@aisdlc/core 2.4.0 → 2.5.0

package/dist/index.js

@@ -1,10 +1,12 @@
-import * as crypto from 'crypto';
-import * as fs7 from 'fs';
-import * as path4 from 'path';
+import * as crypto3 from 'crypto';
+import * as fs8 from 'fs';
+import * as path5 from 'path';
 import yaml3 from 'js-yaml';
-import { SyntaxKind, Project, Node } from 'ts-morph';
 import * as child_process from 'child_process';
-import { execFileSync } from 'child_process';
+import { execFileSync, spawnSync } from 'child_process';
+import { SyntaxKind, Project, Node } from 'ts-morph';
+import Ajv2020 from 'ajv/dist/2020.js';
+import addFormats from 'ajv-formats';
 import { createRequire } from 'module';
 
 // src/types/index.ts
@@ -15,6 +17,168 @@ var VALID_AUTONOMY_MODES = [
   "AMBIGUOUS",
   "HIGH_RISK_MANUAL"
 ];
+function canonicalSort(a, b) {
+  return a < b ? -1 : a > b ? 1 : 0;
+}
+function normalizePath(p) {
+  return p.normalize("NFC").replace(/\\/g, "/");
+}
+function walkMdFiles(dir, fileList = [], excludeDirs = [
+  "node_modules",
+  ".git",
+  "dist",
+  "bin",
+  "obj",
+  "build",
+  "out",
+  "target",
+  "coverage",
+  ".changeset",
+  "scratch",
+  "test-scaffold",
+  "fixtures",
+  "templates",
+  "examples",
+  ".agent",
+  ".agents",
+  ".claude",
+  ".cursor",
+  ".github",
+  ".vscode",
+  ".vs",
+  ".idea"
+]) {
+  try {
+    if (!fs8.existsSync(dir)) return fileList;
+    const files = fs8.readdirSync(dir).sort(canonicalSort);
+    for (const file of files) {
+      const fullPath = path5.join(dir, file);
+      try {
+        if (fs8.statSync(fullPath).isDirectory()) {
+          if (!excludeDirs.includes(file) && !file.startsWith("temp-") && !file.startsWith(".temp-")) {
+            walkMdFiles(fullPath, fileList, excludeDirs);
+          }
+        } else if (file.endsWith(".md")) {
+          fileList.push(fullPath);
+        }
+      } catch {
+      }
+    }
+  } catch {
+  }
+  return fileList.sort(canonicalSort);
+}
+function stripVolatileReportMetadata(content, _ext = "") {
+  let normalized = content.replace(/\r\n/g, "\n");
+  normalized = normalized.replace(/(?:^|\n)>\s*\*\*(?:Generation Date|Generated at|Fecha|Audit Date|Date):\*\*.*$/gim, "");
+  normalized = normalized.replace(/Generated:\s*<span>[\s\S]*?<\/span>/gi, "Generated: <span>[STRIPPED]</span>");
+  return normalized.trim();
+}
+function areCycloneDxSbomsEqual(existingContent, newContent) {
+  try {
+    const a = JSON.parse(existingContent);
+    const b = JSON.parse(newContent);
+    return a.serialNumber === b.serialNumber && JSON.stringify(a.components) === JSON.stringify(b.components) && JSON.stringify(a.vulnerabilities || []) === JSON.stringify(b.vulnerabilities || []);
+  } catch {
+    return false;
+  }
+}
+function areSarifReportsEqual(existingContent, newContent) {
+  try {
+    const a = JSON.parse(existingContent);
+    const b = JSON.parse(newContent);
+    return JSON.stringify(a.runs?.[0]?.results || []) === JSON.stringify(b.runs?.[0]?.results || []);
+  } catch {
+    return false;
+  }
+}
+function isReportContentSemanticallyEqual(existingContent, newContent, filePath) {
+  if (existingContent === newContent) return true;
+  if (filePath.endsWith(".cdx.json") || filePath.endsWith("sbom.json")) {
+    if (areCycloneDxSbomsEqual(existingContent, newContent)) return true;
+  }
+  if (filePath.endsWith(".sarif")) {
+    if (areSarifReportsEqual(existingContent, newContent)) return true;
+  }
+  const ext = path5.extname(filePath).toLowerCase();
+  return stripVolatileReportMetadata(existingContent, ext) === stripVolatileReportMetadata(newContent, ext);
+}
+function atomicWriteFile(filePath, content) {
+  const tempPath = `${filePath}.${process.pid}.${Math.random().toString(36).substring(2)}.tmp`;
+  try {
+    fs8.writeFileSync(tempPath, content, "utf-8");
+    try {
+      if (fs8.existsSync(filePath)) {
+        fs8.rmSync(filePath, { force: true });
+      }
+      fs8.renameSync(tempPath, filePath);
+    } catch {
+      fs8.copyFileSync(tempPath, filePath);
+      fs8.unlinkSync(tempPath);
+    }
+  } catch {
+    fs8.writeFileSync(filePath, content, "utf-8");
+  }
+}
+function writeReportFileIfChanged(filePath, content) {
+  try {
+    if (fs8.existsSync(filePath)) {
+      const existing = fs8.readFileSync(filePath, "utf-8");
+      if (isReportContentSemanticallyEqual(existing, content, filePath)) {
+        return false;
+      }
+    }
+  } catch {
+  }
+  const dir = path5.dirname(filePath);
+  if (!fs8.existsSync(dir)) {
+    fs8.mkdirSync(dir, { recursive: true });
+  }
+  atomicWriteFile(filePath, content);
+  return true;
+}
+var UUID_V5_NAMESPACE_OID = "6ba7b812-9dad-11d1-80b4-00c04fd430c8";
+function resolveDeterministicDate(rootDir) {
+  const epoch = process.env.SOURCE_DATE_EPOCH;
+  if (epoch) {
+    const parsed = parseInt(epoch, 10);
+    if (!isNaN(parsed) && parsed > 0) {
+      return new Date(parsed * 1e3);
+    }
+  }
+  const targetDir = rootDir || process.cwd();
+  if (fs8.existsSync(path5.join(targetDir, ".git"))) {
+    try {
+      const gitOut = execFileSync("git", ["log", "-1", "--format=%ct"], {
+        cwd: targetDir,
+        encoding: "utf-8",
+        stdio: ["pipe", "pipe", "ignore"]
+      }).trim();
+      const parsed = parseInt(gitOut, 10);
+      if (!isNaN(parsed) && parsed > 0) {
+        return new Date(parsed * 1e3);
+      }
+    } catch {
+    }
+  }
+  return /* @__PURE__ */ new Date();
+}
+function generateDeterministicUuidV5(name, namespace = UUID_V5_NAMESPACE_OID) {
+  const nsHex = namespace.replace(/-/g, "");
+  const nsBytes = Buffer.from(nsHex, "hex");
+  const nameBytes = Buffer.from(name, "utf-8");
+  const hash = crypto3.createHash("sha1").update(nsBytes).update(nameBytes).digest();
+  hash[6] = hash[6] & 15 | 80;
+  hash[8] = hash[8] & 63 | 128;
+  const hex = hash.toString("hex").substring(0, 32);
+  return [
+    hex.substring(0, 8),
+    hex.substring(8, 12),
+    hex.substring(12, 16),
+    hex.substring(16, 20),
+    hex.substring(20, 32)
+  ].join("-");
+}
 var CYCLOMATIC_KINDS = /* @__PURE__ */ new Set([
   SyntaxKind.IfStatement,
   SyntaxKind.ConditionalExpression,
@@ -171,7 +335,7 @@ function buildNodeMetrics(node, filePath) {
   return { functionName, filePath, loc, cyclomatic, cognitive, maintainability: mi, codeSmells, line };
 }
 function createTempSourceFile(project, content, filePath) {
-  const ext = path4.extname(filePath).toLowerCase() || ".ts";
+  const ext = path5.extname(filePath).toLowerCase() || ".ts";
   const fileName = `temp_${Date.now()}_${Math.random().toString(36).substring(2, 7)}${ext}`;
   return project.createSourceFile(fileName, content, { overwrite: true });
 }
@@ -208,8 +372,8 @@ function extractFunctionsTypeScriptAst(content, filePath) {
   }
 }
 function extractFunctionsPolyglot(content, filePath) {
-  const ext = path4.extname(filePath).toLowerCase();
-  return ext === ".py" ? extractPythonFunctions(content, filePath) : extractBraceFunctions(content, filePath);
+  const ext = path5.extname(filePath).toLowerCase();
+  return ext === ".py" ? extractPythonFunctionsPolyglot(content, filePath) : extractBraceFunctions(content, filePath);
 }
 function isDocstringToggle(trimmed) {
   const dCount = (trimmed.match(/"""/g) || []).length;
@@ -254,7 +418,7 @@ function processPythonLine(raw, state, blocks, lineIndex) {
     handlePythonBodyLine(raw, state, blocks, lineIndex);
   }
 }
-function extractPythonFunctions(content, filePath) {
+function extractPythonFunctionsPolyglot(content, filePath) {
   const lines = content.split("\n");
   const blocks = [];
   const state = { currentFn: null, fnLines: [], baseIndent: 0, inDocstring: false };
@@ -292,7 +456,7 @@ function processBraceLine(line, state, blocks, lineIndex, ext) {
   }
 }
 function extractBraceFunctions(content, filePath) {
-  const ext = path4.extname(filePath).toLowerCase();
+  const ext = path5.extname(filePath).toLowerCase();
   const lines = content.split("\n");
   const blocks = [];
   const state = {
@@ -501,7 +665,7 @@ function countCommentsAndLoc(rawLines, isPy) {
   return { loc, commentCount, cleanLines };
 }
 function calculatePolyglotMetrics(body, name, filePath, startLine) {
-  const ext = path4.extname(filePath).toLowerCase();
+  const ext = path5.extname(filePath).toLowerCase();
   const rawLines = body.split(/\r?\n/).map((l) => l.trim()).filter((l) => l.length > 0);
   const { loc, commentCount } = countCommentsAndLoc(rawLines, ext === ".py");
   const strippedBody = stripStringsAndComments(body, ext);
@@ -574,50 +738,129 @@ function computeBraceCognitive(lines) {
 function computePolyglotCognitive(lines, isPy) {
   return isPy ? computePythonCognitive(lines) : computeBraceCognitive(lines);
 }
-function walkMdFiles(dir, fileList = [], excludeDirs = [
-  "node_modules",
-  ".git",
-  "dist",
-  "bin",
-  "obj",
-  "build",
-  "out",
-  "target",
-  "coverage",
-  ".changeset",
-  "scratch",
-  "test-scaffold",
-  "fixtures",
-  "templates",
-  "examples",
-  ".agent",
-  ".agents",
-  ".claude",
-  ".cursor",
-  ".github",
-  ".vscode",
-  ".vs",
-  ".idea"
-]) {
+
+// src/verifiers/ast/python-ast.ts
+var PYTHON_AST_RUNNER_SCRIPT = `
+import ast, json, sys
+
+def analyze(code, filepath):
+    try:
+        tree = ast.parse(code)
+    except Exception as e:
+        return {"language": "python", "filePath": filepath, "functions": [], "error": str(e), "unsafeTypesCount": 0, "emptyStubsCount": 0}
+    
+    functions = []
+    unsafe_types = 0
+    empty_stubs = 0
+    for node in ast.walk(tree):
+        if isinstance(node, ast.Name) and node.id == "Any":
+            unsafe_types += 1
+        elif isinstance(node, (ast.FunctionDef, ast.AsyncFunctionDef)):
+            start = node.lineno
+            end = getattr(node, 'end_lineno', start + len(node.body))
+            loc = end - start + 1
+            cc = 1
+            for child in ast.walk(node):
+                if isinstance(child, (ast.If, ast.For, ast.AsyncFor, ast.While, ast.ExceptHandler, ast.With, ast.AsyncWith)):
+                    cc += 1
+                elif isinstance(child, ast.BoolOp):
+                    cc += len(child.values) - 1
+            
+            real_body = [n for n in node.body if not (isinstance(n, ast.Expr) and isinstance(getattr(n, 'value', None), ast.Constant))]
+            is_stub = len(real_body) == 0 or (len(real_body) == 1 and isinstance(real_body[0], ast.Pass))
+            if is_stub:
+                empty_stubs += 1
+            
+            code_smells = ["Empty stub detected"] if is_stub else []
+            mi = max(0.0, round(100.0 - (cc * 2.0) - (loc * 0.2), 1))
+            functions.append({
+                "functionName": node.name,
+                "filePath": filepath,
+                "line": start,
+                "loc": loc,
+                "cyclomatic": cc,
+                "cognitive": cc,
+                "maintainability": mi,
+                "codeSmells": code_smells
+            })
+    return {
+        "language": "python",
+        "filePath": filepath,
+        "functions": functions,
+        "unsafeTypesCount": unsafe_types,
+        "emptyStubsCount": empty_stubs
+    }
+
+code = sys.stdin.read()
+filepath = sys.argv[1] if len(sys.argv) > 1 else ""
+print(json.dumps(analyze(code, filepath)))
+`;
+function extractFunctionsPythonAst(content, filePath) {
   try {
-    if (!fs7.existsSync(dir)) return fileList;
-    const files = fs7.readdirSync(dir);
-    for (const file of files) {
-      const fullPath = path4.join(dir, file);
-      try {
-        if (fs7.statSync(fullPath).isDirectory()) {
-          if (!excludeDirs.includes(file) && !file.startsWith("temp-") && !file.startsWith(".temp-")) {
-            walkMdFiles(fullPath, fileList, excludeDirs);
-          }
-        } else if (file.endsWith(".md")) {
-          fileList.push(fullPath);
-        }
-      } catch {
-      }
+    const res = spawnSync("python", ["-c", PYTHON_AST_RUNNER_SCRIPT, filePath], {
+      input: content,
+      encoding: "utf-8",
+      timeout: 1e4
+    });
+    if (res.status === 0 && res.stdout) {
+      const parsed = JSON.parse(res.stdout);
+      return parsed;
     }
   } catch {
   }
-  return fileList;
+  const fallbackFns = extractPythonFunctionsPolyglot(content, filePath);
+  return {
+    language: "python",
+    filePath,
+    functions: fallbackFns,
+    unsafeTypesCount: 0,
+    emptyStubsCount: 0
+  };
+}
+
+// src/verifiers/ast/native-ast-orchestrator.ts
+function isCliInstalled(bin) {
+  try {
+    const res = spawnSync(bin, ["--version"], { encoding: "utf-8", timeout: 5e3, shell: false });
+    return res.status === 0 && !res.error;
+  } catch {
+    return false;
+  }
+}
+function assertRequiredStack(stack) {
+  if (!stack) return;
+  if (!isCliInstalled(stack)) {
+    throw new Error(`[AI-SDLC Fail-Closed] Required toolchain CLI '${stack}' is not installed in the environment`);
+  }
+}
+function analyzeTypeScript(content, filePath) {
+  return {
+    language: "typescript",
+    filePath,
+    functions: extractFunctionsTypeScriptAst(content, filePath),
+    unsafeTypesCount: 0,
+    emptyStubsCount: 0
+  };
+}
+function analyzePolyglot(content, filePath, ext) {
+  return {
+    language: ext.replace(/^\./, ""),
+    filePath,
+    functions: extractFunctionsPolyglot(content, filePath),
+    unsafeTypesCount: 0,
+    emptyStubsCount: 0
+  };
+}
+function orchestrateNativeAstAnalysis(content, filePath, options = {}) {
+  assertRequiredStack(options.requiredStack);
+  const ext = filePath.substring(filePath.lastIndexOf(".")).toLowerCase();
+  if ([".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs"].includes(ext)) {
+    return analyzeTypeScript(content, filePath);
+  }
+  if (ext === ".py") {
+    return extractFunctionsPythonAst(content, filePath);
+  }
+  return analyzePolyglot(content, filePath, ext);
 }
 function parseMarkdownFrontmatter(content) {
   const match = content.match(/^---\r?\n([\s\S]*?)\r?\n---/);
@@ -649,41 +892,41 @@ function extractGherkinBlock(body) {
 }
 function resolveTargetFiles(rootDir, targetPath) {
   if (targetPath) {
-    const fullTarget = path4.isAbsolute(targetPath) ? targetPath : path4.join(rootDir, targetPath);
-    if (!fs7.existsSync(fullTarget)) return [];
-    return fs7.statSync(fullTarget).isDirectory() ? walkMdFiles(fullTarget) : [fullTarget];
+    const fullTarget = path5.isAbsolute(targetPath) ? targetPath : path5.join(rootDir, targetPath);
+    if (!fs8.existsSync(fullTarget)) return [];
+    return fs8.statSync(fullTarget).isDirectory() ? walkMdFiles(fullTarget) : [fullTarget];
   }
   const searchDirs = [
-    path4.join(rootDir, "product"),
-    path4.join(rootDir, "security"),
-    path4.join(rootDir, "privacy"),
-    path4.join(rootDir, "specs"),
-    path4.join(rootDir, "examples", "product"),
-    path4.join(rootDir, "examples", "security"),
-    path4.join(rootDir, "examples", "privacy"),
-    path4.join(rootDir, "examples", "specs")
+    path5.join(rootDir, "product"),
+    path5.join(rootDir, "security"),
+    path5.join(rootDir, "privacy"),
+    path5.join(rootDir, "specs"),
+    path5.join(rootDir, "examples", "product"),
+    path5.join(rootDir, "examples", "security"),
+    path5.join(rootDir, "examples", "privacy"),
+    path5.join(rootDir, "examples", "specs")
   ];
-  return searchDirs.filter((d) => fs7.existsSync(d)).flatMap((d) => walkMdFiles(d));
+  return searchDirs.filter((d) => fs8.existsSync(d)).flatMap((d) => walkMdFiles(d));
 }
 function resolveFeatureFilePath(rootDir, filePath, id, customTarget) {
   if (customTarget) {
-    return path4.isAbsolute(customTarget) ? customTarget : path4.join(rootDir, customTarget);
-  }
-  const baseDir = path4.join(rootDir, "tests", "features");
-  const candidateSecurity = path4.join(baseDir, "security", `${id.toLowerCase()}.feature`);
-  const candidatePrivacy = path4.join(baseDir, "privacy", `${id.toLowerCase()}.feature`);
-  const candidateRoot = path4.join(baseDir, `${id.toLowerCase()}.feature`);
-  if (fs7.existsSync(candidateSecurity)) return candidateSecurity;
-  if (fs7.existsSync(candidatePrivacy)) return candidatePrivacy;
-  if (fs7.existsSync(candidateRoot)) return candidateRoot;
+    return path5.isAbsolute(customTarget) ? customTarget : path5.join(rootDir, customTarget);
+  }
+  const baseDir = path5.join(rootDir, "tests", "features");
+  const candidateSecurity = path5.join(baseDir, "security", `${id.toLowerCase()}.feature`);
+  const candidatePrivacy = path5.join(baseDir, "privacy", `${id.toLowerCase()}.feature`);
+  const candidateRoot = path5.join(baseDir, `${id.toLowerCase()}.feature`);
+  if (fs8.existsSync(candidateSecurity)) return candidateSecurity;
+  if (fs8.existsSync(candidatePrivacy)) return candidatePrivacy;
+  if (fs8.existsSync(candidateRoot)) return candidateRoot;
   const subDir = filePath.includes("security") ? "security" : filePath.includes("privacy") ? "privacy" : "";
-  return path4.join(baseDir, subDir, `${id.toLowerCase()}.feature`);
+  return path5.join(baseDir, subDir, `${id.toLowerCase()}.feature`);
 }
 function buildFeatureFileContent(rootDir, filePath, id, version, gherkinBlocks) {
   const banner = [
     `# ==============================================================================`,
     `# AUTO-GENERADO POR AI-SDLC (Cucumber Integration)`,
-    `# Origen: ${path4.relative(rootDir, filePath).replace(/\\/g, "/")}`,
+    `# Origen: ${path5.relative(rootDir, filePath).replace(/\\/g, "/")}`,
     `# ID Requerimiento: ${id}`,
     `# Versi\xF3n: ${version || "1.0.0"}`,
     `# NO EDITAR MANUALMENTE: Cualquier cambio debe realizarse en el Markdown origen.`,
@@ -708,20 +951,20 @@ function extractGherkinFeatures(options = {}) {
   const targetFiles = resolveTargetFiles(rootDir, options.targetPath);
   for (const filePath of targetFiles) {
     try {
-      const content = fs7.readFileSync(filePath, "utf-8");
+      const content = fs8.readFileSync(filePath, "utf-8");
       const { frontmatter, body } = parseMarkdownFrontmatter(content);
       const gherkinBlocks = extractGherkinBlock(body);
       if (gherkinBlocks.length === 0) continue;
-      const id = frontmatter.id || path4.basename(filePath, path4.extname(filePath));
+      const id = frontmatter.id || path5.basename(filePath, path5.extname(filePath));
       const targetPath = resolveFeatureFilePath(rootDir, filePath, id, frontmatter["cucumber-feature-file"]);
-      fs7.mkdirSync(path4.dirname(targetPath), { recursive: true });
+      fs8.mkdirSync(path5.dirname(targetPath), { recursive: true });
       const fullContent = buildFeatureFileContent(rootDir, filePath, id, frontmatter.version, gherkinBlocks);
-      fs7.writeFileSync(targetPath, fullContent, "utf-8");
+      fs8.writeFileSync(targetPath, fullContent, "utf-8");
       const scenarioCount = countScenarios(gherkinBlocks);
       totalScenarios += scenarioCount;
       features.push({
-        sourceFile: path4.relative(rootDir, filePath).replace(/\\/g, "/"),
-        outputFile: path4.relative(rootDir, targetPath).replace(/\\/g, "/"),
+        sourceFile: path5.relative(rootDir, filePath).replace(/\\/g, "/"),
+        outputFile: path5.relative(rootDir, targetPath).replace(/\\/g, "/"),
         featureName: id,
         scenarioCount
       });
@@ -738,20 +981,20 @@ function checkGherkinInSync(options = {}) {
   let totalFeatures = 0;
   for (const filePath of targetFiles) {
     try {
-      const content = fs7.readFileSync(filePath, "utf-8");
+      const content = fs8.readFileSync(filePath, "utf-8");
       const { frontmatter, body } = parseMarkdownFrontmatter(content);
       const gherkinBlocks = extractGherkinBlock(body);
       if (gherkinBlocks.length === 0) continue;
       totalFeatures++;
-      const id = frontmatter.id || path4.basename(filePath, path4.extname(filePath));
+      const id = frontmatter.id || path5.basename(filePath, path5.extname(filePath));
       const targetPath = resolveFeatureFilePath(rootDir, filePath, id, frontmatter["cucumber-feature-file"]);
-      const relTarget = path4.relative(rootDir, targetPath).replace(/\\/g, "/");
-      if (!fs7.existsSync(targetPath)) {
+      const relTarget = path5.relative(rootDir, targetPath).replace(/\\/g, "/");
+      if (!fs8.existsSync(targetPath)) {
         missingFiles.push(relTarget);
         continue;
       }
       const expectedContent = buildFeatureFileContent(rootDir, filePath, id, frontmatter.version, gherkinBlocks);
-      const actualContent = fs7.readFileSync(targetPath, "utf-8");
+      const actualContent = fs8.readFileSync(targetPath, "utf-8");
       if (actualContent.replace(/\r\n/g, "\n") !== expectedContent.replace(/\r\n/g, "\n")) {
         outOfSyncFiles.push(relTarget);
       }
@@ -850,7 +1093,7 @@ function generateTestingCoverageReportMarkdown(reqAudit, taskAudit, reqErrors, t
   const reportLines = [
     `# \u{1F9EA} Deterministic Test Coverage Audit for Requirements and Tasks`,
     ``,
-    `> **Audit Date:** ${(/* @__PURE__ */ new Date()).toISOString()}`,
+    `> **Audit Date:** ${resolveDeterministicDate().toISOString()}`,
     `> **Overall Verdict:** ${verdict}`,
     ``,
     `---`,
@@ -913,8 +1156,8 @@ function parseCodeTestIds(content, relTest, reqToTestsMap) {
 }
 function processTestFile(fullPath, rootDir, reqToTestsMap) {
   try {
-    const content = fs7.readFileSync(fullPath, "utf-8");
-    const relTest = path4.relative(rootDir, fullPath).replace(/\\/g, "/");
+    const content = fs8.readFileSync(fullPath, "utf-8");
+    const relTest = path5.relative(rootDir, fullPath).replace(/\\/g, "/");
     if (fullPath.endsWith(".feature")) {
       parseFeatureTags(content, relTest, reqToTestsMap);
     }
@@ -923,16 +1166,16 @@ function processTestFile(fullPath, rootDir, reqToTestsMap) {
   }
 }
 function collectTestFiles(dir, files = []) {
-  if (!fs7.existsSync(dir)) return files;
+  if (!fs8.existsSync(dir)) return files;
   try {
-    const entries = fs7.readdirSync(dir, { withFileTypes: true });
+    const entries = fs8.readdirSync(dir, { withFileTypes: true }).sort((a, b) => canonicalSort(a.name, b.name));
     for (const e of entries) {
       if (e.isDirectory()) {
         if (!EXCLUDED_TEST_DIRS.has(e.name)) {
-          collectTestFiles(path4.join(dir, e.name), files);
+          collectTestFiles(path5.join(dir, e.name), files);
         }
       } else if (isTestFile(e.name)) {
-        files.push(path4.join(dir, e.name));
+        files.push(path5.join(dir, e.name));
       }
     }
   } catch {
@@ -1141,7 +1384,7 @@ function collectTestCorpus(rootDir, allMdFiles) {
   const testContents = [];
   for (const tf of collectTestFiles(rootDir)) {
     try {
-      const content = fs7.readFileSync(tf, "utf-8");
+      const content = fs8.readFileSync(tf, "utf-8");
       testContents.push(content);
       if (tf.endsWith(".feature")) gherkinSources.push(content);
     } catch {
@@ -1149,7 +1392,7 @@ function collectTestCorpus(rootDir, allMdFiles) {
   }
   for (const md of allMdFiles) {
     try {
-      const blocks = extractGherkinBlock(fs7.readFileSync(md, "utf-8"));
+      const blocks = extractGherkinBlock(fs8.readFileSync(md, "utf-8"));
       gherkinSources.push(...blocks);
       testContents.push(...blocks);
     } catch {
@@ -1178,9 +1421,9 @@ function countCucumberScenarios(raw) {
   return { passed, failed };
 }
 function parseCucumberReportFile(reportPath) {
-  if (!fs7.existsSync(reportPath)) return void 0;
+  if (!fs8.existsSync(reportPath)) return void 0;
   try {
-    const raw = JSON.parse(fs7.readFileSync(reportPath, "utf-8"));
+    const raw = JSON.parse(fs8.readFileSync(reportPath, "utf-8"));
     if (!Array.isArray(raw)) return void 0;
     const { passed, failed } = countCucumberScenarios(raw);
     return {
@@ -1194,7 +1437,7 @@ function parseCucumberReportFile(reportPath) {
   }
 }
 function resolveCucumberReport(rootDir, options) {
-  const candidate = options.cucumberReportPath ? path4.isAbsolute(options.cucumberReportPath) ? options.cucumberReportPath : path4.join(rootDir, options.cucumberReportPath) : path4.join(rootDir, "reports", "cucumber-report.json");
+  const candidate = options.cucumberReportPath ? path5.isAbsolute(options.cucumberReportPath) ? options.cucumberReportPath : path5.join(rootDir, options.cucumberReportPath) : path5.join(rootDir, "reports", "cucumber-report.json");
   const parsed = parseCucumberReportFile(candidate);
   if (parsed) return parsed;
   if (options.enforceCucumberExecution) {
@@ -1228,8 +1471,8 @@ function recordUseCaseAuditIfPresent(frontmatter, id, relPath, isTemplate, combi
   if (flowAudit.status === "FALLO_SIN_PRUEBA") state.ucErrors++;
 }
 function processMdFileForCoverage(file, rootDir, reqToTestsMap, corpus, options, state) {
