@dzhechkov/keysarium 1.5.39 → 1.5.41

package/.dz-manifest.json

@@ -3,17 +3,9 @@
     "version": 1,
     "pack": "keysarium",
     "files": [
-      {
-        "path": ".npmignore",
-        "sha256": "9317ffe4ed40056088019932546f9c61314dc12771936facac6c1a223850ba1a"
-      },
-      {
-        "path": "CHANGELOG.md",
-        "sha256": "eea09507de22a829358a02a818a62767d36addeb585ec42a29d3ada8be2e3f7f"
-      },
       {
         "path": "README.md",
-        "sha256": "546283f9b70fe63fbe404fc80bd78e66c898522dfcbf10efb684f13f4a89a77d"
+        "sha256": "55a9e601a7028333e77dd2ee0f8eec201f053cd970deb8f58ecfa7cf06987cf4"
       },
       {
         "path": "README.ru.md",
@@ -23,21 +15,9 @@
         "path": "bin/cli.js",
         "sha256": "a210174d6b63d053f7744757972d31acb0f4d9c59f8dacff7b62872a19ebd31a"
       },
-      {
-        "path": "install.sh",
-        "sha256": "9631575645f93ca8a65aa2f346da7253cd6ffa6394e36c13a2bf0d7eb605387f"
-      },
       {
         "path": "package.json",
-        "sha256": "6e7bd27dbde362b7a252abca1ce6fb6412798af0160a88ed4cbd0ddf106e58c8"
-      },
-      {
-        "path": "scripts/sync-templates.js",
-        "sha256": "2dbbe71d5454c5be20c4460330b7b3ec77dc78d498d99d7226fe474ed2fd1101"
-      },
-      {
-        "path": "sources.json",
-        "sha256": "e36d98d8438c8ef9bc872843aeabc087c8b7a9fc52ed5a50568d28306d26b876"
+        "sha256": "9371c3fe3922382a7871224941fb0bae838dfcbeb750bd55a662e4c27a1e1af7"
       },
       {
         "path": "src/cli.js",
@@ -365,7 +345,7 @@
       },
       {
         "path": "templates/.claude/skills/feature-adr/SKILL.md",
-        "sha256": "bdedfed69d985eb6969f158a72d92f63c6b1b993008c3661f7ffc2c6a7ccfbae"
+        "sha256": "67eb730c815e6b8f9b9b61084c67ceb85440548f00b21f52187d16e81e3d7af8"
       },
       {
         "path": "templates/.claude/skills/feature-adr/examples/sample-feature-output.md",
@@ -401,7 +381,7 @@
       },
       {
         "path": "templates/.claude/skills/feature-adr/modules/06-implementation-plan.md",
-        "sha256": "3903e2694ad47782914b35869bbf19c5f0803b6dafdcfb629df343a5ff00d1b9"
+        "sha256": "b3efdfa1d44f4c51ff46551b5827066955c1f0bfee212d371ac1e2fb1c99980f"
       },
       {
         "path": "templates/.claude/skills/feature-adr/modules/07-code.md",
@@ -501,7 +481,7 @@
       },
       {
         "path": "templates/.claude/skills/feature-adr/scripts/check-plan-completeness.mjs",
-        "sha256": "2e1afeb8cbc08ce872fc8280a0809e7712ee76879d08b48caa5a0d4082cb8647"
+        "sha256": "eddf116620050e80b88497ace026fb8e0a12986f94f216181480c7daa0e08be4"
       },
       {
         "path": "templates/.claude/skills/frontend-design/LICENSE.txt",
@@ -1005,5 +985,5 @@
       }
     ]
   },
-  "signature": "XoglxxyxKFLcXDz2N8wZzIPbdDffl6Mo5OQwgXt1cIZT1dmM/xHe/s70VsMxlFUiYTgQwYyxjHctP33tG/P+DA=="
+  "signature": "AXc5drN9RLQVp4PK9QbjYylVG4nQruSrJQZV4KPQ2JY3/Xif4oZzOxlUOQ1JA5+HRppGUvGnnMtTN8c35rDkDw=="
 }

package/README.md

@@ -419,6 +419,12 @@ deliberately excluded — "skeleton first" is nonsense there.
 
