aw-spec-cli 0.1.23 → 0.1.24

package/assets/.appweaver/orchestrator/workflows/aw-spec-adopt.orch.yaml

@@ -54,7 +54,9 @@
 # only, NO domain files — domain reaches design as spec ids.
 #
 # Adopt does NOT generate code and does NOT modify source — writes land under
-# specs/<Feature>/, .appweaver/memory/constitution*.md, and guardrails/projects/<project>/.
+# specs/<Context>/<Feature>/, in the context's specs/<Context>/domain-model.md, and in the
+# aggregate's OKF concept; the constitution halves and guardrails/projects/<project>/ are
+# written only when the reconcile block below is enabled.
 # Fidelity checks spec/design ↔ CODE; the Adopt review is REPORTED for out-of-band
 # closure — it blocks only on structural failures (unmapped code / fabricated spec/design).
 # There is NO migration content here (characterize is an optional on-touch fence, not a
@@ -69,7 +71,13 @@
 # =============================================================================
 
 name: aw-spec-adopt
-description: The JIT per-feature step of brownfield development — reverse-engineer ONE existing feature into a living spec.md, an aggregate section in the bounded context's shared domain-model.md, and backend-plan.md (+ frontend-plan.md where a frontend lane is declared and this slice owns part of its surface) + source-map.md (origin reverse-engineered, per-item confidence, code-derived plan template), then COMPLETE its shallow OKF concept (deepen it to the reversed reality + link the deep artifacts) and record its cross-slice edges. The spec cites BR-nnn by id and the model defines them, exactly as on the greenfield path, so a reversed slice is checkable by the same gates as any other. Fidelity gate is spec + model + plans vs code, and an invented entity, boundary or invariant is a fabrication exactly as an invented FR- is; the review is reported for out-of-band closure. The governance reconcile — carrying this feature's real evidence into the provisional rule files + constitution onboard wrote — is HELD (reconcile_governance=false), so an ordinary run does not touch the governance tier. A NEW feature is authored via the forward pipeline instead. Output is a normal feature for the CR + forward loop.
+description: The JIT per-feature step of brownfield development — reverse-engineer ONE existing feature into a living spec.md, an aggregate section in the bounded context's shared domain-model.md, and backend-plan.md (+ frontend-plan.md where a frontend lane is declared and this slice owns part of its surface) + source-map.md (origin reverse-engineered, per-item confidence, code-derived plan template), then COMPLETE its shallow OKF concept (deepen it to the reversed reality + link the deep artifacts) and record its cross-slice edges. The spec cites BR-nnn by id and the model defines them, exactly as on the greenfield path, so a reversed slice is checkable by the same gates as any other. Fidelity gate is spec + model + plans vs code, and an invented entity, boundary or invariant is a fabrication exactly as an invented FR- is; the review is reported for out-of-band closure. Every reverse step is scoped to the feature's own operations from the confirmed boundary map, so two features over one aggregate never claim the same operation, and the spec continues the context's BR-nnn numbering from its domain model. Where a frontend lane is declared and this slice owns none of its surface, the feature records lanes=backend so later phases neither author nor demand a frontend plan for it. The governance reconcile — carrying this feature's real evidence into the provisional rule files + constitution onboard wrote — is HELD (reconcile_governance=false), so an ordinary run does not touch the governance tier. A NEW feature is authored via the forward pipeline instead. Output is a normal feature for the CR + forward loop.
+# 2.1.0 — every reverse step is scoped to the FEATURE, not its aggregate: the boundary map's
+#         operation list (and a sibling feature's operations, which are not this one's)
+#         reaches the spec, model, plan, UI plan, source-map and fidelity steps. The spec step
+#         reads the context's domain model so BR-nnn ids continue the context's numbering.
+#         The UI plan is authored under the frontend rule set. A slice with no part of a
+#         declared frontend's surface records lanes=backend for the later phases.
 # 1.5.0 — user_input is now OPTIONAL: adopt CONSUMES the ACTIVE feature (select-feature's
 #         .appweaver/feature.json) when no arg is passed, so onboard→select-feature→adopt needs
 #         no re-typing; an explicit <Feature> still selects directly (and wins). One coalesced
@@ -79,7 +87,7 @@ description: The JIT per-feature step of brownfield development — reverse-engi
 # 1.3.0 — reverse design scaffolds from the DEFAULT `design-template` (onboard's code-derived
 #         override) instead of the never-shipped `brownfield-design-template`, unifying the
 #         whole brownfield pipeline on one code-derived template.
-version: 2.0.0
+version: 2.1.0
 agent_agnostic: true
 dialect: aw-spec.orchestrator/v1
 
