valent-pipeline 0.19.26 → 0.19.28

package/bin/cli.js

@@ -596,6 +596,19 @@ program
     await checkSpecConformanceCmd(options);
   });
 
+// check-groom-currency — re-groom guard: is a GROOMED story's spec stale vs active correction-directives?
+program
+  .command('check-groom-currency')
+  .description('Exit 1 if a GROOMED story\'s spec predates the latest correction-directives change (the sprint then re-specs instead of skip-spec on a stale groomed spec); exit 0 if current. Graceful no-op without git/directives/spec.')
+  .requiredOption('--story <id>', 'Story identifier')
+  .option('--root <dir>', 'Project root (defaults to the current directory)')
+  .option('--manifest <path>', 'Spec manifest path (defaults to stories/<id>/output/qa-test-spec.manifest.json)')
+  .option('--directives <path>', 'Correction-directives path (defaults to knowledge/correction-directives.yaml)')
+  .action(async (options) => {
+    const { checkGroomCurrency } = await import('../src/commands/check-groom-currency.js');
+    await checkGroomCurrency(options);
+  });
+
 // spec commands — mechanical spec-phase gate (Phase 2: READINESS Step 0 dissolved into code)
 const specCmd = program
   .command('spec')

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "valent-pipeline",
-  "version": "0.19.26",
+  "version": "0.19.28",
   "description": "v3 multi-agent AI pipeline for software development lifecycle",
   "type": "module",
   "bin": {

package/pipeline/orchestrators/claude-code/sprint.workflow.js

@@ -391,6 +391,20 @@ const SPECCHECK_SCHEMA = {
   },
 }
 
+// GROOM-CURRENCY gate return (re-groom guard): is a groomed story's spec stale vs active directives?
+const GROOM_CURRENCY_SCHEMA = {
+  type: 'object',
+  required: ['schema', 'story', 'stale'],
+  additionalProperties: true,
+  properties: {
+    schema: { const: 1 },
+    agent: { type: 'string' },
+    story: { type: 'string' },
+    stale: { type: 'boolean' },
+    reason: { type: 'string' },
+  },
+}
+
 // RED gate return (Phase 2 ATDD). `noAcceptance` = the CLI no-op'd (pre-ATDD story); `weakRed` =
 // the suite could not run pre-implementation and weak_red=allow accepted it (carried to JUDGE);
 // `prePassingCases` = acceptance cases that PASSED before implementation (spec bugs -> QA-A).
@@ -1975,6 +1989,18 @@ async function runStory(story) {
   // source story's ACs still hold) from the bug's backlog fields and the source story's existing specs,
   // so the normal dev agents have the inputs they read. Then Build -> Critic -> QA -> Judge run as usual.
   // Spec/SpecCheck (REQS/UXA/QA-A + the mechanical gate) are skipped — a bug fixes existing code, it is not re-specced.
+
+  // Re-groom guard (2026-06-17): if a correction-directive landed SINCE this groomed story was specced
+  // (e.g. CD-11-1's "infra-invariant ACs are required:false" rule), its on-disk spec predates the
+  // directive and is stale — fall through to the full Spec path instead of the skip-spec-on-groomed
+  // shortcut, so the new directive actually shapes the spec. Cheap deterministic check; fails open.
+  let specStale = false
+  if (groomed && itemType !== 'bug') {
+    const currency = await runGroomCurrencyGate(storyId)
+    specStale = currency.stale === true
+    if (specStale) log(`${storyId}: groomed spec is STALE vs active directives (${currency.reason}) — re-speccing`)
+  }
+
   if (itemType === 'bug') {
     phase('Spec')
     log(`${storyId}: bug-fix item — running bug-intake (minimal brief + regression spec), skipping full Spec + Readiness`)
@@ -1989,7 +2015,7 @@ async function runStory(story) {
         `that context write a MINIMAL reqs-brief.md (the fix scope) and qa-test-spec.md (a regression proving the ` +
         `defect is gone plus the affected ACs still pass) into this item's output dir. Do NOT re-spec the whole story.`,
       { label: `bug-intake:${storyId}`, phase: 'Spec', model: modelFor('REQS') })
-  } else if (groomed) {
+  } else if (groomed && !specStale) {
     // Spec + Readiness are SKIPPED for pre-groomed stories. plan.workflow.js already specced them
     // (reqs-brief/uxa-spec/qa-test-spec are on disk) and passed the spec gate at planning time,
     // so re-running here is duplicated token spend. The standalone single-story path leaves `groomed`
@@ -2529,6 +2555,24 @@ async function runStory(story) {
   // re-derivation: the spec is a derivation chain (REQS -> UXA -> QA-A); reworking upstream
   // without re-deriving downstream guarantees the next cycle re-rejects on staleness. Cap-trip
   // throws — a story whose spec artifacts cannot be completed must not reach Build.
+  // Re-groom guard helper: run the deterministic groom-currency CLI (git commit-time of the spec vs
+  // correction-directives.yaml) and return {stale, reason}. Fails open (stale:false) if it can't run,
+  // so a missing/unavailable check never forces a re-spec we can't justify.
+  async function runGroomCurrencyGate(sid) {
+    const v = await agent(
+      [
+        `You are **GROOM-CURRENCY**, a mechanical check for story ${sid} in the valent-pipeline.`,
+        `Run this ONE command from ${runDirPhrase(sid)}, capturing its exit code and last stdout line (JSON):`,
+        `  node .valent-pipeline/bin/cli.js check-groom-currency --story ${sid}`,
+        `Exit 1 = the groomed spec is STALE vs active correction-directives; exit 0 = current. Transcribe, never interpret.`,
+        `Return ONLY { schema:1, agent:"groom-currency", story:"${sid}", stale:boolean, reason:string } as JSON ` +
+          `(stale=true iff the command exited 1; copy the command's JSON "reason").`,
+      ].join('\n'),
+      { label: `gate:groom-currency:${sid}`, phase: 'Spec', schema: GROOM_CURRENCY_SCHEMA, model: modelFor('SPECCHECK') },
+    )
+    return v && typeof v.stale === 'boolean' ? v : { stale: false, reason: 'currency check unavailable — treated as current' }
+  }
+
   async function runSpecCheckGate(sid) {
     // Full trail: spec artifacts land as `docs({id}): …` before the mechanical checks — and each
     // spec-rework cycle re-commits (the commit is a no-op on an already-clean tree).

