paqad-ai 1.63.2 → 1.63.3

package/CHANGELOG.md

@@ -1,5 +1,27 @@
 # paqad-ai
 
+## 1.63.3
+
+### Patch Changes
+
+- eb1fa9a: fix(#401): spec freeze now runs the spec-quality review it always claimed to require
+
+  `paqad-ai spec freeze` told you, in both the rule pack and the workflow contract, that
+  freezing enforces "no critical spec-review defects". It never did: the CLI evaluated the
+  freeze with no review attached, so that clause was enforced nowhere. Agents closed the gap by
+  hand-running `compliance review`, which left a stray `.paqad/compliance/<slug>/spec-review.json`
+  behind that was neither part of the change's evidence bundle nor git-ignored.
+
+  Freeze now runs the review itself and blocks on a critical defect like any other blocker, so
+  there is no second command to run and no stray artifact. On a clean freeze the defect summary
+  is folded into the bundle's `specification.json`, so the review evidence travels with the spec
+  of record. Non-critical findings never block.
+
+  Two related fixes: `spec freeze` and `compliance review` now reject a spec file that resolves
+  outside the project root and record `spec_file` as a project-relative posix path, and the
+  managed `.paqad/.gitignore` covers `compliance/` so a compliance artifact can never surface as
+  an untracked, committable file.
+
 ## 1.63.2
 
 ### Patch Changes

package/dist/cli/index.js

@@ -2903,9 +2903,29 @@ var init_feature_spec_schema = __esm({
         },
         frozen: {
           oneOf: [{ type: "null" }, { $ref: "#/$defs/frozenMetadata" }]
-        }
+        },
+        spec_review: { $ref: "#/$defs/specReviewSummary" }
       },
       $defs: {
+        specReviewSummary: {
+          type: "object",
+          additionalProperties: false,
+          required: ["reviewed_at", "defect_count", "by_severity"],
+          properties: {
+            reviewed_at: { type: "string", format: "date-time" },
+            defect_count: { type: "integer", minimum: 0 },
+            by_severity: {
+              type: "object",
+              additionalProperties: false,
+              required: ["critical", "major", "minor"],
+              properties: {
+                critical: { type: "integer", minimum: 0 },
+                major: { type: "integer", minimum: 0 },
+                minor: { type: "integer", minimum: 0 }
+              }
+            }
+          }
+        },
         verificationCase: {
           type: "object",
           additionalProperties: false,
@@ -8161,6 +8181,7 @@ function defaultFeatureDevelopmentPolicy() {
         instructions: [
           "Write or refine the feature specification before implementation when the lane includes specification.",
           "Spec sign-off (issue #102): on graduated/full lanes the spec must carry behaviour, acceptance criteria (AC-n, given/when/then, proof_type), and human-confirmed invariants (INV-n), and must be frozen before development. Freeze requires no open questions, no critical spec-review defects, and a confirmed invariant set. A mid-build goal change or a work-vs-spec contradiction surfaces via the Decision Pause Contract (spec.change / spec.contradiction) and is never resolved silently.",
+          SPEC_REVIEW_ENFORCEMENT_INSTRUCTION,
           "Freeze the spec before writing code on graduated/full lanes: run `npx paqad-ai spec freeze <spec-file> --signed-off-by <name> --confirm-invariants` and resolve every printed blocker (missing ACs/invariants, open questions) before development. It writes the frozen spec into the active feature bundle (`specification.json`) that development builds against and the spec-change guard checks for drift."
         ],
         required_inputs: ["approved spec boundary"],
@@ -8543,6 +8564,7 @@ stages:
     instructions:
       - Write or refine the feature specification before implementation when the lane includes specification.
       - "Spec sign-off (issue #102): on graduated/full lanes the spec must carry behaviour, acceptance criteria (AC-n, given/when/then, proof_type), and human-confirmed invariants (INV-n), and must be frozen before development. Freeze requires no open questions, no critical spec-review defects, and a confirmed invariant set. A mid-build goal change or a work-vs-spec contradiction surfaces via the Decision Pause Contract (spec.change / spec.contradiction) and is never resolved silently."
+      - "${SPEC_REVIEW_ENFORCEMENT_INSTRUCTION}"
       - "Freeze the spec before writing code on graduated/full lanes: run \`npx paqad-ai spec freeze <spec-file> --signed-off-by <name> --confirm-invariants\` and resolve every printed blocker (missing ACs/invariants, open questions) before development. It writes the frozen spec into the active feature bundle (\`specification.json\`) that development builds against and the spec-change guard checks for drift."
     required_inputs:
       - approved spec boundary
@@ -8649,7 +8671,7 @@ stages:
       - CI gate result
 `;
 }
-var STAGE_ORDER, REQUIRED_TRUE_STRICTNESS;
+var STAGE_ORDER, REQUIRED_TRUE_STRICTNESS, SPEC_REVIEW_ENFORCEMENT_INSTRUCTION;
 var init_feature_development_policy = __esm({
   "src/pipeline/feature-development-policy.ts"() {
     "use strict";
@@ -8674,6 +8696,7 @@ var init_feature_development_policy = __esm({
       checks: { block_on_failure: true },
       documentation_sync: { require_canonical_sync: true }
     };
+    SPEC_REVIEW_ENFORCEMENT_INSTRUCTION = "Spec-review enforcement (issue #401): SCRIPT-ENFORCED. `paqad-ai spec freeze` runs the spec-quality review itself and refuses to freeze while a critical defect is open, so never run `compliance review` by hand to satisfy the clause above. Major and minor findings never block. The defect summary is folded into the bundle's specification.json and no .paqad/compliance/<slug>/spec-review.json is written by this workflow. Author the spec markdown inside the project: a path resolving outside the project root is rejected.";
   }
 });
 
