aw-spec-cli 0.1.29 → 0.1.30

package/assets/.appweaver/orchestrator/workflows/aw-spec-analyze-plan.orch.yaml

@@ -19,6 +19,31 @@
 # a frontend-only project runs 2 + 4; a full-stack project runs all four. Check 3 needs
 # both plans to exist and is skipped, not failed, when only one lane is declared.
 #
+# IT GATES THE DEVELOPER'S WORKING LANE. .appweaver/lane.json (select-stack writes the
+# default, select-lane narrows it, not committed) names the lanes this developer works on.
+# Only a WORKING lane's plan is GATED here — checked, repaired on approval, and given its
+# own receipt (.aw-plan-gate.<lane>.json). A declared lane that is somebody else's is READ:
+# its plan is in context so check 3 can compare the two sides of the contract, but it is
+# never repaired, a missing one never stops the run, and a finding that only its document
+# can close is reported for its developer (plan-gaps `other`) instead of blocking this one.
+# Each lane's receipt carries that lane's verdict, so a frontend plan left with gaps never
+# refuses the backend's implement, and the reverse. With the default (every declared
+# lane) every plan is gated, as before — each in its own receipt.
+#
+# THE REQUEST LEDGER IS READ BY SCRIPT. What the frontend plan asks of the service sits in
+# its §5 "Contract deltas needed" table, one RQ-n per request, and the backend plan answers
+# each in its API section's "Requests from the frontend lane" table. contract-requests reads
+# both on every pass, so check 3 is TOLD which requests are open (a backend-lane gap: answer
+# it, by publishing or declining) and which wait on the frontend (answered and not re-bound,
+# or declined). A frontend developer's run therefore reports open requests for the backend
+# developer instead of stopping on them, and a backend developer's repair answers them.
+# A master run that gates the backend plan also redraws api-draft.json from its API
+# section, so the draft the frontend generates against matches the plan as repaired.
+#
+# THE FRONTEND RECEIPT HASHES THE BACKEND'S PUBLISHED SURFACE TOO (the API section of
+# backend-plan.md): when the backend developer changes it — an answered request, a renamed
+# operation — the frontend lane is stale at implement until its plan is gated again.
+#
 # THIS STAGE VALIDATES; `plan` AUTHORS. A declared lane whose plan document is MISSING
 # STOPS the run naming /appweaver plan — it is not scaffolded and repaired here. Filling
 # an empty template through a 3-pass repair loop would author a plan without the lane's
@@ -41,6 +66,15 @@
 # to be stale, and a stage that refuses to look is not a gate. It reports; it never writes
 # a plan.
 #
+# THE MODE IS DECIDED PER LANE. A change's delta-spec names the lanes it touches on its
+# **Lanes** line, and only a change that names a lane holds that lane's master plan still.
+# So each gated lane is in MASTER mode — repaired on approval, receipted, stopped on — unless
+# an open change names it, and in REPORT mode when one does: a backend-only change leaves
+# the frontend plan free to be gated and repaired while it is in flight. A change with no
+# **Lanes** line names every lane, so with such changes, or with every lane named, the
+# whole run is in report mode as before. A report-mode lane's gaps are listed with the ones
+# this run does not repair (plan-gaps `other`) and neither drive the repair nor the stop.
+#
 # TWO KINDS OF GAP, SPLIT BY WHO CAN CLOSE THEM (plan-gaps). A PLAN gap is closed by
 # rewriting a lane plan, which this stage may do. A ROUTED gap can only be closed in
 # spec.md or domain-model.md, which this stage may not write: a LIFT-FAILURE (a domain
@@ -49,15 +83,17 @@
 # are reported and handed to /appweaver specify. Stopping on them would stop every feature
 # whose spec missed a constraint, with no repair this stage could ever make.
 #
-# EVERY MASTER RUN LEAVES A RECEIPT (.aw-plan-gate.json), green or not: the bytes it
-# checked and the verdict — conformant, routed-gaps or gaps. implement reads it and
-# refuses moved bytes or `gaps`, and warns on `routed-gaps`.
+# EVERY MASTER RUN LEAVES A RECEIPT PER GATED LANE (.aw-plan-gate.<lane>.json), green or
+# not: the bytes it checked — spec.md, the context's domain-model.md and that lane's plan —
+# and that lane's verdict: conformant, routed-gaps or gaps. implement reads the receipt of
+# each lane it generates, refuses moved bytes or `gaps`, and warns on `routed-gaps`.
 #
 # WHICH MODE IS READ FROM THE DIRECTORY, AND DEFAULTS TO REPORT. changes/<id>/ is the
-# evidence (cr-list), not active_version.json's `active_change` — the ledger is the most
-# recently OPENED change and a crashed run can leave the two disagreeing. The permission to
-# write is RAISED only by cr-list answering that nothing is open, so a reading that never
-# arrives leaves this stage read-only rather than rewriting masters mid-delta.
+# evidence (cr-list, asked once per lane with --lane), not active_version.json's
+# `active_change` — the ledger is the most recently OPENED change and a crashed run can leave
+# the two disagreeing. A lane's permission to write is RAISED only by cr-list answering that
+# no open change names it, so a reading that never arrives leaves that lane read-only rather
+# than rewriting its master mid-delta.
 #
 # The change is closed by close-delta, the SINGLE cr-archive caller, and only after
 # finalize-delta has merged the delta into the masters. Also runnable on demand to
@@ -72,8 +108,8 @@
 # =============================================================================
 
