@am_shork/attest 0.9.4 → 0.11.0

package/dist/core/skill.js

@@ -289,40 +289,59 @@ one stage where the assertion is being authored against a value nobody has
 implemented yet. MODIFIED ids are deliberately not readable this way — the end
 state is the base entry with the patch applied, and the base is not in that file.
 
-**The scenarios must be red.** Every added requirement needs at least one
-scenario in a \`*.proposed.spec.ts\`, and at this stage they must fail —
-they describe behaviour that does not exist yet. Prove it:
+Reading a proposed requirement through \`added\` — \`d.added['AUTH-7'].params.x\` —
+is refused by the compiler rather than by this paragraph. It is correct today and
+wrong one command later, because \`--apply\` repoints the import at the registry
+and a registry has no \`added\`; the by-id form above is the one that survives.
+
+**Each added scenario must be observed failing, once.** Every added requirement
+needs at least one scenario in a \`*.proposed.spec.ts\`, and the gate has to see
+each of them fail at least once before it will archive the change. Take the
+observation:
 
 \`\`\`
 attest archive <name> --json     # expect a failing verdict carrying tests-red
 \`\`\`
 
-If it passes at this stage, the scenarios assert nothing real — and this is no
-longer advice. That run writes \`changes/<name>/first-run.json\`, recording how
-each of the change's scenarios ended the first time it was seen, and the archive
-gate later refuses any added requirement whose scenarios have no recorded
-failing run (\`never-red\`). A scenario that was green from the start no longer
-clears the gate.
-
-Two consequences worth knowing before you start:
-
-- **Run this before you implement anything.** The record is written by the
-  command, not by you; skipping the step means the first observation is of
-  already-working code, which is a \`never-red\` block.
-- **A recorded failure is permanent, a recorded pass is not.** The green run at
-  the end cannot erase the red — that is the point — but a scenario recorded as
-  passing can still be fixed: give it an assertion that fails without the change
-  and run the gate again, and the real failure replaces it.
+That run writes \`changes/<name>/first-run.json\`, recording how each of the
+change's scenarios ended, and the archive gate later refuses any added
+requirement whose scenarios have no recorded failing run (\`never-red\`). A
+scenario that has only ever been seen green does not clear the gate — if it
+passes while the behaviour it describes is absent, it asserts nothing real.
+
+**The obligation is that the scenario can fail. It is not an obligation to write
+it first.** The run above is the cheapest way to take the observation, because at
+this point in stage 1 nothing is implemented and the scenarios are red by
+construction. It is not the only way, and the record is what makes the other one
+work: a recorded failure is permanent, a recorded pass is provisional, so a
+failure seen later replaces a pass seen earlier. Two routes, one fact:
+
+- **Nothing implemented yet** — run the command above and the record is taken.
+  This is the shape stage 1 is written around.
+- **The implementation already exists** — you wrote the intent, the scenario and
+  the code in one pass, which is a perfectly good way to work. Remove the
+  implementation, run the command above, then restore it. The record that comes
+  back is the same evidence obtained by the same command, and the restored code
+  makes it green again without erasing it.
+
+Do not reorder work you have already done to satisfy this; take the observation
+the second way. What no route excuses is a scenario that stays green with its
+subject removed — that is the defect \`never-red\` exists to name, and it is
+visible only if you actually take the observation.
+
+A recorded pass is not a dead end either: give the scenario an assertion that
+discriminates and run the gate again, and the real failure replaces it.
 
 Commit \`first-run.json\` with the change. It is evidence a reviewer reads, and
 the gate has to reach the same verdict on a CI checkout as on your machine.
 
 **Never write or edit that file yourself.** The gate trusts it and cannot check
-it: everything else Attest writes can be regenerated and compared, but a first
-run cannot be recomputed once the change is green — which is the whole reason
-the record exists. Producing it any way other than by running the gate destroys
-the only thing it is for. If it says something you did not expect, run the gate
-again; a real failing run replaces a recorded pass.
+it: everything else Attest writes can be regenerated from the tree as it is and
+compared, and this cannot — a green tree says nothing about whether a scenario
+could ever have failed, which is the whole reason the record exists. Producing
+it any way other than by running the gate destroys the only thing it is for. If
+it says something you did not expect, take the observation again — remove the
+behaviour and run the gate; a real failing run replaces a recorded pass.
 
