aw-spec-cli 0.1.18 → 0.1.20

package/assets/.appweaver/orchestrator/workflows/aw-spec-implement.orch.yaml

@@ -42,6 +42,22 @@
 # spec.md — analyze-plan already conformed the plans to it, so the plan is the complete,
 # authoritative source for WHICH elements exist, where each lives and what surface they
 # publish, and anything missing from it is fixed in `plan`, never compensated for here.
+#
+# AND THAT SENTENCE IS NOW CHECKED. "analyze-plan already conformed them" was an assumption
+# about the order the operator ran things in: the lane gates test that the plan FILE EXISTS
+# and nothing more, so `plan` → edit spec.md → `implement` generated at full length from a
+# plan nobody had held against the spec it now contradicts. analyze-plan leaves a receipt of
+# the bytes it proved and plan-gate-check reads it here, on the bootstrap path, before any
+# lane generates. A feature with no receipt has simply never been gated since the receipt
+# existed — reported, never refused. One that HAS a receipt and no longer matches it stops.
+# 3.2.0 — AND NOT delta-spec.md EITHER. The change path used to inline it "only so the
+# paired tests can cite traceability ids", which made the rule true on the bootstrap path
+# and false on the one where changes actually ship: a document in the payload is a document
+# the generator can reason from, so a gap in a delta plan could be quietly filled from the
+# requirement text and the plan never found to be wrong. Both paths now carry plan + model
+# and nothing else. The ids are still cited and still required — the delta plan names the
+# spec id each element serves, which is exactly what analyze-plan-delta conformed, and an
+# element naming none is a planning gap to surface rather than a traceability to invent.
 # But since the model split a plan CITES an invariant by id and never restates it, so the
 # bounded context's domain-model.md is in context too, as the authority on the entity
 # names, the aggregate boundary, the lifecycle states and the TEXT of every BR-nnn the plan
@@ -76,6 +92,14 @@
 # found only elsewhere in the repository is the service lane's, and accepting it is how a
 # frontend that was never scaffolded is generated into anyway and reports green.
 #
+# A LANE'S GAP DISABLES THAT LANE, NOT THE RUN. Three things a lane needs are checked per
+# lane and reported per lane: its source path is on disk, its plan is there, and a project
+# is scaffolded under it. Any of them missing skips that lane with the command that fixes
+# it named, and every other declared lane still generates; only when NOTHING can run does
+# the run stop, with all the reasons printed. The whole-run stop is reserved for states
+# with no correct lane to fall back on — no lane declared at all, a lane declaring no
+# source path, and two lanes claiming overlapping subtrees.
+#
 # WHAT IT DOES NOT DO. It never writes spec.md, a master plan or the domain model, and it
 # never closes a change — finalize-delta merges the change's spec and model halves,
 # analyze-slice verifies the slice, and close-delta archives it and bumps the version.
@@ -91,8 +115,8 @@
 # =============================================================================
 
 name: aw-spec-implement
-description: "Generate the aggregate's source files and paired tests from its lane plans — the backend lane from backend-plan.md when a backend stack is declared, the frontend lane from frontend-plan.md when a frontend stack is, both when both are. One command covers backend-only, frontend-only and full-stack projects and absorbs the former implement-ui and implement-delta. Self-detecting off the changes on disk — with none open it generates from the master plans; with one or more open it ASKS which change and generates only what that change's delta plans mark ADDED or MODIFIED, leaving the masters untouched. Every lane is gated on its own plan and its own scaffolded project, and a lane missing either is reported and skipped rather than failing the other lane; each runnable lane confirms before it writes. Model-driven, and it does not read the spec — analyze-plan already conformed the plans to it. The plan says WHAT to build; the bounded context's domain-model.md, in context alongside it, says what the domain IS — the entity names, the boundary and the text of every invariant the plan cites by id — joined on the delta path by that change's own model delta, since the master is not merged until finalize-delta. The stack binds here from the lane declaration and the constitution halves; the plans stay technology-agnostic."