@@ -116,12 +124,24 @@ vars:
   bundle_dir: "knowledge"      # where /appweaver onboard writes the OKF feature map (repo-root default)
   feature_name: ""             # the aggregate to adopt: USER_INPUT if passed, else the active feature (set-feature canonicalises)
   concept_exists: "false"
-  fe_declared: "false"         # lane_readback runs on_error:continue, so both its bindings need a declared default
+  fe_declared: "false"         # lane_readback runs on_error:continue, so its bindings need declared defaults
+  be_declared: "false"
+  fe_no_surface: "false"       # a frontend lane is declared, this slice owns none of its surface, and a backend lane carries it
+  feature_lanes: ""            # what record_lanes wrote — empty when the feature follows every declared lane
   fe_root: ""
   ui_lane: "false"             # THIS slice reverses a UI half: a frontend lane is declared AND the slice owns UI files
   ui_count: "0"                # how many UI files the concept attributes to this aggregate (aw-inventory ui_source_files)
   ui_source_files: ""
   frontend_plan: ""
+  # THE FEATURE'S SCOPE INSIDE ITS AGGREGATE, from feature-aggregates (the boundary map).
+  operations_note: ""          # this feature's operations + the ones only a sibling feature owns, as one line
+  operations_csv: ""
+  one_to_one: "true"
+  owned_sections: ""
+  shared_with_csv: ""
+  model_scope_plan: ""         # which part of the model section the backend plan realises
+  baseline_commit: ""          # the inventory HEAD the boundary map was drawn at
+  baseline_time: ""
   ui_tpl_source: ""
   # THE LANE PLANS, under the names the forward pipeline reads. A reversed slice is a
   # NORMAL feature, so it carries backend-plan.md / frontend-plan.md like any other —
@@ -149,18 +169,6 @@ vars:
 
 workflow:
 
-  # 0. TECHNICAL rule files → sticky standards (configuration, not hardcoded). tech-select
-  #    reads guardrails/projects/<project>/tech-rule-bindings.md under "## /aw-spec-adopt" and
-  #    loads that reference set into the sticky standards. Loaded FIRST so it is present for
-  #    reverse_design (include_standards:true) — the reversed SPEC step still turns it off
-  #    (include_standards:false), keeping design domain-free (rule partition). No domain rule
-  #    file here — the tech map lists only technical files. No blocking gate: an unconfigured
-  #    project soft-continues (constitution.technical.md still carries the tech base).
-  - id: tech_select
-    action: include
-    module: .appweaver/orchestrator/modules/tech-select.orch.yaml
-    with: { command: aw-spec-adopt }
-
   # 1. Resolve the aggregate to adopt. TWO ways in (arg wins over active):
   #    a) `/appweaver adopt <Feature>` — the explicit arg selects directly.
   #    b) `/appweaver adopt` (no arg) — CONSUME the feature select-feature already
@@ -253,6 +261,34 @@ workflow:
       - { name: aggregate_sections, from: "$.sections" }
       - { name: aggregate_source,   from: "$.source" }
       - { name: aggregate_primary,  from: "$.primary" }   # the concept this feature's OKF work lands on
+      # THE FEATURE'S SCOPE INSIDE THE AGGREGATE. The concept lists every file of the
+      # aggregate, and two features over one aggregate share them — only the boundary map's
+      # operation list tells their scopes apart. operations_note names this feature's
+      # operations and the ones only a sibling owns, as a line every reverse step quotes.
+      - { name: operations_note,    from: "$.operations_note" }
+      - { name: operations_csv,     from: "$.operations_csv" }
+      - { name: one_to_one,         from: "$.one_to_one" }
+      - { name: owned_sections,     from: "$.owned_sections" }
+      - { name: shared_with_csv,    from: "$.shared_with_csv" }
+      # The inventory HEAD the map was drawn at — the source-map's baseline commit and the
+      # concept's timestamp. Empty time where git cannot resolve the commit.
+      - { name: baseline_commit,    from: "$.baseline_commit" }
+      - { name: baseline_time,      from: "$.baseline_time" }
+
+  # HOW MUCH OF THE MODEL SECTION THE BACKEND PLAN REALISES — the rule the forward `plan`
+  # applies. A feature that alone answers for its aggregate realises the whole section; one
+  # that shares it realises only what its own operations act on, or two plans would realise
+  # the same element. The engine has no conditional prompt text, so the rule is an ordered
+  # pair of sets handed to the prompt as one line.
+  - id: model_scope_shared
+    action: set
+    vars:
+      model_scope_plan: "{{owned_sections}}, which this feature SHARES with {{shared_with_csv}}. Realise only the entities, value objects, states and BR-nnn this feature's operations act on, under the model's names and boundary; an element of that section only another feature's operations use belongs to that feature's plan and is left out — never redefined, renamed or narrowed"
+  - id: model_scope_sole
+    condition: "{{one_to_one}} == true"
+    action: set
+    vars:
+      model_scope_plan: "{{owned_sections}}. This feature is the only one that answers for it, so the plan realises that whole section"
 
   # 1a. One-time baseline: refuse to clobber an already-adopted / authored spec.
   #     After adoption, changes go through the CR delta loop, not adopt.
@@ -329,6 +365,20 @@ workflow:
     on_false: stop
     on_false_message: "No active governance for adopt to work against — run /appweaver onboard first. onboard establishes the PROJECT constitution + guardrails/projects/<project>/ rule set (provisional-from-scan) and activates it. Reversing '{{feature_name}}' without that scaffold would author the spec and design against no code-derived rules at all, and leave them with no governance home."
 
