aw-spec-cli 0.1.18 → 0.1.20

package/assets/.appweaver/orchestrator/workflows/aw-spec-analyze-plan-delta.orch.yaml

@@ -153,7 +153,7 @@ workflow:
     action: verify_context
     require_non_empty: feature_dir
     on_empty: stop
-    on_empty_message: "No active feature. Run /appweaver select-feature first (pick or create the aggregate, e.g. Order), then re-run analyze-plan-delta."
+    on_empty_message: "No active feature. Run /appweaver select-feature first (pick or create the feature, e.g. Order or PatientRegistration), then re-run analyze-plan-delta."
 
   - id: verify_spec
     action: verify_context

package/assets/.appweaver/orchestrator/workflows/aw-spec-analyze-plan.orch.yaml

@@ -25,13 +25,30 @@
 # rule set, without the template selection and without the feature's real source files,
 # which is exactly the work `plan` does properly.
 #
-# BOOTSTRAP-ONLY, and it NEVER opens, merges or closes a change. It gates a feature whose
-# spec.md + lane plans ARE the masters. With a change OPEN the delta docs are the
-# authoritative in-flight edit and the master pair must not be rewritten under them, so
-# the run STOPS and routes to /appweaver analyze-plan-delta (the delta's own gate). The
-# change is closed by close-delta, the SINGLE cr-archive caller, and only after
+# TWO MODES, AND THE WRITE IS WHAT SEPARATES THEM. This stage NEVER opens, merges or
+# closes a change; what it can do is REWRITE the master lane plans through its repair loop,
+# and that is the act a change in flight forbids — the delta docs are the authoritative
+# edit and the masters must not drift out from under them before finalize-delta merges.
+#   MASTER mode  (no change open) — the full gate: check, ask, repair, and STOP on gaps
+#                that could not be reconciled. spec.md + the lane plans are the masters.
+#   REPORT mode  (a change is open) — the same checks, read-only: no ask, no repair, no
+#                stop. It writes plan-analyze-report.md and routes on. The plans are
+#                DERIVED from spec.md + domain-model.md, so after finalize-delta merged a
+#                change the drift it reports is the EXPECTED consequence of that merge and
+#                the remedy is /appweaver plan main, not a repair here.
+# Report mode exists because the finalize→close window is exactly when the plans are known
+# to be stale, and a stage that refuses to look is not a gate. It reports; it never writes
+# a plan.
+#
+# WHICH MODE IS READ FROM THE DIRECTORY, AND DEFAULTS TO REPORT. changes/<id>/ is the
+# evidence (cr-list), not active_version.json's `active_change` — the ledger is the most
+# recently OPENED change and a crashed run can leave the two disagreeing. The permission to
+# write is RAISED only by cr-list answering that nothing is open, so a reading that never
+# arrives leaves this stage read-only rather than rewriting masters mid-delta.
+#
+# The change is closed by close-delta, the SINGLE cr-archive caller, and only after
 # finalize-delta has merged the delta into the masters. Also runnable on demand to
-# re-anchor a hand-edited spec — again, only when no change is open.
+# re-anchor a hand-edited spec — in master mode, which means once every change is closed.
 #
 # RENAMED FROM `analyze-design`, following design → plan. It also absorbs the ⌛
 # `analyze-design-ui` phase that was never built as its own command: the frontend lane is
@@ -42,8 +59,8 @@
 # =============================================================================
 
 name: aw-spec-analyze-plan
-description: The spec↔plan conformance gate for every declared lane — confirm backend-plan.md and frontend-plan.md follow spec.md, that they bind to each other's contract, and that neither contradicts the bounded context's domain model (domain overlays are a backstop); with approval, repair the drifting plan. Lanes come from .appweaver/stacks.json, so one command gates backend-only, frontend-only and full-stack projects. Bootstrap-only — with a change open it stops and routes to analyze-plan-delta; it never closes a change.
-version: 3.0.0
+description: The spec↔plan conformance gate for every declared lane — confirm backend-plan.md and frontend-plan.md follow spec.md, that they bind to each other's contract, and that neither contradicts the bounded context's domain model (domain overlays are a backstop); with approval, repair the drifting plan. Lanes come from .appweaver/stacks.json, so one command gates backend-only, frontend-only and full-stack projects. Runs in one of two modes, decided from the changes/ directory rather than the ledger and defaulting to the read-only one — MASTER (no change open) checks, repairs on approval and stops on unreconciled gaps; REPORT (a change open) runs the same checks read-only and writes plan-analyze-report.md without asking, repairing or stopping, because the master plans may not be rewritten while a delta is in flight. It never opens, merges or closes a change.
+version: 3.2.0
 agent_agnostic: true
 dialect: aw-spec.orchestrator/v1
 
