@williambeto/ai-workflow 2.9.4 → 2.9.6

package/CHANGELOG.md

@@ -1,5 +1,49 @@
 ## [unreleased]
 
+## [2.9.6] - 2026-07-19
+
+### 🐛 Bug Fixes
+
+- Include committed release changes in evidence through an explicit Git base
+  reference while preserving current working-tree behavior by default
+- Replace duplicate aggregate validation inside the E2E suite with an exact
+  registry contract, keeping the observed aggregate gate in its dedicated CI
+  step
+
+### 🛡️ Hardening
+
+- Enforce TypeScript source checking in local validation and GitHub Actions
+- Point internal architecture documentation to existing canonical release,
+  template inventory, and status sources, with release-readiness regression
+  coverage
+
+### 📦 Dependencies
+
+- Update `@opencode-ai/sdk` from 1.17.18 to 1.18.3 after package-diff,
+  adapter, consumer, and packaging compatibility validation
+
+### 🧪 Testing
+
+- Cover committed, uncommitted, added, deleted, and invalid-ref release
+  evidence scopes
+- Preserve the complete 23-check validation registry while removing a
+  redundant network and browser execution path from E2E
+
+## [2.9.5] - 2026-07-17
+
+### 🛡️ Hardening
+
+- Declare the 17 required command-to-policy relationships through a
+  runtime-neutral canonical policy section
+- Fail validation when required command policy references are missing,
+  duplicated, unknown, or unexpected
+
+### 🧪 Testing
+
+- Add data-driven contract coverage for the complete policy reference map
+- Verify referenced policies remain available in OpenCode installations and
+  Codex command skills
+
 ## [2.9.4] - 2026-07-16
 
 ### 🛡️ Hardening

package/bin/ai-workflow.js

@@ -23,18 +23,18 @@ import {
   isTerminalFailure,
   readPackageFile,
   resolveWorkflowProfile
-} from "../chunk-JDSEOEYW.js";
+} from "../chunk-E7DHZFTN.js";
 import {
   EvidenceValidator,
   require_ajv,
   require_codegen
-} from "../chunk-FNT7DN3N.js";
+} from "../chunk-XRYGVFHF.js";
 import {
   EvidenceCollector,
   QualityGuard,
   ValidationPlanner,
   parseDeliveryOutcomeClaim
-} from "../chunk-PP42PB7M.js";
+} from "../chunk-D2W2ZW3Y.js";
 import {
   DeliveryDecisionEngine
 } from "../chunk-H7GIKXFO.js";
@@ -2194,6 +2194,9 @@ async function runDoctor({ cwd }) {
   }
 }
 
+// src/cli/commands/collect-evidence.ts
+import { spawnSync } from "child_process";
+
 // src/core/validation/canonical-finalization.ts
 var DELIVERY_SUMMARY_FIELDS = Object.freeze([
   "Status",
@@ -2217,6 +2220,93 @@ function formatDeliverySummary(summary) {
 }
 