+  # TECHNICAL rule files → sticky standards (configuration, not hardcoded). tech-select
+  # reads guardrails/projects/<project>/tech-rule-bindings.md under "## /aw-spec-adopt" and
+  # loads that reference set into the sticky standards for reverse_plan
+  # (include_standards:true) — the reversed SPEC and MODEL steps turn it off
+  # (include_standards:false), keeping them free of architecture (rule partition). No domain
+  # rule file here — the tech map lists only technical files. No blocking gate: an
+  # unconfigured project soft-continues (constitution.technical.md still carries the tech
+  # base). Placed after every gate that can stop the run, so no selection box is shown for a
+  # run that stops anyway.
+  - id: tech_select
+    action: include
+    module: .appweaver/orchestrator/modules/tech-select.orch.yaml
+    with: { command: aw-spec-adopt }
+
   # 2. Scaffold the living docs. The SPEC reuses the forward spec-template (it is
   #    tech-agnostic WHAT/WHY — no architectural bias). The BACKEND PLAN scaffolds from the
   #    DEFAULT `design-template` — which /appweaver onboard REPLACED with the repo's
@@ -405,6 +455,7 @@ workflow:
     outputs:
       - { name: fe_declared, from: "$.frontend_declared" }
       - { name: fe_root,     from: "$.frontend_root" }
+      - { name: be_declared, from: "$.backend_declared" }
   - id: ui_lane_off
     action: set
     vars: { ui_lane: "false" }
@@ -417,6 +468,40 @@ workflow:
     condition: "{{ui_count}} == 0"
     vars: { ui_lane: "false" }
 
+  # 2c. RECORD A SERVICE-ONLY SLICE, so the later phases know it is one. A declared
+  #     frontend lane whose surface this slice does not touch is a DECISION adopt just
+  #     made, and nothing downstream can re-derive it: `plan` would otherwise read the repo's
+  #     declaration, find no frontend-plan.md, and author one from the spec for screens that
+  #     do not exist, and `analyze-plan` would stop on the missing document. feature-lanes
+  #     writes `lanes: [backend]` into this feature's active_version.json, and
+  #     `lane-resolve --feature-dir` reports the frontend lane as not declared FOR THIS
+  #     FEATURE. Recorded only where a backend lane carries the slice — with none declared
+  #     there is no lane to narrow to. `feature-lanes --clear` undoes it when the feature
+  #     gains a UI. Four ordered sets, because the engine has no compound conditions.
+  - id: fe_no_surface_off
+    action: set
+    vars: { fe_no_surface: "false" }
+  - id: fe_no_surface_declared
+    action: set
+    condition: "{{fe_declared}}"
+    vars: { fe_no_surface: "true" }
+  - id: fe_no_surface_has_ui
+    action: set
+    condition: "{{ui_count}} != 0"
+    vars: { fe_no_surface: "false" }
+  - id: fe_no_surface_no_backend
+    action: set
+    condition: "{{be_declared}} != true"
+    vars: { fe_no_surface: "false" }
+  - id: record_lanes
+    condition: "{{fe_no_surface}} == true"
+    action: execute_script
+    script: { ref: actions }
+    subcommand: feature-lanes
+    args: ["--feature-dir", "{{feature_dir}}", "--set", "backend"]
+    outputs:
+      - { name: feature_lanes, from: "$.lanes" }
+
   # Scaffold the LANE's plan from ITS template pair (--lane frontend resolves
   # ui-design-template -> frontend-plan.md), the twin of scaffold_plan above. onboard
   # GENERATED that override from this repo's own UI source, so the reversed frontend plan
@@ -445,7 +530,7 @@ workflow:
     action: verify_context
     require_true: ui_tpl_override
     on_false: stop
-    on_false_message: "A frontend lane is declared ({{fe_root}}) and '{{feature_name}}' owns {{ui_count}} UI file(s), but no CODE-DERIVED UI design template is installed at .appweaver/templates/overrides/ui-design-template.md — only the kit's greenfield template, which would impose a section structure this app's UI did not choose. onboard GENERATES the override from the UI source — declare the lane with /appweaver select-stack and re-run /appweaver onboard, then adopt this feature again."
+    on_false_message: "A frontend lane is declared ({{fe_root}}) and '{{feature_name}}' owns {{ui_count}} UI file(s), but no CODE-DERIVED UI design template is installed at .appweaver/templates/overrides/ui-design-template.md — only the kit's greenfield template, which would impose a section structure this app's UI did not choose. onboard GENERATES the override from the UI source, together with the lane's constitution half and rule set, when it first sees the lane declared. Run /appweaver onboard {{context}} — naming an onboarded context re-runs its governance pass, which authors the missing lane tier — then adopt this feature again."
 
