@aisdlc/core 1.4.1 → 1.5.0

package/dist/index.d.ts

@@ -40,6 +40,12 @@ interface QualityGateOptions {
     policyPath?: string;
     policy?: QualityPolicy;
     thresholds?: QualityThresholds;
+    requireCoverageReport?: boolean;
+    requireFunctionUnitTests?: boolean;
+}
+interface UntestedFunctionItem {
+    file: string;
+    functionName: string;
 }
 interface QualityGateResult {
     success: boolean;
@@ -50,8 +56,24 @@ interface QualityGateResult {
     violationsCount: number;
     results: AnalysisResult[];
     policy: QualityPolicy;
+    coverageViolations?: string[];
+    untestedFunctions?: UntestedFunctionItem[];
     reportMarkdown?: string;
 }
+interface DesignContractDeclaration {
+    component?: string;
+    interface?: string;
+    methods: string[];
+}
+interface ContractTraceAudit {
+    designId: string;
+    component?: string;
+    interfaceName?: string;
+    method: string;
+    implementedInCode: boolean;
+    testedInSuite: boolean;
+    status: 'COMPLIANT' | 'MISSING_IMPLEMENTATION' | 'MISSING_UNIT_TEST';
+}
 interface ArtifactFrontmatter {
     id?: string;
     type?: string;
@@ -65,6 +87,7 @@ interface ArtifactFrontmatter {
     'mitigates-abuse-case'?: string | string[];
     'enforced-in-enclave'?: string;
     'cucumber-tags'?: string[];
+    contracts?: Array<DesignContractDeclaration | string>;
     [key: string]: unknown;
 }
 interface TraceabilityRow {
@@ -87,6 +110,7 @@ interface TraceabilityOptions {
     examplesDir?: string;
     testsDir?: string;
     strictHandoff?: boolean;
+    enforceContracts?: boolean;
 }
 interface TraceabilityResult {
     success: boolean;
@@ -94,6 +118,8 @@ interface TraceabilityResult {
     orphans: TraceabilityRow[];
     orphanCount: number;
     totalRequirements: number;
+    contractAudits?: ContractTraceAudit[];
+    missingContractsCount?: number;
     reportMarkdown: string;
 }
 interface ProductHandoffSubgraph {
@@ -255,6 +281,9 @@ interface TaskItem {
     assignedTo?: string;
     status?: string;
     blockingReason?: string;
+    implementsComponents?: string[];
+    satisfiesRequirements?: string[];
+    implementsContracts?: string[];
     verification: TaskVerification;
 }
 interface TaskSummary {
@@ -267,6 +296,8 @@ interface TaskSummary {
 interface GovernanceOptions {
     rootDir?: string;
     specsDir?: string;
+    enforceDesignCoverage?: boolean;
+    maxUseCasesPerChange?: number;
 }
 interface GovernanceResult {
     success: boolean;
@@ -277,8 +308,23 @@ interface GovernanceResult {
     modeCounts: Record<string, number>;
     tasks: TaskSummary[];
     violations: string[];
+    unassignedDesignScope?: string[];
     reportMarkdown: string;
 }
+interface BddVariantCoverage {
+    nominal: boolean;
+    boundary: boolean;
+    invalid: boolean;
+    totalScenarios: number;
+}
+interface UseCaseFlowAuditItem {
+    id: string;
+    file: string;
+    declaredFlows: string[];
+    coveredFlows: string[];
+    missingFlows: string[];
+    status: 'VERIFICADO_CON_PRUEBA' | 'FALLO_SIN_PRUEBA';
+}
 interface RequirementAuditItem {
     id: string;
     title: string;
@@ -287,6 +333,8 @@ interface RequirementAuditItem {
     method: string;
     testRefs: string;
     existingCount: number;
+    bddVariants?: BddVariantCoverage;
+    missingVariants?: string[];
     status: 'VERIFICADO_CON_PRUEBA' | 'FALLO_SIN_PRUEBA';
 }
 interface TaskAuditItem {
@@ -299,6 +347,8 @@ interface TaskAuditItem {
 }
 interface TestingCoverageOptions {
     rootDir?: string;
+    enforceBddVariants?: boolean;
+    enforceUseCaseFlows?: boolean;
 }
 interface TestingCoverageResult {
     success: boolean;
@@ -310,6 +360,8 @@ interface TestingCoverageResult {
     failedTasks: number;
     requirements: RequirementAuditItem[];
     tasks: TaskAuditItem[];
+    useCaseFlows?: UseCaseFlowAuditItem[];
+    failedUseCaseFlows?: number;
     reportMarkdown: string;
 }
 interface ExtractedFeature {
@@ -870,6 +922,9 @@ interface GenericFrontmatter {
     'verified-by-tests'?: string[];
     'verifiable-by'?: string;
     'acceptance-format'?: string;
+    'enforce-bdd-variants'?: boolean;
+    'alternative-flows'?: unknown[];
+    'exception-flows'?: unknown[];
     tasks?: ParsedTaskItem[];
     [key: string]: unknown;
 }
@@ -879,6 +934,7 @@ declare function parseGenericDoc(content: string): {
 };
 declare function generateTestingCoverageReportMarkdown(reqAudit: RequirementAuditItem[], taskAudit: TaskAuditItem[], reqErrors: number, taskErrors: number): string;
 declare function scanAllTestArtifacts(rootDir: string): Map<string, string[]>;
+declare function analyzeBddVariantsForRequirement(reqId: string, gherkinSources: string[]): BddVariantCoverage;
 declare function verifyTestingCoverage(options?: TestingCoverageOptions): TestingCoverageResult;
 
 /**
@@ -1721,12 +1777,12 @@ declare function renderAntigravityAgentFile(agent: SpecializedAgentTemplate): st
 declare function renderClaudeAgentFile(agent: SpecializedAgentTemplate): string;
 declare function renderCopilotAgentFile(agent: SpecializedAgentTemplate): string;
 declare function renderCursorAgentFile(agent: SpecializedAgentTemplate): string;
-declare const STARTER_ANTIGRAVITY_RULES = "# Google Antigravity & Gemini CLI Rules - AI-SDLC Framework\n\nCanonical Reference: [`process/09_agent_protocols.md`](../../process/09_agent_protocols.md) and [`process/01_governance_and_roles.md`](../../process/01_governance_and_roles.md).\n\nThis file defines the operational rules and specialized role mappings for Google Antigravity and Gemini CLI-based agents within the AI-SDLC ecosystem.\n\n---\n\n## 1. The 5 Unbreakable Commandments of Agents | Los 5 Mandamientos Inquebrantables de los Agentes\n\n1. **FORBIDDEN TO AUTO-APPROVE OR AUTO-MERGE | PROHIBIDO AUTO-APROBAR O AUTO-FUSIONAR**: No agent may auto-approve PRs or perform direct merges to protected branches (`main`, `release/*`). Only a human engineer may approve or merge.\n2. **FORBIDDEN TO INVENT PRODUCT OR ARCHITECTURE DECISIONS**: When facing ambiguous requirements, formulate clarifying questions (`open-questions`). Never assume unspecified intentions.\n3. **FORBIDDEN TO INTRODUCE DEPENDENCIES WITHOUT LICENSE INSPECTION**: Always consult `license-policy.yaml`. Dependencies with viral licenses (`GPL`/`AGPL`) or commercial paid licenses (`BSL`/`SSPL`) are strictly forbidden without authorization.\n4. **FORBIDDEN TO IGNORE CYBERSECURITY (SECURITY-BY-DEFAULT)**: Validate inputs, sanitize data, and add mitigation tests (`SEC-TEST-*`). Disabling linters or suppressing typing errors is prohibited.\n5. **MANDATORY CRYPTOGRAPHIC CITATION**: Every derived artifact must cite upstream artifacts using canonical identifiers and their Unix LF-normalized SHA-256 cryptographic hashes.\n\n---\n\n## 2. Specialized Roles Mapping\n\n### 1. `agent-product-analyst` (Product Analyst / Scribe)\n- **Mission**: Capture new product intent via NAF v4 Enterprise & Capability Vision (`ARCH-INTRO-*`) and define/refine the product model using ProductShape.\n- **Phase 0 (Greenfield Product Inception)**: When creating a new product from scratch (or when `specs/product/` has no baseline), run a concise 3\u20135 question discovery interview (mission/problem, actors `ACT-*`, MVP capabilities `UC-*`, priority quality goals `QR-*`), draft `ARCH-INTRO-001` (`templates/architecture/introduction-and-goals.template.md`), and derive initial `ACT-*`, `UC-*`, `BR-*`, `FR-*`, and `QR-*` drafts.\n- **Input**: Business intent or natural language specification.\n- **Output**: Markdown artifacts with YAML frontmatter compliant with `schemas/architecture/introduction-and-goals.schema.json` (`ARCH-INTRO-*`) and `schemas/product/` (`ACT-*`, `UC-*`, `FR-*`, `QR-*`, `BR-*`).\n- **Guardrails**:\n  - `status` always starts in `draft`.\n  - In `UC-*`, format section `1. Intent and Outcome` under the standard English structure: `As a <ACT-ID>... I want <action>... To <outcome>...`.\n  - Mandatory Gherkin criteria with `@<ID> @automated @regression`.\n  - Run `pnpm run verify:schemas` and `pnpm run verify:duplicates` before delivering the draft.\n\n### 2. `agent-threat-modeler` (Threat Modeler and Security Specialist)\n- **Mission**: Analyze use cases and proactively model adversaries, STRIDE attack vectors, and OWASP ASVS mitigations, both at product level and in the technical security feedback loop over architecture.\n- **Input**: Use cases `UC-*`, functional requirements `FR-*`, or architecture components (`CMP-*`, Mermaid diagrams, ADRs).\n- **Output**: Cybersecurity triad (`ACT-THREAT-*`, `ABUSE-*`, `SEC-REQ-*`) compliant with `schemas/security/`.\n- **Guardrails**:\n  - `status` always starts in `draft`.\n  - Negative BDD attack and rejection scenarios tagged with `@security @mitigation`.\n  - Assignment of Zero Trust enclaves `SEC-ENC-*`.\n\n### 3. `agent-system-architect` (System Architect)\n- **Mission**: Translate the approved product definition into a modular technical architecture based on arc42 enriched with NAF v4.\n- **Output**: Architecture components (`CMP-*`), Mermaid diagrams, and immutable `ADR-*` records compliant with `schemas/architecture/`.\n- **Guardrails**:\n  - Every `CMP-*` must declare `satisfies-requirements` linking `FR-*`, `QR-*`, and `SEC-REQ-*`.\n  - Emit a return handoff to `agent-threat-modeler` in the technical security feedback loop when infrastructure or persistence decisions introduce new attack vectors.\n\n### 4. `agent-qa-engineer` (QA Engineer and SDET)\n- **Mission**: Translate approved requirements (`FR-*`, `SEC-REQ-*`, `QR-*`) into comprehensive FAILING (red) BDD/Gherkin test suites, before `agent-developer` writes production code.\n- **Input**: Approved requirements from the `handoff.yaml` sidecar (`HOF-*`).\n- **Output**: Failing Gherkin scenarios covering: nominal case, boundary cases, out-of-range cases, and conditional categories (security, performance, idempotency, postconditions, interface contract).\n- **Guardrails**:\n  - FORBIDDEN to include production code or anticipate implementations.\n  - Every `FR-*` must have at least nominal + boundary + out-of-range scenarios; missing these blocks handoff to `agent-developer`.\n  - Mandatory tags: `@<FR-ID> @automated @regression`.\n  - Run `pnpm run verify:testing` before emitting handoff.\n\n### 5. `agent-developer` (Software Developer)\n- **Mission**: Implement atomic tasks from SDD specifications (`tasks.md`) with clean, strictly typed code and thorough tests.\n- **Directives**:\n  - Respect the autonomy mode assigned in `tasks.md` (`AUTONOMOUS`, `HUMAN_REVIEW_PLAN`, `AMBIGUOUS`, `HIGH_RISK_MANUAL`).\n  - Make tests delivered by `agent-qa-engineer` pass green without altering them to accommodate code.\n  - Respect `quality-policy.yaml` thresholds: CC $\\le 10$, Cognitive $\\le 15$, MI $\\ge 50$, LOC $\\le 40$.\n  - Run pre-flight with auto-fix: `pnpm run check:fix` and full verification: `pnpm run verify:all`.\n  - Upon completing green implementation, suggest handoff to `agent-expert-user` for post-development functional validation prior to security audit.\n\n### 6. `agent-security-auditor` (Adversarial Code Auditor)\n- **Mission**: Rigorously examine Pull Requests for business logic vulnerabilities, injection vectors, secret leaks, and authorization flaws as part of the Pre-Merge Audit Triad.