 name: aw-spec-analyze-plan
-description: The spec↔plan conformance gate for every declared lane — confirm backend-plan.md and frontend-plan.md follow spec.md, that they bind to each other's contract, and that neither contradicts the bounded context's domain model (domain overlays are a backstop); with approval, repair the drifting plan. Lanes come from .appweaver/stacks.json, so one command gates backend-only, frontend-only and full-stack projects. Runs in one of two modes, decided from the changes/ directory rather than the ledger and defaulting to the read-only one — MASTER (no change open) checks, repairs on approval and stops on unreconciled gaps; REPORT (a change open) runs the same checks read-only and writes plan-analyze-report.md without asking, repairing or stopping, because the master plans may not be rewritten while a delta is in flight. It never opens, merges or closes a change.
-version: 3.3.0
+description: The spec↔plan conformance gate for every declared lane — confirm backend-plan.md and frontend-plan.md follow spec.md, that they bind to each other's contract, and that neither contradicts the bounded context's domain model (domain overlays are a backstop); with approval, repair the drifting plan. Lanes come from .appweaver/stacks.json, so one command gates backend-only, frontend-only and full-stack projects. Each gated lane runs in one of two modes, decided from the changes/ directory rather than the ledger and defaulting to the read-only one — MASTER (no open change names that lane on its **Lanes** line) checks, repairs on approval and stops on unreconciled gaps; REPORT (an open change names it) runs the same checks read-only, because a master plan may not be rewritten while a delta to that lane is in flight. With no lane in master mode the run writes plan-analyze-report.md without asking, repairing or stopping. It never opens, merges or closes a change.
+version: 3.6.0
 agent_agnostic: true
 dialect: aw-spec.orchestrator/v1
 
@@ -92,17 +128,27 @@ vars:
   analyze_ok: "false"
   active_change: ""
   version: ""
-  # WHICH MODE THIS RUN IS IN, read from the changes/ DIRECTORY and defaulted to the
-  # read-only answer. has_changes starts at the BLOCKING value because an unanswered
-  # question is not a clean answer: cr-list runs without on_error: continue, so a failure
-  # stops the run outright, and a field that never arrived leaves this stage read-only
-  # instead of letting the repair loop rewrite master plans while a delta is in flight.
-  has_changes: "true"
-  open_ids: ""             # cr-list's ids_csv — what is open, named, for the operator
+  open_ids: ""             # every open change on the feature, named for the operator
   open_count: "0"
-  no_open_change: "false"  # RAISED only by cr-list answering that nothing is open
-  gate_mode: "report"      # report | master — reported in the outputs
-  may_repair: "false"      # the ask, the repair loop and the conformance stop are MASTER-only
+  # WHICH MODE EACH LANE IS IN, read from the changes/ DIRECTORY (cr-list --lane: does an
+  # open change name the lane) and defaulted to the read-only answer. *_change_open starts
+  # at the BLOCKING value because an unanswered question is not a clean answer: cr-list runs
+  # without on_error: continue, so a failure stops the run outright, and a field that never
+  # arrived leaves that lane read-only instead of letting the repair loop rewrite its master
+  # plan while a delta to it is in flight.
+  be_change_open: "true"
+  fe_change_open: "true"
+  be_open_ids: ""          # the open changes naming the backend
+  fe_open_ids: ""
+  be_no_change: "false"    # RAISED only by cr-list answering that none names the lane
+  fe_no_change: "false"
+  be_may_repair: "false"   # gated AND no open change names it ⇒ MASTER mode for this lane
+  fe_may_repair: "false"
+  be_lane_mode: "not gated" # master | report (…) — reported in the outputs
+  fe_lane_mode: "not gated"
+  repair_lanes: ""         # the lanes this run may repair, as a csv for plan-gaps --lanes
+  gate_mode: "report"      # master (some lane may be repaired) | report (none) — reported in the outputs
+  may_repair: "false"      # some gated lane is in MASTER mode: the ask, the repair loop and the stop run
   gate_ok: "false"         # raised by a run with no plan gap left OR by report mode, which cannot repair
   stamp_receipt: "false"   # master mode ⇒ leave the receipt implement reads, whatever the verdict
   repairs_left: "true"     # lowered on the loop's final pass, which checks and never rewrites
@@ -113,15 +159,40 @@ vars:
   plan_gap_count: "0"
   routed_gaps: "[]"        # the gaps only /appweaver specify can close
   routed_csv: ""
-  receipt_file: ""
   receipt_gated: ""
-  receipt_count: "0"
   lanes_declared: "false"
   be_declared: "false"
   fe_declared: "false"
   fe_excluded: "false"        # this feature records no surface in the declared frontend lane (feature-lanes)
-  # PER-LANE PRESENCE. A lane is CHECKED when it is declared and its plan document is on
-  # disk, and MISSING when it is declared and the document is not. The engine has no
+  # THE WORKING LANES (.appweaver/lane.json) — the lanes this developer's plans are gated
+  # for. A lane that is declared and not worked is read only.
+  be_working: "false"
+  fe_working: "false"
+  working_lane: ""
+  work_lanes: ""           # the working lanes as a csv, for plan-gaps --lanes
+  be_gated: "false"        # worked AND its plan is on disk ⇒ checked, repairable, receipted
+  fe_gated: "false"
+  any_gated: "false"
+  stamp_be: "false"
+  stamp_fe: "false"
+  be_verdict: "gaps"
+  fe_verdict: "gaps"
+  be_plan_gaps: "0"
+  fe_plan_gaps: "0"
+  be_routed: "[]"
+  fe_routed: "[]"
+  be_receipt: ""
+  fe_receipt: ""
+  other_gaps: "0"          # findings only the lane you do not work on can close — reported for its developer
+  other_csv: ""
+  # THE REQUEST LEDGER (contract-requests), re-read on every pass, and the draft.
+  req_backend_text: "none"
+  req_frontend_text: "none"
+  req_summary: "no contract request"
+  draft_path: ""
+  # PER-LANE PRESENCE. A lane is PRESENT when it is declared and its plan document is on
+  # disk — its plan is then in context — and MISSING when it is WORKED and the document is
+  # not. The engine has no
   # compound conditions, so each AND is one ordered assignment taking the lane's own
   # `declared` value under the exists/not-exists condition.
   be_present: "false"
@@ -166,6 +237,7 @@ workflow:
       - { name: lanes_declared, from: "$.declared" }
       - { name: be_declared,    from: "$.backend_declared" }
       - { name: fe_declared,    from: "$.frontend_declared" }
+      - { name: working_lane,   from: "$.working_lane" }
 
