pan-wizard 3.33.0 → 3.35.0

package/pan-wizard-core/bin/lib/verdict.cjs

@@ -28,10 +28,6 @@ const FINDING_CLASSES = Object.freeze(['missing', 'partial', 'contradicts', 'unr
 const SEVERITIES = Object.freeze(['critical', 'high', 'medium', 'low', 'info']);
 const DISPOSITIONS = Object.freeze(['fixed', 'deferred', 'dismissed', 'decision']);
 const REASON_REQUIRED = Object.freeze(['deferred', 'dismissed', 'decision']);
-// A re-run does not re-check these, so their absence from a later verdict is not
-// evidence that they were resolved (D6).
-const AUTO_FIX_EXEMPT = Object.freeze(['human', 'unrequested']);
-
 /** Each judge's own verdict word → the normalised outcome it implies. */
 const KNOWN_VERDICTS = Object.freeze({
   'pan-verifier': Object.freeze({ passed: 'pass', gaps_found: 'fail', human_needed: 'needs_human' }),
@@ -43,6 +39,8 @@ const KNOWN_VERDICTS = Object.freeze({
 const LIMITS = Object.freeze({ findings: 100, where: 200, summary: 300, verdict: 40, score: 40, not_checked: 20, check: 80 });
 // What the verifier's test gate can report (verify-phase.md, run_test_suite).
 const TEST_GATE_VALUES = Object.freeze(['passed', 'failed', 'skipped']);
+const RESOLUTION_STATUSES = Object.freeze(['resolved', 'still_present', 'cannot_tell']);
+const FINDING_ID_RE = /^f_[0-9a-f]{10}$/;
 const AGENT_RE = /^[a-z][a-z0-9-]{0,63}$/;
 const OPEN_FENCE_RE = /^[ \t]*(`{3,}|~{3,})[ \t]*pan-verdict[ \t]*$/;
 const CLOSE_FENCE_RE = /^[ \t]*(`{3,}|~{3,})[ \t]*$/;
@@ -198,7 +196,42 @@ function validateVerdict(obj, opts = {}) {
   });
 
   const notChecked = normaliseNotChecked(obj.not_checked, warnings);
-  return { ok: true, verdict: { contract, agent, outcome, verdict, phase, score, findings, not_checked: notChecked }, warnings };
+  const resolutions = normaliseResolutions(obj.resolutions, warnings);
+  return { ok: true, verdict: { contract, agent, outcome, verdict, phase, score, findings, not_checked: notChecked, resolutions }, warnings };
+}
+
+/**
+ * A judge's answers about its earlier open findings (V6): each `{id|summary, status,
+ * evidence}` with status resolved | still_present | cannot_tell. Silence is not an
+ * answer: a finding the judge leaves out stays open. `resolved` without evidence is
+ * recorded as cannot_tell, so a bare "fixed" closes nothing.
+ */
+function normaliseResolutions(value, warnings) {
+  if (value == null) return [];
+  if (!Array.isArray(value)) {
+    warnings.push('resolutions_not_an_array');
+    return [];
+  }
+  const out = [];
+  value.slice(0, LIMITS.findings).forEach((r, i) => {
+    if (!r || typeof r !== 'object' || Array.isArray(r)) { warnings.push(`resolution_dropped: #${i} is not an object`); return; }
+    const id = typeof r.id === 'string' && FINDING_ID_RE.test(r.id.trim()) ? r.id.trim() : null;
+    const named = r.summary ?? r.truth;
+    const summary = named == null ? null : (truncate(cleanText(String(named)), LIMITS.summary) || null);
+    if (!id && !summary) { warnings.push(`resolution_dropped: #${i} names no finding id or summary`); return; }
+    let status = typeof r.status === 'string' ? r.status.trim().toLowerCase() : '';
+    if (!RESOLUTION_STATUSES.includes(status)) {
+      warnings.push(`resolution_unknown_status: #${i} ${JSON.stringify(r.status === undefined ? null : r.status)} recorded as cannot_tell`);
+      status = 'cannot_tell';
+    }
+    const evidence = r.evidence == null ? '' : truncate(cleanText(String(r.evidence)), LIMITS.summary);
+    if (status === 'resolved' && !evidence) {
+      warnings.push(`resolution_without_evidence: #${i} recorded as cannot_tell`);
+      status = 'cannot_tell';
+    }
+    out.push({ id, summary, status, evidence: evidence || null });
+  });
+  return out;
 }
 
 /**
@@ -336,6 +369,49 @@ function listOfMappings(yaml, key) {
   return items;
 }
 
+/**
+ * A list nested one level under a top-level key, as the verifier writes
+ * `re_verification.gaps_closed`. Items are bare strings (read as `{truth}`) or
+ * mappings (`- truth: "…"` with `evidence: "…"` below it).