 To see where the change stands at any point, without paying for a run:
 
@@ -347,8 +366,9 @@ still not a verdict — \`attest archive\` is the only thing that decides.
 - **What pins each expectation** — a fixture, a literal, an independently
   derived value; never the param the code under test consumed?
 - **Does each statement carry one obligation**, or several under one SHALL?
-- **Was any of this ever red**, or does part of it already work? \`never-red\`
-  asks for a recorded failing run only on the ids you ADD.
+- **Was each scenario ever observed failing** — with its subject absent, whether
+  because it was not written yet or because you removed it? \`never-red\` asks
+  for that on the ids you ADD, and asks nothing about when you took it.
 
 Then present the proposal, the ids, and the red output, and **stop**. Wait for
 agreement before implementing.
@@ -442,8 +462,9 @@ failure this framework exists to make visible:
    identical content is a no-op.
 4. **Do not write or edit \`first-run.json\`.** It is the one file here the gate
    trusts without being able to check it, so a hand-written \`"fail"\` clears
-   \`never-red\` while proving nothing at all. Run the gate before implementing;
-   that is what produces the record honestly.
+   \`never-red\` while proving nothing at all. Run the gate against a tree where
+   the behaviour is absent — that is what produces the record honestly, and it
+   is the one step here nothing else can stand in for.
 
 ### When the gate passes
 

package/dist/core/splice.d.ts

@@ -65,7 +65,7 @@ export interface Modification {
 export interface ModifyRefusal {
     reqId: string;
     field?: string;
-    reason: 'comment' | 'entry-not-found' | 'not-a-literal' | 'param-dropped';
+    reason: 'comment' | 'duplicate-key' | 'entry-not-found' | 'not-a-literal' | 'param-dropped';
 }
 export type ModifyResult = {
     ok: true;
@@ -107,6 +107,26 @@ export declare function spliceModifications(file: string, source: string, change
  * property of its module resolution, uniform across the project, and already
  * answered by the specifier sitting in front of us — the third spelling
  * included, where the answer is "none".
+ *
+ * **A source that does not compile is returned untouched** — ATX-69, over the
+ * one writer that reaches the compiler directly. `ts.createSourceFile` recovers:
+ * handed a file that does not compile it returns a tree built from what the
+ * parser guessed, and every offset below comes out of that tree and is written
+ * back over the bytes of a `*.spec.ts` the user cannot regenerate. The two other
+ * writers in this file ask the same question through the reader that hands them
+ * their offsets; this one has to ask it itself.
+ *
+ * It is unreachable through the command today — the gate refuses a spec it
+ * could not parse before a merge starts (`pipeline.ts`) — and that is exactly
+ * why it is checked here: a defence that holds only because something upstream
+ * holds is not a defence, which is the standard `keySource` above is written to.
+ *
+ * The refusal is the source unchanged rather than a throw or an issue, because
+ * there is no failure channel to use and this function's whole discipline is
+ * that it touches one string literal or nothing. `applyMerge` writes only when
+ * the text moved, so an unparseable spec is renamed with the import it already
+ * had — which is the state a re-run finds and reports, rather than a file
+ * rewritten at offsets nobody can trust.
  */
 export declare function repointImport(file: string, source: string, from: string, to: string): string;
 //# sourceMappingURL=splice.d.ts.map

