@aisdlc/core 2.4.0 → 2.5.1

package/dist/index.d.cts

@@ -25,6 +25,14 @@ interface FunctionMetrics {
     codeSmells: string[];
     line?: number;
 }
+interface LanguageAstReport {
+    language: string;
+    filePath: string;
+    functions: FunctionMetrics[];
+    unsafeTypesCount?: number;
+    emptyStubsCount?: number;
+    rawMetrics?: Record<string, unknown>;
+}
 interface AnalysisResult extends FunctionMetrics {
     relPath: string;
     status: 'PASS' | 'FAIL';
@@ -570,6 +578,7 @@ interface PdacNode {
     filePath: string;
     title?: string;
     digest: string;
+    rawDigest?: string;
     rawContent: string;
     citations: {
         targetId: string;
@@ -587,11 +596,24 @@ interface PdacDrift {
 interface PdacGraphOptions {
     rootDir?: string;
 }
+interface PdacInvalidAnchor {
+    sourceFile: string;
+    targetId: string;
+    anchor: string;
+    reason: string;
+}
+interface PdacUnresolvedCitation {
+    sourceFile: string;
+    targetId: string;
+}
 interface PdacGraphResult {
     success: boolean;
     totalNodes: number;
     totalEdges: number;
     drifts: PdacDrift[];
+    unresolvedCount?: number;
+    unresolvedCitations?: PdacUnresolvedCitation[];
+    invalidAnchors?: PdacInvalidAnchor[];
     reportMarkdown: string;
 }
 interface PdacSyncOptions {
@@ -1170,6 +1192,9 @@ declare function extractFunctionsBraceLanguages(content: string, filePath: strin
 declare function extractFunctionsPython(content: string, filePath: string): FunctionMetrics[];
 declare function calculateMetrics(fnBody: string, fnName: string, filePath: string): FunctionMetrics;
 declare function walkDir(dir: string, extensions?: readonly string[], excludePatterns?: readonly string[]): string[];
+declare const UNIT_TEST_SUFFIXES: string[];
+declare function sanitizeTestCorpus(corpus: string, fnName: string): string;
+declare function isFunctionReferencedInTests(fnName: string, rawCorpus: string): boolean;
 declare function computeViolationSignature(relPath: string, fnName: string, metric: string): string;
 declare function classifyMetricFromMessage(msg: string, fn?: FunctionMetrics): {
     metric: string;
@@ -1202,14 +1227,7 @@ declare function extractFunctionsTypeScriptAst(content: string, filePath: string
  */
 
 declare function extractFunctionsPolyglot(content: string, filePath: string): FunctionMetrics[];
-
-/**
- * AI-SDLC: Automated 360° Traceability Engine (RTM Validator)
- * Verifies complete coverage across:
- *   1. PDaC Handoff (HOF-*) & Product Subgraph (Upstream: UC-*, BR-*, ABUSE-*)
- *   2. arc42 / NAF v4 Architecture Views (Midstream: CMP-*, ADR-*, SEC-ENC-*)
- *   3. BDD / Gherkin Executable Tests (Downstream: .feature files & scenario tags)
- */
+declare function extractPythonFunctionsPolyglot(content: string, filePath: string): FunctionMetrics[];
 
 declare function parseFrontmatter(content: string): {
     frontmatter: ArtifactFrontmatter;
@@ -1334,11 +1352,6 @@ declare function buildFeatureFileContent(rootDir: string, filePath: string, id:
 declare function extractGherkinFeatures(options?: GherkinExtractionOptions): GherkinExtractionResult;
 declare function checkGherkinInSync(options?: GherkinExtractionOptions): GherkinSyncCheckResult;
 
-/**
- * AI-SDLC: Open Source License Compliance & Governance Verifier
- * Supports dynamic Software Composition Analysis (SCA) with CycloneDX SBOM generation.
- */
-
 interface RawPolicyCategory {
     action: 'ALLOW' | 'REVIEW_REQUIRED' | 'DENY' | 'COMMERCIAL_APPROVAL_REQUIRED' | string;
     description?: string;
@@ -1450,12 +1463,11 @@ declare function buildCycloneDxVulnerabilities(vulnerabilities?: ScaVulnerabilit
 declare function generateCycloneDxSbom(dependencies: ScannedDependency[], options?: SbomGenerateOptions): CycloneDxBom;
 declare function writeCycloneDxSbom(sbom: CycloneDxBom, outputPath: string): void;
 declare function generateThirdPartyNotices(dependencies: ScannedDependency[], projectName?: string): string;
-declare function writeThirdPartyNotices(content: string, outputPath: string): void;
-
-/**
- * AI-SDLC: Product Definition as Code (PDaC) Graph & Cryptographic Drift Verifier
- */
+declare function writeThirdPartyNotices(noticesContent: string, outputPath: string): void;
 
+declare function extractSemanticContent(content: string): string;
+declare function validateAnchorExistence(targetContent: string, anchor: string): boolean;
+declare function computeRawSha256(content: string): string;
 declare function computeCanonicalSha256(content: string): string;
 declare function parseFrontmatterId(content: string): {
     id?: string;
@@ -1469,7 +1481,7 @@ interface CitationEntry {
     sourceFile: string;
 }
 declare function extractCitations(content: string, sourceFile: string): CitationEntry[];
-declare function generatePdacReportMarkdown(nodes: PdacNode[], drifts: PdacDrift[], unresolvedCount: number): string;
+declare function generatePdacReportMarkdown(nodes: PdacNode[], drifts: PdacDrift[], unresolvedCount: number, invalidAnchors?: PdacInvalidAnchor[]): string;
 declare function verifyPdacGraph(options?: PdacGraphOptions): PdacGraphResult;
 declare function updateCitationsInContent(content: string, baselineMap: Map<string, PdacNode>, sourceFile: string, details: PdacSyncDetail[]): {
     updatedContent: string;
@@ -1532,19 +1544,6 @@ declare function verifyProgressiveFriction(options?: ProgressiveFrictionOptions)
 declare function scanManualsInWorkspace(rootDir: string): ManualDocumentItem[];
 declare function verifyManuals(options?: ManualsVerificationOptions): ManualsVerificationResult;
 
-/**
- * AI-SDLC: Deterministic Duplicate Requirements Verifier (Shift-Left Pre-Implementation Gate)
- *
- * Verifies that requirements do not collide or duplicate before coding starts:
- *   1. ID Collisions: Different files declaring the same canonical ID (ERROR)
- *   2. Exact Content / Hash Collisions: Different IDs with identical body / SHA-256 (ERROR)
- *   3. Title Redundancy: High lexical similarity (>= 85%) on normalized titles (ERROR)
- *   4. BDD Tag Collisions: Distinct requirements claiming the same specific cucumber-tags (ERROR)
- *   5. Shared Business Rules: Distinct requirements governing the same atomic BR-* (WARNING)
- *
- * NOTE: Multiple requirements under the same Use Case (UC-*) are EXPLICITLY VALID (SRP).
- */
-
 interface ScannedRequirement {
     id: string;
     file: string;
@@ -1668,16 +1667,12 @@ interface PiiSastRule {
     pattern: RegExp;
 }
 declare const PII_SAST_RULES: readonly PiiSastRule[];
-declare function loadPrivacyPolicy(rootDir: string, policyPath?: string): PrivacyPolicy;
+declare function loadPrivacyPolicy(rootDir?: string, policyPath?: string): PrivacyPolicy;
 declare function scanFileForPrivacyViolations(filePath: string, rootDir: string, policy?: PrivacyPolicy): PrivacyViolation[];
 declare function generateRopaInventoryMarkdown(result: PrivacyVerifierResult, policy?: PrivacyPolicy): string;
 declare function generatePrivacyReportMarkdown(result: PrivacyVerifierResult, policy?: PrivacyPolicy): string;
 declare function verifyPrivacy(options?: PrivacyVerifierOptions): PrivacyVerifierResult;
 
-/**
- * AI-SDLC: Automated Formal Quality Report Generator (Polyglot)
- */
-
 declare function calculateRating(mi: number, cc: number): 'A' | 'B' | 'C' | 'D' | 'F';
 declare function detectLanguage(filePath: string): string;
 declare function readCodeCoverageSummary(rootDir?: string): CodeCoverageSummary | null;
@@ -1991,7 +1986,7 @@ interface DashboardMetricsData {
 }
 declare function renderAutonomyModeSection(mode: string, statusIcon: string, count: number, roleDescription: string, allTasks?: TaskSummary[]): string;
 declare function renderManualsTab(manuals: ManualsVerificationResult): string;
-declare function renderDashboardHtml(graphData: GraphElementsResult, metricsData: DashboardMetricsData, title?: string): string;
+declare function renderDashboardHtml(graphData: GraphElementsResult, metricsData: DashboardMetricsData, title?: string, generationDate?: string): string;
 
 /**
  * Loads historical KPI records from reports/releases/ directory.
@@ -2335,11 +2330,11 @@ declare function renderAntigravitySkillFile(skill: LifecycleSkillTemplate): stri
 declare function renderCursorSkillFile(skill: LifecycleSkillTemplate): string;
 declare function renderClaudeSkillFile(skill: LifecycleSkillTemplate): string;
 declare function renderCopilotSkillFile(skill: LifecycleSkillTemplate): string;
-declare const STARTER_ANTIGRAVITY_RULES = "# Google Antigravity & Gemini CLI Rules - AI-SDLC Framework\n\nCanonical Reference: [`process/09_agent_protocols.md`](../../process/09_agent_protocols.md) and [`process/01_governance_and_roles.md`](../../process/01_governance_and_roles.md).\n\nThis file defines the operational rules and specialized role mappings for Google Antigravity and Gemini CLI-based agents within the AI-SDLC ecosystem.\n\n---\n\n## 1. The 5 Unbreakable Commandments of Agents | Los 5 Mandamientos Inquebrantables de los Agentes\n\n1. **FORBIDDEN TO AUTO-APPROVE OR AUTO-MERGE | PROHIBIDO AUTO-APROBAR O AUTO-FUSIONAR**: No agent may auto-approve PRs or perform direct merges to protected branches (`main`, `release/*`). Only a human engineer may approve or merge.\n2. **FORBIDDEN TO INVENT PRODUCT OR ARCHITECTURE DECISIONS**: When facing ambiguous requirements, formulate clarifying questions (`open-questions`). Never assume unspecified intentions.\n3. **FORBIDDEN TO INTRODUCE DEPENDENCIES WITHOUT LICENSE INSPECTION**: Always consult `license-policy.yaml`. Dependencies with viral licenses (`GPL`/`AGPL`) or commercial paid licenses (`BSL`/`SSPL`) are strictly forbidden without authorization.\n4. **FORBIDDEN TO IGNORE CYBERSECURITY & PRIVACY (SECURITY-BY-DEFAULT & PRIVACY-BY-DEFAULT)**: Validate inputs, sanitize data, protect PII according to `privacy-policy.yaml`, and add mitigation tests (`SEC-TEST-*`, `@privacy`). Disabling linters or suppressing typing errors is prohibited.\n5. **MANDATORY CRYPTOGRAPHIC CITATION**: Every derived artifact must cite upstream artifacts using canonical identifiers and their Unix LF-normalized SHA-256 cryptographic hashes.\n\n---\n\n## 2. Specialized Roles Mapping\n\n### 1. `agent-product-analyst` (Product Analyst / Scribe)\n- **Mission**: Capture new product intent via NAF v4 Enterprise & Capability Vision (`ARCH-INTRO-*`) and define/refine the product model using ProductShape.\n- **Phase 0 (Greenfield Product Inception)**: When creating a new product from scratch (or when `specs/product/` has no baseline), run a concise 3\u20135 question discovery interview (mission/problem, actors `ACT-*`, MVP capabilities `UC-*`, priority quality goals `QR-*`), draft `ARCH-INTRO-001` (`templates/architecture/introduction-and-goals.template.md`), and derive initial `ACT-*`, `UC-*`, `BR-*`, `FR-*`, and `QR-*` drafts.\n- **Input**: Business intent or natural language specification.\n- **Output**: Markdown artifacts with YAML frontmatter compliant with `schemas/architecture/introduction-and-goals.schema.json` (`ARCH-INTRO-*`) and `schemas/product/` (`ACT-*`, `UC-*`, `FR-*`, `QR-*`, `BR-*`).\n- **Guardrails**:\n  - `status` always starts in `draft`.\n  - In `UC-*`, format section `1. Intent and Outcome` under the standard English structure: `As a <ACT-ID>... I want <action>... To <outcome>...`.\n  - Mandatory Gherkin criteria with `@<ID> @automated @regression`.\n  - Run `pnpm run verify:schemas` and `pnpm run verify:duplicates` before delivering the draft.\n\n### 2. `agent-threat-modeler` (Threat Modeler and Security Specialist)\n- **Mission**: Analyze use cases and proactively model adversaries, STRIDE attack vectors, and OWASP ASVS mitigations, both at product level and in the technical security feedback loop over architecture.\n- **Input**: Use cases `UC-*`, functional requirements `FR-*`, or architecture components (`CMP-*`, Mermaid diagrams, ADRs).\n- **Output**: Cybersecurity triad (`ACT-THREAT-*`, `ABUSE-*`, `SEC-REQ-*`) compliant with `schemas/security/`, followed by handoff to `agent-privacy-officer`.\n- **Guardrails**:\n  - `status` always starts in `draft`.\n  - Negative BDD attack and rejection scenarios tagged with `@security @mitigation`.\n  - Assignment of Zero Trust enclaves `SEC-ENC-*`.\n\n### 3. `agent-privacy-officer` (Data Protection & Privacy-by-Design Specialist)\n- **Mission**: Receive handoff from `agent-threat-modeler` to model personal data assets (`DATA-ASSET-*`), GDPR Art. 30 processing activities (`PRIV-ROPA-*`), and LINDDUN / GDPR / ISO 27701 privacy requirements (`PRIV-REQ-*`), and audit PR diffs against `privacy-policy.yaml`.\n- **Output**: Privacy triad (`DATA-ASSET-*`, `PRIV-ROPA-*`, `PRIV-REQ-*`) in `specs/privacy/` compliant with `schemas/privacy/`, and `DPIA-*` requests when Art. 9 sensitive data is detected.\n- **Guardrails**:\n  - `status` always starts in `draft`.\n  - Every `PRIV-REQ-*` includes Gherkin scenarios tagged with `@<PRIV-REQ-ID> @privacy @gdpr @automated @regression`.\n  - Run `pnpm run verify:privacy` to block PII in logs/prompts and enforce ROPA & retention/erasure policies.\n\n### 4. `agent-system-architect` (System Architect)\n- **Mission**: Translate the approved product definition into a modular technical architecture based on arc42 enriched with NAF v4.\n- **Output**: Architecture components (`CMP-*`), Mermaid diagrams, and immutable `ADR-*` records compliant with `schemas/architecture/`.