aw-spec-cli 0.1.33 → 0.1.35

package/assets/.appweaver/orchestrator/workflows/aw-spec-analyze-slice.orch.yaml

@@ -24,6 +24,18 @@
 #                  builds green, passes unit tests that construct their subject directly,
 #                  and fails on the first request. Fixed up to 2×.
 #   3. KNOWLEDGE   refresh + review the slice's OKF concept (advisory).
+#   4. TRACEABILITY does a test of the slice NAME every FR- and BR- its plans trace? Green
+#                  tests cannot show a requirement whose test was never written, so each
+#                  working lane's plan is read for its ids and the slice's test files for
+#                  citations. It warns, and the gate fails at the END, like the no-tests case.
+#   5. API         does the built service serve the endpoints its API plan publishes?
+#                  The frontend lane is bound to that API (api-draft.json), so the
+#                  service's as-built document is written the way the lane says and
+#                  compared with it. A planned endpoint not served, or served under another
+#                  route, verb or operation id, fails the gate at the END; a field or status
+#                  code that differs is reported. A lane that sets no way to write the
+#                  document is not checked, and the run says so. A feature whose plan
+#                  names no endpoint is not checked either, and the document is not written.
 # Every fix made here is recorded in that concept, which is also where the slice's
 # file list is READ from (2.3.0 — `aw-xref concept-paths`, replacing the retired
 # `design-paths` scan for ```lang path=… fences that the tech-agnostic backend-plan.md no
@@ -61,9 +73,11 @@
 # gate asks of the whole spec, narrowed to one change's ids and answered while the delta is
 # still the only document that carries them. This gate cannot substitute for it: it is
 # test-driven, and a requirement that was never implemented leaves NO test rather than a
-# failing one, so nothing here fails on it. What this gate does that its twin cannot is
-# score the WHOLE slice, against masters that carry the change, with the fix loops and the
-# referrer blast radius.
+# failing one. Pass 4 catches the part of that a script can see — an FR- or BR- the master
+# plans trace that no test names — but a change's NEW ids reach the master plans only when
+# plan re-derives them, after this gate, so its twin checks those. What this gate does that
+# its twin cannot is score the WHOLE slice, against masters that carry the change, with the
+# fix loops and the referrer blast radius.
 #
 # THE WORKING LANE. Only the lanes the developer on this machine works on (.appweaver/
 # lane.json — select-stack writes the default, select-lane narrows it) are tested, fixed and
@@ -77,8 +91,8 @@
 # =============================================================================
 
 name: aw-spec-analyze-slice
-description: The design↔code conformance gate — run the slice's tests against its acceptance criteria, check the code against the domain gate overlays AND the bounded context's domain-model.md (every invariant the slice's own aggregate section states must be enforced as written; one another aggregate owns is reported, not blocking), verify the change did not break any referring aggregate (the OKF referrer blast radius) and write a triage report before stopping if it did, refresh + review its OKF concept, and record every fix in it. Sits after finalize-delta on the change path, so the two masters it scores against already carry the change, and before close-delta, so a red gate leaves the change open and recoverable.
-version: 2.7.0
+description: The design↔code conformance gate — run the slice's tests against its acceptance criteria, check the code against the domain gate overlays AND the bounded context's domain-model.md (every invariant the slice's own aggregate section states must be enforced as written; one another aggregate owns is reported, not blocking), verify the change did not break any referring aggregate (the OKF referrer blast radius) and write a triage report before stopping if it did, refresh + review its OKF concept, record every fix in it, and check that a test of the slice names every FR- and BR- its lane plans trace (a requirement whose test was never written leaves the suite green; a reverse-engineered plan's gaps are reported, not blocking), and check that the built service serves every endpoint its API plan publishes — the frontend lane is bound to the plan, never to the running service — by writing the service's as-built API document the way the lane says and comparing the two (a missing or moved endpoint fails; a differing field is reported). Sits after finalize-delta on the change path, so the two masters it scores against already carry the change, and before close-delta, so a red gate leaves the change open and recoverable.
+version: 2.11.0
 agent_agnostic: true
 dialect: aw-spec.orchestrator/v1
 
