aw-spec-cli 0.1.15 → 0.1.16

package/assets/.appweaver/orchestrator/workflows/aw-spec-implement-ui.orch.yaml

@@ -104,6 +104,23 @@ vars:
   design_pass: "0"
   design_spec_version: ""
   design_stale: "false"
+  # WHICH LANES story-plan designed and which it dropped. Absent on a story designed before
+  # the keys existed, which is why the default message below keeps both readings.
+  designed_lanes: ""
+  dropped_lanes: ""
+  lane_keys_present: "false"
+  fe_lane_dropped: "false"
+  no_design_msg: ""
+  # the analyze-design verdict — law 40's evidence. certified defaults FALSE so a probe that
+  # could not run fails CLOSED, and the message default carries a route for the same reason.
+  pass_plan_hash: ""
+  gate_status: ""
+  gate_certified: "false"
+  gate_aborted: "false"
+  gate_gap_refs: ""
+  gate_report: ""
+  gate_lane_sha: ""
+  gate_msg: "The analyze-design verdict could not be read, so this run cannot tell whether the feature plans were ever certified. Run /appweaver analyze-design, then re-run."
   service_design_doc: ""
   # the feature's current code, per lane (OKF)
   okf_concept: ""
@@ -142,6 +159,13 @@ workflow:
     on_empty: stop
     on_empty_message: "No active feature. Run /appweaver select-feature first (pick or create the aggregate, e.g. Order), then re-run implement-ui."
 
+  # 1b. THE LEDGER FENCE — the same one implement carries, for the same two readings:
+  #     the staleness computation below and the acceptance pass at the end.
+  - id: spec_state_guard
+    action: include
+    module: .appweaver/orchestrator/modules/spec-state-gate.orch.yaml
+    with: { command: "/appweaver implement-ui" }
+
   # 2. WHICH STORY — the same resolution story-plan and implement use.
   - id: story_scan
     action: execute_script
@@ -173,6 +197,11 @@ workflow:
       - { name: design_pass,         from: "$.fe_last_pass" }
       - { name: design_spec_version, from: "$.fe_doc_spec_version" }
       - { name: design_stale,        from: "$.fe_doc_stale" }
+      - { name: pass_plan_hash,      from: "$.fe_pass_plan_hash" }
+      - { name: designed_lanes,      from: "$.designed_lanes_csv" }
+      - { name: dropped_lanes,       from: "$.dropped_lanes_csv" }
+      - { name: lane_keys_present,   from: "$.lane_keys_present" }
+      - { name: fe_lane_dropped,     from: "$.fe_lane_dropped" }
       - { name: service_design_doc,  from: "$.be_doc_path" }
   - id: require_open_backlog
     action: verify_context
@@ -212,6 +241,11 @@ workflow:
       - { name: design_pass,         from: "$.fe_last_pass" }
       - { name: design_spec_version, from: "$.fe_doc_spec_version" }
       - { name: design_stale,        from: "$.fe_doc_stale" }
+      - { name: pass_plan_hash,      from: "$.fe_pass_plan_hash" }
+      - { name: designed_lanes,      from: "$.designed_lanes_csv" }
+      - { name: dropped_lanes,       from: "$.dropped_lanes_csv" }
+      - { name: lane_keys_present,   from: "$.lane_keys_present" }
+      - { name: fe_lane_dropped,     from: "$.fe_lane_dropped" }
       - { name: service_design_doc,  from: "$.be_doc_path" }
   - id: require_story
     action: verify_context
@@ -230,11 +264,34 @@ workflow:
   # 3. THE STORY MUST HAVE A UI DESIGN. A story with a service design and no UI one is
   #    not a failure — it is a slice with no user-facing surface, and the message says
   #    so rather than implying something is broken.
+  # WHICH OF THE TWO READINGS IT IS, where the story says. analyze-design STOPS on a lane
+  # whose plan is behind; story-plan DROPS it and designs the other — so one command later
+  # "this slice has no user-facing surface" and "the UI lane was out of scope when this was
+  # designed" are the same absence on disk, and the message below could only offer both.
+  # story-plan now stamps `designed_lanes:` and `dropped_lanes:`, so the answer is recorded.
+  # ORDERED SETS, most specific last. The default is the two-reading message, which stays
+  # exactly right for a story designed BEFORE those keys existed: it has neither, and a
+  # missing key must never be read as "no user-facing surface".
+  - id: no_design_msg_default
+    action: set
+    vars:
+      no_design_msg: "Story {{story}} has no UI design — {{story_dir}}/story-frontend-plan.md does not exist, and the story records no designed/dropped lanes (it was designed before the kit stamped them). Either this slice has no user-facing surface (nothing to do here; run /appweaver implement for the service half), or the UI lane was out of scope when it was designed — a frontend lane that is undeclared, or a frontend-plan.md that is missing or behind the spec, drops that lane from a story-plan run and says so. Fix whichever it was and re-run /appweaver story-plan {{story}}."
+  - id: no_design_msg_no_surface
+    condition: "{{lane_keys_present}} == true"
+    action: set
+    vars:
+      no_design_msg: "Story {{story}} has no UI design and its UI lane was NOT dropped — the story records designed lanes [{{designed_lanes}}] and dropped lanes [{{dropped_lanes}}], so this slice genuinely has no user-facing surface. There is nothing for implement-ui to do here; run /appweaver implement for the service half. If it SHOULD have a UI surface, declare the frontend lane and re-run /appweaver story-plan {{story}}."
+  - id: no_design_msg_dropped
+    condition: "{{fe_lane_dropped}} == true"
+    action: set
+    vars:
+      no_design_msg: "Story {{story}} has no UI design because the UI LANE WAS DROPPED when it was designed — the story records dropped lanes [{{dropped_lanes}}]. This is not a slice without a user-facing surface; it is one whose UI half was never designed, because the frontend lane was undeclared or frontend-plan.md was missing or behind the spec. Fix that lane (/appweaver plan-ui, or declare it with /appweaver select-stack), then re-run /appweaver story-plan {{story}} and this command."
+
   - id: require_design
     action: verify_context
     require_true: design_exists
     on_false: stop
-    on_false_message: "Story {{story}} has no UI design — {{story_dir}}/story-frontend-plan.md does not exist. Either this slice has no user-facing surface (nothing to do here; run /appweaver implement for the service half), or the UI lane was out of scope when it was designed — a frontend lane that is undeclared, or a frontend-plan.md that is missing or behind the spec, drops that lane from a story-plan run and says so. Fix whichever it was and re-run /appweaver story-plan {{story}}."
+    on_false_message: "{{no_design_msg}}"
 