 ## Status
 
+`1.5.41` — refreshes the bundled `feature-adr` gate script with the C6 amendment-integrity fix (each
+amendment scoped to its own block; closes a false refusal on markers below the old three-line window
+AND a false pass where a testless amendment borrowed its neighbour's marker). No keysarium behaviour
+changes. See `@dzhechkov/skills-feature-adr@1.5.3`.
+
+
 `1.5.38` — a fix to the bundled `feature-adr` gate script in `templates/`, no pipeline change.
 
 The bundled K2 plan-completeness gate now tells an **ABSENT** `00_complexity_assessment.md` from a
@@ -427,5 +433,5 @@ carrying no acid table is an honest SKIP. Both used to report as a clean skip, s
 silently switched itself off whenever Step 0 wrote nothing — MEASURED 2026-08-21, 66 of 199 features
 carried that file and the last four in a row did not.
 
-`1.5.39` — the bundled `feature-adr` Step-8 module now describes the amendment gate as the command
+`1.5.41` — the bundled `feature-adr` Step-8 module now describes the amendment gate as the command
 `dz amendment-check` instead of a judgement the reviewer is asked to make. Text only; no pipeline change.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dzhechkov/keysarium",
-  "version": "1.5.39",
+  "version": "1.5.41",
   "description": "AI Case Research Toolkit for Claude Code — full 7-phase pipeline with feature-adr, dream cycles, background workers, multi-platform support, reward learning, and Cloud.ru AI Factory mapping (--ai-factory flag)",
   "main": "src/cli.js",
   "bin": {
@@ -51,5 +51,6 @@
   },
   "publishConfig": {
     "access": "public"
-  }
+  },
+  "scripts": {}
 }

package/sbom.json

@@ -9,33 +9,13 @@
     }
   },
   "components": [
-    {
-      "type": "file",
-      "name": ".npmignore",
-      "hashes": [
-        {
-          "alg": "SHA-256",
-          "content": "9317ffe4ed40056088019932546f9c61314dc12771936facac6c1a223850ba1a"
-        }
-      ]
-    },
-    {
-      "type": "file",
-      "name": "CHANGELOG.md",
-      "hashes": [
-        {
-          "alg": "SHA-256",
-          "content": "eea09507de22a829358a02a818a62767d36addeb585ec42a29d3ada8be2e3f7f"
-        }
-      ]
-    },
     {
       "type": "file",
       "name": "README.md",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "546283f9b70fe63fbe404fc80bd78e66c898522dfcbf10efb684f13f4a89a77d"
+          "content": "55a9e601a7028333e77dd2ee0f8eec201f053cd970deb8f58ecfa7cf06987cf4"
         }
       ]
     },
@@ -59,43 +39,13 @@
         }
       ]
     },
-    {
-      "type": "file",
-      "name": "install.sh",
-      "hashes": [
-        {
-          "alg": "SHA-256",
-          "content": "9631575645f93ca8a65aa2f346da7253cd6ffa6394e36c13a2bf0d7eb605387f"
-        }
-      ]
-    },
     {
       "type": "file",
       "name": "package.json",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "6e7bd27dbde362b7a252abca1ce6fb6412798af0160a88ed4cbd0ddf106e58c8"
-        }
-      ]
-    },
-    {
-      "type": "file",
-      "name": "scripts/sync-templates.js",
-      "hashes": [
-        {
-          "alg": "SHA-256",
-          "content": "2dbbe71d5454c5be20c4460330b7b3ec77dc78d498d99d7226fe474ed2fd1101"
-        }
-      ]
-    },
-    {
-      "type": "file",
-      "name": "sources.json",
-      "hashes": [
-        {
-          "alg": "SHA-256",
-          "content": "e36d98d8438c8ef9bc872843aeabc087c8b7a9fc52ed5a50568d28306d26b876"
+          "content": "9371c3fe3922382a7871224941fb0bae838dfcbeb750bd55a662e4c27a1e1af7"
         }
       ]
     },
@@ -915,7 +865,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "bdedfed69d985eb6969f158a72d92f63c6b1b993008c3661f7ffc2c6a7ccfbae"
+          "content": "67eb730c815e6b8f9b9b61084c67ceb85440548f00b21f52187d16e81e3d7af8"
         }
       ]
     },
@@ -1005,7 +955,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "3903e2694ad47782914b35869bbf19c5f0803b6dafdcfb629df343a5ff00d1b9"
+          "content": "b3efdfa1d44f4c51ff46551b5827066955c1f0bfee212d371ac1e2fb1c99980f"
         }
       ]
     },
@@ -1255,7 +1205,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "2e1afeb8cbc08ce872fc8280a0809e7712ee76879d08b48caa5a0d4082cb8647"
+          "content": "eddf116620050e80b88497ace026fb8e0a12986f94f216181480c7daa0e08be4"
         }
       ]
     },

