@dzhechkov/p-replicator 1.10.3 → 1.12.0

package/tests/e2e/packed-insights-writer.test.js

@@ -0,0 +1,308 @@
+'use strict';
+
+const { test, describe, before, after } = require('node:test');
+const assert = require('node:assert/strict');
+const { spawnSync } = require('node:child_process');
+const crypto = require('node:crypto');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+
+const PKG = path.resolve(__dirname, '..', '..');
+const NPM = process.platform === 'win32' ? 'npm.cmd' : 'npm';
+const MISSING_HINT = 'инсайтов пока нет; /myinsights создаст первую запись\n';
+const LOCAL_PACKED = 'PACKED_LOCAL_ONLY';
+const DZ_PACKED = 'PACKED_DZ_ONLY';
+let packDir;
+let tarball;
+let tarballSha256;
+
+function run(file, args, options = {}) {
+  return spawnSync(file, args, { encoding: 'utf8', ...options });
+}
+
+function assertOk(result, label) {
+  assert.equal(result.status, 0,
+    `${label} failed\nstdout:\n${result.stdout || ''}\nstderr:\n${result.stderr || ''}`);
+}
+
+function assertConsumerPath(candidate, consumer) {
+  const realCandidate = fs.realpathSync(candidate);
+  const realConsumer = fs.realpathSync(consumer);
+  const relative = path.relative(realConsumer, realCandidate);
+  assert.ok(relative && !relative.startsWith('..' + path.sep) && !path.isAbsolute(relative),
+    `source-only evidence rejected: ${realCandidate} is outside packed consumer ${realConsumer}`);
+  return realCandidate;
+}
+
+function installConsumer() {
+  const consumer = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'p-rep-packed-consumer-')));
+  fs.writeFileSync(path.join(consumer, 'package.json'),
+    JSON.stringify({ name: 'packed-insights-consumer', private: true }) + '\n');
+  const install = run(NPM, [
+    'install', '--ignore-scripts', '--omit=optional', '--no-audit', '--no-fund',
+    '--no-package-lock', tarball,
+  ], { cwd: consumer });
+  assertOk(install, 'fresh tarball install');
+
+  const packageRoot = path.join(consumer, 'node_modules', '@dzhechkov', 'p-replicator');
+  const cli = assertConsumerPath(path.join(packageRoot, 'bin', 'cli.js'), consumer);
+  const init = run(process.execPath, [cli, 'init'], { cwd: consumer });
+  assertOk(init, 'packed init');
+  return { consumer, packageRoot, cli };
+}
+
+function insight(overrides = {}) {
+  return {
+    date: '2026-08-30',
+    title: 'Packed writer creates the first carrier',
+    tags: ['packed', 'insights'],
+    problem: 'Source-only checks cannot prove what npm consumers receive.',
+    solution: 'Install and execute the exact npm pack tarball.',
+    references: ['tests/e2e/packed-insights-writer.test.js'],
+    ...overrides,
+  };
+}
+
+function runPackedWriter(consumer, input, options = {}) {
+  const writer = assertConsumerPath(
+    path.join(consumer, '.claude', 'hooks', 'write-insight.cjs'), consumer);
+  return run(process.execPath, [writer], {
+    cwd: path.join(consumer, '.claude'),
+    env: { ...process.env, PATH: options.path === undefined ? '' : options.path,
+      CLAUDE_PROJECT_DIR: consumer },
+    input: JSON.stringify(input),
+  });
+}
+
+function parseReceipt(result) {
+  assertOk(result, 'packed writer');
+  return JSON.parse(result.stdout);
+}
+
+function fakeDz(mode) {
+  const bin = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'p-rep-fake-dz-')));
+  const script = path.join(bin, 'dz.js');
+  const outcome = mode === 'ok'
+    ? `process.stdout.write(${JSON.stringify(JSON.stringify([
+      { pattern: DZ_PACKED, domain: 'p-replicator-insights' },
+    ]))});`
+    : mode === 'empty'
+      ? "process.stdout.write('[]');"
+      : 'process.exitCode = 19;';
+  fs.writeFileSync(script, `'use strict';\n${outcome}\n`);
+  if (process.platform === 'win32') {
+    fs.writeFileSync(path.join(bin, 'dz.cmd'),
+      `@\"${process.execPath}\" \"%~dp0\\dz.js\" %*\r\n`);
+  } else {
+    const executable = path.join(bin, 'dz');
+    fs.writeFileSync(executable, `#!${process.execPath}\nrequire('./dz.js');\n`, { mode: 0o700 });
+  }
+  return bin;
+}
+
+function runPackedPrompt(consumer, pathValue) {
+  const hook = assertConsumerPath(
+    path.join(consumer, '.claude', 'hooks', 'session-insights.cjs'), consumer);
+  return run(process.execPath, [hook], {
+    cwd: path.join(consumer, '.claude'),
+    env: { ...process.env, PATH: pathValue, CLAUDE_PROJECT_DIR: consumer },
+    input: JSON.stringify({ hook_event_name: 'UserPromptSubmit', prompt: 'packed fallback' }),
+  });
+}
+
+function promptContext(result, label) {
+  assertOk(result, label);
+  const lines = result.stdout.trimEnd().split('\n');
+  assert.equal(lines.length, 1, `${label} emitted ${lines.length} envelopes`);
+  return JSON.parse(lines[0]).hookSpecificOutput.additionalContext;
+}
+
+before(() => {
+  packDir = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'p-rep-pack-')));