-version: 3.0.0
+description: "Generate the aggregate's source files and paired tests from its lane plans — the backend lane from backend-plan.md when a backend stack is declared, the frontend lane from frontend-plan.md when a frontend stack is, both when both are. One command covers backend-only, frontend-only and full-stack projects and absorbs the former implement-ui and implement-delta. Self-detecting off the changes on disk — with none open it generates from the master plans; with one or more open it ASKS which change and generates only what that change's delta plans mark ADDED or MODIFIED, leaving the masters untouched. Every lane is gated on its own source path, its own plan and its own scaffolded project, and a lane missing any of them is reported and skipped rather than failing the other lane; each runnable lane confirms before it writes. Model-driven, and it does not read the spec — analyze-plan already conformed the plans to it. The plan says WHAT to build; the bounded context's domain-model.md, in context alongside it, says what the domain IS — the entity names, the boundary and the text of every invariant the plan cites by id — joined on the delta path by that change's own model delta, since the master is not merged until finalize-delta. The stack binds here from the lane declaration and the constitution halves; the plans stay technology-agnostic."
+version: 3.4.0
 agent_agnostic: true
 dialect: aw-spec.orchestrator/v1
 
@@ -138,6 +162,20 @@ vars:
   delta_frontend_plan: ""
   delta_frontend_plan_exists: "false"
   wave: ""
+  # THE GATE RECEIPT — was this feature's plan pair ever PROVEN against this spec, and has
+  # anything moved since. analyze-plan writes it on a green master run; this phase is the
+  # reader. Bootstrap path only: a delta generates from delta plans, which analyze-plan-delta
+  # gates, and the master receipt says nothing about those.
+  gate_tracked: "false"
+  gate_fresh: "false"
+  gate_reason: ""
+  gate_at: ""
+  # DEFAULTED PERMISSIVE, DELIBERATELY, and it is the one flag here that is. Every tree that
+  # predates the receipt has none, and "never gated" is an unknown, not a stale plan —
+  # refusing on a missing file would block every existing feature on its first run. The flag
+  # is lowered only by a receipt that EXISTS and no longer matches: that tree has been through
+  # the gate once, so the bytes moving since is a fact, not an absence of one.
+  may_generate: "true"
   # PER-LANE STATE. Each lane resolves its own plan, its own project and its own answer;
   # a lane that is not declared never resolves any of them and its steps never run.
   # The engine has no compound conditions, so each AND is an ordered assignment: a step
@@ -182,22 +220,32 @@ workflow:
 
   # 0. THE LANE MODEL. lane-verify with NO --require, because this phase requires neither
   #    kind: a backend-only and a frontend-only project are both correct states, and which
-  #    lanes exist is exactly what it is here to find out. It still reports every DECLARED
-  #    lane whose source path is empty, missing or overlapping another's — a stack named
-  #    against a path that is not there is a mistake in a phase that writes code — and it
-  #    always exits 0, so the reason reaches the gate below as text.
+  #    lanes exist is exactly what it is here to find out.
+  #
+  #    --allow-missing-root, because a lane whose source path is not on disk is THAT LANE'S
+  #    gap, not the run's. This phase is per-lane throughout — a missing plan or a missing
+  #    project is reported at step 5 and the other lane still generates — and a missing root
+  #    is the same kind of gap, most often a declared frontend that `foundation` has not
+  #    unpacked yet. With the check left on it arrives here instead, as a whole-run stop
+  #    that takes the ready lane down with it. It is re-checked per lane at step 5 from
+  #    `*_root_exists`, which lane-verify reports whether or not the on-disk half is armed.
+  #
+  #    What still stops the run: no lane declared at all, a lane declaring no source path,
+  #    and two lanes claiming overlapping subtrees. Those are declaration errors with no
+  #    correct lane to fall back to, and none of them is a state any phase can work around.
   - id: lane_verify
     action: execute_script
     on_error: continue
     script: { ref: actions }
     subcommand: lane-verify
-    args: ["--command", "/appweaver implement"]
+    args: ["--command", "/appweaver implement", "--allow-missing-root"]
     outputs:
       - { name: lane_ok,        from: "$.ok" }
       - { name: lane_issues,    from: "$.message" }
       - { name: be_declared,    from: "$.backend_declared" }
       - { name: be_lane_id,     from: "$.backend_lane_id" }
       - { name: be_source_path, from: "$.backend_source_path" }
+      - { name: be_root_exists, from: "$.backend_root_exists" }
       - { name: be_profile,     from: "$.backend_profile" }
       - { name: be_title,       from: "$.backend_title" }
       - { name: be_language,    from: "$.backend_language" }
@@ -207,6 +255,7 @@ workflow:
       - { name: fe_declared,    from: "$.frontend_declared" }
       - { name: fe_lane_id,     from: "$.frontend_lane_id" }
       - { name: fe_source_path, from: "$.frontend_source_path" }
+      - { name: fe_root_exists, from: "$.frontend_root_exists" }
       - { name: fe_profile,     from: "$.frontend_profile" }
       - { name: fe_title,       from: "$.frontend_title" }
       - { name: fe_language,    from: "$.frontend_language" }
@@ -244,7 +293,7 @@ workflow:
     action: verify_context
     require_non_empty: feature_dir
     on_empty: stop
-    on_empty_message: "No active feature. Run /appweaver select-feature first (pick or create the aggregate, e.g. Order), then re-run implement."