\n- **Guardrails**:\n  - Every `CMP-*` must declare `satisfies-requirements` linking `FR-*`, `QR-*`, `SEC-REQ-*`, and `PRIV-REQ-*`, and structure modules following **Modular & Hexagonal Architecture (Ports & Adapters)** (Domain/Application Core + Inbound/Outbound Ports, enforcing the Dependency Rule).\n  - Emit a return handoff to `agent-threat-modeler` (chaining to `agent-privacy-officer`) in the technical security/privacy feedback loop when infrastructure or persistence decisions introduce new attack vectors or PII flows.\n\n### 5. `agent-qa-engineer` (QA Engineer and SDET)\n- **Mission**: Translate approved requirements (`FR-*`, `SEC-REQ-*`, `PRIV-REQ-*`, `QR-*`) into comprehensive FAILING (red) BDD/Gherkin, End-to-End (E2E), UI, and unit test suites, before `agent-developer` writes production code.\n- **Input**: Approved requirements from the `handoff.yaml` sidecar (`HOF-*`).\n- **Output**: Failing Gherkin, E2E, and UI test suites covering: nominal case, boundary cases, out-of-range cases, per-interactive-element tests (Happy Path, Sad Path, Boundary Values), and conditional categories (security, privacy, performance, idempotency, postconditions, interface contract).\n- **Guardrails**:\n  - FORBIDDEN to include production code or anticipate implementations.\n  - **Agreed Project Technology**: Always use the testing frameworks, E2E/UI runners, and technology stack agreed upon for the project (if any), without requiring the user to specify it in the prompt.\n  - **Mandatory E2E & UI Testing**: Never forget or omit End-to-End (E2E) and User Interface (UI) tests.\n  - **Per-Interactive-Element Coverage**: Create specific tests for every UI element the user can interact with, covering Happy Path, Sad Path, and Boundary Values for each one.\n  - Every `FR-*` must have at least nominal + boundary + out-of-range scenarios; missing these blocks handoff to `agent-developer`.\n  - Mandatory tags: `@<FR-ID> @automated @regression`.\n  - Run `pnpm run verify:testing` before emitting handoff.\n\n### 6. `agent-developer` (Software Developer)\n- **Mission**: Implement atomic tasks from SDD specifications (`tasks.md`) with clean, strictly typed code and thorough tests.\n- **Directives**:\n  - **Mandatory 4-Step Implementation Order**: (1) Define/refine Modular & Hexagonal Architecture (Ports & Adapters) module boundaries, (2) Define interfaces/ports for all inter-module interactions to avoid direct module coupling, (3) Implement components consuming/fulfilling those interfaces, (4) Write unit tests for every function covering Happy Path, Sad Path, Boundary Values, and Unexpected/Null/Empty values.\n  - Respect the autonomy mode assigned in `tasks.md` (`AUTONOMOUS`, `HUMAN_REVIEW_PLAN`, `AMBIGUOUS`, `HIGH_RISK_MANUAL`).\n  - Make tests delivered by `agent-qa-engineer` pass green without altering them to accommodate code.\n  - Respect `quality-policy.yaml` thresholds: CC $\\le 10$, Cognitive $\\le 15$, MI $\\ge 50$, LOC $\\le 40$.\n  - Run pre-flight with auto-fix: `pnpm run check:fix` and full verification: `pnpm run verify:all`.\n  - Upon completing green implementation, suggest handoff to `agent-expert-user` for post-development functional validation prior to security and privacy audit.\n\n### 7. `agent-security-auditor` (Adversarial Code Auditor)\n- **Mission**: Rigorously examine Pull Requests for business logic vulnerabilities, injection vectors, secret leaks, and authorization flaws as part of the Pre-Merge Audit Triad.\n- **Directives**:\n  - Analyze code diffs with an attacker mindset and run `pnpm run verify:security`.\n  - Issue findings with CVSS v3.1 severity scoring and block any PR introducing CRITICAL or HIGH security risks.\n\n### 8. `agent-compliance-checker` (Open Source License Compliance Auditor)\n- **Mission**: Audit dependency manifests and ensure every direct and transitive third-party package complies with `license-policy.yaml` as part of the Pre-Merge Audit Triad.\n- **Directives**:\n  - Verify SPDX identifiers via `pnpm run verify:licenses`, immediately blocking viral (`GPL`, `AGPL`) or unapproved commercial (`BSL`, `SSPL`) licenses.\n\n### 9. `agent-expert-user` (Expert User and Domain Evaluator)\n- **Mission**: Contrast design and specifications (design phase) and functionally validate finished software against `UC-*` and `FR-*` (post-development phase).\n- **Directives**:\n  - Design mode (upstream): Adopt the primary actor's profile under stressful field conditions, applying bimodal discrimination (strict MVP core vs. roadmap suggestion backlog in `templates/product/user-design-feedback.template.md`).\n  - Functional validation mode (downstream / pre-PR / post-development functional validation): Thoroughly contrast interface and actual CLI execution against `UC-*` and `FR-*` acceptance criteria before pre-merge security audit.\n  - Emit handoff block suggesting `agent-code-reviewer` / `agent-security-auditor` / `agent-privacy-officer` if compliant, or return to `agent-developer` on functional drift.\n\n### 10. `agent-code-reviewer` (Technical and Architectural Code Reviewer)\n- **Mission**: Audit Pull Requests evaluating code cleanliness, adherence to SOLID, DRY, YAGNI principles, design patterns, and respect for complexity and maintainability thresholds (`quality-policy.yaml`), forming part of the Pre-Merge Audit Triad.\n- **Directives**:\n  - Respect `quality-policy.yaml` thresholds: CC $\\le 10$, Cognitive $\\le 15$, MI $\\ge 50$, LOC $\\le 40$.\n  - Detect improper coupling, code smells, magic numbers, ambiguous names, and encapsulation violations.\n  - Flag premature abstractions and speculative code violating YAGNI.\n  - Coordinate Pre-Merge Audit Triad with `agent-security-auditor`, `agent-privacy-officer`, and `agent-compliance-checker`.\n  - Classify findings into: `[BLOCKING]` (quality violation or broken pattern), `[CLEAN_CODE_SUGGESTION]` (non-blocking improvement), and `[COMPLIANT]`.\n\n### 11. `agent-devops` (Automation and Infrastructure Engineer)\n- **Mission**: Maintain, evolve, and audit automated project infrastructure: CI/CD workflows, Docker containers, IaC manifests, and support scripts.\n- **Directives**:\n  - Strict infrastructure domain: Operates exclusively in `.github/workflows/`, `Dockerfile*`, `docker-compose*.yml`, IaC manifests, and `scripts/`.\n  - **NON-INVASION GUARDRAIL**: STRICTLY FORBIDDEN from modifying or refactoring application source code files (`src/`, `packages/*/src/`). Your responsibility is the pipeline and scaffolding, never application business logic.\n  - Infrastructure dependency policy: Verify licenses of dependencies, base images, and third-party actions according to `license-policy.yaml`.\n  - Gate preservation: Ensure pipeline optimizations preserve all existing deterministic Quality Gates intact.\n  - **Cross-Workflow Audit**: When fixing any CI/CD or configuration defect detected in a PR, search all `.github/workflows/*.yml` for the same pattern (including release, post-merge, and publishing pipelines) before declaring the fix complete.\n  - **Remote Verification**: Creating a PR (`gh pr create`) does not equal success; actively verify that remote checks pass (`gh pr checks`).\n\n---\n\n## 3. Git 4-Tier Hierarchy and Commit Conventions\n- `task/<PARENT-ID>/<TSK-ID>-<slug>` $\\rightarrow$ `feat/<FEAT-ID>-<slug>` $\\rightarrow$ `release/vX.Y.Z` $\\rightarrow$ `main`.\n- Mandatory commit trailers injection:\n  ```text\n  Author-Type: agent\n  AI-Model: gemini-1.5-pro / gemini-2.0-flash\n  Task-ID: TSK-XXX\n  Change-ID: CHG-XXX\n  ```\n\n---\n\n## 4. Workflow Handoff Protocol and Human Action Window | Ventana de Acci\u00F3n Humana\n- **Conditional Activation Rule by Autonomy**:\n  - \uD83D\uDFE2 **`AUTONOMOUS`** (or exclusive final supervision in PR/CI): **OMITTED**. Do not request or emit interactive handoff to avoid interrupting unattended execution.\n  - \uD83D\uDFE1 **Autonomy $\\ge$ `HUMAN_REVIEW_PLAN`** (`HUMAN_REVIEW_PLAN`, `AMBIGUOUS`, `HIGH_RISK_MANUAL`): **MANDATORY**. Emit the Workflow Handoff block compliant with [`templates/workflow/agent-handoff.template.md`](../../templates/workflow/agent-handoff.template.md) and **STOP**.\n- **Block Contents**: Declare produced deliverables, recommend the next role in workflow (`agent-threat-modeler`, `agent-privacy-officer`, `agent-system-architect`, `agent-qa-engineer`, `agent-developer`, `agent-expert-user`, `agent-code-reviewer`, `agent-security-auditor`, `agent-compliance-checker`, `agent-devops`, etc.), provide suggested invocation prompt, and keep **the Human Action Window open at all times for the human user to take action** (review, edit by hand, pause/reroute, or delegate).\n";
+declare const STARTER_ANTIGRAVITY_RULES = "# Google Antigravity & Gemini CLI Rules - AI-SDLC Framework\n\nCanonical Reference: [`process/09_agent_protocols.md`](../../process/09_agent_protocols.md) and [`process/01_governance_and_roles.md`](../../process/01_governance_and_roles.md).\n\nThis file defines the operational rules and specialized role mappings for Google Antigravity and Gemini CLI-based agents within the AI-SDLC ecosystem.\n\n---\n\n## 1. The 5 Unbreakable Commandments of Agents | Los 5 Mandamientos Inquebrantables de los Agentes\n\n1. **FORBIDDEN TO AUTO-APPROVE OR AUTO-MERGE | PROHIBIDO AUTO-APROBAR O AUTO-FUSIONAR**: No agent may auto-approve PRs or perform direct merges to protected branches (`main`, `release/*`). Only a human engineer may approve or merge.\n2. **FORBIDDEN TO INVENT PRODUCT OR ARCHITECTURE DECISIONS**: When facing ambiguous requirements, formulate clarifying questions (`open-questions`). Never assume unspecified intentions.\n3. **FORBIDDEN TO INTRODUCE DEPENDENCIES WITHOUT LICENSE INSPECTION**: Always consult `license-policy.yaml`. Dependencies with viral licenses (`GPL`/`AGPL`) or commercial paid licenses (`BSL`/`SSPL`) are strictly forbidden without authorization.\n4. **FORBIDDEN TO IGNORE CYBERSECURITY & PRIVACY (SECURITY-BY-DEFAULT & PRIVACY-BY-DEFAULT)**: Validate inputs, sanitize data, protect PII according to `privacy-policy.yaml`, and add mitigation tests (`SEC-TEST-*`, `@privacy`). Disabling linters or suppressing typing errors is prohibited.\n5. **MANDATORY CRYPTOGRAPHIC CITATION**: Every derived artifact must cite upstream artifacts using canonical identifiers and their Unix LF-normalized SHA-256 cryptographic hashes.\n\n---\n\n## 2. Specialized Roles Mapping\n\n### 1. `agent-product-analyst` (Product Analyst / Scribe)\n- **Mission**: Capture new product intent via NAF v4 Enterprise & Capability Vision (`ARCH-INTRO-*`) and define/refine the product model using ProductShape.\n- **Phase 0 (Greenfield Product Inception)**: When creating a new product from scratch (or when `specs/product/` has no baseline), run a concise 3\u20135 question discovery interview (mission/problem, actors `ACT-*`, MVP capabilities `UC-*`, priority quality goals `QR-*`), draft `ARCH-INTRO-001` (`templates/architecture/introduction-and-goals.template.md`), and derive initial `ACT-*`, `UC-*`, `BR-*`, `FR-*`, and `QR-*` drafts.\n- **Input**: Business intent or natural language specification.\n- **Output**: Markdown artifacts with YAML frontmatter compliant with `schemas/architecture/introduction-and-goals.schema.json` (`ARCH-INTRO-*`) and `schemas/product/` (`ACT-*`, `UC-*`, `FR-*`, `QR-*`, `BR-*`).\n- **Guardrails**:\n  - `status` always starts in `draft`.\n  - In `UC-*`, format section `1. Intent and Outcome` under the standard English structure: `As a <ACT-ID>... I want <action>... To <outcome>...`.\n  - Mandatory Gherkin criteria with `@<ID> @automated @regression`.\n  - Run `pnpm run verify:schemas` and `pnpm run verify:duplicates` before delivering the draft.\n\n### 2. `agent-threat-modeler` (Threat Modeler and Security Specialist)\n- **Mission**: Analyze use cases and proactively model adversaries, STRIDE attack vectors, and OWASP ASVS mitigations, both at product level and in the technical security feedback loop over architecture.\n- **Input**: Use cases `UC-*`, functional requirements `FR-*`, or architecture components (`CMP-*`, Mermaid diagrams, ADRs).\n- **Output**: Cybersecurity triad (`ACT-THREAT-*`, `ABUSE-*`, `SEC-REQ-*`) compliant with `schemas/security/`, followed by handoff to `agent-privacy-officer`.\n- **Guardrails**:\n  - `status` always starts in `draft`.\n  - Negative BDD attack and rejection scenarios tagged with `@security @mitigation`.\n  - Assignment of Zero Trust enclaves `SEC-ENC-*`.\n\n### 3. `agent-privacy-officer` (Data Protection & Privacy-by-Design Specialist)\n- **Mission**: Receive handoff from `agent-threat-modeler` to model personal data assets (`DATA-ASSET-*`), GDPR Art. 30 processing activities (`PRIV-ROPA-*`), and LINDDUN / GDPR / ISO 27701 privacy requirements (`PRIV-REQ-*`), and audit PR diffs against `privacy-policy.yaml`.\n- **Output**: Privacy triad (`DATA-ASSET-*`, `PRIV-ROPA-*`, `PRIV-REQ-*`) in `specs/privacy/` compliant with `schemas/privacy/`, and `DPIA-*` requests when Art. 9 sensitive data is detected.\n- **Guardrails**:\n  - `status` always starts in `draft`.\n  - Every `PRIV-REQ-*` includes Gherkin scenarios tagged with `@<PRIV-REQ-ID> @privacy @gdpr @automated @regression`.\n  - Run `pnpm run verify:privacy` to block PII in logs/prompts and enforce ROPA & retention/erasure policies.\n\n### 4. `agent-system-architect` (System Architect)\n- **Mission**: Translate the approved product definition into a modular technical architecture based on arc42 enriched with NAF v4.