@azure-id/orc 1.9.0 → 1.9.2

package/templates/skills/orc-analyze/schemas/report-audit.md

@@ -1,83 +1,83 @@
-# Template — Analyst Report (AUDIT mode)
-
-Human-readable source of truth. You review and confirm this; the machine spec
-is derived from it. Written to analyst_report/{analysis-name}/report.md.
-
-```markdown
-# Analysis Report — {analysis-name}
-mode: audit
-depth: standard | deep
-source_doc: <path or "pasted">
-scope: <X — the requested scope only>
-analyzed_at: DDMMYY HH:MM:SS
-model: opus-5-high        # the RESOLVED model of the agent that produced this
-                          #   (mini writes sonnet-5-high) — never copied from here
-grounding: repo-read | repo-read+scouts   # scouts only in deep mode
-
-## In-scope rows (X only)
-
-Each row = one audit line that belongs to scope X, reconciled against code. Every
-"Code reality" cell carries quote-anchored file:line evidence
-(`file:line — "verbatim snippet"`, never paraphrased; a ref with no quote
-auto-downgrades to UNVERIFIED), OR the row is tagged ASSUMPTION/UNVERIFIED (and
-appears below as an open question). A row whose code reality is a claim of
-ABSENCE ("no retry exists") instead carries `searched:` — the concrete
-globs/greps run. In deep mode EVERY row is verified, not just the load-bearing
-ones.
-
-| # | Claim (result + notes) | Code reality | Evidence (file:line + quote / searched:) | Files/modules | Status | Resolution |
-|---|------------------------|--------------|------------------------------------------|---------------|--------|------------|
-| 1 | PASS — "UUID validated" | present | auth/uuid.x:8 — "validateUuid(id)" | auth/uuid.x | verified | — |
-| 2 | PASS — notes: "consider adding retry" | no retry | searched: `retry`, `backoff` in svc/ — no hits | svc/x | diverged | user: retry OUT of scope |
-| 3 | FAIL — "missing UUID check" | field renamed to ref_id | models/user.x:20 — "ref_id:" | models/x | diverged | user: update premise; check ref_id |
-
-Status: verified | diverged | resolved
-- verified: claim matches code (with evidence), nothing to challenge.
-- diverged: claim vs code mismatch → was challenged.
-- resolved: a diverged row the user decided on (Resolution column holds the call).
-
-## Assumptions & Open Questions
-- UNVERIFIED (resolved): row 7 cited a "legacy flag" not found in code — user
-  confirmed it was removed; row dropped.
-
-## Additional context (do not build)
-Anchored, non-actionable context pulled from an ADJACENT scope because an in-scope
-row depends on it. Read for understanding; never a task. Each item names the
-in-scope row it serves + why. Omit this whole section if none survived.
-| Anchor (in-scope #) | From scope | Dependency | Touchpoint to respect | Evidence (file:line) |
-|---------------------|-----------|------------|-----------------------|----------------------|
-| Row 3 (ref_id check) | models (Y) | consumes-output | ref_id is set by the user loader before validation | models/user.x:20 |
-
-## Alternatives & risks   (DEEP mode only — omit in standard)
-- Row 3 fix: add ref_id check in the model (recommended) vs at the API edge —
-  edge version duplicates validation across 3 handlers.
-
-## Challenges raised & answers
-- Row 2: notes suggested retry — user confirmed OUT of scope X.
-- Row 3: audit says missing UUID check, code renamed field to ref_id — user
-  confirmed implement the check against ref_id.
-
-## Row numbering — `R#` is the SPEC's namespace, never the report's
-Refer to report rows as **"row N"** only. Labelling a report row `R1` collides
-with the spec's own `R#` ids, and the derivation lint compares the two id sets:
-report-`R1` (a build item) vs spec-`R1` (audit row 1) either false-passes or
-false-bounces. A row that legitimately duplicates another's `files[]` (e.g. a
-doc's closing `Recommendation:` line) carries `yields_build_work: false` in the
-spec rather than a prose qualifier.
-
-## Excluded scopes (recognized, not detailed)
-- Recognized Y, Z in the source doc; excluded from this report per scope = X.