@@ -157,6 +171,46 @@ vars:
   # readable in the outputs even when a step is skipped or errors out.
   okf_ok: "unknown"
   okf_orphans: "0"
+  # Pass 4 (traceability). A lane votes into trace_ok only when it is worked, and its vote
+  # is its check's own `ok` — a check that never answered votes not met.
+  fe_working: "false"
+  be_test_path: ""
+  fe_source_path: ""
+  fe_test_path: ""
+  frontend_plan: ""
+  be_trace_ok: "false"
+  be_trace_clean: "false"
+  be_trace_warning: ""
+  be_untraced: "not checked — no backend lane is worked here"
+  be_trace_vote: "true"
+  fe_trace_ok: "false"
+  fe_trace_clean: "false"
+  fe_trace_warning: ""
+  fe_untraced: "not checked — no frontend lane is worked here"
+  fe_trace_vote: "true"
+  trace_ok: "false"
+  # Pass 5 — the API check of the service lane. A refusing default for the verdict: it is
+  # raised to the check's `ok` only when the check ran, and stays "true" when this
+  # developer does not work on the service lane or the lane sets no way to write its
+  # document — both of which warn instead — or the plan names no endpoint to check.
+  api_needed: "false"          # contract-verify --check: the plan names something to check
+  api_plan_note: ""            # why it names nothing, when it does not
+  api_way: ""
+  api_doc: ""
+  api_placeholder: ""
+  api_export_ok: "false"
+  api_export_reason: ""
+  api_export_log: ""
+  api_has_way: "true"
+  api_export_vote: "true"
+  api_export_clean: "true"
+  api_ok: ""
+  api_checked: "false"
+  api_issues: "not checked — no as-built API document was written in this run"
+  api_warning: ""
+  api_note: ""
+  api_clean: "true"
+  api_vote: "true"
 
 workflow:
 
@@ -181,6 +235,7 @@ workflow:
       - { name: feature_dir,  from: "$.feature_dir" }
       - { name: spec_file,    from: "$.spec_file" }
       - { name: backend_plan, from: "$.backend_plan" }   # the ports + §4.3 wiring the composition pass reads
+      - { name: frontend_plan, from: "$.frontend_plan" } # its §7 Traceability, read by pass 4
 
   - id: require_feature
     action: verify_context
@@ -270,6 +325,10 @@ workflow:
       - { name: working_root,      from: "$.working_root" }
       - { name: working_test_path, from: "$.working_test_path" }
       - { name: be_working,        from: "$.backend_working" }
+      - { name: fe_working,        from: "$.frontend_working" }
+      - { name: be_test_path,      from: "$.backend_test_path" }
+      - { name: fe_source_path,    from: "$.frontend_source_path" }
+      - { name: fe_test_path,      from: "$.frontend_test_path" }
 