   - id: require_lane
     action: verify_context
@@ -207,6 +279,8 @@ workflow:
       - { name: be_declared, from: "$.backend_declared" }
       - { name: fe_declared, from: "$.frontend_declared" }
       - { name: fe_excluded, from: "$.frontend_feature_excluded" }
+      - { name: be_working,  from: "$.backend_working" }
+      - { name: fe_working,  from: "$.frontend_working" }
 
   # The BOUNDED CONTEXT's domain model — where the aggregate root, its entities and its
   # invariants (BR-n) live. The spec cites them by id and the plans record where each is
@@ -262,23 +336,43 @@ workflow:
     on_false: stop
     on_false_message: "No spec.md for the current feature. Run /appweaver specify (and /appweaver plan) first."
 
-  # 1b. IS ANY CHANGE OPEN — asked of the changes/ DIRECTORY, which is what "open" means.
-  #     Not version-read's `has_change`: that is bool(active_change), the most recently
-  #     OPENED change in active_version.json, and a run that died between cr-setup writing
-  #     the directory and the ledger recording it leaves the two disagreeing. The stage
-  #     that may rewrite masters has to read the authority every other delta stage reads.
-  #     No on_error: continue — a cr-list that cannot answer stops the run.
+  # 1b. WHICH CHANGES ARE OPEN — asked of the changes/ DIRECTORY, which is what "open"
+  #     means. Not version-read's `has_change`: that is bool(active_change), the most
+  #     recently OPENED change in active_version.json, and a run that died between cr-setup
+  #     writing the directory and the ledger recording it leaves the two disagreeing. The
+  #     stage that may rewrite masters has to read the authority every other delta stage
+  #     reads. No on_error: continue — a cr-list that cannot answer stops the run.
+  #     This first call names every open change for the operator; the mode is decided by
+  #     the two per-lane calls after it.
   - id: cr_list
     action: execute_script
     script: { ref: actions }
     subcommand: cr-list
     args: ["--feature-dir", "{{feature_dir}}"]
     outputs:
-      - { name: has_changes,   from: "$.has_changes" }
       - { name: open_ids,      from: "$.ids_csv" }
       - { name: open_count,    from: "$.count" }
       - { name: active_change, from: "$.active_change" }
 
+  # The question that decides each lane's mode: which open changes name the lane on their
+  # **Lanes** line. A change with no such line names every lane.
+  - id: cr_list_backend
+    action: execute_script
+    script: { ref: actions }
+    subcommand: cr-list
+    args: ["--feature-dir", "{{feature_dir}}", "--lane", "backend"]
+    outputs:
+      - { name: be_change_open, from: "$.has_changes" }
+      - { name: be_open_ids,    from: "$.ids_csv" }
+  - id: cr_list_frontend
+    action: execute_script
+    script: { ref: actions }
+    subcommand: cr-list
+    args: ["--feature-dir", "{{feature_dir}}", "--lane", "frontend"]
+    outputs:
+      - { name: fe_change_open, from: "$.has_changes" }
+      - { name: fe_open_ids,    from: "$.ids_csv" }
+
   - id: read_version
     action: execute_script
     script: { ref: actions }
@@ -287,27 +381,13 @@ workflow:
     outputs:
       - { name: version, from: "$.version" }
 
-  # 1c. THE WRITE PERMISSION, raised then verified. Nothing open ⇒ spec.md + the lane plans
-  #     ARE the masters ⇒ this stage owns them and may repair. Anything else — a change
-  #     open, or an answer that never arrived — leaves may_repair down and the run is
-  #     read-only: the checks still run and still report, but no plan is rewritten under a
-  #     delta in flight. The permission is raised by the good state, never knocked down by
-  #     the bad one, so the failure direction is refusal to write.
-  - id: no_open_change_raise
-    condition: "{{has_changes}} == false"
-    action: set
-    vars: { no_open_change: "true" }
-
-  - id: enter_master_mode
-    condition: "{{no_open_change}} == true"
-    action: set
-    vars: { gate_mode: "master", may_repair: "true" }
-
-  # 2. WHICH LANES ARE GATED. Present = declared AND on disk; missing = declared AND not.
-  #    Taking the lane's own `declared` value under the exists condition is how the AND is
-  #    expressed — an UNDECLARED lane's flags stay false either way, which is what makes a
-  #    stray plan document from a lane that was later removed silently ignored rather than
-  #    gated against a stack nobody declared.
+  # 2. WHICH LANES ARE GATED. Present = declared AND on disk (its plan is READ); gated =
+  #    present AND worked (its plan is CHECKED, repaired on approval and receipted); missing
+  #    = worked AND not on disk. Taking the lane's own value under the exists condition is
+  #    how each AND is expressed — an UNDECLARED lane's flags stay false either way, which
+  #    is what makes a stray plan document from a lane that was later removed silently
+  #    ignored rather than gated against a stack nobody declared, and a lane somebody else
+  #    works on is read without ever being missing.
   - id: be_flag_present
     condition: "{{backend_plan_exists}} == true"
     action: set
@@ -315,7 +395,7 @@ workflow:
   - id: be_flag_missing
     condition: "{{backend_plan_exists}} == false"
     action: set
-    vars: { be_missing: "{{be_declared}}" }
+    vars: { be_missing: "{{be_working}}" }
   - id: fe_flag_present
     condition: "{{frontend_plan_exists}} == true"
     action: set
@@ -323,10 +403,103 @@ workflow:
   - id: fe_flag_missing
     condition: "{{frontend_plan_exists}} == false"
     action: set
-    vars: { fe_missing: "{{fe_declared}}" }
+    vars: { fe_missing: "{{fe_working}}" }
+  - id: be_flag_gated
+    condition: "{{be_present}} == true"
+    action: set
+    vars: { be_gated: "{{be_working}}" }
+  - id: fe_flag_gated
+    condition: "{{fe_present}} == true"
+    action: set
+    vars: { fe_gated: "{{fe_working}}" }
+  - id: any_gated_be
+    condition: "{{be_gated}} == true"
+    action: set
+    vars: { any_gated: "true" }
+  - id: any_gated_fe
+    condition: "{{fe_gated}} == true"
+    action: set
+    vars: { any_gated: "true" }
+
+  # The working lanes as one csv for plan-gaps — an ordered pair of sets; an empty item
+  # left by the second is dropped by plan-gaps.
+  - id: work_lanes_be
+    condition: "{{be_working}} == true"
+    action: set
+    vars: { work_lanes: "backend" }
+  - id: work_lanes_fe
+    condition: "{{fe_working}} == true"
+    action: set
+    vars: { work_lanes: "{{work_lanes}},frontend" }
 