@@ -25660,7 +25683,13 @@ var MANAGED_GITIGNORE_ENTRIES = [
   "delivery-detection.json",
   // regenerated from git history per machine
   "# compliance ledger (share via dashboard/SIEM, not git)",
-  "ledger/"
+  "ledger/",
+  // Issue #401 — everything under `compliance/` (the obligation index, the compliance
+  // report, a spec-review report) is derived from the spec plus the test tree and is
+  // regenerable, exactly the `ledger/` rationale. It was NOT ignored, so a report written
+  // there surfaced as an untracked, committable artifact in a consumer project and fed the
+  // "untracked .paqad/ artifact leaks into the changed-file set" class tracked by #205.
+  "compliance/"
 ];
 var MANAGED_GITATTRIBUTES_ENTRIES = ["decisions/index.json merge=union"];
 var DEPRECATED_ARTIFACTS = [
@@ -30883,7 +30912,7 @@ init_cancelled_error();
 init_events();
 
 // src/index.ts
-var VERSION = "1.63.2";
+var VERSION = "1.63.3";
 
 // src/cli/commands/audit.ts
 init_esm_shims();
@@ -32018,6 +32047,42 @@ init_esm_shims();
 import { readFile as readFile68, stat as stat7 } from "fs/promises";
 import path10 from "path";
 import { Command as Command4 } from "commander";
+
+// src/stage-evidence/artifact-path.ts
+init_esm_shims();
+import { realpathSync } from "fs";
+import { isAbsolute as isAbsolute6, relative as relative24, resolve as resolve7 } from "pathe";
+var ArtifactOutOfTreeError = class extends Error {
+  constructor(input3) {
+    super(`artifact must be a path inside the project; got ${input3}`);
+    this.input = input3;
+    this.name = "ArtifactOutOfTreeError";
+  }
+};
+function realOrLexical(p) {
+  try {
+    return realpathSync.native(p);
+  } catch {
+    return p;
+  }
+}
+function isEscape(rel) {
+  return rel === "" || rel === ".." || rel.startsWith("../") || rel.startsWith("..\\") || isAbsolute6(rel);
+}
+function normalizeArtifactPath(projectRoot, input3) {
+  const rootResolved = resolve7(projectRoot);
+  const rootReal = realOrLexical(rootResolved);
+  const absInput = isAbsolute6(input3) ? realOrLexical(input3) : resolve7(rootReal, input3);
+  for (const root of /* @__PURE__ */ new Set([rootReal, rootResolved])) {
+    const rel = relative24(root, absInput);
+    if (!isEscape(rel)) {
+      return rel.replace(/\\/g, "/");
+    }
+  }
+  throw new ArtifactOutOfTreeError(input3);
+}
+
+// src/cli/commands/compliance.ts
 function resolveIndexPath2(explicitPath, spec) {
   if (explicitPath) return explicitPath;
   if (spec) return specIndexPath(spec);
@@ -32076,8 +32141,17 @@ function createComplianceCommand() {
     process.exitCode = 0;
   });
   command.command("review <specFile>").description("Run deterministic spec-quality review and persist the review report").option("--project-root <path>", "Project root", process.cwd()).option("--json", "Print JSON instead of a human-readable summary").action(async (specFile, options) => {
-    const specPath = path10.resolve(options.projectRoot, specFile);
-    const relativeSpec = path10.relative(options.projectRoot, specPath);
+    let relativeSpec;
+    try {
+      relativeSpec = normalizeArtifactPath(options.projectRoot, specFile);
+    } catch {
+      console.error(
+        `**\u25B8 paqad** \xB7 a spec has to live inside the project for its review to be portable, and ${specFile} resolves outside it.`
+      );
+      process.exitCode = 1;
+      return;
+    }
+    const specPath = path10.resolve(options.projectRoot, relativeSpec);
     const specMarkdown = await readFile68(specPath, "utf8");
     const previousReport = await loadSpecReviewReport({
       project_root: options.projectRoot,
@@ -32407,7 +32481,7 @@ function resolveRelativeSpec(projectRoot, spec) {
 init_esm_shims();
 init_paths();
 import { existsSync as existsSync105 } from "fs";
