@aisdlc/core 2.4.0 → 2.5.1

package/dist/index.cjs

@@ -1,11 +1,13 @@
 'use strict';
 
-var crypto = require('crypto');
-var fs7 = require('fs');
-var path4 = require('path');
+var crypto3 = require('crypto');
+var fs8 = require('fs');
+var path5 = require('path');
 var yaml3 = require('js-yaml');
-var tsMorph = require('ts-morph');
 var child_process = require('child_process');
+var tsMorph = require('ts-morph');
+var Ajv2020 = require('ajv/dist/2020.js');
+var addFormats = require('ajv-formats');
 var module$1 = require('module');
 
 var _documentCurrentScript = typeof document !== 'undefined' ? document.currentScript : null;
@@ -29,11 +31,13 @@ function _interopNamespace(e) {
   return Object.freeze(n);
 }
 
-var crypto__namespace = /*#__PURE__*/_interopNamespace(crypto);
-var fs7__namespace = /*#__PURE__*/_interopNamespace(fs7);
-var path4__namespace = /*#__PURE__*/_interopNamespace(path4);
+var crypto3__namespace = /*#__PURE__*/_interopNamespace(crypto3);
+var fs8__namespace = /*#__PURE__*/_interopNamespace(fs8);
+var path5__namespace = /*#__PURE__*/_interopNamespace(path5);
 var yaml3__default = /*#__PURE__*/_interopDefault(yaml3);
 var child_process__namespace = /*#__PURE__*/_interopNamespace(child_process);
+var Ajv2020__default = /*#__PURE__*/_interopDefault(Ajv2020);
+var addFormats__default = /*#__PURE__*/_interopDefault(addFormats);
 
