okstra 0.106.1 → 0.107.1

package/runtime/validators/validate-run.py

@@ -861,6 +861,57 @@ def _task_root_from_run_dir(run_dir: Path) -> Path:
     return run_dir.parent.parent
 
 
+def _validate_planning_conformance_declared(report_path: Path, failures: list[str]) -> None:
+    """H4-c — at planning time, every stage that DECLARES `Conformance tests:`
+    must already carry a matching entry in the shared task-level
+    `qa/conformance-manifest.json`. The profile mandates writing the script +
+    manifest entry as part of emitting that line
+    (implementation-planning.md:83/85); without this check a declaration that
+    was never materialized only surfaces much later at the `implementation`
+    entry gate. Matches by stageKey suffix (`-stage-<N>`) like
+    `_scope_manifest_entries`; skips stages that took a `Conformance exemption:`.
+    """
+    data_path = report_path.with_suffix(".data.json")
+    if not data_path.is_file():
+        return
+    try:
+        data = json.loads(data_path.read_text(encoding="utf-8"))
+    except (OSError, json.JSONDecodeError):
+        return
+    ip = data.get("implementationPlanning")
+    if not isinstance(ip, dict):
+        return
+    declaring_stages = [
+        s.get("stage")
+        for s in (ip.get("stages") or [])
+        if isinstance(s, dict) and str(s.get("conformanceTests") or "").strip()
+    ]
+    if not declaring_stages:
+        return
+    task_root = _task_root_from_run_dir(report_path.parent.parent)
+    manifest_path = task_root / "qa" / "conformance-manifest.json"
+    entries = []
+    if manifest_path.is_file():
+        try:
+            entries = json.loads(manifest_path.read_text()).get("entries") or []
+        except (OSError, json.JSONDecodeError):
+            entries = []
+    for stage_number in declaring_stages:
+        suffix = f"-stage-{stage_number}"
+        has_entry = any(
+            isinstance(e, dict) and str(e.get("stageKey") or "").endswith(suffix)
+            for e in entries
+        )
+        if not has_entry:
+            failures.append(
+                f"final-report data.json: stage {stage_number} declares "
+                "`Conformance tests:` but no matching entry exists in "
+                f"{manifest_path} (stageKey ending `{suffix}`). Emitting the "
+                "declaration MUST also write the manifest entry + script "
+                "(implementation-planning.md §Conformance)."
+            )
+
+
 def _validate_conformance(report_path: Path, failures: list[str],
                           surface_patterns: object = None) -> None:
     """Tier 3 conformance 게이트(implementation / final-verification).
@@ -1483,6 +1534,11 @@ def validate_final_report_data(report_path: Path, failures: list[str]) -> None:
     elif task_type == "implementation-planning":
         _validate_implementation_planning_cross_project(data, failures)
         _validate_implementation_planning_decision_drafts(data, failures)
+        _validate_plan_body_gate_recompute(data, failures)
+        _validate_plan_item_extraction_completeness(data, failures)
+        _validate_plan_item_subject_substance(data, failures)
+        _validate_plan_body_clarification_matching(data, failures)
+        _validate_requirement_coverage_covered_by(data, failures)
 
 
 # path:line (foo.service.ts:268), report ID (C-001 / F-013 / G-crit-002 / RC-1),
@@ -1584,6 +1640,302 @@ def _validate_implementation_planning_decision_drafts(data: dict, failures: list
         )
 
 
+# Plan-body gate outcomes ranked by how favorable each is to approval.
+# A higher rank claims a healthier verification result. The recompute check
+# below fails only when the *declared* gate outranks what the recorded
+# per-worker verdicts support — i.e. the lead claimed a better outcome than
+# the votes justify. A lead writing a conservatively *worse* gate is allowed,
+# so genuine edge cases in this recompute never manufacture false failures.
+_PLAN_GATE_RANK = {
+    "aborted-non-result": 0,
+    "blocked-by-disagreement": 0,
+    "passed-with-dissent": 1,
+    "passed": 2,
+}
+
+# Breakage kinds where a single DISAGREE blocks the gate on its own (no majority
+# needed), because the defect is concrete, safety-critical, and adversarially
+# verifiable: `a` = cited path/symbol mismatch, `d` = rollback violates
+# commit/dependency order. `b`/`c`/`e` still need a majority — `b` in particular
+# is prone to planning-vs-implementation environment false positives.
