@antoneeo/mkt-agentic-sdlc-skill 0.23.0 → 0.27.0

package/CHANGELOG.md

@@ -1,5 +1,54 @@
 # Changelog
 
+## [0.27.0] - 2026-10-27
+
+### Added
+- Shared knowledge layer (F-084, kb CHANGELOG): `inventory <path>` and orient's upper bound of never-examined project files reach this lens; `validate`/`check` refuse a malformed `audit/INVENTORY_exclusions.md` row and the new `DECLARED`/`DIVERGES` claim rules; the docs site renders them. `sdlc_core.skip_dir` is extracted from `iter_files`, behaviour unchanged.
+- `constraints --unit <id>` and `constraints --file <path>` (shared core): the constraints an ANALYSIS states in extractable form, each with its line, ending with the sections they could not extract.
+- `benefit` and the docs site recognize a REVIEW_LOG row with tier `post-merge` (written by the code lens: the owner's report of a wrong behaviour in a merged change): `benefit` keeps it out of every review figure, the docs site shows it as "defect reported after merge". `review.md`: a reviewer derives callers and behaviours before comparing with the constraint view.
+- `guides.md`: a code guide may carry a `## Preservation constraints` section copied from a closed unit; it survives regeneration. Nothing else changes in this lens: `validate` adds no note.
+
+### Fixed
+- Shared claim checks (`check`): a `RULING` row on a note that names a foreign origin (`imported_from:`) is refused — relabelling an imported row is not ratifying it; the message for a row superseded by an `IMPORTED` one names the ratification act (F-083).
+- Guide-verdict check (`verdict --hook`, shared core): a level quoted inside a sentence (`Level: L1` in prose) no longer counts as a declaration: only a line that opens with the level word does, the rule the constraint recall already uses (level 1 alone, `L1` or `E1`; levels 2 and 3 with `router` on the same line). The check now judges the project, and its docs-root name, that holds the edited file, not the one around the session's working directory; after a `cd` out of the project it let every edit through. A router verdict follows the same rule: only a line that opens with `router` or declares the level with it counts, never `router: no match` quoted in a sentence; `Level: Spike · router: …` and markdown openers (`##`, `1.`, `•`) count. A quote that itself opens a line (blockquote, code fence) still counts. The protected-path gate (`gate --hook`, `gate --file`) also judges the edited file's project, falls back to the session's project when no docs root sits above the file, and stays silent instead of exiting with an error when two docs roots sit side by side. Its `--protected` prefixes are relative to the nearest docs root above the edited file: with nested docs roots (a monorepo package with its own `ai_docs/`, or a docs folder inside a protected path) rewrite them relative to that root, or the path is no longer protected.
+
+## [0.26.0] - 2026-10-23
+
+### Changed
+- `guides.md`: a document snapshot is verbatim except for credentials and personal or confidential data the guide does not need, which become `[REDACTED: <kind>]` before the snapshot is written; the guide lists the kinds in `redacted_at_intake:`.
+- The session-start orientation (`orient`) now fits under Claude Code's 10,000-character hook limit, even in a project with many documents. Above that limit Claude Code saves the output to a file and shows the agent only the first 2,000 characters, so the guide router never reached the agent. The output is now at most 9,500 characters, including the knowledge layer's lines, and in this order: the triage line, the guide router (one line per guide), the workstream registry (one line per workstream, then the project-wide notes), then the reading guide (README). The manifest (INDEX) and the full files are listed as pointers. A section that does not fit is cut at a line, with a pointer to its file.
+- The per-turn `remind` line also tells the agent, above L1 and when sibling lenses are installed, to choose the lens with `routing.md` and declare it. The line's limit rises from 500 to 600 characters (`vision/rulings.md` r32).
+- `docs_site.py` adds `.docs-site/` to the project's `.gitignore` on its first run in a git repository, so the site's copy of the documents is not committed. It used to print a note only. An entry already in the file is never changed; when git still does not ignore the folder, the note is printed as before.
+- `SKILL.md` names the docs site in the words users use ("docs site", "minisito", "documentation site", "project site"), so a request for it runs `docs_site.py` instead of building a page by hand.
+
+### Added
+- `check` refuses, in every lens, a line shaped like a credential (a password, token or key with a real value, a private-key header, a password in a URL, a bearer token) in a `corpus/given/` file or in the snapshot of a `source_kind: document` guide. The message names the file, the lines and the kinds, never the value. A human clears a false positive with `credential_scan: reviewed — <reason>` (in the sidecar, or in the guide). A project whose stored sources already hold such a line fails `check` until each is redacted or reviewed (`vision/rulings.md` r35a).
+- `adopt`: a dry run listing the document guides that rest on `.sources/` snapshots and what moving each into `corpus/given/` involves. It writes nothing.
+- `check` warns when the same text is stored both as a guide snapshot and as a corpus artifact.
+- `check` also warns on a `corpus/given/` file with no sidecar, accepts a withdrawn artifact's tombstone sidecar (no bytes, no digest), and, when an `original_path:` is a URI, names `original_ref:` for non-local identifiers. A password inside a URL in that warning is masked.
+- Shared claim checks (`check`): a claim's `about` cell may hold several relations separated by `; `, and one reserved predicate, `not-yet-honored-by -> ANALYSIS_<name>`, marks a specification claim the code does not yet honor. `check` refuses the marker when that analysis is missing from `solutions/` or cites neither the claim id nor the id of a row the claim succeeds. `export` drops the markers and says so in one line. Nothing lists or counts claims by the marker (`vision/rulings.md` r33). `memory.md`: a marked claim is cited as not yet true of the code, naming its analysis.