\n- **Output**: Architecture components (`CMP-*`), Mermaid diagrams, and immutable `ADR-*` records compliant with `schemas/architecture/`.\n- **Guardrails**:\n  - Every `CMP-*` must declare `satisfies-requirements` linking `FR-*`, `QR-*`, `SEC-REQ-*`, and `PRIV-REQ-*`, and structure modules following **Modular & Hexagonal Architecture (Ports & Adapters)** (Domain/Application Core + Inbound/Outbound Ports, enforcing the Dependency Rule).\n  - Emit a return handoff to `agent-threat-modeler` (chaining to `agent-privacy-officer`) in the technical security/privacy feedback loop when infrastructure or persistence decisions introduce new attack vectors or PII flows.\n\n### 5. `agent-qa-engineer` (QA Engineer and SDET)\n- **Mission**: Translate approved requirements (`FR-*`, `SEC-REQ-*`, `PRIV-REQ-*`, `QR-*`) into comprehensive FAILING (red) BDD/Gherkin, End-to-End (E2E), UI, and unit test suites, before `agent-developer` writes production code.\n- **Input**: Approved requirements from the `handoff.yaml` sidecar (`HOF-*`).\n- **Output**: Failing Gherkin, E2E, and UI test suites covering: nominal case, boundary cases, out-of-range cases, per-interactive-element tests (Happy Path, Sad Path, Boundary Values), and conditional categories (security, privacy, performance, idempotency, postconditions, interface contract).\n- **Guardrails**:\n  - FORBIDDEN to include production code or anticipate implementations.\n  - **Agreed Project Technology**: Always use the testing frameworks, E2E/UI runners, and technology stack agreed upon for the project (if any), without requiring the user to specify it in the prompt.\n  - **Mandatory E2E & UI Testing**: Never forget or omit End-to-End (E2E) and User Interface (UI) tests.\n  - **Per-Interactive-Element Coverage**: Create specific tests for every UI element the user can interact with, using external tools such as Playwright or FlatUI (or the agreed project testing technology), covering Happy Path, Sad Path, and Boundary Values for each one.\n  - Every `FR-*` must have at least nominal + boundary + out-of-range scenarios; missing these blocks handoff to `agent-developer`.\n  - Mandatory tags: `@<FR-ID> @automated @regression`.\n  - Run `pnpm run verify:testing` before emitting handoff.\n\n### 6. `agent-developer` (Software Developer)\n- **Mission**: Implement atomic tasks from SDD specifications (`tasks.md`) with clean, strictly typed code and thorough tests.\n- **Directives**:\n  - **Mandatory 4-Step Implementation Order**: (1) Define/refine Modular & Hexagonal Architecture (Ports & Adapters) module boundaries, (2) Define interfaces/ports for all inter-module interactions to avoid direct module coupling, (3) Implement components consuming/fulfilling those interfaces, (4) Write unit tests for every function covering Happy Path, Sad Path, Boundary Values, and Unexpected/Null/Empty values.\n  - Respect the autonomy mode assigned in `tasks.md` (`AUTONOMOUS`, `HUMAN_REVIEW_PLAN`, `AMBIGUOUS`, `HIGH_RISK_MANUAL`).\n  - Make tests delivered by `agent-qa-engineer` pass green without altering them to accommodate code.\n  - Respect `quality-policy.yaml` thresholds: CC $\\le 10$, Cognitive $\\le 15$, MI $\\ge 50$, LOC $\\le 40$.\n  - Run pre-flight with auto-fix: `pnpm run check:fix` and full verification: `pnpm run verify:all`.\n  - **Mandatory Regression Verification**: Never declare build, typecheck, or bug fixes complete without executing the relevant automated test suite (`pnpm test`, `dotnet test`) and confirming zero regressions.\n  - **Global Styles Protection**: When touching or refactoring frontend views, verify that global stylesheet/asset imports remain intact and that layouts suffer no visual disruption.\n  - Upon completing green implementation, suggest handoff to `agent-expert-user` for post-development functional validation prior to security and privacy audit.\n\n### 7. `agent-security-auditor` (Adversarial Code Auditor)\n- **Mission**: Rigorously examine Pull Requests for business logic vulnerabilities, injection vectors, secret leaks, and authorization flaws as part of the Pre-Merge Audit Triad.\n- **Directives**:\n  - Analyze code diffs with an attacker mindset and run `pnpm run verify:security`.\n  - Issue findings with CVSS v3.1 severity scoring and block any PR introducing CRITICAL or HIGH security risks.\n\n### 8. `agent-compliance-checker` (Open Source License Compliance Auditor)\n- **Mission**: Audit dependency manifests and ensure every direct and transitive third-party package complies with `license-policy.yaml` as part of the Pre-Merge Audit Triad.\n- **Directives**:\n  - Verify SPDX identifiers via `pnpm run verify:licenses`, immediately blocking viral (`GPL`, `AGPL`) or unapproved commercial (`BSL`, `SSPL`) licenses.\n\n### 9. `agent-expert-user` (Expert User and Domain Evaluator)\n- **Mission**: Contrast design and specifications (design phase) and functionally validate finished software against `UC-*` and `FR-*` (post-development phase).\n- **Directives**:\n  - Design mode (upstream): Adopt the primary actor's profile under stressful field conditions, applying bimodal discrimination (strict MVP core vs. roadmap suggestion backlog in `templates/product/user-design-feedback.template.md`).\n  - Functional validation mode (downstream / pre-PR / post-development functional validation): Thoroughly contrast interface and actual CLI execution against `UC-*` and `FR-*` acceptance criteria before pre-merge security audit.\n  - Emit handoff block suggesting `agent-code-reviewer` / `agent-security-auditor` / `agent-privacy-officer` if compliant, or return to `agent-developer` on functional drift.\n\n### 10. `agent-code-reviewer` (Technical and Architectural Code Reviewer)\n- **Mission**: Audit Pull Requests evaluating code cleanliness, adherence to SOLID, DRY, YAGNI principles, design patterns, and respect for complexity and maintainability thresholds (`quality-policy.yaml`), forming part of the Pre-Merge Audit Triad.\n- **Directives**:\n  - Respect `quality-policy.yaml` thresholds: CC $\\le 10$, Cognitive $\\le 15$, MI $\\ge 50$, LOC $\\le 40$.\n  - Detect improper coupling, code smells, magic numbers, ambiguous names, and encapsulation violations.\n  - Flag premature abstractions and speculative code violating YAGNI.\n  - Coordinate Pre-Merge Audit Triad with `agent-security-auditor`, `agent-privacy-officer`, and `agent-compliance-checker`.\n  - Classify findings into: `[BLOCKING]` (quality violation or broken pattern), `[CLEAN_CODE_SUGGESTION]` (non-blocking improvement), and `[COMPLIANT]`.\n\n### 11. `agent-devops` (Automation and Infrastructure Engineer)\n- **Mission**: Maintain, evolve, and audit automated project infrastructure: CI/CD workflows, Docker containers, IaC manifests, and support scripts.\n- **Directives**:\n  - Strict infrastructure domain: Operates exclusively in `.github/workflows/`, `Dockerfile*`, `docker-compose*.yml`, IaC manifests, and `scripts/`.\n  - **NON-INVASION GUARDRAIL**: STRICTLY FORBIDDEN from modifying or refactoring application source code files (`src/`, `packages/*/src/`). Your responsibility is the pipeline and scaffolding, never application business logic.\n  - Infrastructure dependency policy: Verify licenses of dependencies, base images, and third-party actions according to `license-policy.yaml`.\n  - Gate preservation: Ensure pipeline optimizations preserve all existing deterministic Quality Gates intact.\n  - **Cross-Workflow Audit**: When fixing any CI/CD or configuration defect detected in a PR, search all `.github/workflows/*.yml` for the same pattern (including release, post-merge, and publishing pipelines) before declaring the fix complete.\n  - **Remote Verification**: Creating a PR (`gh pr create`) does not equal success; actively verify that remote checks pass (`gh pr checks`).\n\n---\n\n## 3. Git 4-Tier Hierarchy and Commit Conventions\n- `task/<PARENT-ID>/<TSK-ID>-<slug>` $\\rightarrow$ `feat/<FEAT-ID>-<slug>` $\\rightarrow$ `release/vX.Y.Z` $\\rightarrow$ `main`.\n- Mandatory commit trailers injection:\n  ```text\n  Author-Type: agent\n  AI-Model: gemini-1.5-pro / gemini-2.0-flash\n  Task-ID: TSK-XXX\n  Change-ID: CHG-XXX\n  ```\n\n---\n\n## 4. Workflow Handoff Protocol and Human Action Window | Ventana de Acci\u00F3n Humana\n- **Conditional Activation Rule by Autonomy**:\n  - \uD83D\uDFE2 **`AUTONOMOUS`** (or exclusive final supervision in PR/CI): **OMITTED**. Do not request or emit interactive handoff to avoid interrupting unattended execution.\n  - \uD83D\uDFE1 **Autonomy $\\ge$ `HUMAN_REVIEW_PLAN`** (`HUMAN_REVIEW_PLAN`, `AMBIGUOUS`, `HIGH_RISK_MANUAL`): **MANDATORY**. Emit the Workflow Handoff block compliant with [`templates/workflow/agent-handoff.template.md`](../../templates/workflow/agent-handoff.template.md) and **STOP**.\n- **Block Contents**: Declare produced deliverables, recommend the next role in workflow (`agent-threat-modeler`, `agent-privacy-officer`, `agent-system-architect`, `agent-qa-engineer`, `agent-developer`, `agent-expert-user`, `agent-code-reviewer`, `agent-security-auditor`, `agent-compliance-checker`, `agent-devops`, etc.), provide suggested invocation prompt, and keep **the Human Action Window open at all times for the human user to take action** (review, edit by hand, pause/reroute, or delegate).\n";
 declare const STARTER_CURSOR_CORE_RULES = "---\ndescription: Global canonical directives, 5 unbreakable commandments, and AI-SDLC pre-flight\nglobs: *\nalwaysApply: true\n---\n\n# Global AI-SDLC Rules (Core)\n\nCanonical Reference: [`process/09_agent_protocols.md`](process/09_agent_protocols.md) and [`process/01_governance_and_roles.md`](process/01_governance_and_roles.md).\n\n## 1. The 5 Unbreakable Commandments of Agents | Los 5 Mandamientos Inquebrantables de los Agentes\nEvery agent operating in this repository must strictly observe the following guardrails:\n1. **FORBIDDEN TO AUTO-APPROVE OR AUTO-MERGE | PROHIBIDO AUTO-APROBAR O AUTO-FUSIONAR**: Do not approve PRs or execute direct merges to protected branches (`main`, `release/*`). Approval is exclusively reserved for human reviewers.\n2. **FORBIDDEN TO INVENT PRODUCT OR ARCHITECTURE DECISIONS**: When facing ambiguity, formulate open questions (`open-questions`). Never assume undocumented requirements.\n3. **FORBIDDEN TO INTRODUCE DEPENDENCIES WITHOUT LICENSE INSPECTION**: Always verify `license-policy.yaml`. Viral dependencies (GPL/AGPL) or commercial paid dependencies (BSL/SSPL) are strictly forbidden without explicit human approval.\n4. **FORBIDDEN TO IGNORE CYBERSECURITY & PRIVACY (SECURITY-BY-DEFAULT & PRIVACY-BY-DEFAULT)**: Validate inputs, apply least privilege, protect PII according to `privacy-policy.yaml`, and accompany every change with security and privacy tests (`SEC-TEST-*`, `@privacy`). Suppressing linters or tests to force a green pipeline is prohibited.\n5. **MANDATORY CRYPTOGRAPHIC CITATION**: Link specifications using immutable identifiers and Unix LF-normalized SHA-256 hashes.\n\n## 2. Pre-Flight Verification Commands\nBefore finalizing changes or proposing commits:\n- Pre-flight with auto-fix: `pnpm run check:fix` (or `npx aisdlc check --fix`)\n- Full verification: `pnpm run verify:all` (or `npx aisdlc verify all`)\n- Unit tests: `pnpm test`\n- Strict typing: `pnpm run typecheck`\n\n## 3. Git 4-Tier Hierarchy\n- Tier 1: `main` (Production)\n- Tier 2: `release/vX.Y.Z` (Frozen release)\n- Tier 3: `feat/<FEAT-ID>-<slug>` / `bug/<BUG-ID>-<slug>` (Feature)\n- Tier 4: `task/<PARENT-ID>/<TSK-ID>-<slug>` (Atomic task)\n\n## 4. Specialized Roles Mapping\n| Role | Mission (summary) |\n| :--- | :--- |\n| `agent-product-analyst` | Phase 0 NAF v4 Enterprise & Capability Vision (`ARCH-INTRO-*`, 3\u20135 question interview) + ProductShape artifacts (`ACT-*`, `UC-*`, `FR-*`, `QR-*`, `BR-*`); status starts `draft`. |\n| `agent-threat-modeler` | STRIDE/OWASP threat triad (`ACT-THREAT-*`, `ABUSE-*`, `SEC-REQ-*`); hands off to `agent-privacy-officer`. |\n| `agent-privacy-officer` | LINDDUN & GDPR/LOPDGDD privacy triad (`DATA-ASSET-*`, `PRIV-ROPA-*`, `PRIV-REQ-*`) + Pre-Merge `verify:privacy`. |\n| `agent-system-architect` | Modular arc42 + NAF v4 architecture (`CMP-*`, Mermaid diagrams, `ADR-*`). |\n| `agent-qa-engineer` | FAILING BDD/Gherkin, E2E, and UI suites (using agreed project tech; Happy Path, Sad Path & Boundary Values per interactive UI element) before `agent-developer` writes code. |\n| `agent-developer` | Atomic tasks from `tasks.md`; respects autonomy mode; runs `pnpm run check:fix` + `pnpm run verify:all`. |\n| `agent-security-auditor` | Adversarial PR security audit, SAST, secrets, and CVSS v3.1 evaluation. |\n| `agent-compliance-checker` | SPDX license compliance audit against `license-policy.yaml`. |\n| `agent-expert-user` | Bimodal MVP evaluation (design) and functional validation against `UC-*` and `FR-*` (pre-PR). |\n| `agent-code-reviewer` | PR audit (SOLID, DRY, YAGNI): `[BLOCKING]` / `[CLEAN_CODE_SUGGESTION]` / `[COMPLIANT]`. |\n| `agent-devops` | CI/CD, Docker, IaC only \u2014 **FORBIDDEN** to touch `src/` or `packages/*/src/`. |\n\n## 5. Task Autonomy Modes (`tasks.md`)\n- \uD83D\uDFE2 **`AUTONOMOUS`**: Low risk. Implement directly, omit handoff block.\n- \uD83D\uDFE1 **`HUMAN_REVIEW_PLAN`**: Medium risk. Emit Workflow Handoff block, wait for approval.\n- \uD83D\uDFE0 **`AMBIGUOUS`**: Blocked. Request human clarification.\n- \uD83D\uDD34 **`HIGH_RISK_MANUAL`**: Critical risk. Human-only execution.\n\n## 6. Workflow Handoff Protocol and Human Action Window | Ventana de Acci\u00F3n Humana\n- **Conditional Activation**:\n  * \uD83D\uDFE2 **`AUTONOMOUS`** (or PR/CI supervision): **OMITTED**. Do not request or emit interactive handoff.\n  * \uD83D\uDFE1 **Autonomy $\\ge$ `HUMAN_REVIEW_PLAN`** (`HUMAN_REVIEW_PLAN`, `AMBIGUOUS`, `HIGH_RISK_MANUAL`): **MANDATORY**. Emit Workflow Handoff block compliant with [`templates/workflow/agent-handoff.template.md`](templates/workflow/agent-handoff.template.md) and **STOP**.\n- **Content**: Declare completed deliverables, recommend next role(s), provide suggested invocation prompt, and **keep the Human Action Window open for the human user to take action** (review, edit by hand, pause/reroute, or delegate).\n";