-import { dirname as dirname79, isAbsolute as isAbsolute6, join as join194, resolve as resolve10 } from "path";
+import { dirname as dirname79, isAbsolute as isAbsolute7, join as join194, resolve as resolve11 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 import { Command as Command5 } from "commander";
 
@@ -32415,7 +32489,7 @@ import { Command as Command5 } from "commander";
 init_esm_shims();
 import { createReadStream, existsSync as existsSync104, statSync as statSync13 } from "fs";
 import { createServer } from "http";
-import { extname as extname9, join as join193, normalize as normalize2, resolve as resolve9 } from "path";
+import { extname as extname9, join as join193, normalize as normalize2, resolve as resolve10 } from "path";
 import { createGzip, gzipSync as gzipSync2 } from "zlib";
 init_paths();
 init_logger_registry();
@@ -32505,7 +32579,7 @@ function buildNodeDetail(graph, nodeId, options) {
 init_esm_shims();
 import { existsSync as existsSync75 } from "fs";
 import { readFile as readFile69, readdir as readdir15, stat as stat8 } from "fs/promises";
-import { extname as extname8, join as join161, relative as relative24, sep as sep6 } from "path";
+import { extname as extname8, join as join161, relative as relative25, sep as sep6 } from "path";
 init_paths();
 var KNOWN_TIERS = /* @__PURE__ */ new Set(["green", "amber", "red", "unknown"]);
 function normaliseTier(value) {
@@ -32543,7 +32617,7 @@ function languageFromExtension(filePath) {
   return map[ext] ?? null;
 }
 function toProjectRelative2(projectRoot, absolutePath) {
-  const rel = relative24(projectRoot, absolutePath);
+  const rel = relative25(projectRoot, absolutePath);
   return rel === "" ? "." : rel.split(sep6).join("/");
 }
 function moduleNameForFile(relativePath, knownModules) {
@@ -33437,11 +33511,11 @@ import {
   lstatSync as lstatSync2,
   mkdirSync as mkdirSync47,
   readFileSync as readFileSync76,
-  realpathSync,
+  realpathSync as realpathSync2,
   renameSync as renameSync13,
   writeFileSync as writeFileSync39
 } from "fs";
-import { dirname as dirname77, join as join166, resolve as resolve7, sep as sep7 } from "path";
+import { dirname as dirname77, join as join166, resolve as resolve8, sep as sep7 } from "path";
 var WriteConflictError = class extends Error {
   currentContent;
   currentHash;
@@ -33490,8 +33564,8 @@ function resolveManagedPath(projectRoot, relativePath) {
   if (!ALLOWED_EXTENSIONS.some((extension) => posix4.endsWith(extension))) {
     throw new PathNotAllowedError(relativePath, "extension is not editable");
   }
-  const realRoot = existsSync79(projectRoot) ? realpathSync(resolve7(projectRoot)) : resolve7(projectRoot);
-  const absolute = resolve7(realRoot, posix4);
+  const realRoot = existsSync79(projectRoot) ? realpathSync2(resolve8(projectRoot)) : resolve8(projectRoot);
+  const absolute = resolve8(realRoot, posix4);
   const rootPrefix = `${realRoot}${sep7}`;
   if (!absolute.startsWith(rootPrefix)) {
     throw new PathNotAllowedError(relativePath, "outside the project root");
@@ -33502,7 +33576,7 @@ function resolveManagedPath(projectRoot, relativePath) {
       if (lstatSync2(probe).isSymbolicLink()) {
         throw new PathNotAllowedError(relativePath, "symlinks are not editable");
       }
-      const real = realpathSync(probe);
+      const real = realpathSync2(probe);
       if (real !== probe && !real.startsWith(rootPrefix)) {
         throw new PathNotAllowedError(relativePath, "resolves outside the project root");
       }
@@ -35413,7 +35487,7 @@ function removePack2(projectRoot, input3) {
 init_esm_shims();
 init_paths();
 import { existsSync as existsSync101 } from "fs";
-import { join as join190, resolve as resolve8 } from "path";
+import { join as join190, resolve as resolve9 } from "path";
 