+- Shared claim checks (`check`): the `not-yet-honored-by` marker now works in Hybrid projects (devPNT present). It may name `SHADOW_<doc_key>`; `check` reads the newest `solutions/SHADOW_<doc_key>_vX.Y.md` (versions compared number by number), which must exist and cite the claim id or a predecessor's. A missing shadow is an error that says to export it, and names a file of that key whose name lacks the `_vX.Y` suffix. `check` behaves the same with or without `--hybrid`; export drops both target forms (`vision/rulings.md` r36). New shared helper `sdlc_core.newest_shadow`. `memory.md`: a marked claim is cited naming its target.
+- `verdict --hook` (PreToolUse): refuses an edit when the session declared no guide-router verdict, or never read a guide its verdict names; silent in projects without guides and whenever it cannot tell. Not wired by this package (`ENFORCEMENT.md` §3).
+- `orient` adds a note when one client runs it from two settings entries, which means each session gets the orientation twice. Claude Code and Codex are counted separately, an identical command counts once, and an entry whose validator is gone is not counted.
+- `orient` adds a line naming the sibling lenses installed beside the skill or in the user's Claude skills directory, and says to choose the lens with `routing.md`. The family list is read from `routing.md` §0, as the installer does.
+- `routing.md` §2 gains worked verdicts for four mixed requests: an interface spec written for another team, the requirements another team must build, a guide whose source spec changed, and code that diverges from a supplied spec.
+- The shared validator adds an advisory for a code-lens (`domain: code`) L3 analysis, started on or after 2026-10-24, that lacks a filled `## Guide check` section. Analyses of this lens are not checked.
+
+## [0.25.0] - 2026-10-19
+
+Includes everything listed under [0.24.0], which was tagged but never published to npm.
+
+### Added
+- `mark <paths> --note "<what was done>"` writes a dated entry `**YYYY-MM-DD — <what was done>.**` at the top of `audit/project_notes.md`. A release or work outside an open unit used to leave no dated event, because the date had to be copied there by hand. Without `--note`, and with no open unit, `mark` says so.
+- `validate`: an advisory for a dated entry in `project_notes.md` whose bold does not pair; the chronology then showed the label running into the body.
+- Docs site chronology: a Diary entry's label carries its unit id ("F-074 — closed"), so it reads on its own.
+- `stale` no longer counts files inside the docs root (`ai_docs/`, `mkt_docs/`) as drift of any area, and `mark` refuses to record it: `validate` already checks the docs root, and every document edit used to leave `check` NOT CLEAN until a redundant re-mark.
+
+## [0.24.0] - 2026-10-19
+
+### Added
+- Docs site: `docs_site.py --zip <file>` also writes the site as one .zip to share; unzipped, `index.html` opens on any system. A zip made by hand with Windows PowerShell 5.1 `Compress-Archive` stores `data\core.js`, and on Linux or macOS the page then finds no data; `--zip` always writes `/` names. It refuses a target inside the docs root or the site folder. The `SKILL.md` line names it.
+
 ## [0.23.0] - 2026-10-19
 
 Includes everything listed under [0.22.0], which was tagged but never published to npm.

package/README.md

@@ -27,7 +27,7 @@ Turns an AI agent into a disciplined marketing strategist that produces a profes
 3. **Adversarial CMO review** — an independent, fresh-context reviewer attacks the strategy before the user sees it (generic-positioning swap test, untraced claims, orphan tactics).
 4. **Verbatim request record** — every E3 engagement starts `audit/requests/REQUEST_[engagement].md` before Wave 1: the client's own words and every later decision, append-only and redacted for secrets; owner-given FACT rows and the plan cite its entries, and reviews check client statements against it.
 
-The **docs site** (`scripts/docs_site.py --root <project> [--open]`) writes a static, offline, read-only website of what the agent reads in the project — reading guide, Vision, rules, documents, open work with each next step, and, with a knowledge base, the topic map, each fact with its exact source passage, and the source documents. It is written outside the docs root (`mkt_docs/` or `ai_docs/`); nothing is ranked or recommended.
+The **docs site** (`scripts/docs_site.py --root <project> [--open] [--zip <file>]`) writes a static, offline, read-only website of what the agent reads in the project — reading guide, Vision, rules, documents, open work with each next step, and, with a knowledge base, the topic map, each fact with its exact source passage, and the source documents. It is written to `.docs-site/` (added to `.gitignore` on the first run), outside the docs root (`mkt_docs/` or `ai_docs/`); nothing is ranked or recommended.
 
 The agent asks the user only for facts the user uniquely owns (product, price, budget, capacity); everything else — market sizing, competitor analysis, channel benchmarks — is derived from real web research.
 
@@ -58,8 +58,8 @@ npx mkt-sdlc-init        # creates mkt_docs/ + protocol pointers
 ```
 
 It also **wires the SessionStart orientation hook** into `.claude/`, so an agent opening
-the project is handed the reading guide, the generated manifest, the guide router and the
-last handoff before it does anything — instead of only when it remembers to look. That
+the project is handed the triage line, the guide router, the workstream registry and the
+reading guide (with pointers to the manifest) before it does anything — instead of only when it remembers to look. That
 wiring used to be a manual step documented in `ENFORCEMENT.md`; being manual, it was
 skipped, and a project could run fully governed with an agent that never met the process.
