (M-ADR 0230, Proposed). Report only; [N/A] without a model.
+    {
+        name: "structural-model",
+        source: { kind: "native", run: async (ctx) => checkStructuralModel(ctx.targetRepo) },
+        build: () => ({ status: "run", args: [] }),
+    },
 ];
 // Validators that accept --app-root / --repo-root flags work fine from the
 // bundled location because they override their internal ROOT_DIR via the

package/dist/lib/validate/journey-impact.js

@@ -9,7 +9,7 @@
 //              never the proposal's.
 //   unnamed    a listed journey the proposal's `## Affected Journeys` section does not name.
 //   unshown    a journey named `altered` with nothing to show it: no delta in the change to a feature of kind journey
-//              whose id is the journey's id or ends with it (option B), and no task naming it (option A).
+//              whose delta or living spec tags it @journey:<journey-id> (option B), and no task naming it (option A).
 // A proposal line is `- <journey-id>: altered ...` or `- <journey-id>: unaffected, <reason>`; an unaffected line
 // with no reason is reported too.
 //
@@ -52,6 +52,10 @@ async function csv(repo, name, dir = "catalogues") {
     return text === null ? null : parseCatalogueCsv(text).rows;
 }
 /** The `## Affected Journeys` section: journey id -> what the proposal says of it. */
+/** The journey ids a spec tags with @journey:<id>. */
+export function journeyTags(text) {
+    return new Set([...text.matchAll(/@journey:([a-z0-9][a-z0-9-]*)/g)].map((m) => m[1]));
+}
 export function parseAffectedJourneys(proposal) {
     const out = new Map();
     let inSection = false;
@@ -178,7 +182,18 @@ export async function checkJourneyImpact(repo) {
             if (n.verdict === "unaffected" && n.rest === "")
                 warnings.push(`${CHANGES_DIR}/${change}/proposal.md: journey ${j} is named unaffected without a reason`);
             if (n.verdict === "altered") {
-                const journeyDelta = [...deltaFeatures].some((f) => featureKinds.get(f) === "journey" && (f === j || f.endsWith(`-${j}`)));
+                // Option B: a delta to a feature of kind journey that names this journey with its @journey tag, in the delta
+                // or in the living spec it changes (M-ADR 0229 §4.2). The tag, not the feature's id, binds the two.
+                let journeyDelta = false;
+                for (const f of deltaFeatures) {
+                    if (featureKinds.get(f) !== "journey")
+                        continue;
+                    const text = `${(await readText(join(dir, "specs", f, "spec.md"))) ?? ""}\n${(await readText(join(repo, "openspec", "specs", f, "spec.md"))) ?? ""}`;
+                    if (journeyTags(text).has(j)) {
+                        journeyDelta = true;
+                        break;
+                    }
+                }
                 const shown = journeyDelta || tasks.includes(j);
                 if (!shown)
                     warnings.push(`${CHANGES_DIR}/${change}/proposal.md: journey ${j} is named altered, and the change shows nothing for it: no delta to its journey feature and no task naming it`);