\n- **Directives**:\n  - Analyze code diffs with an attacker mindset and run `pnpm run verify:security`.\n  - Issue findings with CVSS v3.1 severity scoring and block any PR introducing CRITICAL or HIGH security risks.\n\n### 7. `agent-compliance-checker` (Open Source License Compliance Auditor)\n- **Mission**: Audit dependency manifests and ensure every direct and transitive third-party package complies with `license-policy.yaml` as part of the Pre-Merge Audit Triad.\n- **Directives**:\n  - Verify SPDX identifiers via `pnpm run verify:licenses`, immediately blocking viral (`GPL`, `AGPL`) or unapproved commercial (`BSL`, `SSPL`) licenses.\n\n### 8. `agent-expert-user` (Expert User and Domain Evaluator)\n- **Mission**: Contrast design and specifications (design phase) and functionally validate finished software against `UC-*` and `FR-*` (post-development phase).\n- **Directives**:\n  - Design mode (upstream): Adopt the primary actor's profile under stressful field conditions, applying bimodal discrimination (strict MVP core vs. roadmap suggestion backlog in `templates/product/user-design-feedback.template.md`).\n  - Functional validation mode (downstream / pre-PR / post-development functional validation): Thoroughly contrast interface and actual CLI execution against `UC-*` and `FR-*` acceptance criteria before pre-merge security audit.\n  - Emit handoff block suggesting `agent-code-reviewer` / `agent-security-auditor` if compliant, or return to `agent-developer` on functional drift.\n\n### 9. `agent-code-reviewer` (Technical and Architectural Code Reviewer)\n- **Mission**: Audit Pull Requests evaluating code cleanliness, adherence to SOLID, DRY, YAGNI principles, design patterns, and respect for complexity and maintainability thresholds (`quality-policy.yaml`), forming part of the Pre-Merge Audit Triad.\n- **Directives**:\n  - Respect `quality-policy.yaml` thresholds: CC $\\le 10$, Cognitive $\\le 15$, MI $\\ge 50$, LOC $\\le 40$.\n  - Detect improper coupling, code smells, magic numbers, ambiguous names, and encapsulation violations.\n  - Flag premature abstractions and speculative code violating YAGNI.\n  - Coordinate Pre-Merge Audit Triad with `agent-security-auditor` and `agent-compliance-checker`.\n  - Classify findings into: `[BLOCKING]` (quality violation or broken pattern), `[CLEAN_CODE_SUGGESTION]` (non-blocking improvement), and `[COMPLIANT]`.\n\n### 10. `agent-devops` (Automation and Infrastructure Engineer)\n- **Mission**: Maintain, evolve, and audit automated project infrastructure: CI/CD workflows, Docker containers, IaC manifests, and support scripts.\n- **Directives**:\n  - Strict infrastructure domain: Operates exclusively in `.github/workflows/`, `Dockerfile*`, `docker-compose*.yml`, IaC manifests, and `scripts/`.\n  - **NON-INVASION GUARDRAIL**: STRICTLY FORBIDDEN from modifying or refactoring application source code files (`src/`, `packages/*/src/`). Your responsibility is the pipeline and scaffolding, never application business logic.\n  - Infrastructure dependency policy: Verify licenses of dependencies, base images, and third-party actions according to `license-policy.yaml`.\n  - Gate preservation: Ensure pipeline optimizations preserve all existing deterministic Quality Gates intact.\n\n---\n\n## 3. Git 4-Tier Hierarchy and Commit Conventions\n- `task/<PARENT-ID>/<TSK-ID>-<slug>` $\\rightarrow$ `feat/<FEAT-ID>-<slug>` $\\rightarrow$ `release/vX.Y.Z` $\\rightarrow$ `main`.\n- Mandatory commit trailers injection:\n  ```text\n  Author-Type: agent\n  AI-Model: gemini-1.5-pro / gemini-2.0-flash\n  Task-ID: TSK-XXX\n  Change-ID: CHG-XXX\n  ```\n\n---\n\n## 4. Workflow Handoff Protocol and Human Action Window | Ventana de Acci\u00F3n Humana\n- **Conditional Activation Rule by Autonomy**:\n  - \uD83D\uDFE2 **`AUTONOMOUS`** (or exclusive final supervision in PR/CI): **OMITTED**. Do not request or emit interactive handoff to avoid interrupting unattended execution.\n  - \uD83D\uDFE1 **Autonomy $\\ge$ `HUMAN_REVIEW_PLAN`** (`HUMAN_REVIEW_PLAN`, `AMBIGUOUS`, `HIGH_RISK_MANUAL`): **MANDATORY**. Emit the Workflow Handoff block compliant with [`templates/workflow/agent-handoff.template.md`](../../templates/workflow/agent-handoff.template.md) and **STOP**.\n- **Block Contents**: Declare produced deliverables, recommend the next role in workflow (`agent-threat-modeler`, `agent-system-architect`, `agent-qa-engineer`, `agent-developer`, `agent-expert-user`, `agent-code-reviewer`, `agent-security-auditor`, `agent-compliance-checker`, `agent-devops`, etc.), provide suggested invocation prompt, and keep **the Human Action Window open at all times for the human user to take action** (review, edit by hand, pause/reroute, or delegate).\n";
-declare const STARTER_CURSOR_CORE_RULES = "---\ndescription: Global canonical directives, 5 unbreakable commandments, and AI-SDLC pre-flight\nglobs: *\nalwaysApply: true\n---\n\n# Global AI-SDLC Rules (Core)\n\nCanonical Reference: [`process/09_agent_protocols.md`](process/09_agent_protocols.md) and [`process/01_governance_and_roles.md`](process/01_governance_and_roles.md).\n\n## 1. The 5 Unbreakable Commandments of Agents | Los 5 Mandamientos Inquebrantables de los Agentes\nEvery agent operating in this repository must strictly observe the following guardrails:\n1. **FORBIDDEN TO AUTO-APPROVE OR AUTO-MERGE | PROHIBIDO AUTO-APROBAR O AUTO-FUSIONAR**: Do not approve PRs or execute direct merges to protected branches (`main`, `release/*`). Approval is exclusively reserved for human reviewers.\n2. **FORBIDDEN TO INVENT PRODUCT OR ARCHITECTURE DECISIONS**: When facing ambiguity, formulate open questions (`open-questions`). Never assume undocumented requirements.\n3. **FORBIDDEN TO INTRODUCE DEPENDENCIES WITHOUT LICENSE INSPECTION**: Always verify `license-policy.yaml`. Viral dependencies (GPL/AGPL) or commercial paid dependencies (BSL/SSPL) are strictly forbidden without explicit human approval.\n4. **FORBIDDEN TO IGNORE CYBERSECURITY (SECURITY-BY-DEFAULT)**: Validate inputs, apply least privilege, and accompany every change with security tests (`SEC-TEST-*`). Suppressing linters or tests to force a green pipeline is prohibited.\n5. **MANDATORY CRYPTOGRAPHIC CITATION**: Link specifications using immutable identifiers and Unix LF-normalized SHA-256 hashes.\n\n## 2. Pre-Flight Verification Commands\nBefore finalizing changes or proposing commits:\n- Pre-flight with auto-fix: `pnpm run check:fix` (or `npx aisdlc check --fix`)\n- Full verification: `pnpm run verify:all` (or `npx aisdlc verify all`)\n- Unit tests: `pnpm test`\n- Strict typing: `pnpm run typecheck`\n\n## 3. Git 4-Tier Hierarchy\n- Tier 1: `main` (Production)\n- Tier 2: `release/vX.Y.Z` (Frozen release)\n- Tier 3: `feat/<FEAT-ID>-<slug>` / `bug/<BUG-ID>-<slug>` (Feature)\n- Tier 4: `task/<PARENT-ID>/<TSK-ID>-<slug>` (Atomic task)\n\n## 4. Specialized Roles Mapping\n| Role | Mission (summary) |\n| :--- | :--- |\n| `agent-product-analyst` | Phase 0 NAF v4 Enterprise & Capability Vision (`ARCH-INTRO-*`, 3\u20135 question interview) + ProductShape artifacts (`ACT-*`, `UC-*`, `FR-*`, `QR-*`, `BR-*`); status starts `draft`. |\n| `agent-threat-modeler` | STRIDE/OWASP threat triad (`ACT-THREAT-*`, `ABUSE-*`, `SEC-REQ-*`). |\n| `agent-system-architect` | Modular arc42 + NAF v4 architecture (`CMP-*`, Mermaid diagrams, `ADR-*`). |\n| `agent-qa-engineer` | FAILING BDD/Gherkin suites before `agent-developer` writes code. |\n| `agent-developer` | Atomic tasks from `tasks.md`; respects autonomy mode; runs `pnpm run check:fix` + `pnpm run verify:all`. |\n| `agent-security-auditor` | Adversarial PR security audit, SAST, secrets, and CVSS v3.1 evaluation. |\n| `agent-compliance-checker` | SPDX license compliance audit against `license-policy.yaml`. |\n| `agent-expert-user` | Bimodal MVP evaluation (design) and functional validation against `UC-*` and `FR-*` (pre-PR). |\n| `agent-code-reviewer` | PR audit (SOLID, DRY, YAGNI): `[BLOCKING]` / `[CLEAN_CODE_SUGGESTION]` / `[COMPLIANT]`. |\n| `agent-devops` | CI/CD, Docker, IaC only \u2014 **FORBIDDEN** to touch `src/` or `packages/*/src/`. |\n\n## 5. Task Autonomy Modes (`tasks.md`)\n- \uD83D\uDFE2 **`AUTONOMOUS`**: Low risk. Implement directly, omit handoff block.\n- \uD83D\uDFE1 **`HUMAN_REVIEW_PLAN`**: Medium risk. Emit Workflow Handoff block, wait for approval.\n- \uD83D\uDFE0 **`AMBIGUOUS`**: Blocked. Request human clarification.\n- \uD83D\uDD34 **`HIGH_RISK_MANUAL`**: Critical risk. Human-only execution.\n\n## 6. Workflow Handoff Protocol and Human Action Window | Ventana de Acci\u00F3n Humana\n- **Conditional Activation**:\n  * \uD83D\uDFE2 **`AUTONOMOUS`** (or PR/CI supervision): **OMITTED**. Do not request or emit interactive handoff.\n  * \uD83D\uDFE1 **Autonomy $\\ge$ `HUMAN_REVIEW_PLAN`** (`HUMAN_REVIEW_PLAN`, `AMBIGUOUS`, `HIGH_RISK_MANUAL`): **MANDATORY**. Emit Workflow Handoff block compliant with [`templates/workflow/agent-handoff.template.md`](templates/workflow/agent-handoff.template.md) and **STOP**.\n- **Content**: Declare completed deliverables, recommend next role(s), provide suggested invocation prompt, and **keep the Human Action Window open for the human user to take action** (review, edit by hand, pause/reroute, or delegate).\n";
+declare const STARTER_ANTIGRAVITY_RULES = "# Google Antigravity & Gemini CLI Rules - AI-SDLC Framework\n\nCanonical Reference: [`process/09_agent_protocols.md`](../../process/09_agent_protocols.md) and [`process/01_governance_and_roles.md`](../../process/01_governance_and_roles.md).\n\nThis file defines the operational rules and specialized role mappings for Google Antigravity and Gemini CLI-based agents within the AI-SDLC ecosystem.\n\n---\n\n## 1. The 5 Unbreakable Commandments of Agents | Los 5 Mandamientos Inquebrantables de los Agentes\n\n1. **FORBIDDEN TO AUTO-APPROVE OR AUTO-MERGE | PROHIBIDO AUTO-APROBAR O AUTO-FUSIONAR**: No agent may auto-approve PRs or perform direct merges to protected branches (`main`, `release/*`). Only a human engineer may approve or merge.\n2. **FORBIDDEN TO INVENT PRODUCT OR ARCHITECTURE DECISIONS**: When facing ambiguous requirements, formulate clarifying questions (`open-questions`). Never assume unspecified intentions.\n3. **FORBIDDEN TO INTRODUCE DEPENDENCIES WITHOUT LICENSE INSPECTION**: Always consult `license-policy.yaml`. Dependencies with viral licenses (`GPL`/`AGPL`) or commercial paid licenses (`BSL`/`SSPL`) are strictly forbidden without authorization.\n4. **FORBIDDEN TO IGNORE CYBERSECURITY (SECURITY-BY-DEFAULT)**: Validate inputs, sanitize data, and add mitigation tests (`SEC-TEST-*`). Disabling linters or suppressing typing errors is prohibited.\n5. **MANDATORY CRYPTOGRAPHIC CITATION**: Every derived artifact must cite upstream artifacts using canonical identifiers and their Unix LF-normalized SHA-256 cryptographic hashes.\n\n---\n\n## 2. Specialized Roles Mapping\n\n### 1. `agent-product-analyst` (Product Analyst / Scribe)\n- **Mission**: Capture new product intent via NAF v4 Enterprise & Capability Vision (`ARCH-INTRO-*`) and define/refine the product model using ProductShape.