package/templates/.claude/skills/feature-adr/SKILL.md

@@ -100,6 +100,9 @@ ROUTER   →  REQUIREMENTS  →  RESEARCH  →   ADR         →  QCSD SWARM
                                            SPARC-GOAP PLAN
                                                 (all)
                                                    │
+                                       K1 NAME-AVAILABILITY GATE
+                                      (every new command/module/export)
+                                                   │
                                         K2 PLAN-COMPLETENESS GATE
                                        (all — exit 0 or Step 7 waits)
                                                    │
@@ -147,6 +150,27 @@ Step                         | S | M | L | XL | Model  | Agentic QE Skill
 10 Delivery Gate (OPT-IN)    | o | o | o | o  | cross-family of coder | 4 planes: regressions ‖ security ‖ code-quality ‖ product-honesty (o = runs only when explicitly requested; absent ⇒ byte-identical) |
 ```
 
+### K1 name-availability gate (Step-6/7 boundary, MANDATORY, every new name)
+
+Before Step 7 writes a line, every NEW name the plan introduces is checked:
+
+```bash
+dz name-check --command <cmd> --module <basename> --export <a,b,c>
+```
+
+`exit 0` → proceed · `exit 1` → rename in the plan first · `exit 2` → NOT ESTABLISHED (the sweep
+found nothing of that kind — fix the invocation, never read it as free).
+
+**Why this is a gate and not advice.** Twice on 2026-08-23/24 a collision broke the build outright —
+`dz retro` was already a command and its star re-export clash stopped the CLI from importing at all;
+`decideProvenance` was already an export. Both were answerable before any code. The check costs one
+command; the miss costs a rename across every artifact of the feature. An agent's intention to
+remember is layer 4 on the cost-of-detection ladder, and this line exists because that layer failed
+twice in one day.
+
+The check reads workspace SOURCE, never `dist` — a stale build answers "free" confidently. Its honest
+limit is printed on the passing path: a re-export under a different name stays the build's job.
+
 ### K2 plan-completeness gate (Step-6/7 boundary, MANDATORY, all tiers)
 
 Step 7 does not start until the plan passes a SCRIPT — not a reviewer's impression:

package/templates/.claude/skills/feature-adr/modules/06-implementation-plan.md

@@ -185,6 +185,11 @@ Create `features/<slug>/06_implementation_plan.md` with:
 - `## Amendments` — every correction folded into this plan (a Step-3.5 CONDITIONAL condition, a
   challenge-panel confirmed finding, a user checkpoint steer) as a fixed-shape row:
   `AM-N (source): <change>. Confirmation: <property> → test `test_name` (fails if reverted).`
+  The row is MACHINE-READ by the K2 C6 gate: the `→ test \`name\`` marker (or `superseded by AM-N`)
+  must sit inside that amendment's OWN block — anywhere between its `AM-N` line and the line where
+  the NEXT `AM-N` begins. Multi-line amendments are fine; what is NOT fine is putting a marker after
+  the following amendment has already started, because it then belongs to that one. A bare range
+  like `AM-1..AM-4` never opens a row.
   A safeguard amendment's named test must prove it TRIGGERS on a real input, not merely that its code
   path exists. Step 8 verifies every named test exists and is non-vacuous (`dz discrimination-check`).
 