-
-## Handoff readiness (checklist — all five or handoff_ready is false)
-The first three are checkable IN this report. The last two can only become true
-AFTER this report is confirmed and frozen, so on a correct run they stay
-unticked here and are satisfied in the spec — a reader of report.md alone must
-not read that as a failed checklist.
-- [ ] all BLOCKING challenges resolved (every diverged row decided)
-- [ ] zero open UNVERIFIED on any in-scope row
-- [ ] every row has status + evidence-or-resolution
-- [ ] spec derived AFTER the user confirmed this report  (satisfied
-      post-confirmation — see the spec)
-- [ ] scope_closed: true written into the spec  (satisfied post-confirmation —
-      see the spec)
-```
+# Template — Analyst Report (AUDIT mode)
+
+Human-readable source of truth. You review and confirm this; the machine spec
+is derived from it. Written to analyst_report/{analysis-name}/report.md.
+
+```markdown
+# Analysis Report — {analysis-name}
+mode: audit
+depth: standard | deep
+source_doc: <path or "pasted">
+scope: <X — the requested scope only>
+analyzed_at: DDMMYY HH:MM:SS
+model: opus-5-5-high      # the RESOLVED model of the agent that produced this
+                          #   (mini writes sonnet-5-high) — never copied from here
+grounding: repo-read | repo-read+scouts   # scouts only in deep mode
+
+## In-scope rows (X only)
+
+Each row = one audit line that belongs to scope X, reconciled against code. Every
+"Code reality" cell carries quote-anchored file:line evidence
+(`file:line — "verbatim snippet"`, never paraphrased; a ref with no quote
+auto-downgrades to UNVERIFIED), OR the row is tagged ASSUMPTION/UNVERIFIED (and
+appears below as an open question). A row whose code reality is a claim of
+ABSENCE ("no retry exists") instead carries `searched:` — the concrete
+globs/greps run. In deep mode EVERY row is verified, not just the load-bearing
+ones.
+
+| # | Claim (result + notes) | Code reality | Evidence (file:line + quote / searched:) | Files/modules | Status | Resolution |
+|---|------------------------|--------------|------------------------------------------|---------------|--------|------------|
+| 1 | PASS — "UUID validated" | present | auth/uuid.x:8 — "validateUuid(id)" | auth/uuid.x | verified | — |
+| 2 | PASS — notes: "consider adding retry" | no retry | searched: `retry`, `backoff` in svc/ — no hits | svc/x | diverged | user: retry OUT of scope |
+| 3 | FAIL — "missing UUID check" | field renamed to ref_id | models/user.x:20 — "ref_id:" | models/x | diverged | user: update premise; check ref_id |
+
+Status: verified | diverged | resolved
+- verified: claim matches code (with evidence), nothing to challenge.
+- diverged: claim vs code mismatch → was challenged.
+- resolved: a diverged row the user decided on (Resolution column holds the call).
+
+## Assumptions & Open Questions
+- UNVERIFIED (resolved): row 7 cited a "legacy flag" not found in code — user
+  confirmed it was removed; row dropped.
+
+## Additional context (do not build)
+Anchored, non-actionable context pulled from an ADJACENT scope because an in-scope
+row depends on it. Read for understanding; never a task. Each item names the
+in-scope row it serves + why. Omit this whole section if none survived.
+| Anchor (in-scope #) | From scope | Dependency | Touchpoint to respect | Evidence (file:line) |
+|---------------------|-----------|------------|-----------------------|----------------------|
+| Row 3 (ref_id check) | models (Y) | consumes-output | ref_id is set by the user loader before validation | models/user.x:20 |
+
+## Alternatives & risks   (DEEP mode only — omit in standard)
+- Row 3 fix: add ref_id check in the model (recommended) vs at the API edge —
+  edge version duplicates validation across 3 handlers.
+
+## Challenges raised & answers
+- Row 2: notes suggested retry — user confirmed OUT of scope X.
+- Row 3: audit says missing UUID check, code renamed field to ref_id — user
+  confirmed implement the check against ref_id.