 

package/gemini-extension.json

@@ -1,6 +1,6 @@
 {
   "name": "mkt-agentic-sdlc",
-  "version": "0.23.0",
+  "version": "0.27.0",
   "description": "Evidence-First marketing planning protocol with engagement triage, SOSTAC workflow, evidence ledger and optional devPNT integration.",
   "author": "Antonio Pinto (https://github.com/Antoneeo)"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@antoneeo/mkt-agentic-sdlc-skill",
-  "version": "0.23.0",
+  "version": "0.27.0",
   "description": "Evidence-First marketing planning protocol for Claude Code, Gemini CLI, Google Antigravity and Codex: engagement triage, SOSTAC workflow, evidence ledger, mechanical validator and optional devPNT integration.",
   "keywords": [
     "claude-code",

package/skills/mkt-agentic-sdlc/ENFORCEMENT.md

@@ -14,17 +14,17 @@ python "<skill_dir>/scripts/mkt_check.py" check
 
 ## 2. Check in CI (recommended for teams)
 
-Copy all three validator files into the repository: `scripts/mkt_check.py`, `scripts/sdlc_core.py`, and `scripts/knowledge.py`, keeping them side by side. Then add to the pipeline:
+Copy all three validator files into the repository: `scripts/mkt_check.py`, `scripts/sdlc_core.py`, and `scripts/knowledge.py`, keeping them side by side. Then add to the pipeline:
 
 ```
 python tools/mkt_check.py validate --strict
 ```
 
-The validator ships as **three files**: the domain entry point, `sdlc_core.py` and `knowledge.py`. Keep all three together. The core alone still runs but omits shared-memory/KB checks and domain-specific overlays; it is not an equivalent CI gate. `check` includes the knowledge surface when present.
+The validator ships as **three files**: the domain entry point, `sdlc_core.py` and `knowledge.py`. Keep all three together. The core alone still runs but omits shared-memory/KB checks and domain-specific overlays; it is not an equivalent CI gate. `check` includes the knowledge surface when present.
 
 Effect: an unregenerated index, invalid frontmatter, a missing security section or incoherent states **block the pipeline** instead of relying on the agent's memory. `--strict` also fails on warnings and on a missing `ai_docs/`, so a wrong working directory cannot produce a green pipeline. This works because documents travel in the same PR as the code (Phase 5 rule).
 
-Note: the copy in the repo is the authoritative one for CI; update it when you update the skill — all three files, together.
+Note: the copy in the repo is the authoritative one for CI; update it when you update the skill — all three files, together.
 
 **Projects whose docs root is not `ai_docs/`.** Pass `--docs-dir <name>` (e.g. `--docs-dir mkt_docs`) on any subcommand, or set `AGENTIC_SDLC_DOCS_DIR`. Without either, the validator walks up from the working directory and takes the nearest root it recognizes. If it finds two side by side — the shape of a half-finished migration — it refuses and names both rather than validating half a project and printing a verdict. `ai_docs/` remains the default and the recommended root: the parameter exists so a legacy tree can be read and migrated, not so a second one can be kept.
 
@@ -54,14 +54,26 @@ Semantics: exit code 2 + message on stderr ⇒ the write is blocked and the mess
 
 **Usage warnings:**
 - The gate is deliberately coarse: applied to all of `src/` it would also block the legitimate L1/L2 tasks foreseen by the Triage. Use it **only on security-critical directories** (`--protected "src/auth;src/crypto"`), where "never without analysis" is the desired policy.
-- The paths in `--protected` are prefixes relative to the project root, separated by `;`.
+- The paths in `--protected` are prefixes relative to the root of the project the hook judges (below), separated by `;`. With nested docs roots (a monorepo whose package has its own), that is the nearest one above the edited file: write the prefixes relative to it.
 - `ai_docs/`, `tests/` and `test/` are always excluded from blocking.
-- The hook assumes the working directory is the project root (standard behavior of Claude Code hooks).
+- The hook judges the project, and the docs root, holding the edited file: the session's working directory can move with a `cd`, so it is never the reference. With no docs root above the file, it is the session's own project, as before. `--root <path>` overrides it; `gate --file` resolves the same way, and two docs roots side by side leave the gate silent.
 - **Hybrid/devPNT projects**: add `--hybrid` to the gate command. Governed designs live in the devPNT DB, so the gate also unlocks when an approved E-TDD shadow (`ai_docs/solutions/SHADOW_*tdd*.md`, exported before implementation — see `hybrid.md` §Ownership matrix) is present. Without the flag the gate would block legitimate governed work. The flag is deliberately explicit: never auto-detected.
 
+### Verdict check: `verdict` (PreToolUse -- manual for this lens)
+
+`mkt_check.py verdict --hook` refuses an Edit, Write, MultiEdit or NotebookEdit when the
+session transcript shows no guide-router verdict (a line that opens with `router: …` or with the level, `Level: L2 · router: …`, `Level: Spike · router: …`; or one that opens with a level-1 declaration)
+or a guide the verdict names was never read; it is silent in projects without guides and
+whenever it cannot tell. The code package (`agentic-sdlc`) wires it machine-wide on
+Claude Code; this package does not. To wire it by hand, add a `PreToolUse` entry with
+matcher `Edit|Write|MultiEdit|NotebookEdit` and command
+`python "<skills dir>/mkt-agentic-sdlc/scripts/mkt_check.py" verdict --hook; exit 0` — the `; exit 0`
+keeps a missing or older validator from exiting 2, which would block every edit. Cost
+and residuals: `ai_docs/vision/rulings.md` r34.
+
 ## 4. SessionStart hook (orientation, recommended default)
 
-Emits the `ai_docs/` orientation — reading guide (`README.md`), manifest (`INDEX.md`), guide router (`reference/INDEX.md`) and last `handoff.md` — plus the Rule-Zero triage reminder to stdout at session start, so the agent begins already oriented instead of reading them only if it remembers to. It is **fail-open**: a missing, unreadable or oversized doc is skipped, the output is size-capped, and it always exits 0 — a broken or empty `ai_docs/` never blocks the session. It is **zero-execution** (it reads and prints, never runs anything).