   # The slice's source files, from its OKF concept — the context all three passes below
   # work over (test fix loop, integrity triage, conformance). `--under` keeps the working
@@ -444,13 +503,38 @@ workflow:
   # forbidden-patterns / refusal conditions / CI gates). The overlays load as the
   # checklist — VALIDATION only, never an authoring input to feature code. No-op for a
   # non-domain project. Fix violations (bounded 2×); the gate stops if any remain.
+  # A non-domain project's map holds the heading with a `_None_` line; a map with no such
+  # heading, or one naming a file that is not on disk, warns and carries on.
   - id: resolve_gate_overlays
     action: execute_script
     script: { ref: actions }
     subcommand: resolve-domain
     args: ["--command", "aw-spec-gate"]
     outputs:
-      - { name: gate_overlays, from: "$.candidates" }
+      - { name: gate_overlays,      from: "$.candidates" }
+      - { name: gate_domain,        from: "$.domain" }
+      - { name: gate_map_exists,    from: "$.rulemap_exists" }
+      - { name: gate_heading_found, from: "$.heading_found" }
+      - { name: gate_missing,       from: "$.missing" }
+  - id: gate_flags
+    action: set
+    vars: { gate_all_on_disk: "true" }
+  - id: gate_flag_missing
+    condition: "{{gate_missing}} != []"
+    action: set
+    vars: { gate_all_on_disk: "false" }
+  - id: warn_gate_heading
+    condition: "{{gate_map_exists}} == true"
+    action: verify_context
+    require_true: gate_heading_found
+    on_false: continue
+    on_false_message: "WARNING — guardrails/{{gate_domain}}/domain-rule-bindings.md has no `## /aw-spec-gate` heading, so the code is checked against no domain checklist. If that is not intended, add the heading and its overlay files — it must read exactly `## /aw-spec-gate`; a project with no checklist keeps the heading with a `_None_` line."
+  - id: warn_gate_missing
+    condition: "{{gate_map_exists}} == true"
+    action: verify_context
+    require_true: gate_all_on_disk
+    on_false: continue
+    on_false_message: "WARNING — guardrails/{{gate_domain}}/domain-rule-bindings.md maps these checklist files under `## /aw-spec-gate`, but they are not on disk, so the code was not checked against them: {{gate_missing}}. Correct the paths, or add the files."
   - id: load_gate_overlays
     action: load_standards
     files_from_variable: gate_overlays
@@ -806,10 +890,187 @@ workflow:
       - { name: okf_ok,      from: "$.ok" }
       - { name: okf_orphans, from: "$.orphan_count" }
 