 declare const STARTER_CURSOR_PRODUCT_RULES = "---\ndescription: Directives for SDD specifications editing, ProductShape artifacts, Cybersecurity, and Privacy\nglobs: specs/**, templates/**, product/**, security/**, privacy/**\nalwaysApply: false\n---\n\n# Product and SDD Specification Directives\n\nCanonical Reference: [`process/09_agent_protocols.md`](process/09_agent_protocols.md) and [`process/02_product_definition.md`](process/02_product_definition.md).\n\n## 1. Identifier Taxonomy and JSON Schemas\nEvery generated or modified artifact must follow canonical naming and satisfy its schema in `schemas/`:\n- Enterprise & Capability Vision (Phase 0): `ARCH-INTRO-[NUM3]` (`schemas/architecture/introduction-and-goals.schema.json`)\n- Product Actors: `ACT-[SUFFIX]` (`schemas/product/actor.schema.json`)\n- Use Cases: `UC-[SUFFIX]` (`schemas/product/use-case.schema.json`)\n- Functional Requirements: `FR-[SUFFIX]-[NUM3]` (`schemas/product/requirement.schema.json`)\n- Quality Requirements: `QR-[SUFFIX]` (`schemas/product/requirement.schema.json`)\n- Business Rules: `BR-[SUFFIX]` (`schemas/product/business-rule.schema.json`)\n- Threat Actors: `ACT-THREAT-[SUFFIX]` (`schemas/security/threat-actor.schema.json`)\n- Abuse Cases: `ABUSE-[SUFFIX]` (`schemas/security/abuse-case.schema.json`)\n- Security Requirements: `SEC-REQ-[SUFFIX]` (`schemas/security/security-req.schema.json`)\n- Data Assets: `DATA-ASSET-[SUFFIX]` (`schemas/privacy/data-asset.schema.json`)\n- Processing Activities (ROPA): `PRIV-ROPA-[SUFFIX]` (`schemas/privacy/privacy-ropa.schema.json`)\n- Privacy Requirements: `PRIV-REQ-[SUFFIX]` (`schemas/privacy/privacy-req.schema.json`)\n\n## 2. \"AI as Scribe\" Protocol Rules\n- **Phase 0 (New Product Inception)**: When starting a new product, conduct a 3\u20135 question discovery interview, instantiate `ARCH-INTRO-001` (`naf-perspective: \"Enterprise & Capability\"`) in `draft`, and derive `ACT-*`, `UC-*`, `BR-*`, `FR-*`, and `QR-*`.\n- **Initial Status**: Every new artifact strictly starts with `status: draft`. Creating artifacts directly as `active` or `approved` is forbidden.\n- **Gherkin Acceptance Criteria**: In every `FR-*` requirement, include a ```gherkin block with tags `@<ID> @automated @regression` and at least one `Scenario Outline` with an `Examples` data table.\n- **Security & Privacy Mitigations**: Every `SEC-REQ-*` must include negative Gherkin tests (`@security @mitigation`) and every `PRIV-REQ-*` must include Gherkin privacy scenarios (`@privacy @gdpr`).\n- **Use Cases (User Story Structure)**: In every `UC-*`, the `1. Intent and Outcome` section must be written using the standard English structure: `As a <ACT-ID>... I want <action>... To <outcome>...`.\n- **Deterministic Validation**: Run `pnpm run verify:schemas`, `pnpm run verify:duplicates`, and `pnpm run verify:privacy` before presenting the draft to the human reviewer.\n";
-declare const STARTER_CURSOR_QUALITY_RULES = "---\ndescription: Directives for code quality, architecture, TDD, and complexity limits\nglobs: packages/**, src/**, scripts/**, tests/**\nalwaysApply: false\n---\n\n# Code Quality and Architecture Directives\n\nCanonical Reference: [`process/09_agent_protocols.md`](process/09_agent_protocols.md) and [`process/10_quality_management_and_release_gates.md`](process/10_quality_management_and_release_gates.md).\n\n## 1. Non-Negotiable Quality Thresholds (`quality-policy.yaml`)\n- **Cyclomatic Complexity (CC)**: $\\le 10$ per function (warning alert if $> 7$).\n- **Cognitive Complexity**: $\\le 15$ per function (warning if $> 10$).\n- **Maintainability Index (MI)**: $\\ge 50$ (target minimum $\\ge 65$).\n- **Function Length**: $\\le 40$ lines (warning if $> 30$).\n- If a function exceeds these limits, decompose logic into cohesive helper functions before completing the task.\n\n## 2. TDD Methodology, Modular & Hexagonal Architecture (Ports & Adapters) & Unit Testing\n- **Mandatory 4-Step Implementation Order**: (1) Define/refine Modular & Hexagonal Architecture (Ports & Adapters) module boundaries, (2) Define interfaces/ports for all inter-module interactions to avoid direct module coupling, (3) Implement components consuming/fulfilling those interfaces, (4) Write unit tests for every function covering Happy Path, Sad Path, Boundary Values, and Unexpected/Null/Empty values.\n- Apply Test-Driven Development: generate unit tests before or alongside component logic.\n- Tag tests linked to requirements with header comments citing the ID (`FR-*`, `SEC-REQ-*`, or `PRIV-REQ-*`) to enable reverse traceability.\n- Suppressing types (`any`), linter rules (`eslint-disable`), or unit tests to force pipeline passage is prohibited.\n\n## 3. Open Source License Policy (`license-policy.yaml`)\n- Before adding any dependency to `package.json`, verify its SPDX identifier.\n- Only permissive dependencies are allowed (`MIT`, `Apache-2.0`, `BSD-2/3-Clause`, `ISC`).\n- Viral licenses (`GPL`, `AGPL`) or commercial licenses without approval (`BSL`, `SSPL`) are prohibited.\n\n## 4. Structured Output `--json`\n- Any extension to CLI commands must preserve compatibility with the `--json` flag and suppress ANSI escape codes when this flag is present.\n";
-declare const STARTER_CLAUDE_RULES = "# Claude Code Instructions - AI-SDLC Monorepo\n\nCanonical Reference: [`process/09_agent_protocols.md`](process/09_agent_protocols.md) and [`process/01_governance_and_roles.md`](process/01_governance_and_roles.md).\n\nThis repository implements the **AI-SDLC** framework (Spec-Driven Development, deterministic quality governance, Privacy-by-Design, and OSS license compliance for human-agent collaboration).\n\n---\n\n## 1. The 5 Unbreakable Commandments of Agents | Los 5 Mandamientos Inquebrantables de los Agentes\n\n1. **FORBIDDEN TO AUTO-APPROVE OR AUTO-MERGE | PROHIBIDO AUTO-APROBAR O AUTO-FUSIONAR**: Never approve PRs or merge directly to `main` or protected branches. Approval is exclusively a human prerogative.\n2. **FORBIDDEN TO INVENT PRODUCT OR ARCHITECTURE DECISIONS**: When facing ambiguous requirements, formulate open questions (`open-questions`). Never assume undocumented behaviors.\n3. **FORBIDDEN TO INTRODUCE DEPENDENCIES WITHOUT LICENSE INSPECTION**: Always validate the SPDX identifier against `license-policy.yaml`. Viral libraries (`GPL`/`AGPL`) or paid commercial libraries (`BSL`/`SSPL`) are strictly forbidden without formal human approval.\n4. **FORBIDDEN TO IGNORE CYBERSECURITY & PRIVACY (SECURITY-BY-DEFAULT & PRIVACY-BY-DEFAULT)**: Validate inputs, sanitize data, protect PII according to `privacy-policy.yaml`, and include mitigation tests (`SEC-TEST-*`, `@privacy`). Disabling linters or suppressing typing errors (`any`, `@ts-ignore`) is prohibited.\n5. **MANDATORY CRYPTOGRAPHIC CITATION**: Every spec or sidecar must cite immutable identifiers and Unix LF-normalized SHA-256 digests.\n\n---\n\n## 2. Essential Execution and Pre-Flight Commands\n\n```bash\n# 1. Pre-flight with deterministic auto-fix (Gherkin & SHA-256 digests)\npnpm run check:fix\n\n# 2. Complete verification across all Quality Gates (Quality, RTM, Governance, Testing, Licenses, PDaC, Schemas, Duplicates, Security, Privacy)\npnpm run verify:all\n\n# 3. Complete automated test suite (Vitest)\npnpm test\n\n# 4. Strict TypeScript typechecking\npnpm run typecheck\n\n# 5. Scaffolding for a new SDD change\npnpm run change:new <name> --id <chg-id>\n\n# 6. Canonical integration of a completed SDD change\nnpx tsx packages/cli/src/index.ts sdd integrate --change <chg-id>\n```\n\n---\n\n## 3. Specialized Roles Mapping\n\n### 1. `agent-product-analyst` (Product Analyst / Scribe)\n- **Mission**: Capture new product intent via NAF v4 Enterprise & Capability Vision (`ARCH-INTRO-*`) and define/refine the product model using ProductShape.\n- **Phase 0 (Greenfield Product Inception)**: When creating a new product from scratch (or when `specs/product/` has no baseline), run a concise 3\u20135 question discovery interview (mission/problem, actors `ACT-*`, MVP capabilities `UC-*`, priority quality goals `QR-*`), draft `ARCH-INTRO-001` (`templates/architecture/introduction-and-goals.template.md`), and derive initial `ACT-*`, `UC-*`, `BR-*`, `FR-*`, and `QR-*` drafts.\n- **Input**: Business intent or natural language specification.\n- **Output**: Markdown artifacts with YAML frontmatter compliant with `schemas/architecture/introduction-and-goals.schema.json` (`ARCH-INTRO-*`) and `schemas/product/` (`ACT-*`, `UC-*`, `FR-*`, `QR-*`, `BR-*`).\n- **Guardrails**: `status` always starts in `draft`. Mandatory Gherkin criteria with `@<ID> @automated @regression`.\n\n### 2. `agent-threat-modeler` (Threat Modeler and Security Specialist)\n- **Mission**: Analyze use cases and proactively model adversaries, STRIDE attack vectors, and OWASP ASVS mitigations, both at product level and in the technical security feedback loop over architecture, handing off to `agent-privacy-officer`.\n- **Output**: Cybersecurity triad (`ACT-THREAT-*`, `ABUSE-*`, `SEC-REQ-*`) compliant with `schemas/security/`.\n\n### 3. `agent-privacy-officer` (Data Protection & Privacy-by-Design Specialist)\n- **Mission**: Receive handoff from `agent-threat-modeler` to model personal data assets (`DATA-ASSET-*`), GDPR Art. 30 records of processing (`PRIV-ROPA-*`), and LINDDUN / GDPR / ISO 27701 privacy requirements (`PRIV-REQ-*`), and audit code diffs against `privacy-policy.yaml`.\n- **Directives**: Run `pnpm run verify:privacy`, enforce PII masking in logs/LLM prompts, and trigger `DPIA-*` requests on Art. 9 sensitive data.\n\n### 4. `agent-system-architect` (System Architect)\n- **Mission**: Translate the approved product definition into a modular technical architecture based on arc42 enriched with NAF v4 (`CMP-*`, Mermaid diagrams, `ADR-*`).\n- **Guardrails**: Declare `satisfies-requirements` on every `CMP-*` (including `PRIV-REQ-*`), structure components following **Modular & Hexagonal Architecture (Ports & Adapters)** (Domain/Application Core + Inbound/Outbound Ports), instantiate mandatory building block `CMP-OBSERVABILITY` (Level 2/3) alongside Section 8 and an ADR for runtime telemetry, and trigger the technical security/privacy feedback loop toward `agent-threat-modeler` \u2794 `agent-privacy-officer` when infrastructure decisions introduce new attack vectors or PII flows.\n\n### 5. `agent-qa-engineer` (QA Engineer and SDET)\n- **Mission**: Translate approved requirements (`FR-*`, `SEC-REQ-*`, `PRIV-REQ-*`, `QR-*`) into comprehensive FAILING (red) BDD/Gherkin, End-to-End (E2E), UI, and unit test suites, before `agent-developer` writes production code.\n- **Guardrails**: Always use the agreed project technology/testing stack (if any). Never omit End-to-End (E2E) and UI tests. Create specific tests for every interactive UI element covering Happy Path, Sad Path, and Boundary Values. FORBIDDEN to include production code. Mandatory tags: `@<FR-ID> @automated @regression`.\n\n### 6. `agent-developer` (Software Developer)\n- **Mission**: Implement atomic tasks from SDD specifications (`tasks.md`) with clean, strictly typed code and thorough tests.\n- **Directives**: Execute the mandatory 4-step order: (1) Modular & Hexagonal Architecture (Ports & Adapters) definition/redefinition, (2) Inter-module interfaces first, (3) Component implementation, (4) Per-function unit tests (Happy Path, Sad Path, Boundary Values, Unexpected/Null/Empty values). Respect the autonomy mode. Make tests delivered by `agent-qa-engineer` pass green. Run `pnpm run check:fix` and `pnpm run verify:all`.\n\n### 7. `agent-security-auditor` (Adversarial Code Auditor)\n- **Mission**: Examine Pull Requests for business logic vulnerabilities, injection vectors, secret leaks, and authorization flaws as part of the Pre-Merge Audit Triad.\n- **Directives**: Run `pnpm run verify:security`, evaluate CVSS v3.1 severity, and block CRITICAL/HIGH risks.\n\n### 8. `agent-compliance-checker` (Open Source License Compliance Auditor)\n- **Mission**: Audit dependency manifests against `license-policy.yaml` as part of the Pre-Merge Audit Triad.\n- **Directives**: Run `pnpm run verify:licenses`, blocking viral (`GPL`, `AGPL`) or unapproved commercial (`BSL`, `SSPL`) packages.\n\n### 9. `agent-expert-user` (Expert User and Domain Evaluator)\n- **Mission**: Contrast design and specifications (design phase) and functionally validate finished software against `UC-*` and `FR-*` (post-development functional validation phase).\n\n### 10. `agent-code-reviewer` (Technical and Architectural Code Reviewer)\n- **Mission**: Audit Pull Requests evaluating code cleanliness, adherence to SOLID, DRY, YAGNI principles, and respect for `quality-policy.yaml` thresholds, forming part of the Pre-Merge Audit Triad.