+  const packed = run(NPM, ['pack', '--json', '--pack-destination', packDir], { cwd: PKG });
+  assertOk(packed, 'npm pack --json');
+  const receipt = JSON.parse(packed.stdout);
+  assert.equal(receipt.length, 1, 'npm pack must identify exactly one consumer artifact');
+  tarball = path.join(packDir, receipt[0].filename);
+  assert.ok(fs.existsSync(tarball), 'npm pack receipt names a missing tarball');
+  tarballSha256 = crypto.createHash('sha256').update(fs.readFileSync(tarball)).digest('hex');
+  process.stdout.write(`# packed artifact ${path.basename(tarball)} sha256=${tarballSha256}\n`);
+});
+
+after(() => {
+  if (packDir) fs.rmSync(packDir, { recursive: true, force: true });
+});
+
+describe('PR-022 exact packed artifact', () => {
+  test('P10-packed - absent dz emits local only without dz error text', () => {
+    const { consumer } = installConsumer();
+    try {
+      assert.equal(parseReceipt(runPackedWriter(consumer,
+        insight({ title: LOCAL_PACKED }))).status, 'created');
+      const context = promptContext(runPackedPrompt(consumer, ''), 'packed absent recall');
+      assert.match(context, new RegExp(LOCAL_PACKED));
+      assert.doesNotMatch(context, new RegExp(DZ_PACKED));
+      assert.doesNotMatch(context, /dz recall unavailable/i);
+    } finally { fs.rmSync(consumer, { recursive: true, force: true }); }
+  });
+
+  test('P11-packed - armed recall emits dz only', () => {
+    const { consumer } = installConsumer();
+    const bin = fakeDz('ok');
+    try {
+      assert.equal(parseReceipt(runPackedWriter(consumer,
+        insight({ title: LOCAL_PACKED }))).status, 'created');
+      const context = promptContext(runPackedPrompt(consumer, bin), 'packed armed recall');
+      assert.match(context, new RegExp(DZ_PACKED));
+      assert.doesNotMatch(context, new RegExp(LOCAL_PACKED));
+    } finally {
+      fs.rmSync(bin, { recursive: true, force: true });
+      fs.rmSync(consumer, { recursive: true, force: true });
+    }
+  });
+
+  test('P12-packed - failing recall names degradation and emits local only', () => {
+    const { consumer } = installConsumer();
+    const bin = fakeDz('failing');
+    try {
+      assert.equal(parseReceipt(runPackedWriter(consumer,
+        insight({ title: LOCAL_PACKED }))).status, 'created');
+      const context = promptContext(runPackedPrompt(consumer, bin), 'packed failing recall');
+      assert.match(context, /dz recall unavailable: exit 19; using local recent insights/i);
+      assert.match(context, new RegExp(LOCAL_PACKED));
+      assert.doesNotMatch(context, new RegExp(DZ_PACKED));
+    } finally {
+      fs.rmSync(bin, { recursive: true, force: true });
+      fs.rmSync(consumer, { recursive: true, force: true });
+    }
+  });
+
+  test('P13-packed - empty recall emits local only', () => {
+    const { consumer } = installConsumer();
+    const bin = fakeDz('empty');
+    try {
+      assert.equal(parseReceipt(runPackedWriter(consumer,
+        insight({ title: LOCAL_PACKED }))).status, 'created');
+      const context = promptContext(runPackedPrompt(consumer, bin), 'packed empty recall');
+      assert.match(context, new RegExp(LOCAL_PACKED));
+      assert.doesNotMatch(context, new RegExp(DZ_PACKED));
+      assert.doesNotMatch(context, /dz recall unavailable/i);
+    } finally {
+      fs.rmSync(bin, { recursive: true, force: true });
+      fs.rmSync(consumer, { recursive: true, force: true });
+    }
+  });
+
+  test('P1 — packed harvest writer creates, appends, and deduplicates from a missing carrier without dz', () => {
+    const { consumer, packageRoot } = installConsumer();
+    try {
+      assert.match(tarballSha256, /^[a-f0-9]{64}$/);
+      assert.equal(fs.existsSync(path.join(consumer, '.claude', 'insights')), false,
+        'fresh init must leave the legitimate missing state intact');
+      const harvest = assertConsumerPath(
+        path.join(packageRoot, 'templates', '.claude', 'commands', 'harvest.md'), consumer);
+      assert.ok((fs.readFileSync(harvest, 'utf8').match(/insight/gi) || []).length > 0,
+        'the packed command has no insight-writer binding');
+
+      assert.equal(parseReceipt(runPackedWriter(consumer, insight())).status, 'created');
+      const index = path.join(consumer, '.claude', 'insights', 'index.md');
+      const first = fs.readFileSync(index);
+      const second = insight({ title: 'Packed append keeps prior bytes', tags: ['append'] });
+      assert.equal(parseReceipt(runPackedWriter(consumer, second)).status, 'appended');
+      assert.ok(fs.readFileSync(index).subarray(0, first.length).equals(first));
+      const beforeReplay = fs.readFileSync(index);
+      assert.equal(parseReceipt(runPackedWriter(consumer,
+        { ...second, date: '2026-08-31' })).status, 'duplicate');
+      assert.deepEqual(fs.readFileSync(index), beforeReplay);
+      assert.equal(fs.existsSync(path.join(consumer, '.dz')), false,