-  # THE LAST GATE — a slice with no tests fails HERE, not at PASS 1, so everything the
-  # other passes found has already been reported and any fix they made is on disk. It sits
-  # before the after-hooks, because an extension wired to `after_analyze_slice` runs on a
-  # slice this gate has passed.
+  # ═══════ PASS 4 — TRACEABILITY: does a test name every requirement the plans trace? ═══════
+  # Green tests prove that what was written works; they cannot show what was never written.
+  # A requirement whose paired test was never generated leaves the suite green, so each
+  # working lane's plan is read for the FR- and BR- ids its Traceability section traces, and
+  # the slice's TEST files for each one — the concept's list plus every file the fix loops
+  # above wrote, which is why this pass runs last: a test the conformance pass added counts.
+  # A citation is the id in a test's name, a comment, an attribute or a tag (`FR-004`,
+  # `FR_004`, `FR004`). FR numbers restart in every feature, so only this slice's tests are
+  # read; a concept that lists none falls back to every test under the lane's test path.
+  # Two readings are kept apart from a gap: a plan adopt reverse-engineered is REPORTED and
+  # never blocks (its legacy tests predate the spec ids), and an id the plan still traces
+  # that spec.md or the model no longer defines — a change removed it and plan has not
+  # re-derived the master plan yet — is stale, not required. Like the no-tests case it warns
+  # here and fails at the end, after everything else has reported. What it proves is that
+  # each requirement has a test that NAMES it, not that the test asserts what it says.
+  - id: trace_backend
+    condition: "{{be_working}} == true"
+    action: execute_script
+    on_error: continue
+    script: { ref: actions }
+    subcommand: test-citations
+    args: ["--plan", "{{backend_plan}}", "--kind", "backend", "--paths", "{{all_paths}}", "--paths", "{{fixed_files}}", "--paths", "{{conformance_fixes}}", "--paths", "{{wiring_fixes}}", "--source-path", "{{be_source_path}}", "--test-path", "{{be_test_path}}", "--spec", "{{spec_file}}", "--model", "{{domain_model}}"]
+    outputs:
+      - { name: be_trace_ok,      from: "$.ok" }
+      - { name: be_trace_clean,   from: "$.clean" }
+      - { name: be_trace_warning, from: "$.warning" }
+      - { name: be_untraced,      from: "$.uncited_text" }
+  - id: warn_trace_backend
+    condition: "{{be_working}} == true"
+    action: verify_context
+    require_true: be_trace_clean
+    on_false: continue
+    on_false_message: "{{be_trace_warning}}"
+  - id: trace_frontend
+    condition: "{{fe_working}} == true"
+    action: execute_script
+    on_error: continue
+    script: { ref: actions }
+    subcommand: test-citations
+    args: ["--plan", "{{frontend_plan}}", "--kind", "frontend", "--paths", "{{all_paths}}", "--paths", "{{fixed_files}}", "--paths", "{{conformance_fixes}}", "--source-path", "{{fe_source_path}}", "--test-path", "{{fe_test_path}}", "--spec", "{{spec_file}}", "--model", "{{domain_model}}"]
+    outputs:
+      - { name: fe_trace_ok,      from: "$.ok" }
+      - { name: fe_trace_clean,   from: "$.clean" }
+      - { name: fe_trace_warning, from: "$.warning" }
+      - { name: fe_untraced,      from: "$.uncited_text" }
+  - id: warn_trace_frontend
+    condition: "{{fe_working}} == true"
+    action: verify_context
+    require_true: fe_trace_clean
+    on_false: continue
+    on_false_message: "{{fe_trace_warning}}"
+
+  # trace_ok = every worked lane's check passed — a raise and two knock-downs, each lane
+  # voting only when it is worked.
+  - id: be_trace_vote_set
+    condition: "{{be_working}} == true"
+    action: set
+    vars: { be_trace_vote: "{{be_trace_ok}}" }
+  - id: fe_trace_vote_set
+    condition: "{{fe_working}} == true"
+    action: set
+    vars: { fe_trace_vote: "{{fe_trace_ok}}" }
+  - id: trace_seed
+    action: set
+    vars: { trace_ok: "true" }
+  - id: trace_clear_backend
+    condition: "{{be_trace_vote}} != true"
+    action: set
+    vars: { trace_ok: "false" }
+  - id: trace_clear_frontend
+    condition: "{{fe_trace_vote}} != true"
+    action: set
+    vars: { trace_ok: "false" }
+
+  # ═══════ PASS 5 — API: does the built service serve what its API plan publishes? ═══════
+  # The frontend lane binds to the API plan — api-draft.json, drafted by script from
+  # api-plan.md, or from the backend plan's API section for a feature planned before API
+  # plans existed — and never to the running service, so the code is held to the plan here.
+  # The service's as-built document is written the way the lane says (contract-export:
+  # `contract_write`, or `contract_run` + `contract`), after every fix loop above, to the
+  # lane's contracts/openapi.json, and compared with the operations THIS feature's API plan
+  # names, plus a change merged into spec.md and not closed yet (contract-verify).
+  # finalize-delta merges such a change into api-plan.md as well, and applying it again over
