@aisdlc/core 2.0.2 → 2.2.1

package/dist/index.d.cts

@@ -10,6 +10,7 @@ interface QualityPolicy {
     min_branch_coverage: number;
     min_function_coverage: number;
     enforce_mode: 'STRICT' | 'PERMISSIVE' | string;
+    ratchet_mode?: boolean;
     target_directories: string[];
     supported_extensions: string[];
     exclude_patterns: string[];
@@ -22,11 +23,29 @@ interface FunctionMetrics {
     cognitive: number;
     maintainability: number;
     codeSmells: string[];
+    line?: number;
 }
 interface AnalysisResult extends FunctionMetrics {
     relPath: string;
     status: 'PASS' | 'FAIL';
     violations: string[];
+    toleratedViolations?: string[];
+}
+interface QualityBaselineEntry {
+    signature: string;
+    file: string;
+    functionName: string;
+    line: number;
+    metric: string;
+    value?: number;
+    threshold?: number;
+    message: string;
+}
+interface QualityBaseline {
+    version: string;
+    generatedAt: string;
+    totalViolations: number;
+    violations: QualityBaselineEntry[];
 }
 interface QualityThresholds {
     max_cyclomatic?: number;
@@ -42,6 +61,10 @@ interface QualityGateOptions {
     thresholds?: QualityThresholds;
     requireCoverageReport?: boolean;
     requireFunctionUnitTests?: boolean;
+    baseline?: boolean | string;
+    baselinePath?: string;
+    updateBaseline?: boolean;
+    ratchet?: boolean;
 }
 interface UntestedFunctionItem {
     file: string;
@@ -59,6 +82,10 @@ interface QualityGateResult {
     coverageViolations?: string[];
     untestedFunctions?: UntestedFunctionItem[];
     reportMarkdown?: string;
+    baselineViolationsCount?: number;
+    toleratedViolationsCount?: number;
+    newViolationsCount?: number;
+    baselineUpdated?: boolean;
 }
 interface DesignContractDeclaration {
     component?: string;
@@ -451,6 +478,22 @@ interface CycloneDxBom {
     };
     components: CycloneDxComponent[];
 }
+interface ScaVulnerability {
+    id: string;
+    packageName: string;
+    installedVersion: string;
+    fixedVersion?: string;
+    severity: 'CRITICAL' | 'HIGH' | 'MEDIUM' | 'LOW' | 'UNKNOWN';
+    cvssV3Score?: number;
+    cvssV3Vector?: string;
+    title?: string;
+    description?: string;
+    primaryUrl?: string;
+}
+interface VulnerabilityThresholds {
+    failOnSeverity?: 'CRITICAL' | 'HIGH' | 'MEDIUM' | 'LOW';
+    maxCvssScore?: number;
+}
 interface LicenseVerificationOptions {
     rootDir?: string;
     policyPath?: string;
@@ -463,6 +506,8 @@ interface LicenseVerificationOptions {
     generateNotices?: boolean;
     noticesPath?: string;
     productionOnly?: boolean;
+    scanVulnerabilities?: boolean;
+    vulnerabilityThresholds?: VulnerabilityThresholds;
 }
 interface LicenseVerificationResult {
     success: boolean;
@@ -473,6 +518,9 @@ interface LicenseVerificationResult {
     sbomPath?: string;
     noticesPath?: string;
     scannedDependencies?: ScannedDependency[];
+    vulnerabilities?: ScaVulnerability[];
+    vulnerabilitiesSkipped?: boolean;
+    vulnerabilitiesSkipReason?: string;
 }
 interface PdacNode {
     id: string;
@@ -684,12 +732,25 @@ interface SecretVerifierOptions {
     excludePatterns?: string[];
     ignoreSecrets?: string[];
 }
+interface SecuritySuppression {
+    kind: 'sast' | 'secret';
+    ruleId?: string;
+    reason?: string;
+    expires?: string;
+    approvedBy?: string;
+    status: 'active' | 'expired' | 'invalid';
+    filePath: string;
+    lineNumber: number;
+    rawComment: string;
+    invalidReason?: string;
+}
 interface SecretVerifierResult {
     success: boolean;
     totalFilesScanned: number;
     findingsCount: number;
     findings: SecretViolation[];
     scannedWithGitleaks: boolean;
+    suppressions?: SecuritySuppression[];
     reportMarkdown?: string;
 }
 type SastSeverity = 'CRITICAL' | 'HIGH' | 'MEDIUM' | 'LOW';
@@ -715,6 +776,7 @@ interface SastVerifierResult {
     totalFilesScanned: number;
     violationsCount: number;
     violations: SastViolation[];
+    suppressions?: SecuritySuppression[];
     reportMarkdown?: string;
 }
 interface PromptInjectionFinding {
@@ -951,6 +1013,86 @@ interface PrivacyVerifierResult {
     ropaOutputPath?: string;
     reportOutputPath?: string;
 }
+type SarifLevel = "error" | "warning" | "note" | "none";
+interface SarifMultiformatMessageString {
+    text: string;
+    markdown?: string;
+}
+interface SarifRuleConfiguration {
+    level?: SarifLevel;
+}
+interface SarifReportingDescriptor {
+    id: string;
+    name?: string;
+    shortDescription?: {
+        text: string;
+    };
+    fullDescription?: {
+        text: string;
+    };
+    defaultConfiguration?: SarifRuleConfiguration;
+    helpUri?: string;
+    help?: SarifMultiformatMessageString;
+    properties?: {
+        tags?: string[];
+        cwe?: string[];
+        owasp?: string[];
+        precision?: string;
+        securitySeverity?: string;
+        [key: string]: unknown;
+    };
+}
+interface SarifArtifactLocation {
+    uri: string;
+    uriBaseId?: string;
+}
+interface SarifRegion {
+    startLine: number;
+    startColumn?: number;
+    endLine?: number;
+    endColumn?: number;
+}
+interface SarifPhysicalLocation {
+    artifactLocation: SarifArtifactLocation;
+    region?: SarifRegion;
+}
+interface SarifLocation {
+    physicalLocation: SarifPhysicalLocation;
+}
+interface SarifResult {
+    ruleId: string;
+    level: SarifLevel;
+    message: {
+        text: string;
+    };
+    locations: SarifLocation[];
+    ruleIndex?: number;
+    properties?: Record<string, unknown>;
+}
+interface SarifToolDriver {
+    name: string;
+    version?: string;
+    informationUri?: string;
+    rules: SarifReportingDescriptor[];
+}
+interface SarifRun {
+    tool: {
+        driver: SarifToolDriver;
+    };
+    results: SarifResult[];
+}
+interface SarifDocument {
+    $schema: string;
+    version: "2.1.0";
+    runs: SarifRun[];
+}
+interface GenerateSarifOptions {
+    sastResult?: SastVerifierResult;
+    secretsResult?: SecretVerifierResult;
+    toolName?: string;
+    toolVersion?: string;
+    informationUri?: string;
+}
 
 /**
  * AI-SDLC: Deterministic Quality Gate Engine (Polyglot Support)
@@ -966,6 +1108,23 @@ declare function extractFunctionsBraceLanguages(content: string, filePath: strin
 declare function extractFunctionsPython(content: string, filePath: string): FunctionMetrics[];
 declare function calculateMetrics(fnBody: string, fnName: string, filePath: string): FunctionMetrics;
 declare function walkDir(dir: string, extensions?: readonly string[], excludePatterns?: readonly string[]): string[];
+declare function computeViolationSignature(relPath: string, fnName: string, metric: string): string;
+declare function classifyMetricFromMessage(msg: string, fn?: FunctionMetrics): {
+    metric: string;
+    value?: number;
+    threshold?: number;
+};
+declare function isMetricWorsened(baselineEntry: QualityBaselineEntry, current: {
+    metric: string;
+    value?: number;
+}): boolean;
+declare function loadQualityBaseline(baselineFile: string): QualityBaseline | null;
+declare function writeQualityBaseline(baselineFile: string, entries: QualityBaselineEntry[]): QualityBaseline;
+declare function extractBaselineEntriesFromResults(results: AnalysisResult[]): QualityBaselineEntry[];
+declare function applyRatchetMode(results: AnalysisResult[], baseline: QualityBaseline): {
+    toleratedCount: number;
+    newViolationsCount: number;
+};
 declare function verifyQualityGate(options?: QualityGateOptions): QualityGateResult;
 
 /**
@@ -1144,8 +1303,16 @@ declare function processPackageDir(pkgDir: string, directNames: Set<string>, see
 declare function scanSubdirectories(baseDir: string, directNames: Set<string>, seen: Map<string, ScannedDependency>): void;
 declare function scanPnpmStore(pnpmDir: string, directNames: Set<string>, seen: Map<string, ScannedDependency>): void;
 declare function scanWithNativeFs(rootDir: string, options?: ScanOptions): ScannedDependency[];
-declare function scanWithTrivy(rootDir: string): {
+declare function parseTrivyVulnerabilities(stdout: string): ScaVulnerability[];
+declare function evaluateVulnerabilityThresholds(vulnerabilities: ScaVulnerability[], options?: VulnerabilityThresholds): {
+    blocked: boolean;
+    failingVulnerabilities: ScaVulnerability[];
+};
+declare function scanWithTrivy(rootDir: string, options?: {
+    scanVulnerabilities?: boolean;
+}): {
     dependencies: ScannedDependency[];
+    vulnerabilities: ScaVulnerability[];
     executed: boolean;
 };
 declare function scanWithSyft(rootDir: string): {
@@ -1314,7 +1481,7 @@ declare function calculateShannonEntropy(str: string): number;
  * Masks a secret string for safe display and logging (e.g. ghp_1234...5678)
  */
 declare function maskSecret(secret: string): string;
-declare function isPlaceholderOrIgnored(secret: string, line: string): boolean;
+declare function isPlaceholderOrIgnored(secret: string, line: string, filePath?: string, lineNumber?: number, collectedSuppressions?: SecuritySuppression[]): boolean;
 interface DiffLineItem {
     file: string;
     lineNumber: number;
@@ -1324,7 +1491,7 @@ declare function getGitDiffLines(rootDir: string, baseBranch?: string): DiffLine
 declare function walkProjectFiles(dir: string, rootDir: string, excludedPatterns?: string[]): string[];
 declare function isGitleaksInstalled(): boolean;
 declare function runGitleaksCli(rootDir: string): SecretViolation[];
-declare function scanContentForSecrets(content: string, filePath: string, rootDir: string, entropyThreshold?: number): SecretViolation[];
+declare function scanContentForSecrets(content: string, filePath: string, rootDir: string, entropyThreshold?: number, collectedSuppressions?: SecuritySuppression[]): SecretViolation[];
 declare function verifySecrets(options?: SecretVerifierOptions): SecretVerifierResult;
 declare function generateSecretsReportMarkdown(result: SecretVerifierResult): string;
 
@@ -1353,7 +1520,7 @@ declare const DEFAULT_SAST_EXCLUDES: string[];
 declare function isSemgrepInstalled(): boolean;
 declare function runSemgrepCli(rootDir: string): SastViolation[];
 declare function walkSourceFiles(dir: string, rootDir: string, excludes?: string[]): string[];
-declare function scanFileForSast(filePath: string, rootDir: string, minSeverity?: SastSeverity): SastViolation[];
+declare function scanFileForSast(filePath: string, rootDir: string, minSeverity?: SastSeverity, collectedSuppressions?: SecuritySuppression[]): SastViolation[];
 declare function verifySast(options?: SastVerifierOptions): SastVerifierResult;
 declare function generateSastReportMarkdown(result: SastVerifierResult): string;
 declare const PROMPT_INJECTION_SIGNATURES: readonly {
@@ -1364,6 +1531,9 @@ declare const PROMPT_INJECTION_SIGNATURES: readonly {
 }[];
 declare function detectPromptInjection(content: string): PromptInjectionFinding[];
 
+declare function parseSecuritySuppression(line: string, filePath: string, lineNumber: number, referenceDate?: Date): SecuritySuppression | null;
+declare function generateSuppressionsAuditReport(suppressions: SecuritySuppression[]): string;
+
 /**
  * AI-SDLC: Privacy-by-Design as Code (PDaC) & Data Protection Verifier (Gate 12)
  *
@@ -1725,6 +1895,23 @@ declare function collectDashboardMetrics(rootDir: string): {
  */
 declare function generateDashboardReport(options?: DashboardOptions): DashboardResult;
 
+/**
+ * AI-SDLC: OASIS SARIF 2.1.0 Security Reporter
+ *
+ * Exports SAST vulnerabilities and credential leaks into standard OASIS SARIF v2.1.0 format
+ * for automated ingestion by GitHub Advanced Security (GHAS), DefectDojo, Snyk, and ASPM platforms.
+ */
+
+declare const SARIF_SCHEMA_2_1_0 = "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json";
+declare const SARIF_VERSION = "2.1.0";
+declare function normalizeUri(filePath: string): string;
+declare function mapSastSeverityToSarifLevel(severity: SastSeverity): SarifLevel;
+declare function resolveSastCwe(ruleId: string): string[];
+declare function resolveSastOwasp(ruleId: string): string[];
+declare function generateSecuritySarifReport(options?: GenerateSarifOptions): SarifDocument;
+declare function serializeSarifDocument(doc: SarifDocument, pretty?: boolean): string;
+declare function writeSecuritySarifReport(outputPath: string, doc: SarifDocument, pretty?: boolean): void;
+
 /**
  * AI-SDLC: SDD Ecosystem Adapters Interface (OpenSpec & Spec Kit)
  */
@@ -1913,7 +2100,7 @@ declare const SCHEMA_SCHEMAS_ARCHITECTURE_COMPONENT_SCHEMA_JSON = "{\r\n  \"$sch
 declare const SCHEMA_SCHEMAS_ARCHITECTURE_INTRODUCTION_AND_GOALS_SCHEMA_JSON = "{\r\n  \"$schema\": \"https://json-schema.org/draft/2020-12/schema\",\r\n  \"$id\": \"https://ai-sdlc.org/schemas/architecture/introduction-and-goals.schema.json\",\r\n  \"title\": \"NAF v4 Enterprise & Capability / arc42 Introduction and System Goals Schema\",\r\n  \"type\": \"object\",\r\n  \"required\": [\r\n    \"id\",\r\n    \"type\",\r\n    \"title\",\r\n    \"status\",\r\n    \"version\",\r\n    \"naf-perspective\",\r\n    \"cites-product-actors\",\r\n    \"cites-quality-goals\",\r\n    \"cites-use-cases\"\r\n  ],\r\n  \"properties\": {\r\n    \"id\": {\r\n      \"type\": \"string\",\r\n      \"pattern\": \"^ARCH-INTRO-[A-Z0-9]+(-[A-Z0-9]+)*$\"\r\n    },\r\n    \"type\": {\r\n      \"type\": \"string\",\r\n      \"const\": \"architecture-introduction\"\r\n    },\r\n    \"version\": {\r\n      \"type\": \"string\",\r\n      \"pattern\": \"^[0-9]+\\\\.[0-9]+\\\\.[0-9]+(-[0-9A-Za-z.-]+)?$\",\r\n      \"description\": \"Artifact semantic version (SemVer).\"\r\n    },\r\n    \"schema-version\": {\r\n      \"type\": \"string\"\r\n    },\r\n    \"title\": {\r\n      \"type\": \"string\",\r\n      \"minLength\": 3\r\n    },\r\n    \"status\": {\r\n      \"type\": \"string\",\r\n      \"enum\": [\"draft\", \"proposed\", \"accepted\", \"approved\", \"deprecated\", \"superseded\"]\r\n    },\r\n    \"owner\": {\r\n      \"type\": \"string\"\r\n    },\r\n    \"arc42-section\": {\r\n      \"type\": \"integer\",\r\n      \"const\": 1\r\n    },\r\n    \"naf-perspective\": {\r\n      \"type\": \"string\",\r\n      \"const\": \"Enterprise & Capability\"\r\n    },\r\n    \"cites-product-actors\": {\r\n      \"type\": \"array\",\r\n      \"minItems\": 1,\r\n      \"items\": {\r\n        \"type\": \"string\",\r\n        \"pattern\": \"^ACT-[A-Z0-9]+(-[A-Z0-9]+)*$\"\r\n      }\r\n    },\r\n    \"cites-quality-goals\": {\r\n      \"type\": \"array\",\r\n      \"minItems\": 1,\r\n      \"items\": {\r\n        \"type\": \"string\",\r\n        \"pattern\": \"^(QR|SEC-REQ|PRIV-REQ)-[A-Z0-9]+(-[A-Z0-9]+)*$\"\r\n      }\r\n    },\r\n    \"cites-use-cases\": {\r\n      \"type\": \"array\",\r\n      \"minItems\": 1,\r\n      \"items\": {\r\n        \"type\": \"string\",\r\n        \"pattern\": \"^UC-[A-Z0-9]+(-[A-Z0-9]+)*$\"\r\n      }\r\n    },\r\n    \"supersedes\": {\r\n      \"type\": [\"string\", \"null\"],\r\n      \"pattern\": \"^ARCH-INTRO-[A-Z0-9]+(-[A-Z0-9]+)*$\"\r\n    },\r\n    \"superseded-by\": {\r\n      \"type\": [\"string\", \"null\"],\r\n      \"pattern\": \"^ARCH-INTRO-[A-Z0-9]+(-[A-Z0-9]+)*$\"\r\n    }\r\n  },\r\n  \"additionalProperties\": false\r\n}\r\n";
 declare const SCHEMA_SCHEMAS_COMPLIANCE_LICENSE_MANIFEST_SCHEMA_JSON = "{\r\n  \"$schema\": \"https://json-schema.org/draft/2020-12/schema\",\r\n  \"$id\": \"https://ai-sdlc.org/schemas/compliance/license-manifest.schema.json\",\r\n  \"title\": \"Static Dependencies License Manifest Schema\",\r\n  \"type\": \"object\",\r\n  \"required\": [\"evaluated_dependencies\"],\r\n  \"properties\": {\r\n    \"id\": {\r\n      \"type\": \"string\",\r\n      \"pattern\": \"^(MAN-LIC|LIC-MAN|LIC)-[A-Z0-9]+(-[A-Z0-9]+)*$\",\r\n      \"description\": \"Optional canonical artifact identifier.\"\r\n    },\r\n    \"type\": {\r\n      \"type\": \"string\",\r\n      \"const\": \"license-manifest\"\r\n    },\r\n    \"version\": {\r\n      \"type\": \"string\",\r\n      \"pattern\": \"^[0-9]+\\\\.[0-9]+(\\\\.[0-9]+)?(-[0-9A-Za-z.-]+)?$\",\r\n      \"description\": \"Manifest format version.\"\r\n    },\r\n    \"schema-version\": {\r\n      \"type\": \"string\"\r\n    },\r\n    \"description\": {\r\n      \"type\": \"string\"\r\n    },\r\n    \"generated_at\": {\r\n      \"type\": \"string\"\r\n    },\r\n    \"evaluated_dependencies\": {\r\n      \"type\": \"array\",\r\n      \"minItems\": 1,\r\n      \"items\": {\r\n        \"type\": \"object\",\r\n        \"required\": [\"package\", \"version\", \"spdx_license\", \"status\"],\r\n        \"properties\": {\r\n          \"package\": {\r\n            \"type\": \"string\",\r\n            \"minLength\": 1\r\n          },\r\n          \"version\": {\r\n            \"type\": \"string\",\r\n            \"minLength\": 1\r\n          },\r\n          \"spdx_license\": {\r\n            \"type\": \"string\",\r\n            \"minLength\": 1\r\n          },\r\n          \"status\": {\r\n            \"type\": \"string\",\r\n            \"enum\": [\r\n              \"APPROVED\",\r\n              \"REJECTED\",\r\n              \"REVIEW_REQUIRED\",\r\n              \"COMMERCIAL_APPROVAL_REQUIRED\",\r\n              \"PENDING\"\r\n            ]\r\n          },\r\n          \"reason\": {\r\n            \"type\": \"string\"\r\n          },\r\n          \"approved_by\": {\r\n            \"type\": \"string\"\r\n          }\r\n        },\r\n        \"additionalProperties\": false\r\n      }\r\n    }\r\n  },\r\n  \"additionalProperties\": false\r\n}\r\n";
 declare const SCHEMA_SCHEMAS_COMPLIANCE_LICENSE_POLICY_SCHEMA_JSON = "{\r\n  \"$schema\": \"https://json-schema.org/draft/2020-12/schema\",\r\n  \"$id\": \"https://ai-sdlc.org/schemas/compliance/license-policy.schema.json\",\r\n  \"title\": \"Open Source License Policy Schema\",\r\n  \"type\": \"object\",\r\n  \"required\": [\"version\", \"project\", \"default_action\", \"categories\", \"agent_guardrails\", \"ci_gates\"],\r\n  \"properties\": {\r\n    \"version\": {\r\n      \"type\": \"string\"\r\n    },\r\n    \"project\": {\r\n      \"type\": \"string\"\r\n    },\r\n    \"default_action\": {\r\n      \"type\": \"string\",\r\n      \"enum\": [\"ALLOW\", \"DENY\", \"REVIEW_REQUIRED\"]\r\n    },\r\n    \"categories\": {\r\n      \"type\": \"object\"\r\n    },\r\n    \"agent_guardrails\": {\r\n      \"type\": \"object\",\r\n      \"required\": [\"enforce_pre_check\", \"reject_unknown_licenses\"],\r\n      \"properties\": {\r\n        \"enforce_pre_check\": { \"type\": \"boolean\" },\r\n        \"reject_unknown_licenses\": { \"type\": \"boolean\" },\r\n        \"auto_reject_categories\": { \"type\": \"array\", \"items\": { \"type\": \"string\" } },\r\n        \"on_commercial_detected\": { \"type\": \"object\" }\r\n      }\r\n    },\r\n    \"ci_gates\": {\r\n      \"type\": \"object\",\r\n      \"required\": [\"fail_on_denied\", \"generate_sbom\"],\r\n      \"properties\": {\r\n        \"fail_on_denied\": { \"type\": \"boolean\" },\r\n        \"fail_on_missing_license\": { \"type\": \"boolean\" },\r\n        \"generate_sbom\": { \"type\": \"boolean\" },\r\n        \"sbom_format\": { \"type\": \"string\" },\r\n        \"output_notices_file\": { \"type\": \"string\" },\r\n        \"allowed_depth\": { \"type\": \"string\", \"enum\": [\"DIRECT\", \"TRANSITIVE\"] }\r\n      }\r\n    }\r\n  },\r\n  \"additionalProperties\": false\r\n}\r\n";
-declare const SCHEMA_SCHEMAS_COMPLIANCE_QUALITY_POLICY_SCHEMA_JSON = "{\r\n  \"$schema\": \"https://json-schema.org/draft/2020-12/schema\",\r\n  \"$id\": \"https://ai-sdlc.org/schemas/compliance/quality-policy.schema.json\",\r\n  \"title\": \"Software Quality Policy Schema (Polyglot)\",\r\n  \"type\": \"object\",\r\n  \"required\": [\"version\", \"project\", \"enforcement_mode\", \"coding_rules\", \"release_thresholds\", \"agent_guardrails\"],\r\n  \"properties\": {\r\n    \"version\": { \"type\": \"string\" },\r\n    \"project\": { \"type\": \"string\" },\r\n    \"enforcement_mode\": { \"type\": \"string\", \"enum\": [\"STRICT\", \"PERMISSIVE\"] },\r\n    \"scope\": {\r\n      \"type\": \"object\",\r\n      \"properties\": {\r\n        \"target_directories\": { \"type\": \"array\", \"items\": { \"type\": \"string\" } },\r\n        \"supported_extensions\": { \"type\": \"array\", \"items\": { \"type\": \"string\" } },\r\n        \"exclude_patterns\": { \"type\": \"array\", \"items\": { \"type\": \"string\" } }\r\n      }\r\n    },\r\n    \"language_toolchains\": {\r\n      \"type\": \"object\"\r\n    },\r\n    \"coding_rules\": {\r\n      \"type\": \"object\",\r\n      \"required\": [\"standards\", \"enforce_formatting\", \"rules\"],\r\n      \"properties\": {\r\n        \"standards\": { \"type\": \"array\", \"items\": { \"type\": \"string\" } },\r\n        \"enforce_formatting\": { \"type\": \"boolean\" },\r\n        \"formatting_engine\": { \"type\": \"string\" },\r\n        \"linter_engine\": { \"type\": \"string\" },\r\n        \"rules\": { \"type\": \"object\" }\r\n      }\r\n    },\r\n    \"release_thresholds\": {\r\n      \"type\": \"object\",\r\n      \"required\": [\"cyclomatic_complexity\", \"cognitive_complexity\", \"maintainability_index\", \"code_duplication\", \"test_coverage\"],\r\n      \"properties\": {\r\n        \"cyclomatic_complexity\": {\r\n          \"type\": \"object\",\r\n          \"required\": [\"max_per_function\", \"action_on_breach\"],\r\n          \"properties\": {\r\n            \"max_per_function\": { \"type\": \"integer\" },\r\n            \"warning_at\": { \"type\": \"integer\" },\r\n            \"action_on_breach\": { \"type\": \"string\" }\r\n          }\r\n        },\r\n        \"cognitive_complexity\": {\r\n          \"type\": \"object\",\r\n          \"required\": [\"max_per_function\", \"action_on_breach\"],\r\n          \"properties\": {\r\n            \"max_per_function\": { \"type\": \"integer\" },\r\n            \"warning_at\": { \"type\": \"integer\" },\r\n            \"action_on_breach\": { \"type\": \"string\" }\r\n          }\r\n        },\r\n        \"maintainability_index\": {\r\n          \"type\": \"object\",\r\n          \"required\": [\"min_acceptable_score\", \"action_on_breach\"],\r\n          \"properties\": {\r\n            \"min_acceptable_score\": { \"type\": \"number\" },\r\n            \"target_score\": { \"type\": \"number\" },\r\n            \"action_on_breach\": { \"type\": \"string\" }\r\n          }\r\n        },\r\n        \"code_duplication\": {\r\n          \"type\": \"object\",\r\n          \"required\": [\"max_percentage\", \"action_on_breach\"],\r\n          \"properties\": {\r\n            \"max_percentage\": { \"type\": \"number\" },\r\n            \"action_on_breach\": { \"type\": \"string\" }\r\n          }\r\n        },\r\n        \"test_coverage\": {\r\n          \"type\": \"object\",\r\n          \"required\": [\"min_line_coverage_percent\", \"action_on_breach\"],\r\n          \"properties\": {\r\n            \"min_line_coverage_percent\": { \"type\": \"number\" },\r\n            \"min_branch_coverage_percent\": { \"type\": \"number\" },\r\n            \"min_function_coverage_percent\": { \"type\": \"number\" },\r\n            \"action_on_breach\": { \"type\": \"string\" }\r\n          }\r\n        },\r\n        \"technical_debt\": {\r\n          \"type\": \"object\"\r\n        }\r\n      }\r\n    },\r\n    \"agent_guardrails\": {\r\n      \"type\": \"object\",\r\n      \"required\": [\"enforce_pre_commit_linter\", \"prevent_suppression_comments\"],\r\n      \"properties\": {\r\n        \"enforce_pre_commit_linter\": { \"type\": \"boolean\" },\r\n        \"prevent_suppression_comments\": { \"type\": \"boolean\" },\r\n        \"auto_refactor_on_high_complexity\": { \"type\": \"boolean\" }\r\n      }\r\n    }\r\n  },\r\n  \"additionalProperties\": false\r\n}\r\n";
+declare const SCHEMA_SCHEMAS_COMPLIANCE_QUALITY_POLICY_SCHEMA_JSON = "{\r\n  \"$schema\": \"https://json-schema.org/draft/2020-12/schema\",\r\n  \"$id\": \"https://ai-sdlc.org/schemas/compliance/quality-policy.schema.json\",\r\n  \"title\": \"Software Quality Policy Schema (Polyglot)\",\r\n  \"type\": \"object\",\r\n  \"required\": [\"version\", \"project\", \"enforcement_mode\", \"coding_rules\", \"release_thresholds\", \"agent_guardrails\"],\r\n  \"properties\": {\r\n    \"version\": { \"type\": \"string\" },\r\n    \"project\": { \"type\": \"string\" },\r\n    \"enforcement_mode\": { \"type\": \"string\", \"enum\": [\"STRICT\", \"PERMISSIVE\"] },\r\n    \"ratchet_mode\": { \"type\": \"boolean\" },\r\n    \"scope\": {\r\n      \"type\": \"object\",\r\n      \"properties\": {\r\n        \"target_directories\": { \"type\": \"array\", \"items\": { \"type\": \"string\" } },\r\n        \"supported_extensions\": { \"type\": \"array\", \"items\": { \"type\": \"string\" } },\r\n        \"exclude_patterns\": { \"type\": \"array\", \"items\": { \"type\": \"string\" } }\r\n      }\r\n    },\r\n    \"language_toolchains\": {\r\n      \"type\": \"object\"\r\n    },\r\n    \"coding_rules\": {\r\n      \"type\": \"object\",\r\n      \"required\": [\"standards\", \"enforce_formatting\", \"rules\"],\r\n      \"properties\": {\r\n        \"standards\": { \"type\": \"array\", \"items\": { \"type\": \"string\" } },\r\n        \"enforce_formatting\": { \"type\": \"boolean\" },\r\n        \"formatting_engine\": { \"type\": \"string\" },\r\n        \"linter_engine\": { \"type\": \"string\" },\r\n        \"rules\": { \"type\": \"object\" }\r\n      }\r\n    },\r\n    \"release_thresholds\": {\r\n      \"type\": \"object\",\r\n      \"required\": [\"cyclomatic_complexity\", \"cognitive_complexity\", \"maintainability_index\", \"code_duplication\", \"test_coverage\"],\r\n      \"properties\": {\r\n        \"cyclomatic_complexity\": {\r\n          \"type\": \"object\",\r\n          \"required\": [\"max_per_function\", \"action_on_breach\"],\r\n          \"properties\": {\r\n            \"max_per_function\": { \"type\": \"integer\" },\r\n            \"warning_at\": { \"type\": \"integer\" },\r\n            \"action_on_breach\": { \"type\": \"string\" }\r\n          }\r\n        },\r\n        \"cognitive_complexity\": {\r\n          \"type\": \"object\",\r\n          \"required\": [\"max_per_function\", \"action_on_breach\"],\r\n          \"properties\": {\r\n            \"max_per_function\": { \"type\": \"integer\" },\r\n            \"warning_at\": { \"type\": \"integer\" },\r\n            \"action_on_breach\": { \"type\": \"string\" }\r\n          }\r\n        },\r\n        \"maintainability_index\": {\r\n          \"type\": \"object\",\r\n          \"required\": [\"min_acceptable_score\", \"action_on_breach\"],\r\n          \"properties\": {\r\n            \"min_acceptable_score\": { \"type\": \"number\" },\r\n            \"target_score\": { \"type\": \"number\" },\r\n            \"action_on_breach\": { \"type\": \"string\" }\r\n          }\r\n        },\r\n        \"code_duplication\": {\r\n          \"type\": \"object\",\r\n          \"required\": [\"max_percentage\", \"action_on_breach\"],\r\n          \"properties\": {\r\n            \"max_percentage\": { \"type\": \"number\" },\r\n            \"action_on_breach\": { \"type\": \"string\" }\r\n          }\r\n        },\r\n        \"test_coverage\": {\r\n          \"type\": \"object\",\r\n          \"required\": [\"min_line_coverage_percent\", \"action_on_breach\"],\r\n          \"properties\": {\r\n            \"min_line_coverage_percent\": { \"type\": \"number\" },\r\n            \"min_branch_coverage_percent\": { \"type\": \"number\" },\r\n            \"min_function_coverage_percent\": { \"type\": \"number\" },\r\n            \"action_on_breach\": { \"type\": \"string\" }\r\n          }\r\n        },\r\n        \"technical_debt\": {\r\n          \"type\": \"object\"\r\n        }\r\n      }\r\n    },\r\n    \"agent_guardrails\": {\r\n      \"type\": \"object\",\r\n      \"required\": [\"enforce_pre_commit_linter\", \"prevent_suppression_comments\"],\r\n      \"properties\": {\r\n        \"enforce_pre_commit_linter\": { \"type\": \"boolean\" },\r\n        \"prevent_suppression_comments\": { \"type\": \"boolean\" },\r\n        \"auto_refactor_on_high_complexity\": { \"type\": \"boolean\" }\r\n      }\r\n    }\r\n  },\r\n  \"additionalProperties\": false\r\n}\r\n";