\n- **Findings classification**: `[BLOCKING]`, `[CLEAN_CODE_SUGGESTION]`, `[COMPLIANT]`.\n\n### 11. `agent-devops` (Automation and Infrastructure Engineer)\n- **Mission**: Maintain, evolve, and audit automated project infrastructure: CI/CD workflows, Docker containers, IaC manifests, and support scripts.\n- **NON-INVASION GUARDRAIL**: STRICTLY FORBIDDEN from modifying application source code (`src/`, `packages/*/src/`).\n\n---\n\n## 4. Task Autonomy Modes (`tasks.md`)\n\n- \uD83D\uDFE2 **`AUTONOMOUS`**: Low risk, isolated task. Implement code and tests directly. Omit interactive handoff block.\n- \uD83D\uDFE1 **`HUMAN_REVIEW_PLAN`**: Medium risk. Design detailed plan, emit Workflow Handoff block, and wait for human confirmation before coding.\n- \uD83D\uDFE0 **`AMBIGUOUS`**: Incomplete requirements. Blocked: request human clarification.\n- \uD83D\uDD34 **`HIGH_RISK_MANUAL`**: Critical risk (migrations, cryptography). Direct manual execution by humans only.\n\n---\n\n## 5. Git Workflow and Commit Rules with Trailers\n\n### 4-Tier Hierarchy\n1. **Tier 1 (`main`)**: Absolute stability and production readiness.\n2. **Tier 2 (`release/vX.Y.Z`)**: Release stabilization.\n3. **Tier 3 (`feat/<FEAT-ID>-<slug>` or `bug/<BUG-ID>-<slug>`)**: SDD delivery increment.\n4. **Tier 4 (`task/<PARENT-ID>/<TSK-ID>-<slug>`)**: Atomic implementation task.\n\n### Commit Format (Conventional Commits + Git Trailers)\n```text\nfeat(scope): concise imperative description (#issue)\n\nBody explaining the motivation and technical justification of the change.\n\nAuthor-Type: agent\nAI-Model: claude-3-7-sonnet\nTask-ID: TSK-001\nChange-ID: CHG-026-AGENT-NATIVE-CONFIGS\n```\n\n---\n\n## 6. Non-Negotiable Quality Thresholds (`quality-policy.yaml`)\n- **Cyclomatic Complexity (CC)**: $\\le 10$\n- **Cognitive Complexity**: $\\le 15$\n- **Maintainability Index (MI)**: $\\ge 50$\n- **Lines per Function**: $\\le 40$\n- Deterministic CLI output: every `verify` command supports `--json` without ANSI escape codes.\n\n---\n\n## 7. Workflow Handoff Protocol and Human Action Window | Ventana de Acci\u00F3n Humana\n- **Conditional Activation**:\n  - \uD83D\uDFE2 **`AUTONOMOUS`** (or PR/CI final supervision): **OMITTED**. Uninterrupted continuous execution.\n  - \uD83D\uDFE1 **Autonomy $\\ge$ `HUMAN_REVIEW_PLAN`** (`HUMAN_REVIEW_PLAN`, `AMBIGUOUS`, `HIGH_RISK_MANUAL`): **MANDATORY**. Emit Workflow Handoff block ([`templates/workflow/agent-handoff.template.md`](templates/workflow/agent-handoff.template.md)) and **STOP**.\n- **Content**: Completed deliverables, suggested next role(s), copy-paste ready invocation prompt, and **an open Human Action Window for the user to take action** (review, edit by hand, pause/reroute, or delegate).\n";
+declare const STARTER_CURSOR_QUALITY_RULES = "---\ndescription: Directives for code quality, architecture, TDD, and complexity limits\nglobs: packages/**, src/**, scripts/**, tests/**\nalwaysApply: false\n---\n\n# Code Quality and Architecture Directives\n\nCanonical Reference: [`process/09_agent_protocols.md`](process/09_agent_protocols.md) and [`process/10_quality_management_and_release_gates.md`](process/10_quality_management_and_release_gates.md).\n\n## 1. Non-Negotiable Quality Thresholds (`quality-policy.yaml`)\n- **Cyclomatic Complexity (CC)**: $\\le 10$ per function (warning alert if $> 7$).\n- **Cognitive Complexity**: $\\le 15$ per function (warning if $> 10$).\n- **Maintainability Index (MI)**: $\\ge 50$ (target minimum $\\ge 65$).\n- **Function Length**: $\\le 40$ lines (warning if $> 30$).\n- If a function exceeds these limits, decompose logic into cohesive helper functions before completing the task.\n\n## 2. TDD Methodology, Modular & Hexagonal Architecture (Ports & Adapters) & Unit Testing\n- **Mandatory 4-Step Implementation Order**: (1) Define/refine Modular & Hexagonal Architecture (Ports & Adapters) module boundaries, (2) Define interfaces/ports for all inter-module interactions to avoid direct module coupling, (3) Implement components consuming/fulfilling those interfaces, (4) Write unit tests for every function covering Happy Path, Sad Path, Boundary Values, and Unexpected/Null/Empty values.\n- Apply Test-Driven Development: generate unit tests before or alongside component logic.\n- Tag tests linked to requirements with header comments citing the ID (`FR-*`, `SEC-REQ-*`, or `PRIV-REQ-*`) to enable reverse traceability.\n- Suppressing types (`any`), linter rules (`eslint-disable`), or unit tests to force pipeline passage is prohibited.\n- **Mandatory Regression Verification**: Never declare build, typecheck, or bug fixes complete without executing the relevant automated test suite (`pnpm test`, `dotnet test`) and confirming zero regressions.\n- **Global Styles Protection**: When touching or refactoring frontend views, verify that global stylesheet/asset imports remain intact and that layouts suffer no visual disruption.\n\n## 3. Open Source License Policy (`license-policy.yaml`)\n- Before adding any dependency to `package.json`, verify its SPDX identifier.\n- Only permissive dependencies are allowed (`MIT`, `Apache-2.0`, `BSD-2/3-Clause`, `ISC`).\n- Viral licenses (`GPL`, `AGPL`) or commercial licenses without approval (`BSL`, `SSPL`) are prohibited.\n\n## 4. Structured Output `--json`\n- Any extension to CLI commands must preserve compatibility with the `--json` flag and suppress ANSI escape codes when this flag is present.\n";
+declare const STARTER_CLAUDE_RULES = "# Claude Code Instructions - AI-SDLC Monorepo\n\nCanonical Reference: [`process/09_agent_protocols.md`](process/09_agent_protocols.md) and [`process/01_governance_and_roles.md`](process/01_governance_and_roles.md).\n\nThis repository implements the **AI-SDLC** framework (Spec-Driven Development, deterministic quality governance, Privacy-by-Design, and OSS license compliance for human-agent collaboration).\n\n---\n\n## 1. The 5 Unbreakable Commandments of Agents | Los 5 Mandamientos Inquebrantables de los Agentes\n\n1. **FORBIDDEN TO AUTO-APPROVE OR AUTO-MERGE | PROHIBIDO AUTO-APROBAR O AUTO-FUSIONAR**: Never approve PRs or merge directly to `main` or protected branches. Approval is exclusively a human prerogative.\n2. **FORBIDDEN TO INVENT PRODUCT OR ARCHITECTURE DECISIONS**: When facing ambiguous requirements, formulate open questions (`open-questions`). Never assume undocumented behaviors.\n3. **FORBIDDEN TO INTRODUCE DEPENDENCIES WITHOUT LICENSE INSPECTION**: Always validate the SPDX identifier against `license-policy.yaml`. Viral libraries (`GPL`/`AGPL`) or paid commercial libraries (`BSL`/`SSPL`) are strictly forbidden without formal human approval.\n4. **FORBIDDEN TO IGNORE CYBERSECURITY & PRIVACY (SECURITY-BY-DEFAULT & PRIVACY-BY-DEFAULT)**: Validate inputs, sanitize data, protect PII according to `privacy-policy.yaml`, and include mitigation tests (`SEC-TEST-*`, `@privacy`). Disabling linters or suppressing typing errors (`any`, `@ts-ignore`) is prohibited.\n5. **MANDATORY CRYPTOGRAPHIC CITATION**: Every spec or sidecar must cite immutable identifiers and Unix LF-normalized SHA-256 digests.\n\n---\n\n## 2. Essential Execution and Pre-Flight Commands\n\n```bash\n# 1. Pre-flight with deterministic auto-fix (Gherkin & SHA-256 digests)\npnpm run check:fix\n\n# 2. Complete verification across all Quality Gates (Quality, RTM, Governance, Testing, Licenses, PDaC, Schemas, Duplicates, Security, Privacy)\npnpm run verify:all\n\n# 3. Complete automated test suite (Vitest)\npnpm test\n\n# 4. Strict TypeScript typechecking\npnpm run typecheck\n\n# 5. Scaffolding for a new SDD change\npnpm run change:new <name> --id <chg-id>\n\n# 6. Canonical integration of a completed SDD change\nnpx tsx packages/cli/src/index.ts sdd integrate --change <chg-id>\n```\n\n---\n\n## 3. Specialized Roles Mapping\n\n### 1. `agent-product-analyst` (Product Analyst / Scribe)\n- **Mission**: Capture new product intent via NAF v4 Enterprise & Capability Vision (`ARCH-INTRO-*`) and define/refine the product model using ProductShape.\n- **Phase 0 (Greenfield Product Inception)**: When creating a new product from scratch (or when `specs/product/` has no baseline), run a concise 3\u20135 question discovery interview (mission/problem, actors `ACT-*`, MVP capabilities `UC-*`, priority quality goals `QR-*`), draft `ARCH-INTRO-001` (`templates/architecture/introduction-and-goals.template.md`), and derive initial `ACT-*`, `UC-*`, `BR-*`, `FR-*`, and `QR-*` drafts.\n- **Input**: Business intent or natural language specification.\n- **Output**: Markdown artifacts with YAML frontmatter compliant with `schemas/architecture/introduction-and-goals.schema.json` (`ARCH-INTRO-*`) and `schemas/product/` (`ACT-*`, `UC-*`, `FR-*`, `QR-*`, `BR-*`).\n- **Guardrails**: `status` always starts in `draft`. Mandatory Gherkin criteria with `@<ID> @automated @regression`.\n\n### 2. `agent-threat-modeler` (Threat Modeler and Security Specialist)\n- **Mission**: Analyze use cases and proactively model adversaries, STRIDE attack vectors, and OWASP ASVS mitigations, both at product level and in the technical security feedback loop over architecture, handing off to `agent-privacy-officer`.\n- **Output**: Cybersecurity triad (`ACT-THREAT-*`, `ABUSE-*`, `SEC-REQ-*`) compliant with `schemas/security/`.\n\n### 3. `agent-privacy-officer` (Data Protection & Privacy-by-Design Specialist)\n- **Mission**: Receive handoff from `agent-threat-modeler` to model personal data assets (`DATA-ASSET-*`), GDPR Art. 30 records of processing (`PRIV-ROPA-*`), and LINDDUN / GDPR / ISO 27701 privacy requirements (`PRIV-REQ-*`), and audit code diffs against `privacy-policy.yaml`.\n- **Directives**: Run `pnpm run verify:privacy`, enforce PII masking in logs/LLM prompts, and trigger `DPIA-*` requests on Art. 9 sensitive data.\n\n### 4. `agent-system-architect` (System Architect)\n- **Mission**: Translate the approved product definition into a modular technical architecture based on arc42 enriched with NAF v4 (`CMP-*`, Mermaid diagrams, `ADR-*`).\n- **Guardrails**: Declare `satisfies-requirements` on every `CMP-*` (including `PRIV-REQ-*`), structure components following **Modular & Hexagonal Architecture (Ports & Adapters)** (Domain/Application Core + Inbound/Outbound Ports), instantiate mandatory building block `CMP-OBSERVABILITY` (Level 2/3) alongside Section 8 and an ADR for runtime telemetry, and trigger the technical security/privacy feedback loop toward `agent-threat-modeler` \u2794 `agent-privacy-officer` when infrastructure decisions introduce new attack vectors or PII flows.\n\n### 5. `agent-qa-engineer` (QA Engineer and SDET)\n- **Mission**: Translate approved requirements (`FR-*`, `SEC-REQ-*`, `PRIV-REQ-*`, `QR-*`) into comprehensive FAILING (red) BDD/Gherkin, End-to-End (E2E), UI, and unit test suites, before `agent-developer` writes production code.\n- **Guardrails**: Always use the agreed project technology/testing stack (if any). Never omit End-to-End (E2E) and UI tests. Create specific tests for every interactive UI element using external tools such as Playwright or FlatUI (or the agreed project testing technology), covering Happy Path, Sad Path, and Boundary Values. FORBIDDEN to include production code. Mandatory tags: `@<FR-ID> @automated @regression`.\n\n### 6. `agent-developer` (Software Developer)\n- **Mission**: Implement atomic tasks from SDD specifications (`tasks.md`) with clean, strictly typed code and thorough tests.\n- **Directives**: Execute the mandatory 4-step order: (1) Modular & Hexagonal Architecture (Ports & Adapters) definition/redefinition, (2) Inter-module interfaces first, (3) Component implementation, (4) Per-function unit tests (Happy Path, Sad Path, Boundary Values, Unexpected/Null/Empty values). Respect the autonomy mode. Make tests delivered by `agent-qa-engineer` pass green. Run `pnpm run check:fix` and `pnpm run verify:all`. Enforce Mandatory Regression Verification (`pnpm test`) with zero regressions before declaring completion, and enforce Global Styles Protection on frontend views.\n\n### 7. `agent-security-auditor` (Adversarial Code Auditor)\n- **Mission**: Examine Pull Requests for business logic vulnerabilities, injection vectors, secret leaks, and authorization flaws as part of the Pre-Merge Audit Triad.\n- **Directives**: Run `pnpm run verify:security`, evaluate CVSS v3.1 severity, and block CRITICAL/HIGH risks.\n\n### 8. `agent-compliance-checker` (Open Source License Compliance Auditor)\n- **Mission**: Audit dependency manifests against `license-policy.yaml` as part of the Pre-Merge Audit Triad.\n- **Directives**: Run `pnpm run verify:licenses`, blocking viral (`GPL`, `AGPL`) or unapproved commercial (`BSL`, `SSPL`) packages.\n\n### 9. `agent-expert-user` (Expert User and Domain Evaluator)\n- **Mission**: Contrast design and specifications (design phase) and functionally validate finished software against `UC-*` and `FR-*` (post-development functional validation phase).\n\n### 10. `agent-code-reviewer` (Technical and Architectural Code Reviewer)\n- **Mission**: Audit Pull Requests evaluating code cleanliness, adherence to SOLID, DRY, YAGNI principles, and respect for `quality-policy.yaml` thresholds, forming part of the Pre-Merge Audit Triad.\n- **Findings classification**: `[BLOCKING]`, `[CLEAN_CODE_SUGGESTION]`, `[COMPLIANT]`.\n\n### 11. `agent-devops` (Automation and Infrastructure Engineer)\n- **Mission**: Maintain, evolve, and audit automated project infrastructure: CI/CD workflows, Docker containers, IaC manifests, and support scripts.