intentdna 1.8.3 → 1.8.5

package/dist/runtime/verifier.js

@@ -3,6 +3,9 @@ import { readFile, realpath, stat } from "node:fs/promises";
 import { dirname, isAbsolute, relative, resolve } from "node:path";
 export const DEFAULT_VERIFIER_COMMAND_TIMEOUT_MS = 30_000;
 export const MAX_VERIFIER_EVIDENCE_BYTES = 4096;
+export const VERIFIER_DIAGNOSTIC_PREFIX = "INTENTDNA_DIAGNOSTIC:";
+export const MAX_VERIFIER_DIAGNOSTIC_BYTES = 2048;
+const VERIFIER_DIAGNOSTIC_CODE = /^INTENTDNA_DIAGNOSTIC:[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$/;
 const SAFE_COMMAND_VARIABLE_RE = /^[A-Za-z0-9_-]+$/;
 const SAFE_PATH_VARIABLE_RE = /^[-A-Za-z0-9_./]+$/;
 export function resolveVerifierTemplate(template, variables) {
@@ -59,7 +62,7 @@ function resolveVerifierCommand(rawCommand, policy, variables) {
         return { target: declaredCommand, evidence: "policy_denied", exit_code: 126, message: verifierCommandPolicyMessage(declaredCommand) };
     }
     const safeVariables = validateVerifierTemplateVariables(declaredCommand, variables, "command");
-    if (!safeVariables.valid) {
+    if (safeVariables.valid === false) {
         return { target: declaredCommand, evidence: safeVariables.evidence, exit_code: 126, message: safeVariables.message };
     }
     const command = resolveVerifierTemplate(declaredCommand, variables).trim();
@@ -137,8 +140,8 @@ export function isVerifierCommandAllowed(policy, command) {
         return false;
     return policy.allow_command_prefixes?.some((prefix) => normalized.startsWith(prefix)) ?? false;
 }
-export function verifierCommandPolicyMessage(command) {
-    return `Verifier command not allowed by verifier_policy: ${command}`;
+export function verifierCommandPolicyMessage(_command) {
+    return "Verifier command not allowed by verifier_policy";
 }
 export function isBuiltinAssertAllowed(policy, assertName) {
     return policy?.allow_builtin_asserts?.includes(assertName) ?? false;
@@ -156,12 +159,52 @@ export function trimVerifierEvidence(raw) {
         ? trimmed.slice(0, MAX_VERIFIER_EVIDENCE_BYTES)
         : trimmed;
 }
+function sanitizeVerifierDiagnosticLine(raw) {
+    return raw
+        .replace(/[\u0000-\u0008\u000B\u000C\u000D\u000E-\u001F\u007F]/g, "")
+        .trim();
+}
+function trimDiagnosticBytes(raw) {
+    const marker = "...[truncated]";
+    if (Buffer.byteLength(raw, "utf8") <= MAX_VERIFIER_DIAGNOSTIC_BYTES)
+        return raw;
+    let trimmed = raw;
+    while (trimmed.length > 0 && Buffer.byteLength(`${trimmed}${marker}`, "utf8") > MAX_VERIFIER_DIAGNOSTIC_BYTES) {
+        trimmed = trimmed.slice(0, -1);
+    }
+    return `${trimmed}${marker}`;
+}
+function extractVerifierDiagnostics(raw) {
+    return raw
+        .split(/\r?\n/)
+        .map((line) => sanitizeVerifierDiagnosticLine(line))
+        .filter((line) => VERIFIER_DIAGNOSTIC_CODE.test(line));
+}
+function collectVerifierDiagnostics(pendingLine, chunk, diagnostics) {
+    const lines = `${pendingLine}${chunk}`.split("\n");
+    const nextPendingLine = lines.pop() ?? "";
+    diagnostics.push(...extractVerifierDiagnostics(lines.join("\n")));
+    return nextPendingLine.length > MAX_VERIFIER_EVIDENCE_BYTES
+        ? nextPendingLine.slice(0, MAX_VERIFIER_EVIDENCE_BYTES)
+        : nextPendingLine;
+}
+function summarizeCommandEvidenceFromStats(stdoutBytes, stderrBytes, diagnostics = []) {
+    const summary = stdoutBytes === 0 && stderrBytes === 0
+        ? undefined
+        : `stdout_bytes=${stdoutBytes} stderr_bytes=${stderrBytes}`;
+    const diagnostic = diagnostics.length > 0
+        ? trimDiagnosticBytes(diagnostics.join("\n"))
+        : undefined;
+    return trimVerifierEvidence([summary, diagnostic].filter(Boolean).join("\n"));
+}
 export function summarizeCommandEvidence(stdout, stderr) {
     const stdoutBytes = Buffer.byteLength(stdout, "utf8");
     const stderrBytes = Buffer.byteLength(stderr, "utf8");
-    if (stdoutBytes === 0 && stderrBytes === 0)
-        return undefined;
-    return trimVerifierEvidence(`stdout_bytes=${stdoutBytes} stderr_bytes=${stderrBytes}`);
+    return summarizeCommandEvidenceFromStats(stdoutBytes, stderrBytes, extractVerifierDiagnostics(`${stdout}\n${stderr}`));
+}
+function appendFailureDiagnostic(message, evidence) {
+    const diagnostics = extractVerifierDiagnostics(evidence ?? "").join("\n");
+    return diagnostics ? `${message}\n${diagnostics}` : message;
 }
 export async function execVerifierCommand(projectDir, command, timeoutMs = DEFAULT_VERIFIER_COMMAND_TIMEOUT_MS, env) {
     return new Promise((resolvePromise) => {
@@ -170,9 +213,12 @@ export async function execVerifierCommand(projectDir, command, timeoutMs = DEFAU
             stdio: ["ignore", "pipe", "pipe"],
             env: { ...process.env, ...(env ?? {}) },
         });
-        let stdout = "";
-        let stderr = "";
+        let stdoutPendingLine = "";
+        let stderrPendingLine = "";
+        let stdoutBytes = 0;
+        let stderrBytes = 0;
         let settled = false;
+        const diagnostics = [];
         const settle = (result) => {
             if (settled)
                 return;
@@ -183,29 +229,36 @@ export async function execVerifierCommand(projectDir, command, timeoutMs = DEFAU
         const timeoutId = setTimeout(() => {
             child.kill("SIGTERM");
             setTimeout(() => child.kill("SIGKILL"), 1000).unref();
-            settle({ passed: false, timedOut: true, exitCode: 124, evidence: summarizeCommandEvidence(stdout, stderr) });
+            diagnostics.push(...extractVerifierDiagnostics(`${stdoutPendingLine}\n${stderrPendingLine}`));
+            settle({ passed: false, timedOut: true, exitCode: 124, evidence: summarizeCommandEvidenceFromStats(stdoutBytes, stderrBytes, diagnostics) });
         }, timeoutMs);
         child.stdout.on("data", (chunk) => {
-            stdout += String(chunk);
-            if (stdout.length > MAX_VERIFIER_EVIDENCE_BYTES)
-                stdout = stdout.slice(0, MAX_VERIFIER_EVIDENCE_BYTES);
+            const text = String(chunk);
+            stdoutBytes += Buffer.byteLength(text, "utf8");
+            stdoutPendingLine = collectVerifierDiagnostics(stdoutPendingLine, text, diagnostics);
         });
         child.stderr.on("data", (chunk) => {
-            stderr += String(chunk);
-            if (stderr.length > MAX_VERIFIER_EVIDENCE_BYTES)
-                stderr = stderr.slice(0, MAX_VERIFIER_EVIDENCE_BYTES);
+            const text = String(chunk);
+            stderrBytes += Buffer.byteLength(text, "utf8");
+            stderrPendingLine = collectVerifierDiagnostics(stderrPendingLine, text, diagnostics);
         });
         child.on("error", () => settle({
             passed: false,
             timedOut: false,
             exitCode: 1,
-            evidence: summarizeCommandEvidence(stdout, stderr),
+            evidence: summarizeCommandEvidenceFromStats(stdoutBytes, stderrBytes, [
+                ...diagnostics,
+                ...extractVerifierDiagnostics(`${stdoutPendingLine}\n${stderrPendingLine}`),
+            ]),
         }));
         child.on("close", (code) => settle({
             passed: code === 0,
             timedOut: false,
             exitCode: code ?? 1,
-            evidence: summarizeCommandEvidence(stdout, stderr),
+            evidence: summarizeCommandEvidenceFromStats(stdoutBytes, stderrBytes, [
+                ...diagnostics,
+                ...extractVerifierDiagnostics(`${stdoutPendingLine}\n${stderrPendingLine}`),
+            ]),
         }));
     });
 }
@@ -296,7 +349,7 @@ export async function runCompletionVerifier(completion, ir, context) {
     }
     if (completion.file_exists) {
         const safeVariables = validateVerifierTemplateVariables(completion.file_exists, context.variables, "path");
-        if (!safeVariables.valid)
+        if (safeVariables.valid === false)
             return { passed: false, target: completion.file_exists, evidence: safeVariables.evidence, message: safeVariables.message };
         const target = resolveVerifierTemplate(completion.file_exists, context.variables);
         if (hasUnresolvedVerifierTemplate(target))