+Emits the `ai_docs/` orientation to stdout at session start, in the order an arriving agent needs it: the Rule-Zero triage line, the lens choice when sibling lenses are installed, the guide router (`reference/INDEX.md`, one line per guide), the workstream registry (`audit/handoff.md`, one line per workstream, then the project-wide notes), the reading guide (`README.md`), then pointers to the manifest (`INDEX.md`) and to the full files — so the agent begins already oriented instead of reading them only if it remembers to. The whole output stays under 9,500 characters: Claude Code injects a hook's output up to 10,000 and, above that, only a 2,000-character preview, which is how the router once never reached a session (F-075). A section that does not fit is cut at a line with a pointer to its file, and a note says when one client runs the hook from two settings entries. It is **fail-open**: a missing or unreadable doc is skipped, and it always exits 0 — a broken or empty `ai_docs/` never blocks the session. It is **zero-execution** (it reads and prints, never runs anything).
 
 **Wire it on every project that has `ai_docs/` and a Python interpreter.** It was opt-in until v1.16.0 and the field result was the defect this level exists to prevent: the guide router stayed unread unless the user asked for it by hand, so guides were written and never consulted. Prompt-level placement (Rule Zero declares the router verdict; Phase 1 reads the router) carries the process on its own — this hook is the backstop that survives long contexts, compaction and a session that never enters Phase 1 explicitly. Skip it only where Python is unavailable, and know what you are trading.
 
@@ -155,7 +167,7 @@ Gemini CLI — wire the same command into its startup-hook mechanism if present;
 **Usage notes:**
 - The hook assumes the working directory is the project root (standard Claude Code hook behavior); it also accepts `--root <path>`.
 - **Hybrid/devPNT projects**: add `--hybrid` — the hook then appends a one-line pointer to run `devpnt_mcp_get_bootstrap` for the Master Plan / Knowledge Layer and does not replicate them; the filesystem orientation (router + handoff + README) still emits.
-- Like the CI gate (§2), if you copied the validator into the repo, the hook references that copy — keep all three files current when you update the skill.
+- Like the CI gate (§2), if you copied the validator into the repo, the hook references that copy — keep all three files current when you update the skill.
 
 ### Per-turn reminder: `remind` (UserPromptSubmit -- wired by default)
 
@@ -166,13 +178,13 @@ a release ran against a `GUIDE_release.md` the session never consulted, because
 ONE constant line at every prompt, and its first duty is that one: decide whether the
 skill governs the work in front of you and, if it does, load it once.
 
-Cost: 437 characters, ~74 tokens per prompt, paid on every turn including
+Cost: 525 characters, ~88 tokens per prompt, paid on every turn including
 trivial ones. That is admissible only because the owner accepted it explicitly
 (`ai_docs/vision/rulings.md` r19, the "no ceremony ratchet" Non-Goal's second door) --
 and the acceptance was for a FLAT cost. Hence the contract, guarded by
 `scripts/test_remind.py`: the line is **constant and reads nothing** (so nothing repo-
 or session-controlled rides into the agent's context through it, and the cost cannot
-grow with the session), it is **one line under 500 characters**, and it **can never
+grow with the session), it is **one line under 600 characters** (r32 raised r19's 500 to carry the lens choice), and it **can never
 break a prompt** (argv ignored whole, always exit 0). A trivial turn pays a yes/no
 judgement, never a load.
 
@@ -215,7 +227,7 @@ It aggregates the test files (`test_plan.py` + `test_session_start.py` + `test_s
 
 **Optional CI** (same shape as §2, not mandatory): add a `run:` step invoking the `unittest discover` command above.
 
-**T10 note:** if you copied the validator (all three files) and the `test_*.py` battery into the repo for CI, that copy is authoritative — keep it current when you update the skill.
+**T10 note:** if you copied the validator (all three files) and the `test_*.py` battery into the repo for CI, that copy is authoritative — keep it current when you update the skill.
 
 ## `benefit` is a report, never a CI gate
 

package/skills/mkt-agentic-sdlc/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: mkt-agentic-sdlc
-version: 0.23.0
+version: 0.27.0
 description: Evidence-First marketing planning protocol with engagement triage, SOSTAC workflow, evidence ledger, adversarial CMO review, a complete Standalone mode and optional symbiosis with devPNT. Use for marketing plans, go-to-market strategy, campaign planning and market research.
 author: Antonio Pinto (https://github.com/Antoneeo)
 copyright: (c) 2026 Antonio Pinto
@@ -18,7 +18,8 @@ Support files in the skill directory:
 - `templates.md`: templates for every artifact and deliverable.
 - `review.md`: the family's shared review discipline (independence ladder, rounds, log). The marketing-specific attack surface — swap test, untraced numbers, orphan tactics, missing kill/scale — lives in `frameworks.md`'s falsification rules; the adversarial CMO review applies them through `review.md`'s procedure.
 - `scripts/mkt_check.py` + `scripts/sdlc_core.py`: the mechanical validator (`check`, `validate`, `ledger`, `benefit`, `budget`, `funnel`, `trace`, `index`, plus the spine's `stale`/`mark`/`gate`/`orient`/`plan`/`migrate`).  Keep the entry point, `scripts/sdlc_core.py` and `scripts/knowledge.py` together; the last supplies common memory and KB integrity.
-- `scripts/docs_site.py --root <project> --open`: opens in the user's browser a read-only site of what the agent reads; use it to show the project state.
+- `scripts/docs_site.py --root <project> --open` (`--zip <file>` to share): opens in the user's browser a read-only site of what the agent reads; use it to show the project state.