 declare const SCHEMA_SCHEMAS_IDE_MCP_CONFIG_SCHEMA_JSON = "{\r\n  \"$schema\": \"https://json-schema.org/draft/2020-12/schema\",\r\n  \"$id\": \"https://ai-sdlc.org/schemas/ide/mcp-config.schema.json\",\r\n  \"title\": \"IDE MCP Configuration Schema (Cursor, Antigravity, VS Code)\",\r\n  \"type\": \"object\",\r\n  \"properties\": {\r\n    \"$schema\": {\r\n      \"type\": \"string\"\r\n    },\r\n    \"id\": {\r\n      \"type\": \"string\",\r\n      \"pattern\": \"^(MCP-CFG|IDE-MCP|MCP)-[A-Z0-9]+(-[A-Z0-9]+)*$\",\r\n      \"description\": \"Optional identifier for MCP configuration artifact.\"\r\n    },\r\n    \"type\": {\r\n      \"type\": \"string\",\r\n      \"const\": \"mcp-config\"\r\n    },\r\n    \"mcpServers\": {\r\n      \"type\": \"object\",\r\n      \"additionalProperties\": {\r\n        \"type\": \"object\",\r\n        \"required\": [\"command\"],\r\n        \"properties\": {\r\n          \"command\": {\r\n            \"type\": \"string\",\r\n            \"minLength\": 1\r\n          },\r\n          \"args\": {\r\n            \"type\": \"array\",\r\n            \"items\": {\r\n              \"type\": \"string\"\r\n            }\r\n          },\r\n          \"env\": {\r\n            \"type\": \"object\"\r\n          },\r\n          \"disabled\": {\r\n            \"type\": \"boolean\"\r\n          },\r\n          \"alwaysAllow\": {\r\n            \"type\": \"array\",\r\n            \"items\": {\r\n              \"type\": \"string\"\r\n            }\r\n          }\r\n        },\r\n        \"additionalProperties\": false\r\n      },\r\n      \"description\": \"MCP server registry format for Cursor and Antigravity.\"\r\n    },\r\n    \"servers\": {\r\n      \"type\": \"object\",\r\n      \"additionalProperties\": {\r\n        \"type\": \"object\",\r\n        \"required\": [\"command\"],\r\n        \"properties\": {\r\n          \"command\": {\r\n            \"type\": \"string\",\r\n            \"minLength\": 1\r\n          },\r\n          \"args\": {\r\n            \"type\": \"array\",\r\n            \"items\": {\r\n              \"type\": \"string\"\r\n            }\r\n          },\r\n          \"env\": {\r\n            \"type\": \"object\"\r\n          },\r\n          \"disabled\": {\r\n            \"type\": \"boolean\"\r\n          },\r\n          \"alwaysAllow\": {\r\n            \"type\": \"array\",\r\n            \"items\": {\r\n              \"type\": \"string\"\r\n            }\r\n          }\r\n        },\r\n        \"additionalProperties\": false\r\n      },\r\n      \"description\": \"MCP server registry format for VS Code.\"\r\n    }\r\n  },\r\n  \"additionalProperties\": false\r\n}\r\n";
 declare const SCHEMA_SCHEMAS_MANUALS_PRODUCTION_MANUAL_SCHEMA_JSON = "{\r\n  \"$schema\": \"https://json-schema.org/draft/2020-12/schema\",\r\n  \"$id\": \"https://ai-sdlc.org/schemas/manuals/production-manual.schema.json\",\r\n  \"title\": \"AI-SDLC Production & Operations Manual Schema\",\r\n  \"type\": \"object\",\r\n  \"required\": [\r\n    \"id\",\r\n    \"type\",\r\n    \"title\",\r\n    \"status\",\r\n    \"version\",\r\n    \"applies-to-version\",\r\n    \"target-audience\"\r\n  ],\r\n  \"properties\": {\r\n    \"id\": {\r\n      \"type\": \"string\",\r\n      \"pattern\": \"^MAN-PROD-[A-Z0-9]+(-[A-Z0-9]+)*$\",\r\n      \"description\": \"Immutable production manual identifier (e.g. MAN-PROD-SENTINELCORE).\"\r\n    },\r\n    \"type\": {\r\n      \"type\": \"string\",\r\n      \"const\": \"production-manual\"\r\n    },\r\n    \"version\": {\r\n      \"type\": \"string\",\r\n      \"pattern\": \"^[0-9]+\\\\.[0-9]+\\\\.[0-9]+(-[0-9A-Za-z.-]+)?$\",\r\n      \"description\": \"Document semantic version (SemVer).\"\r\n    },\r\n    \"schema-version\": {\r\n      \"type\": \"string\",\r\n      \"description\": \"Template schema version.\"\r\n    },\r\n    \"title\": {\r\n      \"type\": \"string\",\r\n      \"minLength\": 3,\r\n      \"description\": \"Descriptive title of the production manual.\"\r\n    },\r\n    \"status\": {\r\n      \"type\": \"string\",\r\n      \"enum\": [\"draft\", \"active\", \"deprecated\", \"retired\"]\r\n    },\r\n    \"applies-to-version\": {\r\n      \"type\": \"string\",\r\n      \"description\": \"Software version or release this production manual applies to (e.g. v1.0.0).\"\r\n    },\r\n    \"target-audience\": {\r\n      \"type\": \"array\",\r\n      \"items\": {\r\n        \"type\": \"string\"\r\n      },\r\n      \"minItems\": 1,\r\n      \"description\": \"Target technical profiles (e.g. DevOps, SRE, Release Manager, SecOps).\"\r\n    },\r\n    \"components-covered\": {\r\n      \"type\": \"array\",\r\n      \"items\": {\r\n        \"type\": \"string\",\r\n        \"pattern\": \"^CMP-[A-Z0-9]+(-[A-Z0-9]+)*$\"\r\n      },\r\n      \"description\": \"Architecture components (CMP-*) deployed and covered by the manual.\"\r\n    },\r\n    \"enclaves-involved\": {\r\n      \"type\": \"array\",\r\n      \"items\": {\r\n        \"type\": \"string\",\r\n        \"pattern\": \"^SEC-ENC-[A-Z0-9]+(-[A-Z0-9]+)*$\"\r\n      },\r\n      \"description\": \"Security enclaves (SEC-ENC-*) in which deployment executes.\"\r\n    },\r\n    \"supersedes\": {\r\n      \"type\": [\"string\", \"null\"],\r\n      \"pattern\": \"^MAN-PROD-[A-Z0-9]+(-[A-Z0-9]+)*$\"\r\n    },\r\n    \"superseded-by\": {\r\n      \"type\": [\"string\", \"null\"],\r\n      \"pattern\": \"^MAN-PROD-[A-Z0-9]+(-[A-Z0-9]+)*$\"\r\n    }\r\n  },\r\n  \"additionalProperties\": false\r\n}\r\n";
 declare const SCHEMA_SCHEMAS_MANUALS_USER_MANUAL_SCHEMA_JSON = "{\r\n  \"$schema\": \"https://json-schema.org/draft/2020-12/schema\",\r\n  \"$id\": \"https://ai-sdlc.org/schemas/manuals/user-manual.schema.json\",\r\n  \"title\": \"AI-SDLC User Manual Schema\",\r\n  \"type\": \"object\",\r\n  \"required\": [\r\n    \"id\",\r\n    \"type\",\r\n    \"title\",\r\n    \"status\",\r\n    \"version\",\r\n    \"target-audience\",\r\n    \"allowed-roles\",\r\n    \"applies-to-version\"\r\n  ],\r\n  \"properties\": {\r\n    \"id\": {\r\n      \"type\": \"string\",\r\n      \"pattern\": \"^MAN-USER-[A-Z0-9]+(-[A-Z0-9]+)*$\",\r\n      \"description\": \"Immutable user manual identifier (e.g. MAN-USER-SENTINELCORE).\"\r\n    },\r\n    \"type\": {\r\n      \"type\": \"string\",\r\n      \"const\": \"user-manual\"\r\n    },\r\n    \"version\": {\r\n      \"type\": \"string\",\r\n      \"pattern\": \"^[0-9]+\\\\.[0-9]+\\\\.[0-9]+(-[0-9A-Za-z.-]+)?$\",\r\n      \"description\": \"Document semantic version (SemVer).\"\r\n    },\r\n    \"schema-version\": {\r\n      \"type\": \"string\",\r\n      \"description\": \"Template schema version.\"\r\n    },\r\n    \"title\": {\r\n      \"type\": \"string\",\r\n      \"minLength\": 3,\r\n      \"description\": \"Descriptive title of the user manual.\"\r\n    },\r\n    \"status\": {\r\n      \"type\": \"string\",\r\n      \"enum\": [\"draft\", \"active\", \"deprecated\", \"retired\"]\r\n    },\r\n    \"applies-to-version\": {\r\n      \"type\": \"string\",\r\n      \"description\": \"Software version or release this manual applies to (e.g. v1.0.0).\"\r\n    },\r\n    \"target-audience\": {\r\n      \"type\": \"array\",\r\n      \"items\": {\r\n        \"type\": \"string\"\r\n      },\r\n      \"minItems\": 1,\r\n      \"description\": \"Target user profiles or roles for the manual.\"\r\n    },\r\n    \"allowed-roles\": {\r\n      \"type\": \"array\",\r\n      \"items\": {\r\n        \"type\": \"string\"\r\n      },\r\n      \"minItems\": 1,\r\n      \"description\": \"Formal catalog of authorized roles to operate the application (linked to ACT-*).\"\r\n    },\r\n    \"journeys-covered\": {\r\n      \"type\": \"array\",\r\n      \"items\": {\r\n        \"type\": \"string\",\r\n        \"pattern\": \"^JRN-[A-Z0-9]+(-[A-Z0-9]+)*$\"\r\n      },\r\n      \"description\": \"Product journey identifiers (JRN-*) covered in the manual.\"\r\n    },\r\n    \"use-cases-covered\": {\r\n      \"type\": \"array\",\r\n      \"items\": {\r\n        \"type\": \"string\",\r\n        \"pattern\": \"^UC-[A-Z0-9]+(-[A-Z0-9]+)*$\"\r\n      },\r\n      \"description\": \"Use case identifiers (UC-*) implemented across journeys.\"\r\n    },\r\n    \"supersedes\": {\r\n      \"type\": [\"string\", \"null\"],\r\n      \"pattern\": \"^MAN-USER-[A-Z0-9]+(-[A-Z0-9]+)*$\"\r\n    },\r\n    \"superseded-by\": {\r\n      \"type\": [\"string\", \"null\"],\r\n      \"pattern\": \"^MAN-USER-[A-Z0-9]+(-[A-Z0-9]+)*$\"\r\n    }\r\n  },\r\n  \"additionalProperties\": false\r\n}\r\n";
@@ -1922,6 +2109,7 @@ declare const SCHEMA_SCHEMAS_PRIVACY_PRIVACY_POLICY_SCHEMA_JSON = "{\r\n  \"$sch
 declare const SCHEMA_SCHEMAS_PRIVACY_PRIVACY_REQ_SCHEMA_JSON = "{\r\n  \"$schema\": \"https://json-schema.org/draft/2020-12/schema\",\r\n  \"$id\": \"https://ai-sdlc.org/schemas/privacy/privacy-req.schema.json\",\r\n  \"title\": \"Privacy Requirement & Technical Control Schema (PRIV-REQ-*)\",\r\n  \"type\": \"object\",\r\n  \"required\": [\r\n    \"id\",\r\n    \"type\",\r\n    \"title\",\r\n    \"status\",\r\n    \"version\",\r\n    \"privacy-principle\",\r\n    \"linddun-category\",\r\n    \"governs-ropa\"\r\n  ],\r\n  \"properties\": {\r\n    \"id\": {\r\n      \"type\": \"string\",\r\n      \"pattern\": \"^PRIV-REQ-[A-Z0-9]+(-[A-Z0-9]+)*$\"\r\n    },\r\n    \"type\": {\r\n      \"type\": \"string\",\r\n      \"const\": \"privacy-requirement\"\r\n    },\r\n    \"version\": {\r\n      \"type\": \"string\",\r\n      \"pattern\": \"^[0-9]+\\\\.[0-9]+\\\\.[0-9]+(-[0-9A-Za-z.-]+)?$\",\r\n      \"description\": \"Privacy requirement semantic version (SemVer).\"\r\n    },\r\n    \"schema-version\": {\r\n      \"type\": \"string\"\r\n    },\r\n    \"title\": {\r\n      \"type\": \"string\",\r\n      \"minLength\": 3\r\n    },\r\n    \"status\": {\r\n      \"type\": \"string\",\r\n      \"enum\": [\"draft\", \"active\", \"deprecated\", \"retired\"]\r\n    },\r\n    \"privacy-principle\": {\r\n      \"type\": \"string\",\r\n      \"enum\": [\r\n        \"data-minimization\",\r\n        \"purpose-limitation\",\r\n        \"storage-limitation\",\r\n        \"accuracy\",\r\n        \"integrity-and-confidentiality\",\r\n        \"transparency-and-consent\",\r\n        \"data-subject-rights-arco\",\r\n        \"pseudonymization-anonymization\"\r\n      ]\r\n    },\r\n    \"linddun-category\": {\r\n      \"type\": \"string\",\r\n      \"enum\": [\r\n        \"linkability\",\r\n        \"identifiability\",\r\n        \"non-repudiation\",\r\n        \"detectability\",\r\n        \"disclosure-of-information\",\r\n        \"unawareness\",\r\n        \"non-compliance\"\r\n      ],\r\n      \"description\": \"LINDDUN privacy threat category mitigated by this control.\"\r\n    },\r\n    \"governs-ropa\": {\r\n      \"type\": \"array\",\r\n      \"minItems\": 1,\r\n      \"items\": {\r\n        \"type\": \"string\",\r\n        \"pattern\": \"^PRIV-ROPA-[A-Z0-9]+(-[A-Z0-9]+)*$\"\r\n      },\r\n      \"description\": \"Upstream ROPA records (PRIV-ROPA-*) governed by this privacy requirement.\"\r\n    },\r\n    \"protects-data-assets\": {\r\n      \"type\": \"array\",\r\n      \"items\": {\r\n        \"type\": \"string\",\r\n        \"pattern\": \"^DATA-ASSET-[A-Z0-9]+(-[A-Z0-9]+)*$\"\r\n      }\r\n    },\r\n    \"enforced-in-enclave\": {\r\n      \"type\": \"string\",\r\n      \"pattern\": \"^SEC-ENC-[A-Z0-9]+(-[A-Z0-9]+)*$\"\r\n    },\r\n    \"compliance-references\": {\r\n      \"type\": \"array\",\r\n      \"items\": {\r\n        \"type\": \"string\"\r\n      }\r\n    },\r\n    \"acceptance-format\": {\r\n      \"type\": \"string\",\r\n      \"enum\": [\"gherkin\", \"declarative-prose\"]\r\n    },\r\n    \"cucumber-tags\": {\r\n      \"type\": \"array\",\r\n      \"items\": {\r\n        \"type\": \"string\",\r\n        \"pattern\": \"^@[a-zA-Z0-9_-]+$\"\r\n      }\r\n    },\r\n    \"supersedes\": {\r\n      \"type\": [\"string\", \"null\"],\r\n      \"pattern\": \"^PRIV-REQ-[A-Z0-9]+(-[A-Z0-9]+)*$\"\r\n    },\r\n    \"superseded-by\": {\r\n      \"type\": [\"string\", \"null\"],\r\n      \"pattern\": \"^PRIV-REQ-[A-Z0-9]+(-[A-Z0-9]+)*$\"\r\n    }\r\n  },\r\n  \"additionalProperties\": false\r\n}\r\n";
 declare const SCHEMA_SCHEMAS_PRIVACY_PRIVACY_ROPA_SCHEMA_JSON = "{\r\n  \"$schema\": \"https://json-schema.org/draft/2020-12/schema\",\r\n  \"$id\": \"https://ai-sdlc.org/schemas/privacy/privacy-ropa.schema.json\",\r\n  \"title\": \"Record of Processing Activities Schema (PRIV-ROPA-* / GDPR Art. 30)\",\r\n  \"type\": \"object\",\r\n  \"required\": [\r\n    \"id\",\r\n    \"type\",\r\n    \"title\",\r\n    \"status\",\r\n    \"version\",\r\n    \"lawful-basis\",\r\n    \"processing-purpose\",\r\n    \"use-cases\",\r\n    \"data-assets\",\r\n    \"data-subjects\",\r\n    \"retention-ttl\"\r\n  ],\r\n  \"properties\": {\r\n    \"id\": {\r\n      \"type\": \"string\",\r\n      \"pattern\": \"^PRIV-ROPA-[A-Z0-9]+(-[A-Z0-9]+)*$\"\r\n    },\r\n    \"type\": {\r\n      \"type\": \"string\",\r\n      \"const\": \"privacy-ropa\"\r\n    },\r\n    \"version\": {\r\n      \"type\": \"string\",\r\n      \"pattern\": \"^[0-9]+\\\\.[0-9]+\\\\.[0-9]+(-[0-9A-Za-z.-]+)?$\",\r\n      \"description\": \"ROPA record semantic version (SemVer).\"\r\n    },\r\n    \"schema-version\": {\r\n      \"type\": \"string\"\r\n    },\r\n    \"title\": {\r\n      \"type\": \"string\",\r\n      \"minLength\": 3\r\n    },\r\n    \"status\": {\r\n      \"type\": \"string\",\r\n      \"enum\": [\"draft\", \"active\", \"deprecated\", \"retired\"]\r\n    },\r\n    \"lawful-basis\": {\r\n      \"type\": \"string\",\r\n      \"enum\": [\r\n        \"consent\",\r\n        \"contract\",\r\n        \"legal-obligation\",\r\n        \"vital-interests\",\r\n        \"public-task\",\r\n        \"legitimate-interests\"\r\n      ],\r\n      \"description\": \"Lawful basis for processing under GDPR Art. 6.1.\"\r\n    },\r\n    \"special-category-condition\": {\r\n      \"type\": [\"string\", \"null\"],\r\n      \"enum\": [\r\n        null,\r\n        \"explicit-consent\",\r\n        \"employment-social-security\",\r\n        \"vital-interests\",\r\n        \"public-interest\",\r\n        \"preventive-medicine\",\r\n        \"public-health\"\r\n      ],\r\n      \"description\": \"GDPR Art. 9.2 condition when processing special category data.\"\r\n    },\r\n    \"processing-purpose\": {\r\n      \"type\": \"string\",\r\n      \"minLength\": 10\r\n    },\r\n    \"use-cases\": {\r\n      \"type\": \"array\",\r\n      \"minItems\": 1,\r\n      \"items\": {\r\n        \"type\": \"string\",\r\n        \"pattern\": \"^UC-[A-Z0-9]+(-[A-Z0-9]+)*$\"\r\n      },\r\n      \"description\": \"Upstream Use Cases (UC-*) that trigger this data processing activity.\"\r\n    },\r\n    \"data-assets\": {\r\n      \"type\": \"array\",\r\n      \"minItems\": 1,\r\n      \"items\": {\r\n        \"type\": \"string\",\r\n        \"pattern\": \"^DATA-ASSET-[A-Z0-9]+(-[A-Z0-9]+)*$\"\r\n      },\r\n      \"description\": \"Personal Data Assets (DATA-ASSET-*) processed in this activity.\"\r\n    },\r\n    \"data-subjects\": {\r\n      \"type\": \"array\",\r\n      \"minItems\": 1,\r\n      \"items\": {\r\n        \"type\": \"string\",\r\n        \"pattern\": \"^ACT-[A-Z0-9]+(-[A-Z0-9]+)*$\"\r\n      }\r\n    },\r\n    \"retention-ttl\": {\r\n      \"type\": \"string\",\r\n      \"pattern\": \"^([0-9]+(d|m|y)|session-only|indefinite-anonymized)$\"\r\n    },\r\n    \"cross-border-transfer\": {\r\n      \"type\": \"boolean\"\r\n    },\r\n    \"transfer-safeguards\": {\r\n      \"type\": [\"string\", \"null\"],\r\n      \"enum\": [null, \"adequacy-decision\", \"scc\", \"bcr\", \"derogation\"]\r\n    },\r\n    \"subprocessors\": {\r\n      \"type\": \"array\",\r\n      \"items\": {\r\n        \"type\": \"string\"\r\n      }\r\n    },\r\n    \"dpia-required\": {\r\n      \"type\": \"boolean\"\r\n    },\r\n    \"dpia-reference\": {\r\n      \"type\": [\"string\", \"null\"],\r\n      \"pattern\": \"^DPIA-[A-Z0-9]+(-[A-Z0-9]+)*$\"\r\n    },\r\n    \"mitigated-by\": {\r\n      \"type\": \"array\",\r\n      \"items\": {\r\n        \"type\": \"string\",\r\n        \"pattern\": \"^PRIV-REQ-[A-Z0-9]+(-[A-Z0-9]+)*$\"\r\n      },\r\n      \"description\": \"Privacy requirements (PRIV-REQ-*) governing and enforcing this processing activity.\"\r\n    },\r\n    \"supersedes\": {\r\n      \"type\": [\"string\", \"null\"],\r\n      \"pattern\": \"^PRIV-ROPA-[A-Z0-9]+(-[A-Z0-9]+)*$\"\r\n    },\r\n    \"superseded-by\": {\r\n      \"type\": [\"string\", \"null\"],\r\n      \"pattern\": \"^PRIV-ROPA-[A-Z0-9]+(-[A-Z0-9]+)*$\"\r\n    }\r\n  },\r\n  \"additionalProperties\": false\r\n}\r\n";
 declare const SCHEMA_SCHEMAS_PRODUCT_ACTOR_SCHEMA_JSON = "{\r\n  \"$schema\": \"https://json-schema.org/draft/2020-12/schema\",\r\n  \"$id\": \"https://ai-sdlc.org/schemas/product/actor.schema.json\",\r\n  \"title\": \"ProductShape Actor Schema (Versionable)\",\r\n  \"type\": \"object\",\r\n  \"required\": [\"id\", \"type\", \"title\", \"status\", \"version\", \"role-type\"],\r\n  \"properties\": {\r\n    \"id\": {\r\n      \"type\": \"string\",\r\n      \"pattern\": \"^ACT-[A-Z0-9]+(-[A-Z0-9]+)*$\"\r\n    },\r\n    \"type\": {\r\n      \"type\": \"string\",\r\n      \"const\": \"actor\"\r\n    },\r\n    \"version\": {\r\n      \"type\": \"string\",\r\n      \"pattern\": \"^[0-9]+\\\\.[0-9]+\\\\.[0-9]+(-[0-9A-Za-z.-]+)?$\",\r\n      \"description\": \"Artifact semantic version (SemVer).\"\r\n    },\r\n    \"schema-version\": {\r\n      \"type\": \"string\",\r\n      \"description\": \"Schema specification version used.\"\r\n    },\r\n    \"title\": {\r\n      \"type\": \"string\",\r\n      \"minLength\": 3\r\n    },\r\n    \"status\": {\r\n      \"type\": \"string\",\r\n      \"enum\": [\"draft\", \"active\", \"deprecated\", \"retired\"]\r\n    },\r\n    \"role-type\": {\r\n      \"type\": \"string\",\r\n      \"enum\": [\"human-user\", \"ai-agent\", \"external-system\", \"sensor-iot\"]\r\n    },\r\n    \"description\": {\r\n      \"type\": \"string\"\r\n    },\r\n    \"supersedes\": {\r\n      \"type\": [\"string\", \"null\"],\r\n      \"pattern\": \"^ACT-[A-Z0-9]+(-[A-Z0-9]+)*$\",\r\n      \"description\": \"Identifier of the actor superseded by this version or artifact.\"\r\n    },\r\n    \"superseded-by\": {\r\n      \"type\": [\"string\", \"null\"],\r\n      \"pattern\": \"^ACT-[A-Z0-9]+(-[A-Z0-9]+)*$\",\r\n      \"description\": \"Identifier of the new actor superseding this one upon deprecation/retirement.\"\r\n    }\r\n  },\r\n  \"additionalProperties\": false\r\n}\r\n";
+declare const SCHEMA_SCHEMAS_PRODUCT_BOUNDED_CONTEXT_SCHEMA_JSON = "{\n  \"$schema\": \"https://json-schema.org/draft/2020-12/schema\",\n  \"$id\": \"https://ai-sdlc.org/schemas/product/bounded-context.schema.json\",\n  \"title\": \"Domain-Driven Design (DDD) Bounded Context Schema\",\n  \"type\": \"object\",\n  \"required\": [\n    \"id\",\n    \"type\",\n    \"title\",\n    \"status\",\n    \"version\",\n    \"domain-type\",\n    \"responsibilities\"\n  ],\n  \"properties\": {\n    \"id\": {\n      \"type\": \"string\",\n      \"pattern\": \"^BC-[A-Z0-9]+(-[A-Z0-9]+)*$\",\n      \"description\": \"Immutable Bounded Context identifier (e.g. BC-AI-SDLC-GOVERNANCE).\"\n    },\n    \"type\": {\n      \"type\": \"string\",\n      \"const\": \"bounded-context\"\n    },\n    \"version\": {\n      \"type\": \"string\",\n      \"pattern\": \"^[0-9]+\\\\.[0-9]+\\\\.[0-9]+(-[0-9A-Za-z.-]+)?$\",\n      \"description\": \"Bounded context document semantic version (SemVer).\"\n    },\n    \"schema-version\": {\n      \"type\": \"string\",\n      \"description\": \"Template schema version.\"\n    },\n    \"title\": {\n      \"type\": \"string\",\n      \"minLength\": 3,\n      \"description\": \"Descriptive title of the Bounded Context.\"\n    },\n    \"status\": {\n      \"type\": \"string\",\n      \"enum\": [\"draft\", \"active\", \"deprecated\", \"retired\"]\n    },\n    \"domain-type\": {\n      \"type\": \"string\",\n      \"enum\": [\"core\", \"supporting\", \"generic\"],\n      \"description\": \"DDD subdomain classification: core differentiator, supporting capability, or generic commodity.\"\n    },\n    \"strategic-classification\": {\n      \"type\": \"object\",\n      \"properties\": {\n        \"evolutionary-stage\": {\n          \"type\": \"string\",\n          \"enum\": [\"genesis\", \"custom-built\", \"product-rental\", \"commodity\"]\n        },\n        \"business-model-role\": {\n          \"type\": \"string\",\n          \"enum\": [\"differentiator\", \"operational\", \"enabler\"]\n        }\n      },\n      \"additionalProperties\": false\n    },\n    \"responsibilities\": {\n      \"type\": \"array\",\n      \"items\": {\n        \"type\": \"string\",\n        \"minLength\": 3\n      },\n      \"minItems\": 1,\n      \"description\": \"List of functional boundaries and core domain responsibilities encapsulated within this context.\"\n    },\n    \"ubiquitous-language-terms\": {\n      \"type\": \"array\",\n      \"items\": {\n        \"type\": \"string\",\n        \"pattern\": \"^TERM-[A-Z0-9]+(-[A-Z0-9]+)*$\"\n      },\n      \"description\": \"Ubiquitous language terms (TERM-*) governed within this bounded context.\"\n    },\n    \"context-mapping\": {\n      \"type\": \"object\",\n      \"properties\": {\n        \"upstream-dependencies\": {\n          \"type\": \"array\",\n          \"items\": {\n            \"type\": \"string\"\n          }\n        },\n        \"downstream-dependents\": {\n          \"type\": \"array\",\n          \"items\": {\n            \"type\": \"string\"\n          }\n        },\n        \"integration-patterns\": {\n          \"type\": \"array\",\n          \"items\": {\n            \"type\": \"object\",\n            \"properties\": {\n              \"pattern\": {\n                \"type\": \"string\"\n              },\n              \"related-context\": {\n                \"type\": \"string\"\n              }\n            },\n            \"additionalProperties\": false\n          }\n        }\n      },\n      \"additionalProperties\": false\n    },\n    \"components-involved\": {\n      \"type\": \"array\",\n      \"items\": {\n        \"type\": \"string\",\n        \"pattern\": \"^CMP-[A-Z0-9]+(-[A-Z0-9]+)*$\"\n      },\n      \"description\": \"Architecture components (CMP-*) implementing this bounded context.\"\n    },\n    \"supersedes\": {\n      \"type\": [\"string\", \"null\"],\n      \"pattern\": \"^BC-[A-Z0-9]+(-[A-Z0-9]+)*$\"\n    },\n    \"superseded-by\": {\n      \"type\": [\"string\", \"null\"],\n      \"pattern\": \"^BC-[A-Z0-9]+(-[A-Z0-9]+)*$\"\n    }\n  },\n  \"additionalProperties\": false\n}\n";
 declare const SCHEMA_SCHEMAS_PRODUCT_BUSINESS_RULE_SCHEMA_JSON = "{\r\n  \"$schema\": \"https://json-schema.org/draft/2020-12/schema\",\r\n  \"$id\": \"https://ai-sdlc.org/schemas/product/business-rule.schema.json\",\r\n  \"title\": \"ProductShape Business Rule Schema (Versionable)\",\r\n  \"type\": \"object\",\r\n  \"required\": [\"id\", \"type\", \"title\", \"status\", \"version\", \"enforcement-level\"],\r\n  \"properties\": {\r\n    \"id\": {\r\n      \"type\": \"string\",\r\n      \"pattern\": \"^BR-[A-Z0-9]+(-[A-Z0-9]+)*$\"\r\n    },\r\n    \"type\": {\r\n      \"type\": \"string\",\r\n      \"const\": \"business-rule\"\r\n    },\r\n    \"version\": {\r\n      \"type\": \"string\",\r\n      \"pattern\": \"^[0-9]+\\\\.[0-9]+\\\\.[0-9]+(-[0-9A-Za-z.-]+)?$\",\r\n      \"description\": \"Business rule semantic version (SemVer).\"\r\n    },\r\n    \"schema-version\": {\r\n      \"type\": \"string\"\r\n    },\r\n    \"title\": {\r\n      \"type\": \"string\",\r\n      \"minLength\": 3\r\n    },\r\n    \"status\": {\r\n      \"type\": \"string\",\r\n      \"enum\": [\"draft\", \"active\", \"deprecated\", \"retired\"]\r\n    },\r\n    \"enforcement-level\": {\r\n      \"type\": \"string\",\r\n      \"enum\": [\"strict-invariant\", \"override-with-approval\", \"guideline\"]\r\n    },\r\n    \"defined-in\": {\r\n      \"type\": \"string\",\r\n      \"pattern\": \"^BC-[A-Z0-9]+(-[A-Z0-9]+)*$\"\r\n    },\r\n    \"uses-terms\": {\r\n      \"type\": \"array\",\r\n      \"items\": {\r\n        \"type\": \"string\",\r\n        \"pattern\": \"^TERM-[A-Z0-9]+(-[A-Z0-9]+)*$\"\r\n      }\r\n    },\r\n    \"supersedes\": {\r\n      \"type\": [\"string\", \"null\"],\r\n      \"pattern\": \"^BR-[A-Z0-9]+(-[A-Z0-9]+)*$\"\r\n    },\r\n    \"superseded-by\": {\r\n      \"type\": [\"string\", \"null\"],\r\n      \"pattern\": \"^BR-[A-Z0-9]+(-[A-Z0-9]+)*$\"\r\n    }\r\n  },\r\n  \"additionalProperties\": false\r\n}\r\n";
 declare const SCHEMA_SCHEMAS_PRODUCT_JOURNEY_SCHEMA_JSON = "{\r\n  \"$schema\": \"https://json-schema.org/draft/2020-12/schema\",\r\n  \"$id\": \"https://ai-sdlc.org/schemas/product/journey.schema.json\",\r\n  \"title\": \"Customer / Operator Journey Schema\",\r\n  \"type\": \"object\",\r\n  \"required\": [\r\n    \"id\",\r\n    \"type\",\r\n    \"title\",\r\n    \"status\",\r\n    \"version\",\r\n    \"persona\",\r\n    \"stages\",\r\n    \"touchpoints\"\r\n  ],\r\n  \"properties\": {\r\n    \"id\": {\r\n      \"type\": \"string\",\r\n      \"pattern\": \"^JRN-[A-Z0-9]+(-[A-Z0-9]+)*$\"\r\n    },\r\n    \"type\": {\r\n      \"type\": \"string\",\r\n      \"const\": \"journey\"\r\n    },\r\n    \"version\": {\r\n      \"type\": \"string\",\r\n      \"pattern\": \"^[0-9]+\\\\.[0-9]+\\\\.[0-9]+(-[0-9A-Za-z.-]+)?$\",\r\n      \"description\": \"Journey semantic version (SemVer).\"\r\n    },\r\n    \"schema-version\": {\r\n      \"type\": \"string\"\r\n    },\r\n    \"title\": {\r\n      \"type\": \"string\",\r\n      \"minLength\": 3\r\n    },\r\n    \"status\": {\r\n      \"type\": \"string\",\r\n      \"enum\": [\"draft\", \"active\", \"deprecated\", \"retired\"]\r\n    },\r\n    \"persona\": {\r\n      \"type\": \"string\",\r\n      \"pattern\": \"^ACT-[A-Z0-9]+(-[A-Z0-9]+)*$\",\r\n      \"description\": \"Actor (persona) starring in this journey.\"\r\n    },\r\n    \"stages\": {\r\n      \"type\": \"array\",\r\n      \"minItems\": 1,\r\n      \"items\": {\r\n        \"type\": \"string\"\r\n      },\r\n      \"description\": \"Sequential journey stages (e.g. Awareness, Onboarding, Activation, Retention).\"\r\n    },\r\n    \"touchpoints\": {\r\n      \"type\": \"array\",\r\n      \"minItems\": 1,\r\n      \"items\": {\r\n        \"type\": \"string\"\r\n      },\r\n      \"description\": \"Touchpoints between persona and system at each stage.\"\r\n    },\r\n    \"related-use-cases\": {\r\n      \"type\": \"array\",\r\n      \"items\": {\r\n        \"type\": \"string\",\r\n        \"pattern\": \"^UC-[A-Z0-9]+(-[A-Z0-9]+)*$\"\r\n      },\r\n      \"description\": \"System use cases related to this journey.\"\r\n    },\r\n    \"pain-points\": {\r\n      \"type\": \"array\",\r\n      \"items\": {\r\n        \"type\": \"string\"\r\n      },\r\n      \"description\": \"Frictions or issues detected along the user journey.\"\r\n    },\r\n    \"supersedes\": {\r\n      \"type\": [\"string\", \"null\"]\r\n    },\r\n    \"superseded-by\": {\r\n      \"type\": [\"string\", \"null\"]\r\n    }\r\n  },\r\n  \"additionalProperties\": false\r\n}\r\n";