@@ -316,7 +369,7 @@ export async function runCompletionVerifier(completion, ir, context) {
     }
     if (completion.file_not_empty) {
         const safeVariables = validateVerifierTemplateVariables(completion.file_not_empty, context.variables, "path");
-        if (!safeVariables.valid)
+        if (safeVariables.valid === false)
             return { passed: false, target: completion.file_not_empty, evidence: safeVariables.evidence, message: safeVariables.message };
         const target = resolveVerifierTemplate(completion.file_not_empty, context.variables);
         if (hasUnresolvedVerifierTemplate(target))
@@ -338,10 +391,10 @@ export async function runCompletionVerifier(completion, ir, context) {
     }
     if (completion.file_contains) {
         const safeTargetVariables = validateVerifierTemplateVariables(completion.file_contains.path, context.variables, "path");
-        if (!safeTargetVariables.valid)
+        if (safeTargetVariables.valid === false)
             return { passed: false, target: completion.file_contains.path, evidence: safeTargetVariables.evidence, message: safeTargetVariables.message };
         const safePatternVariables = validateVerifierTemplateVariables(completion.file_contains.pattern, context.variables);
-        if (!safePatternVariables.valid)
+        if (safePatternVariables.valid === false)
             return { passed: false, target: completion.file_contains.pattern, evidence: safePatternVariables.evidence, message: safePatternVariables.message };
         const target = resolveVerifierTemplate(completion.file_contains.path, context.variables);
         const pattern = resolveVerifierTemplate(completion.file_contains.pattern, context.variables);
@@ -379,8 +432,8 @@ export async function runCompletionVerifier(completion, ir, context) {
         message: commandResult.passed
             ? undefined
             : commandResult.timedOut
-                ? `Verifier command timed out after ${context.commandTimeoutMs ?? DEFAULT_VERIFIER_COMMAND_TIMEOUT_MS}ms: ${command}`
-                : `Verifier command failed: ${command}`,
+                ? `Verifier command timed out after ${context.commandTimeoutMs ?? DEFAULT_VERIFIER_COMMAND_TIMEOUT_MS}ms`
+                : appendFailureDiagnostic("Verifier command failed", commandResult.evidence),
     };
 }
 export async function runCheckpointVerifier(checkpoint, ir, context) {
@@ -405,8 +458,8 @@ export async function runCheckpointVerifier(checkpoint, ir, context) {
             message: commandResult.passed
                 ? checkpoint.message
                 : commandResult.timedOut
-                    ? `Verifier command timed out after ${context.commandTimeoutMs ?? DEFAULT_VERIFIER_COMMAND_TIMEOUT_MS}ms: ${command}`
-                    : `Verifier command failed: ${command}`,
+                    ? `Verifier command timed out after ${context.commandTimeoutMs ?? DEFAULT_VERIFIER_COMMAND_TIMEOUT_MS}ms`
+                    : appendFailureDiagnostic("Verifier command failed", commandResult.evidence),
         };
     }
     if (checkpoint.assert === "clean_working_tree") {
@@ -454,8 +507,10 @@ export async function runCheckpointVerifier(checkpoint, ir, context) {
             message: commandResult.passed
                 ? checkpoint.message
                 : commandResult.timedOut
-                    ? `Verifier command timed out after ${context.commandTimeoutMs ?? DEFAULT_VERIFIER_COMMAND_TIMEOUT_MS}ms: ${assertCommands[checkpoint.assert]}`
-                    : checkpoint.message,
+                    ? `Verifier command timed out after ${context.commandTimeoutMs ?? DEFAULT_VERIFIER_COMMAND_TIMEOUT_MS}ms`
+                    : checkpoint.message
+                        ? appendFailureDiagnostic(checkpoint.message, commandResult.evidence)
+                        : appendFailureDiagnostic("Verifier command failed", commandResult.evidence),
         };
     }
     return { passed: false, target: checkpoint.assert, exit_code: 1, message: checkpoint.message };

package/dist/templates/flutter-rewrite.dna.yaml

@@ -166,7 +166,8 @@ context_files:
 
 verifier_policy:
   allow_commands:
-    - "node -e \"const fs=require('node:fs');const crypto=require('node:crypto');const path=require('node:path');const mod=process.env.ARGUMENTS||'$ARGUMENTS';const allowed=['BUG','UNIMPLEMENTED','INFRA','REMOVED','TEST_BUG'];const action=['BUG','UNIMPLEMENTED','INFRA','TEST_BUG'];const fail=m=>{throw new Error(m)};const same=(a,b)=>Array.isArray(a)&&a.length===b.length&&a.every((v,i)=>v===b[i]);const snapSame=(a,b)=>a&&b&&a.baseline_source_sha256===b.baseline_source_sha256&&a.diagnosis_artifact_sha256===b.diagnosis_artifact_sha256&&a.observed_failure_count===b.observed_failure_count&&a.work_item_count===b.work_item_count&&same(a.allowed_kinds,b.allowed_kinds);const root=fs.realpathSync(process.cwd());const inside=p=>{if(typeof p!=='string'||!p||path.isAbsolute(p))fail('path_invalid');const r=path.resolve(root,p);if(r!==root&&!r.startsWith(root+path.sep))fail('path_escape');if(fs.existsSync(r)){const real=fs.realpathSync(r);if(real!==root&&!real.startsWith(root+path.sep))fail('path_escape')}return r};const readJson=p=>JSON.parse(fs.readFileSync(inside(p),'utf8'));if(!/^[A-Za-z0-9_-]+$/.test(mod))fail('module');const contractPath='.dna/specs/diagnosis-'+mod+'.contract.json';const reviewPath='.dna/specs/diagnosis-'+mod+'.review.json';const diagnosisPath='.dna/specs/diagnosis-'+mod+'.md';const data=readJson(contractPath);if(data.contract_version!=='diagnosis-contract/v1')fail('contract_version');if(data.module!==mod)fail('module_mismatch');if(data.diagnosis_artifact!==diagnosisPath)fail('diagnosis_artifact_path');if(!same(data.allowed_kinds,allowed))fail('allowed_kinds');const observed=Array.isArray(data.observed_failures)?data.observed_failures:fail('observed_failures');const work=Array.isArray(data.work_items)?data.work_items:fail('work_items');if(!observed.length)fail('empty_observed_failures');if(!work.length)fail('empty_work_items');const ids=new Set(observed.map(x=>x&&x.id).filter(Boolean));if(ids.size!==observed.length)fail('observed_failure_ids');const failureById=new Map();for(const f of observed){if(typeof f.test_name!=='string'||!f.test_name.trim())fail('observed_failure_test_name');if(typeof f.symptom!=='string'||!f.symptom.trim())fail('observed_failure_symptom');if(!Array.isArray(f.evidence_paths)||!f.evidence_paths.length)fail('observed_failure_evidence');for(const p of f.evidence_paths)inside(p);if(f.kind!==undefined)fail('observed_failure_kind_forbidden');failureById.set(f.id,f)}const mapped=new Set();for(const item of work){if(!allowed.includes(item.kind))fail('invalid_kind');if(item.kind==='PLACEHOLDER_CONTRACT')fail('placeholder_kind');if(!Array.isArray(item.observed_failure_ids)||!item.observed_failure_ids.length)fail('work_item_observed_failure_ids');if(!Array.isArray(item.evidence_paths)||!item.evidence_paths.length)fail('work_item_evidence');for(const p of item.evidence_paths)inside(p);if(action.includes(item.kind)){if(!Array.isArray(item.v1_evidence_paths)||!item.v1_evidence_paths.length)fail('work_item_v1_evidence');if(!Array.isArray(item.v2_evidence_paths)||!item.v2_evidence_paths.length)fail('work_item_v2_evidence');for(const p of item.v1_evidence_paths)inside(p);for(const p of item.v2_evidence_paths)inside(p)}for(const id of item.observed_failure_ids){const f=failureById.get(id);if(!f)fail('unknown_observed_failure_id');if(action.includes(item.kind)&&(!f.test_name||!String(f.test_name).trim()))fail('action_test_evidence');mapped.add(id)}}if(mapped.size!==ids.size)fail('unmapped_observed_failures');for(const f of observed.filter(x=>String(x.symptom).includes('PLACEHOLDER_CONTRACT'))){const kinds=new Set(work.filter(i=>i.observed_failure_ids.includes(f.id)).map(i=>i.kind));if(![...kinds].every(k=>k==='TEST_BUG'||k==='UNIMPLEMENTED')||kinds.size===0)fail('placeholder_mapping')}const counts=data.baseline&&data.baseline.counts;if(!data.baseline||!data.baseline.source_path||!counts)fail('baseline');inside(data.baseline.source_path);for(const k of ['failed','skipped','hung']){if(!Number.isInteger(counts[k])||counts[k]<0)fail('baseline_count_'+k)}const total=counts.failed+counts.skipped+counts.hung;if(total!