@aisdlc/core 2.4.0 → 2.5.0

package/dist/index.cjs

@@ -1,11 +1,13 @@
 'use strict';
 
-var crypto = require('crypto');
-var fs7 = require('fs');
-var path4 = require('path');
+var crypto3 = require('crypto');
+var fs8 = require('fs');
+var path5 = require('path');
 var yaml3 = require('js-yaml');
-var tsMorph = require('ts-morph');
 var child_process = require('child_process');
+var tsMorph = require('ts-morph');
+var Ajv2020 = require('ajv/dist/2020.js');
+var addFormats = require('ajv-formats');
 var module$1 = require('module');
 
 var _documentCurrentScript = typeof document !== 'undefined' ? document.currentScript : null;
@@ -29,11 +31,13 @@ function _interopNamespace(e) {
   return Object.freeze(n);
 }
 
-var crypto__namespace = /*#__PURE__*/_interopNamespace(crypto);
-var fs7__namespace = /*#__PURE__*/_interopNamespace(fs7);
-var path4__namespace = /*#__PURE__*/_interopNamespace(path4);
+var crypto3__namespace = /*#__PURE__*/_interopNamespace(crypto3);
+var fs8__namespace = /*#__PURE__*/_interopNamespace(fs8);
+var path5__namespace = /*#__PURE__*/_interopNamespace(path5);
 var yaml3__default = /*#__PURE__*/_interopDefault(yaml3);
 var child_process__namespace = /*#__PURE__*/_interopNamespace(child_process);
+var Ajv2020__default = /*#__PURE__*/_interopDefault(Ajv2020);
+var addFormats__default = /*#__PURE__*/_interopDefault(addFormats);
 
 // src/types/index.ts
 var VALID_CHANGE_PROFILES = ["patch", "standard", "critical"];
@@ -43,6 +47,168 @@ var VALID_AUTONOMY_MODES = [
   "AMBIGUOUS",
   "HIGH_RISK_MANUAL"
 ];
+function canonicalSort(a, b) {
+  return a < b ? -1 : a > b ? 1 : 0;
+}
+function normalizePath(p) {
+  return p.normalize("NFC").replace(/\\/g, "/");
+}
+function walkMdFiles(dir, fileList = [], excludeDirs = [
+  "node_modules",
+  ".git",
+  "dist",
+  "bin",
+  "obj",
+  "build",
+  "out",
+  "target",
+  "coverage",
+  ".changeset",
+  "scratch",
+  "test-scaffold",
+  "fixtures",
+  "templates",
+  "examples",
+  ".agent",
+  ".agents",
+  ".claude",
+  ".cursor",
+  ".github",
+  ".vscode",
+  ".vs",
+  ".idea"
+]) {
+  try {
+    if (!fs8__namespace.existsSync(dir)) return fileList;
+    const files = fs8__namespace.readdirSync(dir).sort(canonicalSort);
+    for (const file of files) {
+      const fullPath = path5__namespace.join(dir, file);
+      try {
+        if (fs8__namespace.statSync(fullPath).isDirectory()) {
+          if (!excludeDirs.includes(file) && !file.startsWith("temp-") && !file.startsWith(".temp-")) {
+            walkMdFiles(fullPath, fileList, excludeDirs);
+          }
+        } else if (file.endsWith(".md")) {
+          fileList.push(fullPath);
+        }
+      } catch {
+      }
+    }
+  } catch {
+  }
+  return fileList.sort(canonicalSort);
+}
+function stripVolatileReportMetadata(content, _ext = "") {
+  let normalized = content.replace(/\r\n/g, "\n");
+  normalized = normalized.replace(/(?:^|\n)>\s*\*\*(?:Generation Date|Generated at|Fecha|Audit Date|Date):\*\*.*$/gim, "");
+  normalized = normalized.replace(/Generated:\s*<span>[\s\S]*?<\/span>/gi, "Generated: <span>[STRIPPED]</span>");
+  return normalized.trim();
+}
+function areCycloneDxSbomsEqual(existingContent, newContent) {
+  try {
+    const a = JSON.parse(existingContent);
+    const b = JSON.parse(newContent);
+    return a.serialNumber === b.serialNumber && JSON.stringify(a.components) === JSON.stringify(b.components) && JSON.stringify(a.vulnerabilities || []) === JSON.stringify(b.vulnerabilities || []);
+  } catch {
+    return false;
+  }
+}
+function areSarifReportsEqual(existingContent, newContent) {
+  try {
+    const a = JSON.parse(existingContent);
+    const b = JSON.parse(newContent);
+    return JSON.stringify(a.runs?.[0]?.results || []) === JSON.stringify(b.runs?.[0]?.results || []);
+  } catch {
+    return false;
+  }
+}
+function isReportContentSemanticallyEqual(existingContent, newContent, filePath) {
+  if (existingContent === newContent) return true;
+  if (filePath.endsWith(".cdx.json") || filePath.endsWith("sbom.json")) {
+    if (areCycloneDxSbomsEqual(existingContent, newContent)) return true;
+  }
+  if (filePath.endsWith(".sarif")) {
+    if (areSarifReportsEqual(existingContent, newContent)) return true;
+  }
+  const ext = path5__namespace.extname(filePath).toLowerCase();
+  return stripVolatileReportMetadata(existingContent, ext) === stripVolatileReportMetadata(newContent, ext);
+}
+function atomicWriteFile(filePath, content) {
+  const tempPath = `${filePath}.${process.pid}.${Math.random().toString(36).substring(2)}.tmp`;
+  try {
+    fs8__namespace.writeFileSync(tempPath, content, "utf-8");
+    try {
+      if (fs8__namespace.existsSync(filePath)) {
+        fs8__namespace.rmSync(filePath, { force: true });
+      }
+      fs8__namespace.renameSync(tempPath, filePath);
+    } catch {
+      fs8__namespace.copyFileSync(tempPath, filePath);
+      fs8__namespace.unlinkSync(tempPath);
+    }
+  } catch {
+    fs8__namespace.writeFileSync(filePath, content, "utf-8");
+  }
+}
+function writeReportFileIfChanged(filePath, content) {
+  try {
+    if (fs8__namespace.existsSync(filePath)) {
+      const existing = fs8__namespace.readFileSync(filePath, "utf-8");
+      if (isReportContentSemanticallyEqual(existing, content, filePath)) {
+        return false;
+      }
+    }
+  } catch {
+  }
+  const dir = path5__namespace.dirname(filePath);
+  if (!fs8__namespace.existsSync(dir)) {
+    fs8__namespace.mkdirSync(dir, { recursive: true });
+  }
+  atomicWriteFile(filePath, content);
+  return true;
+}
+var UUID_V5_NAMESPACE_OID = "6ba7b812-9dad-11d1-80b4-00c04fd430c8";
+function resolveDeterministicDate(rootDir) {
+  const epoch = process.env.SOURCE_DATE_EPOCH;
+  if (epoch) {
+    const parsed = parseInt(epoch, 10);
+    if (!isNaN(parsed) && parsed > 0) {
+      return new Date(parsed * 1e3);
+    }
+  }
+  const targetDir = rootDir || process.cwd();
+  if (fs8__namespace.existsSync(path5__namespace.join(targetDir, ".git"))) {
+    try {
+      const gitOut = child_process.execFileSync("git", ["log", "-1", "--format=%ct"], {
+        cwd: targetDir,
+        encoding: "utf-8",
+        stdio: ["pipe", "pipe", "ignore"]
+      }).trim();
+      const parsed = parseInt(gitOut, 10);
+      if (!isNaN(parsed) && parsed > 0) {
+        return new Date(parsed * 1e3);
+      }
+    } catch {
+    }
+  }
+  return /* @__PURE__ */ new Date();
+}
+function generateDeterministicUuidV5(name, namespace = UUID_V5_NAMESPACE_OID) {
+  const nsHex = namespace.replace(/-/g, "");
+  const nsBytes = Buffer.from(nsHex, "hex");
+  const nameBytes = Buffer.from(name, "utf-8");
+  const hash = crypto3__namespace.createHash("sha1").update(nsBytes).update(nameBytes).digest();
+  hash[6] = hash[6] & 15 | 80;
+  hash[8] = hash[8] & 63 | 128;
+  const hex = hash.toString("hex").substring(0, 32);
+  return [
+    hex.substring(0, 8),
+    hex.substring(8, 12),
+    hex.substring(12, 16),
+    hex.substring(16, 20),
+    hex.substring(20, 32)
+  ].join("-");
+}
 var CYCLOMATIC_KINDS = /* @__PURE__ */ new Set([
   tsMorph.SyntaxKind.IfStatement,
   tsMorph.SyntaxKind.ConditionalExpression,
@@ -199,7 +365,7 @@ function buildNodeMetrics(node, filePath) {
   return { functionName, filePath, loc, cyclomatic, cognitive, maintainability: mi, codeSmells, line };
 }
 function createTempSourceFile(project, content, filePath) {
-  const ext = path4__namespace.extname(filePath).toLowerCase() || ".ts";
+  const ext = path5__namespace.extname(filePath).toLowerCase() || ".ts";
   const fileName = `temp_${Date.now()}_${Math.random().toString(36).substring(2, 7)}${ext}`;
   return project.createSourceFile(fileName, content, { overwrite: true });
 }
@@ -236,8 +402,8 @@ function extractFunctionsTypeScriptAst(content, filePath) {
   }
 }
 function extractFunctionsPolyglot(content, filePath) {
-  const ext = path4__namespace.extname(filePath).toLowerCase();
-  return ext === ".py" ? extractPythonFunctions(content, filePath) : extractBraceFunctions(content, filePath);
+  const ext = path5__namespace.extname(filePath).toLowerCase();
+  return ext === ".py" ? extractPythonFunctionsPolyglot(content, filePath) : extractBraceFunctions(content, filePath);
 }
 function isDocstringToggle(trimmed) {
   const dCount = (trimmed.match(/"""/g) || []).length;
@@ -282,7 +448,7 @@ function processPythonLine(raw, state, blocks, lineIndex) {
     handlePythonBodyLine(raw, state, blocks, lineIndex);
   }
 }
-function extractPythonFunctions(content, filePath) {
+function extractPythonFunctionsPolyglot(content, filePath) {
   const lines = content.split("\n");
   const blocks = [];
   const state = { currentFn: null, fnLines: [], baseIndent: 0, inDocstring: false };
@@ -320,7 +486,7 @@ function processBraceLine(line, state, blocks, lineIndex, ext) {
   }
 }
 function extractBraceFunctions(content, filePath) {
-  const ext = path4__namespace.extname(filePath).toLowerCase();
+  const ext = path5__namespace.extname(filePath).toLowerCase();
   const lines = content.split("\n");
   const blocks = [];
   const state = {
@@ -529,7 +695,7 @@ function countCommentsAndLoc(rawLines, isPy) {
   return { loc, commentCount, cleanLines };
 }
 function calculatePolyglotMetrics(body, name, filePath, startLine) {
-  const ext = path4__namespace.extname(filePath).toLowerCase();
+  const ext = path5__namespace.extname(filePath).toLowerCase();
   const rawLines = body.split(/\r?\n/).map((l) => l.trim()).filter((l) => l.length > 0);
   const { loc, commentCount } = countCommentsAndLoc(rawLines, ext === ".py");
   const strippedBody = stripStringsAndComments(body, ext);
@@ -602,50 +768,129 @@ function computeBraceCognitive(lines) {
 function computePolyglotCognitive(lines, isPy) {
   return isPy ? computePythonCognitive(lines) : computeBraceCognitive(lines);
 }
-function walkMdFiles(dir, fileList = [], excludeDirs = [
-  "node_modules",
-  ".git",
-  "dist",
-  "bin",
-  "obj",
-  "build",
-  "out",
-  "target",
-  "coverage",
-  ".changeset",
-  "scratch",
-  "test-scaffold",
-  "fixtures",
-  "templates",
-  "examples",
-  ".agent",
-  ".agents",
-  ".claude",
-  ".cursor",
-  ".github",
-  ".vscode",
-  ".vs",
-  ".idea"
-]) {
+
+// src/verifiers/ast/python-ast.ts
+var PYTHON_AST_RUNNER_SCRIPT = `
+import ast, json, sys
+
+def analyze(code, filepath):
+    try:
+        tree = ast.parse(code)
+    except Exception as e:
+        return {"language": "python", "filePath": filepath, "functions": [], "error": str(e), "unsafeTypesCount": 0, "emptyStubsCount": 0}
+    
+    functions = []
+    unsafe_types = 0
+    empty_stubs = 0
+    for node in ast.walk(tree):
+        if isinstance(node, ast.Name) and node.id == "Any":
+            unsafe_types += 1
+        elif isinstance(node, (ast.FunctionDef, ast.AsyncFunctionDef)):
+            start = node.lineno
+            end = getattr(node, 'end_lineno', start + len(node.body))
+            loc = end - start + 1
+            cc = 1
+            for child in ast.walk(node):
+                if isinstance(child, (ast.If, ast.For, ast.AsyncFor, ast.While, ast.ExceptHandler, ast.With, ast.AsyncWith)):
+                    cc += 1
+                elif isinstance(child, ast.BoolOp):
+                    cc += len(child.values) - 1
+            
+            real_body = [n for n in node.body if not (isinstance(n, ast.Expr) and isinstance(getattr(n, 'value', None), ast.Constant))]
+            is_stub = len(real_body) == 0 or (len(real_body) == 1 and isinstance(real_body[0], ast.Pass))
+            if is_stub:
+                empty_stubs += 1
+            
+            code_smells = ["Empty stub detected"] if is_stub else []
+            mi = max(0.0, round(100.0 - (cc * 2.0) - (loc * 0.2), 1))
+            functions.append({
+                "functionName": node.name,
+                "filePath": filepath,
+                "line": start,
+                "loc": loc,
+                "cyclomatic": cc,
+                "cognitive": cc,
+                "maintainability": mi,
+                "codeSmells": code_smells
+            })
+    return {
+        "language": "python",
+        "filePath": filepath,
+        "functions": functions,
+        "unsafeTypesCount": unsafe_types,
+        "emptyStubsCount": empty_stubs
+    }
+
+code = sys.stdin.read()
+filepath = sys.argv[1] if len(sys.argv) > 1 else ""
+print(json.dumps(analyze(code, filepath)))
+`;
+function extractFunctionsPythonAst(content, filePath) {
   try {
-    if (!fs7__namespace.existsSync(dir)) return fileList;
-    const files = fs7__namespace.readdirSync(dir);
-    for (const file of files) {
-      const fullPath = path4__namespace.join(dir, file);
-      try {
-        if (fs7__namespace.statSync(fullPath).isDirectory()) {
-          if (!excludeDirs.includes(file) && !file.startsWith("temp-") && !file.startsWith(".temp-")) {
-            walkMdFiles(fullPath, fileList, excludeDirs);
-          }
-        } else if (file.endsWith(".md")) {
-          fileList.push(fullPath);
-        }
-      } catch {
-      }
+    const res = child_process.spawnSync("python", ["-c", PYTHON_AST_RUNNER_SCRIPT, filePath], {
+      input: content,
+      encoding: "utf-8",
+      timeout: 1e4
+    });
+    if (res.status === 0 && res.stdout) {
+      const parsed = JSON.parse(res.stdout);
+      return parsed;
     }
   } catch {
   }
-  return fileList;
+  const fallbackFns = extractPythonFunctionsPolyglot(content, filePath);
+  return {
+    language: "python",
+    filePath,
+    functions: fallbackFns,
+    unsafeTypesCount: 0,
+    emptyStubsCount: 0
+  };
+}
+
+// src/verifiers/ast/native-ast-orchestrator.ts
+function isCliInstalled(bin) {
+  try {
+    const res = child_process.spawnSync(bin, ["--version"], { encoding: "utf-8", timeout: 5e3, shell: false });
+    return res.status === 0 && !res.error;
+  } catch {
+    return false;
+  }
+}
+function assertRequiredStack(stack) {
+  if (!stack) return;
+  if (!isCliInstalled(stack)) {
+    throw new Error(`[AI-SDLC Fail-Closed] Required toolchain CLI '${stack}' is not installed in the environment`);
+  }
+}
+function analyzeTypeScript(content, filePath) {
+  return {
+    language: "typescript",
+    filePath,
+    functions: extractFunctionsTypeScriptAst(content, filePath),
+    unsafeTypesCount: 0,
+    emptyStubsCount: 0
+  };
+}
+function analyzePolyglot(content, filePath, ext) {
+  return {
+    language: ext.replace(/^\./, ""),
+    filePath,
+    functions: extractFunctionsPolyglot(content, filePath),
+    unsafeTypesCount: 0,
+    emptyStubsCount: 0
+  };
+}
+function orchestrateNativeAstAnalysis(content, filePath, options = {}) {
+  assertRequiredStack(options.requiredStack);
+  const ext = filePath.substring(filePath.lastIndexOf(".")).toLowerCase();
+  if ([".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs"].includes(ext)) {
+    return analyzeTypeScript(content, filePath);
+  }
+  if (ext === ".py") {
+    return extractFunctionsPythonAst(content, filePath);
+  }
+  return analyzePolyglot(content, filePath, ext);
 }
 function parseMarkdownFrontmatter(content) {
   const match = content.match(/^---\r?\n([\s\S]*?)\r?\n---/);
@@ -677,41 +922,41 @@ function extractGherkinBlock(body) {
 }
 function resolveTargetFiles(rootDir, targetPath) {
   if (targetPath) {
-    const fullTarget = path4__namespace.isAbsolute(targetPath) ? targetPath : path4__namespace.join(rootDir, targetPath);
-    if (!fs7__namespace.existsSync(fullTarget)) return [];
-    return fs7__namespace.statSync(fullTarget).isDirectory() ? walkMdFiles(fullTarget) : [fullTarget];
+    const fullTarget = path5__namespace.isAbsolute(targetPath) ? targetPath : path5__namespace.join(rootDir, targetPath);
+    if (!fs8__namespace.existsSync(fullTarget)) return [];
+    return fs8__namespace.statSync(fullTarget).isDirectory() ? walkMdFiles(fullTarget) : [fullTarget];
   }
   const searchDirs = [
-    path4__namespace.join(rootDir, "product"),
-    path4__namespace.join(rootDir, "security"),
-    path4__namespace.join(rootDir, "privacy"),
-    path4__namespace.join(rootDir, "specs"),
-    path4__namespace.join(rootDir, "examples", "product"),
-    path4__namespace.join(rootDir, "examples", "security"),
-    path4__namespace.join(rootDir, "examples", "privacy"),
-    path4__namespace.join(rootDir, "examples", "specs")
+    path5__namespace.join(rootDir, "product"),
+    path5__namespace.join(rootDir, "security"),
+    path5__namespace.join(rootDir, "privacy"),
+    path5__namespace.join(rootDir, "specs"),
+    path5__namespace.join(rootDir, "examples", "product"),
+    path5__namespace.join(rootDir, "examples", "security"),
+    path5__namespace.join(rootDir, "examples", "privacy"),
+    path5__namespace.join(rootDir, "examples", "specs")
   ];
-  return searchDirs.filter((d) => fs7__namespace.existsSync(d)).flatMap((d) => walkMdFiles(d));
+  return searchDirs.filter((d) => fs8__namespace.existsSync(d)).flatMap((d) => walkMdFiles(d));
 }
 function resolveFeatureFilePath(rootDir, filePath, id, customTarget) {
   if (customTarget) {
-    return path4__namespace.isAbsolute(customTarget) ? customTarget : path4__namespace.join(rootDir, customTarget);
-  }
-  const baseDir = path4__namespace.join(rootDir, "tests", "features");
-  const candidateSecurity = path4__namespace.join(baseDir, "security", `${id.toLowerCase()}.feature`);
-  const candidatePrivacy = path4__namespace.join(baseDir, "privacy", `${id.toLowerCase()}.feature`);
-  const candidateRoot = path4__namespace.join(baseDir, `${id.toLowerCase()}.feature`);
-  if (fs7__namespace.existsSync(candidateSecurity)) return candidateSecurity;
-  if (fs7__namespace.existsSync(candidatePrivacy)) return candidatePrivacy;
-  if (fs7__namespace.existsSync(candidateRoot)) return candidateRoot;
+    return path5__namespace.isAbsolute(customTarget) ? customTarget : path5__namespace.join(rootDir, customTarget);
+  }
+  const baseDir = path5__namespace.join(rootDir, "tests", "features");
+  const candidateSecurity = path5__namespace.join(baseDir, "security", `${id.toLowerCase()}.feature`);
+  const candidatePrivacy = path5__namespace.join(baseDir, "privacy", `${id.toLowerCase()}.feature`);
+  const candidateRoot = path5__namespace.join(baseDir, `${id.toLowerCase()}.feature`);
+  if (fs8__namespace.existsSync(candidateSecurity)) return candidateSecurity;
+  if (fs8__namespace.existsSync(candidatePrivacy)) return candidatePrivacy;
+  if (fs8__namespace.existsSync(candidateRoot)) return candidateRoot;
   const subDir = filePath.includes("security") ? "security" : filePath.includes("privacy") ? "privacy" : "";
-  return path4__namespace.join(baseDir, subDir, `${id.toLowerCase()}.feature`);
+  return path5__namespace.join(baseDir, subDir, `${id.toLowerCase()}.feature`);
 }
 function buildFeatureFileContent(rootDir, filePath, id, version, gherkinBlocks) {
   const banner = [
     `# ==============================================================================`,
     `# AUTO-GENERADO POR AI-SDLC (Cucumber Integration)`,
-    `# Origen: ${path4__namespace.relative(rootDir, filePath).replace(/\\/g, "/")}`,
+    `# Origen: ${path5__namespace.relative(rootDir, filePath).replace(/\\/g, "/")}`,
     `# ID Requerimiento: ${id}`,
     `# Versi\xF3n: ${version || "1.0.0"}`,
     `# NO EDITAR MANUALMENTE: Cualquier cambio debe realizarse en el Markdown origen.`,
@@ -736,20 +981,20 @@ function extractGherkinFeatures(options = {}) {
   const targetFiles = resolveTargetFiles(rootDir, options.targetPath);
   for (const filePath of targetFiles) {
     try {
-      const content = fs7__namespace.readFileSync(filePath, "utf-8");
+      const content = fs8__namespace.readFileSync(filePath, "utf-8");
       const { frontmatter, body } = parseMarkdownFrontmatter(content);
       const gherkinBlocks = extractGherkinBlock(body);
       if (gherkinBlocks.length === 0) continue;
-      const id = frontmatter.id || path4__namespace.basename(filePath, path4__namespace.extname(filePath));
+      const id = frontmatter.id || path5__namespace.basename(filePath, path5__namespace.extname(filePath));
       const targetPath = resolveFeatureFilePath(rootDir, filePath, id, frontmatter["cucumber-feature-file"]);
-      fs7__namespace.mkdirSync(path4__namespace.dirname(targetPath), { recursive: true });
+      fs8__namespace.mkdirSync(path5__namespace.dirname(targetPath), { recursive: true });
       const fullContent = buildFeatureFileContent(rootDir, filePath, id, frontmatter.version, gherkinBlocks);
-      fs7__namespace.writeFileSync(targetPath, fullContent, "utf-8");
+      fs8__namespace.writeFileSync(targetPath, fullContent, "utf-8");
       const scenarioCount = countScenarios(gherkinBlocks);
       totalScenarios += scenarioCount;
       features.push({
-        sourceFile: path4__namespace.relative(rootDir, filePath).replace(/\\/g, "/"),
-        outputFile: path4__namespace.relative(rootDir, targetPath).replace(/\\/g, "/"),
+        sourceFile: path5__namespace.relative(rootDir, filePath).replace(/\\/g, "/"),
+        outputFile: path5__namespace.relative(rootDir, targetPath).replace(/\\/g, "/"),
         featureName: id,
         scenarioCount
       });
@@ -766,20 +1011,20 @@ function checkGherkinInSync(options = {}) {
   let totalFeatures = 0;
   for (const filePath of targetFiles) {
     try {
-      const content = fs7__namespace.readFileSync(filePath, "utf-8");
+      const content = fs8__namespace.readFileSync(filePath, "utf-8");
       const { frontmatter, body } = parseMarkdownFrontmatter(content);
       const gherkinBlocks = extractGherkinBlock(body);
       if (gherkinBlocks.length === 0) continue;
       totalFeatures++;
-      const id = frontmatter.id || path4__namespace.basename(filePath, path4__namespace.extname(filePath));
+      const id = frontmatter.id || path5__namespace.basename(filePath, path5__namespace.extname(filePath));
       const targetPath = resolveFeatureFilePath(rootDir, filePath, id, frontmatter["cucumber-feature-file"]);
-      const relTarget = path4__namespace.relative(rootDir, targetPath).replace(/\\/g, "/");
-      if (!fs7__namespace.existsSync(targetPath)) {
+      const relTarget = path5__namespace.relative(rootDir, targetPath).replace(/\\/g, "/");
+      if (!fs8__namespace.existsSync(targetPath)) {
         missingFiles.push(relTarget);
         continue;
       }
       const expectedContent = buildFeatureFileContent(rootDir, filePath, id, frontmatter.version, gherkinBlocks);
-      const actualContent = fs7__namespace.readFileSync(targetPath, "utf-8");
+      const actualContent = fs8__namespace.readFileSync(targetPath, "utf-8");
       if (actualContent.replace(/\r\n/g, "\n") !== expectedContent.replace(/\r\n/g, "\n")) {
         outOfSyncFiles.push(relTarget);
       }
@@ -878,7 +1123,7 @@ function generateTestingCoverageReportMarkdown(reqAudit, taskAudit, reqErrors, t
   const reportLines = [
     `# \u{1F9EA} Deterministic Test Coverage Audit for Requirements and Tasks`,
     ``,
-    `> **Audit Date:** ${(/* @__PURE__ */ new Date()).toISOString()}`,
+    `> **Audit Date:** ${resolveDeterministicDate().toISOString()}`,
     `> **Overall Verdict:** ${verdict}`,
     ``,
     `---`,
@@ -941,8 +1186,8 @@ function parseCodeTestIds(content, relTest, reqToTestsMap) {
 }
 function processTestFile(fullPath, rootDir, reqToTestsMap) {
   try {
-    const content = fs7__namespace.readFileSync(fullPath, "utf-8");
-    const relTest = path4__namespace.relative(rootDir, fullPath).replace(/\\/g, "/");
+    const content = fs8__namespace.readFileSync(fullPath, "utf-8");
+    const relTest = path5__namespace.relative(rootDir, fullPath).replace(/\\/g, "/");
     if (fullPath.endsWith(".feature")) {
       parseFeatureTags(content, relTest, reqToTestsMap);
     }
@@ -951,16 +1196,16 @@ function processTestFile(fullPath, rootDir, reqToTestsMap) {
   }
 }
 function collectTestFiles(dir, files = []) {
-  if (!fs7__namespace.existsSync(dir)) return files;
+  if (!fs8__namespace.existsSync(dir)) return files;
   try {
-    const entries = fs7__namespace.readdirSync(dir, { withFileTypes: true });
+    const entries = fs8__namespace.readdirSync(dir, { withFileTypes: true }).sort((a, b) => canonicalSort(a.name, b.name));
     for (const e of entries) {
       if (e.isDirectory()) {
         if (!EXCLUDED_TEST_DIRS.has(e.name)) {
-          collectTestFiles(path4__namespace.join(dir, e.name), files);
+          collectTestFiles(path5__namespace.join(dir, e.name), files);
         }
       } else if (isTestFile(e.name)) {
-        files.push(path4__namespace.join(dir, e.name));
+        files.push(path5__namespace.join(dir, e.name));
       }
     }
   } catch {
@@ -1169,7 +1414,7 @@ function collectTestCorpus(rootDir, allMdFiles) {
   const testContents = [];
   for (const tf of collectTestFiles(rootDir)) {
     try {
-      const content = fs7__namespace.readFileSync(tf, "utf-8");
+      const content = fs8__namespace.readFileSync(tf, "utf-8");
       testContents.push(content);
       if (tf.endsWith(".feature")) gherkinSources.push(content);
     } catch {
@@ -1177,7 +1422,7 @@ function collectTestCorpus(rootDir, allMdFiles) {
   }
   for (const md of allMdFiles) {
     try {
-      const blocks = extractGherkinBlock(fs7__namespace.readFileSync(md, "utf-8"));
+      const blocks = extractGherkinBlock(fs8__namespace.readFileSync(md, "utf-8"));
       gherkinSources.push(...blocks);
       testContents.push(...blocks);
     } catch {
@@ -1206,9 +1451,9 @@ function countCucumberScenarios(raw) {
   return { passed, failed };
 }
 function parseCucumberReportFile(reportPath) {
-  if (!fs7__namespace.existsSync(reportPath)) return void 0;
+  if (!fs8__namespace.existsSync(reportPath)) return void 0;
   try {
-    const raw = JSON.parse(fs7__namespace.readFileSync(reportPath, "utf-8"));
+    const raw = JSON.parse(fs8__namespace.readFileSync(reportPath, "utf-8"));
     if (!Array.isArray(raw)) return void 0;
     const { passed, failed } = countCucumberScenarios(raw);
     return {
@@ -1222,7 +1467,7 @@ function parseCucumberReportFile(reportPath) {
   }
 }
 function resolveCucumberReport(rootDir, options) {
-  const candidate = options.cucumberReportPath ? path4__namespace.isAbsolute(options.cucumberReportPath) ? options.cucumberReportPath : path4__namespace.join(rootDir, options.cucumberReportPath) : path4__namespace.join(rootDir, "reports", "cucumber-report.json");
+  const candidate = options.cucumberReportPath ? path5__namespace.isAbsolute(options.cucumberReportPath) ? options.cucumberReportPath : path5__namespace.join(rootDir, options.cucumberReportPath) : path5__namespace.join(rootDir, "reports", "cucumber-report.json");