+        'the markdown lifecycle must not create dz state');
+    } finally { fs.rmSync(consumer, { recursive: true, force: true }); }
+  });
+
+  test('P17 - deleting .dz retains the packed Markdown record and local delivery', () => {
+    const { consumer } = installConsumer();
+    try {
+      const record = insight({ title: LOCAL_PACKED });
+      const written = parseReceipt(runPackedWriter(consumer, record, { path: process.env.PATH }));
+      assert.equal(written.status, 'created');
+      assert.equal(written.teach.state, 'ok');
+
+      const query = run('dz', ['recall', '--all', '--json', '--project', consumer], {
+        cwd: consumer,
+        env: process.env,
+        timeout: 5000,
+      });
+      assertOk(query, 'packed real dz query');
+      assert.ok(JSON.parse(query.stdout).some((row) =>
+        row.domain === 'p-replicator-insights' && row.pattern.includes(LOCAL_PACKED)),
+      'the exact packed writer did not establish the temporary learned projection');
+
+      const index = path.join(consumer, '.claude', 'insights', 'index.md');
+      const before = fs.readFileSync(index);
+      const dzState = path.join(consumer, '.dz');
+      assert.ok(fs.existsSync(dzState), 'real dz did not establish the deletion fixture');
+      fs.rmSync(dzState, { recursive: true, force: true });
+      assert.deepEqual(fs.readFileSync(index), before,
+        'removing only .dz must not change one Markdown byte');
+
+      const context = promptContext(runPackedPrompt(consumer, ''), 'packed fallback after .dz removal');
+      assert.match(context, new RegExp(LOCAL_PACKED));
+      assert.doesNotMatch(context, new RegExp(DZ_PACKED));
+    } finally { fs.rmSync(consumer, { recursive: true, force: true }); }
+  });
+
+  test('P1 - packed harvest writer completes the absent-create-append-delete lifecycle without dz', () => {
+    const { consumer, cli } = installConsumer();
+    try {
+      const index = path.join(consumer, '.claude', 'insights', 'index.md');
+      assert.equal(parseReceipt(runPackedWriter(consumer, insight())).status, 'created');
+      assert.equal(parseReceipt(runPackedWriter(consumer,
+        insight({ title: 'A distinct second record', solution: 'Append it.' }))).status, 'appended');
+
+      fs.rmSync(path.join(consumer, '.claude', 'insights'), { recursive: true, force: true });
+      const hook = assertConsumerPath(
+        path.join(consumer, '.claude', 'hooks', 'session-insights.cjs'), consumer);
+      const missing = run(process.execPath, [hook], {
+        cwd: path.join(consumer, '.claude'),
+        env: { ...process.env, PATH: '', CLAUDE_PROJECT_DIR: consumer },
+      });
+      assertOk(missing, 'packed missing-carrier hook');
+      assert.equal(missing.stdout, MISSING_HINT);
+      assert.equal(fs.existsSync(path.dirname(index)), false,
+        'the SessionStart reader must leave the carrier absent');
+
+      const doctor = run(process.execPath, [cli, 'doctor'], { cwd: consumer });
+      assertOk(doctor, 'packed doctor after carrier removal');
+      assert.match(doctor.stdout, /insights carrier:\s*NOT STARTED/i);
+      assert.match(doctor.stdout, /\.claude\/insights\/index\.md/);
+
+      assert.equal(parseReceipt(runPackedWriter(consumer,
+        insight({ date: '2026-08-31' }))).status, 'created');
+      assert.ok(fs.existsSync(index), 'the next real write must recreate the removed carrier');
+      assert.equal(fs.existsSync(path.join(consumer, '.dz')), false);
+    } finally { fs.rmSync(consumer, { recursive: true, force: true }); }
+  });
+
+  test('P4 - packed doctor names a removed insights carrier without failing', () => {
+    const { consumer, cli } = installConsumer();
+    try {
+      assert.equal(parseReceipt(runPackedWriter(consumer, insight())).status, 'created');
+      fs.rmSync(path.join(consumer, '.claude', 'insights'), { recursive: true, force: true });
+      const doctor = run(process.execPath, [cli, 'doctor'], { cwd: consumer });
+      assertOk(doctor, 'packed doctor missing-state preservation');
+      assert.match(doctor.stdout, /insights carrier:\s*NOT STARTED/i);
+      assert.match(doctor.stdout, /no \.claude\/insights\/index\.md/i);
+    } finally { fs.rmSync(consumer, { recursive: true, force: true }); }
+  });
+
+  test('P5 - source-only evidence cannot satisfy packed acceptance', () => {
+    const consumer = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'p-rep-provenance-')));
+    try {
+      const checkoutHook = path.join(PKG, 'templates', '.claude', 'hooks', 'session-insights.cjs');
+      assert.throws(() => assertConsumerPath(checkoutHook, consumer),
+        /source-only evidence rejected/,
+        'the provenance safeguard must fire on a real checkout path');
+    } finally { fs.rmSync(consumer, { recursive: true, force: true }); }
+  });
+});

