AppBuildPlan requirement inventory¶

Audited base: 7211107d1da35021789c23b1a6f9e927ff6a76ed.

Classification follows draft ADR 0012's construction/judgment distinction, collapsing its approved-fact A into C only when the approved input exists. C means one answer follows from approved input and an existing construction rule. J means choosing a semantic realization, ownership resolution, scope change, optional output family, provider, or dependency target would require judgment. A mechanically checked prohibition is still listed as a C guard: there is no positive omitted structure to construct, and deleting/changing the forbidden candidate would require judgment. A route collision in approved input is an input error; silently changing the approved route is not construction.

review below means factory_app/workflows/AppGenerator/tools/app_plan_review.py; cache means factory_app/workflows/AppGenerator/tools/app_build_plan.py. References are validator/helper symbols so they remain useful after line numbers change. The Added column records this change; retained guards have no missing positive output to construct.

Limits and decisions from the inventory¶

• validate_plan_coverage skips all greenfield inventory/file requirements for revision or brownfield after requiring at least one task. Extending missing-task construction to those modes without an approved delta/baseline would be a semantic expansion; do not silently do it.
• The three named validators do not require a persistence_contract task merely because entities or a data_contract exist. They also do not independently mandate a client task merely because a managed provider exists. Required managed template outputs already materialize independently through assemble_app_tasks._apply_managed_capability_templates → resolve_managed_capability_templates, using canonical resolve_declared_pack_output_paths. Those outputs are C/already constructed by assembly; they do not prove a missing task requirement.
• app_build_plan remains a mutating normalization/cache stage: it merges persistence tasks, resolves explicit/selected subscription-provider choices, adds selected facade capabilities/pages, rewrites bindings and dependencies, and sorts tasks. This change prepares selected inventory before required-task construction and also rechecks origins after caching; it does not claim the full frozen-plan producer replacement proposed by ADR 0012. Existing registered adapter-filename inference is retained, not newly justified as approved judgment.
• _ensure_context_selected_capability_packs formerly iterated a union of protected selected capability_packs and available_managed_capabilities. It now copies only protected selected entries, including framework/operator packs. Availability alone does not select an omitted provider.
• Removed _repair_missing_read_operation and _plural_entity_slug, which invented list_<plural first entity>. Approved owned_mutations now populate missing capability operations and the task worker's action list; explicit model operations survive. There is no read-prefix completeness rule. Unknown action semantics remain with the existing bounded planning/worker validation feedback; this change does not fabricate a read requirement merely because entities exist.
• Removed _facade_adapter_dependency's free-prose and sole-adapter inference. Registered selected facade/provider bindings now supply these edges. Competing provider or adapter bindings receive bounded feedback rather than a guessed edge.
• Removed subscription-task-only provider defaulting. An explicit provider or already selected provider pack resolves the identity; an otherwise unchosen provider remains bounded validation feedback. Synthesized pack category defaults now use legal schema taxonomy values (custom_domain, or the known mozaikspay category), not source labels such as managed_capability.
• Path/worker prohibitions are listed completely above, but they are guards rather than demands to construct missing optional functionality. A task asking for forbidden output does not authorize guessing an alternative feature or deleting the request.
• execution_target is declared in the typed model but not independently validated in app_build_plan; valid plans use AppGenerator. Initial-agent repair comes from _CANONICAL_INITIAL_AGENTS; it is a separate requirement from workflow execution target.
• Passing current review/cache validators is not strict AppBuildPlan model roundtrip validation: existing cache enrichment carries registry-only metadata and page projections with a different shape, while synthesized module descriptors omit model-authoring descriptive fields. The strict model validates the candidate before repairs, not the enriched cache afterward. This task closes enforced structural requirements; it does not claim to reconcile every producer/cache schema distinction proposed by ADR 0012.
• The three identical raw live model responses were recovered during implementation. tests/fixtures/appplan_monetized_missing_structure.json preserves the model payload and projects the persisted approved context with local metadata normalized. The actual approved design includes an app-owned auth surface; this change preserves that approved input and does not claim to reclassify its upstream product decision. Invented surfaces outside that approval are still rejected.

The exact base behavior is checked by running the new tests against 7211107d: the omitted-page live replay and minimal omitted-structure cases fail there, while complete-plan preservation and unapproved-surface rejection already pass. See the PR validation results for exact case counts and command output; these are offline review/queue replay tests, not a fresh live generated-app acceptance run.

Adjacent typed and runtime safeguards¶

Public review validates the strict AppBuildPlan model before repairs, so malformed task taxonomy/field types are already bounded feedback. The runtime context and nonnegative integer attempt counter are required; there are at most three review attempts. Those execution-safety rules are not app structure to construct. ContextVariablesBridge detaches protected state, so regression fixtures must use the bridge and assert cached state rather than rely on ordinary dict mutation.

Page source compilation now follows declared collection ownership: module output admission constructs missing canonical list/detail actions before dependency publication, and page tasks gain dependencies from their explicit data source pairs. This does not infer ownership from endpoint strings. See the typed page data source contract for construction boundaries and protected-action handling.