+ */
+function nestedList(yaml, parent, key) {
+  const lines = yaml.split('\n');
+  const start = lines.findIndex((l) => {
+    const m = KEY_VALUE_RE.exec(l);
+    return m && m[1] === parent && indentOf(l) === 0;
+  });
+  if (start === -1) return [];
+  const items = [];
+  let keyIndent = -1;
+  let cur = null;
+  for (let i = start + 1; i < lines.length; i++) {
+    const line = lines[i];
+    if (!line.trim()) continue;
+    const ind = indentOf(line);
+    if (ind === 0) break;
+    const body = line.trim();
+    if (keyIndent === -1) {
+      const kv = KEY_VALUE_RE.exec(body);
+      if (kv && kv[1] === key) {
+        if (stripComment(kv[2]) !== '') return []; // `gaps_closed: []`
+        keyIndent = ind;
+      }
+      continue;
+    }
+    if (ind <= keyIndent) break;
+    const it = ITEM_RE.exec(line);
+    if (it) {
+      const kv = KEY_VALUE_RE.exec(it[2]);
+      cur = kv ? { [kv[1]]: unquote(kv[2]) } : { truth: unquote(it[2]) };
+      items.push(cur);
+    } else if (cur) {
+      const kv = KEY_VALUE_RE.exec(body);
+      if (kv) cur[kv[1]] = unquote(kv[2]);
+    }
+  }
+  return items.filter((x) => x.truth || x.summary || x.id);
+}
+
 /** A top-level scalar from the frontmatter (e.g. `status`), or null. */
 function frontmatterScalar(yaml, key) {
   for (const l of yaml.split('\n')) {
@@ -397,12 +473,57 @@ function verdictFromVerificationFrontmatter(text, agent = 'pan-verifier') {
     notChecked = notChecked.filter((n) => !isTests(n));
     contradicted = true;
   }
-  return { contract: VERDICT_CONTRACT, agent, verdict: status, outcome, findings, not_checked: notChecked, test_gate: testGate, not_checked_contradicted: contradicted };
+  // Re-verification answers (V6): a gap the verifier re-checked and closed is
+  // resolved; a regression or a remaining gap is still present.
+  const resolutions = [
+    ...nestedList(yaml, 're_verification', 'gaps_closed').map((g) => ({
+      id: g.id, summary: g.truth || g.summary, status: 'resolved', evidence: g.evidence || 'closed by the verifier\'s re-verification',
+    })),
+    ...nestedList(yaml, 're_verification', 'regressions').map((g) => ({ id: g.id, summary: g.truth || g.summary, status: 'still_present', evidence: g.evidence || null })),
+    ...nestedList(yaml, 're_verification', 'gaps_remaining').map((g) => ({ id: g.id, summary: g.truth || g.summary, status: 'still_present', evidence: g.evidence || null })),
+  ];
+  return { contract: VERDICT_CONTRACT, agent, verdict: status, outcome, findings, not_checked: notChecked, resolutions, test_gate: testGate, not_checked_contradicted: contradicted };
+}
+
+/** Names of the code facts that passed: a passing fact closes its own code-fact finding (V6). */
+function passingFacts(facts) {
+  return (Array.isArray(facts) ? facts : []).filter((f) => f && f.ok === true && f.fact).map((f) => f.fact);
+}
+
+/** The verdict word an agent uses for a fail, or null for an agent outside KNOWN_VERDICTS. */
+function failWordFor(agent) {
+  const table = KNOWN_VERDICTS[agent];
+  return table ? Object.keys(table).find((k) => table[k] === 'fail') || null : null;
+}
+
+/**
+ * Two-key verdict (V9): a code fact can lower a judge's verdict, never raise it.
+ * Any failing fact turns a pass or needs_human into the agent's fail word, keeps
+ * the agent's own word as `agent_verdict`, and adds one high finding per fact
+ * (`where: code-fact:<fact>`) so the gap round has something to close.
+ *
+ * @param {Object} verdict - a validated verdict
+ * @param {Array<{fact: string, ok: boolean, summary: string}>} facts
+ * @returns {{verdict: Object, lowered_by: string[]}} the same verdict object when nothing lowers it
+ */
+function lowerByCodeFacts(verdict, facts) {
+  const failing = (Array.isArray(facts) ? facts : []).filter((f) => f && f.ok === false && f.fact);
+  if (!failing.length || verdict.outcome === 'fail') return { verdict, lowered_by: [] };
+  const findings = [...verdict.findings];
+  for (const f of failing) {
+    findings.push({ class: 'defect', severity: 'high', where: `code-fact:${f.fact}`, summary: truncate(cleanText(f.summary || `${f.fact} failed`), LIMITS.summary) });
+  }
+  return {
+    verdict: { ...verdict, outcome: 'fail', verdict: failWordFor(verdict.agent) || 'fail', agent_verdict: verdict.verdict, findings },
+    lowered_by: failing.map((f) => f.fact),
+  };
 }
 
 /**
  * Read a judge's verdict from an artifact: the LAST `pan-verdict` block wins; with
  * no block, a verification.md frontmatter `status` is read through the adapter.
