opencode-plugin-flow 7.0.1 → 7.1.0

package/dist/index.js

@@ -185,6 +185,19 @@ Save one plan with:
 - \`overview\`: the implementation approach and important boundaries.
 - \`requirements\`: acceptance criteria, constraints, and non-goals.
 - \`decisions\`: assumptions and architecture or scope choices already made.
+- \`gate\`: the canonical whole-repository command, read from repository
+  configuration. Broad evidence later runs this command byte-for-byte, so a check
+  too weak to fail forecloses broad evidence for the session.
+- \`externalEvidence\`: each acceptance observation needing an operating system,
+  architecture, service, credential, setting, or hardware this host may lack, as
+  \`requirement\`, \`environment\`, the exact \`command\` whose passing is that observation,
+  \`platform\`: \`win32\`, \`darwin\`, \`linux\`, or \`other\` for a non-OS environment, and
+  \`assertions\`: the test case names whose passing is that observation, empty for
+  evidence that is not a test result. Empty list when the goal is fully observable
+  here. That command, on that platform, reporting those cases passing is what
+  satisfies it: final review and completed closure stay refused until then. A skipped
+  case exits zero and satisfies nothing, and recording the gap as a \`requirements\`
+  non-goal declares nothing.
 - \`features\`: ordered outcome slices, each with a stable \`id\`, \`title\`,
   \`summary\`, bounded \`targets\`, concrete \`validation\`, and \`dependsOn\` ids.
 
@@ -198,19 +211,14 @@ Preserve stable finding, issue, or requirement IDs exactly in the saved feature
 \`summary\` or \`validation\`; each stays traceable from the immutable plan to one
 outcome and its evidence.
 
-When \`validation\` names an executable command, record the exact plan-listed
-command byte-for-byte. Unrun behavior prose remains reviewer judgment, never a
-fabricated command result. Explicitly name any required operating system,
-architecture, service, credential, external setting, hardware, or evidence
-environment for \`flow-run\` to preflight before implementation.
+A \`validation\` entry naming a command is recorded byte-for-byte; prose there stays
+reviewer judgment, never a fabricated result.
 
 Before saving, confirm:
 
 - every requirement maps to a feature or an explicit non-goal;
 - targets name real files, modules, routes, commands, or artifacts;
 - validation names the behavior or contract the check will prove;
-- every required evidence environment has an identified execution path, and
-  any path needing user or external authority is explicit;
 - dependencies capture true ordering without circular or hidden work;
 - assumptions and intentional gaps are visible in \`decisions\`.
 
@@ -303,11 +311,9 @@ read-only access. It is evidence, not a verdict. Lack of shell access alone is
 not a failure; a missing or conflicting baseline fact, or a material mode,
 platform, race, or failure-path claim without proof, is.
 
-Validation scope is a claim. Treat \`broad\` as adequate only when the durable
-command is the repository's canonical applicable gate or a justified equivalent
-for the delivered state. Flow deliberately projects no raw command output; use
-the durable command, exit code, completeness, digest, source binding, and your
-workspace inspection. A weak or unclear coverage claim is an evidence gap.
+Flow deliberately projects no raw command output; use the durable command, exit
+code, completeness, digest, source binding, and your workspace inspection. A weak or
+unclear coverage claim is an evidence gap.
 
 For a final assignment, also inspect broad validation and confirm docs,
 commands, package surfaces, and remaining gaps are consistent with completion.
@@ -488,9 +494,9 @@ feature and current worktree:
 
 - Preserve every named finding/requirement; map each to an observable acceptance
   outcome.
-- Inventory exact commands, behavior evidence, required operating system,
-  architecture, service, credential, external setting, or hardware, and an
-  authorized path for each.
+- Inventory each \`externalEvidence\` command, its platform, and where it writes a
+  JUnit report: arm it with \`resultsPath\` naming that file, or its declared cases go
+  unobserved and the entry stays open on exit zero.
 - Reuse one conversational run baseline of unrelated work, deletions, renames,
   file types, and executable modes. Refresh changed facts; give each review only
   facts the feature changes or depends on, and give final review the full
@@ -501,9 +507,8 @@ feature and current worktree:
   state-machine work, express it as a compact matrix with \`state/interleaving\`,
   \`event\`, \`expected outcome\`, \`cleanup/invariant\`, and \`evidence\` columns.
 
-Carry the checklist/IDs through workers and review. Required evidence needing
-user or external authority stops before implementation. If skipped or unavailable, it forbids
-\`flow_review_start\`; a substitute pass cannot cure it.
+Carry the checklist/IDs through workers and review. Evidence needing user or
+external authority stops before implementation.
 
 ## Implement
 
@@ -547,9 +552,8 @@ checks from the changed behavior and risk:
   sufficient alone only for genuinely mechanical or documentation-only work.
 - UI claims need visual inspection when a runnable target is available.
 - Cleanup claims need behavior-preservation evidence, not formatting alone.
-- \`scope: "broad"\` is a coverage claim, not a stronger label. Use it only for the
-  repository's canonical applicable gate or a justified equivalent covering the
-  delivered repository state.
+- \`scope: "broad"\` runs the plan's declared \`gate\` and nothing else; the runtime
+  refuses any other command at that scope.
 
 Immediately before each evidence Bash command, call \`flow_validation_start\`
 with current revision, feature id, exact command, and \`scope\` (\`focused\` or
@@ -557,35 +561,29 @@ with current revision, feature id, exact command, and \`scope\` (\`focused\` or
 records the host observation; copy no host-observed fields into a later request.
 The command is durable, so include no secrets.
 
-Exact plan-listed gate commands are recorded byte-for-byte.
-A failed, incomplete, or source-drifted exact plan-listed observation creates a
-freshness boundary. Before new review admission, that gate needs a complete
-exit-zero observation for current source recorded after its latest relevant
-failure or drift; returning to an older digest does not revive an earlier pass,
-and substitute broad validation cannot discharge it. Plan-listed validation prose
-that has never run as an exact command remains reviewer judgment, not a fabricated
-pass or failure.
+A failed, incomplete, or source-drifted observation of a plan-listed command or of
+the declared \`gate\` blocks review until that same command passes for current
+source. No substitute discharges it; reverting the source revives nothing.
 