 // src/dashboard/collectors/architecture.ts
 init_esm_shims();
@@ -37188,7 +37262,7 @@ function computeOverall(sections) {
 }
 function buildReport(projectRoot, options = {}) {
   const now = options.now ?? Date.now();
-  const root = resolve8(projectRoot);
+  const root = resolve9(projectRoot);
   const generatedAt = new Date(now).toISOString();
   const paqadDir = join190(root, PATHS.AGENCY_DIR);
   const manifestPath = join190(root, PATHS.ONBOARDING_MANIFEST);
@@ -37491,8 +37565,8 @@ function writeText(res, body, status = 200, contentType = "text/plain; charset=u
 function serveStatic(req, res, staticDir, urlPath) {
   const safePath = normalize2(urlPath).replace(/^[/\\]+/, "");
   let filePath = join193(staticDir, safePath);
-  const resolved = resolve9(filePath);
-  if (!resolved.startsWith(resolve9(staticDir))) {
+  const resolved = resolve10(filePath);
+  if (!resolved.startsWith(resolve10(staticDir))) {
     writeText(res, "Forbidden", 403);
     return;
   }
@@ -38226,12 +38300,12 @@ function openBrowser(options) {
 var DEFAULT_PORT = 5372;
 function resolveStaticDir(override) {
   if (override) {
-    return isAbsolute6(override) ? override : resolve10(process.cwd(), override);
+    return isAbsolute7(override) ? override : resolve11(process.cwd(), override);
   }
   const here = dirname79(fileURLToPath3(import.meta.url));
   const candidates = [
-    resolve10(here, "../../runtime/graph-ui"),
-    resolve10(here, "../../../runtime/graph-ui")
+    resolve11(here, "../../runtime/graph-ui"),
+    resolve11(here, "../../../runtime/graph-ui")
   ];
   for (const c of candidates) {
     if (existsSync105(join194(c, "index.html"))) return c;
@@ -38240,7 +38314,7 @@ function resolveStaticDir(override) {
 }
 function createDashboardCommand() {
   return new Command5("dashboard").description("Open the paqad-ai project dashboard in a local web view").option("--port <n>", "Server port (auto-increments if occupied)", String(DEFAULT_PORT)).option("--host <host>", "Bind address", "127.0.0.1").option("--no-open", "Do not open the browser automatically").option("--no-watch", "Disable live reload on .paqad/ changes").option("--quiet", "Suppress non-essential stdout", false).option("--read-only", "Disable every mutation endpoint (for shared or CI usage)", false).option("--project-root <path>", "Project root", process.cwd()).option("--static-dir <path>", "Override the bundled frontend directory").action(async (options) => {
-    const projectRoot = resolve10(options.projectRoot);
+    const projectRoot = resolve11(options.projectRoot);
     const paqadDir = join194(projectRoot, PATHS.AGENCY_DIR);
     if (!existsSync105(paqadDir)) {
       process.stderr.write(
@@ -38320,7 +38394,7 @@ Received ${signal}, shutting down\u2026
 init_esm_shims();
 init_paths();
 import { existsSync as existsSync106, readFileSync as readFileSync92, readdirSync as readdirSync29 } from "fs";
-import { join as join195, resolve as resolve11 } from "path";
+import { join as join195, resolve as resolve12 } from "path";
 import { Command as Command6 } from "commander";
 