+
+## Row numbering — `R#` is the SPEC's namespace, never the report's
+Refer to report rows as **"row N"** only. Labelling a report row `R1` collides
+with the spec's own `R#` ids, and the derivation lint compares the two id sets:
+report-`R1` (a build item) vs spec-`R1` (audit row 1) either false-passes or
+false-bounces. A row that legitimately duplicates another's `files[]` (e.g. a
+doc's closing `Recommendation:` line) carries `yields_build_work: false` in the
+spec rather than a prose qualifier.
+
+## Excluded scopes (recognized, not detailed)
+- Recognized Y, Z in the source doc; excluded from this report per scope = X.
+
+## Handoff readiness (checklist — all five or handoff_ready is false)
+The first three are checkable IN this report. The last two can only become true
+AFTER this report is confirmed and frozen, so on a correct run they stay
+unticked here and are satisfied in the spec — a reader of report.md alone must
+not read that as a failed checklist.
+- [ ] all BLOCKING challenges resolved (every diverged row decided)
+- [ ] zero open UNVERIFIED on any in-scope row
+- [ ] every row has status + evidence-or-resolution
+- [ ] spec derived AFTER the user confirmed this report  (satisfied
+      post-confirmation — see the spec)
+- [ ] scope_closed: true written into the spec  (satisfied post-confirmation —
+      see the spec)
+```

package/templates/skills/orc-analyze/schemas/report-prose.md

@@ -1,63 +1,63 @@
-# Template — Analyst Report (PROSE mode)
-
-Human-readable source of truth. Written to analyst_report/{analysis-name}/report.md.
-
-```markdown
-# Analysis Report — {analysis-name}
-mode: prose
-depth: standard | deep
-source_doc: <path or "pasted">
-scope: <X — the requested scope only>
-analyzed_at: DDMMYY HH:MM:SS
-model: opus-5-high        # the RESOLVED model of the agent that produced this
-                          #   (mini writes sonnet-5-high) — never copied from here
-grounding: repo-read | repo-read+scouts   # scouts only in deep mode
-
-## In-scope requirements (X only)
-
-Every "Code reality" cell carries quote-anchored file:line evidence
-(`file:line — "verbatim snippet"`, never paraphrased; a ref with no quote
-auto-downgrades to UNVERIFIED), OR the row is tagged ASSUMPTION/UNVERIFIED (and
-appears below as an open question). Absence claims (status missing) instead
-carry `searched:` — the concrete globs/greps run.
-
-| # | Requirement (from doc) | Code reality | Evidence (file:line + quote / searched:) | Files/modules | Status | Resolution |
-|---|------------------------|--------------|------------------------------------------|---------------|--------|------------|
-| 1 | "notifications must paginate" | list is unbounded | searched: `paginate`, `cursor`, `limit` in api/notifications — no hits | api/notifications/x | missing | implement pagination |
-| 2 | "respect existing auth" | auth middleware present | auth/mw.x:10 — "app.use(requireAuth)" | auth/mw.x | exists | reuse, no change |
-
-Status: exists | missing | conflict | resolved
-
-## Assumptions & Open Questions
-Anything not grounded to code, plus every ambiguity — each was raised as a
-recommended-option challenge and resolved (or is still open).
-- ASSUMPTION (resolved): "paginate" = cursor-based (recommended) — user confirmed.
-- UNVERIFIED (open): whether a rate-limit already exists — evidence not found.
-
-## Additional context (do not build)
-Anchored, non-actionable context pulled from an ADJACENT scope because an in-scope
-requirement depends on it. Read for understanding; never a task. Each item names
-the in-scope requirement it serves + why. Omit this whole section if none survived.
-| Anchor (in-scope #) | From scope | Dependency | Touchpoint to respect | Evidence (file:line) |
-|---------------------|-----------|------------|-----------------------|----------------------|
-| Req 1 (pagination) | listing (Y) | guards-invariant | shared list serializer caps a page at 100 | api/serializers/list.x:31 |
-
-## Alternatives & risks   (DEEP mode only — omit in standard)
-- Approach A (recommended): reuse existing cursor helper — low blast radius, 3 files.
-- Approach B: new offset paginator — simpler read, breaks existing cursor clients.
-- Risk: pagination touches the shared list serializer (dependents: 4 call sites).
-
-## Challenges raised & answers
-- Req 3 appeared to require an admin panel (belongs to scope Z) — user confirmed
-  OUT of scope X.