+ * Code facts (`opts.facts`, plus a verification's own `test_gate`) are applied
+ * after parsing through lowerByCodeFacts.
  * @param {string} text
  * @param {{agent?: string, phase?: string|number}} [opts]
  * @returns {{ok: true, verdict: Object, warnings: string[], source_kind: 'block'|'frontmatter'}
@@ -418,7 +539,9 @@ function parseVerdictText(text, opts = {}) {
       return { ok: false, error: 'invalid_json', reason: `the last pan-verdict block is not valid JSON: ${e.message}` };
     }
     const r = validateVerdict(obj, opts);
-    return r.ok ? { ...r, source_kind: 'block' } : r;
+    if (!r.ok) return r;
+    const low = lowerByCodeFacts(r.verdict, opts.facts);
+    return { ...r, verdict: low.verdict, lowered_by: low.lowered_by, facts_ok: passingFacts(opts.facts), source_kind: 'block' };
   }
   const adapted = verdictFromVerificationFrontmatter(text, opts.agent || 'pan-verifier');
   if (adapted) {
@@ -431,9 +554,13 @@ function parseVerdictText(text, opts = {}) {
     // gate under a pass: both make "passed" claim more than the verifier checked.
     if (!adapted.test_gate) r.warnings.push('test_gate_unrecorded: the verification does not say whether the test suite ran');
     else if (!TEST_GATE_VALUES.includes(adapted.test_gate)) r.warnings.push(`test_gate_unknown: "${adapted.test_gate}" is not passed, failed or skipped`);
-    else if (adapted.test_gate === 'failed' && adapted.outcome === 'pass') r.warnings.push('test_gate_failed_under_pass: the test gate failed but the status is passed');
+    else if (adapted.test_gate === 'failed' && adapted.outcome === 'pass') r.warnings.push('test_gate_failed_under_pass: the test gate failed but the status is passed, so it records as gaps_found');
     if (adapted.not_checked_contradicted) r.warnings.push(`not_checked_contradicted: test_gate is ${adapted.test_gate}, so the not_checked tests entry was dropped`);
-    return { ...r, source_kind: 'frontmatter' };
+    const facts = [...(Array.isArray(opts.facts) ? opts.facts : [])];
+    if (adapted.test_gate === 'failed') facts.push({ fact: 'test_gate', ok: false, summary: 'The test gate failed: the suite reported failures or did not run' });
+    if (adapted.test_gate === 'passed') facts.push({ fact: 'test_gate', ok: true, summary: 'the test gate passed' });
+    const low = lowerByCodeFacts(r.verdict, facts);
+    return { ...r, verdict: low.verdict, lowered_by: low.lowered_by, facts_ok: passingFacts(facts), source_kind: 'frontmatter' };
   }
   return { ok: false, error: 'no_verdict', reason: 'no pan-verdict block and no verification frontmatter status' };
 }
@@ -466,13 +593,16 @@ module.exports = {
   SEVERITIES,
   DISPOSITIONS,
   REASON_REQUIRED,
-  AUTO_FIX_EXEMPT,
   KNOWN_VERDICTS,
   LIMITS,
+  RESOLUTION_STATUSES,
+  FINDING_ID_RE,
   findVerdictBlocks,
   validateVerdict,
   verdictFromVerificationFrontmatter,
   parseVerdictText,
+  lowerByCodeFacts,
+  failWordFor,
   recordSig,
   findingId,
   outcomeForVerdict,

package/pan-wizard-core/bin/lib/verify-integrity.cjs

@@ -0,0 +1,181 @@
+'use strict';
+/**
+ * Test integrity (program V3): did this phase weaken the tests that judge it?
+ *
+ * An agent that cannot make a test pass can make the test stop failing instead:
+ * delete it, skip it, drop its assertions, rewrite its expectation or snapshot, or
+ * add an assertion that cannot fail. ImpossibleBench measured agents doing this on a
+ * large share of impossible tasks, and a stated way out (stop and report the
+ * conflict) cut it sharply. This is the check in code; the executor's way out is
+ * the `BLOCKED_SPEC_CONFLICT` return.
+ *
+ * It walks the phase's own plan commits (the `{type}({phase}-{plan}):` subjects that
+ * verify-scope reads) one at a time and reads each test file's diff:
+ *
+ *   errors    test_deleted · skip_marker_added · assertions_dropped ·
+ *             undeclared_test_edit (an existing assertion changed in a test no plan
+ *             declared) · snapshot_rewritten (undeclared) · always_true_assert
+ *   warnings  test_renamed
+ *
+ * A file a plan declares in `files_modified` may be edited freely, except that an
+ * added skip marker or an always-true assertion is an error anywhere.