 // src/cli/commands/collect-evidence.ts
+function runGit(cwd, args, errorMessage) {
+  const result = spawnSync("git", args, { cwd, encoding: "utf8" });
+  if (result.status !== 0) {
+    const detail = String(result.stderr || result.error?.message || "unknown Git error").trim();
+    throw new Error(`${errorMessage}${detail ? `: ${detail}` : ""}`);
+  }
+  return String(result.stdout || "");
+}
+function parseNameStatus(output) {
+  const changedFiles = /* @__PURE__ */ new Set();
+  const addedFiles = /* @__PURE__ */ new Set();
+  const deletedFiles = /* @__PURE__ */ new Set();
+  const tokens = output.split("\0").filter(Boolean);
+  for (let index = 0; index < tokens.length; ) {
+    const entry = tokens[index++];
+    const tabIndex = entry.indexOf("	");
+    const status = tabIndex >= 0 ? entry.slice(0, tabIndex) : entry;
+    const firstPath = tabIndex >= 0 ? entry.slice(tabIndex + 1) : tokens[index++];
+    if (!firstPath) continue;
+    if (status.startsWith("R")) {
+      const nextPath = tokens[index++];
+      changedFiles.add(firstPath);
+      deletedFiles.add(firstPath);
+      if (nextPath) {
+        changedFiles.add(nextPath);
+        addedFiles.add(nextPath);
+      }
+      continue;
+    }
+    if (status.startsWith("C")) {
+      const nextPath = tokens[index++];
+      if (nextPath) {
+        changedFiles.add(nextPath);
+        addedFiles.add(nextPath);
+      }
+      continue;
+    }
+    changedFiles.add(firstPath);
+    if (status.startsWith("A")) addedFiles.add(firstPath);
+    if (status.startsWith("D")) deletedFiles.add(firstPath);
+  }
+  return {
+    changedFiles: [...changedFiles],
+    addedFiles: [...addedFiles],
+    deletedFiles: [...deletedFiles]
+  };
+}
+function resolveGitDiffScope(cwd, baseRef) {
+  const normalizedRef = baseRef.trim();
+  if (!normalizedRef) throw new Error("--base-ref must not be empty");
+  const baseSha = runGit(
+    cwd,
+    ["rev-parse", "--verify", "--end-of-options", `${normalizedRef}^{commit}`],
+    `Invalid --base-ref '${normalizedRef}'`
+  ).trim();
+  const mergeBase = runGit(
+    cwd,
+    ["merge-base", baseSha, "HEAD"],
+    `Cannot determine a merge base for --base-ref '${normalizedRef}'`
+  ).trim();
+  const committed = parseNameStatus(runGit(
+    cwd,
+    ["diff", "--name-status", "-z", "--find-renames", `${mergeBase}..HEAD`],
+    `Cannot inspect committed changes from --base-ref '${normalizedRef}'`
+  ));
+  const workingTree = parseNameStatus(runGit(
+    cwd,
+    ["diff", "--name-status", "-z", "--find-renames", "HEAD"],
+    "Cannot inspect uncommitted changes"
+  ));
+  const untracked = runGit(
+    cwd,
+    ["ls-files", "--others", "--exclude-standard", "-z"],
+    "Cannot inspect untracked files"
+  ).split("\0").filter(Boolean);
+  const changedFiles = /* @__PURE__ */ new Set([...committed.changedFiles, ...workingTree.changedFiles, ...untracked]);
+  const addedFiles = /* @__PURE__ */ new Set([...committed.addedFiles, ...workingTree.addedFiles, ...untracked]);
+  const deletedFiles = /* @__PURE__ */ new Set([...committed.deletedFiles, ...workingTree.deletedFiles]);
+  for (const file of addedFiles) {
+    if (deletedFiles.delete(file)) addedFiles.delete(file);
+  }
+  return {
+    changedFiles: [...changedFiles].sort(),
+    addedFiles: [...addedFiles].sort(),
+    deletedFiles: [...deletedFiles].sort()
+  };
+}
 function resolvePoliciesFromLegacyMode(mode, evidencePolicy) {
   const activePolicy = evidencePolicy || (mode === "full" ? "required" : "optional");
   let risk = "medium";
@@ -2246,7 +2336,8 @@ async function runCollectEvidence({
   claimedOutcome = null,
   deliveryChangedFiles = null,
   deliveryAddedFiles = null,
-  deliveryDeletedFiles = null
+  deliveryDeletedFiles = null,
+  baseRef = null
 }) {
   if (process.env.AI_WORKFLOW_FINALIZATION_OWNER === "execute") {
     console.log("[FINALIZATION DEFERRED] Parent ai-workflow execute process owns canonical finalization.");
@@ -2254,7 +2345,8 @@ async function runCollectEvidence({
   }
   const policies = resolvePoliciesFromLegacyMode(mode, evidencePolicy);
   const workspaceGuard = new QualityGuard({ cwd, taskSlug, evidencePolicy: policies.evidencePolicy, riskLevel: policies.riskLevel });
-  const observedDeliveryFiles = deliveryChangedFiles ?? workspaceGuard.getChangedFiles();
+  const gitDiffScope = deliveryChangedFiles === null && baseRef ? resolveGitDiffScope(cwd, baseRef) : null;
+  const observedDeliveryFiles = deliveryChangedFiles ?? gitDiffScope?.changedFiles ?? workspaceGuard.getChangedFiles();
   const qualityGuard = new QualityGuard({
     cwd,
     taskSlug,
@@ -2291,8 +2383,8 @@ async function runCollectEvidence({
     workflowEvidence,
     claimedOutcome,
     deliveryChangedFiles: observedDeliveryFiles,
-    deliveryAddedFiles,
-    deliveryDeletedFiles,
+    deliveryAddedFiles: deliveryAddedFiles ?? gitDiffScope?.addedFiles,
+    deliveryDeletedFiles: deliveryDeletedFiles ?? gitDiffScope?.deletedFiles,
     riskLevel: policies.riskLevel
   });
   const evidence = await collector.collect(tasks, { writeArtifact: persist });
@@ -2307,7 +2399,7 @@ async function runCollectEvidence({
 }
 