+    on_empty_message: "No active feature. Run /appweaver select-feature first (pick or create the feature, e.g. Order or PatientRegistration), then re-run implement."
 
   # The bounded context's DOMAIN MODEL — in every generating lane's payload as the authority
   # on what the plan's cited BR-nnn actually require and on the ubiquitous language, and the
@@ -260,6 +309,21 @@ workflow:
       - { name: domain_model,        from: "$.domain_model" }
       - { name: domain_model_exists, from: "$.domain_model_exists" }
 
+  # WHICH PART OF THAT MODEL IS THIS FEATURE'S. The model is filed by aggregate, the specs
+  # tree by feature, and the two names differ for a feature that is one capability over a
+  # shared aggregate (PatientRegistration over Patient) — reading the model by the
+  # feature's name finds no section there. Resolved from the spec's Acts-on line, then the
+  # boundary map, then the feature name, so a 1:1 feature resolves to exactly the section
+  # this workflow always read.
+  - id: feature_aggregates
+    action: execute_script
+    script: { ref: xref }
+    subcommand: feature-aggregates
+    args: ["--feature-dir", "{{feature_dir}}"]
+    outputs:
+      - { name: owned_csv,      from: "$.owned_csv" }
+      - { name: owned_sections, from: "$.owned_sections" }
+
   # 2. WHICH CHANGES ARE OPEN — the evidence is changes/<CR-id>/ on disk; a closed change
   #    has moved to changes/archive/. Any open change makes this run a DELTA run.
   #    `matched_label` resolves a CR id passed as the argument to the whole option string,
@@ -318,6 +382,10 @@ workflow:
     outputs:
       - { name: cr_id,                     from: "$.cr_id" }
       - { name: cr_dir,                    from: "$.cr_dir" }
+      # Resolved for reporting and DELIBERATELY NOT put in any context — see the header.
+      # This phase realises the delta PLAN; the requirement text reaching the generator is
+      # what lets a gap in the plan be compensated for instead of found. Do not add it to
+      # ctx_backend_delta / ctx_frontend_delta.
       - { name: delta_spec,                from: "$.delta_spec" }
       # THIS CHANGE'S MODEL HALF — the structure the delta plans realise. It is context for
       # every generating lane, exactly as the master model is: the delta plan cites the
@@ -350,6 +418,49 @@ workflow:
     action: set
     vars: { fe_plan: "{{delta_frontend_plan}}", fe_plan_ok: "{{delta_frontend_plan_exists}}" }
 
+  # 3b. WERE THESE PLANS PROVEN AGAINST THIS SPEC. This phase does not read spec.md — the
+  #     header's reason is "analyze-plan already conformed the plans to it", which was an
+  #     assumption about the order the operator ran things in and was checked by nothing:
+  #     the lane gates below test that the plan FILE EXISTS and stop there. `plan`, edit
+  #     spec.md, `implement` therefore generated from a plan that was never held against the
+  #     spec it now contradicts, silently and at full length.
+  #
+  #     plan-gate-check compares today's bytes against the receipt analyze-plan left when it
+  #     passed — spec.md, the context's domain-model.md and each gated lane plan. The plans'
+  #     own `**Version**:` headers cannot answer this and must not be used: close-delta stamps
+  #     them and spec.md to the same number in lockstep whether or not a plan was re-derived,
+  #     so the comparison reads equal always.
+  #
+  #     BOOTSTRAP ONLY. A delta run generates from delta plans that analyze-plan-delta gates;
+  #     the master receipt is silent about them, and reading it there would refuse a change
+  #     for drift in documents this run is not building from.
+  - id: plan_gate_check
+    condition: "{{mode}} == bootstrap"
+    action: execute_script
+    script: { ref: actions }
+    subcommand: plan-gate-check
+    args: ["--feature-dir", "{{feature_dir}}"]
+    outputs:
+      - { name: gate_tracked, from: "$.tracked" }
+      - { name: gate_fresh,   from: "$.gate_fresh" }
+      - { name: gate_reason,  from: "$.reason" }
+      - { name: gate_at,      from: "$.gated" }
+
+  #     The ordered assignment is the AND: only a TRACKED feature can lower the flag, and
+  #     what lowers it is the gate no longer being fresh. An untracked one never reaches
+  #     this step's assignment and generates, which is the whole accommodation for trees
+  #     that have not been gated since the receipt existed.