-  const { frontmatter } = parseGenericDoc(fs7.readFileSync(file, "utf-8"));
-  const relPath = path4.relative(rootDir, file).replace(/\\/g, "/");
+  const { frontmatter } = parseGenericDoc(fs8.readFileSync(file, "utf-8"));
+  const relPath = path5.relative(rootDir, file).replace(/\\/g, "/");
   const isTemplate = relPath.includes("templates/");
   const id = frontmatter.id || "";
   if (isRequirementArtifact(frontmatter, id)) {
@@ -1303,7 +1546,6 @@ var DEFAULT_EXCLUDES = [
   "templates",
   "fixtures"
 ];
-var TS_JS_EXTENSIONS = [".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs"];
 function createDefaultQualityPolicy() {
   return {
     max_cyclomatic: 10,
@@ -1384,27 +1626,38 @@ function applyOptionOverrides(policy, overrides) {
   if (overrides.max_function_lines !== void 0) policy.max_function_lines = Number(overrides.max_function_lines);
   if (overrides.enforce_mode !== void 0) policy.enforce_mode = overrides.enforce_mode;
 }
+function parsePolicyYaml(content) {
+  let doc;
+  try {
+    doc = yaml3.load(content);
+  } catch (err) {
+    throw new Error(`[AI-SDLC Fail-Closed] Invalid YAML in quality-policy: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  if (!doc || typeof doc !== "object" || Array.isArray(doc)) {
+    throw new Error(`[AI-SDLC Fail-Closed] Invalid quality policy structure: root must be a YAML mapping`);
+  }
+  return doc;
+}
 function parseQualityPolicy(content, overrides) {
   const policy = createDefaultQualityPolicy();
-  try {
-    const doc = yaml3.load(content);
-    if (doc && typeof doc === "object") {
-      const record = doc;
-      applyDocScope(policy, record);
-      applyDocThresholds(policy, record);
-      if (record.max_per_function !== void 0) policy.max_cyclomatic = Number(record.max_per_function);
-      if (record.min_acceptable_score !== void 0) policy.min_maintainability = Number(record.min_acceptable_score);
-      if (record.max_function_lines !== void 0) policy.max_function_lines = Number(record.max_function_lines);
-    }
-  } catch {
+  if (!content || !content.trim()) {
+    applyEnvThresholds(policy);
+    applyOptionOverrides(policy, overrides);
+    return policy;
   }
+  const record = parsePolicyYaml(content);
+  applyDocScope(policy, record);
+  applyDocThresholds(policy, record);
+  if (record.max_per_function !== void 0) policy.max_cyclomatic = Number(record.max_per_function);
+  if (record.min_acceptable_score !== void 0) policy.min_maintainability = Number(record.min_acceptable_score);
+  if (record.max_function_lines !== void 0) policy.max_function_lines = Number(record.max_function_lines);
   applyEnvThresholds(policy);
   applyOptionOverrides(policy, overrides);
   return policy;
 }
 function extractFunctions(content, filePath) {
-  const ext = path4.extname(filePath).toLowerCase();
-  return TS_JS_EXTENSIONS.includes(ext) ? extractFunctionsTypeScriptAst(content, filePath) : extractFunctionsPolyglot(content, filePath);
+  const report = orchestrateNativeAstAnalysis(content, filePath);
+  return report.functions;
 }
 function extractFunctionsBraceLanguages(content, filePath) {
   return extractFunctions(content, filePath);
@@ -1434,55 +1687,55 @@ function isExcludedFile(file, normalized, excludePatterns) {
   );
 }
 function walkDir(dir, extensions = DEFAULT_EXTENSIONS, excludePatterns = DEFAULT_EXCLUDES) {
-  if (!fs7.existsSync(dir)) return [];
+  if (!fs8.existsSync(dir)) return [];
   const results = [];
-  for (const file of fs7.readdirSync(dir)) {
-    const fullPath = path4.join(dir, file);
+  for (const file of fs8.readdirSync(dir).sort(canonicalSort)) {
+    const fullPath = path5.join(dir, file);
     const normalized = fullPath.replace(/\\/g, "/");
     if (isExcludedFile(file, normalized, excludePatterns)) continue;
-    const stat = fs7.statSync(fullPath);
+    const stat = fs8.statSync(fullPath);
     if (stat.isDirectory()) {
       results.push(...walkDir(fullPath, extensions, excludePatterns));
-    } else if (extensions.includes(path4.extname(file).toLowerCase())) {
+    } else if (extensions.includes(path5.extname(file).toLowerCase())) {
       results.push(fullPath);
     }
   }
   return results;
 }
 function resolvePolicy(rootDir, options) {
-  const policyFile = options.policyPath || path4.join(rootDir, "quality-policy.yaml");
+  const policyFile = options.policyPath || path5.join(rootDir, "quality-policy.yaml");
   if (options.policy) {
     const policy = { ...options.policy };
     applyOptionOverrides(policy, options.thresholds);
     return policy;
   }
-  if (fs7.existsSync(policyFile)) {
-    return parseQualityPolicy(fs7.readFileSync(policyFile, "utf-8"), options.thresholds);
+  if (fs8.existsSync(policyFile)) {
+    return parseQualityPolicy(fs8.readFileSync(policyFile, "utf-8"), options.thresholds);
   }
   return parseQualityPolicy("", options.thresholds);
 }
 function isPathExcluded(targetPath, rootDir, excludePatterns) {
-  const rel = path4.relative(rootDir, targetPath).replace(/\\/g, "/");
-  const base = path4.basename(targetPath);
+  const rel = path5.relative(rootDir, targetPath).replace(/\\/g, "/");
+  const base = path5.basename(targetPath);
   return excludePatterns.some(
     (pat) => base === pat || rel === pat || rel.startsWith(pat + "/") || rel.includes("/" + pat + "/") || rel.endsWith("/" + pat) || rel.includes(pat)
   );
 }
 function scanContainerSubdir(containerDir, subdirName, targetDir, rootDir, policy, files) {
   if (policy.exclude_patterns.includes(subdirName)) return;
-  const subTarget = path4.join(containerDir, subdirName, targetDir);
-  if (!fs7.existsSync(subTarget) || !fs7.statSync(subTarget).isDirectory()) return;
+  const subTarget = path5.join(containerDir, subdirName, targetDir);
+  if (!fs8.existsSync(subTarget) || !fs8.statSync(subTarget).isDirectory()) return;
   if (isPathExcluded(subTarget, rootDir, policy.exclude_patterns)) return;
   for (const f of walkDir(subTarget, policy.supported_extensions, policy.exclude_patterns)) {
     files.add(f);
   }
 }
 function scanMonorepoContainer(rootDir, container, targetDir, policy, files) {
-  const containerDir = path4.join(rootDir, container);
-  if (!fs7.existsSync(containerDir) || !fs7.statSync(containerDir).isDirectory()) return;
+  const containerDir = path5.join(rootDir, container);
+  if (!fs8.existsSync(containerDir) || !fs8.statSync(containerDir).isDirectory()) return;
   if (isPathExcluded(containerDir, rootDir, policy.exclude_patterns)) return;
   try {
-    for (const subdir of fs7.readdirSync(containerDir, { withFileTypes: true })) {
+    for (const subdir of fs8.readdirSync(containerDir, { withFileTypes: true })) {
       if (subdir.isDirectory()) {
         scanContainerSubdir(containerDir, subdir.name, targetDir, rootDir, policy, files);
       }
@@ -1491,13 +1744,14 @@ function scanMonorepoContainer(rootDir, container, targetDir, policy, files) {
   }
 }
 function scanDirectTarget(rootDir, targetDir, policy, files) {
-  const fullDir = path4.join(rootDir, targetDir);
-  if (fs7.existsSync(fullDir) && !isPathExcluded(fullDir, rootDir, policy.exclude_patterns)) {
+  const fullDir = path5.join(rootDir, targetDir);
+  if (fs8.existsSync(fullDir) && !isPathExcluded(fullDir, rootDir, policy.exclude_patterns)) {
     for (const f of walkDir(fullDir, policy.supported_extensions, policy.exclude_patterns)) {
       files.add(f);
     }
   }
 }
+var UNIT_TEST_SUFFIXES = [".spec.ts", ".test.ts", ".spec.js", ".test.js", "_test.py", "_test.go"];
 function collectFilesToScan(rootDir, policy) {
   const files = /* @__PURE__ */ new Set();
   const monorepoContainers = ["packages", "apps", "libs", "modules", "services"];
@@ -1507,7 +1761,7 @@ function collectFilesToScan(rootDir, policy) {
       scanMonorepoContainer(rootDir, container, targetDir, policy, files);
     }
   }
-  return Array.from(files);
+  return Array.from(files).filter((f) => !UNIT_TEST_SUFFIXES.some((s) => f.endsWith(s)));
 }
 function evaluateViolations(fn, policy) {
   const violations = [];
@@ -1529,38 +1783,67 @@ function evaluateViolations(fn, policy) {
   return violations;
 }
 function evaluateFileQuality(file, rootDir, policy) {
-  const content = fs7.readFileSync(file, "utf-8");
+  const content = fs8.readFileSync(file, "utf-8");
   const fns = extractFunctions(content, file);
   return fns.map((fn) => {
     const violations = evaluateViolations(fn, policy);
     return {
       ...fn,
-      relPath: path4.relative(rootDir, file).replace(/\\/g, "/"),
+      relPath: path5.relative(rootDir, file).replace(/\\/g, "/"),
       status: violations.length === 0 ? "PASS" : "FAIL",
       violations
     };
   });
 }
-var UNIT_TEST_SUFFIXES = [".spec.ts", ".test.ts", ".spec.js", ".test.js", "_test.py", "_test.go"];
 function collectUnitTestCorpus(rootDir) {
   const allCodeFiles = walkDir(rootDir, DEFAULT_EXTENSIONS, DEFAULT_EXCLUDES);
   const chunks = [];
   for (const tf of allCodeFiles) {
     if (!UNIT_TEST_SUFFIXES.some((s) => tf.endsWith(s))) continue;
     try {
-      chunks.push(fs7.readFileSync(tf, "utf-8"));
+      chunks.push(fs8.readFileSync(tf, "utf-8"));
     } catch {
     }
   }
   return chunks.join("\n");
 }
+function sanitizeTestCorpus(corpus, fnName) {
+  let cleaned = corpus.replace(/\/\*[\s\S]*?\*\//g, " ");
+  cleaned = cleaned.replace(/(?:\/\/|#)[^\r\n]*/g, " ");
+  cleaned = cleaned.replace(/(['"`])((?:\\.|(?!\1)[^\\])*)\1/g, (match, quote, inner) => {
+    const trimmed = inner.trim();
+    if (trimmed === fnName || trimmed === `#${fnName}` || trimmed === `.${fnName}` || trimmed === `${fnName}()`) {
+      return match;
+    }
+    return `${quote}${quote}`;
+  });
+  return cleaned;
+}
+function buildTestReferencePatterns(escaped) {
+  return [
+    new RegExp(`(?:\\.|\\b)${escaped}\\s*\\(`, "m"),
+    new RegExp(`\\b(?:import|require)\\b[^;\\n]*\\b${escaped}\\b`, "m"),
+    new RegExp(`(?:\\bexpect|\\bassert|\\bshould)\\s*\\([^;\\n]*\\b${escaped}\\b`, "m"),
+    new RegExp("(?:\\bspyOn|\\bmock)\\s*\\([^;\\n]*['\"`]" + escaped + "['\"`]", "m"),
+    new RegExp(`\\b${escaped}\\s*\\.`, "m"),
+    new RegExp("\\b(?:describe|it|test|context)\\s*\\(\\s*['\"`](?:#|\\.)?" + escaped + "['\"`]", "m"),
+    new RegExp(`\\btest_?${escaped}\\b`, "im")
+  ];
+}
+function isFunctionReferencedInTests(fnName, rawCorpus) {
+  if (!fnName || fnName === "anonymous" || fnName === "constructor") return true;
+  const corpus = sanitizeTestCorpus(rawCorpus, fnName);
+  const escaped = fnName.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const patterns = buildTestReferencePatterns(escaped);
+  return patterns.some((p) => p.test(corpus));
+}
 function auditUnitTestsPerFunction(results, rootDir) {
   const corpus = collectUnitTestCorpus(rootDir);
   const untested = [];
   for (const r of results) {
     const fnName = r.functionName.includes(".") ? r.functionName.split(".").pop() : r.functionName;
     if (!fnName || fnName === "anonymous" || fnName === "constructor") continue;
-    if (!corpus.includes(fnName)) {
+    if (!isFunctionReferencedInTests(fnName, corpus)) {
       untested.push({ file: r.relPath, functionName: r.functionName });
       r.violations.push(`Missing unit test for function '${r.functionName}'`);
       r.status = "FAIL";
@@ -1570,11 +1853,11 @@ function auditUnitTestsPerFunction(results, rootDir) {
 }
 function isVitestMidFlightCoverage(rel, fullPath) {
   if (!process.env.VITEST || rel !== "coverage/coverage-summary.json") return false;
-  return path4.resolve(fullPath) === path4.resolve(process.cwd(), rel);
+  return path5.resolve(fullPath) === path5.resolve(process.cwd(), rel);
 }
 function parseCoverageSummaryFile(filePath, source) {
   try {
-    const raw = JSON.parse(fs7.readFileSync(filePath, "utf-8"));
+    const raw = JSON.parse(fs8.readFileSync(filePath, "utf-8"));
     const total = raw.total;
     if (!total) return null;
     return {
@@ -1589,8 +1872,8 @@ function parseCoverageSummaryFile(filePath, source) {
 }
 function readSummaryCoverageJson(rootDir) {
   for (const rel of ["coverage/coverage-summary.json", "reports/coverage-summary.json"]) {
-    const full = path4.join(rootDir, rel);
-    if (!fs7.existsSync(full) || isVitestMidFlightCoverage(rel, full)) continue;
+    const full = path5.join(rootDir, rel);
+    if (!fs8.existsSync(full) || isVitestMidFlightCoverage(rel, full)) continue;
     const summary = parseCoverageSummaryFile(full, rel);
     if (summary) return summary;
   }
@@ -1614,7 +1897,7 @@ function evaluateCoverageThresholds(rootDir, policy, requireReport) {
 }
 function computeViolationSignature(relPath, fnName, metric) {
   const normPath = relPath.replace(/\\/g, "/");
-  return crypto.createHash("sha256").update(normPath + ":" + fnName + ":" + metric).digest("hex");
+  return crypto3.createHash("sha256").update(normPath + ":" + fnName + ":" + metric).digest("hex");
 }
 function classifyMetricFromMessage(msg, fn) {
   if (msg.startsWith("Cyclomatic Complexity")) {
@@ -1643,8 +1926,8 @@ function isMetricWorsened(baselineEntry, current) {
 }
 function loadQualityBaseline(baselineFile) {
   try {
-    if (!fs7.existsSync(baselineFile)) return null;
-    const content = fs7.readFileSync(baselineFile, "utf-8");
+    if (!fs8.existsSync(baselineFile)) return null;
+    const content = fs8.readFileSync(baselineFile, "utf-8");
     return JSON.parse(content);
   } catch {
     return null;
@@ -1653,11 +1936,11 @@ function loadQualityBaseline(baselineFile) {
 function writeQualityBaseline(baselineFile, entries) {
   const baseline = {
     version: "1.0",
-    generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    generatedAt: resolveDeterministicDate(path5.dirname(baselineFile)).toISOString(),
     totalViolations: entries.length,
     violations: entries
   };
-  fs7.writeFileSync(baselineFile, JSON.stringify(baseline, null, 2) + "\n", "utf-8");
+  fs8.writeFileSync(baselineFile, JSON.stringify(baseline, null, 2) + "\n", "utf-8");
   return baseline;
 }
 function extractBaselineEntriesFromResults(results) {
@@ -1716,7 +1999,7 @@ function applyRatchetMode(results, baseline) {
 function resolveBaselineFilePath(rootDir, options) {
   if (options.baselinePath) return options.baselinePath;
   if (typeof options.baseline === "string") return options.baseline;
-  return path4.join(rootDir, "quality-baseline.json");
+  return path5.join(rootDir, "quality-baseline.json");
 }
 function isRatchetModeActive(policy, options, baselineExists) {
   if (options.ratchet !== void 0) return options.ratchet;
@@ -1724,7 +2007,7 @@ function isRatchetModeActive(policy, options, baselineExists) {
   return Boolean(policy.ratchet_mode || options.baseline && baselineExists);
 }
 function evaluateRatchetIfActive(results, baselineFile, isActive) {
-  if (!isActive || !fs7.existsSync(baselineFile)) {
+  if (!isActive || !fs8.existsSync(baselineFile)) {
     return { toleratedViolationsCount: 0, newViolationsCount: 0, baselineViolationsCount: 0 };
   }
   const baseline = loadQualityBaseline(baselineFile);
@@ -1783,7 +2066,7 @@ function verifyQualityGate(options = {}) {
       baselineViolationsCount: entries.length
     });
   }
-  const baselineExists = fs7.existsSync(baselineFile);
+  const baselineExists = fs8.existsSync(baselineFile);
   const isRatchet = isRatchetModeActive(policy, options, baselineExists);
   const ratchetEval = evaluateRatchetIfActive(results, baselineFile, isRatchet);
   return buildQualityGateResult(results, allFiles.length, policy, coverageViolations, untestedFunctions, {
@@ -1801,9 +2084,9 @@ function normalizeHandoffPayload(handoff, changeId) {
   };
 }
 function parseChangeProfile(specFile) {
-  if (!fs7.existsSync(specFile)) return "standard";
+  if (!fs8.existsSync(specFile)) return "standard";
   try {
-    const rawSpec = fs7.readFileSync(specFile, "utf-8").replace(/^\uFEFF/, "");
+    const rawSpec = fs8.readFileSync(specFile, "utf-8").replace(/^\uFEFF/, "");
     const match = rawSpec.match(/^---\r?\n([\s\S]*?)\r?\n---/);
     if (match) {
       const parsedFm = yaml3.load(match[1]);
@@ -1825,12 +2108,12 @@ function checkSpecGherkinFormat(parsedFm, rawSpec, changeWorkspaceDir, errors) {
   }
 }
 function validateSpecFileContent(specFile, changeWorkspaceDir, errors) {
-  if (!fs7.existsSync(specFile)) {
+  if (!fs8.existsSync(specFile)) {
     errors.push(`Falta el archivo obligatorio 'spec.md' en ${changeWorkspaceDir}.`);
     return;
   }
   try {
-    const rawSpec = fs7.readFileSync(specFile, "utf-8").replace(/^\uFEFF/, "");
+    const rawSpec = fs8.readFileSync(specFile, "utf-8").replace(/^\uFEFF/, "");
     const match = rawSpec.match(/^---\r?\n([\s\S]*?)\r?\n---/);
     if (match) {
       const parsedFm = yaml3.load(match[1]);
@@ -1849,19 +2132,19 @@ function validateHandoffSidecar(handoff, changeWorkspaceDir, errors) {
   if (!handoff.subgraph || !Array.isArray(handoff.subgraph.requirements)) {
     errors.push(`El sidecar '${handoff.id}' no define un subgrafo de requerimientos v\xE1lido.`);
   }
-  return path4.join(changeWorkspaceDir, "handoff.yaml");
+  return path5.join(changeWorkspaceDir, "handoff.yaml");
 }
 function validateOpenSpecStructure(profile, changeWorkspaceDir, adapter, errors, warnings) {
-  const proposalFile = path4.join(changeWorkspaceDir, "proposal.md");
-  const tasksFile = path4.join(changeWorkspaceDir, "tasks.md");
+  const proposalFile = path5.join(changeWorkspaceDir, "proposal.md");
+  const tasksFile = path5.join(changeWorkspaceDir, "tasks.md");
   if (profile === "patch") {
     const handoff2 = adapter.loadSidecar(changeWorkspaceDir);
-    return { handoff: handoff2, sidecarFile: handoff2 ? path4.join(changeWorkspaceDir, "handoff.yaml") : void 0 };
+    return { handoff: handoff2, sidecarFile: handoff2 ? path5.join(changeWorkspaceDir, "handoff.yaml") : void 0 };
   }
-  if (!fs7.existsSync(proposalFile)) {
+  if (!fs8.existsSync(proposalFile)) {
     warnings.push(`Falta 'proposal.md' en el espacio de trabajo OpenSpec.`);
   }
-  if (!fs7.existsSync(tasksFile)) {
+  if (!fs8.existsSync(tasksFile)) {
     errors.push(`Falta el archivo obligatorio 'tasks.md' en ${changeWorkspaceDir}.`);
   }
   const handoff = adapter.loadSidecar(changeWorkspaceDir);
@@ -1869,20 +2152,20 @@ function validateOpenSpecStructure(profile, changeWorkspaceDir, adapter, errors,
   return { handoff, sidecarFile };
 }
 function buildOpenSpecWorkspaceInfo(changeWorkspaceDir, profile, handoff, sidecarFile) {
-  const changeId = path4.basename(changeWorkspaceDir);
-  const proposalFile = path4.join(changeWorkspaceDir, "proposal.md");
-  const specFile = path4.join(changeWorkspaceDir, "spec.md");
-  const designFile = path4.join(changeWorkspaceDir, "design.md");
-  const tasksFile = path4.join(changeWorkspaceDir, "tasks.md");
+  const changeId = path5.basename(changeWorkspaceDir);
+  const proposalFile = path5.join(changeWorkspaceDir, "proposal.md");
+  const specFile = path5.join(changeWorkspaceDir, "spec.md");
+  const designFile = path5.join(changeWorkspaceDir, "design.md");
+  const tasksFile = path5.join(changeWorkspaceDir, "tasks.md");
   return {
     framework: "openspec",
     changeId,
     changeDir: changeWorkspaceDir,
     profile,
-    proposalFile: fs7.existsSync(proposalFile) ? proposalFile : void 0,
-    specFile: fs7.existsSync(specFile) ? specFile : void 0,
-    designFile: fs7.existsSync(designFile) ? designFile : void 0,
-    tasksFile: fs7.existsSync(tasksFile) ? tasksFile : void 0,
+    proposalFile: fs8.existsSync(proposalFile) ? proposalFile : void 0,
+    specFile: fs8.existsSync(specFile) ? specFile : void 0,
+    designFile: fs8.existsSync(designFile) ? designFile : void 0,
+    tasksFile: fs8.existsSync(tasksFile) ? tasksFile : void 0,
     sidecarFile,
     handoff: handoff || void 0
   };
@@ -1890,28 +2173,28 @@ function buildOpenSpecWorkspaceInfo(changeWorkspaceDir, profile, handoff, sideca
 var OpenSpecAdapter = class {
   framework = "openspec";
   getChangeWorkspaceDir(rootDir, changeId) {
-    const openspecDir = path4.join(rootDir, "openspec", "changes", changeId);
-    if (fs7.existsSync(openspecDir)) return openspecDir;
-    const activeChangeDir = path4.join(rootDir, "specs", "changes", "active", changeId);
-    if (fs7.existsSync(activeChangeDir)) return activeChangeDir;
-    const completedChangeDir = path4.join(rootDir, "specs", "changes", "completed", changeId);
-    if (fs7.existsSync(completedChangeDir)) return completedChangeDir;
+    const openspecDir = path5.join(rootDir, "openspec", "changes", changeId);
+    if (fs8.existsSync(openspecDir)) return openspecDir;
+    const activeChangeDir = path5.join(rootDir, "specs", "changes", "active", changeId);
+    if (fs8.existsSync(activeChangeDir)) return activeChangeDir;
+    const completedChangeDir = path5.join(rootDir, "specs", "changes", "completed", changeId);
+    if (fs8.existsSync(completedChangeDir)) return completedChangeDir;
     return activeChangeDir;
   }
   depositSidecar(options) {
     const changeDir = this.getChangeWorkspaceDir(options.rootDir, options.changeId);
-    if (!fs7.existsSync(changeDir)) {
-      fs7.mkdirSync(changeDir, { recursive: true });
+    if (!fs8.existsSync(changeDir)) {
+      fs8.mkdirSync(changeDir, { recursive: true });
     }
     const handoff = normalizeHandoffPayload(options.handoff, options.changeId);
     const filename = options.format === "json" ? "handoff.json" : "handoff.yaml";
-    const filePath = path4.join(changeDir, filename);
+    const filePath = path5.join(changeDir, filename);
     const content = options.format === "json" ? JSON.stringify(handoff, null, 2) : yaml3.dump(handoff, { indent: 2, lineWidth: -1 });
-    fs7.writeFileSync(filePath, content, "utf-8");
+    fs8.writeFileSync(filePath, content, "utf-8");
     return filePath;
   }
   loadSidecar(changeWorkspaceDir) {
-    if (!fs7.existsSync(changeWorkspaceDir)) return null;
+    if (!fs8.existsSync(changeWorkspaceDir)) return null;
     const candidateFiles = [
       "handoff.yaml",
       "handoff.yml",
@@ -1922,10 +2205,10 @@ var OpenSpecAdapter = class {
       "product-handoff.json"
     ];
     for (const file of candidateFiles) {
-      const fullPath = path4.join(changeWorkspaceDir, file);
-      if (fs7.existsSync(fullPath)) {
+      const fullPath = path5.join(changeWorkspaceDir, file);
+      if (fs8.existsSync(fullPath)) {
         try {
-          const raw = fs7.readFileSync(fullPath, "utf-8").replace(/^\uFEFF/, "");
+          const raw = fs8.readFileSync(fullPath, "utf-8").replace(/^\uFEFF/, "");
           const parsed = file.endsWith(".json") ? JSON.parse(raw) : yaml3.load(raw);
           if (parsed && typeof parsed === "object" && parsed.id && String(parsed.id).startsWith("HOF-")) {
             return parsed;
@@ -1937,7 +2220,7 @@ var OpenSpecAdapter = class {
     return null;
   }
   validateWorkspace(changeWorkspaceDir) {
-    if (!fs7.existsSync(changeWorkspaceDir)) {
+    if (!fs8.existsSync(changeWorkspaceDir)) {
       return {
         valid: false,
         errors: [`El directorio del cambio OpenSpec no existe: ${changeWorkspaceDir}`],
@@ -1946,7 +2229,7 @@ var OpenSpecAdapter = class {
     }
     const errors = [];
     const warnings = [];
-    const specFile = path4.join(changeWorkspaceDir, "spec.md");
+    const specFile = path5.join(changeWorkspaceDir, "spec.md");
     const profile = parseChangeProfile(specFile);
     validateSpecFileContent(specFile, changeWorkspaceDir, errors);
     const { handoff, sidecarFile } = validateOpenSpecStructure(profile, changeWorkspaceDir, this, errors, warnings);
@@ -1960,9 +2243,9 @@ var OpenSpecAdapter = class {
   }
 };
 function parseChangeProfile2(specFile) {
-  if (!fs7.existsSync(specFile)) return "standard";
+  if (!fs8.existsSync(specFile)) return "standard";
   try {
-    const rawSpec = fs7.readFileSync(specFile, "utf-8").replace(/^\uFEFF/, "");
+    const rawSpec = fs8.readFileSync(specFile, "utf-8").replace(/^\uFEFF/, "");
     const match = rawSpec.match(/^---\r?\n([\s\S]*?)\r?\n---/);
     if (match) {
       const parsedFm = yaml3.load(match[1]);
@@ -1984,12 +2267,12 @@ function checkSpecGherkinFormat2(parsedFm, rawSpec, changeWorkspaceDir, errors)
   }
 }
 function validateSpecFileContent2(specFile, changeWorkspaceDir, errors) {
-  if (!fs7.existsSync(specFile)) {
+  if (!fs8.existsSync(specFile)) {
     errors.push(`Falta el archivo de especificaci\xF3n obligatorio 'spec.md' en ${changeWorkspaceDir}.`);
     return;
   }
   try {
-    const rawSpec = fs7.readFileSync(specFile, "utf-8").replace(/^\uFEFF/, "");
+    const rawSpec = fs8.readFileSync(specFile, "utf-8").replace(/^\uFEFF/, "");
     const match = rawSpec.match(/^---\r?\n([\s\S]*?)\r?\n---/);
     if (match) {
       const parsedFm = yaml3.load(match[1]);