@@ -58,9 +75,23 @@ standards:
 vars:
   analyze_ok: "false"
   active_change: ""
-  has_change: "false"
   version: ""
-  no_open_change: "true"   # NOT has_change ⇒ the masters are authoritative ⇒ this gate applies
+  # WHICH MODE THIS RUN IS IN, read from the changes/ DIRECTORY and defaulted to the
+  # read-only answer. has_changes starts at the BLOCKING value because an unanswered
+  # question is not a clean answer: cr-list runs without on_error: continue, so a failure
+  # stops the run outright, and a field that never arrived leaves this stage read-only
+  # instead of letting the repair loop rewrite master plans while a delta is in flight.
+  has_changes: "true"
+  open_ids: ""             # cr-list's ids_csv — what is open, named, for the operator
+  open_count: "0"
+  no_open_change: "false"  # RAISED only by cr-list answering that nothing is open
+  gate_mode: "report"      # report | master — reported in the outputs
+  may_repair: "false"      # the ask, the repair loop and the conformance stop are MASTER-only
+  gate_ok: "false"         # raised by a conformant run OR by report mode, which cannot repair
+  stamp_receipt: "false"   # master mode AND conformant ⇒ leave the receipt implement reads
+  receipt_file: ""
+  receipt_gated: ""
+  receipt_count: "0"
   lanes_declared: "false"
   be_declared: "false"
   fe_declared: "false"
@@ -91,6 +122,10 @@ vars:
   be_plan_ctx: ""
   fe_plan_ctx: ""
   domain_model: ""
+  owned_sections: ""           # the model section(s) this feature answers for — feature-aggregates
+  shared_with_csv: ""
+  one_to_one: "true"
+  model_scope_plan: ""         # which part of those sections check 4(a) holds the plan to
 
 workflow:
 
@@ -144,11 +179,40 @@ workflow:
       - { name: domain_model,        from: "$.domain_model" }
       - { name: domain_model_exists, from: "$.domain_model_exists" }
 
+  # WHICH PART OF THAT MODEL CHECK 4 HOLDS THE PLAN TO. A feature is a capability scope the
+  # developer chose — it may act on several aggregates, and several features may act on
+  # one — so "the plan matches its aggregate's section" is only exact for a feature that
+  # alone answers for that aggregate. Resolved from the spec's Acts-on line, then the
+  # boundary map, then the feature name.
+  - id: feature_aggregates
+    action: execute_script
+    on_error: continue
+    script: { ref: xref }
+    subcommand: feature-aggregates
+    args: ["--feature-dir", "{{feature_dir}}"]
+    outputs:
+      - { name: owned_sections,  from: "$.owned_sections" }
+      - { name: shared_with_csv, from: "$.shared_with_csv" }
+      - { name: one_to_one,      from: "$.one_to_one" }
+
+  # A shared section is realised by several plans, each covering what its own feature
+  # acts on; flagging every element one plan leaves out would fail each of them for work
+  # another feature's plan carries. Ordered pair of sets — no conditional prompt text.
+  - id: model_scope_shared
+    action: set
+    vars:
+      model_scope_plan: "{{owned_sections}}, which this feature SHARES with other features: every element the plan realises must carry the model's name and sit inside the model's boundary, but an element of the section the plan leaves out is NOT a gap unless this feature's requirements act on it — another feature's plan realises it"
+  - id: model_scope_sole
+    condition: "{{one_to_one}} == true"
+    action: set
+    vars:
+      model_scope_plan: "{{owned_sections}}. This feature is the only one that answers for it, so the plan's domain layer must realise that whole section"
+
   - id: require_feature
     action: verify_context
     require_non_empty: feature_dir
     on_empty: stop
-    on_empty_message: "No active feature. Run /appweaver select-feature first (pick or create the aggregate, e.g. Order), then re-run analyze-plan."
+    on_empty_message: "No active feature. Run /appweaver select-feature first (pick or create the feature, e.g. Order or PatientRegistration), then re-run analyze-plan."
 
   - id: verify_spec
     action: verify_context
@@ -156,33 +220,46 @@ workflow:
     on_false: stop
     on_false_message: "No spec.md for the current feature. Run /appweaver specify (and /appweaver plan) first."
 