 // src/types/index.ts
 var VALID_CHANGE_PROFILES = ["patch", "standard", "critical"];
@@ -43,6 +47,168 @@ var VALID_AUTONOMY_MODES = [
   "AMBIGUOUS",
   "HIGH_RISK_MANUAL"
 ];
+function canonicalSort(a, b) {
+  return a < b ? -1 : a > b ? 1 : 0;
+}
+function normalizePath(p) {
+  return p.normalize("NFC").replace(/\\/g, "/");
+}
+function walkMdFiles(dir, fileList = [], excludeDirs = [
+  "node_modules",
+  ".git",
+  "dist",
+  "bin",
+  "obj",
+  "build",
+  "out",
+  "target",
+  "coverage",
+  ".changeset",
+  "scratch",
+  "test-scaffold",
+  "fixtures",
+  "templates",
+  "examples",
+  ".agent",
+  ".agents",
+  ".claude",
+  ".cursor",
+  ".github",
+  ".vscode",
+  ".vs",
+  ".idea"
+]) {
+  try {
+    if (!fs8__namespace.existsSync(dir)) return fileList;
+    const files = fs8__namespace.readdirSync(dir).sort(canonicalSort);
+    for (const file of files) {
+      const fullPath = path5__namespace.join(dir, file);
+      try {
+        if (fs8__namespace.statSync(fullPath).isDirectory()) {
+          if (!excludeDirs.includes(file) && !file.startsWith("temp-") && !file.startsWith(".temp-")) {
+            walkMdFiles(fullPath, fileList, excludeDirs);
+          }
+        } else if (file.endsWith(".md")) {
+          fileList.push(fullPath);
+        }
+      } catch {
+      }
+    }
+  } catch {
+  }
+  return fileList.sort(canonicalSort);
+}
+function stripVolatileReportMetadata(content, _ext = "") {
+  let normalized = content.replace(/\r\n/g, "\n");
+  normalized = normalized.replace(/(?:^|\n)>\s*\*\*(?:Generation Date|Generated at|Fecha|Audit Date|Date):\*\*.*$/gim, "");
+  normalized = normalized.replace(/Generated:\s*<span>[\s\S]*?<\/span>/gi, "Generated: <span>[STRIPPED]</span>");
+  return normalized.trim();
+}
+function areCycloneDxSbomsEqual(existingContent, newContent) {
+  try {
+    const a = JSON.parse(existingContent);
+    const b = JSON.parse(newContent);
+    return a.serialNumber === b.serialNumber && JSON.stringify(a.components) === JSON.stringify(b.components) && JSON.stringify(a.vulnerabilities || []) === JSON.stringify(b.vulnerabilities || []);
+  } catch {
+    return false;
+  }
+}
+function areSarifReportsEqual(existingContent, newContent) {
+  try {
+    const a = JSON.parse(existingContent);
+    const b = JSON.parse(newContent);
+    return JSON.stringify(a.runs?.[0]?.results || []) === JSON.stringify(b.runs?.[0]?.results || []);
+  } catch {
+    return false;
+  }
+}
+function isReportContentSemanticallyEqual(existingContent, newContent, filePath) {
+  if (existingContent === newContent) return true;
+  if (filePath.endsWith(".cdx.json") || filePath.endsWith("sbom.json")) {
+    if (areCycloneDxSbomsEqual(existingContent, newContent)) return true;
+  }
+  if (filePath.endsWith(".sarif")) {
+    if (areSarifReportsEqual(existingContent, newContent)) return true;
+  }
+  const ext = path5__namespace.extname(filePath).toLowerCase();
+  return stripVolatileReportMetadata(existingContent, ext) === stripVolatileReportMetadata(newContent, ext);
+}
+function atomicWriteFile(filePath, content) {
+  const tempPath = `${filePath}.${process.pid}.${Math.random().toString(36).substring(2)}.tmp`;
+  try {
+    fs8__namespace.writeFileSync(tempPath, content, "utf-8");
+    try {
+      if (fs8__namespace.existsSync(filePath)) {
+        fs8__namespace.rmSync(filePath, { force: true });
+      }
+      fs8__namespace.renameSync(tempPath, filePath);
+    } catch {
+      fs8__namespace.copyFileSync(tempPath, filePath);
+      fs8__namespace.unlinkSync(tempPath);
+    }
+  } catch {
+    fs8__namespace.writeFileSync(filePath, content, "utf-8");
+  }
+}
+function writeReportFileIfChanged(filePath, content) {
+  try {
+    if (fs8__namespace.existsSync(filePath)) {
+      const existing = fs8__namespace.readFileSync(filePath, "utf-8");
+      if (isReportContentSemanticallyEqual(existing, content, filePath)) {
+        return false;
+      }
+    }
+  } catch {
+  }
+  const dir = path5__namespace.dirname(filePath);
+  if (!fs8__namespace.existsSync(dir)) {
+    fs8__namespace.mkdirSync(dir, { recursive: true });
+  }
+  atomicWriteFile(filePath, content);
+  return true;
+}
+var UUID_V5_NAMESPACE_OID = "6ba7b812-9dad-11d1-80b4-00c04fd430c8";
+function resolveDeterministicDate(rootDir) {
+  const epoch = process.env.SOURCE_DATE_EPOCH;
+  if (epoch) {
+    const parsed = parseInt(epoch, 10);
+    if (!isNaN(parsed) && parsed > 0) {
+      return new Date(parsed * 1e3);
+    }
+  }
+  const targetDir = rootDir || process.cwd();
+  if (fs8__namespace.existsSync(path5__namespace.join(targetDir, ".git"))) {
+    try {
+      const gitOut = child_process.execFileSync("git", ["log", "-1", "--format=%ct"], {
+        cwd: targetDir,
+        encoding: "utf-8",
+        stdio: ["pipe", "pipe", "ignore"]
+      }).trim();
+      const parsed = parseInt(gitOut, 10);
+      if (!isNaN(parsed) && parsed > 0) {
+        return new Date(parsed * 1e3);
+      }
+    } catch {
+    }
+  }
+  return /* @__PURE__ */ new Date();
+}
+function generateDeterministicUuidV5(name, namespace = UUID_V5_NAMESPACE_OID) {
+  const nsHex = namespace.replace(/-/g, "");
+  const nsBytes = Buffer.from(nsHex, "hex");
+  const nameBytes = Buffer.from(name, "utf-8");
+  const hash = crypto3__namespace.createHash("sha1").update(nsBytes).update(nameBytes).digest();
+  hash[6] = hash[6] & 15 | 80;
+  hash[8] = hash[8] & 63 | 128;
+  const hex = hash.toString("hex").substring(0, 32);
+  return [
+    hex.substring(0, 8),
+    hex.substring(8, 12),
+    hex.substring(12, 16),
+    hex.substring(16, 20),
+    hex.substring(20, 32)
+  ].join("-");
+}
 var CYCLOMATIC_KINDS = /* @__PURE__ */ new Set([
   tsMorph.SyntaxKind.IfStatement,
   tsMorph.SyntaxKind.ConditionalExpression,
@@ -199,7 +365,7 @@ function buildNodeMetrics(node, filePath) {
   return { functionName, filePath, loc, cyclomatic, cognitive, maintainability: mi, codeSmells, line };
 }
 function createTempSourceFile(project, content, filePath) {
-  const ext = path4__namespace.extname(filePath).toLowerCase() || ".ts";
+  const ext = path5__namespace.extname(filePath).toLowerCase() || ".ts";
   const fileName = `temp_${Date.now()}_${Math.random().toString(36).substring(2, 7)}${ext}`;
   return project.createSourceFile(fileName, content, { overwrite: true });
 }
@@ -236,8 +402,8 @@ function extractFunctionsTypeScriptAst(content, filePath) {
   }
 }
 function extractFunctionsPolyglot(content, filePath) {
-  const ext = path4__namespace.extname(filePath).toLowerCase();
-  return ext === ".py" ? extractPythonFunctions(content, filePath) : extractBraceFunctions(content, filePath);
+  const ext = path5__namespace.extname(filePath).toLowerCase();
+  return ext === ".py" ? extractPythonFunctionsPolyglot(content, filePath) : extractBraceFunctions(content, filePath);
 }
 function isDocstringToggle(trimmed) {
   const dCount = (trimmed.match(/"""/g) || []).length;
@@ -282,7 +448,7 @@ function processPythonLine(raw, state, blocks, lineIndex) {
     handlePythonBodyLine(raw, state, blocks, lineIndex);
   }
 }
-function extractPythonFunctions(content, filePath) {
+function extractPythonFunctionsPolyglot(content, filePath) {
   const lines = content.split("\n");
   const blocks = [];
   const state = { currentFn: null, fnLines: [], baseIndent: 0, inDocstring: false };
@@ -320,7 +486,7 @@ function processBraceLine(line, state, blocks, lineIndex, ext) {
   }
 }
 function extractBraceFunctions(content, filePath) {
-  const ext = path4__namespace.extname(filePath).toLowerCase();
+  const ext = path5__namespace.extname(filePath).toLowerCase();
   const lines = content.split("\n");
   const blocks = [];
   const state = {
@@ -529,7 +695,7 @@ function countCommentsAndLoc(rawLines, isPy) {
   return { loc, commentCount, cleanLines };
 }
 function calculatePolyglotMetrics(body, name, filePath, startLine) {
-  const ext = path4__namespace.extname(filePath).toLowerCase();
+  const ext = path5__namespace.extname(filePath).toLowerCase();
   const rawLines = body.split(/\r?\n/).map((l) => l.trim()).filter((l) => l.length > 0);
   const { loc, commentCount } = countCommentsAndLoc(rawLines, ext === ".py");
   const strippedBody = stripStringsAndComments(body, ext);
@@ -602,50 +768,129 @@ function computeBraceCognitive(lines) {
 function computePolyglotCognitive(lines, isPy) {
   return isPy ? computePythonCognitive(lines) : computeBraceCognitive(lines);
 }
-function walkMdFiles(dir, fileList = [], excludeDirs = [
-  "node_modules",
-  ".git",
-  "dist",
-  "bin",
-  "obj",
-  "build",
-  "out",
-  "target",
-  "coverage",
-  ".changeset",
-  "scratch",
-  "test-scaffold",
-  "fixtures",
-  "templates",
-  "examples",
-  ".agent",
-  ".agents",
-  ".claude",
-  ".cursor",
-  ".github",
-  ".vscode",
-  ".vs",
-  ".idea"
-]) {
+
+// src/verifiers/ast/python-ast.ts
+var PYTHON_AST_RUNNER_SCRIPT = `
+import ast, json, sys
+
+def analyze(code, filepath):
+    try:
+        tree = ast.parse(code)
+    except Exception as e:
+        return {"language": "python", "filePath": filepath, "functions": [], "error": str(e), "unsafeTypesCount": 0, "emptyStubsCount": 0}
+    
+    functions = []
+    unsafe_types = 0
+    empty_stubs = 0
+    for node in ast.walk(tree):
+        if isinstance(node, ast.Name) and node.id == "Any":
+            unsafe_types += 1
+        elif isinstance(node, (ast.FunctionDef, ast.AsyncFunctionDef)):
+            start = node.lineno
+            end = getattr(node, 'end_lineno', start + len(node.body))
+            loc = end - start + 1
+            cc = 1
+            for child in ast.walk(node):
+                if isinstance(child, (ast.If, ast.For, ast.AsyncFor, ast.While, ast.ExceptHandler, ast.With, ast.AsyncWith)):
+                    cc += 1
+                elif isinstance(child, ast.BoolOp):
+                    cc += len(child.values) - 1
+            
+            real_body = [n for n in node.body if not (isinstance(n, ast.Expr) and isinstance(getattr(n, 'value', None), ast.Constant))]
+            is_stub = len(real_body) == 0 or (len(real_body) == 1 and isinstance(real_body[0], ast.Pass))
+            if is_stub:
+                empty_stubs += 1
+            
+            code_smells = ["Empty stub detected"] if is_stub else []
+            mi = max(0.0, round(100.0 - (cc * 2.0) - (loc * 0.2), 1))
+            functions.append({
+                "functionName": node.name,
+                "filePath": filepath,
+                "line": start,
+                "loc": loc,
+                "cyclomatic": cc,
+                "cognitive": cc,
+                "maintainability": mi,
+                "codeSmells": code_smells
+            })
+    return {
+        "language": "python",
+        "filePath": filepath,
+        "functions": functions,
+        "unsafeTypesCount": unsafe_types,
+        "emptyStubsCount": empty_stubs
+    }
+
+code = sys.stdin.read()
+filepath = sys.argv[1] if len(sys.argv) > 1 else ""
+print(json.dumps(analyze(code, filepath)))
+`;
+function extractFunctionsPythonAst(content, filePath) {
   try {
-    if (!fs7__namespace.existsSync(dir)) return fileList;
-    const files = fs7__namespace.readdirSync(dir);
-    for (const file of files) {
-      const fullPath = path4__namespace.join(dir, file);
-      try {
-        if (fs7__namespace.statSync(fullPath).isDirectory()) {
-          if (!excludeDirs.includes(file) && !file.startsWith("temp-") && !file.startsWith(".temp-")) {
-            walkMdFiles(fullPath, fileList, excludeDirs);
-          }
-        } else if (file.endsWith(".md")) {
-          fileList.push(fullPath);
-        }
-      } catch {
-      }
+    const res = child_process.spawnSync("python", ["-c", PYTHON_AST_RUNNER_SCRIPT, filePath], {
+      input: content,
+      encoding: "utf-8",
+      timeout: 1e4
+    });
+    if (res.status === 0 && res.stdout) {
+      const parsed = JSON.parse(res.stdout);
+      return parsed;
     }
   } catch {
   }
-  return fileList;
+  const fallbackFns = extractPythonFunctionsPolyglot(content, filePath);
+  return {
+    language: "python",
+    filePath,
+    functions: fallbackFns,
+    unsafeTypesCount: 0,
+    emptyStubsCount: 0
+  };
+}
+
+// src/verifiers/ast/native-ast-orchestrator.ts
+function isCliInstalled(bin) {
+  try {
+    const res = child_process.spawnSync(bin, ["--version"], { encoding: "utf-8", timeout: 5e3, shell: false });
+    return res.status === 0 && !res.error;
+  } catch {
+    return false;
+  }
+}
+function assertRequiredStack(stack) {
+  if (!stack) return;
+  if (!isCliInstalled(stack)) {
+    throw new Error(`[AI-SDLC Fail-Closed] Required toolchain CLI '${stack}' is not installed in the environment`);
+  }
+}
+function analyzeTypeScript(content, filePath) {
+  return {
+    language: "typescript",
+    filePath,
+    functions: extractFunctionsTypeScriptAst(content, filePath),
+    unsafeTypesCount: 0,
+    emptyStubsCount: 0
+  };
+}
+function analyzePolyglot(content, filePath, ext) {
+  return {
+    language: ext.replace(/^\./, ""),
+    filePath,
+    functions: extractFunctionsPolyglot(content, filePath),
+    unsafeTypesCount: 0,
+    emptyStubsCount: 0
+  };
+}
+function orchestrateNativeAstAnalysis(content, filePath, options = {}) {
+  assertRequiredStack(options.requiredStack);
+  const ext = filePath.substring(filePath.lastIndexOf(".")).toLowerCase();
+  if ([".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs"].includes(ext)) {
+    return analyzeTypeScript(content, filePath);
+  }
+  if (ext === ".py") {
+    return extractFunctionsPythonAst(content, filePath);
+  }
+  return analyzePolyglot(content, filePath, ext);
 }
 function parseMarkdownFrontmatter(content) {
   const match = content.match(/^---\r?\n([\s\S]*?)\r?\n---/);
@@ -677,41 +922,41 @@ function extractGherkinBlock(body) {
 }
 function resolveTargetFiles(rootDir, targetPath) {
   if (targetPath) {
-    const fullTarget = path4__namespace.isAbsolute(targetPath) ? targetPath : path4__namespace.join(rootDir, targetPath);
-    if (!fs7__namespace.existsSync(fullTarget)) return [];
-    return fs7__namespace.statSync(fullTarget).isDirectory() ? walkMdFiles(fullTarget) : [fullTarget];
+    const fullTarget = path5__namespace.isAbsolute(targetPath) ? targetPath : path5__namespace.join(rootDir, targetPath);
+    if (!fs8__namespace.existsSync(fullTarget)) return [];
+    return fs8__namespace.statSync(fullTarget).isDirectory() ? walkMdFiles(fullTarget) : [fullTarget];
   }
   const searchDirs = [
-    path4__namespace.join(rootDir, "product"),
-    path4__namespace.join(rootDir, "security"),
-    path4__namespace.join(rootDir, "privacy"),
-    path4__namespace.join(rootDir, "specs"),
-    path4__namespace.join(rootDir, "examples", "product"),
-    path4__namespace.join(rootDir, "examples", "security"),
-    path4__namespace.join(rootDir, "examples", "privacy"),
-    path4__namespace.join(rootDir, "examples", "specs")
+    path5__namespace.join(rootDir, "product"),
+    path5__namespace.join(rootDir, "security"),
+    path5__namespace.join(rootDir, "privacy"),
+    path5__namespace.join(rootDir, "specs"),
+    path5__namespace.join(rootDir, "examples", "product"),
+    path5__namespace.join(rootDir, "examples", "security"),
+    path5__namespace.join(rootDir, "examples", "privacy"),
+    path5__namespace.join(rootDir, "examples", "specs")
   ];
-  return searchDirs.filter((d) => fs7__namespace.existsSync(d)).flatMap((d) => walkMdFiles(d));
+  return searchDirs.filter((d) => fs8__namespace.existsSync(d)).flatMap((d) => walkMdFiles(d));
 }
 function resolveFeatureFilePath(rootDir, filePath, id, customTarget) {
   if (customTarget) {
-    return path4__namespace.isAbsolute(customTarget) ? customTarget : path4__namespace.join(rootDir, customTarget);
-  }
-  const baseDir = path4__namespace.join(rootDir, "tests", "features");
-  const candidateSecurity = path4__namespace.join(baseDir, "security", `${id.toLowerCase()}.feature`);
-  const candidatePrivacy = path4__namespace.join(baseDir, "privacy", `${id.toLowerCase()}.feature`);
-  const candidateRoot = path4__namespace.join(baseDir, `${id.toLowerCase()}.feature`);
-  if (fs7__namespace.existsSync(candidateSecurity)) return candidateSecurity;
-  if (fs7__namespace.existsSync(candidatePrivacy)) return candidatePrivacy;
-  if (fs7__namespace.existsSync(candidateRoot)) return candidateRoot;
+    return path5__namespace.isAbsolute(customTarget) ? customTarget : path5__namespace.join(rootDir, customTarget);
+  }
+  const baseDir = path5__namespace.join(rootDir, "tests", "features");
+  const candidateSecurity = path5__namespace.join(baseDir, "security", `${id.toLowerCase()}.feature`);
+  const candidatePrivacy = path5__namespace.join(baseDir, "privacy", `${id.toLowerCase()}.feature`);
+  const candidateRoot = path5__namespace.join(baseDir, `${id.toLowerCase()}.feature`);
+  if (fs8__namespace.existsSync(candidateSecurity)) return candidateSecurity;
+  if (fs8__namespace.existsSync(candidatePrivacy)) return candidatePrivacy;
+  if (fs8__namespace.existsSync(candidateRoot)) return candidateRoot;
   const subDir = filePath.includes("security") ? "security" : filePath.includes("privacy") ? "privacy" : "";
-  return path4__namespace.join(baseDir, subDir, `${id.toLowerCase()}.feature`);
+  return path5__namespace.join(baseDir, subDir, `${id.toLowerCase()}.feature`);
 }
 function buildFeatureFileContent(rootDir, filePath, id, version, gherkinBlocks) {
   const banner = [
     `# ==============================================================================`,
     `# AUTO-GENERADO POR AI-SDLC (Cucumber Integration)`,
-    `# Origen: ${path4__namespace.relative(rootDir, filePath).replace(/\\/g, "/")}`,
+    `# Origen: ${path5__namespace.relative(rootDir, filePath).replace(/\\/g, "/")}`,
     `# ID Requerimiento: ${id}`,
     `# Versi\xF3n: ${version || "1.0.0"}`,
     `# NO EDITAR MANUALMENTE: Cualquier cambio debe realizarse en el Markdown origen.`,
@@ -736,20 +981,20 @@ function extractGherkinFeatures(options = {}) {
   const targetFiles = resolveTargetFiles(rootDir, options.targetPath);
   for (const filePath of targetFiles) {
     try {
-      const content = fs7__namespace.readFileSync(filePath, "utf-8");
+      const content = fs8__namespace.readFileSync(filePath, "utf-8");
       const { frontmatter, body } = parseMarkdownFrontmatter(content);
       const gherkinBlocks = extractGherkinBlock(body);
       if (gherkinBlocks.length === 0) continue;
-      const id = frontmatter.id || path4__namespace.basename(filePath, path4__namespace.extname(filePath));
+      const id = frontmatter.id || path5__namespace.basename(filePath, path5__namespace.extname(filePath));
       const targetPath = resolveFeatureFilePath(rootDir, filePath, id, frontmatter["cucumber-feature-file"]);
-      fs7__namespace.mkdirSync(path4__namespace.dirname(targetPath), { recursive: true });
+      fs8__namespace.mkdirSync(path5__namespace.dirname(targetPath), { recursive: true });
       const fullContent = buildFeatureFileContent(rootDir, filePath, id, frontmatter.version, gherkinBlocks);
-      fs7__namespace.writeFileSync(targetPath, fullContent, "utf-8");
+      fs8__namespace.writeFileSync(targetPath, fullContent, "utf-8");
       const scenarioCount = countScenarios(gherkinBlocks);
       totalScenarios += scenarioCount;
       features.push({
-        sourceFile: path4__namespace.relative(rootDir, filePath).replace(/\\/g, "/"),
-        outputFile: path4__namespace.relative(rootDir, targetPath).replace(/\\/g, "/"),
+        sourceFile: path5__namespace.relative(rootDir, filePath).replace(/\\/g, "/"),
+        outputFile: path5__namespace.relative(rootDir, targetPath).replace(/\\/g, "/"),
         featureName: id,
         scenarioCount
       });
@@ -766,20 +1011,20 @@ function checkGherkinInSync(options = {}) {
   let totalFeatures = 0;
   for (const filePath of targetFiles) {
     try {
-      const content = fs7__namespace.readFileSync(filePath, "utf-8");
+      const content = fs8__namespace.readFileSync(filePath, "utf-8");
       const { frontmatter, body } = parseMarkdownFrontmatter(content);
       const gherkinBlocks = extractGherkinBlock(body);
       if (gherkinBlocks.length === 0) continue;
       totalFeatures++;
-      const id = frontmatter.id || path4__namespace.basename(filePath, path4__namespace.extname(filePath));
+      const id = frontmatter.id || path5__namespace.basename(filePath, path5__namespace.extname(filePath));
       const targetPath = resolveFeatureFilePath(rootDir, filePath, id, frontmatter["cucumber-feature-file"]);
-      const relTarget = path4__namespace.relative(rootDir, targetPath).replace(/\\/g, "/");
-      if (!fs7__namespace.existsSync(targetPath)) {
+      const relTarget = path5__namespace.relative(rootDir, targetPath).replace(/\\/g, "/");
+      if (!fs8__namespace.existsSync(targetPath)) {
         missingFiles.push(relTarget);
         continue;
       }
       const expectedContent = buildFeatureFileContent(rootDir, filePath, id, frontmatter.version, gherkinBlocks);
-      const actualContent = fs7__namespace.readFileSync(targetPath, "utf-8");
+      const actualContent = fs8__namespace.readFileSync(targetPath, "utf-8");
       if (actualContent.replace(/\r\n/g, "\n") !== expectedContent.replace(/\r\n/g, "\n")) {
         outOfSyncFiles.push(relTarget);
       }
@@ -878,7 +1123,7 @@ function generateTestingCoverageReportMarkdown(reqAudit, taskAudit, reqErrors, t
   const reportLines = [
     `# \u{1F9EA} Deterministic Test Coverage Audit for Requirements and Tasks`,
     ``,
-    `> **Audit Date:** ${(/* @__PURE__ */ new Date()).toISOString()}`,
+    `> **Audit Date:** ${resolveDeterministicDate().toISOString()}`,
     `> **Overall Verdict:** ${verdict}`,
     ``,
     `---`,
@@ -941,8 +1186,8 @@ function parseCodeTestIds(content, relTest, reqToTestsMap) {
 }
 function processTestFile(fullPath, rootDir, reqToTestsMap) {
   try {
-    const content = fs7__namespace.readFileSync(fullPath, "utf-8");
-    const relTest = path4__namespace.relative(rootDir, fullPath).replace(/\\/g, "/");
+    const content = fs8__namespace.readFileSync(fullPath, "utf-8");
+    const relTest = path5__namespace.relative(rootDir, fullPath).replace(/\\/g, "/");
     if (fullPath.endsWith(".feature")) {
       parseFeatureTags(content, relTest, reqToTestsMap);
     }
@@ -951,16 +1196,16 @@ function processTestFile(fullPath, rootDir, reqToTestsMap) {
   }
 }
 function collectTestFiles(dir, files = []) {
-  if (!fs7__namespace.existsSync(dir)) return files;
+  if (!fs8__namespace.existsSync(dir)) return files;
   try {
-    const entries = fs7__namespace.readdirSync(dir, { withFileTypes: true });
+    const entries = fs8__namespace.readdirSync(dir, { withFileTypes: true }).sort((a, b) => canonicalSort(a.name, b.name));
     for (const e of entries) {
       if (e.isDirectory()) {
         if (!EXCLUDED_TEST_DIRS.has(e.name)) {
-          collectTestFiles(path4__namespace.join(dir, e.name), files);
+          collectTestFiles(path5__namespace.join(dir, e.name), files);
         }
       } else if (isTestFile(e.name)) {
-        files.push(path4__namespace.join(dir, e.name));
+        files.push(path5__namespace.join(dir, e.name));
       }
     }
   } catch {
@@ -1169,7 +1414,7 @@ function collectTestCorpus(rootDir, allMdFiles) {
   const testContents = [];
   for (const tf of collectTestFiles(rootDir)) {
     try {
-      const content = fs7__namespace.readFileSync(tf, "utf-8");
+      const content = fs8__namespace.readFileSync(tf, "utf-8");
       testContents.push(content);
       if (tf.endsWith(".feature")) gherkinSources.push(content);
     } catch {
@@ -1177,7 +1422,7 @@ function collectTestCorpus(rootDir, allMdFiles) {
   }
   for (const md of allMdFiles) {
     try {
-      const blocks = extractGherkinBlock(fs7__namespace.readFileSync(md, "utf-8"));
+      const blocks = extractGherkinBlock(fs8__namespace.readFileSync(md, "utf-8"));
       gherkinSources.push(...blocks);
       testContents.push(...blocks);
     } catch {
@@ -1206,9 +1451,9 @@ function countCucumberScenarios(raw) {
   return { passed, failed };
 }
 function parseCucumberReportFile(reportPath) {
-  if (!fs7__namespace.existsSync(reportPath)) return void 0;
+  if (!fs8__namespace.existsSync(reportPath)) return void 0;
   try {
-    const raw = JSON.parse(fs7__namespace.readFileSync(reportPath, "utf-8"));
+    const raw = JSON.parse(fs8__namespace.readFileSync(reportPath, "utf-8"));
     if (!Array.isArray(raw)) return void 0;
     const { passed, failed } = countCucumberScenarios(raw);
     return {
@@ -1222,7 +1467,7 @@ function parseCucumberReportFile(reportPath) {
   }
 }
 function resolveCucumberReport(rootDir, options) {
-  const candidate = options.cucumberReportPath ? path4__namespace.isAbsolute(options.cucumberReportPath) ? options.cucumberReportPath : path4__namespace.join(rootDir, options.cucumberReportPath) : path4__namespace.join(rootDir, "reports", "cucumber-report.json");
+  const candidate = options.cucumberReportPath ? path5__namespace.isAbsolute(options.cucumberReportPath) ? options.cucumberReportPath : path5__namespace.join(rootDir, options.cucumberReportPath) : path5__namespace.join(rootDir, "reports", "cucumber-report.json");
   const parsed = parseCucumberReportFile(candidate);
   if (parsed) return parsed;
   if (options.enforceCucumberExecution) {
@@ -1256,8 +1501,8 @@ function recordUseCaseAuditIfPresent(frontmatter, id, relPath, isTemplate, combi
   if (flowAudit.status === "FALLO_SIN_PRUEBA") state.ucErrors++;
 }
 function processMdFileForCoverage(file, rootDir, reqToTestsMap, corpus, options, state) {
-  const { frontmatter } = parseGenericDoc(fs7__namespace.readFileSync(file, "utf-8"));
-  const relPath = path4__namespace.relative(rootDir, file).replace(/\\/g, "/");
+  const { frontmatter } = parseGenericDoc(fs8__namespace.readFileSync(file, "utf-8"));
+  const relPath = path5__namespace.relative(rootDir, file).replace(/\\/g, "/");
   const isTemplate = relPath.includes("templates/");
   const id = frontmatter.id || "";
   if (isRequirementArtifact(frontmatter, id)) {
@@ -1331,7 +1576,6 @@ var DEFAULT_EXCLUDES = [
   "templates",
   "fixtures"
 ];
-var TS_JS_EXTENSIONS = [".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs"];
 function createDefaultQualityPolicy() {
   return {
     max_cyclomatic: 10,
@@ -1412,27 +1656,38 @@ function applyOptionOverrides(policy, overrides) {
   if (overrides.max_function_lines !== void 0) policy.max_function_lines = Number(overrides.max_function_lines);
   if (overrides.enforce_mode !== void 0) policy.enforce_mode = overrides.enforce_mode;
 }
+function parsePolicyYaml(content) {
+  let doc;
+  try {
+    doc = yaml3__default.default.load(content);
+  } catch (err) {
+    throw new Error(`[AI-SDLC Fail-Closed] Invalid YAML in quality-policy: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  if (!doc || typeof doc !== "object" || Array.isArray(doc)) {
+    throw new Error(`[AI-SDLC Fail-Closed] Invalid quality policy structure: root must be a YAML mapping`);
+  }
+  return doc;
+}
 function parseQualityPolicy(content, overrides) {
   const policy = createDefaultQualityPolicy();
-  try {
-    const doc = yaml3__default.default.load(content);
-    if (doc && typeof doc === "object") {
-      const record = doc;
-      applyDocScope(policy, record);
-      applyDocThresholds(policy, record);
-      if (record.max_per_function !== void 0) policy.max_cyclomatic = Number(record.max_per_function);
-      if (record.min_acceptable_score !== void 0) policy.min_maintainability = Number(record.min_acceptable_score);
-      if (record.max_function_lines !== void 0) policy.max_function_lines = Number(record.max_function_lines);
-    }
-  } catch {
+  if (!content || !content.trim()) {
+    applyEnvThresholds(policy);
+    applyOptionOverrides(policy, overrides);
+    return policy;
   }
+  const record = parsePolicyYaml(content);
+  applyDocScope(policy, record);
+  applyDocThresholds(policy, record);
+  if (record.max_per_function !== void 0) policy.max_cyclomatic = Number(record.max_per_function);
+  if (record.min_acceptable_score !== void 0) policy.min_maintainability = Number(record.min_acceptable_score);
+  if (record.max_function_lines !== void 0) policy.max_function_lines = Number(record.max_function_lines);
   applyEnvThresholds(policy);
   applyOptionOverrides(policy, overrides);
   return policy;
 }
 function extractFunctions(content, filePath) {
-  const ext = path4__namespace.extname(filePath).toLowerCase();
-  return TS_JS_EXTENSIONS.includes(ext) ? extractFunctionsTypeScriptAst(content, filePath) : extractFunctionsPolyglot(content, filePath);
+  const report = orchestrateNativeAstAnalysis(content, filePath);
+  return report.functions;
 }
 function extractFunctionsBraceLanguages(content, filePath) {
   return extractFunctions(content, filePath);
@@ -1462,55 +1717,55 @@ function isExcludedFile(file, normalized, excludePatterns) {
   );
 }
 function walkDir(dir, extensions = DEFAULT_EXTENSIONS, excludePatterns = DEFAULT_EXCLUDES) {
-  if (!fs7__namespace.existsSync(dir)) return [];
+  if (!fs8__namespace.existsSync(dir)) return [];
   const results = [];
-  for (const file of fs7__namespace.readdirSync(dir)) {
-    const fullPath = path4__namespace.join(dir, file);
+  for (const file of fs8__namespace.readdirSync(dir).sort(canonicalSort)) {
+    const fullPath = path5__namespace.join(dir, file);
     const normalized = fullPath.replace(/\\/g, "/");
     if (isExcludedFile(file, normalized, excludePatterns)) continue;
-    const stat = fs7__namespace.statSync(fullPath);
+    const stat = fs8__namespace.statSync(fullPath);
     if (stat.isDirectory()) {
       results.push(...walkDir(fullPath, extensions, excludePatterns));
-    } else if (extensions.includes(path4__namespace.extname(file).toLowerCase())) {
+    } else if (extensions.includes(path5__namespace.extname(file).toLowerCase())) {
       results.push(fullPath);
     }
   }
   return results;
 }
 function resolvePolicy(rootDir, options) {
-  const policyFile = options.policyPath || path4__namespace.join(rootDir, "quality-policy.yaml");
+  const policyFile = options.policyPath || path5__namespace.join(rootDir, "quality-policy.yaml");
   if (options.policy) {
     const policy = { ...options.policy };
     applyOptionOverrides(policy, options.thresholds);
     return policy;
   }
-  if (fs7__namespace.existsSync(policyFile)) {
-    return parseQualityPolicy(fs7__namespace.readFileSync(policyFile, "utf-8"), options.thresholds);
+  if (fs8__namespace.existsSync(policyFile)) {
+    return parseQualityPolicy(fs8__namespace.readFileSync(policyFile, "utf-8"), options.thresholds);
   }
   return parseQualityPolicy("", options.thresholds);
 }
 function isPathExcluded(targetPath, rootDir, excludePatterns) {
-  const rel = path4__namespace.relative(rootDir, targetPath).replace(/\\/g, "/");
-  const base = path4__namespace.basename(targetPath);
+  const rel = path5__namespace.relative(rootDir, targetPath).replace(/\\/g, "/");
+  const base = path5__namespace.basename(targetPath);
   return excludePatterns.some(
     (pat) => base === pat || rel === pat || rel.startsWith(pat + "/") || rel.includes("/" + pat + "/") || rel.endsWith("/" + pat) || rel.includes(pat)
   );
 }
 function scanContainerSubdir(containerDir, subdirName, targetDir, rootDir, policy, files) {
   if (policy.exclude_patterns.includes(subdirName)) return;
-  const subTarget = path4__namespace.join(containerDir, subdirName, targetDir);
-  if (!fs7__namespace.existsSync(subTarget) || !fs7__namespace.statSync(subTarget).isDirectory()) return;
+  const subTarget = path5__namespace.join(containerDir, subdirName, targetDir);
+  if (!fs8__namespace.existsSync(subTarget) || !fs8__namespace.statSync(subTarget).isDirectory()) return;
   if (isPathExcluded(subTarget, rootDir, policy.exclude_patterns)) return;
   for (const f of walkDir(subTarget, policy.supported_extensions, policy.exclude_patterns)) {
     files.add(f);
   }
 }
 function scanMonorepoContainer(rootDir, container, targetDir, policy, files) {
-  const containerDir = path4__namespace.join(rootDir, container);
-  if (!fs7__namespace.existsSync(containerDir) || !fs7__namespace.statSync(containerDir).isDirectory()) return;
+  const containerDir = path5__namespace.join(rootDir, container);
+  if (!fs8__namespace.existsSync(containerDir) || !fs8__namespace.statSync(containerDir).isDirectory()) return;
   if (isPathExcluded(containerDir, rootDir, policy.exclude_patterns)) return;
   try {
-    for (const subdir of fs7__namespace.readdirSync(containerDir, { withFileTypes: true })) {
+    for (const subdir of fs8__namespace.readdirSync(containerDir, { withFileTypes: true })) {
       if (subdir.isDirectory()) {
         scanContainerSubdir(containerDir, subdir.name, targetDir, rootDir, policy, files);
       }
@@ -1519,13 +1774,14 @@ function scanMonorepoContainer(rootDir, container, targetDir, policy, files) {
   }
 }
 function scanDirectTarget(rootDir, targetDir, policy, files) {
-  const fullDir = path4__namespace.join(rootDir, targetDir);
-  if (fs7__namespace.existsSync(fullDir) && !isPathExcluded(fullDir, rootDir, policy.exclude_patterns)) {
+  const fullDir = path5__namespace.join(rootDir, targetDir);
+  if (fs8__namespace.existsSync(fullDir) && !isPathExcluded(fullDir, rootDir, policy.exclude_patterns)) {
     for (const f of walkDir(fullDir, policy.supported_extensions, policy.exclude_patterns)) {
       files.add(f);
     }
   }
 }
+var UNIT_TEST_SUFFIXES = [".spec.ts", ".test.ts", ".spec.js", ".test.js", "_test.py", "_test.go"];
 function collectFilesToScan(rootDir, policy) {
   const files = /* @__PURE__ */ new Set();
   const monorepoContainers = ["packages", "apps", "libs", "modules", "services"];
@@ -1535,7 +1791,7 @@ function collectFilesToScan(rootDir, policy) {
       scanMonorepoContainer(rootDir, container, targetDir, policy, files);
     }
   }
-  return Array.from(files);
+  return Array.from(files).filter((f) => !UNIT_TEST_SUFFIXES.some((s) => f.endsWith(s)));
 }
 function evaluateViolations(fn, policy) {
   const violations = [];
@@ -1557,38 +1813,67 @@ function evaluateViolations(fn, policy) {
   return violations;
 }
 function evaluateFileQuality(file, rootDir, policy) {
-  const content = fs7__namespace.readFileSync(file, "utf-8");
+  const content = fs8__namespace.readFileSync(file, "utf-8");
   const fns = extractFunctions(content, file);
   return fns.map((fn) => {
     const violations = evaluateViolations(fn, policy);
     return {
       ...fn,
-      relPath: path4__namespace.relative(rootDir, file).replace(/\\/g, "/"),
+      relPath: path5__namespace.relative(rootDir, file).replace(/\\/g, "/"),
       status: violations.length === 0 ? "PASS" : "FAIL",
       violations
     };
   });
 }
-var UNIT_TEST_SUFFIXES = [".spec.ts", ".test.ts", ".spec.js", ".test.js", "_test.py", "_test.go"];
 function collectUnitTestCorpus(rootDir) {
   const allCodeFiles = walkDir(rootDir, DEFAULT_EXTENSIONS, DEFAULT_EXCLUDES);
   const chunks = [];
   for (const tf of allCodeFiles) {
     if (!UNIT_TEST_SUFFIXES.some((s) => tf.endsWith(s))) continue;
     try {
-      chunks.push(fs7__namespace.readFileSync(tf, "utf-8"));
+      chunks.push(fs8__namespace.readFileSync(tf, "utf-8"));
     } catch {
     }
   }
   return chunks.join("\n");
 }
+function sanitizeTestCorpus(corpus, fnName) {
+  let cleaned = corpus.replace(/\/\*[\s\S]*?\*\//g, " ");
+  cleaned = cleaned.replace(/(?:\/\/|#)[^\r\n]*/g, " ");
+  cleaned = cleaned.replace(/(['"`])((?:\\.|(?!\1)[^\\])*)\1/g, (match, quote, inner) => {
+    const trimmed = inner.trim();
+    if (trimmed === fnName || trimmed === `#${fnName}` || trimmed === `.${fnName}` || trimmed === `${fnName}()`) {
+      return match;
+    }
+    return `${quote}${quote}`;
+  });
+  return cleaned;
+}
+function buildTestReferencePatterns(escaped) {
+  return [
+    new RegExp(`(?:\\.|\\b)${escaped}\\s*\\(`, "m"),
+    new RegExp(`\\b(?:import|require)\\b[^;\\n]*\\b${escaped}\\b`, "m"),
+    new RegExp(`(?:\\bexpect|\\bassert|\\bshould)\\s*\\([^;\\n]*\\b${escaped}\\b`, "m"),
+    new RegExp("(?:\\bspyOn|\\bmock)\\s*\\([^;\\n]*['\"`]" + escaped + "['\"`]", "m"),
+    new RegExp(`\\b${escaped}\\s*\\.`, "m"),
+    new RegExp("\\b(?:describe|it|test|context)\\s*\\(\\s*['\"`](?:#|\\.)?" + escaped + "['\"`]", "m"),
+    new RegExp(`\\btest_?${escaped}\\b`, "im")
+  ];
+}
+function isFunctionReferencedInTests(fnName, rawCorpus) {
+  if (!fnName || fnName === "anonymous" || fnName === "constructor") return true;
+  const corpus = sanitizeTestCorpus(rawCorpus, fnName);
+  const escaped = fnName.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const patterns = buildTestReferencePatterns(escaped);
+  return patterns.some((p) => p.test(corpus));
+}
 function auditUnitTestsPerFunction(results, rootDir) {
   const corpus = collectUnitTestCorpus(rootDir);
   const untested = [];
   for (const r of results) {
     const fnName = r.functionName.includes(".") ? r.functionName.split(".").pop() : r.functionName;
     if (!fnName || fnName === "anonymous" || fnName === "constructor") continue;
-    if (!corpus.includes(fnName)) {
+    if (!isFunctionReferencedInTests(fnName, corpus)) {
       untested.push({ file: r.relPath, functionName: r.functionName });
       r.violations.push(`Missing unit test for function '${r.functionName}'`);
       r.status = "FAIL";
@@ -1598,11 +1883,11 @@ function auditUnitTestsPerFunction(results, rootDir) {
 }
 function isVitestMidFlightCoverage(rel, fullPath) {
   if (!process.env.VITEST || rel !== "coverage/coverage-summary.json") return false;
-  return path4__namespace.resolve(fullPath) === path4__namespace.resolve(process.cwd(), rel);
+  return path5__namespace.resolve(fullPath) === path5__namespace.resolve(process.cwd(), rel);
 }
 function parseCoverageSummaryFile(filePath, source) {
   try {
-    const raw = JSON.parse(fs7__namespace.readFileSync(filePath, "utf-8"));
+    const raw = JSON.parse(fs8__namespace.readFileSync(filePath, "utf-8"));
     const total = raw.total;
     if (!total) return null;
     return {
@@ -1617,8 +1902,8 @@ function parseCoverageSummaryFile(filePath, source) {
 }
 function readSummaryCoverageJson(rootDir) {
   for (const rel of ["coverage/coverage-summary.json", "reports/coverage-summary.json"]) {
-    const full = path4__namespace.join(rootDir, rel);
-    if (!fs7__namespace.existsSync(full) || isVitestMidFlightCoverage(rel, full)) continue;
+    const full = path5__namespace.join(rootDir, rel);
+    if (!fs8__namespace.existsSync(full) || isVitestMidFlightCoverage(rel, full)) continue;
     const summary = parseCoverageSummaryFile(full, rel);
     if (summary) return summary;
   }
@@ -1642,7 +1927,7 @@ function evaluateCoverageThresholds(rootDir, policy, requireReport) {
 }
 function computeViolationSignature(relPath, fnName, metric) {
   const normPath = relPath.replace(/\\/g, "/");
-  return crypto__namespace.createHash("sha256").update(normPath + ":" + fnName + ":" + metric).digest("hex");
+  return crypto3__namespace.createHash("sha256").update(normPath + ":" + fnName + ":" + metric).digest("hex");
 }
 function classifyMetricFromMessage(msg, fn) {
   if (msg.startsWith("Cyclomatic Complexity")) {
@@ -1671,8 +1956,8 @@ function isMetricWorsened(baselineEntry, current) {
 }
 function loadQualityBaseline(baselineFile) {
   try {
-    if (!fs7__namespace.existsSync(baselineFile)) return null;
-    const content = fs7__namespace.readFileSync(baselineFile, "utf-8");
+    if (!fs8__namespace.existsSync(baselineFile)) return null;
+    const content = fs8__namespace.readFileSync(baselineFile, "utf-8");
     return JSON.parse(content);
   } catch {
     return null;
@@ -1681,11 +1966,11 @@ function loadQualityBaseline(baselineFile) {
 function writeQualityBaseline(baselineFile, entries) {
   const baseline = {
     version: "1.0",
-    generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    generatedAt: resolveDeterministicDate(path5__namespace.dirname(baselineFile)).toISOString(),
     totalViolations: entries.length,
     violations: entries
   };
-  fs7__namespace.writeFileSync(baselineFile, JSON.stringify(baseline, null, 2) + "\n", "utf-8");
+  fs8__namespace.writeFileSync(baselineFile, JSON.stringify(baseline, null, 2) + "\n", "utf-8");
   return baseline;
 }
 function extractBaselineEntriesFromResults(results) {
@@ -1744,7 +2029,7 @@ function applyRatchetMode(results, baseline) {
 function resolveBaselineFilePath(rootDir, options) {
   if (options.baselinePath) return options.baselinePath;
   if (typeof options.baseline === "string") return options.baseline;
-  return path4__namespace.join(rootDir, "quality-baseline.json");
+  return path5__namespace.join(rootDir, "quality-baseline.json");
 }
 function isRatchetModeActive(policy, options, baselineExists) {
   if (options.ratchet !== void 0) return options.ratchet;
@@ -1752,7 +2037,7 @@ function isRatchetModeActive(policy, options, baselineExists) {
   return Boolean(policy.ratchet_mode || options.baseline && baselineExists);
 }
 function evaluateRatchetIfActive(results, baselineFile, isActive) {
-  if (!isActive || !fs7__namespace.existsSync(baselineFile)) {
+  if (!isActive || !fs8__namespace.existsSync(baselineFile)) {
     return { toleratedViolationsCount: 0, newViolationsCount: 0, baselineViolationsCount: 0 };
   }
   const baseline = loadQualityBaseline(baselineFile);
@@ -1811,7 +2096,7 @@ function verifyQualityGate(options = {}) {
       baselineViolationsCount: entries.length
     });
   }
-  const baselineExists = fs7__namespace.existsSync(baselineFile);
+  const baselineExists = fs8__namespace.existsSync(baselineFile);
   const isRatchet = isRatchetModeActive(policy, options, baselineExists);
   const ratchetEval = evaluateRatchetIfActive(results, baselineFile, isRatchet);
   return buildQualityGateResult(results, allFiles.length, policy, coverageViolations, untestedFunctions, {
@@ -1829,9 +2114,9 @@ function normalizeHandoffPayload(handoff, changeId) {
   };
 }
 function parseChangeProfile(specFile) {
-  if (!fs7__namespace.existsSync(specFile)) return "standard";
+  if (!fs8__namespace.existsSync(specFile)) return "standard";
   try {
-    const rawSpec = fs7__namespace.readFileSync(specFile, "utf-8").replace(/^\uFEFF/, "");
+    const rawSpec = fs8__namespace.readFileSync(specFile, "utf-8").replace(/^\uFEFF/, "");
     const match = rawSpec.match(/^---\r?\n([\s\S]*?)\r?\n---/);
     if (match) {
       const parsedFm = yaml3__default.default.load(match[1]);
@@ -1853,12 +2138,12 @@ function checkSpecGherkinFormat(parsedFm, rawSpec, changeWorkspaceDir, errors) {
   }
 }
 function validateSpecFileContent(specFile, changeWorkspaceDir, errors) {
-  if (!fs7__namespace.existsSync(specFile)) {
+  if (!fs8__namespace.existsSync(specFile)) {
     errors.push(`Falta el archivo obligatorio 'spec.md' en ${changeWorkspaceDir}.`);
     return;
   }
   try {
-    const rawSpec = fs7__namespace.readFileSync(specFile, "utf-8").replace(/^\uFEFF/, "");
+    const rawSpec = fs8__namespace.readFileSync(specFile, "utf-8").replace(/^\uFEFF/, "");
     const match = rawSpec.match(/^---\r?\n([\s\S]*?)\r?\n---/);
     if (match) {
       const parsedFm = yaml3__default.default.load(match[1]);
@@ -1877,19 +2162,19 @@ function validateHandoffSidecar(handoff, changeWorkspaceDir, errors) {
   if (!handoff.subgraph || !Array.isArray(handoff.subgraph.requirements)) {
     errors.push(`El sidecar '${handoff.id}' no define un subgrafo de requerimientos v\xE1lido.`);
   }
-  return path4__namespace.join(changeWorkspaceDir, "handoff.yaml");
+  return path5__namespace.join(changeWorkspaceDir, "handoff.yaml");
 }
 function validateOpenSpecStructure(profile, changeWorkspaceDir, adapter, errors, warnings) {
-  const proposalFile = path4__namespace.join(changeWorkspaceDir, "proposal.md");
-  const tasksFile = path4__namespace.join(changeWorkspaceDir, "tasks.md");
+  const proposalFile = path5__namespace.join(changeWorkspaceDir, "proposal.md");
+  const tasksFile = path5__namespace.join(changeWorkspaceDir, "tasks.md");
   if (profile === "patch") {
     const handoff2 = adapter.loadSidecar(changeWorkspaceDir);
-    return { handoff: handoff2, sidecarFile: handoff2 ? path4__namespace.join(changeWorkspaceDir, "handoff.yaml") : void 0 };
+    return { handoff: handoff2, sidecarFile: handoff2 ? path5__namespace.join(changeWorkspaceDir, "handoff.yaml") : void 0 };
   }
-  if (!fs7__namespace.existsSync(proposalFile)) {
+  if (!fs8__namespace.existsSync(proposalFile)) {
     warnings.push(`Falta 'proposal.md' en el espacio de trabajo OpenSpec.`);
   }
-  if (!fs7__namespace.existsSync(tasksFile)) {
+  if (!fs8__namespace.existsSync(tasksFile)) {
     errors.push(`Falta el archivo obligatorio 'tasks.md' en ${changeWorkspaceDir}.`);
   }
   const handoff = adapter.loadSidecar(changeWorkspaceDir);
@@ -1897,20 +2182,20 @@ function validateOpenSpecStructure(profile, changeWorkspaceDir, adapter, errors,
   return { handoff, sidecarFile };
 }
 function buildOpenSpecWorkspaceInfo(changeWorkspaceDir, profile, handoff, sidecarFile) {
-  const changeId = path4__namespace.basename(changeWorkspaceDir);
-  const proposalFile = path4__namespace.join(changeWorkspaceDir, "proposal.md");
-  const specFile = path4__namespace.join(changeWorkspaceDir, "spec.md");
-  const designFile = path4__namespace.join(changeWorkspaceDir, "design.md");
-  const tasksFile = path4__namespace.join(changeWorkspaceDir, "tasks.md");
+  const changeId = path5__namespace.basename(changeWorkspaceDir);
+  const proposalFile = path5__namespace.join(changeWorkspaceDir, "proposal.md");
+  const specFile = path5__namespace.join(changeWorkspaceDir, "spec.md");
+  const designFile = path5__namespace.join(changeWorkspaceDir, "design.md");
+  const tasksFile = path5__namespace.join(changeWorkspaceDir, "tasks.md");
   return {
     framework: "openspec",
     changeId,
     changeDir: changeWorkspaceDir,
     profile,
-    proposalFile: fs7__namespace.existsSync(proposalFile) ? proposalFile : void 0,
-    specFile: fs7__namespace.existsSync(specFile) ? specFile : void 0,
-    designFile: fs7__namespace.existsSync(designFile) ? designFile : void 0,
-    tasksFile: fs7__namespace.existsSync(tasksFile) ? tasksFile : void 0,
+    proposalFile: fs8__namespace.existsSync(proposalFile) ? proposalFile : void 0,
+    specFile: fs8__namespace.existsSync(specFile) ? specFile : void 0,
+    designFile: fs8__namespace.existsSync(designFile) ? designFile : void 0,
+    tasksFile: fs8__namespace.existsSync(tasksFile) ? tasksFile : void 0,
     sidecarFile,
     handoff: handoff || void 0
   };
@@ -1918,28 +2203,28 @@ function buildOpenSpecWorkspaceInfo(changeWorkspaceDir, profile, handoff, sideca
 var OpenSpecAdapter = class {
   framework = "openspec";
   getChangeWorkspaceDir(rootDir, changeId) {
-    const openspecDir = path4__namespace.join(rootDir, "openspec", "changes", changeId);
-    if (fs7__namespace.existsSync(openspecDir)) return openspecDir;
-    const activeChangeDir = path4__namespace.join(rootDir, "specs", "changes", "active", changeId);
-    if (fs7__namespace.existsSync(activeChangeDir)) return activeChangeDir;
-    const completedChangeDir = path4__namespace.join(rootDir, "specs", "changes", "completed", changeId);
-    if (fs7__namespace.existsSync(completedChangeDir)) return completedChangeDir;
+    const openspecDir = path5__namespace.join(rootDir, "openspec", "changes", changeId);
+    if (fs8__namespace.existsSync(openspecDir)) return openspecDir;
+    const activeChangeDir = path5__namespace.join(rootDir, "specs", "changes", "active", changeId);
+    if (fs8__namespace.existsSync(activeChangeDir)) return activeChangeDir;
+    const completedChangeDir = path5__namespace.join(rootDir, "specs", "changes", "completed", changeId);
+    if (fs8__namespace.existsSync(completedChangeDir)) return completedChangeDir;
     return activeChangeDir;
   }
   depositSidecar(options) {
     const changeDir = this.getChangeWorkspaceDir(options.rootDir, options.changeId);
-    if (!fs7__namespace.existsSync(changeDir)) {
-      fs7__namespace.mkdirSync(changeDir, { recursive: true });
+    if (!fs8__namespace.existsSync(changeDir)) {
+      fs8__namespace.mkdirSync(changeDir, { recursive: true });
     }
     const handoff = normalizeHandoffPayload(options.handoff, options.changeId);
     const filename = options.format === "json" ? "handoff.json" : "handoff.yaml";
-    const filePath = path4__namespace.join(changeDir, filename);
+    const filePath = path5__namespace.join(changeDir, filename);
     const content = options.format === "json" ? JSON.stringify(handoff, null, 2) : yaml3__default.default.dump(handoff, { indent: 2, lineWidth: -1 });
-    fs7__namespace.writeFileSync(filePath, content, "utf-8");
+    fs8__namespace.writeFileSync(filePath, content, "utf-8");
     return filePath;
   }
   loadSidecar(changeWorkspaceDir) {
-    if (!fs7__namespace.existsSync(changeWorkspaceDir)) return null;
+    if (!fs8__namespace.existsSync(changeWorkspaceDir)) return null;
     const candidateFiles = [
       "handoff.yaml",
       "handoff.yml",
@@ -1950,10 +2235,10 @@ var OpenSpecAdapter = class {
       "product-handoff.json"
     ];
     for (const file of candidateFiles) {
-      const fullPath = path4__namespace.join(changeWorkspaceDir, file);
-      if (fs7__namespace.existsSync(fullPath)) {
+      const fullPath = path5__namespace.join(changeWorkspaceDir, file);
+      if (fs8__namespace.existsSync(fullPath)) {
         try {
-          const raw = fs7__namespace.readFileSync(fullPath, "utf-8").replace(/^\uFEFF/, "");
+          const raw = fs8__namespace.readFileSync(fullPath, "utf-8").replace(/^\uFEFF/, "");
           const parsed = file.endsWith(".json") ? JSON.parse(raw) : yaml3__default.default.load(raw);
           if (parsed && typeof parsed === "object" && parsed.id && String(parsed.id).startsWith("HOF-")) {
             return parsed;
@@ -1965,7 +2250,7 @@ var OpenSpecAdapter = class {
     return null;
   }
   validateWorkspace(changeWorkspaceDir) {
-    if (!fs7__namespace.existsSync(changeWorkspaceDir)) {
+    if (!fs8__namespace.existsSync(changeWorkspaceDir)) {
       return {
         valid: false,
         errors: [`El directorio del cambio OpenSpec no existe: ${changeWorkspaceDir}`],
@@ -1974,7 +2259,7 @@ var OpenSpecAdapter = class {
     }
     const errors = [];
     const warnings = [];
-    const specFile = path4__namespace.join(changeWorkspaceDir, "spec.md");
+    const specFile = path5__namespace.join(changeWorkspaceDir, "spec.md");
     const profile = parseChangeProfile(specFile);
     validateSpecFileContent(specFile, changeWorkspaceDir, errors);
     const { handoff, sidecarFile } = validateOpenSpecStructure(profile, changeWorkspaceDir, this, errors, warnings);
@@ -1988,9 +2273,9 @@ var OpenSpecAdapter = class {
   }
 };
 function parseChangeProfile2(specFile) {
-  if (!fs7__namespace.existsSync(specFile)) return "standard";
+  if (!fs8__namespace.existsSync(specFile)) return "standard";
   try {
-    const rawSpec = fs7__namespace.readFileSync(specFile, "utf-8").replace(/^\uFEFF/, "");
+    const rawSpec = fs8__namespace.readFileSync(specFile, "utf-8").replace(/^\uFEFF/, "");
     const match = rawSpec.match(/^---\r?\n([\s\S]*?)\r?\n---/);
     if (match) {
       const parsedFm = yaml3__default.default.load(match[1]);
@@ -2012,12 +2297,12 @@ function checkSpecGherkinFormat2(parsedFm, rawSpec, changeWorkspaceDir, errors)
   }
 }
 function validateSpecFileContent2(specFile, changeWorkspaceDir, errors) {
-  if (!fs7__namespace.existsSync(specFile)) {
+  if (!fs8__namespace.existsSync(specFile)) {
     errors.push(`Falta el archivo de especificaci\xF3n obligatorio 'spec.md' en ${changeWorkspaceDir}.`);
     return;
   }
   try {
-    const rawSpec = fs7__namespace.readFileSync(specFile, "utf-8").replace(/^\uFEFF/, "");
+    const rawSpec = fs8__namespace.readFileSync(specFile, "utf-8").replace(/^\uFEFF/, "");
     const match = rawSpec.match(/^---\r?\n([\s\S]*?)\r?\n---/);
     if (match) {
       const parsedFm = yaml3__default.default.load(match[1]);
@@ -2036,19 +2321,19 @@ function validateHandoffSidecar2(handoff, changeWorkspaceDir, errors) {
   if (!handoff.subgraph || !Array.isArray(handoff.subgraph.requirements)) {
     errors.push(`El sidecar '${handoff.id}' no define un subgrafo de requerimientos v\xE1lido.`);
   }
-  return path4__namespace.join(changeWorkspaceDir, "handoff.yaml");
+  return path5__namespace.join(changeWorkspaceDir, "handoff.yaml");
 }
 function validateSpecKitStructure(profile, changeWorkspaceDir, adapter, errors, warnings) {
-  const planFile = path4__namespace.join(changeWorkspaceDir, "plan.md");
-  const tasksFile = path4__namespace.join(changeWorkspaceDir, "tasks.md");
+  const planFile = path5__namespace.join(changeWorkspaceDir, "plan.md");
+  const tasksFile = path5__namespace.join(changeWorkspaceDir, "tasks.md");
   if (profile === "patch") {
     const handoff2 = adapter.loadSidecar(changeWorkspaceDir);
-    return { handoff: handoff2, sidecarFile: handoff2 ? path4__namespace.join(changeWorkspaceDir, "handoff.yaml") : void 0 };
+    return { handoff: handoff2, sidecarFile: handoff2 ? path5__namespace.join(changeWorkspaceDir, "handoff.yaml") : void 0 };
   }
-  if (!fs7__namespace.existsSync(tasksFile)) {
+  if (!fs8__namespace.existsSync(tasksFile)) {
     errors.push(`Falta el archivo de tareas obligatorio 'tasks.md' en ${changeWorkspaceDir}.`);
   }
-  if (!fs7__namespace.existsSync(planFile)) {
+  if (!fs8__namespace.existsSync(planFile)) {
     warnings.push(`Se recomienda incluir 'plan.md' en el espacio de trabajo Spec Kit.`);
   }
   const handoff = adapter.loadSidecar(changeWorkspaceDir);
@@ -2056,18 +2341,18 @@ function validateSpecKitStructure(profile, changeWorkspaceDir, adapter, errors,
   return { handoff, sidecarFile };
 }
 function buildSpecKitWorkspaceInfo(changeWorkspaceDir, profile, handoff, sidecarFile) {
-  const changeId = path4__namespace.basename(changeWorkspaceDir);
-  const specFile = path4__namespace.join(changeWorkspaceDir, "spec.md");
-  const planFile = path4__namespace.join(changeWorkspaceDir, "plan.md");
-  const tasksFile = path4__namespace.join(changeWorkspaceDir, "tasks.md");
+  const changeId = path5__namespace.basename(changeWorkspaceDir);
+  const specFile = path5__namespace.join(changeWorkspaceDir, "spec.md");
+  const planFile = path5__namespace.join(changeWorkspaceDir, "plan.md");
+  const tasksFile = path5__namespace.join(changeWorkspaceDir, "tasks.md");
   return {
     framework: "speckit",
     changeId,
     changeDir: changeWorkspaceDir,
     profile,
-    specFile: fs7__namespace.existsSync(specFile) ? specFile : void 0,
-    designFile: fs7__namespace.existsSync(planFile) ? planFile : void 0,
-    tasksFile: fs7__namespace.existsSync(tasksFile) ? tasksFile : void 0,
+    specFile: fs8__namespace.existsSync(specFile) ? specFile : void 0,
+    designFile: fs8__namespace.existsSync(planFile) ? planFile : void 0,
+    tasksFile: fs8__namespace.existsSync(tasksFile) ? tasksFile : void 0,
     sidecarFile,
     handoff: handoff || void 0
   };
@@ -2075,18 +2360,18 @@ function buildSpecKitWorkspaceInfo(changeWorkspaceDir, profile, handoff, sidecar
 var SpecKitAdapter = class {
   framework = "speckit";
   getChangeWorkspaceDir(rootDir, changeId) {
-    const standardDir = path4__namespace.join(rootDir, "specs", changeId);
-    if (fs7__namespace.existsSync(standardDir)) return standardDir;
-    const activeChangeDir = path4__namespace.join(rootDir, "specs", "changes", "active", changeId);
-    if (fs7__namespace.existsSync(activeChangeDir)) return activeChangeDir;
-    const completedChangeDir = path4__namespace.join(rootDir, "specs", "changes", "completed", changeId);
-    if (fs7__namespace.existsSync(completedChangeDir)) return completedChangeDir;
+    const standardDir = path5__namespace.join(rootDir, "specs", changeId);
+    if (fs8__namespace.existsSync(standardDir)) return standardDir;
+    const activeChangeDir = path5__namespace.join(rootDir, "specs", "changes", "active", changeId);
+    if (fs8__namespace.existsSync(activeChangeDir)) return activeChangeDir;
+    const completedChangeDir = path5__namespace.join(rootDir, "specs", "changes", "completed", changeId);
+    if (fs8__namespace.existsSync(completedChangeDir)) return completedChangeDir;
     return standardDir;
   }
   depositSidecar(options) {
     const changeDir = this.getChangeWorkspaceDir(options.rootDir, options.changeId);
-    if (!fs7__namespace.existsSync(changeDir)) {
-      fs7__namespace.mkdirSync(changeDir, { recursive: true });
+    if (!fs8__namespace.existsSync(changeDir)) {
+      fs8__namespace.mkdirSync(changeDir, { recursive: true });
     }
     const handoff = { ...options.handoff };
     if (!handoff.id.startsWith("HOF-")) {
@@ -2099,20 +2384,20 @@ var SpecKitAdapter = class {
       handoff.createdAt = (/* @__PURE__ */ new Date()).toISOString();
     }
     const filename = options.format === "json" ? "handoff.json" : "handoff.yaml";
-    const filePath = path4__namespace.join(changeDir, filename);
+    const filePath = path5__namespace.join(changeDir, filename);
     const content = options.format === "json" ? JSON.stringify(handoff, null, 2) : yaml3__default.default.dump(handoff, { indent: 2, lineWidth: -1 });
-    fs7__namespace.writeFileSync(filePath, content, "utf-8");
-    const specifyMemoryDir = path4__namespace.join(options.rootDir, ".specify", "memory");
-    if (fs7__namespace.existsSync(path4__namespace.join(options.rootDir, ".specify"))) {
-      if (!fs7__namespace.existsSync(specifyMemoryDir)) {
-        fs7__namespace.mkdirSync(specifyMemoryDir, { recursive: true });
+    fs8__namespace.writeFileSync(filePath, content, "utf-8");
+    const specifyMemoryDir = path5__namespace.join(options.rootDir, ".specify", "memory");
+    if (fs8__namespace.existsSync(path5__namespace.join(options.rootDir, ".specify"))) {
+      if (!fs8__namespace.existsSync(specifyMemoryDir)) {
+        fs8__namespace.mkdirSync(specifyMemoryDir, { recursive: true });
       }
-      fs7__namespace.writeFileSync(path4__namespace.join(specifyMemoryDir, `${options.changeId}.handoff.yaml`), content, "utf-8");
+      fs8__namespace.writeFileSync(path5__namespace.join(specifyMemoryDir, `${options.changeId}.handoff.yaml`), content, "utf-8");
     }
     return filePath;
   }
   loadSidecar(changeWorkspaceDir) {
-    if (!fs7__namespace.existsSync(changeWorkspaceDir)) return null;
+    if (!fs8__namespace.existsSync(changeWorkspaceDir)) return null;
     const candidateFiles = [
       "handoff.yaml",
       "handoff.yml",
@@ -2122,10 +2407,10 @@ var SpecKitAdapter = class {
       "handoff.json"
     ];
     for (const file of candidateFiles) {
-      const fullPath = path4__namespace.join(changeWorkspaceDir, file);
-      if (fs7__namespace.existsSync(fullPath)) {
+      const fullPath = path5__namespace.join(changeWorkspaceDir, file);
+      if (fs8__namespace.existsSync(fullPath)) {
         try {
-          const raw = fs7__namespace.readFileSync(fullPath, "utf-8").replace(/^\uFEFF/, "");
+          const raw = fs8__namespace.readFileSync(fullPath, "utf-8").replace(/^\uFEFF/, "");
           const parsed = file.endsWith(".json") ? JSON.parse(raw) : yaml3__default.default.load(raw);
           if (parsed && typeof parsed === "object" && parsed.id && String(parsed.id).startsWith("HOF-")) {
             return parsed;
@@ -2137,7 +2422,7 @@ var SpecKitAdapter = class {
     return null;
   }
   validateWorkspace(changeWorkspaceDir) {
-    if (!fs7__namespace.existsSync(changeWorkspaceDir)) {
+    if (!fs8__namespace.existsSync(changeWorkspaceDir)) {
       return {
         valid: false,
         errors: [`El directorio del cambio Spec Kit no existe: ${changeWorkspaceDir}`],
@@ -2146,7 +2431,7 @@ var SpecKitAdapter = class {
     }
     const errors = [];
     const warnings = [];
-    const specFile = path4__namespace.join(changeWorkspaceDir, "spec.md");
+    const specFile = path5__namespace.join(changeWorkspaceDir, "spec.md");
     const profile = parseChangeProfile2(specFile);
     validateSpecFileContent2(specFile, changeWorkspaceDir, errors);
     const { handoff, sidecarFile } = validateSpecKitStructure(profile, changeWorkspaceDir, this, errors, warnings);
@@ -2318,27 +2603,27 @@ ${frontmatter}---
 ${body}`;
 }
 function materializeCanonicalArtifact(rootDir, item, changeId, author, date) {
-  const targetPath = path4__namespace.join(rootDir, item.targetDir, `${item.id}.md`);
-  if (fs7__namespace.existsSync(targetPath)) return targetPath;
-  fs7__namespace.mkdirSync(path4__namespace.dirname(targetPath), { recursive: true });
+  const targetPath = path5__namespace.join(rootDir, item.targetDir, `${item.id}.md`);
+  if (fs8__namespace.existsSync(targetPath)) return targetPath;
+  fs8__namespace.mkdirSync(path5__namespace.dirname(targetPath), { recursive: true });
   const initialContent = buildCanonicalInitialContent(item, changeId, author, date);
-  fs7__namespace.writeFileSync(targetPath, initialContent, "utf-8");
+  fs8__namespace.writeFileSync(targetPath, initialContent, "utf-8");
   return targetPath;
 }
 function findChangeWorkspaceDir(rootDir, changeId) {
-  const activeDir = path4__namespace.join(rootDir, "specs", "changes", "active", changeId);
-  if (fs7__namespace.existsSync(activeDir)) return activeDir;
-  const completedDir = path4__namespace.join(rootDir, "specs", "changes", "completed", changeId);
-  if (fs7__namespace.existsSync(completedDir)) return completedDir;
-  const openspecActive = path4__namespace.join(rootDir, "openspec", "changes", changeId);
-  if (fs7__namespace.existsSync(openspecActive)) return openspecActive;
+  const activeDir = path5__namespace.join(rootDir, "specs", "changes", "active", changeId);
+  if (fs8__namespace.existsSync(activeDir)) return activeDir;
+  const completedDir = path5__namespace.join(rootDir, "specs", "changes", "completed", changeId);
+  if (fs8__namespace.existsSync(completedDir)) return completedDir;
+  const openspecActive = path5__namespace.join(rootDir, "openspec", "changes", changeId);
+  if (fs8__namespace.existsSync(openspecActive)) return openspecActive;
   return null;
 }
 function checkTasksExecution(changeDir, changeId) {
-  const tasksFile = path4__namespace.join(changeDir, "tasks.md");
+  const tasksFile = path5__namespace.join(changeDir, "tasks.md");
   const allTasks = [];
-  if (fs7__namespace.existsSync(tasksFile)) {
-    allTasks.push(...parseTasksFromContent(fs7__namespace.readFileSync(tasksFile, "utf-8")));
+  if (fs8__namespace.existsSync(tasksFile)) {
+    allTasks.push(...parseTasksFromContent(fs8__namespace.readFileSync(tasksFile, "utf-8")));
   }
   const completedTasks = allTasks.filter((t) => t.status === "COMPLETED").map((t) => t.id);
   const pendingTasks = allTasks.filter((t) => t.status !== "COMPLETED").map((t) => t.id);
@@ -2370,9 +2655,9 @@ function buildSubgraphFromProposalIds(ids) {
 function resolveChangeHandoff(changeDir, changeId) {
   const sidecar = loadProductHandoffSidecar(changeDir);
   if (sidecar) return sidecar;
-  const proposalFile = path4__namespace.join(changeDir, "proposal.md");
-  if (!fs7__namespace.existsSync(proposalFile)) return null;
-  const propContent = fs7__namespace.readFileSync(proposalFile, "utf-8");
+  const proposalFile = path5__namespace.join(changeDir, "proposal.md");
+  if (!fs8__namespace.existsSync(proposalFile)) return null;
+  const propContent = fs8__namespace.readFileSync(proposalFile, "utf-8");
   const { frontmatter } = parseFrontmatter(propContent);
   const citations = Array.isArray(frontmatter.citations) ? frontmatter.citations : [];
   const ids = citations.map((c) => c.id || "").filter(Boolean);
@@ -2386,9 +2671,9 @@ function resolveChangeHandoff(changeDir, changeId) {
 }
 function materializeNewCatalogArtifacts(changeDir, rootDir, changeId, author, date, errors) {
   const created = [];
-  const specFile = path4__namespace.join(changeDir, "spec.md");
-  if (!fs7__namespace.existsSync(specFile)) return created;
-  const specContent = fs7__namespace.readFileSync(specFile, "utf-8");
+  const specFile = path5__namespace.join(changeDir, "spec.md");
+  if (!fs8__namespace.existsSync(specFile)) return created;
+  const specContent = fs8__namespace.readFileSync(specFile, "utf-8");
   const { newItems } = parseSpecCatalogScope(specContent);
   for (const item of newItems) {
     try {
@@ -2405,10 +2690,10 @@ function loadCanonicalArtifacts(rootDir) {
   const allMdFiles = walkMdFiles(rootDir);
   const canonicalArtifacts = /* @__PURE__ */ new Map();
   for (const file of allMdFiles) {
-    const relFile = path4__namespace.relative(rootDir, file).replace(/\\/g, "/");
+    const relFile = path5__namespace.relative(rootDir, file).replace(/\\/g, "/");
     if (relFile.includes("specs/changes/") || relFile.includes("templates/")) continue;
     try {
-      const content = fs7__namespace.readFileSync(file, "utf-8");
+      const content = fs8__namespace.readFileSync(file, "utf-8");
       const { frontmatter, body } = parseFrontmatter(content);
       if (frontmatter.id) canonicalArtifacts.set(String(frontmatter.id), { file, frontmatter, body });
     } catch {
@@ -2421,7 +2706,7 @@ function writeUpdatedArtifact(file, frontmatter, body) {
 ${yaml3__default.default.dump(frontmatter, { indent: 2, lineWidth: -1 }).trim()}
 ---
 `;
-  fs7__namespace.writeFileSync(file, yamlHeader + body, "utf-8");
+  fs8__namespace.writeFileSync(file, yamlHeader + body, "utf-8");
 }
 function updateSingleCanonicalRequirement(canonical, completedTasks, changeId, date, author) {
   const fm = canonical.frontmatter;
@@ -2537,28 +2822,28 @@ function updateArchitectureComponents(citedComponents, canonicalArtifacts, targe
   return updated;
 }
 function moveToCompletedFolder(changeDir, changeId, rootDir) {
-  const completedParent = path4__namespace.join(rootDir, "specs", "changes", "completed");
-  if (!fs7__namespace.existsSync(completedParent)) fs7__namespace.mkdirSync(completedParent, { recursive: true });
-  const destDir = path4__namespace.join(completedParent, changeId);
-  if (fs7__namespace.existsSync(destDir)) fs7__namespace.rmSync(destDir, { recursive: true, force: true });
-  fs7__namespace.renameSync(changeDir, destDir);
-  const destProposal = path4__namespace.join(destDir, "proposal.md");
-  if (fs7__namespace.existsSync(destProposal)) {
-    const { frontmatter, body } = parseFrontmatter(fs7__namespace.readFileSync(destProposal, "utf-8"));
+  const completedParent = path5__namespace.join(rootDir, "specs", "changes", "completed");
+  if (!fs8__namespace.existsSync(completedParent)) fs8__namespace.mkdirSync(completedParent, { recursive: true });
+  const destDir = path5__namespace.join(completedParent, changeId);
+  if (fs8__namespace.existsSync(destDir)) fs8__namespace.rmSync(destDir, { recursive: true, force: true });
+  fs8__namespace.renameSync(changeDir, destDir);
+  const destProposal = path5__namespace.join(destDir, "proposal.md");
+  if (fs8__namespace.existsSync(destProposal)) {
+    const { frontmatter, body } = parseFrontmatter(fs8__namespace.readFileSync(destProposal, "utf-8"));
     frontmatter.status = "applied";
     writeUpdatedArtifact(destProposal, frontmatter, body);
   }
   return destDir;
 }
 function archiveChangeWorkspace(changeDir, changeId, rootDir, autoArchive, completedAll) {
-  const isActiveFolder = changeDir.includes("specs" + path4__namespace.sep + "changes" + path4__namespace.sep + "active");
+  const isActiveFolder = changeDir.includes("specs" + path5__namespace.sep + "changes" + path5__namespace.sep + "active");
   if (completedAll && autoArchive && isActiveFolder) {
     const destDir = moveToCompletedFolder(changeDir, changeId, rootDir);
     return { archived: true, archivedPath: destDir };
   }
-  const proposalFile = path4__namespace.join(changeDir, "proposal.md");
-  if (fs7__namespace.existsSync(proposalFile)) {
-    const { frontmatter, body } = parseFrontmatter(fs7__namespace.readFileSync(proposalFile, "utf-8"));
+  const proposalFile = path5__namespace.join(changeDir, "proposal.md");
+  if (fs8__namespace.existsSync(proposalFile)) {
+    const { frontmatter, body } = parseFrontmatter(fs8__namespace.readFileSync(proposalFile, "utf-8"));
     if (completedAll) frontmatter.status = "completed";
     writeUpdatedArtifact(proposalFile, frontmatter, body);
   }
@@ -2623,9 +2908,9 @@ function collectSubgraphPromotableIds(subgraph) {
   return Array.from(new Set(combined));
 }
 function collectSpecAffectedNonArchIds(changeDir) {
-  const specFile = path4__namespace.join(changeDir, "spec.md");
-  if (!fs7__namespace.existsSync(specFile)) return [];
-  const { affectedItems } = parseSpecCatalogScope(fs7__namespace.readFileSync(specFile, "utf-8"));
+  const specFile = path5__namespace.join(changeDir, "spec.md");
+  if (!fs8__namespace.existsSync(specFile)) return [];
+  const { affectedItems } = parseSpecCatalogScope(fs8__namespace.readFileSync(specFile, "utf-8"));
   return affectedItems.map((item) => item.id).filter((id) => !isArchitectureComponentId(id));
 }
 function resolveIntegrationOptions(options) {
@@ -2699,8 +2984,8 @@ function resolveAuditStatus(integratedCount, targetCount, gapsCount) {
 function auditChangeEntry(changeDir, changeName, canonicalMap) {
   const handoff = loadProductHandoffSidecar(changeDir);
   if (!handoff) return null;
-  const tasksFile = path4__namespace.join(changeDir, "tasks.md");
-  const tasks = fs7__namespace.existsSync(tasksFile) ? parseTasksFromContent(fs7__namespace.readFileSync(tasksFile, "utf-8")) : [];
+  const tasksFile = path5__namespace.join(changeDir, "tasks.md");
+  const tasks = fs8__namespace.existsSync(tasksFile) ? parseTasksFromContent(fs8__namespace.readFileSync(tasksFile, "utf-8")) : [];
   const completed = tasks.filter((t) => t.status === "COMPLETED");
   const targetReqs = collectSubgraphPromotableIds(handoff.subgraph);
   const { integrated, missing, gaps } = auditChangeRequirements(targetReqs, canonicalMap);
@@ -2716,11 +3001,11 @@ function auditChangeEntry(changeDir, changeName, canonicalMap) {
   };
 }
 function collectParentDirAudits(parent, canonicalMap, audits, errors) {
-  if (!fs7__namespace.existsSync(parent)) return;
-  const entries = fs7__namespace.readdirSync(parent, { withFileTypes: true });
+  if (!fs8__namespace.existsSync(parent)) return;
+  const entries = fs8__namespace.readdirSync(parent, { withFileTypes: true });
   for (const e of entries) {
     if (!e.isDirectory()) continue;
-    const audit = auditChangeEntry(path4__namespace.join(parent, e.name), e.name, canonicalMap);
+    const audit = auditChangeEntry(path5__namespace.join(parent, e.name), e.name, canonicalMap);
     if (audit) {
       if (audit.gaps.length > 0) errors.push(`[${e.name}] Desalineaci\xF3n: ${audit.gaps.join("; ")}`);
       audits.push(audit);
@@ -2732,8 +3017,8 @@ function verifySddIntegration(options = {}) {
   const audits = [];
   const errors = [];
   const searchDirs = [
-    path4__namespace.join(rootDir, "specs", "changes", "completed"),
-    path4__namespace.join(rootDir, "specs", "changes", "active")
+    path5__namespace.join(rootDir, "specs", "changes", "completed"),
+    path5__namespace.join(rootDir, "specs", "changes", "active")
   ];
   const canonicalMap = loadCanonicalArtifacts(rootDir);
   for (const parent of searchDirs) {
@@ -2781,10 +3066,10 @@ function resolveMatchFromMetadata(activeFolders, options) {
   return {};
 }
 function validateActiveDirectory(activeParent) {
-  if (!fs7__namespace.existsSync(activeParent)) {
+  if (!fs8__namespace.existsSync(activeParent)) {
     return { ok: false, folders: [], error: `No existe el directorio de cambios activos en '${activeParent}'.` };
   }
-  const entries = fs7__namespace.readdirSync(activeParent, { withFileTypes: true });
+  const entries = fs8__namespace.readdirSync(activeParent, { withFileTypes: true });
   const activeFolders = entries.filter((e) => e.isDirectory()).map((e) => e.name);
   if (activeFolders.length === 0) {
     return { ok: false, folders: [], error: "No se encontraron carpetas de cambios activos en specs/changes/active/." };
@@ -2816,7 +3101,7 @@ function evaluateTasksProgress(changeId, tasks) {
 }
 function detectActiveChangeForIntegration(options = {}) {
   const rootDir = options.rootDir || process.cwd();
-  const activeParent = path4__namespace.join(rootDir, "specs", "changes", "active");
+  const activeParent = path5__namespace.join(rootDir, "specs", "changes", "active");
   const dirCheck = validateActiveDirectory(activeParent);
   if (!dirCheck.ok) {
     return {
@@ -2831,9 +3116,9 @@ function detectActiveChangeForIntegration(options = {}) {
   if (!match.changeId) {
     return buildUnmatchedActiveResult(dirCheck.folders, options);
   }
-  const changeDir = path4__namespace.join(activeParent, match.changeId);
-  const tasksFile = path4__namespace.join(changeDir, "tasks.md");
-  const tasks = fs7__namespace.existsSync(tasksFile) ? parseTasksFromContent(fs7__namespace.readFileSync(tasksFile, "utf-8")) : [];
+  const changeDir = path5__namespace.join(activeParent, match.changeId);
+  const tasksFile = path5__namespace.join(changeDir, "tasks.md");
+  const tasks = fs8__namespace.existsSync(tasksFile) ? parseTasksFromContent(fs8__namespace.readFileSync(tasksFile, "utf-8")) : [];
   const progress = evaluateTasksProgress(match.changeId, tasks);
   const reasons = match.reason ? [match.reason] : [];
   if (progress.error) reasons.push(progress.error);
@@ -2848,9 +3133,46 @@ function detectActiveChangeForIntegration(options = {}) {
     reasons
   };
 }
-function computeCanonicalSha256(content) {
+function extractSemanticContent(content) {
+  let normalized = content.replace(/\r\n/g, "\n");
+  normalized = normalized.replace(/(?:\n|^)##?\s+.*(?:Historial de Revisiones|Revision History)(?:[\s\S]*?(?=(?:\n##?\s+[^\n]+)|\s*$))/i, "");
+  normalized = normalized.replace(/(?:\n|^)\|\s*\*?Versi[oó]n\*?\s*\|\s*Fecha\s*\|\s*Autor[\s\S]*?(?=(?:\n##?\s+[^\n]+)|\s*$)/i, "");
+  return normalized.trimEnd() + "\n";
+}
+function slugify(text) {
+  return text.toLowerCase().replace(/[^\w\s-]/g, "").trim().replace(/\s+/g, "-");
+}
+function matchesSlug(line, clean) {
+  const headingText = line.replace(/^#+\s*/, "").trim();
+  const slug = slugify(headingText);
+  if (slug === clean || slug.includes(clean) || clean.includes(slug)) return true;
+  const slugNoNums = slugify(headingText.replace(/^\d+[\.\)]\s*/, "").trim());
+  return slugNoNums === clean || clean === slugNoNums;
+}
+function matchesHeading(content, clean) {
+  for (const line of content.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (trimmed.startsWith("#") && matchesSlug(trimmed, clean)) {
+      return true;
+    }
+  }
+  return false;
+}
+function validateAnchorExistence(targetContent, anchor) {
+  if (!anchor) return true;
+  const clean = anchor.replace(/^#/, "").trim().toLowerCase();
+  if (!clean || targetContent.toLowerCase().includes(clean)) return true;
+  if (matchesHeading(targetContent, clean)) return true;
+  const anchorRegex = new RegExp(`(?:id|name)=["']${clean}["']|\\{#${clean}\\}`, "i");
+  return anchorRegex.test(targetContent);
+}
+function computeRawSha256(content) {
   const normalized = content.replace(/\r\n/g, "\n");
-  return crypto__namespace.createHash("sha256").update(normalized, "utf-8").digest("hex");
+  return crypto3__namespace.createHash("sha256").update(normalized, "utf-8").digest("hex");
+}
+function computeCanonicalSha256(content) {
+  const semantic = extractSemanticContent(content);
+  return crypto3__namespace.createHash("sha256").update(semantic, "utf-8").digest("hex");
 }
 function parseFrontmatterId(content) {
   const match = content.match(/^---\r?\n([\s\S]*?)\r?\n---/);
@@ -2940,7 +3262,7 @@ function buildPdacReportHeader(isOk, driftsCount, nodesCount) {
   return [
     `# \u{1F512} PDaC Cryptographic Matrix and Drift Detection (Anti-Drift)`,
     ``,
-    `> **Evaluation Date:** ${(/* @__PURE__ */ new Date()).toISOString()}`,
+    `> **Evaluation Date:** ${resolveDeterministicDate().toISOString()}`,
     `> **Verdict:** ${verdict}`,
     ``,
     `---`,
@@ -2951,8 +3273,8 @@ function buildPdacReportHeader(isOk, driftsCount, nodesCount) {
     `| :--- | :--- | :--- | :--- |`
   ];
 }
-function generatePdacReportMarkdown(nodes, drifts, unresolvedCount) {
-  const isOk = drifts.length === 0 && unresolvedCount === 0;
+function generatePdacReportMarkdown(nodes, drifts, unresolvedCount, invalidAnchors = []) {
+  const isOk = drifts.length === 0 && unresolvedCount === 0 && invalidAnchors.length === 0;
   const header = buildPdacReportHeader(isOk, drifts.length, nodes.length);
   const nodeRows = nodes.map(
     (n) => `| **\`${n.id}\`** | \`${n.type}\` | ${n.title || "Untitled"} | \`sha256:${n.digest.substring(0, 16)}...\` |`
@@ -2964,9 +3286,9 @@ function isPdacDeliveryDoc(relFile) {
 }
 function processPdacFile(file, rootDir, baselineMap, allCitations) {
   try {
-    const content = fs7__namespace.readFileSync(file, "utf-8");
+    const content = fs8__namespace.readFileSync(file, "utf-8");
     const { id, type, title } = parseFrontmatterId(content);
-    const relFile = path4__namespace.relative(rootDir, file).replace(/\\/g, "/");
+    const relFile = path5__namespace.relative(rootDir, file).replace(/\\/g, "/");
     if (id) {
       const citations = extractCitations(content, relFile);
       baselineMap.set(id, {
@@ -2975,6 +3297,7 @@ function processPdacFile(file, rootDir, baselineMap, allCitations) {
         filePath: relFile,
         title,
         digest: computeCanonicalSha256(content),
+        rawDigest: computeRawSha256(content),
         rawContent: content,
         citations: citations.map((c) => ({
           targetId: c.targetId,
@@ -2998,38 +3321,65 @@ function scanPdacWorkspace(rootDir) {
   }
   return { baselineMap, allCitations };
 }
+function checkAnchor(citation, targetNode, invalidAnchors) {
+  if (citation.anchor && targetNode.rawContent) {
+    if (!validateAnchorExistence(targetNode.rawContent, citation.anchor)) {
+      invalidAnchors.push({
+        sourceFile: citation.sourceFile,
+        targetId: citation.targetId,
+        anchor: citation.anchor,
+        reason: `Anchor '${citation.anchor}' not found in target artifact '${citation.targetId}' (${targetNode.filePath})`
+      });
+    }
+  }
+}
+function checkDigest(citation, targetNode, drifts) {
+  if (!citation.expectedDigest) return;
+  const matches = citation.expectedDigest === targetNode.digest || targetNode.rawDigest !== void 0 && citation.expectedDigest === targetNode.rawDigest;
+  if (!matches) {
+    drifts.push({
+      sourceId: citation.sourceFile,
+      targetId: citation.targetId,
+      sourceFile: citation.sourceFile,
+      expectedDigest: citation.expectedDigest,
+      actualDigest: targetNode.digest
+    });
+  }
+}
 function computePdacDrifts(allCitations, baselineMap) {
   const drifts = [];
+  const unresolvedCitations = [];
+  const invalidAnchors = [];
   let unresolvedCount = 0;
   for (const citation of allCitations) {
     const targetNode = baselineMap.get(citation.targetId);
     if (!targetNode) {
       unresolvedCount++;
-      continue;
-    }
-    if (citation.expectedDigest && citation.expectedDigest !== targetNode.digest) {
-      drifts.push({
-        sourceId: citation.sourceFile,
-        targetId: citation.targetId,
+      unresolvedCitations.push({
         sourceFile: citation.sourceFile,
-        expectedDigest: citation.expectedDigest,
-        actualDigest: targetNode.digest
+        targetId: citation.targetId
       });
+      continue;
     }
+    checkAnchor(citation, targetNode, invalidAnchors);
+    checkDigest(citation, targetNode, drifts);
   }
-  return { drifts, unresolvedCount };
+  return { drifts, unresolvedCount, unresolvedCitations, invalidAnchors };
 }
 function verifyPdacGraph(options = {}) {
   const rootDir = options.rootDir || process.cwd();
   const { baselineMap, allCitations } = scanPdacWorkspace(rootDir);
-  const { drifts, unresolvedCount } = computePdacDrifts(allCitations, baselineMap);
+  const { drifts, unresolvedCount, unresolvedCitations, invalidAnchors } = computePdacDrifts(allCitations, baselineMap);
   const nodes = Array.from(baselineMap.values());
-  const reportMarkdown = generatePdacReportMarkdown(nodes, drifts, unresolvedCount);
+  const reportMarkdown = generatePdacReportMarkdown(nodes, drifts, unresolvedCount, invalidAnchors);
   return {
-    success: drifts.length === 0,
+    success: drifts.length === 0 && unresolvedCount === 0 && invalidAnchors.length === 0,
     totalNodes: nodes.length,
     totalEdges: allCitations.length,
     drifts,
+    unresolvedCount,
+    unresolvedCitations,
+    invalidAnchors,
     reportMarkdown
   };
 }
@@ -3094,22 +3444,22 @@ function updateCitationsInContent(content, baselineMap, sourceFile, details) {
 }
 function collectCandidateFilesForSync(rootDir, targetPath) {
   if (targetPath) {
-    const fullTarget = path4__namespace.isAbsolute(targetPath) ? targetPath : path4__namespace.join(rootDir, targetPath);
-    if (!fs7__namespace.existsSync(fullTarget)) return [];
-    return fs7__namespace.statSync(fullTarget).isDirectory() ? walkMdFiles(fullTarget) : [fullTarget];
+    const fullTarget = path5__namespace.isAbsolute(targetPath) ? targetPath : path5__namespace.join(rootDir, targetPath);
+    if (!fs8__namespace.existsSync(fullTarget)) return [];
+    return fs8__namespace.statSync(fullTarget).isDirectory() ? walkMdFiles(fullTarget) : [fullTarget];
   }
   return walkMdFiles(rootDir).filter((f) => {
-    const relFile = path4__namespace.relative(rootDir, f).replace(/\\/g, "/");
+    const relFile = path5__namespace.relative(rootDir, f).replace(/\\/g, "/");
     return isPdacDeliveryDoc(relFile);
   });
 }
 function syncSingleFile(file, rootDir, baselineMap, details) {
   try {
-    const content = fs7__namespace.readFileSync(file, "utf-8");
-    const relFile = path4__namespace.relative(rootDir, file).replace(/\\/g, "/");
+    const content = fs8__namespace.readFileSync(file, "utf-8");
+    const relFile = path5__namespace.relative(rootDir, file).replace(/\\/g, "/");
     const { updatedContent, changed } = updateCitationsInContent(content, baselineMap, relFile, details);
     if (changed) {
-      fs7__namespace.writeFileSync(file, updatedContent, "utf-8");
+      fs8__namespace.writeFileSync(file, updatedContent, "utf-8");
       return relFile;
     }
   } catch {
@@ -3312,6 +3662,36 @@ var STARTER_SCHEMAS = Object.entries(STARTER_SCHEMAS_MAP).map(([relPath, schema]
 }));
 