package/templates/.claude/skills/feature-adr/scripts/check-plan-completeness.mjs

@@ -292,6 +292,91 @@ if (acidArg) {
   } else if (acidTokens.length === 0) skips.push('C4: no acid corpus declared (no --acid, no `| A<n> |` table in 00_complexity_assessment.md) — acid-naming check SKIPPED');
 else for (const t of acidTokens) if (!new RegExp(`\\b${t.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\b`, 'i').test(plan)) failures.push(`C4: acid token "${safe(t)}" (from ${acidSource}) not named in the plan`);
 
+// ── C6 amendment integrity (backlog 72b89e14, seams б/в/г) ──────────────────────────────────────
+// The measured shape: AM-rows living OUTSIDE `## Amendments` were invisible to every gate; four
+// amendments named no test at all; a retracted amendment (AM-23 cancelling AM-20) left the old one
+// standing. One deterministic check for all three: every AM-token belongs to the section, and every
+// AM row in the section carries `→ test ...` OR an explicit `superseded by AM-N`.
+{
+  // Line-scan, not regex-over-document: \Z is Python, and $-lookahead under /m matches every
+  // line end — a section with no FOLLOWING heading silently failed to parse (caught by the
+  // fixture the moment the tests ran).
+  const planLines = plan.split('\n');
+  let sectionStart = -1, sectionEnd = -1, cursor = 0;
+  for (const pl of planLines) {
+    if (sectionStart < 0 && /^##\s*Amendments\s*$/.test(pl)) sectionStart = cursor + pl.length + 1;
+    else if (sectionStart >= 0 && sectionEnd < 0 && /^##\s/.test(pl)) sectionEnd = cursor;
+    cursor += pl.length + 1;
+  }
+  if (sectionStart >= 0 && sectionEnd < 0) sectionEnd = plan.length;
+  const amSection = sectionStart >= 0 ? plan.slice(sectionStart, sectionEnd) : '';
+  // Only a DEFINITION-shaped line counts as a stray: a list item opening with the AM token.
+  // A mid-prose REFERENCE («per 01_requirements.md (AM-1..AM-6)», «(AM-1: the clause stays
+  // dropped)») cites an amendment defined in ANOTHER artifact and is legitimate — the first cut
+  // failed the real wave1 corpus on exactly that (caught by the standing acid test).
+  {
+    let cursor2 = 0;
+    for (const pl of planLines) {
+      const isDef = /^\s*(?:[-*|]\s*)\*{0,2}AM-(?:CP-)?\d+\b/.test(pl);
+      const inSection = sectionStart >= 0 && cursor2 >= sectionStart && cursor2 < sectionEnd;
+      if (isDef && !inSection) {
+        const tok = (/AM-(?:CP-)?\d+/.exec(pl) || ['AM-?'])[0];
+        failures.push(`C6: ${tok} is DEFINED outside the \`## Amendments\` section (line: "${pl.trim().slice(0, 80)}") — an amendment outside the section is invisible to every downstream reader`);
+      }
+      cursor2 += pl.length + 1;
+    }
+  }
+  if (sectionStart >= 0) {
+    // Each amendment's confirmation is looked for in ITS OWN BLOCK: from its definition line to the
+    // line where the NEXT amendment begins. Three defects die with the old three-line window
+    // (MEASURED 2026-08-25 against the 142-plan corpus — 292 C6 failures before, 33 after, and ZERO
+    // rows newly caught that pass today):
+    //   • FALSE REFUSAL — a marker on the `Confirmation:` line 4+ lines down was invisible, so plans
+    //     that DID name their test were rejected (7 per run, twice in one day, on a user's machine).
+    //   • FALSE PASS — the window is three LINES, not one amendment, so `- AM-1 testless` followed by