-  # 1b. Read the open change (opened by specify, or by plan on a plan-only change).
-  #     has_change drives the BOOTSTRAP-ONLY guard below — it closes nothing.
-  - id: read_change
+  # 1b. IS ANY CHANGE OPEN — asked of the changes/ DIRECTORY, which is what "open" means.
+  #     Not version-read's `has_change`: that is bool(active_change), the most recently
+  #     OPENED change in active_version.json, and a run that died between cr-setup writing
+  #     the directory and the ledger recording it leaves the two disagreeing. The stage
+  #     that may rewrite masters has to read the authority every other delta stage reads.
+  #     No on_error: continue — a cr-list that cannot answer stops the run.
+  - id: cr_list
     action: execute_script
     script: { ref: actions }
-    subcommand: version-read
+    subcommand: cr-list
     args: ["--feature-dir", "{{feature_dir}}"]
     outputs:
+      - { name: has_changes,   from: "$.has_changes" }
+      - { name: open_ids,      from: "$.ids_csv" }
+      - { name: open_count,    from: "$.count" }
       - { name: active_change, from: "$.active_change" }
-      - { name: has_change,    from: "$.has_change" }
-      - { name: version,       from: "$.version" }
-
-  # 1c. BOOTSTRAP-ONLY GUARD. A change open ⇒ the delta spec + delta plans are the
-  #     authoritative in-flight edit and this stage is the WRONG gate: its repair loop
-  #     rewrites the MASTER plans, which would drift the masters out from under the delta
-  #     before finalize-delta merges it. Stop BEFORE any authoring so the wrong-stage run
-  #     has zero side effects, and route to the delta's own gate.
-  - id: flag_change_open
-    condition: "{{has_change}} == true"
+
+  - id: read_version
+    action: execute_script
+    script: { ref: actions }
+    subcommand: version-read
+    args: ["--feature-dir", "{{feature_dir}}"]
+    outputs:
+      - { name: version, from: "$.version" }
+
+  # 1c. THE WRITE PERMISSION, raised then verified. Nothing open ⇒ spec.md + the lane plans
+  #     ARE the masters ⇒ this stage owns them and may repair. Anything else — a change
+  #     open, or an answer that never arrived — leaves may_repair down and the run is
+  #     read-only: the checks still run and still report, but no plan is rewritten under a
+  #     delta in flight. The permission is raised by the good state, never knocked down by
+  #     the bad one, so the failure direction is refusal to write.
+  - id: no_open_change_raise
+    condition: "{{has_changes}} == false"
     action: set
-    vars: { no_open_change: "false" }
+    vars: { no_open_change: "true" }
 
-  - id: require_no_change
-    action: verify_context
-    require_true: no_open_change
-    on_false: stop
-    on_false_message: "Change {{active_change}} is OPEN on this feature — analyze-plan is the BOOTSTRAP gate and must not rewrite the master plans while a delta is in flight. Gate the delta instead: /appweaver analyze-plan-delta → implement → build → analyze-slice-delta → finalize-delta (merges the delta into spec.md and domain-model.md — not the lane plans, which are derived from those two) → analyze-slice → close-delta (archives the change + bumps the version). Re-run analyze-plan once every change is closed, to re-anchor the masters."
+  - id: enter_master_mode
+    condition: "{{no_open_change}} == true"
+    action: set
+    vars: { gate_mode: "master", may_repair: "true" }
 
   # 2. WHICH LANES ARE GATED. Present = declared AND on disk; missing = declared AND not.
   #    Taking the lane's own `declared` value under the exists condition is how the AND is
@@ -344,9 +421,10 @@ workflow:
 
           CHECK 4 — the plans → domain-model.md (when the model is in context; skip if it
           is not):
-          (a) the backend plan's DOMAIN layer matches the model EXACTLY — entities and
-          value objects are its aggregate section's entities (SAME names), the boundary is
-          its Boundary block, states are the lifecycle it describes;
+          (a) the backend plan's DOMAIN layer matches the model EXACTLY. The section(s)
+          this feature answers for: {{model_scope_plan}}. Entities and value objects carry
+          the section's names (SAME names), the boundary is its Boundary block, states are
+          the lifecycle it describes;
           (b) EVERY invariant (BR-nnn) the spec cites has a named ENFORCEMENT POINT in the
           backend plan. An invariant nothing enforces is a HIGH gap; a plan that RESTATES
           what an invariant says instead of citing it by id is a gap too — the model is the
@@ -378,6 +456,45 @@ workflow:
       - id: conform_break
         action: break
         condition: "{{analyze_ok}} == true"
+
+      # REPORT MODE — a change is open (or the mode could not be established), so the
+      # master plans are off limits and there is nothing to ask: repair is not on offer.
+      # Write the report and leave the loop. The report itself has to name the two
+      # readings, because the same gaps mean opposite things either side of the merge.
+      - id: write_report_readonly
+        condition: "{{may_repair}} == false"
+        action: agent_author
+        include_standards: false
+        output_target: { type: file, path: "{{feature_dir}}/plan-analyze-report.md" }
+        task: |
+          Write a Plan Analyze Report to the output from these spec↔plan conformance gaps
+          (spec.md is the ANCHOR). This run was READ-ONLY: change(s) {{open_ids}} are open
+          on this feature, so the master lane plans were checked but NOT repaired.
+          {{analyze_gaps}}
+          Markdown format:
+          - "# Plan Analyze Report — <aggregate>" plus today's date.
+          - A verdict line: "verdict: GAPS ✗ · <n> gap(s) · read-only (change open: {{open_ids}})".
+          - "## Gaps" as a table: | # | check | lane | severity | spec ref | plan location | gap |.
+          - "## How to read this" — state BOTH readings and that only the operator knows
+            which applies, because it depends on whether finalize-delta has already run:
+            (a) AFTER finalize-delta merged a change, these gaps are EXPECTED. The lane
+            plans are DERIVED from spec.md + domain-model.md and finalize-delta merges the
+            change into those two documents only, so the plans stand at their last authored
+            content and the spec has moved ahead of them. The remedy is
+            /appweaver plan main (which re-derives them, carrying DA-n / WA-n forward),
+            after /appweaver close-delta, not a repair of either plan.
+            (b) BEFORE finalize-delta, the masters have not moved, so these gaps are real
+            master drift — but this is still not the stage that fixes it, because the
+            change in flight is planned in its OWN delta plans. Gate those with
+            /appweaver analyze-plan-delta, and re-run /appweaver analyze-plan in master
+            mode once every change is closed.
+          - "## Not repaired here": this report is the whole output of a read-only run. No
+            plan document was written.
+          Return the complete report markdown only.
+      - id: readonly_break
+        action: break
+        condition: "{{may_repair}} == false"
+
       - id: ask_repair
         action: ask
         prompt: |
@@ -501,13 +618,53 @@ workflow:
             already-conformant section VERBATIM.
           Return the COMPLETE updated frontend-plan.md content only.
 