 // src/core/healing/cli-remediation-executor.ts
-import { spawnSync, execSync as execSync2 } from "child_process";
+import { spawnSync as spawnSync2, execSync as execSync2 } from "child_process";
 import fs8 from "fs/promises";
 import path10 from "path";
 async function readScripts(cwd) {
@@ -2371,7 +2463,7 @@ function createCliRemediationExecutor(cwd) {
       process.stdout.write(`  \u2192 npm run ${scriptName} ... `);
       const isWin32 = process.platform === "win32";
       const cmd = isWin32 ? "npm.cmd" : "npm";
-      const result = spawnSync(cmd, ["run", scriptName], {
+      const result = spawnSync2(cmd, ["run", scriptName], {
         cwd,
         shell: false,
         encoding: "utf8",
@@ -2440,6 +2532,8 @@ function stripMarkdownFence(content) {
 }
 
 // src/core/sdd/approval-receipt.ts
+var Ajv = import_ajv.default;
+var addFormats = import_ajv_formats.default;
 var ApprovalReceiptValidator = class {
   cwd;
   constructor({ cwd = process.cwd() } = {}) {
@@ -2463,8 +2557,8 @@ var ApprovalReceiptValidator = class {
       receipt = JSON.parse(await fs10.readFile(absoluteReceiptPath, "utf8"));
       const root = getPackageRoot();
       const schema = JSON.parse(await fs10.readFile(path12.join(root, "dist-assets/schemas/approval-receipt.schema.json"), "utf8"));
-      const ajv = new import_ajv.default({ allErrors: true });
-      (0, import_ajv_formats.default)(ajv);
+      const ajv = new Ajv({ allErrors: true });
+      addFormats(ajv);
       const validateSchema = ajv.compile(schema);
       if (!validateSchema(receipt)) {
         const errors = (validateSchema.errors || []).map((error) => `${error.instancePath} ${error.message}`).join(", ");
@@ -2488,6 +2582,7 @@ var ApprovalReceiptValidator = class {
 var import_ajv2 = __toESM(require_ajv(), 1);
 import fs11 from "fs/promises";
 import path13 from "path";
+var Ajv2 = import_ajv2.default;
 function isContained(root, candidate) {
   return candidate === root || candidate.startsWith(`${root}${path13.sep}`);
 }
@@ -2542,7 +2637,7 @@ var TechnicalPlanValidator = class {
     }
     try {
       const schema = JSON.parse(await fs11.readFile(path13.join(getPackageRoot(), "dist-assets/schemas/technical-plan.schema.json"), "utf8"));
-      const validateSchema = new import_ajv2.default({ allErrors: true }).compile(schema);
+      const validateSchema = new Ajv2({ allErrors: true }).compile(schema);
       if (!validateSchema(plan)) {
         const errors = (validateSchema.errors || []).map((error) => `${error.instancePath} ${error.message}`).join(", ");
         return { valid: false, reason: `Technical plan schema violation: ${errors}` };
@@ -3351,7 +3446,7 @@ async function runFastTrackValidation(cwd, result, checkBranchSafety) {
   const evidencePath = path16.join(cwd, "EVIDENCE.json");
   const hasEvidence = await fs14.access(evidencePath).then(() => true).catch(() => false);
   if (hasEvidence) {