\n- **Phase 0 (Greenfield Product Inception)**: When creating a new product from scratch (or when `specs/product/` has no baseline), run a concise 3\u20135 question discovery interview (mission/problem, actors `ACT-*`, MVP capabilities `UC-*`, priority quality goals `QR-*`), draft `ARCH-INTRO-001` (`templates/architecture/introduction-and-goals.template.md`), and derive initial `ACT-*`, `UC-*`, `BR-*`, `FR-*`, and `QR-*` drafts.\n- **Input**: Business intent or natural language specification.\n- **Output**: Markdown artifacts with YAML frontmatter compliant with `schemas/architecture/introduction-and-goals.schema.json` (`ARCH-INTRO-*`) and `schemas/product/` (`ACT-*`, `UC-*`, `FR-*`, `QR-*`, `BR-*`).\n- **Guardrails**:\n  - `status` always starts in `draft`.\n  - In `UC-*`, format section `1. Intent and Outcome` under the standard English structure: `As a <ACT-ID>... I want <action>... To <outcome>...`.\n  - Mandatory Gherkin criteria with `@<ID> @automated @regression`.\n  - Run `pnpm run verify:schemas` and `pnpm run verify:duplicates` before delivering the draft.\n\n### 2. `agent-threat-modeler` (Threat Modeler and Security Specialist)\n- **Mission**: Analyze use cases and proactively model adversaries, STRIDE attack vectors, and OWASP ASVS mitigations, both at product level and in the technical security feedback loop over architecture.\n- **Input**: Use cases `UC-*`, functional requirements `FR-*`, or architecture components (`CMP-*`, Mermaid diagrams, ADRs).\n- **Output**: Cybersecurity triad (`ACT-THREAT-*`, `ABUSE-*`, `SEC-REQ-*`) compliant with `schemas/security/`.\n- **Guardrails**:\n  - `status` always starts in `draft`.\n  - Negative BDD attack and rejection scenarios tagged with `@security @mitigation`.\n  - Assignment of Zero Trust enclaves `SEC-ENC-*`.\n\n### 3. `agent-system-architect` (System Architect)\n- **Mission**: Translate the approved product definition into a modular technical architecture based on arc42 enriched with NAF v4.\n- **Output**: Architecture components (`CMP-*`), Mermaid diagrams, and immutable `ADR-*` records compliant with `schemas/architecture/`.\n- **Guardrails**:\n  - Every `CMP-*` must declare `satisfies-requirements` linking `FR-*`, `QR-*`, and `SEC-REQ-*`.\n  - Emit a return handoff to `agent-threat-modeler` in the technical security feedback loop when infrastructure or persistence decisions introduce new attack vectors.\n\n### 4. `agent-qa-engineer` (QA Engineer and SDET)\n- **Mission**: Translate approved requirements (`FR-*`, `SEC-REQ-*`, `QR-*`) into comprehensive FAILING (red) BDD/Gherkin, End-to-End (E2E), UI, and unit test suites, before `agent-developer` writes production code.\n- **Input**: Approved requirements from the `handoff.yaml` sidecar (`HOF-*`).\n- **Output**: Failing Gherkin, E2E, and UI test suites covering: nominal case, boundary cases, out-of-range cases, per-interactive-element tests (Happy Path, Sad Path, Boundary Values), and conditional categories (security, performance, idempotency, postconditions, interface contract).\n- **Guardrails**:\n  - FORBIDDEN to include production code or anticipate implementations.\n  - **Agreed Project Technology**: Always use the testing frameworks, E2E/UI runners, and technology stack agreed upon for the project (if any), without requiring the user to specify it in the prompt.\n  - **Mandatory E2E & UI Testing**: Never forget or omit End-to-End (E2E) and User Interface (UI) tests.\n  - **Per-Interactive-Element Coverage**: Create specific tests for every UI element the user can interact with, covering Happy Path, Sad Path, and Boundary Values for each one.\n  - Every `FR-*` must have at least nominal + boundary + out-of-range scenarios; missing these blocks handoff to `agent-developer`.\n  - Mandatory tags: `@<FR-ID> @automated @regression`.\n  - Run `pnpm run verify:testing` before emitting handoff.\n\n### 5. `agent-developer` (Software Developer)\n- **Mission**: Implement atomic tasks from SDD specifications (`tasks.md`) with clean, strictly typed code and thorough tests.\n- **Directives**:\n  - **Mandatory 4-Step Implementation Order**: (1) Define/refine Clean Architecture layers & boundaries, (2) Define interfaces/ports for all inter-module interactions to avoid direct module coupling, (3) Implement components consuming/fulfilling those interfaces, (4) Write unit tests for every function covering Happy Path, Sad Path, Boundary Values, and Unexpected/Null/Empty values.\n  - Respect the autonomy mode assigned in `tasks.md` (`AUTONOMOUS`, `HUMAN_REVIEW_PLAN`, `AMBIGUOUS`, `HIGH_RISK_MANUAL`).\n  - Make tests delivered by `agent-qa-engineer` pass green without altering them to accommodate code.\n  - Respect `quality-policy.yaml` thresholds: CC $\\le 10$, Cognitive $\\le 15$, MI $\\ge 50$, LOC $\\le 40$.\n  - Run pre-flight with auto-fix: `pnpm run check:fix` and full verification: `pnpm run verify:all`.\n  - Upon completing green implementation, suggest handoff to `agent-expert-user` for post-development functional validation prior to security audit.\n\n### 6. `agent-security-auditor` (Adversarial Code Auditor)\n- **Mission**: Rigorously examine Pull Requests for business logic vulnerabilities, injection vectors, secret leaks, and authorization flaws as part of the Pre-Merge Audit Triad.\n- **Directives**:\n  - Analyze code diffs with an attacker mindset and run `pnpm run verify:security`.\n  - Issue findings with CVSS v3.1 severity scoring and block any PR introducing CRITICAL or HIGH security risks.\n\n### 7. `agent-compliance-checker` (Open Source License Compliance Auditor)\n- **Mission**: Audit dependency manifests and ensure every direct and transitive third-party package complies with `license-policy.yaml` as part of the Pre-Merge Audit Triad.\n- **Directives**:\n  - Verify SPDX identifiers via `pnpm run verify:licenses`, immediately blocking viral (`GPL`, `AGPL`) or unapproved commercial (`BSL`, `SSPL`) licenses.\n\n### 8. `agent-expert-user` (Expert User and Domain Evaluator)\n- **Mission**: Contrast design and specifications (design phase) and functionally validate finished software against `UC-*` and `FR-*` (post-development phase).\n- **Directives**:\n  - Design mode (upstream): Adopt the primary actor's profile under stressful field conditions, applying bimodal discrimination (strict MVP core vs. roadmap suggestion backlog in `templates/product/user-design-feedback.template.md`).\n  - Functional validation mode (downstream / pre-PR / post-development functional validation): Thoroughly contrast interface and actual CLI execution against `UC-*` and `FR-*` acceptance criteria before pre-merge security audit.\n  - Emit handoff block suggesting `agent-code-reviewer` / `agent-security-auditor` if compliant, or return to `agent-developer` on functional drift.\n\n### 9. `agent-code-reviewer` (Technical and Architectural Code Reviewer)\n- **Mission**: Audit Pull Requests evaluating code cleanliness, adherence to SOLID, DRY, YAGNI principles, design patterns, and respect for complexity and maintainability thresholds (`quality-policy.yaml`), forming part of the Pre-Merge Audit Triad.\n- **Directives**:\n  - Respect `quality-policy.yaml` thresholds: CC $\\le 10$, Cognitive $\\le 15$, MI $\\ge 50$, LOC $\\le 40$.\n  - Detect improper coupling, code smells, magic numbers, ambiguous names, and encapsulation violations.\n  - Flag premature abstractions and speculative code violating YAGNI.\n  - Coordinate Pre-Merge Audit Triad with `agent-security-auditor` and `agent-compliance-checker`.\n  - Classify findings into: `[BLOCKING]` (quality violation or broken pattern), `[CLEAN_CODE_SUGGESTION]` (non-blocking improvement), and `[COMPLIANT]`.\n\n### 10. `agent-devops` (Automation and Infrastructure Engineer)\n- **Mission**: Maintain, evolve, and audit automated project infrastructure: CI/CD workflows, Docker containers, IaC manifests, and support scripts.\n- **Directives**:\n  - Strict infrastructure domain: Operates exclusively in `.github/workflows/`, `Dockerfile*`, `docker-compose*.yml`, IaC manifests, and `scripts/`.\n  - **NON-INVASION GUARDRAIL**: STRICTLY FORBIDDEN from modifying or refactoring application source code files (`src/`, `packages/*/src/`). Your responsibility is the pipeline and scaffolding, never application business logic.\n  - Infrastructure dependency policy: Verify licenses of dependencies, base images, and third-party actions according to `license-policy.yaml`.\n  - Gate preservation: Ensure pipeline optimizations preserve all existing deterministic Quality Gates intact.\n\n---\n\n## 3. Git 4-Tier Hierarchy and Commit Conventions\n- `task/<PARENT-ID>/<TSK-ID>-<slug>` $\\rightarrow$ `feat/<FEAT-ID>-<slug>` $\\rightarrow$ `release/vX.Y.Z` $\\rightarrow$ `main`.\n- Mandatory commit trailers injection:\n  ```text\n  Author-Type: agent\n  AI-Model: gemini-1.5-pro / gemini-2.0-flash\n  Task-ID: TSK-XXX\n  Change-ID: CHG-XXX\n  ```\n\n---\n\n## 4. Workflow Handoff Protocol and Human Action Window | Ventana de Acci\u00F3n Humana\n- **Conditional Activation Rule by Autonomy**:\n  - \uD83D\uDFE2 **`AUTONOMOUS`** (or exclusive final supervision in PR/CI): **OMITTED**. Do not request or emit interactive handoff to avoid interrupting unattended execution.\n  - \uD83D\uDFE1 **Autonomy $\\ge$ `HUMAN_REVIEW_PLAN`** (`HUMAN_REVIEW_PLAN`, `AMBIGUOUS`, `HIGH_RISK_MANUAL`): **MANDATORY**. Emit the Workflow Handoff block compliant with [`templates/workflow/agent-handoff.template.md`](../../templates/workflow/agent-handoff.template.md) and **STOP**.\n- **Block Contents**: Declare produced deliverables, recommend the next role in workflow (`agent-threat-modeler`, `agent-system-architect`, `agent-qa-engineer`, `agent-developer`, `agent-expert-user`, `agent-code-reviewer`, `agent-security-auditor`, `agent-compliance-checker`, `agent-devops`, etc.), provide suggested invocation prompt, and keep **the Human Action Window open at all times for the human user to take action** (review, edit by hand, pause/reroute, or delegate).\n";