   # 3. Pre-execution hooks.
   - id: resolve_pre_hooks
@@ -474,6 +559,7 @@ workflow:
     context:
       - { path: "{{spec_file}}" }                 # the scaffolded template = section structure + the modelling vocabulary
       - { path: "{{concept_path}}" }              # the OKF concept: source_files, seam, open_questions
+      - { path: "{{domain_model}}" }              # the CONTEXT's model — the BR-nnn ids already issued, which this spec cites and continues
       - { path: .appweaver/memory/constitution.domain.md, optional: true }     # the domain frame
       - { path: .appweaver/memory/constitution.ui.md, optional: true }         # the frontend lane's UX-* base — absent on a backend-only repo, which onboard leaves unwritten by design
   - id: reverse_spec
@@ -498,26 +584,40 @@ workflow:
         whatever it is named: its user stories are that capability's operations and no
         others. Sharing a name with an aggregate does not make it that aggregate's only
         feature — other features may act on the same aggregate. Keep US-1.
-      - Each command / endpoint / use-case the code exposes is a USER STORY (US-n),
+      - THE FEATURE'S SCOPE. {{operations_note}} The source files below are the whole
+        aggregate's, and a sibling feature over it shares them — so an operation that
+        belongs only to another feature is in this code and is still NOT this spec's: no
+        user story, requirement or success criterion for it. A read both features call is
+        this feature's too.
+      - Each of THIS feature's commands / endpoints / use-cases is a USER STORY (US-n),
         never a separate feature. Derive its Given/When/Then from the code's paths.
       - System Requirements in EARS (THE SYSTEM SHALL / WHEN / IF…THEN / WHILE /
         WHERE), each atomic + testable, derived from observed behaviour.
       - Always-true invariants the code enforces get stable BR-nnn ids, CITED here and
-        DEFINED in the domain model — see the next bullet.
+        DEFINED in the domain model — see the next bullet. The context's domain-model.md
+        is in context: still the template on the context's first adopted feature, and on
+        a later one it already defines aggregates and BR-nnn ids that other specs cite. A
+        rule the model ALREADY defines is cited by ITS id. A rule it lacks takes the next
+        id after the highest BR-nnn the model carries (BR-001 on an unfilled model), and
+        the next step defines it there. Never cite an id the model uses for a DIFFERENT
+        rule — not even when a code comment names that id: the model's numbering wins,
+        and the code's citation is recorded as drift.
       - THE DOMAIN MODEL IS NOT THIS DOCUMENT'S. Fill "### Domain Model Reference" with
         the aggregate's NAME and the ids of the invariants this spec relies on
         (BR-nnn), and nothing more. Do NOT write the ubiquitous language, the aggregate
         boundary, the entity/value-object split, the lifecycle states, or the TEXT of any
-        invariant: all of that lives in the bounded context's domain-model.md, which the
-        NEXT step reverses out of this same code, and several specs act on one aggregate
-        so a per-spec copy drifts. Cite by id; never restate.
+        invariant: all of that lives in the bounded context's domain-model.md (in
+        context), which the NEXT step fills or extends from this same code, and several
+        specs act on one aggregate so a per-spec copy drifts. Cite by id; never restate.
       - DOMAIN LIFT — where the CODE enforces them, lift into the three sections
         (cite the source file): Constraints & NFRs (CN-, e.g. retention /
         immutability / append-only audit the code implements), Data Classification
         (DC-, sensitive fields + where they may/mustn't appear), Integration
         Contracts (IC-, external services/feeds the code calls). "None (as of v1.0)"
         if the code shows none — never delete a section.
-      - EXPERIENCE LIFT — only where this slice HAS a UI. Fill Experience Scope from
+      - EXPERIENCE LIFT — only where this slice HAS a UI. Here that is {{ui_lane}} (true
+        = a frontend lane is declared and this aggregate owns UI files, listed below —
+        read them). Fill Experience Scope from
         the surface the code exposes (UI actors, channels, and the device / browser /
         assistive-technology floors the UI source actually targets), and lift the
         project-wide standards that UI already holds into Experience Standards (UX-n),
@@ -545,6 +645,8 @@ workflow:
         OBLIGATION is an IC- requirement, never the adapter design).
 
       Source files to read (the slice's code): {{source_files}}
+      UI source files (the Experience lift's evidence; empty where the aggregate has no UI —
+      a sibling feature's UI folder is not this feature's surface): {{ui_source_files}}
 