package/tests/fixtures/prep-traceability-fixture/docs/features/order-refund/01_specification.md

@@ -0,0 +1,29 @@
+# Specification — Order refund
+
+<!-- FIXTURE: prep-traceability-fixture / feature slug order-refund. Not a live project artifact. -->
+
+## Requirements
+
+### FR-order-refund-1 — Validate refund eligibility
+
+The service must accept a refund request only while its order is inside the refund window.
+
+Acceptance scenarios:
+
+- `SC-FR-order-refund-1-1`: Given an eligible paid order, when the buyer requests a refund, then validation succeeds.
+
+### FR-order-refund-2 — Notify the buyer
+
+The service must notify the buyer after the refund request is accepted.
+
+Acceptance scenarios:
+
+- `SC-FR-order-refund-2-1`: Given an accepted refund request, when processing completes, then the buyer receives a confirmation.
+
+### FR-order-refund-3 — Record the audit event
+
+The service must append an immutable audit event for every accepted refund request.
+
+Acceptance scenarios:
+
+- `SC-FR-order-refund-3-1`: Given an accepted refund request, when it is persisted, then an audit event records the order and request identifiers.

package/tests/fixtures/prep-traceability-fixture/docs/features/order-refund/02_pseudocode.md

@@ -0,0 +1,57 @@
+# Pseudocode — Order refund
+
+<!-- FIXTURE: prep-traceability-fixture / feature slug order-refund. Not a live project artifact. -->
+
+## Core Algorithms
+
+### Algorithm: Validate refund eligibility
+
+REQUIREMENT: `FR-order-refund-1`
+
+REALISES: `SC-FR-order-refund-1-1`
+
+INPUT: order, current time
+
+OUTPUT: eligibility decision
+
+STEPS:
+
+1. Reject an order that is not paid.
+2. Compare the current time with the refund-window deadline.
+3. Return the eligibility decision.
+
+COMPLEXITY: O(1)
+
+### Algorithm: Record the refund audit event
+
+REQUIREMENT: `FR-order-refund-3`
+
+REALISES: `SC-FR-order-refund-3-1`
+
+INPUT: order identifier, refund request identifier
+
+OUTPUT: persisted audit event
+
+STEPS:
+
+1. Build an immutable audit event from both identifiers.
+2. Append the event to the order audit stream.
+3. Return the persisted event.
+
+COMPLEXITY: O(1)
+
+## Scenario Coverage
+
+Scenarios in Specification.md: 3 · claimed by an algorithm: 2
+
+Not claimed by any algorithm:
+
+| Scenario | Reason |
+|---|---|
+| FR-order-refund-2 | out-of-mvp-scope |
+
+Claimed by an algorithm but absent from Specification.md:
+
+| Algorithm | Claimed ID |
+|---|---|
+| none | none |