+  - id: flag_gate_block
+    condition: "{{gate_tracked}} == true"
+    action: set
+    vars: { may_generate: "{{gate_fresh}}" }
+
+  - id: require_gate_fresh
+    action: verify_context
+    require_true: may_generate
+    on_false: stop
+    on_false_message: "implement REFUSED — the master plans are no longer the ones analyze-plan passed: {{gate_reason}}. This phase generates from the plans and does NOT read the spec, on the strength of that gate having conformed them to it, so generating now would realise a plan against requirements nobody checked it against. Re-run /appweaver analyze-plan — it re-checks all four checks, repairs the drifting plan on approval, and re-issues the receipt — then re-run /appweaver implement. If what changed was a plan you re-derived with /appweaver plan main, that is the same path: the re-derived plans have not been gated yet. Nothing was generated."
+
   # 4. THE PROJECT each declared lane generates INTO. Deterministic structure gate:
   #    detect-project searches the LANE'S OWN subtree for an ecosystem manifest (.sln/
   #    .csproj, pom.xml, build.gradle, package.json, go.mod, Cargo.toml, pyproject.toml),
@@ -396,6 +507,12 @@ workflow:
     require_true: be_plan_ok
     on_false: continue
     on_false_message: "BACKEND LANE SKIPPED — lane `{{be_lane_id}}` ({{be_title}}) is declared in .appweaver/stacks.json, but the plan this run generates from is not there: {{be_plan}}. Run /appweaver plan (then /appweaver analyze-plan for the masters, or /appweaver analyze-plan-delta for a change) and re-run implement. Nothing is generated for this lane; any other declared lane still runs."
+  - id: warn_be_root
+    condition: "{{be_declared}} == true"
+    action: verify_context
+    require_true: be_root_exists
+    on_false: continue
+    on_false_message: "BACKEND LANE SKIPPED — lane `{{be_lane_id}}` ({{be_title}}) declares source path `{{be_source_path}}` in .appweaver/stacks.json, and that path is not a directory in this repository. A lane owns its subtree and this phase writes into it, so there is nothing to generate into: unpack a project there with /appweaver foundation <FoundationName> <AppName> where a bundle ships for {{be_profile}}, create one with the stack's own tooling, or re-run /appweaver select-stack and point the lane at the directory that really holds its source. Nothing is generated for this lane; any other declared lane still runs."
   - id: warn_be_project
     condition: "{{be_declared}} == true"
     action: verify_context
@@ -408,6 +525,12 @@ workflow:
     require_true: fe_plan_ok
     on_false: continue
     on_false_message: "FRONTEND LANE SKIPPED — lane `{{fe_lane_id}}` ({{fe_title}}) is declared in .appweaver/stacks.json, but the plan this run generates from is not there: {{fe_plan}}. Run /appweaver plan (then /appweaver analyze-plan for the masters, or /appweaver analyze-plan-delta for a change) and re-run implement. Nothing is generated for this lane; any other declared lane still runs."
+  - id: warn_fe_root
+    condition: "{{fe_declared}} == true"
+    action: verify_context
+    require_true: fe_root_exists
+    on_false: continue
+    on_false_message: "FRONTEND LANE SKIPPED — lane `{{fe_lane_id}}` ({{fe_title}}) declares source path `{{fe_source_path}}` in .appweaver/stacks.json, and that path is not a directory in this repository. A lane owns its subtree and this phase writes into it, so there is nothing to generate into: unpack a project there with /appweaver foundation <FoundationName> <AppName> where a bundle ships for {{fe_profile}}, create one with the stack's own tooling, or re-run /appweaver select-stack and point the lane at the directory that really holds its source. Nothing is generated for this lane; any other declared lane still runs."
   - id: warn_fe_project
     condition: "{{fe_declared}} == true"
     action: verify_context
@@ -415,14 +538,18 @@ workflow:
     on_false: continue
     on_false_message: "FRONTEND LANE SKIPPED — no frontend project found under the {{fe_lane_id}} lane's source path `{{fe_source_path}}`. detect-project searched that subtree and then the whole repository, and answered at scope `{{fe_project_scope}}`; `lane` is the only scope this lane accepts. Scaffold a project there — /appweaver foundation <FoundationName> <AppName> where a bundle ships for {{fe_profile}}, or the stack's own tooling — and re-run implement. A manifest found elsewhere in the repository does NOT count: that one belongs to another lane, and generating this lane's code against it is how a frontend that was never built reports green."