-  # A declared lane with no plan is not a gap this gate repairs — it is work `plan` has
-  # not done. Two independent raises so neither lane can cancel the other's.
+  # 2b. THE WRITE PERMISSION, PER LANE, raised then verified. No open change names the lane
+  #     ⇒ its plan IS the master ⇒ this stage owns it and may repair it. Anything else — a
+  #     change naming it, or an answer that never arrived — leaves that lane read-only: it
+  #     is still checked and reported, but its plan is not rewritten under a delta in
+  #     flight. The permission is raised by the good state, never knocked down by the bad
+  #     one, so the failure direction is refusal to write.
+  - id: be_no_change_raise
+    condition: "{{be_change_open}} == false"
+    action: set
+    vars: { be_no_change: "true" }
+  - id: fe_no_change_raise
+    condition: "{{fe_change_open}} == false"
+    action: set
+    vars: { fe_no_change: "true" }
+  - id: be_master_raise
+    condition: "{{be_no_change}} == true"
+    action: set
+    vars: { be_may_repair: "{{be_gated}}" }
+  - id: fe_master_raise
+    condition: "{{fe_no_change}} == true"
+    action: set
+    vars: { fe_may_repair: "{{fe_gated}}" }
+  - id: enter_master_mode_be
+    condition: "{{be_may_repair}} == true"
+    action: set
+    vars: { gate_mode: "master", may_repair: "true" }
+  - id: enter_master_mode_fe
+    condition: "{{fe_may_repair}} == true"
+    action: set
+    vars: { gate_mode: "master", may_repair: "true" }
+  - id: be_mode_report
+    condition: "{{be_gated}} == true"
+    action: set
+    vars: { be_lane_mode: "report (open change naming it: {{be_open_ids}})" }
+  - id: be_mode_master
+    condition: "{{be_may_repair}} == true"
+    action: set
+    vars: { be_lane_mode: "master" }
+  - id: fe_mode_report
+    condition: "{{fe_gated}} == true"
+    action: set
+    vars: { fe_lane_mode: "report (open change naming it: {{fe_open_ids}})" }
+  - id: fe_mode_master
+    condition: "{{fe_may_repair}} == true"
+    action: set
+    vars: { fe_lane_mode: "master" }
+
+  # The lanes this run may repair, for plan-gaps --lanes: a gap in any other lane is listed
+  # under `other` and neither drives the repair nor the stop. With no lane in master mode
+  # the working lanes are passed as they always were — the read-only run reports by them.
+  - id: repair_lanes_default
+    action: set
+    vars: { repair_lanes: "{{work_lanes}}" }
+  - id: repair_lanes_clear
+    condition: "{{may_repair}} == true"
+    action: set
+    vars: { repair_lanes: "" }
+  - id: repair_lanes_be
+    condition: "{{be_may_repair}} == true"
+    action: set
+    vars: { repair_lanes: "backend" }
+  - id: repair_lanes_fe
+    condition: "{{fe_may_repair}} == true"
+    action: set
+    vars: { repair_lanes: "{{repair_lanes}},frontend" }
+
+  # A WORKED lane with no plan is not a gap this gate repairs — it is work `plan` has not
+  # done. Two independent raises so neither lane can cancel the other's.
   - id: plans_not_ok_backend
     condition: "{{be_missing}} == true"
     action: set
@@ -340,7 +513,13 @@ workflow:
     action: verify_context
     require_true: plans_ok
     on_false: stop
-    on_false_message: "A declared lane has no plan document (backend declared={{be_declared}} missing={{be_missing}} · frontend declared={{fe_declared}} missing={{fe_missing}}). Run /appweaver plan — it authors each declared lane's plan from the spec, the domain model, that lane's rule set and the feature's real source files. This gate validates a plan; it does not write one."
+    on_false_message: "A lane you work on has no plan document (your working lane: `{{working_lane}}` · backend worked={{be_working}} missing={{be_missing}} · frontend worked={{fe_working}} missing={{fe_missing}}). Run /appweaver plan — it authors each working lane's plan from the spec, the domain model, that lane's rule set and the feature's real source files. This gate validates a plan; it does not write one."
+
+  - id: require_gated_lane
+    action: verify_context
+    require_true: any_gated
+    on_false: stop
+    on_false_message: "Nothing to gate for your working lane `{{working_lane}}` (.appweaver/lane.json): this feature records no surface in it (backend declared for this feature={{be_declared}}, frontend={{fe_declared}}). Run /appweaver select-lane to work on another lane, or /appweaver select-feature to gate a feature that has this lane."
 