 declare const SCHEMA_SCHEMAS_PRODUCT_REQUIREMENT_SCHEMA_JSON = "{\r\n  \"$schema\": \"https://json-schema.org/draft/2020-12/schema\",\r\n  \"$id\": \"https://ai-sdlc.org/schemas/product/requirement.schema.json\",\r\n  \"title\": \"ProductShape Requirement Schema (Strict Test Validation Enforced)\",\r\n  \"type\": \"object\",\r\n  \"required\": [\"id\", \"type\", \"title\", \"status\", \"version\", \"category\", \"derives-from\", \"verifiable-by\"],\r\n  \"properties\": {\r\n    \"id\": {\r\n      \"type\": \"string\",\r\n      \"pattern\": \"^(FR|QR|CON)-[A-Z0-9]+(-[A-Z0-9]+)*$\"\r\n    },\r\n    \"type\": {\r\n      \"type\": \"string\",\r\n      \"const\": \"requirement\"\r\n    },\r\n    \"version\": {\r\n      \"type\": \"string\",\r\n      \"pattern\": \"^[0-9]+\\\\.[0-9]+\\\\.[0-9]+(-[0-9A-Za-z.-]+)?$\",\r\n      \"description\": \"Requirement semantic version (SemVer).\"\r\n    },\r\n    \"schema-version\": {\r\n      \"type\": \"string\"\r\n    },\r\n    \"title\": {\r\n      \"type\": \"string\",\r\n      \"minLength\": 3\r\n    },\r\n    \"status\": {\r\n      \"type\": \"string\",\r\n      \"enum\": [\"draft\", \"active\", \"deprecated\", \"retired\"]\r\n    },\r\n    \"category\": {\r\n      \"type\": \"string\",\r\n      \"enum\": [\"functional\", \"quality\", \"constraint\"]\r\n    },\r\n    \"derives-from\": {\r\n      \"type\": \"array\",\r\n      \"minItems\": 1,\r\n      \"items\": {\r\n        \"type\": \"string\",\r\n        \"pattern\": \"^(UC|BR|CON|CAP|GOAL)-[A-Z0-9]+(-[A-Z0-9]+)*$\"\r\n      },\r\n      \"description\": \"Product Traceability: Origin Use Cases, Rules, Constraints, or Capabilities.\"\r\n    },\r\n    \"verifiable-by\": {\r\n      \"type\": \"string\",\r\n      \"enum\": [\"cucumber-bdd\", \"automated-unit-test\", \"integration-test\", \"performance-benchmark\", \"security-audit\", \"inspection\"],\r\n      \"description\": \"Mandatory formal verification method.\"\r\n    },\r\n    \"acceptance-format\": {\r\n      \"type\": \"string\",\r\n      \"enum\": [\"gherkin\", \"declarative-prose\"],\r\n      \"description\": \"Acceptance criteria format.\"\r\n    },\r\n    \"cucumber-tags\": {\r\n      \"type\": \"array\",\r\n      \"items\": {\r\n        \"type\": \"string\",\r\n        \"pattern\": \"^@[a-zA-Z0-9_-]+$\"\r\n      },\r\n      \"description\": \"Cucumber tags for filtering and executing BDD tests.\"\r\n    },\r\n    \"enforce-bdd-variants\": {\r\n      \"type\": \"boolean\",\r\n      \"description\": \"When true, enforces all 3 BDD scenario categories (@nominal, @boundary, @invalid).\"\r\n    },\r\n    \"supersedes\": {\r\n      \"type\": [\"string\", \"null\"],\r\n      \"pattern\": \"^(FR|QR|CON)-[A-Z0-9]+(-[A-Z0-9]+)*$\"\r\n    },\r\n    \"superseded-by\": {\r\n      \"type\": [\"string\", \"null\"],\r\n      \"pattern\": \"^(FR|QR|CON)-[A-Z0-9]+(-[A-Z0-9]+)*$\"\r\n    }\r\n  },\r\n  \"additionalProperties\": false\r\n}\r\n";
@@ -1958,15 +2146,16 @@ declare const STARTER_TEMPLATES_CI_BITBUCKET_PIPELINES_YML = "# ================
 declare const STARTER_TEMPLATES_CI_GITHUB_WORKFLOWS_CI_YML = "name: CI - AI-SDLC Quality Gates & Testing\r\n\r\non:\r\n  push:\r\n    branches: [ main ]\r\n  pull_request:\r\n    branches: [ main ]\r\n\r\njobs:\r\n  verify-and-test:\r\n    runs-on: ubuntu-latest\r\n    strategy:\r\n      matrix:\r\n        node-version: [ 18.x, 20.x, 22.x ]\r\n\r\n    steps:\r\n      - name: Checkout Code\r\n        uses: actions/checkout@v4\r\n\r\n      - name: Install pnpm\r\n        uses: pnpm/action-setup@v4\r\n        with:\r\n          version: 10\r\n\r\n      - name: Setup Node.js ${{ matrix.node-version }}\r\n        uses: actions/setup-node@v4\r\n        with:\r\n          node-version: ${{ matrix.node-version }}\r\n\r\n      - name: Install Dependencies\r\n        run: |\r\n          pnpm install --frozen-lockfile\r\n          pnpm approve-builds --all\r\n\r\n      - name: Build Packages\r\n        run: pnpm run build\r\n\r\n      - name: Run Vitest Unit & Integration Suites\r\n        run: pnpm test\r\n\r\n      - name: AI-SDLC Quality Gate & Full Verification\r\n        run: npx @aisdlc/cli verify all\r\n";
 declare const STARTER_TEMPLATES_CI_GITHUB_WORKFLOWS_DEPLOY_DASHBOARD_YML = "name: Deploy AI-SDLC Dashboard to GitHub Pages\r\n\r\non:\r\n  push:\r\n    branches:\r\n      - main\r\n  workflow_dispatch:\r\n\r\npermissions:\r\n  contents: read\r\n  pages: write\r\n  id-token: write\r\n\r\nconcurrency:\r\n  group: pages\r\n  cancel-in-progress: false\r\n\r\njobs:\r\n  deploy-dashboard:\r\n    name: Build & Publish Interactive Dashboard\r\n    runs-on: ubuntu-latest\r\n    environment:\r\n      name: github-pages\r\n      url: ${{ steps.deployment.outputs.page_url }}\r\n\r\n    steps:\r\n      - name: Checkout Code\r\n        uses: actions/checkout@v4\r\n        with:\r\n          fetch-depth: 0 # Full git history required for historical KPIs and telemetry\r\n\r\n      - name: Setup Node.js\r\n        uses: actions/setup-node@v4\r\n        with:\r\n          node-version: 20\r\n\r\n      - name: Generate AI-SDLC Interactive Dashboard\r\n        run: |\r\n          mkdir -p reports\r\n          npx --yes @aisdlc/cli report dashboard --output reports/index.html\r\n          cp reports/index.html reports/dashboard.html\r\n          touch reports/.nojekyll\r\n\r\n      - name: Setup GitHub Pages\r\n        uses: actions/configure-pages@v5\r\n\r\n      - name: Upload Pages Artifact\r\n        uses: actions/upload-pages-artifact@v3\r\n        with:\r\n          path: reports\r\n\r\n      - name: Deploy to GitHub Pages\r\n        id: deployment\r\n        uses: actions/deploy-pages@v4\r\n\r\n      - name: Emit Summary to GitHub Actions\r\n        if: always() && steps.deployment.outcome == 'success'\r\n        run: |\r\n          echo \"### \uD83C\uDF10 AI-SDLC Interactive Dashboard Published\" >> $GITHUB_STEP_SUMMARY\r\n          echo \"\" >> $GITHUB_STEP_SUMMARY\r\n          echo \"The interactive PDaC / RTM graph, Quality Gate telemetry, and release metrics are live at:\" >> $GITHUB_STEP_SUMMARY\r\n          echo \"\" >> $GITHUB_STEP_SUMMARY\r\n          echo \"\uD83D\uDC49 **[Open Live Dashboard](${{ steps.deployment.outputs.page_url }})**\" >> $GITHUB_STEP_SUMMARY\r\n";
 declare const STARTER_TEMPLATES_CI_GITHUB_WORKFLOWS_PR_KPI_SUMMARY_YML = "name: AI-SDLC PR KPI Aggregator\r\n\r\non:\r\n  pull_request:\r\n    types: [opened, synchronize, reopened]\r\n\r\npermissions:\r\n  contents: read\r\n  pull-requests: write\r\n\r\njobs:\r\n  aggregate-kpis:\r\n    name: Aggregate PR KPIs & Telemetry\r\n    runs-on: ubuntu-latest\r\n\r\n    steps:\r\n      - name: Checkout Repository\r\n        uses: actions/checkout@v4\r\n        with:\r\n          fetch-depth: 0\r\n\r\n      - name: Install pnpm\r\n        uses: pnpm/action-setup@v4\r\n        with:\r\n          version: 10\r\n\r\n      - name: Setup Node.js\r\n        uses: actions/setup-node@v4\r\n        with:\r\n          node-version: 20\r\n\r\n      - name: Install Dependencies\r\n        run: |\r\n          pnpm install --frozen-lockfile\r\n\r\n      - name: Calculate and Emit PR KPIs\r\n        id: kpi\r\n        run: |\r\n          npx @aisdlc/cli kpi pr --base origin/${{ github.base_ref }} --head HEAD >> $GITHUB_STEP_SUMMARY\r\n";
-declare const STARTER_TEMPLATES_CI_GITHUB_WORKFLOWS_SDD_INTEGRATE_ON_MERGE_YML = "name: SDD Canonical Integration on Merge\n\non:\n  pull_request:\n    types: [closed]\n    branches:\n      - main\n      - 'release/**'\n  workflow_dispatch:\n    inputs:\n      change_id:\n        description: 'SDD change ID to integrate manually (e.g. chg-001-telemetry)'\n        required: false\n        type: string\n\npermissions:\n  contents: write\n  pull-requests: read\n\nconcurrency:\n  group: sdd-integrate-${{ github.event.pull_request.base.ref || github.ref_name }}\n  cancel-in-progress: false\n\njobs:\n  integrate-sdd:\n    name: SDD Canonical Integration\n    if: github.event.pull_request.merged == true || github.event_name == 'workflow_dispatch'\n    runs-on: ubuntu-latest\n\n    steps:\n      - name: Checkout Repository\n        uses: actions/checkout@v4\n        with:\n          ref: ${{ github.event.pull_request.base.ref || github.ref_name }}\n          fetch-depth: 0\n          token: ${{ secrets.GITHUB_TOKEN }}\n\n      - name: Install pnpm\n        uses: pnpm/action-setup@v4\n        with:\n          version: 10\n\n      - name: Setup Node.js\n        uses: actions/setup-node@v4\n        with:\n          node-version: 20\n\n      - name: Install Dependencies\n        run: |\n          pnpm install --frozen-lockfile\n          pnpm approve-builds --all\n\n      - name: Build Packages\n        run: pnpm run build\n\n      - name: Detect and Integrate SDD Change\n        id: integrate\n        env:\n          PR_HEAD_REF: ${{ github.event.pull_request.head.ref }}\n          PR_TITLE: ${{ github.event.pull_request.title }}\n          PR_BODY: ${{ github.event.pull_request.body }}\n          MANUAL_CHANGE_ID: ${{ github.event.inputs.change_id }}\n        run: |\n          npx @aisdlc/cli sdd integrate --auto || true\n\n      - name: Commit and Push Canonical Baseline Changes\n        run: |\n          git config user.name \"github-actions[bot]\"\n          git config user.email \"github-actions[bot]@users.noreply.github.com\"\n          git add -A\n          if ! git diff --cached --quiet; then\n            git commit -m \"chore(sdd): integrate changes into canonical baseline [skip ci]\"\n            TARGET_BRANCH=\"${{ github.event.pull_request.base.ref || github.ref_name }}\"\n            MAX_RETRIES=3\n            RETRY_COUNT=0\n            DELAY=2\n\n            while [ $RETRY_COUNT -lt $MAX_RETRIES ]; do\n              echo \"Synchronizing with remote branch $TARGET_BRANCH (pull --rebase)...\"\n              git pull --rebase origin \"$TARGET_BRANCH\"\n              if git push origin \"$TARGET_BRANCH\"; then\n                echo \"\u2714 Canonical integration committed and synchronized to repository.\"\n                exit 0\n              fi\n              RETRY_COUNT=$((RETRY_COUNT + 1))\n              if [ $RETRY_COUNT -lt $MAX_RETRIES ]; then\n                echo \"\u26A0 Push rejected (concurrency detected). Retrying in ${DELAY}s (attempt $RETRY_COUNT/$MAX_RETRIES)...\"\n                sleep $DELAY\n                DELAY=$((DELAY * 2))\n              fi\n            done\n\n            echo \"\u274C Error: Failed to push canonical integration after $MAX_RETRIES attempts.\"\n            exit 1\n          else\n            echo \"\u2139 No pending changes generated in working tree.\"\n          fi\n";
+declare const STARTER_TEMPLATES_CI_GITHUB_WORKFLOWS_SDD_INTEGRATE_ON_MERGE_YML = "name: SDD Canonical Integration on Merge\r\n\r\non:\r\n  pull_request:\r\n    types: [closed]\r\n    branches:\r\n      - main\r\n      - 'release/**'\r\n  workflow_dispatch:\r\n    inputs:\r\n      change_id:\r\n        description: 'SDD change ID to integrate manually (e.g. chg-001-telemetry)'\r\n        required: false\r\n        type: string\r\n\r\npermissions:\r\n  contents: write\r\n  pull-requests: read\r\n\r\nconcurrency:\r\n  group: sdd-integrate-${{ github.event.pull_request.base.ref || github.ref_name }}\r\n  cancel-in-progress: false\r\n\r\njobs:\r\n  integrate-sdd:\r\n    name: SDD Canonical Integration\r\n    if: github.event.pull_request.merged == true || github.event_name == 'workflow_dispatch'\r\n    runs-on: ubuntu-latest\r\n\r\n    steps:\r\n      - name: Checkout Repository\r\n        uses: actions/checkout@v4\r\n        with:\r\n          ref: ${{ github.event.pull_request.base.ref || github.ref_name }}\r\n          fetch-depth: 0\r\n          token: ${{ secrets.GITHUB_TOKEN }}\r\n\r\n      - name: Install pnpm\r\n        uses: pnpm/action-setup@v4\r\n        with:\r\n          version: 10\r\n\r\n      - name: Setup Node.js\r\n        uses: actions/setup-node@v4\r\n        with:\r\n          node-version: 20\r\n\r\n      - name: Install Dependencies\r\n        run: |\r\n          pnpm install --frozen-lockfile\r\n          pnpm approve-builds --all\r\n\r\n      - name: Build Packages\r\n        run: pnpm run build\r\n\r\n      - name: Detect and Integrate SDD Change\r\n        id: integrate\r\n        env:\r\n          PR_HEAD_REF: ${{ github.event.pull_request.head.ref }}\r\n          PR_TITLE: ${{ github.event.pull_request.title }}\r\n          PR_BODY: ${{ github.event.pull_request.body }}\r\n          MANUAL_CHANGE_ID: ${{ github.event.inputs.change_id }}\r\n        run: |\r\n          npx @aisdlc/cli sdd integrate --auto || true\r\n\r\n      - name: Commit and Push Canonical Baseline Changes\r\n        run: |\r\n          git config user.name \"github-actions[bot]\"\r\n          git config user.email \"github-actions[bot]@users.noreply.github.com\"\r\n          git add -A\r\n          if ! git diff --cached --quiet; then\r\n            git commit -m \"chore(sdd): integrate changes into canonical baseline [skip ci]\"\r\n            TARGET_BRANCH=\"${{ github.event.pull_request.base.ref || github.ref_name }}\"\r\n            MAX_RETRIES=3\r\n            RETRY_COUNT=0\r\n            DELAY=2\r\n\r\n            while [ $RETRY_COUNT -lt $MAX_RETRIES ]; do\r\n              echo \"Synchronizing with remote branch $TARGET_BRANCH (pull --rebase)...\"\r\n              git pull --rebase origin \"$TARGET_BRANCH\"\r\n              if git push origin \"$TARGET_BRANCH\"; then\r\n                echo \"\u2714 Canonical integration committed and synchronized to repository.\"\r\n                exit 0\r\n              fi\r\n              RETRY_COUNT=$((RETRY_COUNT + 1))\r\n              if [ $RETRY_COUNT -lt $MAX_RETRIES ]; then\r\n                echo \"\u26A0 Push rejected (concurrency detected). Retrying in ${DELAY}s (attempt $RETRY_COUNT/$MAX_RETRIES)...\"\r\n                sleep $DELAY\r\n                DELAY=$((DELAY * 2))\r\n              fi\r\n            done\r\n\r\n            echo \"\u274C Error: Failed to push canonical integration after $MAX_RETRIES attempts.\"\r\n            exit 1\r\n          else\r\n            echo \"\u2139 No pending changes generated in working tree.\"\r\n          fi\r\n";
 declare const STARTER_TEMPLATES_COMPLIANCE_COMMERCIAL_ACQUISITION_REQUEST_TEMPLATE_MD = "---\r\nid: REQ-LIC-ACQUISITION-001\r\ntype: license-acquisition-request\r\ntitle: Commercial License Acquisition Request for [Library]\r\nstatus: pending-approval # pending-approval, approved, rejected\r\nrequested-package: \"@vendor/commercial-package\"\r\nspdx-license: \"BSL-1.1\" # or Commercial, SSPL-1.0\r\nlicense-category: commercial_acquisition_required\r\nestimated-cost: \"$1,200 / year\"\r\nbusiness-justification: \"Accelerates critical telemetry module development avoiding 4 months of in-house implementation.\"\r\n---\r\n\r\n# Commercial License Acquisition Request\r\n\r\n## 1. Package and Vendor\r\n- **Package**: `@vendor/commercial-package`\r\n- **Version**: `2.4.0`\r\n- **License Type**: BSL 1.1 / Commercial\r\n- **Official Website**: `https://vendor.example.com`\r\n\r\n## 2. Technical Justification and Evaluated Alternatives\r\n- **Why a permissive alternative (MIT/Apache 2.0) is not used**:\r\n  - Open-source alternatives lack required hardware encryption protocol support.\r\n- **Impact of not acquiring the license**:\r\n  - 4-month delay on product delivery milestone.\r\n\r\n## 3. Human Authorization Signatures\r\n- [ ] Tech Lead: Technical approval\r\n- [ ] Legal / IP Counsel: EULA clauses validation\r\n- [ ] Procurement / Budget Owner: Payment authorization\r\n";
-declare const STARTER_TEMPLATES_MANUALS_PRODUCTION_MANUAL_TEMPLATE_MD = "---\r\nid: MAN-PROD-001\r\ntype: production-manual\r\ntitle: \"Production & Operations Manual: Application Name\"\r\nstatus: draft\r\nversion: \"1.0.0\"\r\nschema-version: \"1.0\"\r\napplies-to-version: \"v1.0.0\"\r\ntarget-audience:\r\n  - devops-engineer\r\n  - sre-engineer\r\n  - release-manager\r\n  - secops\r\ncomponents-covered:\r\n  - CMP-NAME-001\r\nenclaves-involved:\r\n  - SEC-ENC-DMZ-001\r\nsupersedes: null\r\nsuperseded-by: null\r\n---\r\n\r\n# MAN-PROD-001: Production & Operations Manual - Application Name\r\n\r\n## 1. Deterministic Release Regeneration (Reproducible Builds)\r\n\r\nThis section contains the specifications and directives required to deterministically reproduce identical bit-by-bit application artifacts or releases from their Git tag.\r\n\r\n### 1.1 Source Code Baseline\r\n\r\n- **Canonical Repository**: `https://github.com/organization/repo-name.git`\r\n- **Immutable Git Release Tag**: `v1.0.0`\r\n- **Commit SHA-256 / SHA-1**: `[VERIFIED_HEXADECIMAL_COMMIT_SHA]`\r\n- **Clean Checkout Command**:\r\n  ```bash\r\n  git clone --recurse-submodules https://github.com/organization/repo-name.git\r\n  cd repo-name\r\n  git checkout tags/v1.0.0\r\n  git submodule update --init --recursive\r\n  ```\r\n\r\n### 1.2 Frozen Toolchains and Build Tool Matrix\r\n\r\nTo prevent discrepancies in binary or package generation, strict usage of pinned versions of the following utilities is enforced:\r\n\r\n| Tool / Runtime | Exact Version | Toolchain Checksum / Digest | Purpose |\r\n| :--- | :--- | :--- | :--- |\r\n| **Node.js LTS** | `v22.12.0` | `sha256:node-v22.12.0-linux-x64.tar.xz` | Execution and transpilation runtime |\r\n| **pnpm** | `9.15.0` | `sha256:pnpm-v9.15.0` | Deterministic monorepo package manager |\r\n| **TypeScript (tsc)** | `5.7.2` | Pinned in `devDependencies` | Strict ECMAScript compiler |\r\n| **Docker BuildKit** | `v0.18.0` | `moby/buildkit:v0.18.0` | Hermetic OCI packaging engine |\r\n\r\n### 1.3 Libraries, Dependencies, and Vertex Graph\r\n\r\n- **Immutable Lockfile**: `pnpm-lock.yaml` (or `Cargo.lock`, `go.sum`, `requirements.lock`). Installations with open resolution are forbidden (`pnpm install --frozen-lockfile` mandatory).\r\n- **SBOM (Software Bill of Materials) Inventory**:\r\n  - Format: CycloneDX JSON v1.5 / SPDX v2.3.\r\n  - Compiled SBOM path: `reports/sbom-cyclonedx.json`.\r\n- **OSS License Governance**:\r\n  - Binding policy: `license-policy.yaml`.\r\n  - Library vertex pre-verification:\r\n    ```bash\r\n    pnpm verify:licenses\r\n    ```\r\n\r\n### 1.4 Step-by-Step Deterministic Build Procedure\r\n\r\n1. **Step 1: Hermetic Dependency Installation**\r\n   ```bash\r\n   pnpm install --frozen-lockfile --ignore-scripts\r\n   ```\r\n\r\n2. **Step 2: Integrity and Strict Type Checking**\r\n   ```bash\r\n   pnpm typecheck\r\n   ```\r\n\r\n3. **Step 3: Artifact Compilation**\r\n   ```bash\r\n   export SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)\r\n   pnpm build\r\n   ```\r\n\r\n4. **Step 4: Cryptographic Verification of Generated Artifact**\r\n   ```bash\r\n   sha256sum dist/app.bundle.js\r\n   # Compare against the canonical checksum registered in official release:\r\n   # Expected: [CANONICAL_SHA256_CHECKSUM]\r\n   ```\r\n\r\n---\r\n\r\n## 2. Version, Infrastructure, and Migration Compatibility Matrix\r\n\r\nThis section defines technical interoperability boundaries between the release version and the deployment ecosystem, ensuring safe Zero-Downtime transitions.\r\n\r\n### 2.1 Platform and Execution Runtime Compatibility\r\n\r\n| Infrastructure Component | Approved Version Range | Recommended Version | Support Status |\r\n| :--- | :--- | :--- | :---: |\r\n| **Kubernetes Cluster (K8s)** | `>= 1.28` and `<= 1.31` | `1.30.2` | \u2705 Certified |\r\n| **Container Runtime (CRI)** | containerd `>= 1.7` / CRI-O `>= 1.28` | containerd `1.7.15` | \u2705 Certified |\r\n| **Base Operating System (Host)** | Ubuntu 22.04 LTS / RHEL 9.2+ | Ubuntu 22.04 LTS (Kernel 6.x) | \u2705 Homologated |\r\n| **Language Runtime (Production)** | Node.js `>= 20.x` and `<= 22.x` | `v22.12.0 LTS` | \u2705 Hermetic |\r\n\r\n### 2.2 Data Schema and Migration Compatibility (N-1 Support)\r\n\r\nTo enable Canary or Blue-Green continuous deployments without transaction loss:\r\n\r\n| Release Version | DB Schema Version | Compatible with $N-1$ Code | Schema Migration Status |\r\n| :---: | :---: | :---: | :--- |\r\n| **`v1.0.0`** (Current) | `SCHEMA-v1.0` | \u2705 Yes (supports `v0.9.x` code) | Non-destructive additive migration (no column renaming). |\r\n| **`v0.9.x`** | `SCHEMA-v0.9` | \u2705 Previous baseline | Fully compatible during Canary drain period. |\r\n\r\n### 2.3 Interoperability Between Architecture Components (`CMP-*`)\r\n\r\n| Dependent Component | Consumed Component | Minimum Compatible Versions | Binding Protocol / Contract |\r\n| :--- | :--- | :---: | :--- |\r\n| `CMP-NAME-001` (Gateway) | `CMP-NAME-002` (Backend) | `>= v1.0.0` | gRPC / Protobuf v3 (`contract_spec.proto`) |\r\n| `CMP-NAME-001` (Gateway) | Messaging Bus / Kafka | `>= 3.5.0` | Kafka v2 Protocol with TLS mTLS |\r\n\r\n### 2.4 Homologated Upgrade & Rollback Paths\r\n\r\n| Source Version | Direct Jump to `v1.0.0` | Intermediate Migration Required | Direct Rollback Procedure |\r\n| :---: | :---: | :---: | :---: |\r\n| **`v0.9.1`** | \u2705 Allowed | \u274C Not required | `kubectl rollout undo` without data loss. |\r\n| **`v0.9.0`** | \u2705 Allowed | \u274C Not required | `kubectl rollout undo` without data loss. |\r\n| **`< v0.9.0`** | \u274C Blocked | \u2705 Must upgrade to `v0.9.1` first | Requires restore from backup snapshot. |\r\n\r\n---\r\n\r\n## 3. CI/CD Architecture and Pipelines\r\n\r\n### 3.1 Hierarchical Branching Model and Integration Triggers\r\n\r\nFollowing the AI-SDLC 4-tier standard:\r\n\r\n```text\r\nTIER 1: main (Production)\r\n  \u25B2\r\n  \u2514\u2500\u2500 PR Release Gate (Manual Tech Lead / Release Manager Approval)\r\n        \u2502\r\nTIER 2: release/v1.0.0 (Open Version Branch)\r\n  \u25B2\r\n  \u2514\u2500\u2500 PR Feature Gate (Lint + Tests + Quality Gate + SAST + SBOM)\r\n        \u2502\r\nTIER 3: feat/CHG-001-* (Feature / Bug)\r\n```\r\n\r\n- **Pull Request Trigger**: Executes linters, full test battery, and governance verifications without deployment.\r\n- **Release Tag Trigger (`v*.*.*`)**: Executes the full hermetic build pipeline, image signing, and continuous deployment.\r\n\r\n### 3.2 CI/CD Pipeline Flowchart\r\n\r\n```mermaid\r\nflowchart LR\r\n    A[\"Git Push / Tag v1.0.0\"] --> B[\"Hermetic Checkout\"]\r\n    B --> C[\"Linters & Typecheck\"]\r\n    C --> D[\"Vitest: Unit & BDD\"]\r\n    D --> E[\"Quality Gate: CC & MI\"]\r\n    E --> F[\"SAST & Secret Scan\"]\r\n    F --> G[\"SBOM & License Gate\"]\r\n    G --> H[\"Deterministic Build\"]\r\n    H --> I[\"Cosign / SLSA Signing\"]\r\n    I --> J[\"Push to OCI Registry\"]\r\n    J --> K[\"Deploy to DMZ Enclave\"]\r\n```\r\n\r\n### 3.3 Release Gate Contracts and Thresholds\r\n\r\n| Quality Gate | Tool / Command | Required Threshold | Action on Non-Compliance |\r\n| :--- | :--- | :--- | :--- |\r\n| **Lint & Typecheck** | `pnpm typecheck` | Zero errors, zero `any` | **Immediate failure** |\r\n| **Automated Tests** | `pnpm test:all` | 100% passed, Coverage >= 85% | **Immediate failure** |\r\n| **Cyclomatic Complexity** | `aisdlc verify quality` | CC <= 10 per function | **Release blocked** |\r\n| **Maintainability Index** | `aisdlc verify quality` | MI >= 50.0 / 100 | **Release blocked** |\r\n| **360\u00B0 Traceability** | `aisdlc verify traceability` | 100% of requirements linked | **Release blocked** |\r\n| **OSS Licenses** | `aisdlc verify licenses` | Zero forbidden/viral licenses | **Release blocked** |\r\n| **Cryptographic Signature** | `cosign verify` | Valid signature from Corporate CA | **Deployment rejected** |\r\n\r\n---\r\n\r\n## 4. Production Deployment Strategy and Procedure\r\n\r\n### 4.1 Infrastructure Prerequisites and Network Enclaves\r\n\r\n- **Target Enclave**: `SEC-ENC-DMZ-001` (Strict segmentation without direct uncontrolled outbound internet access).\r\n- **Enabled Network Ports**:\r\n  - Port `8443/TCP`: Secure WebSocket ingestion with mutual TLS (mTLS) authentication.\r\n  - Port `9090/TCP`: Prometheus metrics (internal management network only).\r\n- **Secrets and Certificate Management**:\r\n  - Server TLS and client root CA certificates mounted via immutable secret at `/etc/pki/tls/`.\r\n  - Embedding cryptographic keys in environment variables or images is strictly forbidden.\r\n\r\n### 4.2 Rollout Strategy\r\n\r\nA **Canary strategy with progressive telemetry metrics analysis** is utilized:\r\n1. 10% of traffic is routed to the new version for 15 minutes.\r\n2. If the 5xx error rate is `<= 0.01%` and p99 latency is `<= 50ms`, traffic is promoted to 100%.\r\n\r\n### 4.3 Step-by-Step Deployment Procedure\r\n\r\n1. **Step 1: Pre-deployment and State Snapshot**\r\n   ```bash\r\n   # Check cluster health and record baseline\r\n   kubectl get pods -n production -l app=system\r\n   kubectl exec -it system-db-0 -- /backup/create-snapshot.sh\r\n   ```\r\n\r\n2. **Step 2: Deployment Manifest Application**\r\n   ```bash\r\n   kubectl apply -f deploy/production/canary-deployment.yaml\r\n   kubectl rollout status deployment/system-service -n production --timeout=180s\r\n   ```\r\n\r\n3. **Step 3: Health Verification and Smoke Tests**\r\n   ```bash\r\n   curl -f --cacert /etc/pki/tls/ca.crt https://127.0.0.1:8443/healthz\r\n   curl -f --cacert /etc/pki/tls/ca.crt https://127.0.0.1:8443/readyz\r\n   pnpm test:example\r\n   ```\r\n\r\n### 4.4 Rollback Plan (Immediate Rollback)\r\n\r\n- **Objective Rollback Activation Criteria**:\r\n  - mTLS handshake failure rate `> 1.0%`.\r\n  - Ingestion p99 latency `> 100ms` for 2 continuous minutes.\r\n  - Critical `CrashLoopBackOff` alert on more than 20% of instances.\r\n- **Rollback Execution Command**:\r\n  ```bash\r\n  kubectl rollout undo deployment/system-service -n production\r\n  kubectl rollout status deployment/system-service -n production\r\n  ```\r\n\r\n---\r\n\r\n## 5. Likely Errors Resolution and Troubleshooting (Runbooks)\r\n\r\nThis section documents the most frequent runtime and deployment failures along with diagnosis and immediate mitigation procedures.\r\n\r\n### 5.1 Frequent Incidents and Solutions Matrix\r\n\r\n#### Incident 1: Dependency Vertex Inconsistency or Drift (Build Failure)\r\n- **Symptom**: `pnpm install --frozen-lockfile` command fails in CI with error `ERR_PNPM_LOCKFILE_OUTDATED`.\r\n- **Root Cause**: `package.json` was modified without updating `pnpm-lock.yaml`.\r\n- **Diagnosis**:\r\n  ```bash\r\n  git diff HEAD^ package.json pnpm-lock.yaml\r\n  ```\r\n- **Mitigation**:\r\n  1. On the feature branch, run `pnpm install` locally to regenerate the deterministic lockfile.\r\n  2. Verify no restricted-license dependencies were introduced via `pnpm verify:licenses`.\r\n  3. Commit both files together in an atomic commit.\r\n\r\n---\r\n\r\n#### Incident 2: mTLS Handshake Failure or Enclave Certificate Rejected\r\n- **Symptom**: Clients receive error `ERR_TLS_CERT_ALTNAME_INVALID` or connection closed with TLS alert `certificate_unknown (46)`.\r\n- **Root Cause**: Internal root CA mounted on server does not match the client certificate issuer CA, or certificate expired.\r\n- **Diagnosis**:\r\n  ```bash\r\n  openssl s_client -connect 127.0.0.1:8443 -CAfile /etc/pki/tls/ca.crt -cert /etc/pki/tls/client.crt -key /etc/pki/tls/client.key\r\n  openssl x509 -in /etc/pki/tls/ca.crt -noout -dates -issuer -subject\r\n  ```\r\n- **Mitigation**:\r\n  1. Verify expiration date of certificate mounted in cluster Secret.\r\n  2. If expired, rotate the certificate by injecting the new pair from HSM / Vault storage.\r\n  3. Orderly restart pods with `kubectl rollout restart deployment/system-service`.\r\n\r\n---\r\n\r\n#### Incident 3: Release Gate Rejection in CI/CD Due to Quality Metrics\r\n- **Symptom**: Pipeline aborts with verdict `Quality Gate REJECTED` (Cyclomatic Complexity > 10 or Maintainability < 50).\r\n- **Root Cause**: Introduction of complex nested logic (multiple `if/else`, extensive `switch`, or branching loops).\r\n- **Diagnosis**:\r\n  ```bash\r\n  pnpm verify:quality\r\n  ```\r\n- **Mitigation**:\r\n  1. Inspect the violation report in `reports/QUALITY_GATE_REPORT.md` to identify the offending function.\r\n  2. Decompose function into cohesive private helper methods following the rule of maximum 40 lines per function.\r\n  3. Re-run `pnpm verify:quality` until green verdict is confirmed. Adding suppression comments (`// @ts-ignore`) is forbidden.\r\n\r\n---\r\n\r\n#### Incident 4: CrashLoopBackOff Due to Memory Leak or Connection Limit\r\n- **Symptom**: Pod is terminated with exit code `ExitCode: 137` (`OOMKilled`) after a load spike.\r\n- **Root Cause**: Undrained socket buffer accumulation during high-frequency bursts.\r\n- **Diagnosis**:\r\n  ```bash\r\n  kubectl describe pod system-service-xxx -n production | grep -i oom\r\n  kubectl logs system-service-xxx -n production --previous\r\n  ```\r\n- **Mitigation**:\r\n  1. Temporarily adjust memory limits in Kubernetes manifest (`resources.limits.memory`) if the load burst is legitimate.\r\n  2. Apply backpressure or discard expired packets in accordance with business rules (`BR-*`).\r\n  3. Run local benchmark with `pnpm test:all` to audit memory consumption.\r\n\r\n---\r\n\r\n### 5.2 Escalation Protocol and Critical Incident Management\r\n\r\n| Severity Level | Impact Criterion | Maximum Response Time | Roles Involved |\r\n| :--- | :--- | :---: | :--- |\r\n| **SEV-1 (Critical)** | Complete service outage or security breach in enclave. | 15 minutes | On-call SRE + Lead Architect + SecOps |\r\n| **SEV-2 (Major)** | Severe service degradation, massive retries without outage. | 1 hour | On-call SRE + Tech Lead |\r\n| **SEV-3 (Minor)** | Isolated node incident without global SLA impact. | 4 hours | Support Engineer / DevOps |\r\n\r\n---\r\n\r\n## 6. Revision History and Version Control\r\n\r\n| Version | Date | Author / Agent | Change Description | Change Reference (Change/PR) |\r\n| :--- | :--- | :--- | :--- | :--- |\r\n| **1.0.0** | 2026-09-15 | Operations & DevOps Team | Initial Production Manual generation | CHG-009 |\r\n";