-A gate that cannot pass withholds completed closure, and reporting the blocker is
-half the move. Fix the gate, or ask the user to choose deferred or abandoned
-closure. Ending the turn having done neither leaves the workflow with no next step.
+A gate or \`externalEvidence\` command that cannot pass withholds completed closure,
+and reporting the blocker is half the move. Reach the passing command, or ask the
+user to choose deferred or abandoned closure. Ending the turn having done neither
+leaves the workflow with no next step, whatever the blocker was.
 
 Every host-observed validation advances the session revision, so the revision
 that armed a completed command is stale. The \`[flow-validation]\` marker reports
-\`passed\` and \`recordedRevision\`. Use \`recordedRevision\` for the next
+\`passed\`, \`recordedRevision\`, and any declared \`assertions\` with what the report
+said about each. Use \`recordedRevision\` for the next
 \`flow_validation_start\`, or for \`flow_review_start\` only when \`passed: true\`. If
 the marker is absent or malformed, refresh compact status before mutating.
 
 Use focused validation for ordinary features. For the final feature, run the
-repository's broad applicable gate after the last relevant edit. A source edit
-invalidates earlier applicability. Failed or unavailable checks are blockers,
-not passing evidence. If the canonical gate cannot run, explain why the chosen
-equivalent is broad enough.
+plan's declared \`gate\` at broad scope after the last relevant edit. A source edit
+invalidates earlier applicability. Failed or unavailable checks are blockers, not
+passing evidence.
 
-Immediately before review admission, reconcile the preflight inventory against
-the recorded current-source observations. Do not call \`flow_review_start\` while
-known required behavior or environment evidence is skipped or unavailable,
-including requirements that are not exact stored commands.
+Immediately before review admission, reconcile the preflight inventory against the
+recorded current-source observations.
 
 ## Review and record
 
@@ -923,9 +921,12 @@ function reviewerSteps(env, onWarning) {
   }
   return Number(raw);
 }
+var SHARED_REVIEWER_MODEL_NOTICE = "Flow: no OPENCODE_FLOW_REVIEWER_MODEL is set, so the independent reviewer runs on the same model as the manager. Independence is stronger with a different model family; set OPENCODE_FLOW_REVIEWER_MODEL to a provider/model this host can reach.";
 function createFlowCoreConfigEntries(options) {
   const env = options?.env ?? process.env;
   const model = envValue(env, "OPENCODE_FLOW_REVIEWER_MODEL");
+  if (!model)
+    options?.onNotice?.(SHARED_REVIEWER_MODEL_NOTICE);
   const steps = reviewerSteps(env, options?.onWarning);
   return {
     agent: {
@@ -948,7 +949,8 @@ function createFlowCoreConfigEntries(options) {
 }
 function applyFlowConfig(config, options) {
   const entries = createFlowCoreConfigEntries({
-    ...options?.onWarning ? { onWarning: options.onWarning } : {}
+    ...options?.onWarning ? { onWarning: options.onWarning } : {},
+    ...options?.onNotice ? { onNotice: options.onNotice } : {}
   });
   for (const name of Object.keys(entries.agent)) {
     if (config.agent && name in config.agent)
@@ -1022,6 +1024,8 @@ var MAX_TEXT_BYTES = 32 * 1024;
 var MAX_ARTIFACTS = 128;
 var MAX_PATH_BYTES = 4 * 1024;
 var MAX_VALIDATION_ID_LENGTH = 256;
+var MAX_DECLARED_ASSERTIONS = 32;
+var MAX_TEST_REPORT_BYTES = 4 * 1024 * 1024;
 var MAX_VALIDATIONS_PER_RUN = MAX_PLAN_FEATURES + 1;
 var MAX_REVIEW_FINDINGS = 100;
 var MAX_SESSION_BYTES = 4 * 1024 * 1024;
@@ -1062,8 +1066,243 @@ function isFeatureId(value) {
   return FEATURE_ID_PATTERN.test(value);
 }
 