\n- **NON-INVASION GUARDRAIL**: STRICTLY FORBIDDEN from modifying application source code (`src/`, `packages/*/src/`).\n\n---\n\n## 4. Task Autonomy Modes (`tasks.md`)\n\n- \uD83D\uDFE2 **`AUTONOMOUS`**: Low risk, isolated task. Implement code and tests directly. Omit interactive handoff block.\n- \uD83D\uDFE1 **`HUMAN_REVIEW_PLAN`**: Medium risk. Design detailed plan, emit Workflow Handoff block, and wait for human confirmation before coding.\n- \uD83D\uDFE0 **`AMBIGUOUS`**: Incomplete requirements. Blocked: request human clarification.\n- \uD83D\uDD34 **`HIGH_RISK_MANUAL`**: Critical risk (migrations, cryptography). Direct manual execution by humans only.\n\n---\n\n## 5. Git Workflow and Commit Rules with Trailers\n\n### 4-Tier Hierarchy\n1. **Tier 1 (`main`)**: Absolute stability and production readiness.\n2. **Tier 2 (`release/vX.Y.Z`)**: Release stabilization.\n3. **Tier 3 (`feat/<FEAT-ID>-<slug>` or `bug/<BUG-ID>-<slug>`)**: SDD delivery increment.\n4. **Tier 4 (`task/<PARENT-ID>/<TSK-ID>-<slug>`)**: Atomic implementation task.\n\n### Commit Format (Conventional Commits + Git Trailers)\n```text\nfeat(scope): concise imperative description (#issue)\n\nBody explaining the motivation and technical justification of the change.\n\nAuthor-Type: agent\nAI-Model: claude-3-7-sonnet\nTask-ID: TSK-001\nChange-ID: CHG-026-AGENT-NATIVE-CONFIGS\n```\n\n---\n\n## 6. Non-Negotiable Quality Thresholds (`quality-policy.yaml`)\n- **Cyclomatic Complexity (CC)**: $\\le 10$\n- **Cognitive Complexity**: $\\le 15$\n- **Maintainability Index (MI)**: $\\ge 50$\n- **Lines per Function**: $\\le 40$\n- Deterministic CLI output: every `verify` command supports `--json` without ANSI escape codes.\n\n---\n\n## 7. Workflow Handoff Protocol and Human Action Window | Ventana de Acci\u00F3n Humana\n- **Conditional Activation**:\n  - \uD83D\uDFE2 **`AUTONOMOUS`** (or PR/CI final supervision): **OMITTED**. Uninterrupted continuous execution.\n  - \uD83D\uDFE1 **Autonomy $\\ge$ `HUMAN_REVIEW_PLAN`** (`HUMAN_REVIEW_PLAN`, `AMBIGUOUS`, `HIGH_RISK_MANUAL`): **MANDATORY**. Emit Workflow Handoff block ([`templates/workflow/agent-handoff.template.md`](templates/workflow/agent-handoff.template.md)) and **STOP**.\n- **Content**: Completed deliverables, suggested next role(s), copy-paste ready invocation prompt, and **an open Human Action Window for the user to take action** (review, edit by hand, pause/reroute, or delegate).\n";
 declare const STARTER_COPILOT_RULES = "<!--\n  AI-SDLC: Canonical Instructions for GitHub Copilot (Chat & Workspace)\n  Canonical Reference: process/09_agent_protocols.md and process/01_governance_and_roles.md\n-->\n\n# GitHub Copilot Instructions - AI-SDLC Framework\n\nYou operate as an assistant agent in the **AI-SDLC** repository. You are not a simple text auto-completer: you are a specialized technical worker subject to normative directives, deterministic autonomy boundaries, and strict traceability.\n\n---\n\n## 1. The 5 Unbreakable Commandments of Agents | Los 5 Mandamientos Inquebrantables de los Agentes\n\n1. **FORBIDDEN TO AUTO-APPROVE OR AUTO-MERGE | PROHIBIDO AUTO-APROBAR O AUTO-FUSIONAR**:\n   - Never execute PR approvals or direct merges to stable branches (`main`, `release/*`). Approval is an exclusive human prerogative.\n2. **FORBIDDEN TO INVENT PRODUCT OR ARCHITECTURE DECISIONS**:\n   - If a requirement is ambiguous or incomplete, formulate open questions (`open-questions`) to the human user. Guessing undocumented intentions is forbidden.\n3. **FORBIDDEN TO INTRODUCE DEPENDENCIES WITHOUT LICENSE INSPECTION**:\n   - Before suggesting or adding dependencies to manifests (`package.json`, etc.), validate their SPDX identifier against `license-policy.yaml`. Adding viral (`GPL`, `AGPL`) or commercial paid (`BSL`, `SSPL`) licenses without human authorization is prohibited.\n4. **FORBIDDEN TO IGNORE CYBERSECURITY & PRIVACY (SECURITY-BY-DEFAULT & PRIVACY-BY-DEFAULT)**:\n   - All code must enforce least privilege, sanitize external inputs, protect PII according to `privacy-policy.yaml`, and include mitigation tests (`SEC-TEST-*`, `@privacy`). Suppressing types (`any`), linters, or tests to force a green pipeline is prohibited.\n5. **MANDATORY CRYPTOGRAPHIC CITATION**:\n   - Every specification, design, or sidecar must reference canonical identifiers and their Unix LF-normalized SHA-256 digests.\n\n---\n\n## 2. Git 4-Tier Branch Hierarchy\n\nWhen proposing or creating branches, respect the strict hierarchical structure:\n- **Tier 1**: `main` (Protected production branch with maximum stability).\n- **Tier 2**: `release/vX.Y.Z` (Release consolidation and scope freeze branch).\n- **Tier 3**: `feat/<FEAT-ID>-<slug>` or `bug/<BUG-ID>-<slug>` (SDD increment or feature branch).\n- **Tier 4**: `task/<PARENT-ID>/<TSK-ID>-<slug>` (Atomic development task branch).\n\n---\n\n## 3. Pre-Flight Commands and Quality Gates\n\nBefore concluding any intervention or suggesting a commit:\n- **Unified pre-flight with auto-fix**: `pnpm run check:fix` (or `npx aisdlc check --fix`).\n- **Complete Quality Gates verification**: `pnpm run verify:all` (or `npx aisdlc verify all`).\n- **Unit test suite**: `pnpm test`.\n- **Strict typing**: `pnpm run typecheck`.\n\nNon-Negotiable Quality Thresholds (`quality-policy.yaml`):\n- Cyclomatic Complexity (CC) $\\le 10$.\n- Cognitive Complexity $\\le 15$.\n- Maintainability Index (MI) $\\ge 50$.\n- Maximum lines per function $\\le 40$.\n\n---\n\n## 4. Task Autonomy Modes (`tasks.md`)\n\n- \uD83D\uDFE2 **`AUTONOMOUS`**: Low risk, isolated task. Implement code and tests directly. Omit interactive handoff block.\n- \uD83D\uDFE1 **`HUMAN_REVIEW_PLAN`**: Medium risk. Design detailed plan, emit Workflow Handoff block, and wait for human confirmation before coding.\n- \uD83D\uDFE0 **`AMBIGUOUS`**: Incomplete requirements. Blocked: request human clarification.\n- \uD83D\uDD34 **`HIGH_RISK_MANUAL`**: Critical risk (migrations, cryptography). Direct manual execution by humans only.\n\n---\n\n## 5. Workflow Handoff Protocol and Human Action Window | Ventana de Acci\u00F3n Humana\n- **Conditional Activation**:\n  * \uD83D\uDFE2 **`AUTONOMOUS` Mode** (or PR/CI final supervision): **OMITTED**. Do not interrupt unattended execution.\n  * \uD83D\uDFE1 **Autonomy $\\ge$ `HUMAN_REVIEW_PLAN`** (`HUMAN_REVIEW_PLAN`, `AMBIGUOUS`, `HIGH_RISK_MANUAL`): **MANDATORY**. Emit Workflow Handoff block compliant with [`templates/workflow/agent-handoff.template.md`](../templates/workflow/agent-handoff.template.md) and **STOP**.\n- **Components**: Declare completed deliverables, recommend next roles (`agent-threat-modeler`, `agent-privacy-officer`, `agent-system-architect`, `agent-developer`, `agent-security-auditor`), provide suggested invocation prompt, and **keep the Human Action Window open at all times for the user to take action** (review, edit by hand, pause/reroute, or delegate).\n\n---\n\n## 6. Specialized Roles Mapping\n\n| Role | Mission (summary) |\n| :--- | :--- |\n| `agent-product-analyst` | Phase 0 NAF v4 Enterprise & Capability Vision (`ARCH-INTRO-*`, 3\u20135 question interview) + ProductShape artifacts (`ACT-*`, `UC-*`, `FR-*`, `QR-*`, `BR-*`); `status` starts `draft`. |\n| `agent-threat-modeler` | STRIDE/OWASP threat triad (`ACT-THREAT-*`, `ABUSE-*`, `SEC-REQ-*`); hands off to `agent-privacy-officer`. |\n| `agent-privacy-officer` | LINDDUN & GDPR/LOPDGDD privacy triad (`DATA-ASSET-*`, `PRIV-ROPA-*`, `PRIV-REQ-*`) + Pre-Merge `verify:privacy`. |\n| `agent-system-architect` | Modular arc42 + NAF v4 architecture (`CMP-*`, Mermaid diagrams, `ADR-*`). |\n| `agent-qa-engineer` | FAILING BDD/Gherkin, E2E, and UI suites (using agreed project tech; Happy Path, Sad Path & Boundary Values per interactive UI element) before `agent-developer` writes production code. |\n| `agent-developer` | Atomic tasks from `tasks.md`; autonomy mode must be respected; runs `pnpm run check:fix` + `pnpm run verify:all`. |\n| `agent-security-auditor` | Adversarial PR security audit, SAST, secrets, and CVSS v3.1 evaluation. |\n| `agent-compliance-checker` | SPDX license compliance audit against `license-policy.yaml`. |\n| `agent-expert-user` | Bimodal MVP evaluation (design) and functional validation against `UC-*` and `FR-*` (pre-PR). |\n| `agent-code-reviewer` | PR audit (SOLID, DRY, YAGNI): `[BLOCKING]` / `[CLEAN_CODE_SUGGESTION]` / `[COMPLIANT]`. |\n| `agent-devops` | CI/CD, Docker, IaC only \u2014 **FORBIDDEN** to touch `src/` or `packages/*/src/`. |\n\n---\n\n## 7. Canonical Reference\nTo consult full protocols, specialized prompts, and interface contracts:\n- [`process/09_agent_protocols.md`](../process/09_agent_protocols.md)\n- [`process/01_governance_and_roles.md`](../process/01_governance_and_roles.md)\n";
 declare const STARTER_CURSOR_MCP = "{\n  \"mcpServers\": {\n    \"ai-sdlc\": {\n      \"command\": \"npx\",\n      \"args\": [\n        \"@aisdlc/mcp\"\n      ]\n    }\n  }\n}\n";
 declare const STARTER_ANTIGRAVITY_MCP = "{\n  \"mcpServers\": {\n    \"ai-sdlc\": {\n      \"command\": \"npx\",\n      \"args\": [\n        \"@aisdlc/mcp\"\n      ]\n    }\n  }\n}\n";
@@ -2377,12 +2372,14 @@ interface InitProjectOptions {
     agents?: string | boolean | string[];
     architecture?: ArchitectureGranularity | string;
     dryRun?: boolean;
+    force?: boolean;
 }
 interface InitProjectResult {
     success: boolean;
     targetDir: string;
     directoriesCreated: string[];
     filesCreated: string[];
+    filesUpdated: string[];
     ciProvider?: SupportedCiProvider;
     agentsConfigured: string[];
     architectureGranularity?: ArchitectureGranularity;
@@ -2399,7 +2396,33 @@ declare function collectAgentFiles(targets: Set<string>): {
 };
 declare function initProject(options?: InitProjectOptions): InitProjectResult;
 
+/**
+ * Strict canonical sort function by Unicode UTF-8 codepoint.
+ */
+declare function canonicalSort(a: string, b: string): number;
+/**
+ * Normalizes file paths to POSIX forward slashes and Unicode NFC form.
+ */
+declare function normalizePath(p: string): string;
 declare function walkMdFiles(dir: string, fileList?: string[], excludeDirs?: string[]): string[];
+/**
+ * Normalizes report text by stripping or standardizing volatile temporal metadata
+ * (e.g., Generation Date, Generated at, Fecha, Audit Date, Date in markdown headers
+ * and Generated: <span>...</span> in HTML headers) so semantic content comparison
+ * is not invalidated by timestamps or dates.
+ */
+declare function stripVolatileReportMetadata(content: string, _ext?: string): string;
+/**
+ * Checks whether an existing report file on disk is semantically identical to new content,
+ * ignoring volatile temporal metadata (timestamps, generation dates).
+ */
+declare function isReportContentSemanticallyEqual(existingContent: string, newContent: string, filePath: string): boolean;
+/**
+ * Writes a report file to disk only if its semantic content has changed,
+ * preventing spurious diffs and Git merge conflicts in PRs caused solely by volatile metadata.
+ * Returns true if the file was written, false if it was skipped (no-op).
+ */
+declare function writeReportFileIfChanged(filePath: string, content: string): boolean;
 
 /**
  * AI-SDLC: Deterministic Data Loss Prevention (DLP) Pre-Prompt Sanitizer (#74)
@@ -2431,4 +2454,38 @@ declare function loadDlpPolicy(rootDir?: string, customPolicyPath?: string): Dlp
 declare function sanitizeDlpText(text: string, policy?: DlpPolicy): DlpSanitizeResult;
 declare function sanitizeDlpPayload<T>(payload: T, policy?: DlpPolicy): T;
 