+  # THE STOP IS MASTER MODE'S ALONE. Two independent raises, because the two reasons to
+  # pass are unrelated: the plans conform, or this run was never allowed to change them.
+  # A read-only run that found gaps has done its whole job by reporting them — stopping
+  # would fail the operator for drift that finalize-delta created on purpose and that only
+  # /appweaver plan main can close.
+  - id: gate_ok_conformant
+    condition: "{{analyze_ok}} == true"
+    action: set
+    vars: { gate_ok: "true" }
+  - id: gate_ok_readonly
+    condition: "{{may_repair}} == false"
+    action: set
+    vars: { gate_ok: "true" }
+
   - id: analyze_gate
     action: verify_context
-    require_true: analyze_ok
+    require_true: gate_ok
     on_false: stop
     on_false_message: "The lane plans do not conform to the spec (gaps: {{analyze_gaps}}) — repair was skipped (see plan-analyze-report.md), or it could not be reconciled in 3 passes. A 'LIFT-FAILURE:' gap means a domain constraint from the gate checklist was never lifted into the spec, and a `model` gap means the plan needs an entity or invariant domain-model.md does not define — both are fixed by /appweaver specify, which authors the spec and the model; this gate may not write either. A `contract` gap is closed in the lane its row names. Otherwise fix out of band, or re-run and choose Repair."
 
-  # (No change-close here by design — this stage only ever runs with NO change open,
+  # THE RECEIPT. implement generates from the plans and deliberately does not read the
+  # spec, on the strength of this stage having conformed them to it — which until now was
+  # an assumption about the order the operator ran things in, checked by nothing. Record
+  # WHAT was proven: the bytes of spec.md, the context's domain-model.md and each lane plan
+  # that was present. plan-gate-check reads it at implement.
+  #
+  # ONLY A GREEN MASTER RUN LEAVES ONE. The AND is the kit's ordered assignment — under
+  # master mode, take the conformance verdict as the answer — because the engine has no
+  # compound conditions. A REPORT-mode run proves nothing about the masters (it may not
+  # even repair them), and a red master run proved the opposite.
+  - id: flag_receipt
+    condition: "{{may_repair}} == true"
+    action: set
+    vars: { stamp_receipt: "{{analyze_ok}}" }
+
+  - id: plan_gate_stamp
+    condition: "{{stamp_receipt}} == true"
+    action: execute_script
+    script: { ref: actions }
+    subcommand: plan-gate-stamp
+    args: ["--feature-dir", "{{feature_dir}}", "--spec-version", "{{version}}", "--mode", "{{gate_mode}}"]
+    outputs:
+      - { name: receipt_file,  from: "$.file" }
+      - { name: receipt_gated, from: "$.gated" }
+      - { name: receipt_count, from: "$.count" }
+
+  # (No change-close here by design — this stage never archives anything in either mode,
   #  and cr-archive belongs to close-delta, which runs after finalize-delta's merge.)
 