   const parsed = parseCucumberReportFile(candidate);
   if (parsed) return parsed;
   if (options.enforceCucumberExecution) {
@@ -1256,8 +1501,8 @@ function recordUseCaseAuditIfPresent(frontmatter, id, relPath, isTemplate, combi
   if (flowAudit.status === "FALLO_SIN_PRUEBA") state.ucErrors++;
 }
 function processMdFileForCoverage(file, rootDir, reqToTestsMap, corpus, options, state) {
-  const { frontmatter } = parseGenericDoc(fs7__namespace.readFileSync(file, "utf-8"));
-  const relPath = path4__namespace.relative(rootDir, file).replace(/\\/g, "/");
+  const { frontmatter } = parseGenericDoc(fs8__namespace.readFileSync(file, "utf-8"));
+  const relPath = path5__namespace.relative(rootDir, file).replace(/\\/g, "/");
   const isTemplate = relPath.includes("templates/");
   const id = frontmatter.id || "";
   if (isRequirementArtifact(frontmatter, id)) {
@@ -1331,7 +1576,6 @@ var DEFAULT_EXCLUDES = [
   "templates",
   "fixtures"
 ];
-var TS_JS_EXTENSIONS = [".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs"];
 function createDefaultQualityPolicy() {
   return {
     max_cyclomatic: 10,
@@ -1412,27 +1656,38 @@ function applyOptionOverrides(policy, overrides) {
   if (overrides.max_function_lines !== void 0) policy.max_function_lines = Number(overrides.max_function_lines);
   if (overrides.enforce_mode !== void 0) policy.enforce_mode = overrides.enforce_mode;
 }
+function parsePolicyYaml(content) {
+  let doc;
+  try {
+    doc = yaml3__default.default.load(content);
+  } catch (err) {
+    throw new Error(`[AI-SDLC Fail-Closed] Invalid YAML in quality-policy: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  if (!doc || typeof doc !== "object" || Array.isArray(doc)) {
+    throw new Error(`[AI-SDLC Fail-Closed] Invalid quality policy structure: root must be a YAML mapping`);
+  }
+  return doc;
+}
 function parseQualityPolicy(content, overrides) {
   const policy = createDefaultQualityPolicy();
-  try {
-    const doc = yaml3__default.default.load(content);
-    if (doc && typeof doc === "object") {
-      const record = doc;
-      applyDocScope(policy, record);
-      applyDocThresholds(policy, record);
-      if (record.max_per_function !== void 0) policy.max_cyclomatic = Number(record.max_per_function);
-      if (record.min_acceptable_score !== void 0) policy.min_maintainability = Number(record.min_acceptable_score);
-      if (record.max_function_lines !== void 0) policy.max_function_lines = Number(record.max_function_lines);
-    }
-  } catch {
+  if (!content || !content.trim()) {
+    applyEnvThresholds(policy);
+    applyOptionOverrides(policy, overrides);
+    return policy;
   }
+  const record = parsePolicyYaml(content);
+  applyDocScope(policy, record);
+  applyDocThresholds(policy, record);
+  if (record.max_per_function !== void 0) policy.max_cyclomatic = Number(record.max_per_function);
+  if (record.min_acceptable_score !== void 0) policy.min_maintainability = Number(record.min_acceptable_score);
+  if (record.max_function_lines !== void 0) policy.max_function_lines = Number(record.max_function_lines);
   applyEnvThresholds(policy);
   applyOptionOverrides(policy, overrides);
   return policy;
 }
 function extractFunctions(content, filePath) {
-  const ext = path4__namespace.extname(filePath).toLowerCase();
-  return TS_JS_EXTENSIONS.includes(ext) ? extractFunctionsTypeScriptAst(content, filePath) : extractFunctionsPolyglot(content, filePath);
+  const report = orchestrateNativeAstAnalysis(content, filePath);
+  return report.functions;
 }
 function extractFunctionsBraceLanguages(content, filePath) {
   return extractFunctions(content, filePath);
@@ -1462,55 +1717,55 @@ function isExcludedFile(file, normalized, excludePatterns) {
   );
 }
 function walkDir(dir, extensions = DEFAULT_EXTENSIONS, excludePatterns = DEFAULT_EXCLUDES) {
-  if (!fs7__namespace.existsSync(dir)) return [];
+  if (!fs8__namespace.existsSync(dir)) return [];
   const results = [];
-  for (const file of fs7__namespace.readdirSync(dir)) {
-    const fullPath = path4__namespace.join(dir, file);
+  for (const file of fs8__namespace.readdirSync(dir).sort(canonicalSort)) {
+    const fullPath = path5__namespace.join(dir, file);
     const normalized = fullPath.replace(/\\/g, "/");
     if (isExcludedFile(file, normalized, excludePatterns)) continue;
-    const stat = fs7__namespace.statSync(fullPath);
+    const stat = fs8__namespace.statSync(fullPath);
     if (stat.isDirectory()) {
       results.push(...walkDir(fullPath, extensions, excludePatterns));
-    } else if (extensions.includes(path4__namespace.extname(file).toLowerCase())) {
+    } else if (extensions.includes(path5__namespace.extname(file).toLowerCase())) {
       results.push(fullPath);
     }
   }
   return results;
 }
 function resolvePolicy(rootDir, options) {
-  const policyFile = options.policyPath || path4__namespace.join(rootDir, "quality-policy.yaml");
+  const policyFile = options.policyPath || path5__namespace.join(rootDir, "quality-policy.yaml");
   if (options.policy) {
     const policy = { ...options.policy };
     applyOptionOverrides(policy, options.thresholds);
     return policy;
   }
-  if (fs7__namespace.existsSync(policyFile)) {
-    return parseQualityPolicy(fs7__namespace.readFileSync(policyFile, "utf-8"), options.thresholds);
+  if (fs8__namespace.existsSync(policyFile)) {
+    return parseQualityPolicy(fs8__namespace.readFileSync(policyFile, "utf-8"), options.thresholds);
   }
   return parseQualityPolicy("", options.thresholds);
 }
 function isPathExcluded(targetPath, rootDir, excludePatterns) {
-  const rel = path4__namespace.relative(rootDir, targetPath).replace(/\\/g, "/");
-  const base = path4__namespace.basename(targetPath);
+  const rel = path5__namespace.relative(rootDir, targetPath).replace(/\\/g, "/");
+  const base = path5__namespace.basename(targetPath);
   return excludePatterns.some(
     (pat) => base === pat || rel === pat || rel.startsWith(pat + "/") || rel.includes("/" + pat + "/") || rel.endsWith("/" + pat) || rel.includes(pat)
   );
 }
 function scanContainerSubdir(containerDir, subdirName, targetDir, rootDir, policy, files) {
   if (policy.exclude_patterns.includes(subdirName)) return;
-  const subTarget = path4__namespace.join(containerDir, subdirName, targetDir);
-  if (!fs7__namespace.existsSync(subTarget) || !fs7__namespace.statSync(subTarget).isDirectory()) return;
+  const subTarget = path5__namespace.join(containerDir, subdirName, targetDir);
+  if (!fs8__namespace.existsSync(subTarget) || !fs8__namespace.statSync(subTarget).isDirectory()) return;
   if (isPathExcluded(subTarget, rootDir, policy.exclude_patterns)) return;
   for (const f of walkDir(subTarget, policy.supported_extensions, policy.exclude_patterns)) {
     files.add(f);
   }
 }
 function scanMonorepoContainer(rootDir, container, targetDir, policy, files) {
-  const containerDir = path4__namespace.join(rootDir, container);
-  if (!fs7__namespace.existsSync(containerDir) || !fs7__namespace.statSync(containerDir).isDirectory()) return;
+  const containerDir = path5__namespace.join(rootDir, container);
+  if (!fs8__namespace.existsSync(containerDir) || !fs8__namespace.statSync(containerDir).isDirectory()) return;
   if (isPathExcluded(containerDir, rootDir, policy.exclude_patterns)) return;
   try {
-    for (const subdir of fs7__namespace.readdirSync(containerDir, { withFileTypes: true })) {
+    for (const subdir of fs8__namespace.readdirSync(containerDir, { withFileTypes: true })) {
       if (subdir.isDirectory()) {
         scanContainerSubdir(containerDir, subdir.name, targetDir, rootDir, policy, files);
       }
@@ -1519,13 +1774,14 @@ function scanMonorepoContainer(rootDir, container, targetDir, policy, files) {
   }
 }
 function scanDirectTarget(rootDir, targetDir, policy, files) {
-  const fullDir = path4__namespace.join(rootDir, targetDir);
-  if (fs7__namespace.existsSync(fullDir) && !isPathExcluded(fullDir, rootDir, policy.exclude_patterns)) {
+  const fullDir = path5__namespace.join(rootDir, targetDir);
+  if (fs8__namespace.existsSync(fullDir) && !isPathExcluded(fullDir, rootDir, policy.exclude_patterns)) {
     for (const f of walkDir(fullDir, policy.supported_extensions, policy.exclude_patterns)) {
       files.add(f);
     }
   }
 }
+var UNIT_TEST_SUFFIXES = [".spec.ts", ".test.ts", ".spec.js", ".test.js", "_test.py", "_test.go"];
 function collectFilesToScan(rootDir, policy) {
   const files = /* @__PURE__ */ new Set();
   const monorepoContainers = ["packages", "apps", "libs", "modules", "services"];
@@ -1535,7 +1791,7 @@ function collectFilesToScan(rootDir, policy) {
       scanMonorepoContainer(rootDir, container, targetDir, policy, files);
     }
   }
-  return Array.from(files);
+  return Array.from(files).filter((f) => !UNIT_TEST_SUFFIXES.some((s) => f.endsWith(s)));
 }
 function evaluateViolations(fn, policy) {
   const violations = [];
@@ -1557,38 +1813,67 @@ function evaluateViolations(fn, policy) {
   return violations;
 }
 function evaluateFileQuality(file, rootDir, policy) {
-  const content = fs7__namespace.readFileSync(file, "utf-8");
+  const content = fs8__namespace.readFileSync(file, "utf-8");
   const fns = extractFunctions(content, file);
   return fns.map((fn) => {
     const violations = evaluateViolations(fn, policy);
     return {
       ...fn,
-      relPath: path4__namespace.relative(rootDir, file).replace(/\\/g, "/"),
+      relPath: path5__namespace.relative(rootDir, file).replace(/\\/g, "/"),
       status: violations.length === 0 ? "PASS" : "FAIL",
       violations
     };
   });
 }
-var UNIT_TEST_SUFFIXES = [".spec.ts", ".test.ts", ".spec.js", ".test.js", "_test.py", "_test.go"];
 function collectUnitTestCorpus(rootDir) {
   const allCodeFiles = walkDir(rootDir, DEFAULT_EXTENSIONS, DEFAULT_EXCLUDES);
   const chunks = [];
   for (const tf of allCodeFiles) {
     if (!UNIT_TEST_SUFFIXES.some((s) => tf.endsWith(s))) continue;
     try {
-      chunks.push(fs7__namespace.readFileSync(tf, "utf-8"));
+      chunks.push(fs8__namespace.readFileSync(tf, "utf-8"));
     } catch {
     }
   }
   return chunks.join("\n");
 }
+function sanitizeTestCorpus(corpus, fnName) {
+  let cleaned = corpus.replace(/\/\*[\s\S]*?\*\//g, " ");
+  cleaned = cleaned.replace(/(?:\/\/|#)[^\r\n]*/g, " ");
+  cleaned = cleaned.replace(/(['"`])((?:\\.|(?!\1)[^\\])*)\1/g, (match, quote, inner) => {
+    const trimmed = inner.trim();
+    if (trimmed === fnName || trimmed === `#${fnName}` || trimmed === `.${fnName}` || trimmed === `${fnName}()`) {
+      return match;
+    }
+    return `${quote}${quote}`;
+  });
+  return cleaned;
+}
+function buildTestReferencePatterns(escaped) {
+  return [
+    new RegExp(`(?:\\.|\\b)${escaped}\\s*\\(`, "m"),
+    new RegExp(`\\b(?:import|require)\\b[^;\\n]*\\b${escaped}\\b`, "m"),
+    new RegExp(`(?:\\bexpect|\\bassert|\\bshould)\\s*\\([^;\\n]*\\b${escaped}\\b`, "m"),
+    new RegExp("(?:\\bspyOn|\\bmock)\\s*\\([^;\\n]*['\"`]" + escaped + "['\"`]", "m"),
+    new RegExp(`\\b${escaped}\\s*\\.`, "m"),
+    new RegExp("\\b(?:describe|it|test|context)\\s*\\(\\s*['\"`](?:#|\\.)?" + escaped + "['\"`]", "m"),
+    new RegExp(`\\btest_?${escaped}\\b`, "im")
+  ];
+}
+function isFunctionReferencedInTests(fnName, rawCorpus) {
+  if (!fnName || fnName === "anonymous" || fnName === "constructor") return true;
+  const corpus = sanitizeTestCorpus(rawCorpus, fnName);
+  const escaped = fnName.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const patterns = buildTestReferencePatterns(escaped);
+  return patterns.some((p) => p.test(corpus));
+}
 function auditUnitTestsPerFunction(results, rootDir) {
   const corpus = collectUnitTestCorpus(rootDir);
   const untested = [];
   for (const r of results) {
     const fnName = r.functionName.includes(".") ? r.functionName.split(".").pop() : r.functionName;
     if (!fnName || fnName === "anonymous" || fnName === "constructor") continue;
-    if (!corpus.includes(fnName)) {
+    if (!isFunctionReferencedInTests(fnName, corpus)) {
       untested.push({ file: r.relPath, functionName: r.functionName });
       r.violations.push(`Missing unit test for function '${r.functionName}'`);
       r.status = "FAIL";
@@ -1598,11 +1883,11 @@ function auditUnitTestsPerFunction(results, rootDir) {
 }
 function isVitestMidFlightCoverage(rel, fullPath) {
   if (!process.env.VITEST || rel !== "coverage/coverage-summary.json") return false;
-  return path4__namespace.resolve(fullPath) === path4__namespace.resolve(process.cwd(), rel);
+  return path5__namespace.resolve(fullPath) === path5__namespace.resolve(process.cwd(), rel);
 }
 function parseCoverageSummaryFile(filePath, source) {
   try {
-    const raw = JSON.parse(fs7__namespace.readFileSync(filePath, "utf-8"));
+    const raw = JSON.parse(fs8__namespace.readFileSync(filePath, "utf-8"));
     const total = raw.total;
     if (!total) return null;
     return {
@@ -1617,8 +1902,8 @@ function parseCoverageSummaryFile(filePath, source) {
 }
 function readSummaryCoverageJson(rootDir) {
   for (const rel of ["coverage/coverage-summary.json", "reports/coverage-summary.json"]) {
-    const full = path4__namespace.join(rootDir, rel);
-    if (!fs7__namespace.existsSync(full) || isVitestMidFlightCoverage(rel, full)) continue;
+    const full = path5__namespace.join(rootDir, rel);
+    if (!fs8__namespace.existsSync(full) || isVitestMidFlightCoverage(rel, full)) continue;
     const summary = parseCoverageSummaryFile(full, rel);
     if (summary) return summary;
   }
@@ -1642,7 +1927,7 @@ function evaluateCoverageThresholds(rootDir, policy, requireReport) {
 }
 function computeViolationSignature(relPath, fnName, metric) {
   const normPath = relPath.replace(/\\/g, "/");
-  return crypto__namespace.createHash("sha256").update(normPath + ":" + fnName + ":" + metric).digest("hex");
+  return crypto3__namespace.createHash("sha256").update(normPath + ":" + fnName + ":" + metric).digest("hex");
 }
 function classifyMetricFromMessage(msg, fn) {
   if (msg.startsWith("Cyclomatic Complexity")) {
@@ -1671,8 +1956,8 @@ function isMetricWorsened(baselineEntry, current) {
 }
 function loadQualityBaseline(baselineFile) {
   try {
-    if (!fs7__namespace.existsSync(baselineFile)) return null;
-    const content = fs7__namespace.readFileSync(baselineFile, "utf-8");
+    if (!fs8__namespace.existsSync(baselineFile)) return null;
+    const content = fs8__namespace.readFileSync(baselineFile, "utf-8");
     return JSON.parse(content);
   } catch {
     return null;
@@ -1681,11 +1966,11 @@ function loadQualityBaseline(baselineFile) {
 function writeQualityBaseline(baselineFile, entries) {
   const baseline = {
     version: "1.0",
-    generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    generatedAt: resolveDeterministicDate(path5__namespace.dirname(baselineFile)).toISOString(),
     totalViolations: entries.length,
     violations: entries
   };
-  fs7__namespace.writeFileSync(baselineFile, JSON.stringify(baseline, null, 2) + "\n", "utf-8");
+  fs8__namespace.writeFileSync(baselineFile, JSON.stringify(baseline, null, 2) + "\n", "utf-8");
   return baseline;
 }
 function extractBaselineEntriesFromResults(results) {
@@ -1744,7 +2029,7 @@ function applyRatchetMode(results, baseline) {
 function resolveBaselineFilePath(rootDir, options) {
   if (options.baselinePath) return options.baselinePath;
   if (typeof options.baseline === "string") return options.baseline;
-  return path4__namespace.join(rootDir, "quality-baseline.json");
+  return path5__namespace.join(rootDir, "quality-baseline.json");
 }
 function isRatchetModeActive(policy, options, baselineExists) {
   if (options.ratchet !== void 0) return options.ratchet;
@@ -1752,7 +2037,7 @@ function isRatchetModeActive(policy, options, baselineExists) {
   return Boolean(policy.ratchet_mode || options.baseline && baselineExists);
 }
 function evaluateRatchetIfActive(results, baselineFile, isActive) {
-  if (!isActive || !fs7__namespace.existsSync(baselineFile)) {
+  if (!isActive || !fs8__namespace.existsSync(baselineFile)) {
     return { toleratedViolationsCount: 0, newViolationsCount: 0, baselineViolationsCount: 0 };
   }
   const baseline = loadQualityBaseline(baselineFile);
@@ -1811,7 +2096,7 @@ function verifyQualityGate(options = {}) {
       baselineViolationsCount: entries.length
     });
   }
-  const baselineExists = fs7__namespace.existsSync(baselineFile);
+  const baselineExists = fs8__namespace.existsSync(baselineFile);
   const isRatchet = isRatchetModeActive(policy, options, baselineExists);
   const ratchetEval = evaluateRatchetIfActive(results, baselineFile, isRatchet);
   return buildQualityGateResult(results, allFiles.length, policy, coverageViolations, untestedFunctions, {
@@ -1829,9 +2114,9 @@ function normalizeHandoffPayload(handoff, changeId) {
   };
 }
 function parseChangeProfile(specFile) {
-  if (!fs7__namespace.existsSync(specFile)) return "standard";
+  if (!fs8__namespace.existsSync(specFile)) return "standard";
   try {
-    const rawSpec = fs7__namespace.readFileSync(specFile, "utf-8").replace(/^\uFEFF/, "");
+    const rawSpec = fs8__namespace.readFileSync(specFile, "utf-8").replace(/^\uFEFF/, "");
     const match = rawSpec.match(/^---\r?\n([\s\S]*?)\r?\n---/);
     if (match) {
       const parsedFm = yaml3__default.default.load(match[1]);
@@ -1853,12 +2138,12 @@ function checkSpecGherkinFormat(parsedFm, rawSpec, changeWorkspaceDir, errors) {
   }
 }
 function validateSpecFileContent(specFile, changeWorkspaceDir, errors) {
-  if (!fs7__namespace.existsSync(specFile)) {
+  if (!fs8__namespace.existsSync(specFile)) {
     errors.push(`Falta el archivo obligatorio 'spec.md' en ${changeWorkspaceDir}.`);
     return;
   }
   try {
-    const rawSpec = fs7__namespace.readFileSync(specFile, "utf-8").replace(/^\uFEFF/, "");
+    const rawSpec = fs8__namespace.readFileSync(specFile, "utf-8").replace(/^\uFEFF/, "");
     const match = rawSpec.match(/^---\r?\n([\s\S]*?)\r?\n---/);
     if (match) {
       const parsedFm = yaml3__default.default.load(match[1]);
@@ -1877,19 +2162,19 @@ function validateHandoffSidecar(handoff, changeWorkspaceDir, errors) {
   if (!handoff.subgraph || !Array.isArray(handoff.subgraph.requirements)) {
     errors.push(`El sidecar '${handoff.id}' no define un subgrafo de requerimientos v\xE1lido.`);
   }
-  return path4__namespace.join(changeWorkspaceDir, "handoff.yaml");
+  return path5__namespace.join(changeWorkspaceDir, "handoff.yaml");
 }
 function validateOpenSpecStructure(profile, changeWorkspaceDir, adapter, errors, warnings) {
-  const proposalFile = path4__namespace.join(changeWorkspaceDir, "proposal.md");
-  const tasksFile = path4__namespace.join(changeWorkspaceDir, "tasks.md");
+  const proposalFile = path5__namespace.join(changeWorkspaceDir, "proposal.md");
+  const tasksFile = path5__namespace.join(changeWorkspaceDir, "tasks.md");
   if (profile === "patch") {
     const handoff2 = adapter.loadSidecar(changeWorkspaceDir);
-    return { handoff: handoff2, sidecarFile: handoff2 ? path4__namespace.join(changeWorkspaceDir, "handoff.yaml") : void 0 };
+    return { handoff: handoff2, sidecarFile: handoff2 ? path5__namespace.join(changeWorkspaceDir, "handoff.yaml") : void 0 };
   }
-  if (!fs7__namespace.existsSync(proposalFile)) {
+  if (!fs8__namespace.existsSync(proposalFile)) {
     warnings.push(`Falta 'proposal.md' en el espacio de trabajo OpenSpec.`);
   }
-  if (!fs7__namespace.existsSync(tasksFile)) {
+  if (!fs8__namespace.existsSync(tasksFile)) {
     errors.push(`Falta el archivo obligatorio 'tasks.md' en ${changeWorkspaceDir}.`);
   }
   const handoff = adapter.loadSidecar(changeWorkspaceDir);
@@ -1897,20 +2182,20 @@ function validateOpenSpecStructure(profile, changeWorkspaceDir, adapter, errors,
   return { handoff, sidecarFile };
 }
 function buildOpenSpecWorkspaceInfo(changeWorkspaceDir, profile, handoff, sidecarFile) {
-  const changeId = path4__namespace.basename(changeWorkspaceDir);
-  const proposalFile = path4__namespace.join(changeWorkspaceDir, "proposal.md");
-  const specFile = path4__namespace.join(changeWorkspaceDir, "spec.md");
-  const designFile = path4__namespace.join(changeWorkspaceDir, "design.md");
-  const tasksFile = path4__namespace.join(changeWorkspaceDir, "tasks.md");
+  const changeId = path5__namespace.basename(changeWorkspaceDir);
+  const proposalFile = path5__namespace.join(changeWorkspaceDir, "proposal.md");
+  const specFile = path5__namespace.join(changeWorkspaceDir, "spec.md");
+  const designFile = path5__namespace.join(changeWorkspaceDir, "design.md");
+  const tasksFile = path5__namespace.join(changeWorkspaceDir, "tasks.md");
   return {
     framework: "openspec",
     changeId,
     changeDir: changeWorkspaceDir,
     profile,
-    proposalFile: fs7__namespace.existsSync(proposalFile) ? proposalFile : void 0,
-    specFile: fs7__namespace.existsSync(specFile) ? specFile : void 0,
-    designFile: fs7__namespace.existsSync(designFile) ? designFile : void 0,
-    tasksFile: fs7__namespace.existsSync(tasksFile) ? tasksFile : void 0,
+    proposalFile: fs8__namespace.existsSync(proposalFile) ? proposalFile : void 0,
+    specFile: fs8__namespace.existsSync(specFile) ? specFile : void 0,
+    designFile: fs8__namespace.existsSync(designFile) ? designFile : void 0,
+    tasksFile: fs8__namespace.existsSync(tasksFile) ? tasksFile : void 0,
     sidecarFile,
     handoff: handoff || void 0
   };
@@ -1918,28 +2203,28 @@ function buildOpenSpecWorkspaceInfo(changeWorkspaceDir, profile, handoff, sideca
 var OpenSpecAdapter = class {
   framework = "openspec";
   getChangeWorkspaceDir(rootDir, changeId) {
-    const openspecDir = path4__namespace.join(rootDir, "openspec", "changes", changeId);
-    if (fs7__namespace.existsSync(openspecDir)) return openspecDir;
-    const activeChangeDir = path4__namespace.join(rootDir, "specs", "changes", "active", changeId);
-    if (fs7__namespace.existsSync(activeChangeDir)) return activeChangeDir;
-    const completedChangeDir = path4__namespace.join(rootDir, "specs", "changes", "completed", changeId);
-    if (fs7__namespace.existsSync(completedChangeDir)) return completedChangeDir;
+    const openspecDir = path5__namespace.join(rootDir, "openspec", "changes", changeId);
+    if (fs8__namespace.existsSync(openspecDir)) return openspecDir;
+    const activeChangeDir = path5__namespace.join(rootDir, "specs", "changes", "active", changeId);
+    if (fs8__namespace.existsSync(activeChangeDir)) return activeChangeDir;
+    const completedChangeDir = path5__namespace.join(rootDir, "specs", "changes", "completed", changeId);
+    if (fs8__namespace.existsSync(completedChangeDir)) return completedChangeDir;
     return activeChangeDir;
   }
   depositSidecar(options) {
     const changeDir = this.getChangeWorkspaceDir(options.rootDir, options.changeId);
-    if (!fs7__namespace.existsSync(changeDir)) {
-      fs7__namespace.mkdirSync(changeDir, { recursive: true });
+    if (!fs8__namespace.existsSync(changeDir)) {
+      fs8__namespace.mkdirSync(changeDir, { recursive: true });
     }
     const handoff = normalizeHandoffPayload(options.handoff, options.changeId);
     const filename = options.format === "json" ? "handoff.json" : "handoff.yaml";
-    const filePath = path4__namespace.join(changeDir, filename);
+    const filePath = path5__namespace.join(changeDir, filename);
     const content = options.format === "json" ? JSON.stringify(handoff, null, 2) : yaml3__default.default.dump(handoff, { indent: 2, lineWidth: -1 });
-    fs7__namespace.writeFileSync(filePath, content, "utf-8");
+    fs8__namespace.writeFileSync(filePath, content, "utf-8");
     return filePath;
   }
   loadSidecar(changeWorkspaceDir) {
-    if (!fs7__namespace.existsSync(changeWorkspaceDir)) return null;
+    if (!fs8__namespace.existsSync(changeWorkspaceDir)) return null;
     const candidateFiles = [
       "handoff.yaml",
       "handoff.yml",
@@ -1950,10 +2235,10 @@ var OpenSpecAdapter = class {
       "product-handoff.json"
     ];
     for (const file of candidateFiles) {
-      const fullPath = path4__namespace.join(changeWorkspaceDir, file);
-      if (fs7__namespace.existsSync(fullPath)) {
+      const fullPath = path5__namespace.join(changeWorkspaceDir, file);
+      if (fs8__namespace.existsSync(fullPath)) {
         try {
-          const raw = fs7__namespace.readFileSync(fullPath, "utf-8").replace(/^\uFEFF/, "");
+          const raw = fs8__namespace.readFileSync(fullPath, "utf-8").replace(/^\uFEFF/, "");
           const parsed = file.endsWith(".json") ? JSON.parse(raw) : yaml3__default.default.load(raw);
           if (parsed && typeof parsed === "object" && parsed.id && String(parsed.id).startsWith("HOF-")) {
             return parsed;
@@ -1965,7 +2250,7 @@ var OpenSpecAdapter = class {
     return null;
   }
   validateWorkspace(changeWorkspaceDir) {
-    if (!fs7__namespace.existsSync(changeWorkspaceDir)) {
+    if (!fs8__namespace.existsSync(changeWorkspaceDir)) {
       return {
         valid: false,
         errors: [`El directorio del cambio OpenSpec no existe: ${changeWorkspaceDir}`],
@@ -1974,7 +2259,7 @@ var OpenSpecAdapter = class {
     }
     const errors = [];
     const warnings = [];
-    const specFile = path4__namespace.join(changeWorkspaceDir, "spec.md");
+    const specFile = path5__namespace.join(changeWorkspaceDir, "spec.md");
     const profile = parseChangeProfile(specFile);
     validateSpecFileContent(specFile, changeWorkspaceDir, errors);
     const { handoff, sidecarFile } = validateOpenSpecStructure(profile, changeWorkspaceDir, this, errors, warnings);
@@ -1988,9 +2273,9 @@ var OpenSpecAdapter = class {
   }
 };
 function parseChangeProfile2(specFile) {
-  if (!fs7__namespace.existsSync(specFile)) return "standard";
+  if (!fs8__namespace.existsSync(specFile)) return "standard";
   try {
-    const rawSpec = fs7__namespace.readFileSync(specFile, "utf-8").replace(/^\uFEFF/, "");
+    const rawSpec = fs8__namespace.readFileSync(specFile, "utf-8").replace(/^\uFEFF/, "");
     const match = rawSpec.match(/^---\r?\n([\s\S]*?)\r?\n---/);
     if (match) {
       const parsedFm = yaml3__default.default.load(match[1]);
@@ -2012,12 +2297,12 @@ function checkSpecGherkinFormat2(parsedFm, rawSpec, changeWorkspaceDir, errors)
   }
 }
 function validateSpecFileContent2(specFile, changeWorkspaceDir, errors) {
-  if (!fs7__namespace.existsSync(specFile)) {
+  if (!fs8__namespace.existsSync(specFile)) {
     errors.push(`Falta el archivo de especificaci\xF3n obligatorio 'spec.md' en ${changeWorkspaceDir}.`);
     return;
   }
   try {
