aw-spec-cli 0.1.16 → 0.1.17

package/assets/.appweaver/orchestrator/workflows/aw-spec-analyze-plan-delta.orch.yaml

@@ -0,0 +1,673 @@
+# =============================================================================
+# aw-spec-analyze-plan-delta (orchestrator) — the delta-spec↔delta-plan GATE, BOTH LANES
+#
+# The CR analog of analyze-plan, scoped to ONE open change. The delta spec is the ANCHOR:
+# confirm this change's delta plans STRICTLY realise it, and that everything they claim to
+# MODIFY really exists in the masters. This stage VALIDATES the delta only — it does NOT
+# touch spec.md / the master plans / domain-model.md, and it does NOT close the change
+# (finalize-delta merges the delta later; close-delta closes it at the very end).
+#
+# IT ASKS WHICH CHANGE, exactly as `plan` does. Many changes may be open on one feature, so
+# this gate LISTS them and asks rather than inferring one. A bare CR id in the command's
+# argument selects without a prompt, one open change auto-confirms, and the chosen change
+# is ACTIVATED so the stages after this one act on the same delta.
+#
+# THE FIVE CHECKS:
+#   1. delta-spec.md → delta-backend-plan.md   — every ADDED/MODIFIED spec item realised
+#   2. delta-spec.md → delta-frontend-plan.md  — every experience item realised
+#   3. delta plan ↔ delta plan — CONTRACT BINDING across the change: what the frontend
+#      delta binds to must appear in the service delta's "Contract deltas for the frontend
+#      lane" table or in the master's published surface. A call neither publishes passes
+#      both one-sided checks and fails at integration.
+#   4. THE EFFECTIVE MODEL — domain-model.md + this change's model delta + the model
+#      deltas of every LOWER-WAVE change (its predecessors). Every structural item the
+#      model delta adds has a realisation row; nothing structural is invented in a plan.
+#   5. MASTER INTEGRITY — every MODIFIED element names something the master plan really
+#      defines, and every MODIFIED spec id something spec.md really defines. You cannot
+#      modify what does not exist; that is an ADD.
+# Plus the OVERLAY BACKSTOP (the domain gate checklist over the constraints this change
+# touches), and the WAVE DISCIPLINE check below.
+#
+# PREDECESSORS, NOT SIBLINGS. A wave is a dependency level. A LOWER-wave change is
+# committed to landing first, so this delta may be planned on top of it — and both halves
+# of each predecessor are in context, its model delta AND its delta-spec, because a plan
+# that realises a predecessor's behaviour without its spec cannot be told apart from one
+# that invented it. A SAME-wave change is ordered against this one by nothing at all: it
+# is visible so it can be designed around, and building on it silently is the defect this
+# check exists to catch.
+#
+# OVERLAP IS COMPUTED, NOT ASKED. cr-overlap reads the `## Aggregate:` headings of every
+# pending model delta and reports which other open changes touch the same aggregates.
+# That is a fact about two files, so a regex answers it exactly and the result is handed
+# to the model as a finding rather than as a question.
+#
+#   specify → plan → ⟨review⟩ → analyze-plan-delta   ← you are here
+#       → implement → build → analyze-slice-delta → finalize-delta → analyze-slice
+#       → close-delta
+#
+# RENAMED FROM `analyze-delta-design`, following design → plan, and it absorbs the
+# frontend half that never existed as its own command.
+#
+# Launch:  /appweaver analyze-plan-delta [CR-id]
+# Prereq:  /appweaver specify (delta-spec + model delta) + /appweaver plan (delta plans).
+# =============================================================================
+
+name: aw-spec-analyze-plan-delta
+description: The delta-spec↔delta-plan conformance gate for ONE open change — confirm its delta-backend-plan.md and delta-frontend-plan.md realise delta-spec.md, bind to each other's contract deltas, realise this change's domain model delta, and only MODIFY elements the masters really define. Checked against the EFFECTIVE model (domain-model.md plus this change's model delta plus every lower-wave predecessor's, whose delta-specs are in context too) and told, deterministically, which other open changes touch the same aggregates. Asks which open change it is gating when more than one is open; a CR id as the argument selects without a prompt. Does not modify the masters or close the change.
+version: 2.0.0
+agent_agnostic: true
+dialect: aw-spec.orchestrator/v1
+
+inputs:
+  user_input:
+    description: "The open change to gate — a bare CR id selects it without a prompt. Omitted, the run lists the open changes and asks."
