pincer-workflow 0.3.0 → 0.4.1

package/template/scripts/pincer-ticket-lib.sh

@@ -2,6 +2,26 @@
 # Shared, read-only parsing for the supported Pincer ticket format.
 # Validators return nonzero with a diagnostic; callers decide how to report it.
 
+PINCER_LIB_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
+PINCER_EVIDENCE="$PINCER_LIB_DIR/pincer-evidence.cjs"
+
+# Run the shared evidence validator; prints its combined output, returns its status.
+# Usage: evidence_validate <manifest> <candidate> <base> <prd> [--files]
+# Absent or malformed candidate/base/prd values are simply not checked, so a bad
+# NOTES.md field is reported by notes_current, never as a manifest verdict.
+evidence_validate() {
+  local manifest=$1 candidate=$2 base=$3 prd=$4; shift 4
+  command -v node >/dev/null 2>&1 || { printf 'evidence: %s: Node.js 18+ is required to validate evidence\n' "$manifest"; return 1; }
+  local -a args=(validate "$manifest")
+  if [[ $candidate =~ ^[a-f0-9]{40}$ ]]; then args+=(--candidate "$candidate"); fi
+  if [[ $base =~ ^[a-f0-9]{40}$ ]]; then args+=(--base "$base"); fi
+  if [[ $prd =~ ^\.prd/prd-v[1-9][0-9]{0,8}\.md$ ]]; then args+=(--prd "$prd"); fi
+  node "$PINCER_EVIDENCE" "${args[@]}" "$@" 2>&1
+}
+evidence_reason() { # first diagnostic line without the manifest prefix; usage errors are labelled
+  printf '%s\n' "$1" | head -1 | sed -e 's/^evidence: [^:]*: //' -e 's/^pincer-evidence: /validator usage: /'
+}
+
 normalize() { # CLI shorthand -> canonical ID; bound arithmetic before conversion.
   local n=${1#T-}; n=${n#t-}
   if ! [[ $n =~ ^[0-9]{1,6}$ ]] || [ "$((10#$n))" -eq 0 ]; then
@@ -185,6 +205,12 @@ validate_prd() {
   validate_metadata "$ref" || return 1
   [ "$(fm_get "$ref" version)" = "$version" ] || { printf 'pincer: %s: version must match filename (%s)\n' "$ref" "$version" >&2; return 1; }
   case "$(fm_get "$ref" status)" in draft|ticketed|built) ;; *) printf 'pincer: %s: PRD status must be draft, ticketed, or built\n' "$ref" >&2; return 1 ;; esac
+  case "$(fm_get "$ref" profile)" in ''|small|standard) ;; *) printf 'pincer: %s: profile must be small or standard (omit for standard)\n' "$ref" >&2; return 1 ;; esac
+}
+
+prd_profile() { # effective planning profile; older PRDs without the field are standard
+  local profile; profile=$(fm_get "$1" profile)
+  printf '%s' "${profile:-standard}"
 }
 
 latest_prd() {
@@ -247,14 +273,19 @@ ticket_readiness() { # explain why a done ticket needs attention, without mutati
   if [ -n "$(unticked "$file")" ]; then printf 'unticked acceptance criteria — complete and re-run verify'; return 1; fi
 }
 