package/tests/snapshot/baseline.json

@@ -1,38 +1,42 @@
 {
-  "generatedAt": "2026-08-27T15:11:31.068Z",
-  "totalFiles": 138,
+  "generatedAt": "2026-08-31T05:41:46.211Z",
+  "totalFiles": 142,
   "files": {
     ".claude/agents/doc-validator.md": "e57950758cd4764b2cb54b3f1905567e9dbc1ed20ac6ecd30998614894689f4f",
-    ".claude/agents/harvest-coordinator.md": "70fa884057669902e18744915305705cf9e45e738a83d7bb5ab011a3b72d683c",
+    ".claude/agents/harvest-coordinator.md": "71e524e8379df46bbf457dbc1d4480634e05c99b7d3a4f59a356b8d71a0a4166",
     ".claude/agents/product-discoverer.md": "f74683fe91b4357d6fb4024ed47b4d5a129ea6375ca6b223dee97176d74acf1c",
     ".claude/agents/replicate-coordinator.md": "e86060110ab188109cf908878206543f414993e14dad01f8dc19f041ee6497a7",
     ".claude/commands/deploy.md": "27f5424ee217163c55e5e6b9322a1f0858159407bd24ebd6d6588d6c22a5f890",
     ".claude/commands/docs.md": "be03592cb3f1d61b60dc96d3e26d71281ad4eb2d4626012c080ce609a32c96e4",
-    ".claude/commands/feature.md": "3b605c004ae6d794dee30892956dc0a9536195e828929bdaff134f3e952e87bb",
-    ".claude/commands/go.md": "655dc9cad37b61a9f283cef15e435c492ee7cbc88a6ce59295ac32c975dee858",
-    ".claude/commands/harvest.md": "c074fe7799f594dda44c5f8166da707f25cee51b12f758dea562a8c1e6ac5dcd",
-    ".claude/commands/myinsights.md": "93258a3340f99a0f14b374746ae2934b01d7cefe06d575434868eb98da2d854a",
+    ".claude/commands/feature.md": "2df6ab3e6c015dc294955234192843c24a00e07784ac30994c7fe7572f8de775",
+    ".claude/commands/go.md": "df92c2ec060707638cc7d26d9c9e6a5fecc381e89915bdb0671c5489fb530574",
+    ".claude/commands/harvest.md": "5d78e189947b8c91602de89742099f25df4c85f5625299bd77bc073af667e155",
+    ".claude/commands/myinsights.md": "f31c5e133b5027197359e4179cbba1ab535f990634a69ea7c5c73bd2bc329d68",
     ".claude/commands/next.md": "1e4984306c3aa80dfc8734dc1c975dfe5fdf2cf6396ddd759e4c7635646107b8",
     ".claude/commands/plan.md": "6fef889f51168981bf4a98b8392a0d595e3d199e1cfaa8e08c0a181ec6c440e4",
-    ".claude/commands/replicate.md": "8862d0dc117815b1c3fc7f6e929996e2458783f1ac443eb70bc2a7ebe63a67c3",
+    ".claude/commands/replicate.md": "7dbf352a122f415bb987d3c968b905d5a9bda932e619382ce24f9ef2c099723a",
     ".claude/commands/run.md": "87144dfe8c56c15ba7c117daa544d8a08b84d7205f21dafcc48d27c6c3995059",
-    ".claude/commands/start.md": "4aaebc10ca8d607d4b2b43883d82392e9788c2f183878a49fc0d1ed54d07ee95",
+    ".claude/commands/start.md": "2c9d2bd450d6a8cd6f8f0e958b77ae4430efc745645a11300cf29e85dcb468a6",
     ".claude/hooks/autocommit-insights.cjs": "5e7cef87b24d457f25315d79fe15f0dfaf94d9269495d638817f0faee2593c6f",
     ".claude/hooks/autocommit-plans.cjs": "9bb404b7f4fda5de03e6c2f16bf8939a79ec1944538767b04bcccc6cf50cc03d",
     ".claude/hooks/autocommit-roadmap.cjs": "f4dcc9ffd9a3aed91dd56e011e699fcf8af903cc81594e4ab1ef61e5432a36ad",
     ".claude/hooks/check-docs-complete.cjs": "27c05c2adcedc806e395b30b455243193a4fbd0968ce96e415679e1f78db951a",
     ".claude/hooks/check-growth-trace.cjs": "91994fc109c8440306c9dd3d5eea176c533eb0818fcdb09bac2b309397d9908a",
-    ".claude/hooks/check-ports.cjs": "1813aa60e4d15c5f6ce54a9b3471c3772efe60c332316183c7ad8f5b619f2169",
-    ".claude/hooks/session-insights.cjs": "46f8357e3886a6d54db1ab4af969b9b8643ae5937ba59038a5651ffbcfd0d30e",
+    ".claude/hooks/check-ports.cjs": "2385687994c882ebb430cdf8ae2bef9309fe5ba284354671413dc134f8e17694",
+    ".claude/hooks/session-insights.cjs": "31fbe90d81b01dfb56557ed5d68dbde2211a14d5469c5d3761f45fb63c07c3a7",
     ".claude/hooks/state-update.cjs": "47146a76b768ac2273abe8f2f017856a0e28b45afaf90048148da417dd19604e",
-    ".claude/hooks/statusline.cjs": "465190ab21610357094fd6eba188ba9f7086dc5a933568f40a7f7c715ccd6745",
-    ".claude/rules/docker-ports.md": "bef41c25c875479341f68783c2d64572800d4710f55401e55519245f03d22efb",
-    ".claude/rules/feature-lifecycle.md": "f9ddc8c889ab7938a7207b36ae46c36be05e9b870956ef16617bf31b2f78c758",
+    ".claude/hooks/statusline.cjs": "5a842162e710b6cb07f59ee0711f2b190d5e505e4546ea01931ba4ba25be8228",