@@ -2008,19 +2291,19 @@ function validateHandoffSidecar2(handoff, changeWorkspaceDir, errors) {
   if (!handoff.subgraph || !Array.isArray(handoff.subgraph.requirements)) {
     errors.push(`El sidecar '${handoff.id}' no define un subgrafo de requerimientos v\xE1lido.`);
   }
-  return path4.join(changeWorkspaceDir, "handoff.yaml");
+  return path5.join(changeWorkspaceDir, "handoff.yaml");
 }
 function validateSpecKitStructure(profile, changeWorkspaceDir, adapter, errors, warnings) {
-  const planFile = path4.join(changeWorkspaceDir, "plan.md");
-  const tasksFile = path4.join(changeWorkspaceDir, "tasks.md");
+  const planFile = path5.join(changeWorkspaceDir, "plan.md");
+  const tasksFile = path5.join(changeWorkspaceDir, "tasks.md");
   if (profile === "patch") {
     const handoff2 = adapter.loadSidecar(changeWorkspaceDir);
-    return { handoff: handoff2, sidecarFile: handoff2 ? path4.join(changeWorkspaceDir, "handoff.yaml") : void 0 };
+    return { handoff: handoff2, sidecarFile: handoff2 ? path5.join(changeWorkspaceDir, "handoff.yaml") : void 0 };
   }
-  if (!fs7.existsSync(tasksFile)) {
+  if (!fs8.existsSync(tasksFile)) {
     errors.push(`Falta el archivo de tareas obligatorio 'tasks.md' en ${changeWorkspaceDir}.`);
   }
-  if (!fs7.existsSync(planFile)) {
+  if (!fs8.existsSync(planFile)) {
     warnings.push(`Se recomienda incluir 'plan.md' en el espacio de trabajo Spec Kit.`);
   }
   const handoff = adapter.loadSidecar(changeWorkspaceDir);
@@ -2028,18 +2311,18 @@ function validateSpecKitStructure(profile, changeWorkspaceDir, adapter, errors,
   return { handoff, sidecarFile };
 }
 function buildSpecKitWorkspaceInfo(changeWorkspaceDir, profile, handoff, sidecarFile) {
-  const changeId = path4.basename(changeWorkspaceDir);
-  const specFile = path4.join(changeWorkspaceDir, "spec.md");
-  const planFile = path4.join(changeWorkspaceDir, "plan.md");
-  const tasksFile = path4.join(changeWorkspaceDir, "tasks.md");
+  const changeId = path5.basename(changeWorkspaceDir);
+  const specFile = path5.join(changeWorkspaceDir, "spec.md");
+  const planFile = path5.join(changeWorkspaceDir, "plan.md");
+  const tasksFile = path5.join(changeWorkspaceDir, "tasks.md");
   return {
     framework: "speckit",
     changeId,
     changeDir: changeWorkspaceDir,
     profile,
-    specFile: fs7.existsSync(specFile) ? specFile : void 0,
-    designFile: fs7.existsSync(planFile) ? planFile : void 0,
-    tasksFile: fs7.existsSync(tasksFile) ? tasksFile : void 0,
+    specFile: fs8.existsSync(specFile) ? specFile : void 0,
+    designFile: fs8.existsSync(planFile) ? planFile : void 0,
+    tasksFile: fs8.existsSync(tasksFile) ? tasksFile : void 0,
     sidecarFile,
     handoff: handoff || void 0
   };
@@ -2047,18 +2330,18 @@ function buildSpecKitWorkspaceInfo(changeWorkspaceDir, profile, handoff, sidecar
 var SpecKitAdapter = class {
   framework = "speckit";
   getChangeWorkspaceDir(rootDir, changeId) {
-    const standardDir = path4.join(rootDir, "specs", changeId);
-    if (fs7.existsSync(standardDir)) return standardDir;
-    const activeChangeDir = path4.join(rootDir, "specs", "changes", "active", changeId);
-    if (fs7.existsSync(activeChangeDir)) return activeChangeDir;
-    const completedChangeDir = path4.join(rootDir, "specs", "changes", "completed", changeId);
-    if (fs7.existsSync(completedChangeDir)) return completedChangeDir;
+    const standardDir = path5.join(rootDir, "specs", changeId);
+    if (fs8.existsSync(standardDir)) return standardDir;
+    const activeChangeDir = path5.join(rootDir, "specs", "changes", "active", changeId);
+    if (fs8.existsSync(activeChangeDir)) return activeChangeDir;
+    const completedChangeDir = path5.join(rootDir, "specs", "changes", "completed", changeId);
+    if (fs8.existsSync(completedChangeDir)) return completedChangeDir;
     return standardDir;
   }
   depositSidecar(options) {
     const changeDir = this.getChangeWorkspaceDir(options.rootDir, options.changeId);
-    if (!fs7.existsSync(changeDir)) {
-      fs7.mkdirSync(changeDir, { recursive: true });
+    if (!fs8.existsSync(changeDir)) {
+      fs8.mkdirSync(changeDir, { recursive: true });
     }
     const handoff = { ...options.handoff };
     if (!handoff.id.startsWith("HOF-")) {
@@ -2071,20 +2354,20 @@ var SpecKitAdapter = class {
       handoff.createdAt = (/* @__PURE__ */ new Date()).toISOString();
     }
     const filename = options.format === "json" ? "handoff.json" : "handoff.yaml";
-    const filePath = path4.join(changeDir, filename);
+    const filePath = path5.join(changeDir, filename);
     const content = options.format === "json" ? JSON.stringify(handoff, null, 2) : yaml3.dump(handoff, { indent: 2, lineWidth: -1 });
-    fs7.writeFileSync(filePath, content, "utf-8");
-    const specifyMemoryDir = path4.join(options.rootDir, ".specify", "memory");
-    if (fs7.existsSync(path4.join(options.rootDir, ".specify"))) {
-      if (!fs7.existsSync(specifyMemoryDir)) {
-        fs7.mkdirSync(specifyMemoryDir, { recursive: true });
+    fs8.writeFileSync(filePath, content, "utf-8");
+    const specifyMemoryDir = path5.join(options.rootDir, ".specify", "memory");
+    if (fs8.existsSync(path5.join(options.rootDir, ".specify"))) {
+      if (!fs8.existsSync(specifyMemoryDir)) {
+        fs8.mkdirSync(specifyMemoryDir, { recursive: true });
       }
-      fs7.writeFileSync(path4.join(specifyMemoryDir, `${options.changeId}.handoff.yaml`), content, "utf-8");
+      fs8.writeFileSync(path5.join(specifyMemoryDir, `${options.changeId}.handoff.yaml`), content, "utf-8");
     }
     return filePath;
   }
   loadSidecar(changeWorkspaceDir) {
-    if (!fs7.existsSync(changeWorkspaceDir)) return null;
+    if (!fs8.existsSync(changeWorkspaceDir)) return null;
     const candidateFiles = [
       "handoff.yaml",
       "handoff.yml",
@@ -2094,10 +2377,10 @@ var SpecKitAdapter = class {
       "handoff.json"
     ];
     for (const file of candidateFiles) {
-      const fullPath = path4.join(changeWorkspaceDir, file);
-      if (fs7.existsSync(fullPath)) {
+      const fullPath = path5.join(changeWorkspaceDir, file);
+      if (fs8.existsSync(fullPath)) {
         try {
-          const raw = fs7.readFileSync(fullPath, "utf-8").replace(/^\uFEFF/, "");
+          const raw = fs8.readFileSync(fullPath, "utf-8").replace(/^\uFEFF/, "");
           const parsed = file.endsWith(".json") ? JSON.parse(raw) : yaml3.load(raw);
           if (parsed && typeof parsed === "object" && parsed.id && String(parsed.id).startsWith("HOF-")) {
             return parsed;
@@ -2109,7 +2392,7 @@ var SpecKitAdapter = class {
     return null;
   }
   validateWorkspace(changeWorkspaceDir) {
-    if (!fs7.existsSync(changeWorkspaceDir)) {
+    if (!fs8.existsSync(changeWorkspaceDir)) {
       return {
         valid: false,
         errors: [`El directorio del cambio Spec Kit no existe: ${changeWorkspaceDir}`],
@@ -2118,7 +2401,7 @@ var SpecKitAdapter = class {
     }
     const errors = [];
     const warnings = [];
-    const specFile = path4.join(changeWorkspaceDir, "spec.md");
+    const specFile = path5.join(changeWorkspaceDir, "spec.md");
     const profile = parseChangeProfile2(specFile);
     validateSpecFileContent2(specFile, changeWorkspaceDir, errors);
     const { handoff, sidecarFile } = validateSpecKitStructure(profile, changeWorkspaceDir, this, errors, warnings);
@@ -2290,27 +2573,27 @@ ${frontmatter}---
 ${body}`;
 }
 function materializeCanonicalArtifact(rootDir, item, changeId, author, date) {
-  const targetPath = path4.join(rootDir, item.targetDir, `${item.id}.md`);
-  if (fs7.existsSync(targetPath)) return targetPath;
-  fs7.mkdirSync(path4.dirname(targetPath), { recursive: true });
+  const targetPath = path5.join(rootDir, item.targetDir, `${item.id}.md`);
+  if (fs8.existsSync(targetPath)) return targetPath;
+  fs8.mkdirSync(path5.dirname(targetPath), { recursive: true });
   const initialContent = buildCanonicalInitialContent(item, changeId, author, date);
-  fs7.writeFileSync(targetPath, initialContent, "utf-8");
+  fs8.writeFileSync(targetPath, initialContent, "utf-8");
   return targetPath;
 }
 function findChangeWorkspaceDir(rootDir, changeId) {
-  const activeDir = path4.join(rootDir, "specs", "changes", "active", changeId);
-  if (fs7.existsSync(activeDir)) return activeDir;
-  const completedDir = path4.join(rootDir, "specs", "changes", "completed", changeId);
-  if (fs7.existsSync(completedDir)) return completedDir;
-  const openspecActive = path4.join(rootDir, "openspec", "changes", changeId);
-  if (fs7.existsSync(openspecActive)) return openspecActive;
+  const activeDir = path5.join(rootDir, "specs", "changes", "active", changeId);
+  if (fs8.existsSync(activeDir)) return activeDir;
+  const completedDir = path5.join(rootDir, "specs", "changes", "completed", changeId);
+  if (fs8.existsSync(completedDir)) return completedDir;
+  const openspecActive = path5.join(rootDir, "openspec", "changes", changeId);
+  if (fs8.existsSync(openspecActive)) return openspecActive;
   return null;
 }
 function checkTasksExecution(changeDir, changeId) {
-  const tasksFile = path4.join(changeDir, "tasks.md");
+  const tasksFile = path5.join(changeDir, "tasks.md");
   const allTasks = [];
-  if (fs7.existsSync(tasksFile)) {
-    allTasks.push(...parseTasksFromContent(fs7.readFileSync(tasksFile, "utf-8")));
+  if (fs8.existsSync(tasksFile)) {
+    allTasks.push(...parseTasksFromContent(fs8.readFileSync(tasksFile, "utf-8")));
   }
   const completedTasks = allTasks.filter((t) => t.status === "COMPLETED").map((t) => t.id);
   const pendingTasks = allTasks.filter((t) => t.status !== "COMPLETED").map((t) => t.id);
@@ -2342,9 +2625,9 @@ function buildSubgraphFromProposalIds(ids) {
 function resolveChangeHandoff(changeDir, changeId) {
   const sidecar = loadProductHandoffSidecar(changeDir);
   if (sidecar) return sidecar;
-  const proposalFile = path4.join(changeDir, "proposal.md");
-  if (!fs7.existsSync(proposalFile)) return null;
-  const propContent = fs7.readFileSync(proposalFile, "utf-8");
+  const proposalFile = path5.join(changeDir, "proposal.md");
+  if (!fs8.existsSync(proposalFile)) return null;
+  const propContent = fs8.readFileSync(proposalFile, "utf-8");
   const { frontmatter } = parseFrontmatter(propContent);
   const citations = Array.isArray(frontmatter.citations) ? frontmatter.citations : [];
   const ids = citations.map((c) => c.id || "").filter(Boolean);
@@ -2358,9 +2641,9 @@ function resolveChangeHandoff(changeDir, changeId) {
 }
 function materializeNewCatalogArtifacts(changeDir, rootDir, changeId, author, date, errors) {
   const created = [];
-  const specFile = path4.join(changeDir, "spec.md");
-  if (!fs7.existsSync(specFile)) return created;
-  const specContent = fs7.readFileSync(specFile, "utf-8");
+  const specFile = path5.join(changeDir, "spec.md");
+  if (!fs8.existsSync(specFile)) return created;
+  const specContent = fs8.readFileSync(specFile, "utf-8");
   const { newItems } = parseSpecCatalogScope(specContent);
   for (const item of newItems) {
     try {
@@ -2377,10 +2660,10 @@ function loadCanonicalArtifacts(rootDir) {
   const allMdFiles = walkMdFiles(rootDir);
   const canonicalArtifacts = /* @__PURE__ */ new Map();
   for (const file of allMdFiles) {
-    const relFile = path4.relative(rootDir, file).replace(/\\/g, "/");
+    const relFile = path5.relative(rootDir, file).replace(/\\/g, "/");
     if (relFile.includes("specs/changes/") || relFile.includes("templates/")) continue;
     try {
-      const content = fs7.readFileSync(file, "utf-8");
+      const content = fs8.readFileSync(file, "utf-8");
       const { frontmatter, body } = parseFrontmatter(content);
       if (frontmatter.id) canonicalArtifacts.set(String(frontmatter.id), { file, frontmatter, body });
     } catch {
@@ -2393,7 +2676,7 @@ function writeUpdatedArtifact(file, frontmatter, body) {
 ${yaml3.dump(frontmatter, { indent: 2, lineWidth: -1 }).trim()}
 ---
 `;
-  fs7.writeFileSync(file, yamlHeader + body, "utf-8");
+  fs8.writeFileSync(file, yamlHeader + body, "utf-8");
 }
 function updateSingleCanonicalRequirement(canonical, completedTasks, changeId, date, author) {
   const fm = canonical.frontmatter;
@@ -2509,28 +2792,28 @@ function updateArchitectureComponents(citedComponents, canonicalArtifacts, targe
   return updated;
 }
 function moveToCompletedFolder(changeDir, changeId, rootDir) {
-  const completedParent = path4.join(rootDir, "specs", "changes", "completed");
-  if (!fs7.existsSync(completedParent)) fs7.mkdirSync(completedParent, { recursive: true });
-  const destDir = path4.join(completedParent, changeId);
-  if (fs7.existsSync(destDir)) fs7.rmSync(destDir, { recursive: true, force: true });
-  fs7.renameSync(changeDir, destDir);
-  const destProposal = path4.join(destDir, "proposal.md");
-  if (fs7.existsSync(destProposal)) {
-    const { frontmatter, body } = parseFrontmatter(fs7.readFileSync(destProposal, "utf-8"));
+  const completedParent = path5.join(rootDir, "specs", "changes", "completed");
+  if (!fs8.existsSync(completedParent)) fs8.mkdirSync(completedParent, { recursive: true });
+  const destDir = path5.join(completedParent, changeId);
+  if (fs8.existsSync(destDir)) fs8.rmSync(destDir, { recursive: true, force: true });
+  fs8.renameSync(changeDir, destDir);
+  const destProposal = path5.join(destDir, "proposal.md");
+  if (fs8.existsSync(destProposal)) {
+    const { frontmatter, body } = parseFrontmatter(fs8.readFileSync(destProposal, "utf-8"));
     frontmatter.status = "applied";
     writeUpdatedArtifact(destProposal, frontmatter, body);
   }
   return destDir;
 }
 function archiveChangeWorkspace(changeDir, changeId, rootDir, autoArchive, completedAll) {
-  const isActiveFolder = changeDir.includes("specs" + path4.sep + "changes" + path4.sep + "active");
+  const isActiveFolder = changeDir.includes("specs" + path5.sep + "changes" + path5.sep + "active");
   if (completedAll && autoArchive && isActiveFolder) {
     const destDir = moveToCompletedFolder(changeDir, changeId, rootDir);
     return { archived: true, archivedPath: destDir };
   }
-  const proposalFile = path4.join(changeDir, "proposal.md");
-  if (fs7.existsSync(proposalFile)) {
-    const { frontmatter, body } = parseFrontmatter(fs7.readFileSync(proposalFile, "utf-8"));
+  const proposalFile = path5.join(changeDir, "proposal.md");
+  if (fs8.existsSync(proposalFile)) {
+    const { frontmatter, body } = parseFrontmatter(fs8.readFileSync(proposalFile, "utf-8"));
     if (completedAll) frontmatter.status = "completed";
     writeUpdatedArtifact(proposalFile, frontmatter, body);
   }
@@ -2595,9 +2878,9 @@ function collectSubgraphPromotableIds(subgraph) {
   return Array.from(new Set(combined));
 }
 function collectSpecAffectedNonArchIds(changeDir) {
-  const specFile = path4.join(changeDir, "spec.md");
-  if (!fs7.existsSync(specFile)) return [];
-  const { affectedItems } = parseSpecCatalogScope(fs7.readFileSync(specFile, "utf-8"));
+  const specFile = path5.join(changeDir, "spec.md");
+  if (!fs8.existsSync(specFile)) return [];
+  const { affectedItems } = parseSpecCatalogScope(fs8.readFileSync(specFile, "utf-8"));
   return affectedItems.map((item) => item.id).filter((id) => !isArchitectureComponentId(id));
 }
 function resolveIntegrationOptions(options) {
@@ -2671,8 +2954,8 @@ function resolveAuditStatus(integratedCount, targetCount, gapsCount) {
 function auditChangeEntry(changeDir, changeName, canonicalMap) {
   const handoff = loadProductHandoffSidecar(changeDir);
   if (!handoff) return null;
-  const tasksFile = path4.join(changeDir, "tasks.md");
-  const tasks = fs7.existsSync(tasksFile) ? parseTasksFromContent(fs7.readFileSync(tasksFile, "utf-8")) : [];
+  const tasksFile = path5.join(changeDir, "tasks.md");
+  const tasks = fs8.existsSync(tasksFile) ? parseTasksFromContent(fs8.readFileSync(tasksFile, "utf-8")) : [];
   const completed = tasks.filter((t) => t.status === "COMPLETED");
   const targetReqs = collectSubgraphPromotableIds(handoff.subgraph);
   const { integrated, missing, gaps } = auditChangeRequirements(targetReqs, canonicalMap);
@@ -2688,11 +2971,11 @@ function auditChangeEntry(changeDir, changeName, canonicalMap) {
   };
 }
 function collectParentDirAudits(parent, canonicalMap, audits, errors) {
-  if (!fs7.existsSync(parent)) return;
-  const entries = fs7.readdirSync(parent, { withFileTypes: true });
+  if (!fs8.existsSync(parent)) return;
+  const entries = fs8.readdirSync(parent, { withFileTypes: true });
   for (const e of entries) {
     if (!e.isDirectory()) continue;
-    const audit = auditChangeEntry(path4.join(parent, e.name), e.name, canonicalMap);
+    const audit = auditChangeEntry(path5.join(parent, e.name), e.name, canonicalMap);
     if (audit) {
       if (audit.gaps.length > 0) errors.push(`[${e.name}] Desalineaci\xF3n: ${audit.gaps.join("; ")}`);
       audits.push(audit);
@@ -2704,8 +2987,8 @@ function verifySddIntegration(options = {}) {
   const audits = [];
   const errors = [];
   const searchDirs = [
-    path4.join(rootDir, "specs", "changes", "completed"),
-    path4.join(rootDir, "specs", "changes", "active")
+    path5.join(rootDir, "specs", "changes", "completed"),
+    path5.join(rootDir, "specs", "changes", "active")
   ];
   const canonicalMap = loadCanonicalArtifacts(rootDir);
   for (const parent of searchDirs) {
@@ -2753,10 +3036,10 @@ function resolveMatchFromMetadata(activeFolders, options) {
   return {};
 }
 function validateActiveDirectory(activeParent) {
-  if (!fs7.existsSync(activeParent)) {
+  if (!fs8.existsSync(activeParent)) {
     return { ok: false, folders: [], error: `No existe el directorio de cambios activos en '${activeParent}'.` };
   }
-  const entries = fs7.readdirSync(activeParent, { withFileTypes: true });
+  const entries = fs8.readdirSync(activeParent, { withFileTypes: true });
   const activeFolders = entries.filter((e) => e.isDirectory()).map((e) => e.name);
   if (activeFolders.length === 0) {
     return { ok: false, folders: [], error: "No se encontraron carpetas de cambios activos en specs/changes/active/." };
@@ -2788,7 +3071,7 @@ function evaluateTasksProgress(changeId, tasks) {
 }
 function detectActiveChangeForIntegration(options = {}) {
   const rootDir = options.rootDir || process.cwd();
-  const activeParent = path4.join(rootDir, "specs", "changes", "active");
+  const activeParent = path5.join(rootDir, "specs", "changes", "active");
   const dirCheck = validateActiveDirectory(activeParent);
   if (!dirCheck.ok) {
     return {
@@ -2803,9 +3086,9 @@ function detectActiveChangeForIntegration(options = {}) {
   if (!match.changeId) {
     return buildUnmatchedActiveResult(dirCheck.folders, options);
   }
-  const changeDir = path4.join(activeParent, match.changeId);
-  const tasksFile = path4.join(changeDir, "tasks.md");
-  const tasks = fs7.existsSync(tasksFile) ? parseTasksFromContent(fs7.readFileSync(tasksFile, "utf-8")) : [];
+  const changeDir = path5.join(activeParent, match.changeId);
+  const tasksFile = path5.join(changeDir, "tasks.md");
+  const tasks = fs8.existsSync(tasksFile) ? parseTasksFromContent(fs8.readFileSync(tasksFile, "utf-8")) : [];
   const progress = evaluateTasksProgress(match.changeId, tasks);
   const reasons = match.reason ? [match.reason] : [];
   if (progress.error) reasons.push(progress.error);
@@ -2820,9 +3103,46 @@ function detectActiveChangeForIntegration(options = {}) {
     reasons
   };
 }
-function computeCanonicalSha256(content) {
+function extractSemanticContent(content) {
+  let normalized = content.replace(/\r\n/g, "\n");
+  normalized = normalized.replace(/(?:\n|^)##?\s+.*(?:Historial de Revisiones|Revision History)(?:[\s\S]*?(?=(?:\n##?\s+[^\n]+)|\s*$))/i, "");
+  normalized = normalized.replace(/(?:\n|^)\|\s*\*?Versi[oó]n\*?\s*\|\s*Fecha\s*\|\s*Autor[\s\S]*?(?=(?:\n##?\s+[^\n]+)|\s*$)/i, "");
+  return normalized.trimEnd() + "\n";
+}
+function slugify(text) {
+  return text.toLowerCase().replace(/[^\w\s-]/g, "").trim().replace(/\s+/g, "-");
+}
+function matchesSlug(line, clean) {
+  const headingText = line.replace(/^#+\s*/, "").trim();
+  const slug = slugify(headingText);
+  if (slug === clean || slug.includes(clean) || clean.includes(slug)) return true;
+  const slugNoNums = slugify(headingText.replace(/^\d+[\.\)]\s*/, "").trim());
+  return slugNoNums === clean || clean === slugNoNums;
+}
+function matchesHeading(content, clean) {
+  for (const line of content.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (trimmed.startsWith("#") && matchesSlug(trimmed, clean)) {
+      return true;
+    }
+  }
+  return false;
+}
+function validateAnchorExistence(targetContent, anchor) {
+  if (!anchor) return true;
+  const clean = anchor.replace(/^#/, "").trim().toLowerCase();
+  if (!clean || targetContent.toLowerCase().includes(clean)) return true;
+  if (matchesHeading(targetContent, clean)) return true;
+  const anchorRegex = new RegExp(`(?:id|name)=["']${clean}["']|\\{#${clean}\\}`, "i");
+  return anchorRegex.test(targetContent);
+}
+function computeRawSha256(content) {
   const normalized = content.replace(/\r\n/g, "\n");
-  return crypto.createHash("sha256").update(normalized, "utf-8").digest("hex");
+  return crypto3.createHash("sha256").update(normalized, "utf-8").digest("hex");
+}
+function computeCanonicalSha256(content) {
+  const semantic = extractSemanticContent(content);
+  return crypto3.createHash("sha256").update(semantic, "utf-8").digest("hex");
 }
 function parseFrontmatterId(content) {
   const match = content.match(/^---\r?\n([\s\S]*?)\r?\n---/);
@@ -2912,7 +3232,7 @@ function buildPdacReportHeader(isOk, driftsCount, nodesCount) {
   return [
     `# \u{1F512} PDaC Cryptographic Matrix and Drift Detection (Anti-Drift)`,
     ``,
-    `> **Evaluation Date:** ${(/* @__PURE__ */ new Date()).toISOString()}`,
+    `> **Evaluation Date:** ${resolveDeterministicDate().toISOString()}`,
     `> **Verdict:** ${verdict}`,
     ``,
     `---`,
@@ -2923,8 +3243,8 @@ function buildPdacReportHeader(isOk, driftsCount, nodesCount) {
     `| :--- | :--- | :--- | :--- |`
   ];
 }
-function generatePdacReportMarkdown(nodes, drifts, unresolvedCount) {
-  const isOk = drifts.length === 0 && unresolvedCount === 0;
+function generatePdacReportMarkdown(nodes, drifts, unresolvedCount, invalidAnchors = []) {
+  const isOk = drifts.length === 0 && unresolvedCount === 0 && invalidAnchors.length === 0;
   const header = buildPdacReportHeader(isOk, drifts.length, nodes.length);
   const nodeRows = nodes.map(
     (n) => `| **\`${n.id}\`** | \`${n.type}\` | ${n.title || "Untitled"} | \`sha256:${n.digest.substring(0, 16)}...\` |`
@@ -2936,9 +3256,9 @@ function isPdacDeliveryDoc(relFile) {
 }
 function processPdacFile(file, rootDir, baselineMap, allCitations) {
   try {
-    const content = fs7.readFileSync(file, "utf-8");
+    const content = fs8.readFileSync(file, "utf-8");
     const { id, type, title } = parseFrontmatterId(content);
-    const relFile = path4.relative(rootDir, file).replace(/\\/g, "/");
+    const relFile = path5.relative(rootDir, file).replace(/\\/g, "/");
     if (id) {
       const citations = extractCitations(content, relFile);
       baselineMap.set(id, {
@@ -2947,6 +3267,7 @@ function processPdacFile(file, rootDir, baselineMap, allCitations) {
         filePath: relFile,
         title,
         digest: computeCanonicalSha256(content),
+        rawDigest: computeRawSha256(content),
         rawContent: content,
         citations: citations.map((c) => ({
           targetId: c.targetId,
@@ -2970,38 +3291,65 @@ function scanPdacWorkspace(rootDir) {
   }
   return { baselineMap, allCitations };
 }
+function checkAnchor(citation, targetNode, invalidAnchors) {
+  if (citation.anchor && targetNode.rawContent) {
+    if (!validateAnchorExistence(targetNode.rawContent, citation.anchor)) {
+      invalidAnchors.push({
+        sourceFile: citation.sourceFile,
+        targetId: citation.targetId,
+        anchor: citation.anchor,
+        reason: `Anchor '${citation.anchor}' not found in target artifact '${citation.targetId}' (${targetNode.filePath})`
+      });
+    }
+  }
+}
+function checkDigest(citation, targetNode, drifts) {
+  if (!citation.expectedDigest) return;
+  const matches = citation.expectedDigest === targetNode.digest || targetNode.rawDigest !== void 0 && citation.expectedDigest === targetNode.rawDigest;
+  if (!matches) {
+    drifts.push({
+      sourceId: citation.sourceFile,
+      targetId: citation.targetId,
+      sourceFile: citation.sourceFile,
+      expectedDigest: citation.expectedDigest,
+      actualDigest: targetNode.digest
+    });
+  }
+}
 function computePdacDrifts(allCitations, baselineMap) {
   const drifts = [];
+  const unresolvedCitations = [];
