@dzhechkov/keysarium 1.7.3 → 1.7.5

package/.dz-manifest.json

@@ -5,7 +5,7 @@
     "files": [
       {
         "path": "README.md",
-        "sha256": "1b64bc03bcb9c05471a15381196d4f8a30879a798a74e5d1fda98c33846b5cb2"
+        "sha256": "e2f661392b2862870ae3ab05892493e5a7ddcdb86360690d126525f08b6d87a1"
       },
       {
         "path": "README.ru.md",
@@ -17,7 +17,7 @@
       },
       {
         "path": "package.json",
-        "sha256": "60d5df9bae91533c201784ba53a7b6f24405d7fe9ddceddea88110f2ed0d99f4"
+        "sha256": "56048c9ebf810b35645674fe4a413112af02be6a53836583d3c80b0ad4047dde"
       },
       {
         "path": "src/cli.js",
@@ -481,7 +481,11 @@
       },
       {
         "path": "templates/.claude/skills/feature-adr/scripts/check-plan-completeness.mjs",
-        "sha256": "630eb9047258ad0333082f407cd34522e4c278650f22ef6dba1ef897ec5cce71"
+        "sha256": "cbe70a524f6ce7987b5e3961ee412b92c24c00d84066d438c759659d656efaa2"
+      },
+      {
+        "path": "templates/.claude/skills/feature-adr/scripts/markdown-masker.mjs",
+        "sha256": "82c3c48c25f400f3a64d1caba3d47357f3db87460f0746f88706f901eb6ff689"
       },
       {
         "path": "templates/.claude/skills/frontend-design/LICENSE.txt",
@@ -669,7 +673,7 @@
       },
       {
         "path": "templates/.claude/skills/reverse-engineering-unicorn/modules/025-cjm-prototype.md",
-        "sha256": "11e2e101c99d42306ac1d0931475c5a8899e929514e41a393b6173e03856cfc3"
+        "sha256": "d9dd399cbb60d6b5fa9734ad44128a49790ef15bbde25c809d69d5c918601eb3"
       },
       {
         "path": "templates/.claude/skills/reverse-engineering-unicorn/modules/03-market-competition.md",
@@ -985,5 +989,5 @@
       }
     ]
   },
-  "signature": "RJjA9cFjrmHeEh1AtaKyrBGVs4Yr/lHYYH4HPKQIdVNq1euwTDSFShvlU+s9nS6/m0hAFCr8W/e3p2I0X1mIDQ=="
+  "signature": "Ni8QtKUfWoED6GoaSA9ARScSXZdJxtM6FSWTILwzYsRLvgJ6fyCmHV9Vz0IriuT0E/NXt8YYp1Oo8Np1iBpVDg=="
 }

package/README.md

@@ -18,7 +18,7 @@ Full 7-phase pipeline for AI case studies, hackathons, and casariums. Provides s
 > the teach protocol. See `skills/goap-research-ed25519/SKILL.md`.
 
 ## Growth engine (reverse-engineering-unicorn M5)
-### What M5 produces, since 0.2.0 / 1.7.3 / 1.6.0
+### What M5 produces, since 0.2.0 / 1.7.5 / 1.6.0
 
 M5 no longer ends as analysis. Three changes, in the order they matter:
 
@@ -458,3 +458,11 @@ carried that file and the last four in a row did not.
 