 // src/delivery/ci-gate.ts
@@ -38770,7 +38844,7 @@ function loadEvidenceBody(projectRoot) {
 }
 function createDeliveryCommand() {
   return new Command6("deliver").description("Run the delivery chain: PR (after asking) \u2192 wait for CI \u2192 evidence on green").option("--project-root <path>", "Project root", process.cwd()).option("--dry-run", "Render branch/commit/PR text without pushing", false).option("--base <branch>", "Base branch for the PR", "main").option("--draft", "Open the PR as a draft", false).option("--title <title>", "Change title (branch slug + PR title)", "").option("--summary <summary>", "One-line summary for the commit/PR body", "").option("--ticket <ref>", "Linked ticket ref (e.g. #45 or PQD-123)").option("--ticket-type <type>", "Ticket type (Story/Bug/Task) \u2192 conventional commit type").option("--scope <scope>", "Conventional-commit scope (usually the module)").option("--open-pr <mode>", "Recommended open_pr choice for the pause (yes|draft|no)", "yes").option("--reviewer <handle>", "PR reviewer (repeatable)", collect, []).option("--label <label>", "PR label (repeatable)", collect, []).action(async (options) => {
-    const projectRoot = resolve11(options.projectRoot);
+    const projectRoot = resolve12(options.projectRoot);
     const shell = createDeliveryShell(projectRoot);
     const host = new GithubHostProvider(shell);
     const result = await runDeliver({
@@ -38967,11 +39041,11 @@ function createEnableCommand() {
 // src/cli/commands/evidence.ts
 init_esm_shims();
 import { mkdirSync as mkdirSync49, writeFileSync as writeFileSync41 } from "fs";
-import { dirname as dirname80, resolve as resolve12 } from "path";
+import { dirname as dirname80, resolve as resolve13 } from "path";
 import { Command as Command11 } from "commander";
 function createEvidenceCommand() {
   return new Command11("evidence").description("Render verification evidence as a scannable PR comment (Markdown or JSON)").argument("[sha]", "Commit SHA or label shown in the headline").option("--format <fmt>", "Output format: markdown | json", "markdown").option("--project-root <path>", "Project root", process.cwd()).option("--output <path>", "Write to a file instead of stdout (for gh pr comment --body-file)").option("--fail-on-red", "Exit non-zero when the overall status is fail", false).action((sha, options) => {
-    const projectRoot = resolve12(options.projectRoot);
+    const projectRoot = resolve13(options.projectRoot);
     const fmt = options.format.toLowerCase();
     if (fmt !== "markdown" && fmt !== "json") {
       process.stderr.write(
@@ -38992,7 +39066,7 @@ function createEvidenceCommand() {
     }
     const output = fmt === "json" ? JSON.stringify(evidence, null, 2) : renderEvidenceMarkdown(evidence, sha ? { sha } : {});
     if (options.output) {
-      const target = resolve12(options.output);
+      const target = resolve13(options.output);
       mkdirSync49(dirname80(target), { recursive: true });
       writeFileSync41(target, `${output}
 `, "utf8");
@@ -39104,19 +39178,19 @@ function createFeatureCommand() {
 init_esm_shims();
 init_paths();
 import { existsSync as existsSync107 } from "fs";
-import { dirname as dirname81, isAbsolute as isAbsolute7, join as join196, resolve as resolve13 } from "path";
+import { dirname as dirname81, isAbsolute as isAbsolute8, join as join196, resolve as resolve14 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 import { Command as Command13 } from "commander";
 var DEFAULT_PORT2 = 5372;
 var DEPRECATION_LINE = "paqad-ai graph has moved into the dashboard. Opening the dashboard on the Graph view. Run paqad-ai dashboard next time.";
 function resolveStaticDir2(override) {
   if (override) {
-    return isAbsolute7(override) ? override : resolve13(process.cwd(), override);
+    return isAbsolute8(override) ? override : resolve14(process.cwd(), override);
   }
   const here = dirname81(fileURLToPath4(import.meta.url));
   const candidates = [
-    resolve13(here, "../../runtime/graph-ui"),
-    resolve13(here, "../../../runtime/graph-ui")
+    resolve14(here, "../../runtime/graph-ui"),
+    resolve14(here, "../../../runtime/graph-ui")
   ];
   for (const c of candidates) {
     if (existsSync107(join196(c, "index.html"))) return c;
@@ -39125,7 +39199,7 @@ function resolveStaticDir2(override) {
 }
 function createGraphCommand() {
   return new Command13("graph").description("Deprecated: opens the dashboard on the Graph view").option("--port <n>", "Server port (auto-increments if occupied)", String(DEFAULT_PORT2)).option("--host <host>", "Bind address", "127.0.0.1").option("--no-open", "Do not open the browser automatically").option("--no-watch", "Disable live reload on .paqad/ changes").option("--quiet", "Suppress non-essential stdout", false).option("--project-root <path>", "Project root", process.cwd()).option("--static-dir <path>", "Override the bundled frontend directory").action(async (options) => {
-    const projectRoot = resolve13(options.projectRoot);
+    const projectRoot = resolve14(options.projectRoot);
     const paqadDir = join196(projectRoot, PATHS.AGENCY_DIR);
     if (!existsSync107(paqadDir)) {
       process.stderr.write(
@@ -41338,7 +41412,7 @@ init_session();
 init_esm_shims();
 init_stage_ledger();
 init_session();
-import { isAbsolute as isAbsolute8, relative as relative25 } from "pathe";
+import { isAbsolute as isAbsolute9, relative as relative26 } from "pathe";
 init_stages();
 function stagesWithKind(rows, kind) {
   const set = /* @__PURE__ */ new Set();
@@ -41495,7 +41569,7 @@ init_service();
 init_esm_shims();
 init_project_intelligence();
 import { readFileSync as readFileSync102 } from "fs";
-import { isAbsolute as isAbsolute9, join as join213 } from "path";
+import { isAbsolute as isAbsolute10, join as join213 } from "path";
 import { confirm, input as input2, select as select3 } from "@inquirer/prompts";
 import { Command as Command18 } from "commander";
 