+  const invalidAnchors = [];
   let unresolvedCount = 0;
   for (const citation of allCitations) {
     const targetNode = baselineMap.get(citation.targetId);
     if (!targetNode) {
       unresolvedCount++;
-      continue;
-    }
-    if (citation.expectedDigest && citation.expectedDigest !== targetNode.digest) {
-      drifts.push({
-        sourceId: citation.sourceFile,
-        targetId: citation.targetId,
+      unresolvedCitations.push({
         sourceFile: citation.sourceFile,
-        expectedDigest: citation.expectedDigest,
-        actualDigest: targetNode.digest
+        targetId: citation.targetId
       });
+      continue;
     }
+    checkAnchor(citation, targetNode, invalidAnchors);
+    checkDigest(citation, targetNode, drifts);
   }
-  return { drifts, unresolvedCount };
+  return { drifts, unresolvedCount, unresolvedCitations, invalidAnchors };
 }
 function verifyPdacGraph(options = {}) {
   const rootDir = options.rootDir || process.cwd();
   const { baselineMap, allCitations } = scanPdacWorkspace(rootDir);
-  const { drifts, unresolvedCount } = computePdacDrifts(allCitations, baselineMap);
+  const { drifts, unresolvedCount, unresolvedCitations, invalidAnchors } = computePdacDrifts(allCitations, baselineMap);
   const nodes = Array.from(baselineMap.values());
-  const reportMarkdown = generatePdacReportMarkdown(nodes, drifts, unresolvedCount);
+  const reportMarkdown = generatePdacReportMarkdown(nodes, drifts, unresolvedCount, invalidAnchors);
   return {
-    success: drifts.length === 0,
+    success: drifts.length === 0 && unresolvedCount === 0 && invalidAnchors.length === 0,
     totalNodes: nodes.length,
     totalEdges: allCitations.length,
     drifts,
+    unresolvedCount,
+    unresolvedCitations,
+    invalidAnchors,
     reportMarkdown
   };
 }
@@ -3066,22 +3414,22 @@ function updateCitationsInContent(content, baselineMap, sourceFile, details) {
 }
 function collectCandidateFilesForSync(rootDir, targetPath) {
   if (targetPath) {
-    const fullTarget = path4.isAbsolute(targetPath) ? targetPath : path4.join(rootDir, targetPath);
-    if (!fs7.existsSync(fullTarget)) return [];
-    return fs7.statSync(fullTarget).isDirectory() ? walkMdFiles(fullTarget) : [fullTarget];
+    const fullTarget = path5.isAbsolute(targetPath) ? targetPath : path5.join(rootDir, targetPath);
+    if (!fs8.existsSync(fullTarget)) return [];
+    return fs8.statSync(fullTarget).isDirectory() ? walkMdFiles(fullTarget) : [fullTarget];
   }
   return walkMdFiles(rootDir).filter((f) => {
-    const relFile = path4.relative(rootDir, f).replace(/\\/g, "/");
+    const relFile = path5.relative(rootDir, f).replace(/\\/g, "/");
     return isPdacDeliveryDoc(relFile);
   });
 }
 function syncSingleFile(file, rootDir, baselineMap, details) {
   try {
-    const content = fs7.readFileSync(file, "utf-8");
-    const relFile = path4.relative(rootDir, file).replace(/\\/g, "/");
+    const content = fs8.readFileSync(file, "utf-8");
+    const relFile = path5.relative(rootDir, file).replace(/\\/g, "/");
     const { updatedContent, changed } = updateCitationsInContent(content, baselineMap, relFile, details);
     if (changed) {
-      fs7.writeFileSync(file, updatedContent, "utf-8");
+      fs8.writeFileSync(file, updatedContent, "utf-8");
       return relFile;
     }
   } catch {
@@ -3284,6 +3632,36 @@ var STARTER_SCHEMAS = Object.entries(STARTER_SCHEMAS_MAP).map(([relPath, schema]
 }));
 
 // src/verifiers/schemas.ts
+var ajvInstance = new Ajv2020({
+  allErrors: true,
+  strict: false,
+  validateFormats: true,
+  verbose: true
+});
+addFormats(ajvInstance);
+var compiledSchemaCache = /* @__PURE__ */ new WeakMap();
+function formatFieldPath(err, propPath) {
+  const field = err.instancePath ? err.instancePath.replace(/^\//, "").replace(/\//g, ".") : propPath || "root";
+  return propPath && field !== "root" && field ? `${propPath}.${field}` : field || "root";
+}
+var KEYWORD_FORMATTERS = {
+  required: (p, _err, fullPath) => `'${fullPath}' missing required field '${String(p?.missingProperty)}'`,
+  additionalProperties: (p, _err, fullPath) => `'${fullPath}' contains disallowed extra property '${String(p?.additionalProperty)}'`,
+  minLength: (p, _err, fullPath) => `'${fullPath}' length must be >= ${String(p?.limit)}`,
+  maxLength: (p, _err, fullPath) => `'${fullPath}' length must be <= ${String(p?.limit)}`,
+  enum: (p, err, fullPath) => `'${fullPath}' must be one of [${Array.isArray(p?.allowedValues) ? p.allowedValues.join(", ") : ""}], received '${String(err.data)}'`,
+  uniqueItems: (_p, _err, fullPath) => `'${fullPath}' contains duplicate items (must have unique items)`,
+  pattern: (p, err, fullPath) => `'${fullPath}' value '${String(err.data)}' does not match pattern ${String(p?.pattern)}`
+};
+function formatKeywordMessage(err, fullPath) {
+  const p = err.params;
+  const formatter = KEYWORD_FORMATTERS[err.keyword];
+  return formatter ? formatter(p, err, fullPath) : `'${fullPath}' ${err.message || "validation failed"}`;
+}
+function formatAjvError(err, propPath) {
+  const fullPath = formatFieldPath(err, propPath);
+  return formatKeywordMessage(err, fullPath);
+}
 var TYPE_TO_SCHEMA_MAP = {
   // Product
   actor: "schemas/product/actor.schema.json",
@@ -3428,10 +3806,10 @@ var EXCLUDED_SCHEMA_DIRS = /* @__PURE__ */ new Set([
 ]);
 function walkHandoffSidecars(dir, fileList = []) {
   try {
-    if (!fs7.existsSync(dir)) return fileList;
-    for (const file of fs7.readdirSync(dir)) {
-      const fullPath = path4.join(dir, file);
-      if (fs7.statSync(fullPath).isDirectory()) {
+    if (!fs8.existsSync(dir)) return fileList;
+    for (const file of fs8.readdirSync(dir)) {
+      const fullPath = path5.join(dir, file);
+      if (fs8.statSync(fullPath).isDirectory()) {
         if (!EXCLUDED_SCHEMA_DIRS.has(file) && !file.startsWith("temp-") && !file.startsWith(".temp-")) {
           walkHandoffSidecars(fullPath, fileList);
         }
@@ -3454,157 +3832,41 @@ function extractArtifactData(filePath, content) {
   }
   return extractFrontmatter(content);
 }
-function validateConst(value, schema, currentProp) {
-  if (schema.const !== void 0 && value !== schema.const) {
-    return [`'${currentProp}' must equal '${schema.const}', received '${String(value)}'`];
+function getOrCompileSchema(schema) {
+  const schemaObj = schema;
+  if (typeof schemaObj.$id === "string") {
+    const existing = ajvInstance.getSchema(schemaObj.$id);
+    if (existing) return existing;
+    return ajvInstance.compile(schema);
   }
-  return [];
-}
-function validateEnum(value, schema, currentProp) {
-  if (schema.enum !== void 0 && !schema.enum.includes(value)) {
-    return [`'${currentProp}' must be one of [${schema.enum.join(", ")}], received '${String(value)}'`];
-  }
-  return [];
-}
-function validateCombinators(value, schema, propPath, currentProp) {
-  if (schema.oneOf) {
-    const matchCount = schema.oneOf.filter((sub) => validateAgainstSchema(value, sub, propPath).length === 0).length;
-    if (matchCount !== 1) {
-      return [`'${currentProp}' must match exactly one sub-schema in oneOf`];
-    }
-  }
-  if (schema.anyOf) {
-    const anyMatched = schema.anyOf.some((sub) => validateAgainstSchema(value, sub, propPath).length === 0);
-    if (!anyMatched) {
-      return [`'${currentProp}' did not match any allowed alternative in anyOf`];
-    }
-  }
-  return [];
-}
-function getActualJsonType(value) {
-  if (value === null) return "null";
-  if (Array.isArray(value)) return "array";
-  const t = typeof value;
-  if (t === "number" && Number.isInteger(value)) return "integer";
-  return t;
-}
-function validateType(value, schema, currentProp) {
-  if (schema.type === void 0) return [];
-  const allowed = Array.isArray(schema.type) ? schema.type : [schema.type];
-  const actual = getActualJsonType(value);
-  const matches = allowed.some((t) => t === actual || t === "number" && actual === "integer");
-  if (!matches) {
-    return [`'${currentProp}' expected type [${allowed.join("|")}], received '${actual}'`];
-  }
-  return [];
-}
-function validateString(value, schema, currentProp) {
-  const errors = [];
-  if (schema.minLength !== void 0 && value.length < schema.minLength) {
-    errors.push(`'${currentProp}' length must be >= ${schema.minLength}`);
-  }
-  if (schema.maxLength !== void 0 && value.length > schema.maxLength) {
-    errors.push(`'${currentProp}' length must be <= ${schema.maxLength}`);
-  }
-  if (schema.pattern !== void 0 && !new RegExp(schema.pattern).test(value)) {
-    errors.push(`'${currentProp}' value '${value}' does not match pattern ${schema.pattern}`);
-  }
-  if (schema.format === "date") {
-    const dateRegex = /^\d{4}-\d{2}-\d{2}$/;
-    if (!dateRegex.test(value) || isNaN(Date.parse(value))) {
-      errors.push(`'${currentProp}' must be a valid ISO-8601 date string (YYYY-MM-DD)`);
-    }
-  }
-  return errors;
-}
-function validateNumber(value, schema, currentProp) {
-  const errors = [];
-  if (schema.minimum !== void 0 && value < schema.minimum) {
-    errors.push(`'${currentProp}' must be >= ${schema.minimum}`);
-  }
-  if (schema.maximum !== void 0 && value > schema.maximum) {
-    errors.push(`'${currentProp}' must be <= ${schema.maximum}`);
-  }
-  return errors;
-}
-function validateArray(value, schema, currentProp) {
-  const errors = [];
-  if (schema.minItems !== void 0 && value.length < schema.minItems) {
-    errors.push(`'${currentProp}' items count must be >= ${schema.minItems}`);
-  }
-  if (schema.maxItems !== void 0 && value.length > schema.maxItems) {
-    errors.push(`'${currentProp}' items count must be <= ${schema.maxItems}`);
-  }
-  if (schema.items) {
-    value.forEach((item, idx) => {
-      errors.push(...validateAgainstSchema(item, schema.items, `${currentProp}[${idx}]`));
-    });
-  }
-  return errors;
-}
-function checkRequiredProperties(record, required, currentProp) {
-  if (!required) return [];
-  const errors = [];
-  for (const reqKey of required) {
-    if (!(reqKey in record) || record[reqKey] === void 0) {
-      errors.push(`'${currentProp}' missing required field '${reqKey}'`);
-    }
-  }
-  return errors;
-}
-function checkObjectProperties(record, schema, propPath, currentProp) {
-  const errors = [];
-  const properties = schema.properties || {};
-  for (const [key, propVal] of Object.entries(record)) {
-    const subPath = propPath ? `${propPath}.${key}` : key;
-    if (key in properties) {
-      errors.push(...validateAgainstSchema(propVal, properties[key], subPath));
-    } else if (schema.additionalProperties === false) {
-      errors.push(`'${currentProp}' contains disallowed extra property '${key}'`);
-    } else if (typeof schema.additionalProperties === "object") {
-      errors.push(...validateAgainstSchema(propVal, schema.additionalProperties, subPath));
-    }
-  }
-  return errors;
-}
-function validateObject(record, schema, propPath, currentProp) {
-  return [
-    ...checkRequiredProperties(record, schema.required, currentProp),
-    ...checkObjectProperties(record, schema, propPath, currentProp)
-  ];
-}
-function validateTypeSpecificRules(value, schema, propPath, currentProp) {
-  if (typeof value === "string") return validateString(value, schema, currentProp);
-  if (typeof value === "number") return validateNumber(value, schema, currentProp);
-  if (Array.isArray(value)) return validateArray(value, schema, currentProp);
-  if (typeof value === "object" && value !== null) {
-    return validateObject(value, schema, propPath, currentProp);
-  }
-  return [];
+  const cached = compiledSchemaCache.get(schema);
+  if (cached) return cached;
+  const compiled = ajvInstance.compile(schema);
+  compiledSchemaCache.set(schema, compiled);
+  return compiled;
 }
 function validateAgainstSchema(value, schema, propPath = "") {
-  const currentProp = propPath || "root";
-  const constErr = validateConst(value, schema, currentProp);
-  if (constErr.length > 0) return constErr;
-  const enumErr = validateEnum(value, schema, currentProp);
-  if (enumErr.length > 0) return enumErr;
-  const combErr = validateCombinators(value, schema, propPath, currentProp);
-  if (combErr.length > 0) return combErr;
-  const typeErr = validateType(value, schema, currentProp);
-  if (typeErr.length > 0) return typeErr;
-  return validateTypeSpecificRules(value, schema, propPath, currentProp);
+  if (!schema || typeof schema !== "object") return [];
+  try {
+    const validate = getOrCompileSchema(schema);
+    const valid = validate(value);
+    if (valid || !validate.errors) return [];
+    return validate.errors.map((err) => formatAjvError(err, propPath));
+  } catch (err) {
+    return [`Schema error: ${err instanceof Error ? err.message : String(err)}`];
+  }
 }
 function findSchemaFile(relSchemaPath, rootDir) {
-  const fullPath = path4.join(rootDir, relSchemaPath);
-  if (fs7.existsSync(fullPath)) return fullPath;
-  const fallbackPath = path4.join(process.cwd(), relSchemaPath);
-  if (fs7.existsSync(fallbackPath)) return fallbackPath;
+  const fullPath = path5.join(rootDir, relSchemaPath);
+  if (fs8.existsSync(fullPath)) return fullPath;
+  const fallbackPath = path5.join(process.cwd(), relSchemaPath);
+  if (fs8.existsSync(fallbackPath)) return fallbackPath;
   return null;
 }
 function loadJsonSchema(fullPath, relSchemaPath) {
-  if (fullPath && fs7.existsSync(fullPath)) {
+  if (fullPath && fs8.existsSync(fullPath)) {
     try {
-      return JSON.parse(fs7.readFileSync(fullPath, "utf-8"));
+      return JSON.parse(fs8.readFileSync(fullPath, "utf-8"));
     } catch {
     }
   }
@@ -3619,7 +3881,7 @@ function resolveSchemaForArtifact(frontmatter, rootDir) {
 }
 function loadSchemaFromPathOrType(schemaOrType, rootDir) {
   if (schemaOrType.endsWith(".json")) {
-    const fullPath = path4.isAbsolute(schemaOrType) ? schemaOrType : findSchemaFile(schemaOrType, rootDir);
+    const fullPath = path5.isAbsolute(schemaOrType) ? schemaOrType : findSchemaFile(schemaOrType, rootDir);
     const relNormalized = schemaOrType.replace(/\\/g, "/");
     const schema = loadJsonSchema(fullPath, relNormalized);
     return { schema, schemaId: schemaOrType };
@@ -3664,9 +3926,9 @@ function collectCandidateSchemaFiles(options, rootDir) {
   if (!options.targetPath) {
     return [...walkMdFiles(rootDir), ...walkHandoffSidecars(rootDir)];
   }
-  const target = path4.isAbsolute(options.targetPath) ? options.targetPath : path4.join(rootDir, options.targetPath);
-  if (!fs7.existsSync(target)) return [];
-  if (fs7.statSync(target).isDirectory()) {
+  const target = path5.isAbsolute(options.targetPath) ? options.targetPath : path5.join(rootDir, options.targetPath);
+  if (!fs8.existsSync(target)) return [];
+  if (fs8.statSync(target).isDirectory()) {
     return [...walkMdFiles(target), ...walkHandoffSidecars(target)];
   }
   if (target.endsWith(".md") || target.endsWith(".yaml") || target.endsWith(".yml")) {
@@ -3717,7 +3979,7 @@ function buildEvaluationFailure(relPath, err) {
 }
 function evaluateArtifactFile(file, relPath, rootDir) {
   try {
-    const content = fs7.readFileSync(file, "utf-8");
+    const content = fs8.readFileSync(file, "utf-8");
     const frontmatter = extractArtifactData(file, content);
     if (!frontmatter || !frontmatter.id) return null;
     const schemaInfo = resolveSchemaForArtifact(frontmatter, rootDir);
@@ -3752,7 +4014,7 @@ function verifyArtifactsSchemas(options = {}) {
   let validCount = 0;
   let totalEvaluated = 0;
   for (const file of filesToScan) {
-    const relPath = path4.relative(rootDir, file).replace(/\\/g, "/");
+    const relPath = path5.relative(rootDir, file).replace(/\\/g, "/");
     if (isIgnoredArtifactPath(relPath, Boolean(options.targetPath))) continue;
     const evaluation = evaluateArtifactFile(file, relPath, rootDir);
     if (!evaluation) continue;
@@ -3767,14 +4029,14 @@ function verifyArtifactsSchemas(options = {}) {
 }
 
 // src/adapters/sdd/scaffold.ts
-function slugify(text) {
+function slugify2(text) {
   return text.normalize("NFD").replace(/[\u0300-\u036f]/g, "").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
 }
 function extractDirMaxNum(dir) {
-  if (!fs7.existsSync(dir)) return 0;
+  if (!fs8.existsSync(dir)) return 0;
   let max = 0;
   try {
-    const entries = fs7.readdirSync(dir, { withFileTypes: true });
+    const entries = fs8.readdirSync(dir, { withFileTypes: true });
     for (const e of entries) {
       if (!e.isDirectory()) continue;
       const match = e.name.match(/^(?:chg|CHG|patch|PATCH)-(\d+)/i);
@@ -3791,10 +4053,10 @@ function extractDirMaxNum(dir) {
 }
 function getNextCorrelativeNumber(rootDir) {
   const candidateDirs = [
-    path4.join(rootDir, "specs", "changes", "active"),
-    path4.join(rootDir, "specs", "changes", "completed"),
-    path4.join(rootDir, "specs"),
-    path4.join(rootDir, "openspec", "changes")
+    path5.join(rootDir, "specs", "changes", "active"),
+    path5.join(rootDir, "specs", "changes", "completed"),
+    path5.join(rootDir, "specs"),
+    path5.join(rootDir, "openspec", "changes")
   ];
   let maxNum = 0;
   for (const dir of candidateDirs) {
@@ -3807,7 +4069,7 @@ function resolveChangeIdentifiers(rootDir, name, profile, options) {
   const targetChangeId = options.changeId || options.id;
   if (targetChangeId) {
     const rawId = targetChangeId.trim();
-    const slug = slugify(rawId);
+    const slug = slugify2(rawId);
     const canonicalId = rawId.toUpperCase();
     const match = rawId.match(/^(?:chg|CHG|patch|PATCH)-(\d+)/i);
     const padNum2 = match ? match[1] : "001";
@@ -3815,7 +4077,7 @@ function resolveChangeIdentifiers(rootDir, name, profile, options) {
   }
   const nextNum = getNextCorrelativeNumber(rootDir);
   const padNum = String(nextNum).padStart(3, "0");
-  const nameSlug = slugify(name);
+  const nameSlug = slugify2(name);
   const prefix = profile === "patch" ? "patch" : "chg";
   return {
     slug: `${prefix}-${padNum}-${nameSlug}`,
@@ -3824,13 +4086,13 @@ function resolveChangeIdentifiers(rootDir, name, profile, options) {
   };
 }
 function ensureEmptyChangeDir(changeDir) {
-  if (fs7.existsSync(changeDir)) {
-    const existing = fs7.readdirSync(changeDir);
+  if (fs8.existsSync(changeDir)) {
+    const existing = fs8.readdirSync(changeDir);
     if (existing.length > 0) {
       return `El directorio del cambio '${changeDir}' ya existe y no est\xE1 vac\xEDo.`;
     }
   } else {
-    fs7.mkdirSync(changeDir, { recursive: true });
+    fs8.mkdirSync(changeDir, { recursive: true });
   }
   return null;
 }
@@ -3839,7 +4101,7 @@ function scanCanonicalArtifacts(rootDir) {
   const artifactMap = /* @__PURE__ */ new Map();
   for (const file of allMdFiles) {
     try {
-      const content = fs7.readFileSync(file, "utf-8");
+      const content = fs8.readFileSync(file, "utf-8");
       const { frontmatter } = parseFrontmatter(content);
       if (frontmatter?.id) {
         const id = String(frontmatter.id);
@@ -4218,7 +4480,7 @@ function buildPatchSuccess(slug, canonicalId, specPath, citedArtifacts, errors)
     changeId: slug,
     canonicalId,
     profile: "patch",
-    changeDir: path4.dirname(specPath),
+    changeDir: path5.dirname(specPath),
     createdFiles: [specPath],
     citedArtifacts,
     errors
@@ -4229,10 +4491,10 @@ function scaffoldPatchChange(rootDir, changeDir, slug, canonicalId, name, inputF
   const citationsSection = citedArtifacts.length > 0 ? `citations:
 ${renderCitationsYamlBlock(citedArtifacts)}
 ` : "";
-  const specPath = path4.join(changeDir, "spec.md");
+  const specPath = path5.join(changeDir, "spec.md");
   const specFmObj = buildPatchFmObj(canonicalId);
   const specContent = buildPatchSpecContent(canonicalId, name, citationsSection);
-  fs7.writeFileSync(specPath, specContent, "utf-8");
+  fs8.writeFileSync(specPath, specContent, "utf-8");
   const errors = validatePatchArtifacts(rootDir, changeDir, specContent, specFmObj, adapter);
   return buildPatchSuccess(slug, canonicalId, specPath, citedArtifacts, errors);
 }
@@ -4243,46 +4505,46 @@ function buildGreenfieldContent(reqId, ucId, name, canonicalId, author, dateStr)
 ${body}`;
 }
 function createGreenfieldRequirement(rootDir, name, padNum, canonicalId, author, dateStr, createdFiles) {
-  const nameSlugUpper = slugify(name).toUpperCase();
+  const nameSlugUpper = slugify2(name).toUpperCase();
   const reqId = `FR-${padNum}-${nameSlugUpper}-001`;
   const ucId = `UC-${padNum}-${nameSlugUpper}`;
-  const productDir = path4.join(rootDir, "specs", "product");
-  if (!fs7.existsSync(productDir)) fs7.mkdirSync(productDir, { recursive: true });
-  const reqFilePath = path4.join(productDir, `${reqId}.md`);
-  if (fs7.existsSync(reqFilePath)) return null;
+  const productDir = path5.join(rootDir, "specs", "product");
+  if (!fs8.existsSync(productDir)) fs8.mkdirSync(productDir, { recursive: true });
+  const reqFilePath = path5.join(productDir, `${reqId}.md`);
+  if (fs8.existsSync(reqFilePath)) return null;
   const reqContent = buildGreenfieldContent(reqId, ucId, name, canonicalId, author, dateStr);
-  fs7.writeFileSync(reqFilePath, reqContent, "utf-8");
+  fs8.writeFileSync(reqFilePath, reqContent, "utf-8");
   createdFiles.push(reqFilePath);
   const digest = computeCanonicalSha256(reqContent);
   return { reqId, ucId, reqFilePath, digest };
 }
 function resolveMissingDraftDestination(rootDir, id) {
   if (id.startsWith("PRIV-REQ-")) {
-    return { dir: path4.join(rootDir, "specs", "privacy", "requirements"), type: "privacy-requirement" };
+    return { dir: path5.join(rootDir, "specs", "privacy", "requirements"), type: "privacy-requirement" };
   }
   if (id.startsWith("DATA-ASSET-")) {
-    return { dir: path4.join(rootDir, "specs", "privacy", "assets"), type: "data-asset" };
+    return { dir: path5.join(rootDir, "specs", "privacy", "assets"), type: "data-asset" };
   }
   if (id.startsWith("PRIV-ROPA-")) {
-    return { dir: path4.join(rootDir, "specs", "privacy", "ropa"), type: "privacy-ropa" };
+    return { dir: path5.join(rootDir, "specs", "privacy", "ropa"), type: "privacy-ropa" };
   }
   if (id.startsWith("UC-")) {
-    return { dir: path4.join(rootDir, "specs", "product"), type: "use-case" };
+    return { dir: path5.join(rootDir, "specs", "product"), type: "use-case" };
   }
   if (id.startsWith("SEC-REQ-") || id.startsWith("SAF-REQ-")) {
-    return { dir: path4.join(rootDir, "specs", "product"), type: "security-requirement" };
+    return { dir: path5.join(rootDir, "specs", "product"), type: "security-requirement" };
   }
-  return { dir: path4.join(rootDir, "specs", "product"), type: "requirement" };
+  return { dir: path5.join(rootDir, "specs", "product"), type: "requirement" };
 }
 function createMissingDraftRequirement(rootDir, name, id, canonicalId, createdFiles) {
   const { dir, type: reqType } = resolveMissingDraftDestination(rootDir, id);
-  if (!fs7.existsSync(dir)) fs7.mkdirSync(dir, { recursive: true });
-  const reqFilePath = path4.join(dir, `${id}.md`);
+  if (!fs8.existsSync(dir)) fs8.mkdirSync(dir, { recursive: true });
+  const reqFilePath = path5.join(dir, `${id}.md`);
   const header = MISSING_DRAFT_HEADER.replaceAll("{{ID}}", id).replaceAll("{{TYPE}}", reqType).replaceAll("{{NAME}}", name);
   const body = MISSING_DRAFT_BODY.replaceAll("{{ID}}", id).replaceAll("{{NAME}}", name).replaceAll("{{CANONICAL_ID}}", canonicalId);
   const reqContent = `${header}
 ${body}`;
-  fs7.writeFileSync(reqFilePath, reqContent, "utf-8");
+  fs8.writeFileSync(reqFilePath, reqContent, "utf-8");
   createdFiles.push(reqFilePath);
   const digest = computeCanonicalSha256(reqContent);
   return { reqFilePath, digest };
@@ -4397,7 +4659,7 @@ function initEmptyCitations() {
 }
 function ensureFallbackRequirement(col, padNum, name) {
   if (col.subRequirements.length === 0) {
-    col.subRequirements.push(`FR-${padNum}-${slugify(name).toUpperCase()}-001`);
+    col.subRequirements.push(`FR-${padNum}-${slugify2(name).toUpperCase()}-001`);
   }
 }
 function collectChangeCitations(rootDir, name, padNum, canonicalId, author, dateStr, inputFromIds, artifactMap, createdFiles) {
@@ -4411,7 +4673,7 @@ function collectChangeCitations(rootDir, name, padNum, canonicalId, author, date
   return col;
 }
 function renderProposalFile(changeDir, canonicalId, name, author, citationsYamlBlock) {
-  const proposalPath = path4.join(changeDir, "proposal.md");
+  const proposalPath = path5.join(changeDir, "proposal.md");
   const citationsSection = citationsYamlBlock ? `citations:
 ${citationsYamlBlock}
 ` : "";
@@ -4431,11 +4693,11 @@ ${name}
 ## 2. Dependencias Externas Evaluadas
 - Lista de dependencias nuevas a incorporar y verificaci\xF3n de licencia seg\xFAn \`license-policy.yaml\`.
