@dzhechkov/keysarium 1.5.39 → 1.5.40

package/.dz-manifest.json

@@ -3,17 +3,9 @@
     "version": 1,
     "pack": "keysarium",
     "files": [
-      {
-        "path": ".npmignore",
-        "sha256": "9317ffe4ed40056088019932546f9c61314dc12771936facac6c1a223850ba1a"
-      },
-      {
-        "path": "CHANGELOG.md",
-        "sha256": "eea09507de22a829358a02a818a62767d36addeb585ec42a29d3ada8be2e3f7f"
-      },
       {
         "path": "README.md",
-        "sha256": "546283f9b70fe63fbe404fc80bd78e66c898522dfcbf10efb684f13f4a89a77d"
+        "sha256": "676f962e26cf674631c11f1593d533fa1e9c4cdee7e1d7786f7727fc1412366a"
       },
       {
         "path": "README.ru.md",
@@ -23,21 +15,9 @@
         "path": "bin/cli.js",
         "sha256": "a210174d6b63d053f7744757972d31acb0f4d9c59f8dacff7b62872a19ebd31a"
       },
-      {
-        "path": "install.sh",
-        "sha256": "9631575645f93ca8a65aa2f346da7253cd6ffa6394e36c13a2bf0d7eb605387f"
-      },
       {
         "path": "package.json",
-        "sha256": "6e7bd27dbde362b7a252abca1ce6fb6412798af0160a88ed4cbd0ddf106e58c8"
-      },
-      {
-        "path": "scripts/sync-templates.js",
-        "sha256": "2dbbe71d5454c5be20c4460330b7b3ec77dc78d498d99d7226fe474ed2fd1101"
-      },
-      {
-        "path": "sources.json",
-        "sha256": "e36d98d8438c8ef9bc872843aeabc087c8b7a9fc52ed5a50568d28306d26b876"
+        "sha256": "7b17d0b5b5a60c3ee74d7d93358040a1353c828a962df2530ba74dc982309089"
       },
       {
         "path": "src/cli.js",
@@ -365,7 +345,7 @@
       },
       {
         "path": "templates/.claude/skills/feature-adr/SKILL.md",
-        "sha256": "bdedfed69d985eb6969f158a72d92f63c6b1b993008c3661f7ffc2c6a7ccfbae"
+        "sha256": "67eb730c815e6b8f9b9b61084c67ceb85440548f00b21f52187d16e81e3d7af8"
       },
       {
         "path": "templates/.claude/skills/feature-adr/examples/sample-feature-output.md",
@@ -501,7 +481,7 @@
       },
       {
         "path": "templates/.claude/skills/feature-adr/scripts/check-plan-completeness.mjs",
-        "sha256": "2e1afeb8cbc08ce872fc8280a0809e7712ee76879d08b48caa5a0d4082cb8647"
+        "sha256": "5cef77e68c58f163be64516013fb90866ef7201e415dc8888cc21a0f4d92b7d8"
       },
       {
         "path": "templates/.claude/skills/frontend-design/LICENSE.txt",
@@ -1005,5 +985,5 @@
       }
     ]
   },
-  "signature": "XoglxxyxKFLcXDz2N8wZzIPbdDffl6Mo5OQwgXt1cIZT1dmM/xHe/s70VsMxlFUiYTgQwYyxjHctP33tG/P+DA=="
+  "signature": "HqvQFasiKkM8l4ksIkFcAGUHMtxvogzo9q7bO3Km4i2EQPoxwyWo6Z85GftW6HRLA+L75kTNPWpMU5avuxmJBA=="
 }

package/README.md

@@ -427,5 +427,5 @@ carrying no acid table is an honest SKIP. Both used to report as a clean skip, s
 silently switched itself off whenever Step 0 wrote nothing — MEASURED 2026-08-21, 66 of 199 features
 carried that file and the last four in a row did not.
 
-`1.5.39` — the bundled `feature-adr` Step-8 module now describes the amendment gate as the command
+`1.5.40` — the bundled `feature-adr` Step-8 module now describes the amendment gate as the command
 `dz amendment-check` instead of a judgement the reviewer is asked to make. Text only; no pipeline change.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dzhechkov/keysarium",
-  "version": "1.5.39",
+  "version": "1.5.40",
   "description": "AI Case Research Toolkit for Claude Code — full 7-phase pipeline with feature-adr, dream cycles, background workers, multi-platform support, reward learning, and Cloud.ru AI Factory mapping (--ai-factory flag)",
   "main": "src/cli.js",
   "bin": {
@@ -51,5 +51,6 @@
   },
   "publishConfig": {
     "access": "public"
-  }
+  },
+  "scripts": {}
 }