+    required: false
+    bind: USER_INPUT
+
+scripts:
+  actions:
+    sh:  .appweaver/scripts/bash/aw-spec-actions.sh
+    ps1: .appweaver/scripts/powershell/aw-spec-actions.ps1
+
+standards:
+  - { path: .appweaver/ai-rules.md }   # kit-resident: the universal operating rules, every flow
+
+vars:
+  analyze_ok: "false"
+  lanes_declared: "false"
+  be_declared: "false"
+  fe_declared: "false"
+  has_changes: "false"
+  cr_choice: ""
+  cr_id: ""
+  wave: "1"
+  predecessor_docs: []      # each lower-wave change's model delta AND its delta-spec
+  predecessor_count: "0"
+  sibling_count: "0"
+  overlap_report: ""
+  # PER-LANE PRESENCE. A lane is gated when it is declared AND has a master plan (only
+  # then is there a base for a delta) AND this change has a delta plan for it. The engine
+  # has no compound conditions, so each AND is one ordered assignment.
+  be_gated: "false"         # declared AND a master plan exists
+  fe_gated: "false"
+  be_present: "false"       # gated AND this change's delta plan exists ⇒ check it
+  fe_present: "false"
+  be_missing: "false"       # gated AND it does NOT ⇒ `plan` has not run for this change
+  fe_missing: "false"
+  deltas_ok: "true"
+  any_lane: "false"
+  both_lanes: "false"       # both delta plans present ⇒ the contract check applies
+  be_repair: "false"
+  fe_repair: "false"
+  backend_repair: "false"
+  frontend_repair: "false"
+  delta_backend_plan: ""
+  delta_frontend_plan: ""
+  # The plan paths AS CONTEXT — bound only for a lane this run actually gates. feature-paths
+  # and cr-paths resolve every path whatever the declaration says, so putting them straight
+  # into the envelope would show the gate documents belonging to a lane nobody declared.
+  # An unbound var renders empty and the engine drops it.
+  be_master_ctx: ""
+  fe_master_ctx: ""
+  be_delta_ctx: ""
+  fe_delta_ctx: ""
+  domain_model: ""
+
+workflow:
+
+  # 0. WHICH LANES EXIST — the same declaration `plan` wrote against.
+  - id: lane_resolve
+    action: execute_script
+    on_error: continue      # never crash raw on an undeclared lane — the gate below explains it
+    script: { ref: actions }
+    subcommand: lane-resolve
+    outputs:
+      - { name: lanes_declared, from: "$.declared" }
+      - { name: be_declared,    from: "$.backend_declared" }
+      - { name: fe_declared,    from: "$.frontend_declared" }
+
+  - id: require_lane
+    action: verify_context
+    require_true: lanes_declared
+    on_false: stop
+    on_false_message: "No lane is declared in .appweaver/stacks.json, so there is no delta plan to gate. Run /appweaver select-stack, then /appweaver plan, then re-run analyze-plan-delta."
+
+  # 1. Resolve the current feature, its spec and its MASTER plans — the base every
+  #    MODIFIED element in a delta has to name.
+  - id: feature_paths
+    action: execute_script
+    on_error: continue      # never crash raw on 'no feature set' — the gate below explains it
+    script: { ref: actions }
+    subcommand: feature-paths
+    outputs:
+      - { name: feature,              from: "$.feature" }
+      - { name: feature_dir,          from: "$.feature_dir" }
+      - { name: spec_file,            from: "$.spec_file" }
+      - { name: spec_exists,          from: "$.spec_exists" }
+      - { name: backend_plan,         from: "$.backend_plan" }
+      - { name: frontend_plan,        from: "$.frontend_plan" }
+      - { name: backend_plan_exists,  from: "$.backend_plan_exists" }
+      - { name: frontend_plan_exists, from: "$.frontend_plan_exists" }
+
+  - id: require_feature
+    action: verify_context
+    require_non_empty: feature_dir
+    on_empty: stop
+    on_empty_message: "No active feature. Run /appweaver select-feature first (pick or create the aggregate, e.g. Order), then re-run analyze-plan-delta."
+
+  - id: verify_spec
+    action: verify_context
+    require_true: spec_exists
+    on_false: stop
+    on_false_message: "No spec.md for the current feature. Run /appweaver specify (and /appweaver plan) first."
+
+  # 2. WHICH CHANGES ARE OPEN. The evidence is changes/<cr-id>/ on disk; a closed change
+  #    has moved to changes/archive/. `matched_label` resolves a CR id passed as the
+  #    command's argument to the whole option string, so the pick below can auto-select it
+  #    — the engine matches a preselection against the option text exactly.
+  - id: cr_list
+    action: execute_script
+    script: { ref: actions }
+    subcommand: cr-list
+    args: ["--feature-dir", "{{feature_dir}}", "--preselect", "{{USER_INPUT}}"]
+    outputs:
+      - { name: change_options, from: "$.select_options" }
+      - { name: matched_label,  from: "$.matched_label" }
+      - { name: has_changes,    from: "$.has_changes" }
+      - { name: change_count,   from: "$.count" }
+
+  - id: require_change
+    action: verify_context
+    require_true: has_changes
+    on_false: stop
+    on_false_message: "No open change on this feature — there is no delta to gate. Run /appweaver specify <change> (which opens the change and writes its delta-spec + model delta), then /appweaver plan to author its delta plans, then re-run analyze-plan-delta. To re-anchor the MASTERS instead, run /appweaver analyze-plan."