   # Check 3 needs BOTH documents. One more ordered assignment: with the backend present,
   # take the frontend's own presence as the answer.
@@ -420,6 +599,20 @@ workflow:
     while: "{{plan_ok}} != true"
     max_iterations: 4
     steps:
+      # The request ledger as the plans stand on this pass — a repair on the previous pass
+      # may have answered or re-bound a request.
+      - id: contract_requests
+        condition: "{{both_lanes}} == true"
+        action: execute_script
+        on_error: continue
+        script: { ref: actions }
+        subcommand: contract-requests
+        args: ["--feature-dir", "{{feature_dir}}"]
+        outputs:
+          - { name: req_backend_text,  from: "$.backend_text" }
+          - { name: req_frontend_text, from: "$.frontend_text" }
+          - { name: req_summary,       from: "$.summary" }
+
       - id: analyze
         action: agent_query
         include_standards: true            # the gate overlays (checklist) are in the standards
@@ -431,6 +624,12 @@ workflow:
           that apply — backend plan present: {{be_present}}, frontend plan present:
           {{fe_present}}, both present: {{both_lanes}}. A check for an absent lane is
           SKIPPED, not failed: an undeclared lane is a project decision, not a gap.
+          WHICH PLANS ARE GATED: backend {{be_gated}}, frontend {{fe_gated}} — the lanes
+          the developer running this works on. Run checks 1, 2, 4 and 5 for a GATED plan
+          only. A plan that is present and NOT gated belongs to another developer: read it
+          for check 3, where the two sides of the contract meet, and nothing else. Every
+          gap still carries the `lane` whose document must change to close it, even when
+          that lane is not gated here — it is reported for that lane's developer.
 
           CHECK 1 — spec.md → backend-plan.md (when the backend plan is in context):
           (a) every spec item — FR / Business Rule / Constraint (CN-) / Data
@@ -457,7 +656,7 @@ workflow:
 
           CHECK 3 — CONTRACT BINDING, backend-plan.md ↔ frontend-plan.md (ONLY when
           {{both_lanes}} is true; skip entirely otherwise). This is the check neither
-          one-sided pass can make:
+          one-sided pass can make, and it runs whichever of the two plans is gated:
           (a) EVERY call, endpoint or payload the frontend plan binds to EXISTS in the
           service plan's published API surface. One that does not is a HIGH gap on the
           `contract` check — lane `backend` when the spec requires the capability (the
@@ -465,9 +664,15 @@ workflow:
           (b) the FIELD SHAPES agree in both directions — a field the frontend reads that
           the service never returns, and a required field the service demands that the
           frontend never sends, are both HIGH gaps;
-          (c) anything the frontend plan raised under "Contract deltas needed" is
-          UNRESOLVED by definition: report it as a gap so it is closed here rather than
-          discovered at integration;
+          (c) THE REQUEST LEDGER, read by script from both plans ({{req_summary}}). OPEN —
+          raised in the frontend plan's "Contract deltas needed" and not answered in the
+          backend plan's "Requests from the frontend lane": {{req_backend_text}}. Report
+          EACH as a HIGH `contract` gap on lane `backend`, route `plan`, naming the RQ-n:
+          the backend plan must publish it or decline it. WAITING ON THE FRONTEND PLAN —
+          answered and not yet re-bound, or declined: {{req_frontend_text}}. Report EACH as
+          a HIGH `contract` gap on lane `frontend`, route `plan`. `none` means nothing in
+          that group. A binding row that cites an open request's proposed id is that
+          request, not a separate gap under (a) or (e);
           (d) the frontend plan cites the service's published surface and does NOT restate,
           re-derive or contradict it, and states no server-side behaviour or persistence
           assumption;
@@ -523,25 +728,37 @@ workflow:
 
       # WHO CAN CLOSE EACH GAP, decided by script from the tags above: a LIFT-FAILURE is
       # routed to specify whatever its tag says, and an untagged gap is a plan gap.
+      # --lanes: a plan gap tagged with a lane this run does not repair — one this
+      # developer does not work on, or one an open change names — is listed under `other`;
+      # it neither drives the repair nor the stop.
       - id: classify_gaps
         action: execute_script
         script: { ref: actions }
         subcommand: plan-gaps
-        args: ["--gaps", "{{analyze_gaps}}"]
+        args: ["--gaps", "{{analyze_gaps}}", "--lanes", "{{repair_lanes}}"]
         outputs:
           - { name: plan_ok,        from: "$.plan_ok" }
           - { name: gate_verdict,   from: "$.verdict" }
           - { name: plan_gap_count, from: "$.plan_gaps" }
           - { name: routed_gaps,    from: "$.routed" }
           - { name: routed_csv,     from: "$.routed_csv" }
+          - { name: other_gaps,     from: "$.other_gaps" }
+          - { name: other_csv,      from: "$.other_csv" }
+          - { name: be_verdict,     from: "$.backend_verdict" }
+          - { name: be_plan_gaps,   from: "$.backend_plan_gaps" }
+          - { name: be_routed,      from: "$.backend_routed" }
+          - { name: fe_verdict,     from: "$.frontend_verdict" }
+          - { name: fe_plan_gaps,   from: "$.frontend_plan_gaps" }
+          - { name: fe_routed,      from: "$.frontend_routed" }
       - id: conform_break
         action: break
         condition: "{{analyze_ok}} == true"
 