+_SINGLE_VOTE_BLOCKING_KINDS = {"a", "d"}
+
+
+def _classify_plan_item_gate(item: dict) -> str:
+    """Recompute one plan item's gate class from its per-worker verdicts,
+    per `prompts/lead/convergence.md` "Round protocol". Returns one of
+    ``majority-disagree`` / ``has-dissent`` / ``full-consensus`` /
+    ``all-non-result``. Collapses ``partial-consensus`` and
+    ``dissent-isolated`` into ``has-dissent`` because they resolve to the
+    same gate value; only the majority-disagree boundary changes the gate.
+    """
+    tokens = [
+        (
+            str(v.get("verdict") or "").strip().upper(),
+            str(v.get("breakageKind") or "").strip().lower(),
+        )
+        for v in (item.get("verdicts") or [])
+        if isinstance(v, dict)
+    ]
+    non_error = [(vd, bk) for (vd, bk) in tokens if vd and vd != "VERIFICATION-ERROR"]
+    if not non_error:
+        return "all-non-result"
+    disagree = [(vd, bk) for (vd, bk) in non_error if vd == "DISAGREE"]
+    agree = [(vd, bk) for (vd, bk) in non_error if vd in ("AGREE", "SUPPLEMENT")]
+    disagree_kinds = {bk for (_vd, bk) in disagree if bk}
+    if not disagree:
+        return "full-consensus"
+    # Single-vote-blocking kinds: one confirmed DISAGREE on a concrete,
+    # safety-critical, adversarially-verifiable defect is enough to block, even
+    # in a two-worker roster — a lone correct dissent must not be outvoted here.
+    # `a`/`d` for any item; `f` only for P-Req items (requirement coverage).
+    is_req = str(item.get("id") or "").upper().startswith("P-REQ")
+    if disagree_kinds & _SINGLE_VOTE_BLOCKING_KINDS or (is_req and "f" in disagree_kinds):
+        return "majority-disagree"
+    # Otherwise a genuine majority is required — and a majority needs at least
+    # two participating votes, so a lone surviving DISAGREE (its peer returned a
+    # non-result) does NOT block. That fixes the paradox where a worker failure
+    # made the gate stricter than a healthy roster would.
+    if len(non_error) >= 2 and len(disagree) > len(agree):
+        return "majority-disagree"
+    return "has-dissent"
+
+
+def _recompute_plan_body_gate(pbv: dict) -> str | None:
+    """Recompute the whole §5.5.9 gate value from ``planItems[].verdicts``.
+    Returns a value in ``PLAN_VERIFY_GATE_VALUES`` or ``None`` when there are
+    no plan items to judge (disabled / empty round)."""
+    classes = [
+        _classify_plan_item_gate(it)
+        for it in (pbv.get("planItems") or [])
+        if isinstance(it, dict)
+    ]
+    if not classes:
+        return None
+    if all(c == "all-non-result" for c in classes):
+        return "aborted-non-result"
+    if any(c == "majority-disagree" for c in classes):
+        return "blocked-by-disagreement"
+    if any(c == "has-dissent" for c in classes):
+        return "passed-with-dissent"
+    return "passed"
+
+
+def _validate_plan_body_gate_recompute(data: dict, failures: list[str]) -> None:
+    """H1 — the declared `Gate result` must not claim a healthier outcome than
+    the recorded per-worker verdicts support. Closes the forgery hole where a
+    lead writes `gateResult: passed` while workers actually voted DISAGREE:
+    the verdicts live in `planItems[].verdicts`, so the gate is recomputable
+    and no longer depends on the lead's honesty alone.
+    """
+    ip = data.get("implementationPlanning")
+    if not isinstance(ip, dict):
+        return
+    pbv = ip.get("planBodyVerification")
+    if not isinstance(pbv, dict):
+        return
+    declared = str(pbv.get("gateResult") or "").strip().lower()
+    recomputed = _recompute_plan_body_gate(pbv)
+    if recomputed is None or declared not in _PLAN_GATE_RANK:
+        return
+    if _PLAN_GATE_RANK[declared] > _PLAN_GATE_RANK[recomputed]:
+        failures.append(
+            "final-report data.json: implementationPlanning.planBodyVerification "
+            f"`gateResult` is `{declared}` but the recorded planItems[].verdicts "
+            f"only support `{recomputed}` (a majority DISAGREE, a DISAGREE(f) on "
+            "a P-Req item, or all-non-result dispatches were recorded). The gate "
+            "value must honestly aggregate the worker votes — do not upgrade it "
+            "to unblock the run (convergence.md Round protocol)."
+        )
+
+
+# Each plan-body deliverable array and the P-* verdict-item prefix it must be
+# extracted into for §5.5.9 cross-verification (convergence.md Plan-item
+# extraction). A weak item dropped from planItems escapes the gate entirely.