+  # the merged plan changes nothing. Runs for the developer who works on the service lane;
+  # the frontend developer's run never starts it.
+  #
+  # ONLY WHEN THERE IS SOMETHING TO CHECK. contract-verify --check reads what the check
+  # would (the draft and the merged, open changes) without the as-built document; a
+  # feature that plans no endpoint — a worker, a batch job, domain logic only — never runs
+  # the lane's export or its warnings. Only an explicit `needed: false` skips: a check that
+  # does not answer leaves the export armed.
+  - id: api_plan_check
+    condition: "{{be_working}} == true"
+    action: execute_script
+    on_error: continue
+    script: { ref: actions }
+    subcommand: contract-verify
+    args: ["--feature-dir", "{{feature_dir}}", "--check"]
+    outputs:
+      - { name: api_needed,    from: "$.needed" }
+      - { name: api_plan_note, from: "$.note" }
+  - id: api_nothing_to_check
+    condition: "{{api_plan_note}} != "
+    action: set
+    vars: { api_issues: "{{api_plan_note}}" }
+  - id: api_export
+    condition: "{{api_needed}} != false"
+    action: execute_script
+    on_error: continue
+    script: { ref: actions }
+    subcommand: contract-export
+    outputs:
+      - { name: api_export_ok,     from: "$.ok" }
+      - { name: api_way,           from: "$.way" }
+      - { name: api_export_reason, from: "$.reason" }
+      - { name: api_export_log,    from: "$.log_tail" }
+      - { name: api_doc,           from: "$.doc" }
+      - { name: api_placeholder,   from: "$.placeholder" }
+  - id: api_no_way_flag
+    condition: "{{api_way}} == none"
+    action: set
+    vars: { api_has_way: "false" }
+  - id: warn_api_no_way
+    condition: "{{api_needed}} != false"
+    action: verify_context
+    require_true: api_has_way
+    on_false: continue
+    on_false_message: "API NOT CHECKED — {{api_export_reason}}. The frontend lane binds to the endpoints the API plan publishes (api-draft.json); without the service's as-built document nothing checks that the code serves them. `contract_write` is any command that writes the service's OpenAPI document to the path {{api_placeholder}} stands for — the stack's own generator, or a script that loads the application and dumps its document — with no server started."
+  # An export that was attempted and failed — a no-way lane has already been told.
+  - id: api_export_vote_set
+    condition: "{{api_needed}} != false"
+    action: set
+    vars: { api_export_vote: "{{api_export_ok}}" }
+  - id: api_export_failed
+    condition: "{{api_export_vote}} != true"
+    action: set
+    vars: { api_export_clean: "false" }
+  - id: api_export_no_way
+    condition: "{{api_has_way}} == false"
+    action: set
+    vars: { api_export_clean: "true" }
+  - id: warn_api_export
+    condition: "{{api_needed}} != false"
+    action: verify_context
+    require_true: api_export_clean
+    on_false: continue
+    on_false_message: "API NOT CHECKED — the service's as-built API document could not be written: {{api_export_reason}}. The code compiled and its tests ran; the way the lane writes its document is what failed. Correct `contract_write` (or `contract_run` / `contract`) on the service lane in .appweaver/stacks.json, start anything it needs, and re-run analyze-slice. Output: {{api_export_log}}"
+  - id: api_verify
+    condition: "{{api_export_ok}} == true"
+    action: execute_script
+    on_error: continue
+    script: { ref: actions }
+    subcommand: contract-verify
+    args: ["--feature-dir", "{{feature_dir}}"]
+    outputs:
+      - { name: api_ok,      from: "$.ok" }
+      - { name: api_checked, from: "$.checked" }
+      - { name: api_issues,  from: "$.issues_text" }
+      - { name: api_warning, from: "$.warning" }
+      - { name: api_note,    from: "$.note" }
+  - id: api_warning_flag
+    condition: "{{api_warning}} != "
+    action: set
+    vars: { api_clean: "false" }
+  - id: warn_api_fields
+    condition: "{{api_export_ok}} == true"
+    action: verify_context
+    require_true: api_clean
+    on_false: continue
+    on_false_message: "{{api_warning}}"
+  - id: api_vote_set
+    condition: "{{api_export_ok}} == true"
+    action: set
+    vars: { api_vote: "{{api_ok}}" }
+
+  # THE LAST THREE GATES — a slice with no tests fails HERE, not at PASS 1, and one whose
+  # tests leave a requirement unnamed fails at the next, and one whose service does not serve
+  # its plan's API at the last, so everything the other passes
+  # found has already been reported and any fix they made is on disk. They sit before the
+  # after-hooks, because an extension wired to `after_analyze_slice` runs on a slice these
+  # gates have passed.
   - id: untested_gate
     action: verify_context
     require_true: tests_present
@@ -826,6 +1087,38 @@ workflow:
       lane declares — or, if the tests exist, name them so each carries its aggregate's
       name, which is what the slice filter selects on. Then re-run /appweaver analyze-slice.
 