 `;
-  fs7.writeFileSync(proposalPath, proposalContent, "utf-8");
+  fs8.writeFileSync(proposalPath, proposalContent, "utf-8");
   return proposalPath;
 }
 function renderSpecFile(changeDir, canonicalId, name, profile) {
-  const specPath = path4.join(changeDir, "spec.md");
+  const specPath = path5.join(changeDir, "spec.md");
   const specFmObj = {
     id: `SPEC-${canonicalId}`,
     type: "delivery-spec",
@@ -4456,12 +4718,12 @@ cucumber-tags:
 ---
 `;
   const body = SPEC_BODY.replaceAll("{{CANONICAL_ID}}", canonicalId).replaceAll("{{NAME}}", name);
-  fs7.writeFileSync(specPath, `${header}
+  fs8.writeFileSync(specPath, `${header}
 ${body}`, "utf-8");
   return { specPath, specFmObj };
 }
 function renderDesignFile(changeDir, canonicalId, name, author, dateStr, citationsYamlBlock) {
-  const designPath = path4.join(changeDir, "design.md");
+  const designPath = path5.join(changeDir, "design.md");
   const citationsSection = citationsYamlBlock ? `citations:
 ${citationsYamlBlock}
 ` : "";
@@ -4480,7 +4742,7 @@ contracts: []
 ${citationsSection}---
 `;
   const body = DESIGN_BODY.replaceAll("{{CANONICAL_ID}}", canonicalId).replaceAll("{{NAME}}", name).replaceAll("{{AUTHOR}}", author).replaceAll("{{DATE}}", dateStr);
-  fs7.writeFileSync(designPath, `${header}
+  fs8.writeFileSync(designPath, `${header}
 ${body}`, "utf-8");
   return designPath;
 }
@@ -4505,14 +4767,14 @@ function buildTasksFrontmatter(canonicalId, name, reqIds) {
   };
 }
 function renderTasksFile(changeDir, canonicalId, name, author, dateStr, reqIds) {
-  const tasksPath = path4.join(changeDir, "tasks.md");
+  const tasksPath = path5.join(changeDir, "tasks.md");
   const tasksFm = buildTasksFrontmatter(canonicalId, name, reqIds);
   const header = `---
 ${yaml3.dump(tasksFm, { indent: 2, lineWidth: -1 }).trim()}
 ---
 `;
   const body = TASKS_BODY.replaceAll("{{CANONICAL_ID}}", canonicalId).replaceAll("{{NAME}}", name).replaceAll("{{AUTHOR}}", author).replaceAll("{{DATE}}", dateStr);
-  fs7.writeFileSync(tasksPath, `${header}
+  fs8.writeFileSync(tasksPath, `${header}
 ${body}`, "utf-8");
   return { tasksPath, tasksFm };
 }
@@ -4691,7 +4953,7 @@ function resolveCiEnvironment(env = process.env) {
   };
 }
 function updateExistingEnvFile(filePath, envString, uppercaseKey) {
-  const content = fs7.readFileSync(filePath, "utf-8");
+  const content = fs8.readFileSync(filePath, "utf-8");
   const lines = content.split("\n");
   let found = false;
   const newLines = lines.map((line) => {
@@ -4702,15 +4964,15 @@ function updateExistingEnvFile(filePath, envString, uppercaseKey) {
     return line;
   });
   if (!found) newLines.push(envString);
-  fs7.writeFileSync(filePath, newLines.filter((l) => l.trim() !== "").join("\n") + "\n", "utf-8");
+  fs8.writeFileSync(filePath, newLines.filter((l) => l.trim() !== "").join("\n") + "\n", "utf-8");
 }
 function writeEnvOutputFile(envOutputFile, key, value) {
   const uppercaseKey = key.toUpperCase();
   const envString = `${uppercaseKey}=${value}`;
-  if (fs7.existsSync(envOutputFile)) {
+  if (fs8.existsSync(envOutputFile)) {
     updateExistingEnvFile(envOutputFile, envString, uppercaseKey);
   } else {
-    fs7.writeFileSync(envOutputFile, envString + "\n", "utf-8");
+    fs8.writeFileSync(envOutputFile, envString + "\n", "utf-8");
   }
 }
 function resolveEnvOutputFilePath(env) {
@@ -4720,8 +4982,8 @@ function resolveEnvOutputFilePath(env) {
   return void 0;
 }
 function emitCiOutput(key, value, env = process.env) {
-  if (env.GITHUB_OUTPUT && fs7.existsSync(env.GITHUB_OUTPUT)) {
-    fs7.appendFileSync(env.GITHUB_OUTPUT, `${key}=${value}
+  if (env.GITHUB_OUTPUT && fs8.existsSync(env.GITHUB_OUTPUT)) {
+    fs8.appendFileSync(env.GITHUB_OUTPUT, `${key}=${value}
 `, "utf-8");
   }
   if (env.TF_BUILD === "true") {
@@ -4763,11 +5025,11 @@ function isIgnoredEntry(name) {
   return name === "changes" || name === "active" || name === "node_modules";
 }
 function scanParentDirectoryHandoffs(parentDir, handoffsMap) {
-  if (!fs7.existsSync(parentDir)) return;
-  const entries = fs7.readdirSync(parentDir, { withFileTypes: true });
+  if (!fs8.existsSync(parentDir)) return;
+  const entries = fs8.readdirSync(parentDir, { withFileTypes: true });
   for (const entry of entries) {
     if (!entry.isDirectory() || isIgnoredEntry(entry.name)) continue;
-    const changeDir = path4.join(parentDir, entry.name);
+    const changeDir = path5.join(parentDir, entry.name);
     if (handooffsHasDir(handoffsMap, changeDir)) continue;
     const handoff = loadProductHandoffSidecar(changeDir);
     if (handoff?.id) {
@@ -4778,10 +5040,10 @@ function scanParentDirectoryHandoffs(parentDir, handoffsMap) {
 function scanAllProductHandoffs(rootDir) {
   const handoffsMap = /* @__PURE__ */ new Map();
   const candidateParentDirs = [
-    path4.join(rootDir, "specs", "changes", "active"),
-    path4.join(rootDir, "specs", "changes", "completed"),
-    path4.join(rootDir, "specs"),
-    path4.join(rootDir, "openspec", "changes")
+    path5.join(rootDir, "specs", "changes", "active"),
+    path5.join(rootDir, "specs", "changes", "completed"),
+    path5.join(rootDir, "specs"),
+    path5.join(rootDir, "openspec", "changes")
   ];
   for (const parentDir of candidateParentDirs) {
     scanParentDirectoryHandoffs(parentDir, handoffsMap);
@@ -4789,9 +5051,9 @@ function scanAllProductHandoffs(rootDir) {
   return handoffsMap;
 }
 function handooffsHasDir(map, dir) {
-  const norm = path4.resolve(dir);
+  const norm = path5.resolve(dir);
   for (const key of map.keys()) {
-    if (path4.resolve(key) === norm) return true;
+    if (path5.resolve(key) === norm) return true;
   }
   return false;
 }
@@ -4826,7 +5088,7 @@ function buildTraceabilityHeader(isOk, errors) {
   return [
     "# 360\xB0 Requirements Traceability Matrix (RTM)",
     "",
-    `*Verification Date: ${(/* @__PURE__ */ new Date()).toISOString()}*`,
+    `*Verification Date: ${resolveDeterministicDate().toISOString()}*`,
     `*Overall Status: ${isOk ? "100% TRACEABLE (PASSED)" : `ERRORS DETECTED (${errors} gaps)`}*`,
     "",
     "## 1. End-to-End Coverage (PDaC Handoff \u2794 arc42/NAF v4 \u2794 BDD/Gherkin)",
@@ -4888,9 +5150,9 @@ function isCodeTestFile(name) {
 }
 function indexFeatureFile(fullPath, rootDir, map) {
   try {
-    const content = fs7.readFileSync(fullPath, "utf-8");
+    const content = fs8.readFileSync(fullPath, "utf-8");
     const tags = extractFeatureTags(content);
-    const relFeature = path4.relative(rootDir, fullPath).replace(/\\/g, "/");
+    const relFeature = path5.relative(rootDir, fullPath).replace(/\\/g, "/");
     for (const tag of tags) {
       const existing = map.get(tag) || [];
       if (!existing.includes(relFeature)) existing.push(relFeature);
@@ -4900,11 +5162,11 @@ function indexFeatureFile(fullPath, rootDir, map) {
   }
 }
 function scanFeatureFiles(dir, rootDir, map) {
-  if (!fs7.existsSync(dir)) return;
+  if (!fs8.existsSync(dir)) return;
   try {
-    const entries = fs7.readdirSync(dir, { withFileTypes: true });
+    const entries = fs8.readdirSync(dir, { withFileTypes: true });
     for (const e of entries) {
-      const fullPath = path4.join(dir, e.name);
+      const fullPath = path5.join(dir, e.name);
       if (e.isDirectory() && !shouldSkipDir(e.name)) {
         scanFeatureFiles(fullPath, rootDir, map);
       } else if (e.name.endsWith(".feature")) {
@@ -4916,8 +5178,8 @@ function scanFeatureFiles(dir, rootDir, map) {
 }
 function indexCodeTestFile(fullPath, rootDir, reqIds, map) {
   try {
-    const content = fs7.readFileSync(fullPath, "utf-8");
-    const relTest = path4.relative(rootDir, fullPath).replace(/\\/g, "/");
+    const content = fs8.readFileSync(fullPath, "utf-8");
+    const relTest = path5.relative(rootDir, fullPath).replace(/\\/g, "/");
     for (const artId of reqIds) {
       if (content.includes(artId)) {
         const existing = map.get(artId) || [];
@@ -4929,11 +5191,11 @@ function indexCodeTestFile(fullPath, rootDir, reqIds, map) {
   }
 }
 function scanCodeTestFiles(dir, rootDir, reqIds, map) {
-  if (!fs7.existsSync(dir)) return;
+  if (!fs8.existsSync(dir)) return;
   try {
-    const entries = fs7.readdirSync(dir, { withFileTypes: true });
+    const entries = fs8.readdirSync(dir, { withFileTypes: true });
     for (const e of entries) {
-      const fullPath = path4.join(dir, e.name);
+      const fullPath = path5.join(dir, e.name);
       if (e.isDirectory() && !shouldSkipDir(e.name)) {
         scanCodeTestFiles(fullPath, rootDir, reqIds, map);
       } else if (isCodeTestFile(e.name)) {
@@ -4967,9 +5229,9 @@ function isArchitectureViewFile(relFile, frontmatter) {
 }
 function processSingleMdFile(file, rootDir, artifactMap, componentsList, architectureViews) {
   try {
-    const content = fs7.readFileSync(file, "utf-8");
+    const content = fs8.readFileSync(file, "utf-8");
     const { frontmatter, body } = parseFrontmatter(content);
-    const relFile = path4.relative(rootDir, file).replace(/\\/g, "/");
+    const relFile = path5.relative(rootDir, file).replace(/\\/g, "/");
     if (frontmatter.id) {
       artifactMap.set(frontmatter.id, {
         file: relFile,
@@ -5134,7 +5396,7 @@ function collectArchitectureViewTraces(reqId, architectureViews) {
   const traces = [];
   for (const view of architectureViews) {
     if (view.content.includes(reqId)) {
-      const viewIdentifier = isEntityWithId(view) && view.id ? view.id : path4.basename(view.file);
+      const viewIdentifier = isEntityWithId(view) && view.id ? view.id : path5.basename(view.file);
       traces.push(viewIdentifier);
     }
   }
@@ -5222,16 +5484,16 @@ function isProductionSourceFile(name) {
   return SOURCE_CODE_EXTS.some((ext) => name.endsWith(ext));
 }
 function collectCodeAndTestCorpora(dir, prodChunks = [], testChunks = []) {
-  if (!fs7.existsSync(dir)) return { prodCorpus: "", testCorpus: "" };
+  if (!fs8.existsSync(dir)) return { prodCorpus: "", testCorpus: "" };
   try {
-    for (const e of fs7.readdirSync(dir, { withFileTypes: true })) {
-      const fullPath = path4.join(dir, e.name);
+    for (const e of fs8.readdirSync(dir, { withFileTypes: true })) {
+      const fullPath = path5.join(dir, e.name);
       if (e.isDirectory() && !shouldSkipDir(e.name)) {
         collectCodeAndTestCorpora(fullPath, prodChunks, testChunks);
       } else if (isCodeTestFile(e.name) || e.name.endsWith(".feature")) {
-        testChunks.push(fs7.readFileSync(fullPath, "utf-8"));
+        testChunks.push(fs8.readFileSync(fullPath, "utf-8"));
       } else if (isProductionSourceFile(e.name)) {
-        prodChunks.push(fs7.readFileSync(fullPath, "utf-8"));
+        prodChunks.push(fs8.readFileSync(fullPath, "utf-8"));
       }
     }
   } catch {
@@ -5385,12 +5647,12 @@ function walkTaskFiles(dir, fileList = [], excludeDirs = [
   "examples"
 ]) {
   try {
-    if (!fs7.existsSync(dir)) return fileList;
-    const files = fs7.readdirSync(dir);
+    if (!fs8.existsSync(dir)) return fileList;
+    const files = fs8.readdirSync(dir).sort(canonicalSort);
     for (const file of files) {
-      const fullPath = path4.join(dir, file);
+      const fullPath = path5.join(dir, file);
       try {
-        if (fs7.statSync(fullPath).isDirectory()) {
+        if (fs8.statSync(fullPath).isDirectory()) {
           if (!excludeDirs.includes(file)) {
             walkTaskFiles(fullPath, fileList, excludeDirs);
           }
@@ -5442,7 +5704,7 @@ function generateGovernanceReportMarkdown(summaries, violationsCount, modeCounts
   const sections = [
     `# \u{1F4CB} Task Governance and Human Autonomy Classification Report
 
-> **Audit Date:** ${(/* @__PURE__ */ new Date()).toISOString()}
+> **Audit Date:** ${resolveDeterministicDate().toISOString()}
 > **Overall Verdict:** ${verdict}
 
 ---`,
@@ -5503,9 +5765,9 @@ function updateGovernanceCounts(t, modeCounts, riskCounts) {
   }
 }
 function parseTasksFromFile(file) {
-  if (!fs7.existsSync(file)) return [];
+  if (!fs8.existsSync(file)) return [];
   try {
-    const content = fs7.readFileSync(file, "utf-8");
+    const content = fs8.readFileSync(file, "utf-8");
     const { frontmatter } = parseTasksDoc(content);
     return frontmatter.tasks || [];
   } catch {
@@ -5513,11 +5775,11 @@ function parseTasksFromFile(file) {
   }
 }
 function extractDesignExpectedScope(changeDir) {
-  const designFile = path4.join(changeDir, "design.md");
-  if (!fs7.existsSync(designFile)) return [];
+  const designFile = path5.join(changeDir, "design.md");
+  if (!fs8.existsSync(designFile)) return [];
   const expected = [];
   try {
-    const { frontmatter } = parseTasksDoc(fs7.readFileSync(designFile, "utf-8"));
+    const { frontmatter } = parseTasksDoc(fs8.readFileSync(designFile, "utf-8"));
     if (typeof frontmatter["architecture-component"] === "string") {
       expected.push(frontmatter["architecture-component"]);
     }
@@ -5557,7 +5819,7 @@ function hasExplicitScopeBindings(tasks) {
   );
 }
 function auditDesignScopeForFile(file, tasks, options, unassignedList, violationsList) {
-  const changeDir = path4.dirname(file);
+  const changeDir = path5.dirname(file);
   const expectedItems = [
     ...extractDesignExpectedScope(changeDir),
     ...extractHandoffExpectedScope(changeDir, options.maxUseCasesPerChange, violationsList)
@@ -5568,13 +5830,13 @@ function auditDesignScopeForFile(file, tasks, options, unassignedList, violation
   for (const item of new Set(expectedItems)) {
     if (!covered.has(item)) {
       unassignedList.push(item);
-      violationsList.push(`[${path4.basename(changeDir)}] Unassigned design/handoff scope in tasks.md: missing task coverage for ${item}`);
+      violationsList.push(`[${path5.basename(changeDir)}] Unassigned design/handoff scope in tasks.md: missing task coverage for ${item}`);
     }
   }
 }
 function processTasksFile(file, rootDir, options, acc) {
   const tasks = parseTasksFromFile(file);
-  const relPath = path4.relative(rootDir, file).replace(/\\/g, "/");
+  const relPath = path5.relative(rootDir, file).replace(/\\/g, "/");
   let unverifiedDelta = 0;
   for (const t of tasks) {
     const { summary, violation, unverified } = evaluateTaskItem(t, relPath);
@@ -5873,11 +6135,11 @@ async function runAllExpandedScenarios(parsed, definitions) {
 }
 async function executeBddFeature(featurePath, registry, options = {}) {
   const rootDir = options.rootDir || process.cwd();
-  const fullPath = path4.isAbsolute(featurePath) ? featurePath : path4.join(rootDir, featurePath);
-  const parsed = parseFeatureDocument(fs7.readFileSync(fullPath, "utf-8"));
+  const fullPath = path5.isAbsolute(featurePath) ? featurePath : path5.join(rootDir, featurePath);
+  const parsed = parseFeatureDocument(fs8.readFileSync(fullPath, "utf-8"));
   const scenarios = await runAllExpandedScenarios(parsed, registry.getDefinitions());
   const report = {
-    uri: path4.relative(rootDir, fullPath).replace(/\\/g, "/"),
+    uri: path5.relative(rootDir, fullPath).replace(/\\/g, "/"),
     featureName: parsed.featureName,
     tags: parsed.tags,
     scenarios,
@@ -5911,10 +6173,10 @@ function mapFeatureToCucumberJson(r) {
   };
 }
 function writeCucumberJsonReport(reports, outputPath) {
-  const dir = path4.dirname(outputPath);
-  if (!fs7.existsSync(dir)) fs7.mkdirSync(dir, { recursive: true });
+  const dir = path5.dirname(outputPath);
+  if (!fs8.existsSync(dir)) fs8.mkdirSync(dir, { recursive: true });
   const payload = JSON.stringify(reports.map(mapFeatureToCucumberJson), null, 2);
-  fs7.writeFileSync(outputPath, payload, "utf-8");
+  fs8.writeFileSync(outputPath, payload, "utf-8");
 }
 function isToolAvailable(toolName) {
   try {
@@ -5960,8 +6222,8 @@ function findLicenseFile(pkgDir) {
     "license.txt"
   ];
   for (const c of candidates) {
-    const full = path4.join(pkgDir, c);
-    if (fs7.existsSync(full)) {
+    const full = path5.join(pkgDir, c);
+    if (fs8.existsSync(full)) {
       return full;
     }
   }
@@ -5978,9 +6240,9 @@ var LICENSE_FILE_PATTERNS = [
   [(t) => t.includes("Microsoft Reciprocal License") || t.includes("MS-RL"), "MS-RL"]
 ];
 function resolveLicenseFromFile(licenseFilePath) {
-  if (!licenseFilePath || !fs7.existsSync(licenseFilePath)) return void 0;
+  if (!licenseFilePath || !fs8.existsSync(licenseFilePath)) return void 0;
   try {
-    const text = fs7.readFileSync(licenseFilePath, "utf-8");
+    const text = fs8.readFileSync(licenseFilePath, "utf-8");
     for (const [matches, spdx] of LICENSE_FILE_PATTERNS) {
       if (matches(text)) return spdx;
     }
@@ -5989,16 +6251,16 @@ function resolveLicenseFromFile(licenseFilePath) {
   return void 0;
 }
 function readPackageJson(filePath) {
-  if (!fs7.existsSync(filePath)) return null;
+  if (!fs8.existsSync(filePath)) return null;
   try {
-    return JSON.parse(fs7.readFileSync(filePath, "utf-8"));
+    return JSON.parse(fs8.readFileSync(filePath, "utf-8"));
   } catch {
     return null;
   }
 }
 function extractDirectDepNames(rootDir, productionOnly) {
   const names = /* @__PURE__ */ new Set();
-  const pkgPath = path4.join(rootDir, "package.json");
+  const pkgPath = path5.join(rootDir, "package.json");
   const pkg = readPackageJson(pkgPath);
   if (!pkg) return names;
   if (pkg.dependencies && typeof pkg.dependencies === "object") {
@@ -6018,7 +6280,7 @@ function resolveSpdxForPackage(pkg, licFile) {
   return spdx;
 }
 function processPackageDir(pkgDir, directNames, seen) {
-  const pkg = readPackageJson(path4.join(pkgDir, "package.json"));
+  const pkg = readPackageJson(path5.join(pkgDir, "package.json"));
   if (!pkg?.name || !pkg.version) return;
   const key = `${pkg.name}@${pkg.version}`;
   if (seen.has(key)) return;
@@ -6039,40 +6301,40 @@ function processPackageDir(pkgDir, directNames, seen) {
   });
 }
 function scanScopeSubdirectory(scopeDir, directNames, seen) {
-  const scopedEntries = fs7.readdirSync(scopeDir, { withFileTypes: true });
+  const scopedEntries = fs8.readdirSync(scopeDir, { withFileTypes: true });
   for (const scoped of scopedEntries) {
     if (scoped.isDirectory()) {
-      processPackageDir(path4.join(scopeDir, scoped.name), directNames, seen);
+      processPackageDir(path5.join(scopeDir, scoped.name), directNames, seen);
     }
   }
 }
 function scanSubdirectories(baseDir, directNames, seen) {
-  if (!fs7.existsSync(baseDir)) return;
-  const entries = fs7.readdirSync(baseDir, { withFileTypes: true });
+  if (!fs8.existsSync(baseDir)) return;
+  const entries = fs8.readdirSync(baseDir, { withFileTypes: true });
   for (const entry of entries) {
     if (!entry.isDirectory()) continue;
     if (entry.name.startsWith("@")) {
-      scanScopeSubdirectory(path4.join(baseDir, entry.name), directNames, seen);
+      scanScopeSubdirectory(path5.join(baseDir, entry.name), directNames, seen);
     } else if (entry.name !== ".bin" && entry.name !== ".pnpm") {
-      processPackageDir(path4.join(baseDir, entry.name), directNames, seen);
+      processPackageDir(path5.join(baseDir, entry.name), directNames, seen);
     }
   }
 }
 function scanPnpmStore(pnpmDir, directNames, seen) {
-  if (!fs7.existsSync(pnpmDir)) return;
-  const entries = fs7.readdirSync(pnpmDir, { withFileTypes: true });
+  if (!fs8.existsSync(pnpmDir)) return;
+  const entries = fs8.readdirSync(pnpmDir, { withFileTypes: true });
   for (const entry of entries) {
     if (!entry.isDirectory()) continue;
-    const candidateModules = path4.join(pnpmDir, entry.name, "node_modules");
-    if (fs7.existsSync(candidateModules)) {
+    const candidateModules = path5.join(pnpmDir, entry.name, "node_modules");
+    if (fs8.existsSync(candidateModules)) {
       scanSubdirectories(candidateModules, directNames, seen);
     }
   }
 }
 function readTextIfExists(filePath) {
-  if (!fs7.existsSync(filePath)) return null;
+  if (!fs8.existsSync(filePath)) return null;
   try {
-    return fs7.readFileSync(filePath, "utf-8");
+    return fs8.readFileSync(filePath, "utf-8");
   } catch {
     return null;
   }
@@ -6132,14 +6394,14 @@ function parsePipfileSection(pkgs, isDirect, lockPath, seen) {
   }
 }
 function scanPythonDependencies(rootDir, seen) {
-  const pyproject = readTextIfExists(path4.join(rootDir, "pyproject.toml")) || "";
+  const pyproject = readTextIfExists(path5.join(rootDir, "pyproject.toml")) || "";
   const directNames = extractPyprojectDirectDeps(pyproject);
   for (const lockName of ["poetry.lock", "uv.lock"]) {
-    const lockPath = path4.join(rootDir, lockName);
+    const lockPath = path5.join(rootDir, lockName);
     const content = readTextIfExists(lockPath);
     if (content) parseTomlPackageBlocks(content, lockPath, directNames, seen);
   }
-  const pipfileLockPath = path4.join(rootDir, "Pipfile.lock");
+  const pipfileLockPath = path5.join(rootDir, "Pipfile.lock");
   const pipfileRaw = readTextIfExists(pipfileLockPath);
   if (!pipfileRaw) return;
   try {
@@ -6182,7 +6444,7 @@ function extractGoCandidateLines(content) {
   return out;
 }
 function scanGoDependencies(rootDir, seen) {
-  const goModPath = path4.join(rootDir, "go.mod");
+  const goModPath = path5.join(rootDir, "go.mod");
   const content = readTextIfExists(goModPath);
   if (!content) return;
   for (const line of extractGoCandidateLines(content)) {
@@ -6225,10 +6487,10 @@ function parseCargoLockBlock(block, rootName, directMeta, cargoLockPath) {
   };
 }
 function scanRustDependencies(rootDir, seen) {
-  const cargoLockPath = path4.join(rootDir, "Cargo.lock");
+  const cargoLockPath = path5.join(rootDir, "Cargo.lock");
   const lockContent = readTextIfExists(cargoLockPath);
   if (!lockContent) return;
-  const cargoToml = readTextIfExists(path4.join(rootDir, "Cargo.toml")) || "";
+  const cargoToml = readTextIfExists(path5.join(rootDir, "Cargo.toml")) || "";
   const directMeta = extractCargoDirectDeps(cargoToml);
   const rootName = extractTomlField(cargoToml, "name");
   for (const block of lockContent.split(/\[\[package\]\]/g).slice(1)) {
@@ -6264,7 +6526,7 @@ function parseMavenDepBlock(block, defaultLic, pomPath) {
   };
 }
 function scanMavenDependencies(rootDir, seen) {
-  const pomPath = path4.join(rootDir, "pom.xml");
+  const pomPath = path5.join(rootDir, "pom.xml");
   const content = readTextIfExists(pomPath);
   if (!content) return;
   const projectLicBlock = content.match(/<licenses>([\s\S]*?)<\/licenses>/)?.[1] || "";
@@ -6280,11 +6542,11 @@ function scanMavenDependencies(rootDir, seen) {
 function scanWithNativeFs(rootDir, options = {}) {
   const directNames = extractDirectDepNames(rootDir, options.productionOnly);
   const seen = /* @__PURE__ */ new Map();
-  const nmDir = path4.join(rootDir, "node_modules");
-  if (fs7.existsSync(nmDir)) {
+  const nmDir = path5.join(rootDir, "node_modules");
+  if (fs8.existsSync(nmDir)) {
     scanSubdirectories(nmDir, directNames, seen);
     if (options.depth !== "direct") {
-      scanPnpmStore(path4.join(nmDir, ".pnpm"), directNames, seen);
+      scanPnpmStore(path5.join(nmDir, ".pnpm"), directNames, seen);
     }
   }
   scanPythonDependencies(rootDir, seen);
@@ -6543,20 +6805,20 @@ function resolveProjectIdentity(options) {
   let name = options.projectName || "ai-sdlc-project";
   let version = options.projectVersion || "1.0.0";
   if (!options.rootDir) return { name, version };
-  const pkgPath = path4.join(options.rootDir, "package.json");
-  if (!fs7.existsSync(pkgPath)) return { name, version };
+  const pkgPath = path5.join(options.rootDir, "package.json");
+  if (!fs8.existsSync(pkgPath)) return { name, version };
   try {
-    const pkg = JSON.parse(fs7.readFileSync(pkgPath, "utf-8"));
+    const pkg = JSON.parse(fs8.readFileSync(pkgPath, "utf-8"));
     if (pkg.name) name = pkg.name;
     if (pkg.version) version = pkg.version;
   } catch {
   }
   return { name, version };
 }
-function buildBomMetadata(name, version) {
+function buildBomMetadata(name, version, rootDir) {
   return {
-    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-    tools: [{ vendor: "AI-SDLC", name: "@aisdlc/core", version: "2.4.0" }],
+    timestamp: resolveDeterministicDate(rootDir).toISOString(),
+    tools: [{ vendor: "AI-SDLC", name: "@aisdlc/core", version: "2.5.0" }],
     component: { type: "application", name, version }
   };
 }
@@ -6567,52 +6829,21 @@ function generateCycloneDxSbom(dependencies, options = {}) {
     bomFormat: "CycloneDX",
     specVersion: "1.5",
     version: 1,
-    serialNumber: `urn:uuid:${crypto.randomUUID()}`,
-    metadata: buildBomMetadata(name, version),
+    serialNumber: `urn:uuid:${generateDeterministicUuidV5(`${name}@${version}|${dependencies.map((d) => `${d.name}@${d.version}:${d.purl || ""}`).sort(canonicalSort).join(";")}`)}`,
+    metadata: buildBomMetadata(name, version, options.rootDir),
     components: dependencies.map(buildCycloneDxComponent),
     ...cdxVulns.length > 0 ? { vulnerabilities: cdxVulns } : {}
   };
 }
-function tryAtomicWrite(filePath, content) {
-  const tempPath = `${filePath}.${process.pid}.${Math.random().toString(36).substring(2)}.tmp`;
-  try {
-    fs7.writeFileSync(tempPath, content, "utf-8");
-    try {
-      if (fs7.existsSync(filePath)) {
-        fs7.rmSync(filePath, { force: true });
-      }
-      fs7.renameSync(tempPath, filePath);
-    } catch {
-      fs7.copyFileSync(tempPath, filePath);
-      fs7.unlinkSync(tempPath);
-    }
-    return true;
-  } catch {
-    return false;
-  }
-}
-function safeWriteFileSync(filePath, content) {
-  const dir = path4.dirname(filePath);
-  if (!fs7.existsSync(dir)) {
-    fs7.mkdirSync(dir, { recursive: true });
-  }
-  for (let attempt = 0; attempt < 10; attempt++) {
-    if (tryAtomicWrite(filePath, content)) return;
-  }
-  try {
-    fs7.writeFileSync(filePath, content, "utf-8");
-  } catch {
-  }
-}
 function writeCycloneDxSbom(sbom, outputPath) {
-  safeWriteFileSync(outputPath, JSON.stringify(sbom, null, 2));
+  writeReportFileIfChanged(outputPath, JSON.stringify(sbom, null, 2));
 }
 function buildThirdPartyHeader(projectName, count) {
   return [
     `# \u{1F4DC} Third-Party Software Notices and Information`,
     ``,
     `> **Proyecto:** ${projectName}`,
-    `> **Fecha:** ${(/* @__PURE__ */ new Date()).toISOString().split("T")[0]}`,
+    `> **Fecha:** ${resolveDeterministicDate().toISOString().split("T")[0]}`,
     `> **Total Componentes:** ${count}`,