 
-  # 6. RUNNABLE = declared AND its plan is there AND its project is there, as an ordered
-  #    assignment plus a knockdown, since the engine has no compound conditions. An
-  #    undeclared lane stays false either way — its `declared` value is what the raise
-  #    assigns.
+  # 6. RUNNABLE = declared AND its source path is on disk AND its plan is there AND its
+  #    project is there, as one ordered assignment plus a knockdown per condition, since
+  #    the engine has no compound conditions. An undeclared lane stays false either way —
+  #    its `declared` value is what the raise assigns.
   - id: be_runnable_raise
     condition: "{{be_plan_ok}} == true"
     action: set
     vars: { be_runnable: "{{be_declared}}" }
+  - id: be_runnable_clear_root
+    condition: "{{be_root_exists}} == false"
+    action: set
+    vars: { be_runnable: "false" }
   - id: be_runnable_clear
     condition: "{{be_project_ok}} == false"
     action: set
@@ -431,6 +558,10 @@ workflow:
     condition: "{{fe_plan_ok}} == true"
     action: set
     vars: { fe_runnable: "{{fe_declared}}" }
+  - id: fe_runnable_clear_root
+    condition: "{{fe_root_exists}} == false"
+    action: set
+    vars: { fe_runnable: "false" }
   - id: fe_runnable_clear
     condition: "{{fe_project_ok}} == false"
     action: set
@@ -471,7 +602,7 @@ workflow:
     action: verify_context
     require_true: generate_any
     on_false: stop
-    on_false_message: "Nothing to implement — no declared lane is both ready and confirmed. Either every declared lane was skipped for a reason printed above (its plan or its project is missing), or each one that was ready was declined at the prompt. Backend lane declared {{be_declared}}, ready {{be_runnable}}; frontend lane declared {{fe_declared}}, ready {{fe_runnable}}. Fix the reasons named above, or re-run and confirm a lane."
+    on_false_message: "Nothing to implement — no declared lane is both ready and confirmed. Either every declared lane was skipped for a reason printed above (its source path, its plan or its project is missing), or each one that was ready was declined at the prompt. Backend lane declared {{be_declared}}, ready {{be_runnable}}; frontend lane declared {{fe_declared}}, ready {{fe_runnable}}. Fix the reasons named above, or re-run and confirm a lane."
 
   # 8. EACH GENERATING LANE'S authoring MODE — the run's mode where the lane is going, and
   #    `skip` where it is not, which silences both of that lane's branches without a
@@ -490,18 +621,21 @@ workflow:
   #    backend's heading is keyed by mode (see the header). No blocking gate: an
   #    unconfigured project soft-continues, since the constitution halves still carry each
   #    lane's ratified base.
+  #
+  #    EACH LANE'S RULES ARE LOADED BESIDE ITS OWN STEPS, AND THE SECOND LANE REPLACES
+  #    THE FIRST'S. Both includes used to run here, before either lane generated — and
+  #    sticky standards only accumulate, so on a full-stack run the backend generator was
+  #    shown `## /aw-spec-implement-ui` and the frontend generator the service set. Each
+  #    prompt says which lane it is in, but it said so inside an envelope that contradicted
+  #    it, and the envelope is the part the model cannot argue with. The frontend include
+  #    now sits immediately before the FRONTEND sections below and passes replace, which
+  #    resets to the workflow's declared seed (ai-rules) before loading the UI set.
   - id: tech_select
     condition: "{{be_go}} == true"
     action: include
     module: .appweaver/orchestrator/modules/tech-select.orch.yaml
     with: { command: "{{be_tech_command}}" }
 
-  - id: tech_select_ui
-    condition: "{{fe_go}} == true"
-    action: include
-    module: .appweaver/orchestrator/modules/tech-select.orch.yaml
-    with: { command: aw-spec-implement-ui }
-
   # 10. Pre-execution hooks — see the hook-phase vars above.
   - id: resolve_pre_hooks
     action: execute_script
@@ -551,9 +685,9 @@ workflow:
       - THE MODEL IS READ, NEVER MINED FOR WORK. It describes the WHOLE bounded context,
         while this run builds one feature. Realise only what the PLAN calls for: an entity,
         event or invariant in the model that no plan element realises is a PLANNING gap —
-        surface it, do not implement it. `{{feature}}` is the aggregate this feature owns;
-        any other `## Aggregate:` section belongs to another slice, and you read it only to
-        honour a reference the plan makes, never to generate its code.