   # ══════════ REVERSE DOMAIN MODEL — the CONTEXT's structure, from the CODE ══════
   # The greenfield split, applied to the reverse: the spec says what the system DOES, the
@@ -596,6 +698,16 @@ workflow:
         (owns / references by id / out of scope), entities, value objects, domain events,
         lifecycle states, and every always-true invariant the code enforces as a stable
         BR-nnn with its RULE TEXT. The spec cites those ids and never restates them.
+      - THE SECTION MODELS THE WHOLE AGGREGATE, as its code has it — every entity, value
+        object, lifecycle state, event and invariant the root carries, including the parts
+        only another feature's operations exercise. {{operations_note}} Structure belongs
+        to the aggregate, not to one capability: a later feature over it cites the ids
+        already here instead of defining its part a second time. `Serving specs` names the
+        features that have a spec so far, this one included — never one that has none yet.
+      - NUMBERING. Define every BR-nnn the reversed spec cites under exactly the id it
+        cites. An invariant the spec does not cite takes the next free id after the highest
+        in the model — or the id the code's own comments give it, where that id is free.
+        An id the model already uses is never given to a different rule.
       - IF THE MODEL ALREADY HAS CONTENT, this is the context's SECOND (or later) adopted
         slice. ADD any of this feature's aggregates not already there as a new section and
         EXTEND the ubiquitous language. Do NOT rewrite, renumber or "tidy" the aggregates
@@ -672,10 +784,15 @@ workflow:
         Domain/Application/API/Infrastructure layering. A component the code has that
         fits no textbook layer (a UI tier, a worker, a shared library) gets its own
         section; a layer the code lacks does NOT appear.
+      - THE FEATURE'S SCOPE. {{operations_note}} The source files below are the whole
+        aggregate's, shared with any sibling feature over it: the plan's operation
+        components realise THIS feature's operations only, and a component that serves only
+        another feature's operation is left out even though its file is listed.
       - KEEP THE NEUTRAL ANCHORS (the template pins these): §1.2 is the domain/data
-        MODEL and MUST match the CONTEXT'S DOMAIN MODEL exactly — the same entity and
-        value-object NAMES, the same boundary, the same lifecycle states — with
-        cross-slice References-by-id kept here. Every BR-nnn the model defines gets a
+        MODEL and follows the CONTEXT'S DOMAIN MODEL exactly within this feature's part of
+        it — {{model_scope_plan}}. Within that part: the same entity and value-object NAMES,
+        the same boundary, the same lifecycle states — with cross-slice References-by-id
+        kept here. Every BR-nnn in that part of the model gets a
         named ENFORCEMENT POINT in this plan: cite it by id and NEVER restate what it
         says, because the model is the only place that text lives. One §2 subsection is
         the EXTERNAL INTEGRATIONS table (heading contains "Integration") realising the
@@ -701,6 +818,17 @@ workflow:
   # NOT its parent: backend-plan.md realises the spec's FR/BR/CN-, frontend-plan.md
   # realises the spec's UX- and the user stories' interaction, and it CONSUMES the backend
   # plan's contracts rather than restating them. Both are in context for exactly that reason.
+  # THE FRONTEND'S RULES REPLACE THE BACKEND'S before the lane's plan is authored — the
+  # swap the forward `plan` makes at the same boundary. Sticky standards only accumulate,
+  # so without it the UI plan was authored under the service rule set and none of the
+  # lane's own. `## /aw-spec-plan-ui` is the set the forward plan authors this same
+  # document under, so a reversed frontend plan and a planned one answer to one rule set.
+  - id: tech_select_ui
+    condition: "{{ui_lane}} == true"
+    action: include
+    module: .appweaver/orchestrator/modules/tech-select.orch.yaml
+    with: { command: aw-spec-plan-ui, replace: "true" }
+
   - id: ctx_reverse_ui_plan
     condition: "{{ui_lane}} == true"
     action: build_context
@@ -728,6 +856,10 @@ workflow:
       a target to bend it toward. An inconsistent app is recorded as inconsistent; a
       surface with no loading states is recorded as having none, NEVER as needing them.
       Rules:
+      - THE FEATURE'S SCOPE. {{operations_note}} The UI files below are the aggregate's
+        whole surface: a screen, component or action that serves only another feature's
+        operation — typically that feature's own UI folder — is that feature's. Where this
+        feature's screen hosts it, cite it as the sibling's; never plan it here.
       - STAY IN THE LANE. Realise the spec's Experience Standards (UX-) and the
         interaction its User Stories imply. The backend plan (in context) supplies
         the CONTRACTS this surface consumes — cite them; do NOT restate, re-derive or
@@ -776,8 +908,9 @@ workflow:
         (certain | inferred). EVERY source file MUST appear — the Fidelity gate
         checks full coverage both ways.
       - THE CONCEPT IS THE AGGREGATE'S ('{{aggregate_primary}}') and lists every feature's
-        code on it. Where its `features:` names features besides '{{feature_name}}', a
-        file that serves ONLY one of those sibling capabilities is not this feature's:
+        code on it. {{operations_note}} Where its `features:` names features besides
+        '{{feature_name}}', a file that serves ONLY one of those sibling capabilities (only
+        their operations) is not this feature's:
         record it under Unmapped / open as `sibling: <Feature>`, never as a mapped row.
         The mapped rows ARE this feature's file list — later commands hand exactly those
         files to their fix loops.
@@ -791,7 +924,8 @@ workflow:
         analysis (not a migration item).
       - Record as-built quirks captured verbatim (candidate deviations), and any
         unmapped code / unanchored spec ids.
-      - Baseline commit = the inventory HEAD.
+      - Baseline commit: `{{baseline_commit}}` — the inventory HEAD the boundary map was
+        drawn at. Write `unknown` when that is empty; never guess one.
       Source files to map: {{source_files}}
 