   # 6. Post-execution hooks.
@@ -531,5 +688,9 @@ outputs:
   conformant: "{{analyze_ok}}"
   gaps: "{{analyze_gaps}}"
   version: "{{version}}"
-  note: "Checked: spec→backend-plan ({{be_present}}), spec→frontend-plan ({{fe_present}}), the plan↔plan contract binding ({{both_lanes}} — it needs both lanes) and both plans against domain-model.md. The domain model was READ, never written: a gap that needs a new entity, event or invariant is fixed by /appweaver specify."
-  next: "/appweaver implement   (the plans conform to the spec; version unchanged — this gate closes nothing)"
+  gate_mode: "{{gate_mode}}"        # master (repair allowed) | report (read-only)
+  open_changes: "{{open_ids}}"      # empty in master mode, by definition
+  gate_receipt: "{{receipt_file}}"  # written only by a GREEN master run; implement reads it
+  gate_receipt_at: "{{receipt_gated}}"
+  note: "Ran in {{gate_mode}} mode ({{open_count}} change(s) open: {{open_ids}}). Checked: spec→backend-plan ({{be_present}}), spec→frontend-plan ({{fe_present}}), the plan↔plan contract binding ({{both_lanes}} — it needs both lanes) and both plans against domain-model.md. The domain model was READ, never written: a gap that needs a new entity, event or invariant is fixed by /appweaver specify. In REPORT mode no plan was rewritten either — the master plans are derived documents and may not move while a delta is in flight."
+  next: "MASTER mode (no change open, conformant={{analyze_ok}}): /appweaver implement — the plans conform to the spec; version unchanged, this gate closes nothing. REPORT mode (change(s) {{open_ids}} open): this run was read-only and wrote plan-analyze-report.md only. If finalize-delta has already merged, the gaps ARE that merge — the lane plans are derived from spec.md + domain-model.md and finalize-delta moves only those two, so re-derive with /appweaver plan main after /appweaver close-delta, then re-run /appweaver analyze-plan in master mode. If the change has NOT merged yet, gate it where it lives: /appweaver analyze-plan-delta."

package/assets/.appweaver/orchestrator/workflows/aw-spec-analyze-slice-delta.orch.yaml

@@ -182,7 +182,7 @@ workflow:
     action: verify_context
     require_non_empty: feature_dir
     on_empty: stop
-    on_empty_message: "No active feature. Run /appweaver select-feature first (pick the aggregate, e.g. Order), then re-run analyze-slice-delta."
+    on_empty_message: "No active feature. Run /appweaver select-feature first (pick the feature, e.g. Order or PatientRegistration), then re-run analyze-slice-delta."
 
   # 3. WHICH CHANGE. Same selection contract as plan, analyze-plan-delta and implement:
   #    cr-list enumerates the open changes (evidence = changes/<CR-id>/ on disk), a bare CR

package/assets/.appweaver/orchestrator/workflows/aw-spec-analyze-slice.orch.yaml

@@ -3,13 +3,17 @@
 #
 # The second of the two discrete conformance gates on the forward path, and the
 # sibling of analyze-plan:
-#   analyze-plan    gates spec ↔ plan   — STATIC,  before implement
-#   analyze-slice   gates plan ↔ slice  — DYNAMIC, after  build
+#   analyze-plan    gates spec + model ↔ plans  — STATIC,  before implement
+#   analyze-slice   gates spec + model ↔ code   — DYNAMIC, after  build
+# Both anchor on the same two masters. The difference is what they score against them and
+# how: analyze-plan reads documents and never runs anything; this gate runs the slice's
+# tests and reads the code they cover.
 # "Slice" is the unit under analysis: the aggregate's code, its paired tests, and
 # its OKF knowledge concept. Three passes over it —
 #   1. BEHAVIOUR   run the tests (paired to the spec's acceptance criteria by the
 #                  design docs); on red, fix up to 3×.
-#   2. CONFORMANCE check the code against the domain gate overlays (validate-only).
+#   2. CONFORMANCE check the code against the domain gate overlays AND the bounded
+#                  context's domain-model.md (validate-only).
 #   3. KNOWLEDGE   refresh + review the slice's OKF concept (advisory).
 # Every fix made here is recorded in that concept, which is also where the slice's
 # file list is READ from (2.3.0 — `aw-xref concept-paths`, replacing the retired
@@ -17,7 +21,22 @@
 # longer carries; the paired `design-reconcile` write-back is retired with it, its job
 # already done by the concept-upsert --merge steps in pass 3).
 #
-# TWO POSITIONS, one gate — and in BOTH the master spec.md is the whole truth:
+# TWO MASTERS, NOT ONE (2.4.0). The spec says what the feature must DO; the bounded
+# context's domain-model.md says what the domain IS — the aggregate boundary, the entities,
+# and the text of every invariant the spec cites by BR id. Since the model split, the spec
+# carries the ids and not the rules, so a gate reading only the spec scores code against a
+# document that no longer states what it is checking for. Both are in every pass's context
+# and the conformance pass scores against both.
+#
+# SCOPE IS WHAT KEEPS THE MODEL FAIR HERE. domain-model.md describes the whole context
+# while this gate scores ONE feature. An invariant under the slice's own `## Aggregate:`
+# section is BLOCKING — unenforced or enforced differently than stated is a violation, and
+# so is naming an entity or field differently from the model. An invariant under another
+# aggregate's section is REPORTED and never blocking: this slice does not own it and often
+# should not enforce it. A feature outside every bounded context has no model, and the pass
+# degrades to overlays + spec, exactly as it behaved before.
+#
+# TWO POSITIONS, one gate — and in BOTH the merged masters are the whole truth:
 #   BOOTSTRAP  implement → build → analyze-slice → run
 #   CHANGE     implement (the delta) → build → analyze-slice-delta → finalize-delta
 #              → analyze-slice → close-delta
@@ -42,8 +61,8 @@
 # =============================================================================
 