+# An evaluation is current when NOTES.md names this PRD, a reviewed base and
+# candidate that are ancestors of HEAD, and an evidence manifest that validates
+# for that candidate; after the candidate, only NOTES.md and the files the
+# manifest lists may have changed, all of them tracked, and the working tree is
+# clean apart from NOTES.md. Legacy notes without a manifest never grant readiness.
 notes_current() {
-  local prd=$1 candidate base changes
+  local prd=$1 candidate base changes manifest output listed file stored canonical offending
   [ -f NOTES.md ] || { printf 'missing'; return 1; }
   validate_metadata NOTES.md >/dev/null 2>&1 || { printf 'stale: invalid or missing evaluation metadata'; return 1; }
   [ "$(fm_get NOTES.md prd)" = "$prd" ] || { printf 'stale: evaluation PRD does not match'; return 1; }
   candidate=$(fm_get NOTES.md candidate); base=$(fm_get NOTES.md base)
-  if ! [[ $candidate =~ ^([a-f0-9]{40}|[a-f0-9]{64})$ ]] || ! [[ $base =~ ^([a-f0-9]{40}|[a-f0-9]{64})$ ]]; then
-    printf 'stale: candidate and base must be full commit IDs'; return 1
+  if ! [[ $candidate =~ ^[a-f0-9]{40}$ ]] || ! [[ $base =~ ^[a-f0-9]{40}$ ]]; then
+    printf 'stale: candidate and base must be full 40-hex commit IDs'; return 1
   fi
   if ! git rev-parse --verify "$candidate^{commit}" >/dev/null 2>&1 ||
      ! git rev-parse --verify "$base^{commit}" >/dev/null 2>&1 ||
@@ -262,8 +293,28 @@ notes_current() {
      ! git merge-base --is-ancestor "$candidate" HEAD 2>/dev/null; then
     printf 'stale: evaluation commits or ancestry unavailable'; return 1
   fi
-  changes=$(git diff --name-only "$candidate" HEAD -- . ':(exclude)NOTES.md') || return 1
-  if [ -n "$changes" ]; then printf 'stale: candidate changed after evaluation'; return 1; fi
+  manifest=$(fm_get NOTES.md evidence)
+  if [ -z "$manifest" ]; then
+    printf 'stale: legacy evaluation without evidence manifest — re-run /pincer-evaluate for evidence schema 1'; return 1
+  fi
+  if ! output=$(evidence_validate "$manifest" "$candidate" "$base" "$prd" --files); then
+    printf 'stale: evidence invalid: %s' "$(evidence_reason "$output")"; return 1
+  fi
+  listed=$(printf '%s\n' "$output" | tail -n +2)
+  # Every listed file must be tracked; keep git's own spelling of each path
+  # (unquoted, relative to this directory, NFC where git normalises) so the set
+  # compares byte-for-byte with the diff below.
+  canonical=""
+  while IFS= read -r file; do
+    [ -n "$file" ] || continue
+    stored=$(git -c core.quotePath=false ls-files --error-unmatch -- "$file" 2>/dev/null) || { printf 'stale: evidence not tracked: %s' "$file"; return 1; }
+    canonical="$canonical$stored
+"
+  done <<< "$listed"
+  # Paths relative to the project root (which may be below the git toplevel).
+  changes=$(git -c core.quotePath=false diff --name-only --relative "$candidate" HEAD -- . ':(exclude)NOTES.md') || return 1
+  offending=$(printf '%s\n' "$changes" | grep -vxF -f <(printf '%s' "$canonical") | grep -v '^$' | head -1)
+  if [ -n "$offending" ]; then printf 'stale: candidate changed after evaluation: %s' "$offending"; return 1; fi
   changes=$(git status --porcelain --untracked-files=all -- . ':(exclude)NOTES.md') || return 1
   if [ -n "$changes" ]; then printf 'stale: working tree has changes outside NOTES.md'; return 1; fi
   printf 'current (%s)' "$candidate"

package/template/scripts/pincer-ticket.sh

@@ -95,7 +95,7 @@ cmd_verify() {
   trap - INT TERM
   if [ "$rc" -ne 0 ]; then
     fm_set "$f" last_check "$(now) failed $hash"
-    echo "✗ $id verification FAILED (exit $rc) — no receipt written. Fix, then re-run." >&2
+    echo "✗ $id verification FAILED (exit $rc) — failure recorded in last_check of $f; any prior successful receipt was revoked. Fix, then re-run verify." >&2
     exit "$rc"
   fi
   if [ "$hash" != "$(verify_hash "$f")" ]; then