   # ═══════ FIDELITY — do spec + model + plans describe the CODE? ══════════════
@@ -817,7 +951,7 @@ workflow:
       - "{{concept_path}}"
     include_standards: false
     tools: Read   # the check is documents vs CODE; with no code it degrades to doc vs doc and certifies fabrication as ok
-    schema: { ok: true, report_needed: false, blocking_gaps: [ { severity: "high", artefact: "<source file / spec id / model element / plan element>", kind: "unmapped-code | fabricated-spec | fabricated-model | fabricated-plan", detail: "<why>" } ], review_items: [ { kind: "inferred | as-built-quirk | missing-invariant | confidence", where: "<spec/model/plan/source-map location>", note: "<what to confirm out of band>" } ] }
+    schema: { ok: true, report_needed: false, blocking_gaps: [ { severity: "high", artefact: "<source file / spec id / model element / plan element>", kind: "unmapped-code | fabricated-spec | fabricated-model | fabricated-plan | foreign-operation", detail: "<why>" } ], review_items: [ { kind: "inferred | as-built-quirk | missing-invariant | confidence", where: "<spec/model/plan/source-map location>", note: "<what to confirm out of band>" } ] }
     mock: { ok: true, report_needed: false, blocking_gaps: [], review_items: [] }
     task: |
       FIDELITY CHECK — do the reversed documents actually describe the CODE
@@ -836,6 +970,14 @@ workflow:
             value object the code does not have, an aggregate boundary it does not draw,
             a lifecycle state it never enters, or a BR-nnn whose rule nothing enforces.
             An anemic slice reversing as an anemic model is CORRECT, not a gap.
+        (3) foreign-operation: a user story, requirement, plan element or UI-plan element
+            that realises an operation belonging ONLY to another feature over the same
+            aggregate. {{operations_note}} Its code is real, so it is not a fabrication —
+            but two specs owning one operation is the overlap the boundary map exists to
+            prevent, and every later change to it would land in the wrong feature.
+      - THE MODEL SECTION COVERS THE WHOLE AGGREGATE. An entity, state, event or invariant
+        that only a sibling feature's operations exercise is NOT fabricated when the code
+        has it: the section models the aggregate, not this feature's slice of it.
       - ONLY THIS FEATURE'S SECTIONS ARE THIS RUN'S. domain-model.md is the CONTEXT's and
         may already carry sections from earlier adopted slices — judge ONLY
         {{aggregate_sections}}. Do not report a sibling aggregate as unmapped because this
@@ -892,7 +1034,7 @@ workflow:
     action: verify_context
     require_true: fidelity_ok
     on_false: stop
-    on_false_message: "Fidelity FAILED for {{feature_name}} — the reversed documents do not match the code (blocking gaps: {{blocking_gaps}}). See {{feature_dir}}/adopt-review-report.md. Fix the unmapped code / remove fabricated items (re-read the source, refine spec.md, {{domain_model}}, backend-plan.md and source-map.md), then re-run /appweaver adopt (after removing the dir) or resolve out of band. A `fabricated-model` gap means the reverse gave this slice structure its code does not have — an entity, a boundary, a lifecycle state or a BR-nnn nothing enforces; the fix is to record the domain as thin as the code really is, never to leave it flattering."
+    on_false_message: "Fidelity FAILED for {{feature_name}} — the reversed documents do not match the code (blocking gaps: {{blocking_gaps}}). See {{feature_dir}}/adopt-review-report.md. Fix the unmapped code / remove fabricated items (re-read the source, refine spec.md, {{domain_model}}, backend-plan.md and source-map.md), then re-run /appweaver adopt (after removing the dir) or resolve out of band. A `fabricated-model` gap means the reverse gave this slice structure its code does not have — an entity, a boundary, a lifecycle state or a BR-nnn nothing enforces; the fix is to record the domain as thin as the code really is, never to leave it flattering. A `foreign-operation` gap means a document claims an operation the boundary map gives only to another feature; remove it here — it belongs to that feature's adopt."
 