-      # REPORT MODE — a change is open (or the mode could not be established), so the
-      # master plans are off limits and there is nothing to ask: repair is not on offer.
-      # Write the report and leave the loop. The report itself has to name the two
-      # readings, because the same gaps mean opposite things either side of the merge.
+      # NO LANE IN MASTER MODE — an open change names every gated lane (or the mode could not
+      # be established), so the master plans are off limits and there is nothing to ask:
+      # repair is not on offer. Write the report and leave the loop. The report itself has
+      # to name the two readings, because the same gaps mean opposite things either side of
+      # the merge.
       - id: write_report_readonly
         condition: "{{may_repair}} == false"
         action: agent_author
@@ -549,12 +766,13 @@ workflow:
         output_target: { type: file, path: "{{feature_dir}}/plan-analyze-report.md" }
         task: |
           Write a Plan Analyze Report to the output from these spec↔plan conformance gaps
-          (spec.md is the ANCHOR). This run was READ-ONLY: change(s) {{open_ids}} are open
-          on this feature, so the master lane plans were checked but NOT repaired.
+          (spec.md is the ANCHOR). This run was READ-ONLY: an open change names each lane it
+          checked — backend plan: {{be_lane_mode}}; frontend plan: {{fe_lane_mode}} — so the
+          master lane plans were checked but NOT repaired.
           {{analyze_gaps}}
           Markdown format:
           - "# Plan Analyze Report — <aggregate>" plus today's date.
-          - A verdict line: "verdict: GAPS ✗ · <n> gap(s) · read-only (change open: {{open_ids}})".
+          - A verdict line: "verdict: GAPS ✗ · <n> gap(s) · read-only (backend plan: {{be_lane_mode}}; frontend plan: {{fe_lane_mode}})".
           - "## Gaps" as a table: | # | check | lane | severity | spec ref | plan location | gap |.
           - "## How to read this" — state BOTH readings and that only the operator knows
             which applies, because it depends on whether finalize-delta has already run:
@@ -567,10 +785,15 @@ workflow:
             (b) BEFORE finalize-delta, the masters have not moved, so these gaps are real
             master drift — but this is still not the stage that fixes it, because the
             change in flight is planned in its OWN delta plans. Gate those with
-            /appweaver analyze-plan-delta, and re-run /appweaver analyze-plan in master
-            mode once every change is closed.
+            /appweaver analyze-plan-delta, and re-run /appweaver analyze-plan once no open
+            change names the lane, when it runs in master mode.
           - "## Not repaired here": this report is the whole output of a read-only run. No
             plan document was written.
+          - "## Left to another developer or a later run" — only when this list is not
+            empty: findings in a
+            plan this run does not repair — a lane this developer does not work on, for that
+            lane's developer to pick up, or a lane an open change names, re-gated once that
+            change closes: {{other_csv}}
           Return the complete report markdown only.
       - id: readonly_break
         action: break
@@ -623,6 +846,11 @@ workflow:
             invariant routes to /appweaver specify, which authors domain-model.md; a
             `contract` gap is closed in the lane the row names. Then re-run
             /appweaver analyze-plan to clear the report.
+          - "## Left to another developer or a later run" — only when this list is not
+            empty: findings in a
+            plan this run does not repair — a lane this developer does not work on, for that
+            lane's developer to pick up, or a lane an open change names, re-gated once that
+            change closes: {{other_csv}}
           Return the complete report markdown only.
       - id: skip_break
         action: break
@@ -640,7 +868,7 @@ workflow:
       - id: be_repair_flag
         condition: "{{backend_repair}} == true"
         action: set
-        vars: { be_repair: "{{be_present}}" }
+        vars: { be_repair: "{{be_may_repair}}" }
       - id: be_repair_last_pass
         condition: "{{repairs_left}} == false"
         action: set
@@ -651,7 +879,7 @@ workflow:
       - id: fe_repair_flag
         condition: "{{frontend_repair}} == true"
         action: set
-        vars: { fe_repair: "{{fe_present}}" }
+        vars: { fe_repair: "{{fe_may_repair}}" }
       - id: fe_repair_last_pass
         condition: "{{repairs_left}} == false"
         action: set
@@ -680,6 +908,13 @@ workflow:
             leave it open and add a DA-n saying it routes to /appweaver specify.
           - CONTRACT gaps whose lane is `backend`: PUBLISH the missing surface in the API
             section as field shapes, so the frontend plan has something real to bind to.
+          - ANSWER EVERY OPEN CONTRACT REQUEST: {{req_backend_text}}. Record each in the API
+            section's "Requests from the frontend lane" table (| Request | Outcome |
+            Operation id | Why |; add the table if there is none): PUBLISH it as an endpoint,
+            under the operation id it proposes unless that clashes with one already in use,
+            or DECLINE it with the reason — a request the spec gives no basis for is
+            declined as a spec gap for /appweaver specify, never published on a guess.
+            Keep every row the table already has.
           - REMOVE, or move to a DA-n assumption, any plan element with no spec basis —
             never keep a plan that exceeds or contradicts the spec. EXCEPTION: do NOT
             remove a cross-cutting element that is (or may be) mandated by the technical
@@ -694,6 +929,8 @@ workflow:
             CN-/DC-/IC-". (The gate will stop and direct the user to specify.)
           - Keep the Traceability section in sync. Preserve every already-conformant
             section VERBATIM. Do NOT change the spec, the domain model or the frontend plan.
+            Close only the gaps whose lane is `backend`; a frontend gap is not this
+            document's.
           Return the COMPLETE updated backend-plan.md content only.
 