package/dist/core/splice.js

@@ -34,6 +34,7 @@
 // reach this file because the gate validated the delta before `--apply` ran.
 import ts from 'typescript';
 import { dirname, relative, resolve } from 'node:path';
+import { parseSource } from './compiler.js';
 import { registryEntryLayouts, registryInsertionPoint } from './static-registry.js';
 import { toPosixPath } from './paths.js';
 import { byCodeUnit, sortDeep } from './order.js';
@@ -252,9 +253,18 @@ export function spliceModifications(file, source, changes) {
     const edits = [];
     const wanted = new Map(changes.map((change) => [change.id, change]));
     // Ids the file does not hold, first and in code-unit order: they have no
-    // position to be reported at, and the walk below is driven by positions.
+    // position to be reported at, and the walk below is driven by positions. An
+    // entry the reader refused to describe is reported as *why* rather than as
+    // absent — a file that writes one key twice does hold the entry, and
+    // `entry-not-found` would send its reader looking for something that is
+    // there. Both are decided before a single edit is pushed, because a refusal
+    // arriving mid-walk would leave `edits` half-built for an entry whose offsets
+    // are exactly the ones not to be trusted.
     for (const id of [...wanted.keys()].sort(byCodeUnit)) {
-        if (!layouts.has(id))
+        const twice = layouts.repeated.get(id);
+        if (twice)
+            refusals.push({ reqId: id, ...twice, reason: 'duplicate-key' });
+        else if (!layouts.byId.has(id))
             refusals.push({ reqId: id, reason: 'entry-not-found' });
     }
     // **The file front to back, not the delta.** Driving the walk from the layout
@@ -268,7 +278,7 @@ export function spliceModifications(file, source, changes) {
     // It is also why the layout is `Map`s rather than objects at every level; the
     // container is what carries the order, and `registryEntryLayouts` says why an
     // object cannot.
-    for (const [id, layout] of layouts) {
+    for (const [id, layout] of layouts.byId) {
         const change = wanted.get(id);
         if (!change)
             continue;
@@ -461,9 +471,32 @@ function sameValue(a, b) {
  * property of its module resolution, uniform across the project, and already
  * answered by the specifier sitting in front of us — the third spelling
  * included, where the answer is "none".
+ *
+ * **A source that does not compile is returned untouched** — ATX-69, over the
+ * one writer that reaches the compiler directly. `ts.createSourceFile` recovers:
+ * handed a file that does not compile it returns a tree built from what the
+ * parser guessed, and every offset below comes out of that tree and is written
+ * back over the bytes of a `*.spec.ts` the user cannot regenerate. The two other
+ * writers in this file ask the same question through the reader that hands them
+ * their offsets; this one has to ask it itself.
+ *
+ * It is unreachable through the command today — the gate refuses a spec it
+ * could not parse before a merge starts (`pipeline.ts`) — and that is exactly
+ * why it is checked here: a defence that holds only because something upstream
+ * holds is not a defence, which is the standard `keySource` above is written to.
+ *
+ * The refusal is the source unchanged rather than a throw or an issue, because
+ * there is no failure channel to use and this function's whole discipline is
+ * that it touches one string literal or nothing. `applyMerge` writes only when
+ * the text moved, so an unparseable spec is renamed with the import it already
+ * had — which is the state a re-run finds and reports, rather than a file
+ * rewritten at offsets nobody can trust.
  */
 export function repointImport(file, source, from, to) {
-    const sf = ts.createSourceFile(file, source, ts.ScriptTarget.Latest, /* setParentNodes */ true);
+    const parsed = parseSource(file, source);
+    if ('error' in parsed)
+        return source;
+    const sf = parsed.sf;
     const dir = dirname(file);
     const edits = [];
     for (const statement of sf.statements) {

package/dist/core/static-registry.d.ts

@@ -135,6 +135,31 @@ export interface RegistryEntryLayout {
     /** Where a new field goes, inside the entry's own body. */
     fieldInsertion: RegistryInsertion;
 }
+/**
+ * The key an entry wrote twice, as the path the author would say it —
+ * `statement`, `params.limit`.
+ *
+ * Absent when what repeats is the entry's **own id**, which no field path
+ * names: `params.limit` is a place inside a requirement, and a second entry
+ * under one id is not inside anything.
+ */
+export interface RepeatedKey {
+    field?: string;
+}
+/** Every entry's layout, and the entries this reader refuses to describe. */
+export interface RegistryLayouts {
+    /**
+     * Value spans per requirement id, in the order the file writes them.
+     *
+     * Named `byId` rather than `entries` so nothing reads `layouts.entries` as
+     * the `Map` method of that name — the order this carries is the contract,
+     * and a reader who thinks they are calling `Map.prototype.entries` is a
+     * reader who has stopped seeing it.
+     */
+    byId: Map<string, RegistryEntryLayout>;
+    /** Ids left out of {@link RegistryLayouts.byId} because a key repeats. */
+    repeated: Map<string, RepeatedKey>;
+}
 /**
  * The layout of every entry in a registry file, by requirement id.
  *
@@ -154,6 +179,26 @@ export interface RegistryEntryLayout {
  * schema's `z.record(z.string(), …)` accepts the result. A `Map` keeps insertion
  * order for every key type, so the property holds by construction rather than by
  * the keys happening not to be numbers.
+ *
+ * **A key written twice defeats that pairing, which is why it is refused rather
+ * than described.** `Map.set` on a key it already holds keeps the *first*
+ * insertion's position and takes the *last* call's value — so an entry writing
+ * `params: { limit: 1, other: 'x', limit: 1 }` yields `limit` at position one
+ * carrying the span of the occurrence that sits after `other`, and the walk's
+ * offsets stop ascending — so an earlier edit moves the bytes under a later one
+ * and the replacement lands outside the value it was addressing.
+ *
+ * Nothing upstream refuses such a file, which is why the guard is here: a
+ * duplicate key is a TypeScript *semantic* error and `parseSource` asks only
+ * the syntactic question, so both readers take the file and hand back the last
+ * occurrence, and `--apply` is the one command that writes.
+ *
+ * Refused at every level for one reason, and the id level is not the mild one:
+ * two entries under a single id put a *later* entry's spans at an *earlier*
+ * entry's position, so the disorder is between entries rather than inside one.
+ * Nothing narrower is worth the reach — an entry whose keys are ambiguous is
+ * one no verdict describes, and the file is a defect to fix rather than one to
+ * edit around.
  */
-export declare function registryEntryLayouts(file: string, source: string): Map<string, RegistryEntryLayout> | undefined;
+export declare function registryEntryLayouts(file: string, source: string): RegistryLayouts | undefined;
 //# sourceMappingURL=static-registry.d.ts.map

