@dzhechkov/p-replicator 1.5.18 → 1.6.0

package/templates/.claude/rules/replicate-pipeline.md

@@ -121,6 +121,9 @@ Always pass these constraints to sparc-prd-mini (Phase 1):
 - Infrastructure: VPS (AdminVPS/HOSTKEY)
 - Deploy: Docker Compose direct deploy
 - AI Integration: MCP servers
+- Storage: у баз и очередей НЕТ публикации на хост — кроме привязки к петле (`127.0.0.1` / `::1`).
+  Ни `0.0.0.0`, ни `[::]`, ни один явный внешний адрес, ни `network_mode: host`
+  (см. `.claude/rules/docker-ports.md`, «Правило №0»)
 
 ## Git Discipline During Pipeline
 
@@ -148,8 +151,8 @@ are project-agnostic and can be enhanced (read by Phase 3) but never recreated.
 **Agents (4):** `replicate-coordinator`, `product-discoverer`, `doc-validator`,
 `harvest-coordinator`
 
-**Rules (5):** `replicate-pipeline`, `skill-interface-protocol`, `git-workflow`,
-`insights-capture`, `feature-lifecycle`
+**Rules (6):** `replicate-pipeline`, `skill-interface-protocol`, `git-workflow`,
+`insights-capture`, `feature-lifecycle`, `docker-ports`
 
 **Hooks:** `.claude/settings.json` (SessionStart + Stop) + cross-platform Node
 scripts in `.claude/hooks/` (`session-insights.cjs`, `autocommit-roadmap.cjs`,

package/templates/.claude/settings.json

@@ -3,7 +3,7 @@
   "_comment": "Default hooks + statusline shipped by @dzhechkov/p-replicator init. Cross-platform Node scripts (no bash dependencies). Auto-commits roadmap/insights/plans on Stop, injects relevant insights on SessionStart. Statusline displays pipeline+roadmap+toolkit dashboard above the prompt. Project-specific hooks (DDD, fitness functions, etc.) are merged in by /replicate Phase 3.",
   "statusLine": {
     "type": "command",
-    "command": "node .claude/hooks/statusline.cjs"
+    "command": "node \"${CLAUDE_PROJECT_DIR}/.claude/hooks/statusline.cjs\""
   },
   "hooks": {
     "SessionStart": [
@@ -12,7 +12,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "node .claude/hooks/session-insights.cjs",
+            "command": "node \"${CLAUDE_PROJECT_DIR}/.claude/hooks/session-insights.cjs\"",
             "timeout": 5
           }
         ]
@@ -24,17 +24,17 @@
         "hooks": [
           {
             "type": "command",
-            "command": "node .claude/hooks/autocommit-roadmap.cjs",
+            "command": "node \"${CLAUDE_PROJECT_DIR}/.claude/hooks/autocommit-roadmap.cjs\"",
             "timeout": 10
           },
           {
             "type": "command",
-            "command": "node .claude/hooks/autocommit-insights.cjs",
+            "command": "node \"${CLAUDE_PROJECT_DIR}/.claude/hooks/autocommit-insights.cjs\"",
             "timeout": 10
           },
           {
             "type": "command",
-            "command": "node .claude/hooks/autocommit-plans.cjs",
+            "command": "node \"${CLAUDE_PROJECT_DIR}/.claude/hooks/autocommit-plans.cjs\"",
             "timeout": 10
           }
         ]

package/templates/.claude/skills/cc-toolkit-generator-enhanced/modules/01-detect-parse.md

@@ -1,7 +1,7 @@
 # Module: Detect & Parse
 
 Phase 1 of the CC-Toolkit-Generator Enhanced pipeline.
-Scans the documentation directory, detects the pipeline type, identifies project
+Scans the PROJECT ROOT (see `docs_path` below — it is the root, not `docs/`), detects the pipeline type, identifies project
 characteristics, and builds the Internal Project Model (IPM) used by all
 subsequent modules.
 
@@ -11,7 +11,7 @@ subsequent modules.
 
 | Parameter | Type | Description |
 |-----------|------|-------------|
-| `docs_path` | string | Path to documentation directory. In Claude.ai context this is `/mnt/user-data/uploads/`. In Claude Code / replicate context this is `docs/` (project root). |
+| `docs_path` | string | The directory every probe below resolves from. In Claude.ai context: `/mnt/user-data/uploads/`. In Claude Code / replicate context: **the PROJECT ROOT** — not `docs/`. It has to be the root, because the probes reach both `.ai-context/` (a root-level directory, beside `.claude/`) and `docs/…` below it; anchoring at `docs/` would force `../` on half of them. |
 
 No prior module output is required. This is the foundation module.
 