+ */
+const fs = require('fs');
+const path = require('path');
+const { execGit, findPhaseInternal, safeReadFile, output, error, toPosix } = require('./core.cjs');
+const { extractFrontmatter } = require('./frontmatter.cjs');
+const { isPlanFile } = require('./constants.cjs');
+const { committedFiles, TEST_PATH_RE, TEST_FILE_RE } = require('./verify-scope.cjs');
+
+const TEST_NAME_RE = /(^|\/)(test_[^/]+\.py|[^/]+_test\.(py|go)|[^/]+Tests?\.(java|kt|cs))$/;
+// A snapshot directory anywhere in the path, or a `.snap` file: two patterns, so neither
+// alternative's anchoring reads as the other's.
+const SNAPSHOT_DIR_RE = /(?:^|\/)(?:__snapshots__|snapshots)\//;
+const SNAPSHOT_EXT_RE = /\.snap$/;
+
+/** Markers that stop a test from running, per ecosystem. */
+const SKIP_RE = [
+  /\b(?:it|test|describe|suite|context)\.(?:skip|only|todo)\s*\(/, // jest / mocha / vitest / node:test
+  /\bx(?:it|test|describe)\s*\(/, // jasmine / mocha
+  /\b(?:skip|only|todo)\s*:\s*(?:true|['"`])/, // node:test options
+  /@pytest\.mark\.(?:skip|skipif|xfail)\b/,
+  /\bpytest\.skip\s*\(/,
+  /@unittest\.skip\w*\b/,
+  /\bt\.Skip(?:Now|f)?\s*\(/, // go
+  /#\[ignore\]/, // rust
+  /@(?:Disabled|Ignore)\b/, // junit
+];
+
+/** Lines that assert, per ecosystem. */
+const ASSERT_RE = [
+  /\bassert(?:\.\w+)?\s*\(/,
+  /\bassert(?:_eq|_ne)?!\s*\(/,
+  /\bexpect\s*\(/,
+  /\.should\b/,
+  /\bself\.assert\w+\s*\(/,
+  /^\s*assert\s+\S/,
+  /\bt\.(?:Error|Errorf|Fatal|Fatalf|Fail|FailNow)\s*\(/,
+  /\b(?:require|assert)\.\w+\s*\(\s*t\b/, // testify
+  /\bAssert\.\w+\s*\(/,
+];
+
+/** Assertions that cannot fail. */
+const ALWAYS_TRUE_RE = [
+  /\bassert(?:\.ok)?\s*\(\s*true\s*[,)]/,
+  /\bexpect\s*\(\s*true\s*\)\s*\.\s*(?:toBe|toEqual|toBeTruthy)\s*\(\s*(?:true)?\s*\)/,
+  /^\s*assert\s+True\s*(?:#.*)?$/,
+  /^\s*assert\s+(\d+)\s*==\s*\1\s*(?:#.*)?$/,
+  /\bself\.assertTrue\s*\(\s*True\s*\)/,
+  /\bassert!\s*\(\s*true\s*\)/,
+  /\bassertTrue\s*\(\s*true\s*\)/,
+];
+
+const isTestFile = (f) => TEST_PATH_RE.test(f) || TEST_FILE_RE.test(f) || TEST_NAME_RE.test(f);
+const isSnapshot = (f) => SNAPSHOT_DIR_RE.test(f) || SNAPSHOT_EXT_RE.test(f);
+const any = (res, line) => res.some((re) => re.test(line));
+const norm = (p) => toPosix(String(p || '').trim()).replace(/^\.\/+/, '');
+
+/** A Rust source file that holds its own unit tests (`#[test]`) at this commit. */
+function hasInlineTests(cwd, hash, file) {
+  if (!file.endsWith('.rs')) return false;
+  const r = execGit(cwd, ['show', `${hash}:${file}`]);
+  return r.exitCode === 0 && /#\[(?:test|cfg\(test\))\]/.test(r.stdout);
+}
+
+/** The union of the phase plans' `files_modified`. */
+function declaredFiles(cwd, info) {
+  const dir = path.join(cwd, info.directory);
+  const out = new Set();
+  for (const f of info.plans.filter(isPlanFile)) {
+    const fm = extractFrontmatter(safeReadFile(path.join(dir, f)) || '');
+    const raw = fm.files_modified || fm['files-modified'];
+    for (const p of Array.isArray(raw) ? raw : (raw ? [raw] : [])) if (norm(p)) out.add(norm(p));
+  }
+  return out;
+}
+
+function isDeclared(file, declared) {
+  for (const d of declared) if (d === file || (d.endsWith('/') && file.startsWith(d))) return true;
+  return false;
+}
+
+/** One commit's file changes: `[{status, file, from?}]`, renames detected. */
+function commitChanges(cwd, hash) {
+  const r = execGit(cwd, ['-c', 'core.quotepath=off', 'show', '--relative', '-M', '--name-status', '--format=', hash]);
+  if (r.exitCode !== 0) return [];
+  return r.stdout.split(/\r?\n/).filter(Boolean).map((line) => {
+    const parts = line.split('\t');
+    const status = parts[0][0];
+    return status === 'R' || status === 'C'
+      ? { status, from: norm(parts[1]), file: norm(parts[2]) }
+      : { status, file: norm(parts[1]) };
+  });
+}
+
+/** One file's added and removed lines in one commit. */
+function fileDiff(cwd, hash, file) {
+  const r = execGit(cwd, ['-c', 'core.quotepath=off', 'show', '--relative', '--format=', '-U0', '--no-color', hash, '--', file]);
+  const added = [];
+  const removed = [];
+  if (r.exitCode !== 0) return { added, removed };
+  for (const line of r.stdout.split(/\r?\n/)) {
+    if (line.startsWith('+++') || line.startsWith('---')) continue;
+    if (line.startsWith('+')) added.push(line.slice(1));
+    else if (line.startsWith('-')) removed.push(line.slice(1));
+  }
+  return { added, removed };
+}
+
+/**
+ * The integrity check for one phase.