+_PLAN_ITEM_SOURCES = (
+    ("optionCandidates", "P-Opt", "Option Candidates (§4.5.1)"),
+    ("stepwiseExecution", "P-Step", "Stepwise Execution Order (§4.5.4)"),
+    ("dependencyMigrationRisk", "P-Dep", "Dependency / Migration Risk (§4.5.5)"),
+    ("validationChecklist", "P-Val", "Validation Checklist (§4.5.6)"),
+    ("rollbackStrategy", "P-Rb", "Rollback Strategy (§4.5.7)"),
+    ("requirementCoverage", "P-Req", "Requirement Coverage (§4.5.8)"),
+)
+
+
+def _validate_plan_item_extraction_completeness(data: dict, failures: list[str]) -> None:
+    """H2 — when a verification round ran, every plan-body deliverable item must
+    appear as a matching `P-*` verdict item. Closes the omission hole where the
+    lead silently drops a weak item (e.g. an out-of-order rollback) from
+    planItems so no worker ever verifies it, yet the gate still reads passed.
+    Requires only that no category is *under-extracted*; over-extraction is fine.
+    """
+    ip = data.get("implementationPlanning")
+    if not isinstance(ip, dict):
+        return
+    pbv = ip.get("planBodyVerification")
+    if not isinstance(pbv, dict):
+        return
+    round_count = pbv.get("roundCount")
+    if not isinstance(round_count, int) or round_count < 1:
+        return
+    extracted_ids = [
+        str(it.get("id") or "").upper()
+        for it in (pbv.get("planItems") or [])
+        if isinstance(it, dict)
+    ]
+    for field, prefix, label in _PLAN_ITEM_SOURCES:
+        source_count = len([r for r in (ip.get(field) or []) if isinstance(r, dict)])
+        if source_count == 0:
+            continue
+        extracted = len(
+            [i for i in extracted_ids if i.startswith(prefix.upper() + "-")]
+        )
+        if extracted < source_count:
+            failures.append(
+                f"final-report data.json: {label} has {source_count} item(s) but "
+                f"planBodyVerification.planItems carries only {extracted} "
+                f"`{prefix}-*` verdict item(s). Every plan-body item MUST be "
+                "extracted for cross-verification — a dropped item escapes the "
+                "gate (convergence.md Plan-item extraction)."
+            )
+
+
+# A `subject` this short or shaped like a bare `P-Opt-1` id is a placeholder,
+# not the plain-language "what this item is" label §5.5.9 renders as a heading.
+_MIN_SUBJECT_LEN = 3
+_BARE_PLAN_ITEM_ID_RE = re.compile(r"^P-(?:Opt|Step|Dep|Val|Rb|Req)-\d+$", re.IGNORECASE)
+
+
+def _validate_plan_item_subject_substance(data: dict, failures: list[str]) -> None:
+    """H2 follow-up — `planItems[].subject` must be a real label, not a
+    placeholder. The schema only enforces non-empty, so `"x"` or a copied
+    `P-Opt-1` id would otherwise slip through and defeat the whole point of the
+    subject (letting a reader see *what* each AGREE/DISAGREE is about).
+    """
+    ip = data.get("implementationPlanning")
+    if not isinstance(ip, dict):
+        return
+    pbv = ip.get("planBodyVerification")
+    if not isinstance(pbv, dict):
+        return
+    for item in pbv.get("planItems") or []:
+        if not isinstance(item, dict):
+            continue
+        item_id = str(item.get("id") or "").strip()
+        subject = str(item.get("subject") or "").strip()
+        if (
+            len(subject) < _MIN_SUBJECT_LEN
+            or subject == item_id
+            or _BARE_PLAN_ITEM_ID_RE.match(subject)
+        ):
+            failures.append(
+                f"final-report data.json: plan item `{item_id or '<unknown>'}` has a "
+                f"placeholder subject `{subject}`. Give a plain-language label of "
+                "what the item is (e.g. 'Option A: upload v2 를 신규 모듈로 분리') so "
+                "the §5.5.9 reader knows what each verdict is about "
+                "(convergence.md Plan-item extraction)."
+            )
+
+
+def _validate_plan_body_clarification_matching(data: dict, failures: list[str]) -> None:
+    """H5 — every plan item that the recorded verdicts make `majority-disagree`
+    must point (via `clarificationId`) at an existing `blocks: approval`
+    clarification row. Closes the hole where a majority-disagree item blocks the
+    gate but no §1 Clarification row is raised, so the user never sees why
+    approval is withheld (convergence.md self-review step 7).