-
-## Excluded scopes (recognized, not detailed)
-- Recognized Y, Z; excluded per scope = X.
-
-## Handoff readiness (checklist — all five or handoff_ready is false)
-- [ ] all BLOCKING challenges resolved
-- [ ] zero open UNVERIFIED on any in-scope requirement
-- [ ] every requirement has status + evidence-or-resolution
-- [ ] spec derived AFTER the user confirmed this report
-- [ ] scope_closed: true written into the spec
-```
+# Template — Analyst Report (PROSE mode)
+
+Human-readable source of truth. Written to analyst_report/{analysis-name}/report.md.
+
+```markdown
+# Analysis Report — {analysis-name}
+mode: prose
+depth: standard | deep
+source_doc: <path or "pasted">
+scope: <X — the requested scope only>
+analyzed_at: DDMMYY HH:MM:SS
+model: opus-5-5-high      # the RESOLVED model of the agent that produced this
+                          #   (mini writes sonnet-5-high) — never copied from here
+grounding: repo-read | repo-read+scouts   # scouts only in deep mode
+
+## In-scope requirements (X only)
+
+Every "Code reality" cell carries quote-anchored file:line evidence
+(`file:line — "verbatim snippet"`, never paraphrased; a ref with no quote
+auto-downgrades to UNVERIFIED), OR the row is tagged ASSUMPTION/UNVERIFIED (and
+appears below as an open question). Absence claims (status missing) instead
+carry `searched:` — the concrete globs/greps run.
+
+| # | Requirement (from doc) | Code reality | Evidence (file:line + quote / searched:) | Files/modules | Status | Resolution |
+|---|------------------------|--------------|------------------------------------------|---------------|--------|------------|
+| 1 | "notifications must paginate" | list is unbounded | searched: `paginate`, `cursor`, `limit` in api/notifications — no hits | api/notifications/x | missing | implement pagination |
+| 2 | "respect existing auth" | auth middleware present | auth/mw.x:10 — "app.use(requireAuth)" | auth/mw.x | exists | reuse, no change |
+
+Status: exists | missing | conflict | resolved
+
+## Assumptions & Open Questions
+Anything not grounded to code, plus every ambiguity — each was raised as a
+recommended-option challenge and resolved (or is still open).
+- ASSUMPTION (resolved): "paginate" = cursor-based (recommended) — user confirmed.
+- UNVERIFIED (open): whether a rate-limit already exists — evidence not found.
+
+## Additional context (do not build)
+Anchored, non-actionable context pulled from an ADJACENT scope because an in-scope
+requirement depends on it. Read for understanding; never a task. Each item names
+the in-scope requirement it serves + why. Omit this whole section if none survived.
+| Anchor (in-scope #) | From scope | Dependency | Touchpoint to respect | Evidence (file:line) |
+|---------------------|-----------|------------|-----------------------|----------------------|
+| Req 1 (pagination) | listing (Y) | guards-invariant | shared list serializer caps a page at 100 | api/serializers/list.x:31 |
+
+## Alternatives & risks   (DEEP mode only — omit in standard)
+- Approach A (recommended): reuse existing cursor helper — low blast radius, 3 files.
+- Approach B: new offset paginator — simpler read, breaks existing cursor clients.
+- Risk: pagination touches the shared list serializer (dependents: 4 call sites).
+
+## Challenges raised & answers
+- Req 3 appeared to require an admin panel (belongs to scope Z) — user confirmed
+  OUT of scope X.
+
+## Excluded scopes (recognized, not detailed)
+- Recognized Y, Z; excluded per scope = X.
+
+## Handoff readiness (checklist — all five or handoff_ready is false)
+- [ ] all BLOCKING challenges resolved
+- [ ] zero open UNVERIFIED on any in-scope requirement
+- [ ] every requirement has status + evidence-or-resolution
+- [ ] spec derived AFTER the user confirmed this report
+- [ ] scope_closed: true written into the spec
+```

package/templates/skills/orc-analyze/schemas/report-requirement.md

@@ -1,78 +1,78 @@
-# Template — Analyst Report (REQUIREMENT mode — no document)
-
-Used when there is NO source document: the user's plain-language request IS the
-requirement, reconciled against the existing code. Human-readable source of
-truth. Written to `<analyzer_dir>/{analysis-name}/report.md` (config
-`analyzer_dir` — the internal artifact dir); it is COPIED to
-`<report_out_dir>/{analysis-name}/report.md` only on the report-only /
-stop-here branch. The old "written to analyst_report/…" wording described the
-copy target as if it were the write target.