   # 3a. Announced, never refused — the same contract implement keeps. design_stale is a
   #     JSON boolean, so `condition:` does the deciding and the value gate is only the
@@ -253,6 +310,62 @@ workflow:
     on_mismatch: continue
     on_mismatch_message: "The spec has moved on ids THIS story carries: {{stale_csv}}. Whatever this run generates for them realises superseded wording. Consider /appweaver sync-stories to bring the backlog back in step, then /appweaver story-plan {{story}}, before building."
 
+  # ═══════ 3a-bis. LAW 40, THE LAST HOP — the plan this pass was designed against ═══════
+  # THREE HASHES, not two. story-plan proved the feature plan was certified in the shape it
+  # was in when this pass was designed, and story-plan-doc stamped that certified hash into
+  # the pass header. But a pass is written once and read forever: comparing only the CURRENT
+  # plan to the CURRENT verdict would let a pass designed against plan H1 still generate
+  # after the plan was edited to H2 and re-gated — which is precisely the case law 40 names,
+  # one level below where it was being checked.
+  #   pass hash        what this pass was designed against  (the story pass header)
+  #   verdict hash     what analyze-design last certified   (the gate verdict)
+  # A MISMATCH IS A STOP, at the same severity as never-gated: continuing ships code built
+  # to an architecture nobody approved. Per lane, and only for the lane this command builds.
+  - id: gate_verdict
+    action: execute_script
+    on_error: continue
+    script: { ref: actions }
+    subcommand: gate-read
+    args: ["--feature-dir", "{{feature_dir}}", "--gate", "analyze-design"]
+    outputs:
+      - { name: gate_status,    from: "$.status" }
+      - { name: gate_certified, from: "$.certified" }
+      - { name: gate_aborted,   from: "$.aborted" }
+      - { name: gate_gap_refs,  from: "$.gap_refs_csv" }
+      - { name: gate_report,    from: "$.report" }
+      - { name: gate_lane_sha,  from: "$.frontend_sha256" }
+
+  # Three reasons, three routes; ordered sets, last match wins. Aborted is last because it
+  # also carries status "fail" — the red gate_result_open writes BEFORE any analysis — and
+  # sending someone to read gaps that were never found is the one wrong answer here.
+  - id: gate_msg_never
+    action: set
+    vars: { gate_msg: "The feature plans for this feature have never been certified: there is no analyze-design verdict beside them. Generation builds from a story pass that sits under an unapproved architecture. Run /appweaver analyze-design, then /appweaver story-plan {{story}}, then re-run /appweaver implement-ui." }
+  - id: gate_msg_red
+    condition: "{{gate_status}} == fail"
+    action: set
+    vars: { gate_msg: "The feature plans do NOT conform to the spec: analyze-design's last verdict is FAIL on {{gate_gap_refs}} (report: {{gate_report}}). Close those gaps before generating code beneath them, then re-run /appweaver implement-ui." }
+  - id: gate_msg_aborted
+    condition: "{{gate_aborted}} == true"
+    action: set
+    vars: { gate_msg: "The last analyze-design run STARTED and never reached a verdict — the red on disk is the one it writes before any analysis, so nothing was found and there are no gaps to read. The plans are UNCERTIFIED, not rejected. Run /appweaver analyze-design to completion, then re-run /appweaver implement-ui." }
+
+  - id: gate_certified_guard
+    action: verify_context
+    require_true: gate_certified
+    on_false: stop
+    on_false_message: "{{gate_msg}}"
+
+  # An EMPTY pass hash fails this, and that is correct: a pass written before the hash was
+  # stamped cannot say which plan shape it was designed against, so nothing can prove it was
+  # designed against the approved one. The route is the same either way — re-design.
+  - id: pass_plan_shape_guard
+    action: verify_context
+    require_value: pass_plan_hash
+    equals: "{{gate_lane_sha}}"
+    on_mismatch: stop