+
+  # 2b. Ask which one. A CR id in the argument auto-selects via matched_label; a feature
+  #     with exactly one open change auto-confirms.
+  - id: pick_change
+    action: user_select
+    prompt: "Which open change is this gate for? Deltas sharing a wave are independent; a higher wave is planned on top of the lower ones."
+    options_from_variable: change_options
+    preselect_from: matched_label
+    single_option_confirm: true
+    outputs:
+      - { name: cr_choice, from: selection }
+
+  # 2c. Make the chosen change the ACTIVE one. finalize-delta and close-delta still resolve
+  #     the change through active_version.json.active_change (implement asks again, and
+  #     re-activates whatever it is answered), so without this a delta gated here could be
+  #     merged as a different one.
+  - id: activate
+    action: execute_script
+    script: { ref: actions }
+    subcommand: cr-activate
+    args: ["--cr-id", "{{cr_choice}}", "--feature-dir", "{{feature_dir}}"]
+    outputs:
+      - { name: active_change, from: "$.active_change" }
+
+  # 3. The change's documents, its wave, and everything that comes BEFORE it —
+  #    predecessor_docs carries each lower-wave change's model delta AND its delta-spec,
+  #    which is what a build_context `context_from:` inlines below.
+  - id: cr_paths
+    action: execute_script
+    script: { ref: actions }
+    subcommand: cr-paths
+    args: ["--cr-id", "{{cr_choice}}", "--feature-dir", "{{feature_dir}}"]
+    outputs:
+      - { name: cr_id,                     from: "$.cr_id" }       # normalised: the label's first token
+      - { name: cr_dir,                    from: "$.cr_dir" }
+      - { name: delta_spec,                from: "$.delta_spec" }
+      - { name: delta_spec_exists,         from: "$.delta_spec_exists" }
+      - { name: delta_model,               from: "$.delta_model" }
+      - { name: delta_backend_plan,        from: "$.delta_backend_plan" }
+      - { name: delta_frontend_plan,       from: "$.delta_frontend_plan" }
+      - { name: delta_backend_plan_exists, from: "$.delta_backend_plan_exists" }
+      - { name: delta_frontend_plan_exists, from: "$.delta_frontend_plan_exists" }
+      - { name: wave,                      from: "$.wave" }
+      - { name: predecessor_docs,          from: "$.predecessor_docs" }
+      - { name: predecessor_count,         from: "$.predecessor_count" }
+      - { name: sibling_count,             from: "$.sibling_count" }
+      - { name: domain_model,              from: "$.domain_model" }
+
+  # 3b. WHICH OTHER OPEN CHANGES TOUCH THE SAME AGGREGATES. Deterministic: the
+  #     `## Aggregate:` headings of the pending model deltas are the merge unit
+  #     domain-model.md is organised by, so this is a regex over two files rather than a
+  #     judgement. The result reaches the check below as a FINDING, not a question.
+  - id: cr_overlap
+    action: execute_script
+    on_error: continue
+    script: { ref: actions }
+    subcommand: cr-overlap
+    args: ["--cr-id", "{{cr_id}}", "--feature-dir", "{{feature_dir}}"]
+    outputs:
+      - { name: overlap_report,       from: "$.overlap_report" }
+      - { name: overlap_count,        from: "$.overlap_count" }
+      - { name: sibling_overlaps,     from: "$.sibling_overlaps" }
+      - { name: predecessor_overlaps, from: "$.predecessor_overlaps" }
+
+  # 4. WHICH LANES ARE GATED. Declared AND a master plan exists (only then is there a base
+  #    for a delta) — then split on whether this change has that lane's delta plan.
+  #    A lane whose MASTER was bootstrapped in the same `plan` run has no delta plan by
+  #    design: it was authored from the whole spec and there is nothing for a delta to
+  #    add. Keying on the master's presence is what keeps that case out of the gate.
+  - id: be_flag_gated
+    condition: "{{backend_plan_exists}} == true"
+    action: set
+    vars: { be_gated: "{{be_declared}}" }
+  - id: fe_flag_gated
+    condition: "{{frontend_plan_exists}} == true"
+    action: set
+    vars: { fe_gated: "{{fe_declared}}" }
+  - id: be_flag_present
+    condition: "{{delta_backend_plan_exists}} == true"
+    action: set
+    vars: { be_present: "{{be_gated}}" }
+  - id: be_flag_missing
+    condition: "{{delta_backend_plan_exists}} == false"
+    action: set
+    vars: { be_missing: "{{be_gated}}" }
+  - id: fe_flag_present
+    condition: "{{delta_frontend_plan_exists}} == true"
+    action: set
+    vars: { fe_present: "{{fe_gated}}" }
+  - id: fe_flag_missing
+    condition: "{{delta_frontend_plan_exists}} == false"
+    action: set
+    vars: { fe_missing: "{{fe_gated}}" }
+
+  # A lane with a master but no delta plan for this change is not a gap this gate repairs
+  # — it is work `plan` has not done for this change. Two independent raises.