 name: aw-spec-analyze-slice
-description: The design↔code conformance gate — run the slice's tests against its acceptance criteria, check the code against the domain gate overlays, verify the change did not break any referring aggregate (the OKF referrer blast radius) and write a triage report before stopping if it did, refresh + review its OKF concept, and record every fix in it. Sits after finalize-delta on the change path, so the master spec it scores against already carries the change, and before close-delta, so a red gate leaves the change open and recoverable.
-version: 2.3.0
+description: The design↔code conformance gate — run the slice's tests against its acceptance criteria, check the code against the domain gate overlays AND the bounded context's domain-model.md (every invariant the slice's own aggregate section states must be enforced as written; one another aggregate owns is reported, not blocking), verify the change did not break any referring aggregate (the OKF referrer blast radius) and write a triage report before stopping if it did, refresh + review its OKF concept, and record every fix in it. Sits after finalize-delta on the change path, so the two masters it scores against already carry the change, and before close-delta, so a red gate leaves the change open and recoverable.
+version: 2.4.0
 agent_agnostic: true
 dialect: aw-spec.orchestrator/v1
 
@@ -69,6 +88,10 @@ standards:
 vars:
   test_ok: "false"
   conformance_ok: "false"
+  # Invariants the model states under ANOTHER aggregate's section that this slice appears
+  # to touch — reported, never blocking, since this slice does not own them. Defaulted so
+  # the gate message and the outputs read a real value on a run that skipped the pass.
+  model_notes: ""
   # NAVIGATION ONLY. Whether a change is open decides where this gate sends you next
   # (close-delta vs run) — nothing else in this workflow reads them. On the CHANGE path
   # finalize-delta has already merged the delta into the master docs, so the delta files
@@ -105,6 +128,7 @@ workflow:
     script: { ref: actions }
     subcommand: feature-paths
     outputs:
+      - { name: feature,     from: "$.feature" }
       - { name: feature_dir, from: "$.feature_dir" }
       - { name: spec_file,   from: "$.spec_file" }
 
@@ -112,7 +136,63 @@ workflow:
     action: verify_context
     require_non_empty: feature_dir
     on_empty: stop
-    on_empty_message: "No active feature. Run /appweaver select-feature first (pick or create the aggregate, e.g. Order), then re-run analyze-slice."
+    on_empty_message: "No active feature. Run /appweaver select-feature first (pick or create the feature, e.g. Order or PatientRegistration), then re-run analyze-slice."
+
+  # The bounded context's DOMAIN MODEL — in every pass's context beside the spec, and the
+  # authority the conformance pass scores against. Since the model split the spec no longer
+  # states the aggregate boundary, the entities or the text of an invariant: it cites BR-nnn
+  # by id and the model holds them. A gate reading only the spec therefore scores code
+  # against a document that no longer carries what it is checking for.
+  #
+  # On the CHANGE path this gate runs after finalize-delta, which has already merged the
+  # change's model half into the master — so the master is complete here and the change's
+  # `domain-model.<CR>.delta.md` is deliberately NOT loaded, exactly as its delta-spec is not.
+  #
+  # optional: on every context entry below, because a feature outside every bounded context
+  # legitimately has no model and a required file that is missing announces itself.
+  # on_error: continue for the same reason — a missing model degrades this gate to its
+  # pre-model behaviour (spec + overlays), it never blocks.
+  - id: context_paths
+    action: execute_script
+    on_error: continue
+    script: { ref: actions }
+    subcommand: context-paths
+    outputs:
+      - { name: context,             from: "$.context" }
+      - { name: domain_model,        from: "$.domain_model" }
+      - { name: domain_model_exists, from: "$.domain_model_exists" }
+
+  # WHICH PART OF THAT MODEL THIS GATE SCORES. The model is filed by aggregate, the specs
+  # tree by feature. For a feature that is one capability over a shared aggregate
+  # (PatientRegistration over Patient) no section carries the feature's name, and scoring
+  # "the BR-nnn under this feature's section" found none and PASSED — every invariant the
+  # feature relies on silently demoted to a non-blocking note. Resolved from the spec's
+  # Acts-on line, then the boundary map, then the feature name.
+  - id: feature_aggregates
+    action: execute_script
+    script: { ref: xref }
+    subcommand: feature-aggregates
+    args: ["--feature-dir", "{{feature_dir}}"]
+    outputs:
+      - { name: owned_sections, from: "$.owned_sections" }
+      - { name: one_to_one,     from: "$.one_to_one" }
+
+  # WHICH OF THOSE INVARIANTS BLOCK. A feature that alone answers for an aggregate owns
+  # its section outright, and every BR-nnn under it has to be enforced in this code. A
+  # feature that shares the aggregate with other features — whatever it is named —
+  # answers only for what its spec cites: the rest of that section is the other features'
+  # code, and blocking on it would fail each of them for work another one does. The
+  # engine has no conditional prompt text, so the rule is chosen by an ordered pair of
+  # sets and handed to the pass as one sentence.
+  - id: model_scope_capability
+    action: set
+    vars:
+      model_scope_rule: "this feature SHARES those sections with other features, so BLOCKING covers only the BR-nnn this feature's spec CITES from them; any other BR-nnn stated there belongs to another feature and is a model_notes entry, not a violation"
+  - id: model_scope_owned
+    condition: "{{one_to_one}} == true"
+    action: set
+    vars:
+      model_scope_rule: "this feature is the ONLY one that answers for that section, so BLOCKING covers EVERY BR-nnn stated there, whether or not the spec cites it"
 