+declare const STARTER_CURSOR_CORE_RULES = "---\ndescription: Global canonical directives, 5 unbreakable commandments, and AI-SDLC pre-flight\nglobs: *\nalwaysApply: true\n---\n\n# Global AI-SDLC Rules (Core)\n\nCanonical Reference: [`process/09_agent_protocols.md`](process/09_agent_protocols.md) and [`process/01_governance_and_roles.md`](process/01_governance_and_roles.md).\n\n## 1. The 5 Unbreakable Commandments of Agents | Los 5 Mandamientos Inquebrantables de los Agentes\nEvery agent operating in this repository must strictly observe the following guardrails:\n1. **FORBIDDEN TO AUTO-APPROVE OR AUTO-MERGE | PROHIBIDO AUTO-APROBAR O AUTO-FUSIONAR**: Do not approve PRs or execute direct merges to protected branches (`main`, `release/*`). Approval is exclusively reserved for human reviewers.\n2. **FORBIDDEN TO INVENT PRODUCT OR ARCHITECTURE DECISIONS**: When facing ambiguity, formulate open questions (`open-questions`). Never assume undocumented requirements.\n3. **FORBIDDEN TO INTRODUCE DEPENDENCIES WITHOUT LICENSE INSPECTION**: Always verify `license-policy.yaml`. Viral dependencies (GPL/AGPL) or commercial paid dependencies (BSL/SSPL) are strictly forbidden without explicit human approval.\n4. **FORBIDDEN TO IGNORE CYBERSECURITY (SECURITY-BY-DEFAULT)**: Validate inputs, apply least privilege, and accompany every change with security tests (`SEC-TEST-*`). Suppressing linters or tests to force a green pipeline is prohibited.\n5. **MANDATORY CRYPTOGRAPHIC CITATION**: Link specifications using immutable identifiers and Unix LF-normalized SHA-256 hashes.\n\n## 2. Pre-Flight Verification Commands\nBefore finalizing changes or proposing commits:\n- Pre-flight with auto-fix: `pnpm run check:fix` (or `npx aisdlc check --fix`)\n- Full verification: `pnpm run verify:all` (or `npx aisdlc verify all`)\n- Unit tests: `pnpm test`\n- Strict typing: `pnpm run typecheck`\n\n## 3. Git 4-Tier Hierarchy\n- Tier 1: `main` (Production)\n- Tier 2: `release/vX.Y.Z` (Frozen release)\n- Tier 3: `feat/<FEAT-ID>-<slug>` / `bug/<BUG-ID>-<slug>` (Feature)\n- Tier 4: `task/<PARENT-ID>/<TSK-ID>-<slug>` (Atomic task)\n\n## 4. Specialized Roles Mapping\n| Role | Mission (summary) |\n| :--- | :--- |\n| `agent-product-analyst` | Phase 0 NAF v4 Enterprise & Capability Vision (`ARCH-INTRO-*`, 3\u20135 question interview) + ProductShape artifacts (`ACT-*`, `UC-*`, `FR-*`, `QR-*`, `BR-*`); status starts `draft`. |\n| `agent-threat-modeler` | STRIDE/OWASP threat triad (`ACT-THREAT-*`, `ABUSE-*`, `SEC-REQ-*`). |\n| `agent-system-architect` | Modular arc42 + NAF v4 architecture (`CMP-*`, Mermaid diagrams, `ADR-*`). |\n| `agent-qa-engineer` | FAILING BDD/Gherkin, E2E, and UI suites (using agreed project tech; Happy Path, Sad Path & Boundary Values per interactive UI element) before `agent-developer` writes code. |\n| `agent-developer` | Atomic tasks from `tasks.md`; respects autonomy mode; runs `pnpm run check:fix` + `pnpm run verify:all`. |\n| `agent-security-auditor` | Adversarial PR security audit, SAST, secrets, and CVSS v3.1 evaluation. |\n| `agent-compliance-checker` | SPDX license compliance audit against `license-policy.yaml`. |\n| `agent-expert-user` | Bimodal MVP evaluation (design) and functional validation against `UC-*` and `FR-*` (pre-PR). |\n| `agent-code-reviewer` | PR audit (SOLID, DRY, YAGNI): `[BLOCKING]` / `[CLEAN_CODE_SUGGESTION]` / `[COMPLIANT]`. |\n| `agent-devops` | CI/CD, Docker, IaC only \u2014 **FORBIDDEN** to touch `src/` or `packages/*/src/`. |\n\n## 5. Task Autonomy Modes (`tasks.md`)\n- \uD83D\uDFE2 **`AUTONOMOUS`**: Low risk. Implement directly, omit handoff block.\n- \uD83D\uDFE1 **`HUMAN_REVIEW_PLAN`**: Medium risk. Emit Workflow Handoff block, wait for approval.\n- \uD83D\uDFE0 **`AMBIGUOUS`**: Blocked. Request human clarification.\n- \uD83D\uDD34 **`HIGH_RISK_MANUAL`**: Critical risk. Human-only execution.\n\n## 6. Workflow Handoff Protocol and Human Action Window | Ventana de Acci\u00F3n Humana\n- **Conditional Activation**:\n  * \uD83D\uDFE2 **`AUTONOMOUS`** (or PR/CI supervision): **OMITTED**. Do not request or emit interactive handoff.\n  * \uD83D\uDFE1 **Autonomy $\\ge$ `HUMAN_REVIEW_PLAN`** (`HUMAN_REVIEW_PLAN`, `AMBIGUOUS`, `HIGH_RISK_MANUAL`): **MANDATORY**. Emit Workflow Handoff block compliant with [`templates/workflow/agent-handoff.template.md`](templates/workflow/agent-handoff.template.md) and **STOP**.\n- **Content**: Declare completed deliverables, recommend next role(s), provide suggested invocation prompt, and **keep the Human Action Window open for the human user to take action** (review, edit by hand, pause/reroute, or delegate).\n";
 declare const STARTER_CURSOR_PRODUCT_RULES = "---\ndescription: Directives for SDD specifications editing, ProductShape artifacts, and Cybersecurity\nglobs: specs/**, templates/**, product/**, security/**\nalwaysApply: false\n---\n\n# Product and SDD Specification Directives\n\nCanonical Reference: [`process/09_agent_protocols.md`](process/09_agent_protocols.md) and [`process/02_product_definition.md`](process/02_product_definition.md).\n\n## 1. Identifier Taxonomy and JSON Schemas\nEvery generated or modified artifact must follow canonical naming and satisfy its schema in `schemas/`:\n- Enterprise & Capability Vision (Phase 0): `ARCH-INTRO-[NUM3]` (`schemas/architecture/introduction-and-goals.schema.json`)\n- Product Actors: `ACT-[SUFFIX]` (`schemas/product/actor.schema.json`)\n- Use Cases: `UC-[SUFFIX]` (`schemas/product/use-case.schema.json`)\n- Functional Requirements: `FR-[SUFFIX]-[NUM3]` (`schemas/product/requirement.schema.json`)\n- Quality Requirements: `QR-[SUFFIX]` (`schemas/product/requirement.schema.json`)\n- Business Rules: `BR-[SUFFIX]` (`schemas/product/business-rule.schema.json`)\n- Threat Actors: `ACT-THREAT-[SUFFIX]` (`schemas/security/threat-actor.schema.json`)\n- Abuse Cases: `ABUSE-[SUFFIX]` (`schemas/security/abuse-case.schema.json`)\n- Security Requirements: `SEC-REQ-[SUFFIX]` (`schemas/security/security-req.schema.json`)\n\n## 2. \"AI as Scribe\" Protocol Rules\n- **Phase 0 (New Product Inception)**: When starting a new product, conduct a 3\u20135 question discovery interview, instantiate `ARCH-INTRO-001` (`naf-perspective: \"Enterprise & Capability\"`) in `draft`, and derive `ACT-*`, `UC-*`, `BR-*`, `FR-*`, and `QR-*`.\n- **Initial Status**: Every new artifact strictly starts with `status: draft`. Creating artifacts directly as `active` or `approved` is forbidden.\n- **Gherkin Acceptance Criteria**: In every `FR-*` requirement, include a ```gherkin block with tags `@<ID> @automated @regression` and at least one `Scenario Outline` with an `Examples` data table.\n- **Security Mitigations**: Every `SEC-REQ-*` must include negative Gherkin tests (`@security @mitigation`).\n- **Use Cases (User Story Structure)**: In every `UC-*`, the `1. Intent and Outcome` section must be written using the standard English structure: `As a <ACT-ID>... I want <action>... To <outcome>...`.\n- **Deterministic Validation**: Run `pnpm run verify:schemas` and `pnpm run verify:duplicates` before presenting the draft to the human reviewer.\n";
-declare const STARTER_CURSOR_QUALITY_RULES = "---\ndescription: Directives for code quality, architecture, TDD, and complexity limits\nglobs: packages/**, src/**, scripts/**, tests/**\nalwaysApply: false\n---\n\n# Code Quality and Architecture Directives\n\nCanonical Reference: [`process/09_agent_protocols.md`](process/09_agent_protocols.md) and [`process/10_quality_management_and_release_gates.md`](process/10_quality_management_and_release_gates.md).\n\n## 1. Non-Negotiable Quality Thresholds (`quality-policy.yaml`)\n- **Cyclomatic Complexity (CC)**: $\\le 10$ per function (warning alert if $> 7$).\n- **Cognitive Complexity**: $\\le 15$ per function (warning if $> 10$).\n- **Maintainability Index (MI)**: $\\ge 50$ (target minimum $\\ge 65$).\n- **Function Length**: $\\le 40$ lines (warning if $> 30$).\n- If a function exceeds these limits, decompose logic into cohesive helper functions before completing the task.\n\n## 2. TDD Methodology and Unit Testing\n- Apply Test-Driven Development: generate unit tests before or alongside component logic.\n- Tag tests linked to requirements with header comments citing the ID (`FR-*` or `SEC-REQ-*`) to enable reverse traceability.\n- Suppressing types (`any`), linter rules (`eslint-disable`), or unit tests to force pipeline passage is prohibited.\n\n## 3. Open Source License Policy (`license-policy.yaml`)\n- Before adding any dependency to `package.json`, verify its SPDX identifier.\n- Only permissive dependencies are allowed (`MIT`, `Apache-2.0`, `BSD-2/3-Clause`, `ISC`).\n- Viral licenses (`GPL`, `AGPL`) or commercial licenses without approval (`BSL`, `SSPL`) are prohibited.\n\n## 4. Structured Output `--json`\n- Any extension to CLI commands must preserve compatibility with the `--json` flag and suppress ANSI escape codes when this flag is present.\n";
-declare const STARTER_CLAUDE_RULES = "# Claude Code Instructions - AI-SDLC Monorepo\n\nCanonical Reference: [`process/09_agent_protocols.md`](process/09_agent_protocols.md) and [`process/01_governance_and_roles.md`](process/01_governance_and_roles.md).\n\nThis repository implements the **AI-SDLC** framework (Spec-Driven Development, deterministic quality governance, and OSS license compliance for human-agent collaboration).\n\n---\n\n## 1. The 5 Unbreakable Commandments of Agents | Los 5 Mandamientos Inquebrantables de los Agentes\n\n1. **FORBIDDEN TO AUTO-APPROVE OR AUTO-MERGE | PROHIBIDO AUTO-APROBAR O AUTO-FUSIONAR**: Never approve PRs or merge directly to `main` or protected branches. Approval is exclusively a human prerogative.\n2. **FORBIDDEN TO INVENT PRODUCT OR ARCHITECTURE DECISIONS**: When facing ambiguous requirements, formulate open questions (`open-questions`). Never assume undocumented behaviors.\n3. **FORBIDDEN TO INTRODUCE DEPENDENCIES WITHOUT LICENSE INSPECTION**: Always validate the SPDX identifier against `license-policy.yaml`. Viral libraries (`GPL`/`AGPL`) or paid commercial libraries (`BSL`/`SSPL`) are strictly forbidden without formal human approval.\n4. **FORBIDDEN TO IGNORE CYBERSECURITY (SECURITY-BY-DEFAULT)**: Validate inputs, sanitize data, and include mitigation tests (`SEC-TEST-*`). Disabling linters or suppressing typing errors (`any`, `@ts-ignore`) is prohibited.\n5. **MANDATORY CRYPTOGRAPHIC CITATION**: Every spec or sidecar must cite immutable identifiers and Unix LF-normalized SHA-256 digests.\n\n---\n\n## 2. Essential Execution and Pre-Flight Commands\n\n```bash\n# 1. Pre-flight with deterministic auto-fix (Gherkin & SHA-256 digests)\npnpm run check:fix\n\n# 2. Complete verification across all Quality Gates (Quality, RTM, Governance, Testing, Licenses, PDaC, Schemas, Duplicates, Security)\npnpm run verify:all\n\n# 3. Complete automated test suite (Vitest)\npnpm test\n\n# 4. Strict TypeScript typechecking\npnpm run typecheck\n\n# 5. Scaffolding for a new SDD change\npnpm run change:new <name> --id <chg-id>\n\n# 6. Canonical integration of a completed SDD change\nnpx tsx packages/cli/src/index.ts sdd integrate --change <chg-id>\n```\n\n---\n\n## 3. Specialized Roles Mapping\n\n### 1. `agent-product-analyst` (Product Analyst / Scribe)\n- **Mission**: Capture new product intent via NAF v4 Enterprise & Capability Vision (`ARCH-INTRO-*`) and define/refine the product model using ProductShape.\n- **Phase 0 (Greenfield Product Inception)**: When creating a new product from scratch (or when `specs/product/` has no baseline), run a concise 3\u20135 question discovery interview (mission/problem, actors `ACT-*`, MVP capabilities `UC-*`, priority quality goals `QR-*`), draft `ARCH-INTRO-001` (`templates/architecture/introduction-and-goals.template.md`), and derive initial `ACT-*`, `UC-*`, `BR-*`, `FR-*`, and `QR-*` drafts.\n- **Input**: Business intent or natural language specification.\n- **Output**: Markdown artifacts with YAML frontmatter compliant with `schemas/architecture/introduction-and-goals.schema.json` (`ARCH-INTRO-*`) and `schemas/product/` (`ACT-*`, `UC-*`, `FR-*`, `QR-*`, `BR-*`).\n- **Guardrails**: `status` always starts in `draft`. Mandatory Gherkin criteria with `@<ID> @automated @regression`.\n\n### 2. `agent-threat-modeler` (Threat Modeler and Security Specialist)\n- **Mission**: Analyze use cases and proactively model adversaries, STRIDE attack vectors, and OWASP ASVS mitigations, both at product level and in the technical security feedback loop over architecture.\n- **Output**: Cybersecurity triad (`ACT-THREAT-*`, `ABUSE-*`, `SEC-REQ-*`) compliant with `schemas/security/`.