+// src/domain/test-results.ts
+var TESTCASE = /<testcase\b([^>]*?)(\/>|>([\s\S]*?)<\/testcase\s*>)/g;
+var ATTRIBUTE = /([\w:.-]+)\s*=\s*"([^"]*)"/g;
+var NEGATIVE = /<(failure|error|skipped)\b/;
+function attributes(source) {
+  const found = {};
+  for (const match of source.matchAll(ATTRIBUTE)) {
+    if (match[1])
+      found[match[1]] = decodeEntities(match[2] ?? "");
+  }
+  return found;
+}
+function decodeEntities(value) {
+  return value.replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&quot;/g, '"').replace(/&apos;/g, "'").replace(/&amp;/g, "&");
+}
+function labels(attributes2) {
+  const name = attributes2.name ?? "";
+  if (name === "")
+    return [];
+  const suites = [
+    attributes2.classname,
+    attributes2.class,
+    attributes2.file,
+    attributes2.filepath
+  ].filter((suite) => suite !== undefined && suite !== "");
+  return [
+    name,
+    ...new Set(suites.flatMap((suite) => [
+      `${suite} ${name}`,
+      `${suite}.${name}`,
+      `${suite} > ${name}`
+    ]))
+  ];
+}
+function absent(declared) {
+  return declared.slice(0, MAX_DECLARED_ASSERTIONS).map((name) => ({ name, status: "absent" }));
+}
+function observeAssertions(declared, report) {
+  const outcomes = new Map;
+  if (!/<testsuites?\b/.test(report))
+    return absent(declared);
+  for (const match of report.matchAll(TESTCASE)) {
+    const body = match[3] ?? "";
+    const status = NEGATIVE.test(body) ? /<skipped\b/.test(body) ? "skipped" : "failed" : "passed";
+    for (const label of labels(attributes(match[1] ?? ""))) {
+      const prior = outcomes.get(label);
+      if (prior === undefined || prior === "passed" && status !== "passed") {
+        outcomes.set(label, status);
+      }
+    }
+  }
+  return declared.slice(0, MAX_DECLARED_ASSERTIONS).map((name) => ({
+    name,
+    status: outcomes.get(name) ?? "absent"
+  }));
+}
+function assertionsSatisfied(declared, observed) {
+  return declared.every((name) => (observed ?? []).some((assertion) => assertion.name === name && assertion.status === "passed"));
+}
+function unmetAssertions(declared, observed) {
+  return declared.flatMap((name) => {
+    const found = (observed ?? []).find((assertion) => assertion.name === name);
+    if (found?.status === "passed")
+      return [];
+    return [`${JSON.stringify(name)} ${found?.status ?? "absent"}`];
+  });
+}
+
+// src/domain/transition-error.ts
+class FlowTransitionError extends Error {
+  code = "FLOW_TRANSITION_REJECTED";
+}
+
+// src/domain/validation.ts
+var VALIDATION_INELIGIBLE_REASONS = [
+  "source-drift",
+  "exit-code-unavailable",
+  "output-completeness-unknown"
+];
+var LONGEST_VALIDATION_INELIGIBLE_REASON = VALIDATION_INELIGIBLE_REASONS.reduce((longest, reason) => reason.length > longest.length ? reason : longest);
+var EVIDENCE_PLATFORMS = [
+  "win32",
+  "darwin",
+  "linux",
+  "other"
+];
+var LONGEST_EVIDENCE_PLATFORM = EVIDENCE_PLATFORMS.reduce((longest, platform) => platform.length > longest.length ? platform : longest);
+function normalizeEvidencePlatform(value) {
+  return EVIDENCE_PLATFORMS.find((platform) => platform !== "other" && platform === value) ?? "other";
+}
+function isValidationEligible(observation, sourceDigest) {
+  return observation.ineligibleReason === undefined && observation.exitCode === 0 && observation.outputComplete && (sourceDigest === undefined || observation.sourceDigest === sourceDigest);
+}
+var NARROWING_FLAGS = new Set([
+  "-t",
+  "--test-name-pattern",
+  "--testNamePattern",
+  "-k",
+  "-run",
+  "--grep",
+  "--filter"
+]);
+function narrowingArguments(command) {
+  return command.split(/\s+/).slice(1).filter((token) => {
+    if (token.startsWith("-")) {
+      return NARROWING_FLAGS.has(token.split("=")[0] ?? token);
+    }
+    const file = token.split("/").pop() ?? "";
+    return /\.(?:test|spec)\./.test(file) || /_test\.[a-z]+$/.test(file) || /^test_.+\.py$/.test(file);
+  });
+}
+function declaredAssertions(session, command) {
+  return [
+    ...new Set((session.plan?.externalEvidence ?? []).filter((entry) => entry.command === command).flatMap((entry) => entry.assertions ?? []))
+  ];
+}
+function sameAssertions(left, right) {
+  const serialize = (value) => JSON.stringify((value ?? []).map((assertion) => [assertion.name, assertion.status]));
+  return serialize(left) === serialize(right);
+}
+function recordValidation(session, input) {
+  if (input.captureId.length < 1 || input.captureId.length > MAX_VALIDATION_ID_LENGTH) {
+    throw new FlowTransitionError(`Validation capture id must contain 1-${MAX_VALIDATION_ID_LENGTH} characters.`);
+  }
+  if (input.exitCode === null && input.ineligibleReason === undefined) {
+    throw new FlowTransitionError("An observation without an exit code must record an ineligible reason.");
+  }
+  const prior = session.runs.flatMap((run2) => run2.validations).find((validation) => validation.id === input.captureId);
+  if (prior) {
+    if (prior.featureId !== input.featureId || prior.runId !== input.runId || prior.scope !== input.scope || prior.command !== input.command || prior.sourceDigest !== input.sourceDigest || prior.exitCode !== input.exitCode || prior.outputDigest !== input.outputDigest || prior.outputComplete !== input.outputComplete || prior.hostPlatform !== input.hostPlatform || prior.resultsPath !== input.resultsPath || !sameAssertions(prior.observedAssertions, input.observedAssertions) || prior.ineligibleReason !== input.ineligibleReason) {
+      throw new FlowTransitionError("Validation capture id was already used for a different observation.");
+    }
+    return { session, value: prior, replayed: true };
+  }
+  if (session.closure) {
+    throw new FlowTransitionError("This Flow session is closed and archive-only.");
+  }
+  const run = session.runs.find((candidate) => candidate.state === "active");
+  if (!run || run.id !== input.runId || run.featureId !== input.featureId) {
+    throw new FlowTransitionError("Validation no longer belongs to the active feature run.");
+  }
+  if (run.reviews.length > 0) {
+    throw new FlowTransitionError("Validation cannot be recorded after review has begun.");
+  }
+  if (run.validations.length >= MAX_VALIDATIONS_PER_RUN) {
+    throw new FlowTransitionError(`A feature run may contain at most ${MAX_VALIDATIONS_PER_RUN} validation observations.`);
+  }
+  if (input.scope === "broad") {
+    const narrowing = narrowingArguments(input.command);
+    if (narrowing.length > 0) {
+      throw new FlowTransitionError(`A broad observation cannot select which tests it runs (${narrowing.join(", ")}). Arm the repository's canonical gate, or record this command as focused.`);
+    }
+    const gate = session.plan?.gate;
+    if (gate !== undefined && input.command !== gate) {
+      throw new FlowTransitionError(`A broad observation must run the plan-declared canonical gate (${gate}). Arm that exact command, or record this one as focused.`);
+    }
+  }
+  const revision = session.revision + 1;
+  const observation = {
+    id: input.captureId,
+    featureId: input.featureId,
+    runId: input.runId,
+    scope: input.scope,
+    command: input.command,
+    sourceDigest: input.sourceDigest,
+    exitCode: input.exitCode,
+    outputDigest: input.outputDigest,
+    outputComplete: input.outputComplete,
+    recordedRevision: revision,
+    ...input.hostPlatform ? { hostPlatform: input.hostPlatform } : {},
+    ...input.resultsPath ? { resultsPath: input.resultsPath } : {},
+    ...input.observedAssertions && input.observedAssertions.length > 0 ? { observedAssertions: input.observedAssertions } : {},
+    ...input.ineligibleReason ? { ineligibleReason: input.ineligibleReason } : {}
+  };
+  const draft = structuredClone(session);
+  return {
+    session: {
+      ...draft,
+      revision,
+      runs: draft.runs.map((candidate) => candidate.id === run.id ? {
+        ...candidate,
+        validations: [...candidate.validations, observation]
+      } : candidate)
+    },
+    value: observation,
+    replayed: false
+  };
+}
+function isObservedOnDeclaredPlatform(entry, observation) {
+  if (entry.platform === undefined || entry.platform === "other")
+    return true;
+  return observation.hostPlatform === entry.platform;
+}
+function externalEvidenceRefusal(session, entry, sourceDigest) {
+  const eligible = session.runs.flatMap((run) => run.validations).filter((observation) => observation.command === entry.command && isValidationEligible(observation, sourceDigest));
+  const wrongHosts = [
+    ...new Set(eligible.filter((observation) => !isObservedOnDeclaredPlatform(entry, observation)).map((observation) => observation.hostPlatform ?? "an unrecorded host"))
+  ];
+  const unmet = eligible.filter((observation) => isObservedOnDeclaredPlatform(entry, observation)).toSorted((left, right) => left.recordedRevision - right.recordedRevision).map((observation) => unmetAssertions(entry.assertions ?? [], observation.observedAssertions)).filter((names) => names.length > 0).at(-1);
+  const needs = entry.platform === undefined || entry.platform === "other" ? entry.environment : `${entry.environment} on ${entry.platform}`;
+  const detail = wrongHosts.length > 0 ? `passed on ${wrongHosts.join(", ")} but this entry declares ${entry.platform}, so that run observed something else — a skipped case exits zero too` : unmet ? `passed on ${entry.platform ?? "the declared host"} but reported no passing result for ${unmet.join(", ")}; arm it again with \`resultsPath\` naming the report the command writes, and make those cases run` : `needs ${needs}`;
+  return `${JSON.stringify(entry.command)} (${detail}, for ${entry.requirement})`;
+}
+function unsatisfiedExternalEvidence(session, sourceDigest) {
+  const declared = session.plan?.externalEvidence ?? [];
+  if (declared.length === 0)
+    return [];
+  const observed = session.runs.flatMap((run) => run.validations);
+  return declared.filter((entry) => !observed.some((observation) => observation.command === entry.command && isObservedOnDeclaredPlatform(entry, observation) && assertionsSatisfied(entry.assertions ?? [], observation.observedAssertions) && isValidationEligible(observation, sourceDigest)));
+}
+function isValidationFresh(session, run, observation) {
+  return session.runs.filter((candidate) => candidate.featureId === run.featureId).flatMap((candidate) => candidate.validations).every((candidate) => candidate.command !== observation.command || isValidationEligible(candidate) || candidate.recordedRevision < observation.recordedRevision);
+}
+function unresolvedVetoedCommands(session, run, sourceDigest) {
+  const gate = session.plan?.gate;
+  const planned = session.approval === "approved" ? [
+    ...session.plan?.features.find((candidate) => candidate.id === run.featureId)?.validation ?? [],
+    ...gate === undefined ? [] : [gate]
+  ] : [];
+  const failed = session.runs.filter((candidate) => candidate.featureId === run.featureId).flatMap((candidate) => candidate.validations).filter((observation) => !isValidationEligible(observation));
+  const commands = [
+    ...new Set(failed.filter((observation) => observation.scope === "broad" || planned.includes(observation.command)).map((observation) => observation.command))
+  ];
+  return commands.filter((command) => !run.validations.some((observation) => observation.command === command && isValidationEligible(observation, sourceDigest) && isValidationFresh(session, run, observation)));
+}
+
 // src/domain/plan.ts
+function gateIssue(gate) {
+  const narrowing = narrowingArguments(gate);
+  return narrowing.length === 0 ? null : `The plan's canonical gate cannot select which tests it runs (${narrowing.join(", ")}).`;
+}
 function planIssue(plan) {
+  if (plan.gate !== undefined) {
+    const issue = gateIssue(plan.gate);
+    if (issue)
+      return issue;
+  }
   if (Buffer.byteLength(JSON.stringify(plan), "utf8") > MAX_PLAN_BYTES) {
     return `A plan may contain at most ${MAX_PLAN_BYTES} UTF-8 bytes.`;
   }
@@ -1213,112 +1452,6 @@ function reviewResultSemanticIssues(result) {
   return issues;
 }
 