-    const rawSpec = fs7__namespace.readFileSync(specFile, "utf-8").replace(/^\uFEFF/, "");
+    const rawSpec = fs8__namespace.readFileSync(specFile, "utf-8").replace(/^\uFEFF/, "");
     const match = rawSpec.match(/^---\r?\n([\s\S]*?)\r?\n---/);
     if (match) {
       const parsedFm = yaml3__default.default.load(match[1]);
@@ -2036,19 +2321,19 @@ function validateHandoffSidecar2(handoff, changeWorkspaceDir, errors) {
   if (!handoff.subgraph || !Array.isArray(handoff.subgraph.requirements)) {
     errors.push(`El sidecar '${handoff.id}' no define un subgrafo de requerimientos v\xE1lido.`);
   }
-  return path4__namespace.join(changeWorkspaceDir, "handoff.yaml");
+  return path5__namespace.join(changeWorkspaceDir, "handoff.yaml");
 }
 function validateSpecKitStructure(profile, changeWorkspaceDir, adapter, errors, warnings) {
-  const planFile = path4__namespace.join(changeWorkspaceDir, "plan.md");
-  const tasksFile = path4__namespace.join(changeWorkspaceDir, "tasks.md");
+  const planFile = path5__namespace.join(changeWorkspaceDir, "plan.md");
+  const tasksFile = path5__namespace.join(changeWorkspaceDir, "tasks.md");
   if (profile === "patch") {
     const handoff2 = adapter.loadSidecar(changeWorkspaceDir);
-    return { handoff: handoff2, sidecarFile: handoff2 ? path4__namespace.join(changeWorkspaceDir, "handoff.yaml") : void 0 };
+    return { handoff: handoff2, sidecarFile: handoff2 ? path5__namespace.join(changeWorkspaceDir, "handoff.yaml") : void 0 };
   }
-  if (!fs7__namespace.existsSync(tasksFile)) {
+  if (!fs8__namespace.existsSync(tasksFile)) {
     errors.push(`Falta el archivo de tareas obligatorio 'tasks.md' en ${changeWorkspaceDir}.`);
   }
-  if (!fs7__namespace.existsSync(planFile)) {
+  if (!fs8__namespace.existsSync(planFile)) {
     warnings.push(`Se recomienda incluir 'plan.md' en el espacio de trabajo Spec Kit.`);
   }
   const handoff = adapter.loadSidecar(changeWorkspaceDir);
@@ -2056,18 +2341,18 @@ function validateSpecKitStructure(profile, changeWorkspaceDir, adapter, errors,
   return { handoff, sidecarFile };
 }
 function buildSpecKitWorkspaceInfo(changeWorkspaceDir, profile, handoff, sidecarFile) {
-  const changeId = path4__namespace.basename(changeWorkspaceDir);
-  const specFile = path4__namespace.join(changeWorkspaceDir, "spec.md");
-  const planFile = path4__namespace.join(changeWorkspaceDir, "plan.md");
-  const tasksFile = path4__namespace.join(changeWorkspaceDir, "tasks.md");
+  const changeId = path5__namespace.basename(changeWorkspaceDir);
+  const specFile = path5__namespace.join(changeWorkspaceDir, "spec.md");
+  const planFile = path5__namespace.join(changeWorkspaceDir, "plan.md");
+  const tasksFile = path5__namespace.join(changeWorkspaceDir, "tasks.md");
   return {
     framework: "speckit",
     changeId,
     changeDir: changeWorkspaceDir,
     profile,
-    specFile: fs7__namespace.existsSync(specFile) ? specFile : void 0,
-    designFile: fs7__namespace.existsSync(planFile) ? planFile : void 0,
-    tasksFile: fs7__namespace.existsSync(tasksFile) ? tasksFile : void 0,
+    specFile: fs8__namespace.existsSync(specFile) ? specFile : void 0,
+    designFile: fs8__namespace.existsSync(planFile) ? planFile : void 0,
+    tasksFile: fs8__namespace.existsSync(tasksFile) ? tasksFile : void 0,
     sidecarFile,
     handoff: handoff || void 0
   };
@@ -2075,18 +2360,18 @@ function buildSpecKitWorkspaceInfo(changeWorkspaceDir, profile, handoff, sidecar
 var SpecKitAdapter = class {
   framework = "speckit";
   getChangeWorkspaceDir(rootDir, changeId) {
-    const standardDir = path4__namespace.join(rootDir, "specs", changeId);
-    if (fs7__namespace.existsSync(standardDir)) return standardDir;
-    const activeChangeDir = path4__namespace.join(rootDir, "specs", "changes", "active", changeId);
-    if (fs7__namespace.existsSync(activeChangeDir)) return activeChangeDir;
-    const completedChangeDir = path4__namespace.join(rootDir, "specs", "changes", "completed", changeId);
-    if (fs7__namespace.existsSync(completedChangeDir)) return completedChangeDir;
+    const standardDir = path5__namespace.join(rootDir, "specs", changeId);
+    if (fs8__namespace.existsSync(standardDir)) return standardDir;
+    const activeChangeDir = path5__namespace.join(rootDir, "specs", "changes", "active", changeId);
+    if (fs8__namespace.existsSync(activeChangeDir)) return activeChangeDir;
+    const completedChangeDir = path5__namespace.join(rootDir, "specs", "changes", "completed", changeId);
+    if (fs8__namespace.existsSync(completedChangeDir)) return completedChangeDir;
     return standardDir;
   }
   depositSidecar(options) {
     const changeDir = this.getChangeWorkspaceDir(options.rootDir, options.changeId);
-    if (!fs7__namespace.existsSync(changeDir)) {
-      fs7__namespace.mkdirSync(changeDir, { recursive: true });
+    if (!fs8__namespace.existsSync(changeDir)) {
+      fs8__namespace.mkdirSync(changeDir, { recursive: true });
     }
     const handoff = { ...options.handoff };
     if (!handoff.id.startsWith("HOF-")) {
@@ -2099,20 +2384,20 @@ var SpecKitAdapter = class {
       handoff.createdAt = (/* @__PURE__ */ new Date()).toISOString();
     }
     const filename = options.format === "json" ? "handoff.json" : "handoff.yaml";
-    const filePath = path4__namespace.join(changeDir, filename);
+    const filePath = path5__namespace.join(changeDir, filename);
     const content = options.format === "json" ? JSON.stringify(handoff, null, 2) : yaml3__default.default.dump(handoff, { indent: 2, lineWidth: -1 });
-    fs7__namespace.writeFileSync(filePath, content, "utf-8");
-    const specifyMemoryDir = path4__namespace.join(options.rootDir, ".specify", "memory");
-    if (fs7__namespace.existsSync(path4__namespace.join(options.rootDir, ".specify"))) {
-      if (!fs7__namespace.existsSync(specifyMemoryDir)) {
-        fs7__namespace.mkdirSync(specifyMemoryDir, { recursive: true });
+    fs8__namespace.writeFileSync(filePath, content, "utf-8");
+    const specifyMemoryDir = path5__namespace.join(options.rootDir, ".specify", "memory");
+    if (fs8__namespace.existsSync(path5__namespace.join(options.rootDir, ".specify"))) {
+      if (!fs8__namespace.existsSync(specifyMemoryDir)) {
+        fs8__namespace.mkdirSync(specifyMemoryDir, { recursive: true });
       }
-      fs7__namespace.writeFileSync(path4__namespace.join(specifyMemoryDir, `${options.changeId}.handoff.yaml`), content, "utf-8");
+      fs8__namespace.writeFileSync(path5__namespace.join(specifyMemoryDir, `${options.changeId}.handoff.yaml`), content, "utf-8");
     }
     return filePath;
   }
   loadSidecar(changeWorkspaceDir) {
-    if (!fs7__namespace.existsSync(changeWorkspaceDir)) return null;
+    if (!fs8__namespace.existsSync(changeWorkspaceDir)) return null;
     const candidateFiles = [
       "handoff.yaml",
       "handoff.yml",
@@ -2122,10 +2407,10 @@ var SpecKitAdapter = class {
       "handoff.json"
     ];
     for (const file of candidateFiles) {
-      const fullPath = path4__namespace.join(changeWorkspaceDir, file);
-      if (fs7__namespace.existsSync(fullPath)) {
+      const fullPath = path5__namespace.join(changeWorkspaceDir, file);
+      if (fs8__namespace.existsSync(fullPath)) {
         try {
-          const raw = fs7__namespace.readFileSync(fullPath, "utf-8").replace(/^\uFEFF/, "");
+          const raw = fs8__namespace.readFileSync(fullPath, "utf-8").replace(/^\uFEFF/, "");
           const parsed = file.endsWith(".json") ? JSON.parse(raw) : yaml3__default.default.load(raw);
           if (parsed && typeof parsed === "object" && parsed.id && String(parsed.id).startsWith("HOF-")) {
             return parsed;
@@ -2137,7 +2422,7 @@ var SpecKitAdapter = class {
     return null;
   }
   validateWorkspace(changeWorkspaceDir) {
-    if (!fs7__namespace.existsSync(changeWorkspaceDir)) {
+    if (!fs8__namespace.existsSync(changeWorkspaceDir)) {
       return {
         valid: false,
         errors: [`El directorio del cambio Spec Kit no existe: ${changeWorkspaceDir}`],
@@ -2146,7 +2431,7 @@ var SpecKitAdapter = class {
     }
     const errors = [];
     const warnings = [];
-    const specFile = path4__namespace.join(changeWorkspaceDir, "spec.md");
+    const specFile = path5__namespace.join(changeWorkspaceDir, "spec.md");
     const profile = parseChangeProfile2(specFile);
     validateSpecFileContent2(specFile, changeWorkspaceDir, errors);
     const { handoff, sidecarFile } = validateSpecKitStructure(profile, changeWorkspaceDir, this, errors, warnings);
@@ -2318,27 +2603,27 @@ ${frontmatter}---
 ${body}`;
 }
 function materializeCanonicalArtifact(rootDir, item, changeId, author, date) {
-  const targetPath = path4__namespace.join(rootDir, item.targetDir, `${item.id}.md`);
-  if (fs7__namespace.existsSync(targetPath)) return targetPath;
-  fs7__namespace.mkdirSync(path4__namespace.dirname(targetPath), { recursive: true });
+  const targetPath = path5__namespace.join(rootDir, item.targetDir, `${item.id}.md`);
+  if (fs8__namespace.existsSync(targetPath)) return targetPath;
+  fs8__namespace.mkdirSync(path5__namespace.dirname(targetPath), { recursive: true });
   const initialContent = buildCanonicalInitialContent(item, changeId, author, date);
-  fs7__namespace.writeFileSync(targetPath, initialContent, "utf-8");
+  fs8__namespace.writeFileSync(targetPath, initialContent, "utf-8");
   return targetPath;
 }
 function findChangeWorkspaceDir(rootDir, changeId) {
-  const activeDir = path4__namespace.join(rootDir, "specs", "changes", "active", changeId);
-  if (fs7__namespace.existsSync(activeDir)) return activeDir;
-  const completedDir = path4__namespace.join(rootDir, "specs", "changes", "completed", changeId);
-  if (fs7__namespace.existsSync(completedDir)) return completedDir;
-  const openspecActive = path4__namespace.join(rootDir, "openspec", "changes", changeId);
-  if (fs7__namespace.existsSync(openspecActive)) return openspecActive;
+  const activeDir = path5__namespace.join(rootDir, "specs", "changes", "active", changeId);
+  if (fs8__namespace.existsSync(activeDir)) return activeDir;
+  const completedDir = path5__namespace.join(rootDir, "specs", "changes", "completed", changeId);
+  if (fs8__namespace.existsSync(completedDir)) return completedDir;
+  const openspecActive = path5__namespace.join(rootDir, "openspec", "changes", changeId);
+  if (fs8__namespace.existsSync(openspecActive)) return openspecActive;
   return null;
 }
 function checkTasksExecution(changeDir, changeId) {
-  const tasksFile = path4__namespace.join(changeDir, "tasks.md");
+  const tasksFile = path5__namespace.join(changeDir, "tasks.md");
   const allTasks = [];
-  if (fs7__namespace.existsSync(tasksFile)) {
-    allTasks.push(...parseTasksFromContent(fs7__namespace.readFileSync(tasksFile, "utf-8")));
+  if (fs8__namespace.existsSync(tasksFile)) {
+    allTasks.push(...parseTasksFromContent(fs8__namespace.readFileSync(tasksFile, "utf-8")));
   }
   const completedTasks = allTasks.filter((t) => t.status === "COMPLETED").map((t) => t.id);
   const pendingTasks = allTasks.filter((t) => t.status !== "COMPLETED").map((t) => t.id);
@@ -2370,9 +2655,9 @@ function buildSubgraphFromProposalIds(ids) {
 function resolveChangeHandoff(changeDir, changeId) {
   const sidecar = loadProductHandoffSidecar(changeDir);
   if (sidecar) return sidecar;
-  const proposalFile = path4__namespace.join(changeDir, "proposal.md");
-  if (!fs7__namespace.existsSync(proposalFile)) return null;
-  const propContent = fs7__namespace.readFileSync(proposalFile, "utf-8");
+  const proposalFile = path5__namespace.join(changeDir, "proposal.md");
+  if (!fs8__namespace.existsSync(proposalFile)) return null;
+  const propContent = fs8__namespace.readFileSync(proposalFile, "utf-8");
   const { frontmatter } = parseFrontmatter(propContent);
   const citations = Array.isArray(frontmatter.citations) ? frontmatter.citations : [];
   const ids = citations.map((c) => c.id || "").filter(Boolean);
@@ -2386,9 +2671,9 @@ function resolveChangeHandoff(changeDir, changeId) {
 }
 function materializeNewCatalogArtifacts(changeDir, rootDir, changeId, author, date, errors) {
   const created = [];
-  const specFile = path4__namespace.join(changeDir, "spec.md");
-  if (!fs7__namespace.existsSync(specFile)) return created;
-  const specContent = fs7__namespace.readFileSync(specFile, "utf-8");
+  const specFile = path5__namespace.join(changeDir, "spec.md");
+  if (!fs8__namespace.existsSync(specFile)) return created;
+  const specContent = fs8__namespace.readFileSync(specFile, "utf-8");
   const { newItems } = parseSpecCatalogScope(specContent);
   for (const item of newItems) {
     try {
@@ -2405,10 +2690,10 @@ function loadCanonicalArtifacts(rootDir) {
   const allMdFiles = walkMdFiles(rootDir);
   const canonicalArtifacts = /* @__PURE__ */ new Map();
   for (const file of allMdFiles) {
-    const relFile = path4__namespace.relative(rootDir, file).replace(/\\/g, "/");
+    const relFile = path5__namespace.relative(rootDir, file).replace(/\\/g, "/");
     if (relFile.includes("specs/changes/") || relFile.includes("templates/")) continue;
     try {
-      const content = fs7__namespace.readFileSync(file, "utf-8");
+      const content = fs8__namespace.readFileSync(file, "utf-8");
       const { frontmatter, body } = parseFrontmatter(content);
       if (frontmatter.id) canonicalArtifacts.set(String(frontmatter.id), { file, frontmatter, body });
     } catch {
@@ -2421,7 +2706,7 @@ function writeUpdatedArtifact(file, frontmatter, body) {
 ${yaml3__default.default.dump(frontmatter, { indent: 2, lineWidth: -1 }).trim()}
 ---
 `;
-  fs7__namespace.writeFileSync(file, yamlHeader + body, "utf-8");
+  fs8__namespace.writeFileSync(file, yamlHeader + body, "utf-8");
 }
 function updateSingleCanonicalRequirement(canonical, completedTasks, changeId, date, author) {
   const fm = canonical.frontmatter;
@@ -2537,28 +2822,28 @@ function updateArchitectureComponents(citedComponents, canonicalArtifacts, targe
   return updated;
 }
 function moveToCompletedFolder(changeDir, changeId, rootDir) {
-  const completedParent = path4__namespace.join(rootDir, "specs", "changes", "completed");
-  if (!fs7__namespace.existsSync(completedParent)) fs7__namespace.mkdirSync(completedParent, { recursive: true });
-  const destDir = path4__namespace.join(completedParent, changeId);
-  if (fs7__namespace.existsSync(destDir)) fs7__namespace.rmSync(destDir, { recursive: true, force: true });
-  fs7__namespace.renameSync(changeDir, destDir);
-  const destProposal = path4__namespace.join(destDir, "proposal.md");
-  if (fs7__namespace.existsSync(destProposal)) {
-    const { frontmatter, body } = parseFrontmatter(fs7__namespace.readFileSync(destProposal, "utf-8"));
+  const completedParent = path5__namespace.join(rootDir, "specs", "changes", "completed");
+  if (!fs8__namespace.existsSync(completedParent)) fs8__namespace.mkdirSync(completedParent, { recursive: true });
+  const destDir = path5__namespace.join(completedParent, changeId);
+  if (fs8__namespace.existsSync(destDir)) fs8__namespace.rmSync(destDir, { recursive: true, force: true });
+  fs8__namespace.renameSync(changeDir, destDir);
+  const destProposal = path5__namespace.join(destDir, "proposal.md");
+  if (fs8__namespace.existsSync(destProposal)) {
+    const { frontmatter, body } = parseFrontmatter(fs8__namespace.readFileSync(destProposal, "utf-8"));
     frontmatter.status = "applied";
     writeUpdatedArtifact(destProposal, frontmatter, body);
   }
   return destDir;
 }
 function archiveChangeWorkspace(changeDir, changeId, rootDir, autoArchive, completedAll) {
-  const isActiveFolder = changeDir.includes("specs" + path4__namespace.sep + "changes" + path4__namespace.sep + "active");
+  const isActiveFolder = changeDir.includes("specs" + path5__namespace.sep + "changes" + path5__namespace.sep + "active");
   if (completedAll && autoArchive && isActiveFolder) {
     const destDir = moveToCompletedFolder(changeDir, changeId, rootDir);
     return { archived: true, archivedPath: destDir };
   }
-  const proposalFile = path4__namespace.join(changeDir, "proposal.md");
-  if (fs7__namespace.existsSync(proposalFile)) {
-    const { frontmatter, body } = parseFrontmatter(fs7__namespace.readFileSync(proposalFile, "utf-8"));
+  const proposalFile = path5__namespace.join(changeDir, "proposal.md");
+  if (fs8__namespace.existsSync(proposalFile)) {
+    const { frontmatter, body } = parseFrontmatter(fs8__namespace.readFileSync(proposalFile, "utf-8"));
     if (completedAll) frontmatter.status = "completed";
     writeUpdatedArtifact(proposalFile, frontmatter, body);
   }
@@ -2623,9 +2908,9 @@ function collectSubgraphPromotableIds(subgraph) {
   return Array.from(new Set(combined));
 }
 function collectSpecAffectedNonArchIds(changeDir) {
-  const specFile = path4__namespace.join(changeDir, "spec.md");
-  if (!fs7__namespace.existsSync(specFile)) return [];
-  const { affectedItems } = parseSpecCatalogScope(fs7__namespace.readFileSync(specFile, "utf-8"));
+  const specFile = path5__namespace.join(changeDir, "spec.md");
+  if (!fs8__namespace.existsSync(specFile)) return [];
+  const { affectedItems } = parseSpecCatalogScope(fs8__namespace.readFileSync(specFile, "utf-8"));
   return affectedItems.map((item) => item.id).filter((id) => !isArchitectureComponentId(id));
 }
 function resolveIntegrationOptions(options) {
@@ -2699,8 +2984,8 @@ function resolveAuditStatus(integratedCount, targetCount, gapsCount) {
 function auditChangeEntry(changeDir, changeName, canonicalMap) {
   const handoff = loadProductHandoffSidecar(changeDir);
   if (!handoff) return null;
-  const tasksFile = path4__namespace.join(changeDir, "tasks.md");
-  const tasks = fs7__namespace.existsSync(tasksFile) ? parseTasksFromContent(fs7__namespace.readFileSync(tasksFile, "utf-8")) : [];
+  const tasksFile = path5__namespace.join(changeDir, "tasks.md");
+  const tasks = fs8__namespace.existsSync(tasksFile) ? parseTasksFromContent(fs8__namespace.readFileSync(tasksFile, "utf-8")) : [];
   const completed = tasks.filter((t) => t.status === "COMPLETED");
   const targetReqs = collectSubgraphPromotableIds(handoff.subgraph);
   const { integrated, missing, gaps } = auditChangeRequirements(targetReqs, canonicalMap);
@@ -2716,11 +3001,11 @@ function auditChangeEntry(changeDir, changeName, canonicalMap) {
   };
 }
 function collectParentDirAudits(parent, canonicalMap, audits, errors) {
-  if (!fs7__namespace.existsSync(parent)) return;
-  const entries = fs7__namespace.readdirSync(parent, { withFileTypes: true });
+  if (!fs8__namespace.existsSync(parent)) return;
+  const entries = fs8__namespace.readdirSync(parent, { withFileTypes: true });
   for (const e of entries) {
     if (!e.isDirectory()) continue;
-    const audit = auditChangeEntry(path4__namespace.join(parent, e.name), e.name, canonicalMap);
+    const audit = auditChangeEntry(path5__namespace.join(parent, e.name), e.name, canonicalMap);
     if (audit) {
       if (audit.gaps.length > 0) errors.push(`[${e.name}] Desalineaci\xF3n: ${audit.gaps.join("; ")}`);
       audits.push(audit);
@@ -2732,8 +3017,8 @@ function verifySddIntegration(options = {}) {
   const audits = [];
   const errors = [];
   const searchDirs = [
-    path4__namespace.join(rootDir, "specs", "changes", "completed"),
-    path4__namespace.join(rootDir, "specs", "changes", "active")
+    path5__namespace.join(rootDir, "specs", "changes", "completed"),
+    path5__namespace.join(rootDir, "specs", "changes", "active")
   ];
   const canonicalMap = loadCanonicalArtifacts(rootDir);
   for (const parent of searchDirs) {
@@ -2781,10 +3066,10 @@ function resolveMatchFromMetadata(activeFolders, options) {
   return {};
 }
 function validateActiveDirectory(activeParent) {
-  if (!fs7__namespace.existsSync(activeParent)) {
+  if (!fs8__namespace.existsSync(activeParent)) {
     return { ok: false, folders: [], error: `No existe el directorio de cambios activos en '${activeParent}'.` };
   }
-  const entries = fs7__namespace.readdirSync(activeParent, { withFileTypes: true });
+  const entries = fs8__namespace.readdirSync(activeParent, { withFileTypes: true });
   const activeFolders = entries.filter((e) => e.isDirectory()).map((e) => e.name);
   if (activeFolders.length === 0) {
     return { ok: false, folders: [], error: "No se encontraron carpetas de cambios activos en specs/changes/active/." };
@@ -2816,7 +3101,7 @@ function evaluateTasksProgress(changeId, tasks) {
 }
 function detectActiveChangeForIntegration(options = {}) {
   const rootDir = options.rootDir || process.cwd();
-  const activeParent = path4__namespace.join(rootDir, "specs", "changes", "active");
+  const activeParent = path5__namespace.join(rootDir, "specs", "changes", "active");
   const dirCheck = validateActiveDirectory(activeParent);
   if (!dirCheck.ok) {
     return {
@@ -2831,9 +3116,9 @@ function detectActiveChangeForIntegration(options = {}) {
   if (!match.changeId) {
     return buildUnmatchedActiveResult(dirCheck.folders, options);
   }
-  const changeDir = path4__namespace.join(activeParent, match.changeId);
-  const tasksFile = path4__namespace.join(changeDir, "tasks.md");
-  const tasks = fs7__namespace.existsSync(tasksFile) ? parseTasksFromContent(fs7__namespace.readFileSync(tasksFile, "utf-8")) : [];
+  const changeDir = path5__namespace.join(activeParent, match.changeId);
+  const tasksFile = path5__namespace.join(changeDir, "tasks.md");
+  const tasks = fs8__namespace.existsSync(tasksFile) ? parseTasksFromContent(fs8__namespace.readFileSync(tasksFile, "utf-8")) : [];
   const progress = evaluateTasksProgress(match.changeId, tasks);
   const reasons = match.reason ? [match.reason] : [];
   if (progress.error) reasons.push(progress.error);
@@ -2848,9 +3133,46 @@ function detectActiveChangeForIntegration(options = {}) {
     reasons
   };
 }
-function computeCanonicalSha256(content) {
+function extractSemanticContent(content) {
+  let normalized = content.replace(/\r\n/g, "\n");
+  normalized = normalized.replace(/(?:\n|^)##?\s+.*(?:Historial de Revisiones|Revision History)(?:[\s\S]*?(?=(?:\n##?\s+[^\n]+)|\s*$))/i, "");
+  normalized = normalized.replace(/(?:\n|^)\|\s*\*?Versi[oó]n\*?\s*\|\s*Fecha\s*\|\s*Autor[\s\S]*?(?=(?:\n##?\s+[^\n]+)|\s*$)/i, "");
+  return normalized.trimEnd() + "\n";
+}
+function slugify(text) {
+  return text.toLowerCase().replace(/[^\w\s-]/g, "").trim().replace(/\s+/g, "-");
+}
+function matchesSlug(line, clean) {
+  const headingText = line.replace(/^#+\s*/, "").trim();
+  const slug = slugify(headingText);
+  if (slug === clean || slug.includes(clean) || clean.includes(slug)) return true;
+  const slugNoNums = slugify(headingText.replace(/^\d+[\.\)]\s*/, "").trim());
+  return slugNoNums === clean || clean === slugNoNums;
+}
+function matchesHeading(content, clean) {
+  for (const line of content.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (trimmed.startsWith("#") && matchesSlug(trimmed, clean)) {
+      return true;
+    }
+  }
+  return false;
+}
+function validateAnchorExistence(targetContent, anchor) {
+  if (!anchor) return true;
+  const clean = anchor.replace(/^#/, "").trim().toLowerCase();
+  if (!clean || targetContent.toLowerCase().includes(clean)) return true;
+  if (matchesHeading(targetContent, clean)) return true;
+  const anchorRegex = new RegExp(`(?:id|name)=["']${clean}["']|\\{#${clean}\\}`, "i");
+  return anchorRegex.test(targetContent);
+}
+function computeRawSha256(content) {
   const normalized = content.replace(/\r\n/g, "\n");
-  return crypto__namespace.createHash("sha256").update(normalized, "utf-8").digest("hex");
+  return crypto3__namespace.createHash("sha256").update(normalized, "utf-8").digest("hex");
+}
+function computeCanonicalSha256(content) {
+  const semantic = extractSemanticContent(content);
+  return crypto3__namespace.createHash("sha256").update(semantic, "utf-8").digest("hex");
 }
 function parseFrontmatterId(content) {
   const match = content.match(/^---\r?\n([\s\S]*?)\r?\n---/);
@@ -2940,7 +3262,7 @@ function buildPdacReportHeader(isOk, driftsCount, nodesCount) {
   return [
     `# \u{1F512} PDaC Cryptographic Matrix and Drift Detection (Anti-Drift)`,
     ``,
-    `> **Evaluation Date:** ${(/* @__PURE__ */ new Date()).toISOString()}`,
+    `> **Evaluation Date:** ${resolveDeterministicDate().toISOString()}`,
     `> **Verdict:** ${verdict}`,
     ``,
     `---`,
@@ -2951,8 +3273,8 @@ function buildPdacReportHeader(isOk, driftsCount, nodesCount) {
     `| :--- | :--- | :--- | :--- |`
   ];
 }
-function generatePdacReportMarkdown(nodes, drifts, unresolvedCount) {
-  const isOk = drifts.length === 0 && unresolvedCount === 0;
+function generatePdacReportMarkdown(nodes, drifts, unresolvedCount, invalidAnchors = []) {
+  const isOk = drifts.length === 0 && unresolvedCount === 0 && invalidAnchors.length === 0;
   const header = buildPdacReportHeader(isOk, drifts.length, nodes.length);
   const nodeRows = nodes.map(
     (n) => `| **\`${n.id}\`** | \`${n.type}\` | ${n.title || "Untitled"} | \`sha256:${n.digest.substring(0, 16)}...\` |`
@@ -2964,9 +3286,9 @@ function isPdacDeliveryDoc(relFile) {
 }
 function processPdacFile(file, rootDir, baselineMap, allCitations) {
   try {
-    const content = fs7__namespace.readFileSync(file, "utf-8");
+    const content = fs8__namespace.readFileSync(file, "utf-8");
     const { id, type, title } = parseFrontmatterId(content);
-    const relFile = path4__namespace.relative(rootDir, file).replace(/\\/g, "/");
+    const relFile = path5__namespace.relative(rootDir, file).replace(/\\/g, "/");
     if (id) {
       const citations = extractCitations(content, relFile);
       baselineMap.set(id, {
@@ -2975,6 +3297,7 @@ function processPdacFile(file, rootDir, baselineMap, allCitations) {
         filePath: relFile,
         title,
         digest: computeCanonicalSha256(content),
+        rawDigest: computeRawSha256(content),
         rawContent: content,
         citations: citations.map((c) => ({
           targetId: c.targetId,
@@ -2998,38 +3321,65 @@ function scanPdacWorkspace(rootDir) {
   }
   return { baselineMap, allCitations };
 }
+function checkAnchor(citation, targetNode, invalidAnchors) {
+  if (citation.anchor && targetNode.rawContent) {
+    if (!validateAnchorExistence(targetNode.rawContent, citation.anchor)) {
+      invalidAnchors.push({
+        sourceFile: citation.sourceFile,
+        targetId: citation.targetId,
+        anchor: citation.anchor,
+        reason: `Anchor '${citation.anchor}' not found in target artifact '${citation.targetId}' (${targetNode.filePath})`
+      });