+        surface it, do not implement it. The section(s) this feature answers for are
+        {{owned_sections}}; any other `## Aggregate:` section you read only to honour a
+        reference the plan makes, never to generate its code.
       - BIND THE STACK: this lane is `{{be_lane_id}}` — {{be_title}}, language
         {{be_language}} ({{be_ecosystem}}), declared in .appweaver/stacks.json and compiled
         with `{{be_build}}`, tested with `{{be_test}}`. Generate in THAT language and
@@ -596,7 +730,14 @@ workflow:
       - Do NOT add behaviour the plan does not state, and do NOT omit any it does. If the
         plan looks wrong or incomplete, STOP and surface it (it is fixed in plan /
         analyze-plan) — never compensate from the spec or from memory.
-      - This aggregate OWNS its files; never regenerate a file another feature owns.
+      - SHARED AGGREGATE FILES ARE EXTENDED, NEVER REGENERATED. A feature is a capability
+        scope, and other features may act on the same aggregate: its root, entities,
+        value objects and repository are shared code. Where such a file already exists,
+        ADD only the members this plan needs and leave every existing member, signature
+        and test exactly as it is — another feature's code depends on them. Create a file
+        only when it does not exist yet. A file that serves only another feature (its
+        use-case, endpoint or handler) is not this feature's to touch; if this plan needs
+        one changed, STOP and surface it.
       - Where generated code depends on a plan Assumption (DA-n) or Workaround (WA-n), mark
         it with a comment citing that id so it is easy to revisit later.
     outputs:
@@ -605,14 +746,22 @@ workflow:
   # ═══════════ BACKEND LANE — delta, generate ONLY what the change adds ════════
   # The delta plan is the authoritative source of WHAT changed — analyze-plan-delta already
   # conformed it to the delta spec. The MASTER plan is the BASE (the unchanged elements the
-  # delta depends on), and the delta spec is here ONLY so the paired tests can cite
-  # traceability ids.
+  # delta depends on).
+  #
+  # NO DELTA-SPEC HERE, exactly as the bootstrap path carries no spec. It used to be
+  # inlined "only so the paired tests can cite traceability ids", but a document in the
+  # payload is a document the generator can reason from, and the whole point of the
+  # contract is that this phase realises the PLAN: with the requirement text in reach, a
+  # gap in the plan can be silently compensated for from the spec and the plan is never
+  # found to be wrong. The ids are still available and still required — the delta plan
+  # cites the spec id each element serves, which is what analyze-plan-delta conformed.
+  # A plan that does not name an id is a planning gap to surface, and that is now visible
+  # instead of being papered over here.
   - id: ctx_backend_delta
     condition: "{{be_mode}} == delta"
     action: build_context
     context:
       - { path: "{{be_plan}}" }                      # this change's delta-backend-plan.md
-      - { path: "{{delta_spec}}", optional: true }
       - { path: "{{delta_model}}", optional: true }  # this change's MODEL half — what it ADDS to / CHANGES in the model
       - { path: "{{backend_plan}}", optional: true } # the master plan — READ ONLY, never amended here
       - { path: "{{domain_model}}", optional: true } # the master model — the domain as it stands BEFORE this change
@@ -642,9 +791,12 @@ workflow:
         winning wherever they differ — it is the newer statement, and the master has not
         been merged yet (finalize-delta does that after this phase). Read there what every
         BR-nnn the delta plan cites actually requires; the plan records WHERE each is
-        enforced and never restates it. You have NO domain rule files and NO spec beyond
-        the delta-spec's ids — if a domain specific is in none of them, STOP and surface it
-        (it is fixed in specify / plan / analyze-plan-delta), never invent it from memory.
+        enforced and never restates it. You have NO domain rule files and NO spec AT ALL —
+        not the master and not this change's delta-spec. The requirement ids are in the
+        delta plan, which cites the one each element serves; that is the whole of what you
+        get. If a domain specific is in neither the plan nor the model, STOP and surface it
+        (it is fixed in specify / plan / analyze-plan-delta), never invent it from memory
+        and never infer it from an id.