 `1.5.40` — the bundled `feature-adr` Step-8 module now describes the amendment gate as the command
 `dz amendment-check` instead of a judgement the reviewer is asked to make. Text only; no pipeline change.
+
+### Shared Markdown masking in feature-adr gates
+
+The standalone plan-completeness gate ships with `markdown-masker.mjs`, copied byte-for-byte from
+harness-core's `src/markdown-masker.ts`. It runs without a core build. Amendment checks, swarm briefs
+and K2 share the parser while retaining their existing unclosed-block and indentation policies.
+The four-space indented-code gap remains open for amendment checks and K2; swarm briefs retain their
+existing masking of indented code. Versions are unchanged in this staged change.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dzhechkov/keysarium",
-  "version": "1.7.3",
+  "version": "1.7.5",
   "description": "AI Case Research Toolkit for Claude Code — full 7-phase pipeline with feature-adr, dream cycles, background workers, multi-platform support, reward learning, and Cloud.ru AI Factory mapping (--ai-factory flag)",
   "main": "src/cli.js",
   "bin": {
@@ -34,12 +34,12 @@
   },
   "repository": {
     "type": "git",
-    "url": "https://github.com/djd1m/dz-harness-hub.git",
+    "url": "git+https://github.com/djd1m/dz-harness.git",
     "directory": "packages/@dzhechkov/keysarium"
   },
-  "homepage": "https://github.com/djd1m/dz-harness-hub/tree/main/packages/@dzhechkov/keysarium#readme",
+  "homepage": "https://github.com/djd1m/dz-harness/tree/main/packages/@dzhechkov/keysarium#readme",
   "bugs": {
-    "url": "https://github.com/djd1m/dz-harness-hub/issues"
+    "url": "https://github.com/djd1m/dz-harness/issues"
   },
   "peerDependencies": {
     "@dzhechkov/keysarium-core": "^1.1.0"

package/sbom.json

@@ -15,7 +15,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "1b64bc03bcb9c05471a15381196d4f8a30879a798a74e5d1fda98c33846b5cb2"
+          "content": "e2f661392b2862870ae3ab05892493e5a7ddcdb86360690d126525f08b6d87a1"
         }
       ]
     },
@@ -49,7 +49,7 @@
         },
         {
           "name": "dz:canonical-json-sha256-v2",
-          "value": "60d5df9bae91533c201784ba53a7b6f24405d7fe9ddceddea88110f2ed0d99f4"
+          "value": "56048c9ebf810b35645674fe4a413112af02be6a53836583d3c80b0ad4047dde"
         }
       ]
     },
@@ -1209,7 +1209,17 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "630eb9047258ad0333082f407cd34522e4c278650f22ef6dba1ef897ec5cce71"
+          "content": "cbe70a524f6ce7987b5e3961ee412b92c24c00d84066d438c759659d656efaa2"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": "templates/.claude/skills/feature-adr/scripts/markdown-masker.mjs",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "82c3c48c25f400f3a64d1caba3d47357f3db87460f0746f88706f901eb6ff689"
         }
       ]
     },
@@ -1679,7 +1689,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "11e2e101c99d42306ac1d0931475c5a8899e929514e41a393b6173e03856cfc3"
+          "content": "d9dd399cbb60d6b5fa9734ad44128a49790ef15bbde25c809d69d5c918601eb3"
         }
       ]
     },

package/templates/.claude/skills/feature-adr/scripts/check-plan-completeness.mjs

@@ -51,6 +51,7 @@
 // the feature's own `00_complexity_assessment.md` acid-case table (rows shaped `| A<N> | … |`), or
 // supplied explicitly with `--acid=T1,T2,…`. If neither establishes a corpus, C4 is SKIPPED-with-note
 // (a feature that declared no acid cases cannot be failed for not naming them).
+import { maskMarkdown } from './markdown-masker.mjs';
 import { readFileSync, readdirSync, existsSync } from 'node:fs';
 import { isAbsolute, join, resolve } from 'node:path';
 