@@ -25,7 +25,7 @@ Scan `docs_path` recursively and catalog every file by category.
 
 ```
 SCAN docs_path FOR:
-  # SPARC pipeline files (top-level or docs/)
+  # SPARC pipeline files — under docs/ (replicate.md:233-243 writes them all there)
   PRD.md
   Solution_Strategy.md
   Specification.md
@@ -41,7 +41,8 @@ SCAN docs_path FOR:
   docs/prd/PRD.md
   docs/ddd/strategic/    # bounded-contexts.md, context-map.md
   docs/ddd/tactical/     # aggregates/, entities/, value-objects/, events/, repositories/
-  docs/adr/*.md          # ADR-001-*.md, ADR-002-*.md, ...
+  docs/adr/*.md          # ADR-001-*.md, ADR-002-*.md, ... (directory shape)
+  docs/ADR.md            # single-file shape — /replicate writes ALL decisions here
   docs/c4/*.mermaid      # context.mermaid, container.mermaid, component.mermaid
   docs/pseudocode/*.pseudo
   docs/tests/*.feature   # Gherkin scenarios
@@ -72,13 +73,18 @@ def detect_pipeline(docs_path: str) -> str:
     has_ddd       = exists(f"{docs_path}/docs/ddd/")
     has_ai_context = exists(f"{docs_path}/.ai-context/")
     has_gherkin   = glob(f"{docs_path}/docs/tests/*.feature")
-    has_adr       = len(glob(f"{docs_path}/docs/adr/*.md")) > 5
-    has_sparc_arch = exists(f"{docs_path}/Architecture.md")
-    has_sparc_sol  = exists(f"{docs_path}/Solution_Strategy.md")
+    # Pipeline-IDENTITY marker: the docs/adr/ DIRECTORY is an idea2prd fingerprint. The
+    # expression is deliberately unchanged (>5) so routing stays byte-identical for every
+    # existing project. The DECISION-presence flag `has_adr` (see Collector below) never
+    # participates in routing: it can now be true via docs/ADR.md — a /replicate fingerprint,
+    # not an idea2prd one — and flipping routing on it would silently reroute SPARC projects.
+    has_idea2prd_adr_dir = len(glob(f"{docs_path}/docs/adr/*.md")) > 5
+    has_sparc_arch = exists(f"{docs_path}/docs/Architecture.md")      # replicate.md:237 writes it here
+    has_sparc_sol  = exists(f"{docs_path}/docs/Solution_Strategy.md") # replicate.md:234 writes it here
 
     if has_ddd and has_ai_context:
         return "IDEA2PRD_FULL"      # Complete idea2prd-manual output
-    elif has_ddd or has_adr:
+    elif has_ddd or has_idea2prd_adr_dir:
         return "IDEA2PRD_PARTIAL"   # Partial idea2prd output
     elif has_sparc_arch and has_sparc_sol:
         return "SPARC"              # Full SPARC documentation set
@@ -88,12 +94,49 @@ def detect_pipeline(docs_path: str) -> str:
         return "MINIMAL"            # Basic PRD only, or mixed
 ```
 