+    }
+  }
+}
+function checkDigest(citation, targetNode, drifts) {
+  if (!citation.expectedDigest) return;
+  const matches = citation.expectedDigest === targetNode.digest || targetNode.rawDigest !== void 0 && citation.expectedDigest === targetNode.rawDigest;
+  if (!matches) {
+    drifts.push({
+      sourceId: citation.sourceFile,
+      targetId: citation.targetId,
+      sourceFile: citation.sourceFile,
+      expectedDigest: citation.expectedDigest,
+      actualDigest: targetNode.digest
+    });
+  }
+}
 function computePdacDrifts(allCitations, baselineMap) {
   const drifts = [];
+  const unresolvedCitations = [];
+  const invalidAnchors = [];
   let unresolvedCount = 0;
   for (const citation of allCitations) {
     const targetNode = baselineMap.get(citation.targetId);
     if (!targetNode) {
       unresolvedCount++;
-      continue;
-    }
-    if (citation.expectedDigest && citation.expectedDigest !== targetNode.digest) {
-      drifts.push({
-        sourceId: citation.sourceFile,
-        targetId: citation.targetId,
+      unresolvedCitations.push({
         sourceFile: citation.sourceFile,
-        expectedDigest: citation.expectedDigest,
-        actualDigest: targetNode.digest
+        targetId: citation.targetId
       });
+      continue;
     }
+    checkAnchor(citation, targetNode, invalidAnchors);
+    checkDigest(citation, targetNode, drifts);
   }
-  return { drifts, unresolvedCount };
+  return { drifts, unresolvedCount, unresolvedCitations, invalidAnchors };
 }
 function verifyPdacGraph(options = {}) {
   const rootDir = options.rootDir || process.cwd();
   const { baselineMap, allCitations } = scanPdacWorkspace(rootDir);
-  const { drifts, unresolvedCount } = computePdacDrifts(allCitations, baselineMap);
+  const { drifts, unresolvedCount, unresolvedCitations, invalidAnchors } = computePdacDrifts(allCitations, baselineMap);
   const nodes = Array.from(baselineMap.values());
-  const reportMarkdown = generatePdacReportMarkdown(nodes, drifts, unresolvedCount);
+  const reportMarkdown = generatePdacReportMarkdown(nodes, drifts, unresolvedCount, invalidAnchors);
   return {
-    success: drifts.length === 0,
+    success: drifts.length === 0 && unresolvedCount === 0 && invalidAnchors.length === 0,
     totalNodes: nodes.length,
     totalEdges: allCitations.length,
     drifts,
+    unresolvedCount,
+    unresolvedCitations,
+    invalidAnchors,
     reportMarkdown
   };
 }
@@ -3094,22 +3444,22 @@ function updateCitationsInContent(content, baselineMap, sourceFile, details) {
 }
 function collectCandidateFilesForSync(rootDir, targetPath) {
   if (targetPath) {
-    const fullTarget = path4__namespace.isAbsolute(targetPath) ? targetPath : path4__namespace.join(rootDir, targetPath);
-    if (!fs7__namespace.existsSync(fullTarget)) return [];
-    return fs7__namespace.statSync(fullTarget).isDirectory() ? walkMdFiles(fullTarget) : [fullTarget];
+    const fullTarget = path5__namespace.isAbsolute(targetPath) ? targetPath : path5__namespace.join(rootDir, targetPath);
+    if (!fs8__namespace.existsSync(fullTarget)) return [];
+    return fs8__namespace.statSync(fullTarget).isDirectory() ? walkMdFiles(fullTarget) : [fullTarget];
   }
   return walkMdFiles(rootDir).filter((f) => {
-    const relFile = path4__namespace.relative(rootDir, f).replace(/\\/g, "/");
+    const relFile = path5__namespace.relative(rootDir, f).replace(/\\/g, "/");
     return isPdacDeliveryDoc(relFile);
   });
 }
 function syncSingleFile(file, rootDir, baselineMap, details) {
   try {
-    const content = fs7__namespace.readFileSync(file, "utf-8");
-    const relFile = path4__namespace.relative(rootDir, file).replace(/\\/g, "/");
+    const content = fs8__namespace.readFileSync(file, "utf-8");
+    const relFile = path5__namespace.relative(rootDir, file).replace(/\\/g, "/");
     const { updatedContent, changed } = updateCitationsInContent(content, baselineMap, relFile, details);
     if (changed) {
-      fs7__namespace.writeFileSync(file, updatedContent, "utf-8");
+      fs8__namespace.writeFileSync(file, updatedContent, "utf-8");
       return relFile;
     }
   } catch {
@@ -3312,6 +3662,36 @@ var STARTER_SCHEMAS = Object.entries(STARTER_SCHEMAS_MAP).map(([relPath, schema]
 }));
 
 // src/verifiers/schemas.ts
+var ajvInstance = new Ajv2020__default.default({
+  allErrors: true,
+  strict: false,
+  validateFormats: true,
+  verbose: true
+});
+addFormats__default.default(ajvInstance);
+var compiledSchemaCache = /* @__PURE__ */ new WeakMap();
+function formatFieldPath(err, propPath) {
+  const field = err.instancePath ? err.instancePath.replace(/^\//, "").replace(/\//g, ".") : propPath || "root";
+  return propPath && field !== "root" && field ? `${propPath}.${field}` : field || "root";
+}
+var KEYWORD_FORMATTERS = {
+  required: (p, _err, fullPath) => `'${fullPath}' missing required field '${String(p?.missingProperty)}'`,
+  additionalProperties: (p, _err, fullPath) => `'${fullPath}' contains disallowed extra property '${String(p?.additionalProperty)}'`,
+  minLength: (p, _err, fullPath) => `'${fullPath}' length must be >= ${String(p?.limit)}`,
+  maxLength: (p, _err, fullPath) => `'${fullPath}' length must be <= ${String(p?.limit)}`,
+  enum: (p, err, fullPath) => `'${fullPath}' must be one of [${Array.isArray(p?.allowedValues) ? p.allowedValues.join(", ") : ""}], received '${String(err.data)}'`,
+  uniqueItems: (_p, _err, fullPath) => `'${fullPath}' contains duplicate items (must have unique items)`,
+  pattern: (p, err, fullPath) => `'${fullPath}' value '${String(err.data)}' does not match pattern ${String(p?.pattern)}`
+};
+function formatKeywordMessage(err, fullPath) {
+  const p = err.params;
+  const formatter = KEYWORD_FORMATTERS[err.keyword];
+  return formatter ? formatter(p, err, fullPath) : `'${fullPath}' ${err.message || "validation failed"}`;
+}
+function formatAjvError(err, propPath) {
+  const fullPath = formatFieldPath(err, propPath);
+  return formatKeywordMessage(err, fullPath);
+}
 var TYPE_TO_SCHEMA_MAP = {
   // Product
   actor: "schemas/product/actor.schema.json",
@@ -3456,10 +3836,10 @@ var EXCLUDED_SCHEMA_DIRS = /* @__PURE__ */ new Set([
 ]);
 function walkHandoffSidecars(dir, fileList = []) {
   try {
-    if (!fs7__namespace.existsSync(dir)) return fileList;
-    for (const file of fs7__namespace.readdirSync(dir)) {
-      const fullPath = path4__namespace.join(dir, file);
-      if (fs7__namespace.statSync(fullPath).isDirectory()) {
+    if (!fs8__namespace.existsSync(dir)) return fileList;
+    for (const file of fs8__namespace.readdirSync(dir)) {
+      const fullPath = path5__namespace.join(dir, file);
+      if (fs8__namespace.statSync(fullPath).isDirectory()) {
         if (!EXCLUDED_SCHEMA_DIRS.has(file) && !file.startsWith("temp-") && !file.startsWith(".temp-")) {
           walkHandoffSidecars(fullPath, fileList);
         }
@@ -3482,157 +3862,41 @@ function extractArtifactData(filePath, content) {
   }
   return extractFrontmatter(content);
 }
-function validateConst(value, schema, currentProp) {
-  if (schema.const !== void 0 && value !== schema.const) {
-    return [`'${currentProp}' must equal '${schema.const}', received '${String(value)}'`];
+function getOrCompileSchema(schema) {
+  const schemaObj = schema;
+  if (typeof schemaObj.$id === "string") {
+    const existing = ajvInstance.getSchema(schemaObj.$id);
+    if (existing) return existing;
+    return ajvInstance.compile(schema);
   }
-  return [];
-}
-function validateEnum(value, schema, currentProp) {
-  if (schema.enum !== void 0 && !schema.enum.includes(value)) {
-    return [`'${currentProp}' must be one of [${schema.enum.join(", ")}], received '${String(value)}'`];
-  }
-  return [];
-}
-function validateCombinators(value, schema, propPath, currentProp) {
-  if (schema.oneOf) {
-    const matchCount = schema.oneOf.filter((sub) => validateAgainstSchema(value, sub, propPath).length === 0).length;
-    if (matchCount !== 1) {
-      return [`'${currentProp}' must match exactly one sub-schema in oneOf`];
-    }
-  }
-  if (schema.anyOf) {
-    const anyMatched = schema.anyOf.some((sub) => validateAgainstSchema(value, sub, propPath).length === 0);
-    if (!anyMatched) {
-      return [`'${currentProp}' did not match any allowed alternative in anyOf`];
-    }
-  }
-  return [];
-}
-function getActualJsonType(value) {
-  if (value === null) return "null";
-  if (Array.isArray(value)) return "array";
-  const t = typeof value;
-  if (t === "number" && Number.isInteger(value)) return "integer";
-  return t;
-}
-function validateType(value, schema, currentProp) {
-  if (schema.type === void 0) return [];
-  const allowed = Array.isArray(schema.type) ? schema.type : [schema.type];
-  const actual = getActualJsonType(value);
-  const matches = allowed.some((t) => t === actual || t === "number" && actual === "integer");
-  if (!matches) {
-    return [`'${currentProp}' expected type [${allowed.join("|")}], received '${actual}'`];
-  }
-  return [];
-}
-function validateString(value, schema, currentProp) {
-  const errors = [];
-  if (schema.minLength !== void 0 && value.length < schema.minLength) {
-    errors.push(`'${currentProp}' length must be >= ${schema.minLength}`);
-  }
-  if (schema.maxLength !== void 0 && value.length > schema.maxLength) {
-    errors.push(`'${currentProp}' length must be <= ${schema.maxLength}`);
-  }
-  if (schema.pattern !== void 0 && !new RegExp(schema.pattern).test(value)) {
-    errors.push(`'${currentProp}' value '${value}' does not match pattern ${schema.pattern}`);
-  }
-  if (schema.format === "date") {
-    const dateRegex = /^\d{4}-\d{2}-\d{2}$/;
-    if (!dateRegex.test(value) || isNaN(Date.parse(value))) {
-      errors.push(`'${currentProp}' must be a valid ISO-8601 date string (YYYY-MM-DD)`);
-    }
-  }
-  return errors;
-}
-function validateNumber(value, schema, currentProp) {
-  const errors = [];
-  if (schema.minimum !== void 0 && value < schema.minimum) {
-    errors.push(`'${currentProp}' must be >= ${schema.minimum}`);
-  }
-  if (schema.maximum !== void 0 && value > schema.maximum) {
-    errors.push(`'${currentProp}' must be <= ${schema.maximum}`);
-  }
-  return errors;
-}
-function validateArray(value, schema, currentProp) {
-  const errors = [];
-  if (schema.minItems !== void 0 && value.length < schema.minItems) {
-    errors.push(`'${currentProp}' items count must be >= ${schema.minItems}`);
-  }
-  if (schema.maxItems !== void 0 && value.length > schema.maxItems) {
-    errors.push(`'${currentProp}' items count must be <= ${schema.maxItems}`);
-  }
-  if (schema.items) {
-    value.forEach((item, idx) => {
-      errors.push(...validateAgainstSchema(item, schema.items, `${currentProp}[${idx}]`));
-    });
-  }
-  return errors;
-}
-function checkRequiredProperties(record, required, currentProp) {
-  if (!required) return [];
-  const errors = [];
-  for (const reqKey of required) {
-    if (!(reqKey in record) || record[reqKey] === void 0) {
-      errors.push(`'${currentProp}' missing required field '${reqKey}'`);
-    }
-  }
-  return errors;
-}
-function checkObjectProperties(record, schema, propPath, currentProp) {
-  const errors = [];
-  const properties = schema.properties || {};
-  for (const [key, propVal] of Object.entries(record)) {
-    const subPath = propPath ? `${propPath}.${key}` : key;
-    if (key in properties) {
-      errors.push(...validateAgainstSchema(propVal, properties[key], subPath));
-    } else if (schema.additionalProperties === false) {
-      errors.push(`'${currentProp}' contains disallowed extra property '${key}'`);
-    } else if (typeof schema.additionalProperties === "object") {
-      errors.push(...validateAgainstSchema(propVal, schema.additionalProperties, subPath));
-    }
-  }
-  return errors;
-}
-function validateObject(record, schema, propPath, currentProp) {
-  return [
-    ...checkRequiredProperties(record, schema.required, currentProp),
-    ...checkObjectProperties(record, schema, propPath, currentProp)
-  ];
-}
-function validateTypeSpecificRules(value, schema, propPath, currentProp) {
-  if (typeof value === "string") return validateString(value, schema, currentProp);
-  if (typeof value === "number") return validateNumber(value, schema, currentProp);
-  if (Array.isArray(value)) return validateArray(value, schema, currentProp);
-  if (typeof value === "object" && value !== null) {
-    return validateObject(value, schema, propPath, currentProp);
-  }
-  return [];
+  const cached = compiledSchemaCache.get(schema);
+  if (cached) return cached;
+  const compiled = ajvInstance.compile(schema);
+  compiledSchemaCache.set(schema, compiled);
+  return compiled;
 }
 function validateAgainstSchema(value, schema, propPath = "") {
-  const currentProp = propPath || "root";
-  const constErr = validateConst(value, schema, currentProp);
-  if (constErr.length > 0) return constErr;
-  const enumErr = validateEnum(value, schema, currentProp);
-  if (enumErr.length > 0) return enumErr;
-  const combErr = validateCombinators(value, schema, propPath, currentProp);
-  if (combErr.length > 0) return combErr;
-  const typeErr = validateType(value, schema, currentProp);
-  if (typeErr.length > 0) return typeErr;
-  return validateTypeSpecificRules(value, schema, propPath, currentProp);
+  if (!schema || typeof schema !== "object") return [];
+  try {
+    const validate = getOrCompileSchema(schema);
+    const valid = validate(value);
+    if (valid || !validate.errors) return [];
+    return validate.errors.map((err) => formatAjvError(err, propPath));
+  } catch (err) {
+    return [`Schema error: ${err instanceof Error ? err.message : String(err)}`];
+  }
 }
 function findSchemaFile(relSchemaPath, rootDir) {
-  const fullPath = path4__namespace.join(rootDir, relSchemaPath);
-  if (fs7__namespace.existsSync(fullPath)) return fullPath;
-  const fallbackPath = path4__namespace.join(process.cwd(), relSchemaPath);
-  if (fs7__namespace.existsSync(fallbackPath)) return fallbackPath;
+  const fullPath = path5__namespace.join(rootDir, relSchemaPath);
+  if (fs8__namespace.existsSync(fullPath)) return fullPath;
+  const fallbackPath = path5__namespace.join(process.cwd(), relSchemaPath);
+  if (fs8__namespace.existsSync(fallbackPath)) return fallbackPath;
   return null;
 }
 function loadJsonSchema(fullPath, relSchemaPath) {
-  if (fullPath && fs7__namespace.existsSync(fullPath)) {
+  if (fullPath && fs8__namespace.existsSync(fullPath)) {
     try {
-      return JSON.parse(fs7__namespace.readFileSync(fullPath, "utf-8"));
+      return JSON.parse(fs8__namespace.readFileSync(fullPath, "utf-8"));
     } catch {
     }
   }
@@ -3647,7 +3911,7 @@ function resolveSchemaForArtifact(frontmatter, rootDir) {
 }
 function loadSchemaFromPathOrType(schemaOrType, rootDir) {
   if (schemaOrType.endsWith(".json")) {
-    const fullPath = path4__namespace.isAbsolute(schemaOrType) ? schemaOrType : findSchemaFile(schemaOrType, rootDir);
+    const fullPath = path5__namespace.isAbsolute(schemaOrType) ? schemaOrType : findSchemaFile(schemaOrType, rootDir);
     const relNormalized = schemaOrType.replace(/\\/g, "/");
     const schema = loadJsonSchema(fullPath, relNormalized);
     return { schema, schemaId: schemaOrType };
@@ -3692,9 +3956,9 @@ function collectCandidateSchemaFiles(options, rootDir) {
   if (!options.targetPath) {
     return [...walkMdFiles(rootDir), ...walkHandoffSidecars(rootDir)];
   }
-  const target = path4__namespace.isAbsolute(options.targetPath) ? options.targetPath : path4__namespace.join(rootDir, options.targetPath);
-  if (!fs7__namespace.existsSync(target)) return [];
-  if (fs7__namespace.statSync(target).isDirectory()) {
+  const target = path5__namespace.isAbsolute(options.targetPath) ? options.targetPath : path5__namespace.join(rootDir, options.targetPath);
+  if (!fs8__namespace.existsSync(target)) return [];
+  if (fs8__namespace.statSync(target).isDirectory()) {
     return [...walkMdFiles(target), ...walkHandoffSidecars(target)];
   }
   if (target.endsWith(".md") || target.endsWith(".yaml") || target.endsWith(".yml")) {
@@ -3745,7 +4009,7 @@ function buildEvaluationFailure(relPath, err) {
 }
 function evaluateArtifactFile(file, relPath, rootDir) {
   try {
-    const content = fs7__namespace.readFileSync(file, "utf-8");
+    const content = fs8__namespace.readFileSync(file, "utf-8");
     const frontmatter = extractArtifactData(file, content);
     if (!frontmatter || !frontmatter.id) return null;
     const schemaInfo = resolveSchemaForArtifact(frontmatter, rootDir);
@@ -3780,7 +4044,7 @@ function verifyArtifactsSchemas(options = {}) {
   let validCount = 0;
   let totalEvaluated = 0;
   for (const file of filesToScan) {
-    const relPath = path4__namespace.relative(rootDir, file).replace(/\\/g, "/");
+    const relPath = path5__namespace.relative(rootDir, file).replace(/\\/g, "/");
     if (isIgnoredArtifactPath(relPath, Boolean(options.targetPath))) continue;
     const evaluation = evaluateArtifactFile(file, relPath, rootDir);
     if (!evaluation) continue;
@@ -3795,14 +4059,14 @@ function verifyArtifactsSchemas(options = {}) {
 }
 
 // src/adapters/sdd/scaffold.ts
-function slugify(text) {
+function slugify2(text) {
   return text.normalize("NFD").replace(/[\u0300-\u036f]/g, "").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
 }
 function extractDirMaxNum(dir) {
-  if (!fs7__namespace.existsSync(dir)) return 0;
+  if (!fs8__namespace.existsSync(dir)) return 0;
   let max = 0;
   try {
-    const entries = fs7__namespace.readdirSync(dir, { withFileTypes: true });
+    const entries = fs8__namespace.readdirSync(dir, { withFileTypes: true });
     for (const e of entries) {
       if (!e.isDirectory()) continue;
       const match = e.name.match(/^(?:chg|CHG|patch|PATCH)-(\d+)/i);
@@ -3819,10 +4083,10 @@ function extractDirMaxNum(dir) {
 }
 function getNextCorrelativeNumber(rootDir) {
   const candidateDirs = [
-    path4__namespace.join(rootDir, "specs", "changes", "active"),
-    path4__namespace.join(rootDir, "specs", "changes", "completed"),
-    path4__namespace.join(rootDir, "specs"),
-    path4__namespace.join(rootDir, "openspec", "changes")
+    path5__namespace.join(rootDir, "specs", "changes", "active"),
+    path5__namespace.join(rootDir, "specs", "changes", "completed"),
+    path5__namespace.join(rootDir, "specs"),
+    path5__namespace.join(rootDir, "openspec", "changes")
   ];
   let maxNum = 0;
   for (const dir of candidateDirs) {
@@ -3835,7 +4099,7 @@ function resolveChangeIdentifiers(rootDir, name, profile, options) {
   const targetChangeId = options.changeId || options.id;
   if (targetChangeId) {
     const rawId = targetChangeId.trim();
-    const slug = slugify(rawId);
+    const slug = slugify2(rawId);
     const canonicalId = rawId.toUpperCase();
     const match = rawId.match(/^(?:chg|CHG|patch|PATCH)-(\d+)/i);
     const padNum2 = match ? match[1] : "001";
@@ -3843,7 +4107,7 @@ function resolveChangeIdentifiers(rootDir, name, profile, options) {
   }
   const nextNum = getNextCorrelativeNumber(rootDir);
   const padNum = String(nextNum).padStart(3, "0");
-  const nameSlug = slugify(name);
+  const nameSlug = slugify2(name);
   const prefix = profile === "patch" ? "patch" : "chg";
   return {
     slug: `${prefix}-${padNum}-${nameSlug}`,
@@ -3852,13 +4116,13 @@ function resolveChangeIdentifiers(rootDir, name, profile, options) {
   };
 }
 function ensureEmptyChangeDir(changeDir) {
-  if (fs7__namespace.existsSync(changeDir)) {
-    const existing = fs7__namespace.readdirSync(changeDir);
+  if (fs8__namespace.existsSync(changeDir)) {
+    const existing = fs8__namespace.readdirSync(changeDir);
     if (existing.length > 0) {
       return `El directorio del cambio '${changeDir}' ya existe y no est\xE1 vac\xEDo.`;
     }
   } else {
-    fs7__namespace.mkdirSync(changeDir, { recursive: true });
+    fs8__namespace.mkdirSync(changeDir, { recursive: true });
   }
   return null;
 }
@@ -3867,7 +4131,7 @@ function scanCanonicalArtifacts(rootDir) {
   const artifactMap = /* @__PURE__ */ new Map();
   for (const file of allMdFiles) {
     try {
-      const content = fs7__namespace.readFileSync(file, "utf-8");
+      const content = fs8__namespace.readFileSync(file, "utf-8");
       const { frontmatter } = parseFrontmatter(content);
       if (frontmatter?.id) {
         const id = String(frontmatter.id);
@@ -4246,7 +4510,7 @@ function buildPatchSuccess(slug, canonicalId, specPath, citedArtifacts, errors)
     changeId: slug,
     canonicalId,
     profile: "patch",
-    changeDir: path4__namespace.dirname(specPath),
+    changeDir: path5__namespace.dirname(specPath),
     createdFiles: [specPath],
     citedArtifacts,
     errors
@@ -4257,10 +4521,10 @@ function scaffoldPatchChange(rootDir, changeDir, slug, canonicalId, name, inputF
   const citationsSection = citedArtifacts.length > 0 ? `citations:
 ${renderCitationsYamlBlock(citedArtifacts)}
 ` : "";
-  const specPath = path4__namespace.join(changeDir, "spec.md");
+  const specPath = path5__namespace.join(changeDir, "spec.md");
   const specFmObj = buildPatchFmObj(canonicalId);
   const specContent = buildPatchSpecContent(canonicalId, name, citationsSection);
-  fs7__namespace.writeFileSync(specPath, specContent, "utf-8");
+  fs8__namespace.writeFileSync(specPath, specContent, "utf-8");
   const errors = validatePatchArtifacts(rootDir, changeDir, specContent, specFmObj, adapter);
   return buildPatchSuccess(slug, canonicalId, specPath, citedArtifacts, errors);
 }
@@ -4271,46 +4535,46 @@ function buildGreenfieldContent(reqId, ucId, name, canonicalId, author, dateStr)
 ${body}`;
 }
 function createGreenfieldRequirement(rootDir, name, padNum, canonicalId, author, dateStr, createdFiles) {
-  const nameSlugUpper = slugify(name).toUpperCase();
+  const nameSlugUpper = slugify2(name).toUpperCase();
   const reqId = `FR-${padNum}-${nameSlugUpper}-001`;
   const ucId = `UC-${padNum}-${nameSlugUpper}`;
-  const productDir = path4__namespace.join(rootDir, "specs", "product");
-  if (!fs7__namespace.existsSync(productDir)) fs7__namespace.mkdirSync(productDir, { recursive: true });
-  const reqFilePath = path4__namespace.join(productDir, `${reqId}.md`);
-  if (fs7__namespace.existsSync(reqFilePath)) return null;
+  const productDir = path5__namespace.join(rootDir, "specs", "product");
+  if (!fs8__namespace.existsSync(productDir)) fs8__namespace.mkdirSync(productDir, { recursive: true });
+  const reqFilePath = path5__namespace.join(productDir, `${reqId}.md`);
+  if (fs8__namespace.existsSync(reqFilePath)) return null;
   const reqContent = buildGreenfieldContent(reqId, ucId, name, canonicalId, author, dateStr);
-  fs7__namespace.writeFileSync(reqFilePath, reqContent, "utf-8");
+  fs8__namespace.writeFileSync(reqFilePath, reqContent, "utf-8");
   createdFiles.push(reqFilePath);
   const digest = computeCanonicalSha256(reqContent);
   return { reqId, ucId, reqFilePath, digest };
 }
 function resolveMissingDraftDestination(rootDir, id) {
   if (id.startsWith("PRIV-REQ-")) {
-    return { dir: path4__namespace.join(rootDir, "specs", "privacy", "requirements"), type: "privacy-requirement" };
+    return { dir: path5__namespace.join(rootDir, "specs", "privacy", "requirements"), type: "privacy-requirement" };
   }
   if (id.startsWith("DATA-ASSET-")) {
-    return { dir: path4__namespace.join(rootDir, "specs", "privacy", "assets"), type: "data-asset" };
+    return { dir: path5__namespace.join(rootDir, "specs", "privacy", "assets"), type: "data-asset" };
   }
   if (id.startsWith("PRIV-ROPA-")) {
-    return { dir: path4__namespace.join(rootDir, "specs", "privacy", "ropa"), type: "privacy-ropa" };
+    return { dir: path5__namespace.join(rootDir, "specs", "privacy", "ropa"), type: "privacy-ropa" };
   }
   if (id.startsWith("UC-")) {
-    return { dir: path4__namespace.join(rootDir, "specs", "product"), type: "use-case" };
+    return { dir: path5__namespace.join(rootDir, "specs", "product"), type: "use-case" };
   }
   if (id.startsWith("SEC-REQ-") || id.startsWith("SAF-REQ-")) {
-    return { dir: path4__namespace.join(rootDir, "specs", "product"), type: "security-requirement" };
+    return { dir: path5__namespace.join(rootDir, "specs", "product"), type: "security-requirement" };
   }
-  return { dir: path4__namespace.join(rootDir, "specs", "product"), type: "requirement" };
+  return { dir: path5__namespace.join(rootDir, "specs", "product"), type: "requirement" };
 }
 function createMissingDraftRequirement(rootDir, name, id, canonicalId, createdFiles) {
   const { dir, type: reqType } = resolveMissingDraftDestination(rootDir, id);
-  if (!fs7__namespace.existsSync(dir)) fs7__namespace.mkdirSync(dir, { recursive: true });
-  const reqFilePath = path4__namespace.join(dir, `${id}.md`);
+  if (!fs8__namespace.existsSync(dir)) fs8__namespace.mkdirSync(dir, { recursive: true });
+  const reqFilePath = path5__namespace.join(dir, `${id}.md`);
   const header = MISSING_DRAFT_HEADER.replaceAll("{{ID}}", id).replaceAll("{{TYPE}}", reqType).replaceAll("{{NAME}}", name);
   const body = MISSING_DRAFT_BODY.replaceAll("{{ID}}", id).replaceAll("{{NAME}}", name).replaceAll("{{CANONICAL_ID}}", canonicalId);
   const reqContent = `${header}
 ${body}`;
-  fs7__namespace.writeFileSync(reqFilePath, reqContent, "utf-8");
+  fs8__namespace.writeFileSync(reqFilePath, reqContent, "utf-8");
   createdFiles.push(reqFilePath);
   const digest = computeCanonicalSha256(reqContent);
   return { reqFilePath, digest };
@@ -4425,7 +4689,7 @@ function initEmptyCitations() {
 }
 function ensureFallbackRequirement(col, padNum, name) {
   if (col.subRequirements.length === 0) {
-    col.subRequirements.push(`FR-${padNum}-${slugify(name).toUpperCase()}-001`);
+    col.subRequirements.push(`FR-${padNum}-${slugify2(name).toUpperCase()}-001`);
   }
 }
 function collectChangeCitations(rootDir, name, padNum, canonicalId, author, dateStr, inputFromIds, artifactMap, createdFiles) {
@@ -4439,7 +4703,7 @@ function collectChangeCitations(rootDir, name, padNum, canonicalId, author, date
   return col;
 }
 function renderProposalFile(changeDir, canonicalId, name, author, citationsYamlBlock) {
-  const proposalPath = path4__namespace.join(changeDir, "proposal.md");
+  const proposalPath = path5__namespace.join(changeDir, "proposal.md");
   const citationsSection = citationsYamlBlock ? `citations:
 ${citationsYamlBlock}
 ` : "";
@@ -4459,11 +4723,11 @@ ${name}
 ## 2. Dependencias Externas Evaluadas
 - Lista de dependencias nuevas a incorporar y verificaci\xF3n de licencia seg\xFAn \`license-policy.yaml\`.