+ * @returns {{phase, checked: boolean, ok: boolean, reason?: string, commits: number, violations: Array, warnings: Array}|{error, reason}}
+ */
+function checkTestIntegrity(cwd, phase) {
+  const info = findPhaseInternal(cwd, phase);
+  if (!info || !info.found) return { error: 'phase_not_found', reason: `no phase directory for phase ${phase}` };
+  const git = committedFiles(cwd, info.phase_number);
+  const base = { phase: info.phase_number, commits: git.commits, violations: [], warnings: [] };
+  if (!git.git) return { ...base, checked: false, ok: true, reason: 'git is unavailable or this is not a repository' };
+  if (!git.commits) return { ...base, checked: false, ok: true, reason: 'no plan commits for this phase (subjects like "feat(03-01): …")' };
+
+  const declared = declaredFiles(cwd, info);
+  const violations = [];
+  const warnings = [];
+  const add = (list, code, file, commit, detail) => list.push({ code, file, commit: commit.slice(0, 12), detail });
+
+  for (const hash of [...git.hashes].reverse()) { // oldest first
+    for (const ch of commitChanges(cwd, hash)) {
+      const { file } = ch;
+      if (ch.status === 'D' && isTestFile(file)) { add(violations, 'test_deleted', file, hash, `${file} was deleted`); continue; }
+      if (ch.status === 'R' && isTestFile(ch.from)) add(warnings, 'test_renamed', file, hash, `${ch.from} was renamed to ${file}`);
+      if (isSnapshot(file) && (ch.status === 'M' || ch.status === 'D') && !isDeclared(file, declared)) {
+        add(violations, 'snapshot_rewritten', file, hash, `snapshot ${file} was ${ch.status === 'D' ? 'deleted' : 'rewritten'} and no plan declares it`);
+        continue;
+      }
+      if (ch.status === 'D' || !(isTestFile(file) || hasInlineTests(cwd, hash, file))) continue;
+      const { added, removed } = fileDiff(cwd, hash, file);
+      const skipsAdded = added.filter((l) => any(SKIP_RE, l)).length - removed.filter((l) => any(SKIP_RE, l)).length;
+      if (skipsAdded > 0) add(violations, 'skip_marker_added', file, hash, `${skipsAdded} skip/only marker(s) added`);
+      const trivial = added.filter((l) => any(ALWAYS_TRUE_RE, l));
+      if (trivial.length) add(violations, 'always_true_assert', file, hash, `an assertion that cannot fail: ${trivial[0].trim().slice(0, 120)}`);
+      const assertsAdded = added.filter((l) => any(ASSERT_RE, l) && !any(ALWAYS_TRUE_RE, l)).length;
+      const assertsRemoved = removed.filter((l) => any(ASSERT_RE, l)).length;
+      if (assertsRemoved > assertsAdded) {
+        add(violations, 'assertions_dropped', file, hash, `${assertsRemoved} assertion line(s) removed, ${assertsAdded} added`);
+      } else if (assertsRemoved > 0 && ch.status === 'M' && !isDeclared(file, declared)) {
+        add(violations, 'undeclared_test_edit', file, hash, `${assertsRemoved} existing assertion(s) changed in a test no plan declares`);
+      }
+    }
+  }
+  return { ...base, checked: true, ok: violations.length === 0, violations, warnings };
+}
+
+function cmdVerifyTestIntegrity(cwd, phase, raw) {
+  if (!phase) error('Usage: verify test-integrity <phase>');
+  const r = checkTestIntegrity(cwd, phase);
+  if (r.error) { output(r, raw); return; }
+  const word = !r.checked ? 'not_checked' : (r.ok ? 'clean' : 'violated');
+  output(r, raw, word, r.ok ? 0 : 1);
+}
+
+module.exports = { checkTestIntegrity, cmdVerifyTestIntegrity, isTestFile, SKIP_RE, ASSERT_RE, ALWAYS_TRUE_RE };

package/pan-wizard-core/bin/lib/verify-plan-set.cjs

@@ -0,0 +1,230 @@
+'use strict';
+/**
+ * Plan checks in code (program V7).
