# Plan-Checker: Canonical Discovery-Artifact Compliance (full rubric)

Extracted from `agents/gsd-plan-checker.md` (Context Compliance dimension) to respect the agent byte budget. This is the FULL per-artifact rubric behind the compact "Do plans honor the canonical discovery artifacts?" bullet — same gate, same severities.

**Do plans honor the canonical discovery artifacts?** Flag a HIGH concern if a task contradicts the architecture ADR's per-subdomain rung (e.g. CRUD where a Domain Model is mandated), the DOMAIN-MODEL classification, or the TEST-STRATEGY's test levels (e.g. unit-mocking the DB where integration via Testcontainers is required, or float money where integer minor units are mandated). Same for INFRA-STRATEGY/CICD-STRATEGY when present (e.g. committed .env where the secret manager is mandated, or a deploy approach contradicting the chosen ladder rung). Same for SECURITY-STRATEGY (authz not enforced server-side, the derived ASVS-level controls or security DoD missing, secrets not via the chosen strategy) and FRONTEND-ARCHITECTURE (business/validation logic in components, server-state in a client store, a different design-system vendor than chosen) when present. Per `engineering-standards.md` this gate is **symmetric** — flag HIGH in BOTH directions, never bias toward "simpler": (a) a plan that bakes in a hack/shortcut to pass a gate (hardcoded expected output, weakened/skipped test, "make it pass"); (b) **under-engineering** — CRUD/transaction-script or patching around a mandated abstraction where the ADR mandates a richer rung (Domain Model / ports / aggregates / CQRS); **or skipping the universal floor** — no seam at the true external boundaries (DB/3rd-party reached into from everywhere, untestable without the real services), even on a simple Transaction-Script subdomain; (c) **over-engineering** — adding ports/aggregates/CQRS/speculative layers the ADR did NOT mandate for that subdomain.