+    on_mismatch_message: "Design pass {{design_pass}} for story {{story}} was designed against a frontend plan that is NOT the one analyze-design currently certifies — the plan has been edited and re-gated since, or this pass predates plan-hash stamping and cannot say what it was designed against. Generating from it would build to an architecture nobody approved for this shape of the plan. Re-run /appweaver story-plan {{story}} to design against the currently certified plan, then re-run /appweaver implement-ui."
+
   # 4. THE FRONTEND LANE and its source path — the only subtree this phase may write
   #    into, resolved before the project gate that searches it.
   - id: lane_gate
@@ -353,9 +466,12 @@ workflow:
         create and what to modify. Create ONLY the files it names as new; modify the
         named existing files IN PLACE. Every other file belongs to work already done —
         do not regenerate, reformat or "tidy" it.
-      - The story delivers {{exercises_csv}} and must satisfy {{constraints_csv}}, of
-        which the UX- constraints are yours to realise. Anything outside those ids is
-        another story's work, even if you can see it is missing.
+      - The story delivers {{exercises_csv}} and must satisfy {{constraints_csv}} — the
+        complete set of bounds the spec declares for this aggregate, stamped into the
+        story's frontmatter by the kit rather than transcribed by anyone. ALL of them
+        apply here: the UX- are yours to realise, and the CN-/DC-/IC- still bind what this
+        surface may show, send and store. Anything outside those ids is another story's
+        work, even if you can see it is missing.
       - The code that already exists for this feature, per lane, is below. The UI files
         ({{ui_source_file_count}} on disk) are yours to read before you edit; the
         service list is there so you can see what the contract is actually backed by.
@@ -444,9 +560,16 @@ workflow:
     action: execute_script
     script: { ref: xref }
     subcommand: concept-upsert
-    args: ["--feature-dir", "{{feature_dir}}", "--source-files", "{{files}}", "--merge", "--lane", "frontend", "--origin", "greenfield"]
+    # --ids + --slice record WHICH REQUIREMENT this run's files realise, as Requirement
+    # Anchors rows in the concept. Both halves were already here and thrown away: the ids
+    # the story exercises, and the files just generated. Only `adopt` writes a
+    # source-map.md, so without this every id on a greenfield feature came back unanchored
+    # at analyze-slice and the trace pass had to read the whole tree to find out what
+    # implements what. Reconcile-on-write, keyed by slice + lane.
+    args: ["--feature-dir", "{{feature_dir}}", "--source-files", "{{files}}", "--merge", "--lane", "frontend", "--origin", "greenfield", "--ids", "{{exercises_csv}}", "--slice", "{{story}}"]
     outputs:
-      - { name: okf_concept, from: "$.concept" }
+      - { name: okf_concept,    from: "$.concept" }
+      - { name: okf_anchors,    from: "$.anchors_written" }
 
   # ═══════════════ ACCEPTANCE — the ONE place the spec is read ═════════════════
   # READ-ONLY and REPORT-ONLY: it never edits code, never edits the pass, and never
@@ -512,7 +635,7 @@ workflow:
       Nothing was changed to fix this: the code follows UI design pass {{design_pass}}, so a gap
       here means either the design was wrong or the spec has moved. Route by which it is —
       the design is wrong: /appweaver story-plan {{story}} (a new pass supersedes this one);
-      the spec is wrong: /appweaver sync-spec, then sync-stories, then story-plan.
+      the spec is wrong: /appweaver sync-spec (⌛ not yet built — until it is, fold the change back by hand under .appweaver/SPEC-EDIT-PROTOCOL.md), then sync-stories, then story-plan.
       Run /appweaver build either way — a design that is right and code that does not compile
       is a third thing, and build is where that one surfaces.
 