     ``,
     `Este documento contiene los avisos de copyright y t\xE9rminos de licencia aplicables a los componentes de terceros utilizados en este proyecto.`,
@@ -6626,9 +6857,9 @@ function buildThirdPartyHeader(projectName, count) {
   ];
 }
 function readLicenseTextPreview(licenseFile) {
-  if (!licenseFile || !fs7.existsSync(licenseFile)) return null;
+  if (!licenseFile || !fs8.existsSync(licenseFile)) return null;
   try {
-    const text = fs7.readFileSync(licenseFile, "utf-8").trim();
+    const text = fs8.readFileSync(licenseFile, "utf-8").trim();
     return text.slice(0, 1e3) + (text.length > 1e3 ? "\n... (texto truncado)" : "");
   } catch {
     return null;
@@ -6660,13 +6891,13 @@ function generateThirdPartyNotices(dependencies, projectName = "AI-SDLC") {
     "",
     "---",
     "",
-    "## Textos de Licencia y Atribuciones",
+    "## 2. Atribuciones y T\xE9rminos de Licencia Individuales",
     "",
     ...attributions
   ].join("\n");
 }
-function writeThirdPartyNotices(content, outputPath) {
-  safeWriteFileSync(outputPath, content);
+function writeThirdPartyNotices(noticesContent, outputPath) {
+  writeReportFileIfChanged(outputPath, noticesContent);
 }
 
 // src/verifiers/licenses.ts
@@ -6743,22 +6974,20 @@ function parseVexStatements(doc) {
   if (!Array.isArray(rawList)) return [];
   return rawList.filter((item) => Boolean(item && typeof item.id === "string" && typeof item.state === "string"));
 }
-function parseLicensePolicy(content) {
+function parseLicenseDoc(content) {
+  let doc;
   try {
-    const doc = yaml3.load(content);
-    const { permitted, restricted, blocked } = classifyCategories(doc?.categories);
-    const exception_packages = parseExceptions(doc?.exceptions);
-    const vex_statements = parseVexStatements(doc);
-    return {
-      version: doc?.version || "1.0",
-      permitted: permitted.length > 0 ? permitted : DEFAULT_PERMITTED,
-      restricted: restricted.length > 0 ? restricted : DEFAULT_RESTRICTED,
-      blocked: blocked.length > 0 ? blocked : DEFAULT_BLOCKED,
-      exception_packages,
-      vex_statements,
-      rawPolicy: doc
-    };
-  } catch {
+    doc = yaml3.load(content);
+  } catch (err) {
+    throw new Error(`[AI-SDLC Fail-Closed] Invalid YAML in license-policy: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  if (!doc || typeof doc !== "object" || Array.isArray(doc)) {
+    throw new Error(`[AI-SDLC Fail-Closed] Invalid license policy structure: root must be a YAML mapping`);
+  }
+  return doc;
+}
+function parseLicensePolicy(content) {
+  if (!content || !content.trim()) {
     return {
       version: "1.0",
       permitted: DEFAULT_PERMITTED,
@@ -6768,6 +6997,17 @@ function parseLicensePolicy(content) {
       vex_statements: []
     };
   }
+  const doc = parseLicenseDoc(content);
+  const { permitted, restricted, blocked } = classifyCategories(doc?.categories);
+  return {
+    version: doc?.version || "1.0",
+    permitted: permitted.length > 0 ? permitted : DEFAULT_PERMITTED,
+    restricted: restricted.length > 0 ? restricted : DEFAULT_RESTRICTED,
+    blocked: blocked.length > 0 ? blocked : DEFAULT_BLOCKED,
+    exception_packages: parseExceptions(doc?.exceptions),
+    vex_statements: parseVexStatements(doc),
+    rawPolicy: doc
+  };
 }
 function evaluateCompoundLicense(lic, policy) {
   const cleanLic = lic.replace(/[()]/g, "").trim();
@@ -6859,7 +7099,7 @@ function buildReportHeader(isOk, depCount, violationCount, sbomPath) {
   return [
     `# \u{1F4DC} Open Source License Compliance Audit (Dynamic SCA)`,
     ``,
-    `> **Verification Date:** ${(/* @__PURE__ */ new Date()).toISOString()}`,
+    `> **Verification Date:** ${resolveDeterministicDate().toISOString()}`,
     `> **Status:** ${statusStr}`,
     `> **Total Audited Dependencies:** ${depCount}`,
     sbomPath ? `> **Generated CycloneDX SBOM:** \`${sbomPath}\`` : "",
@@ -6884,9 +7124,9 @@ function generateLicenseReportMarkdown(dependencies, violations, policy, sbomPat
   return lines.filter(Boolean).join("\n");
 }
 function parseManifestItems(manifestFile) {
-  if (!fs7.existsSync(manifestFile)) return [];
+  if (!fs8.existsSync(manifestFile)) return [];
   try {
-    const doc = yaml3.load(fs7.readFileSync(manifestFile, "utf-8"));
+    const doc = yaml3.load(fs8.readFileSync(manifestFile, "utf-8"));
     return Array.isArray(doc?.evaluated_dependencies) ? doc.evaluated_dependencies : [];
   } catch {
     return [];
@@ -6918,10 +7158,10 @@ function verifyStaticManifest(manifestFile, policy) {
 function resolveManifestPath(rootDir, customPath) {
   if (customPath) return customPath;
   const candidates = [
-    path4.join(rootDir, "compliance", "license-manifest.yaml"),
-    path4.join(rootDir, "license-manifest.yaml")
+    path5.join(rootDir, "compliance", "license-manifest.yaml"),
+    path5.join(rootDir, "license-manifest.yaml")
   ];
-  return candidates.find((p) => fs7.existsSync(p)) || candidates[0];
+  return candidates.find((p) => fs8.existsSync(p)) || candidates[0];
 }
 function handleStaticManifestVerification(options, rootDir, policy) {
   const manifestFile = resolveManifestPath(rootDir, options.manifestPath);
@@ -6942,7 +7182,7 @@ function shouldGenerateSbom(options, rawPolicy) {
 }
 function maybeGenerateSbom(options, rootDir, rawPolicy, dependencies, vulnerabilities, vexStatements) {
   if (!shouldGenerateSbom(options, rawPolicy)) return void 0;
-  const sbomPath = options.sbomPath || path4.join(rootDir, "reports", "sbom.cdx.json");
+  const sbomPath = options.sbomPath || path5.join(rootDir, "reports", "sbom.cdx.json");
   const sbom = generateCycloneDxSbom(dependencies, { rootDir, vulnerabilities, vexStatements });
   writeCycloneDxSbom(sbom, sbomPath);
   return sbomPath;
@@ -6951,7 +7191,7 @@ function maybeGenerateNotices(options, rootDir, rawPolicy, dependencies) {
   const shouldGen = options.generateNotices === true || Boolean(options.noticesPath || rawPolicy?.ci_gates?.output_notices_file);
   if (!shouldGen) return void 0;
   const noticesFileName = rawPolicy?.ci_gates?.output_notices_file || "THIRD_PARTY_NOTICES.md";
-  const noticesPath = options.noticesPath || path4.join(rootDir, noticesFileName);
+  const noticesPath = options.noticesPath || path5.join(rootDir, noticesFileName);
   const noticesContent = generateThirdPartyNotices(dependencies);
   writeThirdPartyNotices(noticesContent, noticesPath);
   return noticesPath;
@@ -6963,8 +7203,8 @@ function handleDynamicScaArtifacts(options, rootDir, rawPolicy, dependencies, vu
   };
 }
 function loadLicensePolicy(rootDir, customPath) {
-  const policyFile = customPath || path4.join(rootDir, "license-policy.yaml");
-  return fs7.existsSync(policyFile) ? parseLicensePolicy(fs7.readFileSync(policyFile, "utf-8")) : parseLicensePolicy("");
+  const policyFile = customPath || path5.join(rootDir, "license-policy.yaml");
+  return fs8.existsSync(policyFile) ? parseLicensePolicy(fs8.readFileSync(policyFile, "utf-8")) : parseLicensePolicy("");
 }
 function evaluateDependencyList(dependencies, policy) {
   const violations = [];
@@ -7068,11 +7308,11 @@ var PROTECTED_BYPASS_PATTERNS = [
   /migrations?[\\/]/i
 ];
 function detectProfileFromChange(changeDir) {
-  if (!fs7.existsSync(changeDir)) return "standard";
-  const specFile = path4.join(changeDir, "spec.md");
-  if (fs7.existsSync(specFile)) {
+  if (!fs8.existsSync(changeDir)) return "standard";
+  const specFile = path5.join(changeDir, "spec.md");
+  if (fs8.existsSync(specFile)) {
     try {
-      const rawSpec = fs7.readFileSync(specFile, "utf-8").replace(/^\uFEFF/, "");
+      const rawSpec = fs8.readFileSync(specFile, "utf-8").replace(/^\uFEFF/, "");
       const match = rawSpec.match(/^---\r?\n([\s\S]*?)\r?\n---/);
       if (match) {
         const parsedFm = yaml3.load(match[1]);
@@ -7090,24 +7330,29 @@ function isPathProtectedFromPatch(filePath) {
   return PROTECTED_BYPASS_PATTERNS.some((pattern) => pattern.test(normalized));
 }
 function detectBranchChangeMatch(rootDir, dirs) {
-  if (!fs7.existsSync(path4.join(rootDir, ".git"))) return void 0;
-  try {
-    const branch = execFileSync("git", ["branch", "--show-current"], {
-      cwd: rootDir,
-      encoding: "utf-8",
-      stdio: ["pipe", "pipe", "ignore"]
-    }).trim().toLowerCase();
-    if (!branch) return void 0;
-    return dirs.find((d) => branch.includes(path4.basename(d).toLowerCase()));
-  } catch {
-    return void 0;
+  let branch = "";
+  if (fs8.existsSync(path5.join(rootDir, ".git"))) {
+    try {
+      branch = execFileSync("git", ["branch", "--show-current"], {
+        cwd: rootDir,
+        encoding: "utf-8",
+        stdio: ["pipe", "pipe", "ignore"]
+      }).trim().toLowerCase();
+    } catch {
+    }
+  }
+  if (!branch) {
+    const ciBranch = (process.env.GITHUB_HEAD_REF || process.env.GITHUB_REF_NAME || process.env.CI_COMMIT_REF_NAME || process.env.BRANCH_NAME || "").toLowerCase();
+    branch = ciBranch;
   }
+  if (!branch) return void 0;
+  return dirs.find((d) => branch.includes(path5.basename(d).toLowerCase()));
 }
 function resolveActiveChangeDir(rootDir) {
-  const activeRoot = path4.join(rootDir, "specs", "changes", "active");
-  if (!fs7.existsSync(activeRoot)) return void 0;
+  const activeRoot = path5.join(rootDir, "specs", "changes", "active");
+  if (!fs8.existsSync(activeRoot)) return void 0;
   try {
-    const dirs = fs7.readdirSync(activeRoot, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => path4.join(activeRoot, d.name));
+    const dirs = fs8.readdirSync(activeRoot, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => path5.join(activeRoot, d.name)).sort((a, b) => canonicalSort(a, b));
     const branchMatch = detectBranchChangeMatch(rootDir, dirs);
     if (branchMatch) return branchMatch;
     return dirs.find((d) => detectProfileFromChange(d) === "patch") || dirs[0];
@@ -7115,8 +7360,12 @@ function resolveActiveChangeDir(rootDir) {
     return void 0;
   }
 }
+function isEphemeralOrIgnored(file) {
+  const norm = file.replace(/\\/g, "/");
+  return norm.startsWith("scratch/") || norm.startsWith("reports/") || norm.startsWith("coverage/") || norm.startsWith("dist/") || norm.startsWith("temp/") || norm.startsWith("tmp/");
+}
 function detectGitDiffFiles(rootDir) {
-  if (!fs7.existsSync(path4.join(rootDir, ".git"))) return [];
+  if (!fs8.existsSync(path5.join(rootDir, ".git"))) return [];
   try {
     const tracked = execFileSync("git", ["diff", "--name-only", "HEAD"], {
       cwd: rootDir,
@@ -7129,7 +7378,7 @@ function detectGitDiffFiles(rootDir) {
       stdio: ["pipe", "pipe", "ignore"]
     });
     const combined = `${tracked}
-${untracked}`.split(/\r?\n/).map((f) => f.trim()).filter(Boolean);
+${untracked}`.split(/\r?\n/).map((f) => f.trim()).filter((f) => Boolean(f) && !isEphemeralOrIgnored(f));
     return Array.from(new Set(combined));
   } catch {
     return [];
@@ -7139,19 +7388,19 @@ function resolveChangeDirectory(rootDir, options) {
   if (options.changeDir) return options.changeDir;
   if (options.changeId) {
     const candidates = [
-      path4.join(rootDir, "specs", options.changeId),
-      path4.join(rootDir, "specs", "changes", "active", options.changeId),
-      path4.join(rootDir, "examples", "specs", options.changeId),
-      path4.join(rootDir, "specs", "changes", "completed", options.changeId)
+      path5.join(rootDir, "specs", options.changeId),
+      path5.join(rootDir, "specs", "changes", "active", options.changeId),
+      path5.join(rootDir, "examples", "specs", options.changeId),
+      path5.join(rootDir, "specs", "changes", "completed", options.changeId)
     ];
-    return candidates.find((c) => fs7.existsSync(c));
+    return candidates.find((c) => fs8.existsSync(c));
   }
   return resolveActiveChangeDir(rootDir);
 }
 function collectPatchViolations(rootDir, modifiedFiles) {
   const violations = [];
   for (const rawFile of modifiedFiles) {
-    const relPath = path4.isAbsolute(rawFile) ? path4.relative(rootDir, rawFile) : rawFile;
+    const relPath = path5.isAbsolute(rawFile) ? path5.relative(rootDir, rawFile) : rawFile;
     if (isPathProtectedFromPatch(relPath)) {
       violations.push(
         `[ANTI-PATCH-BYPASS] File '${relPath}' is a protected path (security, schemas, architectural decisions, or master policies). Changes with 'patch' profile are strictly prohibited from modifying these paths. Must be reclassified to 'standard' or 'critical'.`
@@ -7164,7 +7413,7 @@ function buildFrictionHeader(profile, success, fileCount) {
   return [
     `# \u{1F6E1}\uFE0F Progressive Friction and Anti-Bypass Verification Report`,
     ``,
-    `> **Date:** ${(/* @__PURE__ */ new Date()).toISOString()}`,
+    `> **Date:** ${resolveDeterministicDate().toISOString()}`,
     `> **Evaluated Profile:** \`${profile.toUpperCase()}\``,
     `> **Verdict:** ${success ? "COMPLIANT \u2705" : "BLOCKED \u274C"}`,
     ``,
@@ -7257,13 +7506,13 @@ function extractManualMetadata(fm, id, manualType, relPath, body) {
 }
 function buildManualItem(rootDir, filePath) {
   try {
-    const raw = fs7.readFileSync(filePath, "utf-8");
+    const raw = fs8.readFileSync(filePath, "utf-8");
     const { fm, body } = parseMdFrontmatter(raw);
     const id = typeof fm.id === "string" ? fm.id.trim() : "";
     const rawType = typeof fm.type === "string" ? fm.type.trim() : "";
     const manualType = resolveManualType(id, rawType);
     if (!id || !manualType) return null;
-    const relPath = path4.relative(rootDir, filePath).replace(/\\/g, "/");
+    const relPath = path5.relative(rootDir, filePath).replace(/\\/g, "/");
     return extractManualMetadata(fm, id, manualType, relPath, body);
   } catch {
     return null;
@@ -7274,8 +7523,8 @@ function scanManualsInWorkspace(rootDir) {
   const seenIds = /* @__PURE__ */ new Set();
   const items = [];
   for (const relDir of manualDirs) {
-    const fullDir = path4.join(rootDir, relDir);
-    if (!fs7.existsSync(fullDir)) continue;
+    const fullDir = path5.join(rootDir, relDir);
+    if (!fs8.existsSync(fullDir)) continue;
     for (const file of walkMdFiles(fullDir)) {
       const item = buildManualItem(rootDir, file);
       if (item && !seenIds.has(item.id)) {
@@ -7298,10 +7547,10 @@ function classifyBaselineId(id, type, buckets) {
   }
 }
 function processBaselineFile(file, rootDir, buckets) {
-  const rel = path4.relative(rootDir, file).replace(/\\/g, "/");
+  const rel = path5.relative(rootDir, file).replace(/\\/g, "/");
   if (rel.includes("/changes/") || rel.startsWith("changes/")) return;
   try {
-    const { fm } = parseMdFrontmatter(fs7.readFileSync(file, "utf-8"));
+    const { fm } = parseMdFrontmatter(fs8.readFileSync(file, "utf-8"));
     const id = typeof fm.id === "string" ? fm.id.trim() : "";
     const status = typeof fm.status === "string" ? fm.status.trim().toLowerCase() : "active";
     if (!id || status === "retired" || status === "deprecated") return;
@@ -7322,8 +7571,8 @@ function collectBaselineTargets(rootDir) {
     enclaves: /* @__PURE__ */ new Set()
   };
   for (const dir of ["product", "architecture", "security", "specs"]) {
-    const fullDir = path4.join(rootDir, dir);
-    if (fs7.existsSync(fullDir)) {
+    const fullDir = path5.join(rootDir, dir);
+    if (fs8.existsSync(fullDir)) {
       scanDirectoryForBaseline(rootDir, fullDir, buckets);
     }
   }
@@ -7380,10 +7629,10 @@ function detectCurrentGitBranch(rootDir) {
   }
 }
 function resolveActiveChangeProfile(rootDir) {
-  const activeRoot = path4.join(rootDir, "specs", "changes", "active");
-  if (!fs7.existsSync(activeRoot)) return "standard";
+  const activeRoot = path5.join(rootDir, "specs", "changes", "active");
+  if (!fs8.existsSync(activeRoot)) return "standard";
   try {
-    const dirs = fs7.readdirSync(activeRoot, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => path4.join(activeRoot, d.name));
+    const dirs = fs8.readdirSync(activeRoot, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => path5.join(activeRoot, d.name));
     const profiles = dirs.map((d) => detectProfileFromChange(d));
     if (profiles.includes("critical")) return "critical";
     if (profiles.includes("patch") && profiles.length === 1) return "patch";
@@ -7520,7 +7769,7 @@ var REQ_TYPES = /* @__PURE__ */ new Set(["requirement", "security-requirement",
 var REQ_CATEGORIES = /* @__PURE__ */ new Set(["functional", "quality", "constraint", "security", "safety"]);
 function computeSha256(content) {
   const normalized = content.replace(/\r\n/g, "\n");
-  return crypto.createHash("sha256").update(normalized, "utf-8").digest("hex");
+  return crypto3.createHash("sha256").update(normalized, "utf-8").digest("hex");
 }
 function tokenizeTitle(title) {
   const words = title.toLowerCase().normalize("NFD").replace(/[\u0300-\u036f]/g, "").replace(/[^a-z0-9\s]/g, " ").split(/\s+/).filter((w) => w.length > 2 && !STOP_WORDS.has(w));
@@ -7596,11 +7845,11 @@ function buildRequirementObject(content, fm, body, filePath, relFile) {
 }
 function parseRequirementFile(filePath, rootDir) {
   try {
-    const content = fs7.readFileSync(filePath, "utf-8");
+    const content = fs8.readFileSync(filePath, "utf-8");
     const extracted = extractParsedFrontmatter(content);
     if (!extracted) return null;
     const body = content.substring(extracted.matchLen);
-    const relFile = path4.relative(rootDir, filePath).replace(/\\/g, "/");
+    const relFile = path5.relative(rootDir, filePath).replace(/\\/g, "/");
     return buildRequirementObject(content, extracted.fm, body, filePath, relFile);
   } catch {
     return null;
@@ -7612,7 +7861,7 @@ function isIgnoredScanPath(relFile) {
 function collectRequirements(rootDir) {
   const reqs = [];
   for (const file of walkMdFiles(rootDir)) {
-    const relFile = path4.relative(rootDir, file).replace(/\\/g, "/");
+    const relFile = path5.relative(rootDir, file).replace(/\\/g, "/");
     if (isIgnoredScanPath(relFile)) continue;
     const req = parseRequirementFile(file, rootDir);
     if (req) reqs.push(req);
@@ -7746,7 +7995,7 @@ function buildDuplicatesHeader(result) {
   return [
     `# \u{1F6E1}\uFE0F Duplicate Requirements and Redundancy Audit (Shift-Left Pre-Flight)`,
     ``,
-    `> **Evaluation Date:** ${(/* @__PURE__ */ new Date()).toISOString()}`,
+    `> **Evaluation Date:** ${resolveDeterministicDate().toISOString()}`,
     `> **Verdict:** ${isOk ? "\u2705 COMPLIANT (No blocking duplicates)" : `\u274C BLOCKED (${result.errorCount} duplicate errors detected)`}`,
     `> **Audited Requirements:** ${result.totalRequirements} | **Errors:** ${result.errorCount} | **Warnings:** ${result.warningCount}`,
     ``,
@@ -7869,7 +8118,7 @@ function buildAuditHeader(total, active, expired, invalid) {
   return [
     "# \u{1F4CB} Security Suppressions and Audit Exceptions Inventory",
     "",
-    `> **Generated at:** ${(/* @__PURE__ */ new Date()).toISOString()}`,
+    `> **Generated at:** ${resolveDeterministicDate().toISOString()}`,
     `> **Total Audited Suppressions:** ${total} | **Active:** ${active} | **Expired:** ${expired} | **Invalid:** ${invalid}`,
     "",
     "## 1. Executive Summary",
@@ -8100,10 +8349,10 @@ function isPathExcluded2(relPath, patterns) {
 function walkProjectFiles(dir, rootDir, excludedPatterns = DEFAULT_EXCLUDED_PATTERNS) {
   const results = [];
   try {
-    const entries = fs7.readdirSync(dir, { withFileTypes: true });
+    const entries = fs8.readdirSync(dir, { withFileTypes: true }).sort((a, b) => canonicalSort(a.name, b.name));
     for (const entry of entries) {
-      const fullPath = path4.join(dir, entry.name);
-      const relPath = path4.relative(rootDir, fullPath).replace(/\\/g, "/");
+      const fullPath = path5.join(dir, entry.name);
+      const relPath = path5.relative(rootDir, fullPath).replace(/\\/g, "/");
       if (isPathExcluded2(relPath, excludedPatterns)) continue;
       if (entry.isDirectory()) {
         results.push(...walkProjectFiles(fullPath, rootDir, excludedPatterns));
@@ -8132,8 +8381,8 @@ function pickFirstString(...vals) {
 }
 function parseGitleaksItem(item, rootDir) {
   const rawFile = pickFirstString(item.File, item.file);
-  const filePath = path4.resolve(rootDir, rawFile);
-  const relPath = path4.relative(rootDir, filePath).replace(/\\/g, "/");
+  const filePath = path5.resolve(rootDir, rawFile);
+  const relPath = path5.relative(rootDir, filePath).replace(/\\/g, "/");
   const ruleId = pickFirstString(item.RuleID, item.ruleID) || "GITLEAKS-MATCH";
   const rawSecret = pickFirstString(item.Secret, item.secret, item.Match);
   const line = item.StartLine ?? item.line ?? 1;
@@ -8206,7 +8455,7 @@ function scanLineForSecrets(line, lineNumber, filePath, relPath, entropyThreshol
 function scanContentForSecrets(content, filePath, rootDir, entropyThreshold = 4.3, collectedSuppressions) {
   const violations = [];
   const lines = content.split(/\r?\n/);
-  const relPath = path4.relative(rootDir, filePath).replace(/\\/g, "/");
+  const relPath = path5.relative(rootDir, filePath).replace(/\\/g, "/");
   for (let i = 0; i < lines.length; i++) {
     violations.push(...scanLineForSecrets(lines[i], i + 1, filePath, relPath, entropyThreshold, collectedSuppressions));
   }
@@ -8227,7 +8476,7 @@ function scanDiffItems(diffLines, rootDir, excludePatterns, entropyThreshold) {
   const suppressions = [];
   for (const [relFile, items] of fileGroups) {
     if (isPathExcluded2(relFile, excludePatterns)) continue;
-    const absPath = path4.resolve(rootDir, relFile);
+    const absPath = path5.resolve(rootDir, relFile);
     for (const item of items) {
       const lineViolations = scanLineForSecrets(item.content, item.lineNumber, absPath, relFile, entropyThreshold, suppressions);
       for (const v of lineViolations) {
@@ -8243,7 +8492,7 @@ function scanAllProjectFiles(rootDir, excludePatterns, entropyThreshold) {
   const suppressions = [];
   for (const file of allFiles) {
     try {
-      const content = fs7.readFileSync(file, "utf-8");
+      const content = fs8.readFileSync(file, "utf-8");
       findings.push(...scanContentForSecrets(content, file, rootDir, entropyThreshold, suppressions));
     } catch {
     }
@@ -8300,7 +8549,7 @@ function buildReportHeader2(result) {
   return [
     `# \u{1F510} Deterministic Secrets and Credentials Audit (Gitleaks Gate)`,
     ``,
-    `> **Evaluation Date:** ${(/* @__PURE__ */ new Date()).toISOString()}`,
+    `> **Evaluation Date:** ${resolveDeterministicDate().toISOString()}`,
     `> **Verdict:** ${isOk ? "\u2705 COMPLIANT (No exposed secrets or credentials)" : `\u274C BLOCKED (${result.findingsCount} exposed credentials detected)`}`,
     `> **Audited Files:** ${result.totalFilesScanned} | **Security Violations:** ${result.findingsCount}`,
     `> **Native Gitleaks Engine:** ${result.scannedWithGitleaks ? "\u{1F7E2} Active / Integrated" : "\u26AA Deterministic Native Scanner (@aisdlc/core)"}`,
@@ -8469,8 +8718,8 @@ function runSemgrepCli(rootDir) {
       const parsed = JSON.parse(output);
       if (Array.isArray(parsed.results)) {
         for (const item of parsed.results) {
-          const filePath = path4.resolve(rootDir, item.path);
-          const relPath = path4.relative(rootDir, filePath).replace(/\\/g, "/");
+          const filePath = path5.resolve(rootDir, item.path);
+          const relPath = path5.relative(rootDir, filePath).replace(/\\/g, "/");
           violations.push({
             filePath,
             relPath,
@@ -8497,15 +8746,15 @@ function isSastExcluded(relPath, excludes) {
 function walkSourceFiles(dir, rootDir, excludes = DEFAULT_SAST_EXCLUDES) {
   const files = [];
   try {
-    const entries = fs7.readdirSync(dir, { withFileTypes: true });
+    const entries = fs8.readdirSync(dir, { withFileTypes: true }).sort((a, b) => canonicalSort(a.name, b.name));
     for (const entry of entries) {
-      const fullPath = path4.join(dir, entry.name);
-      const relPath = path4.relative(rootDir, fullPath).replace(/\\/g, "/");
+      const fullPath = path5.join(dir, entry.name);
+      const relPath = path5.relative(rootDir, fullPath).replace(/\\/g, "/");
       if (isSastExcluded(relPath, excludes)) continue;
       if (entry.isDirectory()) {
         files.push(...walkSourceFiles(fullPath, rootDir, excludes));
       } else if (entry.isFile()) {
-        const ext = path4.extname(entry.name).toLowerCase();
+        const ext = path5.extname(entry.name).toLowerCase();
         if (GENERAL_SOURCE_EXTENSIONS.includes(ext)) {
           files.push(fullPath);
         }
@@ -8530,11 +8779,11 @@ function checkRuleMatch(rule, line, ext, minSeverity) {
 }
 function scanFileForSast(filePath, rootDir, minSeverity = "HIGH", collectedSuppressions) {
   const violations = [];
-  const ext = path4.extname(filePath).toLowerCase();
+  const ext = path5.extname(filePath).toLowerCase();
   try {
-    const content = fs7.readFileSync(filePath, "utf-8");
+    const content = fs8.readFileSync(filePath, "utf-8");
     const lines = content.split(/\r?\n/);
-    const relPath = path4.relative(rootDir, filePath).replace(/\\/g, "/");
+    const relPath = path5.relative(rootDir, filePath).replace(/\\/g, "/");
     for (let i = 0; i < lines.length; i++) {
       const line = lines[i];
       if (checkLineSuppression(line, relPath, i + 1, collectedSuppressions)) continue;
@@ -8560,8 +8809,8 @@ function scanFileForSast(filePath, rootDir, minSeverity = "HIGH", collectedSuppr
 function collectSastFiles(rootDir, targetDirs) {
   const files = [];
   for (const tDir of targetDirs) {
-    const fullDir = path4.join(rootDir, tDir);
-    if (fs7.existsSync(fullDir)) {
+    const fullDir = path5.join(rootDir, tDir);
+    if (fs8.existsSync(fullDir)) {
       files.push(...walkSourceFiles(fullDir, rootDir));
     }
   }
@@ -8607,7 +8856,7 @@ function buildSastHeader(isOk, violationsCount, totalFilesScanned) {
   return [
     `# \u{1F6E1}\uFE0F Shift-Left SAST Audit (Static Application Security Testing)`,
     ``,
-    `> **Evaluation Date:** ${(/* @__PURE__ */ new Date()).toISOString()}`,
+    `> **Evaluation Date:** ${resolveDeterministicDate().toISOString()}`,
     `> **Verdict:** ${verdict}`,
     `> **Audited Code Files:** ${totalFilesScanned} | **SAST Violations:** ${violationsCount}`,
     ``,
@@ -8796,22 +9045,31 @@ var PII_SAST_RULES = [
