fix(development-system): require checkpoint evidence

Reject blank commands and evidence references so durable passing, committed, and delivered states remain bound to auditable receipts.

Closes: 20260901-xige

Author: jwilger

plugins/development-system/scripts/write-local-checkpoint.sh

@@ -59,6 +59,8 @@ current_untracked=$(sha256sum "$untracked_stream" | cut -d ' ' -f 1)
 if ! tail -c +15 "$record_file" | jq -e --argjson generation "$expected_generation" --arg predecessor "$expected_predecessor" --arg current_head "$current_head" --arg current_tracked "$current_tracked" --arg current_untracked "$current_untracked" '
   def exact_keys($expected): (keys | sort) == ($expected | sort);
   def string_or_null: type == "string" or . == null;
+  def nonblank: type == "string" and test("\\S");
+  def nonblank_or_null: . == null or nonblank;
   def oid: type == "string" and test("^[0-9a-f]{40}([0-9a-f]{24})?$");
   def sha256: type == "string" and test("^[0-9a-f]{64}$");
   . as $record |
@@ -69,14 +71,14 @@ if ! tail -c +15 "$record_file" | jq -e --argjson generation "$expected_generati
   (.snapshot | exact_keys(["head_oid", "tracked_sha256", "untracked_sha256"]) and (.head_oid | oid) and (.tracked_sha256 | sha256) and (.untracked_sha256 | sha256)) and
   .snapshot.head_oid == $current_head and .snapshot.tracked_sha256 == $current_tracked and .snapshot.untracked_sha256 == $current_untracked and
   (.state | IN("failing", "passing-awaiting-gates-or-review", "committed", "pushed-or-delivery-mode-equivalent")) and
-  (.test == null or (.test | exact_keys(["command", "receipt_ref", "outcome", "failure_kind"]) and (.command | type == "string") and (.receipt_ref | type == "string") and (.outcome | IN("pass", "fail")) and (.failure_kind | string_or_null))) and
+  (.test == null or (.test | exact_keys(["command", "receipt_ref", "outcome", "failure_kind"]) and (.command | nonblank) and (.receipt_ref | nonblank) and (.outcome | IN("pass", "fail")) and (.failure_kind | string_or_null))) and
   (.gates | exact_keys(["lightweight_review_receipt", "fast_gate_receipt", "exact_identity_verification_receipt"]) and
-    (.lightweight_review_receipt | string_or_null) and (.fast_gate_receipt | string_or_null) and
+    (.lightweight_review_receipt | nonblank_or_null) and (.fast_gate_receipt | nonblank_or_null) and
     (.exact_identity_verification_receipt == null or
       (.exact_identity_verification_receipt | exact_keys(["receipt_ref", "outcome"]) and
-       (.receipt_ref | type == "string") and (.outcome | IN("pass", "fail"))))) and
-  (.delivery == null or (.delivery | exact_keys(["mode", "commit_oid", "pushed_oid", "local_snapshot"]) and (.mode | IN("local-only", "direct-to-trunk", "pull-request")) and (.commit_oid | . == null or oid) and (.pushed_oid | . == null or oid) and (.local_snapshot | string_or_null))) and
-  (.ci | exact_keys(["runs", "terminal_success_run_id"]) and (.runs | type == "array") and all(.runs[]; exact_keys(["provider", "run_id", "commit_oid", "status"]) and (.provider | type == "string") and (.run_id | type == "string") and (.commit_oid | oid) and (.status | IN("queued", "running", "success", "failure"))) and (.terminal_success_run_id | string_or_null)) and
+       (.receipt_ref | nonblank) and (.outcome | IN("pass", "fail"))))) and
+  (.delivery == null or (.delivery | exact_keys(["mode", "commit_oid", "pushed_oid", "local_snapshot"]) and (.mode | IN("local-only", "direct-to-trunk", "pull-request")) and (.commit_oid | . == null or oid) and (.pushed_oid | . == null or oid) and (.local_snapshot | nonblank_or_null))) and
+  (.ci | exact_keys(["runs", "terminal_success_run_id"]) and (.runs | type == "array") and all(.runs[]; exact_keys(["provider", "run_id", "commit_oid", "status"]) and (.provider | nonblank) and (.run_id | nonblank) and (.commit_oid | oid) and (.status | IN("queued", "running", "success", "failure"))) and (.terminal_success_run_id | nonblank_or_null)) and
   (.next_action | type == "string") and
   ($generation != 0 or .state == "pushed-or-delivery-mode-equivalent") and
   (.ci.terminal_success_run_id == null or

plugins/development-system/skills/development-workflow/SKILL.md

@@ -92,6 +92,8 @@ only where the following exact shapes permit it. `snapshot` is exactly
 `{"runs":[{"provider":string,"run_id":string,"commit_oid":string,"status":"queued"|"running"|"success"|"failure"}],"terminal_success_run_id":string|null}`;
 `runs` is append-ordered by observation, and a non-null
 `terminal_success_run_id` must name the final array entry.
+Every command, receipt, provider, run ID, and local-snapshot string used as
+evidence must contain at least one non-whitespace character.
 The snapshot hashes are defined as follows:
 
 - `tracked_sha256` is SHA-256 of the exact byte stream from

scripts/tests/development-discipline-plugin.bats

@@ -190,6 +190,11 @@ setup() {
   run bash -c 'cd "$1" && "$2" work-item 1 "$3" "$4"' _ "$repo" "$writer" "$predecessor" "$invalid_committed_test"
   [ "$status" -ne 0 ]
 
+  empty_receipts_json=$(printf '%s' "$failed_verification_push_json" | jq -c '.gates.lightweight_review_receipt = "" | .gates.fast_gate_receipt = "" | .gates.exact_identity_verification_receipt = {receipt_ref:"",outcome:"pass"} | .next_action = "push"')
+  printf 'checkpoint-v1 %s\n' "$empty_receipts_json" >"$invalid_committed_test"
+  run bash -c 'cd "$1" && "$2" work-item 1 "$3" "$4"' _ "$repo" "$writer" "$predecessor" "$invalid_committed_test"
+  [ "$status" -ne 0 ]
+
   failed_verification_delivery_json=$(jq -cn --arg predecessor "$predecessor" --arg head "$head_oid" --arg empty "$empty_sha" '{generation:1,predecessor_sha256:$predecessor,baseline_oid:$head,snapshot:{head_oid:$head,tracked_sha256:$empty,untracked_sha256:$empty},state:"pushed-or-delivery-mode-equivalent",test:{command:"test",receipt_ref:"receipt",outcome:"pass",failure_kind:null},gates:{lightweight_review_receipt:"review",fast_gate_receipt:"gate",exact_identity_verification_receipt:{receipt_ref:"verification",outcome:"fail"}},delivery:{mode:"local-only",commit_oid:null,pushed_oid:null,local_snapshot:"snapshot"},ci:{runs:[],terminal_success_run_id:null},next_action:"local-complete"}')
   printf 'checkpoint-v1 %s\n' "$failed_verification_delivery_json" >"$invalid_committed_test"
   run bash -c 'cd "$1" && "$2" failed-verification 1 "$3" "$4"' _ "$repo" "$writer" "$predecessor" "$invalid_committed_test"