==observed.length)fail('baseline_count_mismatch');const summary=data.summary_counts||{};for(const kind of allowed){if(!Number.isInteger(summary[kind])||summary[kind]!==work.filter(x=>x.kind===kind).length)fail('summary_count_'+kind)}const sha=p=>crypto.createHash('sha256').update(fs.readFileSync(inside(p))).digest('hex');const snap=data.contract_snapshot||{};if(snap.observed_failure_count!==observed.length||snap.work_item_count!==work.length||!same(snap.allowed_kinds,allowed))fail('contract_snapshot');if(snap.baseline_source_sha256!==sha(data.baseline.source_path))fail('baseline_sha256');if(snap.diagnosis_artifact_sha256!==sha(diagnosisPath))fail('diagnosis_sha256');if(!data.staleness||data.staleness.is_stale!==false)fail('stale_contract');const review=readJson(reviewPath);if(review.contract_version!=='diagnosis-contract-review/v1')fail('review_contract_version');if(review.contract_valid!==true)fail('review_contract_valid');if(review.verdict!=='APPROVE')fail('review_verdict');if(review.contract_artifact_reviewed!==contractPath)fail('review_contract_artifact_path');if(review.artifact_reviewed!==diagnosisPath)fail('review_artifact_path');if(!snapSame(review.contract_snapshot,snap))fail('review_contract_snapshot');if(!review.updated_at||Number.isNaN(Date.parse(review.updated_at)))fail('review_updated_at');if(!Array.isArray(review.evidence_paths)||!review.evidence_paths.length)fail('review_evidence_paths');for(const p of review.evidence_paths)inside(p);const cm=fs.statSync(inside(contractPath)).mtimeMs;const dm=fs.statSync(inside(diagnosisPath)).mtimeMs;const rm=fs.statSync(inside(reviewPath)).mtimeMs;if(rm<cm||rm<dm)fail('review_stale');\""
+    - "node -e \"const fs=require('node:fs');const crypto=require('node:crypto');const path=require('node:path');const mod=process.env.ARGUMENTS||'$ARGUMENTS';const allowed=['BUG','UNIMPLEMENTED','INFRA','REMOVED','TEST_BUG'];const action=['BUG','UNIMPLEMENTED','INFRA','TEST_BUG'];const fail=m=>{console.error('INTENTDNA_DIAGNOSTIC:'+m);process.exit(1)};const same=(a,b)=>Array.isArray(a)&&a.length===b.length&&a.every((v,i)=>v===b[i]);const legacySame=(a,b)=>a&&b&&a.baseline_source_sha256===b.baseline_source_sha256&&a.diagnosis_artifact_sha256===b.diagnosis_artifact_sha256&&a.observed_failure_count===b.observed_failure_count&&a.work_item_count===b.work_item_count&&same(a.allowed_kinds,b.allowed_kinds);const modern=s=>s&&typeof s.sidecar_semantic_sha256==='string'&&typeof s.diagnosis_semantic_sha256==='string';const root=fs.realpathSync(process.cwd());const inside=p=>{if(typeof p!=='string'||!p||path.isAbsolute(p))fail('path_invalid');const r=path.resolve(root,p);if(r!==root&&!r.startsWith(root+path.sep))fail('path_escape');if(fs.existsSync(r)){const real=fs.realpathSync(r);if(real!==root&&!real.startsWith(root+path.sep))fail('path_escape')}return r};const readJson=p=>JSON.parse(fs.readFileSync(inside(p),'utf8'));const hash=v=>crypto.createHash('sha256').update(v).digest('hex');const fileHash=p=>hash(fs.readFileSync(inside(p)));const normalizedDiagnosisHash=p=>hash(fs.readFileSync(inside(p),'utf8').replace(/\\s+/g,' ').trim());const canon=v=>Array.isArray(v)?'['+v.map(canon).join(',')+']':v&&typeof v==='object'?'{'+Object.keys(v).sort().map(k=>JSON.stringify(k)+':'+canon(v[k])).join(',')+'}':JSON.stringify(v);if(!/^[A-Za-z0-9_-]+$/.test(mod))fail('module');const contractPath='.dna/specs/diagnosis-'+mod+'.contract.json';const reviewPath='.dna/specs/diagnosis-'+mod+'.review.json';const diagnosisPath='.dna/specs/diagnosis-'+mod+'.md';const behaviorPath='docs/behavior/'+mod+'.md';const data=readJson(contractPath);if(data.contract_version!=='diagnosis-contract/v1')fail('contract_version');if(data.module!==mod)fail('module_mismatch');if(data.diagnosis_artifact!==diagnosisPath)fail('diagnosis_artifact_path');if(!same(data.allowed_kinds,allowed))fail('allowed_kinds');const observed=Array.isArray(data.observed_failures)?data.observed_failures:fail('observed_failures');const work=Array.isArray(data.work_items)?data.work_items:fail('work_items');if(!observed.length)fail('empty_observed_failures');if(!work.length)fail('empty_work_items');const idOk=id=>typeof id==='string'&&/^[A-Za-z0-9][A-Za-z0-9_.:-]*$/.test(id);const ids=new Set();for(const f of observed){if(!idOk(f&&f.id)||ids.has(f.id))fail('observed_failure_ids');ids.add(f.id)}const workIds=new Set();for(const item of work){if(!idOk(item&&item.id)||workIds.has(item.id))fail('work_item_ids');workIds.add(item.id)}const failureById=new Map();for(const f of observed){if(typeof f.test_name!=='string'||!f.test_name.trim())fail('observed_failure_test_name');if(typeof f.symptom!=='string'||!f.symptom.trim())fail('observed_failure_symptom');if(!Array.isArray(f.evidence_paths)||!f.evidence_paths.length)fail('observed_failure_evidence');for(const p of f.evidence_paths)inside(p);if(f.kind!==undefined)fail('observed_failure_kind_forbidden');failureById.set(f.id,f)}const mapped=new Set();for(const item of work){if(!allowed.includes(item.kind))fail('invalid_kind');if(item.kind==='PLACEHOLDER_CONTRACT')fail('placeholder_kind');if(!Array.isArray(item.observed_failure_ids)||!item.observed_failure_ids.length)fail('work_item_observed_failure_ids');if(!Array.isArray(item.evidence_paths)||!item.evidence_paths.length)fail('work_item_evidence');for(const p of item.evidence_paths)inside(p);if(action.includes(item.kind)){if(!Array.isArray(item.v1_evidence_paths)||!item.v1_evidence_paths.length)fail('work_item_v1_evidence');if(!Array.isArray(item.v2_evidence_paths)||!item.v2_evidence_paths.length)fail('work_item_v2_evidence');for(const p of item.v1_evidence_paths)inside(p);for(const p of item.v2_evidence_paths)inside(p)}for(const id of item.observed_failure_ids){const f=failureById.get(id);if(!f)fail('unknown_observed_failure_id');if(action.includes(item.kind)&&(!f.test_name||!String(f.test_name).trim()))fail('action_test_evidence');mapped.add(id)}}if(mapped.size!==ids.size)fail('unmapped_observed_failures');for(const f of observed.filter(x=>String(x.symptom).includes('PLACEHOLDER_CONTRACT'))){const kinds=new Set(work.filter(i=>i.observed_failure_ids.includes(f.id)).map(i=>i.kind));if(![...kinds].every(k=>k==='TEST_BUG'||k==='UNIMPLEMENTED')||kinds.size===0)fail('placeholder_mapping')}const counts=data.baseline&&data.baseline.counts;if(!data.baseline||!data.baseline.source_path||!counts)fail('baseline');for(const k of ['failed','skipped','hung']){if(!Number.isInteger(counts[k])||counts[k]<0)fail('baseline_count_'+k)}if(counts.failed+counts.skipped+counts.hung!==observed.length)fail('baseline_count_mismatch');const summary=data.summary_counts||{};for(const kind of allowed){if(!Number.isInteger(summary[kind])||summary[kind]!==work.filter(x=>x.kind===kind).length)fail('summary_count_'+kind)}const snap=data.contract_snapshot||{};const baselineHash=fileHash(data.baseline.source_path);const diagnosisHash=fileHash(diagnosisPath);if(snap.observed_failure_count!==observed.length||snap.work_item_count!==work.length||!same(snap.allowed_kinds,allowed))fail('contract_snapshot');if(snap.baseline_source_sha256!==baselineHash)fail('baseline_sha256');if(snap.diagnosis_artifact_sha256!==diagnosisHash)fail('diagnosis_sha256');const stale=data.staleness;if(!stale||stale.is_stale!==false)fail('stale_contract');const source=(entry,p,n,expected)=>{if(!entry||entry.path!==p)fail('staleness_'+n+'_path');if(entry.sha256!==expected)fail('staleness_'+n+'_sha256')};source(stale.behavior_doc,behaviorPath,'behavior_doc',fileHash(behaviorPath));source(stale.baseline,data.baseline.source_path,'baseline',baselineHash);source(stale.diagnosis_artifact,diagnosisPath,'diagnosis_artifact',diagnosisHash);const semantic=JSON.parse(JSON.stringify(data));delete semantic.contract_snapshot.sidecar_semantic_sha256;delete semantic.contract_snapshot.diagnosis_artifact_sha256;delete semantic.staleness.diagnosis_artifact;const sidecarSemanticHash=hash(canon(semantic));const diagnosisSemanticHash=normalizedDiagnosisHash(diagnosisPath);if(snap.sidecar_semantic_sha256!==sidecarSemanticHash||snap.diagnosis_semantic_sha256!==diagnosisSemanticHash)fail('contract_snapshot_semantic');if(fs.existsSync(inside(reviewPath))){const prev=readJson(reviewPath);if(prev.verdict==='REQUEST_REANALYSIS'){const ps=prev.contract_snapshot||{};const unchanged=modern(ps)?ps.sidecar_semantic_sha256===sidecarSemanticHash&&ps.diagnosis_semantic_sha256===diagnosisSemanticHash:legacySame(ps,snap);if(unchanged)fail('reanalysis_unchanged');const cm=fs.statSync(inside(contractPath)).mtimeMs;const dm=fs.statSync(inside(diagnosisPath)).mtimeMs;const rm=fs.statSync(inside(reviewPath)).mtimeMs;if(cm<=rm||dm<=rm)fail('reanalysis_not_rewritten')}}\""