+  - id: deltas_not_ok_backend
+    condition: "{{be_missing}} == true"
+    action: set
+    vars: { deltas_ok: "false" }
+  - id: deltas_not_ok_frontend
+    condition: "{{fe_missing}} == true"
+    action: set
+    vars: { deltas_ok: "false" }
+
+  - id: require_deltas
+    action: verify_context
+    require_true: deltas_ok
+    on_false: stop
+    on_false_message: "Change {{cr_id}} has no delta plan for a lane that has a master plan (backend missing={{be_missing}} · frontend missing={{fe_missing}}). Run /appweaver plan {{cr_id}} — it authors that change's delta plan for every lane whose master exists, against the delta spec, the effective model and the feature's real source files. This gate validates a delta plan; it does not write one."
+
+  - id: any_backend
+    condition: "{{be_present}} == true"
+    action: set
+    vars: { any_lane: "true" }
+  - id: any_frontend
+    condition: "{{fe_present}} == true"
+    action: set
+    vars: { any_lane: "true" }
+
+  - id: require_any_lane
+    action: verify_context
+    require_true: any_lane
+    on_false: stop
+    on_false_message: "Change {{cr_id}} has no delta plan to gate on any declared lane. Run /appweaver plan {{cr_id}} first."
+
+  # Check 3 needs BOTH delta plans. One more ordered assignment.
+  - id: flag_both_lanes
+    condition: "{{be_present}} == true"
+    action: set
+    vars: { both_lanes: "{{fe_present}}" }
+
+  # Bind the CONTEXT paths per lane: the master (the base a MODIFIED element must name) for
+  # a gated lane, the delta plan for a present one. A lane that is neither leaves both
+  # empty, so its documents never reach the payload.
+  - id: be_master_ctx_path
+    condition: "{{be_gated}} == true"
+    action: set
+    vars: { be_master_ctx: "{{backend_plan}}" }
+  - id: fe_master_ctx_path
+    condition: "{{fe_gated}} == true"
+    action: set
+    vars: { fe_master_ctx: "{{frontend_plan}}" }
+  - id: be_delta_ctx_path
+    condition: "{{be_present}} == true"
+    action: set
+    vars: { be_delta_ctx: "{{delta_backend_plan}}" }
+  - id: fe_delta_ctx_path
+    condition: "{{fe_present}} == true"
+    action: set
+    vars: { fe_delta_ctx: "{{delta_frontend_plan}}" }
+
+  # 4b. Load the domain GATE overlays (the domain-rule-bindings `/aw-spec-gate` checklist)
+  #     as the conformance checklist — VALIDATION input only, NEVER authoring. analyze sees
+  #     them (include_standards: true); the repair steps do NOT (the delta conforms to the
+  #     delta SPEC, not to the overlays). Empty/no-op for a non-domain project.
+  - id: resolve_gate_overlays
+    action: execute_script
+    script: { ref: actions }
+    subcommand: resolve-domain
+    args: ["--command", "aw-spec-gate"]
+    outputs:
+      - { name: gate_overlays, from: "$.candidates" }
+  - id: load_gate_overlays
+    action: load_standards
+    files_from_variable: gate_overlays
+    optional: true
+
+  # 5. Pre-execution hooks.
+  - id: resolve_pre_hooks
+    action: execute_script
+    script: { ref: actions }
+    subcommand: resolve-hooks
+    args: ["--phase", "before_analyze_cr"]
+    outputs:
+      - { name: before_hooks, from: "$.hooks" }
+  - id: dispatch_pre_hooks
+    action: dispatch_hooks
+    hooks_from_variable: before_hooks
+
+  # 6. THE GATE'S CONTEXT — the delta, the masters it changes, and the EFFECTIVE MODEL.
+  #    context_from inlines each PREDECESSOR's two halves (its model delta and its
+  #    delta-spec); a wave-1 delta has none, which is the common case. A lane that is not
+  #    gated left its *_ctx vars empty and drops out, so the same envelope serves all three
+  #    project shapes, and it stays the envelope for the repair steps: a repair rewrites one
+  #    delta plan against exactly what the check read.