+ *
+ * The plan-checker agent reads a phase's plans and judges them, but the parts of that
+ * judgement that are arithmetic were left to the model: whether every requirement is
+ * covered, whether two plans in one wave edit the same file, whether a dependency
+ * points at a plan that does not exist, at the same wave or a later one, or round in
+ * a circle. `verify plan-set` checks those in code, before the checker is spent.
+ *
+ * It also binds a passing plan check to the plans it checked. The recorder stores a
+ * hash of the phase's plan files with every plan-checker verdict (`plans_sha`), and
+ * `planCheckStatus` tells exec-phase whether the plans it is about to run are the
+ * plans that passed: `ok`, `stale` (edited since), `failed`, `missing`, `legacy`
+ * (a record from before hashing: a warning, never a refusal) or `disabled`.
+ *
+ * And it reports drift: a plan that records `planned_commit` lists the files it
+ * modifies that changed on the branch since it was planned.
+ */
+const fs = require('fs');
+const path = require('path');
+const crypto = require('crypto');
+const { findPhaseInternal, output, error, execGit, loadConfig, toLf, toPosix } = require('./core.cjs');
+const { extractFrontmatter } = require('./frontmatter.cjs');
+const { roadmapRequirementIds } = require('./roadmap.cjs');
+const { buildPlanIndex, dependencyNames } = require('./phase.cjs');
+const { ROADMAP_FILE, getPlanId } = require('./constants.cjs');
+const { planningPath, filterPlanFiles, filterSummaryFiles } = require('./utils.cjs');
+
+const PLAN_CHECKER = 'pan-plan-checker';
+
+const asList = (v) => (Array.isArray(v) ? v : (v == null || v === '' ? [] : [v])).map((x) => String(x).trim()).filter(Boolean);
+const normFile = (f) => toPosix(String(f).trim()).replace(/^\.\//, '');
+
+/** The phase directory and its plan and summary files, or `{error, reason}`. */
+function phaseFiles(cwd, phase) {
+  const info = findPhaseInternal(cwd, phase);
+  if (!info || !info.found) return { error: 'phase_not_found', reason: `no phase directory for phase ${phase}` };
+  const dir = path.join(cwd, info.directory);
+  let files = [];
+  try { files = fs.readdirSync(dir); } catch (e) { return { error: 'unreadable_phase', reason: `cannot read ${info.directory}: ${e.code || e.message}` }; }
+  return { info, dir, planFiles: filterPlanFiles(files).sort(), summaryFiles: filterSummaryFiles(files) };
+}
+
+/**
+ * A hash of a phase's plan files (names and line-ending-normalised contents), so a
+ * plan check can be matched to exactly the plans it checked.
+ */
+function plansSha(dir, planFiles) {
+  const h = crypto.createHash('sha256');
+  for (const f of [...planFiles].sort()) {
+    let text = '';
+    try { text = fs.readFileSync(path.join(dir, f), 'utf-8'); } catch { /* unreadable reads as empty */ }
+    h.update(f + '\u0000' + toLf(text) + '\u0000');
+  }
+  return h.digest('hex').slice(0, 16);
+}
+
+/** `plansSha` for a phase by number, or null when it has no plans. */
+function plansShaFor(cwd, phase) {
+  const pf = phaseFiles(cwd, phase);
+  if (pf.error || !pf.planFiles.length) return null;
+  return plansSha(pf.dir, pf.planFiles);
+}
+
+/** The phase's plans, each with its requirements, planned_commit and file name. */
+function loadPlans(pf) {
+  const { plans } = buildPlanIndex(pf.dir, pf.planFiles, pf.summaryFiles);
+  const byId = new Map(plans.map((p) => [p.id, p]));
+  for (const file of pf.planFiles) {
+    const p = byId.get(getPlanId(file));
+    if (!p) continue;
+    let fm = {};
+    try { fm = extractFrontmatter(fs.readFileSync(path.join(pf.dir, file), 'utf-8')) || {}; } catch { /* unreadable */ }
+    p.file = file;
+    p.requirements = asList(fm.requirements);
+    p.planned_commit = fm.planned_commit ? String(fm.planned_commit).trim() : null;
+    p.files_modified = p.files_modified.map(normFile).filter(Boolean);
+  }
+  return plans;
+}
+
+/** A dependency entry that names a plan of another phase (`02-01` from phase 03). */
+function isOtherPhase(dep, phaseNumber) {
+  const m = /^(\d+(?:\.\d+)*)-\d+$/.exec(String(dep).trim());
+  if (!m) return false;
+  const strip = (s) => String(s).split('.').map((x) => String(parseInt(x, 10))).join('.');
+  return strip(m[1]) !== strip(phaseNumber);
+}
+
+/**
+ * Check a phase's plan set.
+ * @returns {{phase, ok, errors: Array, warnings: Array, plans: number}|{error, reason}}
+ */
+function checkPlanSet(cwd, phase) {
+  const pf = phaseFiles(cwd, phase);
+  if (pf.error) return pf;
+  if (!pf.planFiles.length) return { error: 'no_plans', reason: `phase ${phase} has no plans` };
+  const phaseNumber = pf.info.phase_number || String(phase);
+  const plans = loadPlans(pf);
+  const errors = [];
+  const warnings = [];
+
+  // 1. Requirement coverage, against the roadmap's requirement ids for this phase.