 `;
-  fs7__namespace.writeFileSync(proposalPath, proposalContent, "utf-8");
+  fs8__namespace.writeFileSync(proposalPath, proposalContent, "utf-8");
   return proposalPath;
 }
 function renderSpecFile(changeDir, canonicalId, name, profile) {
-  const specPath = path4__namespace.join(changeDir, "spec.md");
+  const specPath = path5__namespace.join(changeDir, "spec.md");
   const specFmObj = {
     id: `SPEC-${canonicalId}`,
     type: "delivery-spec",
@@ -4484,12 +4748,12 @@ cucumber-tags:
 ---
 `;
   const body = SPEC_BODY.replaceAll("{{CANONICAL_ID}}", canonicalId).replaceAll("{{NAME}}", name);
-  fs7__namespace.writeFileSync(specPath, `${header}
+  fs8__namespace.writeFileSync(specPath, `${header}
 ${body}`, "utf-8");
   return { specPath, specFmObj };
 }
 function renderDesignFile(changeDir, canonicalId, name, author, dateStr, citationsYamlBlock) {
-  const designPath = path4__namespace.join(changeDir, "design.md");
+  const designPath = path5__namespace.join(changeDir, "design.md");
   const citationsSection = citationsYamlBlock ? `citations:
 ${citationsYamlBlock}
 ` : "";
@@ -4508,7 +4772,7 @@ contracts: []
 ${citationsSection}---
 `;
   const body = DESIGN_BODY.replaceAll("{{CANONICAL_ID}}", canonicalId).replaceAll("{{NAME}}", name).replaceAll("{{AUTHOR}}", author).replaceAll("{{DATE}}", dateStr);
-  fs7__namespace.writeFileSync(designPath, `${header}
+  fs8__namespace.writeFileSync(designPath, `${header}
 ${body}`, "utf-8");
   return designPath;
 }
@@ -4533,14 +4797,14 @@ function buildTasksFrontmatter(canonicalId, name, reqIds) {
   };
 }
 function renderTasksFile(changeDir, canonicalId, name, author, dateStr, reqIds) {
-  const tasksPath = path4__namespace.join(changeDir, "tasks.md");
+  const tasksPath = path5__namespace.join(changeDir, "tasks.md");
   const tasksFm = buildTasksFrontmatter(canonicalId, name, reqIds);
   const header = `---
 ${yaml3__default.default.dump(tasksFm, { indent: 2, lineWidth: -1 }).trim()}
 ---
 `;
   const body = TASKS_BODY.replaceAll("{{CANONICAL_ID}}", canonicalId).replaceAll("{{NAME}}", name).replaceAll("{{AUTHOR}}", author).replaceAll("{{DATE}}", dateStr);
-  fs7__namespace.writeFileSync(tasksPath, `${header}
+  fs8__namespace.writeFileSync(tasksPath, `${header}
 ${body}`, "utf-8");
   return { tasksPath, tasksFm };
 }
@@ -4719,7 +4983,7 @@ function resolveCiEnvironment(env = process.env) {
   };
 }
 function updateExistingEnvFile(filePath, envString, uppercaseKey) {
-  const content = fs7__namespace.readFileSync(filePath, "utf-8");
+  const content = fs8__namespace.readFileSync(filePath, "utf-8");
   const lines = content.split("\n");
   let found = false;
   const newLines = lines.map((line) => {
@@ -4730,15 +4994,15 @@ function updateExistingEnvFile(filePath, envString, uppercaseKey) {
     return line;
   });
   if (!found) newLines.push(envString);
-  fs7__namespace.writeFileSync(filePath, newLines.filter((l) => l.trim() !== "").join("\n") + "\n", "utf-8");
+  fs8__namespace.writeFileSync(filePath, newLines.filter((l) => l.trim() !== "").join("\n") + "\n", "utf-8");
 }
 function writeEnvOutputFile(envOutputFile, key, value) {
   const uppercaseKey = key.toUpperCase();
   const envString = `${uppercaseKey}=${value}`;
-  if (fs7__namespace.existsSync(envOutputFile)) {
+  if (fs8__namespace.existsSync(envOutputFile)) {
     updateExistingEnvFile(envOutputFile, envString, uppercaseKey);
   } else {
-    fs7__namespace.writeFileSync(envOutputFile, envString + "\n", "utf-8");
+    fs8__namespace.writeFileSync(envOutputFile, envString + "\n", "utf-8");
   }
 }
 function resolveEnvOutputFilePath(env) {
@@ -4748,8 +5012,8 @@ function resolveEnvOutputFilePath(env) {
   return void 0;
 }
 function emitCiOutput(key, value, env = process.env) {
-  if (env.GITHUB_OUTPUT && fs7__namespace.existsSync(env.GITHUB_OUTPUT)) {
-    fs7__namespace.appendFileSync(env.GITHUB_OUTPUT, `${key}=${value}
+  if (env.GITHUB_OUTPUT && fs8__namespace.existsSync(env.GITHUB_OUTPUT)) {
+    fs8__namespace.appendFileSync(env.GITHUB_OUTPUT, `${key}=${value}
 `, "utf-8");
   }
   if (env.TF_BUILD === "true") {
@@ -4791,11 +5055,11 @@ function isIgnoredEntry(name) {
   return name === "changes" || name === "active" || name === "node_modules";
 }
 function scanParentDirectoryHandoffs(parentDir, handoffsMap) {
-  if (!fs7__namespace.existsSync(parentDir)) return;
-  const entries = fs7__namespace.readdirSync(parentDir, { withFileTypes: true });
+  if (!fs8__namespace.existsSync(parentDir)) return;
+  const entries = fs8__namespace.readdirSync(parentDir, { withFileTypes: true });
   for (const entry of entries) {
     if (!entry.isDirectory() || isIgnoredEntry(entry.name)) continue;
-    const changeDir = path4__namespace.join(parentDir, entry.name);
+    const changeDir = path5__namespace.join(parentDir, entry.name);
     if (handooffsHasDir(handoffsMap, changeDir)) continue;
     const handoff = loadProductHandoffSidecar(changeDir);
     if (handoff?.id) {
@@ -4806,10 +5070,10 @@ function scanParentDirectoryHandoffs(parentDir, handoffsMap) {
 function scanAllProductHandoffs(rootDir) {
   const handoffsMap = /* @__PURE__ */ new Map();
   const candidateParentDirs = [
-    path4__namespace.join(rootDir, "specs", "changes", "active"),
-    path4__namespace.join(rootDir, "specs", "changes", "completed"),
-    path4__namespace.join(rootDir, "specs"),
-    path4__namespace.join(rootDir, "openspec", "changes")
+    path5__namespace.join(rootDir, "specs", "changes", "active"),
+    path5__namespace.join(rootDir, "specs", "changes", "completed"),
+    path5__namespace.join(rootDir, "specs"),
+    path5__namespace.join(rootDir, "openspec", "changes")
   ];
   for (const parentDir of candidateParentDirs) {
     scanParentDirectoryHandoffs(parentDir, handoffsMap);
@@ -4817,9 +5081,9 @@ function scanAllProductHandoffs(rootDir) {
   return handoffsMap;
 }
 function handooffsHasDir(map, dir) {
-  const norm = path4__namespace.resolve(dir);
+  const norm = path5__namespace.resolve(dir);
   for (const key of map.keys()) {
-    if (path4__namespace.resolve(key) === norm) return true;
+    if (path5__namespace.resolve(key) === norm) return true;
   }
   return false;
 }
@@ -4854,7 +5118,7 @@ function buildTraceabilityHeader(isOk, errors) {
   return [
     "# 360\xB0 Requirements Traceability Matrix (RTM)",
     "",
-    `*Verification Date: ${(/* @__PURE__ */ new Date()).toISOString()}*`,
+    `*Verification Date: ${resolveDeterministicDate().toISOString()}*`,
     `*Overall Status: ${isOk ? "100% TRACEABLE (PASSED)" : `ERRORS DETECTED (${errors} gaps)`}*`,
     "",
     "## 1. End-to-End Coverage (PDaC Handoff \u2794 arc42/NAF v4 \u2794 BDD/Gherkin)",
@@ -4916,9 +5180,9 @@ function isCodeTestFile(name) {
 }
 function indexFeatureFile(fullPath, rootDir, map) {
   try {
-    const content = fs7__namespace.readFileSync(fullPath, "utf-8");
+    const content = fs8__namespace.readFileSync(fullPath, "utf-8");
     const tags = extractFeatureTags(content);
-    const relFeature = path4__namespace.relative(rootDir, fullPath).replace(/\\/g, "/");
+    const relFeature = path5__namespace.relative(rootDir, fullPath).replace(/\\/g, "/");
     for (const tag of tags) {
       const existing = map.get(tag) || [];
       if (!existing.includes(relFeature)) existing.push(relFeature);
@@ -4928,11 +5192,11 @@ function indexFeatureFile(fullPath, rootDir, map) {
   }
 }
 function scanFeatureFiles(dir, rootDir, map) {
-  if (!fs7__namespace.existsSync(dir)) return;
+  if (!fs8__namespace.existsSync(dir)) return;
   try {
-    const entries = fs7__namespace.readdirSync(dir, { withFileTypes: true });
+    const entries = fs8__namespace.readdirSync(dir, { withFileTypes: true });
     for (const e of entries) {
-      const fullPath = path4__namespace.join(dir, e.name);
+      const fullPath = path5__namespace.join(dir, e.name);
       if (e.isDirectory() && !shouldSkipDir(e.name)) {
         scanFeatureFiles(fullPath, rootDir, map);
       } else if (e.name.endsWith(".feature")) {
@@ -4944,8 +5208,8 @@ function scanFeatureFiles(dir, rootDir, map) {
 }
 function indexCodeTestFile(fullPath, rootDir, reqIds, map) {
   try {
-    const content = fs7__namespace.readFileSync(fullPath, "utf-8");
-    const relTest = path4__namespace.relative(rootDir, fullPath).replace(/\\/g, "/");
+    const content = fs8__namespace.readFileSync(fullPath, "utf-8");
+    const relTest = path5__namespace.relative(rootDir, fullPath).replace(/\\/g, "/");
     for (const artId of reqIds) {
       if (content.includes(artId)) {
         const existing = map.get(artId) || [];
@@ -4957,11 +5221,11 @@ function indexCodeTestFile(fullPath, rootDir, reqIds, map) {
   }
 }
 function scanCodeTestFiles(dir, rootDir, reqIds, map) {
-  if (!fs7__namespace.existsSync(dir)) return;
+  if (!fs8__namespace.existsSync(dir)) return;
   try {
-    const entries = fs7__namespace.readdirSync(dir, { withFileTypes: true });
+    const entries = fs8__namespace.readdirSync(dir, { withFileTypes: true });
     for (const e of entries) {
-      const fullPath = path4__namespace.join(dir, e.name);
+      const fullPath = path5__namespace.join(dir, e.name);
       if (e.isDirectory() && !shouldSkipDir(e.name)) {
         scanCodeTestFiles(fullPath, rootDir, reqIds, map);
       } else if (isCodeTestFile(e.name)) {
@@ -4995,9 +5259,9 @@ function isArchitectureViewFile(relFile, frontmatter) {
 }
 function processSingleMdFile(file, rootDir, artifactMap, componentsList, architectureViews) {
   try {
-    const content = fs7__namespace.readFileSync(file, "utf-8");
+    const content = fs8__namespace.readFileSync(file, "utf-8");
     const { frontmatter, body } = parseFrontmatter(content);
-    const relFile = path4__namespace.relative(rootDir, file).replace(/\\/g, "/");
+    const relFile = path5__namespace.relative(rootDir, file).replace(/\\/g, "/");
     if (frontmatter.id) {
       artifactMap.set(frontmatter.id, {
         file: relFile,
@@ -5162,7 +5426,7 @@ function collectArchitectureViewTraces(reqId, architectureViews) {
   const traces = [];
   for (const view of architectureViews) {
     if (view.content.includes(reqId)) {
-      const viewIdentifier = isEntityWithId(view) && view.id ? view.id : path4__namespace.basename(view.file);
+      const viewIdentifier = isEntityWithId(view) && view.id ? view.id : path5__namespace.basename(view.file);
       traces.push(viewIdentifier);
     }
   }
@@ -5250,16 +5514,16 @@ function isProductionSourceFile(name) {
   return SOURCE_CODE_EXTS.some((ext) => name.endsWith(ext));
 }
 function collectCodeAndTestCorpora(dir, prodChunks = [], testChunks = []) {
-  if (!fs7__namespace.existsSync(dir)) return { prodCorpus: "", testCorpus: "" };
+  if (!fs8__namespace.existsSync(dir)) return { prodCorpus: "", testCorpus: "" };
   try {
-    for (const e of fs7__namespace.readdirSync(dir, { withFileTypes: true })) {
-      const fullPath = path4__namespace.join(dir, e.name);
+    for (const e of fs8__namespace.readdirSync(dir, { withFileTypes: true })) {
+      const fullPath = path5__namespace.join(dir, e.name);
       if (e.isDirectory() && !shouldSkipDir(e.name)) {
         collectCodeAndTestCorpora(fullPath, prodChunks, testChunks);
       } else if (isCodeTestFile(e.name) || e.name.endsWith(".feature")) {
-        testChunks.push(fs7__namespace.readFileSync(fullPath, "utf-8"));
+        testChunks.push(fs8__namespace.readFileSync(fullPath, "utf-8"));
       } else if (isProductionSourceFile(e.name)) {
-        prodChunks.push(fs7__namespace.readFileSync(fullPath, "utf-8"));
+        prodChunks.push(fs8__namespace.readFileSync(fullPath, "utf-8"));
       }
     }
   } catch {
@@ -5413,12 +5677,12 @@ function walkTaskFiles(dir, fileList = [], excludeDirs = [
   "examples"
 ]) {
   try {
-    if (!fs7__namespace.existsSync(dir)) return fileList;
-    const files = fs7__namespace.readdirSync(dir);
+    if (!fs8__namespace.existsSync(dir)) return fileList;
+    const files = fs8__namespace.readdirSync(dir).sort(canonicalSort);
     for (const file of files) {
-      const fullPath = path4__namespace.join(dir, file);
+      const fullPath = path5__namespace.join(dir, file);
       try {
-        if (fs7__namespace.statSync(fullPath).isDirectory()) {
+        if (fs8__namespace.statSync(fullPath).isDirectory()) {
           if (!excludeDirs.includes(file)) {
             walkTaskFiles(fullPath, fileList, excludeDirs);
           }
@@ -5470,7 +5734,7 @@ function generateGovernanceReportMarkdown(summaries, violationsCount, modeCounts
   const sections = [
     `# \u{1F4CB} Task Governance and Human Autonomy Classification Report
 
-> **Audit Date:** ${(/* @__PURE__ */ new Date()).toISOString()}
+> **Audit Date:** ${resolveDeterministicDate().toISOString()}
 > **Overall Verdict:** ${verdict}
 
 ---`,
@@ -5531,9 +5795,9 @@ function updateGovernanceCounts(t, modeCounts, riskCounts) {
   }
 }
 function parseTasksFromFile(file) {
-  if (!fs7__namespace.existsSync(file)) return [];
+  if (!fs8__namespace.existsSync(file)) return [];
   try {
-    const content = fs7__namespace.readFileSync(file, "utf-8");
+    const content = fs8__namespace.readFileSync(file, "utf-8");
     const { frontmatter } = parseTasksDoc(content);
     return frontmatter.tasks || [];
   } catch {
@@ -5541,11 +5805,11 @@ function parseTasksFromFile(file) {
   }
 }
 function extractDesignExpectedScope(changeDir) {
-  const designFile = path4__namespace.join(changeDir, "design.md");
-  if (!fs7__namespace.existsSync(designFile)) return [];
+  const designFile = path5__namespace.join(changeDir, "design.md");
+  if (!fs8__namespace.existsSync(designFile)) return [];
   const expected = [];
   try {
-    const { frontmatter } = parseTasksDoc(fs7__namespace.readFileSync(designFile, "utf-8"));
+    const { frontmatter } = parseTasksDoc(fs8__namespace.readFileSync(designFile, "utf-8"));
     if (typeof frontmatter["architecture-component"] === "string") {
       expected.push(frontmatter["architecture-component"]);
     }
@@ -5585,7 +5849,7 @@ function hasExplicitScopeBindings(tasks) {
   );
 }
 function auditDesignScopeForFile(file, tasks, options, unassignedList, violationsList) {
-  const changeDir = path4__namespace.dirname(file);
+  const changeDir = path5__namespace.dirname(file);
   const expectedItems = [
     ...extractDesignExpectedScope(changeDir),
     ...extractHandoffExpectedScope(changeDir, options.maxUseCasesPerChange, violationsList)
@@ -5596,13 +5860,13 @@ function auditDesignScopeForFile(file, tasks, options, unassignedList, violation
   for (const item of new Set(expectedItems)) {
     if (!covered.has(item)) {
       unassignedList.push(item);
-      violationsList.push(`[${path4__namespace.basename(changeDir)}] Unassigned design/handoff scope in tasks.md: missing task coverage for ${item}`);
+      violationsList.push(`[${path5__namespace.basename(changeDir)}] Unassigned design/handoff scope in tasks.md: missing task coverage for ${item}`);
     }
   }
 }
 function processTasksFile(file, rootDir, options, acc) {
   const tasks = parseTasksFromFile(file);
-  const relPath = path4__namespace.relative(rootDir, file).replace(/\\/g, "/");
+  const relPath = path5__namespace.relative(rootDir, file).replace(/\\/g, "/");
   let unverifiedDelta = 0;
   for (const t of tasks) {
     const { summary, violation, unverified } = evaluateTaskItem(t, relPath);
@@ -5901,11 +6165,11 @@ async function runAllExpandedScenarios(parsed, definitions) {
 }
 async function executeBddFeature(featurePath, registry, options = {}) {
   const rootDir = options.rootDir || process.cwd();
-  const fullPath = path4__namespace.isAbsolute(featurePath) ? featurePath : path4__namespace.join(rootDir, featurePath);
-  const parsed = parseFeatureDocument(fs7__namespace.readFileSync(fullPath, "utf-8"));
+  const fullPath = path5__namespace.isAbsolute(featurePath) ? featurePath : path5__namespace.join(rootDir, featurePath);
+  const parsed = parseFeatureDocument(fs8__namespace.readFileSync(fullPath, "utf-8"));
   const scenarios = await runAllExpandedScenarios(parsed, registry.getDefinitions());
   const report = {
-    uri: path4__namespace.relative(rootDir, fullPath).replace(/\\/g, "/"),
+    uri: path5__namespace.relative(rootDir, fullPath).replace(/\\/g, "/"),
     featureName: parsed.featureName,
     tags: parsed.tags,
     scenarios,
@@ -5939,10 +6203,10 @@ function mapFeatureToCucumberJson(r) {
   };
 }
 function writeCucumberJsonReport(reports, outputPath) {
-  const dir = path4__namespace.dirname(outputPath);
-  if (!fs7__namespace.existsSync(dir)) fs7__namespace.mkdirSync(dir, { recursive: true });
+  const dir = path5__namespace.dirname(outputPath);
+  if (!fs8__namespace.existsSync(dir)) fs8__namespace.mkdirSync(dir, { recursive: true });
   const payload = JSON.stringify(reports.map(mapFeatureToCucumberJson), null, 2);
-  fs7__namespace.writeFileSync(outputPath, payload, "utf-8");
+  fs8__namespace.writeFileSync(outputPath, payload, "utf-8");
 }
 function isToolAvailable(toolName) {
   try {
@@ -5988,8 +6252,8 @@ function findLicenseFile(pkgDir) {
     "license.txt"
   ];
   for (const c of candidates) {
-    const full = path4__namespace.join(pkgDir, c);
-    if (fs7__namespace.existsSync(full)) {
+    const full = path5__namespace.join(pkgDir, c);
+    if (fs8__namespace.existsSync(full)) {
       return full;
     }
   }
@@ -6006,9 +6270,9 @@ var LICENSE_FILE_PATTERNS = [
   [(t) => t.includes("Microsoft Reciprocal License") || t.includes("MS-RL"), "MS-RL"]
 ];
 function resolveLicenseFromFile(licenseFilePath) {
-  if (!licenseFilePath || !fs7__namespace.existsSync(licenseFilePath)) return void 0;
+  if (!licenseFilePath || !fs8__namespace.existsSync(licenseFilePath)) return void 0;
   try {
-    const text = fs7__namespace.readFileSync(licenseFilePath, "utf-8");
+    const text = fs8__namespace.readFileSync(licenseFilePath, "utf-8");
     for (const [matches, spdx] of LICENSE_FILE_PATTERNS) {
       if (matches(text)) return spdx;
     }
@@ -6017,16 +6281,16 @@ function resolveLicenseFromFile(licenseFilePath) {
   return void 0;
 }
 function readPackageJson(filePath) {
-  if (!fs7__namespace.existsSync(filePath)) return null;
+  if (!fs8__namespace.existsSync(filePath)) return null;
   try {
-    return JSON.parse(fs7__namespace.readFileSync(filePath, "utf-8"));
+    return JSON.parse(fs8__namespace.readFileSync(filePath, "utf-8"));
   } catch {
     return null;
   }
 }
 function extractDirectDepNames(rootDir, productionOnly) {
   const names = /* @__PURE__ */ new Set();
-  const pkgPath = path4__namespace.join(rootDir, "package.json");
+  const pkgPath = path5__namespace.join(rootDir, "package.json");
   const pkg = readPackageJson(pkgPath);
   if (!pkg) return names;
   if (pkg.dependencies && typeof pkg.dependencies === "object") {
@@ -6046,7 +6310,7 @@ function resolveSpdxForPackage(pkg, licFile) {
   return spdx;
 }
 function processPackageDir(pkgDir, directNames, seen) {
-  const pkg = readPackageJson(path4__namespace.join(pkgDir, "package.json"));
+  const pkg = readPackageJson(path5__namespace.join(pkgDir, "package.json"));
   if (!pkg?.name || !pkg.version) return;
   const key = `${pkg.name}@${pkg.version}`;
   if (seen.has(key)) return;
@@ -6067,40 +6331,40 @@ function processPackageDir(pkgDir, directNames, seen) {
   });
 }
 function scanScopeSubdirectory(scopeDir, directNames, seen) {
-  const scopedEntries = fs7__namespace.readdirSync(scopeDir, { withFileTypes: true });
+  const scopedEntries = fs8__namespace.readdirSync(scopeDir, { withFileTypes: true });
   for (const scoped of scopedEntries) {
     if (scoped.isDirectory()) {
-      processPackageDir(path4__namespace.join(scopeDir, scoped.name), directNames, seen);
+      processPackageDir(path5__namespace.join(scopeDir, scoped.name), directNames, seen);
     }
   }
 }
 function scanSubdirectories(baseDir, directNames, seen) {
-  if (!fs7__namespace.existsSync(baseDir)) return;
-  const entries = fs7__namespace.readdirSync(baseDir, { withFileTypes: true });
+  if (!fs8__namespace.existsSync(baseDir)) return;
+  const entries = fs8__namespace.readdirSync(baseDir, { withFileTypes: true });
   for (const entry of entries) {
     if (!entry.isDirectory()) continue;
     if (entry.name.startsWith("@")) {
-      scanScopeSubdirectory(path4__namespace.join(baseDir, entry.name), directNames, seen);
+      scanScopeSubdirectory(path5__namespace.join(baseDir, entry.name), directNames, seen);
     } else if (entry.name !== ".bin" && entry.name !== ".pnpm") {
-      processPackageDir(path4__namespace.join(baseDir, entry.name), directNames, seen);
+      processPackageDir(path5__namespace.join(baseDir, entry.name), directNames, seen);
     }
   }
 }
 function scanPnpmStore(pnpmDir, directNames, seen) {
-  if (!fs7__namespace.existsSync(pnpmDir)) return;
-  const entries = fs7__namespace.readdirSync(pnpmDir, { withFileTypes: true });
+  if (!fs8__namespace.existsSync(pnpmDir)) return;
+  const entries = fs8__namespace.readdirSync(pnpmDir, { withFileTypes: true });
   for (const entry of entries) {
     if (!entry.isDirectory()) continue;
-    const candidateModules = path4__namespace.join(pnpmDir, entry.name, "node_modules");
-    if (fs7__namespace.existsSync(candidateModules)) {
+    const candidateModules = path5__namespace.join(pnpmDir, entry.name, "node_modules");
+    if (fs8__namespace.existsSync(candidateModules)) {
       scanSubdirectories(candidateModules, directNames, seen);
     }
   }
 }
 function readTextIfExists(filePath) {
-  if (!fs7__namespace.existsSync(filePath)) return null;
+  if (!fs8__namespace.existsSync(filePath)) return null;
   try {
-    return fs7__namespace.readFileSync(filePath, "utf-8");
+    return fs8__namespace.readFileSync(filePath, "utf-8");
   } catch {
     return null;
   }
@@ -6160,14 +6424,14 @@ function parsePipfileSection(pkgs, isDirect, lockPath, seen) {
   }
 }
 function scanPythonDependencies(rootDir, seen) {
-  const pyproject = readTextIfExists(path4__namespace.join(rootDir, "pyproject.toml")) || "";
+  const pyproject = readTextIfExists(path5__namespace.join(rootDir, "pyproject.toml")) || "";
   const directNames = extractPyprojectDirectDeps(pyproject);
   for (const lockName of ["poetry.lock", "uv.lock"]) {
-    const lockPath = path4__namespace.join(rootDir, lockName);
+    const lockPath = path5__namespace.join(rootDir, lockName);
     const content = readTextIfExists(lockPath);
     if (content) parseTomlPackageBlocks(content, lockPath, directNames, seen);
   }
-  const pipfileLockPath = path4__namespace.join(rootDir, "Pipfile.lock");
+  const pipfileLockPath = path5__namespace.join(rootDir, "Pipfile.lock");
   const pipfileRaw = readTextIfExists(pipfileLockPath);
   if (!pipfileRaw) return;
   try {
@@ -6210,7 +6474,7 @@ function extractGoCandidateLines(content) {
   return out;
 }
 function scanGoDependencies(rootDir, seen) {
-  const goModPath = path4__namespace.join(rootDir, "go.mod");
+  const goModPath = path5__namespace.join(rootDir, "go.mod");
   const content = readTextIfExists(goModPath);
   if (!content) return;
   for (const line of extractGoCandidateLines(content)) {
@@ -6253,10 +6517,10 @@ function parseCargoLockBlock(block, rootName, directMeta, cargoLockPath) {
   };
 }
 function scanRustDependencies(rootDir, seen) {
-  const cargoLockPath = path4__namespace.join(rootDir, "Cargo.lock");
+  const cargoLockPath = path5__namespace.join(rootDir, "Cargo.lock");
   const lockContent = readTextIfExists(cargoLockPath);
   if (!lockContent) return;
-  const cargoToml = readTextIfExists(path4__namespace.join(rootDir, "Cargo.toml")) || "";
+  const cargoToml = readTextIfExists(path5__namespace.join(rootDir, "Cargo.toml")) || "";
   const directMeta = extractCargoDirectDeps(cargoToml);
   const rootName = extractTomlField(cargoToml, "name");
   for (const block of lockContent.split(/\[\[package\]\]/g).slice(1)) {
@@ -6292,7 +6556,7 @@ function parseMavenDepBlock(block, defaultLic, pomPath) {
   };
 }
 function scanMavenDependencies(rootDir, seen) {
-  const pomPath = path4__namespace.join(rootDir, "pom.xml");
+  const pomPath = path5__namespace.join(rootDir, "pom.xml");
   const content = readTextIfExists(pomPath);
   if (!content) return;
   const projectLicBlock = content.match(/<licenses>([\s\S]*?)<\/licenses>/)?.[1] || "";
@@ -6308,11 +6572,11 @@ function scanMavenDependencies(rootDir, seen) {
 function scanWithNativeFs(rootDir, options = {}) {
   const directNames = extractDirectDepNames(rootDir, options.productionOnly);