@@ -180,7 +181,21 @@ if (adrFiles.length === 0 && TIER_REQUIRES_ADR) {
     const adr = readFileSync(join(adrDir, f), 'utf-8');
     const confIdx = adr.search(/^##+\s*Confirmation/mi);
     if (confIdx < 0) { failures.push(`C2: ${safe(f)} has no Confirmation section`); continue; }
-    const conf = adr.slice(confIdx);
+    // The section ENDS at the next heading of the same or higher level — it does not run to EOF.
+    // Slicing to EOF swallowed every later section, so a `Links` entry citing an existing test as
+    // PRECEDENT was read as this ADR's own Confirmation and demanded of the plan (measured
+    // 2026-08-31 on features/finding-identity-closure: reqe.test.ts, cited under
+    // "Implementation precedent", failed C2 while the real Confirmation test was named correctly).
+    // Deeper subsections stay inside: a Confirmation with ### children is one section.
+    const rest = adr.slice(confIdx);
+    const confLevel = (rest.match(/^(#+)/) || ['', '##'])[1].length;
+    // Search AFTER the Confirmation heading's own line — searching from the heading itself matches
+    // it and collapses the section to nothing, which turns a scoping fix into a gate that reports
+    // "Confirmation names no test file paths" for every ADR (caught by running it).
+    const bodyStart = rest.indexOf('\n') + 1;
+    const afterHeading = rest.slice(bodyStart);
+    const nextHeading = afterHeading.search(new RegExp('^#{1,' + confLevel + '}[^#]', 'm'));
+    const conf = nextHeading < 0 ? rest : rest.slice(0, bodyStart + nextHeading);
     const paths = extractCandidatePaths(conf).filter(isTestPath);
     // UNKNOWN ECOSYSTEM STAYS A FAILURE, never a WARN: a gate that downgrades itself on the one
     // repo it cannot read is a gate that is off exactly where it is needed. The remedy is named
@@ -305,21 +320,7 @@ else for (const t of acidTokens) if (!new RegExp(`\\b${t.replace(/[.*+?^${}()|[\
   // `## Amendments` could become the section heading, and a fenced example row could either open a
   // phantom amendment or hand a real testless one someone else's marker. Third fence-blindness
   // found in a checker today, so it is closed here by construction rather than by care.
-  const rawLines = plan.split('\n');
-  const planLines = [];
-  {
-    let fence = null;
-    for (const line of rawLines) {
-      const open = /^ {0,3}(```+|~~~+)/.exec(line);
-      if (fence === null && open) { fence = open[1][0]; planLines.push(''); continue; }
-      if (fence !== null) {
-        planLines.push('');
-        if (new RegExp('^ {0,3}' + fence + '{3,}\\s*$').test(line)) fence = null;
-        continue;
-      }
-      planLines.push(line);
-    }
-  }
+  const planLines = maskMarkdown(plan, { unclosed: 'mask' }).split('\n');
   let sectionStart = -1, sectionEnd = -1, cursor = 0;
   for (const pl of planLines) {
     // The SAME heading shape amendment-trace.ts accepts: up to three leading spaces, two to four