+    ".claude/hooks/write-insight.cjs": "743f2d85b037cf522dfaf4775947b0cd331e52f2f304e88360c160e0e8e9a589",
+    ".claude/rules/cost-of-detection-ladder.md": "f15309ee8f1494478ff7678380dbe8fc8eecd154be36d57c9090cd17126a07da",
+    ".claude/rules/docker-ports.md": "59eb430f29dd762e8b76ad6d1177fe8b5b250de007856c743387cb88ee157942",
+    ".claude/rules/feature-lifecycle.md": "4a7bb631bc3600c8aeb5a5a484258298688d87604ac5d2d3cacdff9139d05edc",
     ".claude/rules/git-workflow.md": "7d8d2ded47fcc0fb95da3dc226efa6cb3c80d6adf7296977588c181dfce20192",
-    ".claude/rules/insights-capture.md": "488d694caffe7a32915b0ec1beb7a84b223fe602722c5bb91ab8bf2785626387",
-    ".claude/rules/replicate-pipeline.md": "99289f711c34cfddddbef5328b74749fc63d1f74636c6a4e4d61caa202fad05d",
-    ".claude/rules/skill-interface-protocol.md": "7669309b0ae4330bc6cf6b26bd9cfc01d7b99a8e70c1f056a52574430db9378e",
-    ".claude/settings.json": "b1df6cf834ccfa227f3318a70862115c17838ab31253e9d8d89381b7763e61fd",
+    ".claude/rules/honest-configuration.md": "851bc28e9e2baf1043bc09b982f3df3431bc7af1e076f8ff9df3d6729835bad5",
+    ".claude/rules/insights-capture.md": "d529e6be79178636ca362d83366b1dd7a843371e8ba4f2b09d65c009fab52dc4",
+    ".claude/rules/replicate-pipeline.md": "fce6480a56bd4ab2d6908faac5985d7557527b1ca36ad597bb00feabca3688bd",
+    ".claude/rules/skill-interface-protocol.md": "c3f624d0a8a4c7e0f5744e529eb4486cc0589fdb732b9799bccc75091a6d63ca",
+    ".claude/rules/swarm-file-evidence.md": "c71a216dbc3fd633c30949823ceac354f8439b96279a1a8dd606afb1b3ef5c45",
+    ".claude/settings.json": "18db09827dce410667b93e2b1a41ef8e46d4431114733e4304a5fc2192b2fc66",
     ".claude/skills/brutal-honesty-review/evals/brutal-honesty-review.yaml": "855c155d55575e12aab23fb3a5fb2fada74d93974ff755dfedac6f2d5bd41f13",
     ".claude/skills/brutal-honesty-review/README.md": "2a026b4af50b21456e50424fbfa089cb983fbbaa0c68024c8c17c695bea25a57",
     ".claude/skills/brutal-honesty-review/resources/assessment-rubrics.md": "dac09c91c765e2211799cc230738fb72a966f47511edb872306a906e49640cbe",
@@ -95,7 +99,7 @@
     ".claude/skills/goap-research-ed25519/scripts/test_suite_completeness.py": "727c5d5b0dad215957012276ebc146397178255077e762ed7b88a60d8178d2ab",
     ".claude/skills/goap-research-ed25519/SKILL.md": "404cb696d537d29585ec35f97a86173a582cd6fcf8d5f172a4f5bbd75ec971a8",
     ".claude/skills/knowledge-extractor/examples/rate-limiting-extraction.md": "fab68772135532aaa7675dfca4ec068cfa68a847f964f872f201f08fb9ee4034",
-    ".claude/skills/knowledge-extractor/modules/01-agent-review.md": "53883f182c26c710190399a23193cddb4a94b0f35bb42169a353f354aae4083a",
+    ".claude/skills/knowledge-extractor/modules/01-agent-review.md": "33395c8b87c4d7d1f63dff0891aaebcf50e302cbe2026005b3c6d51817f35a70",
     ".claude/skills/knowledge-extractor/modules/02-classify.md": "3b6a59cde451fc89e2e683b7cd35f5535d12cc6072cd40ca35cf7d5f61eb78aa",
     ".claude/skills/knowledge-extractor/modules/03-decontextualize.md": "ecb082116577cb86dfa4f43066d3c6d61b5d4a70964cb9ed4f15c6311d526347",
     ".claude/skills/knowledge-extractor/modules/04-integrate.md": "15a31634dd52e87bcad78a2b612c821dcd11b91ed21f2ddb2cde741411aa287e",
@@ -137,7 +141,7 @@
     ".claude/skills/reverse-engineering-unicorn/references/jtbd-canvas.md": "7938e657af631109ca7b4752002c21ac84a7dad3a35cc522be088f814d102773",
     ".claude/skills/reverse-engineering-unicorn/SKILL.md": "20d6b667971f9749d091c1d47e2f75df957f259647cbb861ac54174280096c71",
     ".claude/skills/sparc-prd-mini/references/sparc-methodology.md": "9c93dafe8149590809ff6b27508d7df52c8efa7f31f8e8f8052b7124a6561fee",
-    ".claude/skills/sparc-prd-mini/SKILL.md": "71f97e269e8b1807550a4ef91b2f0ac4dd892a074781504890d33db8f32685d2",
+    ".claude/skills/sparc-prd-mini/SKILL.md": "29c74d628f86f79fe2ba7b4d2a69b34de332519b8a11c945568e59830535742a",
     ".claude/skills/sparc-prd-mini/templates/CLAUDE.md": "9eeb66752cc4dec5c3c3fa5a8f7cfc3dd282f75d245bd36835f690a945b534ed",
     ".claude/skills/sparc-prd-mini/templates/prd.md": "7b4497bc76bb421fae7a07ecb46af01e021412180a394a5487a3c3c42dc004b6"
   }