   # Is a change OPEN on this feature? Read for NAVIGATION only — see the vars note. Safe
   # on the bootstrap path: with no active_version.json, version-read returns
@@ -185,6 +265,7 @@ workflow:
           test_log: "{{test_log}}"
         context:
           - { path: "{{spec_file}}" }
+          - { path: "{{domain_model}}", optional: true }
         context_from: all_paths
       - id: fix
         action: agent_generate
@@ -193,7 +274,10 @@ workflow:
         task: |
           Tests failed. Make them pass by fixing the code (or a genuinely wrong
           test) in the files in context, keeping behaviour aligned with the spec's
-          acceptance criteria (spec in context). Test log:
+          acceptance criteria (spec in context). Where the spec cites an invariant
+          by id (BR-nnn), the bounded context's domain-model.md in context carries
+          its text and the entity names it is stated over — read the rule there
+          rather than inferring it from the id. Test log:
           {{test_log}}
         outputs:
           - { name: fixed_files, from: "$.files" }
@@ -238,27 +322,58 @@ workflow:
         action: build_context
         context:
           - { path: "{{spec_file}}" }
+          - { path: "{{domain_model}}", optional: true }
         context_from: all_paths
       - id: check_overlays
         action: agent_query
         include_standards: true            # the gate overlays (checklist) are in the standards
-        schema: { ok: true, violations: [ { rule: "<overlay rule / id>", where: "<file:symbol>", issue: "<what is violated>" } ] }
-        mock: { ok: true, violations: [] }
+        schema: { ok: true, violations: [ { rule: "<overlay rule / BR-nnn>", where: "<file:symbol>", issue: "<what is violated>" } ], model_notes: [ { rule: "<BR-nnn>", owner: "<the aggregate that states it>", issue: "<what is unenforced or mismatched>" } ] }
+        mock: { ok: true, violations: [], model_notes: [] }
         task: |
-          The domain gate checklist is loaded in the standards (the overlay
-          forbidden-patterns, refusal conditions, and CI gates). Check the feature's
-          generated code + tests (in context) against EACH checklist rule and list
-          EVERY violation, e.g.: a hard delete of a retention-protected aggregate /
-          version history / audit record; a second write path bypassing the aggregate
-          or interop adapter; an invented/free-text coded value where a validated code
-          is required; a missing or weakened audit emission on an audited operation; a
-          data-classification-restricted field exposed on the public surface or written
-          to logs/metrics/traces. Also confirm the constraint TESTS exist (audit is
-          emitted, a restricted field is not exposed, an interop projection round-trips).
-          ok=true ONLY when no checklist rule is violated.
+          TWO authorities, checked in one pass over the feature's generated code + tests
+          (in context).
+
+          1. THE DOMAIN GATE CHECKLIST, loaded in the standards (the overlay
+          forbidden-patterns, refusal conditions, and CI gates). Check the code against
+          EACH checklist rule and list EVERY violation, e.g.: a hard delete of a
+          retention-protected aggregate / version history / audit record; a second write
+          path bypassing the aggregate or interop adapter; an invented/free-text coded
+          value where a validated code is required; a missing or weakened audit emission
+          on an audited operation; a data-classification-restricted field exposed on the
+          public surface or written to logs/metrics/traces. Also confirm the constraint
+          TESTS exist (audit is emitted, a restricted field is not exposed, an interop
+          projection round-trips).
+
+          2. THE BOUNDED CONTEXT'S DOMAIN MODEL, `domain-model.md` in context — the
+          authority on what the domain IS. The spec cites invariants by id; this document
+          states them. It describes the WHOLE context while this gate scores ONE feature,
+          so scope matters:
+            • BLOCKING — the invariants of the section(s) this feature answers for,
+              {{owned_sections}}: {{model_scope_rule}}. Each blocking rule has to be
+              enforced somewhere in this code, and the
+              enforcement has to say what the model says. An owned invariant with no
+              enforcement, or one enforced with a different threshold, condition or
+              direction than the model states, is a `violations` entry with the BR id as
+              its `rule`. The model wins: it is what finalize-delta merged and what the
+              plans were conformed against.
+            • BLOCKING — the ubiquitous language of that same section. An entity, field or
+              state the code names differently from the model is a violation; the model's
+              name is the right one.
+            • NOT BLOCKING — anything the model states under any section not named above.
+              This slice does not own those and often should not enforce them. Report each
+              one this code appears to touch as a `model_notes` entry, naming the owning
+              aggregate, and carry on.
+          If no domain-model.md is in context, this feature is outside every bounded
+          context: skip part 2 entirely and report nothing for it. Never infer an
+          invariant's text from its id, and never treat a rule the model does not state
+          as one.
+
+          ok=true ONLY when no checklist rule is violated AND no BLOCKING invariant above
+          is unenforced or contradicted. `model_notes` never affects ok.
         outputs:
           - { name: conformance_ok,         from: "$.ok" }
           - { name: conformance_violations, from: "$.violations" }
+          - { name: model_notes,            from: "$.model_notes" }
       - id: conformance_break
         action: break
         condition: "{{conformance_ok}} == true"
@@ -268,9 +383,15 @@ workflow:
         permission_mode: acceptEdits
         task: |
           Fix these domain-conformance violations in the feature's code (in context),
-          following the gate checklist rules (in the standards) and keeping the design's
-          behaviour intact. Do NOT weaken or delete a test to hide a violation — fix the
-          code. After fixing, re-run the tests (Bash) to confirm they stay green.
+          keeping the design's behaviour intact. A violation whose `rule` is an overlay
+          rule is fixed against the gate checklist in the standards; one whose `rule` is a
+          BR-nnn is fixed against the text domain-model.md states for it under its section
+          among {{owned_sections}} — enforce what the model says, where the code
+          already owns that decision, and name entities and fields the way the model names
+          them. Do NOT weaken or delete a test to hide a violation, and do NOT edit
+          domain-model.md or the spec to match the code: this is a gate on the code, and a
+          model that is genuinely wrong is corrected upstream through /appweaver specify.
+          After fixing, re-run the tests (Bash) to confirm they stay green.
           Violations: {{conformance_violations}}
         outputs:
           - { name: conformance_fixes, from: "$.files" }
@@ -279,7 +400,7 @@ workflow:
     action: verify_context
     require_true: conformance_ok
     on_false: stop
-    on_false_message: "Code violates the domain gate checklist after 2 fix attempts (violations: {{conformance_violations}}). These are the domain constraints plan/implement must satisfy — fix the code, or if the constraint itself is wrong, correct it upstream (/appweaver specify → plan)."
+    on_false_message: "Code fails domain conformance after 2 fix attempts (violations: {{conformance_violations}}). Each entry is either a gate-checklist rule or an invariant (BR-nnn) the aggregate's own section of {{domain_model}} states and this code does not enforce as written. Both are constraints plan/implement must satisfy — fix the code, or if the constraint itself is wrong, correct it upstream (/appweaver specify → plan) rather than editing the model to match what was built. Invariants owned by other aggregates in this context were reported, not enforced here: {{model_notes}}"
 