-// src/domain/transition-error.ts
-class FlowTransitionError extends Error {
-  code = "FLOW_TRANSITION_REJECTED";
-}
-
-// src/domain/validation.ts
-var VALIDATION_INELIGIBLE_REASONS = [
-  "source-drift",
-  "exit-code-unavailable",
-  "output-completeness-unknown"
-];
-var LONGEST_VALIDATION_INELIGIBLE_REASON = VALIDATION_INELIGIBLE_REASONS.reduce((longest, reason) => reason.length > longest.length ? reason : longest);
-function isValidationEligible(observation, sourceDigest) {
-  return observation.ineligibleReason === undefined && observation.exitCode === 0 && observation.outputComplete && (sourceDigest === undefined || observation.sourceDigest === sourceDigest);
-}
-var NARROWING_FLAGS = new Set([
-  "-t",
-  "--test-name-pattern",
-  "--testNamePattern",
-  "-k",
-  "-run",
-  "--grep",
-  "--filter"
-]);
-function narrowingArguments(command) {
-  return command.split(/\s+/).slice(1).filter((token) => {
-    if (token.startsWith("-")) {
-      return NARROWING_FLAGS.has(token.split("=")[0] ?? token);
-    }
-    const file = token.split("/").pop() ?? "";
-    return /\.(?:test|spec)\./.test(file) || /_test\.[a-z]+$/.test(file) || /^test_.+\.py$/.test(file);
-  });
-}
-function recordValidation(session, input) {
-  if (input.captureId.length < 1 || input.captureId.length > MAX_VALIDATION_ID_LENGTH) {
-    throw new FlowTransitionError(`Validation capture id must contain 1-${MAX_VALIDATION_ID_LENGTH} characters.`);
-  }
-  if (input.exitCode === null && input.ineligibleReason === undefined) {
-    throw new FlowTransitionError("An observation without an exit code must record an ineligible reason.");
-  }
-  const prior = session.runs.flatMap((run2) => run2.validations).find((validation) => validation.id === input.captureId);
-  if (prior) {
-    if (prior.featureId !== input.featureId || prior.runId !== input.runId || prior.scope !== input.scope || prior.command !== input.command || prior.sourceDigest !== input.sourceDigest || prior.exitCode !== input.exitCode || prior.outputDigest !== input.outputDigest || prior.outputComplete !== input.outputComplete || prior.ineligibleReason !== input.ineligibleReason) {
-      throw new FlowTransitionError("Validation capture id was already used for a different observation.");
-    }
-    return { session, value: prior, replayed: true };
-  }
-  if (session.closure) {
-    throw new FlowTransitionError("This Flow session is closed and archive-only.");
-  }
-  const run = session.runs.find((candidate) => candidate.state === "active");
-  if (!run || run.id !== input.runId || run.featureId !== input.featureId) {
-    throw new FlowTransitionError("Validation no longer belongs to the active feature run.");
-  }
-  if (run.reviews.length > 0) {
-    throw new FlowTransitionError("Validation cannot be recorded after review has begun.");
-  }
-  if (run.validations.length >= MAX_VALIDATIONS_PER_RUN) {
-    throw new FlowTransitionError(`A feature run may contain at most ${MAX_VALIDATIONS_PER_RUN} validation observations.`);
-  }
-  if (input.scope === "broad") {
-    const narrowing = narrowingArguments(input.command);
-    if (narrowing.length > 0) {
-      throw new FlowTransitionError(`A broad observation cannot select which tests it runs (${narrowing.join(", ")}). Arm the repository's canonical gate, or record this command as focused.`);
-    }
-  }
-  const revision = session.revision + 1;
-  const observation = {
-    id: input.captureId,
-    featureId: input.featureId,
-    runId: input.runId,
-    scope: input.scope,
-    command: input.command,
-    sourceDigest: input.sourceDigest,
-    exitCode: input.exitCode,
-    outputDigest: input.outputDigest,
-    outputComplete: input.outputComplete,
-    recordedRevision: revision,
-    ...input.ineligibleReason ? { ineligibleReason: input.ineligibleReason } : {}
-  };
-  const draft = structuredClone(session);
-  return {
-    session: {
-      ...draft,
-      revision,
-      runs: draft.runs.map((candidate) => candidate.id === run.id ? {
-        ...candidate,
-        validations: [...candidate.validations, observation]
-      } : candidate)
-    },
-    value: observation,
-    replayed: false
-  };
-}
-function isValidationFresh(session, run, observation) {
-  return session.runs.filter((candidate) => candidate.featureId === run.featureId).flatMap((candidate) => candidate.validations).every((candidate) => candidate.command !== observation.command || isValidationEligible(candidate) || candidate.recordedRevision < observation.recordedRevision);
-}
-function unresolvedVetoedCommands(session, run, sourceDigest) {
-  const planned = session.approval === "approved" ? session.plan?.features.find((candidate) => candidate.id === run.featureId)?.validation ?? [] : [];
-  const failed = session.runs.filter((candidate) => candidate.featureId === run.featureId).flatMap((candidate) => candidate.validations).filter((observation) => !isValidationEligible(observation));
-  const commands = [
-    ...new Set(failed.filter((observation) => observation.scope === "broad" || planned.includes(observation.command)).map((observation) => observation.command))
-  ];
-  return commands.filter((command) => !run.validations.some((observation) => observation.command === command && isValidationEligible(observation, sourceDigest) && isValidationFresh(session, run, observation)));
-}
-
 // src/domain/transitions.ts
 function fail(message) {
   throw new FlowTransitionError(message);
@@ -1374,6 +1507,22 @@ function assertPlan(plan) {
   if (issue)
     fail(issue);
 }
+function assertDeclaredGate(plan) {
+  if (plan.gate === undefined) {
+    fail("A saved plan must declare `gate`: the exact canonical command that validates the whole repository, which every broad observation then has to run.");
+  }
+}
+function assertDeclaredExternalEvidence(plan) {
+  if (plan.externalEvidence === undefined) {
+    fail("A saved plan must declare `externalEvidence`: every acceptance observation needing an environment this host may not be, each with the exact command whose passing is that observation. Declare an empty list when the goal is fully observable here.");
+  }
+  if (plan.externalEvidence?.some((entry) => entry.platform === undefined)) {
+    fail("Every `externalEvidence` entry must declare `platform`: the operating system that can observe it (`win32`, `darwin`, or `linux`), or `other` when the missing environment is a service, credential, setting, or device rather than an OS. Flow compares an OS against the host the command actually ran on.");
+  }
+  if (plan.externalEvidence?.some((entry) => entry.assertions === undefined)) {
+    fail("Every `externalEvidence` entry must declare `assertions`: the test case names whose passing is that observation, so a run cannot discharge it by exiting zero for a case that was skipped. Declare an empty list when the evidence is not a test result — a credential, a device, or a setting has no case names.");
+  }
+}
 function assertArtifacts(artifacts) {
   const issue = artifactIssues(artifacts)[0];
   if (issue)
@@ -1406,6 +1555,8 @@ function sessionStatus(session) {
 function savePlan(session, input, environment) {
   assertPlan(input.plan);
   if (!session) {
+    assertDeclaredGate(input.plan);
+    assertDeclaredExternalEvidence(input.plan);
     if (input.expectedRevision !== 0) {
       fail("A new Flow session must start from expectedRevision 0.");
     }
@@ -1435,6 +1586,8 @@ function savePlan(session, input, environment) {
   const replay = existingOperation(session, "plan-save", input.operationId, input);
   if (replay)
     return { session, value: null, replayed: true };
+  assertDeclaredGate(input.plan);
+  assertDeclaredExternalEvidence(input.plan);
   assertRevision(session, input.expectedRevision);
   assertMutable(session);
   if (session.approval === "approved")
@@ -1576,6 +1729,12 @@ function startReview(session, input, environment) {
     fail(`Review requires passing these exact commands for the current workspace content: ${unresolved.map((command) => JSON.stringify(command)).join(", ")}. A different command cannot discharge one that failed.`);
   }
   const kind = isFinalFeatureRun(session, run) ? "final" : "feature";
+  if (kind === "final") {
+    const unsatisfied = unsatisfiedExternalEvidence(session, input.sourceDigest);
+    if (unsatisfied.length > 0) {
+      fail(`Final review requires the plan's declared external evidence to pass for the current workspace content: ${unsatisfied.map((entry) => externalEvidenceRefusal(session, entry, input.sourceDigest)).join(", ")}. A substitute observation cannot discharge it. If the environment is unavailable, ask the user to choose deferred or abandoned closure.`);
+    }
+  }
   const applicable = run.validations.filter((validation) => isValidationEligible(validation, input.sourceDigest) && isValidationFresh(session, run, validation));
   const hasRequiredValidation = kind === "feature" ? applicable.length > 0 : applicable.some((validation) => validation.scope === "broad");
   if (!hasRequiredValidation) {
@@ -1752,6 +1911,12 @@ function closeSession(session, input) {
   if (input.kind === "completed" && sessionStatus(session) !== "completed") {
     fail("A completed close requires every planned feature to pass review.");
   }
+  if (input.kind === "completed") {
+    const unsatisfied = unsatisfiedExternalEvidence(session);
+    if (unsatisfied.length > 0) {
+      fail(`A completed close requires the plan's declared external evidence to have passed: ${unsatisfied.map((entry) => externalEvidenceRefusal(session, entry)).join(", ")}. Close deferred or abandoned instead.`);
+    }
+  }
   let closure = null;
   const next = commit(session, "session-close", input.operationId, input, (draft, revision) => {
     closure = {
@@ -1981,12 +2146,25 @@ var PlanFeatureSchema = z.object({
   validation: z.array(boundedText("Feature validation")).max(MAX_PLAN_FEATURES).default([]),
   dependsOn: z.array(FeatureIdSchema).max(MAX_PLAN_FEATURES).default([])
 }).strict();
+var ExternalEvidenceSchema = z.object({
+  requirement: boundedText("External evidence requirement"),
+  environment: boundedText("External evidence environment"),
+  command: boundedText("External evidence command"),
+  platform: z.enum(EVIDENCE_PLATFORMS).optional(),
+  assertions: z.array(boundedText("External evidence assertion")).max(MAX_DECLARED_ASSERTIONS).optional()
+}).strict();
+var ObservedAssertionSchema = z.object({
+  name: boundedText("Observed assertion name"),
+  status: z.enum(["passed", "failed", "skipped", "absent"])
+}).strict();
 var PlanSchema = z.object({
   summary: boundedText("Plan summary"),
   overview: boundedText("Plan overview"),
   requirements: z.array(boundedText("Plan requirement")).max(MAX_PLAN_FEATURES).default([]),
   decisions: z.array(boundedText("Plan decision")).max(MAX_PLAN_FEATURES).default([]),
-  features: z.array(PlanFeatureSchema).min(1).max(MAX_PLAN_FEATURES)
+  features: z.array(PlanFeatureSchema).min(1).max(MAX_PLAN_FEATURES),
+  gate: boundedText("Plan gate").optional(),
+  externalEvidence: z.array(ExternalEvidenceSchema).max(MAX_PLAN_FEATURES).optional()
 }).strict().superRefine((plan, context) => {
   if (encoder.encode(JSON.stringify(plan)).byteLength > MAX_PLAN_BYTES) {
     context.addIssue({
@@ -2026,6 +2204,11 @@ var ValidationObservationSchema = z.object({
   outputDigest: SourceDigestSchema,
   outputComplete: z.boolean(),
   recordedRevision: RevisionSchema,
+  hostPlatform: z.enum(EVIDENCE_PLATFORMS).optional(),
+  resultsPath: boundedText("Validation results path", {
+    maxBytes: MAX_PATH_BYTES
+  }).optional(),
+  observedAssertions: z.array(ObservedAssertionSchema).max(MAX_DECLARED_ASSERTIONS).optional(),
   ineligibleReason: z.enum(VALIDATION_INELIGIBLE_REASONS).optional()
 }).strict().refine((observation) => observation.exitCode !== null || observation.ineligibleReason !== undefined, {
   error: "An observation without an exit code must record an ineligible reason.",
@@ -2153,7 +2336,10 @@ var ValidationStartInputSchema = z.object({
     expectedRevision: RevisionSchema,
     featureId: FeatureIdSchema,
     command: boundedText("Validation command"),
-    scope: z.enum(["focused", "broad"])
+    scope: z.enum(["focused", "broad"]),
+    resultsPath: boundedText("Validation results path", {
+      maxBytes: MAX_PATH_BYTES
+    }).optional()
   }).strict()
 }).strict();
 var StatusInputSchema = z.object({
@@ -2364,7 +2550,13 @@ function reviewerProjection(session, assignmentId) {
         targets: [...candidate.targets],
         validation: [...candidate.validation],
         dependsOn: [...candidate.dependsOn]
-      }))
+      })),
+      ...plan.gate === undefined ? {} : { gate: plan.gate },
+      ...plan.externalEvidence === undefined ? {} : {
+        externalEvidence: plan.externalEvidence.map((entry) => ({
+          ...entry
+        }))
+      }
     } : null,
     feature: feature ?? null,
     assignment,
@@ -3521,6 +3713,10 @@ var flowFeatureCompleteReplay = (workspace, input) => service(workspace).feature
 var flowFeatureReset = (workspace, input) => service(workspace).featureReset(input);
 var flowSessionClose = (workspace, input) => service(workspace).sessionClose(input);
 
