snipara-companion 3.6.22 → 3.6.23

package/README.md

@@ -484,6 +484,13 @@ npx -y snipara-companion workflow producer-review --latest --outcome useful --re
 npx -y snipara-companion handoff --summary "auth impact mapped" --next "run auth tests"
 ```
 
+For a stricter engineering workflow, add `--strict` to a completed
+`workflow task-commit` or `workflow phase-commit`. Strict phase closeout requires
+all declared tasks to be completed or skipped and requires every supplied
+verification item to be passed. The default remains backward-compatible for
+older workflows; strict mode is recommended for release, security, and
+multi-agent work.
+
 Managed workflow judgments use risk-based authority. `info` and `watch`
 recommendations are accepted locally by policy and remain auditable; `risk` and
 `block` recommendations still need `workflow judgment-respond`. The immutable

package/dist/index.js

@@ -35537,6 +35537,29 @@ function workflowOutcomeEvidence(values) {
     ];
   });
 }
+function assertStrictVerificationEvidence(values, subject) {
+  const evidence = workflowOutcomeEvidence(values);
+  if (evidence.length === 0) {
+    throw new Error(`${subject} requires at least one --evidence passed:<check> in strict mode.`);
+  }
+  const nonPassing = evidence.filter((item) => item.status !== "passed");
+  if (nonPassing.length > 0) {
+    throw new Error(
+      `${subject} has non-passing evidence in strict mode: ${nonPassing.map((item) => `${item.status}:${item.label}`).join(" | ")}`
+    );
+  }
+  return evidence;
+}
+function assertStrictPhaseTasksCompleted(phase) {
+  const incomplete = workflowTasks(phase).filter(
+    (task) => !["completed", "skipped"].includes(task.status)
+  );
+  if (incomplete.length > 0) {
+    throw new Error(
+      `Phase '${phase.id}' has incomplete tasks in strict mode: ${incomplete.map((task) => `${task.id} (${task.status})`).join(", ")}`
+    );
+  }
+}
 var MANAGED_WORKFLOW_JUDGMENT_AUTONOMY_VERSION = "snipara.workflow.judgment-autonomy.v1";
 function isPolicyAutoEligibleRecommendation(recommendation) {
   return recommendation.severity === "info" || recommendation.severity === "watch";
@@ -36887,6 +36910,9 @@ async function workflowTaskCommitCommand(options) {
   const outcome = options.outcome ?? "completed";
   const category = options.category ?? "workflow-task";
   const files = options.files && options.files.length > 0 ? options.files : task.files ?? phase.files;
+  if (options.strict && outcome === "completed") {
+    assertStrictVerificationEvidence(options.evidence, `Task '${task.id}'`);
+  }
   await memoryGuardCheckCommand({
     trigger: "commit",
     files,
@@ -37533,6 +37559,10 @@ async function workflowPhaseCommitCommand(options) {
   const outcome = options.outcome ?? "completed";
   const category = options.category ?? "workflow-phase";
   const files = options.files && options.files.length > 0 ? options.files : phase.files;
+  if (options.strict && outcome === "completed") {
+    assertStrictPhaseTasksCompleted(phase);
+    assertStrictVerificationEvidence(options.evidence, `Phase '${phase.id}'`);
+  }
   if (outcome === "completed" && workflowTasks(phase).some((task) => task.status === "blocked")) {
     throw new Error(
       `Phase '${phase.id}' still has blocked tasks. Retry or complete their recovery tasks before phase-commit.`
@@ -46464,7 +46494,7 @@ workflow.command("task-commit").description("Persist a task outcome and keep the
   "Task evidence as passed|failed|not-run|unknown:text; repeatable",
   collectOption,
   []
-).option("--json", "Print raw JSON").action(async (phaseId, taskId, options) => {
+).option("--strict", "Require passed evidence before completing this task").option("--json", "Print raw JSON").action(async (phaseId, taskId, options) => {
   await workflowTaskCommitCommand({
     phaseId,
     taskId,
@@ -46478,6 +46508,7 @@ workflow.command("task-commit").description("Persist a task outcome and keep the
     outcome: options.outcome,
     files: options.files,
     evidence: options.evidence,
+    strict: Boolean(options.strict),
     json: options.json
   });
 });
@@ -46524,7 +46555,7 @@ workflow.command("phase-commit").description(
   "Phase evidence as passed|failed|not-run|unknown:text; repeatable",
   collectOption,
   []
-).option("--json", "Print raw JSON").action(async (phaseId, options) => {
+).option("--strict", "Require all tasks complete and passed evidence before completing this phase").option("--json", "Print raw JSON").action(async (phaseId, options) => {
   await workflowPhaseCommitCommand({
     phaseId,
     summary: options.summary,
@@ -46537,6 +46568,7 @@ workflow.command("phase-commit").description(
     outcome: options.outcome,
     files: options.files,
     evidence: options.evidence,
+    strict: Boolean(options.strict),
     json: options.json
   });
 });

package/docs/FULL_REFERENCE.md

@@ -1180,6 +1180,15 @@ snipara-companion workflow run --mode full --no-runtime-hint --query "implement
 snipara-companion workflow run --mode orchestrate --query "map production rollout risks"
 snipara-companion workflow final-commit --summary "Shipped auth hardening and tests" --why "Close the reported session replay gap" --evidence "passed:pnpm test auth" --risk "Monitor production auth errors" --next-step "Review the first 24 hours of telemetry" --files src/auth.ts tests/auth.test.ts
 snipara-companion workflow producer-report
+```
+
+Use `--strict` on a completed `workflow task-commit` or `workflow phase-commit`
+when the work needs a hard engineering closeout. Strict phase commit refuses
+pending or in-progress declared tasks and requires every supplied evidence item
+to be passed. Without the flag, legacy workflows retain their existing
+compatibility behavior.
+
+```
 snipara-companion workflow producer-review --artifact producer-abc123 --outcome useful --reviewer alice
 snipara-companion final-commit --summary "Shipped auth hardening and tests" --why "Close the reported session replay gap" --evidence "passed:pnpm test auth" --next-step "Review the first 24 hours of telemetry" --files src/auth.ts tests/auth.test.ts
 snipara-companion doctor

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "snipara-companion",
-  "version": "3.6.22",
+  "version": "3.6.23",
   "description": "Local-first CLI that asks your repo what breaks before an AI coding agent edits it.",
   "main": "dist/index.js",
   "bin": {