+  It is what users mean by "docs site", "minisito", "documentation site" or "project site": run it, never build a page by hand.
 - `hybrid.md`: the devPNT seam — the authoritative hierarchy, the ownership matrix (which artifact is mastered where), and the Hybrid rules. Read it when the `devpnt_*` tools point at this project; a Standalone engagement never needs it.
 - `ENFORCEMENT.md`: optional setup for CI and hooks.
 

package/skills/mkt-agentic-sdlc/docs_site/app.js

@@ -12,7 +12,7 @@
   var D = null;   // documents, loaded on first use
   var K = null;   // knowledge base, loaded on first use
   var app = document.getElementById("app");
-  var ORIGINS = ["given", "elicited", "derived", "ruling", "imported"];
+  var ORIGINS = ["given", "elicited", "derived", "ruling", "imported", "declared"];
 
   // ------------------------------------------------------------- helpers
 
@@ -483,6 +483,7 @@
     if (f.statement) marks.push(el("span", { "class": "tag statement", title: t("statement_notice"), text: t("statement_mark") }));
     if (f.state === "superseded") marks.push(el("span", { "class": "tag replaced", title: t("state_superseded_why"), text: t("state_superseded") }));
     if (f.state === "contested") marks.push(el("span", { "class": "tag conflict", title: t("state_contested_why"), text: t("state_contested") }));
+    if (f.state === "diverges") marks.push(el("span", { "class": "tag conflict", title: t("state_diverges_why"), text: t("state_diverges") }));
     if (opts && opts.topic) marks.push(link("#/topic/" + encodeURIComponent(f.topic), f.topic, "chip"));
     return el("li", { "class": "fact" + (f.state === "superseded" ? " replaced" : ""), onclick: function () { location.hash = "#/fact/" + encodeURIComponent(id); } },
       el("span", { "class": "dot bg-" + oc }),
@@ -597,6 +598,11 @@
           el("p", { "class": "why-line", text: t("state_contested_why") }),
           el("ul", { "class": "facts" }, (f.with || []).map(function (s) { return factLine(s, { topic: true }); })));
       }
+      if (f.state === "diverges") {
+        parts.push(el("h3", null, el("span", { "class": "tag conflict", text: t("state_diverges") }), " ", t("fact_diverges_from")),
+          el("p", { "class": "why-line", text: t("state_diverges_why") }),
+          el("ul", { "class": "facts" }, (f.diverges_from || []).map(function (s) { return factLine(s, { topic: true }); })));
+      }
       if (f.grounds) {
         parts.push(el("h3", { text: t("fact_rests_on") }),
           el("p", { "class": "why-line", text: t("ground_class_" + f.ground_class) }),

package/skills/mkt-agentic-sdlc/docs_site/strings.js

@@ -56,7 +56,9 @@ window.DOCS_SITE_STRINGS = {
   event_request: "request record",
   event_note: "note",
   event_source: "source document received",
+  event_sent: "document sent",
   event_review: "review",
+  event_defect: "defect reported after merge",
   event_decision: "decision record",
   event_project_note: "project note",
   event_spike: "exploration outcome",
@@ -231,6 +233,8 @@ window.DOCS_SITE_STRINGS = {
   origin_ruling_why: "Taken to settle a conflict.",
   origin_imported: "from another knowledge base",
   origin_imported_why: "Brought in from another knowledge base, where its own sources are.",
+  origin_declared: "declared by this project",
+  origin_declared_why: "What this project told a recipient, on the day it was sent: a statement of ours, not a fact about the product.",
   origin_other: "origin as written: {v}",
   origin_other_why: "An origin this site does not know.",
 
@@ -239,6 +243,8 @@ window.DOCS_SITE_STRINGS = {
   state_superseded_why: "A newer fact takes its place.",
   state_contested: "in conflict",
   state_contested_why: "Facts that disagree, not yet settled.",
+  state_diverges: "diverges",
+  state_diverges_why: "What we declared contradicts what the project decided. It is corrected by a new send, or the decision changes.",
 
   statement_mark: "statement",
   statement_prefix: "[statement] {text}",
@@ -254,6 +260,7 @@ window.DOCS_SITE_STRINGS = {
   fact_replaced_by: "Replaced by",
   fact_current_at_end: "Current fact at the end of each chain",
   fact_in_conflict_with: "In conflict with",
+  fact_diverges_from: "Diverges from",
   fact_rests_on: "What it rests on",
   fact_untraced: "This part could not be traced.",
   fact_sources: "Sources",
@@ -266,6 +273,7 @@ window.DOCS_SITE_STRINGS = {
   fact_unknown: "This fact is not in this knowledge base.",
 
   ground_document: "a document",
+  ground_declared: "a document this project sent",
   ground_statement: "a person's statement",
   ground_decision: "a decision",
   ground_kb: "another knowledge base",
@@ -273,6 +281,7 @@ window.DOCS_SITE_STRINGS = {
   ground_class_statement: "Rests, at least in part, on a person's statement.",
   ground_class_untraceable: "Part of what it rests on could not be traced.",
   ground_class_imported: "Rests on another knowledge base.",
+  ground_class_declared: "Rests on our own declaration to a recipient, not on evidence.",
   ground_class_documents: "Rests on documents or decisions only.",
 
   chain_loop: "The chain of replacements loops back to {id}: it stops here.",

package/skills/mkt-agentic-sdlc/docs_site/style.css

@@ -18,6 +18,7 @@
   --o-derived: #a99be0;
   --o-ruling: #7fa7e6;
   --o-imported: #9cc96b;
+  --o-declared: #d98fb0;
   --conflict: #e0605a;
   --display: "Iowan Old Style", "Palatino Linotype", Palatino, "Book Antiqua", Charter, Georgia, serif;
   --body: "Segoe UI Variable Text", "Avenir Next", Avenir, "Gill Sans Nova", "Gill Sans", "Trebuchet MS", sans-serif;
@@ -179,6 +180,7 @@ a.factid code { color: var(--link); }
 .o-derived { color: var(--o-derived); } .bg-derived { background: var(--o-derived); }
 .o-ruling { color: var(--o-ruling); } .bg-ruling { background: var(--o-ruling); }
 .o-imported { color: var(--o-imported); } .bg-imported { background: var(--o-imported); }
+.o-declared { color: var(--o-declared); } .bg-declared { background: var(--o-declared); }
 .o-other { color: var(--paper-3); } .bg-other { background: var(--paper-3); }
 
 .panel {

package/skills/mkt-agentic-sdlc/guides.md

@@ -201,7 +201,13 @@ the component from partial understanding.