   const seen = /* @__PURE__ */ new Map();
-  const nmDir = path4__namespace.join(rootDir, "node_modules");
-  if (fs7__namespace.existsSync(nmDir)) {
+  const nmDir = path5__namespace.join(rootDir, "node_modules");
+  if (fs8__namespace.existsSync(nmDir)) {
     scanSubdirectories(nmDir, directNames, seen);
     if (options.depth !== "direct") {
-      scanPnpmStore(path4__namespace.join(nmDir, ".pnpm"), directNames, seen);
+      scanPnpmStore(path5__namespace.join(nmDir, ".pnpm"), directNames, seen);
     }
   }
   scanPythonDependencies(rootDir, seen);
@@ -6571,20 +6835,20 @@ function resolveProjectIdentity(options) {
   let name = options.projectName || "ai-sdlc-project";
   let version = options.projectVersion || "1.0.0";
   if (!options.rootDir) return { name, version };
-  const pkgPath = path4__namespace.join(options.rootDir, "package.json");
-  if (!fs7__namespace.existsSync(pkgPath)) return { name, version };
+  const pkgPath = path5__namespace.join(options.rootDir, "package.json");
+  if (!fs8__namespace.existsSync(pkgPath)) return { name, version };
   try {
-    const pkg = JSON.parse(fs7__namespace.readFileSync(pkgPath, "utf-8"));
+    const pkg = JSON.parse(fs8__namespace.readFileSync(pkgPath, "utf-8"));
     if (pkg.name) name = pkg.name;
     if (pkg.version) version = pkg.version;
   } catch {
   }
   return { name, version };
 }
-function buildBomMetadata(name, version) {
+function buildBomMetadata(name, version, rootDir) {
   return {
-    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-    tools: [{ vendor: "AI-SDLC", name: "@aisdlc/core", version: "2.4.0" }],
+    timestamp: resolveDeterministicDate(rootDir).toISOString(),
+    tools: [{ vendor: "AI-SDLC", name: "@aisdlc/core", version: "2.5.0" }],
     component: { type: "application", name, version }
   };
 }
@@ -6595,52 +6859,21 @@ function generateCycloneDxSbom(dependencies, options = {}) {
     bomFormat: "CycloneDX",
     specVersion: "1.5",
     version: 1,
-    serialNumber: `urn:uuid:${crypto__namespace.randomUUID()}`,
-    metadata: buildBomMetadata(name, version),
+    serialNumber: `urn:uuid:${generateDeterministicUuidV5(`${name}@${version}|${dependencies.map((d) => `${d.name}@${d.version}:${d.purl || ""}`).sort(canonicalSort).join(";")}`)}`,
+    metadata: buildBomMetadata(name, version, options.rootDir),
     components: dependencies.map(buildCycloneDxComponent),
     ...cdxVulns.length > 0 ? { vulnerabilities: cdxVulns } : {}
   };
 }
-function tryAtomicWrite(filePath, content) {
-  const tempPath = `${filePath}.${process.pid}.${Math.random().toString(36).substring(2)}.tmp`;
-  try {
-    fs7__namespace.writeFileSync(tempPath, content, "utf-8");
-    try {
-      if (fs7__namespace.existsSync(filePath)) {
-        fs7__namespace.rmSync(filePath, { force: true });
-      }
-      fs7__namespace.renameSync(tempPath, filePath);
-    } catch {
-      fs7__namespace.copyFileSync(tempPath, filePath);
-      fs7__namespace.unlinkSync(tempPath);
-    }
-    return true;
-  } catch {
-    return false;
-  }
-}
-function safeWriteFileSync(filePath, content) {
-  const dir = path4__namespace.dirname(filePath);
-  if (!fs7__namespace.existsSync(dir)) {
-    fs7__namespace.mkdirSync(dir, { recursive: true });
-  }
-  for (let attempt = 0; attempt < 10; attempt++) {
-    if (tryAtomicWrite(filePath, content)) return;
-  }
-  try {
-    fs7__namespace.writeFileSync(filePath, content, "utf-8");
-  } catch {
-  }
-}
 function writeCycloneDxSbom(sbom, outputPath) {
-  safeWriteFileSync(outputPath, JSON.stringify(sbom, null, 2));
+  writeReportFileIfChanged(outputPath, JSON.stringify(sbom, null, 2));
 }
 function buildThirdPartyHeader(projectName, count) {
   return [
     `# \u{1F4DC} Third-Party Software Notices and Information`,
     ``,
     `> **Proyecto:** ${projectName}`,
-    `> **Fecha:** ${(/* @__PURE__ */ new Date()).toISOString().split("T")[0]}`,
+    `> **Fecha:** ${resolveDeterministicDate().toISOString().split("T")[0]}`,
     `> **Total Componentes:** ${count}`,
     ``,
     `Este documento contiene los avisos de copyright y t\xE9rminos de licencia aplicables a los componentes de terceros utilizados en este proyecto.`,
@@ -6654,9 +6887,9 @@ function buildThirdPartyHeader(projectName, count) {
   ];
 }
 function readLicenseTextPreview(licenseFile) {
-  if (!licenseFile || !fs7__namespace.existsSync(licenseFile)) return null;
+  if (!licenseFile || !fs8__namespace.existsSync(licenseFile)) return null;
   try {
-    const text = fs7__namespace.readFileSync(licenseFile, "utf-8").trim();
+    const text = fs8__namespace.readFileSync(licenseFile, "utf-8").trim();
     return text.slice(0, 1e3) + (text.length > 1e3 ? "\n... (texto truncado)" : "");
   } catch {
     return null;
@@ -6688,13 +6921,13 @@ function generateThirdPartyNotices(dependencies, projectName = "AI-SDLC") {
     "",
     "---",
     "",
-    "## Textos de Licencia y Atribuciones",
+    "## 2. Atribuciones y T\xE9rminos de Licencia Individuales",
     "",
     ...attributions
   ].join("\n");
 }
-function writeThirdPartyNotices(content, outputPath) {
-  safeWriteFileSync(outputPath, content);
+function writeThirdPartyNotices(noticesContent, outputPath) {
+  writeReportFileIfChanged(outputPath, noticesContent);
 }
 
 // src/verifiers/licenses.ts
@@ -6771,22 +7004,20 @@ function parseVexStatements(doc) {
   if (!Array.isArray(rawList)) return [];
   return rawList.filter((item) => Boolean(item && typeof item.id === "string" && typeof item.state === "string"));
 }
-function parseLicensePolicy(content) {
+function parseLicenseDoc(content) {
+  let doc;
   try {
-    const doc = yaml3__default.default.load(content);
-    const { permitted, restricted, blocked } = classifyCategories(doc?.categories);
-    const exception_packages = parseExceptions(doc?.exceptions);
-    const vex_statements = parseVexStatements(doc);
-    return {
-      version: doc?.version || "1.0",
-      permitted: permitted.length > 0 ? permitted : DEFAULT_PERMITTED,
-      restricted: restricted.length > 0 ? restricted : DEFAULT_RESTRICTED,
-      blocked: blocked.length > 0 ? blocked : DEFAULT_BLOCKED,
-      exception_packages,
-      vex_statements,
-      rawPolicy: doc
-    };
-  } catch {
+    doc = yaml3__default.default.load(content);
+  } catch (err) {
+    throw new Error(`[AI-SDLC Fail-Closed] Invalid YAML in license-policy: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  if (!doc || typeof doc !== "object" || Array.isArray(doc)) {
+    throw new Error(`[AI-SDLC Fail-Closed] Invalid license policy structure: root must be a YAML mapping`);
+  }
+  return doc;
+}
+function parseLicensePolicy(content) {
+  if (!content || !content.trim()) {
     return {
       version: "1.0",
       permitted: DEFAULT_PERMITTED,
@@ -6796,6 +7027,17 @@ function parseLicensePolicy(content) {
       vex_statements: []
     };
   }
+  const doc = parseLicenseDoc(content);
+  const { permitted, restricted, blocked } = classifyCategories(doc?.categories);
+  return {
+    version: doc?.version || "1.0",
+    permitted: permitted.length > 0 ? permitted : DEFAULT_PERMITTED,
+    restricted: restricted.length > 0 ? restricted : DEFAULT_RESTRICTED,
+    blocked: blocked.length > 0 ? blocked : DEFAULT_BLOCKED,
+    exception_packages: parseExceptions(doc?.exceptions),
+    vex_statements: parseVexStatements(doc),
+    rawPolicy: doc
+  };
 }
 function evaluateCompoundLicense(lic, policy) {
   const cleanLic = lic.replace(/[()]/g, "").trim();
@@ -6887,7 +7129,7 @@ function buildReportHeader(isOk, depCount, violationCount, sbomPath) {
   return [
     `# \u{1F4DC} Open Source License Compliance Audit (Dynamic SCA)`,
     ``,
-    `> **Verification Date:** ${(/* @__PURE__ */ new Date()).toISOString()}`,
+    `> **Verification Date:** ${resolveDeterministicDate().toISOString()}`,
     `> **Status:** ${statusStr}`,
     `> **Total Audited Dependencies:** ${depCount}`,
     sbomPath ? `> **Generated CycloneDX SBOM:** \`${sbomPath}\`` : "",
@@ -6912,9 +7154,9 @@ function generateLicenseReportMarkdown(dependencies, violations, policy, sbomPat
   return lines.filter(Boolean).join("\n");
 }
 function parseManifestItems(manifestFile) {
-  if (!fs7__namespace.existsSync(manifestFile)) return [];
+  if (!fs8__namespace.existsSync(manifestFile)) return [];
   try {
-    const doc = yaml3__default.default.load(fs7__namespace.readFileSync(manifestFile, "utf-8"));
+    const doc = yaml3__default.default.load(fs8__namespace.readFileSync(manifestFile, "utf-8"));
     return Array.isArray(doc?.evaluated_dependencies) ? doc.evaluated_dependencies : [];
   } catch {
     return [];
@@ -6946,10 +7188,10 @@ function verifyStaticManifest(manifestFile, policy) {
 function resolveManifestPath(rootDir, customPath) {
   if (customPath) return customPath;
   const candidates = [
-    path4__namespace.join(rootDir, "compliance", "license-manifest.yaml"),
-    path4__namespace.join(rootDir, "license-manifest.yaml")
+    path5__namespace.join(rootDir, "compliance", "license-manifest.yaml"),
+    path5__namespace.join(rootDir, "license-manifest.yaml")
   ];
-  return candidates.find((p) => fs7__namespace.existsSync(p)) || candidates[0];
+  return candidates.find((p) => fs8__namespace.existsSync(p)) || candidates[0];
 }
 function handleStaticManifestVerification(options, rootDir, policy) {
   const manifestFile = resolveManifestPath(rootDir, options.manifestPath);
@@ -6970,7 +7212,7 @@ function shouldGenerateSbom(options, rawPolicy) {
 }
 function maybeGenerateSbom(options, rootDir, rawPolicy, dependencies, vulnerabilities, vexStatements) {
   if (!shouldGenerateSbom(options, rawPolicy)) return void 0;
-  const sbomPath = options.sbomPath || path4__namespace.join(rootDir, "reports", "sbom.cdx.json");
+  const sbomPath = options.sbomPath || path5__namespace.join(rootDir, "reports", "sbom.cdx.json");
   const sbom = generateCycloneDxSbom(dependencies, { rootDir, vulnerabilities, vexStatements });
   writeCycloneDxSbom(sbom, sbomPath);
   return sbomPath;
@@ -6979,7 +7221,7 @@ function maybeGenerateNotices(options, rootDir, rawPolicy, dependencies) {
   const shouldGen = options.generateNotices === true || Boolean(options.noticesPath || rawPolicy?.ci_gates?.output_notices_file);
   if (!shouldGen) return void 0;
   const noticesFileName = rawPolicy?.ci_gates?.output_notices_file || "THIRD_PARTY_NOTICES.md";
-  const noticesPath = options.noticesPath || path4__namespace.join(rootDir, noticesFileName);
+  const noticesPath = options.noticesPath || path5__namespace.join(rootDir, noticesFileName);
   const noticesContent = generateThirdPartyNotices(dependencies);
   writeThirdPartyNotices(noticesContent, noticesPath);
   return noticesPath;
@@ -6991,8 +7233,8 @@ function handleDynamicScaArtifacts(options, rootDir, rawPolicy, dependencies, vu
   };
 }
 function loadLicensePolicy(rootDir, customPath) {
-  const policyFile = customPath || path4__namespace.join(rootDir, "license-policy.yaml");
-  return fs7__namespace.existsSync(policyFile) ? parseLicensePolicy(fs7__namespace.readFileSync(policyFile, "utf-8")) : parseLicensePolicy("");
+  const policyFile = customPath || path5__namespace.join(rootDir, "license-policy.yaml");
+  return fs8__namespace.existsSync(policyFile) ? parseLicensePolicy(fs8__namespace.readFileSync(policyFile, "utf-8")) : parseLicensePolicy("");
 }
 function evaluateDependencyList(dependencies, policy) {
   const violations = [];
@@ -7096,11 +7338,11 @@ var PROTECTED_BYPASS_PATTERNS = [
   /migrations?[\\/]/i
 ];
 function detectProfileFromChange(changeDir) {
-  if (!fs7__namespace.existsSync(changeDir)) return "standard";
-  const specFile = path4__namespace.join(changeDir, "spec.md");
-  if (fs7__namespace.existsSync(specFile)) {
+  if (!fs8__namespace.existsSync(changeDir)) return "standard";
+  const specFile = path5__namespace.join(changeDir, "spec.md");
+  if (fs8__namespace.existsSync(specFile)) {
     try {
-      const rawSpec = fs7__namespace.readFileSync(specFile, "utf-8").replace(/^\uFEFF/, "");
+      const rawSpec = fs8__namespace.readFileSync(specFile, "utf-8").replace(/^\uFEFF/, "");
       const match = rawSpec.match(/^---\r?\n([\s\S]*?)\r?\n---/);
       if (match) {
         const parsedFm = yaml3__default.default.load(match[1]);
@@ -7118,24 +7360,29 @@ function isPathProtectedFromPatch(filePath) {
   return PROTECTED_BYPASS_PATTERNS.some((pattern) => pattern.test(normalized));
 }
 function detectBranchChangeMatch(rootDir, dirs) {
-  if (!fs7__namespace.existsSync(path4__namespace.join(rootDir, ".git"))) return void 0;
-  try {
-    const branch = child_process.execFileSync("git", ["branch", "--show-current"], {
-      cwd: rootDir,
-      encoding: "utf-8",
-      stdio: ["pipe", "pipe", "ignore"]
-    }).trim().toLowerCase();
-    if (!branch) return void 0;
-    return dirs.find((d) => branch.includes(path4__namespace.basename(d).toLowerCase()));
-  } catch {
-    return void 0;
+  let branch = "";
+  if (fs8__namespace.existsSync(path5__namespace.join(rootDir, ".git"))) {
+    try {
+      branch = child_process.execFileSync("git", ["branch", "--show-current"], {
+        cwd: rootDir,
+        encoding: "utf-8",
+        stdio: ["pipe", "pipe", "ignore"]
+      }).trim().toLowerCase();
+    } catch {
+    }
+  }
+  if (!branch) {
+    const ciBranch = (process.env.GITHUB_HEAD_REF || process.env.GITHUB_REF_NAME || process.env.CI_COMMIT_REF_NAME || process.env.BRANCH_NAME || "").toLowerCase();
+    branch = ciBranch;
   }
+  if (!branch) return void 0;
+  return dirs.find((d) => branch.includes(path5__namespace.basename(d).toLowerCase()));
 }
 function resolveActiveChangeDir(rootDir) {
-  const activeRoot = path4__namespace.join(rootDir, "specs", "changes", "active");
-  if (!fs7__namespace.existsSync(activeRoot)) return void 0;
+  const activeRoot = path5__namespace.join(rootDir, "specs", "changes", "active");
+  if (!fs8__namespace.existsSync(activeRoot)) return void 0;
   try {
-    const dirs = fs7__namespace.readdirSync(activeRoot, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => path4__namespace.join(activeRoot, d.name));
+    const dirs = fs8__namespace.readdirSync(activeRoot, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => path5__namespace.join(activeRoot, d.name)).sort((a, b) => canonicalSort(a, b));
     const branchMatch = detectBranchChangeMatch(rootDir, dirs);
     if (branchMatch) return branchMatch;
     return dirs.find((d) => detectProfileFromChange(d) === "patch") || dirs[0];
@@ -7143,8 +7390,12 @@ function resolveActiveChangeDir(rootDir) {
     return void 0;
   }
 }
+function isEphemeralOrIgnored(file) {
+  const norm = file.replace(/\\/g, "/");
+  return norm.startsWith("scratch/") || norm.startsWith("reports/") || norm.startsWith("coverage/") || norm.startsWith("dist/") || norm.startsWith("temp/") || norm.startsWith("tmp/");
+}
 function detectGitDiffFiles(rootDir) {
-  if (!fs7__namespace.existsSync(path4__namespace.join(rootDir, ".git"))) return [];
+  if (!fs8__namespace.existsSync(path5__namespace.join(rootDir, ".git"))) return [];
   try {
     const tracked = child_process.execFileSync("git", ["diff", "--name-only", "HEAD"], {
       cwd: rootDir,
@@ -7157,7 +7408,7 @@ function detectGitDiffFiles(rootDir) {
       stdio: ["pipe", "pipe", "ignore"]
     });
     const combined = `${tracked}
-${untracked}`.split(/\r?\n/).map((f) => f.trim()).filter(Boolean);
+${untracked}`.split(/\r?\n/).map((f) => f.trim()).filter((f) => Boolean(f) && !isEphemeralOrIgnored(f));
     return Array.from(new Set(combined));
   } catch {
     return [];
@@ -7167,19 +7418,19 @@ function resolveChangeDirectory(rootDir, options) {
   if (options.changeDir) return options.changeDir;
   if (options.changeId) {
     const candidates = [
-      path4__namespace.join(rootDir, "specs", options.changeId),
-      path4__namespace.join(rootDir, "specs", "changes", "active", options.changeId),
-      path4__namespace.join(rootDir, "examples", "specs", options.changeId),
-      path4__namespace.join(rootDir, "specs", "changes", "completed", options.changeId)
+      path5__namespace.join(rootDir, "specs", options.changeId),
+      path5__namespace.join(rootDir, "specs", "changes", "active", options.changeId),
+      path5__namespace.join(rootDir, "examples", "specs", options.changeId),
+      path5__namespace.join(rootDir, "specs", "changes", "completed", options.changeId)
     ];
-    return candidates.find((c) => fs7__namespace.existsSync(c));
+    return candidates.find((c) => fs8__namespace.existsSync(c));
   }
   return resolveActiveChangeDir(rootDir);
 }
 function collectPatchViolations(rootDir, modifiedFiles) {
   const violations = [];
   for (const rawFile of modifiedFiles) {
-    const relPath = path4__namespace.isAbsolute(rawFile) ? path4__namespace.relative(rootDir, rawFile) : rawFile;
+    const relPath = path5__namespace.isAbsolute(rawFile) ? path5__namespace.relative(rootDir, rawFile) : rawFile;
     if (isPathProtectedFromPatch(relPath)) {
       violations.push(
         `[ANTI-PATCH-BYPASS] File '${relPath}' is a protected path (security, schemas, architectural decisions, or master policies). Changes with 'patch' profile are strictly prohibited from modifying these paths. Must be reclassified to 'standard' or 'critical'.`
@@ -7192,7 +7443,7 @@ function buildFrictionHeader(profile, success, fileCount) {
   return [
     `# \u{1F6E1}\uFE0F Progressive Friction and Anti-Bypass Verification Report`,
     ``,
-    `> **Date:** ${(/* @__PURE__ */ new Date()).toISOString()}`,
+    `> **Date:** ${resolveDeterministicDate().toISOString()}`,
     `> **Evaluated Profile:** \`${profile.toUpperCase()}\``,
     `> **Verdict:** ${success ? "COMPLIANT \u2705" : "BLOCKED \u274C"}`,
     ``,
@@ -7285,13 +7536,13 @@ function extractManualMetadata(fm, id, manualType, relPath, body) {
 }
 function buildManualItem(rootDir, filePath) {
   try {
-    const raw = fs7__namespace.readFileSync(filePath, "utf-8");
+    const raw = fs8__namespace.readFileSync(filePath, "utf-8");
     const { fm, body } = parseMdFrontmatter(raw);
     const id = typeof fm.id === "string" ? fm.id.trim() : "";
     const rawType = typeof fm.type === "string" ? fm.type.trim() : "";
     const manualType = resolveManualType(id, rawType);
     if (!id || !manualType) return null;
-    const relPath = path4__namespace.relative(rootDir, filePath).replace(/\\/g, "/");
+    const relPath = path5__namespace.relative(rootDir, filePath).replace(/\\/g, "/");
     return extractManualMetadata(fm, id, manualType, relPath, body);
   } catch {
     return null;
@@ -7302,8 +7553,8 @@ function scanManualsInWorkspace(rootDir) {
   const seenIds = /* @__PURE__ */ new Set();
   const items = [];
   for (const relDir of manualDirs) {
-    const fullDir = path4__namespace.join(rootDir, relDir);
-    if (!fs7__namespace.existsSync(fullDir)) continue;
+    const fullDir = path5__namespace.join(rootDir, relDir);
+    if (!fs8__namespace.existsSync(fullDir)) continue;
     for (const file of walkMdFiles(fullDir)) {
       const item = buildManualItem(rootDir, file);
       if (item && !seenIds.has(item.id)) {
@@ -7326,10 +7577,10 @@ function classifyBaselineId(id, type, buckets) {
   }
 }
 function processBaselineFile(file, rootDir, buckets) {
-  const rel = path4__namespace.relative(rootDir, file).replace(/\\/g, "/");
+  const rel = path5__namespace.relative(rootDir, file).replace(/\\/g, "/");
   if (rel.includes("/changes/") || rel.startsWith("changes/")) return;
   try {
-    const { fm } = parseMdFrontmatter(fs7__namespace.readFileSync(file, "utf-8"));
+    const { fm } = parseMdFrontmatter(fs8__namespace.readFileSync(file, "utf-8"));
     const id = typeof fm.id === "string" ? fm.id.trim() : "";
     const status = typeof fm.status === "string" ? fm.status.trim().toLowerCase() : "active";
     if (!id || status === "retired" || status === "deprecated") return;
@@ -7350,8 +7601,8 @@ function collectBaselineTargets(rootDir) {
     enclaves: /* @__PURE__ */ new Set()
   };
   for (const dir of ["product", "architecture", "security", "specs"]) {
-    const fullDir = path4__namespace.join(rootDir, dir);
-    if (fs7__namespace.existsSync(fullDir)) {
+    const fullDir = path5__namespace.join(rootDir, dir);
+    if (fs8__namespace.existsSync(fullDir)) {
       scanDirectoryForBaseline(rootDir, fullDir, buckets);
     }
   }
@@ -7408,10 +7659,10 @@ function detectCurrentGitBranch(rootDir) {
   }
 }
 function resolveActiveChangeProfile(rootDir) {
-  const activeRoot = path4__namespace.join(rootDir, "specs", "changes", "active");
-  if (!fs7__namespace.existsSync(activeRoot)) return "standard";
+  const activeRoot = path5__namespace.join(rootDir, "specs", "changes", "active");
+  if (!fs8__namespace.existsSync(activeRoot)) return "standard";
   try {
-    const dirs = fs7__namespace.readdirSync(activeRoot, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => path4__namespace.join(activeRoot, d.name));
+    const dirs = fs8__namespace.readdirSync(activeRoot, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => path5__namespace.join(activeRoot, d.name));
     const profiles = dirs.map((d) => detectProfileFromChange(d));
     if (profiles.includes("critical")) return "critical";
     if (profiles.includes("patch") && profiles.length === 1) return "patch";
@@ -7548,7 +7799,7 @@ var REQ_TYPES = /* @__PURE__ */ new Set(["requirement", "security-requirement",
 var REQ_CATEGORIES = /* @__PURE__ */ new Set(["functional", "quality", "constraint", "security", "safety"]);
 function computeSha256(content) {
   const normalized = content.replace(/\r\n/g, "\n");
-  return crypto__namespace.createHash("sha256").update(normalized, "utf-8").digest("hex");
+  return crypto3__namespace.createHash("sha256").update(normalized, "utf-8").digest("hex");
 }
 function tokenizeTitle(title) {
   const words = title.toLowerCase().normalize("NFD").replace(/[\u0300-\u036f]/g, "").replace(/[^a-z0-9\s]/g, " ").split(/\s+/).filter((w) => w.length > 2 && !STOP_WORDS.has(w));
@@ -7624,11 +7875,11 @@ function buildRequirementObject(content, fm, body, filePath, relFile) {
 }
 function parseRequirementFile(filePath, rootDir) {
   try {
-    const content = fs7__namespace.readFileSync(filePath, "utf-8");
+    const content = fs8__namespace.readFileSync(filePath, "utf-8");
     const extracted = extractParsedFrontmatter(content);
     if (!extracted) return null;
     const body = content.substring(extracted.matchLen);
-    const relFile = path4__namespace.relative(rootDir, filePath).replace(/\\/g, "/");
+    const relFile = path5__namespace.relative(rootDir, filePath).replace(/\\/g, "/");
     return buildRequirementObject(content, extracted.fm, body, filePath, relFile);
   } catch {
     return null;
@@ -7640,7 +7891,7 @@ function isIgnoredScanPath(relFile) {
 function collectRequirements(rootDir) {
   const reqs = [];
   for (const file of walkMdFiles(rootDir)) {
-    const relFile = path4__namespace.relative(rootDir, file).replace(/\\/g, "/");
+    const relFile = path5__namespace.relative(rootDir, file).replace(/\\/g, "/");
     if (isIgnoredScanPath(relFile)) continue;
     const req = parseRequirementFile(file, rootDir);
     if (req) reqs.push(req);
@@ -7774,7 +8025,7 @@ function buildDuplicatesHeader(result) {
   return [
     `# \u{1F6E1}\uFE0F Duplicate Requirements and Redundancy Audit (Shift-Left Pre-Flight)`,
     ``,
-    `> **Evaluation Date:** ${(/* @__PURE__ */ new Date()).toISOString()}`,
+    `> **Evaluation Date:** ${resolveDeterministicDate().toISOString()}`,
     `> **Verdict:** ${isOk ? "\u2705 COMPLIANT (No blocking duplicates)" : `\u274C BLOCKED (${result.errorCount} duplicate errors detected)`}`,
     `> **Audited Requirements:** ${result.totalRequirements} | **Errors:** ${result.errorCount} | **Warnings:** ${result.warningCount}`,
     ``,
@@ -7897,7 +8148,7 @@ function buildAuditHeader(total, active, expired, invalid) {
   return [
     "# \u{1F4CB} Security Suppressions and Audit Exceptions Inventory",
     "",
-    `> **Generated at:** ${(/* @__PURE__ */ new Date()).toISOString()}`,
+    `> **Generated at:** ${resolveDeterministicDate().toISOString()}`,
     `> **Total Audited Suppressions:** ${total} | **Active:** ${active} | **Expired:** ${expired} | **Invalid:** ${invalid}`,
     "",
     "## 1. Executive Summary",
@@ -8128,10 +8379,10 @@ function isPathExcluded2(relPath, patterns) {
 function walkProjectFiles(dir, rootDir, excludedPatterns = DEFAULT_EXCLUDED_PATTERNS) {