       - THE MODEL IS READ, NEVER MINED FOR WORK. Realise only what the DELTA PLAN calls
         for: an item in the model delta that no delta-plan element realises is a PLANNING
         gap — surface it, do not implement it. Everything in the master model that this
@@ -682,7 +834,10 @@ workflow:
         the port isn't present, code to it and note that as the prerequisite.
       - Author a paired test for every ADDED/MODIFIED behaviour / use-case / endpoint;
         derive the cases from the delta plan's pre/post/invariant contracts and cite the
-        delta-spec id (FR / BR / CN / DC / IC / US).
+        requirement id THE DELTA PLAN NAMES for that element (FR / BR / CN / DC / IC / US).
+        The spec is not in context: take the id from the plan and cite it verbatim, never
+        guess one from the element's shape. A delta-plan element that names no id is a
+        planning gap — surface it rather than inventing the traceability.
       - REGRESSION: for each element in the delta plan's "Regression targets", verify (add
         or adjust a test where needed) that the existing behaviour still holds after a
         shared element changed — but do NOT rewrite that existing behaviour.
@@ -714,6 +869,22 @@ workflow:
     outputs:
       - { name: okf_concept, from: "$.concept" }
 
+  # ══════════════ THE LANE SWAP — the frontend's rules replace the backend's ═══
+  # build_context already scoped the two lanes' PAYLOADS apart; this is the same boundary
+  # for their STANDARDS, which the envelope carries and which nothing used to reset. It
+  # runs here rather than up with the backend's include because standards accumulate:
+  # loading both before either lane generated is precisely what showed each generator the
+  # other lane's rule set. `replace` resets to the declared seed (ai-rules stays) and then
+  # loads `## /aw-spec-implement-ui`, so from here down the envelope is the frontend's.
+  #
+  # Nothing after the frontend sections regenerates backend code — the OKF steps that
+  # follow run include_standards: false — so the swap needs no undo.
+  - id: tech_select_ui
+    condition: "{{fe_go}} == true"
+    action: include
+    module: .appweaver/orchestrator/modules/tech-select.orch.yaml
+    with: { command: aw-spec-implement-ui, replace: "true" }
+
   # ═══════════ FRONTEND LANE — bootstrap, generate from the MASTER plan ════════
   # The experience twin of the service generation, one lane over. Its own build_context,
   # because the envelope persists across steps and the two lanes must not see each other's
@@ -815,7 +986,8 @@ workflow:
     action: build_context
     context:
       - { path: "{{fe_plan}}" }                       # this change's delta-frontend-plan.md
-      - { path: "{{delta_spec}}", optional: true }
+      # No delta-spec — see the service lane's note above: this phase realises the PLAN,
+      # and the ids the tests cite come from the plan's own rows.
       - { path: "{{delta_model}}", optional: true }   # this change's MODEL half — new terms, states and rules the UI must speak
       - { path: "{{frontend_plan}}", optional: true } # the master plan — READ ONLY, never amended here
       - { path: "{{domain_model}}", optional: true }  # the master model — the ubiquitous language as it stands BEFORE this change
@@ -846,9 +1018,10 @@ workflow:
         READ TOGETHER, the delta winning wherever they differ — the master has not been
         merged yet. A TERM THIS CHANGE INTRODUCES OR RENAMES IS IN THE DELTA, and the UI
         must speak it exactly as the delta spells it, in labels, states and messages. Read
-        there what any BR-nnn the delta plan cites requires. NO domain rule files, and no
-        spec beyond the delta-spec's ids; if a domain specific is in none of them, STOP and
-        surface it.
+        there what any BR-nnn the delta plan cites requires. NO domain rule files, and NO
+        spec at all — not the master and not this change's delta-spec; the requirement ids
+        come from the delta plan, which cites the one each element serves. If a domain
+        specific is in neither the plan nor the model, STOP and surface it.
       - THE MODEL IS READ, NEVER MINED FOR WORK, and reading a rule is not permission to
         move it. Realise only what the DELTA PLAN calls for — an item in the model delta
         that no delta-plan element realises is a PLANNING gap, and a client-side check
@@ -872,7 +1045,9 @@ workflow:
         evaluation.
       - Author a paired test for every ADDED/MODIFIED screen, interaction and state,
         including the unwanted-behaviour states and an accessibility assertion per
-        interactive surface, citing the delta-spec id (UX-/US-/FR-/CN-/DC-/IC-/SC-).
+        interactive surface, citing the requirement id THE DELTA PLAN NAMES for that row
+        (UX-/US-/FR-/CN-/DC-/IC-/SC-). The spec is not in context: take the id from the
+        plan and cite it verbatim. A row that names no id is a planning gap — surface it.