package/sbom.json

@@ -9,33 +9,13 @@
     }
   },
   "components": [
-    {
-      "type": "file",
-      "name": ".npmignore",
-      "hashes": [
-        {
-          "alg": "SHA-256",
-          "content": "9317ffe4ed40056088019932546f9c61314dc12771936facac6c1a223850ba1a"
-        }
-      ]
-    },
-    {
-      "type": "file",
-      "name": "CHANGELOG.md",
-      "hashes": [
-        {
-          "alg": "SHA-256",
-          "content": "eea09507de22a829358a02a818a62767d36addeb585ec42a29d3ada8be2e3f7f"
-        }
-      ]
-    },
     {
       "type": "file",
       "name": "README.md",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "546283f9b70fe63fbe404fc80bd78e66c898522dfcbf10efb684f13f4a89a77d"
+          "content": "676f962e26cf674631c11f1593d533fa1e9c4cdee7e1d7786f7727fc1412366a"
         }
       ]
     },
@@ -59,43 +39,13 @@
         }
       ]
     },
-    {
-      "type": "file",
-      "name": "install.sh",
-      "hashes": [
-        {
-          "alg": "SHA-256",
-          "content": "9631575645f93ca8a65aa2f346da7253cd6ffa6394e36c13a2bf0d7eb605387f"
-        }
-      ]
-    },
     {
       "type": "file",
       "name": "package.json",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "6e7bd27dbde362b7a252abca1ce6fb6412798af0160a88ed4cbd0ddf106e58c8"
-        }
-      ]
-    },
-    {
-      "type": "file",
-      "name": "scripts/sync-templates.js",
-      "hashes": [
-        {
-          "alg": "SHA-256",
-          "content": "2dbbe71d5454c5be20c4460330b7b3ec77dc78d498d99d7226fe474ed2fd1101"
-        }
-      ]
-    },
-    {
-      "type": "file",
-      "name": "sources.json",
-      "hashes": [
-        {
-          "alg": "SHA-256",
-          "content": "e36d98d8438c8ef9bc872843aeabc087c8b7a9fc52ed5a50568d28306d26b876"
+          "content": "7b17d0b5b5a60c3ee74d7d93358040a1353c828a962df2530ba74dc982309089"
         }
       ]
     },
@@ -915,7 +865,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "bdedfed69d985eb6969f158a72d92f63c6b1b993008c3661f7ffc2c6a7ccfbae"
+          "content": "67eb730c815e6b8f9b9b61084c67ceb85440548f00b21f52187d16e81e3d7af8"
         }
       ]
     },
@@ -1255,7 +1205,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "2e1afeb8cbc08ce872fc8280a0809e7712ee76879d08b48caa5a0d4082cb8647"
+          "content": "5cef77e68c58f163be64516013fb90866ef7201e415dc8888cc21a0f4d92b7d8"
         }
       ]
     },