-
-```markdown
-# Analysis Report — {analysis-name}
-mode: requirement
-depth: standard | deep
-source: "pasted request"        # the user's own words, verbatim
-scope: <X — the requested scope only>
-analyzed_at: DDMMYY HH:MM:SS
-model: opus-5-high        # the RESOLVED model of the agent that produced this
-                          #   (mini writes sonnet-5-high) — never copied from here
-grounding: repo-read | repo-read+scouts   # scouts only in deep mode
-
-## Restated requirement (analyst's words)
-One or two sentences restating the request — restating is what surfaces
-misreadings. If the restatement rests on any assumption, tag it and ask.
-
-## In-scope requirement parts (X only)
-
-Each part of the request, reconciled against code. Every "Code reality" cell
-carries quote-anchored file:line evidence (`file:line — "verbatim snippet"`,
-never paraphrased; a ref with no quote auto-downgrades to UNVERIFIED), OR the
-part is tagged ASSUMPTION/UNVERIFIED (and appears below as an open question).
-Absence claims (status missing/buildable) instead carry `searched:` — the
-concrete globs/greps run. In deep mode EVERY part is verified.
-
-| # | Requirement part (from request) | Code reality | Evidence (file:line + quote / searched:) | Files/modules | Status | Resolution |
-|---|---------------------------------|--------------|------------------------------------------|---------------|--------|------------|
-| 1 | "add CSV export to reports" | reports render HTML only | searched: `export*`, `csv`, `download` — no hits | web/reports/x | missing | new export path |
-| 2 | "reuse current auth" | auth guard on report routes | web/reports/routes.x:12 — "requireAuth(" | web/reports/x | exists | reuse, no change |
-
-Status: buildable | exists | conflict | resolved
-- buildable: not present, but consistent with the code — safe to build.
-- exists: already implemented — flag so the planner doesn't duplicate.
-- conflict: request contradicts existing behavior → challenged.
-- resolved: a challenged part the user decided on.
-
-## Assumptions & Open Questions
-Every ambiguity in the request + anything not grounded to code. Each raised as a
-recommended-option challenge and resolved (or still open).
-- ASSUMPTION (resolved): "export" = download file (recommended) vs email — user
-  confirmed download.
-- UNVERIFIED (open): whether a reports permission gate exists — evidence not found.
-
-## Additional context (do not build)
-Anchored, non-actionable context pulled from an ADJACENT scope because an in-scope
-request part depends on it. Read for understanding; never a task. Each item names
-the in-scope part it serves + why. Omit this whole section if none survived.
-| Anchor (in-scope #) | From scope | Dependency | Touchpoint to respect | Evidence (file:line) |
-|---------------------|-----------|------------|-----------------------|----------------------|
-| Part 1 (CSV export) | reporting (Y) | consumes-output | report query already paginates; export must page too | web/reports/query.x:44 |
-
-## Alternatives & risks   (DEEP mode only — omit in standard)
-- Approach A (recommended): stream CSV from the existing query — low blast radius.
-- Approach B: precompute + cache — faster reads, adds a cache dependency.
-- Risk: export reuses the report query (dependents: 2 schedulers).
-
-## Challenges raised & answers
-- Part 3 ("admin-only export") looked like scope Z (admin) — user confirmed OUT.
-
-## Excluded scopes (recognized, not detailed)
-- Recognized Y, Z implied by the request; excluded per scope = X.