-export { ALL_ARCHITECTURE_TEMPLATES, type ActiveTaskMatch, type AgentTarget, type AnalysisResult, type ArchTemplateDef, type ArchitectureGranularity, type ArtifactFrontmatter, type ArtifactSchemaOptions, type ArtifactSchemaResult, type ArtifactSchemaViolation, type ArtifactValidationResult, type AuthorIdentity, type AuthorKpiSummary, type AutonomyMode, BRANCH_PATTERNS, type BddFeatureExecutionReport, type BddScenarioExecution, type BddStepExecution, BddStepRegistry, type BddVariantCoverage, type BranchClassificationResult, type BranchHierarchyPlan, type BranchValidationError, type BranchValidationSuccess, type BugRecordSummary, type ChangeDetectionOptions, type ChangeDetectionResult, type ChangeProfile, type CiProvider, type CodeCoverageSummary, type CommitKpiRecord, type CommitTrailers, type ContractTraceAudit, type CycloneDxBom, type CycloneDxComponent, type CycloneDxLicense, type CycloneDxVulnerability, type CytoscapeEdgeData, type CytoscapeElement, type CytoscapeNodeData, DEFAULT_DLP_RULES, DEFAULT_EXCLUDED_PATTERNS, DEFAULT_EXCLUDES, DEFAULT_EXTENSIONS, DEFAULT_PRIVACY_POLICY, DEFAULT_SAST_EXCLUDES, type DashboardHistoricalKpi, type DashboardOptions, type DashboardResult, type DataAssetSummary, type DesignContractDeclaration, type DiffLineItem, type DlpPolicy, type DlpRule, type DlpSanitizeResult, type DuplicateIssue, type DuplicateIssueType, type DuplicateSeverity, type DuplicateVerifierOptions, type DuplicateVerifierResult, type ExtractedFeature, type FunctionMetrics, GENERAL_SOURCE_EXTENSIONS, type GenerateSarifOptions, type GherkinExtractionOptions, type GherkinExtractionResult, type GherkinSyncCheckResult, type GitCheckoutTaskOptions, type GitCheckoutTaskResult, type GovernanceOptions, type GovernanceResult, type GraphElementsResult, type GraphNodeLayer, type GraphNodeStatus, type GraphNodeType, type HookInstallResult, type InitProjectOptions, type InitProjectResult, type JsonSchemaRule, KPI_SUMMARY_END_TAG, KPI_SUMMARY_START_TAG, LIFECYCLE_SKILL_TEMPLATES, type LicensePolicy, type LicenseVerificationOptions, type LicenseVerificationResult, type LicenseViolation, type LifecycleSkillTemplate, type ManualDocumentItem, type ManualsCoverageSummary, type ManualsVerificationOptions, type ManualsVerificationResult, type ModelDefectStats, OpenSpecAdapter, PII_SAST_RULES, PREPARE_COMMIT_MSG_SCRIPT, PROMPT_INJECTION_SIGNATURES, PROTECTED_BYPASS_PATTERNS, type PackageJsonInfo, type ParsedFeatureDocument, type ParsedScenarioBlock, type ParsedStepItem, type PdacDrift, type PdacGraphOptions, type PdacGraphResult, type PdacNode, type PdacSyncDetail, type PdacSyncOptions, type PdacSyncResult, type PiiSastRule, type PrKpiAggregation, type PreflightCheckOptions, type PreflightCheckResult, type PreflightGateSummary, type PrivacyClassificationRule, type PrivacyFindingType, type PrivacyPolicy, type PrivacyRopaSummary, type PrivacyVerifierOptions, type PrivacyVerifierResult, type PrivacyViolation, type ProductHandoff, type ProductHandoffSubgraph, type ProgressiveFrictionOptions, type ProgressiveFrictionResult, type PromptInjectionFinding, type QualityBaseline, type QualityBaselineEntry, type QualityGateOptions, type QualityGateResult, type QualityPolicy, type QualityReportOptions, type QualityReportResult, type QualityThresholds, type ReleaseKpiReport, type RequirementAuditItem, type ResolvedCiEnv, SARIF_SCHEMA_2_1_0, SARIF_VERSION, SAST_RULES, SCHEMA_SCHEMAS_ARCHITECTURE_ADR_SCHEMA_JSON, SCHEMA_SCHEMAS_ARCHITECTURE_COMPONENT_SCHEMA_JSON, SCHEMA_SCHEMAS_ARCHITECTURE_INTRODUCTION_AND_GOALS_SCHEMA_JSON, SCHEMA_SCHEMAS_COMPLIANCE_LICENSE_MANIFEST_SCHEMA_JSON, SCHEMA_SCHEMAS_COMPLIANCE_LICENSE_POLICY_SCHEMA_JSON, SCHEMA_SCHEMAS_COMPLIANCE_QUALITY_POLICY_SCHEMA_JSON, SCHEMA_SCHEMAS_IDE_MCP_CONFIG_SCHEMA_JSON, SCHEMA_SCHEMAS_MANUALS_PRODUCTION_MANUAL_SCHEMA_JSON, SCHEMA_SCHEMAS_MANUALS_USER_MANUAL_SCHEMA_JSON, SCHEMA_SCHEMAS_PRIVACY_DATA_ASSET_SCHEMA_JSON, SCHEMA_SCHEMAS_PRIVACY_PRIVACY_POLICY_SCHEMA_JSON, SCHEMA_SCHEMAS_PRIVACY_PRIVACY_REQ_SCHEMA_JSON, SCHEMA_SCHEMAS_PRIVACY_PRIVACY_ROPA_SCHEMA_JSON, SCHEMA_SCHEMAS_PRODUCT_ACTOR_SCHEMA_JSON, SCHEMA_SCHEMAS_PRODUCT_BOUNDED_CONTEXT_SCHEMA_JSON, SCHEMA_SCHEMAS_PRODUCT_BUSINESS_RULE_SCHEMA_JSON, SCHEMA_SCHEMAS_PRODUCT_JOURNEY_SCHEMA_JSON, SCHEMA_SCHEMAS_PRODUCT_REQUIREMENT_SCHEMA_JSON, SCHEMA_SCHEMAS_PRODUCT_TERM_SCHEMA_JSON, SCHEMA_SCHEMAS_PRODUCT_USE_CASE_SCHEMA_JSON, SCHEMA_SCHEMAS_SAFETY_HAZARD_SCHEMA_JSON, SCHEMA_SCHEMAS_SAFETY_SAFETY_REQ_SCHEMA_JSON, SCHEMA_SCHEMAS_SDD_DESIGN_SCHEMA_JSON, SCHEMA_SCHEMAS_SDD_HANDOFF_SCHEMA_JSON, SCHEMA_SCHEMAS_SDD_PROPOSAL_SCHEMA_JSON, SCHEMA_SCHEMAS_SDD_RELEASE_KPIS_SCHEMA_JSON, SCHEMA_SCHEMAS_SDD_SESSION_TELEMETRY_SCHEMA_JSON, SCHEMA_SCHEMAS_SDD_SPEC_SCHEMA_JSON, SCHEMA_SCHEMAS_SDD_TASKS_SCHEMA_JSON, SCHEMA_SCHEMAS_SECURITY_ABUSE_CASE_SCHEMA_JSON, SCHEMA_SCHEMAS_SECURITY_ENCLAVE_SCHEMA_JSON, SCHEMA_SCHEMAS_SECURITY_SECURITY_REQ_SCHEMA_JSON, SCHEMA_SCHEMAS_SECURITY_THREAT_ACTOR_SCHEMA_JSON, SCHEMA_SCHEMAS_WORKFLOW_AGENT_HANDOFF_SCHEMA_JSON, SECRET_RULES, SPECIALIZED_AGENT_TEMPLATES, STARTER_ANTIGRAVITY_MCP, STARTER_ANTIGRAVITY_RULES, STARTER_ARCH_ADR, STARTER_ARCH_ARCHITECTURE_CONSTRAINTS, STARTER_ARCH_COMPONENT, STARTER_ARCH_CONTEXT_AND_SCOPE, STARTER_ARCH_CROSS_CUTTING_CONCEPTS, STARTER_ARCH_DEPLOYMENT_VIEW, STARTER_ARCH_GLOSSARY, STARTER_ARCH_INTRODUCTION_AND_GOALS, STARTER_ARCH_LEVEL_1_WHITEBOX, STARTER_ARCH_QUALITY_REQUIREMENTS, STARTER_ARCH_RISKS_AND_TECHNICAL_DEBT, STARTER_ARCH_RUNTIME_VIEW, STARTER_ARCH_SOLUTION_STRATEGY, STARTER_AZURE_PIPELINES, STARTER_BASE_TEMPLATES, STARTER_BITBUCKET_PIPELINES, STARTER_CLAUDE_RULES, STARTER_COMPLIANCE_LICENSE_MANIFEST_YAML, STARTER_COPILOT_RULES, STARTER_CURSOR_CORE_RULES, STARTER_CURSOR_MCP, STARTER_CURSOR_PRODUCT_RULES, STARTER_CURSOR_QUALITY_RULES, STARTER_GITHUB_CI, STARTER_GITHUB_DEPLOY_DASHBOARD, STARTER_GITHUB_PR_KPI, STARTER_GITHUB_PULL_REQUEST_TEMPLATE, STARTER_GITHUB_SDD_INTEGRATE, STARTER_GITLAB_CI, STARTER_LICENSE_POLICY, STARTER_PRIVACY_POLICY, STARTER_PROCESS_README, STARTER_PULL_REQUEST_TEMPLATE, STARTER_QUALITY_POLICY, STARTER_REQUIREMENT_TEMPLATE, STARTER_SCHEMAS, STARTER_SCHEMAS_MAP, STARTER_TASK_TEMPLATE, STARTER_TEMPLATES_CI_AZURE_PIPELINES_YML, STARTER_TEMPLATES_CI_BITBUCKET_PIPELINES_YML, STARTER_TEMPLATES_CI_GITHUB_WORKFLOWS_CI_YML, STARTER_TEMPLATES_CI_GITHUB_WORKFLOWS_DEPLOY_DASHBOARD_YML, STARTER_TEMPLATES_CI_GITHUB_WORKFLOWS_PR_KPI_SUMMARY_YML, STARTER_TEMPLATES_CI_GITHUB_WORKFLOWS_SDD_INTEGRATE_ON_MERGE_YML, STARTER_TEMPLATES_CI__GITLAB_CI_YML, STARTER_TEMPLATES_COMPLIANCE_COMMERCIAL_ACQUISITION_REQUEST_TEMPLATE_MD, STARTER_TEMPLATES_MANUALS_PRODUCTION_MANUAL_TEMPLATE_MD, STARTER_TEMPLATES_MANUALS_USER_MANUAL_TEMPLATE_MD, STARTER_TEMPLATES_PRIVACY_DATA_ASSET_TEMPLATE_MD, STARTER_TEMPLATES_PRIVACY_DPIA_REQUEST_TEMPLATE_MD, STARTER_TEMPLATES_PRIVACY_PRIVACY_REQ_TEMPLATE_MD, STARTER_TEMPLATES_PRIVACY_PRIVACY_ROPA_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_ACTOR_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_BOUNDED_CONTEXT_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_BUSINESS_RULE_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_JOURNEY_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_REQUIREMENT_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_TERM_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_USER_DESIGN_FEEDBACK_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_USE_CASE_TEMPLATE_MD, STARTER_TEMPLATES_SAFETY_HAZARD_TEMPLATE_MD, STARTER_TEMPLATES_SAFETY_SAFETY_REQ_TEMPLATE_MD, STARTER_TEMPLATES_SDD_DESIGN_TEMPLATE_MD, STARTER_TEMPLATES_SDD_HANDOFF_TEMPLATE_YAML, STARTER_TEMPLATES_SDD_PROPOSAL_TEMPLATE_MD, STARTER_TEMPLATES_SDD_PULL_REQUEST_TEMPLATE_MD, STARTER_TEMPLATES_SDD_SPEC_TEMPLATE_MD, STARTER_TEMPLATES_SDD_TASKS_TEMPLATE_MD, STARTER_TEMPLATES_SECURITY_ABUSE_CASE_TEMPLATE_MD, STARTER_TEMPLATES_SECURITY_ENCLAVE_TEMPLATE_MD, STARTER_TEMPLATES_SECURITY_SECURITY_REQ_TEMPLATE_MD, STARTER_TEMPLATES_SECURITY_THREAT_ACTOR_TEMPLATE_MD, STARTER_TEMPLATES_WORKFLOW_AGENT_HANDOFF_TEMPLATE_MD, STARTER_VSCODE_MCP, STARTER_WORKFLOW_HANDOFF_TEMPLATE, STARTER__GITHUB_PULL_REQUEST_TEMPLATE_MD, type SarifArtifactLocation, type SarifDocument, type SarifLevel, type SarifLocation, type SarifMultiformatMessageString, type SarifPhysicalLocation, type SarifRegion, type SarifReportingDescriptor, type SarifResult, type SarifRuleConfiguration, type SarifRun, type SarifToolDriver, type SastFindingType, type SastRule, type SastSeverity, type SastVerifierOptions, type SastVerifierResult, type SastViolation, type SbomGenerateOptions, type ScaTool, type ScaVulnerability, type ScanOptions, type ScannedDependency, type ScannedRequirement, type SddAdapter, type SddChangeScaffoldOptions, type SddChangeScaffoldResult, type SddDepositOptions, type SddFramework, type SddIntegrationAudit, type SddIntegrationOptions, type SddIntegrationResult, type SddValidationResult, type SddWorkspaceInfo, type SecretFindingType, type SecretRule, type SecretVerifierOptions, type SecretVerifierResult, type SecretViolation, type SecuritySuppression, type SpecCatalogScope, SpecKitAdapter, type SpecializedAgentTemplate, type StarterSchemaEntry, type StarterTemplateEntry, type StepDataTable, type StepDefinitionEntry, type StepHandler, type SupportedCiProvider, TYPE_TO_SCHEMA_MAP, type TaskAuditItem, type TaskItem, type TaskLocateResult, type TaskSummary, type TaskVerification, type TestingCoverageOptions, type TestingCoverageResult, type TraceabilityOptions, type TraceabilityResult, type TraceabilityRow, type UntestedFunctionItem, type UseCaseFlowAuditItem, VALID_AGENT_TARGETS, VALID_ARCHITECTURE_GRANULARITIES, VALID_AUTONOMY_MODES, VALID_CHANGE_PROFILES, VALID_CI_PROVIDERS, type VexAnalysisJustification, type VexAnalysisState, type VexStatement, type VulnerabilityThresholds, aggregateCommitKpiRecords, aggregatePrKpis, aggregateReleaseKpis, analyzeBddVariantsForRequirement, appendRevisionHistoryRow, applyRatchetMode, buildCycloneDxComponent, buildCycloneDxVulnerabilities, buildFeatureFileContent, buildGraphElements, calculateJaccardSimilarity, calculateMetrics, calculateRating, calculateShannonEntropy, checkGherkinInSync, checkoutTaskBranch, classifyBranch, classifyMetricFromMessage, collectAgentFiles, collectDashboardMetrics, collectHistoricalKpis, computeCanonicalSha256, computeSha256, computeViolationSignature, createDefaultDlpPolicy, createDefaultQualityPolicy, depositProductHandoffSidecar, detectActiveChangeForIntegration, detectAuthorIdentity, detectLanguage, detectProfileFromChange, detectPromptInjection, emitCiOutput, evaluateCompoundLicense, evaluateSingleDependency, evaluateVulnerabilityThresholds, executeBddFeature, extractBaselineEntriesFromResults, extractCitations, extractCommitKpisFromRange, extractDirectDepNames, extractFeatureTags, extractFrontmatter, extractFunctions, extractFunctionsBraceLanguages, extractFunctionsPolyglot, extractFunctionsPython, extractFunctionsTypeScriptAst, extractGherkinBlock, extractGherkinFeatures, extractNormativeText, findChangeWorkspaceDir, findLicenseFile, formatCommitTrailers, formatPrKpiMarkdown, formatReleaseKpiMarkdown, generateBranchHierarchyPlan, generateCycloneDxSbom, generateDashboardReport, generateDuplicatesReportMarkdown, generateGovernanceReportMarkdown, generateLicenseReportMarkdown, generatePdacReportMarkdown, generatePrivacyReportMarkdown, generateQualityReport, generateRopaInventoryMarkdown, generateSastReportMarkdown, generateSecretsReportMarkdown, generateSecuritySarifReport, generateSuppressionsAuditReport, generateTestingCoverageReportMarkdown, generateThirdPartyNotices, generateTraceabilityReportMarkdown, getArchitectureTemplates, getCytoscapeScript, getGitDiffLines, getNextCorrelativeNumber, getSddAdapter, inferArtifactTypeFromId, inferMissingTrailers, initProject, injectKpisIntoPrBody, installGitHooks, integrateSddChange, isGitleaksInstalled, isMetricWorsened, isPathProtectedFromPatch, isPlaceholderOrIgnored, isRequirementArtifact, isSemgrepInstalled, isToolAvailable, loadDlpPolicy, loadPrivacyPolicy, loadProductHandoffSidecar, loadQualityBaseline, locateTaskInActiveChanges, mapSastSeverityToSarifLevel, maskSecret, normalizeSpdxLicense, normalizeUri, parseCommitTrailers, parseDlpPolicy, parseFeatureDocument, parseFrontmatter, parseFrontmatterId, parseGenericDoc, parseLicensePolicy, parseMarkdownFrontmatter, parseQualityPolicy, parseRequirementFile, parseSecuritySuppression, parseSpecCatalogScope, parseTasksDoc, parseTasksFromContent, parseTrivyVulnerabilities, processPackageDir, readCodeCoverageSummary, readPackageJson, renderAntigravityAgentFile, renderAntigravitySkillFile, renderAutonomyModeSection, renderClaudeAgentFile, renderClaudeSkillFile, renderCopilotAgentFile, renderCopilotSkillFile, renderCursorAgentFile, renderCursorSkillFile, renderDashboardHtml, renderManualsTab, resolveAgentTargets, resolveBranchHierarchy, resolveCiEnvironment, resolveCytoscapePath, resolveDefaultBranchBase, resolveFeatureFilePath, resolveGitRef, resolveLicenseFromFile, resolveReleaseBaseBranch, resolveSastCwe, resolveSastOwasp, resolveSchemaForArtifact, resolveTargetFiles, runGitleaksCli, runSemgrepCli, sanitizeDlpPayload, sanitizeDlpText, scaffoldSddChange, scanAllProductHandoffs, scanAllTestArtifacts, scanContentForSecrets, scanFileForPrivacyViolations, scanFileForSast, scanGoDependencies, scanInstalledLicenses, scanManualsInWorkspace, scanMavenDependencies, scanPnpmStore, scanPythonDependencies, scanRustDependencies, scanSubdirectories, scanWithNativeFs, scanWithSyft, scanWithTrivy, serializeSarifDocument, slugify, syncPdacDigests, tokenizeTitle, updateCitationsInContent, validateAgainstSchema, validateArtifactSchema, verifyArtifactDuplicates, verifyArtifactsSchemas, verifyLicenses, verifyManuals, verifyPdacGraph, verifyPrivacy, verifyProgressiveFriction, verifyQualityGate, verifySast, verifySddIntegration, verifySecrets, verifyTasksGovernance, verifyTestingCoverage, verifyTraceability, walkDir, walkMdFiles, walkProjectFiles, walkSourceFiles, walkTaskFiles, writeCucumberJsonReport, writeCycloneDxSbom, writeQualityBaseline, writeReleaseKpiReport, writeSecuritySarifReport, writeThirdPartyNotices };
+/**
+ * AI-SDLC: Native Python AST Analyzer
+ * Uses Python standard library 'ast' module (zero external dependencies).
+ */
+
+declare function extractFunctionsPythonAst(content: string, filePath: string): LanguageAstReport;
+
+/**
+ * AI-SDLC: Native Language SDK/CLI AST Orchestrator
+ * Dispatches to native language compilers / SDKs (python ast, ts-morph, dotnet, cargo, go)
+ * with strict Fail-Closed enforcement for configured toolchain stacks.
+ */
+
+interface NativeAstOptions {
+    requiredStack?: string;
+    strictToolchain?: boolean;
+}
+declare function isCliInstalled(bin: string): boolean;
+declare function orchestrateNativeAstAnalysis(content: string, filePath: string, options?: NativeAstOptions): LanguageAstReport;
+
+/**
+ * AI-SDLC: Deterministic Time & Reproducibility Engine
+ */
+/**
+ * Resolves a deterministic Date instance respecting SOURCE_DATE_EPOCH
+ * or Git HEAD commit timestamp fallback, enabling bit-for-bit reproducible artifacts.
+ */
+declare function resolveDeterministicDate(rootDir?: string): Date;
+/**
+ * Generates an RFC 4122 compliant UUIDv5 from a namespace and name string
+ * without external dependencies.