\n\n### 3. `agent-system-architect` (System Architect)\n- **Mission**: Translate the approved product definition into a modular technical architecture based on arc42 enriched with NAF v4 (`CMP-*`, Mermaid diagrams, `ADR-*`).\n- **Guardrails**: Declare `satisfies-requirements` on every `CMP-*` and trigger the technical security feedback loop toward `agent-threat-modeler` when infrastructure decisions introduce new attack vectors.\n\n### 4. `agent-qa-engineer` (QA Engineer and SDET)\n- **Mission**: Translate approved requirements (`FR-*`, `SEC-REQ-*`, `QR-*`) into comprehensive FAILING (red) BDD/Gherkin test suites, before `agent-developer` writes production code.\n- **Guardrails**: FORBIDDEN to include production code. Mandatory tags: `@<FR-ID> @automated @regression`.\n\n### 5. `agent-developer` (Software Developer)\n- **Mission**: Implement atomic tasks from SDD specifications (`tasks.md`) with clean, strictly typed code and thorough tests.\n- **Directives**: Respect the autonomy mode. Make tests delivered by `agent-qa-engineer` pass green. Run `pnpm run check:fix` and `pnpm run verify:all`.\n\n### 6. `agent-security-auditor` (Adversarial Code Auditor)\n- **Mission**: Examine Pull Requests for business logic vulnerabilities, injection vectors, secret leaks, and authorization flaws as part of the Pre-Merge Audit Triad.\n- **Directives**: Run `pnpm run verify:security`, evaluate CVSS v3.1 severity, and block CRITICAL/HIGH risks.\n\n### 7. `agent-compliance-checker` (Open Source License Compliance Auditor)\n- **Mission**: Audit dependency manifests against `license-policy.yaml` as part of the Pre-Merge Audit Triad.\n- **Directives**: Run `pnpm run verify:licenses`, blocking viral (`GPL`, `AGPL`) or unapproved commercial (`BSL`, `SSPL`) packages.\n\n### 8. `agent-expert-user` (Expert User and Domain Evaluator)\n- **Mission**: Contrast design and specifications (design phase) and functionally validate finished software against `UC-*` and `FR-*` (post-development functional validation phase).\n\n### 9. `agent-code-reviewer` (Technical and Architectural Code Reviewer)\n- **Mission**: Audit Pull Requests evaluating code cleanliness, adherence to SOLID, DRY, YAGNI principles, and respect for `quality-policy.yaml` thresholds, forming part of the Pre-Merge Audit Triad.\n- **Findings classification**: `[BLOCKING]`, `[CLEAN_CODE_SUGGESTION]`, `[COMPLIANT]`.\n\n### 10. `agent-devops` (Automation and Infrastructure Engineer)\n- **Mission**: Maintain, evolve, and audit automated project infrastructure: CI/CD workflows, Docker containers, IaC manifests, and support scripts.\n- **NON-INVASION GUARDRAIL**: STRICTLY FORBIDDEN from modifying application source code (`src/`, `packages/*/src/`).\n\n---\n\n## 4. Task Autonomy Modes (`tasks.md`)\n\n- \uD83D\uDFE2 **`AUTONOMOUS`**: Low risk, isolated task. Implement code and tests directly. Omit interactive handoff block.\n- \uD83D\uDFE1 **`HUMAN_REVIEW_PLAN`**: Medium risk. Design detailed plan, emit Workflow Handoff block, and wait for human confirmation before coding.\n- \uD83D\uDFE0 **`AMBIGUOUS`**: Incomplete requirements. Blocked: request human clarification.\n- \uD83D\uDD34 **`HIGH_RISK_MANUAL`**: Critical risk (migrations, cryptography). Direct manual execution by humans only.\n\n---\n\n## 5. Git Workflow and Commit Rules with Trailers\n\n### 4-Tier Hierarchy\n1. **Tier 1 (`main`)**: Absolute stability and production readiness.\n2. **Tier 2 (`release/vX.Y.Z`)**: Release stabilization.\n3. **Tier 3 (`feat/<FEAT-ID>-<slug>` or `bug/<BUG-ID>-<slug>`)**: SDD delivery increment.\n4. **Tier 4 (`task/<PARENT-ID>/<TSK-ID>-<slug>`)**: Atomic implementation task.\n\n### Commit Format (Conventional Commits + Git Trailers)\n```text\nfeat(scope): concise imperative description (#issue)\n\nBody explaining the motivation and technical justification of the change.\n\nAuthor-Type: agent\nAI-Model: claude-3-7-sonnet\nTask-ID: TSK-001\nChange-ID: CHG-026-AGENT-NATIVE-CONFIGS\n```\n\n---\n\n## 6. Non-Negotiable Quality Thresholds (`quality-policy.yaml`)\n- **Cyclomatic Complexity (CC)**: $\\le 10$\n- **Cognitive Complexity**: $\\le 15$\n- **Maintainability Index (MI)**: $\\ge 50$\n- **Lines per Function**: $\\le 40$\n- Deterministic CLI output: every `verify` command supports `--json` without ANSI escape codes.\n\n---\n\n## 7. Workflow Handoff Protocol and Human Action Window | Ventana de Acci\u00F3n Humana\n- **Conditional Activation**:\n  - \uD83D\uDFE2 **`AUTONOMOUS`** (or PR/CI final supervision): **OMITTED**. Uninterrupted continuous execution.\n  - \uD83D\uDFE1 **Autonomy $\\ge$ `HUMAN_REVIEW_PLAN`** (`HUMAN_REVIEW_PLAN`, `AMBIGUOUS`, `HIGH_RISK_MANUAL`): **MANDATORY**. Emit Workflow Handoff block ([`templates/workflow/agent-handoff.template.md`](templates/workflow/agent-handoff.template.md)) and **STOP**.\n- **Content**: Completed deliverables, suggested next role(s), copy-paste ready invocation prompt, and **an open Human Action Window for the user to take action** (review, edit by hand, pause/reroute, or delegate).\n";
-declare const STARTER_COPILOT_RULES = "<!--\n  AI-SDLC: Canonical Instructions for GitHub Copilot (Chat & Workspace)\n  Canonical Reference: process/09_agent_protocols.md and process/01_governance_and_roles.md\n-->\n\n# GitHub Copilot Instructions - AI-SDLC Framework\n\nYou operate as an assistant agent in the **AI-SDLC** repository. You are not a simple text auto-completer: you are a specialized technical worker subject to normative directives, deterministic autonomy boundaries, and strict traceability.\n\n---\n\n## 1. The 5 Unbreakable Commandments of Agents | Los 5 Mandamientos Inquebrantables de los Agentes\n\n1. **FORBIDDEN TO AUTO-APPROVE OR AUTO-MERGE | PROHIBIDO AUTO-APROBAR O AUTO-FUSIONAR**:\n   - Never execute PR approvals or direct merges to stable branches (`main`, `release/*`). Approval is an exclusive human prerogative.\n2. **FORBIDDEN TO INVENT PRODUCT OR ARCHITECTURE DECISIONS**:\n   - If a requirement is ambiguous or incomplete, formulate open questions (`open-questions`) to the human user. Guessing undocumented intentions is forbidden.\n3. **FORBIDDEN TO INTRODUCE DEPENDENCIES WITHOUT LICENSE INSPECTION**:\n   - Before suggesting or adding dependencies to manifests (`package.json`, etc.), validate their SPDX identifier against `license-policy.yaml`. Adding viral (`GPL`, `AGPL`) or commercial paid (`BSL`, `SSPL`) licenses without human authorization is prohibited.\n4. **FORBIDDEN TO IGNORE CYBERSECURITY (SECURITY-BY-DEFAULT)**:\n   - All code must enforce least privilege, sanitize external inputs, and include mitigation tests (`SEC-TEST-*`). Suppressing types (`any`), linters, or tests to force a green pipeline is prohibited.\n5. **MANDATORY CRYPTOGRAPHIC CITATION**:\n   - Every specification, design, or sidecar must reference canonical identifiers and their Unix LF-normalized SHA-256 digests.\n\n---\n\n## 2. Git 4-Tier Branch Hierarchy\n\nWhen proposing or creating branches, respect the strict hierarchical structure:\n- **Tier 1**: `main` (Protected production branch with maximum stability).\n- **Tier 2**: `release/vX.Y.Z` (Release consolidation and scope freeze branch).\n- **Tier 3**: `feat/<FEAT-ID>-<slug>` or `bug/<BUG-ID>-<slug>` (SDD increment or feature branch).\n- **Tier 4**: `task/<PARENT-ID>/<TSK-ID>-<slug>` (Atomic development task branch).\n\n---\n\n## 3. Pre-Flight Commands and Quality Gates\n\nBefore concluding any intervention or suggesting a commit:\n- **Unified pre-flight with auto-fix**: `pnpm run check:fix` (or `npx aisdlc check --fix`).\n- **Complete Quality Gates verification**: `pnpm run verify:all` (or `npx aisdlc verify all`).\n- **Unit test suite**: `pnpm test`.\n- **Strict typing**: `pnpm run typecheck`.\n\nNon-Negotiable Quality Thresholds (`quality-policy.yaml`):\n- Cyclomatic Complexity (CC) $\\le 10$.\n- Cognitive Complexity $\\le 15$.\n- Maintainability Index (MI) $\\ge 50$.\n- Maximum lines per function $\\le 40$.\n\n---\n\n## 4. Task Autonomy Modes (`tasks.md`)\n\n- \uD83D\uDFE2 **`AUTONOMOUS`**: Low risk, isolated task. Implement code and tests directly. Omit interactive handoff block.\n- \uD83D\uDFE1 **`HUMAN_REVIEW_PLAN`**: Medium risk. Design detailed plan, emit Workflow Handoff block, and wait for human confirmation before coding.\n- \uD83D\uDFE0 **`AMBIGUOUS`**: Incomplete requirements. Blocked: request human clarification.\n- \uD83D\uDD34 **`HIGH_RISK_MANUAL`**: Critical risk (migrations, cryptography). Direct manual execution by humans only.\n\n---\n\n## 5. Workflow Handoff Protocol and Human Action Window | Ventana de Acci\u00F3n Humana\n- **Conditional Activation**:\n  * \uD83D\uDFE2 **`AUTONOMOUS` Mode** (or PR/CI final supervision): **OMITTED**. Do not interrupt unattended execution.\n  * \uD83D\uDFE1 **Autonomy $\\ge$ `HUMAN_REVIEW_PLAN`** (`HUMAN_REVIEW_PLAN`, `AMBIGUOUS`, `HIGH_RISK_MANUAL`): **MANDATORY**. Emit Workflow Handoff block compliant with [`templates/workflow/agent-handoff.template.md`](../templates/workflow/agent-handoff.template.md) and **STOP**.\n- **Components**: Declare completed deliverables, recommend next roles (`agent-threat-modeler`, `agent-system-architect`, `agent-developer`, `agent-security-auditor`), provide suggested invocation prompt, and **keep the Human Action Window open at all times for the user to take action** (review, edit by hand, pause/reroute, or delegate).\n\n---\n\n## 6. Specialized Roles Mapping\n\n| Role | Mission (summary) |\n| :--- | :--- |\n| `agent-product-analyst` | Phase 0 NAF v4 Enterprise & Capability Vision (`ARCH-INTRO-*`, 3\u20135 question interview) + ProductShape artifacts (`ACT-*`, `UC-*`, `FR-*`, `QR-*`, `BR-*`); `status` starts `draft`. |\n| `agent-threat-modeler` | STRIDE/OWASP threat triad (`ACT-THREAT-*`, `ABUSE-*`, `SEC-REQ-*`). |\n| `agent-system-architect` | Modular arc42 + NAF v4 architecture (`CMP-*`, Mermaid diagrams, `ADR-*`). |\n| `agent-qa-engineer` | FAILING BDD/Gherkin suites before `agent-developer` writes production code. |\n| `agent-developer` | Atomic tasks from `tasks.md`; autonomy mode must be respected; runs `pnpm run check:fix` + `pnpm run verify:all`. |\n| `agent-security-auditor` | Adversarial PR security audit, SAST, secrets, and CVSS v3.1 evaluation. |\n| `agent-compliance-checker` | SPDX license compliance audit against `license-policy.yaml`. |\n| `agent-expert-user` | Bimodal MVP evaluation (design) and functional validation against `UC-*` and `FR-*` (pre-PR). |\n| `agent-code-reviewer` | PR audit (SOLID, DRY, YAGNI): `[BLOCKING]` / `[CLEAN_CODE_SUGGESTION]` / `[COMPLIANT]`. |\n| `agent-devops` | CI/CD, Docker, IaC only \u2014 **FORBIDDEN** to touch `src/` or `packages/*/src/`. |\n\n---\n\n## 7. Canonical Reference\nTo consult full protocols, specialized prompts, and interface contracts:\n- [`process/09_agent_protocols.md`](../process/09_agent_protocols.md)\n- [`process/01_governance_and_roles.md`](../process/01_governance_and_roles.md)\n";