+    - "node -e \"const fs=require('node:fs');const crypto=require('node:crypto');const path=require('node:path');const mod=process.env.ARGUMENTS||'$ARGUMENTS';const allowed=['BUG','UNIMPLEMENTED','INFRA','REMOVED','TEST_BUG'];const action=['BUG','UNIMPLEMENTED','INFRA','TEST_BUG'];const fail=m=>{console.error('INTENTDNA_DIAGNOSTIC:'+m);process.exit(1)};const same=(a,b)=>Array.isArray(a)&&a.length===b.length&&a.every((v,i)=>v===b[i]);const snapSame=(a,b)=>a&&b&&a.baseline_source_sha256===b.baseline_source_sha256&&a.diagnosis_artifact_sha256===b.diagnosis_artifact_sha256&&a.sidecar_semantic_sha256===b.sidecar_semantic_sha256&&a.diagnosis_semantic_sha256===b.diagnosis_semantic_sha256&&a.observed_failure_count===b.observed_failure_count&&a.work_item_count===b.work_item_count&&same(a.allowed_kinds,b.allowed_kinds);const root=fs.realpathSync(process.cwd());const inside=p=>{if(typeof p!=='string'||!p||path.isAbsolute(p))fail('path_invalid');const r=path.resolve(root,p);if(r!==root&&!r.startsWith(root+path.sep))fail('path_escape');if(fs.existsSync(r)){const real=fs.realpathSync(r);if(real!==root&&!real.startsWith(root+path.sep))fail('path_escape')}return r};const readJson=p=>JSON.parse(fs.readFileSync(inside(p),'utf8'));const hash=v=>crypto.createHash('sha256').update(v).digest('hex');const fileHash=p=>hash(fs.readFileSync(inside(p)));const normalizedDiagnosisHash=p=>hash(fs.readFileSync(inside(p),'utf8').replace(/\\s+/g,' ').trim());const canon=v=>Array.isArray(v)?'['+v.map(canon).join(',')+']':v&&typeof v==='object'?'{'+Object.keys(v).sort().map(k=>JSON.stringify(k)+':'+canon(v[k])).join(',')+'}':JSON.stringify(v);if(!/^[A-Za-z0-9_-]+$/.test(mod))fail('module');const contractPath='.dna/specs/diagnosis-'+mod+'.contract.json';const reviewPath='.dna/specs/diagnosis-'+mod+'.review.json';const diagnosisPath='.dna/specs/diagnosis-'+mod+'.md';const behaviorPath='docs/behavior/'+mod+'.md';const data=readJson(contractPath);if(data.contract_version!=='diagnosis-contract/v1')fail('contract_version');if(data.module!==mod)fail('module_mismatch');if(data.diagnosis_artifact!==diagnosisPath)fail('diagnosis_artifact_path');if(!same(data.allowed_kinds,allowed))fail('allowed_kinds');const observed=Array.isArray(data.observed_failures)?data.observed_failures:fail('observed_failures');const work=Array.isArray(data.work_items)?data.work_items:fail('work_items');if(!observed.length)fail('empty_observed_failures');if(!work.length)fail('empty_work_items');const idOk=id=>typeof id==='string'&&/^[A-Za-z0-9][A-Za-z0-9_.:-]*$/.test(id);const ids=new Set();for(const f of observed){if(!idOk(f&&f.id)||ids.has(f.id))fail('observed_failure_ids');ids.add(f.id)}const workIds=new Set();for(const item of work){if(!idOk(item&&item.id)||workIds.has(item.id))fail('work_item_ids');workIds.add(item.id)}const failureById=new Map();for(const f of observed){if(typeof f.test_name!=='string'||!f.test_name.trim())fail('observed_failure_test_name');if(typeof f.symptom!=='string'||!f.symptom.trim())fail('observed_failure_symptom');if(!Array.isArray(f.evidence_paths)||!f.evidence_paths.length)fail('observed_failure_evidence');for(const p of f.evidence_paths)inside(p);if(f.kind!==undefined)fail('observed_failure_kind_forbidden');failureById.set(f.id,f)}const mapped=new Set();for(const item of work){if(!allowed.includes(item.kind))fail('invalid_kind');if(item.kind==='PLACEHOLDER_CONTRACT')fail('placeholder_kind');if(!Array.isArray(item.observed_failure_ids)||!item.observed_failure_ids.length)fail('work_item_observed_failure_ids');if(!Array.isArray(item.evidence_paths)||!item.evidence_paths.length)fail('work_item_evidence');for(const p of item.evidence_paths)inside(p);if(action.includes(item.kind)){if(!Array.isArray(item.v1_evidence_paths)||!item.v1_evidence_paths.length)fail('work_item_v1_evidence');if(!Array.isArray(item.v2_evidence_paths)||!item.v2_evidence_paths.length)fail('work_item_v2_evidence');for(const p of item.v1_evidence_paths)inside(p);for(const p of item.v2_evidence_paths)inside(p)}for(const id of item.observed_failure_ids){const f=failureById.get(id);if(!f)fail('unknown_observed_failure_id');if(action.includes(item.kind)&&(!f.test_name||!String(f.test_name).trim()))fail('action_test_evidence');mapped.add(id)}}if(mapped.size!==ids.size)fail('unmapped_observed_failures');for(const f of observed.filter(x=>String(x.symptom).includes('PLACEHOLDER_CONTRACT'))){const kinds=new Set(work.filter(i=>i.observed_failure_ids.includes(f.id)).map(i=>i.kind));if(![...kinds].every(k=>k==='TEST_BUG'||k==='UNIMPLEMENTED')||kinds.size===0)fail('placeholder_mapping')}const counts=data.baseline&&data.baseline.counts;if(!data.baseline||!data.baseline.source_path||!counts)fail('baseline');for(const k of ['failed','skipped','hung']){if(!Number.isInteger(counts[k])||counts[k]<0)fail('baseline_count_'+k)}if(counts.failed+counts.skipped+counts.hung!==observed.length)fail('baseline_count_mismatch');const summary=data.summary_counts||{};for(const kind of allowed){if(!Number.isInteger(summary[kind])||summary[kind]!==work.filter(x=>x.kind===kind).length)fail('summary_count_'+kind)}const snap=data.contract_snapshot||{};const baselineHash=fileHash(data.baseline.source_path);const diagnosisHash=fileHash(diagnosisPath);if(snap.observed_failure_count!==observed.length||snap.work_item_count!==work.length||!same(snap.allowed_kinds,allowed))fail('contract_snapshot');if(snap.baseline_source_sha256!==baselineHash)fail('baseline_sha256');if(snap.diagnosis_artifact_sha256!==diagnosisHash)fail('diagnosis_sha256');const stale=data.staleness;if(!stale||stale.is_stale!==false)fail('stale_contract');const source=(entry,p,n,expected)=>{if(!entry||entry.path!==p)fail('staleness_'+n+'_path');if(entry.sha256!==expected)fail('staleness_'+n+'_sha256')};source(stale.behavior_doc,behaviorPath,'behavior_doc',fileHash(behaviorPath));source(stale.baseline,data.baseline.source_path,'baseline',baselineHash);source(stale.diagnosis_artifact,diagnosisPath,'diagnosis_artifact',diagnosisHash);const semantic=JSON.parse(JSON.stringify(data));delete semantic.contract_snapshot.sidecar_semantic_sha256;delete semantic.contract_snapshot.diagnosis_artifact_sha256;delete semantic.staleness.diagnosis_artifact;const sidecarSemanticHash=hash(canon(semantic));const diagnosisSemanticHash=normalizedDiagnosisHash(diagnosisPath);if(snap.sidecar_semantic_sha256!==sidecarSemanticHash||snap.diagnosis_semantic_sha256!==diagnosisSemanticHash)fail('contract_snapshot_semantic');const review=readJson(reviewPath);if(review.contract_version!=='diagnosis-contract-review/v1')fail('review_contract_version');if(review.contract_valid!==true)fail('review_contract_valid');if(review.verdict!=='APPROVE')fail('review_verdict');if(review.contract_artifact_reviewed!==contractPath)fail('review_contract_artifact_path');if(review.artifact_reviewed!==diagnosisPath)fail('review_artifact_path');if(!snapSame(review.contract_snapshot,snap))fail('review_contract_snapshot');if(!review.updated_at||Number.isNaN(Date.parse(review.updated_at)))fail('review_updated_at');if(!Array.isArray(review.evidence_paths)||!review.evidence_paths.length)fail('review_evidence_paths');for(const p of review.evidence_paths)inside(p);const cm=fs.statSync(inside(contractPath)).mtimeMs;const dm=fs.statSync(inside(diagnosisPath)).mtimeMs;const rm=fs.statSync(inside(reviewPath)).mtimeMs;if(rm<cm||rm<dm)fail('review_stale');\""
   allow_builtin_asserts:
     - clean_working_tree
 
@@ -248,7 +249,7 @@ roles:
   analyzer:
     description: "Reads code and classifies failing tests. Writes diagnosis spec only."