package/dist/core/static-registry.js

@@ -217,7 +217,7 @@ export function readDeltaSource(file, source) {
  */
 export function declaredIdsFromSource(file, source) {
     const sf = ts.createSourceFile(file, source, ts.ScriptTarget.Latest, /* setParentNodes */ true);
-    const names = localNames(sf, DEFINE);
+    const names = authoringNames(sf, DEFINE);
     const ids = new Set();
     // Any `defineRequirements({ … })` in the file, not only the exported one: the
     // failure being diagnosed is often that the call is not where it should be —
@@ -295,43 +295,119 @@ function constInitializer(sf, name) {
  * The callee is matched against the local name the import bound — an alias or a
  * namespace import is the same call — rather than against any single-argument
  * call, so `buildRegistry({…})` is not mistaken for a registry.
+ *
+ * **Unwrapped here, once, rather than by each caller.** `as const`, `satisfies`
+ * and a bare pair of parentheses do not change the value, so `literalValue`
+ * strips them before it reads — while the write side asks
+ * `ts.isObjectLiteralExpression` of whatever this hands back. A wrapper returned
+ * from here is therefore a registry the readers accept and the writers cannot
+ * locate, on the one command that edits a `*.reqs.ts`. Both sides come through
+ * this function precisely so they cannot disagree about which literal is the
+ * registry; leaving the unwrap to each caller is what puts the disagreement
+ * inside it.
  */
 function authoringCall(expr, sf, fn) {
     if (!ts.isCallExpression(expr) || expr.arguments.length !== 1)
         return undefined;
-    return callsAuthoringFn(expr, localNames(sf, fn), fn) ? expr.arguments[0] : undefined;
+    if (!callsAuthoringFn(expr, authoringNames(sf, fn), fn))
+        return undefined;
+    return unwrap(expr.arguments[0]);
 }
 /**
- * Whether a call is a call of `fn`, by the local names the imports bound to it.
+ * Whether a call is a call of `fn`, by what the file binds the callee to.
  *
  * One predicate for both readers of this question — the extraction above and the
  * id recovery below — because they must not be able to disagree about what
  * counts as the authoring call. An alias rule taught to one and not the other
  * would make recovery silently miss exactly the files the reader refuses.
+ *
+ * **A name this file binds to something other than an import is not `fn`.**
+ * Matching by spelling alone lets a file hand the two readers different
+ * registries while contradicting itself in plain sight — `const
+ * defineRequirements = (r) => ({ ...r, 'ADMIN-1': … })` in front of the export
+ * leaves this reader with the literal argument and the evaluator with whatever
+ * that function returns. A wrong answer rather than a refusal, of the shape the
+ * `let` guard above is kept for, on the commands a reviewer runs *because* they
+ * execute nothing (design §5.2, ATX-16).
+ *
+ * So the rule is about the binding: an import binding is trusted, a name this
+ * file never binds is trusted (it comes from a global or a harness, which is
+ * what the bare name is for), and a `const`/`let`/`var`/`function`/`class` in
+ * this file is not — whether the callee is that name or a property reached
+ * through it. Refusing is all that is needed: the file becomes
+ * `registry-not-static` with `--eval` named as the way back, which is ATX-17
+ * unchanged.
+ *
+ * **What this still cannot see is the module graph**, and it is not written to:
+ * `import { defineRequirements } from './wrapper.js'` binds the name by an
+ * import, so it is accepted, and what that module exports is not a question the
+ * source text of *this* file answers. Resolving it would mean reading — and
+ * then trusting — another file, which is the evaluator's job and the reason
+ * `--eval` exists. The line drawn here is what the file contradicts about itself.
  */
 function callsAuthoringFn(call, names, fn) {
     const callee = call.expression;
-    return ((ts.isIdentifier(callee) && names.has(callee.text)) ||
-        (ts.isPropertyAccessExpression(callee) && callee.name.text === fn));
+    if (ts.isIdentifier(callee))
+        return names.called.has(callee.text);