+// src/infrastructure/fs/workspace-validation.ts
+import { readFile as readFile2, stat } from "node:fs/promises";
+import { isAbsolute as isAbsolute2, join as join3, relative, resolve as resolve2 } from "node:path";
+
 // src/application/prepare-validation.ts
 function maximumSerializedUnusedCaptureId(session) {
   const used = new Set(session.runs.flatMap((run) => run.validations.map((validation) => validation.id)));
@@ -3539,6 +3735,11 @@ function maximumSerializedObservation(session, prepared) {
     exitCode: Number.MIN_SAFE_INTEGER,
     outputDigest: prepared.sourceDigest,
     outputComplete: false,
+    hostPlatform: LONGEST_EVIDENCE_PLATFORM,
+    observedAssertions: prepared.assertions.map((name) => ({
+      name,
+      status: "skipped"
+    })),
     ineligibleReason: LONGEST_VALIDATION_INELIGIBLE_REASON
   };
 }
@@ -3546,7 +3747,7 @@ function assertValidationCanBeRecorded(session, prepared) {
   const prospective = recordValidation(session, maximumSerializedObservation(session, prepared)).session;
   SessionSchema.parse(prospective);
 }
-async function prepareValidation(repository, input) {
+async function prepareValidation(repository, input, hostPlatform) {
   return repository.transact(async (transaction) => {
     const session = await transaction.load();
     if (!session)
@@ -3561,12 +3762,18 @@ async function prepareValidation(repository, input) {
     if (run.reviews.length > 0) {
       throw new Error("Validation cannot start after review has begun.");
     }
+    if (input.resultsPath !== undefined && !isArtifactPath(input.resultsPath)) {
+      throw new Error(`Validation results path: ${ARTIFACT_PATH_MESSAGE}`);
+    }
     const prepared = {
       featureId: run.featureId,
       runId: run.id,
       command: input.command,
       scope: input.scope,
-      sourceDigest: await transaction.computeSourceDigest()
+      sourceDigest: await transaction.computeSourceDigest(),
+      hostPlatform,
+      assertions: declaredAssertions(session, input.command),
+      resultsPath: input.resultsPath
     };
     assertValidationCanBeRecorded(session, prepared);
     return prepared;
@@ -3589,7 +3796,18 @@ async function persistObservedValidation(repository, input) {
 