+    //     `- AM-2 … -> test x` PASSED: AM-1 borrowed its neighbour's marker. That is the safety half,
+    //     and it is why the boundary is the next DEFINITION rather than a blank line — a blank line
+    //     does not separate adjacent bullet rows.
+    //   • A substring seek (`amSection.indexOf(lnRaw)`) let a duplicated line read someone else's
+    //     window. Indices remove that hazard for free.
+    // The boundary is not invented: parseAmendments() in harness-core/src/amendment-trace.ts has used
+    // the same next-definition bound all along, so this also ends a divergence between two checkers.
+    const secLines = amSection.split('\n');
+    // The bullet stays OPTIONAL: requiring it drops 104 of the corpus's 347 real AM rows out of the
+    // check entirely (MEASURED). The `(?!\s*\.)` guard is what refuses a wrapped `AM-1..AM-4;`
+    // range preamble, which used to open a phantom amendment and double-count AM-1 — it costs 0 rows.
+    const DEF = /^(?:[-*|]\s*)?\*{0,2}(AM-(?:CP-)?\d+)\*{0,2}\b(?!\s*\.)/;
+    // `tests?` — the two-id form `-> tests \`a\` and \`b\`` is corpus-canonical and is what
+    // amendment-trace.ts parses; matching only the singular turned two currently-green rows red.
+    const MARK = /\u2192\s*tests?\b|->\s*tests?\b/;
+    const defs = [];
+    secLines.forEach((l, i) => { const m = DEF.exec(l.trim()); if (m) defs.push({ i, id: m[1] }); });
+    for (let k = 0; k < defs.length; k++) {
+      const to = k + 1 < defs.length ? defs[k + 1].i : secLines.length;
+      const block = secLines.slice(defs[k].i, to).join('\n');
+      const hasTest = MARK.test(block);
+      const superseded = /superseded by AM-(?:CP-)?\d+/i.test(block);
+      if (!hasTest && !superseded) failures.push(`C6: ${defs[k].id} carries neither \`\u2192 test <name>\` nor \`superseded by AM-N\` — an amendment without a confirmation is a wish, and a retracted one must say its successor`);
+    }
+  }
+}
+
+// ── C7 ADR↔plan command-name drift (seam д) — WARN, deliberately never FAIL ─────────────────────
+// The measured incident: the ADR said `dz policy-sync`, the plan said `dz agents-sync` (and even
+// carried a test that the OTHER alias must not exist) — whichever file the coder opened first won.
+// Deterministically provable is only the SET DIFFERENCE, not which side is right, so this warns
+// with both sides named and never blocks.
+{
+  const adrAll = adrFiles.map((f) => { try { return readFileSync(join(adrDir, f), 'utf-8'); } catch { return ''; } }).join('\n');
+  const cmds = (t) => new Set([...t.matchAll(/`dz ([a-z][a-z0-9-]+)`/g)].map((m) => m[1]));
+  const inAdr = cmds(adrAll); const inPlan = cmds(plan);
+  const onlyAdr = [...inAdr].filter((c) => !inPlan.has(c));
+  const onlyPlan = [...inPlan].filter((c) => !inAdr.has(c));
+  if (adrAll !== '' && onlyAdr.length > 0 && onlyPlan.length > 0) {
+    warnings.push(`C7: ADR and plan cite DIFFERENT dz commands — ADR-only: ${onlyAdr.join(', ')}; plan-only: ${onlyPlan.join(', ')} — if these name the SAME thing, one of the two files is lying to the coder (seam д)`);
+  }
+}
+
 // C5 — Inputs read line
 if (!/Inputs read:/i.test(plan)) warnings.push('C5: no "Inputs read:" line (wave-2 seam, WARN only)');
 else for (const need of ['03_adr','05_architecture']) if (!plan.includes(need)) warnings.push(`C5: Inputs read line missing ${need}`);