@@ -42975,7 +43049,7 @@ function createRagCommand() {
       readFile: (path11) => {
         try {
           return readFileSync102(
-            isAbsolute9(path11) ? path11 : join213(options.projectRoot, path11),
+            isAbsolute10(path11) ? path11 : join213(options.projectRoot, path11),
             "utf8"
           );
         } catch {
@@ -44145,7 +44219,7 @@ init_framework_config();
 init_esm_shims();
 init_path_utils();
 init_reconciler();
-import { isAbsolute as isAbsolute10, relative as relative26 } from "path";
+import { isAbsolute as isAbsolute11, relative as relative27 } from "path";
 function normalise(path11) {
   return toPosixPath(path11).replace(/^\.\//, "").replace(/\/+$/, "");
 }
@@ -44160,7 +44234,7 @@ function resolvePathSensitivity(projectRoot, relPath) {
   if (!map) {
     return "normal";
   }
-  const rel = isAbsolute10(relPath) ? relative26(projectRoot, relPath) : relPath;
+  const rel = isAbsolute11(relPath) ? relative27(projectRoot, relPath) : relPath;
   const target = normalise(rel);
   if (target.length === 0) {
     return "normal";
@@ -44564,7 +44638,20 @@ function freezeSpec(spec, input3) {
     spec_hash: spec.spec_hash,
     signed_off_by: input3.signed_off_by
   };
-  return { ...spec, frozen };
+  const specReview = input3.spec_review ? summarizeSpecReview2(input3.spec_review) : void 0;
+  return { ...spec, frozen, ...specReview === void 0 ? {} : { spec_review: specReview } };
+}
+function summarizeSpecReview2(report) {
+  const open = report.defects.filter((defect) => defect.status !== "resolved");
+  return {
+    reviewed_at: report.metadata.reviewed_at,
+    defect_count: open.length,
+    by_severity: {
+      critical: open.filter((defect) => defect.severity === "critical").length,
+      major: open.filter((defect) => defect.severity === "major").length,
+      minor: open.filter((defect) => defect.severity === "minor").length
+    }
+  };
 }
 function isFrozenSpecStale(spec, currentSpecHash) {
   return spec.frozen !== null && spec.frozen.spec_hash !== currentSpecHash;
@@ -44675,34 +44762,6 @@ init_esm_shims();
 init_stage_ledger();
 init_session();
 