+### ADR collector — ONE normalizer for both storage shapes
+
+ADRs arrive in two shapes: a `docs/adr/*.md` directory (idea2prd-manual, one decision per file) and
+a single `docs/ADR.md` (what `/replicate` writes). ONE collector handles both; no other step in this
+skill may glob ADR paths for itself — every consumer iterates `detected_docs.idea2prd.adrs`.
+
+```python
+def collect_adrs(docs_path: str) -> list:
+    entries = []
+    for f in glob(f"{docs_path}/docs/adr/*.md"):           # shape A: one decision per file
+        entries.append({ "id": id_from_filename(f),        # ADR-001-title.md -> "ADR-001"
+                         "title": first_heading(f),
+                         "source_path": f })
+    single = f"{docs_path}/docs/ADR.md"                    # shape B: /replicate's single file
+    if exists(single):
+        for section in split_on_h2_headings(read(single)): # each "## ..." heading opens one decision
+            entries.append({ "id": id_from_heading(section),   # "## ADR-003: X" -> "ADR-003"; else slug of title
+                             "title": heading_title(section),
+                             "source_path": single })
+    # STABLE-FIRST dedupe: keep the FIRST entry for a given id (falling back to title when an id is
+    # absent), and directory entries are appended first — so "directory wins" is a property of the
+    # ORDER above, not an unstated convention inside the helper.
+    return dedupe_stable_first_by_id_then_title(entries)   # both shapes present -> merged, no double-count
+
+has_adr = len(collect_adrs(docs_path)) > 0   # THE one definition — decisions, not files
+```
+
+Worked examples (the behavioural contract, verbatim acid ids):
+
+- **A1** — `docs/ADR.md` with two `##` sections ⇒ 2 entries, `has_adr: true`. The single-file shape
+  is a first-class citizen, not a fallback.
+- **A4** — `docs/ADR.md` exists but holds prose with NO `##` headings ⇒ 0 entries,
+  `has_adr: false`. A file is not a decision; presence of the path never flips the flag by itself.
+- **A5** — BOTH shapes present and `docs/adr/ADR-002-caching.md` duplicates the id of a `## ADR-002`
+  section ⇒ one merged list, the duplicate dropped (directory entry wins — it is the finer-grained
+  source).
+
 | Pipeline | Minimum Docs | Typical File Count |
 |----------|-------------|-------------------|
 | IDEA2PRD_FULL | `docs/ddd/` + `.ai-context/` | 30-50 files |
 | IDEA2PRD_PARTIAL | `docs/ddd/` or `docs/adr/` (>5) | 15-30 files |
-| SPARC | `Architecture.md` + `Solution_Strategy.md` | 8-11 files |
-| SPARC_MINIMAL | `Architecture.md` only | 2-5 files |
+| SPARC | `docs/Architecture.md` + `docs/Solution_Strategy.md` | 8-11 files |
+| SPARC_MINIMAL | `docs/Architecture.md` only | 2-5 files |
 | MINIMAL | PRD.md only | 1-3 files |
 
 ### Step 3: Detect Project Characteristics
@@ -116,7 +159,7 @@ IF any keyword found → has_external_apis = true
 #### 3b. `has_database`
 
 ```
-SCAN Architecture.md, Specification.md, docker-compose.yml,
+SCAN docs/Architecture.md, docs/Specification.md, docker-compose.yml (project root),
      ADR-*-data.md, repositories/*.md FOR:
   keywords: "PostgreSQL", "Postgres", "MongoDB", "MySQL", "Redis",
             "database", "Prisma", "TypeORM", "Drizzle", "Knex",
@@ -185,7 +228,7 @@ IPM = {
         events:         [paths] | [],
         repositories:   [paths] | []
       },
-      adrs:             [paths] | [],
+      adrs:             [{id, title, source_path}] | [],   // collect_adrs() output — entries, not bare paths
       c4_diagrams:      [paths] | [],
       pseudocode:       [paths] | [],
       gherkin_tests:    [paths] | [],
@@ -217,7 +260,7 @@ IPM = {
     has_ddd_strategic:  bool,   // same as has_ddd (alias for readability)
     has_gherkin:        bool,   // detected_docs.idea2prd.gherkin_tests non-empty
     has_fitness:        bool,   // detected_docs.idea2prd.fitness non-empty
-    has_adr:            bool,   // detected_docs.idea2prd.adr length > 0
+    has_adr:            bool,   // collect_adrs() output non-empty — the ONE definition (see ADR collector)
     has_c4:             bool,   // detected_docs.idea2prd.c4 non-empty
     has_ai_context:     bool,   // detected_docs.ai_context.readme non-null
     has_pseudocode:     bool,   // detected_docs.sparc.pseudocode OR idea2prd.pseudocode non-null
@@ -291,7 +334,7 @@ All of the following must be satisfied before the IPM is considered valid:
 
 | Check | Condition | Action on Failure |
 |-------|-----------|-------------------|
-| Minimum docs | SPARC: at least `PRD.md` + `Architecture.md` present | Halt. Ask user to upload missing docs. |
+| Minimum docs | SPARC: at least `docs/PRD.md` + `docs/Architecture.md` present | Halt. Ask user to upload missing docs. |
 | Minimum docs | idea2prd: at least `docs/ddd/` directory present | Halt. Ask user to upload missing docs. |
 | Pipeline resolved | `pipeline_type` is not ambiguous | If mixed signals, default to "SPARC" with unified mapping. |
 | Characteristics scanned | All 4 characteristic flags have been evaluated | Re-scan if any flag is missing. |

package/templates/.claude/skills/cc-toolkit-generator-enhanced/modules/02-analyze-map.md

@@ -128,7 +128,9 @@ DDD TACTICAL:
     - Event handlers           → PostToolUse hooks (P2)
 
 ADR DOCUMENTS:
-  FOR EACH adr/*.md:
+  # via detected_docs.idea2prd.adrs — the Module-1 collector output, BOTH storage
+  # shapes (docs/adr/*.md AND the single docs/ADR.md). Never glob ADR paths here.
+  FOR EACH entry IN detected_docs.idea2prd.adrs (read entry.source_path):
     CLASSIFY by keywords:
       "security", "auth", "encryption"  → security.md rule
       "performance", "scale", "cache"   → performance rules
@@ -217,8 +219,8 @@ aggregates/ has >3 files          → ddd-validator.md (+8), +5 if >7 files
 aggregates/ has >5 files          → aggregate-patterns/ (+5)
 events/ has >3 files              → event-handlers/ (+5)
 events/ has >0 files              → event-handlers/ (+10)
-docs/adr/ has >10 files           → architect.md (+10)
-docs/adr/ has >15 files           → architect.md (+5 additional)
+adrs has >10 decisions            → architect.md (+10)   # detected_docs.idea2prd.adrs — decisions, not files
+adrs has >15 decisions            → architect.md (+5 additional)
 docs/tests/*.feature exists       → testing-patterns/ (+10), tdd-guide.md (+8)
 tests/ has >10 scenarios          → testing-patterns/ (+5)
 docs/fitness/ exists              → fitness-functions.md (+10)
@@ -226,10 +228,10 @@ fitness has >5 functions          → validation hooks (+5)
 .ai-context/ exists               → INTEGRATE into CLAUDE.md, project-context/ (+10)
 .ai-context/ has >4 files         → project-context/ RECOMMEND
 
-# ADR Security Boost
-FOR EACH adr/*.md containing "security": security.md += 2
-FOR EACH adr/*.md containing "authentication": security.md += 1
-FOR EACH adr/*.md containing "encryption": security.md += 1
+# ADR Security Boost (over detected_docs.idea2prd.adrs — read each entry.source_path)
+FOR EACH adr entry containing "security": security.md += 2
+FOR EACH adr entry containing "authentication": security.md += 1
+FOR EACH adr entry containing "encryption": security.md += 1
 ```
 