+declare const STARTER_CURSOR_QUALITY_RULES = "---\ndescription: Directives for code quality, architecture, TDD, and complexity limits\nglobs: packages/**, src/**, scripts/**, tests/**\nalwaysApply: false\n---\n\n# Code Quality and Architecture Directives\n\nCanonical Reference: [`process/09_agent_protocols.md`](process/09_agent_protocols.md) and [`process/10_quality_management_and_release_gates.md`](process/10_quality_management_and_release_gates.md).\n\n## 1. Non-Negotiable Quality Thresholds (`quality-policy.yaml`)\n- **Cyclomatic Complexity (CC)**: $\\le 10$ per function (warning alert if $> 7$).\n- **Cognitive Complexity**: $\\le 15$ per function (warning if $> 10$).\n- **Maintainability Index (MI)**: $\\ge 50$ (target minimum $\\ge 65$).\n- **Function Length**: $\\le 40$ lines (warning if $> 30$).\n- If a function exceeds these limits, decompose logic into cohesive helper functions before completing the task.\n\n## 2. TDD Methodology, Clean Architecture & Unit Testing\n- **Mandatory 4-Step Implementation Order**: (1) Define/refine Clean Architecture layers & boundaries, (2) Define interfaces/ports for all inter-module interactions to avoid direct module coupling, (3) Implement components consuming/fulfilling those interfaces, (4) Write unit tests for every function covering Happy Path, Sad Path, Boundary Values, and Unexpected/Null/Empty values.\n- Apply Test-Driven Development: generate unit tests before or alongside component logic.\n- Tag tests linked to requirements with header comments citing the ID (`FR-*` or `SEC-REQ-*`) to enable reverse traceability.\n- Suppressing types (`any`), linter rules (`eslint-disable`), or unit tests to force pipeline passage is prohibited.\n\n## 3. Open Source License Policy (`license-policy.yaml`)\n- Before adding any dependency to `package.json`, verify its SPDX identifier.\n- Only permissive dependencies are allowed (`MIT`, `Apache-2.0`, `BSD-2/3-Clause`, `ISC`).\n- Viral licenses (`GPL`, `AGPL`) or commercial licenses without approval (`BSL`, `SSPL`) are prohibited.\n\n## 4. Structured Output `--json`\n- Any extension to CLI commands must preserve compatibility with the `--json` flag and suppress ANSI escape codes when this flag is present.\n";
+declare const STARTER_CLAUDE_RULES = "# Claude Code Instructions - AI-SDLC Monorepo\n\nCanonical Reference: [`process/09_agent_protocols.md`](process/09_agent_protocols.md) and [`process/01_governance_and_roles.md`](process/01_governance_and_roles.md).\n\nThis repository implements the **AI-SDLC** framework (Spec-Driven Development, deterministic quality governance, and OSS license compliance for human-agent collaboration).\n\n---\n\n## 1. The 5 Unbreakable Commandments of Agents | Los 5 Mandamientos Inquebrantables de los Agentes\n\n1. **FORBIDDEN TO AUTO-APPROVE OR AUTO-MERGE | PROHIBIDO AUTO-APROBAR O AUTO-FUSIONAR**: Never approve PRs or merge directly to `main` or protected branches. Approval is exclusively a human prerogative.\n2. **FORBIDDEN TO INVENT PRODUCT OR ARCHITECTURE DECISIONS**: When facing ambiguous requirements, formulate open questions (`open-questions`). Never assume undocumented behaviors.\n3. **FORBIDDEN TO INTRODUCE DEPENDENCIES WITHOUT LICENSE INSPECTION**: Always validate the SPDX identifier against `license-policy.yaml`. Viral libraries (`GPL`/`AGPL`) or paid commercial libraries (`BSL`/`SSPL`) are strictly forbidden without formal human approval.\n4. **FORBIDDEN TO IGNORE CYBERSECURITY (SECURITY-BY-DEFAULT)**: Validate inputs, sanitize data, and include mitigation tests (`SEC-TEST-*`). Disabling linters or suppressing typing errors (`any`, `@ts-ignore`) is prohibited.\n5. **MANDATORY CRYPTOGRAPHIC CITATION**: Every spec or sidecar must cite immutable identifiers and Unix LF-normalized SHA-256 digests.\n\n---\n\n## 2. Essential Execution and Pre-Flight Commands\n\n```bash\n# 1. Pre-flight with deterministic auto-fix (Gherkin & SHA-256 digests)\npnpm run check:fix\n\n# 2. Complete verification across all Quality Gates (Quality, RTM, Governance, Testing, Licenses, PDaC, Schemas, Duplicates, Security)\npnpm run verify:all\n\n# 3. Complete automated test suite (Vitest)\npnpm test\n\n# 4. Strict TypeScript typechecking\npnpm run typecheck\n\n# 5. Scaffolding for a new SDD change\npnpm run change:new <name> --id <chg-id>\n\n# 6. Canonical integration of a completed SDD change\nnpx tsx packages/cli/src/index.ts sdd integrate --change <chg-id>\n```\n\n---\n\n## 3. Specialized Roles Mapping\n\n### 1. `agent-product-analyst` (Product Analyst / Scribe)\n- **Mission**: Capture new product intent via NAF v4 Enterprise & Capability Vision (`ARCH-INTRO-*`) and define/refine the product model using ProductShape.\n- **Phase 0 (Greenfield Product Inception)**: When creating a new product from scratch (or when `specs/product/` has no baseline), run a concise 3\u20135 question discovery interview (mission/problem, actors `ACT-*`, MVP capabilities `UC-*`, priority quality goals `QR-*`), draft `ARCH-INTRO-001` (`templates/architecture/introduction-and-goals.template.md`), and derive initial `ACT-*`, `UC-*`, `BR-*`, `FR-*`, and `QR-*` drafts.\n- **Input**: Business intent or natural language specification.\n- **Output**: Markdown artifacts with YAML frontmatter compliant with `schemas/architecture/introduction-and-goals.schema.json` (`ARCH-INTRO-*`) and `schemas/product/` (`ACT-*`, `UC-*`, `FR-*`, `QR-*`, `BR-*`).\n- **Guardrails**: `status` always starts in `draft`. Mandatory Gherkin criteria with `@<ID> @automated @regression`.\n\n### 2. `agent-threat-modeler` (Threat Modeler and Security Specialist)\n- **Mission**: Analyze use cases and proactively model adversaries, STRIDE attack vectors, and OWASP ASVS mitigations, both at product level and in the technical security feedback loop over architecture.\n- **Output**: Cybersecurity triad (`ACT-THREAT-*`, `ABUSE-*`, `SEC-REQ-*`) compliant with `schemas/security/`.\n\n### 3. `agent-system-architect` (System Architect)\n- **Mission**: Translate the approved product definition into a modular technical architecture based on arc42 enriched with NAF v4 (`CMP-*`, Mermaid diagrams, `ADR-*`).\n- **Guardrails**: Declare `satisfies-requirements` on every `CMP-*` and trigger the technical security feedback loop toward `agent-threat-modeler` when infrastructure decisions introduce new attack vectors.\n\n### 4. `agent-qa-engineer` (QA Engineer and SDET)\n- **Mission**: Translate approved requirements (`FR-*`, `SEC-REQ-*`, `QR-*`) into comprehensive FAILING (red) BDD/Gherkin, End-to-End (E2E), UI, and unit test suites, before `agent-developer` writes production code.\n- **Guardrails**: Always use the agreed project technology/testing stack (if any). Never omit End-to-End (E2E) and UI tests. Create specific tests for every interactive UI element covering Happy Path, Sad Path, and Boundary Values. FORBIDDEN to include production code. Mandatory tags: `@<FR-ID> @automated @regression`.\n\n### 5. `agent-developer` (Software Developer)\n- **Mission**: Implement atomic tasks from SDD specifications (`tasks.md`) with clean, strictly typed code and thorough tests.\n- **Directives**: Execute the mandatory 4-step order: (1) Clean Architecture definition/redefinition, (2) Inter-module interfaces first, (3) Component implementation, (4) Per-function unit tests (Happy Path, Sad Path, Boundary Values, Unexpected/Null/Empty values). Respect the autonomy mode. Make tests delivered by `agent-qa-engineer` pass green. Run `pnpm run check:fix` and `pnpm run verify:all`.\n\n### 6. `agent-security-auditor` (Adversarial Code Auditor)\n- **Mission**: Examine Pull Requests for business logic vulnerabilities, injection vectors, secret leaks, and authorization flaws as part of the Pre-Merge Audit Triad.\n- **Directives**: Run `pnpm run verify:security`, evaluate CVSS v3.1 severity, and block CRITICAL/HIGH risks.\n\n### 7. `agent-compliance-checker` (Open Source License Compliance Auditor)\n- **Mission**: Audit dependency manifests against `license-policy.yaml` as part of the Pre-Merge Audit Triad.\n- **Directives**: Run `pnpm run verify:licenses`, blocking viral (`GPL`, `AGPL`) or unapproved commercial (`BSL`, `SSPL`) packages.\n\n### 8. `agent-expert-user` (Expert User and Domain Evaluator)\n- **Mission**: Contrast design and specifications (design phase) and functionally validate finished software against `UC-*` and `FR-*` (post-development functional validation phase).\n\n### 9. `agent-code-reviewer` (Technical and Architectural Code Reviewer)\n- **Mission**: Audit Pull Requests evaluating code cleanliness, adherence to SOLID, DRY, YAGNI principles, and respect for `quality-policy.yaml` thresholds, forming part of the Pre-Merge Audit Triad.\n- **Findings classification**: `[BLOCKING]`, `[CLEAN_CODE_SUGGESTION]`, `[COMPLIANT]`.\n\n### 10. `agent-devops` (Automation and Infrastructure Engineer)\n- **Mission**: Maintain, evolve, and audit automated project infrastructure: CI/CD workflows, Docker containers, IaC manifests, and support scripts.\n- **NON-INVASION GUARDRAIL**: STRICTLY FORBIDDEN from modifying application source code (`src/`, `packages/*/src/`).\n\n---\n\n## 4. Task Autonomy Modes (`tasks.md`)\n\n- \uD83D\uDFE2 **`AUTONOMOUS`**: Low risk, isolated task. Implement code and tests directly. Omit interactive handoff block.\n- \uD83D\uDFE1 **`HUMAN_REVIEW_PLAN`**: Medium risk. Design detailed plan, emit Workflow Handoff block, and wait for human confirmation before coding.\n- \uD83D\uDFE0 **`AMBIGUOUS`**: Incomplete requirements. Blocked: request human clarification.\n- \uD83D\uDD34 **`HIGH_RISK_MANUAL`**: Critical risk (migrations, cryptography). Direct manual execution by humans only.\n\n---\n\n## 5. Git Workflow and Commit Rules with Trailers\n\n### 4-Tier Hierarchy\n1. **Tier 1 (`main`)**: Absolute stability and production readiness.\n2. **Tier 2 (`release/vX.Y.Z`)**: Release stabilization.\n3. **Tier 3 (`feat/<FEAT-ID>-<slug>` or `bug/<BUG-ID>-<slug>`)**: SDD delivery increment.\n4. **Tier 4 (`task/<PARENT-ID>/<TSK-ID>-<slug>`)**: Atomic implementation task.\n\n### Commit Format (Conventional Commits + Git Trailers)\n```text\nfeat(scope): concise imperative description (#issue)\n\nBody explaining the motivation and technical justification of the change.\n\nAuthor-Type: agent\nAI-Model: claude-3-7-sonnet\nTask-ID: TSK-001\nChange-ID: CHG-026-AGENT-NATIVE-CONFIGS\n```\n\n---\n\n## 6. Non-Negotiable Quality Thresholds (`quality-policy.yaml`)\n- **Cyclomatic Complexity (CC)**: $\\le 10$\n- **Cognitive Complexity**: $\\le 15$\n- **Maintainability Index (MI)**: $\\ge 50$\n- **Lines per Function**: $\\le 40$\n- Deterministic CLI output: every `verify` command supports `--json` without ANSI escape codes.\n\n---\n\n## 7. Workflow Handoff Protocol and Human Action Window | Ventana de Acci\u00F3n Humana\n- **Conditional Activation**:\n  - \uD83D\uDFE2 **`AUTONOMOUS`** (or PR/CI final supervision): **OMITTED**. Uninterrupted continuous execution.\n  - \uD83D\uDFE1 **Autonomy $\\ge$ `HUMAN_REVIEW_PLAN`** (`HUMAN_REVIEW_PLAN`, `AMBIGUOUS`, `HIGH_RISK_MANUAL`): **MANDATORY**. Emit Workflow Handoff block ([`templates/workflow/agent-handoff.template.md`](templates/workflow/agent-handoff.template.md)) and **STOP**.\n- **Content**: Completed deliverables, suggested next role(s), copy-paste ready invocation prompt, and **an open Human Action Window for the user to take action** (review, edit by hand, pause/reroute, or delegate).\n";