@@ -537,4 +660,4 @@ outputs:
   okf_concept: "{{okf_concept}} (this run's files MERGED into ui_source_files; the service lane's source_files is untouched)"
   acceptance: "ok={{accept_ok}} · gaps: {{accept_gaps}}"
   stale_ids: "{{stale_csv}}"
-  next: "/appweaver build — it compiles every declared lane, so a break in either surfaces there. Then /appweaver analyze-slice. The story stays OPEN until /appweaver close-story ratifies its ADRs, flips its interface entries live and archives the passes."
+  next: "/appweaver build — it compiles every declared lane, so a break in either surfaces there. Then /appweaver analyze-slice. The story stays OPEN: /appweaver close-story — which would ratify its ADRs, flip its interface entries live and archive the passes — is ⌛ NOT BUILT YET, so there is no transition out of in-flight and no last gate before merge."

package/assets/.appweaver/orchestrator/workflows/aw-spec-implement.orch.yaml

@@ -94,6 +94,12 @@ vars:
   story_title: ""
   exercises_csv: ""
   constraints_csv: ""
+  # UNASKED IS NOT UNMATCHED. detect-project answers true whenever no --ecosystem was
+  # given, and the gate below only reads it on the repo-scope fallback — so the default
+  # has to be permissive or a probe that could not run would refuse a scaffolded lane.
+  ecosystem_match: "true"
+  project_scope: ""
+  project_markers: ""
   current_version: ""
   stale_csv: ""
   stale_note: ""
@@ -106,6 +112,16 @@ vars:
   design_pass: "0"
   design_spec_version: ""
   design_stale: "false"
+  # the analyze-design verdict — law 40's evidence. certified defaults FALSE so a probe that
+  # could not run fails CLOSED, and the message default carries a route for the same reason.
+  pass_plan_hash: ""
+  gate_status: ""
+  gate_certified: "false"
+  gate_aborted: "false"
+  gate_gap_refs: ""
+  gate_report: ""
+  gate_lane_sha: ""
+  gate_msg: "The analyze-design verdict could not be read, so this run cannot tell whether the feature plans were ever certified. Run /appweaver analyze-design, then re-run."
   # the feature's current code, per lane (OKF)
   okf_concept: ""
   coverage_digest: ""
@@ -149,6 +165,15 @@ workflow:
     on_empty: stop
     on_empty_message: "No active feature. Run /appweaver select-feature first (pick or create the aggregate, e.g. Order), then re-run implement."
 
+  # 1b. THE LEDGER FENCE. Generation is design-only by contract, but this run reads the
+  #     spec twice all the same: stale_csv below is computed against the ledger, and the
+  #     acceptance pass at the end reads spec.md as the wording the code is judged
+  #     against. Both are worthless if the version does not name the contents.
+  - id: spec_state_guard
+    action: include
+    module: .appweaver/orchestrator/modules/spec-state-gate.orch.yaml
+    with: { command: "/appweaver implement" }
+
   # 2. WHICH STORY. Same resolution story-plan uses: an explicit id in the input wins,
   #    anything else (nothing named, an unknown id, several) becomes a pick from the open
   #    backlog. One scan returns every fact the gates below read.
@@ -182,6 +207,7 @@ workflow:
       - { name: design_pass,         from: "$.be_last_pass" }
       - { name: design_spec_version, from: "$.be_doc_spec_version" }
       - { name: design_stale,        from: "$.be_doc_stale" }
+      - { name: pass_plan_hash,      from: "$.be_pass_plan_hash" }
   - id: require_open_backlog
     action: verify_context
     require_true: any_open
@@ -220,6 +246,7 @@ workflow:
       - { name: design_pass,         from: "$.be_last_pass" }
       - { name: design_spec_version, from: "$.be_doc_spec_version" }
       - { name: design_stale,        from: "$.be_doc_stale" }
+      - { name: pass_plan_hash,      from: "$.be_pass_plan_hash" }
   - id: require_story
     action: verify_context
     require_true: resolved
@@ -264,6 +291,62 @@ workflow:
     on_mismatch: continue
     on_mismatch_message: "The spec has moved on ids THIS story carries: {{stale_csv}}. Whatever this run generates for them realises superseded wording. Consider /appweaver sync-stories to bring the backlog back in step, then /appweaver story-plan {{story}}, before building."
 