 #### 4c. Assign Priority Tiers

package/templates/.claude/skills/cc-toolkit-generator-enhanced/references/enhanced-recommendations.md

@@ -13,7 +13,9 @@ def detect_pipeline(uploads_path: str) -> str:
     has_ddd = exists(f"{uploads_path}/docs/ddd/")
     has_ai_context = exists(f"{uploads_path}/.ai-context/")
     has_gherkin = glob(f"{uploads_path}/docs/tests/*.feature")
-    has_adr = len(glob(f"{uploads_path}/docs/adr/*.md")) > 5
+    # Shape marker only (mirrors Module 1 detect_pipeline). The DECISION flag has_adr is
+    # defined ONCE, in Module 1 ADR collector — never redefined here.
+    has_idea2prd_adr_dir = len(glob(f"{uploads_path}/docs/adr/*.md")) > 5
     has_sparc = exists(f"{uploads_path}/Architecture.md")
     
     if has_ddd and has_ai_context:
@@ -124,7 +126,7 @@ if len(events) > 5:
 ```python
 score = 10  # base (always somewhat useful)
 
-adrs = glob("docs/adr/*.md")
+adrs = detected_docs.idea2prd.adrs   # Module-1 collector: both storage shapes
 if len(adrs) > 5:
     score += 5
 if len(adrs) > 10:
@@ -145,8 +147,8 @@ if exists("docs/c4/container.mermaid"):
 ```python
 security_boost = 0
 
-for adr in glob("docs/adr/*.md"):
-    content = read(adr)
+for adr in detected_docs.idea2prd.adrs:   # both storage shapes
+    content = read(adr.source_path)
     if "security" in content.lower():
         security_boost += 2
     if "authentication" in content.lower():

package/templates/.claude/skills/cc-toolkit-generator-enhanced/references/extended-mapping.md

@@ -211,7 +211,7 @@ EXTRACT events/*.md:
 ### From ADRs
 
 ```
-FOR EACH adr/*.md:
+FOR EACH entry IN detected_docs.idea2prd.adrs (read entry.source_path):
   EXTRACT:
     - Title → Rule/skill name candidate
     - Status → (if Accepted) include, (if Deprecated) exclude
@@ -348,7 +348,7 @@ IF fitness has architecture rules: +5 to ddd-validator
 ### From ADR Integration Decisions
 