+ */
+declare function generateDeterministicUuidV5(name: string, namespace?: string): string;
+
+export { ALL_ARCHITECTURE_TEMPLATES, type ActiveTaskMatch, type AgentTarget, type AnalysisResult, type ArchTemplateDef, type ArchitectureGranularity, type ArtifactFrontmatter, type ArtifactSchemaOptions, type ArtifactSchemaResult, type ArtifactSchemaViolation, type ArtifactValidationResult, type AuthorIdentity, type AuthorKpiSummary, type AutonomyMode, BRANCH_PATTERNS, type BddFeatureExecutionReport, type BddScenarioExecution, type BddStepExecution, BddStepRegistry, type BddVariantCoverage, type BranchClassificationResult, type BranchHierarchyPlan, type BranchValidationError, type BranchValidationSuccess, type BugRecordSummary, type ChangeDetectionOptions, type ChangeDetectionResult, type ChangeProfile, type CiProvider, type CodeCoverageSummary, type CommitKpiRecord, type CommitTrailers, type ContractTraceAudit, type CycloneDxBom, type CycloneDxComponent, type CycloneDxLicense, type CycloneDxVulnerability, type CytoscapeEdgeData, type CytoscapeElement, type CytoscapeNodeData, DEFAULT_DLP_RULES, DEFAULT_EXCLUDED_PATTERNS, DEFAULT_EXCLUDES, DEFAULT_EXTENSIONS, DEFAULT_PRIVACY_POLICY, DEFAULT_SAST_EXCLUDES, type DashboardHistoricalKpi, type DashboardOptions, type DashboardResult, type DataAssetSummary, type DesignContractDeclaration, type DiffLineItem, type DlpPolicy, type DlpRule, type DlpSanitizeResult, type DuplicateIssue, type DuplicateIssueType, type DuplicateSeverity, type DuplicateVerifierOptions, type DuplicateVerifierResult, type ExtractedFeature, type FunctionMetrics, GENERAL_SOURCE_EXTENSIONS, type GenerateSarifOptions, type GherkinExtractionOptions, type GherkinExtractionResult, type GherkinSyncCheckResult, type GitCheckoutTaskOptions, type GitCheckoutTaskResult, type GovernanceOptions, type GovernanceResult, type GraphElementsResult, type GraphNodeLayer, type GraphNodeStatus, type GraphNodeType, type HookInstallResult, type InitProjectOptions, type InitProjectResult, type JsonSchemaRule, KPI_SUMMARY_END_TAG, KPI_SUMMARY_START_TAG, LIFECYCLE_SKILL_TEMPLATES, type LanguageAstReport, type LicensePolicy, type LicenseVerificationOptions, type LicenseVerificationResult, type LicenseViolation, type LifecycleSkillTemplate, type ManualDocumentItem, type ManualsCoverageSummary, type ManualsVerificationOptions, type ManualsVerificationResult, type ModelDefectStats, type NativeAstOptions, OpenSpecAdapter, PII_SAST_RULES, PREPARE_COMMIT_MSG_SCRIPT, PROMPT_INJECTION_SIGNATURES, PROTECTED_BYPASS_PATTERNS, type PackageJsonInfo, type ParsedFeatureDocument, type ParsedScenarioBlock, type ParsedStepItem, type PdacDrift, type PdacGraphOptions, type PdacGraphResult, type PdacInvalidAnchor, type PdacNode, type PdacSyncDetail, type PdacSyncOptions, type PdacSyncResult, type PdacUnresolvedCitation, type PiiSastRule, type PrKpiAggregation, type PreflightCheckOptions, type PreflightCheckResult, type PreflightGateSummary, type PrivacyClassificationRule, type PrivacyFindingType, type PrivacyPolicy, type PrivacyRopaSummary, type PrivacyVerifierOptions, type PrivacyVerifierResult, type PrivacyViolation, type ProductHandoff, type ProductHandoffSubgraph, type ProgressiveFrictionOptions, type ProgressiveFrictionResult, type PromptInjectionFinding, type QualityBaseline, type QualityBaselineEntry, type QualityGateOptions, type QualityGateResult, type QualityPolicy, type QualityReportOptions, type QualityReportResult, type QualityThresholds, type ReleaseKpiReport, type RequirementAuditItem, type ResolvedCiEnv, SARIF_SCHEMA_2_1_0, SARIF_VERSION, SAST_RULES, SCHEMA_SCHEMAS_ARCHITECTURE_ADR_SCHEMA_JSON, SCHEMA_SCHEMAS_ARCHITECTURE_COMPONENT_SCHEMA_JSON, SCHEMA_SCHEMAS_ARCHITECTURE_INTRODUCTION_AND_GOALS_SCHEMA_JSON, SCHEMA_SCHEMAS_COMPLIANCE_LICENSE_MANIFEST_SCHEMA_JSON, SCHEMA_SCHEMAS_COMPLIANCE_LICENSE_POLICY_SCHEMA_JSON, SCHEMA_SCHEMAS_COMPLIANCE_QUALITY_POLICY_SCHEMA_JSON, SCHEMA_SCHEMAS_IDE_MCP_CONFIG_SCHEMA_JSON, SCHEMA_SCHEMAS_MANUALS_PRODUCTION_MANUAL_SCHEMA_JSON, SCHEMA_SCHEMAS_MANUALS_USER_MANUAL_SCHEMA_JSON, SCHEMA_SCHEMAS_PRIVACY_DATA_ASSET_SCHEMA_JSON, SCHEMA_SCHEMAS_PRIVACY_PRIVACY_POLICY_SCHEMA_JSON, SCHEMA_SCHEMAS_PRIVACY_PRIVACY_REQ_SCHEMA_JSON, SCHEMA_SCHEMAS_PRIVACY_PRIVACY_ROPA_SCHEMA_JSON, SCHEMA_SCHEMAS_PRODUCT_ACTOR_SCHEMA_JSON, SCHEMA_SCHEMAS_PRODUCT_BOUNDED_CONTEXT_SCHEMA_JSON, SCHEMA_SCHEMAS_PRODUCT_BUSINESS_RULE_SCHEMA_JSON, SCHEMA_SCHEMAS_PRODUCT_JOURNEY_SCHEMA_JSON, SCHEMA_SCHEMAS_PRODUCT_REQUIREMENT_SCHEMA_JSON, SCHEMA_SCHEMAS_PRODUCT_TERM_SCHEMA_JSON, SCHEMA_SCHEMAS_PRODUCT_USE_CASE_SCHEMA_JSON, SCHEMA_SCHEMAS_SAFETY_HAZARD_SCHEMA_JSON, SCHEMA_SCHEMAS_SAFETY_SAFETY_REQ_SCHEMA_JSON, SCHEMA_SCHEMAS_SDD_DESIGN_SCHEMA_JSON, SCHEMA_SCHEMAS_SDD_HANDOFF_SCHEMA_JSON, SCHEMA_SCHEMAS_SDD_PROPOSAL_SCHEMA_JSON, SCHEMA_SCHEMAS_SDD_RELEASE_KPIS_SCHEMA_JSON, SCHEMA_SCHEMAS_SDD_SESSION_TELEMETRY_SCHEMA_JSON, SCHEMA_SCHEMAS_SDD_SPEC_SCHEMA_JSON, SCHEMA_SCHEMAS_SDD_TASKS_SCHEMA_JSON, SCHEMA_SCHEMAS_SECURITY_ABUSE_CASE_SCHEMA_JSON, SCHEMA_SCHEMAS_SECURITY_ENCLAVE_SCHEMA_JSON, SCHEMA_SCHEMAS_SECURITY_SECURITY_REQ_SCHEMA_JSON, SCHEMA_SCHEMAS_SECURITY_THREAT_ACTOR_SCHEMA_JSON, SCHEMA_SCHEMAS_WORKFLOW_AGENT_HANDOFF_SCHEMA_JSON, SECRET_RULES, SPECIALIZED_AGENT_TEMPLATES, STARTER_ANTIGRAVITY_MCP, STARTER_ANTIGRAVITY_RULES, STARTER_ARCH_ADR, STARTER_ARCH_ARCHITECTURE_CONSTRAINTS, STARTER_ARCH_COMPONENT, STARTER_ARCH_CONTEXT_AND_SCOPE, STARTER_ARCH_CROSS_CUTTING_CONCEPTS, STARTER_ARCH_DEPLOYMENT_VIEW, STARTER_ARCH_GLOSSARY, STARTER_ARCH_INTRODUCTION_AND_GOALS, STARTER_ARCH_LEVEL_1_WHITEBOX, STARTER_ARCH_QUALITY_REQUIREMENTS, STARTER_ARCH_RISKS_AND_TECHNICAL_DEBT, STARTER_ARCH_RUNTIME_VIEW, STARTER_ARCH_SOLUTION_STRATEGY, STARTER_AZURE_PIPELINES, STARTER_BASE_TEMPLATES, STARTER_BITBUCKET_PIPELINES, STARTER_CLAUDE_RULES, STARTER_COMPLIANCE_LICENSE_MANIFEST_YAML, STARTER_COPILOT_RULES, STARTER_CURSOR_CORE_RULES, STARTER_CURSOR_MCP, STARTER_CURSOR_PRODUCT_RULES, STARTER_CURSOR_QUALITY_RULES, STARTER_GITHUB_CI, STARTER_GITHUB_DEPLOY_DASHBOARD, STARTER_GITHUB_PR_KPI, STARTER_GITHUB_PULL_REQUEST_TEMPLATE, STARTER_GITHUB_SDD_INTEGRATE, STARTER_GITLAB_CI, STARTER_LICENSE_POLICY, STARTER_PRIVACY_POLICY, STARTER_PROCESS_README, STARTER_PULL_REQUEST_TEMPLATE, STARTER_QUALITY_POLICY, STARTER_REQUIREMENT_TEMPLATE, STARTER_SCHEMAS, STARTER_SCHEMAS_MAP, STARTER_TASK_TEMPLATE, STARTER_TEMPLATES_CI_AZURE_PIPELINES_YML, STARTER_TEMPLATES_CI_BITBUCKET_PIPELINES_YML, STARTER_TEMPLATES_CI_GITHUB_WORKFLOWS_CI_YML, STARTER_TEMPLATES_CI_GITHUB_WORKFLOWS_DEPLOY_DASHBOARD_YML, STARTER_TEMPLATES_CI_GITHUB_WORKFLOWS_PR_KPI_SUMMARY_YML, STARTER_TEMPLATES_CI_GITHUB_WORKFLOWS_SDD_INTEGRATE_ON_MERGE_YML, STARTER_TEMPLATES_CI__GITLAB_CI_YML, STARTER_TEMPLATES_COMPLIANCE_COMMERCIAL_ACQUISITION_REQUEST_TEMPLATE_MD, STARTER_TEMPLATES_MANUALS_PRODUCTION_MANUAL_TEMPLATE_MD, STARTER_TEMPLATES_MANUALS_USER_MANUAL_TEMPLATE_MD, STARTER_TEMPLATES_PRIVACY_DATA_ASSET_TEMPLATE_MD, STARTER_TEMPLATES_PRIVACY_DPIA_REQUEST_TEMPLATE_MD, STARTER_TEMPLATES_PRIVACY_PRIVACY_REQ_TEMPLATE_MD, STARTER_TEMPLATES_PRIVACY_PRIVACY_ROPA_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_ACTOR_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_BOUNDED_CONTEXT_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_BUSINESS_RULE_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_JOURNEY_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_REQUIREMENT_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_TERM_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_USER_DESIGN_FEEDBACK_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_USE_CASE_TEMPLATE_MD, STARTER_TEMPLATES_SAFETY_HAZARD_TEMPLATE_MD, STARTER_TEMPLATES_SAFETY_SAFETY_REQ_TEMPLATE_MD, STARTER_TEMPLATES_SDD_DESIGN_TEMPLATE_MD, STARTER_TEMPLATES_SDD_HANDOFF_TEMPLATE_YAML, STARTER_TEMPLATES_SDD_PROPOSAL_TEMPLATE_MD, STARTER_TEMPLATES_SDD_PULL_REQUEST_TEMPLATE_MD, STARTER_TEMPLATES_SDD_SPEC_TEMPLATE_MD, STARTER_TEMPLATES_SDD_TASKS_TEMPLATE_MD, STARTER_TEMPLATES_SECURITY_ABUSE_CASE_TEMPLATE_MD, STARTER_TEMPLATES_SECURITY_ENCLAVE_TEMPLATE_MD, STARTER_TEMPLATES_SECURITY_SECURITY_REQ_TEMPLATE_MD, STARTER_TEMPLATES_SECURITY_THREAT_ACTOR_TEMPLATE_MD, STARTER_TEMPLATES_WORKFLOW_AGENT_HANDOFF_TEMPLATE_MD, STARTER_VSCODE_MCP, STARTER_WORKFLOW_HANDOFF_TEMPLATE, STARTER__GITHUB_PULL_REQUEST_TEMPLATE_MD, type SarifArtifactLocation, type SarifDocument, type SarifLevel, type SarifLocation, type SarifMultiformatMessageString, type SarifPhysicalLocation, type SarifRegion, type SarifReportingDescriptor, type SarifResult, type SarifRuleConfiguration, type SarifRun, type SarifToolDriver, type SastFindingType, type SastRule, type SastSeverity, type SastVerifierOptions, type SastVerifierResult, type SastViolation, type SbomGenerateOptions, type ScaTool, type ScaVulnerability, type ScanOptions, type ScannedDependency, type ScannedRequirement, type SddAdapter, type SddChangeScaffoldOptions, type SddChangeScaffoldResult, type SddDepositOptions, type SddFramework, type SddIntegrationAudit, type SddIntegrationOptions, type SddIntegrationResult, type SddValidationResult, type SddWorkspaceInfo, type SecretFindingType, type SecretRule, type SecretVerifierOptions, type SecretVerifierResult, type SecretViolation, type SecuritySuppression, type SpecCatalogScope, SpecKitAdapter, type SpecializedAgentTemplate, type StarterSchemaEntry, type StarterTemplateEntry, type StepDataTable, type StepDefinitionEntry, type StepHandler, type SupportedCiProvider, TYPE_TO_SCHEMA_MAP, type TaskAuditItem, type TaskItem, type TaskLocateResult, type TaskSummary, type TaskVerification, type TestingCoverageOptions, type TestingCoverageResult, type TraceabilityOptions, type TraceabilityResult, type TraceabilityRow, UNIT_TEST_SUFFIXES, type UntestedFunctionItem, type UseCaseFlowAuditItem, VALID_AGENT_TARGETS, VALID_ARCHITECTURE_GRANULARITIES, VALID_AUTONOMY_MODES, VALID_CHANGE_PROFILES, VALID_CI_PROVIDERS, type VexAnalysisJustification, type VexAnalysisState, type VexStatement, type VulnerabilityThresholds, aggregateCommitKpiRecords, aggregatePrKpis, aggregateReleaseKpis, analyzeBddVariantsForRequirement, appendRevisionHistoryRow, applyRatchetMode, buildCycloneDxComponent, buildCycloneDxVulnerabilities, buildFeatureFileContent, buildGraphElements, calculateJaccardSimilarity, calculateMetrics, calculateRating, calculateShannonEntropy, canonicalSort, checkGherkinInSync, checkoutTaskBranch, classifyBranch, classifyMetricFromMessage, collectAgentFiles, collectDashboardMetrics, collectHistoricalKpis, computeCanonicalSha256, computeRawSha256, computeSha256, computeViolationSignature, createDefaultDlpPolicy, createDefaultQualityPolicy, depositProductHandoffSidecar, detectActiveChangeForIntegration, detectAuthorIdentity, detectLanguage, detectProfileFromChange, detectPromptInjection, emitCiOutput, evaluateCompoundLicense, evaluateSingleDependency, evaluateVulnerabilityThresholds, executeBddFeature, extractBaselineEntriesFromResults, extractCitations, extractCommitKpisFromRange, extractDirectDepNames, extractFeatureTags, extractFrontmatter, extractFunctions, extractFunctionsBraceLanguages, extractFunctionsPolyglot, extractFunctionsPython, extractFunctionsPythonAst, extractFunctionsTypeScriptAst, extractGherkinBlock, extractGherkinFeatures, extractNormativeText, extractPythonFunctionsPolyglot, extractSemanticContent, findChangeWorkspaceDir, findLicenseFile, formatCommitTrailers, formatPrKpiMarkdown, formatReleaseKpiMarkdown, generateBranchHierarchyPlan, generateCycloneDxSbom, generateDashboardReport, generateDeterministicUuidV5, generateDuplicatesReportMarkdown, generateGovernanceReportMarkdown, generateLicenseReportMarkdown, generatePdacReportMarkdown, generatePrivacyReportMarkdown, generateQualityReport, generateRopaInventoryMarkdown, generateSastReportMarkdown, generateSecretsReportMarkdown, generateSecuritySarifReport, generateSuppressionsAuditReport, generateTestingCoverageReportMarkdown, generateThirdPartyNotices, generateTraceabilityReportMarkdown, getArchitectureTemplates, getCytoscapeScript, getGitDiffLines, getNextCorrelativeNumber, getSddAdapter, inferArtifactTypeFromId, inferMissingTrailers, initProject, injectKpisIntoPrBody, installGitHooks, integrateSddChange, isCliInstalled, isFunctionReferencedInTests, isGitleaksInstalled, isMetricWorsened, isPathProtectedFromPatch, isPlaceholderOrIgnored, isReportContentSemanticallyEqual, isRequirementArtifact, isSemgrepInstalled, isToolAvailable, loadDlpPolicy, loadPrivacyPolicy, loadProductHandoffSidecar, loadQualityBaseline, locateTaskInActiveChanges, mapSastSeverityToSarifLevel, maskSecret, normalizePath, normalizeSpdxLicense, normalizeUri, orchestrateNativeAstAnalysis, parseCommitTrailers, parseDlpPolicy, parseFeatureDocument, parseFrontmatter, parseFrontmatterId, parseGenericDoc, parseLicensePolicy, parseMarkdownFrontmatter, parseQualityPolicy, parseRequirementFile, parseSecuritySuppression, parseSpecCatalogScope, parseTasksDoc, parseTasksFromContent, parseTrivyVulnerabilities, processPackageDir, readCodeCoverageSummary, readPackageJson, renderAntigravityAgentFile, renderAntigravitySkillFile, renderAutonomyModeSection, renderClaudeAgentFile, renderClaudeSkillFile, renderCopilotAgentFile, renderCopilotSkillFile, renderCursorAgentFile, renderCursorSkillFile, renderDashboardHtml, renderManualsTab, resolveAgentTargets, resolveBranchHierarchy, resolveCiEnvironment, resolveCytoscapePath, resolveDefaultBranchBase, resolveDeterministicDate, resolveFeatureFilePath, resolveGitRef, resolveLicenseFromFile, resolveReleaseBaseBranch, resolveSastCwe, resolveSastOwasp, resolveSchemaForArtifact, resolveTargetFiles, runGitleaksCli, runSemgrepCli, sanitizeDlpPayload, sanitizeDlpText, sanitizeTestCorpus, scaffoldSddChange, scanAllProductHandoffs, scanAllTestArtifacts, scanContentForSecrets, scanFileForPrivacyViolations, scanFileForSast, scanGoDependencies, scanInstalledLicenses, scanManualsInWorkspace, scanMavenDependencies, scanPnpmStore, scanPythonDependencies, scanRustDependencies, scanSubdirectories, scanWithNativeFs, scanWithSyft, scanWithTrivy, serializeSarifDocument, slugify, stripVolatileReportMetadata, syncPdacDigests, tokenizeTitle, updateCitationsInContent, validateAgainstSchema, validateAnchorExistence, validateArtifactSchema, verifyArtifactDuplicates, verifyArtifactsSchemas, verifyLicenses, verifyManuals, verifyPdacGraph, verifyPrivacy, verifyProgressiveFriction, verifyQualityGate, verifySast, verifySddIntegration, verifySecrets, verifyTasksGovernance, verifyTestingCoverage, verifyTraceability, walkDir, walkMdFiles, walkProjectFiles, walkSourceFiles, walkTaskFiles, writeCucumberJsonReport, writeCycloneDxSbom, writeQualityBaseline, writeReleaseKpiReport, writeReportFileIfChanged, writeSecuritySarifReport, writeThirdPartyNotices };