 // src/infrastructure/fs/workspace-validation.ts
 function prepareWorkspaceValidation(workspace, input) {
-  return prepareValidation(createFileSessionRepository(workspace), input);
+  return prepareValidation(createFileSessionRepository(workspace), input, normalizeEvidencePlatform(process.platform));
+}
+async function readWorkspaceTestReport(workspace, relativePath) {
+  const root = resolve2(workspace);
+  const target = resolve2(join3(root, relativePath));
+  const inside = relative(root, target);
+  if (inside === "" || isAbsolute2(inside) || inside.split(/[\\/]/)[0] === "..")
+    return null;
+  const info = await stat(target).catch(() => null);
+  if (!info?.isFile() || info.size > MAX_TEST_REPORT_BYTES)
+    return null;
+  return { text: await readFile2(target, "utf8"), modifiedMs: info.mtimeMs };
 }
 function persistWorkspaceValidation(workspace, input) {
   return persistObservedValidation(createFileSessionRepository(workspace), input);
@@ -3646,6 +3864,7 @@ class AutoDriveCoordinator {
   #timing = null;
   #options;
   #hostParentage = false;
+  #hostMissingParentage = false;
   constructor(options) {
     this.#options = options;
   }
@@ -3794,8 +4013,12 @@ class AutoDriveCoordinator {
 ${FLOW_MANAGER_KERNEL}`;
   }
   observeHostMessage(host, message) {
-    if (message.role === "assistant" && message.parentID !== undefined)
-      this.#hostParentage = true;
+    if (message.role === "assistant") {
+      if (message.parentID === undefined)
+        this.#hostMissingParentage = true;
+      else
+        this.#hostParentage = true;
+    }
     const lease = this.#lease;
     if (lease?.hostSessionId !== host)
       return;
@@ -3853,6 +4076,11 @@ ${FLOW_MANAGER_KERNEL}`;
     if (revision > point.revision)
       point.advance = revision + Number(reviewerPending);
   }
+  continuationSupport() {
+    if (this.#hostParentage)
+      return "supported";
+    return this.#hostMissingParentage ? "unsupported" : "unknown";
+  }
   timingSnapshot() {
     const timing = this.#timing;
     if (!timing)
@@ -4002,6 +4230,7 @@ function createConfigHook(ctx, options) {
     }
     applyFlowConfig(config, {
       onWarning: (warning) => log("warn", warning),
+      onNotice: (notice) => log("info", notice),
       onCollision: (kind, name) => log("warn", `Flow replaced a user-defined ${kind} named '${name}'; rename the local entry while Flow is enabled.`)
     });
   };
@@ -4009,7 +4238,7 @@ function createConfigHook(ctx, options) {
 