 ```
-SCAN adr/*.md for:
+SCAN detected_docs.idea2prd.adrs (each entry.source_path) for:
   - "GitHub" → @modelcontextprotocol/server-github
   - "PostgreSQL", "Postgres" → @modelcontextprotocol/server-postgres
   - "MongoDB" → @modelcontextprotocol/server-mongodb

package/templates/.claude/skills/cc-toolkit-generator-enhanced/references/templates/ddd-agents.md

@@ -425,7 +425,7 @@ APPROVE / REQUEST_CHANGES / COMMENT
    - Context diagram summary
    - Container descriptions
 
-2. Extract from `docs/adr/`:
+2. Extract from `detected_docs.idea2prd.adrs` (docs/adr/*.md or the single docs/ADR.md):
    - Top 5-10 most important ADRs
    - Architecture-related decisions
 
@@ -448,7 +448,7 @@ APPROVE / REQUEST_CHANGES / COMMENT
 1. Extract from `docs/fitness/`:
    - All fitness functions as checklist
 
-2. Extract from `docs/adr/`:
+2. Extract from `detected_docs.idea2prd.adrs` (docs/adr/*.md or the single docs/ADR.md):
    - Key decisions affecting code
 
 3. Extract from `docs/ddd/tactical/`:

package/templates/.claude/skills/cc-toolkit-generator-enhanced/references/templates/ddd-skills.md

@@ -345,6 +345,6 @@ src/
 1. From `.ai-context/coding-standards.md`:
    - Direct integration
 
-2. From `docs/adr/`:
+2. From `detected_docs.idea2prd.adrs` (docs/adr/*.md or the single docs/ADR.md):
    - Extract coding-related decisions
    - Extract rejected alternatives as anti-patterns

package/templates/.claude/skills/cc-toolkit-generator-enhanced/references/templates/enhanced-claude-md.md

@@ -188,9 +188,9 @@ If specific .ai-context file missing, extract from:
 |---------|----------------|------------------|
 | Overview | docs/prd/PRD.md | Research_Findings.md |
 | Architecture | docs/c4/*.mermaid | Architecture.md |
-| Key Decisions | docs/adr/*.md | Solution_Strategy.md |
+| Key Decisions | detected_docs.idea2prd.adrs (docs/adr/*.md or docs/ADR.md) | Solution_Strategy.md |
 | Domain Model | docs/ddd/strategic/ | Specification.md |
-| Tech Stack | docs/adr/*-technology.md | Architecture.md |
+| Tech Stack | adrs entries titled *technology* | Architecture.md |
 | Testing | docs/tests/*.feature | Refinement.md |
 | Deployment | docs/completion/ | Completion.md |
 

package/templates/.claude/skills/cc-toolkit-generator-enhanced/references/templates/feature-suggestions.md

@@ -4,13 +4,21 @@ Templates for generating a feature navigation and contextual suggestion system.
 Combines CLAUDE.md roadmap, SessionStart hook for dynamic context, `/next` command,
 and `feature-navigator` skill for on-demand roadmap navigation.
 
-Architecture: **feature-roadmap.json** as single source of truth → consumed by hook, skill, and command.
+Architecture: **feature-roadmap.json** as the system's single data file → consumed by hook, skill,
+and command. (The SCHEMA of that file is defined once, in `.claude/commands/next.md`; this document
+describes the system built on it, not the file's fields.)
 
