okstra 0.196.0 → 0.197.1

package/runtime/validators/validate-run.py

@@ -41,6 +41,7 @@ from okstra_project.dirs import tasks_root as _okstra_tasks_root  # noqa: E402
 from okstra_project.resolver import resolve_architecture  # noqa: E402
 
 from okstra_ctl.conformance import (  # noqa: E402
+    conformance_result_file,
     detect_surfaces,
     exempt_stage_surface_conflicts,
     evaluate_conformance,
@@ -56,6 +57,10 @@ from okstra_ctl.dispatch_state import (  # noqa: E402
     v2_worker_state_key,
 )
 from okstra_ctl.paths import RunRef, okstra_home, project_rel  # noqa: E402
+from okstra_ctl.tdd_bypass import (  # noqa: E402
+    bypass_file as tdd_bypass_file,
+    granted_stages,
+)
 from okstra_ctl.reconcile import settle_run_row  # noqa: E402
 from okstra_ctl.report_contract import CURRENT_REPORT_SCHEMA_VERSION  # noqa: E402
 from okstra_ctl.release_gate import (  # noqa: E402
@@ -1700,7 +1705,7 @@ def _load_conformance_results(qa_dir: Path, manifest: dict) -> dict:
         key = entry.get("stageKey") if isinstance(entry, dict) else None
         if not isinstance(key, str) or not key:
             continue
-        sidecar = qa_dir / f"result-{key}.json"
+        sidecar = conformance_result_file(qa_dir, key)
         if not sidecar.is_file():
             continue
         try:
@@ -1997,10 +2002,32 @@ def _approved_plan_conformance_manifest(
     }
 
 
+def _conformance_script_matches(actual: str, declared: str) -> bool:
+    """두 script 표기가 같은 파일을 가리키는지 판정한다.
+
+    1순위는 task-root 상대형끼리의 일치다. task_root 아래로 접히지 않는
+    절대경로(예: 워크트리 경로로 적힌 선언)가 남으면, 남은 쪽이 다른 쪽을
+    경로 경계에서 후행 일치하는지까지 본다 — `/…/wt/qa/scripts/s.ts` 와
+    `qa/scripts/s.ts` 는 같은 파일이다. 후행 일치는 경계(`/`)를 요구하므로
+    `renamed-stage-1.ts` 같은 다른 파일은 걸리지 않는다.
+    """
+    if actual == declared:
+        return True
+    if not actual or not declared:
+        return False
+    if actual.startswith("/") != declared.startswith("/"):
+        longer, shorter = (
+            (actual, declared) if actual.startswith("/") else (declared, actual)
+        )
+        return longer.endswith("/" + shorter)
+    return False
+
+
 def _declared_conformance_errors(
     declared_manifest: dict,
     actual_manifest: dict,
     stage_name: str | None,
+    task_root: Path,
 ) -> list[str]:
     """Compare scoped plan declarations with their one actual manifest entry."""
     declared = _scope_manifest_entries(declared_manifest, stage_name).get("entries", [])
@@ -2025,8 +2052,15 @@ def _declared_conformance_errors(
             errors.append(f"stage {stage_number} has multiple matching entries")
             continue
         actual_entry = matches[0]
-        actual_script = _normalize_conformance_script(str(actual_entry.get("script") or ""))
-        if actual_script != declaration.get("script"):
+        # 양쪽을 같은 task-root 상대형으로 접은 뒤 대조한다 — 계획이 절대경로를,
+        # 실행자가 상대형을 쓰면 같은 파일이 문자열로는 영영 안 맞는다.
+        actual_script = _normalize_conformance_script(
+            str(actual_entry.get("script") or ""), task_root
+        )
+        declared_script = _normalize_conformance_script(
+            str(declaration.get("script") or ""), task_root
+        )
+        if not _conformance_script_matches(actual_script, declared_script):
             errors.append(f"stage {stage_number} script mismatch")
         actual_requires = actual_entry.get("requires")
         actual_capabilities = (
@@ -2226,6 +2260,7 @@ def _validate_conformance(
                 declared_manifest,
                 empty_scoped_manifest,
                 stage_name,
+                task_root,
             ):
                 failures.append(
                     f"conformance gate BLOCKING: approved plan {error}; "
@@ -2252,6 +2287,7 @@ def _validate_conformance(
             declared_manifest,
             manifest,
             stage_name,
+            task_root,
         ):
             failures.append(
                 f"conformance gate BLOCKING: approved plan {error} "
@@ -6352,9 +6388,14 @@ def _plan_verify_dispatched_results(
             # critic 동수 라운드는 `kind: "critic"` 으로 나간다 — 결과 파일명은
             # 같은 `-plan-verify-r<N>-` 꼴이다. reverify 계열만 세면 동수가 있던
             # run 마다 critic 표가 "디스패치 기록 없음" 으로 오탐된다(2026-09-09,
-            # fontsninja-v3-site dev-10627 planning 002).
+            # fontsninja-v3-site dev-10627 planning 002). 계획 본문 라운드 자신의
+            # kind 인 `plan-verify-r<N>` 도 같은 이유로 센다.
             kind = str(row.get("kind") or "")
-            if not (kind.startswith("reverify-r") or kind == "critic"):
+            if not (
+                kind.startswith("reverify-r")
+                or kind.startswith("plan-verify-r")
+                or kind == "critic"
+            ):
                 continue
             name = Path(str(row.get("workerResultPath") or "")).name
             if "-plan-verify-r" not in name:
@@ -8003,13 +8044,19 @@ def _load_stage_validator():
     return mod
 