 // src/verifiers/schemas.ts
+var ajvInstance = new Ajv2020__default.default({
+  allErrors: true,
+  strict: false,
+  validateFormats: true,
+  verbose: true
+});
+addFormats__default.default(ajvInstance);
+var compiledSchemaCache = /* @__PURE__ */ new WeakMap();
+function formatFieldPath(err, propPath) {
+  const field = err.instancePath ? err.instancePath.replace(/^\//, "").replace(/\//g, ".") : propPath || "root";
+  return propPath && field !== "root" && field ? `${propPath}.${field}` : field || "root";
+}
+var KEYWORD_FORMATTERS = {
+  required: (p, _err, fullPath) => `'${fullPath}' missing required field '${String(p?.missingProperty)}'`,
+  additionalProperties: (p, _err, fullPath) => `'${fullPath}' contains disallowed extra property '${String(p?.additionalProperty)}'`,
+  minLength: (p, _err, fullPath) => `'${fullPath}' length must be >= ${String(p?.limit)}`,
+  maxLength: (p, _err, fullPath) => `'${fullPath}' length must be <= ${String(p?.limit)}`,
+  enum: (p, err, fullPath) => `'${fullPath}' must be one of [${Array.isArray(p?.allowedValues) ? p.allowedValues.join(", ") : ""}], received '${String(err.data)}'`,
+  uniqueItems: (_p, _err, fullPath) => `'${fullPath}' contains duplicate items (must have unique items)`,
+  pattern: (p, err, fullPath) => `'${fullPath}' value '${String(err.data)}' does not match pattern ${String(p?.pattern)}`
+};
+function formatKeywordMessage(err, fullPath) {
+  const p = err.params;
+  const formatter = KEYWORD_FORMATTERS[err.keyword];
+  return formatter ? formatter(p, err, fullPath) : `'${fullPath}' ${err.message || "validation failed"}`;
+}
+function formatAjvError(err, propPath) {
+  const fullPath = formatFieldPath(err, propPath);
+  return formatKeywordMessage(err, fullPath);
+}
 var TYPE_TO_SCHEMA_MAP = {
   // Product
   actor: "schemas/product/actor.schema.json",
@@ -3456,10 +3836,10 @@ var EXCLUDED_SCHEMA_DIRS = /* @__PURE__ */ new Set([
 ]);
 function walkHandoffSidecars(dir, fileList = []) {
   try {
-    if (!fs7__namespace.existsSync(dir)) return fileList;
-    for (const file of fs7__namespace.readdirSync(dir)) {
-      const fullPath = path4__namespace.join(dir, file);
-      if (fs7__namespace.statSync(fullPath).isDirectory()) {
+    if (!fs8__namespace.existsSync(dir)) return fileList;
+    for (const file of fs8__namespace.readdirSync(dir)) {
+      const fullPath = path5__namespace.join(dir, file);
+      if (fs8__namespace.statSync(fullPath).isDirectory()) {
         if (!EXCLUDED_SCHEMA_DIRS.has(file) && !file.startsWith("temp-") && !file.startsWith(".temp-")) {
           walkHandoffSidecars(fullPath, fileList);
         }
@@ -3482,157 +3862,41 @@ function extractArtifactData(filePath, content) {
   }
   return extractFrontmatter(content);
 }
-function validateConst(value, schema, currentProp) {
-  if (schema.const !== void 0 && value !== schema.const) {
-    return [`'${currentProp}' must equal '${schema.const}', received '${String(value)}'`];
-  }
-  return [];
-}
-function validateEnum(value, schema, currentProp) {
-  if (schema.enum !== void 0 && !schema.enum.includes(value)) {
-    return [`'${currentProp}' must be one of [${schema.enum.join(", ")}], received '${String(value)}'`];
+function getOrCompileSchema(schema) {
+  const schemaObj = schema;
+  if (typeof schemaObj.$id === "string") {
+    const existing = ajvInstance.getSchema(schemaObj.$id);
+    if (existing) return existing;
+    return ajvInstance.compile(schema);
   }
-  return [];
-}
-function validateCombinators(value, schema, propPath, currentProp) {
-  if (schema.oneOf) {
-    const matchCount = schema.oneOf.filter((sub) => validateAgainstSchema(value, sub, propPath).length === 0).length;
-    if (matchCount !== 1) {
-      return [`'${currentProp}' must match exactly one sub-schema in oneOf`];
-    }
-  }
-  if (schema.anyOf) {
-    const anyMatched = schema.anyOf.some((sub) => validateAgainstSchema(value, sub, propPath).length === 0);
-    if (!anyMatched) {
-      return [`'${currentProp}' did not match any allowed alternative in anyOf`];
-    }
-  }
-  return [];
-}
-function getActualJsonType(value) {
-  if (value === null) return "null";
-  if (Array.isArray(value)) return "array";
-  const t = typeof value;
-  if (t === "number" && Number.isInteger(value)) return "integer";
-  return t;
-}
-function validateType(value, schema, currentProp) {
-  if (schema.type === void 0) return [];
-  const allowed = Array.isArray(schema.type) ? schema.type : [schema.type];
-  const actual = getActualJsonType(value);
-  const matches = allowed.some((t) => t === actual || t === "number" && actual === "integer");
-  if (!matches) {
-    return [`'${currentProp}' expected type [${allowed.join("|")}], received '${actual}'`];
-  }
-  return [];
-}
-function validateString(value, schema, currentProp) {
-  const errors = [];
-  if (schema.minLength !== void 0 && value.length < schema.minLength) {
-    errors.push(`'${currentProp}' length must be >= ${schema.minLength}`);
-  }
-  if (schema.maxLength !== void 0 && value.length > schema.maxLength) {
-    errors.push(`'${currentProp}' length must be <= ${schema.maxLength}`);
-  }
-  if (schema.pattern !== void 0 && !new RegExp(schema.pattern).test(value)) {
-    errors.push(`'${currentProp}' value '${value}' does not match pattern ${schema.pattern}`);
-  }
-  if (schema.format === "date") {
-    const dateRegex = /^\d{4}-\d{2}-\d{2}$/;
-    if (!dateRegex.test(value) || isNaN(Date.parse(value))) {
-      errors.push(`'${currentProp}' must be a valid ISO-8601 date string (YYYY-MM-DD)`);
-    }
-  }
-  return errors;
-}
-function validateNumber(value, schema, currentProp) {
-  const errors = [];
-  if (schema.minimum !== void 0 && value < schema.minimum) {
-    errors.push(`'${currentProp}' must be >= ${schema.minimum}`);
-  }
-  if (schema.maximum !== void 0 && value > schema.maximum) {
-    errors.push(`'${currentProp}' must be <= ${schema.maximum}`);
-  }
-  return errors;
-}
-function validateArray(value, schema, currentProp) {
-  const errors = [];
-  if (schema.minItems !== void 0 && value.length < schema.minItems) {
-    errors.push(`'${currentProp}' items count must be >= ${schema.minItems}`);
-  }
-  if (schema.maxItems !== void 0 && value.length > schema.maxItems) {
-    errors.push(`'${currentProp}' items count must be <= ${schema.maxItems}`);
-  }
-  if (schema.items) {
-    value.forEach((item, idx) => {
-      errors.push(...validateAgainstSchema(item, schema.items, `${currentProp}[${idx}]`));
-    });
-  }
-  return errors;
-}
-function checkRequiredProperties(record, required, currentProp) {
-  if (!required) return [];
-  const errors = [];
-  for (const reqKey of required) {
-    if (!(reqKey in record) || record[reqKey] === void 0) {
-      errors.push(`'${currentProp}' missing required field '${reqKey}'`);
-    }
-  }
-  return errors;
-}
-function checkObjectProperties(record, schema, propPath, currentProp) {
-  const errors = [];
-  const properties = schema.properties || {};
-  for (const [key, propVal] of Object.entries(record)) {
-    const subPath = propPath ? `${propPath}.${key}` : key;
-    if (key in properties) {
-      errors.push(...validateAgainstSchema(propVal, properties[key], subPath));
-    } else if (schema.additionalProperties === false) {
-      errors.push(`'${currentProp}' contains disallowed extra property '${key}'`);
-    } else if (typeof schema.additionalProperties === "object") {
-      errors.push(...validateAgainstSchema(propVal, schema.additionalProperties, subPath));
-    }
-  }
-  return errors;
-}
-function validateObject(record, schema, propPath, currentProp) {
-  return [
-    ...checkRequiredProperties(record, schema.required, currentProp),
-    ...checkObjectProperties(record, schema, propPath, currentProp)
-  ];
-}
-function validateTypeSpecificRules(value, schema, propPath, currentProp) {
-  if (typeof value === "string") return validateString(value, schema, currentProp);
-  if (typeof value === "number") return validateNumber(value, schema, currentProp);
-  if (Array.isArray(value)) return validateArray(value, schema, currentProp);
-  if (typeof value === "object" && value !== null) {
-    return validateObject(value, schema, propPath, currentProp);
-  }
-  return [];
+  const cached = compiledSchemaCache.get(schema);
+  if (cached) return cached;
+  const compiled = ajvInstance.compile(schema);
+  compiledSchemaCache.set(schema, compiled);
+  return compiled;
 }
 function validateAgainstSchema(value, schema, propPath = "") {
-  const currentProp = propPath || "root";
-  const constErr = validateConst(value, schema, currentProp);
-  if (constErr.length > 0) return constErr;
-  const enumErr = validateEnum(value, schema, currentProp);
-  if (enumErr.length > 0) return enumErr;
-  const combErr = validateCombinators(value, schema, propPath, currentProp);
-  if (combErr.length > 0) return combErr;
-  const typeErr = validateType(value, schema, currentProp);
-  if (typeErr.length > 0) return typeErr;
-  return validateTypeSpecificRules(value, schema, propPath, currentProp);
+  if (!schema || typeof schema !== "object") return [];
+  try {
+    const validate = getOrCompileSchema(schema);
+    const valid = validate(value);
+    if (valid || !validate.errors) return [];
+    return validate.errors.map((err) => formatAjvError(err, propPath));
+  } catch (err) {
+    return [`Schema error: ${err instanceof Error ? err.message : String(err)}`];
+  }
 }
 function findSchemaFile(relSchemaPath, rootDir) {
-  const fullPath = path4__namespace.join(rootDir, relSchemaPath);
-  if (fs7__namespace.existsSync(fullPath)) return fullPath;
-  const fallbackPath = path4__namespace.join(process.cwd(), relSchemaPath);
-  if (fs7__namespace.existsSync(fallbackPath)) return fallbackPath;
+  const fullPath = path5__namespace.join(rootDir, relSchemaPath);
+  if (fs8__namespace.existsSync(fullPath)) return fullPath;
+  const fallbackPath = path5__namespace.join(process.cwd(), relSchemaPath);
+  if (fs8__namespace.existsSync(fallbackPath)) return fallbackPath;
   return null;
 }
 function loadJsonSchema(fullPath, relSchemaPath) {
-  if (fullPath && fs7__namespace.existsSync(fullPath)) {
+  if (fullPath && fs8__namespace.existsSync(fullPath)) {
     try {
-      return JSON.parse(fs7__namespace.readFileSync(fullPath, "utf-8"));
+      return JSON.parse(fs8__namespace.readFileSync(fullPath, "utf-8"));
     } catch {
     }
   }
@@ -3647,7 +3911,7 @@ function resolveSchemaForArtifact(frontmatter, rootDir) {
 }
 function loadSchemaFromPathOrType(schemaOrType, rootDir) {
   if (schemaOrType.endsWith(".json")) {
-    const fullPath = path4__namespace.isAbsolute(schemaOrType) ? schemaOrType : findSchemaFile(schemaOrType, rootDir);
+    const fullPath = path5__namespace.isAbsolute(schemaOrType) ? schemaOrType : findSchemaFile(schemaOrType, rootDir);
     const relNormalized = schemaOrType.replace(/\\/g, "/");
     const schema = loadJsonSchema(fullPath, relNormalized);
     return { schema, schemaId: schemaOrType };
@@ -3692,9 +3956,9 @@ function collectCandidateSchemaFiles(options, rootDir) {
   if (!options.targetPath) {
     return [...walkMdFiles(rootDir), ...walkHandoffSidecars(rootDir)];
   }
-  const target = path4__namespace.isAbsolute(options.targetPath) ? options.targetPath : path4__namespace.join(rootDir, options.targetPath);
-  if (!fs7__namespace.existsSync(target)) return [];
-  if (fs7__namespace.statSync(target).isDirectory()) {
+  const target = path5__namespace.isAbsolute(options.targetPath) ? options.targetPath : path5__namespace.join(rootDir, options.targetPath);
+  if (!fs8__namespace.existsSync(target)) return [];
+  if (fs8__namespace.statSync(target).isDirectory()) {
     return [...walkMdFiles(target), ...walkHandoffSidecars(target)];
   }
   if (target.endsWith(".md") || target.endsWith(".yaml") || target.endsWith(".yml")) {
@@ -3745,7 +4009,7 @@ function buildEvaluationFailure(relPath, err) {
 }
 function evaluateArtifactFile(file, relPath, rootDir) {
   try {
-    const content = fs7__namespace.readFileSync(file, "utf-8");
+    const content = fs8__namespace.readFileSync(file, "utf-8");
     const frontmatter = extractArtifactData(file, content);
     if (!frontmatter || !frontmatter.id) return null;
     const schemaInfo = resolveSchemaForArtifact(frontmatter, rootDir);
@@ -3780,7 +4044,7 @@ function verifyArtifactsSchemas(options = {}) {
   let validCount = 0;
   let totalEvaluated = 0;
   for (const file of filesToScan) {
-    const relPath = path4__namespace.relative(rootDir, file).replace(/\\/g, "/");
+    const relPath = path5__namespace.relative(rootDir, file).replace(/\\/g, "/");
     if (isIgnoredArtifactPath(relPath, Boolean(options.targetPath))) continue;
     const evaluation = evaluateArtifactFile(file, relPath, rootDir);
     if (!evaluation) continue;
@@ -3795,14 +4059,14 @@ function verifyArtifactsSchemas(options = {}) {
 }
 