     tool_permissions:
-      allow: [Read, Grep, Glob, Write]
+      allow: [Read, Grep, Glob, Write, mcp__intentdna__dna_artifact_digest]
       deny: [Bash, Edit, NotebookEdit]
     scope:
       read: ["**/*"]
@@ -263,13 +264,14 @@ roles:
       - "The sidecar allowed_kinds array must be exactly BUG, UNIMPLEMENTED, INFRA, REMOVED, TEST_BUG in that order; PLACEHOLDER_CONTRACT is never a kind"
       - "A placeholder-contract symptom may appear only in observed_failures.symptom and must map to concrete TEST_BUG and/or UNIMPLEMENTED work_items with evidence"
       - "If reanalyzing after REQUEST_REANALYSIS, update every reviewer sections_to_fix item and report sections_updated"
+      - "Use mcp__intentdna__dna_artifact_digest for every exact contract SHA-256; never guess a digest or use Bash to compute one"
       - "DO NOT include fix prescriptions, implementation order, call-site instructions, or Notes for Surgeon"
       - "DO NOT run tests. DO NOT edit app code. Analysis only."
 
   analysis_reviewer:
     description: "Reviews analyzer output quality and writes durable diagnosis review verdict."
     tool_permissions:
-      allow: [Read, Grep, Glob, Write]
+      allow: [Read, Grep, Glob, Write, mcp__intentdna__dna_artifact_digest]
       deny: [Bash, Edit, NotebookEdit]
     scope:
       read: ["**/*"]
@@ -278,6 +280,7 @@ roles:
       - "REQUIRED FIRST: Read all context files listed in SKILL.md"
       - "Verify analyzer spec: v1 references exist? Classifications sound?"
       - "Independently validate .dna/specs/diagnosis-$ARGUMENTS.contract.json against the template sidecar contract; do not use Bash"
+      - "Use mcp__intentdna__dna_artifact_digest to independently verify exact raw, normalized-text, and canonical-JSON SHA-256 values"
       - "Check missing: any failing test not covered?"
       - "Verify diagnosis remains evidence-only: no fix prescriptions, implementation order, call-site instructions, or Notes for Surgeon"
       - "Output a structured verdict block with contract_version, contract_valid, failure_reason, contract_artifact_reviewed, contract_snapshot, verdict, artifact_reviewed, sections_to_fix, evidence_paths, confidence, summary, and updated_at"
@@ -486,16 +489,20 @@ workflows:
              - observed_failures: one entry per failing/skipped/hung test with id, test_name, symptom, evidence_paths, and no kind field
              - work_items: one or more entries mapping observed_failure_ids to kind, evidence_paths, v1_evidence_paths, and v2_evidence_paths
              - summary_counts: exact count of work_items by BUG / UNIMPLEMENTED / INFRA / REMOVED / TEST_BUG
-             - contract_snapshot: baseline_source_sha256, diagnosis_artifact_sha256, observed_failure_count, work_item_count, allowed_kinds
-             - staleness: source mtimes or hashes for behavior_doc, baseline, diagnosis_artifact, and is_stale false
+             - contract_snapshot: baseline_source_sha256, diagnosis_artifact_sha256, sidecar_semantic_sha256, diagnosis_semantic_sha256, observed_failure_count, work_item_count, allowed_kinds
+             - staleness: behavior_doc, baseline, and diagnosis_artifact entries each contain the exact project-relative path and current sha256; is_stale is false
+             - Obtain hashes with mcp__intentdna__dna_artifact_digest, which is read-only and project-relative: bytes mode for behavior/baseline/diagnosis, whitespace_normalized_text for diagnosis_semantic_sha256, and canonical_json for the sidecar with exclude_json_pointers=["/contract_snapshot/sidecar_semantic_sha256", "/contract_snapshot/diagnosis_artifact_sha256", "/staleness/diagnosis_artifact"] for sidecar_semantic_sha256. Write the returned values back to the sidecar and re-run the canonical digest to confirm it is stable. Never guess hashes.
           7. Contract rules:
              - observed_failures must not be empty; work_items must not be empty.
              - Every observed_failure id must be mapped by at least one work_item.
              - Every work_item kind must be one of the five allowed kinds exactly.
              - PLACEHOLDER_CONTRACT is forbidden as a kind. If a placeholder-contract symptom exists, keep it in observed_failures.symptom and map it to concrete TEST_BUG and/or UNIMPLEMENTED work_items with evidence.
              - REMOVED may be diagnosed but must be marked manual/user-approved before any future fix can execute it.
-             - Mixed unknown kinds, missing evidence, count mismatches, missing/changed contract_snapshot, and stale baseline/diagnosis snapshots make the contract invalid.
+             - Mixed unknown kinds, missing evidence, count mismatches, missing/changed contract_snapshot, and stale behavior/baseline/diagnosis snapshots make the contract invalid.
           8. If this is a reanalysis after REQUEST_REANALYSIS or DIAGNOSIS_CONTRACT_INVALID, read the reviewer verdict first, update every section listed in sections_to_fix plus the summary table and contract sidecar, and report sections_updated in your final response. Reanalysis is not successful unless both the spec artifact and contract sidecar are rewritten.
+          9. Before handing off to review, the producer-side diagnosis contract completion gate must pass. It rejects grouped observations that hide per-test failures, duplicate/bad ids, unmapped observed_failures, missing evidence, count mismatches, bad hashes, stale state, and no-material-change reanalysis after REQUEST_REANALYSIS. Reanalysis compares the canonical sidecar with its self-digest and raw diagnosis snapshot fields omitted, plus a whitespace-normalized diagnosis hash, so a real sidecar-only correction is allowed while formatting-only Markdown changes are not.