package/templates/.claude/skills/feature-adr/SKILL.md

@@ -100,6 +100,9 @@ ROUTER   →  REQUIREMENTS  →  RESEARCH  →   ADR         →  QCSD SWARM
                                            SPARC-GOAP PLAN
                                                 (all)
                                                    │
+                                       K1 NAME-AVAILABILITY GATE
+                                      (every new command/module/export)
+                                                   │
                                         K2 PLAN-COMPLETENESS GATE
                                        (all — exit 0 or Step 7 waits)
                                                    │
@@ -147,6 +150,27 @@ Step                         | S | M | L | XL | Model  | Agentic QE Skill
 10 Delivery Gate (OPT-IN)    | o | o | o | o  | cross-family of coder | 4 planes: regressions ‖ security ‖ code-quality ‖ product-honesty (o = runs only when explicitly requested; absent ⇒ byte-identical) |
 ```
 
+### K1 name-availability gate (Step-6/7 boundary, MANDATORY, every new name)
+
+Before Step 7 writes a line, every NEW name the plan introduces is checked:
+
+```bash
+dz name-check --command <cmd> --module <basename> --export <a,b,c>
+```
+
+`exit 0` → proceed · `exit 1` → rename in the plan first · `exit 2` → NOT ESTABLISHED (the sweep
+found nothing of that kind — fix the invocation, never read it as free).
+
+**Why this is a gate and not advice.** Twice on 2026-08-23/24 a collision broke the build outright —
+`dz retro` was already a command and its star re-export clash stopped the CLI from importing at all;
+`decideProvenance` was already an export. Both were answerable before any code. The check costs one
+command; the miss costs a rename across every artifact of the feature. An agent's intention to
+remember is layer 4 on the cost-of-detection ladder, and this line exists because that layer failed
+twice in one day.
+
+The check reads workspace SOURCE, never `dist` — a stale build answers "free" confidently. Its honest
+limit is printed on the passing path: a re-export under a different name stays the build's job.
+
 ### K2 plan-completeness gate (Step-6/7 boundary, MANDATORY, all tiers)
 
 Step 7 does not start until the plan passes a SCRIPT — not a reviewer's impression:

package/templates/.claude/skills/feature-adr/scripts/check-plan-completeness.mjs

@@ -292,6 +292,68 @@ if (acidArg) {
   } else if (acidTokens.length === 0) skips.push('C4: no acid corpus declared (no --acid, no `| A<n> |` table in 00_complexity_assessment.md) — acid-naming check SKIPPED');
 else for (const t of acidTokens) if (!new RegExp(`\\b${t.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\b`, 'i').test(plan)) failures.push(`C4: acid token "${safe(t)}" (from ${acidSource}) not named in the plan`);
 
+// ── C6 amendment integrity (backlog 72b89e14, seams б/в/г) ──────────────────────────────────────
+// The measured shape: AM-rows living OUTSIDE `## Amendments` were invisible to every gate; four
+// amendments named no test at all; a retracted amendment (AM-23 cancelling AM-20) left the old one
+// standing. One deterministic check for all three: every AM-token belongs to the section, and every
+// AM row in the section carries `→ test ...` OR an explicit `superseded by AM-N`.
+{
+  // Line-scan, not regex-over-document: \Z is Python, and $-lookahead under /m matches every
+  // line end — a section with no FOLLOWING heading silently failed to parse (caught by the
+  // fixture the moment the tests ran).
+  const planLines = plan.split('\n');
+  let sectionStart = -1, sectionEnd = -1, cursor = 0;
+  for (const pl of planLines) {
+    if (sectionStart < 0 && /^##\s*Amendments\s*$/.test(pl)) sectionStart = cursor + pl.length + 1;
+    else if (sectionStart >= 0 && sectionEnd < 0 && /^##\s/.test(pl)) sectionEnd = cursor;
+    cursor += pl.length + 1;
+  }
+  if (sectionStart >= 0 && sectionEnd < 0) sectionEnd = plan.length;
+  const amSection = sectionStart >= 0 ? plan.slice(sectionStart, sectionEnd) : '';
+  // Only a DEFINITION-shaped line counts as a stray: a list item opening with the AM token.
+  // A mid-prose REFERENCE («per 01_requirements.md (AM-1..AM-6)», «(AM-1: the clause stays
+  // dropped)») cites an amendment defined in ANOTHER artifact and is legitimate — the first cut
+  // failed the real wave1 corpus on exactly that (caught by the standing acid test).
+  {
+    let cursor2 = 0;
+    for (const pl of planLines) {
+      const isDef = /^\s*(?:[-*|]\s*)\*{0,2}AM-(?:CP-)?\d+\b/.test(pl);
+      const inSection = sectionStart >= 0 && cursor2 >= sectionStart && cursor2 < sectionEnd;
+      if (isDef && !inSection) {
+        const tok = (/AM-(?:CP-)?\d+/.exec(pl) || ['AM-?'])[0];
+        failures.push(`C6: ${tok} is DEFINED outside the \`## Amendments\` section (line: "${pl.trim().slice(0, 80)}") — an amendment outside the section is invisible to every downstream reader`);
+      }
+      cursor2 += pl.length + 1;
+    }
+  }
+  if (sectionStart >= 0) {
+    for (const lnRaw of amSection.split('\n')) {
+      const ln = lnRaw.trim();
+      const am = /^(?:[-*|]\s*)?\*{0,2}(AM-(?:CP-)?\d+)\*{0,2}\b/.exec(ln);
+      if (!am) continue;
+      const hasTest = /\u2192\s*test\b|->\s*test\b/.test(ln) || /\u2192\s*test\b|->\s*test\b/.test(amSection.slice(amSection.indexOf(lnRaw)).split('\n').slice(0, 3).join('\n'));
+      const superseded = /superseded by AM-(?:CP-)?\d+/i.test(ln);
+      if (!hasTest && !superseded) failures.push(`C6: ${am[1]} carries neither \`\u2192 test <name>\` nor \`superseded by AM-N\` — an amendment without a confirmation is a wish, and a retracted one must say its successor`);
+    }
+  }
+}
+
+// ── C7 ADR↔plan command-name drift (seam д) — WARN, deliberately never FAIL ─────────────────────
+// The measured incident: the ADR said `dz policy-sync`, the plan said `dz agents-sync` (and even
+// carried a test that the OTHER alias must not exist) — whichever file the coder opened first won.
+// Deterministically provable is only the SET DIFFERENCE, not which side is right, so this warns
+// with both sides named and never blocks.
+{
+  const adrAll = adrFiles.map((f) => { try { return readFileSync(join(adrDir, f), 'utf-8'); } catch { return ''; } }).join('\n');
+  const cmds = (t) => new Set([...t.matchAll(/`dz ([a-z][a-z0-9-]+)`/g)].map((m) => m[1]));
+  const inAdr = cmds(adrAll); const inPlan = cmds(plan);
+  const onlyAdr = [...inAdr].filter((c) => !inPlan.has(c));
+  const onlyPlan = [...inPlan].filter((c) => !inAdr.has(c));
+  if (adrAll !== '' && onlyAdr.length > 0 && onlyPlan.length > 0) {
+    warnings.push(`C7: ADR and plan cite DIFFERENT dz commands — ADR-only: ${onlyAdr.join(', ')}; plan-only: ${onlyPlan.join(', ')} — if these name the SAME thing, one of the two files is lying to the coder (seam д)`);
+  }
+}
+
 // C5 — Inputs read line
 if (!/Inputs read:/i.test(plan)) warnings.push('C5: no "Inputs read:" line (wave-2 seam, WARN only)');
 else for (const need of ['03_adr','05_architecture']) if (!plan.includes(need)) warnings.push(`C5: Inputs read line missing ${need}`);