 // src/adapters/sdd/scaffold.ts
-function slugify(text) {
+function slugify2(text) {
   return text.normalize("NFD").replace(/[\u0300-\u036f]/g, "").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
 }
 function extractDirMaxNum(dir) {
-  if (!fs7__namespace.existsSync(dir)) return 0;
+  if (!fs8__namespace.existsSync(dir)) return 0;
   let max = 0;
   try {
-    const entries = fs7__namespace.readdirSync(dir, { withFileTypes: true });
+    const entries = fs8__namespace.readdirSync(dir, { withFileTypes: true });
     for (const e of entries) {
       if (!e.isDirectory()) continue;
       const match = e.name.match(/^(?:chg|CHG|patch|PATCH)-(\d+)/i);
@@ -3819,10 +4083,10 @@ function extractDirMaxNum(dir) {
 }
 function getNextCorrelativeNumber(rootDir) {
   const candidateDirs = [
-    path4__namespace.join(rootDir, "specs", "changes", "active"),
-    path4__namespace.join(rootDir, "specs", "changes", "completed"),
-    path4__namespace.join(rootDir, "specs"),
-    path4__namespace.join(rootDir, "openspec", "changes")
+    path5__namespace.join(rootDir, "specs", "changes", "active"),
+    path5__namespace.join(rootDir, "specs", "changes", "completed"),
+    path5__namespace.join(rootDir, "specs"),
+    path5__namespace.join(rootDir, "openspec", "changes")
   ];
   let maxNum = 0;
   for (const dir of candidateDirs) {
@@ -3835,7 +4099,7 @@ function resolveChangeIdentifiers(rootDir, name, profile, options) {
   const targetChangeId = options.changeId || options.id;
   if (targetChangeId) {
     const rawId = targetChangeId.trim();
-    const slug = slugify(rawId);
+    const slug = slugify2(rawId);
     const canonicalId = rawId.toUpperCase();
     const match = rawId.match(/^(?:chg|CHG|patch|PATCH)-(\d+)/i);
     const padNum2 = match ? match[1] : "001";
@@ -3843,7 +4107,7 @@ function resolveChangeIdentifiers(rootDir, name, profile, options) {
   }
   const nextNum = getNextCorrelativeNumber(rootDir);
   const padNum = String(nextNum).padStart(3, "0");
-  const nameSlug = slugify(name);
+  const nameSlug = slugify2(name);
   const prefix = profile === "patch" ? "patch" : "chg";
   return {
     slug: `${prefix}-${padNum}-${nameSlug}`,
@@ -3852,13 +4116,13 @@ function resolveChangeIdentifiers(rootDir, name, profile, options) {
   };
 }
 function ensureEmptyChangeDir(changeDir) {
-  if (fs7__namespace.existsSync(changeDir)) {
-    const existing = fs7__namespace.readdirSync(changeDir);
+  if (fs8__namespace.existsSync(changeDir)) {
+    const existing = fs8__namespace.readdirSync(changeDir);
     if (existing.length > 0) {
       return `El directorio del cambio '${changeDir}' ya existe y no est\xE1 vac\xEDo.`;
     }
   } else {
-    fs7__namespace.mkdirSync(changeDir, { recursive: true });
+    fs8__namespace.mkdirSync(changeDir, { recursive: true });
   }
   return null;
 }
@@ -3867,7 +4131,7 @@ function scanCanonicalArtifacts(rootDir) {
   const artifactMap = /* @__PURE__ */ new Map();
   for (const file of allMdFiles) {
     try {
-      const content = fs7__namespace.readFileSync(file, "utf-8");
+      const content = fs8__namespace.readFileSync(file, "utf-8");
       const { frontmatter } = parseFrontmatter(content);
       if (frontmatter?.id) {
         const id = String(frontmatter.id);
@@ -4246,7 +4510,7 @@ function buildPatchSuccess(slug, canonicalId, specPath, citedArtifacts, errors)
     changeId: slug,
     canonicalId,
     profile: "patch",
-    changeDir: path4__namespace.dirname(specPath),
+    changeDir: path5__namespace.dirname(specPath),
     createdFiles: [specPath],
     citedArtifacts,
     errors
@@ -4257,10 +4521,10 @@ function scaffoldPatchChange(rootDir, changeDir, slug, canonicalId, name, inputF
   const citationsSection = citedArtifacts.length > 0 ? `citations:
 ${renderCitationsYamlBlock(citedArtifacts)}
 ` : "";
-  const specPath = path4__namespace.join(changeDir, "spec.md");
+  const specPath = path5__namespace.join(changeDir, "spec.md");
   const specFmObj = buildPatchFmObj(canonicalId);
   const specContent = buildPatchSpecContent(canonicalId, name, citationsSection);
-  fs7__namespace.writeFileSync(specPath, specContent, "utf-8");
+  fs8__namespace.writeFileSync(specPath, specContent, "utf-8");
   const errors = validatePatchArtifacts(rootDir, changeDir, specContent, specFmObj, adapter);
   return buildPatchSuccess(slug, canonicalId, specPath, citedArtifacts, errors);
 }
@@ -4271,46 +4535,46 @@ function buildGreenfieldContent(reqId, ucId, name, canonicalId, author, dateStr)
 ${body}`;
 }
 function createGreenfieldRequirement(rootDir, name, padNum, canonicalId, author, dateStr, createdFiles) {
-  const nameSlugUpper = slugify(name).toUpperCase();
+  const nameSlugUpper = slugify2(name).toUpperCase();
   const reqId = `FR-${padNum}-${nameSlugUpper}-001`;
   const ucId = `UC-${padNum}-${nameSlugUpper}`;
-  const productDir = path4__namespace.join(rootDir, "specs", "product");
-  if (!fs7__namespace.existsSync(productDir)) fs7__namespace.mkdirSync(productDir, { recursive: true });
-  const reqFilePath = path4__namespace.join(productDir, `${reqId}.md`);
-  if (fs7__namespace.existsSync(reqFilePath)) return null;
+  const productDir = path5__namespace.join(rootDir, "specs", "product");
+  if (!fs8__namespace.existsSync(productDir)) fs8__namespace.mkdirSync(productDir, { recursive: true });
+  const reqFilePath = path5__namespace.join(productDir, `${reqId}.md`);
+  if (fs8__namespace.existsSync(reqFilePath)) return null;
   const reqContent = buildGreenfieldContent(reqId, ucId, name, canonicalId, author, dateStr);
-  fs7__namespace.writeFileSync(reqFilePath, reqContent, "utf-8");
+  fs8__namespace.writeFileSync(reqFilePath, reqContent, "utf-8");
   createdFiles.push(reqFilePath);
   const digest = computeCanonicalSha256(reqContent);
   return { reqId, ucId, reqFilePath, digest };
 }
 function resolveMissingDraftDestination(rootDir, id) {
   if (id.startsWith("PRIV-REQ-")) {
-    return { dir: path4__namespace.join(rootDir, "specs", "privacy", "requirements"), type: "privacy-requirement" };
+    return { dir: path5__namespace.join(rootDir, "specs", "privacy", "requirements"), type: "privacy-requirement" };
   }
   if (id.startsWith("DATA-ASSET-")) {
-    return { dir: path4__namespace.join(rootDir, "specs", "privacy", "assets"), type: "data-asset" };
+    return { dir: path5__namespace.join(rootDir, "specs", "privacy", "assets"), type: "data-asset" };
   }
   if (id.startsWith("PRIV-ROPA-")) {
-    return { dir: path4__namespace.join(rootDir, "specs", "privacy", "ropa"), type: "privacy-ropa" };
+    return { dir: path5__namespace.join(rootDir, "specs", "privacy", "ropa"), type: "privacy-ropa" };
   }
   if (id.startsWith("UC-")) {
-    return { dir: path4__namespace.join(rootDir, "specs", "product"), type: "use-case" };
+    return { dir: path5__namespace.join(rootDir, "specs", "product"), type: "use-case" };
   }
   if (id.startsWith("SEC-REQ-") || id.startsWith("SAF-REQ-")) {
-    return { dir: path4__namespace.join(rootDir, "specs", "product"), type: "security-requirement" };
+    return { dir: path5__namespace.join(rootDir, "specs", "product"), type: "security-requirement" };
   }
-  return { dir: path4__namespace.join(rootDir, "specs", "product"), type: "requirement" };
+  return { dir: path5__namespace.join(rootDir, "specs", "product"), type: "requirement" };
 }
 function createMissingDraftRequirement(rootDir, name, id, canonicalId, createdFiles) {
   const { dir, type: reqType } = resolveMissingDraftDestination(rootDir, id);
-  if (!fs7__namespace.existsSync(dir)) fs7__namespace.mkdirSync(dir, { recursive: true });
-  const reqFilePath = path4__namespace.join(dir, `${id}.md`);
+  if (!fs8__namespace.existsSync(dir)) fs8__namespace.mkdirSync(dir, { recursive: true });
+  const reqFilePath = path5__namespace.join(dir, `${id}.md`);
   const header = MISSING_DRAFT_HEADER.replaceAll("{{ID}}", id).replaceAll("{{TYPE}}", reqType).replaceAll("{{NAME}}", name);
   const body = MISSING_DRAFT_BODY.replaceAll("{{ID}}", id).replaceAll("{{NAME}}", name).replaceAll("{{CANONICAL_ID}}", canonicalId);
   const reqContent = `${header}
 ${body}`;
-  fs7__namespace.writeFileSync(reqFilePath, reqContent, "utf-8");
+  fs8__namespace.writeFileSync(reqFilePath, reqContent, "utf-8");
   createdFiles.push(reqFilePath);
   const digest = computeCanonicalSha256(reqContent);
   return { reqFilePath, digest };
@@ -4425,7 +4689,7 @@ function initEmptyCitations() {
 }
 function ensureFallbackRequirement(col, padNum, name) {
   if (col.subRequirements.length === 0) {
-    col.subRequirements.push(`FR-${padNum}-${slugify(name).toUpperCase()}-001`);
+    col.subRequirements.push(`FR-${padNum}-${slugify2(name).toUpperCase()}-001`);
   }
 }
 function collectChangeCitations(rootDir, name, padNum, canonicalId, author, dateStr, inputFromIds, artifactMap, createdFiles) {
@@ -4439,7 +4703,7 @@ function collectChangeCitations(rootDir, name, padNum, canonicalId, author, date
   return col;
 }
 function renderProposalFile(changeDir, canonicalId, name, author, citationsYamlBlock) {
-  const proposalPath = path4__namespace.join(changeDir, "proposal.md");
+  const proposalPath = path5__namespace.join(changeDir, "proposal.md");
   const citationsSection = citationsYamlBlock ? `citations:
 ${citationsYamlBlock}
 ` : "";
@@ -4459,11 +4723,11 @@ ${name}
 ## 2. Dependencias Externas Evaluadas
 - Lista de dependencias nuevas a incorporar y verificaci\xF3n de licencia seg\xFAn \`license-policy.yaml\`.
 `;
-  fs7__namespace.writeFileSync(proposalPath, proposalContent, "utf-8");
+  fs8__namespace.writeFileSync(proposalPath, proposalContent, "utf-8");
   return proposalPath;
 }
 function renderSpecFile(changeDir, canonicalId, name, profile) {
-  const specPath = path4__namespace.join(changeDir, "spec.md");
+  const specPath = path5__namespace.join(changeDir, "spec.md");
   const specFmObj = {
     id: `SPEC-${canonicalId}`,
     type: "delivery-spec",
@@ -4484,12 +4748,12 @@ cucumber-tags:
 ---
 `;
   const body = SPEC_BODY.replaceAll("{{CANONICAL_ID}}", canonicalId).replaceAll("{{NAME}}", name);
-  fs7__namespace.writeFileSync(specPath, `${header}
+  fs8__namespace.writeFileSync(specPath, `${header}
 ${body}`, "utf-8");
   return { specPath, specFmObj };
 }
 function renderDesignFile(changeDir, canonicalId, name, author, dateStr, citationsYamlBlock) {
-  const designPath = path4__namespace.join(changeDir, "design.md");
+  const designPath = path5__namespace.join(changeDir, "design.md");
   const citationsSection = citationsYamlBlock ? `citations:
 ${citationsYamlBlock}
 ` : "";
@@ -4508,7 +4772,7 @@ contracts: []
 ${citationsSection}---
 `;
   const body = DESIGN_BODY.replaceAll("{{CANONICAL_ID}}", canonicalId).replaceAll("{{NAME}}", name).replaceAll("{{AUTHOR}}", author).replaceAll("{{DATE}}", dateStr);
-  fs7__namespace.writeFileSync(designPath, `${header}
+  fs8__namespace.writeFileSync(designPath, `${header}
 ${body}`, "utf-8");
   return designPath;
 }
@@ -4533,14 +4797,14 @@ function buildTasksFrontmatter(canonicalId, name, reqIds) {
   };
 }
 function renderTasksFile(changeDir, canonicalId, name, author, dateStr, reqIds) {
-  const tasksPath = path4__namespace.join(changeDir, "tasks.md");
+  const tasksPath = path5__namespace.join(changeDir, "tasks.md");
   const tasksFm = buildTasksFrontmatter(canonicalId, name, reqIds);
   const header = `---
 ${yaml3__default.default.dump(tasksFm, { indent: 2, lineWidth: -1 }).trim()}
 ---
 `;
   const body = TASKS_BODY.replaceAll("{{CANONICAL_ID}}", canonicalId).replaceAll("{{NAME}}", name).replaceAll("{{AUTHOR}}", author).replaceAll("{{DATE}}", dateStr);
-  fs7__namespace.writeFileSync(tasksPath, `${header}
+  fs8__namespace.writeFileSync(tasksPath, `${header}
 ${body}`, "utf-8");
   return { tasksPath, tasksFm };
 }
@@ -4719,7 +4983,7 @@ function resolveCiEnvironment(env = process.env) {
   };
 }
 function updateExistingEnvFile(filePath, envString, uppercaseKey) {
-  const content = fs7__namespace.readFileSync(filePath, "utf-8");
+  const content = fs8__namespace.readFileSync(filePath, "utf-8");
   const lines = content.split("\n");
   let found = false;
   const newLines = lines.map((line) => {
@@ -4730,15 +4994,15 @@ function updateExistingEnvFile(filePath, envString, uppercaseKey) {
     return line;
   });
   if (!found) newLines.push(envString);
-  fs7__namespace.writeFileSync(filePath, newLines.filter((l) => l.trim() !== "").join("\n") + "\n", "utf-8");
+  fs8__namespace.writeFileSync(filePath, newLines.filter((l) => l.trim() !== "").join("\n") + "\n", "utf-8");
 }
 function writeEnvOutputFile(envOutputFile, key, value) {
   const uppercaseKey = key.toUpperCase();
   const envString = `${uppercaseKey}=${value}`;
-  if (fs7__namespace.existsSync(envOutputFile)) {
+  if (fs8__namespace.existsSync(envOutputFile)) {
     updateExistingEnvFile(envOutputFile, envString, uppercaseKey);
   } else {
-    fs7__namespace.writeFileSync(envOutputFile, envString + "\n", "utf-8");
+    fs8__namespace.writeFileSync(envOutputFile, envString + "\n", "utf-8");
   }
 }
 function resolveEnvOutputFilePath(env) {
@@ -4748,8 +5012,8 @@ function resolveEnvOutputFilePath(env) {
   return void 0;
 }
 function emitCiOutput(key, value, env = process.env) {
-  if (env.GITHUB_OUTPUT && fs7__namespace.existsSync(env.GITHUB_OUTPUT)) {
-    fs7__namespace.appendFileSync(env.GITHUB_OUTPUT, `${key}=${value}
+  if (env.GITHUB_OUTPUT && fs8__namespace.existsSync(env.GITHUB_OUTPUT)) {
+    fs8__namespace.appendFileSync(env.GITHUB_OUTPUT, `${key}=${value}
 `, "utf-8");
   }
   if (env.TF_BUILD === "true") {
@@ -4791,11 +5055,11 @@ function isIgnoredEntry(name) {
   return name === "changes" || name === "active" || name === "node_modules";
 }
 function scanParentDirectoryHandoffs(parentDir, handoffsMap) {
-  if (!fs7__namespace.existsSync(parentDir)) return;
-  const entries = fs7__namespace.readdirSync(parentDir, { withFileTypes: true });
+  if (!fs8__namespace.existsSync(parentDir)) return;
+  const entries = fs8__namespace.readdirSync(parentDir, { withFileTypes: true });
   for (const entry of entries) {
     if (!entry.isDirectory() || isIgnoredEntry(entry.name)) continue;
-    const changeDir = path4__namespace.join(parentDir, entry.name);
+    const changeDir = path5__namespace.join(parentDir, entry.name);
     if (handooffsHasDir(handoffsMap, changeDir)) continue;
     const handoff = loadProductHandoffSidecar(changeDir);
     if (handoff?.id) {
@@ -4806,10 +5070,10 @@ function scanParentDirectoryHandoffs(parentDir, handoffsMap) {
 function scanAllProductHandoffs(rootDir) {
   const handoffsMap = /* @__PURE__ */ new Map();
   const candidateParentDirs = [
-    path4__namespace.join(rootDir, "specs", "changes", "active"),
-    path4__namespace.join(rootDir, "specs", "changes", "completed"),
-    path4__namespace.join(rootDir, "specs"),
-    path4__namespace.join(rootDir, "openspec", "changes")
+    path5__namespace.join(rootDir, "specs", "changes", "active"),
+    path5__namespace.join(rootDir, "specs", "changes", "completed"),
+    path5__namespace.join(rootDir, "specs"),
+    path5__namespace.join(rootDir, "openspec", "changes")
   ];
   for (const parentDir of candidateParentDirs) {
     scanParentDirectoryHandoffs(parentDir, handoffsMap);
@@ -4817,9 +5081,9 @@ function scanAllProductHandoffs(rootDir) {
   return handoffsMap;
 }
 function handooffsHasDir(map, dir) {
-  const norm = path4__namespace.resolve(dir);
+  const norm = path5__namespace.resolve(dir);
   for (const key of map.keys()) {
-    if (path4__namespace.resolve(key) === norm) return true;
+    if (path5__namespace.resolve(key) === norm) return true;
   }
   return false;
 }
@@ -4854,7 +5118,7 @@ function buildTraceabilityHeader(isOk, errors) {
   return [
     "# 360\xB0 Requirements Traceability Matrix (RTM)",
     "",
-    `*Verification Date: ${(/* @__PURE__ */ new Date()).toISOString()}*`,
+    `*Verification Date: ${resolveDeterministicDate().toISOString()}*`,
     `*Overall Status: ${isOk ? "100% TRACEABLE (PASSED)" : `ERRORS DETECTED (${errors} gaps)`}*`,
     "",
     "## 1. End-to-End Coverage (PDaC Handoff \u2794 arc42/NAF v4 \u2794 BDD/Gherkin)",
@@ -4916,9 +5180,9 @@ function isCodeTestFile(name) {
 }
 function indexFeatureFile(fullPath, rootDir, map) {
   try {
-    const content = fs7__namespace.readFileSync(fullPath, "utf-8");
+    const content = fs8__namespace.readFileSync(fullPath, "utf-8");
     const tags = extractFeatureTags(content);
-    const relFeature = path4__namespace.relative(rootDir, fullPath).replace(/\\/g, "/");
+    const relFeature = path5__namespace.relative(rootDir, fullPath).replace(/\\/g, "/");
     for (const tag of tags) {
       const existing = map.get(tag) || [];
       if (!existing.includes(relFeature)) existing.push(relFeature);
@@ -4928,11 +5192,11 @@ function indexFeatureFile(fullPath, rootDir, map) {
   }
 }
 function scanFeatureFiles(dir, rootDir, map) {
-  if (!fs7__namespace.existsSync(dir)) return;
+  if (!fs8__namespace.existsSync(dir)) return;
   try {
-    const entries = fs7__namespace.readdirSync(dir, { withFileTypes: true });
+    const entries = fs8__namespace.readdirSync(dir, { withFileTypes: true });
     for (const e of entries) {
-      const fullPath = path4__namespace.join(dir, e.name);
+      const fullPath = path5__namespace.join(dir, e.name);
       if (e.isDirectory() && !shouldSkipDir(e.name)) {
         scanFeatureFiles(fullPath, rootDir, map);
       } else if (e.name.endsWith(".feature")) {
@@ -4944,8 +5208,8 @@ function scanFeatureFiles(dir, rootDir, map) {
 }
 function indexCodeTestFile(fullPath, rootDir, reqIds, map) {
   try {
-    const content = fs7__namespace.readFileSync(fullPath, "utf-8");
-    const relTest = path4__namespace.relative(rootDir, fullPath).replace(/\\/g, "/");
+    const content = fs8__namespace.readFileSync(fullPath, "utf-8");
+    const relTest = path5__namespace.relative(rootDir, fullPath).replace(/\\/g, "/");
     for (const artId of reqIds) {
       if (content.includes(artId)) {
         const existing = map.get(artId) || [];
@@ -4957,11 +5221,11 @@ function indexCodeTestFile(fullPath, rootDir, reqIds, map) {
   }
 }
 function scanCodeTestFiles(dir, rootDir, reqIds, map) {
-  if (!fs7__namespace.existsSync(dir)) return;
+  if (!fs8__namespace.existsSync(dir)) return;
   try {
-    const entries = fs7__namespace.readdirSync(dir, { withFileTypes: true });
+    const entries = fs8__namespace.readdirSync(dir, { withFileTypes: true });
     for (const e of entries) {
-      const fullPath = path4__namespace.join(dir, e.name);
+      const fullPath = path5__namespace.join(dir, e.name);
       if (e.isDirectory() && !shouldSkipDir(e.name)) {
         scanCodeTestFiles(fullPath, rootDir, reqIds, map);
       } else if (isCodeTestFile(e.name)) {
@@ -4995,9 +5259,9 @@ function isArchitectureViewFile(relFile, frontmatter) {
 }
 function processSingleMdFile(file, rootDir, artifactMap, componentsList, architectureViews) {
   try {
-    const content = fs7__namespace.readFileSync(file, "utf-8");
+    const content = fs8__namespace.readFileSync(file, "utf-8");
     const { frontmatter, body } = parseFrontmatter(content);
-    const relFile = path4__namespace.relative(rootDir, file).replace(/\\/g, "/");
+    const relFile = path5__namespace.relative(rootDir, file).replace(/\\/g, "/");
     if (frontmatter.id) {
       artifactMap.set(frontmatter.id, {
         file: relFile,
@@ -5162,7 +5426,7 @@ function collectArchitectureViewTraces(reqId, architectureViews) {
   const traces = [];
   for (const view of architectureViews) {
     if (view.content.includes(reqId)) {
-      const viewIdentifier = isEntityWithId(view) && view.id ? view.id : path4__namespace.basename(view.file);
+      const viewIdentifier = isEntityWithId(view) && view.id ? view.id : path5__namespace.basename(view.file);
       traces.push(viewIdentifier);
     }
   }
@@ -5250,16 +5514,16 @@ function isProductionSourceFile(name) {
   return SOURCE_CODE_EXTS.some((ext) => name.endsWith(ext));
 }
 function collectCodeAndTestCorpora(dir, prodChunks = [], testChunks = []) {
-  if (!fs7__namespace.existsSync(dir)) return { prodCorpus: "", testCorpus: "" };
+  if (!fs8__namespace.existsSync(dir)) return { prodCorpus: "", testCorpus: "" };
   try {
-    for (const e of fs7__namespace.readdirSync(dir, { withFileTypes: true })) {
-      const fullPath = path4__namespace.join(dir, e.name);
+    for (const e of fs8__namespace.readdirSync(dir, { withFileTypes: true })) {
+      const fullPath = path5__namespace.join(dir, e.name);
       if (e.isDirectory() && !shouldSkipDir(e.name)) {
         collectCodeAndTestCorpora(fullPath, prodChunks, testChunks);
       } else if (isCodeTestFile(e.name) || e.name.endsWith(".feature")) {
-        testChunks.push(fs7__namespace.readFileSync(fullPath, "utf-8"));
+        testChunks.push(fs8__namespace.readFileSync(fullPath, "utf-8"));
       } else if (isProductionSourceFile(e.name)) {
-        prodChunks.push(fs7__namespace.readFileSync(fullPath, "utf-8"));
+        prodChunks.push(fs8__namespace.readFileSync(fullPath, "utf-8"));
       }
     }
   } catch {
@@ -5413,12 +5677,12 @@ function walkTaskFiles(dir, fileList = [], excludeDirs = [
   "examples"
 ]) {
   try {
-    if (!fs7__namespace.existsSync(dir)) return fileList;
-    const files = fs7__namespace.readdirSync(dir);
+    if (!fs8__namespace.existsSync(dir)) return fileList;
+    const files = fs8__namespace.readdirSync(dir).sort(canonicalSort);
     for (const file of files) {
-      const fullPath = path4__namespace.join(dir, file);
+      const fullPath = path5__namespace.join(dir, file);
       try {
-        if (fs7__namespace.statSync(fullPath).isDirectory()) {
+        if (fs8__namespace.statSync(fullPath).isDirectory()) {
           if (!excludeDirs.includes(file)) {
             walkTaskFiles(fullPath, fileList, excludeDirs);
           }
@@ -5470,7 +5734,7 @@ function generateGovernanceReportMarkdown(summaries, violationsCount, modeCounts
   const sections = [
     `# \u{1F4CB} Task Governance and Human Autonomy Classification Report
 