+  let roadmap = '';
+  try { roadmap = fs.readFileSync(planningPath(cwd, ROADMAP_FILE), 'utf-8'); } catch { /* no roadmap: nothing to cover */ }
+  const required = roadmapRequirementIds(roadmap, phaseNumber);
+  const key = (id) => String(id).trim().toUpperCase();
+  const planned = new Set(plans.flatMap((p) => p.requirements.map(key)));
+  for (const id of required) {
+    if (!planned.has(key(id))) errors.push({ code: 'uncovered_requirement', requirement: id, detail: `requirement ${id} is in the roadmap for phase ${phaseNumber} but no plan lists it` });
+  }
+  if (required.length) {
+    const known = new Set(required.map(key));
+    for (const p of plans) for (const r of p.requirements) {
+      if (!known.has(key(r))) warnings.push({ code: 'unknown_requirement', plan: p.id, requirement: r, detail: `plan ${p.id} lists ${r}, which the roadmap does not give phase ${phaseNumber}` });
+    }
+  }
+
+  // 2. Dependencies: each must name a plan of this phase in an earlier wave.
+  const resolved = new Map(); // plan id → ids of the plans it depends on
+  for (const p of plans) {
+    const deps = [];
+    for (const d of p.depends_on) {
+      if (isOtherPhase(d, phaseNumber)) continue; // a finished phase's plan: not this set's to check
+      const target = plans.find((q) => q.id !== p.id && dependencyNames(d, q.id));
+      if (!target) {
+        if (dependencyNames(d, p.id)) errors.push({ code: 'self_reference', plan: p.id, detail: `plan ${p.id} depends on itself` });
+        else errors.push({ code: 'missing_reference', plan: p.id, depends_on: d, detail: `plan ${p.id} depends on "${d}", which names no plan in this phase` });
+        continue;
+      }
+      deps.push(target.id);
+      if (target.wave >= p.wave) {
+        errors.push({ code: 'future_reference', plan: p.id, depends_on: target.id, detail: `plan ${p.id} (wave ${p.wave}) depends on ${target.id} (wave ${target.wave}); a dependency must be in an earlier wave` });
+      }
+    }
+    resolved.set(p.id, deps);
+    const depWaves = deps.map((id) => plans.find((q) => q.id === id).wave);
+    const expected = depWaves.length ? Math.max(...depWaves) + 1 : 1;
+    if (p.wave > expected) {
+      warnings.push({ code: 'wave_gap', plan: p.id, detail: `plan ${p.id} is in wave ${p.wave} but its dependencies allow wave ${expected}` });
+    }
+  }
+
+  // 3. Cycles.
+  const state = new Map();
+  const reported = new Set();
+  const visit = (id, trail) => {
+    if (state.get(id) === 'done') return;
+    if (state.get(id) === 'active') {
+      const cycle = [...trail.slice(trail.indexOf(id)), id];
+      const sig = [...new Set(cycle)].sort().join(',');
+      if (!reported.has(sig)) { reported.add(sig); errors.push({ code: 'cycle', plans: cycle, detail: `dependency cycle: ${cycle.join(' → ')}` }); }
+      return;
+    }
+    state.set(id, 'active');
+    for (const d of resolved.get(id) || []) visit(d, [...trail, id]);
+    state.set(id, 'done');
+  };
+  for (const p of plans) visit(p.id, []);
+
+  // 4. Same-wave file overlap: two plans that run in parallel must not edit one file.
+  const dependsOn = (a, b, seen = new Set()) => {
+    if (seen.has(a)) return false;
+    seen.add(a);
+    return (resolved.get(a) || []).some((d) => d === b || dependsOn(d, b, seen));
+  };
+  for (let i = 0; i < plans.length; i++) {
+    for (let j = i + 1; j < plans.length; j++) {
+      const a = plans[i];
+      const b = plans[j];
+      if (a.wave !== b.wave) continue;
+      const shared = a.files_modified.filter((f) => b.files_modified.includes(f));
+      if (!shared.length || dependsOn(a.id, b.id) || dependsOn(b.id, a.id)) continue;
+      errors.push({ code: 'same_wave_overlap', plans: [a.id, b.id], files: shared, detail: `plans ${a.id} and ${b.id} both modify ${shared.join(', ')} in wave ${a.wave} with no dependency between them` });
+    }
+  }
+
+  return { phase: phaseNumber, ok: errors.length === 0, errors, warnings, plans: plans.length, plans_sha: plansSha(pf.dir, pf.planFiles) };
+}
+
+/**
+ * Whether the plans exec-phase is about to run are the plans that passed a plan check.