+        completion:
+          - command_success: "node -e \"const fs=require('node:fs');const crypto=require('node:crypto');const path=require('node:path');const mod=process.env.ARGUMENTS||'$ARGUMENTS';const allowed=['BUG','UNIMPLEMENTED','INFRA','REMOVED','TEST_BUG'];const action=['BUG','UNIMPLEMENTED','INFRA','TEST_BUG'];const fail=m=>{console.error('INTENTDNA_DIAGNOSTIC:'+m);process.exit(1)};const same=(a,b)=>Array.isArray(a)&&a.length===b.length&&a.every((v,i)=>v===b[i]);const legacySame=(a,b)=>a&&b&&a.baseline_source_sha256===b.baseline_source_sha256&&a.diagnosis_artifact_sha256===b.diagnosis_artifact_sha256&&a.observed_failure_count===b.observed_failure_count&&a.work_item_count===b.work_item_count&&same(a.allowed_kinds,b.allowed_kinds);const modern=s=>s&&typeof s.sidecar_semantic_sha256==='string'&&typeof s.diagnosis_semantic_sha256==='string';const root=fs.realpathSync(process.cwd());const inside=p=>{if(typeof p!=='string'||!p||path.isAbsolute(p))fail('path_invalid');const r=path.resolve(root,p);if(r!==root&&!r.startsWith(root+path.sep))fail('path_escape');if(fs.existsSync(r)){const real=fs.realpathSync(r);if(real!==root&&!real.startsWith(root+path.sep))fail('path_escape')}return r};const readJson=p=>JSON.parse(fs.readFileSync(inside(p),'utf8'));const hash=v=>crypto.createHash('sha256').update(v).digest('hex');const fileHash=p=>hash(fs.readFileSync(inside(p)));const normalizedDiagnosisHash=p=>hash(fs.readFileSync(inside(p),'utf8').replace(/\\s+/g,' ').trim());const canon=v=>Array.isArray(v)?'['+v.map(canon).join(',')+']':v&&typeof v==='object'?'{'+Object.keys(v).sort().map(k=>JSON.stringify(k)+':'+canon(v[k])).join(',')+'}':JSON.stringify(v);if(!/^[A-Za-z0-9_-]+$/.test(mod))fail('module');const contractPath='.dna/specs/diagnosis-'+mod+'.contract.json';const reviewPath='.dna/specs/diagnosis-'+mod+'.review.json';const diagnosisPath='.dna/specs/diagnosis-'+mod+'.md';const behaviorPath='docs/behavior/'+mod+'.md';const data=readJson(contractPath);if(data.contract_version!=='diagnosis-contract/v1')fail('contract_version');if(data.module!==mod)fail('module_mismatch');if(data.diagnosis_artifact!==diagnosisPath)fail('diagnosis_artifact_path');if(!same(data.allowed_kinds,allowed))fail('allowed_kinds');const observed=Array.isArray(data.observed_failures)?data.observed_failures:fail('observed_failures');const work=Array.isArray(data.work_items)?data.work_items:fail('work_items');if(!observed.length)fail('empty_observed_failures');if(!work.length)fail('empty_work_items');const idOk=id=>typeof id==='string'&&/^[A-Za-z0-9][A-Za-z0-9_.:-]*$/.test(id);const ids=new Set();for(const f of observed){if(!idOk(f&&f.id)||ids.has(f.id))fail('observed_failure_ids');ids.add(f.id)}const workIds=new Set();for(const item of work){if(!idOk(item&&item.id)||workIds.has(item.id))fail('work_item_ids');workIds.add(item.id)}const failureById=new Map();for(const f of observed){if(typeof f.test_name!=='string'||!f.test_name.trim())fail('observed_failure_test_name');if(typeof f.symptom!=='string'||!f.symptom.trim())fail('observed_failure_symptom');if(!Array.isArray(f.evidence_paths)||!f.evidence_paths.length)fail('observed_failure_evidence');for(const p of f.evidence_paths)inside(p);if(f.kind!==undefined)fail('observed_failure_kind_forbidden');failureById.set(f.id,f)}const mapped=new Set();for(const item of work){if(!allowed.includes(item.kind))fail('invalid_kind');if(item.kind==='PLACEHOLDER_CONTRACT')fail('placeholder_kind');if(!Array.isArray(item.observed_failure_ids)||!item.observed_failure_ids.length)fail('work_item_observed_failure_ids');if(!Array.isArray(item.evidence_paths)||!item.evidence_paths.length)fail('work_item_evidence');for(const p of item.evidence_paths)inside(p);if(action.includes(item.kind)){if(!Array.isArray(item.v1_evidence_paths)||!item.v1_evidence_paths.length)fail('work_item_v1_evidence');if(!Array.isArray(item.v2_evidence_paths)||!item.v2_evidence_paths.length)fail('work_item_v2_evidence');for(const p of item.v1_evidence_paths)inside(p);for(const p of item.v2_evidence_paths)inside(p)}for(const id of item.observed_failure_ids){const f=failureById.get(id);if(!f)fail('unknown_observed_failure_id');if(action.includes(item.kind)&&(!f.test_name||!String(f.test_name).trim()))fail('action_test_evidence');mapped.add(id)}}if(mapped.size!==ids.size)fail('unmapped_observed_failures');for(const f of observed.filter(x=>String(x.symptom).includes('PLACEHOLDER_CONTRACT'))){const kinds=new Set(work.filter(i=>i.observed_failure_ids.includes(f.id)).map(i=>i.kind));if(![...kinds].every(k=>k==='TEST_BUG'||k==='UNIMPLEMENTED')||kinds.size===0)fail('placeholder_mapping')}const counts=data.baseline&&data.baseline.counts;if(!data.baseline||!data.baseline.source_path||!counts)fail('baseline');for(const k of ['failed','skipped','hung']){if(!Number.isInteger(counts[k])||counts[k]<0)fail('baseline_count_'+k)}if(counts.failed+counts.skipped+counts.hung!==observed.length)fail('baseline_count_mismatch');const summary=data.summary_counts||{};for(const kind of allowed){if(!Number.isInteger(summary[kind])||summary[kind]!==work.filter(x=>x.kind===kind).length)fail('summary_count_'+kind)}const snap=data.contract_snapshot||{};const baselineHash=fileHash(data.baseline.source_path);const diagnosisHash=fileHash(diagnosisPath);if(snap.observed_failure_count!==observed.length||snap.work_item_count!==work.length||!same(snap.allowed_kinds,allowed))fail('contract_snapshot');if(snap.baseline_source_sha256!==baselineHash)fail('baseline_sha256');if(snap.diagnosis_artifact_sha256!==diagnosisHash)fail('diagnosis_sha256');const stale=data.staleness;if(!stale||stale.is_stale!==false)fail('stale_contract');const source=(entry,p,n,expected)=>{if(!entry||entry.path!==p)fail('staleness_'+n+'_path');if(entry.sha256!==expected)fail('staleness_'+n+'_sha256')};source(stale.behavior_doc,behaviorPath,'behavior_doc',fileHash(behaviorPath));source(stale.baseline,data.baseline.source_path,'baseline',baselineHash);source(stale.diagnosis_artifact,diagnosisPath,'diagnosis_artifact',diagnosisHash);const semantic=JSON.parse(JSON.stringify(data));delete semantic.contract_snapshot.sidecar_semantic_sha256;delete semantic.contract_snapshot.diagnosis_artifact_sha256;delete semantic.staleness.diagnosis_artifact;const sidecarSemanticHash=hash(canon(semantic));const diagnosisSemanticHash=normalizedDiagnosisHash(diagnosisPath);if(snap.sidecar_semantic_sha256!==sidecarSemanticHash||snap.diagnosis_semantic_sha256!==diagnosisSemanticHash)fail('contract_snapshot_semantic');if(fs.existsSync(inside(reviewPath))){const prev=readJson(reviewPath);if(prev.verdict==='REQUEST_REANALYSIS'){const ps=prev.contract_snapshot||{};const unchanged=modern(ps)?ps.sidecar_semantic_sha256===sidecarSemanticHash&&ps.diagnosis_semantic_sha256===diagnosisSemanticHash:legacySame(ps,snap);if(unchanged)fail('reanalysis_unchanged');const cm=fs.statSync(inside(contractPath)).mtimeMs;const dm=fs.statSync(inside(diagnosisPath)).mtimeMs;const rm=fs.statSync(inside(reviewPath)).mtimeMs;if(cm<=rm||dm<=rm)fail('reanalysis_not_rewritten')}}\""
         handoff:
           produces:
             - type: file
@@ -527,8 +534,9 @@ workflows:
              - summary_counts match work_items by kind
              - every work_item has evidence_paths and only allowed kinds
              - PLACEHOLDER_CONTRACT is rejected as a kind but placeholder-contract symptoms are allowed when mapped to TEST_BUG and/or UNIMPLEMENTED
-             - contract_snapshot includes diagnosis_artifact_sha256, baseline_source_sha256, observed_failure_count, work_item_count, and allowed_kinds
-             - staleness.is_stale is false; stale baseline/diagnosis/contract snapshots are invalid
+             - contract_snapshot includes diagnosis_artifact_sha256, baseline_source_sha256, sidecar_semantic_sha256, diagnosis_semantic_sha256, observed_failure_count, work_item_count, and allowed_kinds
+             - staleness.is_stale is false and behavior_doc, baseline, and diagnosis_artifact path+sha256 entries match current project files; stale source snapshots are invalid
+             - independently recompute hashes with mcp__intentdna__dna_artifact_digest using the same bytes, whitespace_normalized_text, and canonical_json modes; canonical_json must omit /contract_snapshot/sidecar_semantic_sha256, /contract_snapshot/diagnosis_artifact_sha256, and /staleness/diagnosis_artifact
              - REMOVED work_items are reviewable diagnosis facts only and must not authorize automatic fix execution
 
           Output exactly one structured verdict block:
@@ -541,6 +549,8 @@ workflows:
             "contract_snapshot": {
               "baseline_source_sha256": "sha256 from contract sidecar",
               "diagnosis_artifact_sha256": "sha256 from contract sidecar",
+              "sidecar_semantic_sha256": "canonical routing sidecar sha256 from contract sidecar",
+              "diagnosis_semantic_sha256": "whitespace-normalized diagnosis sha256 from contract sidecar",
               "observed_failure_count": 0,
               "work_item_count": 0,
               "allowed_kinds": ["BUG", "UNIMPLEMENTED", "INFRA", "REMOVED", "TEST_BUG"]
@@ -560,7 +570,7 @@ workflows:
           APPROVE → diagnosis complete.