+  - id: ctx_gate
+    action: build_context
+    context_from: predecessor_docs           # LOWER waves only — committed to landing first
+    context:
+      - { path: "{{delta_spec}}" }                        # THE ANCHOR for this change
+      - { path: "{{delta_model}}", optional: true }       # its model half — unfilled on a plan-only change
+      - { path: "{{be_delta_ctx}}", optional: true }
+      - { path: "{{fe_delta_ctx}}", optional: true }
+      - { path: "{{spec_file}}" }                         # the master spec (READ ONLY)
+      - { path: "{{be_master_ctx}}", optional: true }     # the master plans (READ ONLY) — the base
+      - { path: "{{fe_master_ctx}}", optional: true }     #   every MODIFIED element must name
+      - { path: "{{domain_model}}", optional: true }      # the canonical model (READ ONLY)
+
+  # 7. Conformance + REPAIR loop (the delta spec is the anchor): check → REPORT gaps +
+  #    ASK → Repair on approval → re-check; "Report and Skip" writes the report + stops.
+  #    Bounded (3×). The repair is PER LANE, so a frontend drift never rewrites a
+  #    conformant service delta.
+  - id: analyze_loop
+    action: loop
+    while: "{{analyze_ok}} != true"
+    max_iterations: 3
+    steps:
+      - id: analyze
+        action: agent_query
+        include_standards: true            # the gate overlays (checklist) are in the standards
+        schema: { ok: true, backend_repair: false, frontend_repair: false, gaps: [ { severity: "high", check: "<spec-backend|spec-frontend|contract|model|master|wave|overlay>", lane: "<backend|frontend>", spec_ref: "<delta FR/BR/CN/DC/IC/UX/US or overlay or —>", where: "<delta-plan section>", gap: "<how it drifts>" } ] }
+        mock: { ok: true, backend_repair: false, frontend_repair: false, gaps: [] }
+        task: |
+          delta-spec.md is the ANCHOR for change {{cr_id}} (wave {{wave}}). Gate this
+          change's DELTA PLANS against it, against the masters they change, and against the
+          effective domain model, and list EVERY drift as a gap. Run the checks that apply
+          — service delta present: {{be_present}}, experience delta present: {{fe_present}},
+          both present: {{both_lanes}}. A check for an absent lane is SKIPPED, not failed.
+
+          CHECK 1 — delta-spec.md → delta-backend-plan.md (when it is in context):
+          (a) every ADDED / MODIFIED delta-spec item — FR / BR / CN- / DC- / IC- / user
+          story — has a home in the delta plan (an ADDED or MODIFIED element that serves
+          it). A delta-spec item with no delta-plan element is a HIGH gap. EXCEPT the
+          Experience Standards (UX-), which the service lane excludes by contract;
+          (b) the delta plan introduces NOTHING beyond the delta spec — any element with no
+          delta-spec basis is a drift unless logged as a delta DA-n;
+          (c) shared elements have ONE owning definition (no duplicated element), the
+          layers stay coherent and it stays technology-agnostic;
+          (d) PLAN-ONLY CHANGE — if the delta-spec is an unfilled stub, the spec is
+          deliberately unchanged and this change moves only HOW existing ids are realised.
+          Then every changed element must still trace to an EXISTING spec id in the master
+          spec (in context). An element tracing to nothing at all is still a HIGH gap.
+
+          CHECK 2 — delta-spec.md → delta-frontend-plan.md (when it is in context):
+          (a) every UX- item in the delta-spec has a home HERE — the service lane excludes
+          them, so a UX- in neither delta is a DROPPED requirement, a HIGH gap;
+          (b) every new or altered interaction carries its FULL state set (loading, empty,
+          error, permission-denied, in-flight). A missing state is a HIGH gap, not a later
+          refinement;
+          (c) every user story and interaction-state FR- in the delta-spec has a screen and
+          a flow; the lifted CN-/DC-/IC-/SC- obligations are realised citing their ids;
+          (d) it stays technology-agnostic — no framework, router, state library, component
+          library or styling approach.
+
+          CHECK 3 — CONTRACT BINDING across the change (ONLY when {{both_lanes}} is true;
+          skip entirely otherwise):
+          (a) EVERY call, endpoint or payload the experience delta binds to is EITHER in
+          the service delta's "Contract deltas for the frontend lane" table OR already in
+          the MASTER backend plan's published surface. One that is in neither is a HIGH
+          `contract` gap — lane `backend` when the delta-spec requires the capability, lane
+          `frontend` when the experience invented it;
+          (b) FIELD SHAPES agree in both directions — a field the experience reads that the
+          service never returns, and a required field the service demands that the
+          experience never sends, are both HIGH gaps;
+          (c) anything the experience delta raised under "Contract deltas needed" is
+          UNRESOLVED by definition: report it so it is closed here rather than at
+          integration;
+          (d) a contract the service delta REMOVES or narrows that the master frontend plan
+          still uses is a HIGH gap — the experience delta has to carry the matching change.