+declare const STARTER_TEMPLATES_MANUALS_PRODUCTION_MANUAL_TEMPLATE_MD = "---\r\nid: MAN-PROD-001\r\ntype: production-manual\r\ntitle: \"Production & Operations Manual: Application Name\"\r\nstatus: draft\r\nversion: \"1.0.0\"\r\nschema-version: \"1.0\"\r\napplies-to-version: \"v1.0.0\"\r\ntarget-audience:\r\n  - devops-engineer\r\n  - sre-engineer\r\n  - release-manager\r\n  - secops\r\ncomponents-covered:\r\n  - CMP-NAME-001\r\nenclaves-involved:\r\n  - SEC-ENC-DMZ-001\r\nsupersedes: null\r\nsuperseded-by: null\r\n---\r\n\r\n# MAN-PROD-001: Production & Operations Manual - Application Name\r\n\r\n## 1. Deterministic Release Regeneration (Reproducible Builds)\r\n\r\nThis section contains the specifications and directives required to deterministically reproduce identical bit-by-bit application artifacts or releases from their Git tag.\r\n\r\n### 1.1 Source Code Baseline\r\n\r\n- **Canonical Repository**: `https://github.com/organization/repo-name.git`\r\n- **Immutable Git Release Tag**: `v1.0.0`\r\n- **Commit SHA-256 / SHA-1**: `[VERIFIED_HEXADECIMAL_COMMIT_SHA]`\r\n- **Clean Checkout Command**:\r\n  ```bash\r\n  git clone --recurse-submodules https://github.com/organization/repo-name.git\r\n  cd repo-name\r\n  git checkout tags/v1.0.0\r\n  git submodule update --init --recursive\r\n  ```\r\n\r\n### 1.2 Frozen Toolchains and Build Tool Matrix\r\n\r\nTo prevent discrepancies in binary or package generation, strict usage of pinned versions of the following utilities is enforced:\r\n\r\n| Tool / Runtime | Exact Version | Toolchain Checksum / Digest | Purpose |\r\n| :--- | :--- | :--- | :--- |\r\n| **Node.js LTS** | `v22.12.0` | `sha256:node-v22.12.0-linux-x64.tar.xz` | Execution and transpilation runtime |\r\n| **pnpm** | `9.15.0` | `sha256:pnpm-v9.15.0` | Deterministic monorepo package manager |\r\n| **TypeScript (tsc)** | `5.7.2` | Pinned in `devDependencies` | Strict ECMAScript compiler |\r\n| **Docker BuildKit** | `v0.18.0` | `moby/buildkit:v0.18.0` | Hermetic OCI packaging engine |\r\n\r\n### 1.3 Libraries, Dependencies, and Vertex Graph\r\n\r\n- **Immutable Lockfile**: `pnpm-lock.yaml` (or `Cargo.lock`, `go.sum`, `requirements.lock`). Installations with open resolution are forbidden (`pnpm install --frozen-lockfile` mandatory).\r\n- **SBOM (Software Bill of Materials) Inventory**:\r\n  - Format: CycloneDX JSON v1.5 / SPDX v2.3.\r\n  - Compiled SBOM path: `reports/sbom-cyclonedx.json`.\r\n- **OSS License Governance**:\r\n  - Binding policy: `license-policy.yaml`.\r\n  - Library vertex pre-verification:\r\n    ```bash\r\n    pnpm verify:licenses\r\n    ```\r\n\r\n### 1.4 Step-by-Step Deterministic Build Procedure\r\n\r\n1. **Step 1: Hermetic Dependency Installation**\r\n   ```bash\r\n   pnpm install --frozen-lockfile --ignore-scripts\r\n   ```\r\n\r\n2. **Step 2: Integrity and Strict Type Checking**\r\n   ```bash\r\n   pnpm typecheck\r\n   ```\r\n\r\n3. **Step 3: Artifact Compilation**\r\n   ```bash\r\n   export SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)\r\n   pnpm build\r\n   ```\r\n\r\n4. **Step 4: Cryptographic Verification of Generated Artifact**\r\n   ```bash\r\n   sha256sum dist/app.bundle.js\r\n   # Compare against the canonical checksum registered in official release:\r\n   # Expected: [CANONICAL_SHA256_CHECKSUM]\r\n   ```\r\n\r\n\n\n5. **Step 5: Sigstore / Cosign Signature and SLSA Provenance Verification**\n   ```bash\n   # Verify npm package provenance from registry\n   npm audit signatures\n\n   # Verify package tarball with Sigstore / Cosign (Keyless via OIDC identity)\n   cosign verify-blob \\\n     --bundle release-artifacts/package.tgz.bundle \\\n     --certificate-identity-regexp \"^https://github.com/organization/repo-name/.*$\" \\\n     --certificate-oidc-issuer \"https://token.actions.githubusercontent.com\" \\\n     release-artifacts/package.tgz\n\n   # Verify SLSA Build Provenance Attestation using GitHub CLI\n   gh attestation verify release-artifacts/package.tgz --repo organization/repo-name\n   ```\n\n---\r\n\r\n## 2. Version, Infrastructure, and Migration Compatibility Matrix\r\n\r\nThis section defines technical interoperability boundaries between the release version and the deployment ecosystem, ensuring safe Zero-Downtime transitions.\r\n\r\n### 2.1 Platform and Execution Runtime Compatibility\r\n\r\n| Infrastructure Component | Approved Version Range | Recommended Version | Support Status |\r\n| :--- | :--- | :--- | :---: |\r\n| **Kubernetes Cluster (K8s)** | `>= 1.28` and `<= 1.31` | `1.30.2` | \u2705 Certified |\r\n| **Container Runtime (CRI)** | containerd `>= 1.7` / CRI-O `>= 1.28` | containerd `1.7.15` | \u2705 Certified |\r\n| **Base Operating System (Host)** | Ubuntu 22.04 LTS / RHEL 9.2+ | Ubuntu 22.04 LTS (Kernel 6.x) | \u2705 Homologated |\r\n| **Language Runtime (Production)** | Node.js `>= 20.x` and `<= 22.x` | `v22.12.0 LTS` | \u2705 Hermetic |\r\n\r\n### 2.2 Data Schema and Migration Compatibility (N-1 Support)\r\n\r\nTo enable Canary or Blue-Green continuous deployments without transaction loss:\r\n\r\n| Release Version | DB Schema Version | Compatible with $N-1$ Code | Schema Migration Status |\r\n| :---: | :---: | :---: | :--- |\r\n| **`v1.0.0`** (Current) | `SCHEMA-v1.0` | \u2705 Yes (supports `v0.9.x` code) | Non-destructive additive migration (no column renaming). |\r\n| **`v0.9.x`** | `SCHEMA-v0.9` | \u2705 Previous baseline | Fully compatible during Canary drain period. |\r\n\r\n### 2.3 Interoperability Between Architecture Components (`CMP-*`)\r\n\r\n| Dependent Component | Consumed Component | Minimum Compatible Versions | Binding Protocol / Contract |\r\n| :--- | :--- | :---: | :--- |\r\n| `CMP-NAME-001` (Gateway) | `CMP-NAME-002` (Backend) | `>= v1.0.0` | gRPC / Protobuf v3 (`contract_spec.proto`) |\r\n| `CMP-NAME-001` (Gateway) | Messaging Bus / Kafka | `>= 3.5.0` | Kafka v2 Protocol with TLS mTLS |\r\n\r\n### 2.4 Homologated Upgrade & Rollback Paths\r\n\r\n| Source Version | Direct Jump to `v1.0.0` | Intermediate Migration Required | Direct Rollback Procedure |\r\n| :---: | :---: | :---: | :---: |\r\n| **`v0.9.1`** | \u2705 Allowed | \u274C Not required | `kubectl rollout undo` without data loss. |\r\n| **`v0.9.0`** | \u2705 Allowed | \u274C Not required | `kubectl rollout undo` without data loss. |\r\n| **`< v0.9.0`** | \u274C Blocked | \u2705 Must upgrade to `v0.9.1` first | Requires restore from backup snapshot. |\r\n\r\n---\r\n\r\n## 3. CI/CD Architecture and Pipelines\r\n\r\n### 3.1 Hierarchical Branching Model and Integration Triggers\r\n\r\nFollowing the AI-SDLC 4-tier standard:\r\n\r\n```text\r\nTIER 1: main (Production)\r\n  \u25B2\r\n  \u2514\u2500\u2500 PR Release Gate (Manual Tech Lead / Release Manager Approval)\r\n        \u2502\r\nTIER 2: release/v1.0.0 (Open Version Branch)\r\n  \u25B2\r\n  \u2514\u2500\u2500 PR Feature Gate (Lint + Tests + Quality Gate + SAST + SBOM)\r\n        \u2502\r\nTIER 3: feat/CHG-001-* (Feature / Bug)\r\n```\r\n\r\n- **Pull Request Trigger**: Executes linters, full test battery, and governance verifications without deployment.\r\n- **Release Tag Trigger (`v*.*.*`)**: Executes the full hermetic build pipeline, image signing, and continuous deployment.\r\n\r\n### 3.2 CI/CD Pipeline Flowchart\r\n\r\n```mermaid\r\nflowchart LR\r\n    A[\"Git Push / Tag v1.0.0\"] --> B[\"Hermetic Checkout\"]\r\n    B --> C[\"Linters & Typecheck\"]\r\n    C --> D[\"Vitest: Unit & BDD\"]\r\n    D --> E[\"Quality Gate: CC & MI\"]\r\n    E --> F[\"SAST & Secret Scan\"]\r\n    F --> G[\"SBOM & License Gate\"]\r\n    G --> H[\"Deterministic Build\"]\r\n    H --> I[\"Cosign / SLSA Signing\"]\r\n    I --> J[\"Push to OCI Registry\"]\r\n    J --> K[\"Deploy to DMZ Enclave\"]\r\n```\r\n\r\n### 3.3 Release Gate Contracts and Thresholds\r\n\r\n| Quality Gate | Tool / Command | Required Threshold | Action on Non-Compliance |\r\n| :--- | :--- | :--- | :--- |\r\n| **Lint & Typecheck** | `pnpm typecheck` | Zero errors, zero `any` | **Immediate failure** |\r\n| **Automated Tests** | `pnpm test:all` | 100% passed, Coverage >= 85% | **Immediate failure** |\r\n| **Cyclomatic Complexity** | `aisdlc verify quality` | CC <= 10 per function | **Release blocked** |\r\n| **Maintainability Index** | `aisdlc verify quality` | MI >= 50.0 / 100 | **Release blocked** |\r\n| **360\u00B0 Traceability** | `aisdlc verify traceability` | 100% of requirements linked | **Release blocked** |\r\n| **OSS Licenses** | `aisdlc verify licenses` | Zero forbidden/viral licenses | **Release blocked** |\r\n| **Cryptographic Signature & SLSA** | `cosign verify-blob` / `gh attestation verify` | Valid signature and SLSA provenance from GitHub Actions OIDC | **Deployment rejected** |\r\n\r\n---\r\n\r\n## 4. Production Deployment Strategy and Procedure\r\n\r\n### 4.1 Infrastructure Prerequisites and Network Enclaves\r\n\r\n- **Target Enclave**: `SEC-ENC-DMZ-001` (Strict segmentation without direct uncontrolled outbound internet access).\r\n- **Enabled Network Ports**:\r\n  - Port `8443/TCP`: Secure WebSocket ingestion with mutual TLS (mTLS) authentication.\r\n  - Port `9090/TCP`: Prometheus metrics (internal management network only).\r\n- **Secrets and Certificate Management**:\r\n  - Server TLS and client root CA certificates mounted via immutable secret at `/etc/pki/tls/`.\r\n  - Embedding cryptographic keys in environment variables or images is strictly forbidden.\r\n\r\n### 4.2 Rollout Strategy\r\n\r\nA **Canary strategy with progressive telemetry metrics analysis** is utilized:\r\n1. 10% of traffic is routed to the new version for 15 minutes.\r\n2. If the 5xx error rate is `<= 0.01%` and p99 latency is `<= 50ms`, traffic is promoted to 100%.\r\n\r\n### 4.3 Step-by-Step Deployment Procedure\r\n\r\n1. **Step 1: Pre-deployment and State Snapshot**\r\n   ```bash\r\n   # Check cluster health and record baseline\r\n   kubectl get pods -n production -l app=system\r\n   kubectl exec -it system-db-0 -- /backup/create-snapshot.sh\r\n   ```\r\n\r\n2. **Step 2: Deployment Manifest Application**\r\n   ```bash\r\n   kubectl apply -f deploy/production/canary-deployment.yaml\r\n   kubectl rollout status deployment/system-service -n production --timeout=180s\r\n   ```\r\n\r\n3. **Step 3: Health Verification and Smoke Tests**\r\n   ```bash\r\n   curl -f --cacert /etc/pki/tls/ca.crt https://127.0.0.1:8443/healthz\r\n   curl -f --cacert /etc/pki/tls/ca.crt https://127.0.0.1:8443/readyz\r\n   pnpm test:example\r\n   ```\r\n\r\n### 4.4 Rollback Plan (Immediate Rollback)\r\n\r\n- **Objective Rollback Activation Criteria**:\r\n  - mTLS handshake failure rate `> 1.0%`.\r\n  - Ingestion p99 latency `> 100ms` for 2 continuous minutes.\r\n  - Critical `CrashLoopBackOff` alert on more than 20% of instances.\r\n- **Rollback Execution Command**:\r\n  ```bash\r\n  kubectl rollout undo deployment/system-service -n production\r\n  kubectl rollout status deployment/system-service -n production\r\n  ```\r\n\r\n---\r\n\r\n## 5. Likely Errors Resolution and Troubleshooting (Runbooks)\r\n\r\nThis section documents the most frequent runtime and deployment failures along with diagnosis and immediate mitigation procedures.\r\n\r\n### 5.1 Frequent Incidents and Solutions Matrix\r\n\r\n#### Incident 1: Dependency Vertex Inconsistency or Drift (Build Failure)\r\n- **Symptom**: `pnpm install --frozen-lockfile` command fails in CI with error `ERR_PNPM_LOCKFILE_OUTDATED`.\r\n- **Root Cause**: `package.json` was modified without updating `pnpm-lock.yaml`.\r\n- **Diagnosis**:\r\n  ```bash\r\n  git diff HEAD^ package.json pnpm-lock.yaml\r\n  ```\r\n- **Mitigation**:\r\n  1. On the feature branch, run `pnpm install` locally to regenerate the deterministic lockfile.\r\n  2. Verify no restricted-license dependencies were introduced via `pnpm verify:licenses`.\r\n  3. Commit both files together in an atomic commit.\r\n\r\n---\r\n\r\n#### Incident 2: mTLS Handshake Failure or Enclave Certificate Rejected\r\n- **Symptom**: Clients receive error `ERR_TLS_CERT_ALTNAME_INVALID` or connection closed with TLS alert `certificate_unknown (46)`.\r\n- **Root Cause**: Internal root CA mounted on server does not match the client certificate issuer CA, or certificate expired.\r\n- **Diagnosis**:\r\n  ```bash\r\n  openssl s_client -connect 127.0.0.1:8443 -CAfile /etc/pki/tls/ca.crt -cert /etc/pki/tls/client.crt -key /etc/pki/tls/client.key\r\n  openssl x509 -in /etc/pki/tls/ca.crt -noout -dates -issuer -subject\r\n  ```\r\n- **Mitigation**:\r\n  1. Verify expiration date of certificate mounted in cluster Secret.\r\n  2. If expired, rotate the certificate by injecting the new pair from HSM / Vault storage.\r\n  3. Orderly restart pods with `kubectl rollout restart deployment/system-service`.\r\n\r\n---\r\n\r\n#### Incident 3: Release Gate Rejection in CI/CD Due to Quality Metrics\r\n- **Symptom**: Pipeline aborts with verdict `Quality Gate REJECTED` (Cyclomatic Complexity > 10 or Maintainability < 50).\r\n- **Root Cause**: Introduction of complex nested logic (multiple `if/else`, extensive `switch`, or branching loops).\r\n- **Diagnosis**:\r\n  ```bash\r\n  pnpm verify:quality\r\n  ```\r\n- **Mitigation**:\r\n  1. Inspect the violation report in `reports/QUALITY_GATE_REPORT.md` to identify the offending function.\r\n  2. Decompose function into cohesive private helper methods following the rule of maximum 40 lines per function.\r\n  3. Re-run `pnpm verify:quality` until green verdict is confirmed. Adding suppression comments (`// @ts-ignore`) is forbidden.\r\n\r\n---\r\n\r\n#### Incident 4: CrashLoopBackOff Due to Memory Leak or Connection Limit\r\n- **Symptom**: Pod is terminated with exit code `ExitCode: 137` (`OOMKilled`) after a load spike.\r\n- **Root Cause**: Undrained socket buffer accumulation during high-frequency bursts.\r\n- **Diagnosis**:\r\n  ```bash\r\n  kubectl describe pod system-service-xxx -n production | grep -i oom\r\n  kubectl logs system-service-xxx -n production --previous\r\n  ```\r\n- **Mitigation**:\r\n  1. Temporarily adjust memory limits in Kubernetes manifest (`resources.limits.memory`) if the load burst is legitimate.\r\n  2. Apply backpressure or discard expired packets in accordance with business rules (`BR-*`).\r\n  3. Run local benchmark with `pnpm test:all` to audit memory consumption.\r\n\r\n---\r\n\r\n### 5.2 Escalation Protocol and Critical Incident Management\r\n\r\n| Severity Level | Impact Criterion | Maximum Response Time | Roles Involved |\r\n| :--- | :--- | :---: | :--- |\r\n| **SEV-1 (Critical)** | Complete service outage or security breach in enclave. | 15 minutes | On-call SRE + Lead Architect + SecOps |\r\n| **SEV-2 (Major)** | Severe service degradation, massive retries without outage. | 1 hour | On-call SRE + Tech Lead |\r\n| **SEV-3 (Minor)** | Isolated node incident without global SLA impact. | 4 hours | Support Engineer / DevOps |\r\n\r\n---\r\n\r\n## 6. Revision History and Version Control\r\n\r\n| Version | Date | Author / Agent | Change Description | Change Reference (Change/PR) |\r\n| :--- | :--- | :--- | :--- | :--- |\r\n| **1.0.0** | 2026-09-15 | Operations & DevOps Team | Initial Production Manual generation | CHG-009 |\r\n";
 declare const STARTER_TEMPLATES_MANUALS_USER_MANUAL_TEMPLATE_MD = "---\r\nid: MAN-USER-001\r\ntype: user-manual\r\ntitle: \"User Manual: Application Name\"\r\nstatus: draft\r\nversion: \"1.0.0\"\r\nschema-version: \"1.0\"\r\napplies-to-version: \"v1.0.0\"\r\ntarget-audience:\r\n  - ACT-ROLE-USER-001\r\n  - ACT-OPERATOR-002\r\nallowed-roles:\r\n  - ACT-ROLE-USER-001\r\n  - ACT-OPERATOR-002\r\njourneys-covered:\r\n  - JRN-JOURNEY-001\r\nuse-cases-covered:\r\n  - UC-ACTION-001\r\nsupersedes: null\r\nsuperseded-by: null\r\n---\r\n\r\n# MAN-USER-001: User Manual - Application Name\r\n\r\n## 1. System Purpose and Audience\r\n\r\nConcisely describes the software's purpose, the operational value it delivers to end users, and the general context in which it operates.\r\n\r\n- **Application / System**: `[System Name or Bounded Context]`\r\n- **Software Version**: `v1.0.0`\r\n- **Target Audience**: `[Functional roles and user profiles addressed]`\r\n\r\n---\r\n\r\n## 2. User Role Catalog and Permissions Matrix (RBAC)\r\n\r\nThis section formally defines the roles authorized to access and operate the application, as well as the privileges assigned to each.\r\n\r\n### 2.1 Authorized Role Catalog\r\n\r\n| Role Identifier | Role Name | Associated Actor | Description & Responsibility | Enclave / Access Level |\r\n| :--- | :--- | :--- | :--- | :--- |\r\n| **`ROLE_USER`** | Standard User | `ACT-ROLE-USER-001` | Data queries and nominal business flow execution. | Corporate Network / Web UI |\r\n| **`ROLE_OPERATOR`** | System Operator | `ACT-OPERATOR-002` | Streaming supervision, alert management, and command control. | DMZ Enclave / Operational Console |\r\n\r\n### 2.2 Access and Capabilities Matrix by Role\r\n\r\n| Application Capability / Module | `ROLE_USER` | `ROLE_OPERATOR` | Authentication Mode |\r\n| :--- | :---: | :---: | :--- |\r\n| Status Query and Dashboard Visualizations | \u2705 Allowed | \u2705 Allowed | Bearer Token (OIDC/JWT) |\r\n| Business Journey Execution (`JRN-JOURNEY-001`) | \u2705 Allowed | \u2705 Allowed | Bearer Token (OIDC/JWT) |\r\n| Real-Time Streaming and Operational Control | \u274C Denied | \u2705 Allowed | mTLS + Device X.509 Certificate |\r\n| Global Parameters Configuration & Connectivity | \u274C Denied | \u2705 Allowed | Administrator Credential |\r\n\r\n---\r\n\r\n## 3. Version and User Platform Compatibility Matrix\r\n\r\nThis section specifies cross-compatibility between the current application version and user environments, clients, and formats.\r\n\r\n### 3.1 Client-Server Compatibility (APIs and SDKs)\r\n\r\n| Application Version (Backend) | Compatible CLI Version | Compatible SDK Version | Compatibility Status | Migration Notes |\r\n| :---: | :---: | :---: | :---: | :--- |\r\n| **`v1.0.0`** (Current) | `>= v1.0.0` | `>= v1.0.0` | \u2705 Fully Supported | Active canonical version. |\r\n| **`v1.0.0`** (Current) | `v0.9.x` | `v0.9.x` | \u26A0\uFE0F Degraded Mode | Requires upgrade before next minor. |\r\n| **`v1.0.0`** (Current) | `< v0.9.0` | `< v0.9.0` | \u274C Incompatible / Deprecated | Legacy endpoints decommissioned. |\r\n\r\n### 3.2 Homologated Browsers and Client Platforms\r\n\r\n| Platform / Environment | Minimum Supported Versions | Support Level | Known Constraints |\r\n| :--- | :--- | :---: | :--- |\r\n| **Google Chrome / Chromium** | Version `>= 120` | Tier 1 (Official) | Optimal WebSockets and WebGL performance. |\r\n| **Mozilla Firefox** | Version `>= 115 ESR` | Tier 1 (Official) | Full client certificate support. |\r\n| **Safari / WebKit** | Version `>= 17.0` | Tier 2 (Functional) | Requires explicit mTLS enablement in macOS Keychain. |\r\n| **Terminal / CLI (Linux / macOS / Windows)** | Node.js `>= 18` or Bash `>= 5.0` | Tier 1 (Official) | Full support on PowerShell 7+ and bash. |\r\n\r\n### 3.3 Configuration Files and Data Formats Compatibility\r\n\r\n| Format / Artifact | Source Version Supported | Automatic Conversion | User Action Required |\r\n| :--- | :---: | :---: | :--- |\r\n| **`config.yaml`** | `v0.9.x` | \u2705 Yes | None. Application migrates deprecated keys on startup. |\r\n| **Export Profiles (`.json`)** | `v0.9.x` | \u2705 Yes | 100% backward compatible. |\r\n\r\n---\r\n\r\n## 4. Application Installation, Access, and Configuration\r\n\r\n### 4.1 Access Channels and Prerequisites\r\n\r\n- **Web Portal / UI**: Access URL (e.g., `https://app.system.internal`).\r\n- **Command Line (CLI)**: Executable binary or package (e.g., `npx system-cli` or `./system-client`).\r\n- **Supported Browsers or Platforms**: Chrome >= 120, Firefox >= 120, Linux/macOS/Windows terminal.\r\n\r\n### 4.2 Client Configuration and Environment Variables\r\n\r\nThe application allows parameterizing its behavior via environment variables or local configuration files:\r\n\r\n| Parameter / Variable | Type | Default Value | Required | Description |\r\n| :--- | :--- | :--- | :---: | :--- |\r\n| `API_ENDPOINT` | URL | `https://api.system.internal/v1` | Yes | Base backend API endpoint. |\r\n| `WS_STREAM_URL` | WSS URL | `wss://stream.system.internal/telemetry` | No | Real-time telemetry or notifications socket. |\r\n| `CLIENT_TIMEOUT_MS` | Integer | `5000` | No | Network response timeout in milliseconds. |\r\n| `AUTH_PROFILE` | String | `production` | No | Active authentication profile (`development`, `staging`, `production`). |\r\n\r\n### 4.3 Local Configuration File (`config.yaml` / `.env`)\r\n\r\nExample recommended configuration for operator workstations:\r\n\r\n```yaml\r\n# Client configuration file: config.yaml\r\nprofile: production\r\nnetwork:\r\n  api_endpoint: \"https://api.system.internal/v1\"\r\n  stream_url: \"wss://stream.system.internal/telemetry\"\r\n  timeout_ms: 5000\r\n  retry_attempts: 3\r\n\r\nsecurity:\r\n  tls_verify: true\r\n  client_cert_path: \"/etc/pki/client/operator.crt\"\r\n  client_key_path: \"/etc/pki/client/operator.key\"\r\n\r\nui:\r\n  theme: \"dark\"\r\n  refresh_interval_sec: 1\r\n```\r\n\r\n---\r\n\r\n## 5. Step-by-Step Journey Execution Guide (`JRN-*`)\r\n\r\nEach subsection documents an end-to-end Journey, specifying authorized execution roles, starting conditions, and the step-by-step operating procedure.\r\n\r\n### 5.1 `JRN-JOURNEY-001`: User Journey Name\r\n\r\n- **Linked Use Case**: `UC-ACTION-001`\r\n- **Primary Actor**: `ACT-ROLE-USER-001`\r\n- **Authorized Roles**: `ROLE_USER`, `ROLE_OPERATOR`\r\n- **Required Execution Enclave**: Corporate Intranet or VPN access\r\n\r\n#### A. Preconditions\r\n1. User must have an active and authenticated session with their authorized role.\r\n2. The base entity or resource must be in `ACTIVE` state.\r\n\r\n#### B. Step-by-Step Procedure\r\n\r\n1. **Step 1: Operation Initiation**\r\n   - **Action**: User navigates to the execution section or invokes the corresponding command:\r\n     ```bash\r\n     system-cli execute --journey JRN-JOURNEY-001 --input payload.json\r\n     ```\r\n   - **Required Input**: Resource identifier and validated parameters.\r\n   - **Expected On-Screen Response**: System displays confirmation dialog with operation summary.\r\n\r\n2. **Step 2: Validation and Submission**\r\n   - **Action**: User reviews parameters and confirms execution.\r\n   - **System Behavior**: Client locally validates data schema and transmits signed request.\r\n\r\n3. **Step 3: Observable Outcome Verification**\r\n   - **Success Outcome**: Console / interface displays success message `MSG-SUCCESS-001` with generated unique transaction ID.\r\n   - **Final State**: Resource transitions to `PROCESSED` state.\r\n\r\n#### C. Alternative Flows and Exception Handling\r\n- **Unauthorized Access**: If an unauthorized role attempts to invoke the journey, the system blocks the action, outputs code `MSG-ERR-AUTH-403`, and records the access attempt in the audit trail.\r\n- **Connection Loss in Transit**: If connection is lost during step 2, client retries with exponential backoff up to 3 times before notifying user.\r\n\r\n---\r\n\r\n## 6. System Messages Catalog and Response Codes\r\n\r\nStructured matrix of key informational, warning, and error messages emitted by the application during its operational lifecycle:\r\n\r\n| Code | Severity | Literal Screen Message | Trigger / Context | Meaning for User | Recommended Corrective Action |\r\n| :--- | :--- | :--- | :--- | :--- | :--- |\r\n| **`MSG-SYS-100`** | `INFO` | `\"Connection established successfully with server\"` | Successful network handshake upon initializing session. | Application is online and ready to process commands. | None. Normal operation. |\r\n| **`MSG-SYS-200`** | `INFO` | `\"Operation completed successfully. Transaction ID: [TX-ID]\"` | Successful completion of a Journey or Use Case. | Transaction was persisted and acknowledged by backend. | Save `TX-ID` for tracking if required. |\r\n| **`MSG-WARN-301`** | `WARN` | `\"High link latency (>500ms). Degraded mode active\"` | Response metric exceeds real-time threshold. | Screen data may experience slight refresh delays. | Check network connection quality or bandwidth. |\r\n| **`MSG-WARN-302`** | `WARN` | `\"Session expiring in 5 minutes\"` | Authentication token approaching TTL expiry. | User will be logged out unless credential is refreshed. | Renew session by clicking alert or re-authenticating. |\r\n| **`MSG-ERR-401`** | `ERR-USER` | `\"Invalid credentials or expired token. Access denied\"` | Login authentication failure or expired token. | User identity could not be validated. | Re-enter credentials or request a new token. |\r\n| **`MSG-ERR-403`** | `ERR-USER` | `\"Unauthorized action for assigned role [ROLE]\"` | Attempted execution of Journey or command outside RBAC. | User role lacks permissions for this resource. | Contact administrator to request permission expansion. |\r\n| **`MSG-ERR-422`** | `ERR-USER` | `\"Invalid payload: field [FIELD] does not match schema\"` | Syntactic validation or business rule (`BR-*`) failure. | User-supplied data is invalid. | Correct indicated fields according to business rule. |\r\n| **`MSG-ERR-503`** | `ERR-SYS` | `\"Service temporarily unavailable. Retrying...\"` | Backend gateway unreachable or under scheduled maintenance. | Central server is not responding to requests. | Await automatic retries or check system status page. |\r\n\r\n---\r\n\r\n## 7. Frequently Asked Questions (FAQ) and Support\r\n\r\n- **What should I do if I lose connectivity while executing a Journey?**  \r\n  The application implements idempotency mechanisms. Once network connectivity is restored, verify resource status before retrying to prevent duplicate transactions.\r\n- **How do I request a user role change?**  \r\n  Contact the Security Administrator (`SecOps`) referencing your user ID and operational justification for the role change.\r\n\r\n---\r\n\r\n## 8. Revision History and Version Control\r\n\r\n| Version | Date | Author / Agent | Change Description | Change Reference (Change/PR) |\r\n| :--- | :--- | :--- | :--- | :--- |\r\n| **1.0.0** | 2026-09-15 | Documentation & Product Team | Initial User Manual generation | CHG-009 |\r\n";