 ---
 
 ## 1. Data File Template: `feature-roadmap.json`
 
-Generate as `.claude/feature-roadmap.json` — pre-populate from project's PRD/Specification:
+Generate as `.claude/feature-roadmap.json` — pre-populate from project's PRD/Specification.
+
+**Fields: follow `.claude/commands/next.md`, which holds the single schema.** In particular every
+feature carries `priority` from the closed set `mvp | high | medium | low`; a roadmap without it
+cannot be read by the shipped status line. The sketch below shows only the ENVELOPE and this system's
+OPTIONAL extensions — `project`, `current_sprint`, `description`, `sprint`, `files` — which the
+canonical schema does not forbid:
 
 ```json
 {
@@ -21,6 +29,7 @@ Generate as `.claude/feature-roadmap.json` — pre-populate from project's PRD/S
       "id": "{{feature-id}}",
       "name": "{{Feature Name}}",
       "description": "{{Brief description of the feature}}",
+      "priority": "mvp|high|medium|low",
       "status": "done|in_progress|next|planned|blocked",
       "files": ["src/path/to/main-file.ts"],
       "depends_on": ["{{other-feature-id}}"],

package/templates/.claude/skills/cc-toolkit-generator-enhanced/references/templates/start-command.md

@@ -139,7 +139,7 @@ List ALL documentation files the /start should read.
 ```markdown
    - `docs/ddd/strategic/` → bounded contexts, context map
    - `docs/ddd/tactical/` → aggregates, entities, events
-   - `docs/adr/` → technology decisions
+   - `detected_docs.idea2prd.adrs` (docs/adr/ or docs/ADR.md) → technology decisions
    - `docs/tests/*.feature` → Gherkin test scenarios
 ```
 

package/templates/.claude/skills/requirements-validator/SKILL.md

@@ -64,6 +64,13 @@ Always flag these terms and suggest specific replacements:
 
 **Score <50 = BLOCKED from development.** Provide rewrite suggestions.
 
+**Blocking floor — the weakest link decides, never the average.** Independently of the score, a
+requirement is BLOCKED if `Testable = 0` (no acceptance criteria) or `Completeness = 0` (rubric "No
+AC"). A story can total 72/100 with neither, and 72 reads as "minor fixes" in the table above. A non-zero `Testable` or `Completeness` REQUIRES quoting the acceptance criteria it scores — no quote
+means 0, because the agent that scores is the agent the floor binds. The
+floor is closed at those two: `Measurable` and `Traceability` are deliberately excluded — see
+`references/scoring-system.md` → "Blocking floor" for the worked case and the reason.
+
 ## Output Format
 
 ### Requirements Analysis Report

package/templates/.claude/skills/requirements-validator/references/scoring-system.md

@@ -53,6 +53,34 @@ Total Score = INVEST Score (50%) + SMART Score (30%) + Quality Score (20%)
 | 50-69 | Fair | 🔶 REWORK | Significant clarification needed |
 | **0-49** | **Poor** | **🚫 BLOCKED** | **Requires complete rewrite** |
 
+### Blocking floor (overrides the total, both directions)
+
+**The weakest link decides, never the average.** A requirement is BLOCKED — whatever its total says —
+if either of these is zero:
+
+| Criterion | Zero means | Why it vetoes |
+|-----------|-----------|---------------|
+| `Testable` (INVEST, 8) | no acceptance criteria exist | the gate exists to block untestable requirements |
+| `Completeness` (Quality, 10) | "No AC" on the rubric above | nothing states what "done" is |
+
+Without this floor the total alone lets an untestable requirement through. Worked case: a story with
+NO acceptance criteria and NO test links loses `Testable` 8, `Completeness` 10 and `Traceability` 10,
+keeps everything else, and totals **72/100** — above the 70 line, filed as "fix minor issues, then
+proceed". The floor blocks it on `Testable = 0` and `Completeness = 0`.
+
+**The floor keys on the artifact, not on the number you wrote.** The same agent scores these
+criteria AND is bound by the floor, so a score is not evidence of anything — reporting `Testable = 4`
+("vague AC") on a story with no AC at all evades the veto without lying about the rubric. Therefore:
+
+> A non-zero `Testable` or `Completeness` REQUIRES quoting the acceptance criteria being scored —
+> the actual text, with its document and heading. `Testable = 4` means the AC exist and are vague:
+> quote them. **No quote ⇒ the score is 0 ⇒ the floor applies.**
+
+**The floor is CLOSED at these two.** `Measurable` and `Traceability` are deliberately NOT on it: a
+requirement with no number is often correct ("the user can export the report as PDF" is specific,
+testable and unmeasurable), so vetoing on `Measurable` would turn a false pass into a false block.
+Widening this list needs the same kind of worked case as the one above.
+
 ## Quality Gate Rules
 
 ### BLOCKED (Score < 50)

package/templates/.claude/skills/sparc-prd-mini/SKILL.md

@@ -382,16 +382,24 @@ view("/mnt/skills/user/problem-solver-enhanced/SKILL.md")
 
 **User Story Format:**
 ```
-As a [persona],
+US-<nnn>: As a [persona],
 I want to [action],
 So that [benefit].
 