       - id: repair_frontend
@@ -718,8 +955,13 @@ workflow:
             published surface (in context). CITE it; do not restate, re-derive or
             contradict it, and introduce NO server-side behaviour or persistence
             assumption. A capability the experience needs that the surface does not offer
-            stays under "Contract deltas needed" — it is the service lane's to publish,
-            never a client-side workaround.
+            is a CONTRACT REQUEST in §5's "Contract deltas needed" table — a new RQ-n, the
+            operation id it proposes, what it sends and receives, the spec ids it serves —
+            and the binding row that needs it cites that id; it is the service lane's to
+            publish, never a client-side workaround. Keep every request with its id.
+          - THE BACKEND'S ANSWERS: {{req_frontend_text}}. Re-bind every binding row of an
+            answered request to the operation id the backend gave it; plan around a
+            declined one, or log a DA-n routing the need to /appweaver specify.
           - Use the domain model's UBIQUITOUS LANGUAGE exactly in labels, states and
             messages, and cite BR-nnn rather than restating a rule. DO NOT EDIT
             domain-model.md or backend-plan.md.
@@ -740,21 +982,55 @@ workflow:
   # EVERY MASTER RUN LEAVES ONE, and it is written BEFORE the stop below, so a red run
   # records its `gaps` verdict too and implement refuses it. A REPORT-mode run leaves
   # none: it checked the masters while a delta was in flight, and they are about to move.
+  #
+  # ONE RECEIPT PER MASTER-MODE LANE, each with that lane's own verdict, so the two lanes'
+  # implement runs never refuse each other. A lane read but not gated gets none from this
+  # run, and neither does a lane an open change names: it was checked in report mode.
   - id: flag_receipt
     condition: "{{may_repair}} == true"
     action: set
     vars: { stamp_receipt: "true" }
-
-  - id: plan_gate_stamp
+  - id: flag_receipt_be
+    condition: "{{stamp_receipt}} == true"
+    action: set
+    vars: { stamp_be: "{{be_may_repair}}" }
+  - id: flag_receipt_fe
     condition: "{{stamp_receipt}} == true"
+    action: set
+    vars: { stamp_fe: "{{fe_may_repair}}" }
+
+  # THE DRAFT, redrawn from the backend plan as this run leaves it — a repair may have
+  # published an endpoint or answered a request. Master mode only, like the receipt, and
+  # only for a gated backend plan. Advisory: it never fails the gate.
+  - id: contract_draft
+    condition: "{{stamp_be}} == true"
+    action: execute_script
+    on_error: continue
+    script: { ref: actions }
+    subcommand: contract-draft
+    args: ["--feature-dir", "{{feature_dir}}"]
+    outputs:
+      - { name: draft_path, from: "$.path" }
+
+  - id: plan_gate_stamp_backend
+    condition: "{{stamp_be}} == true"
+    action: execute_script
+    script: { ref: actions }
+    subcommand: plan-gate-stamp
+    args: ["--feature-dir", "{{feature_dir}}", "--lane", "backend", "--spec-version", "{{version}}", "--mode", "{{gate_mode}}", "--verdict", "{{be_verdict}}", "--plan-gaps", "{{be_plan_gaps}}", "--routed", "{{be_routed}}"]
+    outputs:
+      - { name: be_receipt,    from: "$.file" }
+      - { name: receipt_gated, from: "$.gated" }
+
+  - id: plan_gate_stamp_frontend
+    condition: "{{stamp_fe}} == true"
     action: execute_script
     script: { ref: actions }
     subcommand: plan-gate-stamp
-    args: ["--feature-dir", "{{feature_dir}}", "--spec-version", "{{version}}", "--mode", "{{gate_mode}}", "--verdict", "{{gate_verdict}}", "--plan-gaps", "{{plan_gap_count}}", "--routed", "{{routed_gaps}}"]
+    args: ["--feature-dir", "{{feature_dir}}", "--lane", "frontend", "--spec-version", "{{version}}", "--mode", "{{gate_mode}}", "--verdict", "{{fe_verdict}}", "--plan-gaps", "{{fe_plan_gaps}}", "--routed", "{{fe_routed}}"]
     outputs:
-      - { name: receipt_file,  from: "$.file" }
+      - { name: fe_receipt,    from: "$.file" }
       - { name: receipt_gated, from: "$.gated" }
-      - { name: receipt_count, from: "$.count" }
 
   # THE STOP IS MASTER MODE'S ALONE, and only a PLAN gap triggers it. Two independent
   # raises, because the two reasons to pass are unrelated: no gap is left that a plan
@@ -775,7 +1051,7 @@ workflow:
     action: verify_context
     require_true: gate_ok
     on_false: stop
-    on_false_message: "The lane plans do not conform to the spec: {{plan_gap_count}} gap(s) a plan rewrite closes are still open (all gaps: {{analyze_gaps}}). Either you chose `Report and Skip`, in which case plan-analyze-report.md beside the plans lists them — or repair ran up to three times and the fourth pass, which checks and does not rewrite, still found these. Every gap above was read off the plans as they stand on disk now. The receipt records verdict `gaps`, so /appweaver implement will refuse until this gate is re-run clean. A `contract` gap is closed in the lane its row names. Gaps routed to `specify` ({{routed_csv}}) are not what stopped this run: they need /appweaver specify, which authors the spec and the model. Fix out of band, or re-run and choose Repair."
+    on_false_message: "The plans of your working lane `{{working_lane}}` do not conform to the spec: {{plan_gap_count}} gap(s) a plan rewrite closes are still open (all gaps: {{analyze_gaps}}). Either you chose `Report and Skip`, in which case plan-analyze-report.md beside the plans lists them — or repair ran up to three times and the fourth pass, which checks and does not rewrite, still found these. Every gap above was read off the plans as they stand on disk now. Each gated lane's receipt records its own verdict, so /appweaver implement refuses a lane left with `gaps` until this gate is re-run clean, and generates a lane that passed. A `contract` gap is closed in the lane its row names. Gaps routed to `specify` ({{routed_csv}}) are not what stopped this run: they need /appweaver specify, which authors the spec and the model. Fix out of band, or re-run and choose Repair."
 