 declare const STARTER_TEMPLATES_PRIVACY_DATA_ASSET_TEMPLATE_MD = "---\r\nid: DATA-ASSET-USER-PROFILE-001\r\ntype: data-asset\r\ntitle: User Profile & Identity Personal Data Asset\r\nstatus: draft\r\nversion: \"1.0.0\"\r\nschema-version: \"1.0\"\r\nclassification: confidential-pii # public, internal, confidential-pii, special-category-sensitive\r\npii-categories:\r\n  - identifiers\r\n  - contact\r\ndata-subjects:\r\n  - ACT-USER-001\r\nfields:\r\n  - name: email\r\n    sensitivity: pii\r\n    masking-strategy: sha256-salt\r\n  - name: phone_number\r\n    sensitivity: pii\r\n    masking-strategy: redact\r\n  - name: operator_callsign\r\n    sensitivity: internal\r\n    masking-strategy: none\r\nretention-period: 365d\r\nerasure-method: crypto-shredding\r\nowner-bounded-context: CMP-IDENTITY-SERVICE-001\r\nsupersedes: null\r\nsuperseded-by: null\r\n---\r\n\r\n# DATA-ASSET-USER-PROFILE-001: User Profile & Identity Personal Data Asset\r\n\r\n## 1. Data Asset Inventory & Purpose\r\nDescribes the structure, storage medium, and operational boundary of the personal data asset governed under GDPR / ISO 27701.\r\n\r\n## 2. Field-Level Sensitivity & Masking Policy\r\n\r\n| Field Name | Sensitivity | Masking / Pseudonymization Strategy | Allowed in Logs | Allowed in AI Prompts |\r\n| :--- | :--- | :--- | :---: | :---: |\r\n| `email` | `pii` | `sha256-salt` | \u274C No | \u274C No |\r\n| `phone_number` | `pii` | `redact` | \u274C No | \u274C No |\r\n| `operator_callsign` | `internal` | `none` | \u2705 Yes | \u2705 Yes |\r\n\r\n## 3. Storage Limitation & Right to Erasure (GDPR Art. 17)\r\n- **Maximum Retention TTL**: `365d` after account deactivation.\r\n- **Erasure Mechanism**: `crypto-shredding` (destruction of per-subject encryption key and PII column purge).\r\n\r\n---\r\n\r\n## 4. Revision History and Version Control\r\n\r\n| Version | Date | Author / Agent | Change Description | Change Reference (Change/PR) |\r\n| :--- | :--- | :--- | :--- | :--- |\r\n| **1.0.0** | 2026-10-17 | Privacy Officer (`agent-privacy-officer`) | Initial personal data asset inventory | CHG-PRIV-001 |\r\n";
 declare const STARTER_TEMPLATES_PRIVACY_DPIA_REQUEST_TEMPLATE_MD = "---\r\nid: DPIA-ASSESSMENT-001\r\ntype: dpia-request\r\ntitle: Data Protection Impact Assessment (DPIA / EIPD) Request\r\nstatus: pending-dpo-approval # pending-dpo-approval, approved, rejected\r\nversion: \"1.0.0\"\r\nschema-version: \"1.0\"\r\nropa-reference: PRIV-ROPA-USER-AUTH-001\r\ndata-assets:\r\n  - DATA-ASSET-USER-PROFILE-001\r\nspecial-category-triggers:\r\n  - \"GDPR Art. 9 Special Category Data or Automated Profiling\"\r\nresidual-risk-level: MEDIUM # LOW, MEDIUM, HIGH\r\n---\r\n\r\n# Data Protection Impact Assessment (DPIA / EIPD \u2014 GDPR Art. 35)\r\n\r\n## 1. Trigger & Necessity Assessment\r\n- **Associated ROPA**: `PRIV-ROPA-USER-AUTH-001`\r\n- **Data Assets Affected**: `DATA-ASSET-USER-PROFILE-001`\r\n- **Why a DPIA is Mandatory**: Processing involves `special_category_sensitive` data (biometrics, health, precise geolocation) or systematic automated profiling under GDPR Art. 35.\r\n\r\n## 2. Necessity, Proportionality & LINDDUN Risk Matrix\r\n\r\n| LINDDUN Threat Category | Identified Privacy Risk | Intrinsic Risk | Technical Mitigation (`PRIV-REQ-*`) | Residual Risk |\r\n| :--- | :--- | :---: | :--- | :---: |\r\n| **Identifiability** | Re-identification of operator from telemetry streams | HIGH | `PRIV-REQ-MASKING-001` (SHA-256 salted pseudonymization) | LOW |\r\n| **Disclosure of Information** | Plaintext PII leakage in error logs | HIGH | `PRIV-REQ-MASKING-001` (Redaction middleware) | LOW |\r\n\r\n## 3. Mandatory Human Sovereign Signatures (DPO & Legal)\r\n- [ ] **Data Protection Officer (DPO)**: Necessity, proportionality, and GDPR Art. 35 validation\r\n- [ ] **Legal / Privacy Counsel**: Lawful basis and cross-border transfer clauses verified\r\n- [ ] **Security Officer (CISO) / System Architect**: Cryptographic and enclave controls verified\r\n";
 declare const STARTER_TEMPLATES_PRIVACY_PRIVACY_REQ_TEMPLATE_MD = "---\r\nid: PRIV-REQ-MASKING-001\r\ntype: privacy-requirement\r\ntitle: Mandatory Pseudonymization and Log Redaction of Operator PII\r\nstatus: draft\r\nversion: \"1.0.0\"\r\nschema-version: \"1.0\"\r\nprivacy-principle: data-minimization # data-minimization, purpose-limitation, storage-limitation, accuracy, integrity-and-confidentiality, transparency-and-consent, data-subject-rights-arco, pseudonymization-anonymization\r\nlinddun-category: identifiability # linkability, identifiability, non-repudiation, detectability, disclosure-of-information, unawareness, non-compliance\r\ngoverns-ropa:\r\n  - PRIV-ROPA-USER-AUTH-001\r\nprotects-data-assets:\r\n  - DATA-ASSET-USER-PROFILE-001\r\nenforced-in-enclave: SEC-ENC-DMZ-001\r\ncompliance-references:\r\n  - \"GDPR-Art-25-Privacy-by-Design\"\r\n  - \"GDPR-Art-32-Pseudonymization\"\r\n  - \"ISO-27701-A.7.4\"\r\nacceptance-format: gherkin\r\ncucumber-tags:\r\n  - \"@PRIV-REQ-MASKING-001\"\r\n  - \"@privacy\"\r\n  - \"@linddun\"\r\nsupersedes: null\r\nsuperseded-by: null\r\n---\r\n\r\n# PRIV-REQ-MASKING-001: Mandatory Pseudonymization and Log Redaction of Operator PII\r\n\r\n## 1. Technical Privacy Control Statement\r\nThe system MUST pseudonymize or redact all `confidential-pii` fields (`email`, `phone_number`) prior to emitting structured application logs, telemetry traces, or external AI prompts, and MUST enforce automated TTL purge after `365d`.\r\n\r\n---\r\n\r\n## 2. Upstream Privacy Traceability (PDaC)\r\n\r\n| Dimension | Link / Artifact | Relationship Type | Status |\r\n| :--- | :--- | :--- | :--- |\r\n| **Record of Processing (ROPA)** | `PRIV-ROPA-USER-AUTH-001` | Governs Processing Activity | Validated |\r\n| **Protected Data Asset** | `DATA-ASSET-USER-PROFILE-001` | Enforces Field Masking & TTL | Validated |\r\n\r\n---\r\n\r\n## 3. Privacy Verification Criteria in Gherkin Format (Cucumber Privacy Tests)\r\n\r\n```gherkin\r\n@PRIV-REQ-MASKING-001 @privacy @linddun\r\nFeature: Personal Data Pseudonymization and Zero-PII Telemetry Logging\r\n  As a Data Protection Officer (DPO)\r\n  I want all personal identifiers to be redacted or salted-hashed before logging\r\n  So that application logs and telemetry never expose raw personal data\r\n\r\n  Scenario: Structured logger redacts PII fields automatically (Nominal Privacy Control)\r\n    Given an authenticated operator session with email \"operator@example.com\" and phone \"+34600112233\"\r\n    When the telemetry ingestion service emits an audit log entry\r\n    Then the serialized log payload must not contain the literal string \"operator@example.com\"\r\n    And the serialized log payload must not contain the literal string \"+34600112233\"\r\n    And the email field must be replaced by a deterministic SHA-256 salted pseudonym\r\n\r\n  Scenario: Right to erasure purges expired or revoked subject records\r\n    Given a personal data record for subject \"ACT-USER-001\" exceeding the \"365d\" retention TTL\r\n    When the automated retention enforcement job executes\r\n    Then the personal data fields must be irreversibly erased via crypto-shredding\r\n```\r\n\r\n---\r\n\r\n## 4. Revision History and Version Control\r\n\r\n| Version | Date | Author / Agent | Change Description | Change Reference (Change/PR) |\r\n| :--- | :--- | :--- | :--- | :--- |\r\n| **1.0.0** | 2026-10-17 | Privacy Officer (`agent-privacy-officer`) | Initial privacy control specification | CHG-PRIV-001 |\r\n";
 declare const STARTER_TEMPLATES_PRIVACY_PRIVACY_ROPA_TEMPLATE_MD = "---\r\nid: PRIV-ROPA-USER-AUTH-001\r\ntype: privacy-ropa\r\ntitle: Record of Processing Activity for Operator Authentication and Session Audit\r\nstatus: draft\r\nversion: \"1.0.0\"\r\nschema-version: \"1.0\"\r\nlawful-basis: contract # consent, contract, legal-obligation, vital-interests, public-task, legitimate-interests\r\nspecial-category-condition: null\r\nprocessing-purpose: \"Authenticate authorized operators and maintain tamper-evident operational session audit trails.\"\r\nuse-cases:\r\n  - UC-ACTION-001\r\ndata-assets:\r\n  - DATA-ASSET-USER-PROFILE-001\r\ndata-subjects:\r\n  - ACT-USER-001\r\nretention-ttl: 365d\r\ncross-border-transfer: false\r\ntransfer-safeguards: null\r\nsubprocessors: []\r\ndpia-required: false\r\ndpia-reference: null\r\nmitigated-by:\r\n  - PRIV-REQ-MASKING-001\r\nsupersedes: null\r\nsuperseded-by: null\r\n---\r\n\r\n# PRIV-ROPA-USER-AUTH-001: Record of Processing Activity (GDPR Art. 30)\r\n\r\n## 1. Processing Activity Summary & Lawful Basis\r\n- **Lawful Basis (GDPR Art. 6.1)**: `contract` \u2014 Necessary for the performance of the operator service agreement.\r\n- **Purpose of Processing**: Authenticate authorized operators and maintain tamper-evident operational session audit trails.\r\n\r\n## 2. Linked Product & Data Artifacts\r\n\r\n| Dimension | Artifact ID | Relationship |\r\n| :--- | :--- | :--- |\r\n| **Triggering Use Cases** | `UC-ACTION-001` | Initiates personal data collection/processing |\r\n| **Data Assets Processed** | `DATA-ASSET-USER-PROFILE-001` | Personal data fields subject to minimization |\r\n| **Data Subjects** | `ACT-USER-001` | Natural persons whose data is processed |\r\n| **Governing Privacy Controls** | `PRIV-REQ-MASKING-001` | Technical privacy-by-design controls |\r\n\r\n## 3. International Transfers & Subprocessors\r\n- **Cross-Border Transfer Outside EEA**: `false`\r\n- **Authorized Subprocessors**: None (In-house processing within `SEC-ENC-DMZ-001`).\r\n\r\n---\r\n\r\n## 4. Revision History and Version Control\r\n\r\n| Version | Date | Author / Agent | Change Description | Change Reference (Change/PR) |\r\n| :--- | :--- | :--- | :--- | :--- |\r\n| **1.0.0** | 2026-10-17 | Privacy Officer (`agent-privacy-officer`) | Initial GDPR Art. 30 ROPA entry | CHG-PRIV-001 |\r\n";
 declare const STARTER_TEMPLATES_PRODUCT_ACTOR_TEMPLATE_MD = "---\r\nid: ACT-NAME-001\r\ntype: actor\r\ntitle: Descriptive Actor Title\r\nstatus: draft\r\nversion: \"1.0.0\"\r\nschema-version: \"1.0\"\r\nrole-type: human-user # human-user, ai-agent, external-system, sensor-iot\r\ndescription: One-sentence summary of the role this actor performs in the system.\r\nsupersedes: null\r\nsuperseded-by: null\r\n---\r\n\r\n# ACT-NAME-001: Descriptive Actor Title\r\n\r\n## 1. Profile and Responsibility\r\nDescribes who this actor is, their operational context, and what goals they pursue when interacting with the product.\r\n\r\n## 2. System Touchpoints\r\n- Interaction channels (Web UI, REST API, WebSocket, Messaging).\r\n- Privilege level and latency/availability expectations.\r\n\r\n---\r\n\r\n## 3. Revision History and Version Control\r\n\r\n| Version | Date | Author / Agent | Change Description | Change Reference (Change/PR) |\r\n| :--- | :--- | :--- | :--- | :--- |\r\n| **1.0.0** | 2026-09-03 | Product Owner / Analyst | Initial actor profile creation | CHG-INIT-001 |\r\n";
+declare const STARTER_TEMPLATES_PRODUCT_BOUNDED_CONTEXT_TEMPLATE_MD = "---\nid: BC-NAME-001\ntype: bounded-context\ntitle: \"Bounded Context Name\"\nstatus: draft\nversion: \"1.0.0\"\nschema-version: \"1.0\"\ndomain-type: core\nstrategic-classification:\n  evolutionary-stage: custom-built\n  business-model-role: differentiator\nresponsibilities:\n  - \"Primary domain capability or boundary responsibility\"\nubiquitous-language-terms:\n  - TERM-NAME-001\ncontext-mapping:\n  upstream-dependencies: []\n  downstream-dependents: []\n  integration-patterns:\n    - pattern: Open Host Service / Published Language\n      related-context: BC-ANOTHER-001\ncomponents-involved:\n  - CMP-NAME-001\nsupersedes: null\nsuperseded-by: null\n---\n\n# BC-NAME-001: Bounded Context Name\n\n## 1. Context Purpose and Scope\nExecutive summary and clear linguistic boundary defining what is inside vs. outside this Bounded Context according to Domain-Driven Design (DDD).\n\n### 1.1 Strategic Domain Classification\n- **Domain Type**: `core` (Core Domain / Supporting Subdomain / Generic Subdomain)\n- **Evolutionary Stage**: `custom-built` (Genesis / Custom-Built / Product / Commodity - Wardley Mapping)\n- **Business Role**: Key differentiator creating competitive advantage for the product.\n\n---\n\n## 2. Ubiquitous Language & Domain Invariants\n- **Core Entities & Aggregates**: High-level domain concepts encapsulated within this boundary.\n- **Glossary References**:\n  - `TERM-NAME-001`: Primary ubiquitous term definition.\n- **Domain Invariants**: Critical business rules (`BR-*`) enforced exclusively within this boundary.\n\n---\n\n## 3. Context Mapping & Integration Relationships\nRelationships with adjacent Bounded Contexts:\n- **Upstream Contexts**: Contexts providing domain events, APIs, or contracts.\n- **Downstream Contexts**: Contexts consuming models from this boundary.\n- **Anti-Corruption Layers (ACL)**: Translations safeguarding ubiquitous language from external contamination.\n\n---\n\n## 4. Architecture Mapping\n- **Physical Components (`CMP-*`)**: Components implementing aggregates, services, or adapters within this context.\n- **Security Enclaves (`SEC-ENC-*`)**: Execution boundary or isolation tier.\n\n---\n\n## 5. Revision History\n\n| Version | Date | Author / Agent | Change Description | Change Reference (Change/PR) |\n| :--- | :--- | :--- | :--- | :--- |\n| **1.0.0** | YYYY-MM-DD | Product Analyst / Architect | Initial Bounded Context definition | CHG-INIT-001 |\n";
 declare const STARTER_TEMPLATES_PRODUCT_BUSINESS_RULE_TEMPLATE_MD = "---\r\nid: BR-DOMAIN-001\r\ntype: business-rule\r\ntitle: Business Rule Name\r\nstatus: draft\r\nversion: \"1.0.0\"\r\nschema-version: \"1.0\"\r\nenforcement-level: strict-invariant # strict-invariant, override-with-approval, guideline\r\ndefined-in: BC-CONTEXT-001\r\nuses-terms:\r\n  - TERM-TERM-001\r\nsupersedes: null\r\nsuperseded-by: null\r\n---\r\n\r\n# BR-DOMAIN-001: Business Rule Name\r\n\r\n## 1. Rule Definition\r\nFormally establishes the business invariant that must not be violated under any circumstance.\r\n\r\n## 2. Business Rationale and Consequences\r\n- **Why it exists**: Economic, regulatory, or technical justification for the constraint.\r\n- **Action upon violation**: Immediate transaction rejection with a formal error code.\r\n\r\n---\r\n\r\n## 3. Revision History and Version Control\r\n\r\n| Version | Date | Author / Agent | Change Description | Change Reference (Change/PR) |\r\n| :--- | :--- | :--- | :--- | :--- |\r\n| **1.0.0** | 2026-09-03 | Product Owner / Analyst | Initial business rule definition | CHG-INIT-001 |\r\n";
 declare const STARTER_TEMPLATES_PRODUCT_JOURNEY_TEMPLATE_MD = "---\r\nid: JRN-NAME-001\r\ntype: journey\r\ntitle: Descriptive User or Operator Journey Title\r\nstatus: draft\r\nversion: \"1.0.0\"\r\nschema-version: \"1.0\"\r\npersona: ACT-OPERATOR-001\r\nstages:\r\n  - \"Discovery and Planning\"\r\n  - \"Configuration and Pre-flight\"\r\n  - \"Mission Execution\"\r\n  - \"Post-Analysis and Wrap-up\"\r\ntouchpoints:\r\n  - \"Mission planning web portal\"\r\n  - \"Ground control station (GCS)\"\r\n  - \"Real-time telemetry dashboard\"\r\n  - \"Flight report exporter\"\r\nrelated-use-cases:\r\n  - UC-PLAN-MISSION-001\r\n  - UC-MONITOR-FLIGHT-001\r\npain-points:\r\n  - \"Latency when loading offline navigation maps\"\r\n  - \"Complexity in manual flight plan reconciliation\"\r\nsupersedes: null\r\nsuperseded-by: null\r\n---\r\n\r\n# JRN-NAME-001: Descriptive User or Operator Journey Title\r\n\r\n## 1. Actor / Primary Persona Profile\r\n- **Protagonist Actor**: `ACT-OPERATOR-001`\r\n- **Main Goal**: Complete operational workflow with high efficiency, safety, and real-time visibility.\r\n\r\n---\r\n\r\n## 2. Journey Stages Map\r\n\r\n| Stage | User Goal | Touchpoints | Frictions / Pain Points |\r\n| :--- | :--- | :--- | :--- |\r\n| **1. Discovery and Planning** | Design route and validate operational constraints | Mission planning web portal | Complexity in manual flight plan reconciliation |\r\n| **2. Configuration and Pre-flight** | Verify subsystem health and link integrity | Ground control station (GCS) | Latency when loading offline navigation maps |\r\n| **3. Mission Execution** | Supervise telemetry and respond to alerts | Real-time telemetry dashboard | None detected in nominal flow |\r\n| **4. Post-Analysis and Wrap-up** | Export mission logs and performance metrics | Flight report exporter | Telemetry consolidation latency |\r\n\r\n---\r\n\r\n## 3. Traceability to Use Cases and Product\r\n\r\n- `UC-PLAN-MISSION-001`: Planning and validation of safe corridors.\r\n- `UC-MONITOR-FLIGHT-001`: Ingestion and visualization of real-time telemetry.\r\n\r\n---\r\n\r\n## 4. Revision History\r\n\r\n| Version | Date | Author / Agent | Change Description | Change Reference (Change/PR) |\r\n| :--- | :--- | :--- | :--- | :--- |\r\n| **1.0.0** | 2026-09-23 | Product Manager / UX Lead | Initial operator journey definition | CHG-INIT-001 |\r\n";
 declare const STARTER_TEMPLATES_PRODUCT_REQUIREMENT_TEMPLATE_MD = "---\r\n# Valid prefixes: FR- (Functional), QR- (Quality), CON- (Constraint)\r\nid: FR-FEATURE-001\r\ntype: requirement\r\ntitle: Concise Requirement Title\r\nstatus: draft\r\nversion: \"1.0.0\"\r\nschema-version: \"1.0\"\r\ncategory: functional # functional, quality, constraint\r\n\r\n# 1. PRODUCT TRACEABILITY (Upstream)\r\nderives-from:\r\n  - UC-ACTION-001\r\n\r\n# 2. METHOD AND ACCEPTANCE CRITERIA\r\nverifiable-by: cucumber-bdd # cucumber-bdd, automated-unit-test, integration-test, performance-benchmark\r\nacceptance-format: gherkin # gherkin, declarative-prose\r\ncucumber-tags:\r\n  - \"@FR-FEATURE-001\"\r\n  - \"@automated\"\r\n  - \"@regression\"\r\n\r\nsupersedes: null\r\nsuperseded-by: null\r\n---\r\n\r\n# FR-FEATURE-001: Concise Requirement Title\r\n\r\n## 1. Normative Statement\r\nThe system MUST [unambiguous and atomic description of expected behavior under specific conditions].\r\n\r\n---\r\n\r\n## 2. Upstream Traceability\r\n\r\n| Dimension | Link / Artifact | Relationship Type | Status |\r\n| :--- | :--- | :--- | :--- |\r\n| **Product (Upstream)** | `UC-ACTION-001` | Derived from Use Case | Validated |\r\n\r\n> *Note: Traceability toward Architecture and Testing is maintained inversely; services declare `satisfies-requirements` and test suites tag or reference this requirement.*\r\n\r\n---\r\n\r\n## 3. Acceptance Criteria in Gherkin (Cucumber) Format\r\n\r\n```gherkin\r\n@FR-FEATURE-001 @automated @regression\r\nFeature: Concise Requirement Title\r\n  As a [primary actor / user role]\r\n  I want [functional system capability]\r\n  So that [obtain expected business benefit or value]\r\n\r\n  Background:\r\n    Given the system is in operational state\r\n    And the actor is authenticated with valid permissions\r\n\r\n  Scenario: Successful nominal flow\r\n    Given the system has initial precondition configured\r\n    When the actor submits a request with valid parameters\r\n    Then the system processes the operation successfully\r\n    And the resource status updates to \"ACTIVE\"\r\n    And the corresponding domain event is emitted\r\n\r\n  Scenario Outline: Business rule validation and edge cases\r\n    Given data input with value \"<input>\"\r\n    When requirement validation is processed\r\n    Then the response must return status code \"<status_code>\"\r\n    And the descriptive message must be \"<message>\"\r\n\r\n    Examples:\r\n      | input          | status_code | message                 |\r\n      | correct_value  | 200         | SUCCESSFUL_OPERATION    |\r\n      | invalid_value  | 400         | ERROR_INVALID_PARAMETER |\r\n      | limit_exceeded | 422         | ERROR_LIMIT_EXCEEDED    |\r\n```\r\n\r\n---\r\n\r\n## 4. Revision History and Version Control\r\n\r\n| Version | Date | Author / Agent | Change Description | Change Reference (Change/PR) |\r\n| :--- | :--- | :--- | :--- | :--- |\r\n| **1.0.0** | 2026-09-03 | Product Owner / QA | Initial specification with complete 360\u00B0 traceability | CHG-INIT-001 |\r\n";
@@ -2018,11 +2207,11 @@ interface LifecycleSkillTemplate {
 }
 declare const LIFECYCLE_SKILL_TEMPLATES: readonly LifecycleSkillTemplate[];
 declare function renderAntigravitySkillFile(skill: LifecycleSkillTemplate): string;
-declare const STARTER_ANTIGRAVITY_RULES = "# Google Antigravity & Gemini CLI Rules - AI-SDLC Framework\n\nCanonical Reference: [`process/09_agent_protocols.md`](../../process/09_agent_protocols.md) and [`process/01_governance_and_roles.md`](../../process/01_governance_and_roles.md).\n\nThis file defines the operational rules and specialized role mappings for Google Antigravity and Gemini CLI-based agents within the AI-SDLC ecosystem.\n\n---\n\n## 1. The 5 Unbreakable Commandments of Agents | Los 5 Mandamientos Inquebrantables de los Agentes\n\n1. **FORBIDDEN TO AUTO-APPROVE OR AUTO-MERGE | PROHIBIDO AUTO-APROBAR O AUTO-FUSIONAR**: No agent may auto-approve PRs or perform direct merges to protected branches (`main`, `release/*`). Only a human engineer may approve or merge.\n2. **FORBIDDEN TO INVENT PRODUCT OR ARCHITECTURE DECISIONS**: When facing ambiguous requirements, formulate clarifying questions (`open-questions`). Never assume unspecified intentions.\n3. **FORBIDDEN TO INTRODUCE DEPENDENCIES WITHOUT LICENSE INSPECTION**: Always consult `license-policy.yaml`. Dependencies with viral licenses (`GPL`/`AGPL`) or commercial paid licenses (`BSL`/`SSPL`) are strictly forbidden without authorization.\n4. **FORBIDDEN TO IGNORE CYBERSECURITY & PRIVACY (SECURITY-BY-DEFAULT & PRIVACY-BY-DEFAULT)**: Validate inputs, sanitize data, protect PII according to `privacy-policy.yaml`, and add mitigation tests (`SEC-TEST-*`, `@privacy`). Disabling linters or suppressing typing errors is prohibited.\n5. **MANDATORY CRYPTOGRAPHIC CITATION**: Every derived artifact must cite upstream artifacts using canonical identifiers and their Unix LF-normalized SHA-256 cryptographic hashes.\n\n---\n\n## 2. Specialized Roles Mapping\n\n### 1. `agent-product-analyst` (Product Analyst / Scribe)\n- **Mission**: Capture new product intent via NAF v4 Enterprise & Capability Vision (`ARCH-INTRO-*`) and define/refine the product model using ProductShape.\n- **Phase 0 (Greenfield Product Inception)**: When creating a new product from scratch (or when `specs/product/` has no baseline), run a concise 3\u20135 question discovery interview (mission/problem, actors `ACT-*`, MVP capabilities `UC-*`, priority quality goals `QR-*`), draft `ARCH-INTRO-001` (`templates/architecture/introduction-and-goals.template.md`), and derive initial `ACT-*`, `UC-*`, `BR-*`, `FR-*`, and `QR-*` drafts.\n- **Input**: Business intent or natural language specification.\n- **Output**: Markdown artifacts with YAML frontmatter compliant with `schemas/architecture/introduction-and-goals.schema.json` (`ARCH-INTRO-*`) and `schemas/product/` (`ACT-*`, `UC-*`, `FR-*`, `QR-*`, `BR-*`).\n- **Guardrails**:\n  - `status` always starts in `draft`.\n  - In `UC-*`, format section `1. Intent and Outcome` under the standard English structure: `As a <ACT-ID>... I want <action>... To <outcome>...`.\n  - Mandatory Gherkin criteria with `@<ID> @automated @regression`.\n  - Run `pnpm run verify:schemas` and `pnpm run verify:duplicates` before delivering the draft.\n\n### 2. `agent-threat-modeler` (Threat Modeler and Security Specialist)\n- **Mission**: Analyze use cases and proactively model adversaries, STRIDE attack vectors, and OWASP ASVS mitigations, both at product level and in the technical security feedback loop over architecture.\n- **Input**: Use cases `UC-*`, functional requirements `FR-*`, or architecture components (`CMP-*`, Mermaid diagrams, ADRs).\n- **Output**: Cybersecurity triad (`ACT-THREAT-*`, `ABUSE-*`, `SEC-REQ-*`) compliant with `schemas/security/`, followed by handoff to `agent-privacy-officer`.\n- **Guardrails**:\n  - `status` always starts in `draft`.\n  - Negative BDD attack and rejection scenarios tagged with `@security @mitigation`.\n  - Assignment of Zero Trust enclaves `SEC-ENC-*`.\n\n### 3. `agent-privacy-officer` (Data Protection & Privacy-by-Design Specialist)\n- **Mission**: Receive handoff from `agent-threat-modeler` to model personal data assets (`DATA-ASSET-*`), GDPR Art. 30 processing activities (`PRIV-ROPA-*`), and LINDDUN / GDPR / ISO 27701 privacy requirements (`PRIV-REQ-*`), and audit PR diffs against `privacy-policy.yaml`.\n- **Output**: Privacy triad (`DATA-ASSET-*`, `PRIV-ROPA-*`, `PRIV-REQ-*`) in `specs/privacy/` compliant with `schemas/privacy/`, and `DPIA-*` requests when Art. 9 sensitive data is detected.\n- **Guardrails**:\n  - `status` always starts in `draft`.\n  - Every `PRIV-REQ-*` includes Gherkin scenarios tagged with `@<PRIV-REQ-ID> @privacy @gdpr @automated @regression`.\n  - Run `pnpm run verify:privacy` to block PII in logs/prompts and enforce ROPA & retention/erasure policies.\n\n### 4. `agent-system-architect` (System Architect)\n- **Mission**: Translate the approved product definition into a modular technical architecture based on arc42 enriched with NAF v4.\n- **Output**: Architecture components (`CMP-*`), Mermaid diagrams, and immutable `ADR-*` records compliant with `schemas/architecture/`.\n- **Guardrails**:\n  - Every `CMP-*` must declare `satisfies-requirements` linking `FR-*`, `QR-*`, `SEC-REQ-*`, and `PRIV-REQ-*`.\n  - Emit a return handoff to `agent-threat-modeler` (chaining to `agent-privacy-officer`) in the technical security/privacy feedback loop when infrastructure or persistence decisions introduce new attack vectors or PII flows.\n\n### 5. `agent-qa-engineer` (QA Engineer and SDET)\n- **Mission**: Translate approved requirements (`FR-*`, `SEC-REQ-*`, `PRIV-REQ-*`, `QR-*`) into comprehensive FAILING (red) BDD/Gherkin, End-to-End (E2E), UI, and unit test suites, before `agent-developer` writes production code.\n- **Input**: Approved requirements from the `handoff.yaml` sidecar (`HOF-*`).\n- **Output**: Failing Gherkin, E2E, and UI test suites covering: nominal case, boundary cases, out-of-range cases, per-interactive-element tests (Happy Path, Sad Path, Boundary Values), and conditional categories (security, privacy, performance, idempotency, postconditions, interface contract).\n- **Guardrails**:\n  - FORBIDDEN to include production code or anticipate implementations.\n  - **Agreed Project Technology**: Always use the testing frameworks, E2E/UI runners, and technology stack agreed upon for the project (if any), without requiring the user to specify it in the prompt.\n  - **Mandatory E2E & UI Testing**: Never forget or omit End-to-End (E2E) and User Interface (UI) tests.\n  - **Per-Interactive-Element Coverage**: Create specific tests for every UI element the user can interact with, covering Happy Path, Sad Path, and Boundary Values for each one.\n  - Every `FR-*` must have at least nominal + boundary + out-of-range scenarios; missing these blocks handoff to `agent-developer`.\n  - Mandatory tags: `@<FR-ID> @automated @regression`.\n  - Run `pnpm run verify:testing` before emitting handoff.\n\n### 6. `agent-developer` (Software Developer)\n- **Mission**: Implement atomic tasks from SDD specifications (`tasks.md`) with clean, strictly typed code and thorough tests.\n- **Directives**:\n  - **Mandatory 4-Step Implementation Order**: (1) Define/refine Clean Architecture layers & boundaries, (2) Define interfaces/ports for all inter-module interactions to avoid direct module coupling, (3) Implement components consuming/fulfilling those interfaces, (4) Write unit tests for every function covering Happy Path, Sad Path, Boundary Values, and Unexpected/Null/Empty values.\n  - Respect the autonomy mode assigned in `tasks.md` (`AUTONOMOUS`, `HUMAN_REVIEW_PLAN`, `AMBIGUOUS`, `HIGH_RISK_MANUAL`).\n  - Make tests delivered by `agent-qa-engineer` pass green without altering them to accommodate code.\n  - Respect `quality-policy.yaml` thresholds: CC $\\le 10$, Cognitive $\\le 15$, MI $\\ge 50$, LOC $\\le 40$.