 // src/platform/opencode/leadership.ts
 import { realpathSync as realpathSync2 } from "node:fs";
-import { resolve as resolve2 } from "node:path";
+import { resolve as resolve3 } from "node:path";
 var REGISTRY_KIND = "opencode-plugin-flow.runtime-leadership";
 var REGISTRY_FORMAT_VERSION = 2;
 var FLOW_LEADERSHIP_PROTOCOL_VERSION = 1;
@@ -4026,7 +4255,7 @@ function validIdentity(value) {
 function canonicalProjectId(scopeId) {
   if (!boundedText2(scopeId))
     throw new TypeError("Flow runtime scope must be a non-empty path.");
-  const projectId = resolve2(scopeId);
+  const projectId = resolve3(scopeId);
   try {
     return realpathSync2(projectId);
   } catch {
@@ -4190,7 +4419,15 @@ var plan = host.object({
   overview: text,
   requirements: host.array(text).max(MAX_PLAN_FEATURES).default([]),
   decisions: host.array(text).max(MAX_PLAN_FEATURES).default([]),
-  features: host.array(planFeature).min(1).max(MAX_PLAN_FEATURES)
+  features: host.array(planFeature).min(1).max(MAX_PLAN_FEATURES),
+  gate: text.optional(),
+  externalEvidence: host.array(host.object({
+    requirement: text,
+    environment: text,
+    command: text,
+    platform: host.enum(EVIDENCE_PLATFORMS).optional(),
+    assertions: host.array(text).max(MAX_DECLARED_ASSERTIONS).optional()
+  }).strict()).max(MAX_PLAN_FEATURES).optional()
 }).strict().superRefine((value, context) => {
   if (encoder2.encode(JSON.stringify(value)).byteLength > MAX_PLAN_BYTES) {
     context.addIssue({
@@ -4238,7 +4475,10 @@ var ValidationStartArgs = {
     expectedRevision: revision,
     featureId,
     command: text,
-    scope: host.enum(["focused", "broad"])
+    scope: host.enum(["focused", "broad"]),
+    resultsPath: boundedHostText("Validation results path", {
+      maxBytes: MAX_PATH_BYTES
+    }).optional()
   }).strict()
 };
 var ReviewStartArgs = {
@@ -4291,23 +4531,30 @@ function toolError(error) {
     }
   });
 }
-function withAutoTiming(response, snapshot2) {
-  if (!snapshot2)
-    return response;
+function withAutoContext(response, options) {
+  let workflowData = response.workflowData;
   try {
-    const timing = snapshot2();
-    if (!timing)
-      return response;
-    return {
-      ...response,
-      workflowData: {
-        ...response.workflowData,
-        autoTiming: timing
-      }
-    };
-  } catch {
-    return response;
-  }
+    const timing = options.autoTimingSnapshot?.();
+    if (timing)
+      workflowData = { ...workflowData, autoTiming: timing };
+  } catch {}
+  try {
+    const support = options.autoContinuationSupport?.();
+    if (support === "supported" || support === "unsupported") {
+      workflowData = {
+        ...workflowData,
+        autoContinuation: {
+          scope: "current-plugin-process",
+          support,
+          ...support === "unsupported" ? {
+            reason: "host-reports-no-assistant-message-parentage",
+            recovery: "Drive each feature with /flow-run."
+          } : {}
+        }
+      };
+    }
+  } catch {}
+  return workflowData === response.workflowData ? response : { ...response, workflowData };
 }
 async function execute(context, handler) {
   try {
@@ -4336,7 +4583,7 @@ function createTools(_ctx, options) {
     flow_status: tool({
       description: "Read compact, execution, detail, or reviewer Flow state.",
       args: StatusArgs,
-      execute: (args, context) => execute(context, async (workspace) => withAutoTiming(await flowStatus(workspace, args), options.autoTimingSnapshot))
+      execute: (args, context) => execute(context, async (workspace) => withAutoContext(await flowStatus(workspace, args), options))
     }),
     flow_plan_save: tool({
       description: "Create or replace the active draft plan.",
@@ -4437,14 +4684,35 @@ function isBash(tool2) {
 