-// src/stage-evidence/artifact-path.ts
-init_esm_shims();
-import { realpathSync as realpathSync2 } from "fs";
-import { isAbsolute as isAbsolute11, relative as relative27, resolve as resolve14 } from "pathe";
-var ArtifactOutOfTreeError = class extends Error {
-  constructor(input3) {
-    super(`artifact must be a path inside the project; got ${input3}`);
-    this.input = input3;
-    this.name = "ArtifactOutOfTreeError";
-  }
-};
-function realOrLexical(p) {
-  try {
-    return realpathSync2.native(p);
-  } catch {
-    return p;
-  }
-}
-function normalizeArtifactPath(projectRoot, input3) {
-  const rootAbs = realOrLexical(resolve14(projectRoot));
-  const absInput = isAbsolute11(input3) ? realOrLexical(input3) : resolve14(rootAbs, input3);
-  const rel = relative27(rootAbs, absInput);
-  if (rel === "" || rel === ".." || rel.startsWith("../") || rel.startsWith("..\\") || isAbsolute11(rel)) {
-    throw new ArtifactOutOfTreeError(input3);
-  }
-  return rel.replace(/\\/g, "/");
-}
-
 // src/stage-evidence/bundle-artifact.ts
 init_esm_shims();
 init_paths2();
@@ -45827,9 +45886,13 @@ function createSpecCommand() {
       try {
         relSpec = normalizeArtifactPath(options.projectRoot, specFile);
       } catch {
-        relSpec = null;
+        console.error(
+          `**\u25B8 paqad** \xB7 a spec has to live inside the project so its record stays portable, and ${specFile} resolves outside it. Author it in the repo and freeze it from there.`
+        );
+        process.exitCode = 1;
+        return;
       }
-      if (relSpec !== null && classifyBundlePath(relSpec) !== null) {
+      if (classifyBundlePath(relSpec) !== null) {
         console.error(
           `**\u25B8 paqad** \xB7 a feature bundle holds only its rigid artifacts, so a spec can't live at ${relSpec}. Author it outside \`.paqad/ledger/feature-evidence/\` \u2014 the freeze writes specification.json into the bundle for you.`
         );
@@ -45847,11 +45910,15 @@ function createSpecCommand() {
       const specId = options.specId ?? basename16(specFile).replace(/\.[^.]+$/, "");
       const built = buildFeatureSpec({
         spec_id: specId,
-        spec_file: specFile,
+        spec_file: relSpec,
         spec_markdown: markdown
       });
       const spec = options.confirmInvariants ? { ...built, invariants: built.invariants.map((inv) => ({ ...inv, confirmed: true })) } : built;
-      const evaluation = evaluateSpecFreeze(spec);
+      const specReview = reviewSpecification({
+        spec_file: relSpec,
+        spec_markdown: markdown
+      });
+      const evaluation = evaluateSpecFreeze(spec, specReview);
       if (!evaluation.can_freeze) {
         console.error(
           `**\u25B8 paqad** \xB7 can't freeze this spec yet \u2014 ${evaluation.blockers.length} blocker${evaluation.blockers.length === 1 ? "" : "s"} to resolve:`
@@ -45864,7 +45931,8 @@ function createSpecCommand() {
       }
       const frozen = freezeSpec(spec, {
         signed_off_by: options.signedOffBy,
-        frozen_at: (/* @__PURE__ */ new Date()).toISOString()
+        frozen_at: (/* @__PURE__ */ new Date()).toISOString(),
+        spec_review: specReview
       });
       let bundlePath = null;
       try {