package/templates/.claude/skills/feature-adr/scripts/markdown-masker.mjs

@@ -0,0 +1,109 @@
+/**
+ * Canonical Markdown block masker; copied byte-for-byte as markdown-masker.mjs beside K2.
+ * Keep this file valid JavaScript (inferred TS types, no build needed by the copy).
+ *
+ * CommonMark fences and type-2 HTML comments; same UTF-16 length and newline positions.
+ * Inline code cannot open an HTML block. HTML delimiters within a block are consumed left to
+ * right, including close/reopen on one line. This is not a complete CommonMark parser.
+ *
+ * Reader policies are deliberate: amendment-trace restores unclosed blocks; brief/K2 hide them.
+ * Four-space code is still unsupported by default. ONLY brief keeps its pre-existing policy.
+ * Containers, tab indentation and HTML block types other than comments remain unsupported.
+ * Callbacks expose line facts; callers own semantic diagnostics and list-barrier representation.
+ */
+export function maskMarkdown(md = '', {
+  unclosed = 'restore',
+  indentedCode = false,
+  inlineComments = false,
+  onMasked = (_line = 0) => {},
+  onDisputed = (_line = 0) => {},
+} = {}) {
+  const lines = md.split('\n');
+  const out = lines.slice();
+  const masked = lines.map(() => false);
+  let state = 'text';
+  let marker = '';
+  let markerLength = 0;
+  let openedAt = -1;
+  let nestedOpener = false;
+  let disputed = false;
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i] ?? '';
+    const blank = () => { out[i] = ' '.repeat(line.length); masked[i] = true; };
+    if (state === 'fence') {
+      blank();
+      const close = /^ {0,3}(`{3,}|~{3,})\s*$/.exec(line);
+      if (close) {
+        const run = close[1] ?? '';
+        if (run[0] === marker && run.length >= markerLength) {
+          state = 'text';
+          openedAt = -1;
+        }
+      }
+      continue;
+    }
+    if (state === 'text') {
+      const fence = /^ {0,3}(`{3,}|~{3,})([^\n]*)$/.exec(line);
+      if (fence && !(fence[1]?.[0] === '`' && fence[2]?.includes('`'))) {
+        const run = fence[1] ?? '';
+        state = 'fence';
+        marker = run[0] ?? '';
+        markerLength = run.length;
+        openedAt = i;
+        blank();
+        continue;
+      }
+      if (indentedCode && /^ {4,}/.test(line)) {
+        blank();
+        continue;
+      }
+    }
+    // Outside HTML only a block opener counts: code-spanned delimiters in prose are inert.
+    // Inside HTML, backticks are literal and do not protect a delimiter.
+    const htmlStart = /^ {0,3}<!--/.test(line);
+    const wasDisputed = disputed;
+    // Ambiguity is diagnostic state, never permission to scan otherwise-visible prose.
+    // Brief deliberately keeps that diagnostic across blocks until the author's outer close;
+    // block-only readers must not hide an unrelated arrow or opener because it is pending.
+    if (state === 'html' || htmlStart || inlineComments) {
+      let maskLine = state === 'html' || htmlStart;
+      const tokens = [...line.matchAll(/`+|<!--|-->/g)];
+      for (let t = 0; t < tokens.length; t++) {
+        const token = tokens[t];
+        if (!token) continue;
+        if (token[0][0] === '`') {
+          // Code spans require an EXACT matching run; a shorter embedded run is literal.
+          // HTML blocks treat backticks literally. Inline-comment support is brief's existing
+          // policy; other readers only enter this scan at a block opener or while disputed.
+          if (state !== 'html') {
+            const end = tokens.findIndex((next, j) => j > t && next[0] === token[0]);
+            if (end >= 0) t = end;
+          }
+          continue;
+        }
+        if (token[0] === '<!--') {
+          if (state === 'html') nestedOpener = true;
+          else { state = 'html'; openedAt = i; }
+          maskLine = true;
+        } else if (state === 'html') {
+          state = 'text';
+          openedAt = -1;
+          if (nestedOpener) { disputed = true; nestedOpener = false; }
+        } else if (disputed) {
+          disputed = false;
+          maskLine = true;
+        }
+      }
+      if (maskLine) blank();
+    }
+    if (wasDisputed || disputed) onDisputed(i);
+  }
+  if (openedAt >= 0 && unclosed === 'restore') {
+    for (let i = openedAt; i < lines.length; i++) {
+      out[i] = lines[i] ?? '';
+      masked[i] = false;
+    }
+  }
+  for (let i = 0; i < masked.length; i++) if (masked[i]) onMasked(i);
+  return out.join('\n');
+}

package/templates/.claude/skills/reverse-engineering-unicorn/modules/025-cjm-prototype.md

@@ -144,7 +144,27 @@ const CJM_META = {
 // Lock result (✅)
 ```
 
-**Design адаптация под {INDUSTRY}:**
+**Design: откуда берётся облик. Порядок приоритета, и он не симметричен.**
+
+Прежде чем открывать таблицу ниже, ответьте на один вопрос: **воспроизводит ли проект НАЗВАННЫЙ
+существующий продукт, и снят ли его облик?**
+
+| Состояние источника | Откуда берётся палитра/типографика/тон |
+|---|---|
+| источник назван, облик **СНЯТ** | **из снятого облика источника** — таблица ниже НЕ применяется |
+| источник назван, облик **НЕ ИЗМЕРЕН** (не удалось снять) | таблица ниже — как **ФОЛБЭК**, и он подписывается словом «фолбэк» вместе с причиной, по которой облик не сняли |
+| **источника нет** (продукт не воспроизводится) | таблица ниже — как **ФОЛБЭК** по отрасли, и он тоже подписывается |
+
+Почему это не две равноправные ветви. Отраслевая палитра — это догадка о том, как продукт мог бы
+выглядеть. Когда есть живой источник, догадка не «одна из двух опций»: она хуже измерения ровно
+настолько, насколько выдуманное отличается от наблюдённого. Прототип, который тихо подставил
+Emerald, потому что проект про здоровье, читается точно так же, как прототип, у которого Emerald
+измерен у источника — и именно эта неразличимость и есть дефект.
+
+Подпись обязательна во всех состояниях, включая «источника нет»: неподписанная палитра и
+подписанная выглядят одинаково для следующего читателя, а значат разное.
+
+**Design адаптация под {INDUSTRY} — ФОЛБЭК, применяется только в двух нижних состояниях:**
 
 | Industry | Палитра | Иконки | Тон |
 |----------|---------|--------|-----|