   const results = [];
   try {
-    const entries = fs7__namespace.readdirSync(dir, { withFileTypes: true });
+    const entries = fs8__namespace.readdirSync(dir, { withFileTypes: true }).sort((a, b) => canonicalSort(a.name, b.name));
     for (const entry of entries) {
-      const fullPath = path4__namespace.join(dir, entry.name);
-      const relPath = path4__namespace.relative(rootDir, fullPath).replace(/\\/g, "/");
+      const fullPath = path5__namespace.join(dir, entry.name);
+      const relPath = path5__namespace.relative(rootDir, fullPath).replace(/\\/g, "/");
       if (isPathExcluded2(relPath, excludedPatterns)) continue;
       if (entry.isDirectory()) {
         results.push(...walkProjectFiles(fullPath, rootDir, excludedPatterns));
@@ -8160,8 +8411,8 @@ function pickFirstString(...vals) {
 }
 function parseGitleaksItem(item, rootDir) {
   const rawFile = pickFirstString(item.File, item.file);
-  const filePath = path4__namespace.resolve(rootDir, rawFile);
-  const relPath = path4__namespace.relative(rootDir, filePath).replace(/\\/g, "/");
+  const filePath = path5__namespace.resolve(rootDir, rawFile);
+  const relPath = path5__namespace.relative(rootDir, filePath).replace(/\\/g, "/");
   const ruleId = pickFirstString(item.RuleID, item.ruleID) || "GITLEAKS-MATCH";
   const rawSecret = pickFirstString(item.Secret, item.secret, item.Match);
   const line = item.StartLine ?? item.line ?? 1;
@@ -8234,7 +8485,7 @@ function scanLineForSecrets(line, lineNumber, filePath, relPath, entropyThreshol
 function scanContentForSecrets(content, filePath, rootDir, entropyThreshold = 4.3, collectedSuppressions) {
   const violations = [];
   const lines = content.split(/\r?\n/);
-  const relPath = path4__namespace.relative(rootDir, filePath).replace(/\\/g, "/");
+  const relPath = path5__namespace.relative(rootDir, filePath).replace(/\\/g, "/");
   for (let i = 0; i < lines.length; i++) {
     violations.push(...scanLineForSecrets(lines[i], i + 1, filePath, relPath, entropyThreshold, collectedSuppressions));
   }
@@ -8255,7 +8506,7 @@ function scanDiffItems(diffLines, rootDir, excludePatterns, entropyThreshold) {
   const suppressions = [];
   for (const [relFile, items] of fileGroups) {
     if (isPathExcluded2(relFile, excludePatterns)) continue;
-    const absPath = path4__namespace.resolve(rootDir, relFile);
+    const absPath = path5__namespace.resolve(rootDir, relFile);
     for (const item of items) {
       const lineViolations = scanLineForSecrets(item.content, item.lineNumber, absPath, relFile, entropyThreshold, suppressions);
       for (const v of lineViolations) {
@@ -8271,7 +8522,7 @@ function scanAllProjectFiles(rootDir, excludePatterns, entropyThreshold) {
   const suppressions = [];
   for (const file of allFiles) {
     try {
-      const content = fs7__namespace.readFileSync(file, "utf-8");
+      const content = fs8__namespace.readFileSync(file, "utf-8");
       findings.push(...scanContentForSecrets(content, file, rootDir, entropyThreshold, suppressions));
     } catch {
     }
@@ -8328,7 +8579,7 @@ function buildReportHeader2(result) {
   return [
     `# \u{1F510} Deterministic Secrets and Credentials Audit (Gitleaks Gate)`,
     ``,
-    `> **Evaluation Date:** ${(/* @__PURE__ */ new Date()).toISOString()}`,
+    `> **Evaluation Date:** ${resolveDeterministicDate().toISOString()}`,
     `> **Verdict:** ${isOk ? "\u2705 COMPLIANT (No exposed secrets or credentials)" : `\u274C BLOCKED (${result.findingsCount} exposed credentials detected)`}`,
     `> **Audited Files:** ${result.totalFilesScanned} | **Security Violations:** ${result.findingsCount}`,
     `> **Native Gitleaks Engine:** ${result.scannedWithGitleaks ? "\u{1F7E2} Active / Integrated" : "\u26AA Deterministic Native Scanner (@aisdlc/core)"}`,
@@ -8497,8 +8748,8 @@ function runSemgrepCli(rootDir) {
       const parsed = JSON.parse(output);
       if (Array.isArray(parsed.results)) {
         for (const item of parsed.results) {
-          const filePath = path4__namespace.resolve(rootDir, item.path);
-          const relPath = path4__namespace.relative(rootDir, filePath).replace(/\\/g, "/");
+          const filePath = path5__namespace.resolve(rootDir, item.path);
+          const relPath = path5__namespace.relative(rootDir, filePath).replace(/\\/g, "/");
           violations.push({
             filePath,
             relPath,
@@ -8525,15 +8776,15 @@ function isSastExcluded(relPath, excludes) {
 function walkSourceFiles(dir, rootDir, excludes = DEFAULT_SAST_EXCLUDES) {
   const files = [];
   try {
-    const entries = fs7__namespace.readdirSync(dir, { withFileTypes: true });
+    const entries = fs8__namespace.readdirSync(dir, { withFileTypes: true }).sort((a, b) => canonicalSort(a.name, b.name));
     for (const entry of entries) {
-      const fullPath = path4__namespace.join(dir, entry.name);
-      const relPath = path4__namespace.relative(rootDir, fullPath).replace(/\\/g, "/");
+      const fullPath = path5__namespace.join(dir, entry.name);
+      const relPath = path5__namespace.relative(rootDir, fullPath).replace(/\\/g, "/");
       if (isSastExcluded(relPath, excludes)) continue;
       if (entry.isDirectory()) {
         files.push(...walkSourceFiles(fullPath, rootDir, excludes));
       } else if (entry.isFile()) {
-        const ext = path4__namespace.extname(entry.name).toLowerCase();
+        const ext = path5__namespace.extname(entry.name).toLowerCase();
         if (GENERAL_SOURCE_EXTENSIONS.includes(ext)) {
           files.push(fullPath);
         }
@@ -8558,11 +8809,11 @@ function checkRuleMatch(rule, line, ext, minSeverity) {
 }
 function scanFileForSast(filePath, rootDir, minSeverity = "HIGH", collectedSuppressions) {
   const violations = [];
-  const ext = path4__namespace.extname(filePath).toLowerCase();
+  const ext = path5__namespace.extname(filePath).toLowerCase();
   try {
-    const content = fs7__namespace.readFileSync(filePath, "utf-8");
+    const content = fs8__namespace.readFileSync(filePath, "utf-8");
     const lines = content.split(/\r?\n/);
-    const relPath = path4__namespace.relative(rootDir, filePath).replace(/\\/g, "/");
+    const relPath = path5__namespace.relative(rootDir, filePath).replace(/\\/g, "/");
     for (let i = 0; i < lines.length; i++) {
       const line = lines[i];
       if (checkLineSuppression(line, relPath, i + 1, collectedSuppressions)) continue;
@@ -8588,8 +8839,8 @@ function scanFileForSast(filePath, rootDir, minSeverity = "HIGH", collectedSuppr
 function collectSastFiles(rootDir, targetDirs) {
   const files = [];
   for (const tDir of targetDirs) {
-    const fullDir = path4__namespace.join(rootDir, tDir);
-    if (fs7__namespace.existsSync(fullDir)) {
+    const fullDir = path5__namespace.join(rootDir, tDir);
+    if (fs8__namespace.existsSync(fullDir)) {
       files.push(...walkSourceFiles(fullDir, rootDir));
     }
   }
@@ -8635,7 +8886,7 @@ function buildSastHeader(isOk, violationsCount, totalFilesScanned) {
   return [
     `# \u{1F6E1}\uFE0F Shift-Left SAST Audit (Static Application Security Testing)`,
     ``,
-    `> **Evaluation Date:** ${(/* @__PURE__ */ new Date()).toISOString()}`,
+    `> **Evaluation Date:** ${resolveDeterministicDate().toISOString()}`,
     `> **Verdict:** ${verdict}`,
     `> **Audited Code Files:** ${totalFilesScanned} | **SAST Violations:** ${violationsCount}`,
     ``,
@@ -8824,22 +9075,31 @@ var PII_SAST_RULES = [
     pattern: /\b(?:ssn|dni|nif|tax_?id|national_?id)\s*[:=]\s*['"](?:\d{3}-\d{2}-\d{4}|\d{8}[A-HJ-NP-TV-Z])['"]/i
   }
 ];
-function loadPrivacyPolicy(rootDir, policyPath) {
-  const candidate = policyPath ? path4__namespace.isAbsolute(policyPath) ? policyPath : path4__namespace.join(rootDir, policyPath) : path4__namespace.join(rootDir, "privacy-policy.yaml");
-  if (!fs7__namespace.existsSync(candidate)) return DEFAULT_PRIVACY_POLICY;
+function parsePrivacyDoc(raw, candidate) {
+  let parsed;
   try {
-    const parsed = yaml3__default.default.load(fs7__namespace.readFileSync(candidate, "utf-8"));
-    if (!parsed || typeof parsed !== "object") return DEFAULT_PRIVACY_POLICY;
-    return {
-      ...DEFAULT_PRIVACY_POLICY,
-      ...parsed,
-      classifications: { ...DEFAULT_PRIVACY_POLICY.classifications, ...parsed.classifications || {} },
-      agent_guardrails: { ...DEFAULT_PRIVACY_POLICY.agent_guardrails, ...parsed.agent_guardrails || {} },
-      ci_gates: { ...DEFAULT_PRIVACY_POLICY.ci_gates, ...parsed.ci_gates || {} }
-    };
-  } catch {
-    return DEFAULT_PRIVACY_POLICY;
+    parsed = yaml3__default.default.load(raw);
+  } catch (err) {
+    throw new Error(`[AI-SDLC Fail-Closed] Invalid YAML in privacy-policy '${candidate}': ${err instanceof Error ? err.message : String(err)}`);
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error(`[AI-SDLC Fail-Closed] Invalid privacy policy structure in '${candidate}': root must be a YAML mapping`);
   }
+  return parsed;
+}
+function loadPrivacyPolicy(rootDir = process.cwd(), policyPath) {
+  const candidate = policyPath ? path5__namespace.isAbsolute(policyPath) ? policyPath : path5__namespace.join(rootDir, policyPath) : path5__namespace.join(rootDir, "privacy-policy.yaml");
+  if (!fs8__namespace.existsSync(candidate)) return DEFAULT_PRIVACY_POLICY;
+  const raw = fs8__namespace.readFileSync(candidate, "utf-8");
+  if (!raw || !raw.trim()) return DEFAULT_PRIVACY_POLICY;
+  const parsed = parsePrivacyDoc(raw, candidate);
+  return {
+    ...DEFAULT_PRIVACY_POLICY,
+    ...parsed,
+    classifications: { ...DEFAULT_PRIVACY_POLICY.classifications, ...parsed.classifications || {} },
+    agent_guardrails: { ...DEFAULT_PRIVACY_POLICY.agent_guardrails, ...parsed.agent_guardrails || {} },
+    ci_gates: { ...DEFAULT_PRIVACY_POLICY.ci_gates, ...parsed.ci_gates || {} }
+  };
 }
 function isLineExemptFromPrivacyScan(line) {
   return line.includes("ai-sdlc:allow-pii") || line.includes("ai-sdlc:allow-sast") || line.includes("nosec");
@@ -8856,9 +9116,9 @@ function shouldApplyPiiRule(rule, policy) {
 function scanFileForPrivacyViolations(filePath, rootDir, policy = DEFAULT_PRIVACY_POLICY) {
   const violations = [];
   try {
-    const content = fs7__namespace.readFileSync(filePath, "utf-8");
+    const content = fs8__namespace.readFileSync(filePath, "utf-8");
     const lines = content.split(/\r?\n/);
-    const relPath = path4__namespace.relative(rootDir, filePath).replace(/\\/g, "/");
+    const relPath = path5__namespace.relative(rootDir, filePath).replace(/\\/g, "/");
     for (let i = 0; i < lines.length; i++) {
       const line = lines[i];
       if (isLineExemptFromPrivacyScan(line)) continue;
@@ -8967,10 +9227,10 @@ function discoverPrivacyArtifacts(rootDir) {
     dpiaStatuses: /* @__PURE__ */ new Map()
   };
   for (const file of walkMdFiles(rootDir)) {
-    const relPath = path4__namespace.relative(rootDir, file).replace(/\\/g, "/");
+    const relPath = path5__namespace.relative(rootDir, file).replace(/\\/g, "/");
     if (isExcludedPrivacyMd(relPath)) continue;
     try {
-      const fm = extractFrontmatter(fs7__namespace.readFileSync(file, "utf-8"));
+      const fm = extractFrontmatter(fs8__namespace.readFileSync(file, "utf-8"));
       if (fm && fm.id) classifyPrivacyMarkdown(fm, relPath, acc);
     } catch {
     }
@@ -9015,7 +9275,7 @@ function checkAssetRopaRegistration(asset, ropaRecords, policy, fullPath) {
 }
 function auditDataAssetGovernance(asset, ropaRecords, policy, rootDir) {
   if (!isSensitiveClassification(asset.classification)) return [];
-  const fullPath = path4__namespace.join(rootDir, asset.filePath);
+  const fullPath = path5__namespace.join(rootDir, asset.filePath);
   const v1 = checkAssetRetention(asset, policy, fullPath);
   const v2 = checkAssetRopaRegistration(asset, ropaRecords, policy, fullPath);
   return [v1, v2].filter((v) => v !== null);
@@ -9087,8 +9347,8 @@ function checkRopaDpiaApproval(ropa, dataAssets, dpiaStatuses, fullPath) {
 function collectSourceFilesForPrivacy(rootDir, targetDirs) {
   const files = [];
   for (const dir of targetDirs) {
-    const fullDir = path4__namespace.join(rootDir, dir);
-    if (fs7__namespace.existsSync(fullDir)) {
+    const fullDir = path5__namespace.join(rootDir, dir);
+    if (fs8__namespace.existsSync(fullDir)) {
       files.push(...walkSourceFiles(fullDir, rootDir));
     }
   }
@@ -9178,15 +9438,13 @@ function generatePrivacyReportMarkdown(result, policy = DEFAULT_PRIVACY_POLICY)
 function writePrivacyOutputsIfNeeded(result, options, policy, rootDir) {
   if (options.generateRopa) {
     const relRopa = options.ropaOutputPath || policy.ci_gates.output_ropa_file || "reports/ROPA_INVENTORY.md";
-    const fullRopa = path4__namespace.isAbsolute(relRopa) ? relRopa : path4__namespace.join(rootDir, relRopa);
-    fs7__namespace.mkdirSync(path4__namespace.dirname(fullRopa), { recursive: true });
-    fs7__namespace.writeFileSync(fullRopa, result.ropaMarkdown, "utf-8");
+    const fullRopa = path5__namespace.isAbsolute(relRopa) ? relRopa : path5__namespace.join(rootDir, relRopa);
+    writeReportFileIfChanged(fullRopa, result.ropaMarkdown);
     result.ropaOutputPath = fullRopa;
   }
   if (options.reportOutputPath) {
-    const fullReport = path4__namespace.isAbsolute(options.reportOutputPath) ? options.reportOutputPath : path4__namespace.join(rootDir, options.reportOutputPath);
-    fs7__namespace.mkdirSync(path4__namespace.dirname(fullReport), { recursive: true });
-    fs7__namespace.writeFileSync(fullReport, result.reportMarkdown, "utf-8");
+    const fullReport = path5__namespace.isAbsolute(options.reportOutputPath) ? options.reportOutputPath : path5__namespace.join(rootDir, options.reportOutputPath);
+    writeReportFileIfChanged(fullReport, result.reportMarkdown);
     result.reportOutputPath = fullReport;
   }
 }
@@ -9198,7 +9456,7 @@ function evaluateDiscoveredPrivacyGovernance(discovered, policy, rootDir) {
   }
   let dpiaRequiredCount = 0;
   for (const ropa of discovered.ropaRecords) {
-    const fullPath = path4__namespace.join(rootDir, ropa.filePath);
+    const fullPath = path5__namespace.join(rootDir, ropa.filePath);
     violations.push(...checkRopaControlsAndSubprocessors(ropa, governedRopaIds, policy, fullPath));
     const dpiaCheck = checkRopaDpiaApproval(ropa, discovered.dataAssets, discovered.dpiaStatuses, fullPath);
     if (dpiaCheck.dpiaRequired) dpiaRequiredCount++;
@@ -9244,7 +9502,7 @@ function calculateRating(mi, cc) {
   return "F";
 }
 function detectLanguage(filePath) {
-  const ext = path4__namespace.extname(filePath).toLowerCase();
+  const ext = path5__namespace.extname(filePath).toLowerCase();
   switch (ext) {
     case ".ts":
       return "TypeScript";
@@ -9269,7 +9527,7 @@ function detectLanguage(filePath) {
 }
 function parseJsonSummaryFile(filePath, relSource) {
   try {
-    const raw = JSON.parse(fs7__namespace.readFileSync(filePath, "utf-8"));
+    const raw = JSON.parse(fs8__namespace.readFileSync(filePath, "utf-8"));
     const total = raw.total;
     if (!total || typeof total !== "object") return null;
     const linesPct = Number(total.lines?.pct);
@@ -9292,7 +9550,7 @@ function updateLcovCounts(line, counts) {
 }
 function parseLcovFile(filePath, relSource) {
   try {
-    const lines = fs7__namespace.readFileSync(filePath, "utf-8").split(/\r?\n/);
+    const lines = fs8__namespace.readFileSync(filePath, "utf-8").split(/\r?\n/);
     const counts = { LF: 0, LH: 0, BRF: 0, BRH: 0, FNF: 0, FNH: 0 };
     for (const line of lines) {
       updateLcovCounts(line, counts);
@@ -9312,16 +9570,16 @@ function parseLcovFile(filePath, relSource) {
 function readCodeCoverageSummary(rootDir = process.cwd()) {
   const jsonCandidates = ["coverage/coverage-summary.json", "reports/coverage-summary.json"];
   for (const rel of jsonCandidates) {
-    const full = path4__namespace.join(rootDir, rel);
-    if (fs7__namespace.existsSync(full)) {
+    const full = path5__namespace.join(rootDir, rel);
+    if (fs8__namespace.existsSync(full)) {
       const parsed = parseJsonSummaryFile(full, rel);
       if (parsed) return parsed;
     }
   }
   const lcovCandidates = ["coverage/lcov.info", "lcov.info", "reports/lcov.info"];
   for (const rel of lcovCandidates) {
-    const full = path4__namespace.join(rootDir, rel);
-    if (fs7__namespace.existsSync(full)) {
+    const full = path5__namespace.join(rootDir, rel);
+    if (fs8__namespace.existsSync(full)) {
       const parsed = parseLcovFile(full, rel);
       if (parsed) return parsed;
     }
@@ -9406,7 +9664,7 @@ function buildReportHeader3(verdict, rating, mi, cc) {
   return [
     `# \u{1F4CA} Formal Quality and Release Gate Report (AI-SDLC)`,
     "",
-    `> **Generation Date:** ${(/* @__PURE__ */ new Date()).toISOString()}`,
+    `> **Generation Date:** ${resolveDeterministicDate().toISOString()}`,
     `> **Release Gate Verdict:** ${status}`,
     `> **Global Rating:** **\`${rating}\`** (MI Index: ${mi}/100, Average CC: ${cc})`
   ];
@@ -9457,9 +9715,8 @@ function renderQualityReportMarkdown(gateResult, coverage, accumulated, averages
   return [...header, "", "---", "", ...table, "", "---", "", ...polyglot, ...violationsSection, "", EVALUATION_STANDARDS_MD].join("\n");
 }
 function writeQualityReportFile(rootDir, markdown) {
-  const reportsDir = path4__namespace.join(rootDir, "reports");
-  fs7__namespace.mkdirSync(reportsDir, { recursive: true });
-  fs7__namespace.writeFileSync(path4__namespace.join(reportsDir, "QUALITY_REPORT.md"), markdown, "utf-8");
+  const targetPath = path5__namespace.join(rootDir, "reports", "QUALITY_REPORT.md");
+  return writeReportFileIfChanged(targetPath, markdown);
 }
 function generateQualityReport(options = {}) {
   const rootDir = options.rootDir || process.cwd();
@@ -9601,9 +9858,9 @@ Flujo de Integraci\xF3n (Merges):`,
   };
 }
 function resolveVersionFromProposal(changeDir) {
-  const proposalFile = path4__namespace.join(changeDir, "proposal.md");
-  if (!fs7__namespace.existsSync(proposalFile)) return "1.0.0";
-  const propContent = fs7__namespace.readFileSync(proposalFile, "utf-8");
+  const proposalFile = path5__namespace.join(changeDir, "proposal.md");
+  if (!fs8__namespace.existsSync(proposalFile)) return "1.0.0";
+  const propContent = fs8__namespace.readFileSync(proposalFile, "utf-8");
   const propFm = propContent.match(/^---\r?\n([\s\S]*?)\r?\n---/);
   if (!propFm) return "1.0.0";
   const parsedProp = yaml3__default.default.load(propFm[1]);
@@ -9620,9 +9877,9 @@ function isTaskMatchingId(currentId, cleanTaskId) {
   return currentLower === targetLower || currentLower.startsWith(`${targetLower}-`) || targetLower.startsWith(`${currentLower}-`);
 }
 function parseTasksFrontmatter(tasksFile) {
-  if (!fs7__namespace.existsSync(tasksFile)) return null;
+  if (!fs8__namespace.existsSync(tasksFile)) return null;
   try {
-    const content = fs7__namespace.readFileSync(tasksFile, "utf-8");
+    const content = fs8__namespace.readFileSync(tasksFile, "utf-8");
     const fmMatch = content.match(/^---\r?\n([\s\S]*?)\r?\n---/);
     if (!fmMatch) return null;
     const fm = yaml3__default.default.load(fmMatch[1]);
@@ -9644,7 +9901,7 @@ function buildTaskMatch(currentId, currentTitle, rawChangeId, changeDir, version
   };
 }
 function inspectChangeTasks(changeDir, entryName, cleanTaskId, availableTasks) {
-  const fm = parseTasksFrontmatter(path4__namespace.join(changeDir, "tasks.md"));
+  const fm = parseTasksFrontmatter(path5__namespace.join(changeDir, "tasks.md"));
   if (!fm || !fm.tasks) return void 0;
   const rawChangeId = resolveRawChangeId(fm, entryName);
   const versionStr = resolveChangeVersion(fm, changeDir);
@@ -9665,16 +9922,16 @@ function locateTaskInActiveChanges(taskId, rootDir = process.cwd()) {
   if (!cleanTaskId) {
     return { found: false, error: "Debe especificar un identificador de tarea v\xE1lido (ej. TSK-001)." };
   }
-  const activeChangesDir = path4__namespace.join(rootDir, "specs", "changes", "active");
-  if (!fs7__namespace.existsSync(activeChangesDir)) {
+  const activeChangesDir = path5__namespace.join(rootDir, "specs", "changes", "active");
+  if (!fs8__namespace.existsSync(activeChangesDir)) {
     return { found: false, error: `No se encontr\xF3 el directorio de cambios activos en '${activeChangesDir}'.` };
   }
   const availableTasks = [];
-  const candidateDirs = fs7__namespace.readdirSync(activeChangesDir, { withFileTypes: true });
+  const candidateDirs = fs8__namespace.readdirSync(activeChangesDir, { withFileTypes: true });
   let matchedTask;
   for (const entry of candidateDirs) {
     if (!entry.isDirectory()) continue;
-    const changeDir = path4__namespace.join(activeChangesDir, entry.name);
+    const changeDir = path5__namespace.join(activeChangesDir, entry.name);
     const m = inspectChangeTasks(changeDir, entry.name, cleanTaskId, availableTasks);
     if (m && !matchedTask) {
       matchedTask = m;
@@ -9711,14 +9968,14 @@ function detectExistingFeatureBranch(branches, dirName, changeId, changeSlug) {
     (b) => b.startsWith("feat/") && (b.toLowerCase().includes(dirName.toLowerCase()) || b.toLowerCase().includes(changeId.toLowerCase())) && classifyBranch(b).valid
   );
   if (existing) return existing;
-  const normalizedName = slugify(changeSlug).replace(/^(chg|bug|feat)-(\d+)/i, (_, p, n) => `${p.toUpperCase()}-${n}`);
+  const normalizedName = slugify2(changeSlug).replace(/^(chg|bug|feat)-(\d+)/i, (_, p, n) => `${p.toUpperCase()}-${n}`);
   return `feat/${normalizedName}`;
 }
 function buildDefaultTaskSuffix(taskId, taskTitle) {
   let taskSuffix = taskId.toLowerCase();
   const hasSlug = taskSuffix.includes("-") && taskSuffix.split("-").length > 2;
   if (!hasSlug && taskTitle) {
-    const titleSlug = slugify(taskTitle).split("-").slice(0, 4).join("-");
+    const titleSlug = slugify2(taskTitle).split("-").slice(0, 4).join("-");
     if (titleSlug) {
       taskSuffix = `${taskSuffix}-${titleSlug}`;
     }
@@ -9738,7 +9995,7 @@ function resolveBranchHierarchy(match, rootDir = process.cwd()) {
   const branches = getGitBranchList(rootDir);
   const cleanVersion = (match.version || "1.0.0").replace(/^v/, "");
   const releaseBranch = detectExistingReleaseBranch(branches, cleanVersion);
-  const dirName = path4__namespace.basename(match.changeDir);
+  const dirName = path5__namespace.basename(match.changeDir);
   const changeSlug = dirName.replace(/^(chg|CHG)-/i, (m) => m.toUpperCase());
   const featureBranch = detectExistingFeatureBranch(branches, dirName, match.changeId, changeSlug);
   const parentIdMatch = featureBranch.replace(/^(feat|feature)\//i, "").match(/^[a-zA-Z0-9]+-[a-zA-Z0-9]+/);
@@ -10045,13 +10302,13 @@ function getGitConfigValue(key, cwd) {
 }
 function readSessionTelemetry(cwd) {
   const possiblePaths = [
-    path4__namespace.join(cwd, ".ai-sdlc", "session-telemetry.json"),
-    path4__namespace.join(cwd, ".ai-sdlc", "agent-session.json")
+    path5__namespace.join(cwd, ".ai-sdlc", "session-telemetry.json"),
+    path5__namespace.join(cwd, ".ai-sdlc", "agent-session.json")
   ];
   for (const p of possiblePaths) {
-    if (fs7__namespace.existsSync(p)) {
+    if (fs8__namespace.existsSync(p)) {
       try {
-        const raw = fs7__namespace.readFileSync(p, "utf-8");
+        const raw = fs8__namespace.readFileSync(p, "utf-8");
         return JSON.parse(raw);
       } catch {
       }
@@ -10271,20 +10528,20 @@ if [ -f "$TELEMETRY_FILE" ]; then
 fi
 `;
 function installGitHooks(rootDir = process.cwd()) {
-  const gitDir = path4__namespace.join(rootDir, ".git");
-  if (!fs7__namespace.existsSync(gitDir)) {
+  const gitDir = path5__namespace.join(rootDir, ".git");
+  if (!fs8__namespace.existsSync(gitDir)) {
     return {
       success: false,
       error: `No se encontr\xF3 el directorio Git en '${gitDir}'.`
     };
   }
-  const hooksDir = path4__namespace.join(gitDir, "hooks");
-  if (!fs7__namespace.existsSync(hooksDir)) {
-    fs7__namespace.mkdirSync(hooksDir, { recursive: true });
+  const hooksDir = path5__namespace.join(gitDir, "hooks");
+  if (!fs8__namespace.existsSync(hooksDir)) {
+    fs8__namespace.mkdirSync(hooksDir, { recursive: true });
   }
-  const hookPath = path4__namespace.join(hooksDir, "prepare-commit-msg");
+  const hookPath = path5__namespace.join(hooksDir, "prepare-commit-msg");
   try {
-    fs7__namespace.writeFileSync(hookPath, PREPARE_COMMIT_MSG_SCRIPT, { encoding: "utf-8", mode: 493 });
+    fs8__namespace.writeFileSync(hookPath, PREPARE_COMMIT_MSG_SCRIPT, { encoding: "utf-8", mode: 493 });