+
+          CHECK 4 — THE EFFECTIVE MODEL. It is domain-model.md PLUS this change's model
+          delta PLUS the model deltas of every LOWER-WAVE change in context (its
+          predecessors, whose delta-specs are in context too). {{predecessor_count}}
+          predecessor document(s) were inlined.
+          (a) EVERY item this change's model delta ADDS / MODIFIES / REMOVES has a
+          realisation row in the service delta's "Model changes this plan realises",
+          saying where it lands and WHERE the invariant is ENFORCED. An item in the model
+          delta with no row is a structural change nothing implements — a HIGH gap;
+          (b) NO aggregate, entity, event or invariant appears in a delta plan that the
+          effective model does not define. A plan may not invent domain structure: the fix
+          is /appweaver specify (which authors the model delta), never the plan;
+          (c) a plan that RESTATES what an invariant says instead of citing its BR-nnn is a
+          gap — the model is the only place that text lives;
+          (d) DEPENDENCIES ON A PREDECESSOR. Where a delta plan relies on something a
+          lower-wave change introduces — in its model delta or in its delta-spec — that
+          change MUST be named under "## Depends on". An undeclared dependency is a HIGH
+          `wave` gap: the declaration is what orders the finalizes and what stops a
+          recall from silently invalidating this plan;
+          (e) both deltas use the model's UBIQUITOUS LANGUAGE exactly — same terms, no
+          synonyms.
+
+          CHECK 5 — MASTER INTEGRITY (the masters are in context, READ ONLY):
+          (a) every MODIFIED element names a REAL element the master plan defines — you
+          cannot MODIFY what the master does not define (that would be an ADD). A dangling
+          MODIFIED reference is a HIGH `master` gap;
+          (b) every MODIFIED / REMOVED spec id names one the master spec really defines;
+          (c) nothing in a delta plan edits the master: the delta plans are the whole plan
+          for this change, and no stage merges them back — a master plan is re-derived from
+          the spec and the model that finalize-delta merges.
+
+          CHECK 6 — WAVE DISCIPLINE. This change is wave {{wave}}. Other open changes
+          touching the same aggregates, computed from the pending model deltas:
+          {{overlap_report}}
+          ({{sibling_overlaps}} same-wave, {{predecessor_overlaps}} lower-wave;
+          {{sibling_count}} same-or-higher-wave change(s) are open in total.)
+          (a) a SAME-WAVE overlap is ordered against this change by nothing. If either
+          delta plan assumes it — builds on its structure, or expects its contract — that
+          is a HIGH `wave` gap: either raise this change's wave and declare the dependency,
+          or plan around it (expand-then-contract). Merely NAMING it under "Other open
+          deltas" is correct and is not a gap;
+          (b) a same-wave overlap that the plans do not mention at all is a MEDIUM `wave`
+          gap — it has to be visible to whoever implements this change;
+          (c) a LOWER-wave overlap may be built on, but only with the "## Depends on"
+          declaration check 4(d) requires.
+
+          CHECK 7 — OVERLAY BACKSTOP. The domain gate checklist is loaded in the standards.
+          For each constraint it states (retention, immutability, append-only audit,
+          data-exposure, interop obligation, etc.) that THIS CHANGE touches, confirm the
+          delta realises it via a delta CN-/DC-/IC-. If the change touches such a
+          constraint and it is in NEITHER the delta spec NOR a delta plan, it is a HIGH gap
+          — set spec_ref to the overlay name and PREFIX the gap text with "LIFT-FAILURE:"
+          (re-run /appweaver specify to lift it into the delta spec; do NOT fabricate it in
+          a delta plan).
+
+          Tag every gap with its `check` and the `lane` whose document must change to close
+          it. Set backend_repair true if any gap needs the service delta rewritten, and
+          frontend_repair likewise. (If a delta plan is still the empty template, treat the
+          WHOLE delta spec as gaps against it.) Set ok=true ONLY when every applicable
+          check passes and no touched checklist constraint is unaccounted for.
+        outputs:
+          - { name: analyze_ok,      from: "$.ok" }
+          - { name: analyze_gaps,    from: "$.gaps" }
+          - { name: backend_repair,  from: "$.backend_repair" }
+          - { name: frontend_repair, from: "$.frontend_repair" }
+      - id: conform_break
+        action: break
+        condition: "{{analyze_ok}} == true"
+      - id: ask_repair
+        action: ask
+        prompt: |
+          analyze-plan-delta found delta-spec↔delta-plan gaps on {{cr_id}} (the delta spec
+          is the anchor; the masters and the domain model are read-only here):
+          {{analyze_gaps}}
+          Repair the drifting delta plan(s) now, or report the gaps and stop?