-
-## Handoff readiness (checklist — all five or handoff_ready is false)
-- [ ] all BLOCKING challenges resolved
-- [ ] zero open UNVERIFIED on any in-scope part
-- [ ] every part has status + evidence-or-resolution
-- [ ] spec derived AFTER the user confirmed this report
-- [ ] scope_closed: true written into the spec
-```
+# Template — Analyst Report (REQUIREMENT mode — no document)
+
+Used when there is NO source document: the user's plain-language request IS the
+requirement, reconciled against the existing code. Human-readable source of
+truth. Written to `<analyzer_dir>/{analysis-name}/report.md` (config
+`analyzer_dir` — the internal artifact dir); it is COPIED to
+`<report_out_dir>/{analysis-name}/report.md` only on the report-only /
+stop-here branch. The old "written to analyst_report/…" wording described the
+copy target as if it were the write target.
+
+```markdown
+# Analysis Report — {analysis-name}
+mode: requirement
+depth: standard | deep
+source: "pasted request"        # the user's own words, verbatim
+scope: <X — the requested scope only>
+analyzed_at: DDMMYY HH:MM:SS
+model: opus-5-5-high      # the RESOLVED model of the agent that produced this
+                          #   (mini writes sonnet-5-high) — never copied from here
+grounding: repo-read | repo-read+scouts   # scouts only in deep mode
+
+## Restated requirement (analyst's words)
+One or two sentences restating the request — restating is what surfaces
+misreadings. If the restatement rests on any assumption, tag it and ask.
+
+## In-scope requirement parts (X only)
+
+Each part of the request, reconciled against code. Every "Code reality" cell
+carries quote-anchored file:line evidence (`file:line — "verbatim snippet"`,
+never paraphrased; a ref with no quote auto-downgrades to UNVERIFIED), OR the
+part is tagged ASSUMPTION/UNVERIFIED (and appears below as an open question).
+Absence claims (status missing/buildable) instead carry `searched:` — the
+concrete globs/greps run. In deep mode EVERY part is verified.
+
+| # | Requirement part (from request) | Code reality | Evidence (file:line + quote / searched:) | Files/modules | Status | Resolution |
+|---|---------------------------------|--------------|------------------------------------------|---------------|--------|------------|
+| 1 | "add CSV export to reports" | reports render HTML only | searched: `export*`, `csv`, `download` — no hits | web/reports/x | missing | new export path |
+| 2 | "reuse current auth" | auth guard on report routes | web/reports/routes.x:12 — "requireAuth(" | web/reports/x | exists | reuse, no change |
+
+Status: buildable | exists | conflict | resolved
+- buildable: not present, but consistent with the code — safe to build.
+- exists: already implemented — flag so the planner doesn't duplicate.
+- conflict: request contradicts existing behavior → challenged.
+- resolved: a challenged part the user decided on.
+
+## Assumptions & Open Questions
+Every ambiguity in the request + anything not grounded to code. Each raised as a
+recommended-option challenge and resolved (or still open).
+- ASSUMPTION (resolved): "export" = download file (recommended) vs email — user
+  confirmed download.
+- UNVERIFIED (open): whether a reports permission gate exists — evidence not found.
+
+## Additional context (do not build)
+Anchored, non-actionable context pulled from an ADJACENT scope because an in-scope
+request part depends on it. Read for understanding; never a task. Each item names
+the in-scope part it serves + why. Omit this whole section if none survived.
+| Anchor (in-scope #) | From scope | Dependency | Touchpoint to respect | Evidence (file:line) |
+|---------------------|-----------|------------|-----------------------|----------------------|
+| Part 1 (CSV export) | reporting (Y) | consumes-output | report query already paginates; export must page too | web/reports/query.x:44 |
+
+## Alternatives & risks   (DEEP mode only — omit in standard)
+- Approach A (recommended): stream CSV from the existing query — low blast radius.
+- Approach B: precompute + cache — faster reads, adds a cache dependency.
+- Risk: export reuses the report query (dependents: 2 schedulers).
+
+## Challenges raised & answers
+- Part 3 ("admin-only export") looked like scope Z (admin) — user confirmed OUT.
+
+## Excluded scopes (recognized, not detailed)
+- Recognized Y, Z implied by the request; excluded per scope = X.
+
+## Handoff readiness (checklist — all five or handoff_ready is false)
+- [ ] all BLOCKING challenges resolved
+- [ ] zero open UNVERIFIED on any in-scope part
+- [ ] every part has status + evidence-or-resolution
+- [ ] spec derived AFTER the user confirmed this report
+- [ ] scope_closed: true written into the spec
+```