 Acceptance Criteria:
+[SC-<story-id>-1]
 Given [context]
 When [action]
 Then [expected result]
 ```
 
+Every user story carries an ID `US-<nnn>` — three digits, assigned in order, never reused even after
+a story is deleted. Every acceptance scenario under it carries `SC-<US-id>-<n>`, numbered from 1
+within its story: the scenarios of `US-007` are `SC-US-007-1`, `SC-US-007-2`, and so on. Phase 4
+traces algorithms back to these IDs, and there is nothing to trace to if a scenario has no name — nor
+anything reliable to trace to if two scenarios can end up with the same name, which is what the
+never-reused rule prevents.
+
 **PRD Generation:**
 ```
 view("templates/prd.md")
@@ -437,6 +445,7 @@ type EntityName = {
 ## Core Algorithms
 
 ### Algorithm: [Name]
+REALISES: [SC-… ids this algorithm implements, comma-separated]
 INPUT: [parameters]
 OUTPUT: [result]
 
@@ -471,6 +480,54 @@ Response (4xx/5xx):
 [Error categories and responses]
 ```
 
+**Шаг 4.9 — ПОКРЫТИЕ СЦЕНАРИЕВ (обязательный, до чекпойнта).**
+
+Re-read `Specification.md` and collect every `SC-` scenario ID. Collect every algorithm's `REALISES`
+line from `Pseudocode.md`. Write a `## Scenario Coverage` block into `Pseudocode.md` — **in every
+case, including the one where everything is covered**, because an absent block and a block saying
+"all covered" are indistinguishable to the next reader:
+
+```
+## Scenario Coverage
+
+Scenarios in Specification.md: [N]  ·  claimed by an algorithm: [M]
+
+Not claimed by any algorithm:
+| Scenario | Reason |
+|---|---|
+| SC-… | ui-only |
+
+Claimed by an algorithm but absent from Specification.md:
+| Algorithm | Claimed ID |
+|---|---|
+| [name] | SC-… |
+```
+
+**Both tables are required, and both may be the single word `none`.** A traceability check that runs
+one way only is half a check: without the second table an algorithm can declare `REALISES: SC-US-009-3`
+for a scenario nobody ever wrote, and the dangling reference reads exactly like coverage. `none` is
+written out rather than left blank, because an empty table and a forgotten table look identical.
+
+**Reasons are a CLOSED list of five**, and nothing else is accepted:
+
+| Reason | Means |
+|---|---|
+| `ui-only` | realised entirely in the interface, no algorithm to write |
+| `external-service` | performed by a third party, see `Architecture.md` → External Dependencies |
+| `out-of-mvp-scope` | deliberately not built yet |
+| `data-only` | satisfied by a schema or constraint, not by a procedure |
+| `config-only` | satisfied by OUR OWN configuration — a server setting, a header, a policy file — with no procedure to write |
+
+Free text is NOT a reason, and `N/A` is NOT a reason. A field that accepts anything records nothing:
+the whole value of the list is that an unclaimed scenario has to be one of a small number of
+recognisable things, and if it is none of them, the gap is real and belongs in the algorithms.
+
+**What this establishes, and what it does not.** It establishes that a CLAIM exists and that its two
+ends name each other. It does NOT establish that the algorithm's steps actually perform the check the
+scenario describes — no comparison of names can. So this catches *"nobody wrote anything about this
+scenario"*; it does not catch *"someone wrote a line that mentions it"*. Say so here rather than
+letting a later reader assume the stronger thing.
+
 **[MANUAL] CP4:**
 ```
 ═══════════════════════════════════════════════════════════════
@@ -541,6 +598,51 @@ graph TB
 | Queue | | |
 | Infrastructure | | |
 