+  # ═══════ 3a-bis. LAW 40, THE LAST HOP — the plan this pass was designed against ═══════
+  # THREE HASHES, not two. story-plan proved the feature plan was certified in the shape it
+  # was in when this pass was designed, and story-plan-doc stamped that certified hash into
+  # the pass header. But a pass is written once and read forever: comparing only the CURRENT
+  # plan to the CURRENT verdict would let a pass designed against plan H1 still generate
+  # after the plan was edited to H2 and re-gated — which is precisely the case law 40 names,
+  # one level below where it was being checked.
+  #   pass hash        what this pass was designed against  (the story pass header)
+  #   verdict hash     what analyze-design last certified   (the gate verdict)
+  # A MISMATCH IS A STOP, at the same severity as never-gated: continuing ships code built
+  # to an architecture nobody approved. Per lane, and only for the lane this command builds.
+  - id: gate_verdict
+    action: execute_script
+    on_error: continue
+    script: { ref: actions }
+    subcommand: gate-read
+    args: ["--feature-dir", "{{feature_dir}}", "--gate", "analyze-design"]
+    outputs:
+      - { name: gate_status,    from: "$.status" }
+      - { name: gate_certified, from: "$.certified" }
+      - { name: gate_aborted,   from: "$.aborted" }
+      - { name: gate_gap_refs,  from: "$.gap_refs_csv" }
+      - { name: gate_report,    from: "$.report" }
+      - { name: gate_lane_sha,  from: "$.backend_sha256" }
+
+  # Three reasons, three routes; ordered sets, last match wins. Aborted is last because it
+  # also carries status "fail" — the red gate_result_open writes BEFORE any analysis — and
+  # sending someone to read gaps that were never found is the one wrong answer here.
+  - id: gate_msg_never
+    action: set
+    vars: { gate_msg: "The feature plans for this feature have never been certified: there is no analyze-design verdict beside them. Generation builds from a story pass that sits under an unapproved architecture. Run /appweaver analyze-design, then /appweaver story-plan {{story}}, then re-run /appweaver implement." }
+  - id: gate_msg_red
+    condition: "{{gate_status}} == fail"
+    action: set
+    vars: { gate_msg: "The feature plans do NOT conform to the spec: analyze-design's last verdict is FAIL on {{gate_gap_refs}} (report: {{gate_report}}). Close those gaps before generating code beneath them, then re-run /appweaver implement." }
+  - id: gate_msg_aborted
+    condition: "{{gate_aborted}} == true"
+    action: set
+    vars: { gate_msg: "The last analyze-design run STARTED and never reached a verdict — the red on disk is the one it writes before any analysis, so nothing was found and there are no gaps to read. The plans are UNCERTIFIED, not rejected. Run /appweaver analyze-design to completion, then re-run /appweaver implement." }
+
+  - id: gate_certified_guard
+    action: verify_context
+    require_true: gate_certified
+    on_false: stop
+    on_false_message: "{{gate_msg}}"
+
+  # An EMPTY pass hash fails this, and that is correct: a pass written before the hash was
+  # stamped cannot say which plan shape it was designed against, so nothing can prove it was
+  # designed against the approved one. The route is the same either way — re-design.
+  - id: pass_plan_shape_guard
+    action: verify_context
+    require_value: pass_plan_hash
+    equals: "{{gate_lane_sha}}"
+    on_mismatch: stop
+    on_mismatch_message: "Design pass {{design_pass}} for story {{story}} was designed against a backend plan that is NOT the one analyze-design currently certifies — the plan has been edited and re-gated since, or this pass predates plan-hash stamping and cannot say what it was designed against. Generating from it would build to an architecture nobody approved for this shape of the plan. Re-run /appweaver story-plan {{story}} to design against the currently certified plan, then re-run /appweaver implement."
+
   # 4. THE SERVICE LANE and its source path. This phase writes code, and the lane's root
   #    is the only subtree it may write into — so this runs before the project gate,
   #    which searches that subtree.
@@ -277,21 +360,46 @@ workflow:
   #    searches the LANE'S OWN subtree for an ecosystem manifest, falling back to the
   #    whole repo for the layout that keeps its manifest beside the lane root rather than
   #    inside it. How the project got there is not asked.
+  #    THE FALLBACK IS DELIBERATE AND IT NEEDED A DISCRIMINATOR. Searching the whole repo
+  #    when the lane's own subtree has no manifest is right — a .NET .sln legitimately sits
+  #    ABOVE the src/ it builds — but it answered with whatever manifest it found first, so
+  #    in a two-lane repo where only the frontend is scaffolded, the SERVICE lane's gate
+  #    passed on the frontend's package.json. Which is exactly the failure implement-ui's
+  #    `project_scope == lane` rule was written to prevent, one lane over.
+  #    `--ecosystem` is the fix, and NOT implement-ui's rule: this passes the value
+  #    lane-gate has already bound from stacks.json (that include runs above), so the repo
+  #    -scope hit is accepted only when the manifest is one this lane's ecosystem knows.
+  #    Nothing here re-derives it — a second guess is a second thing to keep in step.
   - id: detect_foundation
     action: execute_script
     script: { ref: actions }
     subcommand: detect-project
-    args: ["--root", "{{lane_source_path}}"]
+    args: ["--root", "{{lane_source_path}}", "--ecosystem", "{{lane_ecosystem}}"]
     outputs:
       - { name: foundation_present, from: "$.scaffolded" }
       - { name: project_markers,    from: "$.markers" }
       - { name: project_scope,      from: "$.scope" }
+      - { name: ecosystem_match,    from: "$.ecosystem_match" }
   - id: foundation_gate
     action: verify_context
     require_true: foundation_present
     on_false: stop
     on_false_message: "No project found under the {{lane_id}} lane's source path `{{lane_source_path}}`, nor anywhere else in this repository. Implement GENERATES this story's code into an existing project tree, so one has to be scaffolded first: run /appweaver foundation <FoundationName> <AppName> where a foundation bundle ships for this stack, or create the project with the stack's own tooling under that path. Any ecosystem manifest marks it — .sln/.csproj, pom.xml, build.gradle(.kts), package.json, go.mod, Cargo.toml or pyproject.toml."
 