+declare const STARTER_COPILOT_RULES = "<!--\n  AI-SDLC: Canonical Instructions for GitHub Copilot (Chat & Workspace)\n  Canonical Reference: process/09_agent_protocols.md and process/01_governance_and_roles.md\n-->\n\n# GitHub Copilot Instructions - AI-SDLC Framework\n\nYou operate as an assistant agent in the **AI-SDLC** repository. You are not a simple text auto-completer: you are a specialized technical worker subject to normative directives, deterministic autonomy boundaries, and strict traceability.\n\n---\n\n## 1. The 5 Unbreakable Commandments of Agents | Los 5 Mandamientos Inquebrantables de los Agentes\n\n1. **FORBIDDEN TO AUTO-APPROVE OR AUTO-MERGE | PROHIBIDO AUTO-APROBAR O AUTO-FUSIONAR**:\n   - Never execute PR approvals or direct merges to stable branches (`main`, `release/*`). Approval is an exclusive human prerogative.\n2. **FORBIDDEN TO INVENT PRODUCT OR ARCHITECTURE DECISIONS**:\n   - If a requirement is ambiguous or incomplete, formulate open questions (`open-questions`) to the human user. Guessing undocumented intentions is forbidden.\n3. **FORBIDDEN TO INTRODUCE DEPENDENCIES WITHOUT LICENSE INSPECTION**:\n   - Before suggesting or adding dependencies to manifests (`package.json`, etc.), validate their SPDX identifier against `license-policy.yaml`. Adding viral (`GPL`, `AGPL`) or commercial paid (`BSL`, `SSPL`) licenses without human authorization is prohibited.\n4. **FORBIDDEN TO IGNORE CYBERSECURITY (SECURITY-BY-DEFAULT)**:\n   - All code must enforce least privilege, sanitize external inputs, and include mitigation tests (`SEC-TEST-*`). Suppressing types (`any`), linters, or tests to force a green pipeline is prohibited.\n5. **MANDATORY CRYPTOGRAPHIC CITATION**:\n   - Every specification, design, or sidecar must reference canonical identifiers and their Unix LF-normalized SHA-256 digests.\n\n---\n\n## 2. Git 4-Tier Branch Hierarchy\n\nWhen proposing or creating branches, respect the strict hierarchical structure:\n- **Tier 1**: `main` (Protected production branch with maximum stability).\n- **Tier 2**: `release/vX.Y.Z` (Release consolidation and scope freeze branch).\n- **Tier 3**: `feat/<FEAT-ID>-<slug>` or `bug/<BUG-ID>-<slug>` (SDD increment or feature branch).\n- **Tier 4**: `task/<PARENT-ID>/<TSK-ID>-<slug>` (Atomic development task branch).\n\n---\n\n## 3. Pre-Flight Commands and Quality Gates\n\nBefore concluding any intervention or suggesting a commit:\n- **Unified pre-flight with auto-fix**: `pnpm run check:fix` (or `npx aisdlc check --fix`).\n- **Complete Quality Gates verification**: `pnpm run verify:all` (or `npx aisdlc verify all`).\n- **Unit test suite**: `pnpm test`.\n- **Strict typing**: `pnpm run typecheck`.\n\nNon-Negotiable Quality Thresholds (`quality-policy.yaml`):\n- Cyclomatic Complexity (CC) $\\le 10$.\n- Cognitive Complexity $\\le 15$.\n- Maintainability Index (MI) $\\ge 50$.\n- Maximum lines per function $\\le 40$.\n\n---\n\n## 4. Task Autonomy Modes (`tasks.md`)\n\n- \uD83D\uDFE2 **`AUTONOMOUS`**: Low risk, isolated task. Implement code and tests directly. Omit interactive handoff block.\n- \uD83D\uDFE1 **`HUMAN_REVIEW_PLAN`**: Medium risk. Design detailed plan, emit Workflow Handoff block, and wait for human confirmation before coding.\n- \uD83D\uDFE0 **`AMBIGUOUS`**: Incomplete requirements. Blocked: request human clarification.\n- \uD83D\uDD34 **`HIGH_RISK_MANUAL`**: Critical risk (migrations, cryptography). Direct manual execution by humans only.\n\n---\n\n## 5. Workflow Handoff Protocol and Human Action Window | Ventana de Acci\u00F3n Humana\n- **Conditional Activation**:\n  * \uD83D\uDFE2 **`AUTONOMOUS` Mode** (or PR/CI final supervision): **OMITTED**. Do not interrupt unattended execution.\n  * \uD83D\uDFE1 **Autonomy $\\ge$ `HUMAN_REVIEW_PLAN`** (`HUMAN_REVIEW_PLAN`, `AMBIGUOUS`, `HIGH_RISK_MANUAL`): **MANDATORY**. Emit Workflow Handoff block compliant with [`templates/workflow/agent-handoff.template.md`](../templates/workflow/agent-handoff.template.md) and **STOP**.\n- **Components**: Declare completed deliverables, recommend next roles (`agent-threat-modeler`, `agent-system-architect`, `agent-developer`, `agent-security-auditor`), provide suggested invocation prompt, and **keep the Human Action Window open at all times for the user to take action** (review, edit by hand, pause/reroute, or delegate).\n\n---\n\n## 6. Specialized Roles Mapping\n\n| Role | Mission (summary) |\n| :--- | :--- |\n| `agent-product-analyst` | Phase 0 NAF v4 Enterprise & Capability Vision (`ARCH-INTRO-*`, 3\u20135 question interview) + ProductShape artifacts (`ACT-*`, `UC-*`, `FR-*`, `QR-*`, `BR-*`); `status` starts `draft`. |\n| `agent-threat-modeler` | STRIDE/OWASP threat triad (`ACT-THREAT-*`, `ABUSE-*`, `SEC-REQ-*`). |\n| `agent-system-architect` | Modular arc42 + NAF v4 architecture (`CMP-*`, Mermaid diagrams, `ADR-*`). |\n| `agent-qa-engineer` | FAILING BDD/Gherkin, E2E, and UI suites (using agreed project tech; Happy Path, Sad Path & Boundary Values per interactive UI element) before `agent-developer` writes production code. |\n| `agent-developer` | Atomic tasks from `tasks.md`; autonomy mode must be respected; runs `pnpm run check:fix` + `pnpm run verify:all`. |\n| `agent-security-auditor` | Adversarial PR security audit, SAST, secrets, and CVSS v3.1 evaluation. |\n| `agent-compliance-checker` | SPDX license compliance audit against `license-policy.yaml`. |\n| `agent-expert-user` | Bimodal MVP evaluation (design) and functional validation against `UC-*` and `FR-*` (pre-PR). |\n| `agent-code-reviewer` | PR audit (SOLID, DRY, YAGNI): `[BLOCKING]` / `[CLEAN_CODE_SUGGESTION]` / `[COMPLIANT]`. |\n| `agent-devops` | CI/CD, Docker, IaC only \u2014 **FORBIDDEN** to touch `src/` or `packages/*/src/`. |\n\n---\n\n## 7. Canonical Reference\nTo consult full protocols, specialized prompts, and interface contracts:\n- [`process/09_agent_protocols.md`](../process/09_agent_protocols.md)\n- [`process/01_governance_and_roles.md`](../process/01_governance_and_roles.md)\n";
 declare const STARTER_CURSOR_MCP = "{\n  \"mcpServers\": {\n    \"ai-sdlc\": {\n      \"command\": \"npx\",\n      \"args\": [\n        \"@aisdlc/mcp\"\n      ]\n    }\n  }\n}\n";
 declare const STARTER_ANTIGRAVITY_MCP = "{\n  \"mcpServers\": {\n    \"ai-sdlc\": {\n      \"command\": \"npx\",\n      \"args\": [\n        \"@aisdlc/mcp\"\n      ]\n    }\n  }\n}\n";
 declare const STARTER_VSCODE_MCP = "{\n  \"servers\": {\n    \"ai-sdlc\": {\n      \"command\": \"npx\",\n      \"args\": [\n        \"@aisdlc/mcp\"\n      ]\n    }\n  }\n}\n";
@@ -1781,4 +1837,4 @@ declare function initProject(options?: InitProjectOptions): InitProjectResult;
 
 declare function walkMdFiles(dir: string, fileList?: string[], excludeDirs?: string[]): string[];
 
-export { ALL_ARCHITECTURE_TEMPLATES, type ActiveTaskMatch, type AgentTarget, type AnalysisResult, type ArchTemplateDef, type ArchitectureGranularity, type ArtifactFrontmatter, type ArtifactSchemaOptions, type ArtifactSchemaResult, type ArtifactSchemaViolation, type ArtifactValidationResult, type AuthorIdentity, type AuthorKpiSummary, type AutonomyMode, BRANCH_PATTERNS, type BranchClassificationResult, type BranchHierarchyPlan, type BranchValidationError, type BranchValidationSuccess, type BugRecordSummary, type ChangeDetectionOptions, type ChangeDetectionResult, type ChangeProfile, type CiProvider, type CodeCoverageSummary, type CommitKpiRecord, type CommitTrailers, type CycloneDxBom, type CycloneDxComponent, type CycloneDxLicense, type CytoscapeEdgeData, type CytoscapeElement, type CytoscapeNodeData, DEFAULT_EXCLUDED_PATTERNS, DEFAULT_EXCLUDES, DEFAULT_EXTENSIONS, DEFAULT_SAST_EXCLUDES, type DashboardHistoricalKpi, type DashboardOptions, type DashboardResult, type DiffLineItem, type DuplicateIssue, type DuplicateIssueType, type DuplicateSeverity, type DuplicateVerifierOptions, type DuplicateVerifierResult, type ExtractedFeature, type FunctionMetrics, GENERAL_SOURCE_EXTENSIONS, type GherkinExtractionOptions, type GherkinExtractionResult, type GherkinSyncCheckResult, type GitCheckoutTaskOptions, type GitCheckoutTaskResult, type GovernanceOptions, type GovernanceResult, type GraphElementsResult, type GraphNodeLayer, type GraphNodeStatus, type GraphNodeType, type HookInstallResult, type InitProjectOptions, type InitProjectResult, type JsonSchemaRule, KPI_SUMMARY_END_TAG, KPI_SUMMARY_START_TAG, type LicensePolicy, type LicenseVerificationOptions, type LicenseVerificationResult, type LicenseViolation, type ManualDocumentItem, type ManualsCoverageSummary, type ManualsVerificationOptions, type ManualsVerificationResult, type ModelDefectStats, OpenSpecAdapter, PREPARE_COMMIT_MSG_SCRIPT, PROMPT_INJECTION_SIGNATURES, PROTECTED_BYPASS_PATTERNS, type PackageJsonInfo, type PdacDrift, type PdacGraphOptions, type PdacGraphResult, type PdacNode, type PdacSyncDetail, type PdacSyncOptions, type PdacSyncResult, type PrKpiAggregation, type PreflightCheckOptions, type PreflightCheckResult, type PreflightGateSummary, type ProductHandoff, type ProductHandoffSubgraph, type ProgressiveFrictionOptions, type ProgressiveFrictionResult, type PromptInjectionFinding, type QualityGateOptions, type QualityGateResult, type QualityPolicy, type QualityReportOptions, type QualityReportResult, type QualityThresholds, type ReleaseKpiReport, type RequirementAuditItem, type ResolvedCiEnv, SAST_RULES, SECRET_RULES, SPECIALIZED_AGENT_TEMPLATES, STARTER_ANTIGRAVITY_MCP, STARTER_ANTIGRAVITY_RULES, STARTER_ARCH_ADR, STARTER_ARCH_ARCHITECTURE_CONSTRAINTS, STARTER_ARCH_COMPONENT, STARTER_ARCH_CONTEXT_AND_SCOPE, STARTER_ARCH_CROSS_CUTTING_CONCEPTS, STARTER_ARCH_DEPLOYMENT_VIEW, STARTER_ARCH_GLOSSARY, STARTER_ARCH_INTRODUCTION_AND_GOALS, STARTER_ARCH_LEVEL_1_WHITEBOX, STARTER_ARCH_QUALITY_REQUIREMENTS, STARTER_ARCH_RISKS_AND_TECHNICAL_DEBT, STARTER_ARCH_RUNTIME_VIEW, STARTER_ARCH_SOLUTION_STRATEGY, STARTER_AZURE_PIPELINES, STARTER_BITBUCKET_PIPELINES, STARTER_CLAUDE_RULES, STARTER_COPILOT_RULES, STARTER_CURSOR_CORE_RULES, STARTER_CURSOR_MCP, STARTER_CURSOR_PRODUCT_RULES, STARTER_CURSOR_QUALITY_RULES, STARTER_GITHUB_CI, STARTER_GITHUB_SDD_INTEGRATE, STARTER_GITLAB_CI, STARTER_LICENSE_POLICY, STARTER_QUALITY_POLICY, STARTER_REQUIREMENT_TEMPLATE, STARTER_TASK_TEMPLATE, STARTER_VSCODE_MCP, STARTER_WORKFLOW_HANDOFF_TEMPLATE, type SastFindingType, type SastRule, type SastSeverity, type SastVerifierOptions, type SastVerifierResult, type SastViolation, type SbomGenerateOptions, type ScaTool, type ScanOptions, type ScannedDependency, type ScannedRequirement, type SddAdapter, type SddChangeScaffoldOptions, type SddChangeScaffoldResult, type SddDepositOptions, type SddFramework, type SddIntegrationAudit, type SddIntegrationOptions, type SddIntegrationResult, type SddValidationResult, type SddWorkspaceInfo, type SecretFindingType, type SecretRule, type SecretVerifierOptions, type SecretVerifierResult, type SecretViolation, type SpecCatalogScope, SpecKitAdapter, type SpecializedAgentTemplate, type SupportedCiProvider, TYPE_TO_SCHEMA_MAP, type TaskAuditItem, type TaskItem, type TaskLocateResult, type TaskSummary, type TaskVerification, type TestingCoverageOptions, type TestingCoverageResult, type TraceabilityOptions, type TraceabilityResult, type