wogiflow 2.7.1 → 2.9.0

package/scripts/flow-done-gates.js

@@ -721,6 +721,80 @@ function testDiscoveryGate(ctx) {
   }
 }
 
+/**
+ * Verification proof gate — checks that completed acceptance criteria
+ * have verification evidence recorded in the durable session.
+ *
+ * Without this, agents can mark criteria as "completed" without any
+ * behavioral evidence that the feature actually works.
+ *
+ * Checks durable-session.json for verificationProof on each completed step.
+ * Steps without proof are flagged. If ALL steps lack proof, gate blocks.
+ * If SOME steps have proof, gate warns (partial evidence).
+ */
+function verificationProofGate(ctx) {
+  let loadDurableSession;
+  try {
+    ({ loadDurableSession } = require('./flow-durable-session'));
+  } catch (_err) {
+    ctx.warn('verificationProof (durable session module not available)');
+    return { passed: true };
+  }
+
+  try {
+    const session = loadDurableSession();
+    if (!session || !session.taskId) {
+      // No durable session — graceful fallback for tasks created before this gate existed
+      console.log(`  ${ctx.color('yellow', '\u25CB')} verificationProof (no durable session — skipping)`);
+      return { passed: true };
+    }
+
+    // Only check acceptance criteria steps, not system steps.
+    // Normalize step type to handle both kebab-case and snake_case variants.
+    const normalizeStepType = (type) => (type || '').toLowerCase().replace(/_/g, '-');
+    const criteriaSteps = (session.steps || []).filter(s =>
+      s.status === 'completed' && normalizeStepType(s.type) === 'acceptance-criteria'
+    );
+
+    if (criteriaSteps.length === 0) {
+      console.log(`  ${ctx.color('yellow', '\u25CB')} verificationProof (no completed criteria — skipping)`);
+      return { passed: true };
+    }
+
+    const unverified = criteriaSteps.filter(s => !s.verificationProof);
+    const verified = criteriaSteps.length - unverified.length;
+
+    if (unverified.length === 0) {
+      ctx.success(`verificationProof (${verified}/${criteriaSteps.length} criteria have evidence)`);
+      return { passed: true };
+    }
+
+    // If ALL criteria lack proof → hard block
+    if (verified === 0) {
+      ctx.error(`verificationProof (0/${criteriaSteps.length} criteria have verification evidence)`);
+      for (const s of unverified.slice(0, 5)) {
+        console.log(ctx.color('dim', `    - ${(s.description || s.title || s.id || '').substring(0, 100)}`));
+      }
+      console.log(ctx.color('dim', '    Run runtime verification or provide behavioral evidence for each criterion.'));
+      return {
+        passed: false,
+        errorOutput: `${unverified.length} acceptance criteria completed without verification proof. ` +
+          'Each criterion needs behavioral evidence (WebMCP, Playwright, curl, or manual checklist).'
+      };
+    }
+
+    // Partial proof — warn but allow (transitional)
+    console.log(`  ${ctx.color('yellow', '\u25CB')} verificationProof (${verified}/${criteriaSteps.length} verified — ${unverified.length} missing proof)`);
+    for (const s of unverified.slice(0, 3)) {
+      console.log(ctx.color('dim', `    - Missing: ${(s.description || s.title || s.id || '').substring(0, 80)}`));
+    }
+    return { passed: true };
+  } catch (err) {
+    ctx.warn(`verificationProof (error: ${ctx.truncateOutput(err.message, 3, 200)})`);
+    return { passed: true };
+  }
+}
+
 function unknownGate(ctx, gateName) {
   console.log(`  ${ctx.color('yellow', '\u25CB')} ${gateName} (manual check)`);
   return { passed: true };
@@ -804,6 +878,7 @@ const GATE_REGISTRY = {
   uiVerification: verificationGate,
   apiVerification: verificationGate,
   testDiscovery: testDiscoveryGate,
+  verificationProof: verificationProofGate,
   // Workspace gates (conditional — auto-skip when not in workspace)
   workspaceCompliance: workspaceGate,
 };
@@ -851,6 +926,7 @@ module.exports = {
   generatedTestsPassGate,
   verificationGate,
   testDiscoveryGate,
+  verificationProofGate,
   workspaceGate,
   unknownGate,
 };

package/scripts/flow-done.js

@@ -557,6 +557,20 @@ async function main() {
     process.exit(1);
   }
 
+  // Write gate latch — proves quality gates passed for this task.
+  // The TaskCompleted hook checks this latch before allowing completion.
+  // Without it, agents can call TaskUpdate and bypass all gates.
+  try {
+    const { setGateLatch } = require('./flow-gate-latch');
+    const gates = getConfig().qualityGates?.[taskTypeForGates]?.require
+      ?? getConfig().qualityGates?.feature?.require ?? [];
+    setGateLatch(taskId, gates);
+  } catch (err) {
+    if (process.env.DEBUG) {
+      console.error(`[flow-done] Gate latch write failed: ${err.message}`);
+    }
+  }
+
   console.log('');
 