package/tests/snapshot/templates.test.js

@@ -9,6 +9,10 @@ const crypto = require('node:crypto');
 const PKG_DIR = path.resolve(__dirname, '..', '..');
 const TEMPLATES = path.join(PKG_DIR, 'templates');
 const BASELINE = path.join(__dirname, 'baseline.json');
+const DETECTION_LADDER = '.claude/rules/cost-of-detection-ladder.md';
+const PACK_LADDER = `templates/${DETECTION_LADDER}`;
+const MANIFEST = path.join(PKG_DIR, '.dz-manifest.json');
+const SBOM = path.join(PKG_DIR, 'sbom.json');
 
 function walk(dir, base = dir, out = []) {
   if (!fs.existsSync(dir)) return out;
@@ -29,6 +33,20 @@ function sha256(p) {
   return crypto.createHash('sha256').update(fs.readFileSync(p)).digest('hex');
 }
 
+function integrityProblems(signed, sbom, file, digest) {
+  const problems = [];
+  const manifestEntry = signed.manifest.files.find((entry) => entry.path === file);
+  if (!manifestEntry) problems.push(`manifest missing ${file}`);
+  else if (manifestEntry.sha256 !== digest) problems.push(`manifest digest mismatch for ${file}`);
+
+  const component = sbom.components.find((entry) => entry.name === file);
+  if (!component) problems.push(`SBOM missing ${file}`);
+  else if (component.hashes.find((entry) => entry.alg === 'SHA-256')?.content !== digest) {
+    problems.push(`SBOM digest mismatch for ${file}`);
+  }
+  return problems;
+}
+
 describe('snapshot: templates/', () => {
   test('baseline.json exists', () => {
     assert.ok(
@@ -37,6 +55,35 @@ describe('snapshot: templates/', () => {
     );
   });
 
+  test('baseline explicitly registers the consumer detection ladder', () => {
+    const baseline = JSON.parse(fs.readFileSync(BASELINE, 'utf8'));
+    assert.match(
+      baseline.files[DETECTION_LADDER] || '',
+      /^[a-f0-9]{64}$/,
+      `${DETECTION_LADDER} must have a SHA-256 entry in baseline.json`
+    );
+  });
+
+  test('signed manifest and SBOM register the settled detection-ladder digest', () => {
+    const digest = sha256(path.join(TEMPLATES, DETECTION_LADDER));
+    const signed = JSON.parse(fs.readFileSync(MANIFEST, 'utf8'));
+    const sbom = JSON.parse(fs.readFileSync(SBOM, 'utf8'));
+    assert.deepEqual(integrityProblems(signed, sbom, PACK_LADDER, digest), []);
+
+    const omitted = JSON.parse(JSON.stringify(signed));
+    omitted.manifest.files = omitted.manifest.files.filter((entry) => entry.path !== PACK_LADDER);
+    assert.deepEqual(integrityProblems(omitted, sbom, PACK_LADDER, digest),
+      [`manifest missing ${PACK_LADDER}`],
+      'removing the real manifest entry must fire the integrity safeguard');
+
+    const changed = JSON.parse(JSON.stringify(sbom));
+    const component = changed.components.find((entry) => entry.name === PACK_LADDER);
+    component.hashes.find((entry) => entry.alg === 'SHA-256').content = '0'.repeat(64);
+    assert.deepEqual(integrityProblems(signed, changed, PACK_LADDER, digest),
+      [`SBOM digest mismatch for ${PACK_LADDER}`],
+      'changing the real SBOM digest must fire the integrity safeguard');
+  });
+
   test('current templates match recorded baseline (no drift)', () => {
     const baseline = JSON.parse(fs.readFileSync(BASELINE, 'utf8'));
     const current = walk(TEMPLATES);

package/tests/unit/absence-is-not-emptiness.test.js

@@ -140,7 +140,21 @@ describe('an artifact that is there but says nothing is not verified', () => {
       const zero = run(dir, 'doctor');
       assert.equal(zero.code, 0, 'zero entries must not fail either: ' + zero.out);
 