\n  - Run pre-flight with auto-fix: `pnpm run check:fix` and full verification: `pnpm run verify:all`.\n  - Upon completing green implementation, suggest handoff to `agent-expert-user` for post-development functional validation prior to security and privacy audit.\n\n### 7. `agent-security-auditor` (Adversarial Code Auditor)\n- **Mission**: Rigorously examine Pull Requests for business logic vulnerabilities, injection vectors, secret leaks, and authorization flaws as part of the Pre-Merge Audit Triad.\n- **Directives**:\n  - Analyze code diffs with an attacker mindset and run `pnpm run verify:security`.\n  - Issue findings with CVSS v3.1 severity scoring and block any PR introducing CRITICAL or HIGH security risks.\n\n### 8. `agent-compliance-checker` (Open Source License Compliance Auditor)\n- **Mission**: Audit dependency manifests and ensure every direct and transitive third-party package complies with `license-policy.yaml` as part of the Pre-Merge Audit Triad.\n- **Directives**:\n  - Verify SPDX identifiers via `pnpm run verify:licenses`, immediately blocking viral (`GPL`, `AGPL`) or unapproved commercial (`BSL`, `SSPL`) licenses.\n\n### 9. `agent-expert-user` (Expert User and Domain Evaluator)\n- **Mission**: Contrast design and specifications (design phase) and functionally validate finished software against `UC-*` and `FR-*` (post-development phase).\n- **Directives**:\n  - Design mode (upstream): Adopt the primary actor's profile under stressful field conditions, applying bimodal discrimination (strict MVP core vs. roadmap suggestion backlog in `templates/product/user-design-feedback.template.md`).\n  - Functional validation mode (downstream / pre-PR / post-development functional validation): Thoroughly contrast interface and actual CLI execution against `UC-*` and `FR-*` acceptance criteria before pre-merge security audit.\n  - Emit handoff block suggesting `agent-code-reviewer` / `agent-security-auditor` / `agent-privacy-officer` if compliant, or return to `agent-developer` on functional drift.\n\n### 10. `agent-code-reviewer` (Technical and Architectural Code Reviewer)\n- **Mission**: Audit Pull Requests evaluating code cleanliness, adherence to SOLID, DRY, YAGNI principles, design patterns, and respect for complexity and maintainability thresholds (`quality-policy.yaml`), forming part of the Pre-Merge Audit Triad.\n- **Directives**:\n  - Respect `quality-policy.yaml` thresholds: CC $\\le 10$, Cognitive $\\le 15$, MI $\\ge 50$, LOC $\\le 40$.\n  - Detect improper coupling, code smells, magic numbers, ambiguous names, and encapsulation violations.\n  - Flag premature abstractions and speculative code violating YAGNI.\n  - Coordinate Pre-Merge Audit Triad with `agent-security-auditor`, `agent-privacy-officer`, and `agent-compliance-checker`.\n  - Classify findings into: `[BLOCKING]` (quality violation or broken pattern), `[CLEAN_CODE_SUGGESTION]` (non-blocking improvement), and `[COMPLIANT]`.\n\n### 11. `agent-devops` (Automation and Infrastructure Engineer)\n- **Mission**: Maintain, evolve, and audit automated project infrastructure: CI/CD workflows, Docker containers, IaC manifests, and support scripts.\n- **Directives**:\n  - Strict infrastructure domain: Operates exclusively in `.github/workflows/`, `Dockerfile*`, `docker-compose*.yml`, IaC manifests, and `scripts/`.\n  - **NON-INVASION GUARDRAIL**: STRICTLY FORBIDDEN from modifying or refactoring application source code files (`src/`, `packages/*/src/`). Your responsibility is the pipeline and scaffolding, never application business logic.\n  - Infrastructure dependency policy: Verify licenses of dependencies, base images, and third-party actions according to `license-policy.yaml`.\n  - Gate preservation: Ensure pipeline optimizations preserve all existing deterministic Quality Gates intact.\n\n---\n\n## 3. Git 4-Tier Hierarchy and Commit Conventions\n- `task/<PARENT-ID>/<TSK-ID>-<slug>` $\\rightarrow$ `feat/<FEAT-ID>-<slug>` $\\rightarrow$ `release/vX.Y.Z` $\\rightarrow$ `main`.\n- Mandatory commit trailers injection:\n  ```text\n  Author-Type: agent\n  AI-Model: gemini-1.5-pro / gemini-2.0-flash\n  Task-ID: TSK-XXX\n  Change-ID: CHG-XXX\n  ```\n\n---\n\n## 4. Workflow Handoff Protocol and Human Action Window | Ventana de Acci\u00F3n Humana\n- **Conditional Activation Rule by Autonomy**:\n  - \uD83D\uDFE2 **`AUTONOMOUS`** (or exclusive final supervision in PR/CI): **OMITTED**. Do not request or emit interactive handoff to avoid interrupting unattended execution.\n  - \uD83D\uDFE1 **Autonomy $\\ge$ `HUMAN_REVIEW_PLAN`** (`HUMAN_REVIEW_PLAN`, `AMBIGUOUS`, `HIGH_RISK_MANUAL`): **MANDATORY**. Emit the Workflow Handoff block compliant with [`templates/workflow/agent-handoff.template.md`](../../templates/workflow/agent-handoff.template.md) and **STOP**.\n- **Block Contents**: Declare produced deliverables, recommend the next role in workflow (`agent-threat-modeler`, `agent-privacy-officer`, `agent-system-architect`, `agent-qa-engineer`, `agent-developer`, `agent-expert-user`, `agent-code-reviewer`, `agent-security-auditor`, `agent-compliance-checker`, `agent-devops`, etc.), provide suggested invocation prompt, and keep **the Human Action Window open at all times for the human user to take action** (review, edit by hand, pause/reroute, or delegate).\n";
+declare const STARTER_ANTIGRAVITY_RULES = "# Google Antigravity & Gemini CLI Rules - AI-SDLC Framework\n\nCanonical Reference: [`process/09_agent_protocols.md`](../../process/09_agent_protocols.md) and [`process/01_governance_and_roles.md`](../../process/01_governance_and_roles.md).\n\nThis file defines the operational rules and specialized role mappings for Google Antigravity and Gemini CLI-based agents within the AI-SDLC ecosystem.\n\n---\n\n## 1. The 5 Unbreakable Commandments of Agents | Los 5 Mandamientos Inquebrantables de los Agentes\n\n1. **FORBIDDEN TO AUTO-APPROVE OR AUTO-MERGE | PROHIBIDO AUTO-APROBAR O AUTO-FUSIONAR**: No agent may auto-approve PRs or perform direct merges to protected branches (`main`, `release/*`). Only a human engineer may approve or merge.\n2. **FORBIDDEN TO INVENT PRODUCT OR ARCHITECTURE DECISIONS**: When facing ambiguous requirements, formulate clarifying questions (`open-questions`). Never assume unspecified intentions.\n3. **FORBIDDEN TO INTRODUCE DEPENDENCIES WITHOUT LICENSE INSPECTION**: Always consult `license-policy.yaml`. Dependencies with viral licenses (`GPL`/`AGPL`) or commercial paid licenses (`BSL`/`SSPL`) are strictly forbidden without authorization.\n4. **FORBIDDEN TO IGNORE CYBERSECURITY & PRIVACY (SECURITY-BY-DEFAULT & PRIVACY-BY-DEFAULT)**: Validate inputs, sanitize data, protect PII according to `privacy-policy.yaml`, and add mitigation tests (`SEC-TEST-*`, `@privacy`). Disabling linters or suppressing typing errors is prohibited.\n5. **MANDATORY CRYPTOGRAPHIC CITATION**: Every derived artifact must cite upstream artifacts using canonical identifiers and their Unix LF-normalized SHA-256 cryptographic hashes.\n\n---\n\n## 2. Specialized Roles Mapping\n\n### 1. `agent-product-analyst` (Product Analyst / Scribe)\n- **Mission**: Capture new product intent via NAF v4 Enterprise & Capability Vision (`ARCH-INTRO-*`) and define/refine the product model using ProductShape.\n- **Phase 0 (Greenfield Product Inception)**: When creating a new product from scratch (or when `specs/product/` has no baseline), run a concise 3\u20135 question discovery interview (mission/problem, actors `ACT-*`, MVP capabilities `UC-*`, priority quality goals `QR-*`), draft `ARCH-INTRO-001` (`templates/architecture/introduction-and-goals.template.md`), and derive initial `ACT-*`, `UC-*`, `BR-*`, `FR-*`, and `QR-*` drafts.\n- **Input**: Business intent or natural language specification.\n- **Output**: Markdown artifacts with YAML frontmatter compliant with `schemas/architecture/introduction-and-goals.schema.json` (`ARCH-INTRO-*`) and `schemas/product/` (`ACT-*`, `UC-*`, `FR-*`, `QR-*`, `BR-*`).\n- **Guardrails**:\n  - `status` always starts in `draft`.\n  - In `UC-*`, format section `1. Intent and Outcome` under the standard English structure: `As a <ACT-ID>... I want <action>... To <outcome>...`.\n  - Mandatory Gherkin criteria with `@<ID> @automated @regression`.\n  - Run `pnpm run verify:schemas` and `pnpm run verify:duplicates` before delivering the draft.\n\n### 2. `agent-threat-modeler` (Threat Modeler and Security Specialist)\n- **Mission**: Analyze use cases and proactively model adversaries, STRIDE attack vectors, and OWASP ASVS mitigations, both at product level and in the technical security feedback loop over architecture.\n- **Input**: Use cases `UC-*`, functional requirements `FR-*`, or architecture components (`CMP-*`, Mermaid diagrams, ADRs).\n- **Output**: Cybersecurity triad (`ACT-THREAT-*`, `ABUSE-*`, `SEC-REQ-*`) compliant with `schemas/security/`, followed by handoff to `agent-privacy-officer`.\n- **Guardrails**:\n  - `status` always starts in `draft`.\n  - Negative BDD attack and rejection scenarios tagged with `@security @mitigation`.\n  - Assignment of Zero Trust enclaves `SEC-ENC-*`.\n\n### 3. `agent-privacy-officer` (Data Protection & Privacy-by-Design Specialist)\n- **Mission**: Receive handoff from `agent-threat-modeler` to model personal data assets (`DATA-ASSET-*`), GDPR Art. 30 processing activities (`PRIV-ROPA-*`), and LINDDUN / GDPR / ISO 27701 privacy requirements (`PRIV-REQ-*`), and audit PR diffs against `privacy-policy.yaml`.\n- **Output**: Privacy triad (`DATA-ASSET-*`, `PRIV-ROPA-*`, `PRIV-REQ-*`) in `specs/privacy/` compliant with `schemas/privacy/`, and `DPIA-*` requests when Art. 9 sensitive data is detected.\n- **Guardrails**:\n  - `status` always starts in `draft`.\n  - Every `PRIV-REQ-*` includes Gherkin scenarios tagged with `@<PRIV-REQ-ID> @privacy @gdpr @automated @regression`.\n  - Run `pnpm run verify:privacy` to block PII in logs/prompts and enforce ROPA & retention/erasure policies.\n\n### 4. `agent-system-architect` (System Architect)\n- **Mission**: Translate the approved product definition into a modular technical architecture based on arc42 enriched with NAF v4.\n- **Output**: Architecture components (`CMP-*`), Mermaid diagrams, and immutable `ADR-*` records compliant with `schemas/architecture/`.\n- **Guardrails**:\n  - Every `CMP-*` must declare `satisfies-requirements` linking `FR-*`, `QR-*`, `SEC-REQ-*`, and `PRIV-REQ-*`, and structure modules following **Modular & Hexagonal Architecture (Ports & Adapters)** (Domain/Application Core + Inbound/Outbound Ports, enforcing the Dependency Rule).\n  - Emit a return handoff to `agent-threat-modeler` (chaining to `agent-privacy-officer`) in the technical security/privacy feedback loop when infrastructure or persistence decisions introduce new attack vectors or PII flows.\n\n### 5. `agent-qa-engineer` (QA Engineer and SDET)\n- **Mission**: Translate approved requirements (`FR-*`, `SEC-REQ-*`, `PRIV-REQ-*`, `QR-*`) into comprehensive FAILING (red) BDD/Gherkin, End-to-End (E2E), UI, and unit test suites, before `agent-developer` writes production code.\n- **Input**: Approved requirements from the `handoff.yaml` sidecar (`HOF-*`).\n- **Output**: Failing Gherkin, E2E, and UI test suites covering: nominal case, boundary cases, out-of-range cases, per-interactive-element tests (Happy Path, Sad Path, Boundary Values), and conditional categories (security, privacy, performance, idempotency, postconditions, interface contract).\n- **Guardrails**:\n  - FORBIDDEN to include production code or anticipate implementations.\n  - **Agreed Project Technology**: Always use the testing frameworks, E2E/UI runners, and technology stack agreed upon for the project (if any), without requiring the user to specify it in the prompt.\n  - **Mandatory E2E & UI Testing**: Never forget or omit End-to-End (E2E) and User Interface (UI) tests.\n  - **Per-Interactive-Element Coverage**: Create specific tests for every UI element the user can interact with, covering Happy Path, Sad Path, and Boundary Values for each one.\n  - Every `FR-*` must have at least nominal + boundary + out-of-range scenarios; missing these blocks handoff to `agent-developer`.\n  - Mandatory tags: `@<FR-ID> @automated @regression`.\n  - Run `pnpm run verify:testing` before emitting handoff.\n\n### 6. `agent-developer` (Software Developer)\n- **Mission**: Implement atomic tasks from SDD specifications (`tasks.md`) with clean, strictly typed code and thorough tests.\n- **Directives**:\n  - **Mandatory 4-Step Implementation Order**: (1) Define/refine Modular & Hexagonal Architecture (Ports & Adapters) module boundaries, (2) Define interfaces/ports for all inter-module interactions to avoid direct module coupling, (3) Implement components consuming/fulfilling those interfaces, (4) Write unit tests for every function covering Happy Path, Sad Path, Boundary Values, and Unexpected/Null/Empty values.\n  - Respect the autonomy mode assigned in `tasks.md` (`AUTONOMOUS`, `HUMAN_REVIEW_PLAN`, `AMBIGUOUS`, `HIGH_RISK_MANUAL`).\n  - Make tests delivered by `agent-qa-engineer` pass green without altering them to accommodate code.\n  - Respect `quality-policy.yaml` thresholds: CC $\\le 10$, Cognitive $\\le 15$, MI $\\ge 50$, LOC $\\le 40$.\n  - Run pre-flight with auto-fix: `pnpm run check:fix` and full verification: `pnpm run verify:all`.\n  - Upon completing green implementation, suggest handoff to `agent-expert-user` for post-development functional validation prior to security and privacy audit.\n\n### 7. `agent-security-auditor` (Adversarial Code Auditor)\n- **Mission**: Rigorously examine Pull Requests for business logic vulnerabilities, injection vectors, secret leaks, and authorization flaws as part of the Pre-Merge Audit Triad.\n- **Directives**:\n  - Analyze code diffs with an attacker mindset and run `pnpm run verify:security`.\n  - Issue findings with CVSS v3.1 severity scoring and block any PR introducing CRITICAL or HIGH security risks.\n\n### 8. `agent-compliance-checker` (Open Source License Compliance Auditor)\n- **Mission**: Audit dependency manifests and ensure every direct and transitive third-party package complies with `license-policy.yaml` as part of the Pre-Merge Audit Triad.\n- **Directives**:\n  - Verify SPDX identifiers via `pnpm run verify:licenses`, immediately blocking viral (`GPL`, `AGPL`) or unapproved commercial (`BSL`, `SSPL`) licenses.\n\n### 9. `agent-expert-user` (Expert User and Domain Evaluator)\n- **Mission**: Contrast design and specifications (design phase) and functionally validate finished software against `UC-*` and `FR-*` (post-development phase).\n- **Directives**:\n  - Design mode (upstream): Adopt the primary actor's profile under stressful field conditions, applying bimodal discrimination (strict MVP core vs. roadmap suggestion backlog in `templates/product/user-design-feedback.template.md`).\n  - Functional validation mode (downstream / pre-PR / post-development functional validation): Thoroughly contrast interface and actual CLI execution against `UC-*` and `FR-*` acceptance criteria before pre-merge security audit.\n  - Emit handoff block suggesting `agent-code-reviewer` / `agent-security-auditor` / `agent-privacy-officer` if compliant, or return to `agent-developer` on functional drift.\n\n### 10. `agent-code-reviewer` (Technical and Architectural Code Reviewer)\n- **Mission**: Audit Pull Requests evaluating code cleanliness, adherence to SOLID, DRY, YAGNI principles, design patterns, and respect for complexity and maintainability thresholds (`quality-policy.yaml`), forming part of the Pre-Merge Audit Triad.\n- **Directives**:\n  - Respect `quality-policy.yaml` thresholds: CC $\\le 10$, Cognitive $\\le 15$, MI $\\ge 50$, LOC $\\le 40$.\n  - Detect improper coupling, code smells, magic numbers, ambiguous names, and encapsulation violations.\n  - Flag premature abstractions and speculative code violating YAGNI.\n  - Coordinate Pre-Merge Audit Triad with `agent-security-auditor`, `agent-privacy-officer`, and `agent-compliance-checker`.\n  - Classify findings into: `[BLOCKING]` (quality violation or broken pattern), `[CLEAN_CODE_SUGGESTION]` (non-blocking improvement), and `[COMPLIANT]`.\n\n### 11. `agent-devops` (Automation and Infrastructure Engineer)\n- **Mission**: Maintain, evolve, and audit automated project infrastructure: CI/CD workflows, Docker containers, IaC manifests, and support scripts.\n- **Directives**:\n  - Strict infrastructure domain: Operates exclusively in `.github/workflows/`, `Dockerfile*`, `docker-compose*.yml`, IaC manifests, and `scripts/`.\n  - **NON-INVASION GUARDRAIL**: STRICTLY FORBIDDEN from modifying or refactoring application source code files (`src/`, `packages/*/src/`). Your responsibility is the pipeline and scaffolding, never application business logic.\n  - Infrastructure dependency policy: Verify licenses of dependencies, base images, and third-party actions according to `license-policy.yaml`.\n  - Gate preservation: Ensure pipeline optimizations preserve all existing deterministic Quality Gates intact.\n\n---\n\n## 3. Git 4-Tier Hierarchy and Commit Conventions\n- `task/<PARENT-ID>/<TSK-ID>-<slug>` $\\rightarrow$ `feat/<FEAT-ID>-<slug>` $\\rightarrow$ `release/vX.Y.Z` $\\rightarrow$ `main`.\n- Mandatory commit trailers injection:\n  ```text\n  Author-Type: agent\n  AI-Model: gemini-1.5-pro / gemini-2.0-flash\n  Task-ID: TSK-XXX\n  Change-ID: CHG-XXX\n  ```\n\n---\n\n## 4. Workflow Handoff Protocol and Human Action Window | Ventana de Acci\u00F3n Humana\n- **Conditional Activation Rule by Autonomy**:\n  - \uD83D\uDFE2 **`AUTONOMOUS`** (or exclusive final supervision in PR/CI): **OMITTED**. Do not request or emit interactive handoff to avoid interrupting unattended execution.\n  - \uD83D\uDFE1 **Autonomy $\\ge$ `HUMAN_REVIEW_PLAN`** (`HUMAN_REVIEW_PLAN`, `AMBIGUOUS`, `HIGH_RISK_MANUAL`): **MANDATORY**. Emit the Workflow Handoff block compliant with [`templates/workflow/agent-handoff.template.md`](../../templates/workflow/agent-handoff.template.md) and **STOP**.\n- **Block Contents**: Declare produced deliverables, recommend the next role in workflow (`agent-threat-modeler`, `agent-privacy-officer`, `agent-system-architect`, `agent-qa-engineer`, `agent-developer`, `agent-expert-user`, `agent-code-reviewer`, `agent-security-auditor`, `agent-compliance-checker`, `agent-devops`, etc.), provide suggested invocation prompt, and keep **the Human Action Window open at all times for the human user to take action** (review, edit by hand, pause/reroute, or delegate).\n";
 declare const STARTER_CURSOR_CORE_RULES = "---\ndescription: Global canonical directives, 5 unbreakable commandments, and AI-SDLC pre-flight\nglobs: *\nalwaysApply: true\n---\n\n# Global AI-SDLC Rules (Core)\n\nCanonical Reference: [`process/09_agent_protocols.md`](process/09_agent_protocols.md) and [`process/01_governance_and_roles.md`](process/01_governance_and_roles.md).\n\n## 1. The 5 Unbreakable Commandments of Agents | Los 5 Mandamientos Inquebrantables de los Agentes\nEvery agent operating in this repository must strictly observe the following guardrails:\n1. **FORBIDDEN TO AUTO-APPROVE OR AUTO-MERGE | PROHIBIDO AUTO-APROBAR O AUTO-FUSIONAR**: Do not approve PRs or execute direct merges to protected branches (`main`, `release/*`). Approval is exclusively reserved for human reviewers.\n2. **FORBIDDEN TO INVENT PRODUCT OR ARCHITECTURE DECISIONS**: When facing ambiguity, formulate open questions (`open-questions`). Never assume undocumented requirements.\n3. **FORBIDDEN TO INTRODUCE DEPENDENCIES WITHOUT LICENSE INSPECTION**: Always verify `license-policy.yaml`. Viral dependencies (GPL/AGPL) or commercial paid dependencies (BSL/SSPL) are strictly forbidden without explicit human approval.\n4. **FORBIDDEN TO IGNORE CYBERSECURITY & PRIVACY (SECURITY-BY-DEFAULT & PRIVACY-BY-DEFAULT)**: Validate inputs, apply least privilege, protect PII according to `privacy-policy.yaml`, and accompany every change with security and privacy tests (`SEC-TEST-*`, `@privacy`). Suppressing linters or tests to force a green pipeline is prohibited.\n5. **MANDATORY CRYPTOGRAPHIC CITATION**: Link specifications using immutable identifiers and Unix LF-normalized SHA-256 hashes.\n\n## 2. Pre-Flight Verification Commands\nBefore finalizing changes or proposing commits:\n- Pre-flight with auto-fix: `pnpm run check:fix` (or `npx aisdlc check --fix`)\n- Full verification: `pnpm run verify:all` (or `npx aisdlc verify all`)\n- Unit tests: `pnpm test`\n- Strict typing: `pnpm run typecheck`\n\n## 3. Git 4-Tier Hierarchy\n- Tier 1: `main` (Production)\n- Tier 2: `release/vX.Y.Z` (Frozen release)\n- Tier 3: `feat/<FEAT-ID>-<slug>` / `bug/<BUG-ID>-<slug>` (Feature)\n- Tier 4: `task/<PARENT-ID>/<TSK-ID>-<slug>` (Atomic task)\n\n## 4. Specialized Roles Mapping\n| Role | Mission (summary) |\n| :--- | :--- |\n| `agent-product-analyst` | Phase 0 NAF v4 Enterprise & Capability Vision (`ARCH-INTRO-*`, 3\u20135 question interview) + ProductShape artifacts (`ACT-*`, `UC-*`, `FR-*`, `QR-*`, `BR-*`); status starts `draft`. |\n| `agent-threat-modeler` | STRIDE/OWASP threat triad (`ACT-THREAT-*`, `ABUSE-*`, `SEC-REQ-*`); hands off to `agent-privacy-officer`. |\n| `agent-privacy-officer` | LINDDUN & GDPR/LOPDGDD privacy triad (`DATA-ASSET-*`, `PRIV-ROPA-*`, `PRIV-REQ-*`) + Pre-Merge `verify:privacy`. |\n| `agent-system-architect` | Modular arc42 + NAF v4 architecture (`CMP-*`, Mermaid diagrams, `ADR-*`). |\n| `agent-qa-engineer` | FAILING BDD/Gherkin, E2E, and UI suites (using agreed project tech; Happy Path, Sad Path & Boundary Values per interactive UI element) before `agent-developer` writes code. |\n| `agent-developer` | Atomic tasks from `tasks.md`; respects autonomy mode; runs `pnpm run check:fix` + `pnpm run verify:all`. |\n| `agent-security-auditor` | Adversarial PR security audit, SAST, secrets, and CVSS v3.1 evaluation. |\n| `agent-compliance-checker` | SPDX license compliance audit against `license-policy.yaml`. |\n| `agent-expert-user` | Bimodal MVP evaluation (design) and functional validation against `UC-*` and `FR-*` (pre-PR). |\n| `agent-code-reviewer` | PR audit (SOLID, DRY, YAGNI): `[BLOCKING]` / `[CLEAN_CODE_SUGGESTION]` / `[COMPLIANT]`. |\n| `agent-devops` | CI/CD, Docker, IaC only \u2014 **FORBIDDEN** to touch `src/` or `packages/*/src/`. |\n\n## 5. Task Autonomy Modes (`tasks.md`)\n- \uD83D\uDFE2 **`AUTONOMOUS`**: Low risk. Implement directly, omit handoff block.\n- \uD83D\uDFE1 **`HUMAN_REVIEW_PLAN`**: Medium risk. Emit Workflow Handoff block, wait for approval.\n- \uD83D\uDFE0 **`AMBIGUOUS`**: Blocked. Request human clarification.\n- \uD83D\uDD34 **`HIGH_RISK_MANUAL`**: Critical risk. Human-only execution.\n\n## 6. Workflow Handoff Protocol and Human Action Window | Ventana de Acci\u00F3n Humana\n- **Conditional Activation**:\n  * \uD83D\uDFE2 **`AUTONOMOUS`** (or PR/CI supervision): **OMITTED**. Do not request or emit interactive handoff.\n  * \uD83D\uDFE1 **Autonomy $\\ge$ `HUMAN_REVIEW_PLAN`** (`HUMAN_REVIEW_PLAN`, `AMBIGUOUS`, `HIGH_RISK_MANUAL`): **MANDATORY**. Emit Workflow Handoff block compliant with [`templates/workflow/agent-handoff.template.md`](templates/workflow/agent-handoff.template.md) and **STOP**.\n- **Content**: Declare completed deliverables, recommend next role(s), provide suggested invocation prompt, and **keep the Human Action Window open for the human user to take action** (review, edit by hand, pause/reroute, or delegate).\n";
 declare const STARTER_CURSOR_PRODUCT_RULES = "---\ndescription: Directives for SDD specifications editing, ProductShape artifacts, Cybersecurity, and Privacy\nglobs: specs/**, templates/**, product/**, security/**, privacy/**\nalwaysApply: false\n---\n\n# Product and SDD Specification Directives\n\nCanonical Reference: [`process/09_agent_protocols.md`](process/09_agent_protocols.md) and [`process/02_product_definition.md`](process/02_product_definition.md).\n\n## 1. Identifier Taxonomy and JSON Schemas\nEvery generated or modified artifact must follow canonical naming and satisfy its schema in `schemas/`:\n- Enterprise & Capability Vision (Phase 0): `ARCH-INTRO-[NUM3]` (`schemas/architecture/introduction-and-goals.schema.json`)\n- Product Actors: `ACT-[SUFFIX]` (`schemas/product/actor.schema.json`)\n- Use Cases: `UC-[SUFFIX]` (`schemas/product/use-case.schema.json`)\n- Functional Requirements: `FR-[SUFFIX]-[NUM3]` (`schemas/product/requirement.schema.json`)\n- Quality Requirements: `QR-[SUFFIX]` (`schemas/product/requirement.schema.json`)\n- Business Rules: `BR-[SUFFIX]` (`schemas/product/business-rule.schema.json`)\n- Threat Actors: `ACT-THREAT-[SUFFIX]` (`schemas/security/threat-actor.schema.json`)\n- Abuse Cases: `ABUSE-[SUFFIX]` (`schemas/security/abuse-case.schema.json`)\n- Security Requirements: `SEC-REQ-[SUFFIX]` (`schemas/security/security-req.schema.json`)\n- Data Assets: `DATA-ASSET-[SUFFIX]` (`schemas/privacy/data-asset.schema.json`)\n- Processing Activities (ROPA): `PRIV-ROPA-[SUFFIX]` (`schemas/privacy/privacy-ropa.schema.json`)\n- Privacy Requirements: `PRIV-REQ-[SUFFIX]` (`schemas/privacy/privacy-req.schema.json`)\n\n## 2. \"AI as Scribe\" Protocol Rules\n- **Phase 0 (New Product Inception)**: When starting a new product, conduct a 3\u20135 question discovery interview, instantiate `ARCH-INTRO-001` (`naf-perspective: \"Enterprise & Capability\"`) in `draft`, and derive `ACT-*`, `UC-*`, `BR-*`, `FR-*`, and `QR-*`.\n- **Initial Status**: Every new artifact strictly starts with `status: draft`. Creating artifacts directly as `active` or `approved` is forbidden.\n- **Gherkin Acceptance Criteria**: In every `FR-*` requirement, include a ```gherkin block with tags `@<ID> @automated @regression` and at least one `Scenario Outline` with an `Examples` data table.\n- **Security & Privacy Mitigations**: Every `SEC-REQ-*` must include negative Gherkin tests (`@security @mitigation`) and every `PRIV-REQ-*` must include Gherkin privacy scenarios (`@privacy @gdpr`).\n- **Use Cases (User Story Structure)**: In every `UC-*`, the `1. Intent and Outcome` section must be written using the standard English structure: `As a <ACT-ID>... I want <action>... To <outcome>...`.\n- **Deterministic Validation**: Run `pnpm run verify:schemas`, `pnpm run verify:duplicates`, and `pnpm run verify:privacy` before presenting the draft to the human reviewer.\n";
-declare const STARTER_CURSOR_QUALITY_RULES = "---\ndescription: Directives for code quality, architecture, TDD, and complexity limits\nglobs: packages/**, src/**, scripts/**, tests/**\nalwaysApply: false\n---\n\n# Code Quality and Architecture Directives\n\nCanonical Reference: [`process/09_agent_protocols.md`](process/09_agent_protocols.md) and [`process/10_quality_management_and_release_gates.md`](process/10_quality_management_and_release_gates.md).\n\n## 1. Non-Negotiable Quality Thresholds (`quality-policy.yaml`)\n- **Cyclomatic Complexity (CC)**: $\\le 10$ per function (warning alert if $> 7$).\n- **Cognitive Complexity**: $\\le 15$ per function (warning if $> 10$).\n- **Maintainability Index (MI)**: $\\ge 50$ (target minimum $\\ge 65$).\n- **Function Length**: $\\le 40$ lines (warning if $> 30$).\n- If a function exceeds these limits, decompose logic into cohesive helper functions before completing the task.\n\n## 2. TDD Methodology, Clean Architecture & Unit Testing\n- **Mandatory 4-Step Implementation Order**: (1) Define/refine Clean Architecture layers & boundaries, (2) Define interfaces/ports for all inter-module interactions to avoid direct module coupling, (3) Implement components consuming/fulfilling those interfaces, (4) Write unit tests for every function covering Happy Path, Sad Path, Boundary Values, and Unexpected/Null/Empty values.\n- Apply Test-Driven Development: generate unit tests before or alongside component logic.\n- Tag tests linked to requirements with header comments citing the ID (`FR-*`, `SEC-REQ-*`, or `PRIV-REQ-*`) to enable reverse traceability.\n- Suppressing types (`any`), linter rules (`eslint-disable`), or unit tests to force pipeline passage is prohibited.\n\n## 3. Open Source License Policy (`license-policy.yaml`)\n- Before adding any dependency to `package.json`, verify its SPDX identifier.\n- Only permissive dependencies are allowed (`MIT`, `Apache-2.0`, `BSD-2/3-Clause`, `ISC`).\n- Viral licenses (`GPL`, `AGPL`) or commercial licenses without approval (`BSL`, `SSPL`) are prohibited.\n\n## 4. Structured Output `--json`\n- Any extension to CLI commands must preserve compatibility with the `--json` flag and suppress ANSI escape codes when this flag is present.\n";