+  # THE TRACEABILITY GATE — pass 4's verdict, last for the same reason as the one above.
+  - id: untraced_gate
+    action: verify_context
+    require_true: trace_ok
+    on_false: stop
+    on_false_message: >
+      The slice's tests are green, but they do not name every requirement its plans trace —
+      so a requirement whose test was never written passes here unchecked. Named by no test:
+      backend — {{be_untraced}}; frontend — {{fe_untraced}}. Everything above ran and
+      passed (domain conformance={{conformance_ok}}, composition={{wiring_ok}}). Run
+      /appweaver fix-test-coverage: it writes a test for each id, or names the id in the
+      test that already exercises it (`FR-004`, `FR_004` or `FR004` in its name, a comment,
+      an attribute or a tag), and never touches production code. Then re-run
+      /appweaver analyze-slice.
+
+  # THE API GATE — pass 5's verdict.
+  - id: api_gate
+    action: verify_context
+    require_true: api_vote
+    on_false: stop
+    on_false_message: >
+      The slice's tests are green, but the built service does not serve what the API plan
+      publishes — and the frontend lane is bound to it: {{api_issues}}. Everything
+      above ran and passed (domain conformance={{conformance_ok}},
+      composition={{wiring_ok}}, traceability={{trace_ok}}). Make the code serve each
+      endpoint at the route, verb and operation id the API plan states — /appweaver
+      implement generates what it names — then /appweaver build and re-run /appweaver
+      analyze-slice. Where the API plan is what is wrong, correct it with /appweaver plan,
+      then analyze-plan: that redraws the contract, and the frontend lane re-checks against
+      it. On a change that is open and not merged yet, run /appweaver analyze-slice-delta
+      <CR-id> instead — this gate checks the master API plan, plus a change already merged.
+
   - id: resolve_post_hooks
     action: execute_script
     script: { ref: actions }
@@ -861,6 +1154,19 @@ outputs:
   # nothing on this run, and the gate failed at the end saying so.
   tests_present: "{{tests_present}}"
   tests_matched: "{{test_matched}}"
+  # Pass 4: the FR-/BR- ids each worked lane's plan traces that no test of the slice names —
+  # `none` when every one is named. A reverse-engineered plan's are reported, never blocking.
+  traceability_ok: "{{trace_ok}}"
+  backend_untraced: "{{be_untraced}}"
+  frontend_untraced: "{{fe_untraced}}"
+  # Pass 5: what the built service serves vs what the API plan publishes. `api_checked`
+  # false means no as-built document was written — the lane sets no way, or it failed, and
+  # the run warned — or the plan names no endpoint, which `backend_api_issues` then says;
+  # `api_issues` is `none` when every planned endpoint is served as planned.
+  api_ok: "{{api_vote}}"
+  api_checked: "{{api_checked}}"
+  backend_api_issues: "{{api_issues}}"
+  api_document: "{{api_doc}}"   # the as-built document, when api_checked — commit it with the service
   referrer_count: "{{referrer_count}}"
   referrer_blast_radius: "{{referrer_names}}"
   okf_concept: "{{okf_concept}}"