+    if (!ts.isPropertyAccessExpression(callee) || callee.name.text !== fn)
+        return false;
+    // `attest.defineRequirements(…)`. The object is held to the same rule as the
+    // bare name, which is what keeps the two forms from having two answers: a
+    // namespace import is trusted, a name this file never binds is trusted, and
+    // anything this file built is not. A deeper access — `a.b.defineRequirements`
+    // — is not an identifier and so is not one of those, which no namespace
+    // import can produce anyway.
+    const object = callee.expression;
+    return ts.isIdentifier(object) && !names.declared.has(object.text);
 }
-/** Local names bound to the imported `fn`, including aliases. */
-function localNames(sf, fn) {
-    const names = new Set();
+/** How the file binds the names a callee could be written with. */
+function authoringNames(sf, fn) {
+    const called = new Set();
+    const declared = new Set();
     for (const statement of sf.statements) {
-        if (!ts.isImportDeclaration(statement))
-            continue;
-        const bindings = statement.importClause?.namedBindings;
-        if (!bindings || !ts.isNamedImports(bindings))
+        if (ts.isImportDeclaration(statement)) {
+            const bindings = statement.importClause?.namedBindings;
+            if (bindings && ts.isNamedImports(bindings)) {
+                for (const el of bindings.elements) {
+                    if ((el.propertyName ?? el.name).text === fn)
+                        called.add(el.name.text);
+                }
+            }
             continue;
-        for (const el of bindings.elements) {
-            if ((el.propertyName ?? el.name).text === fn)
-                names.add(el.name.text);
         }
+        for (const name of declaredNames(statement))
+            declared.add(name);
     }
     // A file that never imported it can still be read: the import may come from a
     // global or a test harness, and the callee name is the only signal we need.
-    names.add(fn);
-    return names;
+    // Withdrawn exactly when the file itself says the name is something else.
+    if (!declared.has(fn))
+        called.add(fn);
+    return { called, declared };
+}
+/** The module-scope names one statement binds, if it is not an import. */
+function* declaredNames(statement) {
+    if (ts.isVariableStatement(statement)) {
+        for (const decl of statement.declarationList.declarations)
+            yield* bindingNames(decl.name);
+        return;
+    }
+    if ((ts.isFunctionDeclaration(statement) || ts.isClassDeclaration(statement)) && statement.name) {
+        yield statement.name.text;
+    }
+}
+/** Every name a binding introduces, destructuring included. */
+function* bindingNames(name) {
+    if (ts.isIdentifier(name)) {
+        yield name.text;
+        return;
+    }
+    // `const { defineRequirements } = evil;` binds the name as surely as an
+    // assignment does, and reads less like a shadow rather than more.
+    for (const element of name.elements) {
+        if (ts.isBindingElement(element))
+            yield* bindingNames(element.name);
+    }
 }
 /** Strip the type-level wrappers that do not change the value (`as const`, `satisfies`, parens). */
 function unwrap(node) {
@@ -520,31 +596,66 @@ function objectInsertion(sf, source, obj) {
  * schema's `z.record(z.string(), …)` accepts the result. A `Map` keeps insertion
  * order for every key type, so the property holds by construction rather than by
  * the keys happening not to be numbers.
+ *
+ * **A key written twice defeats that pairing, which is why it is refused rather
+ * than described.** `Map.set` on a key it already holds keeps the *first*
+ * insertion's position and takes the *last* call's value — so an entry writing
+ * `params: { limit: 1, other: 'x', limit: 1 }` yields `limit` at position one
+ * carrying the span of the occurrence that sits after `other`, and the walk's
+ * offsets stop ascending — so an earlier edit moves the bytes under a later one
+ * and the replacement lands outside the value it was addressing.
+ *
+ * Nothing upstream refuses such a file, which is why the guard is here: a
+ * duplicate key is a TypeScript *semantic* error and `parseSource` asks only