       - REGRESSION: for each element in the delta plan's regression targets, verify (add or
         adjust a test where needed) that the existing behaviour still holds after a shared
         component or state container changed — but do NOT rewrite that behaviour.
@@ -959,15 +1134,15 @@ workflow:
     schema: { overview: "<2-4 sentences of prose>" }
     mock: { overview: "" }
     task: |
-      Write the OKF knowledge-concept Overview for the aggregate `{{feature}}`. 2-4
-      sentences of PROSE:
+      Write the OKF knowledge-concept Overview for the feature `{{feature}}` — that is,
+      for the aggregate it answers for, {{owned_csv}}. 2-4 sentences of PROSE:
       - name the aggregate ROOT and what the aggregate IS;
       - state the INVARIANTS it guards (its BR-nnn — what they require, not their ids);
       - state its TRANSACTION BOUNDARY — what it OWNS inside the boundary vs what it only
         REFERENCES by id.
       The bounded context's domain-model.md is the source where it is in context: read
-      ONLY its `## Aggregate: {{feature}}` section — the other aggregates are other
-      slices' concepts. Where it is not in context, distil the same three things from
+      ONLY {{owned_sections}} — the other sections belong to other aggregates. Where more
+      than one is named, describe the FIRST. Where it is not in context, distil the same three things from
       backend-plan.md's domain section instead.
       Plain prose only: no headings, no bullets, no code fences, no file paths, and no
       restating of the dependency edges (those live in the Depends-On / Cross-References
@@ -1010,5 +1185,11 @@ outputs:
   delta_model: "{{delta_model}}"       # its second half on the delta path — empty on the bootstrap path
   okf_concept: "{{okf_concept}}"
   xref_edge_count: "{{xref_edge_count}}"
-  note: "Lanes come from .appweaver/stacks.json — backend declared {{be_declared}} (ready {{be_runnable}}, implemented {{be_go}}), frontend declared {{fe_declared}} (ready {{fe_runnable}}, implemented {{fe_go}}). A declared lane that was skipped printed its reason above and did not stop the other one; an undeclared lane produces nothing and that is not a failure. Each generating lane read its PLAN for what to build and {{domain_model}} for what the domain is — plus {{delta_model}} on the delta path, since the master model does not carry the change until finalize-delta merges it. Every one of those documents was READ and none was written: this phase generates code and nothing else."
+  # Bootstrap path only. tracked=false means this feature has never passed analyze-plan
+  # since the gate began leaving a receipt — an unknown, not a stale plan, and it blocks
+  # nothing.
+  plan_gate_tracked: "{{gate_tracked}}"
+  plan_gate_fresh: "{{gate_fresh}}"
+  plan_gate_at: "{{gate_at}}"
+  note: "Lanes come from .appweaver/stacks.json — backend declared {{be_declared}} (ready {{be_runnable}}, implemented {{be_go}}), frontend declared {{fe_declared}} (ready {{fe_runnable}}, implemented {{fe_go}}). A declared lane that was skipped printed its reason above and did not stop the other one; an undeclared lane produces nothing and that is not a failure. Each generating lane read its PLAN for what to build and {{domain_model}} for what the domain is — plus {{delta_model}} on the delta path, since the master model does not carry the change until finalize-delta merges it. Every one of those documents was READ and none was written: this phase generates code and nothing else. On the bootstrap path the plans were checked against analyze-plan's receipt before anything generated (tracked={{gate_tracked}}, fresh={{gate_fresh}}, gated {{gate_at}}) — tracked=false means this feature has never passed analyze-plan since the gate began recording what it proved, which is an unknown rather than a stale plan and blocks nothing; run /appweaver analyze-plan once to start the record."
   next: "This run was mode `{{mode}}`, change `{{active_change}}` (empty on the bootstrap path). BOOTSTRAP → /appweaver build → analyze-slice → run. DELTA → /appweaver build → analyze-slice-delta {{active_change}} → finalize-delta → analyze-slice → close-delta, with the change still OPEN throughout — compile first, then analyze-slice-delta verifies that every element the delta plans marked ADDED or MODIFIED is actually in the code with a paired test (the gate that catches a lane you declined at the prompt above), then finalize-delta merges it into spec.md + the context's domain-model.md while leaving it open, analyze-slice verifies the slice against those merged masters while a red result is still recoverable, and close-delta LAST archives the change and bumps the version."