+        options: ["Repair", "Report and Skip"]
+        answer_var: repair_choice
+      - id: write_report
+        condition: "{{repair_choice}} == Report and Skip"
+        action: agent_author
+        include_standards: false
+        output_target: { type: file, path: "{{cr_dir}}/delta-plan-analyze-report.md" }
+        task: |
+          Write a Delta Plan Analyze Report to the output from these delta-spec↔delta-plan
+          conformance gaps (the delta spec is the ANCHOR; the user chose to skip repair):
+          {{analyze_gaps}}
+          Markdown format:
+          - "# Delta Plan Analyze Report — {{cr_id}}" plus today's date.
+          - A verdict line: "verdict: GAPS ✗ · <n> gap(s)".
+          - "## Gaps" as a table: | # | check | lane | severity | delta-spec ref | delta-plan location | gap |.
+          - "## How to resolve": the delta spec is the anchor — update the named delta plan
+            to realise it for each gap (out of band). A `model` gap whose fix is a missing
+            entity or invariant routes to /appweaver specify, which authors the model
+            delta; a `wave` gap is closed by declaring "## Depends on" (and raising the
+            wave) or by planning around the sibling; a "LIFT-FAILURE:" gap means the
+            constraint was never lifted into the delta spec. Then re-run
+            /appweaver analyze-plan-delta {{cr_id}} to clear the report.
+          Return the complete report markdown only.
+      - id: skip_break
+        action: break
+        condition: "{{repair_choice}} == Report and Skip"
+
+      # WHICH DOCUMENT GETS REWRITTEN — drift reported in that lane AND that lane present.
+      # Cleared first, so a lane repaired on the previous iteration and clean on this one
+      # is not rewritten again.
+      - id: be_repair_clear
+        action: set
+        vars: { be_repair: "false" }
+      - id: be_repair_flag
+        condition: "{{backend_repair}} == true"
+        action: set
+        vars: { be_repair: "{{be_present}}" }
+      - id: fe_repair_clear
+        action: set
+        vars: { fe_repair: "false" }
+      - id: fe_repair_flag
+        condition: "{{frontend_repair}} == true"
+        action: set
+        vars: { fe_repair: "{{fe_present}}" }
+
+      - id: repair_backend
+        condition: "{{be_repair}} == true"
+        action: agent_author
+        include_standards: false           # rewrite-in-place: the delta spec anchors — NOT the overlays
+        output_target: { type: file, path: "{{delta_backend_plan}}" }
+        task: |
+          delta-spec.md is the ANCHOR — update the SERVICE delta plan for {{cr_id}} (in
+          context) to REALISE it, closing the gaps whose lane is `backend` (the delta spec
+          WINS every time):
+          {{analyze_gaps}}
+          - Add a delta-plan element for each uncovered ADDED/MODIFIED delta-spec
+            FR/BR/CN/DC/IC/US, in the correct section, serving that spec id. On a PLAN-ONLY
+            change (an unfilled delta-spec) trace every changed element to an EXISTING
+            master spec id instead — you are changing the realisation, never inventing a
+            requirement.
+          - Ensure every MODIFIED element names a REAL element from the master plan (in
+            context); if the master does not define it, make it an ADDED element instead.
+          - Fill "## Model changes this plan realises" with a row per item this change's
+            MODEL DELTA adds, modifies or removes — where it lands, and where each
+            invariant is ENFORCED. Cite BR-nnn by id; never restate what one says. DO NOT
+            EDIT domain-model.md or the model delta: they are spec-tier. A gap that can
+            only be closed by ADDING to the model stays open with a DA-n saying it routes
+            to /appweaver specify.
+          - CONTRACT gaps whose lane is `backend`: publish the missing surface in
+            "## Contract deltas for the frontend lane" as field shapes. That table is the
+            only part of this document the experience delta may bind to.
+          - WAVE gaps: name a lower-wave change you build on under "## Depends on", and
+            name a same-wave overlap under "Other open deltas" — you may NOT assume a
+            same-wave change's structure or contract, because nothing orders it against
+            this one.
+          - REMOVE, or move to a delta DA-n note, any element with no delta-spec basis —
+            never keep a plan that exceeds the delta spec.
+          - A "LIFT-FAILURE:" gap you CANNOT close — the constraint is not in the delta
+            spec, and you must NOT invent a domain rule it omits. Leave it open and add a
+            note "lift-failure: <constraint> — re-run /appweaver specify to lift it into
+            the delta spec".
+          - Keep the technology-agnostic form (signatures + pre/post/invariant, field
+            shapes — NO code). Preserve every already-conformant section VERBATIM. Do NOT
+            change the delta spec, the masters or the domain model. Do NOT edit the Wave /
+            Base version / Delta spec / Model delta headers — scripts stamp those.
+          Return the COMPLETE updated delta plan content only.