-> **Audit Date:** ${(/* @__PURE__ */ new Date()).toISOString()}
+> **Audit Date:** ${resolveDeterministicDate().toISOString()}
 > **Overall Verdict:** ${verdict}
 
 ---`,
@@ -5531,9 +5795,9 @@ function updateGovernanceCounts(t, modeCounts, riskCounts) {
   }
 }
 function parseTasksFromFile(file) {
-  if (!fs7__namespace.existsSync(file)) return [];
+  if (!fs8__namespace.existsSync(file)) return [];
   try {
-    const content = fs7__namespace.readFileSync(file, "utf-8");
+    const content = fs8__namespace.readFileSync(file, "utf-8");
     const { frontmatter } = parseTasksDoc(content);
     return frontmatter.tasks || [];
   } catch {
@@ -5541,11 +5805,11 @@ function parseTasksFromFile(file) {
   }
 }
 function extractDesignExpectedScope(changeDir) {
-  const designFile = path4__namespace.join(changeDir, "design.md");
-  if (!fs7__namespace.existsSync(designFile)) return [];
+  const designFile = path5__namespace.join(changeDir, "design.md");
+  if (!fs8__namespace.existsSync(designFile)) return [];
   const expected = [];
   try {
-    const { frontmatter } = parseTasksDoc(fs7__namespace.readFileSync(designFile, "utf-8"));
+    const { frontmatter } = parseTasksDoc(fs8__namespace.readFileSync(designFile, "utf-8"));
     if (typeof frontmatter["architecture-component"] === "string") {
       expected.push(frontmatter["architecture-component"]);
     }
@@ -5585,7 +5849,7 @@ function hasExplicitScopeBindings(tasks) {
   );
 }
 function auditDesignScopeForFile(file, tasks, options, unassignedList, violationsList) {
-  const changeDir = path4__namespace.dirname(file);
+  const changeDir = path5__namespace.dirname(file);
   const expectedItems = [
     ...extractDesignExpectedScope(changeDir),
     ...extractHandoffExpectedScope(changeDir, options.maxUseCasesPerChange, violationsList)
@@ -5596,13 +5860,13 @@ function auditDesignScopeForFile(file, tasks, options, unassignedList, violation
   for (const item of new Set(expectedItems)) {
     if (!covered.has(item)) {
       unassignedList.push(item);
-      violationsList.push(`[${path4__namespace.basename(changeDir)}] Unassigned design/handoff scope in tasks.md: missing task coverage for ${item}`);
+      violationsList.push(`[${path5__namespace.basename(changeDir)}] Unassigned design/handoff scope in tasks.md: missing task coverage for ${item}`);
     }
   }
 }
 function processTasksFile(file, rootDir, options, acc) {
   const tasks = parseTasksFromFile(file);
-  const relPath = path4__namespace.relative(rootDir, file).replace(/\\/g, "/");
+  const relPath = path5__namespace.relative(rootDir, file).replace(/\\/g, "/");
   let unverifiedDelta = 0;
   for (const t of tasks) {
     const { summary, violation, unverified } = evaluateTaskItem(t, relPath);
@@ -5901,11 +6165,11 @@ async function runAllExpandedScenarios(parsed, definitions) {
 }
 async function executeBddFeature(featurePath, registry, options = {}) {
   const rootDir = options.rootDir || process.cwd();
-  const fullPath = path4__namespace.isAbsolute(featurePath) ? featurePath : path4__namespace.join(rootDir, featurePath);
-  const parsed = parseFeatureDocument(fs7__namespace.readFileSync(fullPath, "utf-8"));
+  const fullPath = path5__namespace.isAbsolute(featurePath) ? featurePath : path5__namespace.join(rootDir, featurePath);
+  const parsed = parseFeatureDocument(fs8__namespace.readFileSync(fullPath, "utf-8"));
   const scenarios = await runAllExpandedScenarios(parsed, registry.getDefinitions());
   const report = {
-    uri: path4__namespace.relative(rootDir, fullPath).replace(/\\/g, "/"),
+    uri: path5__namespace.relative(rootDir, fullPath).replace(/\\/g, "/"),
     featureName: parsed.featureName,
     tags: parsed.tags,
     scenarios,
@@ -5939,10 +6203,10 @@ function mapFeatureToCucumberJson(r) {
   };
 }
 function writeCucumberJsonReport(reports, outputPath) {
-  const dir = path4__namespace.dirname(outputPath);
-  if (!fs7__namespace.existsSync(dir)) fs7__namespace.mkdirSync(dir, { recursive: true });
+  const dir = path5__namespace.dirname(outputPath);
+  if (!fs8__namespace.existsSync(dir)) fs8__namespace.mkdirSync(dir, { recursive: true });
   const payload = JSON.stringify(reports.map(mapFeatureToCucumberJson), null, 2);
-  fs7__namespace.writeFileSync(outputPath, payload, "utf-8");
+  fs8__namespace.writeFileSync(outputPath, payload, "utf-8");
 }
 function isToolAvailable(toolName) {
   try {
@@ -5988,8 +6252,8 @@ function findLicenseFile(pkgDir) {
     "license.txt"
   ];
   for (const c of candidates) {
-    const full = path4__namespace.join(pkgDir, c);
-    if (fs7__namespace.existsSync(full)) {
+    const full = path5__namespace.join(pkgDir, c);
+    if (fs8__namespace.existsSync(full)) {
       return full;
     }
   }
@@ -6006,9 +6270,9 @@ var LICENSE_FILE_PATTERNS = [
   [(t) => t.includes("Microsoft Reciprocal License") || t.includes("MS-RL"), "MS-RL"]
 ];
 function resolveLicenseFromFile(licenseFilePath) {
-  if (!licenseFilePath || !fs7__namespace.existsSync(licenseFilePath)) return void 0;
+  if (!licenseFilePath || !fs8__namespace.existsSync(licenseFilePath)) return void 0;
   try {
-    const text = fs7__namespace.readFileSync(licenseFilePath, "utf-8");
+    const text = fs8__namespace.readFileSync(licenseFilePath, "utf-8");
     for (const [matches, spdx] of LICENSE_FILE_PATTERNS) {
       if (matches(text)) return spdx;
     }
@@ -6017,16 +6281,16 @@ function resolveLicenseFromFile(licenseFilePath) {
   return void 0;
 }
 function readPackageJson(filePath) {
-  if (!fs7__namespace.existsSync(filePath)) return null;
+  if (!fs8__namespace.existsSync(filePath)) return null;
   try {
-    return JSON.parse(fs7__namespace.readFileSync(filePath, "utf-8"));
+    return JSON.parse(fs8__namespace.readFileSync(filePath, "utf-8"));
   } catch {
     return null;
   }
 }
 function extractDirectDepNames(rootDir, productionOnly) {
   const names = /* @__PURE__ */ new Set();
-  const pkgPath = path4__namespace.join(rootDir, "package.json");
+  const pkgPath = path5__namespace.join(rootDir, "package.json");
   const pkg = readPackageJson(pkgPath);
   if (!pkg) return names;
   if (pkg.dependencies && typeof pkg.dependencies === "object") {
@@ -6046,7 +6310,7 @@ function resolveSpdxForPackage(pkg, licFile) {
   return spdx;
 }
 function processPackageDir(pkgDir, directNames, seen) {
-  const pkg = readPackageJson(path4__namespace.join(pkgDir, "package.json"));
+  const pkg = readPackageJson(path5__namespace.join(pkgDir, "package.json"));
   if (!pkg?.name || !pkg.version) return;
   const key = `${pkg.name}@${pkg.version}`;
   if (seen.has(key)) return;
@@ -6067,40 +6331,40 @@ function processPackageDir(pkgDir, directNames, seen) {
   });
 }
 function scanScopeSubdirectory(scopeDir, directNames, seen) {
-  const scopedEntries = fs7__namespace.readdirSync(scopeDir, { withFileTypes: true });
+  const scopedEntries = fs8__namespace.readdirSync(scopeDir, { withFileTypes: true });
   for (const scoped of scopedEntries) {
     if (scoped.isDirectory()) {
-      processPackageDir(path4__namespace.join(scopeDir, scoped.name), directNames, seen);
+      processPackageDir(path5__namespace.join(scopeDir, scoped.name), directNames, seen);
     }
   }
 }
 function scanSubdirectories(baseDir, directNames, seen) {
-  if (!fs7__namespace.existsSync(baseDir)) return;
-  const entries = fs7__namespace.readdirSync(baseDir, { withFileTypes: true });
+  if (!fs8__namespace.existsSync(baseDir)) return;
+  const entries = fs8__namespace.readdirSync(baseDir, { withFileTypes: true });
   for (const entry of entries) {
     if (!entry.isDirectory()) continue;
     if (entry.name.startsWith("@")) {
-      scanScopeSubdirectory(path4__namespace.join(baseDir, entry.name), directNames, seen);
+      scanScopeSubdirectory(path5__namespace.join(baseDir, entry.name), directNames, seen);
     } else if (entry.name !== ".bin" && entry.name !== ".pnpm") {
-      processPackageDir(path4__namespace.join(baseDir, entry.name), directNames, seen);
+      processPackageDir(path5__namespace.join(baseDir, entry.name), directNames, seen);
     }
   }
 }
 function scanPnpmStore(pnpmDir, directNames, seen) {
-  if (!fs7__namespace.existsSync(pnpmDir)) return;
-  const entries = fs7__namespace.readdirSync(pnpmDir, { withFileTypes: true });
+  if (!fs8__namespace.existsSync(pnpmDir)) return;
+  const entries = fs8__namespace.readdirSync(pnpmDir, { withFileTypes: true });
   for (const entry of entries) {
     if (!entry.isDirectory()) continue;
-    const candidateModules = path4__namespace.join(pnpmDir, entry.name, "node_modules");
-    if (fs7__namespace.existsSync(candidateModules)) {
+    const candidateModules = path5__namespace.join(pnpmDir, entry.name, "node_modules");
+    if (fs8__namespace.existsSync(candidateModules)) {
       scanSubdirectories(candidateModules, directNames, seen);
     }
   }
 }
 function readTextIfExists(filePath) {
-  if (!fs7__namespace.existsSync(filePath)) return null;
+  if (!fs8__namespace.existsSync(filePath)) return null;
   try {
-    return fs7__namespace.readFileSync(filePath, "utf-8");
+    return fs8__namespace.readFileSync(filePath, "utf-8");
   } catch {
     return null;
   }
@@ -6160,14 +6424,14 @@ function parsePipfileSection(pkgs, isDirect, lockPath, seen) {
   }
 }
 function scanPythonDependencies(rootDir, seen) {
-  const pyproject = readTextIfExists(path4__namespace.join(rootDir, "pyproject.toml")) || "";
+  const pyproject = readTextIfExists(path5__namespace.join(rootDir, "pyproject.toml")) || "";
   const directNames = extractPyprojectDirectDeps(pyproject);
   for (const lockName of ["poetry.lock", "uv.lock"]) {
-    const lockPath = path4__namespace.join(rootDir, lockName);
+    const lockPath = path5__namespace.join(rootDir, lockName);
     const content = readTextIfExists(lockPath);
     if (content) parseTomlPackageBlocks(content, lockPath, directNames, seen);
   }
-  const pipfileLockPath = path4__namespace.join(rootDir, "Pipfile.lock");
+  const pipfileLockPath = path5__namespace.join(rootDir, "Pipfile.lock");
   const pipfileRaw = readTextIfExists(pipfileLockPath);
   if (!pipfileRaw) return;
   try {
@@ -6210,7 +6474,7 @@ function extractGoCandidateLines(content) {
   return out;
 }
 function scanGoDependencies(rootDir, seen) {
-  const goModPath = path4__namespace.join(rootDir, "go.mod");
+  const goModPath = path5__namespace.join(rootDir, "go.mod");
   const content = readTextIfExists(goModPath);
   if (!content) return;
   for (const line of extractGoCandidateLines(content)) {
@@ -6253,10 +6517,10 @@ function parseCargoLockBlock(block, rootName, directMeta, cargoLockPath) {
   };
 }
 function scanRustDependencies(rootDir, seen) {
-  const cargoLockPath = path4__namespace.join(rootDir, "Cargo.lock");
+  const cargoLockPath = path5__namespace.join(rootDir, "Cargo.lock");
   const lockContent = readTextIfExists(cargoLockPath);
   if (!lockContent) return;
-  const cargoToml = readTextIfExists(path4__namespace.join(rootDir, "Cargo.toml")) || "";
+  const cargoToml = readTextIfExists(path5__namespace.join(rootDir, "Cargo.toml")) || "";
   const directMeta = extractCargoDirectDeps(cargoToml);
   const rootName = extractTomlField(cargoToml, "name");
   for (const block of lockContent.split(/\[\[package\]\]/g).slice(1)) {
@@ -6292,7 +6556,7 @@ function parseMavenDepBlock(block, defaultLic, pomPath) {
   };
 }
 function scanMavenDependencies(rootDir, seen) {
-  const pomPath = path4__namespace.join(rootDir, "pom.xml");
+  const pomPath = path5__namespace.join(rootDir, "pom.xml");
   const content = readTextIfExists(pomPath);
   if (!content) return;
   const projectLicBlock = content.match(/<licenses>([\s\S]*?)<\/licenses>/)?.[1] || "";
@@ -6308,11 +6572,11 @@ function scanMavenDependencies(rootDir, seen) {
 function scanWithNativeFs(rootDir, options = {}) {
   const directNames = extractDirectDepNames(rootDir, options.productionOnly);
   const seen = /* @__PURE__ */ new Map();
-  const nmDir = path4__namespace.join(rootDir, "node_modules");
-  if (fs7__namespace.existsSync(nmDir)) {
+  const nmDir = path5__namespace.join(rootDir, "node_modules");
+  if (fs8__namespace.existsSync(nmDir)) {
     scanSubdirectories(nmDir, directNames, seen);
     if (options.depth !== "direct") {
-      scanPnpmStore(path4__namespace.join(nmDir, ".pnpm"), directNames, seen);
+      scanPnpmStore(path5__namespace.join(nmDir, ".pnpm"), directNames, seen);
     }
   }
   scanPythonDependencies(rootDir, seen);
@@ -6571,20 +6835,20 @@ function resolveProjectIdentity(options) {
   let name = options.projectName || "ai-sdlc-project";
   let version = options.projectVersion || "1.0.0";
   if (!options.rootDir) return { name, version };
-  const pkgPath = path4__namespace.join(options.rootDir, "package.json");
-  if (!fs7__namespace.existsSync(pkgPath)) return { name, version };
+  const pkgPath = path5__namespace.join(options.rootDir, "package.json");
+  if (!fs8__namespace.existsSync(pkgPath)) return { name, version };
   try {
-    const pkg = JSON.parse(fs7__namespace.readFileSync(pkgPath, "utf-8"));
+    const pkg = JSON.parse(fs8__namespace.readFileSync(pkgPath, "utf-8"));
     if (pkg.name) name = pkg.name;
     if (pkg.version) version = pkg.version;
   } catch {
   }
   return { name, version };
 }
-function buildBomMetadata(name, version) {
+function buildBomMetadata(name, version, rootDir) {
   return {
-    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-    tools: [{ vendor: "AI-SDLC", name: "@aisdlc/core", version: "2.4.0" }],
+    timestamp: resolveDeterministicDate(rootDir).toISOString(),
+    tools: [{ vendor: "AI-SDLC", name: "@aisdlc/core", version: "2.5.0" }],
     component: { type: "application", name, version }
   };
 }
@@ -6595,52 +6859,21 @@ function generateCycloneDxSbom(dependencies, options = {}) {
     bomFormat: "CycloneDX",
     specVersion: "1.5",
     version: 1,
-    serialNumber: `urn:uuid:${crypto__namespace.randomUUID()}`,
-    metadata: buildBomMetadata(name, version),
+    serialNumber: `urn:uuid:${generateDeterministicUuidV5(`${name}@${version}|${dependencies.map((d) => `${d.name}@${d.version}:${d.purl || ""}`).sort(canonicalSort).join(";")}`)}`,
+    metadata: buildBomMetadata(name, version, options.rootDir),
     components: dependencies.map(buildCycloneDxComponent),
     ...cdxVulns.length > 0 ? { vulnerabilities: cdxVulns } : {}
   };
 }
-function tryAtomicWrite(filePath, content) {
-  const tempPath = `${filePath}.${process.pid}.${Math.random().toString(36).substring(2)}.tmp`;
-  try {
-    fs7__namespace.writeFileSync(tempPath, content, "utf-8");
-    try {
-      if (fs7__namespace.existsSync(filePath)) {
-        fs7__namespace.rmSync(filePath, { force: true });
-      }
-      fs7__namespace.renameSync(tempPath, filePath);
-    } catch {
-      fs7__namespace.copyFileSync(tempPath, filePath);
-      fs7__namespace.unlinkSync(tempPath);
-    }
-    return true;
-  } catch {
-    return false;
-  }
-}
-function safeWriteFileSync(filePath, content) {
-  const dir = path4__namespace.dirname(filePath);
-  if (!fs7__namespace.existsSync(dir)) {
-    fs7__namespace.mkdirSync(dir, { recursive: true });
-  }
-  for (let attempt = 0; attempt < 10; attempt++) {
-    if (tryAtomicWrite(filePath, content)) return;
-  }
-  try {
-    fs7__namespace.writeFileSync(filePath, content, "utf-8");
-  } catch {
-  }
-}
 function writeCycloneDxSbom(sbom, outputPath) {
-  safeWriteFileSync(outputPath, JSON.stringify(sbom, null, 2));
+  writeReportFileIfChanged(outputPath, JSON.stringify(sbom, null, 2));
 }
 function buildThirdPartyHeader(projectName, count) {
   return [
     `# \u{1F4DC} Third-Party Software Notices and Information`,
     ``,
     `> **Proyecto:** ${projectName}`,
-    `> **Fecha:** ${(/* @__PURE__ */ new Date()).toISOString().split("T")[0]}`,
+    `> **Fecha:** ${resolveDeterministicDate().toISOString().split("T")[0]}`,
     `> **Total Componentes:** ${count}`,
     ``,
     `Este documento contiene los avisos de copyright y t\xE9rminos de licencia aplicables a los componentes de terceros utilizados en este proyecto.`,
@@ -6654,9 +6887,9 @@ function buildThirdPartyHeader(projectName, count) {
   ];
 }
 function readLicenseTextPreview(licenseFile) {
-  if (!licenseFile || !fs7__namespace.existsSync(licenseFile)) return null;
+  if (!licenseFile || !fs8__namespace.existsSync(licenseFile)) return null;
   try {
-    const text = fs7__namespace.readFileSync(licenseFile, "utf-8").trim();
+    const text = fs8__namespace.readFileSync(licenseFile, "utf-8").trim();
     return text.slice(0, 1e3) + (text.length > 1e3 ? "\n... (texto truncado)" : "");
   } catch {
     return null;
@@ -6688,13 +6921,13 @@ function generateThirdPartyNotices(dependencies, projectName = "AI-SDLC") {
     "",
     "---",
     "",
-    "## Textos de Licencia y Atribuciones",
+    "## 2. Atribuciones y T\xE9rminos de Licencia Individuales",
     "",
     ...attributions
   ].join("\n");
 }
-function writeThirdPartyNotices(content, outputPath) {
-  safeWriteFileSync(outputPath, content);
+function writeThirdPartyNotices(noticesContent, outputPath) {
+  writeReportFileIfChanged(outputPath, noticesContent);
 }
 