package/src/commands/check-groom-currency.js

@@ -0,0 +1,64 @@
+import { existsSync } from 'fs';
+import { isAbsolute, join } from 'path';
+import { execFileSync } from 'child_process';
+
+function resolveRoot(options) {
+  const r = options.root || process.cwd();
+  return isAbsolute(r) ? r : join(process.cwd(), r);
+}
+
+/** Unix commit-time of the last commit touching `relPath`, or null if uncommitted / git unavailable. */
+function lastCommitTime(root, relPath) {
+  try {
+    const out = execFileSync('git', ['log', '-1', '--format=%ct', '--', relPath], { cwd: root, encoding: 'utf-8' }).trim();
+    const t = parseInt(out, 10);
+    return Number.isFinite(t) ? t : null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * `valent-pipeline check-groom-currency --story <id> [--root <dir>] [--manifest <path>] [--directives <path>]`
+ *
+ * Is a GROOMED story's spec still CURRENT with the active correction-directives? The sprint skips the
+ * Spec phase for a story plan-time grooming already specced — a token win — but a directive that
+ * landed AFTER grooming (canonical: CD-11-1's "infra-invariant ACs are required:false" rule) never
+ * shaped that on-disk spec, so the skip silently reuses a STALE spec. (Story 2.1 hit exactly this: its
+ * spec, groomed before CD-11-1, marked infra invariants required:true and the ATDD red gate rejected
+ * it for premature-pass — a manual forced re-groom was the workaround.)
+ *
+ * STALE iff `correction-directives.yaml` was committed AFTER the story's spec manifest. Prints a JSON
+ * verdict and exits 1 when STALE (the sprint workflow then re-specs), 0 when FRESH. Graceful no-op
+ * (FRESH / exit 0) when there are no directives, no committed spec, or no git — never forces a
+ * re-groom on missing data, so legacy / non-git projects are unaffected.
+ */
+export async function checkGroomCurrency(options) {
+  const root = resolveRoot(options);
+  const story = options.story;
+  if (!story) {
+    console.error('check-groom-currency: --story is required.');
+    process.exit(2);
+  }
+  const specRel = options.manifest || join('stories', story, 'output', 'qa-test-spec.manifest.json');
+  const dirRel = options.directives || join('knowledge', 'correction-directives.yaml');
+  const specAbs = isAbsolute(specRel) ? specRel : join(root, specRel);
+  const dirAbs = isAbsolute(dirRel) ? dirRel : join(root, dirRel);
+
+  if (!existsSync(dirAbs) || !existsSync(specAbs)) {
+    console.log(JSON.stringify({ ok: true, stale: false, reason: 'no active directives or no spec manifest on disk — nothing to re-groom against' }));
+    process.exit(0);
+  }
+
+  const specCt = lastCommitTime(root, specRel);
+  const dirCt = lastCommitTime(root, dirRel);
+  // Fail SAFE on missing git times: treat as fresh (do not force a re-groom we cannot justify).
+  const stale = !!(specCt && dirCt && dirCt > specCt);
+  const reason = stale
+    ? `correction-directives.yaml was committed (${dirCt}) AFTER the spec manifest (${specCt}) — a directive landed since grooming; re-spec so it applies`
+    : (specCt && dirCt
+        ? `spec manifest is at or after the latest directive change (spec ${specCt} >= directives ${dirCt}) — current`
+        : 'spec or directives uncommitted — treating as current (no re-groom forced on missing git data)');
+  console.log(JSON.stringify({ ok: true, stale, reason, specCommit: specCt, directivesCommit: dirCt }));
+  process.exit(stale ? 1 : 0);
+}