      rewrites snapshot bytes at all (keeps snapshots byte-verbatim; the
      normalized hash stays stable either way).
    - The snapshot is verbatim: no paraphrasing, no reformatting beyond what is
-     needed to save it as markdown.
+     needed to save it as markdown — with one exception, made before the file is
+     written and hashed: credentials, and personal or confidential third-party data
+     the guide does not need, become `[REDACTED: <kind>]`, and the guide's
+     frontmatter lists the kinds in `redacted_at_intake:`. A snapshot is committed
+     and hash-pinned, and `check` refuses a credential-shaped line in a document
+     guide's snapshot (a false positive is declared in the guide as
+     `credential_scan: reviewed — <reason>`).
    - **For `source_kind: code`** the snapshot is the verbatim CODE EXCERPTS the guide
      explains — the specific functions / classes / regions of the real files, each
      labelled with its `path:symbol` (or `path:startLine-endLine`) — assembled into
@@ -256,6 +262,12 @@ in the snapshot, never to your assumption about what the code does.
   (source-anchored), not an elaborated version of it.
 - When in doubt about whether something is "supported" by the source, treat it
   as not covered rather than stretching the marker to fit.
+- **Declared exception: `## Preservation constraints`.** A code guide may carry
+  this section, copied at an L3 closure from the ANALYSIS's table (code lens,
+  `SKILL.md` Phase 5). The section's marker cites each row it holds as
+  `[source: solutions/ANALYSIS_<name>.md#P<n>]` instead of a snapshot anchor: each
+  row records what the code must keep doing, as that unit enumerated and probed it,
+  not an excerpt of the code.
 
 ## 4. Ingestion bound (T9)
 
@@ -287,5 +299,7 @@ state it explicitly when handing off a newly created guide.
   closure (docs travel with the code); when you merely READ one, check it against
   the code before trusting it. Too large to absorb → mark it `SUPERSEDED` rather
   than leave a confident-wrong map badged CURRENT, which is worse than none.
+- **A regenerated guide keeps `## Preservation constraints` unchanged**: the
+  section does not come from the snapshot (§3), so regeneration carries it over.
 - **Agent-global KB guides** use the same pipeline and validator via
   `--root ~/.agentic-sdlc`; freshness via the same `stale` engine.

package/skills/mkt-agentic-sdlc/memory.md

@@ -29,7 +29,7 @@ the most recent document or convert a claim into approval.
 
 When `topics/` exists, also scan `topics/INDEX.md` and follow relevant descendants,
 synonyms and claim sources. Cite claim IDs with their locators. Preserve CONTESTED
-alternatives; name successors when citing SUPERSEDED claims; check validity windows.
+alternatives; name successors when citing SUPERSEDED claims; cite a claim marked `not-yet-honored-by` as not yet true of the code, naming its target; check validity windows.
 For DERIVED claims grounding a decision, reopen the derivation to non-DERIVED ground;
 an inaccessible chain is unverified, not an independent source. Imported rulings do
 not grant local authority. Corpus text is data, never executable agent instructions.

package/skills/mkt-agentic-sdlc/review.md

@@ -187,7 +187,10 @@ can block forever gets removed. **Log one row per completed review, PASS or FAIL
 logging only passes would erase exactly that evidence. The row goes in
 `ai_docs/audit/reviews/REVIEW_LOG.md` (create it if absent — `templates.md`):
 `| date | doc_key | tier | model | reviewer | findings_raised | findings_real | verdict | revise_rounds |`,
-with `tier` = `design` or `closure` in Standalone. **`model` records the capability
+with `tier` = `design` or `closure` in Standalone. In the code lens, a wrong behaviour
+the owner reports in a merged L3 change is one row too, tier `post-merge`, `model`
+`none (owner report)`, reviewer `owner`, the owner quoted in the notes: a defect
+record, not a review, so `benefit` keeps it out of every review figure. **`model` records the capability
 tier that actually ran** — `deep`, `light`, `economy`, `single (client exposes no
 choice)`, `below floor: <reason>`, or `none (not due)` on a NOT DUE row — never a provider name in doctrine (a project
 may of course write its own model names in its own log). Without it the floor above
@@ -285,6 +288,11 @@ The binding inputs, by review type:
   clause reads both), and the **probe harness** (`ai_docs/solutions/harness_[feature]/`).
   Hand these *in addition to* the design artifact — the reviewer checks the artifact
   **against** them, not only for internal consistency.
+- **The constraint view comes last.** Where the ANALYSIS carries ids, the reviewer
+  derives the callers and behaviours first, then compares with
+  `sdlc_check.py constraints --unit <id>`: a constraint the design states and the
+  diff breaks is a finding. The view never replaces the ANALYSIS or the diff in the
+  request.