     pattern: /\b(?:ssn|dni|nif|tax_?id|national_?id)\s*[:=]\s*['"](?:\d{3}-\d{2}-\d{4}|\d{8}[A-HJ-NP-TV-Z])['"]/i
   }
 ];
-function loadPrivacyPolicy(rootDir, policyPath) {
-  const candidate = policyPath ? path4.isAbsolute(policyPath) ? policyPath : path4.join(rootDir, policyPath) : path4.join(rootDir, "privacy-policy.yaml");
-  if (!fs7.existsSync(candidate)) return DEFAULT_PRIVACY_POLICY;
+function parsePrivacyDoc(raw, candidate) {
+  let parsed;
   try {
-    const parsed = yaml3.load(fs7.readFileSync(candidate, "utf-8"));
-    if (!parsed || typeof parsed !== "object") return DEFAULT_PRIVACY_POLICY;
-    return {
-      ...DEFAULT_PRIVACY_POLICY,
-      ...parsed,
-      classifications: { ...DEFAULT_PRIVACY_POLICY.classifications, ...parsed.classifications || {} },
-      agent_guardrails: { ...DEFAULT_PRIVACY_POLICY.agent_guardrails, ...parsed.agent_guardrails || {} },
-      ci_gates: { ...DEFAULT_PRIVACY_POLICY.ci_gates, ...parsed.ci_gates || {} }
-    };
-  } catch {
-    return DEFAULT_PRIVACY_POLICY;
+    parsed = yaml3.load(raw);
+  } catch (err) {
+    throw new Error(`[AI-SDLC Fail-Closed] Invalid YAML in privacy-policy '${candidate}': ${err instanceof Error ? err.message : String(err)}`);
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error(`[AI-SDLC Fail-Closed] Invalid privacy policy structure in '${candidate}': root must be a YAML mapping`);
   }
+  return parsed;
+}
+function loadPrivacyPolicy(rootDir = process.cwd(), policyPath) {
+  const candidate = policyPath ? path5.isAbsolute(policyPath) ? policyPath : path5.join(rootDir, policyPath) : path5.join(rootDir, "privacy-policy.yaml");
+  if (!fs8.existsSync(candidate)) return DEFAULT_PRIVACY_POLICY;
+  const raw = fs8.readFileSync(candidate, "utf-8");
+  if (!raw || !raw.trim()) return DEFAULT_PRIVACY_POLICY;
+  const parsed = parsePrivacyDoc(raw, candidate);
+  return {
+    ...DEFAULT_PRIVACY_POLICY,
+    ...parsed,
+    classifications: { ...DEFAULT_PRIVACY_POLICY.classifications, ...parsed.classifications || {} },
+    agent_guardrails: { ...DEFAULT_PRIVACY_POLICY.agent_guardrails, ...parsed.agent_guardrails || {} },
+    ci_gates: { ...DEFAULT_PRIVACY_POLICY.ci_gates, ...parsed.ci_gates || {} }
+  };
 }
 function isLineExemptFromPrivacyScan(line) {
   return line.includes("ai-sdlc:allow-pii") || line.includes("ai-sdlc:allow-sast") || line.includes("nosec");
@@ -8828,9 +9086,9 @@ function shouldApplyPiiRule(rule, policy) {
 function scanFileForPrivacyViolations(filePath, rootDir, policy = DEFAULT_PRIVACY_POLICY) {
   const violations = [];
   try {
-    const content = fs7.readFileSync(filePath, "utf-8");
+    const content = fs8.readFileSync(filePath, "utf-8");
     const lines = content.split(/\r?\n/);
-    const relPath = path4.relative(rootDir, filePath).replace(/\\/g, "/");
+    const relPath = path5.relative(rootDir, filePath).replace(/\\/g, "/");
     for (let i = 0; i < lines.length; i++) {
       const line = lines[i];
       if (isLineExemptFromPrivacyScan(line)) continue;
@@ -8939,10 +9197,10 @@ function discoverPrivacyArtifacts(rootDir) {
     dpiaStatuses: /* @__PURE__ */ new Map()
   };
   for (const file of walkMdFiles(rootDir)) {
-    const relPath = path4.relative(rootDir, file).replace(/\\/g, "/");
+    const relPath = path5.relative(rootDir, file).replace(/\\/g, "/");
     if (isExcludedPrivacyMd(relPath)) continue;
     try {
-      const fm = extractFrontmatter(fs7.readFileSync(file, "utf-8"));
+      const fm = extractFrontmatter(fs8.readFileSync(file, "utf-8"));
       if (fm && fm.id) classifyPrivacyMarkdown(fm, relPath, acc);
     } catch {
     }
@@ -8987,7 +9245,7 @@ function checkAssetRopaRegistration(asset, ropaRecords, policy, fullPath) {
 }
 function auditDataAssetGovernance(asset, ropaRecords, policy, rootDir) {
   if (!isSensitiveClassification(asset.classification)) return [];
-  const fullPath = path4.join(rootDir, asset.filePath);
+  const fullPath = path5.join(rootDir, asset.filePath);
   const v1 = checkAssetRetention(asset, policy, fullPath);
   const v2 = checkAssetRopaRegistration(asset, ropaRecords, policy, fullPath);
   return [v1, v2].filter((v) => v !== null);
@@ -9059,8 +9317,8 @@ function checkRopaDpiaApproval(ropa, dataAssets, dpiaStatuses, fullPath) {
 function collectSourceFilesForPrivacy(rootDir, targetDirs) {
   const files = [];
   for (const dir of targetDirs) {
-    const fullDir = path4.join(rootDir, dir);
-    if (fs7.existsSync(fullDir)) {
+    const fullDir = path5.join(rootDir, dir);
+    if (fs8.existsSync(fullDir)) {
       files.push(...walkSourceFiles(fullDir, rootDir));
     }
   }
@@ -9150,15 +9408,13 @@ function generatePrivacyReportMarkdown(result, policy = DEFAULT_PRIVACY_POLICY)
 function writePrivacyOutputsIfNeeded(result, options, policy, rootDir) {
   if (options.generateRopa) {
     const relRopa = options.ropaOutputPath || policy.ci_gates.output_ropa_file || "reports/ROPA_INVENTORY.md";
-    const fullRopa = path4.isAbsolute(relRopa) ? relRopa : path4.join(rootDir, relRopa);
-    fs7.mkdirSync(path4.dirname(fullRopa), { recursive: true });
-    fs7.writeFileSync(fullRopa, result.ropaMarkdown, "utf-8");
+    const fullRopa = path5.isAbsolute(relRopa) ? relRopa : path5.join(rootDir, relRopa);
+    writeReportFileIfChanged(fullRopa, result.ropaMarkdown);
     result.ropaOutputPath = fullRopa;
   }
   if (options.reportOutputPath) {
-    const fullReport = path4.isAbsolute(options.reportOutputPath) ? options.reportOutputPath : path4.join(rootDir, options.reportOutputPath);
-    fs7.mkdirSync(path4.dirname(fullReport), { recursive: true });
-    fs7.writeFileSync(fullReport, result.reportMarkdown, "utf-8");
+    const fullReport = path5.isAbsolute(options.reportOutputPath) ? options.reportOutputPath : path5.join(rootDir, options.reportOutputPath);
+    writeReportFileIfChanged(fullReport, result.reportMarkdown);
     result.reportOutputPath = fullReport;
   }
 }
@@ -9170,7 +9426,7 @@ function evaluateDiscoveredPrivacyGovernance(discovered, policy, rootDir) {
   }
   let dpiaRequiredCount = 0;
   for (const ropa of discovered.ropaRecords) {
-    const fullPath = path4.join(rootDir, ropa.filePath);
+    const fullPath = path5.join(rootDir, ropa.filePath);
     violations.push(...checkRopaControlsAndSubprocessors(ropa, governedRopaIds, policy, fullPath));
     const dpiaCheck = checkRopaDpiaApproval(ropa, discovered.dataAssets, discovered.dpiaStatuses, fullPath);
     if (dpiaCheck.dpiaRequired) dpiaRequiredCount++;
@@ -9216,7 +9472,7 @@ function calculateRating(mi, cc) {
   return "F";
 }
 function detectLanguage(filePath) {
-  const ext = path4.extname(filePath).toLowerCase();
+  const ext = path5.extname(filePath).toLowerCase();
   switch (ext) {
     case ".ts":
       return "TypeScript";
@@ -9241,7 +9497,7 @@ function detectLanguage(filePath) {
 }
 function parseJsonSummaryFile(filePath, relSource) {
   try {
-    const raw = JSON.parse(fs7.readFileSync(filePath, "utf-8"));
+    const raw = JSON.parse(fs8.readFileSync(filePath, "utf-8"));
     const total = raw.total;
     if (!total || typeof total !== "object") return null;
     const linesPct = Number(total.lines?.pct);
@@ -9264,7 +9520,7 @@ function updateLcovCounts(line, counts) {
 }
 function parseLcovFile(filePath, relSource) {
   try {
-    const lines = fs7.readFileSync(filePath, "utf-8").split(/\r?\n/);
+    const lines = fs8.readFileSync(filePath, "utf-8").split(/\r?\n/);
     const counts = { LF: 0, LH: 0, BRF: 0, BRH: 0, FNF: 0, FNH: 0 };
     for (const line of lines) {
       updateLcovCounts(line, counts);
@@ -9284,16 +9540,16 @@ function parseLcovFile(filePath, relSource) {
 function readCodeCoverageSummary(rootDir = process.cwd()) {
   const jsonCandidates = ["coverage/coverage-summary.json", "reports/coverage-summary.json"];
   for (const rel of jsonCandidates) {
-    const full = path4.join(rootDir, rel);
-    if (fs7.existsSync(full)) {
+    const full = path5.join(rootDir, rel);
+    if (fs8.existsSync(full)) {
       const parsed = parseJsonSummaryFile(full, rel);
       if (parsed) return parsed;
     }
   }
   const lcovCandidates = ["coverage/lcov.info", "lcov.info", "reports/lcov.info"];
   for (const rel of lcovCandidates) {
-    const full = path4.join(rootDir, rel);
-    if (fs7.existsSync(full)) {
+    const full = path5.join(rootDir, rel);
+    if (fs8.existsSync(full)) {
       const parsed = parseLcovFile(full, rel);
       if (parsed) return parsed;
     }
@@ -9378,7 +9634,7 @@ function buildReportHeader3(verdict, rating, mi, cc) {
   return [
     `# \u{1F4CA} Formal Quality and Release Gate Report (AI-SDLC)`,
     "",
-    `> **Generation Date:** ${(/* @__PURE__ */ new Date()).toISOString()}`,
+    `> **Generation Date:** ${resolveDeterministicDate().toISOString()}`,
     `> **Release Gate Verdict:** ${status}`,
     `> **Global Rating:** **\`${rating}\`** (MI Index: ${mi}/100, Average CC: ${cc})`
   ];
@@ -9429,9 +9685,8 @@ function renderQualityReportMarkdown(gateResult, coverage, accumulated, averages
   return [...header, "", "---", "", ...table, "", "---", "", ...polyglot, ...violationsSection, "", EVALUATION_STANDARDS_MD].join("\n");
 }
 function writeQualityReportFile(rootDir, markdown) {
-  const reportsDir = path4.join(rootDir, "reports");
-  fs7.mkdirSync(reportsDir, { recursive: true });
-  fs7.writeFileSync(path4.join(reportsDir, "QUALITY_REPORT.md"), markdown, "utf-8");
+  const targetPath = path5.join(rootDir, "reports", "QUALITY_REPORT.md");
+  return writeReportFileIfChanged(targetPath, markdown);
 }
 function generateQualityReport(options = {}) {
   const rootDir = options.rootDir || process.cwd();
@@ -9573,9 +9828,9 @@ Flujo de Integraci\xF3n (Merges):`,
   };
 }
 function resolveVersionFromProposal(changeDir) {
-  const proposalFile = path4.join(changeDir, "proposal.md");
-  if (!fs7.existsSync(proposalFile)) return "1.0.0";
-  const propContent = fs7.readFileSync(proposalFile, "utf-8");
+  const proposalFile = path5.join(changeDir, "proposal.md");
+  if (!fs8.existsSync(proposalFile)) return "1.0.0";
+  const propContent = fs8.readFileSync(proposalFile, "utf-8");
   const propFm = propContent.match(/^---\r?\n([\s\S]*?)\r?\n---/);
   if (!propFm) return "1.0.0";
   const parsedProp = yaml3.load(propFm[1]);
@@ -9592,9 +9847,9 @@ function isTaskMatchingId(currentId, cleanTaskId) {
   return currentLower === targetLower || currentLower.startsWith(`${targetLower}-`) || targetLower.startsWith(`${currentLower}-`);
 }
 function parseTasksFrontmatter(tasksFile) {
-  if (!fs7.existsSync(tasksFile)) return null;
+  if (!fs8.existsSync(tasksFile)) return null;
   try {
-    const content = fs7.readFileSync(tasksFile, "utf-8");
+    const content = fs8.readFileSync(tasksFile, "utf-8");
     const fmMatch = content.match(/^---\r?\n([\s\S]*?)\r?\n---/);
     if (!fmMatch) return null;
     const fm = yaml3.load(fmMatch[1]);
@@ -9616,7 +9871,7 @@ function buildTaskMatch(currentId, currentTitle, rawChangeId, changeDir, version
   };
 }
 function inspectChangeTasks(changeDir, entryName, cleanTaskId, availableTasks) {
-  const fm = parseTasksFrontmatter(path4.join(changeDir, "tasks.md"));
+  const fm = parseTasksFrontmatter(path5.join(changeDir, "tasks.md"));
   if (!fm || !fm.tasks) return void 0;
   const rawChangeId = resolveRawChangeId(fm, entryName);
   const versionStr = resolveChangeVersion(fm, changeDir);
@@ -9637,16 +9892,16 @@ function locateTaskInActiveChanges(taskId, rootDir = process.cwd()) {
   if (!cleanTaskId) {
     return { found: false, error: "Debe especificar un identificador de tarea v\xE1lido (ej. TSK-001)." };
   }
-  const activeChangesDir = path4.join(rootDir, "specs", "changes", "active");
-  if (!fs7.existsSync(activeChangesDir)) {
+  const activeChangesDir = path5.join(rootDir, "specs", "changes", "active");
+  if (!fs8.existsSync(activeChangesDir)) {
     return { found: false, error: `No se encontr\xF3 el directorio de cambios activos en '${activeChangesDir}'.` };
   }
   const availableTasks = [];
-  const candidateDirs = fs7.readdirSync(activeChangesDir, { withFileTypes: true });
+  const candidateDirs = fs8.readdirSync(activeChangesDir, { withFileTypes: true });
   let matchedTask;
   for (const entry of candidateDirs) {
     if (!entry.isDirectory()) continue;
-    const changeDir = path4.join(activeChangesDir, entry.name);
+    const changeDir = path5.join(activeChangesDir, entry.name);
     const m = inspectChangeTasks(changeDir, entry.name, cleanTaskId, availableTasks);
     if (m && !matchedTask) {
       matchedTask = m;
@@ -9683,14 +9938,14 @@ function detectExistingFeatureBranch(branches, dirName, changeId, changeSlug) {
     (b) => b.startsWith("feat/") && (b.toLowerCase().includes(dirName.toLowerCase()) || b.toLowerCase().includes(changeId.toLowerCase())) && classifyBranch(b).valid
   );
   if (existing) return existing;
-  const normalizedName = slugify(changeSlug).replace(/^(chg|bug|feat)-(\d+)/i, (_, p, n) => `${p.toUpperCase()}-${n}`);
+  const normalizedName = slugify2(changeSlug).replace(/^(chg|bug|feat)-(\d+)/i, (_, p, n) => `${p.toUpperCase()}-${n}`);
   return `feat/${normalizedName}`;
 }
 function buildDefaultTaskSuffix(taskId, taskTitle) {
   let taskSuffix = taskId.toLowerCase();
   const hasSlug = taskSuffix.includes("-") && taskSuffix.split("-").length > 2;
   if (!hasSlug && taskTitle) {
-    const titleSlug = slugify(taskTitle).split("-").slice(0, 4).join("-");
+    const titleSlug = slugify2(taskTitle).split("-").slice(0, 4).join("-");
     if (titleSlug) {
       taskSuffix = `${taskSuffix}-${titleSlug}`;
     }
@@ -9710,7 +9965,7 @@ function resolveBranchHierarchy(match, rootDir = process.cwd()) {
   const branches = getGitBranchList(rootDir);
   const cleanVersion = (match.version || "1.0.0").replace(/^v/, "");
   const releaseBranch = detectExistingReleaseBranch(branches, cleanVersion);
-  const dirName = path4.basename(match.changeDir);
+  const dirName = path5.basename(match.changeDir);
   const changeSlug = dirName.replace(/^(chg|CHG)-/i, (m) => m.toUpperCase());
   const featureBranch = detectExistingFeatureBranch(branches, dirName, match.changeId, changeSlug);
   const parentIdMatch = featureBranch.replace(/^(feat|feature)\//i, "").match(/^[a-zA-Z0-9]+-[a-zA-Z0-9]+/);
@@ -10017,13 +10272,13 @@ function getGitConfigValue(key, cwd) {
 }
 function readSessionTelemetry(cwd) {
   const possiblePaths = [
-    path4.join(cwd, ".ai-sdlc", "session-telemetry.json"),
-    path4.join(cwd, ".ai-sdlc", "agent-session.json")
+    path5.join(cwd, ".ai-sdlc", "session-telemetry.json"),
+    path5.join(cwd, ".ai-sdlc", "agent-session.json")
   ];
   for (const p of possiblePaths) {
-    if (fs7.existsSync(p)) {
+    if (fs8.existsSync(p)) {
       try {
-        const raw = fs7.readFileSync(p, "utf-8");
+        const raw = fs8.readFileSync(p, "utf-8");
         return JSON.parse(raw);
       } catch {
       }
@@ -10243,20 +10498,20 @@ if [ -f "$TELEMETRY_FILE" ]; then
 fi
 `;
 function installGitHooks(rootDir = process.cwd()) {
-  const gitDir = path4.join(rootDir, ".git");
-  if (!fs7.existsSync(gitDir)) {
+  const gitDir = path5.join(rootDir, ".git");
+  if (!fs8.existsSync(gitDir)) {
     return {
       success: false,
       error: `No se encontr\xF3 el directorio Git en '${gitDir}'.`
     };
   }
-  const hooksDir = path4.join(gitDir, "hooks");
-  if (!fs7.existsSync(hooksDir)) {
-    fs7.mkdirSync(hooksDir, { recursive: true });
+  const hooksDir = path5.join(gitDir, "hooks");
+  if (!fs8.existsSync(hooksDir)) {
+    fs8.mkdirSync(hooksDir, { recursive: true });
   }
-  const hookPath = path4.join(hooksDir, "prepare-commit-msg");
+  const hookPath = path5.join(hooksDir, "prepare-commit-msg");
   try {
-    fs7.writeFileSync(hookPath, PREPARE_COMMIT_MSG_SCRIPT, { encoding: "utf-8", mode: 493 });
+    fs8.writeFileSync(hookPath, PREPARE_COMMIT_MSG_SCRIPT, { encoding: "utf-8", mode: 493 });
     return {
       success: true,
       hookPath
@@ -10597,16 +10852,16 @@ function formatReleaseKpiMarkdown(report) {
   ].join("\n");
 }
 function writeReleaseKpiReport(report, options = {}) {
-  const root = options.outputDir || (options.rootDir ? path4.join(options.rootDir, "reports", "releases") : path4.join(process.cwd(), "reports", "releases"));
-  if (!fs7.existsSync(root)) {
-    fs7.mkdirSync(root, { recursive: true });
+  const root = options.outputDir || (options.rootDir ? path5.join(options.rootDir, "reports", "releases") : path5.join(process.cwd(), "reports", "releases"));
+  if (!fs8.existsSync(root)) {
+    fs8.mkdirSync(root, { recursive: true });
   }
   const cleanBranchName = report.releaseBranch.replace(/[^a-zA-Z0-9.-]/g, "_");
-  const mdPath = path4.join(root, `RELEASE_KPIS_${cleanBranchName}.md`);
-  const jsonPath = path4.join(root, `release_${cleanBranchName}.kpis.json`);
+  const mdPath = path5.join(root, `RELEASE_KPIS_${cleanBranchName}.md`);
+  const jsonPath = path5.join(root, `release_${cleanBranchName}.kpis.json`);
   const mdContent = formatReleaseKpiMarkdown(report);
-  fs7.writeFileSync(mdPath, mdContent, "utf-8");
-  fs7.writeFileSync(jsonPath, JSON.stringify(report, null, 2), "utf-8");
+  fs8.writeFileSync(mdPath, mdContent, "utf-8");
+  fs8.writeFileSync(jsonPath, JSON.stringify(report, null, 2), "utf-8");
   return { markdownPath: mdPath, jsonPath };
 }
 var cachedScript = null;
@@ -10615,19 +10870,19 @@ function resolveCytoscapePath() {
   try {
     const req = createRequire(import.meta.url);
     const entryPath = req.resolve("cytoscape");
-    const dir = path4.dirname(entryPath);
-    const minPath = path4.join(dir, "cytoscape.min.js");
-    if (fs7.existsSync(minPath)) {
+    const dir = path5.dirname(entryPath);
+    const minPath = path5.join(dir, "cytoscape.min.js");
+    if (fs8.existsSync(minPath)) {
       return minPath;
     }
   } catch {
   }
   const searchDirs = [
-    path4.join(process.cwd(), "node_modules", "cytoscape", "dist", "cytoscape.min.js"),
-    path4.join(process.cwd(), "packages", "core", "node_modules", "cytoscape", "dist", "cytoscape.min.js")
+    path5.join(process.cwd(), "node_modules", "cytoscape", "dist", "cytoscape.min.js"),
+    path5.join(process.cwd(), "packages", "core", "node_modules", "cytoscape", "dist", "cytoscape.min.js")
   ];
   for (const candidate of searchDirs) {
-    if (fs7.existsSync(candidate)) {
+    if (fs8.existsSync(candidate)) {
       return candidate;
     }
   }
@@ -10640,7 +10895,7 @@ function getCytoscapeScript() {
   const scriptPath = resolveCytoscapePath();
   if (scriptPath) {
     try {
-      cachedScript = fs7.readFileSync(scriptPath, "utf-8");
+      cachedScript = fs8.readFileSync(scriptPath, "utf-8");
       return cachedScript;
     } catch {
     }
@@ -10740,7 +10995,7 @@ function extractFrontmatter2(fileContent) {
   }
 }
 function toScannedArtifact(filePath, relPath) {
-  const fileContent = fs7.readFileSync(filePath, "utf-8");
+  const fileContent = fs8.readFileSync(filePath, "utf-8");
   const fm = extractFrontmatter2(fileContent);
   const id = typeof fm?.id === "string" ? fm.id.trim() : "";
   if (!id) return null;
@@ -10752,12 +11007,12 @@ function toScannedArtifact(filePath, relPath) {
   return { id, type: classified.type, title, layer: classified.layer, filePath: relPath, content, frontmatter: fm };
 }
 function parseAndCatalogArtifactFile(rootDir, filePath, scannedMap, archViewByBasename) {
-  const relPath = path4.relative(rootDir, filePath).replace(/\\/g, "/");
+  const relPath = path5.relative(rootDir, filePath).replace(/\\/g, "/");
   if (relPath.includes("/changes/") || relPath.startsWith("changes/")) return;
   const scannedArt = toScannedArtifact(filePath, relPath);
   if (!scannedArt) return;
   if (scannedArt.layer === "architecture" && scannedArt.type === "architecture") {
-    archViewByBasename.set(path4.basename(relPath), scannedArt);
+    archViewByBasename.set(path5.basename(relPath), scannedArt);
   } else {
     scannedMap.set(scannedArt.id, scannedArt);
   }
@@ -10767,8 +11022,8 @@ function scanWorkspaceArtifacts(rootDir) {
   const archViewByBasename = /* @__PURE__ */ new Map();
   const artifactDirs = ["product", "architecture", "specs", "security", "privacy"];
   for (const dirName of artifactDirs) {
-    const fullDirPath = path4.join(rootDir, dirName);
-    if (fs7.existsSync(fullDirPath)) {
+    const fullDirPath = path5.join(rootDir, dirName);
+    if (fs8.existsSync(fullDirPath)) {
       for (const f of walkMdFiles(fullDirPath)) {
         parseAndCatalogArtifactFile(rootDir, f, scannedArtifactsMap, archViewByBasename);
       }
@@ -10828,9 +11083,9 @@ function addTraceArchEdges(r, status, archViewByBasename, nodeMap, addEdge) {
   }
 }
 function loadTestContentPreview(filePath) {
-  if (!fs7.existsSync(filePath)) return void 0;
+  if (!fs8.existsSync(filePath)) return void 0;
   try {
-    const testContent = fs7.readFileSync(filePath, "utf-8");
+    const testContent = fs8.readFileSync(filePath, "utf-8");
     const lang = filePath.endsWith(".feature") ? "gherkin" : "typescript";
     const preview = testContent.substring(0, 1500) + (testContent.length > 1500 ? "\n... (truncated)" : "");
     return "```" + lang + "\n" + preview + "\n```";
@@ -10840,10 +11095,10 @@ function loadTestContentPreview(filePath) {
 }
 function ensureTestNode(t, testId, rootDir, nodeMap) {
   if (nodeMap.has(testId)) return;
-  const fullTestPath = path4.isAbsolute(t) ? t : path4.join(rootDir, t);
+  const fullTestPath = path5.isAbsolute(t) ? t : path5.join(rootDir, t);
   nodeMap.set(testId, {
     id: testId,
-    label: path4.basename(t),
+    label: path5.basename(t),
     title: t,
     type: t.endsWith(".feature") ? "bdd-feature" : "code-test",
     layer: "test",
@@ -12988,9 +13243,10 @@ ${manualsTab}
 ${kpisTab}
   </main>`;
 }
-function renderDashboardHtml(graphData, metricsData, title = "AI-SDLC: Dashboard Interactivo de Trazabilidad y Calidad") {
+function renderDashboardHtml(graphData, metricsData, title = "AI-SDLC: Dashboard Interactivo de Trazabilidad y Calidad", generationDate) {
   const head = renderDashboardHead(title);
-  const header = renderHeaderHtml(graphData.issueCount, (/* @__PURE__ */ new Date()).toISOString());
+  const effectiveDate = generationDate || resolveDeterministicDate().toISOString();
+  const header = renderHeaderHtml(graphData.issueCount, effectiveDate);
   const nav = renderNavTabsHtml();
   const main = renderDashboardMain(metricsData);
   const sidebar = renderTaskSidebarHtml();
@@ -13020,9 +13276,9 @@ var IGNORED_SCAN_DIRS = /* @__PURE__ */ new Set([
   ".agent"
 ]);
 function readKpiFilesInDir(dir) {
-  if (!fs7.existsSync(dir)) return [];
+  if (!fs8.existsSync(dir)) return [];
   try {
-    return fs7.readdirSync(dir).filter((f) => f.endsWith(".kpis.json")).map((f) => path4.join(dir, f));
+    return fs8.readdirSync(dir).filter((f) => f.endsWith(".kpis.json")).map((f) => path5.join(dir, f));
   } catch {
     return [];
   }
@@ -13030,11 +13286,11 @@ function readKpiFilesInDir(dir) {
 function scanSubdirKpiFiles(dir, depth, acc) {
   if (depth > 4) return;
   try {
-    const entries = fs7.readdirSync(dir, { withFileTypes: true });
+    const entries = fs8.readdirSync(dir, { withFileTypes: true });
     for (const entry of entries) {
       if (!entry.isDirectory() || IGNORED_SCAN_DIRS.has(entry.name)) continue;
-      const sub = path4.join(dir, entry.name);
-      if (entry.name === "releases" && path4.basename(dir) === "reports") {
+      const sub = path5.join(dir, entry.name);
+      if (entry.name === "releases" && path5.basename(dir) === "reports") {
         acc.push(...readKpiFilesInDir(sub));
       } else {
         scanSubdirKpiFiles(sub, depth + 1, acc);
@@ -13044,7 +13300,7 @@ function scanSubdirKpiFiles(dir, depth, acc) {
   }
 }
 function findKpiJsonFiles(rootDir) {
-  const primaryFiles = readKpiFilesInDir(path4.join(rootDir, "reports", "releases"));
+  const primaryFiles = readKpiFilesInDir(path5.join(rootDir, "reports", "releases"));
   if (primaryFiles.length > 0) return primaryFiles;
   const found = [];
   scanSubdirKpiFiles(rootDir, 0, found);
@@ -13055,7 +13311,7 @@ function collectHistoricalKpis(rootDir) {
   const kpiFiles = findKpiJsonFiles(rootDir);
   for (const fullPath of kpiFiles) {
     try {
-      const content = fs7.readFileSync(fullPath, "utf-8");
+      const content = fs8.readFileSync(fullPath, "utf-8");
       const report = JSON.parse(content);
       if (!items.some((it) => it.id === report.releaseBranch && it.timestamp === report.generatedAt)) {
         items.push({
@@ -13261,15 +13517,11 @@ function computeGateAverages(gateResults) {
 }
 function generateDashboardReport(options = {}) {
   const rootDir = options.rootDir || process.cwd();
-  const outputPath = options.outputPath || path4.join(rootDir, "reports", "dashboard.html");
+  const outputPath = options.outputPath || path5.join(rootDir, "reports", "dashboard.html");
   const graphData = buildGraphElements(rootDir);
   const metricsData = collectDashboardMetrics(rootDir);
-  const html = renderDashboardHtml(graphData, metricsData, options.title);
-  const outDir = path4.dirname(outputPath);
-  if (!fs7.existsSync(outDir)) {
-    fs7.mkdirSync(outDir, { recursive: true });
-  }
-  fs7.writeFileSync(outputPath, html, "utf-8");
+  const html = renderDashboardHtml(graphData, metricsData, options.title, resolveDeterministicDate(rootDir).toISOString());
+  writeReportFileIfChanged(outputPath, html);
   const { bddCoverageRatio, traceabilityRatio } = computeSummaryRatios(metricsData);
   const { avgMi, avgCc } = computeGateAverages(metricsData.gate.results);
   return {
@@ -13295,6 +13547,8 @@ function generateDashboardReport(options = {}) {
     html
   };
 }
+
+// src/reporters/sarif.ts
 var SARIF_SCHEMA_2_1_0 = "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json";
 var SARIF_VERSION = "2.1.0";
 function normalizeUri(filePath) {
@@ -13442,11 +13696,7 @@ function serializeSarifDocument(doc, pretty = true) {
   return JSON.stringify(doc, null, pretty ? 2 : 0);
 }
 function writeSecuritySarifReport(outputPath, doc, pretty = true) {
-  const dir = path4.dirname(outputPath);
-  if (!fs7.existsSync(dir)) {
-    fs7.mkdirSync(dir, { recursive: true });
-  }
-  fs7.writeFileSync(outputPath, serializeSarifDocument(doc, pretty), "utf-8");
+  writeReportFileIfChanged(outputPath, serializeSarifDocument(doc, pretty));
 }
 
 // src/init/agent-templates.ts