   # ═══════ INTEGRITY — did this feature's change break any aggregate that USES it? ═══════
   # The slice is green + domain-conformant on its own. But a change to a feature can break
@@ -325,6 +446,7 @@ workflow:
       integrity_log: "{{integrity_log}}"
     context:
       - { path: "{{spec_file}}" }
+      - { path: "{{domain_model}}", optional: true }
     context_from: all_paths
   - id: write_broken_referrers
     action: agent_author
@@ -436,6 +558,18 @@ workflow:
 
 outputs:
   feature_dir: "{{feature_dir}}"
+  bounded_context: "{{context}}"
+  # The second master this gate scored against — the RESOLVED path, which context-paths
+  # reports whether or not the file is there. `model_scored` is the one that says whether
+  # it actually reached the passes: false means the conformance pass checked the gate
+  # overlays alone, either because the feature is outside every bounded context or because
+  # its context has not been modelled yet.
+  domain_model: "{{domain_model}}"
+  model_scored: "{{domain_model_exists}}"
+  # Invariants another aggregate in this context owns that this slice appears to touch.
+  # Reported by the conformance pass and never gated — surfaced so a real cross-aggregate
+  # leak is visible rather than only living in one query's answer.
+  model_notes: "{{model_notes}}"
   test_tool: "{{test_tool}}"
   referrer_count: "{{referrer_count}}"
   referrer_blast_radius: "{{referrer_names}}"