+ * the syntactic question, so both readers take the file and hand back the last
+ * occurrence, and `--apply` is the one command that writes.
+ *
+ * Refused at every level for one reason, and the id level is not the mild one:
+ * two entries under a single id put a *later* entry's spans at an *earlier*
+ * entry's position, so the disorder is between entries rather than inside one.
+ * Nothing narrower is worth the reach — an entry whose keys are ambiguous is
+ * one no verdict describes, and the file is a defect to fix rather than one to
+ * edit around.
  */
 export function registryEntryLayouts(file, source) {
     const found = registryLiteral(file, source);
     if (!found)
         return undefined;
     const { sf, literal } = found;
-    const layouts = new Map();
+    const byId = new Map();
+    const repeated = new Map();
     for (const entry of literal.properties) {
         if (!ts.isPropertyAssignment(entry))
             continue;
         const id = staticName(entry.name);
         if (id === undefined || id === '__proto__')
             continue;
+        if (byId.has(id) || repeated.has(id)) {
+            // Deleted, not left as the first occurrence: both readers take the *last*
+            // one, so describing the first would hand the writer a span whose value
+            // nothing evaluates.
+            byId.delete(id);
+            repeated.set(id, {});
+            continue;
+        }
         const body = unwrap(entry.initializer);
         if (!ts.isObjectLiteralExpression(body))
             continue;
         const fields = new Map();
         const paramKeys = new Map();
         let params;
+        /** The first repeated key seen, as the path the refusal names. */
+        let twice;
         for (const field of body.properties) {
             if (!ts.isPropertyAssignment(field))
                 continue;
             const name = staticName(field.name);
             if (name === undefined || name === '__proto__')
                 continue;
+            if (fields.has(name)) {
+                twice ??= name;
+                continue;
+            }
             // The unwrapped value, so an `as const` or a parenthesis stays outside the
             // span and survives the replacement it wraps.
             const value = unwrap(field.initializer);
@@ -559,18 +670,26 @@ export function registryEntryLayouts(file, source) {
                 const key = staticName(param.name);
                 if (key === undefined || key === '__proto__')
                     continue;
+                if (paramKeys.has(key)) {
+                    twice ??= `params.${key}`;
+                    continue;
+                }
                 const value = unwrap(param.initializer);
                 paramKeys.set(key, { start: value.getStart(sf), end: value.getEnd() });
             }
         }
-        layouts.set(id, {
+        if (twice !== undefined) {
+            repeated.set(id, { field: twice });
+            continue;
+        }
+        byId.set(id, {
             fields,
             paramKeys,
             ...(params ? { paramsInsertion: objectInsertion(sf, source, params) } : {}),
             fieldInsertion: objectInsertion(sf, source, body),
         });
     }
-    return layouts;
+    return { byId, repeated };
 }
 /**
  * The `defineRequirements({ … })` literal of a registry file, with the source

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@am_shork/attest",
-  "version": "0.9.4",
+  "version": "0.11.0",
   "description": "TDD-native spec framework: tests are the source of truth for verification, ID-bound requirements the source of truth for intent.",
   "type": "module",
   "packageManager": "pnpm@10.28.0",
@@ -56,6 +56,7 @@
     "attest": "node bin/attest.js",
     "check:self": "node bin/attest.js check self",
     "verify:self": "node bin/attest.js verify self",
+    "debug:self": "vitest run --config vitest.self.config.ts",
     "cover:self": "node bin/attest.js cover self",
     "render:self": "node bin/attest.js render self --out self/requirements/SPEC.md",
     "render:self:check": "node bin/attest.js render self --out self/requirements/SPEC.md --check"