     return {
       success: true,
       hookPath
@@ -10625,16 +10882,16 @@ function formatReleaseKpiMarkdown(report) {
   ].join("\n");
 }
 function writeReleaseKpiReport(report, options = {}) {
-  const root = options.outputDir || (options.rootDir ? path4__namespace.join(options.rootDir, "reports", "releases") : path4__namespace.join(process.cwd(), "reports", "releases"));
-  if (!fs7__namespace.existsSync(root)) {
-    fs7__namespace.mkdirSync(root, { recursive: true });
+  const root = options.outputDir || (options.rootDir ? path5__namespace.join(options.rootDir, "reports", "releases") : path5__namespace.join(process.cwd(), "reports", "releases"));
+  if (!fs8__namespace.existsSync(root)) {
+    fs8__namespace.mkdirSync(root, { recursive: true });
   }
   const cleanBranchName = report.releaseBranch.replace(/[^a-zA-Z0-9.-]/g, "_");
-  const mdPath = path4__namespace.join(root, `RELEASE_KPIS_${cleanBranchName}.md`);
-  const jsonPath = path4__namespace.join(root, `release_${cleanBranchName}.kpis.json`);
+  const mdPath = path5__namespace.join(root, `RELEASE_KPIS_${cleanBranchName}.md`);
+  const jsonPath = path5__namespace.join(root, `release_${cleanBranchName}.kpis.json`);
   const mdContent = formatReleaseKpiMarkdown(report);
-  fs7__namespace.writeFileSync(mdPath, mdContent, "utf-8");
-  fs7__namespace.writeFileSync(jsonPath, JSON.stringify(report, null, 2), "utf-8");
+  fs8__namespace.writeFileSync(mdPath, mdContent, "utf-8");
+  fs8__namespace.writeFileSync(jsonPath, JSON.stringify(report, null, 2), "utf-8");
   return { markdownPath: mdPath, jsonPath };
 }
 var cachedScript = null;
@@ -10643,19 +10900,19 @@ function resolveCytoscapePath() {
   try {
     const req = module$1.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('index.cjs', document.baseURI).href)));
     const entryPath = req.resolve("cytoscape");
-    const dir = path4__namespace.dirname(entryPath);
-    const minPath = path4__namespace.join(dir, "cytoscape.min.js");
-    if (fs7__namespace.existsSync(minPath)) {
+    const dir = path5__namespace.dirname(entryPath);
+    const minPath = path5__namespace.join(dir, "cytoscape.min.js");
+    if (fs8__namespace.existsSync(minPath)) {
       return minPath;
     }
   } catch {
   }
   const searchDirs = [
-    path4__namespace.join(process.cwd(), "node_modules", "cytoscape", "dist", "cytoscape.min.js"),
-    path4__namespace.join(process.cwd(), "packages", "core", "node_modules", "cytoscape", "dist", "cytoscape.min.js")
+    path5__namespace.join(process.cwd(), "node_modules", "cytoscape", "dist", "cytoscape.min.js"),
+    path5__namespace.join(process.cwd(), "packages", "core", "node_modules", "cytoscape", "dist", "cytoscape.min.js")
   ];
   for (const candidate of searchDirs) {
-    if (fs7__namespace.existsSync(candidate)) {
+    if (fs8__namespace.existsSync(candidate)) {
       return candidate;
     }
   }
@@ -10668,7 +10925,7 @@ function getCytoscapeScript() {
   const scriptPath = resolveCytoscapePath();
   if (scriptPath) {
     try {
-      cachedScript = fs7__namespace.readFileSync(scriptPath, "utf-8");
+      cachedScript = fs8__namespace.readFileSync(scriptPath, "utf-8");
       return cachedScript;
     } catch {
     }
@@ -10768,7 +11025,7 @@ function extractFrontmatter2(fileContent) {
   }
 }
 function toScannedArtifact(filePath, relPath) {
-  const fileContent = fs7__namespace.readFileSync(filePath, "utf-8");
+  const fileContent = fs8__namespace.readFileSync(filePath, "utf-8");
   const fm = extractFrontmatter2(fileContent);
   const id = typeof fm?.id === "string" ? fm.id.trim() : "";
   if (!id) return null;
@@ -10780,12 +11037,12 @@ function toScannedArtifact(filePath, relPath) {
   return { id, type: classified.type, title, layer: classified.layer, filePath: relPath, content, frontmatter: fm };
 }
 function parseAndCatalogArtifactFile(rootDir, filePath, scannedMap, archViewByBasename) {
-  const relPath = path4__namespace.relative(rootDir, filePath).replace(/\\/g, "/");
+  const relPath = path5__namespace.relative(rootDir, filePath).replace(/\\/g, "/");
   if (relPath.includes("/changes/") || relPath.startsWith("changes/")) return;
   const scannedArt = toScannedArtifact(filePath, relPath);
   if (!scannedArt) return;
   if (scannedArt.layer === "architecture" && scannedArt.type === "architecture") {
-    archViewByBasename.set(path4__namespace.basename(relPath), scannedArt);
+    archViewByBasename.set(path5__namespace.basename(relPath), scannedArt);
   } else {
     scannedMap.set(scannedArt.id, scannedArt);
   }
@@ -10795,8 +11052,8 @@ function scanWorkspaceArtifacts(rootDir) {
   const archViewByBasename = /* @__PURE__ */ new Map();
   const artifactDirs = ["product", "architecture", "specs", "security", "privacy"];
   for (const dirName of artifactDirs) {
-    const fullDirPath = path4__namespace.join(rootDir, dirName);
-    if (fs7__namespace.existsSync(fullDirPath)) {
+    const fullDirPath = path5__namespace.join(rootDir, dirName);
+    if (fs8__namespace.existsSync(fullDirPath)) {
       for (const f of walkMdFiles(fullDirPath)) {
         parseAndCatalogArtifactFile(rootDir, f, scannedArtifactsMap, archViewByBasename);
       }
@@ -10856,9 +11113,9 @@ function addTraceArchEdges(r, status, archViewByBasename, nodeMap, addEdge) {
   }
 }
 function loadTestContentPreview(filePath) {
-  if (!fs7__namespace.existsSync(filePath)) return void 0;
+  if (!fs8__namespace.existsSync(filePath)) return void 0;
   try {
-    const testContent = fs7__namespace.readFileSync(filePath, "utf-8");
+    const testContent = fs8__namespace.readFileSync(filePath, "utf-8");
     const lang = filePath.endsWith(".feature") ? "gherkin" : "typescript";
     const preview = testContent.substring(0, 1500) + (testContent.length > 1500 ? "\n... (truncated)" : "");
     return "```" + lang + "\n" + preview + "\n```";
@@ -10868,10 +11125,10 @@ function loadTestContentPreview(filePath) {
 }
 function ensureTestNode(t, testId, rootDir, nodeMap) {
   if (nodeMap.has(testId)) return;
-  const fullTestPath = path4__namespace.isAbsolute(t) ? t : path4__namespace.join(rootDir, t);
+  const fullTestPath = path5__namespace.isAbsolute(t) ? t : path5__namespace.join(rootDir, t);
   nodeMap.set(testId, {
     id: testId,
-    label: path4__namespace.basename(t),
+    label: path5__namespace.basename(t),
     title: t,
     type: t.endsWith(".feature") ? "bdd-feature" : "code-test",
     layer: "test",
@@ -13016,9 +13273,10 @@ ${manualsTab}
 ${kpisTab}
   </main>`;
 }
-function renderDashboardHtml(graphData, metricsData, title = "AI-SDLC: Dashboard Interactivo de Trazabilidad y Calidad") {
+function renderDashboardHtml(graphData, metricsData, title = "AI-SDLC: Dashboard Interactivo de Trazabilidad y Calidad", generationDate) {
   const head = renderDashboardHead(title);
-  const header = renderHeaderHtml(graphData.issueCount, (/* @__PURE__ */ new Date()).toISOString());
+  const effectiveDate = generationDate || resolveDeterministicDate().toISOString();
+  const header = renderHeaderHtml(graphData.issueCount, effectiveDate);
   const nav = renderNavTabsHtml();
   const main = renderDashboardMain(metricsData);
   const sidebar = renderTaskSidebarHtml();
@@ -13048,9 +13306,9 @@ var IGNORED_SCAN_DIRS = /* @__PURE__ */ new Set([
   ".agent"
 ]);
 function readKpiFilesInDir(dir) {
-  if (!fs7__namespace.existsSync(dir)) return [];
+  if (!fs8__namespace.existsSync(dir)) return [];
   try {
-    return fs7__namespace.readdirSync(dir).filter((f) => f.endsWith(".kpis.json")).map((f) => path4__namespace.join(dir, f));
+    return fs8__namespace.readdirSync(dir).filter((f) => f.endsWith(".kpis.json")).map((f) => path5__namespace.join(dir, f));
   } catch {
     return [];
   }
@@ -13058,11 +13316,11 @@ function readKpiFilesInDir(dir) {
 function scanSubdirKpiFiles(dir, depth, acc) {
   if (depth > 4) return;
   try {
-    const entries = fs7__namespace.readdirSync(dir, { withFileTypes: true });
+    const entries = fs8__namespace.readdirSync(dir, { withFileTypes: true });
     for (const entry of entries) {
       if (!entry.isDirectory() || IGNORED_SCAN_DIRS.has(entry.name)) continue;
-      const sub = path4__namespace.join(dir, entry.name);
-      if (entry.name === "releases" && path4__namespace.basename(dir) === "reports") {
+      const sub = path5__namespace.join(dir, entry.name);
+      if (entry.name === "releases" && path5__namespace.basename(dir) === "reports") {
         acc.push(...readKpiFilesInDir(sub));
       } else {
         scanSubdirKpiFiles(sub, depth + 1, acc);
@@ -13072,7 +13330,7 @@ function scanSubdirKpiFiles(dir, depth, acc) {
   }
 }
 function findKpiJsonFiles(rootDir) {
-  const primaryFiles = readKpiFilesInDir(path4__namespace.join(rootDir, "reports", "releases"));
+  const primaryFiles = readKpiFilesInDir(path5__namespace.join(rootDir, "reports", "releases"));
   if (primaryFiles.length > 0) return primaryFiles;
   const found = [];
   scanSubdirKpiFiles(rootDir, 0, found);
@@ -13083,7 +13341,7 @@ function collectHistoricalKpis(rootDir) {
   const kpiFiles = findKpiJsonFiles(rootDir);
   for (const fullPath of kpiFiles) {
     try {
-      const content = fs7__namespace.readFileSync(fullPath, "utf-8");
+      const content = fs8__namespace.readFileSync(fullPath, "utf-8");
       const report = JSON.parse(content);
       if (!items.some((it) => it.id === report.releaseBranch && it.timestamp === report.generatedAt)) {
         items.push({
@@ -13289,15 +13547,11 @@ function computeGateAverages(gateResults) {
 }
 function generateDashboardReport(options = {}) {
   const rootDir = options.rootDir || process.cwd();
-  const outputPath = options.outputPath || path4__namespace.join(rootDir, "reports", "dashboard.html");
+  const outputPath = options.outputPath || path5__namespace.join(rootDir, "reports", "dashboard.html");
   const graphData = buildGraphElements(rootDir);
   const metricsData = collectDashboardMetrics(rootDir);
-  const html = renderDashboardHtml(graphData, metricsData, options.title);
-  const outDir = path4__namespace.dirname(outputPath);
-  if (!fs7__namespace.existsSync(outDir)) {
-    fs7__namespace.mkdirSync(outDir, { recursive: true });
-  }
-  fs7__namespace.writeFileSync(outputPath, html, "utf-8");
+  const html = renderDashboardHtml(graphData, metricsData, options.title, resolveDeterministicDate(rootDir).toISOString());
+  writeReportFileIfChanged(outputPath, html);
   const { bddCoverageRatio, traceabilityRatio } = computeSummaryRatios(metricsData);
   const { avgMi, avgCc } = computeGateAverages(metricsData.gate.results);
   return {
@@ -13323,6 +13577,8 @@ function generateDashboardReport(options = {}) {
     html
   };
 }
+
+// src/reporters/sarif.ts
 var SARIF_SCHEMA_2_1_0 = "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json";
 var SARIF_VERSION = "2.1.0";
 function normalizeUri(filePath) {
@@ -13470,11 +13726,7 @@ function serializeSarifDocument(doc, pretty = true) {
   return JSON.stringify(doc, null, pretty ? 2 : 0);
 }
 function writeSecuritySarifReport(outputPath, doc, pretty = true) {
-  const dir = path4__namespace.dirname(outputPath);
-  if (!fs7__namespace.existsSync(dir)) {
-    fs7__namespace.mkdirSync(dir, { recursive: true });
-  }
-  fs7__namespace.writeFileSync(outputPath, serializeSarifDocument(doc, pretty), "utf-8");
+  writeReportFileIfChanged(outputPath, serializeSarifDocument(doc, pretty));
 }
 
 // src/init/agent-templates.ts
@@ -16395,14 +16647,14 @@ function collectAgentFiles(targets) {
 function writeProjectFiles(destDir, files, dryRun) {
   const filesCreated = [];
   for (const f of files) {
-    const fullFilePath = path4__namespace.join(destDir, f.relPath);
-    const parentDir = path4__namespace.dirname(fullFilePath);
+    const fullFilePath = path5__namespace.join(destDir, f.relPath);
+    const parentDir = path5__namespace.dirname(fullFilePath);
     if (!dryRun) {
-      if (!fs7__namespace.existsSync(parentDir)) {
-        fs7__namespace.mkdirSync(parentDir, { recursive: true });
+      if (!fs8__namespace.existsSync(parentDir)) {
+        fs8__namespace.mkdirSync(parentDir, { recursive: true });
       }
-      if (!fs7__namespace.existsSync(fullFilePath)) {
-        fs7__namespace.writeFileSync(fullFilePath, f.content, "utf-8");
+      if (!fs8__namespace.existsSync(fullFilePath)) {
+        fs8__namespace.writeFileSync(fullFilePath, f.content, "utf-8");
         filesCreated.push(f.relPath);
       }
     } else {
@@ -16486,7 +16738,7 @@ function getCiWorkflowFiles(ciProvider) {
 function createDirectoriesOnDisk(destDir, directories, dryRun) {
   const created = [];
   for (const d of directories) {
-    if (!dryRun) fs7__namespace.mkdirSync(path4__namespace.join(destDir, d), { recursive: true });
+    if (!dryRun) fs8__namespace.mkdirSync(path5__namespace.join(destDir, d), { recursive: true });
     created.push(d);
   }
   return created;
@@ -16501,7 +16753,7 @@ function collectStarterFiles(ciProvider, agentFiles = [], archGranularity = "min
     ...getCiWorkflowFiles(ciProvider),
     ...agentFiles,
     ...getArchitectureTemplates(archGranularity).map((t) => ({
-      relPath: path4__namespace.join("templates", "architecture", t.filename).replace(/\\/g, "/"),
+      relPath: path5__namespace.join("templates", "architecture", t.filename).replace(/\\/g, "/"),
       content: t.content
     }))
   ];
@@ -16532,15 +16784,15 @@ function injectMissingScripts(scripts) {
   return modified;
 }
 function updateConsumerPackageJson(destDir, dryRun) {
-  const pkgPath = path4__namespace.join(destDir, "package.json");
-  if (!fs7__namespace.existsSync(pkgPath)) return false;
+  const pkgPath = path5__namespace.join(destDir, "package.json");
+  if (!fs8__namespace.existsSync(pkgPath)) return false;
   try {
-    const pkg = JSON.parse(fs7__namespace.readFileSync(pkgPath, "utf-8"));
+    const pkg = JSON.parse(fs8__namespace.readFileSync(pkgPath, "utf-8"));
     if (!pkg || typeof pkg !== "object") return false;
     pkg.scripts = pkg.scripts || {};
     const modified = injectMissingScripts(pkg.scripts);
     if (modified && !dryRun) {
-      fs7__namespace.writeFileSync(pkgPath, JSON.stringify(pkg, null, 2) + "\n", "utf-8");
+      fs8__namespace.writeFileSync(pkgPath, JSON.stringify(pkg, null, 2) + "\n", "utf-8");
     }
     return modified;
   } catch {
@@ -16548,7 +16800,7 @@ function updateConsumerPackageJson(destDir, dryRun) {
   }
 }
 function tryInstallGitHook(destDir, dryRun) {
-  if (!dryRun && fs7__namespace.existsSync(path4__namespace.join(destDir, ".git"))) {
+  if (!dryRun && fs8__namespace.existsSync(path5__namespace.join(destDir, ".git"))) {
     return installGitHooks(destDir).success;
   }
   return false;
@@ -16597,7 +16849,7 @@ function validateInitOptions(options) {
 }
 function initProject(options = {}) {
   const baseDir = options.rootDir || process.cwd();
-  const destDir = path4__namespace.resolve(baseDir, options.targetDir || ".");
+  const destDir = path5__namespace.resolve(baseDir, options.targetDir || ".");
   const validated = validateInitOptions(options);
   if (!validated.valid) return buildInitError(destDir, validated.error);
   const agentTargets = resolveAgentTargets(options.agents);
@@ -16681,33 +16933,40 @@ function normalizeParsedRule(raw, idx) {
     enabled: raw.enabled !== false
   };
 }
+function parseDlpDoc(yamlContent) {
+  let doc;
+  try {
+    doc = yaml3__default.default.load(yamlContent);
+  } catch (err) {
+    throw new Error(`[AI-SDLC Fail-Closed] Invalid YAML in dlp-policy: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  if (!doc || typeof doc !== "object" || Array.isArray(doc)) {
+    throw new Error(`[AI-SDLC Fail-Closed] Invalid dlp-policy structure: root must be a YAML mapping`);
+  }
+  const record = doc;
+  if (record.rules !== void 0 && !Array.isArray(record.rules)) {
+    throw new Error(`[AI-SDLC Fail-Closed] Invalid dlp-policy: rules must be an array`);
+  }
+  return record;
+}
 function parseDlpPolicy(yamlContent) {
   const fallback = createDefaultDlpPolicy();
   if (!yamlContent || !yamlContent.trim()) return fallback;
-  try {
-    const doc = yaml3__default.default.load(yamlContent);
-    if (!doc || typeof doc !== "object") return fallback;
-    const rawRules = Array.isArray(doc.rules) ? doc.rules : [];
-    const parsedRules = rawRules.map((r, i) => normalizeParsedRule(r, i)).filter((r) => r !== null);
-    return {
-      version: typeof doc.version === "string" ? doc.version : "1.0",
-      enabled: doc.enabled !== false,
-      zero_data_retention_required: Boolean(doc.zero_data_retention_required ?? true),
-      rules: parsedRules.length > 0 ? parsedRules : fallback.rules
-    };
-  } catch {
-    return fallback;
-  }
+  const record = parseDlpDoc(yamlContent);
+  const rawRules = Array.isArray(record.rules) ? record.rules : [];
+  const parsedRules = rawRules.map((r, i) => normalizeParsedRule(r, i)).filter((r) => r !== null);
+  return {
+    version: typeof record.version === "string" ? record.version : "1.0",
+    enabled: record.enabled !== false,
+    zero_data_retention_required: Boolean(record.zero_data_retention_required ?? true),
+    rules: parsedRules.length > 0 ? parsedRules : fallback.rules
+  };
 }
 function loadDlpPolicy(rootDir, customPolicyPath) {
   const base = rootDir || process.cwd();
-  const filePath = customPolicyPath ? path4__namespace.isAbsolute(customPolicyPath) ? customPolicyPath : path4__namespace.join(base, customPolicyPath) : path4__namespace.join(base, "dlp-policy.yaml");
-  if (!fs7__namespace.existsSync(filePath)) return createDefaultDlpPolicy();
-  try {
-    return parseDlpPolicy(fs7__namespace.readFileSync(filePath, "utf-8"));
-  } catch {
-    return createDefaultDlpPolicy();
-  }
+  const filePath = customPolicyPath ? path5__namespace.isAbsolute(customPolicyPath) ? customPolicyPath : path5__namespace.join(base, customPolicyPath) : path5__namespace.join(base, "dlp-policy.yaml");
+  if (!fs8__namespace.existsSync(filePath)) return createDefaultDlpPolicy();
+  return parseDlpPolicy(fs8__namespace.readFileSync(filePath, "utf-8"));
 }
 function applySingleDlpRule(text, rule) {
   if (rule.enabled === false) return { output: text, matches: 0 };
@@ -16895,6 +17154,7 @@ exports.STARTER_WORKFLOW_HANDOFF_TEMPLATE = STARTER_WORKFLOW_HANDOFF_TEMPLATE;
 exports.STARTER__GITHUB_PULL_REQUEST_TEMPLATE_MD = STARTER__GITHUB_PULL_REQUEST_TEMPLATE_MD;
 exports.SpecKitAdapter = SpecKitAdapter;
 exports.TYPE_TO_SCHEMA_MAP = TYPE_TO_SCHEMA_MAP;
+exports.UNIT_TEST_SUFFIXES = UNIT_TEST_SUFFIXES;
 exports.VALID_AGENT_TARGETS = VALID_AGENT_TARGETS;
 exports.VALID_ARCHITECTURE_GRANULARITIES = VALID_ARCHITECTURE_GRANULARITIES;
 exports.VALID_AUTONOMY_MODES = VALID_AUTONOMY_MODES;
@@ -16914,6 +17174,7 @@ exports.calculateJaccardSimilarity = calculateJaccardSimilarity;
 exports.calculateMetrics = calculateMetrics;
 exports.calculateRating = calculateRating;
 exports.calculateShannonEntropy = calculateShannonEntropy;
+exports.canonicalSort = canonicalSort;
 exports.checkGherkinInSync = checkGherkinInSync;
 exports.checkoutTaskBranch = checkoutTaskBranch;
 exports.classifyBranch = classifyBranch;
@@ -16922,6 +17183,7 @@ exports.collectAgentFiles = collectAgentFiles;
 exports.collectDashboardMetrics = collectDashboardMetrics;
 exports.collectHistoricalKpis = collectHistoricalKpis;
 exports.computeCanonicalSha256 = computeCanonicalSha256;
+exports.computeRawSha256 = computeRawSha256;
 exports.computeSha256 = computeSha256;
 exports.computeViolationSignature = computeViolationSignature;
 exports.createDefaultDlpPolicy = createDefaultDlpPolicy;
@@ -16947,10 +17209,13 @@ exports.extractFunctions = extractFunctions;
 exports.extractFunctionsBraceLanguages = extractFunctionsBraceLanguages;
 exports.extractFunctionsPolyglot = extractFunctionsPolyglot;
 exports.extractFunctionsPython = extractFunctionsPython;
+exports.extractFunctionsPythonAst = extractFunctionsPythonAst;
 exports.extractFunctionsTypeScriptAst = extractFunctionsTypeScriptAst;
 exports.extractGherkinBlock = extractGherkinBlock;
 exports.extractGherkinFeatures = extractGherkinFeatures;
 exports.extractNormativeText = extractNormativeText;
+exports.extractPythonFunctionsPolyglot = extractPythonFunctionsPolyglot;
+exports.extractSemanticContent = extractSemanticContent;
 exports.findChangeWorkspaceDir = findChangeWorkspaceDir;
 exports.findLicenseFile = findLicenseFile;
 exports.formatCommitTrailers = formatCommitTrailers;
@@ -16959,6 +17224,7 @@ exports.formatReleaseKpiMarkdown = formatReleaseKpiMarkdown;
 exports.generateBranchHierarchyPlan = generateBranchHierarchyPlan;
 exports.generateCycloneDxSbom = generateCycloneDxSbom;
 exports.generateDashboardReport = generateDashboardReport;
+exports.generateDeterministicUuidV5 = generateDeterministicUuidV5;
 exports.generateDuplicatesReportMarkdown = generateDuplicatesReportMarkdown;
 exports.generateGovernanceReportMarkdown = generateGovernanceReportMarkdown;
 exports.generateLicenseReportMarkdown = generateLicenseReportMarkdown;
@@ -16984,10 +17250,13 @@ exports.initProject = initProject;
 exports.injectKpisIntoPrBody = injectKpisIntoPrBody;
 exports.installGitHooks = installGitHooks;
 exports.integrateSddChange = integrateSddChange;
+exports.isCliInstalled = isCliInstalled;
+exports.isFunctionReferencedInTests = isFunctionReferencedInTests;
 exports.isGitleaksInstalled = isGitleaksInstalled;
 exports.isMetricWorsened = isMetricWorsened;
 exports.isPathProtectedFromPatch = isPathProtectedFromPatch;
 exports.isPlaceholderOrIgnored = isPlaceholderOrIgnored;
+exports.isReportContentSemanticallyEqual = isReportContentSemanticallyEqual;
 exports.isRequirementArtifact = isRequirementArtifact2;
 exports.isSemgrepInstalled = isSemgrepInstalled;
 exports.isToolAvailable = isToolAvailable;
@@ -16998,8 +17267,10 @@ exports.loadQualityBaseline = loadQualityBaseline;
 exports.locateTaskInActiveChanges = locateTaskInActiveChanges;
 exports.mapSastSeverityToSarifLevel = mapSastSeverityToSarifLevel;
 exports.maskSecret = maskSecret;
+exports.normalizePath = normalizePath;
 exports.normalizeSpdxLicense = normalizeSpdxLicense;
 exports.normalizeUri = normalizeUri;
+exports.orchestrateNativeAstAnalysis = orchestrateNativeAstAnalysis;
 exports.parseCommitTrailers = parseCommitTrailers;
 exports.parseDlpPolicy = parseDlpPolicy;
 exports.parseFeatureDocument = parseFeatureDocument;
@@ -17034,6 +17305,7 @@ exports.resolveBranchHierarchy = resolveBranchHierarchy;
 exports.resolveCiEnvironment = resolveCiEnvironment;
 exports.resolveCytoscapePath = resolveCytoscapePath;
 exports.resolveDefaultBranchBase = resolveDefaultBranchBase;
+exports.resolveDeterministicDate = resolveDeterministicDate;
 exports.resolveFeatureFilePath = resolveFeatureFilePath;
 exports.resolveGitRef = resolveGitRef;
 exports.resolveLicenseFromFile = resolveLicenseFromFile;
@@ -17046,6 +17318,7 @@ exports.runGitleaksCli = runGitleaksCli;
 exports.runSemgrepCli = runSemgrepCli;
 exports.sanitizeDlpPayload = sanitizeDlpPayload;
 exports.sanitizeDlpText = sanitizeDlpText;
+exports.sanitizeTestCorpus = sanitizeTestCorpus;
 exports.scaffoldSddChange = scaffoldSddChange;
 exports.scanAllProductHandoffs = scanAllProductHandoffs;
 exports.scanAllTestArtifacts = scanAllTestArtifacts;
@@ -17064,11 +17337,13 @@ exports.scanWithNativeFs = scanWithNativeFs;
 exports.scanWithSyft = scanWithSyft;
 exports.scanWithTrivy = scanWithTrivy;
 exports.serializeSarifDocument = serializeSarifDocument;
-exports.slugify = slugify;
+exports.slugify = slugify2;
+exports.stripVolatileReportMetadata = stripVolatileReportMetadata;
 exports.syncPdacDigests = syncPdacDigests;
 exports.tokenizeTitle = tokenizeTitle;
 exports.updateCitationsInContent = updateCitationsInContent;
 exports.validateAgainstSchema = validateAgainstSchema;
+exports.validateAnchorExistence = validateAnchorExistence;
 exports.validateArtifactSchema = validateArtifactSchema;
 exports.verifyArtifactDuplicates = verifyArtifactDuplicates;
 exports.verifyArtifactsSchemas = verifyArtifactsSchemas;
@@ -17093,6 +17368,7 @@ exports.writeCucumberJsonReport = writeCucumberJsonReport;
 exports.writeCycloneDxSbom = writeCycloneDxSbom;
 exports.writeQualityBaseline = writeQualityBaseline;
 exports.writeReleaseKpiReport = writeReleaseKpiReport;
+exports.writeReportFileIfChanged = writeReportFileIfChanged;
 exports.writeSecuritySarifReport = writeSecuritySarifReport;
 exports.writeThirdPartyNotices = writeThirdPartyNotices;
 //# sourceMappingURL=index.cjs.map