 class ValidationCaptureCoordinator {
   #persist;
+  #readReport;
   #now;
   #randomId;
   #pending = new Map;
   constructor(options) {
     this.#persist = options.persistObservation;
+    this.#readReport = options.readReport;
     this.#now = options.now ?? Date.now;
     this.#randomId = options.randomId ?? randomUUID3;
   }
+  async#observeAssertions(capture) {
+    if (capture.assertions.length === 0)
+      return [];
+    const absent2 = capture.assertions.map((name) => ({
+      name,
+      status: "absent"
+    }));
+    if (!capture.resultsPath || !this.#readReport)
+      return absent2;
+    let report;
+    try {
+      report = await this.#readReport(capture.workspace, capture.resultsPath);
+    } catch {
+      return absent2;
+    }
+    if (!report || report.modifiedMs <= capture.armedAt)
+      return absent2;
+    return observeAssertions(capture.assertions, report.text);
+  }
   #prune() {
     const cutoff = this.#now() - CAPTURE_TTL_MS;
     for (const [sessionID, capture] of this.#pending) {
@@ -4502,12 +4770,17 @@ class ValidationCaptureCoordinator {
     const observedExit = exitCode(output.metadata);
     const observedComplete = completeOutput(output.metadata);
     const hostGap = observedExit === null ? "exit-code-unavailable" : observedComplete === null ? "output-completeness-unknown" : null;
+    const observedAssertions = await this.#observeAssertions(capture);
     const observation = await this.#persist(capture.workspace, {
       featureId: capture.featureId,
       runId: capture.runId,
       command: capture.command,
       scope: capture.scope,
       sourceDigest: capture.sourceDigest,
+      hostPlatform: capture.hostPlatform,
+      assertions: capture.assertions,
+      resultsPath: capture.resultsPath,
+      ...observedAssertions.length > 0 ? { observedAssertions } : {},
       captureId: capture.captureId,
       exitCode: observedExit,
       outputDigest: digest(output.output),
@@ -4521,6 +4794,7 @@ class ValidationCaptureCoordinator {
       scope: observation.scope,
       passed: isValidationEligible(observation),
       recordedRevision: observation.recordedRevision,
+      ...observation.observedAssertions ? { assertions: observation.observedAssertions } : {},
       ...observation.ineligibleReason ? { ineligibleReason: observation.ineligibleReason } : {}
     })}`;
     return observation;
@@ -4602,6 +4876,9 @@ function createCommandHook(assertOperational, autoDrive) {
     if (command !== "flow-auto")
       return void autoDrive.deactivate(input.sessionID);
     const metadata = await autoDrive.activate(input.sessionID);
+    if (autoDrive.continuationSupport() === "unsupported") {
+      output.parts.unshift(textPart("Note: this OpenCode host does not report assistant message parentage, so Flow cannot continue automatically between features here. Each feature still runs normally; drive the next one with /flow-run."));
+    }
     const instruction = output.parts.find((part) => part.type === "text" && part.synthetic === true);
     if (!instruction) {
       autoDrive.deactivate(input.sessionID);
@@ -4702,12 +4979,14 @@ var FlowPlugin = async (ctx) => {
     onWarning: (message) => log("warn", message)
   });
   const validation = new ValidationCaptureCoordinator({
-    persistObservation: persistWorkspaceValidation
+    persistObservation: persistWorkspaceValidation,
+    readReport: readWorkspaceTestReport
   });
   const tools = createTools(ctx, {
     validation,
     prepareValidation: prepareWorkspaceValidation,
-    autoTimingSnapshot: () => autoDrive.timingSnapshot()
+    autoTimingSnapshot: () => autoDrive.timingSnapshot(),
+    autoContinuationSupport: () => autoDrive.continuationSupport()
   });
   return {
     config: createConfigHook(ctx, {
@@ -4774,4 +5053,4 @@ export {
   plugin_default as default
 };
 
-//# debugId=F9B2A9081022601764756E2164756E21
+//# debugId=59C59901BAE4E80164756E2164756E21