 // src/verifiers/licenses.ts
@@ -6771,22 +7004,20 @@ function parseVexStatements(doc) {
   if (!Array.isArray(rawList)) return [];
   return rawList.filter((item) => Boolean(item && typeof item.id === "string" && typeof item.state === "string"));
 }
-function parseLicensePolicy(content) {
+function parseLicenseDoc(content) {
+  let doc;
   try {
-    const doc = yaml3__default.default.load(content);
-    const { permitted, restricted, blocked } = classifyCategories(doc?.categories);
-    const exception_packages = parseExceptions(doc?.exceptions);
-    const vex_statements = parseVexStatements(doc);
-    return {
-      version: doc?.version || "1.0",
-      permitted: permitted.length > 0 ? permitted : DEFAULT_PERMITTED,
-      restricted: restricted.length > 0 ? restricted : DEFAULT_RESTRICTED,
-      blocked: blocked.length > 0 ? blocked : DEFAULT_BLOCKED,
-      exception_packages,
-      vex_statements,
-      rawPolicy: doc
-    };
-  } catch {
+    doc = yaml3__default.default.load(content);
+  } catch (err) {
+    throw new Error(`[AI-SDLC Fail-Closed] Invalid YAML in license-policy: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  if (!doc || typeof doc !== "object" || Array.isArray(doc)) {
+    throw new Error(`[AI-SDLC Fail-Closed] Invalid license policy structure: root must be a YAML mapping`);
+  }
+  return doc;
+}
+function parseLicensePolicy(content) {
+  if (!content || !content.trim()) {
     return {
       version: "1.0",
       permitted: DEFAULT_PERMITTED,
@@ -6796,6 +7027,17 @@ function parseLicensePolicy(content) {
       vex_statements: []
     };
   }
+  const doc = parseLicenseDoc(content);
+  const { permitted, restricted, blocked } = classifyCategories(doc?.categories);
+  return {
+    version: doc?.version || "1.0",
+    permitted: permitted.length > 0 ? permitted : DEFAULT_PERMITTED,
+    restricted: restricted.length > 0 ? restricted : DEFAULT_RESTRICTED,
+    blocked: blocked.length > 0 ? blocked : DEFAULT_BLOCKED,
+    exception_packages: parseExceptions(doc?.exceptions),
+    vex_statements: parseVexStatements(doc),
+    rawPolicy: doc
+  };
 }
 function evaluateCompoundLicense(lic, policy) {
   const cleanLic = lic.replace(/[()]/g, "").trim();
@@ -6887,7 +7129,7 @@ function buildReportHeader(isOk, depCount, violationCount, sbomPath) {
   return [
     `# \u{1F4DC} Open Source License Compliance Audit (Dynamic SCA)`,
     ``,
-    `> **Verification Date:** ${(/* @__PURE__ */ new Date()).toISOString()}`,
+    `> **Verification Date:** ${resolveDeterministicDate().toISOString()}`,
     `> **Status:** ${statusStr}`,
     `> **Total Audited Dependencies:** ${depCount}`,
     sbomPath ? `> **Generated CycloneDX SBOM:** \`${sbomPath}\`` : "",
@@ -6912,9 +7154,9 @@ function generateLicenseReportMarkdown(dependencies, violations, policy, sbomPat
   return lines.filter(Boolean).join("\n");
 }
 function parseManifestItems(manifestFile) {
-  if (!fs7__namespace.existsSync(manifestFile)) return [];
+  if (!fs8__namespace.existsSync(manifestFile)) return [];
   try {
-    const doc = yaml3__default.default.load(fs7__namespace.readFileSync(manifestFile, "utf-8"));
+    const doc = yaml3__default.default.load(fs8__namespace.readFileSync(manifestFile, "utf-8"));
     return Array.isArray(doc?.evaluated_dependencies) ? doc.evaluated_dependencies : [];
   } catch {
     return [];
@@ -6946,10 +7188,10 @@ function verifyStaticManifest(manifestFile, policy) {
 function resolveManifestPath(rootDir, customPath) {
   if (customPath) return customPath;
   const candidates = [
-    path4__namespace.join(rootDir, "compliance", "license-manifest.yaml"),
-    path4__namespace.join(rootDir, "license-manifest.yaml")
+    path5__namespace.join(rootDir, "compliance", "license-manifest.yaml"),
+    path5__namespace.join(rootDir, "license-manifest.yaml")
   ];
-  return candidates.find((p) => fs7__namespace.existsSync(p)) || candidates[0];
+  return candidates.find((p) => fs8__namespace.existsSync(p)) || candidates[0];
 }
 function handleStaticManifestVerification(options, rootDir, policy) {
   const manifestFile = resolveManifestPath(rootDir, options.manifestPath);
@@ -6970,7 +7212,7 @@ function shouldGenerateSbom(options, rawPolicy) {
 }
 function maybeGenerateSbom(options, rootDir, rawPolicy, dependencies, vulnerabilities, vexStatements) {
   if (!shouldGenerateSbom(options, rawPolicy)) return void 0;
-  const sbomPath = options.sbomPath || path4__namespace.join(rootDir, "reports", "sbom.cdx.json");
+  const sbomPath = options.sbomPath || path5__namespace.join(rootDir, "reports", "sbom.cdx.json");
   const sbom = generateCycloneDxSbom(dependencies, { rootDir, vulnerabilities, vexStatements });
   writeCycloneDxSbom(sbom, sbomPath);
   return sbomPath;
@@ -6979,7 +7221,7 @@ function maybeGenerateNotices(options, rootDir, rawPolicy, dependencies) {
   const shouldGen = options.generateNotices === true || Boolean(options.noticesPath || rawPolicy?.ci_gates?.output_notices_file);
   if (!shouldGen) return void 0;
   const noticesFileName = rawPolicy?.ci_gates?.output_notices_file || "THIRD_PARTY_NOTICES.md";
-  const noticesPath = options.noticesPath || path4__namespace.join(rootDir, noticesFileName);
+  const noticesPath = options.noticesPath || path5__namespace.join(rootDir, noticesFileName);
   const noticesContent = generateThirdPartyNotices(dependencies);
   writeThirdPartyNotices(noticesContent, noticesPath);
   return noticesPath;
@@ -6991,8 +7233,8 @@ function handleDynamicScaArtifacts(options, rootDir, rawPolicy, dependencies, vu
   };
 }
 function loadLicensePolicy(rootDir, customPath) {
-  const policyFile = customPath || path4__namespace.join(rootDir, "license-policy.yaml");
-  return fs7__namespace.existsSync(policyFile) ? parseLicensePolicy(fs7__namespace.readFileSync(policyFile, "utf-8")) : parseLicensePolicy("");
+  const policyFile = customPath || path5__namespace.join(rootDir, "license-policy.yaml");
+  return fs8__namespace.existsSync(policyFile) ? parseLicensePolicy(fs8__namespace.readFileSync(policyFile, "utf-8")) : parseLicensePolicy("");
 }
 function evaluateDependencyList(dependencies, policy) {
   const violations = [];
@@ -7096,11 +7338,11 @@ var PROTECTED_BYPASS_PATTERNS = [
   /migrations?[\\/]/i
 ];
 function detectProfileFromChange(changeDir) {
-  if (!fs7__namespace.existsSync(changeDir)) return "standard";
-  const specFile = path4__namespace.join(changeDir, "spec.md");
-  if (fs7__namespace.existsSync(specFile)) {
+  if (!fs8__namespace.existsSync(changeDir)) return "standard";
+  const specFile = path5__namespace.join(changeDir, "spec.md");
+  if (fs8__namespace.existsSync(specFile)) {
     try {
-      const rawSpec = fs7__namespace.readFileSync(specFile, "utf-8").replace(/^\uFEFF/, "");
+      const rawSpec = fs8__namespace.readFileSync(specFile, "utf-8").replace(/^\uFEFF/, "");
       const match = rawSpec.match(/^---\r?\n([\s\S]*?)\r?\n---/);
       if (match) {
         const parsedFm = yaml3__default.default.load(match[1]);
@@ -7118,24 +7360,29 @@ function isPathProtectedFromPatch(filePath) {
   return PROTECTED_BYPASS_PATTERNS.some((pattern) => pattern.test(normalized));
 }
 function detectBranchChangeMatch(rootDir, dirs) {
-  if (!fs7__namespace.existsSync(path4__namespace.join(rootDir, ".git"))) return void 0;
-  try {
-    const branch = child_process.execFileSync("git", ["branch", "--show-current"], {
-      cwd: rootDir,
-      encoding: "utf-8",
-      stdio: ["pipe", "pipe", "ignore"]
-    }).trim().toLowerCase();
-    if (!branch) return void 0;
-    return dirs.find((d) => branch.includes(path4__namespace.basename(d).toLowerCase()));
-  } catch {
-    return void 0;
+  let branch = "";
+  if (fs8__namespace.existsSync(path5__namespace.join(rootDir, ".git"))) {
+    try {
+      branch = child_process.execFileSync("git", ["branch", "--show-current"], {
+        cwd: rootDir,
+        encoding: "utf-8",
+        stdio: ["pipe", "pipe", "ignore"]
+      }).trim().toLowerCase();
+    } catch {
+    }
+  }
+  if (!branch) {
+    const ciBranch = (process.env.GITHUB_HEAD_REF || process.env.GITHUB_REF_NAME || process.env.CI_COMMIT_REF_NAME || process.env.BRANCH_NAME || "").toLowerCase();
+    branch = ciBranch;
   }
+  if (!branch) return void 0;
+  return dirs.find((d) => branch.includes(path5__namespace.basename(d).toLowerCase()));
 }
 function resolveActiveChangeDir(rootDir) {
-  const activeRoot = path4__namespace.join(rootDir, "specs", "changes", "active");
-  if (!fs7__namespace.existsSync(activeRoot)) return void 0;
+  const activeRoot = path5__namespace.join(rootDir, "specs", "changes", "active");
+  if (!fs8__namespace.existsSync(activeRoot)) return void 0;
   try {
-    const dirs = fs7__namespace.readdirSync(activeRoot, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => path4__namespace.join(activeRoot, d.name));
+    const dirs = fs8__namespace.readdirSync(activeRoot, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => path5__namespace.join(activeRoot, d.name)).sort((a, b) => canonicalSort(a, b));
     const branchMatch = detectBranchChangeMatch(rootDir, dirs);
     if (branchMatch) return branchMatch;
     return dirs.find((d) => detectProfileFromChange(d) === "patch") || dirs[0];
@@ -7143,8 +7390,12 @@ function resolveActiveChangeDir(rootDir) {
     return void 0;
   }
 }
+function isEphemeralOrIgnored(file) {
+  const norm = file.replace(/\\/g, "/");
+  return norm.startsWith("scratch/") || norm.startsWith("reports/") || norm.startsWith("coverage/") || norm.startsWith("dist/") || norm.startsWith("temp/") || norm.startsWith("tmp/");
+}
 function detectGitDiffFiles(rootDir) {
-  if (!fs7__namespace.existsSync(path4__namespace.join(rootDir, ".git"))) return [];
+  if (!fs8__namespace.existsSync(path5__namespace.join(rootDir, ".git"))) return [];
   try {
     const tracked = child_process.execFileSync("git", ["diff", "--name-only", "HEAD"], {
       cwd: rootDir,
@@ -7157,7 +7408,7 @@ function detectGitDiffFiles(rootDir) {
       stdio: ["pipe", "pipe", "ignore"]
     });
     const combined = `${tracked}
-${untracked}`.split(/\r?\n/).map((f) => f.trim()).filter(Boolean);
+${untracked}`.split(/\r?\n/).map((f) => f.trim()).filter((f) => Boolean(f) && !isEphemeralOrIgnored(f));
     return Array.from(new Set(combined));
   } catch {
     return [];
@@ -7167,19 +7418,19 @@ function resolveChangeDirectory(rootDir, options) {
   if (options.changeDir) return options.changeDir;
   if (options.changeId) {
     const candidates = [
-      path4__namespace.join(rootDir, "specs", options.changeId),
-      path4__namespace.join(rootDir, "specs", "changes", "active", options.changeId),
-      path4__namespace.join(rootDir, "examples", "specs", options.changeId),
-      path4__namespace.join(rootDir, "specs", "changes", "completed", options.changeId)
+      path5__namespace.join(rootDir, "specs", options.changeId),
+      path5__namespace.join(rootDir, "specs", "changes", "active", options.changeId),
+      path5__namespace.join(rootDir, "examples", "specs", options.changeId),
+      path5__namespace.join(rootDir, "specs", "changes", "completed", options.changeId)
     ];
-    return candidates.find((c) => fs7__namespace.existsSync(c));
+    return candidates.find((c) => fs8__namespace.existsSync(c));
   }
   return resolveActiveChangeDir(rootDir);
 }
 function collectPatchViolations(rootDir, modifiedFiles) {
   const violations = [];
   for (const rawFile of modifiedFiles) {
-    const relPath = path4__namespace.isAbsolute(rawFile) ? path4__namespace.relative(rootDir, rawFile) : rawFile;
+    const relPath = path5__namespace.isAbsolute(rawFile) ? path5__namespace.relative(rootDir, rawFile) : rawFile;
     if (isPathProtectedFromPatch(relPath)) {
       violations.push(
         `[ANTI-PATCH-BYPASS] File '${relPath}' is a protected path (security, schemas, architectural decisions, or master policies). Changes with 'patch' profile are strictly prohibited from modifying these paths. Must be reclassified to 'standard' or 'critical'.`
@@ -7192,7 +7443,7 @@ function buildFrictionHeader(profile, success, fileCount) {
   return [
     `# \u{1F6E1}\uFE0F Progressive Friction and Anti-Bypass Verification Report`,
     ``,
-    `> **Date:** ${(/* @__PURE__ */ new Date()).toISOString()}`,
+    `> **Date:** ${resolveDeterministicDate().toISOString()}`,
     `> **Evaluated Profile:** \`${profile.toUpperCase()}\``,
     `> **Verdict:** ${success ? "COMPLIANT \u2705" : "BLOCKED \u274C"}`,
     ``,
@@ -7285,13 +7536,13 @@ function extractManualMetadata(fm, id, manualType, relPath, body) {
 }
 function buildManualItem(rootDir, filePath) {
   try {
-    const raw = fs7__namespace.readFileSync(filePath, "utf-8");
+    const raw = fs8__namespace.readFileSync(filePath, "utf-8");
     const { fm, body } = parseMdFrontmatter(raw);
     const id = typeof fm.id === "string" ? fm.id.trim() : "";
     const rawType = typeof fm.type === "string" ? fm.type.trim() : "";
     const manualType = resolveManualType(id, rawType);
     if (!id || !manualType) return null;
-    const relPath = path4__namespace.relative(rootDir, filePath).replace(/\\/g, "/");
+    const relPath = path5__namespace.relative(rootDir, filePath).replace(/\\/g, "/");
     return extractManualMetadata(fm, id, manualType, relPath, body);
   } catch {
     return null;
@@ -7302,8 +7553,8 @@ function scanManualsInWorkspace(rootDir) {
   const seenIds = /* @__PURE__ */ new Set();
   const items = [];
   for (const relDir of manualDirs) {
-    const fullDir = path4__namespace.join(rootDir, relDir);
-    if (!fs7__namespace.existsSync(fullDir)) continue;
+    const fullDir = path5__namespace.join(rootDir, relDir);
+    if (!fs8__namespace.existsSync(fullDir)) continue;
     for (const file of walkMdFiles(fullDir)) {
       const item = buildManualItem(rootDir, file);
       if (item && !seenIds.has(item.id)) {
@@ -7326,10 +7577,10 @@ function classifyBaselineId(id, type, buckets) {
   }
 }
 function processBaselineFile(file, rootDir, buckets) {
-  const rel = path4__namespace.relative(rootDir, file).replace(/\\/g, "/");
+  const rel = path5__namespace.relative(rootDir, file).replace(/\\/g, "/");
   if (rel.includes("/changes/") || rel.startsWith("changes/")) return;
   try {
-    const { fm } = parseMdFrontmatter(fs7__namespace.readFileSync(file, "utf-8"));
+    const { fm } = parseMdFrontmatter(fs8__namespace.readFileSync(file, "utf-8"));
     const id = typeof fm.id === "string" ? fm.id.trim() : "";
     const status = typeof fm.status === "string" ? fm.status.trim().toLowerCase() : "active";
     if (!id || status === "retired" || status === "deprecated") return;
@@ -7350,8 +7601,8 @@ function collectBaselineTargets(rootDir) {
     enclaves: /* @__PURE__ */ new Set()
   };
   for (const dir of ["product", "architecture", "security", "specs"]) {
-    const fullDir = path4__namespace.join(rootDir, dir);
-    if (fs7__namespace.existsSync(fullDir)) {
+    const fullDir = path5__namespace.join(rootDir, dir);
+    if (fs8__namespace.existsSync(fullDir)) {
       scanDirectoryForBaseline(rootDir, fullDir, buckets);
     }
   }
@@ -7408,10 +7659,10 @@ function detectCurrentGitBranch(rootDir) {
   }
 }
 function resolveActiveChangeProfile(rootDir) {
-  const activeRoot = path4__namespace.join(rootDir, "specs", "changes", "active");
-  if (!fs7__namespace.existsSync(activeRoot)) return "standard";
+  const activeRoot = path5__namespace.join(rootDir, "specs", "changes", "active");
+  if (!fs8__namespace.existsSync(activeRoot)) return "standard";
   try {
-    const dirs = fs7__namespace.readdirSync(activeRoot, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => path4__namespace.join(activeRoot, d.name));
+    const dirs = fs8__namespace.readdirSync(activeRoot, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => path5__namespace.join(activeRoot, d.name));
     const profiles = dirs.map((d) => detectProfileFromChange(d));
     if (profiles.includes("critical")) return "critical";
     if (profiles.includes("patch") && profiles.length === 1) return "patch";
@@ -7548,7 +7799,7 @@ var REQ_TYPES = /* @__PURE__ */ new Set(["requirement", "security-requirement",
 var REQ_CATEGORIES = /* @__PURE__ */ new Set(["functional", "quality", "constraint", "security", "safety"]);
 function computeSha256(content) {
   const normalized = content.replace(/\r\n/g, "\n");
-  return crypto__namespace.createHash("sha256").update(normalized, "utf-8").digest("hex");
+  return crypto3__namespace.createHash("sha256").update(normalized, "utf-8").digest("hex");
 }
 function tokenizeTitle(title) {
   const words = title.toLowerCase().normalize("NFD").replace(/[\u0300-\u036f]/g, "").replace(/[^a-z0-9\s]/g, " ").split(/\s+/).filter((w) => w.length > 2 && !STOP_WORDS.has(w));
@@ -7624,11 +7875,11 @@ function buildRequirementObject(content, fm, body, filePath, relFile) {
 }
 function parseRequirementFile(filePath, rootDir) {
   try {
-    const content = fs7__namespace.readFileSync(filePath, "utf-8");
+    const content = fs8__namespace.readFileSync(filePath, "utf-8");
     const extracted = extractParsedFrontmatter(content);
     if (!extracted) return null;
     const body = content.substring(extracted.matchLen);
-    const relFile = path4__namespace.relative(rootDir, filePath).replace(/\\/g, "/");
+    const relFile = path5__namespace.relative(rootDir, filePath).replace(/\\/g, "/");
     return buildRequirementObject(content, extracted.fm, body, filePath, relFile);
   } catch {
     return null;
@@ -7640,7 +7891,7 @@ function isIgnoredScanPath(relFile) {
 function collectRequirements(rootDir) {
   const reqs = [];
   for (const file of walkMdFiles(rootDir)) {
-    const relFile = path4__namespace.relative(rootDir, file).replace(/\\/g, "/");
+    const relFile = path5__namespace.relative(rootDir, file).replace(/\\/g, "/");
     if (isIgnoredScanPath(relFile)) continue;
     const req = parseRequirementFile(file, rootDir);
     if (req) reqs.push(req);
@@ -7774,7 +8025,7 @@ function buildDuplicatesHeader(result) {
   return [
     `# \u{1F6E1}\uFE0F Duplicate Requirements and Redundancy Audit (Shift-Left Pre-Flight)`,
     ``,
-    `> **Evaluation Date:** ${(/* @__PURE__ */ new Date()).toISOString()}`,
+    `> **Evaluation Date:** ${resolveDeterministicDate().toISOString()}`,
     `> **Verdict:** ${isOk ? "\u2705 COMPLIANT (No blocking duplicates)" : `\u274C BLOCKED (${result.errorCount} duplicate errors detected)`}`,
     `> **Audited Requirements:** ${result.totalRequirements} | **Errors:** ${result.errorCount} | **Warnings:** ${result.warningCount}`,
     ``,
@@ -7897,7 +8148,7 @@ function buildAuditHeader(total, active, expired, invalid) {
   return [
     "# \u{1F4CB} Security Suppressions and Audit Exceptions Inventory",
     "",
-    `> **Generated at:** ${(/* @__PURE__ */ new Date()).toISOString()}`,
+    `> **Generated at:** ${resolveDeterministicDate().toISOString()}`,
     `> **Total Audited Suppressions:** ${total} | **Active:** ${active} | **Expired:** ${expired} | **Invalid:** ${invalid}`,
     "",
     "## 1. Executive Summary",
@@ -8128,10 +8379,10 @@ function isPathExcluded2(relPath, patterns) {
 function walkProjectFiles(dir, rootDir, excludedPatterns = DEFAULT_EXCLUDED_PATTERNS) {
   const results = [];
   try {
-    const entries = fs7__namespace.readdirSync(dir, { withFileTypes: true });
+    const entries = fs8__namespace.readdirSync(dir, { withFileTypes: true }).sort((a, b) => canonicalSort(a.name, b.name));
     for (const entry of entries) {
-      const fullPath = path4__namespace.join(dir, entry.name);
-      const relPath = path4__namespace.relative(rootDir, fullPath).replace(/\\/g, "/");
+      const fullPath = path5__namespace.join(dir, entry.name);
+      const relPath = path5__namespace.relative(rootDir, fullPath).replace(/\\/g, "/");
       if (isPathExcluded2(relPath, excludedPatterns)) continue;
       if (entry.isDirectory()) {
         results.push(...walkProjectFiles(fullPath, rootDir, excludedPatterns));
@@ -8160,8 +8411,8 @@ function pickFirstString(...vals) {
 }
 function parseGitleaksItem(item, rootDir) {
   const rawFile = pickFirstString(item.File, item.file);
-  const filePath = path4__namespace.resolve(rootDir, rawFile);
-  const relPath = path4__namespace.relative(rootDir, filePath).replace(/\\/g, "/");
+  const filePath = path5__namespace.resolve(rootDir, rawFile);
+  const relPath = path5__namespace.relative(rootDir, filePath).replace(/\\/g, "/");
   const ruleId = pickFirstString(item.RuleID, item.ruleID) || "GITLEAKS-MATCH";
   const rawSecret = pickFirstString(item.Secret, item.secret, item.Match);
   const line = item.StartLine ?? item.line ?? 1;
@@ -8234,7 +8485,7 @@ function scanLineForSecrets(line, lineNumber, filePath, relPath, entropyThreshol
 function scanContentForSecrets(content, filePath, rootDir, entropyThreshold = 4.3, collectedSuppressions) {
   const violations = [];
   const lines = content.split(/\r?\n/);
-  const relPath = path4__namespace.relative(rootDir, filePath).replace(/\\/g, "/");
+  const relPath = path5__namespace.relative(rootDir, filePath).replace(/\\/g, "/");
   for (let i = 0; i < lines.length; i++) {
     violations.push(...scanLineForSecrets(lines[i], i + 1, filePath, relPath, entropyThreshold, collectedSuppressions));
   }
@@ -8255,7 +8506,7 @@ function scanDiffItems(diffLines, rootDir, excludePatterns, entropyThreshold) {
   const suppressions = [];
   for (const [relFile, items] of fileGroups) {
     if (isPathExcluded2(relFile, excludePatterns)) continue;
-    const absPath = path4__namespace.resolve(rootDir, relFile);
+    const absPath = path5__namespace.resolve(rootDir, relFile);
     for (const item of items) {
       const lineViolations = scanLineForSecrets(item.content, item.lineNumber, absPath, relFile, entropyThreshold, suppressions);
       for (const v of lineViolations) {
@@ -8271,7 +8522,7 @@ function scanAllProjectFiles(rootDir, excludePatterns, entropyThreshold) {
   const suppressions = [];
   for (const file of allFiles) {
     try {
-      const content = fs7__namespace.readFileSync(file, "utf-8");
+      const content = fs8__namespace.readFileSync(file, "utf-8");
       findings.push(...scanContentForSecrets(content, file, rootDir, entropyThreshold, suppressions));
     } catch {
     }
@@ -8328,7 +8579,7 @@ function buildReportHeader2(result) {
   return [
     `# \u{1F510} Deterministic Secrets and Credentials Audit (Gitleaks Gate)`,
     ``,
-    `> **Evaluation Date:** ${(/* @__PURE__ */ new Date()).toISOString()}`,
+    `> **Evaluation Date:** ${resolveDeterministicDate().toISOString()}`,
     `> **Verdict:** ${isOk ? "\u2705 COMPLIANT (No exposed secrets or credentials)" : `\u274C BLOCKED (${result.findingsCount} exposed credentials detected)`}`,
     `> **Audited Files:** ${result.totalFilesScanned} | **Security Violations:** ${result.findingsCount}`,
     `> **Native Gitleaks Engine:** ${result.scannedWithGitleaks ? "\u{1F7E2} Active / Integrated" : "\u26AA Deterministic Native Scanner (@aisdlc/core)"}`,
@@ -8497,8 +8748,8 @@ function runSemgrepCli(rootDir) {
       const parsed = JSON.parse(output);
       if (Array.isArray(parsed.results)) {
         for (const item of parsed.results) {
-          const filePath = path4__namespace.resolve(rootDir, item.path);
-          const relPath = path4__namespace.relative(rootDir, filePath).replace(/\\/g, "/");
+          const filePath = path5__namespace.resolve(rootDir, item.path);
+          const relPath = path5__namespace.relative(rootDir, filePath).replace(/\\/g, "/");
           violations.push({
             filePath,
             relPath,
@@ -8525,15 +8776,15 @@ function isSastExcluded(relPath, excludes) {
 function walkSourceFiles(dir, rootDir, excludes = DEFAULT_SAST_EXCLUDES) {
   const files = [];
   try {
-    const entries = fs7__namespace.readdirSync(dir, { withFileTypes: true });
+    const entries = fs8__namespace.readdirSync(dir, { withFileTypes: true }).sort((a, b) => canonicalSort(a.name, b.name));
     for (const entry of entries) {
-      const fullPath = path4__namespace.join(dir, entry.name);
-      const relPath = path4__namespace.relative(rootDir, fullPath).replace(/\\/g, "/");
+      const fullPath = path5__namespace.join(dir, entry.name);
+      const relPath = path5__namespace.relative(rootDir, fullPath).replace(/\\/g, "/");
       if (isSastExcluded(relPath, excludes)) continue;
       if (entry.isDirectory()) {
         files.push(...walkSourceFiles(fullPath, rootDir, excludes));
       } else if (entry.isFile()) {
-        const ext = path4__namespace.extname(entry.name).toLowerCase();
+        const ext = path5__namespace.extname(entry.name).toLowerCase();
         if (GENERAL_SOURCE_EXTENSIONS.includes(ext)) {
           files.push(fullPath);
         }
@@ -8558,11 +8809,11 @@ function checkRuleMatch(rule, line, ext, minSeverity) {
 }
 function scanFileForSast(filePath, rootDir, minSeverity = "HIGH", collectedSuppressions) {
   const violations = [];
-  const ext = path4__namespace.extname(filePath).toLowerCase();
+  const ext = path5__namespace.extname(filePath).toLowerCase();
   try {
-    const content = fs7__namespace.readFileSync(filePath, "utf-8");
+    const content = fs8__namespace.readFileSync(filePath, "utf-8");
     const lines = content.split(/\r?\n/);
-    const relPath = path4__namespace.relative(rootDir, filePath).replace(/\\/g, "/");
+    const relPath = path5__namespace.relative(rootDir, filePath).replace(/\\/g, "/");
     for (let i = 0; i < lines.length; i++) {
       const line = lines[i];
       if (checkLineSuppression(line, relPath, i + 1, collectedSuppressions)) continue;
@@ -8588,8 +8839,8 @@ function scanFileForSast(filePath, rootDir, minSeverity = "HIGH", collectedSuppr
 function collectSastFiles(rootDir, targetDirs) {
   const files = [];
   for (const tDir of targetDirs) {
-    const fullDir = path4__namespace.join(rootDir, tDir);
-    if (fs7__namespace.existsSync(fullDir)) {
+    const fullDir = path5__namespace.join(rootDir, tDir);
+    if (fs8__namespace.existsSync(fullDir)) {
       files.push(...walkSourceFiles(fullDir, rootDir));
     }
   }
@@ -8635,7 +8886,7 @@ function buildSastHeader(isOk, violationsCount, totalFilesScanned) {
   return [
     `# \u{1F6E1}\uFE0F Shift-Left SAST Audit (Static Application Security Testing)`,
     ``,
-    `> **Evaluation Date:** ${(/* @__PURE__ */ new Date()).toISOString()}`,
+    `> **Evaluation Date:** ${resolveDeterministicDate().toISOString()}`,
     `> **Verdict:** ${verdict}`,
     `> **Audited Code Files:** ${totalFilesScanned} | **SAST Violations:** ${violationsCount}`,
     ``,
@@ -8824,22 +9075,31 @@ var PII_SAST_RULES = [
     pattern: /\b(?:ssn|dni|nif|tax_?id|national_?id)\s*[:=]\s*['"](?:\d{3}-\d{2}-\d{4}|\d{8}[A-HJ-NP-TV-Z])['"]/i
   }
 ];
-function loadPrivacyPolicy(rootDir, policyPath) {
-  const candidate = policyPath ? path4__namespace.isAbsolute(policyPath) ? policyPath : path4__namespace.join(rootDir, policyPath) : path4__namespace.join(rootDir, "privacy-policy.yaml");
-  if (!fs7__namespace.existsSync(candidate)) return DEFAULT_PRIVACY_POLICY;
+function parsePrivacyDoc(raw, candidate) {
+  let parsed;
   try {
-    const parsed = yaml3__default.default.load(fs7__namespace.readFileSync(candidate, "utf-8"));
-    if (!parsed || typeof parsed !== "object") return DEFAULT_PRIVACY_POLICY;
-    return {
-      ...DEFAULT_PRIVACY_POLICY,
-      ...parsed,
-      classifications: { ...DEFAULT_PRIVACY_POLICY.classifications, ...parsed.classifications || {} },
-      agent_guardrails: { ...DEFAULT_PRIVACY_POLICY.agent_guardrails, ...parsed.agent_guardrails || {} },
-      ci_gates: { ...DEFAULT_PRIVACY_POLICY.ci_gates, ...parsed.ci_gates || {} }
-    };
-  } catch {
-    return DEFAULT_PRIVACY_POLICY;
+    parsed = yaml3__default.default.load(raw);
+  } catch (err) {
+    throw new Error(`[AI-SDLC Fail-Closed] Invalid YAML in privacy-policy '${candidate}': ${err instanceof Error ? err.message : String(err)}`);
   }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error(`[AI-SDLC Fail-Closed] Invalid privacy policy structure in '${candidate}': root must be a YAML mapping`);
+  }
+  return parsed;
+}
+function loadPrivacyPolicy(rootDir = process.cwd(), policyPath) {
+  const candidate = policyPath ? path5__namespace.isAbsolute(policyPath) ? policyPath : path5__namespace.join(rootDir, policyPath) : path5__namespace.join(rootDir, "privacy-policy.yaml");
+  if (!fs8__namespace.existsSync(candidate)) return DEFAULT_PRIVACY_POLICY;
+  const raw = fs8__namespace.readFileSync(candidate, "utf-8");
+  if (!raw || !raw.trim()) return DEFAULT_PRIVACY_POLICY;
+  const parsed = parsePrivacyDoc(raw, candidate);
+  return {
+    ...DEFAULT_PRIVACY_POLICY,
+    ...parsed,
+    classifications: { ...DEFAULT_PRIVACY_POLICY.classifications, ...parsed.classifications || {} },
+    agent_guardrails: { ...DEFAULT_PRIVACY_POLICY.agent_guardrails, ...parsed.agent_guardrails || {} },
+    ci_gates: { ...DEFAULT_PRIVACY_POLICY.ci_gates, ...parsed.ci_gates || {} }
+  };
 }
 function isLineExemptFromPrivacyScan(line) {
   return line.includes("ai-sdlc:allow-pii") || line.includes("ai-sdlc:allow-sast") || line.includes("nosec");
@@ -8856,9 +9116,9 @@ function shouldApplyPiiRule(rule, policy) {
 function scanFileForPrivacyViolations(filePath, rootDir, policy = DEFAULT_PRIVACY_POLICY) {
   const violations = [];
   try {
-    const content = fs7__namespace.readFileSync(filePath, "utf-8");
+    const content = fs8__namespace.readFileSync(filePath, "utf-8");
     const lines = content.split(/\r?\n/);
-    const relPath = path4__namespace.relative(rootDir, filePath).replace(/\\/g, "/");
+    const relPath = path5__namespace.relative(rootDir, filePath).replace(/\\/g, "/");
     for (let i = 0; i < lines.length; i++) {
       const line = lines[i];
       if (isLineExemptFromPrivacyScan(line)) continue;
@@ -8967,10 +9227,10 @@ function discoverPrivacyArtifacts(rootDir) {
     dpiaStatuses: /* @__PURE__ */ new Map()
   };
   for (const file of walkMdFiles(rootDir)) {
-    const relPath = path4__namespace.relative(rootDir, file).replace(/\\/g, "/");
+    const relPath = path5__namespace.relative(rootDir, file).replace(/\\/g, "/");
     if (isExcludedPrivacyMd(relPath)) continue;
     try {
-      const fm = extractFrontmatter(fs7__namespace.readFileSync(file, "utf-8"));
+      const fm = extractFrontmatter(fs8__namespace.readFileSync(file, "utf-8"));
       if (fm && fm.id) classifyPrivacyMarkdown(fm, relPath, acc);
     } catch {
     }
@@ -9015,7 +9275,7 @@ function checkAssetRopaRegistration(asset, ropaRecords, policy, fullPath) {
 }
 function auditDataAssetGovernance(asset, ropaRecords, policy, rootDir) {
   if (!isSensitiveClassification(asset.classification)) return [];
-  const fullPath = path4__namespace.join(rootDir, asset.filePath);
+  const fullPath = path5__namespace.join(rootDir, asset.filePath);
   const v1 = checkAssetRetention(asset, policy, fullPath);
   const v2 = checkAssetRopaRegistration(asset, ropaRecords, policy, fullPath);
   return [v1, v2].filter((v) => v !== null);
@@ -9087,8 +9347,8 @@ function checkRopaDpiaApproval(ropa, dataAssets, dpiaStatuses, fullPath) {
 function collectSourceFilesForPrivacy(rootDir, targetDirs) {
   const files = [];
   for (const dir of targetDirs) {
-    const fullDir = path4__namespace.join(rootDir, dir);
-    if (fs7__namespace.existsSync(fullDir)) {
+    const fullDir = path5__namespace.join(rootDir, dir);
+    if (fs8__namespace.existsSync(fullDir)) {
       files.push(...walkSourceFiles(fullDir, rootDir));
     }
   }
@@ -9178,15 +9438,13 @@ function generatePrivacyReportMarkdown(result, policy = DEFAULT_PRIVACY_POLICY)
 function writePrivacyOutputsIfNeeded(result, options, policy, rootDir) {
   if (options.generateRopa) {
     const relRopa = options.ropaOutputPath || policy.ci_gates.output_ropa_file || "reports/ROPA_INVENTORY.md";
-    const fullRopa = path4__namespace.isAbsolute(relRopa) ? relRopa : path4__namespace.join(rootDir, relRopa);
-    fs7__namespace.mkdirSync(path4__namespace.dirname(fullRopa), { recursive: true });
-    fs7__namespace.writeFileSync(fullRopa, result.ropaMarkdown, "utf-8");
+    const fullRopa = path5__namespace.isAbsolute(relRopa) ? relRopa : path5__namespace.join(rootDir, relRopa);
+    writeReportFileIfChanged(fullRopa, result.ropaMarkdown);
     result.ropaOutputPath = fullRopa;
   }
   if (options.reportOutputPath) {
-    const fullReport = path4__namespace.isAbsolute(options.reportOutputPath) ? options.reportOutputPath : path4__namespace.join(rootDir, options.reportOutputPath);
-    fs7__namespace.mkdirSync(path4__namespace.dirname(fullReport), { recursive: true });
-    fs7__namespace.writeFileSync(fullReport, result.reportMarkdown, "utf-8");
+    const fullReport = path5__namespace.isAbsolute(options.reportOutputPath) ? options.reportOutputPath : path5__namespace.join(rootDir, options.reportOutputPath);
+    writeReportFileIfChanged(fullReport, result.reportMarkdown);
     result.reportOutputPath = fullReport;
   }
 }
@@ -9198,7 +9456,7 @@ function evaluateDiscoveredPrivacyGovernance(discovered, policy, rootDir) {
   }
   let dpiaRequiredCount = 0;
   for (const ropa of discovered.ropaRecords) {
-    const fullPath = path4__namespace.join(rootDir, ropa.filePath);
+    const fullPath = path5__namespace.join(rootDir, ropa.filePath);
     violations.push(...checkRopaControlsAndSubprocessors(ropa, governedRopaIds, policy, fullPath));
     const dpiaCheck = checkRopaDpiaApproval(ropa, discovered.dataAssets, discovered.dpiaStatuses, fullPath);
     if (dpiaCheck.dpiaRequired) dpiaRequiredCount++;
@@ -9244,7 +9502,7 @@ function calculateRating(mi, cc) {
   return "F";
 }
 function detectLanguage(filePath) {
-  const ext = path4__namespace.extname(filePath).toLowerCase();
+  const ext = path5__namespace.extname(filePath).toLowerCase();
   switch (ext) {
     case ".ts":
       return "TypeScript";
@@ -9269,7 +9527,7 @@ function detectLanguage(filePath) {
 }
 function parseJsonSummaryFile(filePath, relSource) {
   try {
-    const raw = JSON.parse(fs7__namespace.readFileSync(filePath, "utf-8"));
+    const raw = JSON.parse(fs8__namespace.readFileSync(filePath, "utf-8"));
     const total = raw.total;
     if (!total || typeof total !== "object") return null;
     const linesPct = Number(total.lines?.pct);
@@ -9292,7 +9550,7 @@ function updateLcovCounts(line, counts) {
 }
 function parseLcovFile(filePath, relSource) {
   try {
-    const lines = fs7__namespace.readFileSync(filePath, "utf-8").split(/\r?\n/);
+    const lines = fs8__namespace.readFileSync(filePath, "utf-8").split(/\r?\n/);
     const counts = { LF: 0, LH: 0, BRF: 0, BRH: 0, FNF: 0, FNH: 0 };
     for (const line of lines) {
       updateLcovCounts(line, counts);
@@ -9312,16 +9570,16 @@ function parseLcovFile(filePath, relSource) {
 function readCodeCoverageSummary(rootDir = process.cwd()) {
   const jsonCandidates = ["coverage/coverage-summary.json", "reports/coverage-summary.json"];
   for (const rel of jsonCandidates) {
-    const full = path4__namespace.join(rootDir, rel);
-    if (fs7__namespace.existsSync(full)) {
+    const full = path5__namespace.join(rootDir, rel);
+    if (fs8__namespace.existsSync(full)) {
       const parsed = parseJsonSummaryFile(full, rel);
       if (parsed) return parsed;
     }
   }
   const lcovCandidates = ["coverage/lcov.info", "lcov.info", "reports/lcov.info"];
   for (const rel of lcovCandidates) {
-    const full = path4__namespace.join(rootDir, rel);
-    if (fs7__namespace.existsSync(full)) {
+    const full = path5__namespace.join(rootDir, rel);
+    if (fs8__namespace.existsSync(full)) {
       const parsed = parseLcovFile(full, rel);
       if (parsed) return parsed;
     }
@@ -9406,7 +9664,7 @@ function buildReportHeader3(verdict, rating, mi, cc) {
   return [
     `# \u{1F4CA} Formal Quality and Release Gate Report (AI-SDLC)`,
     "",
-    `> **Generation Date:** ${(/* @__PURE__ */ new Date()).toISOString()}`,
+    `> **Generation Date:** ${resolveDeterministicDate().toISOString()}`,
     `> **Release Gate Verdict:** ${status}`,
     `> **Global Rating:** **\`${rating}\`** (MI Index: ${mi}/100, Average CC: ${cc})`
   ];
@@ -9457,9 +9715,8 @@ function renderQualityReportMarkdown(gateResult, coverage, accumulated, averages
   return [...header, "", "---", "", ...table, "", "---", "", ...polyglot, ...violationsSection, "", EVALUATION_STANDARDS_MD].join("\n");
 }
 function writeQualityReportFile(rootDir, markdown) {
-  const reportsDir = path4__namespace.join(rootDir, "reports");
-  fs7__namespace.mkdirSync(reportsDir, { recursive: true });
-  fs7__namespace.writeFileSync(path4__namespace.join(reportsDir, "QUALITY_REPORT.md"), markdown, "utf-8");
+  const targetPath = path5__namespace.join(rootDir, "reports", "QUALITY_REPORT.md");
+  return writeReportFileIfChanged(targetPath, markdown);
 }
 function generateQualityReport(options = {}) {
   const rootDir = options.rootDir || process.cwd();
@@ -9601,9 +9858,9 @@ Flujo de Integraci\xF3n (Merges):`,
   };
 }
 function resolveVersionFromProposal(changeDir) {
-  const proposalFile = path4__namespace.join(changeDir, "proposal.md");
-  if (!fs7__namespace.existsSync(proposalFile)) return "1.0.0";
-  const propContent = fs7__namespace.readFileSync(proposalFile, "utf-8");
+  const proposalFile = path5__namespace.join(changeDir, "proposal.md");
+  if (!fs8__namespace.existsSync(proposalFile)) return "1.0.0";
+  const propContent = fs8__namespace.readFileSync(proposalFile, "utf-8");
   const propFm = propContent.match(/^---\r?\n([\s\S]*?)\r?\n---/);
   if (!propFm) return "1.0.0";
   const parsedProp = yaml3__default.default.load(propFm[1]);
@@ -9620,9 +9877,9 @@ function isTaskMatchingId(currentId, cleanTaskId) {
   return currentLower === targetLower || currentLower.startsWith(`${targetLower}-`) || targetLower.startsWith(`${currentLower}-`);
 }
 function parseTasksFrontmatter(tasksFile) {
-  if (!fs7__namespace.existsSync(tasksFile)) return null;
+  if (!fs8__namespace.existsSync(tasksFile)) return null;
   try {
-    const content = fs7__namespace.readFileSync(tasksFile, "utf-8");
+    const content = fs8__namespace.readFileSync(tasksFile, "utf-8");
     const fmMatch = content.match(/^---\r?\n([\s\S]*?)\r?\n---/);
     if (!fmMatch) return null;
     const fm = yaml3__default.default.load(fmMatch[1]);
@@ -9644,7 +9901,7 @@ function buildTaskMatch(currentId, currentTitle, rawChangeId, changeDir, version
   };
 }
 function inspectChangeTasks(changeDir, entryName, cleanTaskId, availableTasks) {
-  const fm = parseTasksFrontmatter(path4__namespace.join(changeDir, "tasks.md"));
+  const fm = parseTasksFrontmatter(path5__namespace.join(changeDir, "tasks.md"));
   if (!fm || !fm.tasks) return void 0;
   const rawChangeId = resolveRawChangeId(fm, entryName);
   const versionStr = resolveChangeVersion(fm, changeDir);
@@ -9665,16 +9922,16 @@ function locateTaskInActiveChanges(taskId, rootDir = process.cwd()) {
   if (!cleanTaskId) {
     return { found: false, error: "Debe especificar un identificador de tarea v\xE1lido (ej. TSK-001)." };
   }
-  const activeChangesDir = path4__namespace.join(rootDir, "specs", "changes", "active");
-  if (!fs7__namespace.existsSync(activeChangesDir)) {
+  const activeChangesDir = path5__namespace.join(rootDir, "specs", "changes", "active");
+  if (!fs8__namespace.existsSync(activeChangesDir)) {
     return { found: false, error: `No se encontr\xF3 el directorio de cambios activos en '${activeChangesDir}'.` };
   }
   const availableTasks = [];
-  const candidateDirs = fs7__namespace.readdirSync(activeChangesDir, { withFileTypes: true });
+  const candidateDirs = fs8__namespace.readdirSync(activeChangesDir, { withFileTypes: true });
   let matchedTask;
   for (const entry of candidateDirs) {
     if (!entry.isDirectory()) continue;
-    const changeDir = path4__namespace.join(activeChangesDir, entry.name);
+    const changeDir = path5__namespace.join(activeChangesDir, entry.name);
     const m = inspectChangeTasks(changeDir, entry.name, cleanTaskId, availableTasks);
     if (m && !matchedTask) {
       matchedTask = m;
@@ -9711,14 +9968,14 @@ function detectExistingFeatureBranch(branches, dirName, changeId, changeSlug) {
     (b) => b.startsWith("feat/") && (b.toLowerCase().includes(dirName.toLowerCase()) || b.toLowerCase().includes(changeId.toLowerCase())) && classifyBranch(b).valid
   );
   if (existing) return existing;
-  const normalizedName = slugify(changeSlug).replace(/^(chg|bug|feat)-(\d+)/i, (_, p, n) => `${p.toUpperCase()}-${n}`);
+  const normalizedName = slugify2(changeSlug).replace(/^(chg|bug|feat)-(\d+)/i, (_, p, n) => `${p.toUpperCase()}-${n}`);
   return `feat/${normalizedName}`;
 }
 function buildDefaultTaskSuffix(taskId, taskTitle) {
   let taskSuffix = taskId.toLowerCase();
   const hasSlug = taskSuffix.includes("-") && taskSuffix.split("-").length > 2;
   if (!hasSlug && taskTitle) {
-    const titleSlug = slugify(taskTitle).split("-").slice(0, 4).join("-");
+    const titleSlug = slugify2(taskTitle).split("-").slice(0, 4).join("-");
     if (titleSlug) {
       taskSuffix = `${taskSuffix}-${titleSlug}`;
     }
@@ -9738,7 +9995,7 @@ function resolveBranchHierarchy(match, rootDir = process.cwd()) {
   const branches = getGitBranchList(rootDir);
   const cleanVersion = (match.version || "1.0.0").replace(/^v/, "");
   const releaseBranch = detectExistingReleaseBranch(branches, cleanVersion);
-  const dirName = path4__namespace.basename(match.changeDir);
+  const dirName = path5__namespace.basename(match.changeDir);
   const changeSlug = dirName.replace(/^(chg|CHG)-/i, (m) => m.toUpperCase());
   const featureBranch = detectExistingFeatureBranch(branches, dirName, match.changeId, changeSlug);
   const parentIdMatch = featureBranch.replace(/^(feat|feature)\//i, "").match(/^[a-zA-Z0-9]+-[a-zA-Z0-9]+/);
@@ -10045,13 +10302,13 @@ function getGitConfigValue(key, cwd) {
 }
 function readSessionTelemetry(cwd) {
   const possiblePaths = [
-    path4__namespace.join(cwd, ".ai-sdlc", "session-telemetry.json"),
-    path4__namespace.join(cwd, ".ai-sdlc", "agent-session.json")
+    path5__namespace.join(cwd, ".ai-sdlc", "session-telemetry.json"),
+    path5__namespace.join(cwd, ".ai-sdlc", "agent-session.json")
   ];
   for (const p of possiblePaths) {
-    if (fs7__namespace.existsSync(p)) {
+    if (fs8__namespace.existsSync(p)) {
       try {
-        const raw = fs7__namespace.readFileSync(p, "utf-8");
+        const raw = fs8__namespace.readFileSync(p, "utf-8");
         return JSON.parse(raw);
       } catch {
       }
@@ -10271,20 +10528,20 @@ if [ -f "$TELEMETRY_FILE" ]; then
 fi
 `;
 function installGitHooks(rootDir = process.cwd()) {
-  const gitDir = path4__namespace.join(rootDir, ".git");
-  if (!fs7__namespace.existsSync(gitDir)) {
+  const gitDir = path5__namespace.join(rootDir, ".git");
+  if (!fs8__namespace.existsSync(gitDir)) {
     return {
       success: false,
       error: `No se encontr\xF3 el directorio Git en '${gitDir}'.`
     };
   }
-  const hooksDir = path4__namespace.join(gitDir, "hooks");
-  if (!fs7__namespace.existsSync(hooksDir)) {
-    fs7__namespace.mkdirSync(hooksDir, { recursive: true });
+  const hooksDir = path5__namespace.join(gitDir, "hooks");
+  if (!fs8__namespace.existsSync(hooksDir)) {
+    fs8__namespace.mkdirSync(hooksDir, { recursive: true });
   }
-  const hookPath = path4__namespace.join(hooksDir, "prepare-commit-msg");
+  const hookPath = path5__namespace.join(hooksDir, "prepare-commit-msg");
   try {
-    fs7__namespace.writeFileSync(hookPath, PREPARE_COMMIT_MSG_SCRIPT, { encoding: "utf-8", mode: 493 });
+    fs8__namespace.writeFileSync(hookPath, PREPARE_COMMIT_MSG_SCRIPT, { encoding: "utf-8", mode: 493 });
     return {
       success: true,
       hookPath
@@ -10625,16 +10882,16 @@ function formatReleaseKpiMarkdown(report) {
   ].join("\n");
 }
 function writeReleaseKpiReport(report, options = {}) {
-  const root = options.outputDir || (options.rootDir ? path4__namespace.join(options.rootDir, "reports", "releases") : path4__namespace.join(process.cwd(), "reports", "releases"));
-  if (!fs7__namespace.existsSync(root)) {
-    fs7__namespace.mkdirSync(root, { recursive: true });
+  const root = options.outputDir || (options.rootDir ? path5__namespace.join(options.rootDir, "reports", "releases") : path5__namespace.join(process.cwd(), "reports", "releases"));
+  if (!fs8__namespace.existsSync(root)) {
+    fs8__namespace.mkdirSync(root, { recursive: true });
   }
   const cleanBranchName = report.releaseBranch.replace(/[^a-zA-Z0-9.-]/g, "_");
-  const mdPath = path4__namespace.join(root, `RELEASE_KPIS_${cleanBranchName}.md`);
-  const jsonPath = path4__namespace.join(root, `release_${cleanBranchName}.kpis.json`);
+  const mdPath = path5__namespace.join(root, `RELEASE_KPIS_${cleanBranchName}.md`);
+  const jsonPath = path5__namespace.join(root, `release_${cleanBranchName}.kpis.json`);
   const mdContent = formatReleaseKpiMarkdown(report);
-  fs7__namespace.writeFileSync(mdPath, mdContent, "utf-8");
-  fs7__namespace.writeFileSync(jsonPath, JSON.stringify(report, null, 2), "utf-8");
+  fs8__namespace.writeFileSync(mdPath, mdContent, "utf-8");
+  fs8__namespace.writeFileSync(jsonPath, JSON.stringify(report, null, 2), "utf-8");
   return { markdownPath: mdPath, jsonPath };
 }
 var cachedScript = null;
@@ -10643,19 +10900,19 @@ function resolveCytoscapePath() {
   try {
     const req = module$1.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('index.cjs', document.baseURI).href)));
     const entryPath = req.resolve("cytoscape");
-    const dir = path4__namespace.dirname(entryPath);
-    const minPath = path4__namespace.join(dir, "cytoscape.min.js");
-    if (fs7__namespace.existsSync(minPath)) {
+    const dir = path5__namespace.dirname(entryPath);
+    const minPath = path5__namespace.join(dir, "cytoscape.min.js");
+    if (fs8__namespace.existsSync(minPath)) {
       return minPath;
     }
   } catch {
   }
   const searchDirs = [
-    path4__namespace.join(process.cwd(), "node_modules", "cytoscape", "dist", "cytoscape.min.js"),
-    path4__namespace.join(process.cwd(), "packages", "core", "node_modules", "cytoscape", "dist", "cytoscape.min.js")
+    path5__namespace.join(process.cwd(), "node_modules", "cytoscape", "dist", "cytoscape.min.js"),
+    path5__namespace.join(process.cwd(), "packages", "core", "node_modules", "cytoscape", "dist", "cytoscape.min.js")
   ];
   for (const candidate of searchDirs) {
-    if (fs7__namespace.existsSync(candidate)) {
+    if (fs8__namespace.existsSync(candidate)) {
       return candidate;
     }
   }
@@ -10668,7 +10925,7 @@ function getCytoscapeScript() {
   const scriptPath = resolveCytoscapePath();
   if (scriptPath) {
     try {
-      cachedScript = fs7__namespace.readFileSync(scriptPath, "utf-8");
+      cachedScript = fs8__namespace.readFileSync(scriptPath, "utf-8");
       return cachedScript;
     } catch {
     }
@@ -10768,7 +11025,7 @@ function extractFrontmatter2(fileContent) {
   }
 }
 function toScannedArtifact(filePath, relPath) {
-  const fileContent = fs7__namespace.readFileSync(filePath, "utf-8");
+  const fileContent = fs8__namespace.readFileSync(filePath, "utf-8");
   const fm = extractFrontmatter2(fileContent);
   const id = typeof fm?.id === "string" ? fm.id.trim() : "";
   if (!id) return null;
@@ -10780,12 +11037,12 @@ function toScannedArtifact(filePath, relPath) {
   return { id, type: classified.type, title, layer: classified.layer, filePath: relPath, content, frontmatter: fm };
 }
 function parseAndCatalogArtifactFile(rootDir, filePath, scannedMap, archViewByBasename) {
-  const relPath = path4__namespace.relative(rootDir, filePath).replace(/\\/g, "/");
+  const relPath = path5__namespace.relative(rootDir, filePath).replace(/\\/g, "/");
   if (relPath.includes("/changes/") || relPath.startsWith("changes/")) return;
   const scannedArt = toScannedArtifact(filePath, relPath);
   if (!scannedArt) return;
   if (scannedArt.layer === "architecture" && scannedArt.type === "architecture") {
-    archViewByBasename.set(path4__namespace.basename(relPath), scannedArt);
+    archViewByBasename.set(path5__namespace.basename(relPath), scannedArt);
   } else {
     scannedMap.set(scannedArt.id, scannedArt);
   }
@@ -10795,8 +11052,8 @@ function scanWorkspaceArtifacts(rootDir) {
   const archViewByBasename = /* @__PURE__ */ new Map();
   const artifactDirs = ["product", "architecture", "specs", "security", "privacy"];
   for (const dirName of artifactDirs) {
-    const fullDirPath = path4__namespace.join(rootDir, dirName);
-    if (fs7__namespace.existsSync(fullDirPath)) {
+    const fullDirPath = path5__namespace.join(rootDir, dirName);
+    if (fs8__namespace.existsSync(fullDirPath)) {
       for (const f of walkMdFiles(fullDirPath)) {
         parseAndCatalogArtifactFile(rootDir, f, scannedArtifactsMap, archViewByBasename);
       }
@@ -10856,9 +11113,9 @@ function addTraceArchEdges(r, status, archViewByBasename, nodeMap, addEdge) {
   }
 }
 function loadTestContentPreview(filePath) {
-  if (!fs7__namespace.existsSync(filePath)) return void 0;
+  if (!fs8__namespace.existsSync(filePath)) return void 0;
   try {
-    const testContent = fs7__namespace.readFileSync(filePath, "utf-8");
+    const testContent = fs8__namespace.readFileSync(filePath, "utf-8");
     const lang = filePath.endsWith(".feature") ? "gherkin" : "typescript";
     const preview = testContent.substring(0, 1500) + (testContent.length > 1500 ? "\n... (truncated)" : "");
     return "```" + lang + "\n" + preview + "\n```";
@@ -10868,10 +11125,10 @@ function loadTestContentPreview(filePath) {
 }
 function ensureTestNode(t, testId, rootDir, nodeMap) {
   if (nodeMap.has(testId)) return;
-  const fullTestPath = path4__namespace.isAbsolute(t) ? t : path4__namespace.join(rootDir, t);
+  const fullTestPath = path5__namespace.isAbsolute(t) ? t : path5__namespace.join(rootDir, t);
   nodeMap.set(testId, {
     id: testId,
-    label: path4__namespace.basename(t),
+    label: path5__namespace.basename(t),
     title: t,
     type: t.endsWith(".feature") ? "bdd-feature" : "code-test",
     layer: "test",
@@ -13016,9 +13273,10 @@ ${manualsTab}
 ${kpisTab}
   </main>`;
 }
-function renderDashboardHtml(graphData, metricsData, title = "AI-SDLC: Dashboard Interactivo de Trazabilidad y Calidad") {
+function renderDashboardHtml(graphData, metricsData, title = "AI-SDLC: Dashboard Interactivo de Trazabilidad y Calidad", generationDate) {
   const head = renderDashboardHead(title);
-  const header = renderHeaderHtml(graphData.issueCount, (/* @__PURE__ */ new Date()).toISOString());
+  const effectiveDate = generationDate || resolveDeterministicDate().toISOString();
+  const header = renderHeaderHtml(graphData.issueCount, effectiveDate);
   const nav = renderNavTabsHtml();
   const main = renderDashboardMain(metricsData);
   const sidebar = renderTaskSidebarHtml();
@@ -13048,9 +13306,9 @@ var IGNORED_SCAN_DIRS = /* @__PURE__ */ new Set([
   ".agent"
 ]);
 function readKpiFilesInDir(dir) {
-  if (!fs7__namespace.existsSync(dir)) return [];
+  if (!fs8__namespace.existsSync(dir)) return [];
   try {
-    return fs7__namespace.readdirSync(dir).filter((f) => f.endsWith(".kpis.json")).map((f) => path4__namespace.join(dir, f));
+    return fs8__namespace.readdirSync(dir).filter((f) => f.endsWith(".kpis.json")).map((f) => path5__namespace.join(dir, f));
   } catch {
     return [];
   }
@@ -13058,11 +13316,11 @@ function readKpiFilesInDir(dir) {
 function scanSubdirKpiFiles(dir, depth, acc) {
   if (depth > 4) return;
   try {
-    const entries = fs7__namespace.readdirSync(dir, { withFileTypes: true });
+    const entries = fs8__namespace.readdirSync(dir, { withFileTypes: true });
     for (const entry of entries) {
       if (!entry.isDirectory() || IGNORED_SCAN_DIRS.has(entry.name)) continue;
-      const sub = path4__namespace.join(dir, entry.name);
-      if (entry.name === "releases" && path4__namespace.basename(dir) === "reports") {
+      const sub = path5__namespace.join(dir, entry.name);
+      if (entry.name === "releases" && path5__namespace.basename(dir) === "reports") {
         acc.push(...readKpiFilesInDir(sub));
       } else {
         scanSubdirKpiFiles(sub, depth + 1, acc);
@@ -13072,7 +13330,7 @@ function scanSubdirKpiFiles(dir, depth, acc) {
   }
 }
 function findKpiJsonFiles(rootDir) {
-  const primaryFiles = readKpiFilesInDir(path4__namespace.join(rootDir, "reports", "releases"));
+  const primaryFiles = readKpiFilesInDir(path5__namespace.join(rootDir, "reports", "releases"));
   if (primaryFiles.length > 0) return primaryFiles;
   const found = [];
   scanSubdirKpiFiles(rootDir, 0, found);
@@ -13083,7 +13341,7 @@ function collectHistoricalKpis(rootDir) {
   const kpiFiles = findKpiJsonFiles(rootDir);
   for (const fullPath of kpiFiles) {
     try {
-      const content = fs7__namespace.readFileSync(fullPath, "utf-8");
+      const content = fs8__namespace.readFileSync(fullPath, "utf-8");
       const report = JSON.parse(content);
       if (!items.some((it) => it.id === report.releaseBranch && it.timestamp === report.generatedAt)) {
         items.push({
@@ -13289,15 +13547,11 @@ function computeGateAverages(gateResults) {
 }
 function generateDashboardReport(options = {}) {
   const rootDir = options.rootDir || process.cwd();
-  const outputPath = options.outputPath || path4__namespace.join(rootDir, "reports", "dashboard.html");
+  const outputPath = options.outputPath || path5__namespace.join(rootDir, "reports", "dashboard.html");
   const graphData = buildGraphElements(rootDir);
   const metricsData = collectDashboardMetrics(rootDir);
-  const html = renderDashboardHtml(graphData, metricsData, options.title);
-  const outDir = path4__namespace.dirname(outputPath);
-  if (!fs7__namespace.existsSync(outDir)) {
-    fs7__namespace.mkdirSync(outDir, { recursive: true });
-  }
-  fs7__namespace.writeFileSync(outputPath, html, "utf-8");
+  const html = renderDashboardHtml(graphData, metricsData, options.title, resolveDeterministicDate(rootDir).toISOString());
+  writeReportFileIfChanged(outputPath, html);
   const { bddCoverageRatio, traceabilityRatio } = computeSummaryRatios(metricsData);
   const { avgMi, avgCc } = computeGateAverages(metricsData.gate.results);
   return {
@@ -13323,6 +13577,8 @@ function generateDashboardReport(options = {}) {
     html
   };
 }
+
+// src/reporters/sarif.ts
 var SARIF_SCHEMA_2_1_0 = "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json";
 var SARIF_VERSION = "2.1.0";
 function normalizeUri(filePath) {
@@ -13470,11 +13726,7 @@ function serializeSarifDocument(doc, pretty = true) {
   return JSON.stringify(doc, null, pretty ? 2 : 0);
 }
 function writeSecuritySarifReport(outputPath, doc, pretty = true) {
-  const dir = path4__namespace.dirname(outputPath);
-  if (!fs7__namespace.existsSync(dir)) {
-    fs7__namespace.mkdirSync(dir, { recursive: true });
-  }
-  fs7__namespace.writeFileSync(outputPath, serializeSarifDocument(doc, pretty), "utf-8");
+  writeReportFileIfChanged(outputPath, serializeSarifDocument(doc, pretty));
 }
 
