@wairon/cli 5.1.1-dev.40 → 5.1.1-dev.41

package/README.md

@@ -175,6 +175,7 @@ See [docs/cli.md](docs/cli.md). Summary:
 | `wairon domains list \| scan \| add \| remove` | Domains (subsystem-derived + free-standing) |
 | `wairon skills list \| install` | Manage the SDD skills installed into your tools |
 | `wairon lock [-y]` | Validate the tree as-complete and freeze it (generates the implementer agents) |
+| `wairon lock-check [--strict]` | Merge gate: is the design in this tree the design that was approved? Importable as a [reusable workflow](.github/workflows/lock-check.yml) |
 | `wairon mcp serve \| install \| status` | The wairon MCP server (`sdd_*` tools) |
 | `wairon serve [--port] [--data-dir] [--no-auth]` | Self-host: HTTP MCP for many isolated projects + admin plane |
 | `wairon host project \| key \| lock \| promote` | Administer the hosting server (projects, keys, state-scoped lock/promote) |

package/dist/cli/index.js

@@ -65,7 +65,7 @@ var init_defaults = __esm({
       copilot: ".github/prompts",
       codex: ".codex/agents"
     };
-    WAIRON_VERSION = "5.1.1-dev.40";
+    WAIRON_VERSION = "5.1.1-dev.41";
     GITHUB_REPO = "SYW-Apps/Waffle-AIron";
     SUPPORTED_ALIASES = ["wai"];
     SCAN_EXCLUDE_DIRS = /* @__PURE__ */ new Set([
@@ -3136,6 +3136,10 @@ var init_budget_policy = __esm({
 function canonicalize(value) {
   return JSON.stringify(sortKeys(value));
 }
+function compareOrdinal(a, b) {
+  if (a < b) return -1;
+  return a > b ? 1 : 0;
+}
 function sortKeys(v) {
   if (Array.isArray(v)) return v.map(sortKeys);
   if (v && typeof v === "object") {
@@ -3156,14 +3160,17 @@ var init_canonical_json = __esm({
 });
 
 // src/core/statehash.ts
+function inIdentityOrder(specs) {
+  return specs.map((spec) => ({ spec, content: canonicalize(spec) })).sort((a, b) => compareOrdinal(a.spec.id, b.spec.id) || compareOrdinal(a.content, b.content)).map((entry) => entry.spec);
+}
 function computeStateId() {
   const tree = {
     system: loadSystemSpec(),
-    subsystems: loadSubsystemSpecs(),
-    components: loadComponentSpecs(),
-    interfaces: loadInterfaceSpecs(),
-    implementations: loadImplementationSpecs(),
-    types: loadTypeSpecs()
+    subsystems: inIdentityOrder(loadSubsystemSpecs()),
+    components: inIdentityOrder(loadComponentSpecs()),
+    interfaces: inIdentityOrder(loadInterfaceSpecs()),
+    implementations: inIdentityOrder(loadImplementationSpecs()),
+    types: inIdentityOrder(loadTypeSpecs())
   };
   const digest2 = crypto.createHash("sha256").update(canonicalize(tree)).digest("hex");
   return { algorithm: CONTENT_ALGORITHM, digest: digest2 };
@@ -8426,7 +8433,7 @@ function discoverPacks(dir) {
     return [];
   }
   const refs = [];
-  for (const e of entries.sort((a, b) => a.name.localeCompare(b.name))) {
+  for (const e of entries.sort((a, b) => compareOrdinal(a.name, b.name))) {
     const full = path12.join(dir, e.name);
     if (e.isDirectory()) {
       if (packDirEntry(full)) refs.push(full);
@@ -8716,6 +8723,7 @@ var init_extensions = __esm({
     init_fs();
     init_project_config();
     init_version();
+    init_canonical_json();
     init_project();
     init_packstore();
     ProfileDefSchema = import_zod9.z.object({
@@ -22436,7 +22444,7 @@ var init_core = __esm({
 
 // src/core/rules/gate-identity.ts
 function doctrineIdentity(doctrine, builtinRules, gate) {
-  const byKey = (items, key) => [...items].sort((a, b) => key(a).localeCompare(key(b)));
+  const byKey = (items, key) => [...items].sort((a, b) => compareOrdinal(key(a), key(b)));
   return {
     /**
      * The BUILTIN rule set, by identity rather than by wairon version.
@@ -30445,6 +30453,37 @@ var path35 = __toESM(require("path"));
 init_core();
 init_fs();
 init_validation();
+function checkApproval(strict) {
+  if (!loadSystemSpec()) {
+    return {
+      state: "no-tree",
+      approved: !strict,
+      message: strict ? "No SDD spec tree here (.wai/specs) \u2014 and --strict asks for an approved design, so this is a failure. Run `wairon init` to start one, or drop --strict." : "No SDD spec tree here (.wai/specs) \u2014 there is no design to approve, so nothing is gated."
+    };
+  }
+  const lock = readLockState(computeGateStateId());
+  const record2 = lock.record;
+  switch (lock.state) {
+    case "locked":
+      return {
+        state: "locked",
+        approved: true,
+        message: `The design in this tree is the approved design \u2014 approved ${record2.lockedAt} by ${describeApprover(record2.lockedBy)}.`
+      };
+    case "stale":
+      return {
+        state: "stale",
+        approved: false,
+        message: `The design changed after it was approved (the approval on record is ${record2.lockedAt} by ${describeApprover(record2.lockedBy)}). Nothing says a human has seen what is about to merge. Fix: run \`wairon lock\` on this branch and commit the updated .wai/lock.json.`
+      };
+    default:
+      return {
+        state: "unlocked",
+        approved: !strict,
+        message: strict ? "No approval on record (.wai/lock.json is absent), and --strict asks for one. Run `wairon lock` and commit the record." : "No approval on record (.wai/lock.json is absent) \u2014 this project has not opted into the approval gate, so nothing is gated. Run `wairon lock` and commit the record to turn it on, or pass --strict to fail here instead."
+      };
+  }
+}
 async function runLock(options = {}, gate) {
   const diff = diffAgainstApproval();
   if (!diff) {
@@ -47147,6 +47186,17 @@ async function statusCommand(opts) {
   }
   await runStatus({ subsystem: opts.subsystem, recursive: opts.recursive });
 }
+async function lockCheckCommand(opts) {
+  const verdict = checkApproval(opts.strict === true);
+  if (!verdict.approved) logger.error(verdict.message);
+  else if (verdict.state === "locked") logger.success(verdict.message);
+  else logger.info(verdict.message);
+  if (verdict.approved) return;
+  process.exit(1);
+}
+program.command("lock-check").description("Merge gate: is the design in this working tree the design that was approved? Compares the tree's gate identity against the committed .wai/lock.json. Exits 1 when the design moved past its approval; passes with a notice when the project never locked, unless --strict.").option("--strict", "also fail when nothing was ever approved, or when there is no spec tree at all").action(async (opts) => {
+  await lockCheckCommand(opts);
+});
 program.command("lock").description("Final check before implementation: validate the spec tree as complete, freeze all specs to complete, and (re)generate the agent topology \u2014 only if it validates. In an attached checkout, locks the hosted project instead.").option("-y, --yes", "skip the confirmation prompt (for scripts / CI)").option("--subsystem <id>", "only lock specs in the specified subsystem").option("--no-recursive", "do not recursively validate subprojects").action(async (opts) => {
   await lockCommand(opts);
 });