           REQUEST_REANALYSIS → sections_to_fix must be passed back to analyze. If contract_valid is false, set failure_reason to DIAGNOSIS_CONTRACT_INVALID and include the exact invalid rule in sections_to_fix. docs/behavior/blocked_items.md is historical context only and must not be treated as the current run verdict.
         completion:
-          - command_success: "node -e \"const fs=require('node:fs');const crypto=require('node:crypto');const path=require('node:path');const mod=process.env.ARGUMENTS||'$ARGUMENTS';const allowed=['BUG','UNIMPLEMENTED','INFRA','REMOVED','TEST_BUG'];const action=['BUG','UNIMPLEMENTED','INFRA','TEST_BUG'];const fail=m=>{throw new Error(m)};const same=(a,b)=>Array.isArray(a)&&a.length===b.length&&a.every((v,i)=>v===b[i]);const snapSame=(a,b)=>a&&b&&a.baseline_source_sha256===b.baseline_source_sha256&&a.diagnosis_artifact_sha256===b.diagnosis_artifact_sha256&&a.observed_failure_count===b.observed_failure_count&&a.work_item_count===b.work_item_count&&same(a.allowed_kinds,b.allowed_kinds);const root=fs.realpathSync(process.cwd());const inside=p=>{if(typeof p!=='string'||!p||path.isAbsolute(p))fail('path_invalid');const r=path.resolve(root,p);if(r!==root&&!r.startsWith(root+path.sep))fail('path_escape');if(fs.existsSync(r)){const real=fs.realpathSync(r);if(real!==root&&!real.startsWith(root+path.sep))fail('path_escape')}return r};const readJson=p=>JSON.parse(fs.readFileSync(inside(p),'utf8'));if(!/^[A-Za-z0-9_-]+$/.test(mod))fail('module');const contractPath='.dna/specs/diagnosis-'+mod+'.contract.json';const reviewPath='.dna/specs/diagnosis-'+mod+'.review.json';const diagnosisPath='.dna/specs/diagnosis-'+mod+'.md';const data=readJson(contractPath);if(data.contract_version!=='diagnosis-contract/v1')fail('contract_version');if(data.module!==mod)fail('module_mismatch');if(data.diagnosis_artifact!==diagnosisPath)fail('diagnosis_artifact_path');if(!same(data.allowed_kinds,allowed))fail('allowed_kinds');const observed=Array.isArray(data.observed_failures)?data.observed_failures:fail('observed_failures');const work=Array.isArray(data.work_items)?data.work_items:fail('work_items');if(!observed.length)fail('empty_observed_failures');if(!work.length)fail('empty_work_items');const ids=new Set(observed.map(x=>x&&x.id).filter(Boolean));if(ids.size!==observed.length)fail('observed_failure_ids');const failureById=new Map();for(const f of observed){if(typeof f.test_name!=='string'||!f.test_name.trim())fail('observed_failure_test_name');if(typeof f.symptom!=='string'||!f.symptom.trim())fail('observed_failure_symptom');if(!Array.isArray(f.evidence_paths)||!f.evidence_paths.length)fail('observed_failure_evidence');for(const p of f.evidence_paths)inside(p);if(f.kind!==undefined)fail('observed_failure_kind_forbidden');failureById.set(f.id,f)}const mapped=new Set();for(const item of work){if(!allowed.includes(item.kind))fail('invalid_kind');if(item.kind==='PLACEHOLDER_CONTRACT')fail('placeholder_kind');if(!Array.isArray(item.observed_failure_ids)||!item.observed_failure_ids.length)fail('work_item_observed_failure_ids');if(!Array.isArray(item.evidence_paths)||!item.evidence_paths.length)fail('work_item_evidence');for(const p of item.evidence_paths)inside(p);if(action.includes(item.kind)){if(!Array.isArray(item.v1_evidence_paths)||!item.v1_evidence_paths.length)fail('work_item_v1_evidence');if(!Array.isArray(item.v2_evidence_paths)||!item.v2_evidence_paths.length)fail('work_item_v2_evidence');for(const p of item.v1_evidence_paths)inside(p);for(const p of item.v2_evidence_paths)inside(p)}for(const id of item.observed_failure_ids){const f=failureById.get(id);if(!f)fail('unknown_observed_failure_id');if(action.includes(item.kind)&&(!f.test_name||!String(f.test_name).trim()))fail('action_test_evidence');mapped.add(id)}}if(mapped.size!==ids.size)fail('unmapped_observed_failures');for(const f of observed.filter(x=>String(x.symptom).includes('PLACEHOLDER_CONTRACT'))){const kinds=new Set(work.filter(i=>i.observed_failure_ids.includes(f.id)).map(i=>i.kind));if(![...kinds].every(k=>k==='TEST_BUG'||k==='UNIMPLEMENTED')||kinds.size===0)fail('placeholder_mapping')}const counts=data.baseline&&data.baseline.counts;if(!data.baseline||!data.baseline.source_path||!counts)fail('baseline');inside(data.baseline.source_path);for(const k of ['failed','skipped','hung']){if(!Number.isInteger(counts[k])||counts[k]<0)fail('baseline_count_'+k)}const total=counts.failed+counts.skipped+counts.hung;if(total!==observed.length)fail('baseline_count_mismatch');const summary=data.summary_counts||{};for(const kind of allowed){if(!Number.isInteger(summary[kind])||summary[kind]!==work.filter(x=>x.kind===kind).length)fail('summary_count_'+kind)}const sha=p=>crypto.createHash('sha256').update(fs.readFileSync(inside(p))).digest('hex');const snap=data.contract_snapshot||{};if(snap.observed_failure_count!==observed.length||snap.work_item_count!==work.length||!same(snap.allowed_kinds,allowed))fail('contract_snapshot');if(snap.baseline_source_sha256!==sha(data.baseline.source_path))fail('baseline_sha256');if(snap.diagnosis_artifact_sha256!==sha(diagnosisPath))fail('diagnosis_sha256');if(!data.staleness||data.staleness.is_stale!==false)fail('stale_contract');const review=readJson(reviewPath);if(review.contract_version!=='diagnosis-contract-review/v1')fail('review_contract_version');if(review.contract_valid!==true)fail('review_contract_valid');if(review.verdict!=='APPROVE')fail('review_verdict');if(review.contract_artifact_reviewed!==contractPath)fail('review_contract_artifact_path');if(review.artifact_reviewed!==diagnosisPath)fail('review_artifact_path');if(!snapSame(review.contract_snapshot,snap))fail('review_contract_snapshot');if(!review.updated_at||Number.isNaN(Date.parse(review.updated_at)))fail('review_updated_at');if(!Array.isArray(review.evidence_paths)||!review.evidence_paths.length)fail('review_evidence_paths');for(const p of review.evidence_paths)inside(p);const cm=fs.statSync(inside(contractPath)).mtimeMs;const dm=fs.statSync(inside(diagnosisPath)).mtimeMs;const rm=fs.statSync(inside(reviewPath)).mtimeMs;if(rm<cm||rm<dm)fail('review_stale');\""
+          - command_success: "node -e \"const fs=require('node:fs');const crypto=require('node:crypto');const path=require('node:path');const mod=process.env.ARGUMENTS||'$ARGUMENTS';const allowed=['BUG','UNIMPLEMENTED','INFRA','REMOVED','TEST_BUG'];const action=['BUG','UNIMPLEMENTED','INFRA','TEST_BUG'];const fail=m=>{console.error('INTENTDNA_DIAGNOSTIC:'+m);process.exit(1)};const same=(a,b)=>Array.isArray(a)&&a.length===b.length&&a.every((v,i)=>v===b[i]);const snapSame=(a,b)=>a&&b&&a.baseline_source_sha256===b.baseline_source_sha256&&a.diagnosis_artifact_sha256===b.diagnosis_artifact_sha256&&a.sidecar_semantic_sha256===b.sidecar_semantic_sha256&&a.diagnosis_semantic_sha256===b.diagnosis_semantic_sha256&&a.observed_failure_count===b.observed_failure_count&&a.work_item_count===b.work_item_count&&same(a.allowed_kinds,b.allowed_kinds);const root=fs.realpathSync(process.cwd());const inside=p=>{if(typeof p!=='string'||!p||path.isAbsolute(p))fail('path_invalid');const r=path.resolve(root,p);if(r!==root&&!r.startsWith(root+path.sep))fail('path_escape');if(fs.existsSync(r)){const real=fs.realpathSync(r);if(real!