Align plan library with clarified v1 review contracts

[mchwang]

PR #1 review clarified v1 contracts after the first library slice in PR #4. Before runner integration, align the library and add real regressions for: exact full-argv allowlist matching (appended flags fail); registry-selected versioned schemas and current-copy identity; required selected-issue context; canonical leaf paths with checkout case/Unicode identity; base Git entry types, pre-existing symlink lineage, and rejection of new links/regular-file conversions. Keep container and merge enforcement in their planned runner phases. Acceptance: tests reproduce each mismatch before its fix, then pass with typecheck. See docs/plan-format.md and the updated T18 criteria. Coordinate with #2; future typed new-link support is #5.

Also enforce the deterministic JSON/YAML parsing contract and v1 tokenizer fixtures now documented in docs/plan-format.md, including duplicate decoded keys, anchor/alias/tag/merge rejection, strict scalar handling, safe integers, and byte/depth limits. Gitlink paths are review-only in v1; reject plan authoring until #7 is implemented. update_file must target the exact existing path and reject implicit adds/path changes.

Dispatch semantic validation by the registry validator key and retain frozen conformance fixtures for schema/versions/1/semantics.md. Implement server-side request/suggestion binding to stable repository/task/plan identity; reject delayed cross-plan Apply even if revision and item IDs coincide (coordinate persistence with #2).

[mchwang]

PR #1 contract follow-up (57bbeea): implement the declared-link target snapshot audit before out-of-scope classification: reject old/new target changes including directory descendants and dangling targets. Runner integration must also enforce separate-filesystem Git metadata without writable inode aliases, exercise hardlink/alias/mountpoint attacks, and test container-visible schema/output channels. Authoring prompt tests must cover escaped lessons and revision feedback as well as repo/issue data.

[mchwang]

PR #1 858513c specifies one suggestion card per revision. Applying consumes its server ID, increments revision, and atomically invalidates sibling/old-revision cards. UI offers Refresh suggestions to regenerate from current plan under a new bound request, requiring review before another Apply. No silent rebase/replay. Add cross-plan same-revision/item-ID, concurrent CAS, consumed-ID replay, and refresh regression tests.

[mchwang]

Final PR #1 contract follow-ups (4f849bd, 215cd78): register retained registry snapshots once per ID and keep CLI transport copies out of registration; enforce pre-spawn byte/model-token budgets and startup-probed planning profiles; external supervisor bounds stdout/stderr/logs/UI output and terminates whole containers on overflow/deadline, including uncooperative children. Add boundary and near-limit vendor-envelope fixtures. Local Ajv registration check passed in PR #1; runtime probes remain to implement.

[mchwang]

PR #4 now targets merged main and implements the library portion: strict v1 parser/registry dispatch, exact argv, required selected issue and trusted typed path context, symlink lineage/target overlap, gitlink authoring rejection, request-time identity checks in pure suggestions, stable identity in approvals/choices, and typed file metadata. Baseline 60 tests; 18 conformance failures reproduced before fixes; final local suite 120 passing plus typecheck. This issue remains open for trusted context acquisition, actual post-run filesystem audits, persistent request IDs/cancellation/replay/CAS, and runner/prompt/process enforcement.

[mchwang]

PR #4 review dispositions backed by executable probes: approval fingerprints already include the complete PlanItem via the shorthand item property; changing title, intent, files, acceptance, or dependencies stales approval. Symlink target resolution already routes every component through canonical path validation: ../.git/config, ../.GIT/config, and ../.git/../target reject retained rename while edit/delete repair is permitted. Both Copilot claims were declined without implementation changes.

[mchwang]

PR #4 library alignment is complete at 611aedd and remains unmerged: 136 passing tests, typecheck, and both current-head CI runs pass; six new Copilot rounds converge with no actionable new findings and zero unresolved threads. Follow-up review also fixed bounded replay/deadlines, rename/delete/recreate metadata provenance, symlink target edge cases, and graft/shallow ancestry rejection. Keep this issue open for the documented runner/store responsibilities: trusted context acquisition, actual post-run filesystem audits, persistent IDs/cancellation/replay/CAS, and prompt/container/process enforcement.

[mchwang]

E1 audit at 3920754 confirms current-v1 parser, semantic and Store contracts have 109 passing tests. Remaining schema-loading limitation: core/plan.ts statically imports v1 and guards registry paths/validator, then uses registry-keyed semantic dispatch. It does not dynamically select schemas for a second retained version. Assign generalized loading to the schema integration owner before adding another retained version; E2-E4 stay explicitly v1. Runtime enforcement and live integration obligations remain open. See PR #30 and lane ownership #29.