+    """
+    ip = data.get("implementationPlanning")
+    if not isinstance(ip, dict):
+        return
+    pbv = ip.get("planBodyVerification")
+    if not isinstance(pbv, dict):
+        return
+    round_count = pbv.get("roundCount")
+    if not isinstance(round_count, int) or round_count < 1:
+        return
+    clar_rows = [r for r in (data.get("clarificationItems") or []) if isinstance(r, dict)]
+    all_ids = {r.get("id") for r in clar_rows if r.get("id")}
+    approval_ids = {r.get("id") for r in clar_rows if r.get("blocks") == "approval" and r.get("id")}
+    for item in pbv.get("planItems") or []:
+        if not isinstance(item, dict):
+            continue
+        if _classify_plan_item_gate(item) != "majority-disagree":
+            continue
+        item_id = item.get("id") or "<unknown>"
+        cid = item.get("clarificationId")
+        if not cid:
+            failures.append(
+                f"final-report data.json: plan item `{item_id}` is majority-disagree "
+                "but carries no `clarificationId`. A blocking disagreement MUST "
+                "surface as a `## 1. Clarification Items` row (blocks=approval) so "
+                "the user sees the blocker (convergence.md self-review step 7)."
+            )
+        elif cid not in approval_ids:
+            reason = (
+                "references a non-existent §1 row"
+                if cid not in all_ids
+                else "references a §1 row whose `blocks` is not `approval`"
+            )
+            failures.append(
+                f"final-report data.json: plan item `{item_id}` (majority-disagree) "
+                f"has clarificationId `{cid}` which {reason}. Every majority-disagree "
+                "item MUST map 1:1 to a `blocks: approval` Clarification row."
+            )
+
+
+_COVERED_BY_ANCHOR_RE = re.compile(r"option|stage|step", re.IGNORECASE)
+_COVERED_BY_STAGE_REF_RE = re.compile(r"stage\s*(\d+)", re.IGNORECASE)
+_COVERED_BY_VAGUE = {"recommended option", "the recommended option", "recommended"}
+
+
+def _validate_requirement_coverage_covered_by(data: dict, failures: list[str]) -> None:
+    """H3 (partial) — a `covered` requirement row's `coveredBy` must name a
+    concrete plan element that actually exists, not the spec-forbidden bare
+    "recommended option" nor a phantom stage. Whether the cited step truly
+    *satisfies* the requirement stays a worker DISAGREE(f) judgment; this closes
+    the coarser hole where `coveredBy` points at nothing real.
+    """
+    ip = data.get("implementationPlanning")
+    if not isinstance(ip, dict):
+        return
+    rows = [r for r in (ip.get("requirementCoverage") or []) if isinstance(r, dict)]
+    if not rows:
+        return
+    stage_numbers = {
+        s.get("stage") for s in (ip.get("stages") or []) if isinstance(s, dict)
+    }
+    for row in rows:
+        if row.get("status") != "covered":
+            continue
+        rid = row.get("id") or "<row>"
+        covered = str(row.get("coveredBy") or "").strip()
+        if covered.lower() in _COVERED_BY_VAGUE:
+            failures.append(
+                f"final-report data.json: requirementCoverage `{rid}` is `covered` "
+                f"but coveredBy is just `{covered}`. Name the specific Option "
+                "Candidate and Stage/Step that satisfies it, not 'recommended "
+                "option' (profile Requirement Coverage)."
+            )
+            continue
+        if not _COVERED_BY_ANCHOR_RE.search(covered):
+            failures.append(
+                f"final-report data.json: requirementCoverage `{rid}` coveredBy "
+                f"`{covered}` names no Option / Stage / Step. A `covered` row must "
+                "cite the concrete plan element that satisfies the requirement."
+            )
+            continue
+        phantom = [
+            n for m in _COVERED_BY_STAGE_REF_RE.finditer(covered)
+            if stage_numbers and (n := int(m.group(1))) not in stage_numbers
+        ]
+        if phantom:
+            failures.append(
+                f"final-report data.json: requirementCoverage `{rid}` coveredBy "
+                f"cites Stage {phantom[0]} which does not exist in the Stage Map. "
+                "A coverage row must point at a real stage."
+            )
+
+
 def _validate_final_verification_consistency(data: dict, failures: list[str]) -> None:
     """Enforce verdict ↔ blocker/condition/routing consistency on the
     final-verification data.json (SSOT). The schema guarantees field SHAPE;
@@ -2424,6 +2776,8 @@ def main() -> int:
             except (OSError, json.JSONDecodeError):
                 _sp = None
         _validate_conformance(report_path, failures, surface_patterns=_sp)
+    if task_type == "implementation-planning":
+        _validate_planning_conformance_declared(report_path, failures)
     if task_type == "improvement-discovery":
         brief_relative = str(task_manifest.get("taskBriefPath") or "").strip()
         brief_path = (