+  # 5b. THE GATE PASSED ON SOMEBODY ELSE'S PROJECT. A repo-scope hit whose manifests are
+  #     none of this lane's ecosystem means the search fell back past the lane root and
+  #     found the OTHER lane's project. STOPS rather than warns: the next thing this run
+  #     does is generate {{lane_language}} code, and it has just been told there is nowhere
+  #     of that kind to put it — carrying on writes a service tree inside a frontend, or
+  #     into the repo root. Scoped to the fallback, so the deliberate manifest-above-the-lane
+  #     layout (a .sln over src/) still passes: that hit IS this lane's ecosystem.
+  - id: foundation_ecosystem_gate
+    condition: "{{project_scope}} == repo"
+    action: verify_context
+    require_true: ecosystem_match
+    on_false: stop
+    on_false_message: "The {{lane_id}} lane's source path `{{lane_source_path}}` holds no project, and the repo-wide fallback found only manifests that are not {{lane_ecosystem}}: {{project_markers}}. That is the OTHER lane's project — this gate passing on it would send {{lane_language}} code into a tree built for something else. Scaffold this lane: /appweaver foundation <FoundationName> <AppName> where a bundle ships for {{lane_profile}}, or create the project with the stack's own tooling under `{{lane_source_path}}`. (A manifest deliberately kept ABOVE the lane root — a .sln over src/ — is accepted, because it is this lane's ecosystem.)"
+
   # 6. WHAT ALREADY EXISTS, from the feature's OKF concept, split by lane. This is what
   #    makes the run incremental: the pass names the files it changes, and this names the
   #    files that are there to change. Advisory — the first story of a greenfield feature
@@ -363,8 +471,12 @@ workflow:
         to modify. Create ONLY the files it names as new; modify the named existing
         files IN PLACE. Every other file in this feature belongs to work that is
         already done — do not regenerate, reformat or "tidy" it.
-      - The story delivers {{exercises_csv}} and must satisfy {{constraints_csv}}.
-        Anything outside those ids is another story's work, even if you can see it is
+      - The story delivers {{exercises_csv}} and must satisfy {{constraints_csv}} — the
+        complete set of bounds the spec declares for this aggregate, stamped into the
+        story's frontmatter by the kit rather than transcribed by anyone. Satisfy the
+        CN-, DC- and IC- among them. IGNORE the UX-: those are what the UI lane realises,
+        and a service-side obligation is stated as a CN- by design. Anything outside those
+        ids is another story's work, even if you can see it is
         missing. If the slice genuinely cannot be built without touching shared
         structure, make the smallest change that works and SAY SO in your summary.
       - The code that already exists for this feature, per lane, is below. The service
@@ -445,9 +557,16 @@ workflow:
     action: execute_script
     script: { ref: xref }
     subcommand: concept-upsert
-    args: ["--feature-dir", "{{feature_dir}}", "--source-files", "{{files}}", "--merge", "--lane", "backend", "--origin", "greenfield"]
+    # --ids + --slice record WHICH REQUIREMENT this run's files realise, as Requirement
+    # Anchors rows in the concept. Both halves were already here and thrown away: the ids
+    # the story exercises, and the files just generated. Only `adopt` writes a
+    # source-map.md, so without this every id on a greenfield feature came back unanchored
+    # at analyze-slice and the trace pass had to read the whole tree to find out what
+    # implements what. Reconcile-on-write, keyed by slice + lane.
+    args: ["--feature-dir", "{{feature_dir}}", "--source-files", "{{files}}", "--merge", "--lane", "backend", "--origin", "greenfield", "--ids", "{{exercises_csv}}", "--slice", "{{story}}"]
     outputs:
-      - { name: okf_concept, from: "$.concept" }
+      - { name: okf_concept,    from: "$.concept" }
+      - { name: okf_anchors,    from: "$.anchors_written" }
 
   # 8a. Cross-slice edges are a FEATURE property, not a story's: which sibling
   #     aggregates this one references is stated by the feature plan's domain model,
@@ -568,7 +687,7 @@ workflow:
       Nothing was changed to fix this: the code follows design pass {{design_pass}}, so a gap
       here means either the design was wrong or the spec has moved. Route by which it is —
       the design is wrong: /appweaver story-plan {{story}} (a new pass supersedes this one);
-      the spec is wrong: /appweaver sync-spec, then sync-stories, then story-plan.
+      the spec is wrong: /appweaver sync-spec (⌛ not yet built — until it is, fold the change back by hand under .appweaver/SPEC-EDIT-PROTOCOL.md), then sync-stories, then story-plan.
       Run /appweaver build either way — a design that is right and code that does not compile
       is a third thing, and build is where that one surfaces.
 