 // src/init/agent-templates.ts
@@ -13567,6 +13819,7 @@ var SPECIALIZED_AGENT_TEMPLATES = [
 - Document critical technological decisions using immutable \`ADR-*\` records conforming to \`schemas/architecture/adr.schema.json\`.
 - Validate that architectural choices comply with legal constraints in \`license-policy.yaml\` and data protection constraints in \`privacy-policy.yaml\`.
 - **Technical Security & Privacy Feedback Loop**: If architectural decisions (databases, queues, distributed caching, third-party APIs, LLM providers, authentication schemes) introduce new attack vectors or PII data flows, emit a return handoff to \`agent-threat-modeler\` (which chains to \`agent-privacy-officer\`) for technical modeling prior to the testing phase.
+- **Mandatory Observability Component (\`CMP-OBSERVABILITY\`)**: In every system architecture modeled under arc42/NAF v4, the system architect MUST define an explicit building block \`CMP-OBSERVABILITY\` (Level 2/3) in Section 5 alongside Section 8 Cross-Cutting Concepts (\`ARCH-CROSS-*\`) and an immutable ADR for Runtime Observability, standardizing on: (1) Structured JSON logging with configurable granularity (\`LOG_LEVEL\`), (2) Distributed tracing via OpenTelemetry with W3C Trace Context (\`traceparent\`), and (3) Operational metrics (RED: Rate, Errors, Duration) in Prometheus / OpenMetrics format for Grafana scraping, satisfying \`QR-OBS-*\`.
 - If autonomy is $\\ge$ \`HUMAN_REVIEW_PLAN\`, conclude by emitting the Workflow Handoff block (\`templates/workflow/agent-handoff.template.md\`) suggesting \`agent-qa-engineer\` (or \`agent-threat-modeler\` if technical security/privacy loop is required) and opening the Human Action Window. In \`AUTONOMOUS\` mode, omit interactive handoff.`
   },
   {
@@ -13626,9 +13879,12 @@ Execute every implementation task following this strict sequential order:
 - **Zero Fake-Wiring Guardrail**: Strictly forbidden from marking a task \`COMPLETED\` with hardcoded \`mockData\` arrays in production views, \`setTimeout\` simulating network calls, or empty UI event handlers (\`onClick={() => {}}\`, \`onSubmit={() => {}}\`). Frontend components must wire directly to the shared contract and real Backend endpoints.
 - **Mandatory 4 UI States Matrix**: Every data-driven UI component or screen must explicitly implement all 4 usability states: \`Loading\` (spinner/skeleton + disabled submit), \`Empty\` (clear message + CTA), \`Error\` (visible error recovery banner, never silent failure), and \`Nominal/Success\` (accessible semantic DOM + keyboard navigation).
 - **Live Runtime Smoke Verification**: For tasks touching UI or UI-to-Backend integration, unit tests alone are insufficient. Before emitting handoff, boot the real Backend and Frontend servers and verify (via Playwright E2E or Chrome DevTools MCP) that browser \`console.error\` and \`pageerror\` counts are \`0\` and API calls return real \`2xx\` responses without CORS or schema mismatches.
+- **Mandatory Structured Logging & Observability**: Never emit unstructured console logs (\`console.log\`) in production code (\`no_console_logs_in_prod\`). Integrate the structured logger (\`ILogger\`) with configurable \`LOG_LEVEL\`, propagate W3C distributed trace context (\`trace_id\`), and record RED operational metrics compatible with Prometheus and Grafana.
 - Before adding any external dependency, verify its SPDX license is permitted in \`license-policy.yaml\`.
 - Respect non-negotiable \`quality-policy.yaml\` thresholds: Cyclomatic Complexity $\\le 10$, Cognitive Complexity $\\le 15$, Maintainability Index $\\ge 50$, Function Length $\\le 40$ lines.
 - Run unified pre-flight with auto-fix (\`pnpm run check:fix\`) and full verification (\`pnpm run verify:all\`).
+- **Mandatory Regression Verification**: Never declare build, typecheck, or bug fixes complete without executing the relevant automated test suite (\`pnpm test\`, \`dotnet test\`) and confirming zero regressions.
+- **Global Styles Protection**: When touching or refactoring frontend views, verify that global stylesheet/asset imports remain intact and that layouts suffer no visual disruption.
 - Upon completing green implementation, suggest handoff to \`agent-expert-user\` for Post-Development Functional Validation prior to security and privacy audit.`
   },
   {
@@ -14056,7 +14312,7 @@ This file defines the operational rules and specialized role mappings for Google
   - FORBIDDEN to include production code or anticipate implementations.
   - **Agreed Project Technology**: Always use the testing frameworks, E2E/UI runners, and technology stack agreed upon for the project (if any), without requiring the user to specify it in the prompt.
   - **Mandatory E2E & UI Testing**: Never forget or omit End-to-End (E2E) and User Interface (UI) tests.
-  - **Per-Interactive-Element Coverage**: Create specific tests for every UI element the user can interact with, covering Happy Path, Sad Path, and Boundary Values for each one.
+  - **Per-Interactive-Element Coverage**: Create specific tests for every UI element the user can interact with, using external tools such as Playwright or FlatUI (or the agreed project testing technology), covering Happy Path, Sad Path, and Boundary Values for each one.
   - Every \`FR-*\` must have at least nominal + boundary + out-of-range scenarios; missing these blocks handoff to \`agent-developer\`.
   - Mandatory tags: \`@<FR-ID> @automated @regression\`.
   - Run \`pnpm run verify:testing\` before emitting handoff.
@@ -14069,6 +14325,8 @@ This file defines the operational rules and specialized role mappings for Google
   - Make tests delivered by \`agent-qa-engineer\` pass green without altering them to accommodate code.
   - Respect \`quality-policy.yaml\` thresholds: CC $\\le 10$, Cognitive $\\le 15$, MI $\\ge 50$, LOC $\\le 40$.
   - Run pre-flight with auto-fix: \`pnpm run check:fix\` and full verification: \`pnpm run verify:all\`.
+  - **Mandatory Regression Verification**: Never declare build, typecheck, or bug fixes complete without executing the relevant automated test suite (\`pnpm test\`, \`dotnet test\`) and confirming zero regressions.
+  - **Global Styles Protection**: When touching or refactoring frontend views, verify that global stylesheet/asset imports remain intact and that layouts suffer no visual disruption.
   - Upon completing green implementation, suggest handoff to \`agent-expert-user\` for post-development functional validation prior to security and privacy audit.
 