package/src/commands/evidence.js

@@ -17,7 +17,7 @@ import { randomBytes } from 'crypto';
 import { parse as parseYaml } from 'yaml';
 import {
   runEvidence, pinGate, formatRunTrailer, formatRunDigest, resolveRoot, evidenceDir, latestRun, latestPins,
-  verifyIntegrity, assertRules, assertRedRules, snapshotFiles, buildProof, utcCompact,
+  verifyIntegrity, assertRules, assertRedRules, pinSourceDelta, snapshotFiles, buildProof, utcCompact,
   latestAssert, collectFailingCases, authenticateBaseline, verifyShipEvidence, sha256Hex,
   validStoryId, recordStageResults,
 } from '../lib/evidence.js';
@@ -342,6 +342,19 @@ export async function evidenceAssertCmd(options) {
     .map((s) => s.trim())
     .filter(Boolean);
 
+  // Pin coherence v3 (2026-06-17): a pin/tested SHA mismatch is incoherent only if SOURCE moved
+  // between the pin and the tested commit — compute the per-gate source delta here (git IO) so
+  // assertRules stays pure. A bookkeeping-only commit (start-story snapshot, board/run state, a
+  // re-pin) leaves the reviewed code intact and keeps the pin coherent.
+  const pinsForCheck = latestPins(evDir);
+  const pinDelta = {};
+  for (const gate of requirePins) {
+    const pin = pinsForCheck instanceof Map ? pinsForCheck.get(gate) : pinsForCheck?.[gate];
+    if (pin && run.record.git && pin.sha !== run.record.git.sha) {
+      pinDelta[gate] = pinSourceDelta({ root, fromSha: pin.sha, toSha: run.record.git.sha });
+    }
+  }
+
   const result = assertRules({
     record: run.record,
     parsedReports,
@@ -349,11 +362,12 @@ export async function evidenceAssertCmd(options) {
     manifestCases,
     baseline,
     baselineAuth,
-    pins: latestPins(evDir),
+    pins: pinsForCheck,
     requirePins,
     allowDirty: !options.strictDirty,
     redBaseline,
     frozenSpecForced: !!options.redBaseline,
+    pinDelta,
   });
 
   const verdictRecord = {

package/src/lib/git-flow.js

@@ -177,6 +177,11 @@ const STATE_EXCLUDE_PATTERNS = [
   // is refused ("local changes would be overwritten"). A transient local pointer has no business in
   // git history; keep it on disk, out of git. (Root cause of a 3rd Sprint-1 zero-ship, 2026-06-13.)
   '.valent-pipeline/run-state.json',
+  // Resolve snapshots + scratch the orchestrator/skills drop next to a run. start-story's pre-branch
+  // snapshot used to sweep these onto the integration branch, creating no-source-delta commits that
+  // false-rejected pin coherence AND contaminated the next story's base (2026-06-17). Off git.
+  '.resolve-snapshot.json',
+  'scratch/',
 ];
 
 /**

package/src/lib/spec-conformance.js

@@ -73,8 +73,10 @@ function stripLineComment(line) {
 }
 
 /**
- * Scan one story test file for un-waived skip/only/todo markers. A waiver is `// valent-waiver: ...`
- * on the same line or the line immediately above the marker.
+ * Scan one story test file for un-waived skip/only/todo markers. A waiver is `valent-waiver:` on the
+ * marker's own line (including embedded in an it.skip/describe.skip title) or in the comment/decorator
+ * block immediately preceding it (up to 3 lines up — multi-line reasons, a wrapped decorator). Waivers
+ * sit on or above the marker by convention, so the window only looks back, never forward.
  * @returns {Array<{kind:'unwaived-skip', file:string, line:number, detail:string}>}
  */
 function scanSkips(file) {
@@ -86,7 +88,7 @@ function scanSkips(file) {
     SKIP_MARKER.lastIndex = 0;
     const m = code.match(SKIP_MARKER);
     if (!m) continue;
-    const waived = WAIVER_RE.test(raw) || (i > 0 && WAIVER_RE.test(lines[i - 1]));
+    const waived = WAIVER_RE.test(raw) || lines.slice(Math.max(0, i - 3), i).some((l) => WAIVER_RE.test(l));
     if (waived) continue;
     out.push({
       kind: 'unwaived-skip',