TraceabilityRow, VALID_AGENT_TARGETS, VALID_ARCHITECTURE_GRANULARITIES, VALID_AUTONOMY_MODES, VALID_CHANGE_PROFILES, VALID_CI_PROVIDERS, aggregateCommitKpiRecords, aggregatePrKpis, aggregateReleaseKpis, appendRevisionHistoryRow, buildCycloneDxComponent, buildFeatureFileContent, buildGraphElements, calculateJaccardSimilarity, calculateMetrics, calculateRating, calculateShannonEntropy, checkGherkinInSync, checkoutTaskBranch, classifyBranch, collectAgentFiles, collectDashboardMetrics, collectHistoricalKpis, computeCanonicalSha256, computeSha256, createDefaultQualityPolicy, depositProductHandoffSidecar, detectActiveChangeForIntegration, detectAuthorIdentity, detectLanguage, detectProfileFromChange, detectPromptInjection, emitCiOutput, evaluateCompoundLicense, evaluateSingleDependency, extractCitations, extractCommitKpisFromRange, extractDirectDepNames, extractFeatureTags, extractFrontmatter, extractFunctions, extractFunctionsBraceLanguages, extractFunctionsPolyglot, extractFunctionsPython, extractFunctionsTypeScriptAst, extractGherkinBlock, extractGherkinFeatures, extractNormativeText, findChangeWorkspaceDir, findLicenseFile, formatCommitTrailers, formatPrKpiMarkdown, formatReleaseKpiMarkdown, generateBranchHierarchyPlan, generateCycloneDxSbom, generateDashboardReport, generateDuplicatesReportMarkdown, generateGovernanceReportMarkdown, generateLicenseReportMarkdown, generatePdacReportMarkdown, generateQualityReport, generateSastReportMarkdown, generateSecretsReportMarkdown, generateTestingCoverageReportMarkdown, generateThirdPartyNotices, generateTraceabilityReportMarkdown, getArchitectureTemplates, getCytoscapeScript, getGitDiffLines, getNextCorrelativeNumber, getSddAdapter, inferArtifactTypeFromId, inferMissingTrailers, initProject, injectKpisIntoPrBody, installGitHooks, integrateSddChange, isGitleaksInstalled, isPathProtectedFromPatch, isPlaceholderOrIgnored, isRequirementArtifact, isSemgrepInstalled, isToolAvailable, loadProductHandoffSidecar, locateTaskInActiveChanges, maskSecret, normalizeSpdxLicense, parseCommitTrailers, parseFrontmatter, parseFrontmatterId, parseGenericDoc, parseLicensePolicy, parseMarkdownFrontmatter, parseQualityPolicy, parseRequirementFile, parseSpecCatalogScope, parseTasksDoc, parseTasksFromContent, processPackageDir, readCodeCoverageSummary, readPackageJson, renderAntigravityAgentFile, renderAutonomyModeSection, renderClaudeAgentFile, renderCopilotAgentFile, renderCursorAgentFile, renderDashboardHtml, renderManualsTab, resolveAgentTargets, resolveBranchHierarchy, resolveCiEnvironment, resolveCytoscapePath, resolveFeatureFilePath, resolveGitRef, resolveLicenseFromFile, resolveSchemaForArtifact, resolveTargetFiles, runGitleaksCli, runSemgrepCli, scaffoldSddChange, scanAllProductHandoffs, scanAllTestArtifacts, scanContentForSecrets, scanFileForSast, scanInstalledLicenses, scanManualsInWorkspace, scanPnpmStore, scanSubdirectories, scanWithNativeFs, scanWithSyft, scanWithTrivy, slugify, syncPdacDigests, tokenizeTitle, updateCitationsInContent, validateAgainstSchema, validateArtifactSchema, verifyArtifactDuplicates, verifyArtifactsSchemas, verifyLicenses, verifyManuals, verifyPdacGraph, verifyProgressiveFriction, verifyQualityGate, verifySast, verifySddIntegration, verifySecrets, verifyTasksGovernance, verifyTestingCoverage, verifyTraceability, walkDir, walkMdFiles, walkProjectFiles, walkSourceFiles, walkTaskFiles, writeCycloneDxSbom, writeReleaseKpiReport, writeThirdPartyNotices };
+export { ALL_ARCHITECTURE_TEMPLATES, type ActiveTaskMatch, type AgentTarget, type AnalysisResult, type ArchTemplateDef, type ArchitectureGranularity, type ArtifactFrontmatter, type ArtifactSchemaOptions, type ArtifactSchemaResult, type ArtifactSchemaViolation, type ArtifactValidationResult, type AuthorIdentity, type AuthorKpiSummary, type AutonomyMode, BRANCH_PATTERNS, type BddVariantCoverage, type BranchClassificationResult, type BranchHierarchyPlan, type BranchValidationError, type BranchValidationSuccess, type BugRecordSummary, type ChangeDetectionOptions, type ChangeDetectionResult, type ChangeProfile, type CiProvider, type CodeCoverageSummary, type CommitKpiRecord, type CommitTrailers, type ContractTraceAudit, type CycloneDxBom, type CycloneDxComponent, type CycloneDxLicense, type CytoscapeEdgeData, type CytoscapeElement, type CytoscapeNodeData, DEFAULT_EXCLUDED_PATTERNS, DEFAULT_EXCLUDES, DEFAULT_EXTENSIONS, DEFAULT_SAST_EXCLUDES, type DashboardHistoricalKpi, type DashboardOptions, type DashboardResult, type DesignContractDeclaration, type DiffLineItem, type DuplicateIssue, type DuplicateIssueType, type DuplicateSeverity, type DuplicateVerifierOptions, type DuplicateVerifierResult, type ExtractedFeature, type FunctionMetrics, GENERAL_SOURCE_EXTENSIONS, type GherkinExtractionOptions, type GherkinExtractionResult, type GherkinSyncCheckResult, type GitCheckoutTaskOptions, type GitCheckoutTaskResult, type GovernanceOptions, type GovernanceResult, type GraphElementsResult, type GraphNodeLayer, type GraphNodeStatus, type GraphNodeType, type HookInstallResult, type InitProjectOptions, type InitProjectResult, type JsonSchemaRule, KPI_SUMMARY_END_TAG, KPI_SUMMARY_START_TAG, type LicensePolicy, type LicenseVerificationOptions, type LicenseVerificationResult, type LicenseViolation, type ManualDocumentItem, type ManualsCoverageSummary, type ManualsVerificationOptions, type ManualsVerificationResult, type ModelDefectStats, OpenSpecAdapter, PREPARE_COMMIT_MSG_SCRIPT, PROMPT_INJECTION_SIGNATURES, PROTECTED_BYPASS_PATTERNS, type PackageJsonInfo, type PdacDrift, type PdacGraphOptions, type PdacGraphResult, type PdacNode, type PdacSyncDetail, type PdacSyncOptions, type PdacSyncResult, type PrKpiAggregation, type PreflightCheckOptions, type PreflightCheckResult, type PreflightGateSummary, type ProductHandoff, type ProductHandoffSubgraph, type ProgressiveFrictionOptions, type ProgressiveFrictionResult, type PromptInjectionFinding, type QualityGateOptions, type QualityGateResult, type QualityPolicy, type QualityReportOptions, type QualityReportResult, type QualityThresholds, type ReleaseKpiReport, type RequirementAuditItem, type ResolvedCiEnv, SAST_RULES, SECRET_RULES, SPECIALIZED_AGENT_TEMPLATES, STARTER_ANTIGRAVITY_MCP, STARTER_ANTIGRAVITY_RULES, STARTER_ARCH_ADR, STARTER_ARCH_ARCHITECTURE_CONSTRAINTS, STARTER_ARCH_COMPONENT, STARTER_ARCH_CONTEXT_AND_SCOPE, STARTER_ARCH_CROSS_CUTTING_CONCEPTS, STARTER_ARCH_DEPLOYMENT_VIEW, STARTER_ARCH_GLOSSARY, STARTER_ARCH_INTRODUCTION_AND_GOALS, STARTER_ARCH_LEVEL_1_WHITEBOX, STARTER_ARCH_QUALITY_REQUIREMENTS, STARTER_ARCH_RISKS_AND_TECHNICAL_DEBT, STARTER_ARCH_RUNTIME_VIEW, STARTER_ARCH_SOLUTION_STRATEGY, STARTER_AZURE_PIPELINES, STARTER_BITBUCKET_PIPELINES, STARTER_CLAUDE_RULES, STARTER_COPILOT_RULES, STARTER_CURSOR_CORE_RULES, STARTER_CURSOR_MCP, STARTER_CURSOR_PRODUCT_RULES, STARTER_CURSOR_QUALITY_RULES, STARTER_GITHUB_CI, STARTER_GITHUB_SDD_INTEGRATE, STARTER_GITLAB_CI, STARTER_LICENSE_POLICY, STARTER_QUALITY_POLICY, STARTER_REQUIREMENT_TEMPLATE, STARTER_TASK_TEMPLATE, STARTER_VSCODE_MCP, STARTER_WORKFLOW_HANDOFF_TEMPLATE, type SastFindingType, type SastRule, type SastSeverity, type SastVerifierOptions, type SastVerifierResult, type SastViolation, type SbomGenerateOptions, type ScaTool, type ScanOptions, type ScannedDependency, type ScannedRequirement, type SddAdapter, type SddChangeScaffoldOptions, type SddChangeScaffoldResult, type SddDepositOptions, type SddFramework, type SddIntegrationAudit, type SddIntegrationOptions, type SddIntegrationResult, type SddValidationResult, type SddWorkspaceInfo, type SecretFindingType, type SecretRule, type SecretVerifierOptions, type SecretVerifierResult, type SecretViolation, type SpecCatalogScope, SpecKitAdapter, type SpecializedAgentTemplate, type SupportedCiProvider, TYPE_TO_SCHEMA_MAP, type TaskAuditItem, type TaskItem, type TaskLocateResult, type TaskSummary, type TaskVerification, type TestingCoverageOptions, type TestingCoverageResult, type TraceabilityOptions, type TraceabilityResult, type TraceabilityRow, type UntestedFunctionItem, type UseCaseFlowAuditItem, VALID_AGENT_TARGETS, VALID_ARCHITECTURE_GRANULARITIES, VALID_AUTONOMY_MODES, VALID_CHANGE_PROFILES, VALID_CI_PROVIDERS, aggregateCommitKpiRecords, aggregatePrKpis, aggregateReleaseKpis, analyzeBddVariantsForRequirement, appendRevisionHistoryRow, buildCycloneDxComponent, buildFeatureFileContent, buildGraphElements, calculateJaccardSimilarity, calculateMetrics, calculateRating, calculateShannonEntropy, checkGherkinInSync, checkoutTaskBranch, classifyBranch, collectAgentFiles, collectDashboardMetrics, collectHistoricalKpis, computeCanonicalSha256, computeSha256, createDefaultQualityPolicy, depositProductHandoffSidecar, detectActiveChangeForIntegration, detectAuthorIdentity, detectLanguage, detectProfileFromChange, detectPromptInjection, emitCiOutput, evaluateCompoundLicense, evaluateSingleDependency, extractCitations, extractCommitKpisFromRange, extractDirectDepNames, extractFeatureTags, extractFrontmatter, extractFunctions, extractFunctionsBraceLanguages, extractFunctionsPolyglot, extractFunctionsPython, extractFunctionsTypeScriptAst, extractGherkinBlock, extractGherkinFeatures, extractNormativeText, findChangeWorkspaceDir, findLicenseFile, formatCommitTrailers, formatPrKpiMarkdown, formatReleaseKpiMarkdown, generateBranchHierarchyPlan, generateCycloneDxSbom, generateDashboardReport, generateDuplicatesReportMarkdown, generateGovernanceReportMarkdown, generateLicenseReportMarkdown, generatePdacReportMarkdown, generateQualityReport, generateSastReportMarkdown, generateSecretsReportMarkdown, generateTestingCoverageReportMarkdown, generateThirdPartyNotices, generateTraceabilityReportMarkdown, getArchitectureTemplates, getCytoscapeScript, getGitDiffLines, getNextCorrelativeNumber, getSddAdapter, inferArtifactTypeFromId, inferMissingTrailers, initProject, injectKpisIntoPrBody, installGitHooks, integrateSddChange, isGitleaksInstalled, isPathProtectedFromPatch, isPlaceholderOrIgnored, isRequirementArtifact, isSemgrepInstalled, isToolAvailable, loadProductHandoffSidecar, locateTaskInActiveChanges, maskSecret, normalizeSpdxLicense, parseCommitTrailers, parseFrontmatter, parseFrontmatterId, parseGenericDoc, parseLicensePolicy, parseMarkdownFrontmatter, parseQualityPolicy, parseRequirementFile, parseSpecCatalogScope, parseTasksDoc, parseTasksFromContent, processPackageDir, readCodeCoverageSummary, readPackageJson, renderAntigravityAgentFile, renderAutonomyModeSection, renderClaudeAgentFile, renderCopilotAgentFile, renderCursorAgentFile, renderDashboardHtml, renderManualsTab, resolveAgentTargets, resolveBranchHierarchy, resolveCiEnvironment, resolveCytoscapePath, resolveFeatureFilePath, resolveGitRef, resolveLicenseFromFile, resolveSchemaForArtifact, resolveTargetFiles, runGitleaksCli, runSemgrepCli, scaffoldSddChange, scanAllProductHandoffs, scanAllTestArtifacts, scanContentForSecrets, scanFileForSast, scanInstalledLicenses, scanManualsInWorkspace, scanPnpmStore, scanSubdirectories, scanWithNativeFs, scanWithSyft, scanWithTrivy, slugify, syncPdacDigests, tokenizeTitle, updateCitationsInContent, validateAgainstSchema, validateArtifactSchema, verifyArtifactDuplicates, verifyArtifactsSchemas, verifyLicenses, verifyManuals, verifyPdacGraph, verifyProgressiveFriction, verifyQualityGate, verifySast, verifySddIntegration, verifySecrets, verifyTasksGovernance, verifyTestingCoverage, verifyTraceability, walkDir, walkMdFiles, walkProjectFiles, walkSourceFiles, walkTaskFiles, writeCycloneDxSbom, writeReleaseKpiReport, writeThirdPartyNotices };