-    const { EvidenceValidator: EvidenceValidator2 } = await import("../evidence-validator-HS3NTWAB.js");
+    const { EvidenceValidator: EvidenceValidator2 } = await import("../evidence-validator-6GD442JE.js");
     const isTest = process.env.NODE_ENV === "test" || process.env.VITEST === "true";
     const evidenceValidator = new EvidenceValidator2({ cwd, skipFileCheck: isTest, skipGitCheck: isTest });
     const valResult = await evidenceValidator.validate();
@@ -3662,7 +3757,7 @@ Usage:
   ai-workflow run --spec-path=<path> [--approval-path=<path>] [--runtime=<opencode|codex>]
   ai-workflow init [--yes] [--force] [--dry-run] [--no-install] [--no-overwrite] [--claude] [--codex] [--antigravity] [--profile=<profile>]
   ai-workflow validate [--a11y] [--visual-dist=<path>] [--port=<port>]
-  ai-workflow collect-evidence [--task=<slug>] [--evidence-policy=<optional|required>] [--mode=<quick|standard|full>] [--dry-run] [--visual-dist=<path>] [--port=<port>]
+  ai-workflow collect-evidence [--task=<slug>] [--evidence-policy=<optional|required>] [--mode=<quick|standard|full>] [--base-ref=<git-ref>] [--dry-run] [--visual-dist=<path>] [--port=<port>]
   ai-workflow doctor
   ai-workflow clean [--yes] [--dry-run] [--purge-agents]
   ai-workflow lint skills
@@ -3686,6 +3781,7 @@ function parseFlags(args) {
   const taskArg = args.find((arg) => arg.startsWith("--task="));
   const modeArg = args.find((arg) => arg.startsWith("--mode="));
   const evidencePolicyArg = args.find((arg) => arg.startsWith("--evidence-policy="));
+  const baseRefArg = args.find((arg) => arg.startsWith("--base-ref="));
   const requestArg = args.find((arg) => arg.startsWith("--request="));
   const visualDistArg = args.find((arg) => arg.startsWith("--visual-dist="));
   const portArg = args.find((arg) => arg.startsWith("--port="));
@@ -3708,6 +3804,7 @@ function parseFlags(args) {
     taskSlug: taskArg ? taskArg.replace("--task=", "") : void 0,
     mode: modeArg ? modeArg.replace("--mode=", "") : void 0,
     evidencePolicy: evidencePolicyArg ? evidencePolicyArg.replace("--evidence-policy=", "") : void 0,
+    baseRef: baseRefArg ? baseRefArg.replace("--base-ref=", "") : void 0,
     request: requestArg ? requestArg.replace("--request=", "") : void 0,
     visualDist: visualDistArg ? visualDistArg.replace("--visual-dist=", "") : void 0,
     port: portArg ? portArg.replace("--port=", "") : void 0,
@@ -3751,13 +3848,14 @@ var commandMap = {
       taskSlug: flags.taskSlug,
       mode: flags.mode,
       evidencePolicy: flags.evidencePolicy,
+      baseRef: flags.baseRef,
       dryRun: flags.dryRun,
       visualDist: flags.visualDist,
       port: flags.port
     });
   },
   validate: async (_, flags) => {
-    const { runValidate } = await import("../validate-7G3HBE2K.js");
+    const { runValidate } = await import("../validate-YMBSICJL.js");
     await runValidate({
       cwd: process.cwd(),
       taskSlug: flags.taskSlug,