+ * @returns {{status: 'ok'|'stale'|'failed'|'missing'|'legacy'|'disabled', reason?: string, plans_sha?: string, checked_sha?: string, attempt?: number}}
+ */
+function planCheckStatus(cwd, phase) {
+  const config = loadConfig(cwd);
+  if (config.plan_checker === false) return { status: 'disabled', reason: 'workflow.plan_check is off in config.json' };
+  const F = require('./findings.cjs');
+  const V = require('./verdict.cjs');
+  const { verdicts } = F.foldFindings(F.readLedger(cwd).rows);
+  const mine = verdicts.filter((v) => v.agent === PLAN_CHECKER && V.comparablePhase(v.phase) === V.comparablePhase(phase));
+  const last = mine[mine.length - 1];
+  const current = plansShaFor(cwd, phase);
+  if (!last) return { status: 'missing', reason: 'no plan check is recorded for this phase', plans_sha: current };
+  if (last.outcome !== 'pass') return { status: 'failed', reason: `the last plan check (attempt ${last.attempt}) found issues`, attempt: last.attempt, plans_sha: current };
+  if (!last.plans_sha) return { status: 'legacy', reason: 'the plan check was recorded before plans were hashed, so it cannot show the plans are unchanged', attempt: last.attempt, plans_sha: current };
+  if (last.plans_sha !== current) return { status: 'stale', reason: 'the plans changed after they passed the plan check', attempt: last.attempt, checked_sha: last.plans_sha, plans_sha: current };
+  return { status: 'ok', attempt: last.attempt, plans_sha: current };
+}
+
+/**
+ * Plans not yet executed whose modified files changed since they were planned.
+ * @returns {Array<{plan, planned_commit, files?: string[], error?: string}>}
+ */
+function planDrift(cwd, phase) {
+  const pf = phaseFiles(cwd, phase);
+  if (pf.error || !pf.planFiles.length) return [];
+  const out = [];
+  for (const p of loadPlans(pf)) {
+    if (p.has_summary || !p.planned_commit || !p.files_modified.length) continue;
+    if (!/^[0-9a-f]{4,40}$/i.test(p.planned_commit)) { out.push({ plan: p.id, planned_commit: p.planned_commit, error: 'not a commit sha' }); continue; }
+    const r = execGit(cwd, ['diff', '--name-only', p.planned_commit, 'HEAD', '--']);
+    if (r.exitCode !== 0) { out.push({ plan: p.id, planned_commit: p.planned_commit, error: 'unknown commit' }); continue; }
+    const changed = new Set(r.stdout.split(/\r?\n/).map(normFile).filter(Boolean));
+    const files = p.files_modified.filter((f) => changed.has(f));
+    if (files.length) out.push({ plan: p.id, planned_commit: p.planned_commit, files });
+  }
+  return out;
+}
+
+function cmdVerifyPlanSet(cwd, phase, raw) {
+  if (!phase) error('Usage: verify plan-set <phase>');
+  const r = checkPlanSet(cwd, phase);
+  if (r.error) { output(r, raw); return; }
+  const result = { ...r, plan_check: planCheckStatus(cwd, phase), drift: planDrift(cwd, phase) };
+  output(result, raw, r.ok ? 'valid' : 'invalid', r.ok ? 0 : 1);
+}
+
+module.exports = { checkPlanSet, plansSha, plansShaFor, planCheckStatus, planDrift, cmdVerifyPlanSet, PLAN_CHECKER };

package/pan-wizard-core/bin/lib/verify-preflight.cjs

@@ -7,7 +7,7 @@
 const fs = require('fs');
 const path = require('path');
 const { safeReadFile, execGit, findPhaseInternal, output, normalizePhaseName } = require('./core.cjs');
-const { readStateSafe } = require('./state.cjs');
+const { readStateSafe, activeBlockersFromState } = require('./state.cjs');
 const {
   STATE_FILE, ROADMAP_FILE, CONFIG_FILE, PATTERNS_FILE, PHASE_DIR_RE,
 } = require('./constants.cjs');
@@ -44,19 +44,10 @@ function cmdPreflight(cwd, target, raw) {
     blockers.push('state.md not found — run /pan:new-project');
   }
 
-  // Check 3: no unresolved blockers in state.md
+  // Check 3: no unresolved blockers in state.md (the template's `### Blockers/Concerns`,
+  // where `state add-blocker` writes, or a legacy `## Blockers`)
   if (stateContent) {
-    const blockersMatch = stateContent.match(/##\s*Blockers\s*\n([\s\S]*?)(?=\n##|$)/i);
-    const activeBlockers = [];
-    if (blockersMatch) {
-      const items = blockersMatch[1].match(/^-\s+(.+)$/gm) || [];
-      for (const item of items) {
-        const text = item.replace(/^-\s+/, '').trim();
-        if (text && !/^none$/i.test(text)) {
-          activeBlockers.push(text);
-        }
-      }
-    }
+    const activeBlockers = activeBlockersFromState(stateContent);
     if (activeBlockers.length === 0) {
       checks.push({ name: 'no_blockers', passed: true });
     } else {