Стройте план, который можно отклонить до patch

export interface PlanStep {
  readonly id: string;
  readonly title: string;
  readonly reads: readonly string[];
  readonly writes: readonly string[];
  readonly commands: readonly CommandSpec[];
  readonly evidence: string;
}

export interface ChangePlan {
  readonly contract: TaskContract;
  readonly steps: readonly PlanStep[];
}

function validateStep(root: string, contract: TaskContract, step: PlanStep, policy: CommandPolicy): void {
  if (step.id.trim() === "" || step.title.trim() === "" || step.evidence.trim() === "") {
    throw new Error("Every plan step needs an id, title, and evidence target");
  }
  for (const path of [...step.reads, ...step.writes]) {
    resolveContained(root, path);
  }
  for (const path of step.writes) {
    const normalized = relative(root, resolveContained(root, path)).split("\\").join("/");
    if (!pathAllowed(normalized, contract.allowedWritePaths)) {
      throw new Error(`Plan writes outside allowed scope: ${path}`);
    }
  }
  for (const command of step.commands) {
    if (!policy.allowedCommandKeys.has(commandKey(command))) {
      throw new Error(`Plan contains a command outside the allowlist: ${command.label}`);
    }
  }
}

export function validatePlan(root: string, plan: ChangePlan, policy: CommandPolicy): ChangePlan {
  if (plan.steps.length === 0) {
    throw new Error("Plan must have at least one step");
  }
  const ids = new Set<string>();
  for (const step of plan.steps) {
    if (ids.has(step.id)) {
      throw new Error(`Duplicate plan step id: ${step.id}`);
    }
    ids.add(step.id);
    validateStep(root, plan.contract, step, policy);
  }
  return plan;