package/assets/.appweaver/orchestrator/workflows/aw-spec-build.orch.yaml

@@ -36,18 +36,17 @@
 # and its fix loop is never handed the frontend's files. With the default (every declared
 # lane) every lane is compiled, as before.
 #
-# 1.5.0 — THE BACKEND PUBLISHES ITS API DOCUMENT. After a green compile, a developer who
-# works on the service lane exports its API document again (contract-export: start the
-# service, save what it serves under contracts/ in its lane root folder, stop it), so the
-# committed document follows the fixes this loop made. The frontend lane reads that
-# document and never starts the service. A failed export warns and the build stays green.
+# NO API DOCUMENT IS WRITTEN HERE. The contract between the lanes is the API plan's draft
+# (api-draft.json), and the service's as-built document is written and checked
+# against it by analyze-slice, after its own fix loops — so it reflects the code that gate
+# passes, not the code this loop left.
 #
 # Launch:  /appweaver build [strategy]
 # =============================================================================
 
 name: aw-spec-build
-description: Compile the feature by running the build command of every lane the developer works on (.appweaver/lane.json — every declared lane by default), fix compile errors against the design intent, then record the touched files in the slice's knowledge concept; a developer who works on the service lane then re-exports its API document (contracts/openapi.json), which the frontend lane reads from the commit. Backend-only, frontend-only and full-stack projects all compile here — the gate requires a lane declaration, not a lane of a particular kind. Loads TECHNICAL rules only (tech-rule-bindings) — no domain rules reach this stage.
-version: 1.5.0
+description: Compile the feature by running the build command of every lane the developer works on (.appweaver/lane.json — every declared lane by default), fix compile errors against the design intent, then record the touched files in the slice's knowledge concept. Backend-only, frontend-only and full-stack projects all compile here — the gate requires a lane declaration, not a lane of a particular kind. Loads TECHNICAL rules only (tech-rule-bindings) — no domain rules reach this stage.
+version: 1.6.0
 agent_agnostic: true
 dialect: aw-spec.orchestrator/v1
 
@@ -73,13 +72,6 @@ vars:
   working_kind: ""        # one kind when the developer works on one lane of two, else empty — every declared lane
   working_root: ""
   working_test_path: ""
-  be_working: "false"     # the service lane is declared and this developer works on it — it publishes the API document
-  contract_ok: ""
-  export_doc: ""
-  contract_reason: ""
-  contract_log: ""
-  contract_already: "false"
-  contract_fresh: "true"
 
 workflow:
 
@@ -192,38 +184,6 @@ workflow:
     on_false: stop
     on_false_message: "Build still failing after 3 fix attempts. Last log: {{build_log}}"
 
-  # THE API DOCUMENT, published from the code that just compiled — by the developer who
-  # works on the service lane, so the frontend developer reads it from the commit instead of
-  # starting the service. Advisory: a failed export warns and the build stays green.
-  - id: contract_export
-    condition: "{{be_working}} == true"
-    action: execute_script
-    on_error: continue
-    script: { ref: actions }
-    subcommand: contract-export
-    outputs:
-      - { name: contract_ok,      from: "$.ok" }
-      - { name: export_doc,       from: "$.doc" }
-      - { name: contract_reason,  from: "$.reason" }
-      - { name: contract_already, from: "$.already_running" }
-      - { name: contract_log,     from: "$.log_tail" }
-  - id: warn_contract_export
-    condition: "{{be_working}} == true"
-    action: verify_context
-    require_true: contract_ok
-    on_false: continue
-    on_false_message: "API DOCUMENT NOT EXPORTED — {{contract_reason}}. The build is green; only the published document is out of date. The service lane is started with its `contract_run` command and its document fetched from its `contract` URL, both read from .appweaver/stacks.json or else its stack profile — correct them there, start anything the service needs, and re-run build. Service output: {{contract_log}}"
-  - id: contract_stale_flag
-    condition: "{{contract_already}} == true"
-    action: set
-    vars: { contract_fresh: "false" }
-  - id: warn_contract_stale
-    condition: "{{be_working}} == true"
-    action: verify_context
-    require_true: contract_fresh
-    on_false: continue
-    on_false_message: "WARNING — the API document was {{contract_reason}}. Stop that service and re-run build to export the code as it is now."
-
   # Record what the fix loop touched in the slice's OKF concept. This replaces the retired
   # `design-reconcile` step, which copied on-disk file bodies back into the design doc's
   # path-tagged fences — meaningless now that backend-plan.md describes contracts, not code (and
@@ -263,5 +223,4 @@ outputs:
   # (a file moved or deleted without re-running the owning slice). Advisory, never gated.
   stale_source_files: "{{paths_missing}}"
   working_lane: "{{working_lane}}"   # the lane(s) compiled — .appweaver/lane.json
-  api_document: "{{export_doc}}"     # the service's API document, exported after the green compile — commit it for the frontend lane
   next: "/appweaver analyze-slice"