   # ═══════════ OKF CONCEPT — COMPLETE the shallow scan concept (deep reverse) ═══
   # onboard wrote this aggregate's OKF concept SHALLOW (a discovery stub — enough to pick the
@@ -937,12 +1079,14 @@ workflow:
         points at the deep truth. Keep every link another feature's adopt added.
       - UNION `source_files` with the source-map's mapped files (grouped by the code's OWN
         folders, per OKF) — never drop a file already listed, which may be a sibling
-        capability's — and set `timestamp` to the baseline (inventory HEAD) commit time.
+        capability's. The boundary map was drawn at the baseline commit, whose time is
+        [{{baseline_time}}]: set `timestamp` to that value, and where the brackets are empty
+        (git could not resolve the commit) leave `timestamp` exactly as it is.
       - Update frontmatter: keep `origin: reverse-engineered`; make sure `features:`
-        includes '{{feature_name}}'; stamp `generated_by: aw-spec-adopt`; and record that
-        '{{feature_name}}' is ADOPTED / deep-reversed. Where several features act on the
-        aggregate, record WHICH of them are adopted rather than marking the whole concept
-        done — the others are still shallow.
+        includes '{{feature_name}}'; stamp `generated_by: aw-spec-adopt`; and add
+        '{{feature_name}}' to `adopted_features:` (a block list, like `features:`), keeping
+        every feature already listed there. A feature in `features:` and not in
+        `adopted_features:` is still the shallow stub — never mark the whole concept done.
       - Resolve any `open_questions` the deep reverse answered; keep the rest.
       - Do NOT touch the concept's Depends-On / Cross-References sections (xref_record
         maintains those next), and do NOT edit any OTHER aggregate concept.
@@ -1188,6 +1332,9 @@ outputs:
   bounded_context: "{{context}}"
   ui_lane: "{{ui_lane}}"
   ui_count: "{{ui_count}}"
+  feature_lanes: "{{feature_lanes}}"   # empty = every declared lane; [backend] = a service-only slice in a repo with a frontend
+  operations: "{{operations_csv}}"     # this feature's operations, from the boundary map
+  baseline_commit: "{{baseline_commit}}"
   source_map: "{{feature_dir}}/source-map.md"
   feature: "{{feature_name}}"
   # What the feature acts on. Equal to the feature on a 1:1 slice; not on a feature that
@@ -1204,4 +1351,4 @@ outputs:
   composed_file: "{{composed_file}}"
   technical_reconcile_ok: "{{technical_ok}}"
   domain_reconcile_ok: "{{domain_ok}}"
-  next: "Adopted {{feature_name}} (spec.md + backend-plan.md + source-map.md, v1.0) and wrote {{aggregate_sections}} — the model section(s) for the aggregate(s) it acts on, resolved from the {{aggregate_source}} — in the bounded context `{{context}}`'s shared {{domain_model}}. The spec cites BR-nnn by id, the model carries their text, so this slice is checkable by the same gates as a greenfield one and analyze-plan's check 4 now has a model to check against. A section another feature over the same aggregate wrote first was EXTENDED, never duplicated; every other section is untouched. COMPLETED the OKF concept of {{aggregate_primary}} (deepened + linked the deep artifacts; {{xref_edge_count}} cross-slice edge(s) recorded). UI HALF: ui_lane={{ui_lane}} — where it is true this slice also has frontend-plan.md, reversed from the {{ui_count}} UI file(s) the feature map attributes to it; where it is false the repo declared no frontend lane, or this aggregate owns no part of its surface, and a service-only adoption is the correct outcome rather than a gap. The SHARED UI surface (app shell, layout, design system) belongs to no slice and stays in {{bundle_dir}}/architecture/frontend.md. NOTE — governance reconcile is currently HELD (reconcile_governance=false): this run did NOT modify the constitution halves or the guardrails/projects/{{gov_domain}}/ rule set, so they keep onboard's provisional scaffold. Close any items in {{feature_dir}}/adopt-review-report.md out of band. The slice is now a NORMAL feature: refine via /appweaver analyze-plan, then drive every change through the CR delta loop (/appweaver specify → plan → analyze-plan-delta → implement → build → analyze-slice-delta → finalize-delta → analyze-slice → close-delta). If a change edits untested legacy behaviour with blast radius, characterize just that surface first (optional on-touch fence). To restore governance reconcile, set reconcile_governance to \"true\" in the workflow vars."
+  next: "Adopted {{feature_name}} (spec.md + backend-plan.md + source-map.md, v1.0) and wrote {{aggregate_sections}} — the model section(s) for the aggregate(s) it acts on, resolved from the {{aggregate_source}} — in the bounded context `{{context}}`'s shared {{domain_model}}. The spec cites BR-nnn by id, the model carries their text, so this slice is checkable by the same gates as a greenfield one and analyze-plan's check 4 now has a model to check against. A section another feature over the same aggregate wrote first was EXTENDED, never duplicated; every other section is untouched. COMPLETED the OKF concept of {{aggregate_primary}} (deepened + linked the deep artifacts; {{xref_edge_count}} cross-slice edge(s) recorded). UI HALF: ui_lane={{ui_lane}} — where it is true this slice also has frontend-plan.md, reversed from the {{ui_count}} UI file(s) the feature map attributes to it; where it is false the repo declared no frontend lane, or this aggregate owns no part of its surface, and a service-only adoption is the correct outcome rather than a gap. In the second case, where a frontend lane IS declared, the feature records lanes=[backend] in its active_version.json (feature_lanes shows it), so plan and the analyze gates treat the frontend lane as absent for THIS feature; run `aw-spec-actions feature-lanes --clear` if it later gains a UI. The SHARED UI surface (app shell, layout, design system) belongs to no slice and stays in {{bundle_dir}}/architecture/frontend.md. NOTE — governance reconcile is currently HELD (reconcile_governance=false): this run did NOT modify the constitution halves or the guardrails/projects/{{gov_domain}}/ rule set, so they keep onboard's provisional scaffold. Close any items in {{feature_dir}}/adopt-review-report.md out of band. The slice is now a NORMAL feature: refine via /appweaver analyze-plan, then drive every change through the CR delta loop (/appweaver specify → plan → analyze-plan-delta → implement → build → analyze-slice-delta → finalize-delta → analyze-slice → close-delta). If a change edits untested legacy behaviour with blast radius, characterize just that surface first (optional on-touch fence). To restore governance reconcile, set reconcile_governance to \"true\" in the workflow vars."

package/assets/.appweaver/orchestrator/workflows/aw-spec-analyze-plan-delta.orch.yaml

@@ -77,6 +77,7 @@ vars:
   lanes_declared: "false"
   be_declared: "false"
   fe_declared: "false"
+  fe_excluded: "false"        # this feature records no surface in the declared frontend lane (feature-lanes)
   has_changes: "false"
   cr_choice: ""
   cr_id: ""
@@ -149,6 +150,23 @@ workflow:
       - { name: backend_plan_exists,  from: "$.backend_plan_exists" }
       - { name: frontend_plan_exists, from: "$.frontend_plan_exists" }
 