@@ -16367,14 +16617,14 @@ function collectAgentFiles(targets) {
 function writeProjectFiles(destDir, files, dryRun) {
   const filesCreated = [];
   for (const f of files) {
-    const fullFilePath = path4.join(destDir, f.relPath);
-    const parentDir = path4.dirname(fullFilePath);
+    const fullFilePath = path5.join(destDir, f.relPath);
+    const parentDir = path5.dirname(fullFilePath);
     if (!dryRun) {
-      if (!fs7.existsSync(parentDir)) {
-        fs7.mkdirSync(parentDir, { recursive: true });
+      if (!fs8.existsSync(parentDir)) {
+        fs8.mkdirSync(parentDir, { recursive: true });
       }
-      if (!fs7.existsSync(fullFilePath)) {
-        fs7.writeFileSync(fullFilePath, f.content, "utf-8");
+      if (!fs8.existsSync(fullFilePath)) {
+        fs8.writeFileSync(fullFilePath, f.content, "utf-8");
         filesCreated.push(f.relPath);
       }
     } else {
@@ -16458,7 +16708,7 @@ function getCiWorkflowFiles(ciProvider) {
 function createDirectoriesOnDisk(destDir, directories, dryRun) {
   const created = [];
   for (const d of directories) {
-    if (!dryRun) fs7.mkdirSync(path4.join(destDir, d), { recursive: true });
+    if (!dryRun) fs8.mkdirSync(path5.join(destDir, d), { recursive: true });
     created.push(d);
   }
   return created;
@@ -16473,7 +16723,7 @@ function collectStarterFiles(ciProvider, agentFiles = [], archGranularity = "min
     ...getCiWorkflowFiles(ciProvider),
     ...agentFiles,
     ...getArchitectureTemplates(archGranularity).map((t) => ({
-      relPath: path4.join("templates", "architecture", t.filename).replace(/\\/g, "/"),
+      relPath: path5.join("templates", "architecture", t.filename).replace(/\\/g, "/"),
       content: t.content
     }))
   ];
@@ -16504,15 +16754,15 @@ function injectMissingScripts(scripts) {
   return modified;
 }
 function updateConsumerPackageJson(destDir, dryRun) {
-  const pkgPath = path4.join(destDir, "package.json");
-  if (!fs7.existsSync(pkgPath)) return false;
+  const pkgPath = path5.join(destDir, "package.json");
+  if (!fs8.existsSync(pkgPath)) return false;
   try {
-    const pkg = JSON.parse(fs7.readFileSync(pkgPath, "utf-8"));
+    const pkg = JSON.parse(fs8.readFileSync(pkgPath, "utf-8"));
     if (!pkg || typeof pkg !== "object") return false;
     pkg.scripts = pkg.scripts || {};
     const modified = injectMissingScripts(pkg.scripts);
     if (modified && !dryRun) {
-      fs7.writeFileSync(pkgPath, JSON.stringify(pkg, null, 2) + "\n", "utf-8");
+      fs8.writeFileSync(pkgPath, JSON.stringify(pkg, null, 2) + "\n", "utf-8");
     }
     return modified;
   } catch {
@@ -16520,7 +16770,7 @@ function updateConsumerPackageJson(destDir, dryRun) {
   }
 }
 function tryInstallGitHook(destDir, dryRun) {
-  if (!dryRun && fs7.existsSync(path4.join(destDir, ".git"))) {
+  if (!dryRun && fs8.existsSync(path5.join(destDir, ".git"))) {
     return installGitHooks(destDir).success;
   }
   return false;
@@ -16569,7 +16819,7 @@ function validateInitOptions(options) {
 }
 function initProject(options = {}) {
   const baseDir = options.rootDir || process.cwd();
-  const destDir = path4.resolve(baseDir, options.targetDir || ".");
+  const destDir = path5.resolve(baseDir, options.targetDir || ".");
   const validated = validateInitOptions(options);
   if (!validated.valid) return buildInitError(destDir, validated.error);
   const agentTargets = resolveAgentTargets(options.agents);
@@ -16653,33 +16903,40 @@ function normalizeParsedRule(raw, idx) {
     enabled: raw.enabled !== false
   };
 }
+function parseDlpDoc(yamlContent) {
+  let doc;
+  try {
+    doc = yaml3.load(yamlContent);
+  } catch (err) {
+    throw new Error(`[AI-SDLC Fail-Closed] Invalid YAML in dlp-policy: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  if (!doc || typeof doc !== "object" || Array.isArray(doc)) {
+    throw new Error(`[AI-SDLC Fail-Closed] Invalid dlp-policy structure: root must be a YAML mapping`);
+  }
+  const record = doc;
+  if (record.rules !== void 0 && !Array.isArray(record.rules)) {
+    throw new Error(`[AI-SDLC Fail-Closed] Invalid dlp-policy: rules must be an array`);
+  }
+  return record;
+}
 function parseDlpPolicy(yamlContent) {
   const fallback = createDefaultDlpPolicy();
   if (!yamlContent || !yamlContent.trim()) return fallback;
-  try {
-    const doc = yaml3.load(yamlContent);
-    if (!doc || typeof doc !== "object") return fallback;
-    const rawRules = Array.isArray(doc.rules) ? doc.rules : [];
-    const parsedRules = rawRules.map((r, i) => normalizeParsedRule(r, i)).filter((r) => r !== null);
-    return {
-      version: typeof doc.version === "string" ? doc.version : "1.0",
-      enabled: doc.enabled !== false,
-      zero_data_retention_required: Boolean(doc.zero_data_retention_required ?? true),
-      rules: parsedRules.length > 0 ? parsedRules : fallback.rules
-    };
-  } catch {
-    return fallback;
-  }
+  const record = parseDlpDoc(yamlContent);
+  const rawRules = Array.isArray(record.rules) ? record.rules : [];
+  const parsedRules = rawRules.map((r, i) => normalizeParsedRule(r, i)).filter((r) => r !== null);
+  return {
+    version: typeof record.version === "string" ? record.version : "1.0",
+    enabled: record.enabled !== false,
+    zero_data_retention_required: Boolean(record.zero_data_retention_required ?? true),
+    rules: parsedRules.length > 0 ? parsedRules : fallback.rules
+  };
 }
 function loadDlpPolicy(rootDir, customPolicyPath) {
   const base = rootDir || process.cwd();
-  const filePath = customPolicyPath ? path4.isAbsolute(customPolicyPath) ? customPolicyPath : path4.join(base, customPolicyPath) : path4.join(base, "dlp-policy.yaml");
-  if (!fs7.existsSync(filePath)) return createDefaultDlpPolicy();
-  try {
-    return parseDlpPolicy(fs7.readFileSync(filePath, "utf-8"));
-  } catch {
-    return createDefaultDlpPolicy();
-  }
+  const filePath = customPolicyPath ? path5.isAbsolute(customPolicyPath) ? customPolicyPath : path5.join(base, customPolicyPath) : path5.join(base, "dlp-policy.yaml");
+  if (!fs8.existsSync(filePath)) return createDefaultDlpPolicy();
+  return parseDlpPolicy(fs8.readFileSync(filePath, "utf-8"));
 }
 function applySingleDlpRule(text, rule) {
   if (rule.enabled === false) return { output: text, matches: 0 };
@@ -16730,6 +16987,6 @@ function sanitizeDlpPayload(payload, policy = createDefaultDlpPolicy()) {
   }
 }
 
-export { ALL_ARCHITECTURE_TEMPLATES, BRANCH_PATTERNS, BddStepRegistry, DEFAULT_DLP_RULES, DEFAULT_EXCLUDED_PATTERNS, DEFAULT_EXCLUDES, DEFAULT_EXTENSIONS, DEFAULT_PRIVACY_POLICY, DEFAULT_SAST_EXCLUDES, GENERAL_SOURCE_EXTENSIONS, KPI_SUMMARY_END_TAG, KPI_SUMMARY_START_TAG, LIFECYCLE_SKILL_TEMPLATES, OpenSpecAdapter, PII_SAST_RULES, PREPARE_COMMIT_MSG_SCRIPT, PROMPT_INJECTION_SIGNATURES, PROTECTED_BYPASS_PATTERNS, SARIF_SCHEMA_2_1_0, SARIF_VERSION, SAST_RULES, SCHEMA_SCHEMAS_ARCHITECTURE_ADR_SCHEMA_JSON, SCHEMA_SCHEMAS_ARCHITECTURE_COMPONENT_SCHEMA_JSON, SCHEMA_SCHEMAS_ARCHITECTURE_INTRODUCTION_AND_GOALS_SCHEMA_JSON, SCHEMA_SCHEMAS_COMPLIANCE_LICENSE_MANIFEST_SCHEMA_JSON, SCHEMA_SCHEMAS_COMPLIANCE_LICENSE_POLICY_SCHEMA_JSON, SCHEMA_SCHEMAS_COMPLIANCE_QUALITY_POLICY_SCHEMA_JSON, SCHEMA_SCHEMAS_IDE_MCP_CONFIG_SCHEMA_JSON, SCHEMA_SCHEMAS_MANUALS_PRODUCTION_MANUAL_SCHEMA_JSON, SCHEMA_SCHEMAS_MANUALS_USER_MANUAL_SCHEMA_JSON, SCHEMA_SCHEMAS_PRIVACY_DATA_ASSET_SCHEMA_JSON, SCHEMA_SCHEMAS_PRIVACY_PRIVACY_POLICY_SCHEMA_JSON, SCHEMA_SCHEMAS_PRIVACY_PRIVACY_REQ_SCHEMA_JSON, SCHEMA_SCHEMAS_PRIVACY_PRIVACY_ROPA_SCHEMA_JSON, SCHEMA_SCHEMAS_PRODUCT_ACTOR_SCHEMA_JSON, SCHEMA_SCHEMAS_PRODUCT_BOUNDED_CONTEXT_SCHEMA_JSON, SCHEMA_SCHEMAS_PRODUCT_BUSINESS_RULE_SCHEMA_JSON, SCHEMA_SCHEMAS_PRODUCT_JOURNEY_SCHEMA_JSON, SCHEMA_SCHEMAS_PRODUCT_REQUIREMENT_SCHEMA_JSON, SCHEMA_SCHEMAS_PRODUCT_TERM_SCHEMA_JSON, SCHEMA_SCHEMAS_PRODUCT_USE_CASE_SCHEMA_JSON, SCHEMA_SCHEMAS_SAFETY_HAZARD_SCHEMA_JSON, SCHEMA_SCHEMAS_SAFETY_SAFETY_REQ_SCHEMA_JSON, SCHEMA_SCHEMAS_SDD_DESIGN_SCHEMA_JSON, SCHEMA_SCHEMAS_SDD_HANDOFF_SCHEMA_JSON, SCHEMA_SCHEMAS_SDD_PROPOSAL_SCHEMA_JSON, SCHEMA_SCHEMAS_SDD_RELEASE_KPIS_SCHEMA_JSON, SCHEMA_SCHEMAS_SDD_SESSION_TELEMETRY_SCHEMA_JSON, SCHEMA_SCHEMAS_SDD_SPEC_SCHEMA_JSON, SCHEMA_SCHEMAS_SDD_TASKS_SCHEMA_JSON, SCHEMA_SCHEMAS_SECURITY_ABUSE_CASE_SCHEMA_JSON, SCHEMA_SCHEMAS_SECURITY_ENCLAVE_SCHEMA_JSON, SCHEMA_SCHEMAS_SECURITY_SECURITY_REQ_SCHEMA_JSON, SCHEMA_SCHEMAS_SECURITY_THREAT_ACTOR_SCHEMA_JSON, SCHEMA_SCHEMAS_WORKFLOW_AGENT_HANDOFF_SCHEMA_JSON, SECRET_RULES, SPECIALIZED_AGENT_TEMPLATES, STARTER_ANTIGRAVITY_MCP, STARTER_ANTIGRAVITY_RULES, STARTER_ARCH_ADR, STARTER_ARCH_ARCHITECTURE_CONSTRAINTS, STARTER_ARCH_COMPONENT, STARTER_ARCH_CONTEXT_AND_SCOPE, STARTER_ARCH_CROSS_CUTTING_CONCEPTS, STARTER_ARCH_DEPLOYMENT_VIEW, STARTER_ARCH_GLOSSARY, STARTER_ARCH_INTRODUCTION_AND_GOALS, STARTER_ARCH_LEVEL_1_WHITEBOX, STARTER_ARCH_QUALITY_REQUIREMENTS, STARTER_ARCH_RISKS_AND_TECHNICAL_DEBT, STARTER_ARCH_RUNTIME_VIEW, STARTER_ARCH_SOLUTION_STRATEGY, STARTER_AZURE_PIPELINES, STARTER_BASE_TEMPLATES, STARTER_BITBUCKET_PIPELINES, STARTER_CLAUDE_RULES, STARTER_COMPLIANCE_LICENSE_MANIFEST_YAML, STARTER_COPILOT_RULES, STARTER_CURSOR_CORE_RULES, STARTER_CURSOR_MCP, STARTER_CURSOR_PRODUCT_RULES, STARTER_CURSOR_QUALITY_RULES, STARTER_GITHUB_CI, STARTER_GITHUB_DEPLOY_DASHBOARD, STARTER_GITHUB_PR_KPI, STARTER_GITHUB_PULL_REQUEST_TEMPLATE, STARTER_GITHUB_SDD_INTEGRATE, STARTER_GITLAB_CI, STARTER_LICENSE_POLICY, STARTER_PRIVACY_POLICY, STARTER_PROCESS_README, STARTER_PULL_REQUEST_TEMPLATE, STARTER_QUALITY_POLICY, STARTER_REQUIREMENT_TEMPLATE, STARTER_SCHEMAS, STARTER_SCHEMAS_MAP, STARTER_TASK_TEMPLATE, STARTER_TEMPLATES_CI_AZURE_PIPELINES_YML, STARTER_TEMPLATES_CI_BITBUCKET_PIPELINES_YML, STARTER_TEMPLATES_CI_GITHUB_WORKFLOWS_CI_YML, STARTER_TEMPLATES_CI_GITHUB_WORKFLOWS_DEPLOY_DASHBOARD_YML, STARTER_TEMPLATES_CI_GITHUB_WORKFLOWS_PR_KPI_SUMMARY_YML, STARTER_TEMPLATES_CI_GITHUB_WORKFLOWS_SDD_INTEGRATE_ON_MERGE_YML, STARTER_TEMPLATES_CI__GITLAB_CI_YML, STARTER_TEMPLATES_COMPLIANCE_COMMERCIAL_ACQUISITION_REQUEST_TEMPLATE_MD, STARTER_TEMPLATES_MANUALS_PRODUCTION_MANUAL_TEMPLATE_MD, STARTER_TEMPLATES_MANUALS_USER_MANUAL_TEMPLATE_MD, STARTER_TEMPLATES_PRIVACY_DATA_ASSET_TEMPLATE_MD, STARTER_TEMPLATES_PRIVACY_DPIA_REQUEST_TEMPLATE_MD, STARTER_TEMPLATES_PRIVACY_PRIVACY_REQ_TEMPLATE_MD, STARTER_TEMPLATES_PRIVACY_PRIVACY_ROPA_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_ACTOR_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_BOUNDED_CONTEXT_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_BUSINESS_RULE_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_JOURNEY_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_REQUIREMENT_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_TERM_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_USER_DESIGN_FEEDBACK_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_USE_CASE_TEMPLATE_MD, STARTER_TEMPLATES_SAFETY_HAZARD_TEMPLATE_MD, STARTER_TEMPLATES_SAFETY_SAFETY_REQ_TEMPLATE_MD, STARTER_TEMPLATES_SDD_DESIGN_TEMPLATE_MD, STARTER_TEMPLATES_SDD_HANDOFF_TEMPLATE_YAML, STARTER_TEMPLATES_SDD_PROPOSAL_TEMPLATE_MD, STARTER_TEMPLATES_SDD_PULL_REQUEST_TEMPLATE_MD, STARTER_TEMPLATES_SDD_SPEC_TEMPLATE_MD, STARTER_TEMPLATES_SDD_TASKS_TEMPLATE_MD, STARTER_TEMPLATES_SECURITY_ABUSE_CASE_TEMPLATE_MD, STARTER_TEMPLATES_SECURITY_ENCLAVE_TEMPLATE_MD, STARTER_TEMPLATES_SECURITY_SECURITY_REQ_TEMPLATE_MD, STARTER_TEMPLATES_SECURITY_THREAT_ACTOR_TEMPLATE_MD, STARTER_TEMPLATES_WORKFLOW_AGENT_HANDOFF_TEMPLATE_MD, STARTER_VSCODE_MCP, STARTER_WORKFLOW_HANDOFF_TEMPLATE, STARTER__GITHUB_PULL_REQUEST_TEMPLATE_MD, SpecKitAdapter, TYPE_TO_SCHEMA_MAP, VALID_AGENT_TARGETS, VALID_ARCHITECTURE_GRANULARITIES, VALID_AUTONOMY_MODES, VALID_CHANGE_PROFILES, VALID_CI_PROVIDERS, aggregateCommitKpiRecords, aggregatePrKpis, aggregateReleaseKpis, analyzeBddVariantsForRequirement, appendRevisionHistoryRow, applyRatchetMode, buildCycloneDxComponent, buildCycloneDxVulnerabilities, buildFeatureFileContent, buildGraphElements, calculateJaccardSimilarity, calculateMetrics, calculateRating, calculateShannonEntropy, checkGherkinInSync, checkoutTaskBranch, classifyBranch, classifyMetricFromMessage, collectAgentFiles, collectDashboardMetrics, collectHistoricalKpis, computeCanonicalSha256, computeSha256, computeViolationSignature, createDefaultDlpPolicy, createDefaultQualityPolicy, depositProductHandoffSidecar, detectActiveChangeForIntegration, detectAuthorIdentity, detectLanguage, detectProfileFromChange, detectPromptInjection, emitCiOutput, evaluateCompoundLicense, evaluateSingleDependency, evaluateVulnerabilityThresholds, executeBddFeature, extractBaselineEntriesFromResults, extractCitations, extractCommitKpisFromRange, extractDirectDepNames, extractFeatureTags, extractFrontmatter, extractFunctions, extractFunctionsBraceLanguages, extractFunctionsPolyglot, extractFunctionsPython, extractFunctionsTypeScriptAst, extractGherkinBlock, extractGherkinFeatures, extractNormativeText, findChangeWorkspaceDir, findLicenseFile, formatCommitTrailers, formatPrKpiMarkdown, formatReleaseKpiMarkdown, generateBranchHierarchyPlan, generateCycloneDxSbom, generateDashboardReport, generateDuplicatesReportMarkdown, generateGovernanceReportMarkdown, generateLicenseReportMarkdown, generatePdacReportMarkdown, generatePrivacyReportMarkdown, generateQualityReport, generateRopaInventoryMarkdown, generateSastReportMarkdown, generateSecretsReportMarkdown, generateSecuritySarifReport, generateSuppressionsAuditReport, generateTestingCoverageReportMarkdown, generateThirdPartyNotices, generateTraceabilityReportMarkdown, getArchitectureTemplates, getCytoscapeScript, getGitDiffLines, getNextCorrelativeNumber, getSddAdapter, inferArtifactTypeFromId, inferMissingTrailers, initProject, injectKpisIntoPrBody, installGitHooks, integrateSddChange, isGitleaksInstalled, isMetricWorsened, isPathProtectedFromPatch, isPlaceholderOrIgnored, isRequirementArtifact2 as isRequirementArtifact, isSemgrepInstalled, isToolAvailable, loadDlpPolicy, loadPrivacyPolicy, loadProductHandoffSidecar, loadQualityBaseline, locateTaskInActiveChanges, mapSastSeverityToSarifLevel, maskSecret, normalizeSpdxLicense, normalizeUri, parseCommitTrailers, parseDlpPolicy, parseFeatureDocument, parseFrontmatter, parseFrontmatterId, parseGenericDoc, parseLicensePolicy, parseMarkdownFrontmatter, parseQualityPolicy, parseRequirementFile, parseSecuritySuppression, parseSpecCatalogScope, parseTasksDoc, parseTasksFromContent, parseTrivyVulnerabilities, processPackageDir, readCodeCoverageSummary, readPackageJson, renderAntigravityAgentFile, renderAntigravitySkillFile, renderAutonomyModeSection, renderClaudeAgentFile, renderClaudeSkillFile, renderCopilotAgentFile, renderCopilotSkillFile, renderCursorAgentFile, renderCursorSkillFile, renderDashboardHtml, renderManualsTab, resolveAgentTargets, resolveBranchHierarchy, resolveCiEnvironment, resolveCytoscapePath, resolveDefaultBranchBase, resolveFeatureFilePath, resolveGitRef, resolveLicenseFromFile, resolveReleaseBaseBranch, resolveSastCwe, resolveSastOwasp, resolveSchemaForArtifact, resolveTargetFiles, runGitleaksCli, runSemgrepCli, sanitizeDlpPayload, sanitizeDlpText, scaffoldSddChange, scanAllProductHandoffs, scanAllTestArtifacts, scanContentForSecrets, scanFileForPrivacyViolations, scanFileForSast, scanGoDependencies, scanInstalledLicenses, scanManualsInWorkspace, scanMavenDependencies, scanPnpmStore, scanPythonDependencies, scanRustDependencies, scanSubdirectories, scanWithNativeFs, scanWithSyft, scanWithTrivy, serializeSarifDocument, slugify, syncPdacDigests, tokenizeTitle, updateCitationsInContent, validateAgainstSchema, validateArtifactSchema, verifyArtifactDuplicates, verifyArtifactsSchemas, verifyLicenses, verifyManuals, verifyPdacGraph, verifyPrivacy, verifyProgressiveFriction, verifyQualityGate, verifySast, verifySddIntegration, verifySecrets, verifyTasksGovernance, verifyTestingCoverage, verifyTraceability, walkDir, walkMdFiles, walkProjectFiles, walkSourceFiles, walkTaskFiles, writeCucumberJsonReport, writeCycloneDxSbom, writeQualityBaseline, writeReleaseKpiReport, writeSecuritySarifReport, writeThirdPartyNotices };
+export { ALL_ARCHITECTURE_TEMPLATES, BRANCH_PATTERNS, BddStepRegistry, DEFAULT_DLP_RULES, DEFAULT_EXCLUDED_PATTERNS, DEFAULT_EXCLUDES, DEFAULT_EXTENSIONS, DEFAULT_PRIVACY_POLICY, DEFAULT_SAST_EXCLUDES, GENERAL_SOURCE_EXTENSIONS, KPI_SUMMARY_END_TAG, KPI_SUMMARY_START_TAG, LIFECYCLE_SKILL_TEMPLATES, OpenSpecAdapter, PII_SAST_RULES, PREPARE_COMMIT_MSG_SCRIPT, PROMPT_INJECTION_SIGNATURES, PROTECTED_BYPASS_PATTERNS, SARIF_SCHEMA_2_1_0, SARIF_VERSION, SAST_RULES, SCHEMA_SCHEMAS_ARCHITECTURE_ADR_SCHEMA_JSON, SCHEMA_SCHEMAS_ARCHITECTURE_COMPONENT_SCHEMA_JSON, SCHEMA_SCHEMAS_ARCHITECTURE_INTRODUCTION_AND_GOALS_SCHEMA_JSON, SCHEMA_SCHEMAS_COMPLIANCE_LICENSE_MANIFEST_SCHEMA_JSON, SCHEMA_SCHEMAS_COMPLIANCE_LICENSE_POLICY_SCHEMA_JSON, SCHEMA_SCHEMAS_COMPLIANCE_QUALITY_POLICY_SCHEMA_JSON, SCHEMA_SCHEMAS_IDE_MCP_CONFIG_SCHEMA_JSON, SCHEMA_SCHEMAS_MANUALS_PRODUCTION_MANUAL_SCHEMA_JSON, SCHEMA_SCHEMAS_MANUALS_USER_MANUAL_SCHEMA_JSON, SCHEMA_SCHEMAS_PRIVACY_DATA_ASSET_SCHEMA_JSON, SCHEMA_SCHEMAS_PRIVACY_PRIVACY_POLICY_SCHEMA_JSON, SCHEMA_SCHEMAS_PRIVACY_PRIVACY_REQ_SCHEMA_JSON, SCHEMA_SCHEMAS_PRIVACY_PRIVACY_ROPA_SCHEMA_JSON, SCHEMA_SCHEMAS_PRODUCT_ACTOR_SCHEMA_JSON, SCHEMA_SCHEMAS_PRODUCT_BOUNDED_CONTEXT_SCHEMA_JSON, SCHEMA_SCHEMAS_PRODUCT_BUSINESS_RULE_SCHEMA_JSON, SCHEMA_SCHEMAS_PRODUCT_JOURNEY_SCHEMA_JSON, SCHEMA_SCHEMAS_PRODUCT_REQUIREMENT_SCHEMA_JSON, SCHEMA_SCHEMAS_PRODUCT_TERM_SCHEMA_JSON, SCHEMA_SCHEMAS_PRODUCT_USE_CASE_SCHEMA_JSON, SCHEMA_SCHEMAS_SAFETY_HAZARD_SCHEMA_JSON, SCHEMA_SCHEMAS_SAFETY_SAFETY_REQ_SCHEMA_JSON, SCHEMA_SCHEMAS_SDD_DESIGN_SCHEMA_JSON, SCHEMA_SCHEMAS_SDD_HANDOFF_SCHEMA_JSON, SCHEMA_SCHEMAS_SDD_PROPOSAL_SCHEMA_JSON, SCHEMA_SCHEMAS_SDD_RELEASE_KPIS_SCHEMA_JSON, SCHEMA_SCHEMAS_SDD_SESSION_TELEMETRY_SCHEMA_JSON, SCHEMA_SCHEMAS_SDD_SPEC_SCHEMA_JSON, SCHEMA_SCHEMAS_SDD_TASKS_SCHEMA_JSON, SCHEMA_SCHEMAS_SECURITY_ABUSE_CASE_SCHEMA_JSON, SCHEMA_SCHEMAS_SECURITY_ENCLAVE_SCHEMA_JSON, SCHEMA_SCHEMAS_SECURITY_SECURITY_REQ_SCHEMA_JSON, SCHEMA_SCHEMAS_SECURITY_THREAT_ACTOR_SCHEMA_JSON, SCHEMA_SCHEMAS_WORKFLOW_AGENT_HANDOFF_SCHEMA_JSON, SECRET_RULES, SPECIALIZED_AGENT_TEMPLATES, STARTER_ANTIGRAVITY_MCP, STARTER_ANTIGRAVITY_RULES, STARTER_ARCH_ADR, STARTER_ARCH_ARCHITECTURE_CONSTRAINTS, STARTER_ARCH_COMPONENT, STARTER_ARCH_CONTEXT_AND_SCOPE, STARTER_ARCH_CROSS_CUTTING_CONCEPTS, STARTER_ARCH_DEPLOYMENT_VIEW, STARTER_ARCH_GLOSSARY, STARTER_ARCH_INTRODUCTION_AND_GOALS, STARTER_ARCH_LEVEL_1_WHITEBOX, STARTER_ARCH_QUALITY_REQUIREMENTS, STARTER_ARCH_RISKS_AND_TECHNICAL_DEBT, STARTER_ARCH_RUNTIME_VIEW, STARTER_ARCH_SOLUTION_STRATEGY, STARTER_AZURE_PIPELINES, STARTER_BASE_TEMPLATES, STARTER_BITBUCKET_PIPELINES, STARTER_CLAUDE_RULES, STARTER_COMPLIANCE_LICENSE_MANIFEST_YAML, STARTER_COPILOT_RULES, STARTER_CURSOR_CORE_RULES, STARTER_CURSOR_MCP, STARTER_CURSOR_PRODUCT_RULES, STARTER_CURSOR_QUALITY_RULES, STARTER_GITHUB_CI, STARTER_GITHUB_DEPLOY_DASHBOARD, STARTER_GITHUB_PR_KPI, STARTER_GITHUB_PULL_REQUEST_TEMPLATE, STARTER_GITHUB_SDD_INTEGRATE, STARTER_GITLAB_CI, STARTER_LICENSE_POLICY, STARTER_PRIVACY_POLICY, STARTER_PROCESS_README, STARTER_PULL_REQUEST_TEMPLATE, STARTER_QUALITY_POLICY, STARTER_REQUIREMENT_TEMPLATE, STARTER_SCHEMAS, STARTER_SCHEMAS_MAP, STARTER_TASK_TEMPLATE, STARTER_TEMPLATES_CI_AZURE_PIPELINES_YML, STARTER_TEMPLATES_CI_BITBUCKET_PIPELINES_YML, STARTER_TEMPLATES_CI_GITHUB_WORKFLOWS_CI_YML, STARTER_TEMPLATES_CI_GITHUB_WORKFLOWS_DEPLOY_DASHBOARD_YML, STARTER_TEMPLATES_CI_GITHUB_WORKFLOWS_PR_KPI_SUMMARY_YML, STARTER_TEMPLATES_CI_GITHUB_WORKFLOWS_SDD_INTEGRATE_ON_MERGE_YML, STARTER_TEMPLATES_CI__GITLAB_CI_YML, STARTER_TEMPLATES_COMPLIANCE_COMMERCIAL_ACQUISITION_REQUEST_TEMPLATE_MD, STARTER_TEMPLATES_MANUALS_PRODUCTION_MANUAL_TEMPLATE_MD, STARTER_TEMPLATES_MANUALS_USER_MANUAL_TEMPLATE_MD, STARTER_TEMPLATES_PRIVACY_DATA_ASSET_TEMPLATE_MD, STARTER_TEMPLATES_PRIVACY_DPIA_REQUEST_TEMPLATE_MD, STARTER_TEMPLATES_PRIVACY_PRIVACY_REQ_TEMPLATE_MD, STARTER_TEMPLATES_PRIVACY_PRIVACY_ROPA_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_ACTOR_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_BOUNDED_CONTEXT_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_BUSINESS_RULE_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_JOURNEY_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_REQUIREMENT_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_TERM_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_USER_DESIGN_FEEDBACK_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_USE_CASE_TEMPLATE_MD, STARTER_TEMPLATES_SAFETY_HAZARD_TEMPLATE_MD, STARTER_TEMPLATES_SAFETY_SAFETY_REQ_TEMPLATE_MD, STARTER_TEMPLATES_SDD_DESIGN_TEMPLATE_MD, STARTER_TEMPLATES_SDD_HANDOFF_TEMPLATE_YAML, STARTER_TEMPLATES_SDD_PROPOSAL_TEMPLATE_MD, STARTER_TEMPLATES_SDD_PULL_REQUEST_TEMPLATE_MD, STARTER_TEMPLATES_SDD_SPEC_TEMPLATE_MD, STARTER_TEMPLATES_SDD_TASKS_TEMPLATE_MD, STARTER_TEMPLATES_SECURITY_ABUSE_CASE_TEMPLATE_MD, STARTER_TEMPLATES_SECURITY_ENCLAVE_TEMPLATE_MD, STARTER_TEMPLATES_SECURITY_SECURITY_REQ_TEMPLATE_MD, STARTER_TEMPLATES_SECURITY_THREAT_ACTOR_TEMPLATE_MD, STARTER_TEMPLATES_WORKFLOW_AGENT_HANDOFF_TEMPLATE_MD, STARTER_VSCODE_MCP, STARTER_WORKFLOW_HANDOFF_TEMPLATE, STARTER__GITHUB_PULL_REQUEST_TEMPLATE_MD, SpecKitAdapter, TYPE_TO_SCHEMA_MAP, UNIT_TEST_SUFFIXES, VALID_AGENT_TARGETS, VALID_ARCHITECTURE_GRANULARITIES, VALID_AUTONOMY_MODES, VALID_CHANGE_PROFILES, VALID_CI_PROVIDERS, aggregateCommitKpiRecords, aggregatePrKpis, aggregateReleaseKpis, analyzeBddVariantsForRequirement, appendRevisionHistoryRow, applyRatchetMode, buildCycloneDxComponent, buildCycloneDxVulnerabilities, buildFeatureFileContent, buildGraphElements, calculateJaccardSimilarity, calculateMetrics, calculateRating, calculateShannonEntropy, canonicalSort, checkGherkinInSync, checkoutTaskBranch, classifyBranch, classifyMetricFromMessage, collectAgentFiles, collectDashboardMetrics, collectHistoricalKpis, computeCanonicalSha256, computeRawSha256, computeSha256, computeViolationSignature, createDefaultDlpPolicy, createDefaultQualityPolicy, depositProductHandoffSidecar, detectActiveChangeForIntegration, detectAuthorIdentity, detectLanguage, detectProfileFromChange, detectPromptInjection, emitCiOutput, evaluateCompoundLicense, evaluateSingleDependency, evaluateVulnerabilityThresholds, executeBddFeature, extractBaselineEntriesFromResults, extractCitations, extractCommitKpisFromRange, extractDirectDepNames, extractFeatureTags, extractFrontmatter, extractFunctions, extractFunctionsBraceLanguages, extractFunctionsPolyglot, extractFunctionsPython, extractFunctionsPythonAst, extractFunctionsTypeScriptAst, extractGherkinBlock, extractGherkinFeatures, extractNormativeText, extractPythonFunctionsPolyglot, extractSemanticContent, findChangeWorkspaceDir, findLicenseFile, formatCommitTrailers, formatPrKpiMarkdown, formatReleaseKpiMarkdown, generateBranchHierarchyPlan, generateCycloneDxSbom, generateDashboardReport, generateDeterministicUuidV5, generateDuplicatesReportMarkdown, generateGovernanceReportMarkdown, generateLicenseReportMarkdown, generatePdacReportMarkdown, generatePrivacyReportMarkdown, generateQualityReport, generateRopaInventoryMarkdown, generateSastReportMarkdown, generateSecretsReportMarkdown, generateSecuritySarifReport, generateSuppressionsAuditReport, generateTestingCoverageReportMarkdown, generateThirdPartyNotices, generateTraceabilityReportMarkdown, getArchitectureTemplates, getCytoscapeScript, getGitDiffLines, getNextCorrelativeNumber, getSddAdapter, inferArtifactTypeFromId, inferMissingTrailers, initProject, injectKpisIntoPrBody, installGitHooks, integrateSddChange, isCliInstalled, isFunctionReferencedInTests, isGitleaksInstalled, isMetricWorsened, isPathProtectedFromPatch, isPlaceholderOrIgnored, isReportContentSemanticallyEqual, isRequirementArtifact2 as isRequirementArtifact, isSemgrepInstalled, isToolAvailable, loadDlpPolicy, loadPrivacyPolicy, loadProductHandoffSidecar, loadQualityBaseline, locateTaskInActiveChanges, mapSastSeverityToSarifLevel, maskSecret, normalizePath, normalizeSpdxLicense, normalizeUri, orchestrateNativeAstAnalysis, parseCommitTrailers, parseDlpPolicy, parseFeatureDocument, parseFrontmatter, parseFrontmatterId, parseGenericDoc, parseLicensePolicy, parseMarkdownFrontmatter, parseQualityPolicy, parseRequirementFile, parseSecuritySuppression, parseSpecCatalogScope, parseTasksDoc, parseTasksFromContent, parseTrivyVulnerabilities, processPackageDir, readCodeCoverageSummary, readPackageJson, renderAntigravityAgentFile, renderAntigravitySkillFile, renderAutonomyModeSection, renderClaudeAgentFile, renderClaudeSkillFile, renderCopilotAgentFile, renderCopilotSkillFile, renderCursorAgentFile, renderCursorSkillFile, renderDashboardHtml, renderManualsTab, resolveAgentTargets, resolveBranchHierarchy, resolveCiEnvironment, resolveCytoscapePath, resolveDefaultBranchBase, resolveDeterministicDate, resolveFeatureFilePath, resolveGitRef, resolveLicenseFromFile, resolveReleaseBaseBranch, resolveSastCwe, resolveSastOwasp, resolveSchemaForArtifact, resolveTargetFiles, runGitleaksCli, runSemgrepCli, sanitizeDlpPayload, sanitizeDlpText, sanitizeTestCorpus, scaffoldSddChange, scanAllProductHandoffs, scanAllTestArtifacts, scanContentForSecrets, scanFileForPrivacyViolations, scanFileForSast, scanGoDependencies, scanInstalledLicenses, scanManualsInWorkspace, scanMavenDependencies, scanPnpmStore, scanPythonDependencies, scanRustDependencies, scanSubdirectories, scanWithNativeFs, scanWithSyft, scanWithTrivy, serializeSarifDocument, slugify2 as slugify, stripVolatileReportMetadata, syncPdacDigests, tokenizeTitle, updateCitationsInContent, validateAgainstSchema, validateAnchorExistence, validateArtifactSchema, verifyArtifactDuplicates, verifyArtifactsSchemas, verifyLicenses, verifyManuals, verifyPdacGraph, verifyPrivacy, verifyProgressiveFriction, verifyQualityGate, verifySast, verifySddIntegration, verifySecrets, verifyTasksGovernance, verifyTestingCoverage, verifyTraceability, walkDir, walkMdFiles, walkProjectFiles, walkSourceFiles, walkTaskFiles, writeCucumberJsonReport, writeCycloneDxSbom, writeQualityBaseline, writeReleaseKpiReport, writeReportFileIfChanged, writeSecuritySarifReport, writeThirdPartyNotices };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map