-declare const STARTER_CLAUDE_RULES = "# Claude Code Instructions - AI-SDLC Monorepo\n\nCanonical Reference: [`process/09_agent_protocols.md`](process/09_agent_protocols.md) and [`process/01_governance_and_roles.md`](process/01_governance_and_roles.md).\n\nThis repository implements the **AI-SDLC** framework (Spec-Driven Development, deterministic quality governance, Privacy-by-Design, and OSS license compliance for human-agent collaboration).\n\n---\n\n## 1. The 5 Unbreakable Commandments of Agents | Los 5 Mandamientos Inquebrantables de los Agentes\n\n1. **FORBIDDEN TO AUTO-APPROVE OR AUTO-MERGE | PROHIBIDO AUTO-APROBAR O AUTO-FUSIONAR**: Never approve PRs or merge directly to `main` or protected branches. Approval is exclusively a human prerogative.\n2. **FORBIDDEN TO INVENT PRODUCT OR ARCHITECTURE DECISIONS**: When facing ambiguous requirements, formulate open questions (`open-questions`). Never assume undocumented behaviors.\n3. **FORBIDDEN TO INTRODUCE DEPENDENCIES WITHOUT LICENSE INSPECTION**: Always validate the SPDX identifier against `license-policy.yaml`. Viral libraries (`GPL`/`AGPL`) or paid commercial libraries (`BSL`/`SSPL`) are strictly forbidden without formal human approval.\n4. **FORBIDDEN TO IGNORE CYBERSECURITY & PRIVACY (SECURITY-BY-DEFAULT & PRIVACY-BY-DEFAULT)**: Validate inputs, sanitize data, protect PII according to `privacy-policy.yaml`, and include mitigation tests (`SEC-TEST-*`, `@privacy`). Disabling linters or suppressing typing errors (`any`, `@ts-ignore`) is prohibited.\n5. **MANDATORY CRYPTOGRAPHIC CITATION**: Every spec or sidecar must cite immutable identifiers and Unix LF-normalized SHA-256 digests.\n\n---\n\n## 2. Essential Execution and Pre-Flight Commands\n\n```bash\n# 1. Pre-flight with deterministic auto-fix (Gherkin & SHA-256 digests)\npnpm run check:fix\n\n# 2. Complete verification across all Quality Gates (Quality, RTM, Governance, Testing, Licenses, PDaC, Schemas, Duplicates, Security, Privacy)\npnpm run verify:all\n\n# 3. Complete automated test suite (Vitest)\npnpm test\n\n# 4. Strict TypeScript typechecking\npnpm run typecheck\n\n# 5. Scaffolding for a new SDD change\npnpm run change:new <name> --id <chg-id>\n\n# 6. Canonical integration of a completed SDD change\nnpx tsx packages/cli/src/index.ts sdd integrate --change <chg-id>\n```\n\n---\n\n## 3. Specialized Roles Mapping\n\n### 1. `agent-product-analyst` (Product Analyst / Scribe)\n- **Mission**: Capture new product intent via NAF v4 Enterprise & Capability Vision (`ARCH-INTRO-*`) and define/refine the product model using ProductShape.\n- **Phase 0 (Greenfield Product Inception)**: When creating a new product from scratch (or when `specs/product/` has no baseline), run a concise 3\u20135 question discovery interview (mission/problem, actors `ACT-*`, MVP capabilities `UC-*`, priority quality goals `QR-*`), draft `ARCH-INTRO-001` (`templates/architecture/introduction-and-goals.template.md`), and derive initial `ACT-*`, `UC-*`, `BR-*`, `FR-*`, and `QR-*` drafts.\n- **Input**: Business intent or natural language specification.\n- **Output**: Markdown artifacts with YAML frontmatter compliant with `schemas/architecture/introduction-and-goals.schema.json` (`ARCH-INTRO-*`) and `schemas/product/` (`ACT-*`, `UC-*`, `FR-*`, `QR-*`, `BR-*`).\n- **Guardrails**: `status` always starts in `draft`. Mandatory Gherkin criteria with `@<ID> @automated @regression`.\n\n### 2. `agent-threat-modeler` (Threat Modeler and Security Specialist)\n- **Mission**: Analyze use cases and proactively model adversaries, STRIDE attack vectors, and OWASP ASVS mitigations, both at product level and in the technical security feedback loop over architecture, handing off to `agent-privacy-officer`.\n- **Output**: Cybersecurity triad (`ACT-THREAT-*`, `ABUSE-*`, `SEC-REQ-*`) compliant with `schemas/security/`.\n\n### 3. `agent-privacy-officer` (Data Protection & Privacy-by-Design Specialist)\n- **Mission**: Receive handoff from `agent-threat-modeler` to model personal data assets (`DATA-ASSET-*`), GDPR Art. 30 records of processing (`PRIV-ROPA-*`), and LINDDUN / GDPR / ISO 27701 privacy requirements (`PRIV-REQ-*`), and audit code diffs against `privacy-policy.yaml`.\n- **Directives**: Run `pnpm run verify:privacy`, enforce PII masking in logs/LLM prompts, and trigger `DPIA-*` requests on Art. 9 sensitive data.\n\n### 4. `agent-system-architect` (System Architect)\n- **Mission**: Translate the approved product definition into a modular technical architecture based on arc42 enriched with NAF v4 (`CMP-*`, Mermaid diagrams, `ADR-*`).\n- **Guardrails**: Declare `satisfies-requirements` on every `CMP-*` (including `PRIV-REQ-*`), instantiate mandatory building block `CMP-OBSERVABILITY` (Level 2/3) alongside Section 8 and an ADR for runtime telemetry, and trigger the technical security/privacy feedback loop toward `agent-threat-modeler` \u2794 `agent-privacy-officer` when infrastructure decisions introduce new attack vectors or PII flows.\n\n### 5. `agent-qa-engineer` (QA Engineer and SDET)\n- **Mission**: Translate approved requirements (`FR-*`, `SEC-REQ-*`, `PRIV-REQ-*`, `QR-*`) into comprehensive FAILING (red) BDD/Gherkin, End-to-End (E2E), UI, and unit test suites, before `agent-developer` writes production code.\n- **Guardrails**: Always use the agreed project technology/testing stack (if any). Never omit End-to-End (E2E) and UI tests. Create specific tests for every interactive UI element covering Happy Path, Sad Path, and Boundary Values. FORBIDDEN to include production code. Mandatory tags: `@<FR-ID> @automated @regression`.\n\n### 6. `agent-developer` (Software Developer)\n- **Mission**: Implement atomic tasks from SDD specifications (`tasks.md`) with clean, strictly typed code and thorough tests.\n- **Directives**: Execute the mandatory 4-step order: (1) Clean Architecture definition/redefinition, (2) Inter-module interfaces first, (3) Component implementation, (4) Per-function unit tests (Happy Path, Sad Path, Boundary Values, Unexpected/Null/Empty values). Respect the autonomy mode. Make tests delivered by `agent-qa-engineer` pass green. Run `pnpm run check:fix` and `pnpm run verify:all`.\n\n### 7. `agent-security-auditor` (Adversarial Code Auditor)\n- **Mission**: Examine Pull Requests for business logic vulnerabilities, injection vectors, secret leaks, and authorization flaws as part of the Pre-Merge Audit Triad.\n- **Directives**: Run `pnpm run verify:security`, evaluate CVSS v3.1 severity, and block CRITICAL/HIGH risks.\n\n### 8. `agent-compliance-checker` (Open Source License Compliance Auditor)\n- **Mission**: Audit dependency manifests against `license-policy.yaml` as part of the Pre-Merge Audit Triad.\n- **Directives**: Run `pnpm run verify:licenses`, blocking viral (`GPL`, `AGPL`) or unapproved commercial (`BSL`, `SSPL`) packages.\n\n### 9. `agent-expert-user` (Expert User and Domain Evaluator)\n- **Mission**: Contrast design and specifications (design phase) and functionally validate finished software against `UC-*` and `FR-*` (post-development functional validation phase).\n\n### 10. `agent-code-reviewer` (Technical and Architectural Code Reviewer)\n- **Mission**: Audit Pull Requests evaluating code cleanliness, adherence to SOLID, DRY, YAGNI principles, and respect for `quality-policy.yaml` thresholds, forming part of the Pre-Merge Audit Triad.\n- **Findings classification**: `[BLOCKING]`, `[CLEAN_CODE_SUGGESTION]`, `[COMPLIANT]`.\n\n### 11. `agent-devops` (Automation and Infrastructure Engineer)\n- **Mission**: Maintain, evolve, and audit automated project infrastructure: CI/CD workflows, Docker containers, IaC manifests, and support scripts.\n- **NON-INVASION GUARDRAIL**: STRICTLY FORBIDDEN from modifying application source code (`src/`, `packages/*/src/`).\n\n---\n\n## 4. Task Autonomy Modes (`tasks.md`)\n\n- \uD83D\uDFE2 **`AUTONOMOUS`**: Low risk, isolated task. Implement code and tests directly. Omit interactive handoff block.\n- \uD83D\uDFE1 **`HUMAN_REVIEW_PLAN`**: Medium risk. Design detailed plan, emit Workflow Handoff block, and wait for human confirmation before coding.\n- \uD83D\uDFE0 **`AMBIGUOUS`**: Incomplete requirements. Blocked: request human clarification.\n- \uD83D\uDD34 **`HIGH_RISK_MANUAL`**: Critical risk (migrations, cryptography). Direct manual execution by humans only.\n\n---\n\n## 5. Git Workflow and Commit Rules with Trailers\n\n### 4-Tier Hierarchy\n1. **Tier 1 (`main`)**: Absolute stability and production readiness.\n2. **Tier 2 (`release/vX.Y.Z`)**: Release stabilization.\n3. **Tier 3 (`feat/<FEAT-ID>-<slug>` or `bug/<BUG-ID>-<slug>`)**: SDD delivery increment.\n4. **Tier 4 (`task/<PARENT-ID>/<TSK-ID>-<slug>`)**: Atomic implementation task.\n\n### Commit Format (Conventional Commits + Git Trailers)\n```text\nfeat(scope): concise imperative description (#issue)\n\nBody explaining the motivation and technical justification of the change.\n\nAuthor-Type: agent\nAI-Model: claude-3-7-sonnet\nTask-ID: TSK-001\nChange-ID: CHG-026-AGENT-NATIVE-CONFIGS\n```\n\n---\n\n## 6. Non-Negotiable Quality Thresholds (`quality-policy.yaml`)\n- **Cyclomatic Complexity (CC)**: $\\le 10$\n- **Cognitive Complexity**: $\\le 15$\n- **Maintainability Index (MI)**: $\\ge 50$\n- **Lines per Function**: $\\le 40$\n- Deterministic CLI output: every `verify` command supports `--json` without ANSI escape codes.\n\n---\n\n## 7. Workflow Handoff Protocol and Human Action Window | Ventana de Acci\u00F3n Humana\n- **Conditional Activation**:\n  - \uD83D\uDFE2 **`AUTONOMOUS`** (or PR/CI final supervision): **OMITTED**. Uninterrupted continuous execution.\n  - \uD83D\uDFE1 **Autonomy $\\ge$ `HUMAN_REVIEW_PLAN`** (`HUMAN_REVIEW_PLAN`, `AMBIGUOUS`, `HIGH_RISK_MANUAL`): **MANDATORY**. Emit Workflow Handoff block ([`templates/workflow/agent-handoff.template.md`](templates/workflow/agent-handoff.template.md)) and **STOP**.\n- **Content**: Completed deliverables, suggested next role(s), copy-paste ready invocation prompt, and **an open Human Action Window for the user to take action** (review, edit by hand, pause/reroute, or delegate).\n";
+declare const STARTER_CURSOR_QUALITY_RULES = "---\ndescription: Directives for code quality, architecture, TDD, and complexity limits\nglobs: packages/**, src/**, scripts/**, tests/**\nalwaysApply: false\n---\n\n# Code Quality and Architecture Directives\n\nCanonical Reference: [`process/09_agent_protocols.md`](process/09_agent_protocols.md) and [`process/10_quality_management_and_release_gates.md`](process/10_quality_management_and_release_gates.md).\n\n## 1. Non-Negotiable Quality Thresholds (`quality-policy.yaml`)\n- **Cyclomatic Complexity (CC)**: $\\le 10$ per function (warning alert if $> 7$).\n- **Cognitive Complexity**: $\\le 15$ per function (warning if $> 10$).\n- **Maintainability Index (MI)**: $\\ge 50$ (target minimum $\\ge 65$).\n- **Function Length**: $\\le 40$ lines (warning if $> 30$).\n- If a function exceeds these limits, decompose logic into cohesive helper functions before completing the task.\n\n## 2. TDD Methodology, Modular & Hexagonal Architecture (Ports & Adapters) & Unit Testing\n- **Mandatory 4-Step Implementation Order**: (1) Define/refine Modular & Hexagonal Architecture (Ports & Adapters) module boundaries, (2) Define interfaces/ports for all inter-module interactions to avoid direct module coupling, (3) Implement components consuming/fulfilling those interfaces, (4) Write unit tests for every function covering Happy Path, Sad Path, Boundary Values, and Unexpected/Null/Empty values.\n- Apply Test-Driven Development: generate unit tests before or alongside component logic.\n- Tag tests linked to requirements with header comments citing the ID (`FR-*`, `SEC-REQ-*`, or `PRIV-REQ-*`) to enable reverse traceability.\n- Suppressing types (`any`), linter rules (`eslint-disable`), or unit tests to force pipeline passage is prohibited.\n\n## 3. Open Source License Policy (`license-policy.yaml`)\n- Before adding any dependency to `package.json`, verify its SPDX identifier.\n- Only permissive dependencies are allowed (`MIT`, `Apache-2.0`, `BSD-2/3-Clause`, `ISC`).\n- Viral licenses (`GPL`, `AGPL`) or commercial licenses without approval (`BSL`, `SSPL`) are prohibited.\n\n## 4. Structured Output `--json`\n- Any extension to CLI commands must preserve compatibility with the `--json` flag and suppress ANSI escape codes when this flag is present.\n";
+declare const STARTER_CLAUDE_RULES = "# Claude Code Instructions - AI-SDLC Monorepo\n\nCanonical Reference: [`process/09_agent_protocols.md`](process/09_agent_protocols.md) and [`process/01_governance_and_roles.md`](process/01_governance_and_roles.md).\n\nThis repository implements the **AI-SDLC** framework (Spec-Driven Development, deterministic quality governance, Privacy-by-Design, and OSS license compliance for human-agent collaboration).\n\n---\n\n## 1. The 5 Unbreakable Commandments of Agents | Los 5 Mandamientos Inquebrantables de los Agentes\n\n1. **FORBIDDEN TO AUTO-APPROVE OR AUTO-MERGE | PROHIBIDO AUTO-APROBAR O AUTO-FUSIONAR**: Never approve PRs or merge directly to `main` or protected branches. Approval is exclusively a human prerogative.\n2. **FORBIDDEN TO INVENT PRODUCT OR ARCHITECTURE DECISIONS**: When facing ambiguous requirements, formulate open questions (`open-questions`). Never assume undocumented behaviors.\n3. **FORBIDDEN TO INTRODUCE DEPENDENCIES WITHOUT LICENSE INSPECTION**: Always validate the SPDX identifier against `license-policy.yaml`. Viral libraries (`GPL`/`AGPL`) or paid commercial libraries (`BSL`/`SSPL`) are strictly forbidden without formal human approval.\n4. **FORBIDDEN TO IGNORE CYBERSECURITY & PRIVACY (SECURITY-BY-DEFAULT & PRIVACY-BY-DEFAULT)**: Validate inputs, sanitize data, protect PII according to `privacy-policy.yaml`, and include mitigation tests (`SEC-TEST-*`, `@privacy`). Disabling linters or suppressing typing errors (`any`, `@ts-ignore`) is prohibited.\n5. **MANDATORY CRYPTOGRAPHIC CITATION**: Every spec or sidecar must cite immutable identifiers and Unix LF-normalized SHA-256 digests.\n\n---\n\n## 2. Essential Execution and Pre-Flight Commands\n\n```bash\n# 1. Pre-flight with deterministic auto-fix (Gherkin & SHA-256 digests)\npnpm run check:fix\n\n# 2. Complete verification across all Quality Gates (Quality, RTM, Governance, Testing, Licenses, PDaC, Schemas, Duplicates, Security, Privacy)\npnpm run verify:all\n\n# 3. Complete automated test suite (Vitest)\npnpm test\n\n# 4. Strict TypeScript typechecking\npnpm run typecheck\n\n# 5. Scaffolding for a new SDD change\npnpm run change:new <name> --id <chg-id>\n\n# 6. Canonical integration of a completed SDD change\nnpx tsx packages/cli/src/index.ts sdd integrate --change <chg-id>\n```\n\n---\n\n## 3. Specialized Roles Mapping\n\n### 1. `agent-product-analyst` (Product Analyst / Scribe)\n- **Mission**: Capture new product intent via NAF v4 Enterprise & Capability Vision (`ARCH-INTRO-*`) and define/refine the product model using ProductShape.\n- **Phase 0 (Greenfield Product Inception)**: When creating a new product from scratch (or when `specs/product/` has no baseline), run a concise 3\u20135 question discovery interview (mission/problem, actors `ACT-*`, MVP capabilities `UC-*`, priority quality goals `QR-*`), draft `ARCH-INTRO-001` (`templates/architecture/introduction-and-goals.template.md`), and derive initial `ACT-*`, `UC-*`, `BR-*`, `FR-*`, and `QR-*` drafts.\n- **Input**: Business intent or natural language specification.\n- **Output**: Markdown artifacts with YAML frontmatter compliant with `schemas/architecture/introduction-and-goals.schema.json` (`ARCH-INTRO-*`) and `schemas/product/` (`ACT-*`, `UC-*`, `FR-*`, `QR-*`, `BR-*`).\n- **Guardrails**: `status` always starts in `draft`. Mandatory Gherkin criteria with `@<ID> @automated @regression`.\n\n### 2. `agent-threat-modeler` (Threat Modeler and Security Specialist)\n- **Mission**: Analyze use cases and proactively model adversaries, STRIDE attack vectors, and OWASP ASVS mitigations, both at product level and in the technical security feedback loop over architecture, handing off to `agent-privacy-officer`.\n- **Output**: Cybersecurity triad (`ACT-THREAT-*`, `ABUSE-*`, `SEC-REQ-*`) compliant with `schemas/security/`.\n\n### 3. `agent-privacy-officer` (Data Protection & Privacy-by-Design Specialist)\n- **Mission**: Receive handoff from `agent-threat-modeler` to model personal data assets (`DATA-ASSET-*`), GDPR Art. 30 records of processing (`PRIV-ROPA-*`), and LINDDUN / GDPR / ISO 27701 privacy requirements (`PRIV-REQ-*`), and audit code diffs against `privacy-policy.yaml`.\n- **Directives**: Run `pnpm run verify:privacy`, enforce PII masking in logs/LLM prompts, and trigger `DPIA-*` requests on Art. 9 sensitive data.\n\n### 4. `agent-system-architect` (System Architect)\n- **Mission**: Translate the approved product definition into a modular technical architecture based on arc42 enriched with NAF v4 (`CMP-*`, Mermaid diagrams, `ADR-*`).\n- **Guardrails**: Declare `satisfies-requirements` on every `CMP-*` (including `PRIV-REQ-*`), structure components following **Modular & Hexagonal Architecture (Ports & Adapters)** (Domain/Application Core + Inbound/Outbound Ports), instantiate mandatory building block `CMP-OBSERVABILITY` (Level 2/3) alongside Section 8 and an ADR for runtime telemetry, and trigger the technical security/privacy feedback loop toward `agent-threat-modeler` \u2794 `agent-privacy-officer` when infrastructure decisions introduce new attack vectors or PII flows.\n\n### 5. `agent-qa-engineer` (QA Engineer and SDET)\n- **Mission**: Translate approved requirements (`FR-*`, `SEC-REQ-*`, `PRIV-REQ-*`, `QR-*`) into comprehensive FAILING (red) BDD/Gherkin, End-to-End (E2E), UI, and unit test suites, before `agent-developer` writes production code.\n- **Guardrails**: Always use the agreed project technology/testing stack (if any). Never omit End-to-End (E2E) and UI tests. Create specific tests for every interactive UI element covering Happy Path, Sad Path, and Boundary Values. FORBIDDEN to include production code. Mandatory tags: `@<FR-ID> @automated @regression`.\n\n### 6. `agent-developer` (Software Developer)\n- **Mission**: Implement atomic tasks from SDD specifications (`tasks.md`) with clean, strictly typed code and thorough tests.\n- **Directives**: Execute the mandatory 4-step order: (1) Modular & Hexagonal Architecture (Ports & Adapters) definition/redefinition, (2) Inter-module interfaces first, (3) Component implementation, (4) Per-function unit tests (Happy Path, Sad Path, Boundary Values, Unexpected/Null/Empty values). Respect the autonomy mode. Make tests delivered by `agent-qa-engineer` pass green. Run `pnpm run check:fix` and `pnpm run verify:all`.\n\n### 7. `agent-security-auditor` (Adversarial Code Auditor)\n- **Mission**: Examine Pull Requests for business logic vulnerabilities, injection vectors, secret leaks, and authorization flaws as part of the Pre-Merge Audit Triad.\n- **Directives**: Run `pnpm run verify:security`, evaluate CVSS v3.1 severity, and block CRITICAL/HIGH risks.\n\n### 8. `agent-compliance-checker` (Open Source License Compliance Auditor)\n- **Mission**: Audit dependency manifests against `license-policy.yaml` as part of the Pre-Merge Audit Triad.\n- **Directives**: Run `pnpm run verify:licenses`, blocking viral (`GPL`, `AGPL`) or unapproved commercial (`BSL`, `SSPL`) packages.\n\n### 9. `agent-expert-user` (Expert User and Domain Evaluator)\n- **Mission**: Contrast design and specifications (design phase) and functionally validate finished software against `UC-*` and `FR-*` (post-development functional validation phase).\n\n### 10. `agent-code-reviewer` (Technical and Architectural Code Reviewer)\n- **Mission**: Audit Pull Requests evaluating code cleanliness, adherence to SOLID, DRY, YAGNI principles, and respect for `quality-policy.yaml` thresholds, forming part of the Pre-Merge Audit Triad.\n- **Findings classification**: `[BLOCKING]`, `[CLEAN_CODE_SUGGESTION]`, `[COMPLIANT]`.\n\n### 11. `agent-devops` (Automation and Infrastructure Engineer)\n- **Mission**: Maintain, evolve, and audit automated project infrastructure: CI/CD workflows, Docker containers, IaC manifests, and support scripts.\n- **NON-INVASION GUARDRAIL**: STRICTLY FORBIDDEN from modifying application source code (`src/`, `packages/*/src/`).\n\n---\n\n## 4. Task Autonomy Modes (`tasks.md`)\n\n- \uD83D\uDFE2 **`AUTONOMOUS`**: Low risk, isolated task. Implement code and tests directly. Omit interactive handoff block.\n- \uD83D\uDFE1 **`HUMAN_REVIEW_PLAN`**: Medium risk. Design detailed plan, emit Workflow Handoff block, and wait for human confirmation before coding.\n- \uD83D\uDFE0 **`AMBIGUOUS`**: Incomplete requirements. Blocked: request human clarification.\n- \uD83D\uDD34 **`HIGH_RISK_MANUAL`**: Critical risk (migrations, cryptography). Direct manual execution by humans only.\n\n---\n\n## 5. Git Workflow and Commit Rules with Trailers\n\n### 4-Tier Hierarchy\n1. **Tier 1 (`main`)**: Absolute stability and production readiness.\n2. **Tier 2 (`release/vX.Y.Z`)**: Release stabilization.\n3. **Tier 3 (`feat/<FEAT-ID>-<slug>` or `bug/<BUG-ID>-<slug>`)**: SDD delivery increment.\n4. **Tier 4 (`task/<PARENT-ID>/<TSK-ID>-<slug>`)**: Atomic implementation task.\n\n### Commit Format (Conventional Commits + Git Trailers)\n```text\nfeat(scope): concise imperative description (#issue)\n\nBody explaining the motivation and technical justification of the change.\n\nAuthor-Type: agent\nAI-Model: claude-3-7-sonnet\nTask-ID: TSK-001\nChange-ID: CHG-026-AGENT-NATIVE-CONFIGS\n```\n\n---\n\n## 6. Non-Negotiable Quality Thresholds (`quality-policy.yaml`)\n- **Cyclomatic Complexity (CC)**: $\\le 10$\n- **Cognitive Complexity**: $\\le 15$\n- **Maintainability Index (MI)**: $\\ge 50$\n- **Lines per Function**: $\\le 40$\n- Deterministic CLI output: every `verify` command supports `--json` without ANSI escape codes.\n\n---\n\n## 7. Workflow Handoff Protocol and Human Action Window | Ventana de Acci\u00F3n Humana\n- **Conditional Activation**:\n  - \uD83D\uDFE2 **`AUTONOMOUS`** (or PR/CI final supervision): **OMITTED**. Uninterrupted continuous execution.\n  - \uD83D\uDFE1 **Autonomy $\\ge$ `HUMAN_REVIEW_PLAN`** (`HUMAN_REVIEW_PLAN`, `AMBIGUOUS`, `HIGH_RISK_MANUAL`): **MANDATORY**. Emit Workflow Handoff block ([`templates/workflow/agent-handoff.template.md`](templates/workflow/agent-handoff.template.md)) and **STOP**.\n- **Content**: Completed deliverables, suggested next role(s), copy-paste ready invocation prompt, and **an open Human Action Window for the user to take action** (review, edit by hand, pause/reroute, or delegate).\n";
 declare const STARTER_COPILOT_RULES = "<!--\n  AI-SDLC: Canonical Instructions for GitHub Copilot (Chat & Workspace)\n  Canonical Reference: process/09_agent_protocols.md and process/01_governance_and_roles.md\n-->\n\n# GitHub Copilot Instructions - AI-SDLC Framework\n\nYou operate as an assistant agent in the **AI-SDLC** repository. You are not a simple text auto-completer: you are a specialized technical worker subject to normative directives, deterministic autonomy boundaries, and strict traceability.\n\n---\n\n## 1. The 5 Unbreakable Commandments of Agents | Los 5 Mandamientos Inquebrantables de los Agentes\n\n1. **FORBIDDEN TO AUTO-APPROVE OR AUTO-MERGE | PROHIBIDO AUTO-APROBAR O AUTO-FUSIONAR**:\n   - Never execute PR approvals or direct merges to stable branches (`main`, `release/*`). Approval is an exclusive human prerogative.\n2. **FORBIDDEN TO INVENT PRODUCT OR ARCHITECTURE DECISIONS**:\n   - If a requirement is ambiguous or incomplete, formulate open questions (`open-questions`) to the human user. Guessing undocumented intentions is forbidden.\n3. **FORBIDDEN TO INTRODUCE DEPENDENCIES WITHOUT LICENSE INSPECTION**:\n   - Before suggesting or adding dependencies to manifests (`package.json`, etc.), validate their SPDX identifier against `license-policy.yaml`. Adding viral (`GPL`, `AGPL`) or commercial paid (`BSL`, `SSPL`) licenses without human authorization is prohibited.\n4. **FORBIDDEN TO IGNORE CYBERSECURITY & PRIVACY (SECURITY-BY-DEFAULT & PRIVACY-BY-DEFAULT)**:\n   - All code must enforce least privilege, sanitize external inputs, protect PII according to `privacy-policy.yaml`, and include mitigation tests (`SEC-TEST-*`, `@privacy`). Suppressing types (`any`), linters, or tests to force a green pipeline is prohibited.\n5. **MANDATORY CRYPTOGRAPHIC CITATION**:\n   - Every specification, design, or sidecar must reference canonical identifiers and their Unix LF-normalized SHA-256 digests.\n\n---\n\n## 2. Git 4-Tier Branch Hierarchy\n\nWhen proposing or creating branches, respect the strict hierarchical structure:\n- **Tier 1**: `main` (Protected production branch with maximum stability).\n- **Tier 2**: `release/vX.Y.Z` (Release consolidation and scope freeze branch).\n- **Tier 3**: `feat/<FEAT-ID>-<slug>` or `bug/<BUG-ID>-<slug>` (SDD increment or feature branch).\n- **Tier 4**: `task/<PARENT-ID>/<TSK-ID>-<slug>` (Atomic development task branch).\n\n---\n\n## 3. Pre-Flight Commands and Quality Gates\n\nBefore concluding any intervention or suggesting a commit:\n- **Unified pre-flight with auto-fix**: `pnpm run check:fix` (or `npx aisdlc check --fix`).\n- **Complete Quality Gates verification**: `pnpm run verify:all` (or `npx aisdlc verify all`).\n- **Unit test suite**: `pnpm test`.\n- **Strict typing**: `pnpm run typecheck`.\n\nNon-Negotiable Quality Thresholds (`quality-policy.yaml`):\n- Cyclomatic Complexity (CC) $\\le 10$.\n- Cognitive Complexity $\\le 15$.\n- Maintainability Index (MI) $\\ge 50$.\n- Maximum lines per function $\\le 40$.\n\n---\n\n## 4. Task Autonomy Modes (`tasks.md`)\n\n- \uD83D\uDFE2 **`AUTONOMOUS`**: Low risk, isolated task. Implement code and tests directly. Omit interactive handoff block.\n- \uD83D\uDFE1 **`HUMAN_REVIEW_PLAN`**: Medium risk. Design detailed plan, emit Workflow Handoff block, and wait for human confirmation before coding.\n- \uD83D\uDFE0 **`AMBIGUOUS`**: Incomplete requirements. Blocked: request human clarification.\n- \uD83D\uDD34 **`HIGH_RISK_MANUAL`**: Critical risk (migrations, cryptography). Direct manual execution by humans only.\n\n---\n\n## 5. Workflow Handoff Protocol and Human Action Window | Ventana de Acci\u00F3n Humana\n- **Conditional Activation**:\n  * \uD83D\uDFE2 **`AUTONOMOUS` Mode** (or PR/CI final supervision): **OMITTED**. Do not interrupt unattended execution.\n  * \uD83D\uDFE1 **Autonomy $\\ge$ `HUMAN_REVIEW_PLAN`** (`HUMAN_REVIEW_PLAN`, `AMBIGUOUS`, `HIGH_RISK_MANUAL`): **MANDATORY**. Emit Workflow Handoff block compliant with [`templates/workflow/agent-handoff.template.md`](../templates/workflow/agent-handoff.template.md) and **STOP**.\n- **Components**: Declare completed deliverables, recommend next roles (`agent-threat-modeler`, `agent-privacy-officer`, `agent-system-architect`, `agent-developer`, `agent-security-auditor`), provide suggested invocation prompt, and **keep the Human Action Window open at all times for the user to take action** (review, edit by hand, pause/reroute, or delegate).\n\n---\n\n## 6. Specialized Roles Mapping\n\n| Role | Mission (summary) |\n| :--- | :--- |\n| `agent-product-analyst` | Phase 0 NAF v4 Enterprise & Capability Vision (`ARCH-INTRO-*`, 3\u20135 question interview) + ProductShape artifacts (`ACT-*`, `UC-*`, `FR-*`, `QR-*`, `BR-*`); `status` starts `draft`. |\n| `agent-threat-modeler` | STRIDE/OWASP threat triad (`ACT-THREAT-*`, `ABUSE-*`, `SEC-REQ-*`); hands off to `agent-privacy-officer`. |\n| `agent-privacy-officer` | LINDDUN & GDPR/LOPDGDD privacy triad (`DATA-ASSET-*`, `PRIV-ROPA-*`, `PRIV-REQ-*`) + Pre-Merge `verify:privacy`. |\n| `agent-system-architect` | Modular arc42 + NAF v4 architecture (`CMP-*`, Mermaid diagrams, `ADR-*`). |\n| `agent-qa-engineer` | FAILING BDD/Gherkin, E2E, and UI suites (using agreed project tech; Happy Path, Sad Path & Boundary Values per interactive UI element) before `agent-developer` writes production code. |\n| `agent-developer` | Atomic tasks from `tasks.md`; autonomy mode must be respected; runs `pnpm run check:fix` + `pnpm run verify:all`. |\n| `agent-security-auditor` | Adversarial PR security audit, SAST, secrets, and CVSS v3.1 evaluation. |\n| `agent-compliance-checker` | SPDX license compliance audit against `license-policy.yaml`. |\n| `agent-expert-user` | Bimodal MVP evaluation (design) and functional validation against `UC-*` and `FR-*` (pre-PR). |\n| `agent-code-reviewer` | PR audit (SOLID, DRY, YAGNI): `[BLOCKING]` / `[CLEAN_CODE_SUGGESTION]` / `[COMPLIANT]`. |\n| `agent-devops` | CI/CD, Docker, IaC only \u2014 **FORBIDDEN** to touch `src/` or `packages/*/src/`. |\n\n---\n\n## 7. Canonical Reference\nTo consult full protocols, specialized prompts, and interface contracts:\n- [`process/09_agent_protocols.md`](../process/09_agent_protocols.md)\n- [`process/01_governance_and_roles.md`](../process/01_governance_and_roles.md)\n";