+  # THIS FEATURE'S LANES. lane_resolve above read the REPO's declaration; one feature may
+  # own no part of a lane's surface — adopt records `lanes: [backend]` in
+  # active_version.json for a service-only slice in a repo that also has a UI. Re-read with
+  # --feature-dir so a lane the feature records no surface in is absent here: no delta plan
+  # is expected of it. With no feature resolved the argument is dropped and the repo's
+  # answer stands.
+  - id: feature_lanes
+    action: execute_script
+    on_error: continue
+    script: { ref: actions }
+    subcommand: lane-resolve
+    args: ["--feature-dir", "{{feature_dir}}"]
+    outputs:
+      - { name: be_declared, from: "$.backend_declared" }
+      - { name: fe_declared, from: "$.frontend_declared" }
+      - { name: fe_excluded, from: "$.frontend_feature_excluded" }
+
   - id: require_feature
     action: verify_context
     require_non_empty: feature_dir

package/assets/.appweaver/orchestrator/workflows/aw-spec-analyze-plan.orch.yaml

@@ -119,6 +119,7 @@ vars:
   lanes_declared: "false"
   be_declared: "false"
   fe_declared: "false"
+  fe_excluded: "false"        # this feature records no surface in the declared frontend lane (feature-lanes)
   # PER-LANE PRESENCE. A lane is CHECKED when it is declared and its plan document is on
   # disk, and MISSING when it is declared and the document is not. The engine has no
   # compound conditions, so each AND is one ordered assignment taking the lane's own
@@ -190,6 +191,23 @@ workflow:
       - { name: backend_plan_exists, from: "$.backend_plan_exists" }
       - { name: frontend_plan_exists, from: "$.frontend_plan_exists" }
 
+  # THIS FEATURE'S LANES. lane_resolve above read the REPO's declaration; one feature may
+  # own no part of a lane's surface — adopt records `lanes: [backend]` in
+  # active_version.json for a service-only slice in a repo that also has a UI. Re-read with
+  # --feature-dir so a lane the feature records no surface in is absent here: its missing
+  # plan is not a gap this gate stops on. With no feature resolved the argument is dropped
+  # and the repo's answer stands.
+  - id: feature_lanes
+    action: execute_script
+    on_error: continue
+    script: { ref: actions }
+    subcommand: lane-resolve
+    args: ["--feature-dir", "{{feature_dir}}"]
+    outputs:
+      - { name: be_declared, from: "$.backend_declared" }
+      - { name: fe_declared, from: "$.frontend_declared" }
+      - { name: fe_excluded, from: "$.frontend_feature_excluded" }
+
   # The BOUNDED CONTEXT's domain model — where the aggregate root, its entities and its
   # invariants (BR-n) live. The spec cites them by id and the plans record where each is
   # ENFORCED, so check 4 has nothing to check without it in context.
@@ -773,6 +791,7 @@ outputs:
   bounded_context: "{{context}}"
   backend_plan: "{{backend_plan}}"      # empty when no backend lane is declared
   frontend_plan: "{{frontend_plan}}"    # empty when no frontend lane is declared
+  frontend_excluded: "{{fe_excluded}}" # true = a frontend lane is declared and this feature records no surface in it (feature-lanes)
   domain_model: "{{domain_model}}"
   conformant: "{{analyze_ok}}"
   gaps: "{{analyze_gaps}}"

package/assets/.appweaver/orchestrator/workflows/aw-spec-analyze-slice-delta.orch.yaml

@@ -115,6 +115,7 @@ vars:
   # ordered assignment; the engine has no compound conditions.
   be_declared: "false"
   fe_declared: "false"
+  fe_excluded: "false"        # this feature records no surface in the declared frontend lane (feature-lanes)
   be_gated: "false"
   fe_gated: "false"
   any_lane: "false"
@@ -193,6 +194,23 @@ workflow:
       - { name: backend_plan,  from: "$.backend_plan" }
       - { name: frontend_plan, from: "$.frontend_plan" }
 
+  # THIS FEATURE'S LANES. lane_resolve above read the REPO's declaration; one feature may
+  # own no part of a lane's surface — adopt records `lanes: [backend]` in
+  # active_version.json for a service-only slice in a repo that also has a UI. Re-read with
+  # --feature-dir so a lane the feature records no surface in is absent here: its code is
+  # not gated against a plan it never had. With no feature resolved the argument is dropped
+  # and the repo's answer stands.
+  - id: feature_lanes
+    action: execute_script
+    on_error: continue
+    script: { ref: actions }
+    subcommand: lane-resolve
+    args: ["--feature-dir", "{{feature_dir}}"]
+    outputs:
+      - { name: be_declared, from: "$.backend_declared" }
+      - { name: fe_declared, from: "$.frontend_declared" }
+      - { name: fe_excluded, from: "$.frontend_feature_excluded" }
+
   - id: require_feature
     action: verify_context
     require_non_empty: feature_dir