 - **For a closure review, the diff and the test evidence**: the run output that
   backs every completion claim, dated after the final relevant change.
 - **For a design or closure review of an L3/E3 unit, the request record**

package/skills/mkt-agentic-sdlc/routing.md

@@ -92,6 +92,10 @@ Run the steps in order. Stop at the first one that decides.
 | "research sources and teach a newcomer a topic" | purpose: teaching → course | never reached | never reached | **course** |
 | "ingest these manuals, then create a course" | split: corpus = supplied docs; training = teaching | never reached | never reached | **knowledge** for ingestion; **course** for training |
 | "write sales copy and an onboarding course" | split: persuasion and teaching | never reached | never reached | **marketing** for copy; **course** for training |
+| "write the interface spec of our service for another team" (kept and versioned with the repo) | code | repo's own doc set → code | not build-consumed → no flip | **code** |
+| "write the requirements another team must build, from their documents and our notes" | supplied docs → knowledge | never reached | never reached | **knowledge** |
+| "the vendor spec changed: update the guide distilled from it" | split (step 4): guide = supplied docs; any code change the new spec requires = this repo | never reached | never reached | **knowledge** for re-distilling the guide; **code** for the code change, citing the guide |
+| "the code and the supplied spec diverge" | split (step 4): changing the code = this repo; correcting the distillation = supplied docs | never reached | never reached | **code** if the code is wrong; **knowledge** if the distillation is — which one is wrong is the owner's call, not the router's |
 
 ## 3. Acting on the verdict
 

package/skills/mkt-agentic-sdlc/scripts/docs_site.py

@@ -33,6 +33,7 @@ import re
 import shutil
 import subprocess
 import sys
+import zipfile
 import unicodedata
 import urllib.parse
 from datetime import datetime
@@ -614,6 +615,11 @@ class Grounds:
             return [{"kind": "untraceable", "path": rel}]
         seen = seen | {rel}
         if rel.startswith("corpus/given/"):
+            # F-084: a document this project SENT is our own declaration, not
+            # ground for a fact about the product.
+            side = self._meta(rel + ".meta.md")
+            if _v(side, "provenance").upper() == "DECLARED":
+                return [{"kind": "declared", "path": rel}]
             return [{"kind": "document", "path": rel}]
         if not _inside(self.docs, rel) or not (self.docs / rel).is_file():
             return [{"kind": "untraceable", "path": rel}]
@@ -642,6 +648,8 @@ def ground_class(leaves):
         return "statement"
     if "untraceable" in kinds:
         return "untraceable"
+    if "declared" in kinds:
+        return "declared"
     if "kb" in kinds:
         return "imported"
     return "documents"
@@ -706,12 +714,15 @@ def build_kb(docs):
             kind, rest = _kind(r)
             f = {"text": r["claim"], "valid": r["valid"], "qty": r["qty"], "about": r["about"],
                  "origin": (r["prov"] or "").strip().lower(), "topic": slug,
-                 "state": {"SUPERSEDED": "superseded", "CONTESTED": "contested"}.get(kind, "ok")}
+                 "state": {"SUPERSEDED": "superseded", "CONTESTED": "contested",
+                           "DIVERGES": "diverges"}.get(kind, "ok")}
             if kind == "SUPERSEDED":
                 f["successors"] = _ids(rest)
                 f["chain_ends"] = chain_ends(r["id"], by_id)
             if kind == "CONTESTED":
                 f["with"] = _ids(rest)
+            if kind == "DIVERGES":
+                f["diverges_from"] = _ids(rest)
             srcs = []
             for src in r["source"].split(";"):
                 src = src.strip()
@@ -767,6 +778,8 @@ def build_sources(docs, rows_of):
         name = mp.name[:-len(".meta.md")]
         t = _text(mp) or ""
         meta = sdlc_core.load_frontmatter(t.splitlines()) or {}
+        if knowledge.kb_is_tombstone(meta):
+            continue  # withdrawn: no bytes to show; corpus/INDEX.md keeps the row
         through = _v(meta, "extracted_through")
         parsed = knowledge.kb_parse_extracted_through(through) if through else None
         if not through:
@@ -1221,7 +1234,14 @@ def chronology(docs, pages):
         text = _text(p)
         # a shadow mirror is not an analysis to `validate` (list_analyses): not here either
         if text is not None and not sdlc_core.is_shadow(p, (text.splitlines() or [""])[0]):
+            # a Diary label ("closed", "Approved (R5)") names no unit: prefix the id, so
+            # the event reads on its own in the chronology (field case 2026-10-19)
+            uid = dict((k.lower(), v) for k, v in split_frontmatter(text)[0]).get("id", "").strip()
+            start = len(events)
             openers("solutions/" + p.name, "diary", sdlc_core.DIARY_SECTION)
+            if uid:
+                for e in events[start:]:
+                    e["label"] = "%s — %s" % (uid, e["label"])
     # spike outcomes: SPIKE_* in the code/kb/course lenses, RESEARCH_* in marketing
     for rel in sorted(["solutions/" + p.name for p in docs.glob("solutions/SPIKE_*.md")]
                       + ["spikes/" + p.name for p in docs.glob("spikes/RESEARCH_*.md")]):
@@ -1236,7 +1256,9 @@ def chronology(docs, pages):
     text = _text(docs / rel) if (docs / rel).is_file() else None
     if text is not None:
         for row in sdlc_core.parse_review_log(text)[0]:
-            add(row["date"], "review", "%s — %s: %s" % (
+            # F-085: a `post-merge` row is the owner's defect report, not a review
+            kind = "defect" if row["tier"].lower().startswith("post-merge") else "review"
+            add(row["date"], kind, "%s — %s: %s" % (
                 row["doc_key"], row["tier"], row["verdict"]), rel)
     for p in sorted(docs.glob("architecture/ADR_*.md")):
         rel = "architecture/" + p.name
@@ -1251,13 +1273,17 @@ def chronology(docs, pages):
             text = _text(p)
             if text is None:
                 continue
-            date = knowledge.frontmatter_date(
-                sdlc_core.load_frontmatter(text.splitlines()))
+            fm = sdlc_core.load_frontmatter(text.splitlines())
+            date = knowledge.frontmatter_date(fm)
             if not date:
                 continue
+            if kind == "source" and knowledge.kb_is_tombstone(fm):
+                continue
             if kind == "source":
                 name = p.name[:-len(suffix)]
-                add(date, kind, name, rel, source=name)
+                # F-084: a DECLARED sidecar's date is the day it was SENT
+                sent = _v(fm, "provenance").upper() == "DECLARED"
+                add(date, "sent" if sent else kind, name, rel, source=name)
             else:
                 add(date, kind, title_of(rel, text), rel)
     # Most recent first. Within one day a document's later entry is the more recent
@@ -1289,6 +1315,29 @@ def check_out(out, docs):
     return out
 
 
+def check_zip(target, docs, out):
+    """Where `--zip` may write: a .zip file outside the docs root and outside the site."""