@@ -593,4 +712,4 @@ outputs:
   okf_concept: "{{okf_concept}} (this run's files MERGED into source_files; {{xref_edge_count}} cross-slice edge(s) recorded into sibling aggregates)"
   acceptance: "ok={{accept_ok}} · gaps: {{accept_gaps}}"
   stale_ids: "{{stale_csv}}"
-  next: "/appweaver build — it compiles every declared lane. Then /appweaver analyze-slice (spec ↔ code, through the design), and /appweaver implement-ui if this story has a UI design. The story stays OPEN until /appweaver close-story ratifies its ADRs, flips its interface entries live and archives the passes."
+  next: "/appweaver build — it compiles every declared lane. Then /appweaver analyze-slice (spec ↔ code, through the design), and /appweaver implement-ui if this story has a UI design. The story stays OPEN: /appweaver close-story — which would ratify its ADRs, flip its interface entries live and archive the passes — is ⌛ NOT BUILT YET, so there is no transition out of in-flight and no last gate before merge."

package/assets/.appweaver/orchestrator/workflows/aw-spec-plan-ui.orch.yaml

@@ -30,15 +30,17 @@
 # stamped at the same moment never contends with it. Hand edits are refused unless accept_manual:true
 # folds them in. The model writes NO version anywhere.
 #
-# WHERE IT SITS. specify/sync-spec move the spec; the developer then runs plan (the
+# WHERE IT SITS. specify/sync-spec (⌛ sync-spec is not built yet; the hand route is
+# .appweaver/SPEC-EDIT-PROTOCOL.md) move the spec; the developer then runs plan (the
 # service lane) and plan-ui, which conform each lane's design to what moved. FE story
 # designs READ this document for the ids they carry and NEVER write back — nothing
 # merges into it, so it keeps exactly one writer. It is the FEATURE-LEVEL
 # ARCHITECTURAL CONFIRMATION for the experience, with the concrete component-level
 # work left to the per-story passes.
 #
-# IT READS THE CODE. concept-paths resolves the feature's OKF concept to the files
-# realising its UI today and the authoring steps declare `tools: Read`, so a plan over
+# IT READS THE CODE — ITS OWN LANE'S. concept-coverage resolves the feature's OKF concept
+# to the `ui_source_files` realising its UI today (the service lane's `source_files` is a
+# different key and a different tree) and the authoring steps declare `tools: Read`, so a plan over
 # an existing frontend ADJUSTS to the composition, naming and state handling actually
 # there. The code is the what-exists authority; the spec stays the only authority on
 # required behaviour. source_count 0 = greenfield, and the phase never blocks on it.
@@ -90,7 +92,7 @@ standards:
   - { path: .appweaver/ai-rules.md }   # kit-resident: the universal operating rules, every flow
 
 vars:
-  source_csv: ""                   # concept-paths — the files realising this feature's UI today
+  source_csv: ""                   # concept-coverage — the UI files realising this feature today
   source_count: "0"                # 0 ⇒ greenfield: no frontend code for this feature yet
   okf_concept: ""                  # the feature's OKF concept doc
   ui_plan_mode: "bootstrap_gf"     # resolved below → bootstrap_gf | bootstrap_bf | update
@@ -167,19 +169,10 @@ workflow:
 
   # 1b. The spec's own ledger tripwire — a plan derived from an unledgered spec
   #     stamps a baseline the ledger cannot name (same fence as plan's).
-  - id: spec_guard_read
-    action: execute_script
-    script: { ref: actions }
-    subcommand: spec-check
-    args: ["--feature-dir", "{{feature_dir}}"]
-    outputs:
-      - { name: spec_ok,    from: "$.ok" }
-      - { name: spec_state, from: "$.state" }
   - id: spec_guard
-    action: verify_context
-    require_true: spec_ok
-    on_false: stop
-    on_false_message: "spec.md has moved outside the ledger (state: {{spec_state}}). Record what changed in a Change History row (or fold it back through /appweaver sync-spec), re-run spec-stamp to re-baseline, then re-run plan-ui."
+    action: include
+    module: .appweaver/orchestrator/modules/spec-state-gate.orch.yaml
+    with: { command: "/appweaver plan-ui" }
 
   # 2. Scaffold frontend-plan.md (idempotent). --lane frontend resolves the pair
   #    ui-design-template → frontend-plan.md, and MIGRATES a legacy design.ui.md by
@@ -245,24 +238,28 @@ workflow:
     action: verify_context
     require_true: plan_stale
     on_false: stop
-    on_false_message: "frontend-plan.md is in step with spec {{current_version}} — nothing to update."
+    on_false_message: "frontend-plan.md is in step with spec {{current_version}} — nothing to update. If the PLAN is wrong and the spec is right, hand-edit frontend-plan.md and re-run /appweaver plan-ui with accept_manual: true — that is what tells this command to keep the edit's intent and reconcile it rather than treat it as drift; without the flag the manual fence stops the run after the edit is already on disk."
 