   // Check if task exists

package/scripts/flow-gate-latch.js

@@ -0,0 +1,119 @@
+#!/usr/bin/env node
+
+/**
+ * Wogi Flow - Gate Latch
+ *
+ * Records when quality gates have passed for a task.
+ * The TaskCompleted hook checks for this latch before allowing
+ * a task to move to recentlyCompleted.
+ *
+ * Without the latch, agents can call TaskUpdate(status: "completed")
+ * and bypass all quality gates. The latch ensures that the only path
+ * to completion goes through the quality gate pipeline.
+ *
+ * Flow:
+ * 1. flow-done.js runs quality gates → gates pass → writes latch
+ * 2. Agent calls TaskUpdate → TaskCompleted hook fires
+ * 3. Hook checks latch → if present and recent → allows completion
+ * 4. If no latch → blocks completion with actionable error message
+ *
+ * Latch file: .workflow/state/.gates-passed.json
+ * TTL: 30 minutes (stale latches are ignored)
+ */
+
+const path = require('node:path');
+const fs = require('node:fs');
+const { PATHS, safeJsonParse } = require('./flow-utils');
+
+/** Latch time-to-live in milliseconds (30 minutes) */
+const LATCH_TTL_MS = 30 * 60 * 1000;
+
+/** Path to the gate latch file */
+const LATCH_PATH = path.join(PATHS.state, '.gates-passed.json');
+
+/**
+ * Record that quality gates have passed for a task.
+ * Called by flow-done.js after all gates pass.
+ *
+ * @param {string} taskId - The task ID that passed gates
+ * @param {string[]} gatesPassed - Names of gates that passed
+ * @returns {{ written: boolean, path: string }}
+ */
+function setGateLatch(taskId, gatesPassed = []) {
+  try {
+    const latch = {
+      taskId,
+      gatesPassed,
+      passedAt: new Date().toISOString(),
+      pid: process.pid
+    };
+    fs.writeFileSync(LATCH_PATH, JSON.stringify(latch, null, 2));
+    return { written: true, path: LATCH_PATH };
+  } catch (err) {
+    if (process.env.DEBUG) {
+      console.error(`[gate-latch] Failed to write latch: ${err.message}`);
+    }
+    return { written: false, path: LATCH_PATH };
+  }
+}
+
+/**
+ * Check if quality gates have passed for a task.
+ * Returns the latch data if valid, null if no latch or expired.
+ *
+ * @param {string} taskId - The task ID to check
+ * @returns {{ valid: boolean, latch: Object|null, reason: string }}
+ */
+function checkGateLatch(taskId) {
+  const latch = safeJsonParse(LATCH_PATH, null);
+
+  if (!latch) {
+    return {
+      valid: false,
+      latch: null,
+      reason: 'No gate latch found. Quality gates have not been run for this task.'
+    };
+  }
+
+  // Check task ID matches
+  if (latch.taskId !== taskId) {
+    return {
+      valid: false,
+      latch,
+      reason: `Gate latch is for task ${latch.taskId}, not ${taskId}.`
+    };
+  }
+
+  // Check TTL
+  const passedAt = new Date(latch.passedAt).getTime();
+  const age = Date.now() - passedAt;
+  if (age > LATCH_TTL_MS) {
+    return {
+      valid: false,
+      latch,
+      reason: `Gate latch expired (${Math.round(age / 60000)} min old, TTL is ${LATCH_TTL_MS / 60000} min).`
+    };
+  }
+
+  return {
+    valid: true,
+    latch,
+    reason: `Gates passed at ${latch.passedAt} (${latch.gatesPassed.length} gates)`
+  };
+}
+
+/**
+ * Clear the gate latch after task completion.
+ * Prevents stale latches from persisting.
+ */
+function clearGateLatch() {
+  try {
+    if (fs.existsSync(LATCH_PATH)) {
+      fs.unlinkSync(LATCH_PATH);
+    }
+  } catch (_err) {
+    // Non-critical
+  }
+}
+
+module.exports = { setGateLatch, checkGateLatch, clearGateLatch, LATCH_PATH };