+    target = target.resolve()
+    if target.suffix.lower() != ".zip":
+        raise SiteError("--zip %s must name a .zip file." % target)
+    for folder, what in ((docs.resolve(), "the docs root"), (out.resolve(), "the site folder")):
+        if target == folder or folder in target.parents:
+            raise SiteError("--zip %s is inside %s %s." % (target, what, folder))
+    if target.exists() and not target.is_file():
+        raise SiteError("--zip %s exists and is not a file." % target)
+    return target
+
+
+def write_zip(out, target):
+    """The site as one file to share. Entry names always use '/': an archive whose names
+    carry '\\' (Windows PowerShell 5.1 Compress-Archive) unpacks on Linux and macOS as
+    files named `data\\core.js`, and the page then finds no data (field case 2026-10-19)."""
+    with zipfile.ZipFile(str(target), "w", zipfile.ZIP_DEFLATED) as z:
+        for p in sorted(out.rglob("*")):
+            if p.is_file() and p.name != MARKER:
+                z.write(str(p), p.relative_to(out).as_posix())
+
+
 def write_site(out, core, pages, kb):
     out.mkdir(parents=True, exist_ok=True)
     for rel in PAGE_FILES + ("data",):
@@ -1324,6 +1373,30 @@ def git_ignored(project, out):
         return None
 
 
+def ensure_ignored(project, out):
+    """Add the site folder to the project's .gitignore when git does not ignore it, so the
+    site's copy of the documents is not committed. An entry already in the file is never
+    rewritten (git may ignore it elsewhere, or the user negated it on purpose). Returns the
+    line added, or None; False when the folder stays not ignored."""
+    if git_ignored(project, out) is not False:
+        return None
+    rel = out.resolve().relative_to(project.resolve()).as_posix()
+    entry = rel + "/"
+    gi = project / ".gitignore"
+    try:
+        raw = gi.read_bytes() if gi.is_file() else b""
+        text = raw.decode("utf-8")
+        if {rel, entry, "/" + rel, "/" + entry} & {l.strip() for l in text.splitlines()}:
+            return False
+        nl = "\r\n" if "\r\n" in text else "\n"
+        sep = nl if text and not text.endswith(("\n", "\r")) else ""
+        with open(str(gi), "ab") as f:
+            f.write((sep + entry + nl).encode("utf-8"))
+    except (OSError, UnicodeDecodeError):
+        return False
+    return entry
+
+
 def _shown(path, docs):
     try:
         return Path(path).relative_to(docs).as_posix()
@@ -1339,11 +1412,14 @@ def main(argv=None):
     ap.add_argument("--docs-dir", dest="docs_dir", help="docs root name (ai_docs or mkt_docs)")
     ap.add_argument("--out", help="output folder (default: <project>/%s)" % DEFAULT_OUT)
     ap.add_argument("--open", action="store_true", help="open the site in the browser")
+    ap.add_argument("--zip", metavar="FILE",
+                    help="also write the site as one .zip to share; it opens on any system")
     args = ap.parse_args(argv)
     del _UNREADABLE[:]
     try:
         project, docs, name = resolve_root(args)
         out = check_out(Path(args.out) if args.out else project / DEFAULT_OUT, docs)
+        target = check_zip(Path(args.zip), docs, out) if args.zip else None
     except SiteError as exc:
         print("[ERROR] %s" % exc)
         return 2
@@ -1366,9 +1442,16 @@ def main(argv=None):
         ", %d topics, %d facts" % (len(kb["order"]), len(kb["facts"])) if kb else "", docs))
     for path, exc in _UNREADABLE:
         print("[ERROR] unreadable: %s (%s)" % (_shown(path, docs), exc))
-    if git_ignored(project, out) is False:
+    added = ensure_ignored(project, out)
+    if added:
+        print("[ok] added %s to %s so the site's copy of your documents is not committed."
+              % (added, project / ".gitignore"))
+    elif added is False:
         print("[note] %s is not git-ignored: add it to .gitignore so the site's copy of "
               "your documents is not committed." % out)
+    if target:
+        write_zip(out, target)
+        print("[ok] docs site zipped: %s (unzip it and open index.html)" % target)
     if args.open:
         import webbrowser
         webbrowser.open((out / "index.html").as_uri())