 declare const STARTER_CURSOR_MCP = "{\n  \"mcpServers\": {\n    \"ai-sdlc\": {\n      \"command\": \"npx\",\n      \"args\": [\n        \"@aisdlc/mcp\"\n      ]\n    }\n  }\n}\n";
 declare const STARTER_ANTIGRAVITY_MCP = "{\n  \"mcpServers\": {\n    \"ai-sdlc\": {\n      \"command\": \"npx\",\n      \"args\": [\n        \"@aisdlc/mcp\"\n      ]\n    }\n  }\n}\n";
@@ -2084,4 +2273,4 @@ declare function initProject(options?: InitProjectOptions): InitProjectResult;
 
 declare function walkMdFiles(dir: string, fileList?: string[], excludeDirs?: string[]): string[];
 
-export { ALL_ARCHITECTURE_TEMPLATES, type ActiveTaskMatch, type AgentTarget, type AnalysisResult, type ArchTemplateDef, type ArchitectureGranularity, type ArtifactFrontmatter, type ArtifactSchemaOptions, type ArtifactSchemaResult, type ArtifactSchemaViolation, type ArtifactValidationResult, type AuthorIdentity, type AuthorKpiSummary, type AutonomyMode, BRANCH_PATTERNS, type BddVariantCoverage, type BranchClassificationResult, type BranchHierarchyPlan, type BranchValidationError, type BranchValidationSuccess, type BugRecordSummary, type ChangeDetectionOptions, type ChangeDetectionResult, type ChangeProfile, type CiProvider, type CodeCoverageSummary, type CommitKpiRecord, type CommitTrailers, type ContractTraceAudit, type CycloneDxBom, type CycloneDxComponent, type CycloneDxLicense, type CytoscapeEdgeData, type CytoscapeElement, type CytoscapeNodeData, DEFAULT_EXCLUDED_PATTERNS, DEFAULT_EXCLUDES, DEFAULT_EXTENSIONS, DEFAULT_PRIVACY_POLICY, DEFAULT_SAST_EXCLUDES, type DashboardHistoricalKpi, type DashboardOptions, type DashboardResult, type DataAssetSummary, type DesignContractDeclaration, type DiffLineItem, type DuplicateIssue, type DuplicateIssueType, type DuplicateSeverity, type DuplicateVerifierOptions, type DuplicateVerifierResult, type ExtractedFeature, type FunctionMetrics, GENERAL_SOURCE_EXTENSIONS, type GherkinExtractionOptions, type GherkinExtractionResult, type GherkinSyncCheckResult, type GitCheckoutTaskOptions, type GitCheckoutTaskResult, type GovernanceOptions, type GovernanceResult, type GraphElementsResult, type GraphNodeLayer, type GraphNodeStatus, type GraphNodeType, type HookInstallResult, type InitProjectOptions, type InitProjectResult, type JsonSchemaRule, KPI_SUMMARY_END_TAG, KPI_SUMMARY_START_TAG, LIFECYCLE_SKILL_TEMPLATES, type LicensePolicy, type LicenseVerificationOptions, type LicenseVerificationResult, type LicenseViolation, type LifecycleSkillTemplate, type ManualDocumentItem, type ManualsCoverageSummary, type ManualsVerificationOptions, type ManualsVerificationResult, type ModelDefectStats, OpenSpecAdapter, PII_SAST_RULES, PREPARE_COMMIT_MSG_SCRIPT, PROMPT_INJECTION_SIGNATURES, PROTECTED_BYPASS_PATTERNS, type PackageJsonInfo, type PdacDrift, type PdacGraphOptions, type PdacGraphResult, type PdacNode, type PdacSyncDetail, type PdacSyncOptions, type PdacSyncResult, type PiiSastRule, type PrKpiAggregation, type PreflightCheckOptions, type PreflightCheckResult, type PreflightGateSummary, type PrivacyClassificationRule, type PrivacyFindingType, type PrivacyPolicy, type PrivacyRopaSummary, type PrivacyVerifierOptions, type PrivacyVerifierResult, type PrivacyViolation, type ProductHandoff, type ProductHandoffSubgraph, type ProgressiveFrictionOptions, type ProgressiveFrictionResult, type PromptInjectionFinding, type QualityGateOptions, type QualityGateResult, type QualityPolicy, type QualityReportOptions, type QualityReportResult, type QualityThresholds, type ReleaseKpiReport, type RequirementAuditItem, type ResolvedCiEnv, SAST_RULES, SCHEMA_SCHEMAS_ARCHITECTURE_ADR_SCHEMA_JSON, SCHEMA_SCHEMAS_ARCHITECTURE_COMPONENT_SCHEMA_JSON, SCHEMA_SCHEMAS_ARCHITECTURE_INTRODUCTION_AND_GOALS_SCHEMA_JSON, SCHEMA_SCHEMAS_COMPLIANCE_LICENSE_MANIFEST_SCHEMA_JSON, SCHEMA_SCHEMAS_COMPLIANCE_LICENSE_POLICY_SCHEMA_JSON, SCHEMA_SCHEMAS_COMPLIANCE_QUALITY_POLICY_SCHEMA_JSON, SCHEMA_SCHEMAS_IDE_MCP_CONFIG_SCHEMA_JSON, SCHEMA_SCHEMAS_MANUALS_PRODUCTION_MANUAL_SCHEMA_JSON, SCHEMA_SCHEMAS_MANUALS_USER_MANUAL_SCHEMA_JSON, SCHEMA_SCHEMAS_PRIVACY_DATA_ASSET_SCHEMA_JSON, SCHEMA_SCHEMAS_PRIVACY_PRIVACY_POLICY_SCHEMA_JSON, SCHEMA_SCHEMAS_PRIVACY_PRIVACY_REQ_SCHEMA_JSON, SCHEMA_SCHEMAS_PRIVACY_PRIVACY_ROPA_SCHEMA_JSON, SCHEMA_SCHEMAS_PRODUCT_ACTOR_SCHEMA_JSON, SCHEMA_SCHEMAS_PRODUCT_BUSINESS_RULE_SCHEMA_JSON, SCHEMA_SCHEMAS_PRODUCT_JOURNEY_SCHEMA_JSON, SCHEMA_SCHEMAS_PRODUCT_REQUIREMENT_SCHEMA_JSON, SCHEMA_SCHEMAS_PRODUCT_TERM_SCHEMA_JSON, SCHEMA_SCHEMAS_PRODUCT_USE_CASE_SCHEMA_JSON, SCHEMA_SCHEMAS_SAFETY_HAZARD_SCHEMA_JSON, SCHEMA_SCHEMAS_SAFETY_SAFETY_REQ_SCHEMA_JSON, SCHEMA_SCHEMAS_SDD_DESIGN_SCHEMA_JSON, SCHEMA_SCHEMAS_SDD_HANDOFF_SCHEMA_JSON, SCHEMA_SCHEMAS_SDD_PROPOSAL_SCHEMA_JSON, SCHEMA_SCHEMAS_SDD_RELEASE_KPIS_SCHEMA_JSON, SCHEMA_SCHEMAS_SDD_SESSION_TELEMETRY_SCHEMA_JSON, SCHEMA_SCHEMAS_SDD_SPEC_SCHEMA_JSON, SCHEMA_SCHEMAS_SDD_TASKS_SCHEMA_JSON, SCHEMA_SCHEMAS_SECURITY_ABUSE_CASE_SCHEMA_JSON, SCHEMA_SCHEMAS_SECURITY_ENCLAVE_SCHEMA_JSON, SCHEMA_SCHEMAS_SECURITY_SECURITY_REQ_SCHEMA_JSON, SCHEMA_SCHEMAS_SECURITY_THREAT_ACTOR_SCHEMA_JSON, SCHEMA_SCHEMAS_WORKFLOW_AGENT_HANDOFF_SCHEMA_JSON, SECRET_RULES, SPECIALIZED_AGENT_TEMPLATES, STARTER_ANTIGRAVITY_MCP, STARTER_ANTIGRAVITY_RULES, STARTER_ARCH_ADR, STARTER_ARCH_ARCHITECTURE_CONSTRAINTS, STARTER_ARCH_COMPONENT, STARTER_ARCH_CONTEXT_AND_SCOPE, STARTER_ARCH_CROSS_CUTTING_CONCEPTS, STARTER_ARCH_DEPLOYMENT_VIEW, STARTER_ARCH_GLOSSARY, STARTER_ARCH_INTRODUCTION_AND_GOALS, STARTER_ARCH_LEVEL_1_WHITEBOX, STARTER_ARCH_QUALITY_REQUIREMENTS, STARTER_ARCH_RISKS_AND_TECHNICAL_DEBT, STARTER_ARCH_RUNTIME_VIEW, STARTER_ARCH_SOLUTION_STRATEGY, STARTER_AZURE_PIPELINES, STARTER_BASE_TEMPLATES, STARTER_BITBUCKET_PIPELINES, STARTER_CLAUDE_RULES, STARTER_COMPLIANCE_LICENSE_MANIFEST_YAML, STARTER_COPILOT_RULES, STARTER_CURSOR_CORE_RULES, STARTER_CURSOR_MCP, STARTER_CURSOR_PRODUCT_RULES, STARTER_CURSOR_QUALITY_RULES, STARTER_GITHUB_CI, STARTER_GITHUB_DEPLOY_DASHBOARD, STARTER_GITHUB_PR_KPI, STARTER_GITHUB_PULL_REQUEST_TEMPLATE, STARTER_GITHUB_SDD_INTEGRATE, STARTER_GITLAB_CI, STARTER_LICENSE_POLICY, STARTER_PRIVACY_POLICY, STARTER_PROCESS_README, STARTER_PULL_REQUEST_TEMPLATE, STARTER_QUALITY_POLICY, STARTER_REQUIREMENT_TEMPLATE, STARTER_SCHEMAS, STARTER_SCHEMAS_MAP, STARTER_TASK_TEMPLATE, STARTER_TEMPLATES_CI_AZURE_PIPELINES_YML, STARTER_TEMPLATES_CI_BITBUCKET_PIPELINES_YML, STARTER_TEMPLATES_CI_GITHUB_WORKFLOWS_CI_YML, STARTER_TEMPLATES_CI_GITHUB_WORKFLOWS_DEPLOY_DASHBOARD_YML, STARTER_TEMPLATES_CI_GITHUB_WORKFLOWS_PR_KPI_SUMMARY_YML, STARTER_TEMPLATES_CI_GITHUB_WORKFLOWS_SDD_INTEGRATE_ON_MERGE_YML, STARTER_TEMPLATES_CI__GITLAB_CI_YML, STARTER_TEMPLATES_COMPLIANCE_COMMERCIAL_ACQUISITION_REQUEST_TEMPLATE_MD, STARTER_TEMPLATES_MANUALS_PRODUCTION_MANUAL_TEMPLATE_MD, STARTER_TEMPLATES_MANUALS_USER_MANUAL_TEMPLATE_MD, STARTER_TEMPLATES_PRIVACY_DATA_ASSET_TEMPLATE_MD, STARTER_TEMPLATES_PRIVACY_DPIA_REQUEST_TEMPLATE_MD, STARTER_TEMPLATES_PRIVACY_PRIVACY_REQ_TEMPLATE_MD, STARTER_TEMPLATES_PRIVACY_PRIVACY_ROPA_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_ACTOR_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_BUSINESS_RULE_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_JOURNEY_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_REQUIREMENT_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_TERM_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_USER_DESIGN_FEEDBACK_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_USE_CASE_TEMPLATE_MD, STARTER_TEMPLATES_SAFETY_HAZARD_TEMPLATE_MD, STARTER_TEMPLATES_SAFETY_SAFETY_REQ_TEMPLATE_MD, STARTER_TEMPLATES_SDD_DESIGN_TEMPLATE_MD, STARTER_TEMPLATES_SDD_HANDOFF_TEMPLATE_YAML, STARTER_TEMPLATES_SDD_PROPOSAL_TEMPLATE_MD, STARTER_TEMPLATES_SDD_PULL_REQUEST_TEMPLATE_MD, STARTER_TEMPLATES_SDD_SPEC_TEMPLATE_MD, STARTER_TEMPLATES_SDD_TASKS_TEMPLATE_MD, STARTER_TEMPLATES_SECURITY_ABUSE_CASE_TEMPLATE_MD, STARTER_TEMPLATES_SECURITY_ENCLAVE_TEMPLATE_MD, STARTER_TEMPLATES_SECURITY_SECURITY_REQ_TEMPLATE_MD, STARTER_TEMPLATES_SECURITY_THREAT_ACTOR_TEMPLATE_MD, STARTER_TEMPLATES_WORKFLOW_AGENT_HANDOFF_TEMPLATE_MD, STARTER_VSCODE_MCP, STARTER_WORKFLOW_HANDOFF_TEMPLATE, STARTER__GITHUB_PULL_REQUEST_TEMPLATE_MD, type SastFindingType, type SastRule, type SastSeverity, type SastVerifierOptions, type SastVerifierResult, type SastViolation, type SbomGenerateOptions, type ScaTool, type ScanOptions, type ScannedDependency, type ScannedRequirement, type SddAdapter, type SddChangeScaffoldOptions, type SddChangeScaffoldResult, type SddDepositOptions, type SddFramework, type SddIntegrationAudit, type SddIntegrationOptions, type SddIntegrationResult, type SddValidationResult, type SddWorkspaceInfo, type SecretFindingType, type SecretRule, type SecretVerifierOptions, type SecretVerifierResult, type SecretViolation, type SpecCatalogScope, SpecKitAdapter, type SpecializedAgentTemplate, type StarterSchemaEntry, type StarterTemplateEntry, type SupportedCiProvider, TYPE_TO_SCHEMA_MAP, type TaskAuditItem, type TaskItem, type TaskLocateResult, type TaskSummary, type TaskVerification, type TestingCoverageOptions, type TestingCoverageResult, type TraceabilityOptions, type TraceabilityResult, type TraceabilityRow, type UntestedFunctionItem, type UseCaseFlowAuditItem, VALID_AGENT_TARGETS, VALID_ARCHITECTURE_GRANULARITIES, VALID_AUTONOMY_MODES, VALID_CHANGE_PROFILES, VALID_CI_PROVIDERS, aggregateCommitKpiRecords, aggregatePrKpis, aggregateReleaseKpis, analyzeBddVariantsForRequirement, appendRevisionHistoryRow, buildCycloneDxComponent, buildFeatureFileContent, buildGraphElements, calculateJaccardSimilarity, calculateMetrics, calculateRating, calculateShannonEntropy, checkGherkinInSync, checkoutTaskBranch, classifyBranch, collectAgentFiles, collectDashboardMetrics, collectHistoricalKpis, computeCanonicalSha256, computeSha256, createDefaultQualityPolicy, depositProductHandoffSidecar, detectActiveChangeForIntegration, detectAuthorIdentity, detectLanguage, detectProfileFromChange, detectPromptInjection, emitCiOutput, evaluateCompoundLicense, evaluateSingleDependency, extractCitations, extractCommitKpisFromRange, extractDirectDepNames, extractFeatureTags, extractFrontmatter, extractFunctions, extractFunctionsBraceLanguages, extractFunctionsPolyglot, extractFunctionsPython, extractFunctionsTypeScriptAst, extractGherkinBlock, extractGherkinFeatures, extractNormativeText, findChangeWorkspaceDir, findLicenseFile, formatCommitTrailers, formatPrKpiMarkdown, formatReleaseKpiMarkdown, generateBranchHierarchyPlan, generateCycloneDxSbom, generateDashboardReport, generateDuplicatesReportMarkdown, generateGovernanceReportMarkdown, generateLicenseReportMarkdown, generatePdacReportMarkdown, generatePrivacyReportMarkdown, generateQualityReport, generateRopaInventoryMarkdown, generateSastReportMarkdown, generateSecretsReportMarkdown, generateTestingCoverageReportMarkdown, generateThirdPartyNotices, generateTraceabilityReportMarkdown, getArchitectureTemplates, getCytoscapeScript, getGitDiffLines, getNextCorrelativeNumber, getSddAdapter, inferArtifactTypeFromId, inferMissingTrailers, initProject, injectKpisIntoPrBody, installGitHooks, integrateSddChange, isGitleaksInstalled, isPathProtectedFromPatch, isPlaceholderOrIgnored, isRequirementArtifact, isSemgrepInstalled, isToolAvailable, loadPrivacyPolicy, loadProductHandoffSidecar, locateTaskInActiveChanges, maskSecret, normalizeSpdxLicense, parseCommitTrailers, parseFrontmatter, parseFrontmatterId, parseGenericDoc, parseLicensePolicy, parseMarkdownFrontmatter, parseQualityPolicy, parseRequirementFile, parseSpecCatalogScope, parseTasksDoc, parseTasksFromContent, processPackageDir, readCodeCoverageSummary, readPackageJson, renderAntigravityAgentFile, renderAntigravitySkillFile, renderAutonomyModeSection, renderClaudeAgentFile, renderCopilotAgentFile, renderCursorAgentFile, renderDashboardHtml, renderManualsTab, resolveAgentTargets, resolveBranchHierarchy, resolveCiEnvironment, resolveCytoscapePath, resolveFeatureFilePath, resolveGitRef, resolveLicenseFromFile, resolveSchemaForArtifact, resolveTargetFiles, runGitleaksCli, runSemgrepCli, scaffoldSddChange, scanAllProductHandoffs, scanAllTestArtifacts, scanContentForSecrets, scanFileForPrivacyViolations, scanFileForSast, scanInstalledLicenses, scanManualsInWorkspace, scanPnpmStore, scanSubdirectories, scanWithNativeFs, scanWithSyft, scanWithTrivy, slugify, syncPdacDigests, tokenizeTitle, updateCitationsInContent, validateAgainstSchema, validateArtifactSchema, verifyArtifactDuplicates, verifyArtifactsSchemas, verifyLicenses, verifyManuals, verifyPdacGraph, verifyPrivacy, verifyProgressiveFriction, verifyQualityGate, verifySast, verifySddIntegration, verifySecrets, verifyTasksGovernance, verifyTestingCoverage, verifyTraceability, walkDir, walkMdFiles, walkProjectFiles, walkSourceFiles, walkTaskFiles, writeCycloneDxSbom, writeReleaseKpiReport, writeThirdPartyNotices };
+export { ALL_ARCHITECTURE_TEMPLATES, type ActiveTaskMatch, type AgentTarget, type AnalysisResult, type ArchTemplateDef, type ArchitectureGranularity, type ArtifactFrontmatter, type ArtifactSchemaOptions, type ArtifactSchemaResult, type ArtifactSchemaViolation, type ArtifactValidationResult, type AuthorIdentity, type AuthorKpiSummary, type AutonomyMode, BRANCH_PATTERNS, type BddVariantCoverage, type BranchClassificationResult, type BranchHierarchyPlan, type BranchValidationError, type BranchValidationSuccess, type BugRecordSummary, type ChangeDetectionOptions, type ChangeDetectionResult, type ChangeProfile, type CiProvider, type CodeCoverageSummary, type CommitKpiRecord, type CommitTrailers, type ContractTraceAudit, type CycloneDxBom, type CycloneDxComponent, type CycloneDxLicense, type CytoscapeEdgeData, type CytoscapeElement, type CytoscapeNodeData, DEFAULT_EXCLUDED_PATTERNS, DEFAULT_EXCLUDES, DEFAULT_EXTENSIONS, DEFAULT_PRIVACY_POLICY, DEFAULT_SAST_EXCLUDES, type DashboardHistoricalKpi, type DashboardOptions, type DashboardResult, type DataAssetSummary, type DesignContractDeclaration, type DiffLineItem, type DuplicateIssue, type DuplicateIssueType, type DuplicateSeverity, type DuplicateVerifierOptions, type DuplicateVerifierResult, type ExtractedFeature, type FunctionMetrics, GENERAL_SOURCE_EXTENSIONS, type GenerateSarifOptions, type GherkinExtractionOptions, type GherkinExtractionResult, type GherkinSyncCheckResult, type GitCheckoutTaskOptions, type GitCheckoutTaskResult, type GovernanceOptions, type GovernanceResult, type GraphElementsResult, type GraphNodeLayer, type GraphNodeStatus, type GraphNodeType, type HookInstallResult, type InitProjectOptions, type InitProjectResult, type JsonSchemaRule, KPI_SUMMARY_END_TAG, KPI_SUMMARY_START_TAG, LIFECYCLE_SKILL_TEMPLATES, type LicensePolicy, type LicenseVerificationOptions, type LicenseVerificationResult, type LicenseViolation, type LifecycleSkillTemplate, type ManualDocumentItem, type ManualsCoverageSummary, type ManualsVerificationOptions, type ManualsVerificationResult, type ModelDefectStats, OpenSpecAdapter, PII_SAST_RULES, PREPARE_COMMIT_MSG_SCRIPT, PROMPT_INJECTION_SIGNATURES, PROTECTED_BYPASS_PATTERNS, type PackageJsonInfo, type PdacDrift, type PdacGraphOptions, type PdacGraphResult, type PdacNode, type PdacSyncDetail, type PdacSyncOptions, type PdacSyncResult, type PiiSastRule, type PrKpiAggregation, type PreflightCheckOptions, type PreflightCheckResult, type PreflightGateSummary, type PrivacyClassificationRule, type PrivacyFindingType, type PrivacyPolicy, type PrivacyRopaSummary, type PrivacyVerifierOptions, type PrivacyVerifierResult, type PrivacyViolation, type ProductHandoff, type ProductHandoffSubgraph, type ProgressiveFrictionOptions, type ProgressiveFrictionResult, type PromptInjectionFinding, type QualityBaseline, type QualityBaselineEntry, type QualityGateOptions, type QualityGateResult, type QualityPolicy, type QualityReportOptions, type QualityReportResult, type QualityThresholds, type ReleaseKpiReport, type RequirementAuditItem, type ResolvedCiEnv, SARIF_SCHEMA_2_1_0, SARIF_VERSION, SAST_RULES, SCHEMA_SCHEMAS_ARCHITECTURE_ADR_SCHEMA_JSON, SCHEMA_SCHEMAS_ARCHITECTURE_COMPONENT_SCHEMA_JSON, SCHEMA_SCHEMAS_ARCHITECTURE_INTRODUCTION_AND_GOALS_SCHEMA_JSON, SCHEMA_SCHEMAS_COMPLIANCE_LICENSE_MANIFEST_SCHEMA_JSON, SCHEMA_SCHEMAS_COMPLIANCE_LICENSE_POLICY_SCHEMA_JSON, SCHEMA_SCHEMAS_COMPLIANCE_QUALITY_POLICY_SCHEMA_JSON, SCHEMA_SCHEMAS_IDE_MCP_CONFIG_SCHEMA_JSON, SCHEMA_SCHEMAS_MANUALS_PRODUCTION_MANUAL_SCHEMA_JSON, SCHEMA_SCHEMAS_MANUALS_USER_MANUAL_SCHEMA_JSON, SCHEMA_SCHEMAS_PRIVACY_DATA_ASSET_SCHEMA_JSON, SCHEMA_SCHEMAS_PRIVACY_PRIVACY_POLICY_SCHEMA_JSON, SCHEMA_SCHEMAS_PRIVACY_PRIVACY_REQ_SCHEMA_JSON, SCHEMA_SCHEMAS_PRIVACY_PRIVACY_ROPA_SCHEMA_JSON, SCHEMA_SCHEMAS_PRODUCT_ACTOR_SCHEMA_JSON, SCHEMA_SCHEMAS_PRODUCT_BOUNDED_CONTEXT_SCHEMA_JSON, SCHEMA_SCHEMAS_PRODUCT_BUSINESS_RULE_SCHEMA_JSON, SCHEMA_SCHEMAS_PRODUCT_JOURNEY_SCHEMA_JSON, SCHEMA_SCHEMAS_PRODUCT_REQUIREMENT_SCHEMA_JSON, SCHEMA_SCHEMAS_PRODUCT_TERM_SCHEMA_JSON, SCHEMA_SCHEMAS_PRODUCT_USE_CASE_SCHEMA_JSON, SCHEMA_SCHEMAS_SAFETY_HAZARD_SCHEMA_JSON, SCHEMA_SCHEMAS_SAFETY_SAFETY_REQ_SCHEMA_JSON, SCHEMA_SCHEMAS_SDD_DESIGN_SCHEMA_JSON, SCHEMA_SCHEMAS_SDD_HANDOFF_SCHEMA_JSON, SCHEMA_SCHEMAS_SDD_PROPOSAL_SCHEMA_JSON, SCHEMA_SCHEMAS_SDD_RELEASE_KPIS_SCHEMA_JSON, SCHEMA_SCHEMAS_SDD_SESSION_TELEMETRY_SCHEMA_JSON, SCHEMA_SCHEMAS_SDD_SPEC_SCHEMA_JSON, SCHEMA_SCHEMAS_SDD_TASKS_SCHEMA_JSON, SCHEMA_SCHEMAS_SECURITY_ABUSE_CASE_SCHEMA_JSON, SCHEMA_SCHEMAS_SECURITY_ENCLAVE_SCHEMA_JSON, SCHEMA_SCHEMAS_SECURITY_SECURITY_REQ_SCHEMA_JSON, SCHEMA_SCHEMAS_SECURITY_THREAT_ACTOR_SCHEMA_JSON, SCHEMA_SCHEMAS_WORKFLOW_AGENT_HANDOFF_SCHEMA_JSON, SECRET_RULES, SPECIALIZED_AGENT_TEMPLATES, STARTER_ANTIGRAVITY_MCP, STARTER_ANTIGRAVITY_RULES, STARTER_ARCH_ADR, STARTER_ARCH_ARCHITECTURE_CONSTRAINTS, STARTER_ARCH_COMPONENT, STARTER_ARCH_CONTEXT_AND_SCOPE, STARTER_ARCH_CROSS_CUTTING_CONCEPTS, STARTER_ARCH_DEPLOYMENT_VIEW, STARTER_ARCH_GLOSSARY, STARTER_ARCH_INTRODUCTION_AND_GOALS, STARTER_ARCH_LEVEL_1_WHITEBOX, STARTER_ARCH_QUALITY_REQUIREMENTS, STARTER_ARCH_RISKS_AND_TECHNICAL_DEBT, STARTER_ARCH_RUNTIME_VIEW, STARTER_ARCH_SOLUTION_STRATEGY, STARTER_AZURE_PIPELINES, STARTER_BASE_TEMPLATES, STARTER_BITBUCKET_PIPELINES, STARTER_CLAUDE_RULES, STARTER_COMPLIANCE_LICENSE_MANIFEST_YAML, STARTER_COPILOT_RULES, STARTER_CURSOR_CORE_RULES, STARTER_CURSOR_MCP, STARTER_CURSOR_PRODUCT_RULES, STARTER_CURSOR_QUALITY_RULES, STARTER_GITHUB_CI, STARTER_GITHUB_DEPLOY_DASHBOARD, STARTER_GITHUB_PR_KPI, STARTER_GITHUB_PULL_REQUEST_TEMPLATE, STARTER_GITHUB_SDD_INTEGRATE, STARTER_GITLAB_CI, STARTER_LICENSE_POLICY, STARTER_PRIVACY_POLICY, STARTER_PROCESS_README, STARTER_PULL_REQUEST_TEMPLATE, STARTER_QUALITY_POLICY, STARTER_REQUIREMENT_TEMPLATE, STARTER_SCHEMAS, STARTER_SCHEMAS_MAP, STARTER_TASK_TEMPLATE, STARTER_TEMPLATES_CI_AZURE_PIPELINES_YML, STARTER_TEMPLATES_CI_BITBUCKET_PIPELINES_YML, STARTER_TEMPLATES_CI_GITHUB_WORKFLOWS_CI_YML, STARTER_TEMPLATES_CI_GITHUB_WORKFLOWS_DEPLOY_DASHBOARD_YML, STARTER_TEMPLATES_CI_GITHUB_WORKFLOWS_PR_KPI_SUMMARY_YML, STARTER_TEMPLATES_CI_GITHUB_WORKFLOWS_SDD_INTEGRATE_ON_MERGE_YML, STARTER_TEMPLATES_CI__GITLAB_CI_YML, STARTER_TEMPLATES_COMPLIANCE_COMMERCIAL_ACQUISITION_REQUEST_TEMPLATE_MD, STARTER_TEMPLATES_MANUALS_PRODUCTION_MANUAL_TEMPLATE_MD, STARTER_TEMPLATES_MANUALS_USER_MANUAL_TEMPLATE_MD, STARTER_TEMPLATES_PRIVACY_DATA_ASSET_TEMPLATE_MD, STARTER_TEMPLATES_PRIVACY_DPIA_REQUEST_TEMPLATE_MD, STARTER_TEMPLATES_PRIVACY_PRIVACY_REQ_TEMPLATE_MD, STARTER_TEMPLATES_PRIVACY_PRIVACY_ROPA_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_ACTOR_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_BOUNDED_CONTEXT_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_BUSINESS_RULE_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_JOURNEY_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_REQUIREMENT_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_TERM_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_USER_DESIGN_FEEDBACK_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_USE_CASE_TEMPLATE_MD, STARTER_TEMPLATES_SAFETY_HAZARD_TEMPLATE_MD, STARTER_TEMPLATES_SAFETY_SAFETY_REQ_TEMPLATE_MD, STARTER_TEMPLATES_SDD_DESIGN_TEMPLATE_MD, STARTER_TEMPLATES_SDD_HANDOFF_TEMPLATE_YAML, STARTER_TEMPLATES_SDD_PROPOSAL_TEMPLATE_MD, STARTER_TEMPLATES_SDD_PULL_REQUEST_TEMPLATE_MD, STARTER_TEMPLATES_SDD_SPEC_TEMPLATE_MD, STARTER_TEMPLATES_SDD_TASKS_TEMPLATE_MD, STARTER_TEMPLATES_SECURITY_ABUSE_CASE_TEMPLATE_MD, STARTER_TEMPLATES_SECURITY_ENCLAVE_TEMPLATE_MD, STARTER_TEMPLATES_SECURITY_SECURITY_REQ_TEMPLATE_MD, STARTER_TEMPLATES_SECURITY_THREAT_ACTOR_TEMPLATE_MD, STARTER_TEMPLATES_WORKFLOW_AGENT_HANDOFF_TEMPLATE_MD, STARTER_VSCODE_MCP, STARTER_WORKFLOW_HANDOFF_TEMPLATE, STARTER__GITHUB_PULL_REQUEST_TEMPLATE_MD, type SarifArtifactLocation, type SarifDocument, type SarifLevel, type SarifLocation, type SarifMultiformatMessageString, type SarifPhysicalLocation, type SarifRegion, type SarifReportingDescriptor, type SarifResult, type SarifRuleConfiguration, type SarifRun, type SarifToolDriver, type SastFindingType, type SastRule, type SastSeverity, type SastVerifierOptions, type SastVerifierResult, type SastViolation, type SbomGenerateOptions, type ScaTool, type ScaVulnerability, type ScanOptions, type ScannedDependency, type ScannedRequirement, type SddAdapter, type SddChangeScaffoldOptions, type SddChangeScaffoldResult, type SddDepositOptions, type SddFramework, type SddIntegrationAudit, type SddIntegrationOptions, type SddIntegrationResult, type SddValidationResult, type SddWorkspaceInfo, type SecretFindingType, type SecretRule, type SecretVerifierOptions, type SecretVerifierResult, type SecretViolation, type SecuritySuppression, type SpecCatalogScope, SpecKitAdapter, type SpecializedAgentTemplate, type StarterSchemaEntry, type StarterTemplateEntry, type SupportedCiProvider, TYPE_TO_SCHEMA_MAP, type TaskAuditItem, type TaskItem, type TaskLocateResult, type TaskSummary, type TaskVerification, type TestingCoverageOptions, type TestingCoverageResult, type TraceabilityOptions, type TraceabilityResult, type TraceabilityRow, type UntestedFunctionItem, type UseCaseFlowAuditItem, VALID_AGENT_TARGETS, VALID_ARCHITECTURE_GRANULARITIES, VALID_AUTONOMY_MODES, VALID_CHANGE_PROFILES, VALID_CI_PROVIDERS, type VulnerabilityThresholds, aggregateCommitKpiRecords, aggregatePrKpis, aggregateReleaseKpis, analyzeBddVariantsForRequirement, appendRevisionHistoryRow, applyRatchetMode, buildCycloneDxComponent, buildFeatureFileContent, buildGraphElements, calculateJaccardSimilarity, calculateMetrics, calculateRating, calculateShannonEntropy, checkGherkinInSync, checkoutTaskBranch, classifyBranch, classifyMetricFromMessage, collectAgentFiles, collectDashboardMetrics, collectHistoricalKpis, computeCanonicalSha256, computeSha256, computeViolationSignature, createDefaultQualityPolicy, depositProductHandoffSidecar, detectActiveChangeForIntegration, detectAuthorIdentity, detectLanguage, detectProfileFromChange, detectPromptInjection, emitCiOutput, evaluateCompoundLicense, evaluateSingleDependency, evaluateVulnerabilityThresholds, extractBaselineEntriesFromResults, extractCitations, extractCommitKpisFromRange, extractDirectDepNames, extractFeatureTags, extractFrontmatter, extractFunctions, extractFunctionsBraceLanguages, extractFunctionsPolyglot, extractFunctionsPython, extractFunctionsTypeScriptAst, extractGherkinBlock, extractGherkinFeatures, extractNormativeText, findChangeWorkspaceDir, findLicenseFile, formatCommitTrailers, formatPrKpiMarkdown, formatReleaseKpiMarkdown, generateBranchHierarchyPlan, generateCycloneDxSbom, generateDashboardReport, generateDuplicatesReportMarkdown, generateGovernanceReportMarkdown, generateLicenseReportMarkdown, generatePdacReportMarkdown, generatePrivacyReportMarkdown, generateQualityReport, generateRopaInventoryMarkdown, generateSastReportMarkdown, generateSecretsReportMarkdown, generateSecuritySarifReport, generateSuppressionsAuditReport, generateTestingCoverageReportMarkdown, generateThirdPartyNotices, generateTraceabilityReportMarkdown, getArchitectureTemplates, getCytoscapeScript, getGitDiffLines, getNextCorrelativeNumber, getSddAdapter, inferArtifactTypeFromId, inferMissingTrailers, initProject, injectKpisIntoPrBody, installGitHooks, integrateSddChange, isGitleaksInstalled, isMetricWorsened, isPathProtectedFromPatch, isPlaceholderOrIgnored, isRequirementArtifact, isSemgrepInstalled, isToolAvailable, loadPrivacyPolicy, loadProductHandoffSidecar, loadQualityBaseline, locateTaskInActiveChanges, mapSastSeverityToSarifLevel, maskSecret, normalizeSpdxLicense, normalizeUri, parseCommitTrailers, parseFrontmatter, parseFrontmatterId, parseGenericDoc, parseLicensePolicy, parseMarkdownFrontmatter, parseQualityPolicy, parseRequirementFile, parseSecuritySuppression, parseSpecCatalogScope, parseTasksDoc, parseTasksFromContent, parseTrivyVulnerabilities, processPackageDir, readCodeCoverageSummary, readPackageJson, renderAntigravityAgentFile, renderAntigravitySkillFile, renderAutonomyModeSection, renderClaudeAgentFile, renderCopilotAgentFile, renderCursorAgentFile, renderDashboardHtml, renderManualsTab, resolveAgentTargets, resolveBranchHierarchy, resolveCiEnvironment, resolveCytoscapePath, resolveFeatureFilePath, resolveGitRef, resolveLicenseFromFile, resolveSastCwe, resolveSastOwasp, resolveSchemaForArtifact, resolveTargetFiles, runGitleaksCli, runSemgrepCli, scaffoldSddChange, scanAllProductHandoffs, scanAllTestArtifacts, scanContentForSecrets, scanFileForPrivacyViolations, scanFileForSast, scanInstalledLicenses, scanManualsInWorkspace, scanPnpmStore, scanSubdirectories, scanWithNativeFs, scanWithSyft, scanWithTrivy, serializeSarifDocument, slugify, syncPdacDigests, tokenizeTitle, updateCitationsInContent, validateAgainstSchema, validateArtifactSchema, verifyArtifactDuplicates, verifyArtifactsSchemas, verifyLicenses, verifyManuals, verifyPdacGraph, verifyPrivacy, verifyProgressiveFriction, verifyQualityGate, verifySast, verifySddIntegration, verifySecrets, verifyTasksGovernance, verifyTestingCoverage, verifyTraceability, walkDir, walkMdFiles, walkProjectFiles, walkSourceFiles, walkTaskFiles, writeCycloneDxSbom, writeQualityBaseline, writeReleaseKpiReport, writeSecuritySarifReport, writeThirdPartyNotices };