   # 5. Pre-execution hooks.
-  # THE CODE. The UI plan is an architectural confirmation too, so it must know what
-  # this feature's experience already looks like on disk: concept-paths resolves the
-  # feature's OKF concept to the files realising it, and the authoring steps declare
-  # `tools: Read`. A PATH LIST, not inlined content (E60). on_error: continue — a
+  # THE CODE — THIS LANE'S. The UI plan is an architectural confirmation too, so it must
+  # know what this feature's experience already looks like on disk. concept-COVERAGE, not
+  # concept-paths: a feature has ONE OKF concept holding both lanes' file lists under
+  # different keys, and concept-paths returns the SERVICE lane's `source_files`. Reading it
+  # here planned the frontend against the backend's tree — a feature with a built frontend
+  # and no backend was planned as greenfield, and one with both handed the UI author the
+  # service lane's files to adjust to. concept-coverage splits the two and this binds
+  # `ui_source_files`. A PATH LIST, not inlined content (E60). on_error: continue — a
   # greenfield feature has no concept doc and must never be blocked by one;
   # source_count 0 is the greenfield signal the tasks read.
   - id: concept_paths
     action: execute_script
     on_error: continue
     script: { ref: xref }
-    subcommand: concept-paths
+    subcommand: concept-coverage
     args: ["--feature-dir", "{{feature_dir}}"]
     outputs:
-      - { name: source_csv,   from: "$.csv" }
-      - { name: source_count, from: "$.count" }
+      - { name: source_csv,   from: "$.frontend_csv" }
+      - { name: source_count, from: "$.frontend_count" }
       - { name: okf_concept,  from: "$.concept" }
 
   - id: resolve_pre_hooks
@@ -515,6 +512,12 @@ workflow:
         moved is re-realised from the spec's CURRENT text — the spec is the wording.
         A UX- is THIS document's to realise: a moved UX- with no home here after the
         update is a DROPPED requirement.
+      - AN ID THE SPEC HAS NEWLY DEFINED GAINS ONE. An id in the work list that NO
+        existing section realises is an ADDITION: give it a home in the sections that
+        realise it and a traceability row like any other. The scope rule above says
+        which sections may be touched; it does not say a new requirement may not be
+        designed, and reading it that way would let every added UX- or FR- with a
+        user-facing surface select nothing to rework and land unrealised.
       - THE CODE IS THE WHAT-EXISTS AUTHORITY, and it is a DIFFERENT authority from the
         spec. {{source_count}} file(s) realise this feature's experience today; re-read the
         ones the moved ids touch (code state is read FRESH every run, never assumed) and ADJUST this plan to the composition,
@@ -594,4 +597,4 @@ outputs:
   lane_root: "{{lane_root}}"
   derived_from_spec: "{{current_version}}"
   conformed_ids: "{{changed_csv}}"
-  next: "frontend-plan.md written for the {{lane_id}} lane at {{ui_plan_doc}} (mode: {{ui_plan_mode}}). Gate this write: /appweaver analyze-design — one command over BOTH lanes, which is what proves no UX- fell between them; it reads §7 Traceability as the two-way spine. CHECK §5 CONTRACT BINDING: it binds to interfaces.md, which /appweaver plan publishes — if that log was absent this run, §5 was bound from the spec's IC- ids alone and a DA-n says so, which means running plan first and re-running this command is what turns an assumption into the real contract. Contract deltas needed goes back to the service lane, never into the client. source_files_read {{source_count}} is how many existing UI files this plan was written against; 0 means greenfield. Then /appweaver implement-ui. NOTE while the pipeline is mid-rename: migrated_legacy_design=true means design.ui.md is now frontend-plan.md, and stages not yet rebuilt for the rename (implement-ui, the delta chain) still look for design.ui.md — rebuild or point them at frontend-plan.md before relying on them."
+  next: "frontend-plan.md written for the {{lane_id}} lane at {{ui_plan_doc}} (mode: {{ui_plan_mode}}). Gate this write: /appweaver analyze-design — one command over BOTH lanes, which is what proves no UX- fell between them; it reads §7 Traceability as the two-way spine. CHECK §5 CONTRACT BINDING: it binds to interfaces.md, which /appweaver plan publishes — if that log was absent this run, §5 was bound from the spec's IC- ids alone and a DA-n says so, which means running plan first and re-running this command is what turns an assumption into the real contract. Contract deltas needed goes back to the service lane, never into the client. source_files_read {{source_count}} is how many existing UI files this plan was written against; 0 means greenfield. Then /appweaver implement-ui."