+
+      - id: repair_frontend
+        condition: "{{fe_repair}} == true"
+        action: agent_author
+        include_standards: false           # rewrite-in-place: the delta spec anchors — NOT the overlays
+        output_target: { type: file, path: "{{delta_frontend_plan}}" }
+        task: |
+          delta-spec.md is the ANCHOR — update the EXPERIENCE delta plan for {{cr_id}} (in
+          context) to REALISE it, closing the gaps whose lane is `frontend` (the delta spec
+          WINS every time):
+          {{analyze_gaps}}
+          - Give every uncovered UX-, user story and interaction-state FR- from the delta
+            spec a home: a screen, a flow, and the FULL state set (loading, empty, error,
+            permission-denied, in-flight). UX- items live HERE and nowhere else.
+          - Ensure every MODIFIED component, screen or state container names a REAL element
+            from the master frontend plan (in context); if the master does not define it,
+            make it an ADDED element instead. A shared component is MODIFIED in place,
+            never copied into the change.
+          - CONTRACT gaps whose lane is `frontend`: bind ONLY to the service delta's
+            "## Contract deltas for the frontend lane" table and to the master plan's
+            published surface. CITE them; do not restate, re-derive or contradict them, and
+            introduce NO server-side behaviour or persistence assumption. A capability the
+            experience needs that neither offers stays under "Contract deltas needed" — it
+            is the service lane's to publish, never a client-side workaround.
+          - WAVE gaps: name a lower-wave change you build on under "## Depends on", and a
+            same-wave overlap under "Other open deltas"; never assume a same-wave change's
+            screens, shared components or contract.
+          - Use the domain model's UBIQUITOUS LANGUAGE exactly in labels, states and
+            messages, and cite BR-nnn rather than restating a rule. DO NOT EDIT
+            domain-model.md, the model delta or either master.
+          - A state the UI can reach that the delta spec does not describe is a SPEC gap:
+            log it as a DA-n that routes to /appweaver specify; never invent the
+            requirement here.
+          - Stay TECHNOLOGY-AGNOSTIC: no framework, router, state library, component
+            library or styling approach. Preserve every already-conformant section
+            VERBATIM. Do NOT edit the Wave / Base version / Delta spec / Service delta
+            headers — scripts stamp those.
+          Return the COMPLETE updated delta plan content only.
+
+  - id: analyze_gate
+    action: verify_context
+    require_true: analyze_ok
+    on_false: stop
+    on_false_message: "The delta plans for {{cr_id}} do not realise the delta spec (gaps: {{analyze_gaps}}) — repair was skipped (see {{cr_dir}}/delta-plan-analyze-report.md), or it could not be reconciled in 3 passes. A 'LIFT-FAILURE:' gap means a domain constraint from the gate checklist was never lifted into the delta spec, and a `model` gap means a plan needs structure the effective model does not define — both are fixed by /appweaver specify, which authors the delta spec and the model delta; this gate may not write either. A `wave` gap is closed by declaring '## Depends on' (and raising the wave with cr-wave) or by planning around the sibling. Otherwise fix out of band, or re-run and choose Repair."
+
+  # 8. Post-execution hooks.
+  - id: resolve_post_hooks
+    action: execute_script
+    script: { ref: actions }
+    subcommand: resolve-hooks
+    args: ["--phase", "after_analyze_cr"]
+    outputs:
+      - { name: after_hooks, from: "$.hooks" }
+  - id: dispatch_post_hooks
+    action: dispatch_hooks
+    hooks_from_variable: after_hooks
+
+outputs:
+  feature_dir: "{{feature_dir}}"
+  cr_id: "{{cr_id}}"
+  cr_dir: "{{cr_dir}}"
+  wave: "{{wave}}"
+  delta_backend_plan: "{{delta_backend_plan}}"    # empty when that lane has no delta plan
+  delta_frontend_plan: "{{delta_frontend_plan}}"
+  conformant: "{{analyze_ok}}"
+  gaps: "{{analyze_gaps}}"
+  overlaps: "{{overlap_report}}"
+  note: "Gated change {{cr_id}} (wave {{wave}}) against its delta spec, the masters it changes, and the EFFECTIVE model — domain-model.md plus this change's model delta plus the {{predecessor_count}} predecessor change(s) from LOWER waves (each one's model delta and its delta-spec). Same-wave changes are visible but never assumed: {{sibling_count}} open at the same or a higher wave, overlapping this one on — {{overlap_report}}. The masters and the model were READ, never written."
+  next: "/appweaver implement {{cr_id}} → build → analyze-slice-delta → finalize-delta → analyze-slice → close-delta   (implement is one command for both lanes and both paths — passing the id above skips its 'which change' prompt; the delta plans realise the delta spec; the change stays OPEN through finalize-delta's merge and analyze-slice's verification, and only close-delta archives it and bumps the version)"