==root&&!real.startsWith(root+path.sep))fail('path_escape')}return r};const readJson=p=>JSON.parse(fs.readFileSync(inside(p),'utf8'));const hash=v=>crypto.createHash('sha256').update(v).digest('hex');const fileHash=p=>hash(fs.readFileSync(inside(p)));const normalizedDiagnosisHash=p=>hash(fs.readFileSync(inside(p),'utf8').replace(/\\s+/g,' ').trim());const canon=v=>Array.isArray(v)?'['+v.map(canon).join(',')+']':v&&typeof v==='object'?'{'+Object.keys(v).sort().map(k=>JSON.stringify(k)+':'+canon(v[k])).join(',')+'}':JSON.stringify(v);if(!/^[A-Za-z0-9_-]+$/.test(mod))fail('module');const contractPath='.dna/specs/diagnosis-'+mod+'.contract.json';const reviewPath='.dna/specs/diagnosis-'+mod+'.review.json';const diagnosisPath='.dna/specs/diagnosis-'+mod+'.md';const behaviorPath='docs/behavior/'+mod+'.md';const data=readJson(contractPath);if(data.contract_version!=='diagnosis-contract/v1')fail('contract_version');if(data.module!==mod)fail('module_mismatch');if(data.diagnosis_artifact!==diagnosisPath)fail('diagnosis_artifact_path');if(!same(data.allowed_kinds,allowed))fail('allowed_kinds');const observed=Array.isArray(data.observed_failures)?data.observed_failures:fail('observed_failures');const work=Array.isArray(data.work_items)?data.work_items:fail('work_items');if(!observed.length)fail('empty_observed_failures');if(!work.length)fail('empty_work_items');const idOk=id=>typeof id==='string'&&/^[A-Za-z0-9][A-Za-z0-9_.:-]*$/.test(id);const ids=new Set();for(const f of observed){if(!idOk(f&&f.id)||ids.has(f.id))fail('observed_failure_ids');ids.add(f.id)}const workIds=new Set();for(const item of work){if(!idOk(item&&item.id)||workIds.has(item.id))fail('work_item_ids');workIds.add(item.id)}const failureById=new Map();for(const f of observed){if(typeof f.test_name!=='string'||!f.test_name.trim())fail('observed_failure_test_name');if(typeof f.symptom!=='string'||!f.symptom.trim())fail('observed_failure_symptom');if(!Array.isArray(f.evidence_paths)||!f.evidence_paths.length)fail('observed_failure_evidence');for(const p of f.evidence_paths)inside(p);if(f.kind!==undefined)fail('observed_failure_kind_forbidden');failureById.set(f.id,f)}const mapped=new Set();for(const item of work){if(!allowed.includes(item.kind))fail('invalid_kind');if(item.kind==='PLACEHOLDER_CONTRACT')fail('placeholder_kind');if(!Array.isArray(item.observed_failure_ids)||!item.observed_failure_ids.length)fail('work_item_observed_failure_ids');if(!Array.isArray(item.evidence_paths)||!item.evidence_paths.length)fail('work_item_evidence');for(const p of item.evidence_paths)inside(p);if(action.includes(item.kind)){if(!Array.isArray(item.v1_evidence_paths)||!item.v1_evidence_paths.length)fail('work_item_v1_evidence');if(!Array.isArray(item.v2_evidence_paths)||!item.v2_evidence_paths.length)fail('work_item_v2_evidence');for(const p of item.v1_evidence_paths)inside(p);for(const p of item.v2_evidence_paths)inside(p)}for(const id of item.observed_failure_ids){const f=failureById.get(id);if(!f)fail('unknown_observed_failure_id');if(action.includes(item.kind)&&(!f.test_name||!String(f.test_name).trim()))fail('action_test_evidence');mapped.add(id)}}if(mapped.size!==ids.size)fail('unmapped_observed_failures');for(const f of observed.filter(x=>String(x.symptom).includes('PLACEHOLDER_CONTRACT'))){const kinds=new Set(work.filter(i=>i.observed_failure_ids.includes(f.id)).map(i=>i.kind));if(![...kinds].every(k=>k==='TEST_BUG'||k==='UNIMPLEMENTED')||kinds.size===0)fail('placeholder_mapping')}const counts=data.baseline&&data.baseline.counts;if(!data.baseline||!data.baseline.source_path||!counts)fail('baseline');for(const k of ['failed','skipped','hung']){if(!Number.isInteger(counts[k])||counts[k]<0)fail('baseline_count_'+k)}if(counts.failed+counts.skipped+counts.hung!==observed.length)fail('baseline_count_mismatch');const summary=data.summary_counts||{};for(const kind of allowed){if(!Number.isInteger(summary[kind])||summary[kind]!==work.filter(x=>x.kind===kind).length)fail('summary_count_'+kind)}const snap=data.contract_snapshot||{};const baselineHash=fileHash(data.baseline.source_path);const diagnosisHash=fileHash(diagnosisPath);if(snap.observed_failure_count!==observed.length||snap.work_item_count!==work.length||!same(snap.allowed_kinds,allowed))fail('contract_snapshot');if(snap.baseline_source_sha256!==baselineHash)fail('baseline_sha256');if(snap.diagnosis_artifact_sha256!==diagnosisHash)fail('diagnosis_sha256');const stale=data.staleness;if(!stale||stale.is_stale!==false)fail('stale_contract');const source=(entry,p,n,expected)=>{if(!entry||entry.path!==p)fail('staleness_'+n+'_path');if(entry.sha256!==expected)fail('staleness_'+n+'_sha256')};source(stale.behavior_doc,behaviorPath,'behavior_doc',fileHash(behaviorPath));source(stale.baseline,data.baseline.source_path,'baseline',baselineHash);source(stale.diagnosis_artifact,diagnosisPath,'diagnosis_artifact',diagnosisHash);const semantic=JSON.parse(JSON.stringify(data));delete semantic.contract_snapshot.sidecar_semantic_sha256;delete semantic.contract_snapshot.diagnosis_artifact_sha256;delete semantic.staleness.diagnosis_artifact;const sidecarSemanticHash=hash(canon(semantic));const diagnosisSemanticHash=normalizedDiagnosisHash(diagnosisPath);if(snap.sidecar_semantic_sha256!==sidecarSemanticHash||snap.diagnosis_semantic_sha256!==diagnosisSemanticHash)fail('contract_snapshot_semantic');const review=readJson(reviewPath);if(review.contract_version!=='diagnosis-contract-review/v1')fail('review_contract_version');if(review.contract_valid!==true)fail('review_contract_valid');if(review.verdict!=='APPROVE')fail('review_verdict');if(review.contract_artifact_reviewed!==contractPath)fail('review_contract_artifact_path');if(review.artifact_reviewed!==diagnosisPath)fail('review_artifact_path');if(!snapSame(review.contract_snapshot,snap))fail('review_contract_snapshot');if(!review.updated_at||Number.isNaN(Date.parse(review.updated_at)))fail('review_updated_at');if(!Array.isArray(review.evidence_paths)||!review.evidence_paths.length)fail('review_evidence_paths');for(const p of review.evidence_paths)inside(p);const cm=fs.statSync(inside(contractPath)).mtimeMs;const dm=fs.statSync(inside(diagnosisPath)).mtimeMs;const rm=fs.statSync(inside(reviewPath)).mtimeMs;if(rm<cm||rm<dm)fail('review_stale');\""
         handoff:
           consumes:
             - type: file

package/hooks/hooks.json

@@ -3,7 +3,7 @@
     "PreToolUse": [{ "matcher": "*", "hooks": [{ "type": "command", "command": "dna-hook PreToolUse", "timeout": 5 }] }],
     "PostToolUse": [{ "matcher": "*", "hooks": [{ "type": "command", "command": "dna-hook PostToolUse", "timeout": 3 }] }],
     "UserPromptSubmit": [{ "matcher": "*", "hooks": [{ "type": "command", "command": "dna-hook UserPromptSubmit", "timeout": 5 }] }],
-    "SubagentStop": [{ "matcher": "*", "hooks": [{ "type": "command", "command": "dna-hook SubagentStop", "timeout": 3 }] }],
+    "SubagentStop": [{ "matcher": "*", "hooks": [{ "type": "command", "command": "dna-hook SubagentStop", "timeout": 45 }] }],
     "PreCompact": [{ "matcher": "*", "hooks": [{ "type": "command", "command": "dna-hook PreCompact", "timeout": 3 }] }],
     "Notification": [{ "matcher": "*", "hooks": [{ "type": "command", "command": "dna-hook Notification", "timeout": 3 }] }],
     "Stop": [{ "matcher": "*", "hooks": [{ "type": "command", "command": "dna-hook Stop", "timeout": 45 }] }],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "intentdna",
-  "version": "1.8.3",
+  "version": "1.8.5",
   "description": "Intent DNA — Declarative policy layer for AI agent behavior",
   "type": "module",
   "main": "dist/index.js",