 ### 7. \`agent-security-auditor\` (Adversarial Code Auditor)
@@ -14241,6 +14499,8 @@ Canonical Reference: [\`process/09_agent_protocols.md\`](process/09_agent_protoc
 - Apply Test-Driven Development: generate unit tests before or alongside component logic.
 - Tag tests linked to requirements with header comments citing the ID (\`FR-*\`, \`SEC-REQ-*\`, or \`PRIV-REQ-*\`) to enable reverse traceability.
 - Suppressing types (\`any\`), linter rules (\`eslint-disable\`), or unit tests to force pipeline passage is prohibited.
+- **Mandatory Regression Verification**: Never declare build, typecheck, or bug fixes complete without executing the relevant automated test suite (\`pnpm test\`, \`dotnet test\`) and confirming zero regressions.
+- **Global Styles Protection**: When touching or refactoring frontend views, verify that global stylesheet/asset imports remain intact and that layouts suffer no visual disruption.
 
 ## 3. Open Source License Policy (\`license-policy.yaml\`)
 - Before adding any dependency to \`package.json\`, verify its SPDX identifier.
@@ -14315,11 +14575,11 @@ npx tsx packages/cli/src/index.ts sdd integrate --change <chg-id>
 
 ### 5. \`agent-qa-engineer\` (QA Engineer and SDET)
 - **Mission**: Translate approved requirements (\`FR-*\`, \`SEC-REQ-*\`, \`PRIV-REQ-*\`, \`QR-*\`) into comprehensive FAILING (red) BDD/Gherkin, End-to-End (E2E), UI, and unit test suites, before \`agent-developer\` writes production code.
-- **Guardrails**: Always use the agreed project technology/testing stack (if any). Never omit End-to-End (E2E) and UI tests. Create specific tests for every interactive UI element covering Happy Path, Sad Path, and Boundary Values. FORBIDDEN to include production code. Mandatory tags: \`@<FR-ID> @automated @regression\`.
+- **Guardrails**: Always use the agreed project technology/testing stack (if any). Never omit End-to-End (E2E) and UI tests. Create specific tests for every interactive UI element using external tools such as Playwright or FlatUI (or the agreed project testing technology), covering Happy Path, Sad Path, and Boundary Values. FORBIDDEN to include production code. Mandatory tags: \`@<FR-ID> @automated @regression\`.
 
 ### 6. \`agent-developer\` (Software Developer)
 - **Mission**: Implement atomic tasks from SDD specifications (\`tasks.md\`) with clean, strictly typed code and thorough tests.
-- **Directives**: Execute the mandatory 4-step order: (1) Modular & Hexagonal Architecture (Ports & Adapters) definition/redefinition, (2) Inter-module interfaces first, (3) Component implementation, (4) Per-function unit tests (Happy Path, Sad Path, Boundary Values, Unexpected/Null/Empty values). Respect the autonomy mode. Make tests delivered by \`agent-qa-engineer\` pass green. Run \`pnpm run check:fix\` and \`pnpm run verify:all\`.
+- **Directives**: Execute the mandatory 4-step order: (1) Modular & Hexagonal Architecture (Ports & Adapters) definition/redefinition, (2) Inter-module interfaces first, (3) Component implementation, (4) Per-function unit tests (Happy Path, Sad Path, Boundary Values, Unexpected/Null/Empty values). Respect the autonomy mode. Make tests delivered by \`agent-qa-engineer\` pass green. Run \`pnpm run check:fix\` and \`pnpm run verify:all\`. Enforce Mandatory Regression Verification (\`pnpm test\`) with zero regressions before declaring completion, and enforce Global Styles Protection on frontend views.
 
 ### 7. \`agent-security-auditor\` (Adversarial Code Auditor)
 - **Mission**: Examine Pull Requests for business logic vulnerabilities, injection vectors, secret leaks, and authorization flaws as part of the Pre-Merge Audit Triad.
@@ -16392,24 +16652,32 @@ function collectAgentFiles(targets) {
   appendMcpFiles(dirs, files);
   return { dirs, files };
 }
-function writeProjectFiles(destDir, files, dryRun) {
-  const filesCreated = [];
+function writeSingleFile(fullFilePath, content, relPath, opts, results) {
+  const exists = fs8__namespace.existsSync(fullFilePath);
+  if (opts.dryRun) {
+    if (exists && opts.force) results.filesUpdated.push(relPath);
+    else if (!exists) results.filesCreated.push(relPath);
+    return;
+  }
+  const parentDir = path5__namespace.dirname(fullFilePath);
+  if (!fs8__namespace.existsSync(parentDir)) {
+    fs8__namespace.mkdirSync(parentDir, { recursive: true });
+  }
+  if (!exists) {
+    fs8__namespace.writeFileSync(fullFilePath, content, "utf-8");
+    results.filesCreated.push(relPath);
+  } else if (opts.force) {
+    fs8__namespace.writeFileSync(fullFilePath, content, "utf-8");
+    results.filesUpdated.push(relPath);
+  }
+}
+function writeProjectFiles(destDir, files, dryRun, force) {
+  const results = { filesCreated: [], filesUpdated: [] };
   for (const f of files) {
-    const fullFilePath = path4__namespace.join(destDir, f.relPath);
-    const parentDir = path4__namespace.dirname(fullFilePath);
-    if (!dryRun) {
-      if (!fs7__namespace.existsSync(parentDir)) {
-        fs7__namespace.mkdirSync(parentDir, { recursive: true });
-      }
-      if (!fs7__namespace.existsSync(fullFilePath)) {
-        fs7__namespace.writeFileSync(fullFilePath, f.content, "utf-8");
-        filesCreated.push(f.relPath);
-      }
-    } else {
-      filesCreated.push(f.relPath);
-    }
+    const fullFilePath = path5__namespace.join(destDir, f.relPath);
+    writeSingleFile(fullFilePath, f.content, f.relPath, { dryRun, force }, results);
   }
-  return filesCreated;
+  return results;
 }
 function validateCiProvider(ci) {
   if (!ci) return { valid: true };
@@ -16486,7 +16754,7 @@ function getCiWorkflowFiles(ciProvider) {
 function createDirectoriesOnDisk(destDir, directories, dryRun) {
   const created = [];
   for (const d of directories) {
-    if (!dryRun) fs7__namespace.mkdirSync(path4__namespace.join(destDir, d), { recursive: true });
+    if (!dryRun) fs8__namespace.mkdirSync(path5__namespace.join(destDir, d), { recursive: true });
     created.push(d);
   }
   return created;
@@ -16501,7 +16769,7 @@ function collectStarterFiles(ciProvider, agentFiles = [], archGranularity = "min
     ...getCiWorkflowFiles(ciProvider),
     ...agentFiles,
     ...getArchitectureTemplates(archGranularity).map((t) => ({
-      relPath: path4__namespace.join("templates", "architecture", t.filename).replace(/\\/g, "/"),
+      relPath: path5__namespace.join("templates", "architecture", t.filename).replace(/\\/g, "/"),
       content: t.content
     }))
   ];
@@ -16532,15 +16800,15 @@ function injectMissingScripts(scripts) {
   return modified;
 }
 function updateConsumerPackageJson(destDir, dryRun) {
-  const pkgPath = path4__namespace.join(destDir, "package.json");
-  if (!fs7__namespace.existsSync(pkgPath)) return false;
+  const pkgPath = path5__namespace.join(destDir, "package.json");
+  if (!fs8__namespace.existsSync(pkgPath)) return false;
   try {
-    const pkg = JSON.parse(fs7__namespace.readFileSync(pkgPath, "utf-8"));
+    const pkg = JSON.parse(fs8__namespace.readFileSync(pkgPath, "utf-8"));
     if (!pkg || typeof pkg !== "object") return false;
     pkg.scripts = pkg.scripts || {};
     const modified = injectMissingScripts(pkg.scripts);
     if (modified && !dryRun) {
-      fs7__namespace.writeFileSync(pkgPath, JSON.stringify(pkg, null, 2) + "\n", "utf-8");
+      fs8__namespace.writeFileSync(pkgPath, JSON.stringify(pkg, null, 2) + "\n", "utf-8");
     }
     return modified;
   } catch {
@@ -16548,7 +16816,7 @@ function updateConsumerPackageJson(destDir, dryRun) {
   }
 }
 function tryInstallGitHook(destDir, dryRun) {
-  if (!dryRun && fs7__namespace.existsSync(path4__namespace.join(destDir, ".git"))) {
+  if (!dryRun && fs8__namespace.existsSync(path5__namespace.join(destDir, ".git"))) {
     return installGitHooks(destDir).success;
   }
   return false;
@@ -16564,6 +16832,7 @@ function buildInitError(targetDir, error) {
     targetDir,
     directoriesCreated: [],
     filesCreated: [],
+    filesUpdated: [],
     agentsConfigured: [],
     gitHookInstalled: false,
     error
@@ -16576,12 +16845,13 @@ function mergeDirectories(base, extra) {
   }
   return result;
 }
-function buildInitSuccessResult(destDir, directoriesCreated, filesCreated, ciProvider, agentsConfigured, architectureGranularity, gitHookInstalled) {
+function buildInitSuccessResult(destDir, directoriesCreated, filesCreated, filesUpdated, ciProvider, agentsConfigured, architectureGranularity, gitHookInstalled) {
   return {
     success: true,
     targetDir: destDir,
     directoriesCreated,
     filesCreated,
+    filesUpdated,
     ciProvider,
     agentsConfigured,
     architectureGranularity,
@@ -16595,24 +16865,32 @@ function validateInitOptions(options) {
   if (!archRes.valid) return { valid: false, archGranularity: "minimal", error: archRes.error };
   return { valid: true, ciProvider: ciRes.provider, archGranularity: archRes.granularity };
 }
+function assembleScaffoldingPlan(ciProvider, agents, archGranularity) {
+  const agentTargets = resolveAgentTargets(agents);
+  const { dirs: agentDirs, files: agentFiles } = collectAgentFiles(agentTargets);
+  const directories = mergeDirectories(getBaseDirectories(ciProvider), agentDirs);
+  const starterFiles = collectStarterFiles(ciProvider, agentFiles, archGranularity);
+  return { agentTargets, directories, starterFiles };
+}
 function initProject(options = {}) {
-  const baseDir = options.rootDir || process.cwd();
-  const destDir = path4__namespace.resolve(baseDir, options.targetDir || ".");
+  const destDir = path5__namespace.resolve(options.rootDir || process.cwd(), options.targetDir || ".");
   const validated = validateInitOptions(options);
   if (!validated.valid) return buildInitError(destDir, validated.error);
-  const agentTargets = resolveAgentTargets(options.agents);
-  const { dirs: agentDirs, files: agentFiles } = collectAgentFiles(agentTargets);
-  const directories = mergeDirectories(getBaseDirectories(validated.ciProvider), agentDirs);
-  const directoriesCreated = createDirectoriesOnDisk(destDir, directories, options.dryRun);
-  const starterFiles = collectStarterFiles(validated.ciProvider, agentFiles, validated.archGranularity);
-  const filesCreated = writeProjectFiles(destDir, starterFiles, options.dryRun);
+  const { agentTargets, directories, starterFiles } = assembleScaffoldingPlan(
+    validated.ciProvider,
+    options.agents,
+    validated.archGranularity
+  );
+  const dirsCreated = createDirectoriesOnDisk(destDir, directories, options.dryRun);
+  const { filesCreated, filesUpdated } = writeProjectFiles(destDir, starterFiles, options.dryRun, options.force);
   if (updateConsumerPackageJson(destDir, options.dryRun)) {
     filesCreated.push("package.json");
   }
   return buildInitSuccessResult(
     destDir,
-    directoriesCreated,
+    dirsCreated,
     filesCreated,
+    filesUpdated,
     validated.ciProvider,
     formatAgentsConfigured(agentTargets),
     validated.archGranularity,
@@ -16681,33 +16959,40 @@ function normalizeParsedRule(raw, idx) {
     enabled: raw.enabled !== false
   };
 }
+function parseDlpDoc(yamlContent) {
+  let doc;
+  try {
+    doc = yaml3__default.default.load(yamlContent);
+  } catch (err) {
+    throw new Error(`[AI-SDLC Fail-Closed] Invalid YAML in dlp-policy: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  if (!doc || typeof doc !== "object" || Array.isArray(doc)) {
+    throw new Error(`[AI-SDLC Fail-Closed] Invalid dlp-policy structure: root must be a YAML mapping`);
+  }
+  const record = doc;
+  if (record.rules !== void 0 && !Array.isArray(record.rules)) {
+    throw new Error(`[AI-SDLC Fail-Closed] Invalid dlp-policy: rules must be an array`);
+  }
+  return record;
+}
 function parseDlpPolicy(yamlContent) {
   const fallback = createDefaultDlpPolicy();
   if (!yamlContent || !yamlContent.trim()) return fallback;
-  try {
-    const doc = yaml3__default.default.load(yamlContent);
-    if (!doc || typeof doc !== "object") return fallback;
-    const rawRules = Array.isArray(doc.rules) ? doc.rules : [];
-    const parsedRules = rawRules.map((r, i) => normalizeParsedRule(r, i)).filter((r) => r !== null);
-    return {
-      version: typeof doc.version === "string" ? doc.version : "1.0",
-      enabled: doc.enabled !== false,
-      zero_data_retention_required: Boolean(doc.zero_data_retention_required ?? true),
-      rules: parsedRules.length > 0 ? parsedRules : fallback.rules
-    };
-  } catch {
-    return fallback;
-  }
+  const record = parseDlpDoc(yamlContent);
+  const rawRules = Array.isArray(record.rules) ? record.rules : [];
+  const parsedRules = rawRules.map((r, i) => normalizeParsedRule(r, i)).filter((r) => r !== null);
+  return {
+    version: typeof record.version === "string" ? record.version : "1.0",
+    enabled: record.enabled !== false,
+    zero_data_retention_required: Boolean(record.zero_data_retention_required ?? true),
+    rules: parsedRules.length > 0 ? parsedRules : fallback.rules
+  };
 }
 function loadDlpPolicy(rootDir, customPolicyPath) {
   const base = rootDir || process.cwd();
-  const filePath = customPolicyPath ? path4__namespace.isAbsolute(customPolicyPath) ? customPolicyPath : path4__namespace.join(base, customPolicyPath) : path4__namespace.join(base, "dlp-policy.yaml");
-  if (!fs7__namespace.existsSync(filePath)) return createDefaultDlpPolicy();
-  try {
-    return parseDlpPolicy(fs7__namespace.readFileSync(filePath, "utf-8"));
-  } catch {
-    return createDefaultDlpPolicy();
-  }
+  const filePath = customPolicyPath ? path5__namespace.isAbsolute(customPolicyPath) ? customPolicyPath : path5__namespace.join(base, customPolicyPath) : path5__namespace.join(base, "dlp-policy.yaml");
+  if (!fs8__namespace.existsSync(filePath)) return createDefaultDlpPolicy();
+  return parseDlpPolicy(fs8__namespace.readFileSync(filePath, "utf-8"));
 }
 function applySingleDlpRule(text, rule) {
   if (rule.enabled === false) return { output: text, matches: 0 };
@@ -16895,6 +17180,7 @@ exports.STARTER_WORKFLOW_HANDOFF_TEMPLATE = STARTER_WORKFLOW_HANDOFF_TEMPLATE;
 exports.STARTER__GITHUB_PULL_REQUEST_TEMPLATE_MD = STARTER__GITHUB_PULL_REQUEST_TEMPLATE_MD;
 exports.SpecKitAdapter = SpecKitAdapter;
 exports.TYPE_TO_SCHEMA_MAP = TYPE_TO_SCHEMA_MAP;
+exports.UNIT_TEST_SUFFIXES = UNIT_TEST_SUFFIXES;
 exports.VALID_AGENT_TARGETS = VALID_AGENT_TARGETS;
 exports.VALID_ARCHITECTURE_GRANULARITIES = VALID_ARCHITECTURE_GRANULARITIES;
 exports.VALID_AUTONOMY_MODES = VALID_AUTONOMY_MODES;
@@ -16914,6 +17200,7 @@ exports.calculateJaccardSimilarity = calculateJaccardSimilarity;
 exports.calculateMetrics = calculateMetrics;
 exports.calculateRating = calculateRating;
 exports.calculateShannonEntropy = calculateShannonEntropy;
+exports.canonicalSort = canonicalSort;
 exports.checkGherkinInSync = checkGherkinInSync;
 exports.checkoutTaskBranch = checkoutTaskBranch;
 exports.classifyBranch = classifyBranch;
@@ -16922,6 +17209,7 @@ exports.collectAgentFiles = collectAgentFiles;
 exports.collectDashboardMetrics = collectDashboardMetrics;
 exports.collectHistoricalKpis = collectHistoricalKpis;
 exports.computeCanonicalSha256 = computeCanonicalSha256;
+exports.computeRawSha256 = computeRawSha256;
 exports.computeSha256 = computeSha256;
 exports.computeViolationSignature = computeViolationSignature;
 exports.createDefaultDlpPolicy = createDefaultDlpPolicy;
@@ -16947,10 +17235,13 @@ exports.extractFunctions = extractFunctions;
 exports.extractFunctionsBraceLanguages = extractFunctionsBraceLanguages;
 exports.extractFunctionsPolyglot = extractFunctionsPolyglot;
 exports.extractFunctionsPython = extractFunctionsPython;
+exports.extractFunctionsPythonAst = extractFunctionsPythonAst;
 exports.extractFunctionsTypeScriptAst = extractFunctionsTypeScriptAst;
 exports.extractGherkinBlock = extractGherkinBlock;
 exports.extractGherkinFeatures = extractGherkinFeatures;
 exports.extractNormativeText = extractNormativeText;
+exports.extractPythonFunctionsPolyglot = extractPythonFunctionsPolyglot;
+exports.extractSemanticContent = extractSemanticContent;
 exports.findChangeWorkspaceDir = findChangeWorkspaceDir;
 exports.findLicenseFile = findLicenseFile;
 exports.formatCommitTrailers = formatCommitTrailers;
@@ -16959,6 +17250,7 @@ exports.formatReleaseKpiMarkdown = formatReleaseKpiMarkdown;
 exports.generateBranchHierarchyPlan = generateBranchHierarchyPlan;
 exports.generateCycloneDxSbom = generateCycloneDxSbom;
 exports.generateDashboardReport = generateDashboardReport;
+exports.generateDeterministicUuidV5 = generateDeterministicUuidV5;
 exports.generateDuplicatesReportMarkdown = generateDuplicatesReportMarkdown;
 exports.generateGovernanceReportMarkdown = generateGovernanceReportMarkdown;
 exports.generateLicenseReportMarkdown = generateLicenseReportMarkdown;
@@ -16984,10 +17276,13 @@ exports.initProject = initProject;
 exports.injectKpisIntoPrBody = injectKpisIntoPrBody;
 exports.installGitHooks = installGitHooks;
 exports.integrateSddChange = integrateSddChange;
+exports.isCliInstalled = isCliInstalled;
+exports.isFunctionReferencedInTests = isFunctionReferencedInTests;
 exports.isGitleaksInstalled = isGitleaksInstalled;
 exports.isMetricWorsened = isMetricWorsened;
 exports.isPathProtectedFromPatch = isPathProtectedFromPatch;
 exports.isPlaceholderOrIgnored = isPlaceholderOrIgnored;
+exports.isReportContentSemanticallyEqual = isReportContentSemanticallyEqual;
 exports.isRequirementArtifact = isRequirementArtifact2;
 exports.isSemgrepInstalled = isSemgrepInstalled;
 exports.isToolAvailable = isToolAvailable;
@@ -16998,8 +17293,10 @@ exports.loadQualityBaseline = loadQualityBaseline;
 exports.locateTaskInActiveChanges = locateTaskInActiveChanges;
 exports.mapSastSeverityToSarifLevel = mapSastSeverityToSarifLevel;
 exports.maskSecret = maskSecret;
+exports.normalizePath = normalizePath;
 exports.normalizeSpdxLicense = normalizeSpdxLicense;
 exports.normalizeUri = normalizeUri;
+exports.orchestrateNativeAstAnalysis = orchestrateNativeAstAnalysis;
 exports.parseCommitTrailers = parseCommitTrailers;
 exports.parseDlpPolicy = parseDlpPolicy;
 exports.parseFeatureDocument = parseFeatureDocument;
@@ -17034,6 +17331,7 @@ exports.resolveBranchHierarchy = resolveBranchHierarchy;
 exports.resolveCiEnvironment = resolveCiEnvironment;
 exports.resolveCytoscapePath = resolveCytoscapePath;
 exports.resolveDefaultBranchBase = resolveDefaultBranchBase;
+exports.resolveDeterministicDate = resolveDeterministicDate;
 exports.resolveFeatureFilePath = resolveFeatureFilePath;
 exports.resolveGitRef = resolveGitRef;
 exports.resolveLicenseFromFile = resolveLicenseFromFile;
@@ -17046,6 +17344,7 @@ exports.runGitleaksCli = runGitleaksCli;
 exports.runSemgrepCli = runSemgrepCli;
 exports.sanitizeDlpPayload = sanitizeDlpPayload;
 exports.sanitizeDlpText = sanitizeDlpText;
+exports.sanitizeTestCorpus = sanitizeTestCorpus;
 exports.scaffoldSddChange = scaffoldSddChange;
 exports.scanAllProductHandoffs = scanAllProductHandoffs;
 exports.scanAllTestArtifacts = scanAllTestArtifacts;
@@ -17064,11 +17363,13 @@ exports.scanWithNativeFs = scanWithNativeFs;
 exports.scanWithSyft = scanWithSyft;
 exports.scanWithTrivy = scanWithTrivy;
 exports.serializeSarifDocument = serializeSarifDocument;
-exports.slugify = slugify;
+exports.slugify = slugify2;
+exports.stripVolatileReportMetadata = stripVolatileReportMetadata;
 exports.syncPdacDigests = syncPdacDigests;
 exports.tokenizeTitle = tokenizeTitle;
 exports.updateCitationsInContent = updateCitationsInContent;
 exports.validateAgainstSchema = validateAgainstSchema;
+exports.validateAnchorExistence = validateAnchorExistence;
 exports.validateArtifactSchema = validateArtifactSchema;
 exports.verifyArtifactDuplicates = verifyArtifactDuplicates;
 exports.verifyArtifactsSchemas = verifyArtifactsSchemas;
@@ -17093,6 +17394,7 @@ exports.writeCucumberJsonReport = writeCucumberJsonReport;
 exports.writeCycloneDxSbom = writeCycloneDxSbom;
 exports.writeQualityBaseline = writeQualityBaseline;
 exports.writeReleaseKpiReport = writeReleaseKpiReport;
+exports.writeReportFileIfChanged = writeReportFileIfChanged;
 exports.writeSecuritySarifReport = writeSecuritySarifReport;
 exports.writeThirdPartyNotices = writeThirdPartyNotices;
 //# sourceMappingURL=index.cjs.map