-      fs.writeFileSync(idx, '# Insights\n\n## 2026-08-27 — a rake\n\nBody.\n');
+      const writer = path.join(dir, '.claude', 'hooks', 'write-insight.cjs');
+      const written = spawnSync(process.execPath, [writer], {
+        cwd: dir,
+        env: { ...process.env, CLAUDE_PROJECT_DIR: dir },
+        input: JSON.stringify({
+          date: '2026-08-30',
+          title: 'Doctor reads writer output',
+          tags: ['doctor'],
+          problem: 'A synthetic fixture could drift from the real writer format.',
+          solution: 'Create the populated state through the installed writer.',
+          references: ['tests/unit/absence-is-not-emptiness.test.js'],
+        }),
+        encoding: 'utf8',
+      });
+      assert.equal(written.status, 0, written.stderr || written.stdout);
       const some = run(dir, 'doctor');
       assert.equal(some.code, 0);
 

package/tests/unit/check-pipeline-gaps.test.js

@@ -0,0 +1,94 @@
+'use strict';
+
+const { describe, test } = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { spawnSync } = require('node:child_process');
+
+const PACKAGE_ROOT = path.resolve(__dirname, '..', '..');
+const CHECKER = path.join(PACKAGE_ROOT, 'scripts', 'check-pipeline-gaps.sh');
+
+function write(root, relative, body) {
+  const target = path.join(root, relative);
+  fs.mkdirSync(path.dirname(target), { recursive: true });
+  fs.writeFileSync(target, body);
+  return target;
+}
+
+function mapSource(root, relative, heading, values) {
+  const lines = Object.entries(values).map(([role, value]) => `  ${role}: ${value}`);
+  return write(root, relative, `${heading}\n\n\`\`\`yaml\nDOCUMENT_ROLE_MAP:\n${lines.join('\n')}\n\`\`\`\n`);
+}
+
+function run(root, featureMap, projectMap) {
+  const result = spawnSync('bash', [
+    CHECKER,
+    root,
+    '--traceability',
+    '--role-map-source', featureMap,
+    '--project-role-map-source', projectMap,
+  ], { encoding: 'utf8' });
+  return { status: result.status, output: `${result.stdout || ''}${result.stderr || ''}` };
+}
+
+describe('check-pipeline-gaps executable contract', () => {
+  test('ADR Confirmation — the real process compares structural FR NFR and AC keys', (t) => {
+    const root = fs.mkdtempSync(path.join(os.tmpdir(), 'p-replicator-checker-'));
+    t.after(() => fs.rmSync(root, { recursive: true, force: true }));
+    const roles = {
+      specification: 'requirements.md',
+      pseudocode: 'algorithms.md',
+      architecture: 'architecture.md',
+      refinement: 'refinement.md',
+      completion: 'completion.md',
+    };
+    const featureMap = mapSource(root, 'feature-map.md', '### Phase 1 document role map', roles);
+    const projectMap = mapSource(root, 'project-map.md', '### Project-level default', roles);
+    write(root, 'docs/features/payments/requirements.md', [
+      '### FR-payments-1 — charge',
+      '### NFR-payments-2 — latency',
+      '### AC-payments-3 — accepted',
+      '',
+    ].join('\n'));
+    write(root, 'docs/features/payments/algorithms.md', [
+      '### Algorithm: charge',
+      'REQUIREMENT: `FR-payments-1`',
+      'REQUIREMENT: `NFR-payments-2`',
+      'REQUIREMENT: `AC-payments-3`',
+      '',
+    ].join('\n'));
+
+    const result = run(root, featureMap, projectMap);
+    assert.equal(result.status, 0, result.output);
+    assert.match(result.output, /COUNT requirements=3 algorithms=3 missing-algorithm=0 orphan-algorithm=0/);
+    assert.match(result.output, /VERDICT traceability=PASS features=1 gaps=0 inconclusive=0/);
+  });
+
+  test('the default mode is the same role-mapped traceability contract', (t) => {
+    const root = fs.mkdtempSync(path.join(os.tmpdir(), 'p-replicator-default-mode-'));
+    t.after(() => fs.rmSync(root, { recursive: true, force: true }));
+    const roles = {
+      specification: 'requirements custom.md',
+      pseudocode: 'algorithms custom.md',
+      architecture: 'architecture custom.md',
+      refinement: 'refinement custom.md',
+      completion: 'completion custom.md',
+    };
+    const featureMap = mapSource(root, 'feature-map.md', '### Phase 1 document role map', roles);
+    const projectMap = mapSource(root, 'project-map.md', '### Project-level default', roles);
+    write(root, 'docs/requirements custom.md', '### FR-project-1 — mapped\n');
+    write(root, 'docs/algorithms custom.md',
+      '### Algorithm: mapped\nREQUIREMENT: `FR-project-1`\n');
+
+    const result = spawnSync('bash', [
+      CHECKER, root, '--role-map-source', featureMap,
+      '--project-role-map-source', projectMap,
+    ], { encoding: 'utf8' });
+    const output = `${result.stdout || ''}${result.stderr || ''}`;
+    assert.equal(result.status, 0, output);
+    assert.match(output, /TRACE contour=project/);
+    assert.match(output, /VERDICT traceability=PASS features=0 gaps=0 inconclusive=0/);
+  });
+});