 
-def _append_stage_data_failures(data: Mapping[str, Any], failures: list[str]) -> None:
+def _append_stage_data_failures(
+    data: Mapping[str, Any], failures: list[str], task_root: Path | None = None,
+) -> None:
     """Run the stage relationship checks that schema v2 cannot express.
 
     The depends-on DAG, parallel-stage file safety, RED→GREEN ordering, and
     the TDD-exemption vocabulary are relationships between stages, which a
     JSON Schema cannot state. They are enforced here, against the data.json,
     by the same validator that owns the rule vocabulary.
+
+    `tddExemption: user-bypass` is the one reason the plan cannot assert by
+    itself, so the user's grants are read from the task's own bypass ledger
+    and passed in; without the task root no stage counts as granted.
     """
     if (data or {}).get("schemaVersion") != CURRENT_REPORT_SCHEMA_VERSION:
         return  # Schema validation already rejected an unknown version.
@@ -8020,7 +8067,11 @@ def _append_stage_data_failures(data: Mapping[str, Any], failures: list[str]) ->
     if mod is None:  # pragma: no cover — repo/runtime always ship the file
         failures.append(f"cannot load Stage Map validator at {_STAGE_VALIDATOR_PATH}")
         return
-    for e in mod.collect_data_validation_errors(dict(planning)):
+    granted = (
+        frozenset(granted_stages(tdd_bypass_file(task_root)))
+        if task_root is not None else frozenset()
+    )
+    for e in mod.collect_data_validation_errors(dict(planning), granted):
         failures.append(
             f"implementation-planning stage contract invalid "
             f"[{e.code} stage={e.stage}]: {e.message}"
@@ -9485,7 +9536,11 @@ def main() -> int:
                 )
                 _validate_stage_has_requirement(validation_data, failures)
             if task_type == "implementation-planning":
-                _append_stage_data_failures(validation_data, failures)
+                _append_stage_data_failures(
+                    validation_data,
+                    failures,
+                    _task_root_from_run_dir(report_path.parent.parent),
+                )
         if task_type == "improvement-discovery":
             run_dir = report_path.parent.parent
             _validate_improvement_discovery(report_path, run_dir, brief_path, failures)