   # (No change-close here by design — this stage never archives anything in either mode,
   #  and cr-archive belongs to close-delta, which runs after finalize-delta's merge.)
@@ -805,9 +1081,18 @@ outputs:
   plan_gaps: "{{plan_gap_count}}"   # open gaps a plan rewrite closes
   routed_to_specify: "{{routed_csv}}"   # open gaps only /appweaver specify can close
   version: "{{version}}"
-  gate_mode: "{{gate_mode}}"        # master (repair allowed) | report (read-only)
-  open_changes: "{{open_ids}}"      # empty in master mode, by definition
-  gate_receipt: "{{receipt_file}}"  # written by every master run, with its verdict; implement reads it
+  gate_mode: "{{gate_mode}}"        # master (some lane repairable) | report (read-only)
+  backend_mode: "{{be_lane_mode}}"  # master | report (an open change names the backend) | not gated
+  frontend_mode: "{{fe_lane_mode}}"
+  open_changes: "{{open_ids}}"      # every open change on the feature, whichever lanes it names
+  working_lane: "{{working_lane}}"  # the developer's working lane(s) — .appweaver/lane.json
+  gated_backend: "{{be_gated}}"     # checked by this run; repaired and receipted in master mode only
+  gated_frontend: "{{fe_gated}}"
+  backend_receipt: "{{be_receipt}}"   # .aw-plan-gate.backend.json, with the backend's own verdict ({{be_verdict}})
+  frontend_receipt: "{{fe_receipt}}"  # .aw-plan-gate.frontend.json, with the frontend's own verdict ({{fe_verdict}})
   gate_receipt_at: "{{receipt_gated}}"
-  note: "Ran in {{gate_mode}} mode ({{open_count}} change(s) open: {{open_ids}}). Checked: spec→backend-plan ({{be_present}}), spec→frontend-plan ({{fe_present}}), the plan↔plan contract binding ({{both_lanes}} — it needs both lanes) and both plans against domain-model.md. The domain model was READ, never written: a gap that needs a new entity, event or invariant is fixed by /appweaver specify. In REPORT mode no plan was rewritten either — the master plans are derived documents and may not move while a delta is in flight."
-  next: "MASTER mode (no change open, verdict={{gate_verdict}}): /appweaver implement — no gap a plan rewrite closes is left; version unchanged, this gate closes nothing. If the verdict is routed-gaps, implement generates and warns: {{routed_csv}} — each is a spec or model gap, lifted by opening a change with /appweaver specify. REPORT mode (change(s) {{open_ids}} open): this run was read-only and wrote plan-analyze-report.md only. If finalize-delta has already merged, the gaps ARE that merge — the lane plans are derived from spec.md + domain-model.md and finalize-delta moves only those two, so re-derive with /appweaver plan main after /appweaver close-delta, then re-run /appweaver analyze-plan in master mode. If the change has NOT merged yet, gate it where it lives: /appweaver analyze-plan-delta."
+  other_lane_gaps: "{{other_csv}}"   # findings in a plan this run does not repair — another developer's lane, or one an open change names
+  contract_requests: "{{req_summary}}" # the frontend plan's RQ-n requests and the backend plan's answers, as this run left them
+  api_draft: "{{draft_path}}"          # api-draft.json, redrawn from the gated backend plan's API section — commit it with the plan
+  note: "Ran for your working lane `{{working_lane}}` — backend plan: {{be_lane_mode}}; frontend plan: {{fe_lane_mode}} ({{open_count}} change(s) open: {{open_ids}}). A lane is in master mode unless an open change names it on its **Lanes** line. Gated: spec→backend-plan ({{be_gated}}), spec→frontend-plan ({{fe_gated}}), the plan↔plan contract binding ({{both_lanes}} — it needs both plans, and reads the one you do not work on without repairing it) and each gated plan against domain-model.md. {{other_gaps}} finding(s) are in a plan this run does not repair — a lane you do not work on, for its developer, or a lane an open change names — and are reported, not repaired: {{other_csv}}. The domain model was READ, never written: a gap that needs a new entity, event or invariant is fixed by /appweaver specify. A plan in REPORT mode was not rewritten either — a master plan may not move while a delta that names its lane is in flight."
+  next: "MASTER mode (no open change names the lane, verdict={{gate_verdict}}): /appweaver implement — no gap a plan rewrite closes is left; version unchanged, this gate closes nothing. If the verdict is routed-gaps, implement generates and warns: {{routed_csv}} — each is a spec or model gap, lifted by opening a change with /appweaver specify. REPORT mode (an open change names the lane — backend: {{be_open_ids}}; frontend: {{fe_open_ids}}): that lane's plan was checked read-only, and a run with no lane in master mode wrote plan-analyze-report.md only. If finalize-delta has already merged, the gaps ARE that merge — the lane plans are derived from spec.md + domain-model.md and finalize-delta moves only those two, so re-derive with /appweaver plan main after /appweaver close-delta, then re-run /appweaver analyze-plan in master mode. If the change has NOT merged yet, gate it where it lives: /appweaver analyze-plan-delta."