+## External Dependencies
+
+Every capability this product needs from someone else's service. One row per capability, not one row
+per vendor: "sends email" and "reports bounces" are two questions, and a provider can do one without
+the other.
+
+| Capability needed | Provider / API | Evidence | Verdict | Requirements relying on it |
+|---|---|---|---|---|
+| [what the product needs it to DO] | [service] | [link to the provider's own docs naming this capability] · checked [YYYY-MM-DD] | CONFIRMED | [REQ ids] |
+
+**Evidence — what counts, and what does not.** Evidence is a link to the PROVIDER'S OWN documentation
+that names the specific capability, plus the date it was checked, plus **a short verbatim QUOTE from
+that page stating the capability**. These do NOT count, and each is a way this check gets faked: a
+landing page or marketing page; a pricing page; recollection — "the model knows this API supports
+it"; and **a URL nobody opened** — a plausible-looking link is the cheapest possible forgery, which
+is exactly why the quote is required and the link alone is not enough. A capability nobody could cite
+is not confirmed, and saying so is the point of the middle verdict.
+
+**Verdicts — exactly three, because two would hide a difference that matters:**
+
+| Verdict | Means | Consequence in Phase 2 |
+|---|---|---|
+| CONFIRMED | cited, and the citation names this capability | none |
+| UNCONFIRMED | nobody could produce a citation | the REQUIREMENTS in that row's last column cannot enter Phase 3 — defer, remove or replace them. Unrelated work continues; the run is 🟡 CAVEATS at best and the row is NAMED in the report |
+| CONTRADICTED | the provider's own docs say it cannot | 🔴 NEEDS WORK — the requirement rests on something that is not there |
+
+`UNCONFIRMED` is not a failure to be hidden; it is the honest state of a project on a machine with no
+web access. Collapsing it into CONFIRMED overstates what is known; collapsing it into CONTRADICTED
+blocks work that may be perfectly fine — and would push people to write a citation that isn't one,
+which is how a gate becomes theatre.
+
+But it does not pass for free either. **The consequence is scoped to the REQUIREMENT, not to the
+run:** the requirements listed in an `UNCONFIRMED` row do not enter Phase 3 until they are deferred,
+removed, or rewritten onto something confirmable. Everything not resting on that capability proceeds.
+Without this scoping an inventory of nothing but `UNCONFIRMED` rows would reach Phase 3 with a
+caveat, and external feasibility would never have to be established at all — the check would be
+optional in practice while looking mandatory on paper.
+
+**If this product has no external dependencies**, write exactly that: *"No external dependencies —
+this product calls no third-party service."* An empty section and an absent section are
+indistinguishable, and only one of them means anything.
+
+Names in the row above are PLACEHOLDERS. Do not copy a real provider or a real capability from any
+example: what an API can do drifts, and a stale fact recorded as evidence is worse than none.
+
 ## Data Architecture
 [Data models, relationships, storage strategy]
 
@@ -551,6 +653,46 @@ graph TB
 [Horizontal/vertical scaling, bottlenecks]
 ```
 
+**Шаг 5.9 — СВЕРКА С ПСЕВДОКОДОМ (обязательный, до чекпойнта).**
+
+Фаза 4 написала модель данных ДО того, как эта фаза выбрала хранилище и технологии, и до сих пор
+ничто их не сверяло. Именно отсюда берутся расхождения, которые всплывают уже в коде: поле осталось
+булевым, когда схема получила перечисление; алгоритм пользуется полем, которого в схеме нет; у
+статуса три значения в одном документе и пять в другом.
+
+Перечитай в `Pseudocode.md` ДВЕ секции — `## Data Structures` и `## Core Algorithms` — и сверь их с
+тем, что выбрано ЗДЕСЬ. Алгоритмы нужны обязательно: расхождение «алгоритм читает поле, которого в
+схеме нет» по одним лишь структурам данных не обнаруживается. Ищи три вида расхождений:
+
+- **смена типа** — поле объявлено одним типом, а хранилище требует другого (булево против перечисления);
+- **отсутствующая колонка** — алгоритм читает или пишет поле, которого в схеме нет;
+- **несовпадение набора значений** — у одного и того же поля разное число допустимых значений.
+
+Какую сторону править — решается по РОЛИ документа, а не по старшинству. `Pseudocode.md` держит
+ЛОГИЧЕСКУЮ модель (что означает поле), `Architecture.md` — ФИЗИЧЕСКУЮ (где и как оно лежит).
+Поэтому: если эта фаза ввела осознанное физическое ограничение (тип хранилища, индекс, длина) —
+правится `Pseudocode.md`; если выбранная технология НАРУШАЕТ требуемую семантику (теряются значения,
+исчезает состояние, которым пользуется алгоритм) — меняется выбор ЗДЕСЬ, потому что требование
+старше удобства реализации. Секция `## Data Architecture` этого документа остаётся на месте, но
+описывает отображение на хранилище и связи, а НЕ пересказывает список полей: второй экземпляр списка
+становится вторым местом, где начинается расхождение.
+
+Результат записывается в `Architecture.md` ВСЕГДА, отдельным блоком:
+
+```markdown
+## Reconciliation with Pseudocode
+
+| Сущность.поле | Вид расхождения | Что сделано |
+|---|---|---|
+| … | смена типа / отсутствующая колонка / несовпадение набора значений | … |
+```
+
+Если сверка не нашла ничего — блок всё равно пишется, и он ОБЯЗАН назвать, что именно
+сверялось: «Расхождений с `Pseudocode.md` не найдено. Сверены сущности: <перечисление>; алгоритмы:
+<перечисление>.» Одна фраза «расхождений нет» без перечня — это церемония, которую модель напишет
+не глядя; перечень делает утверждение проверяемым. Молчание не является результатом сверки: по нему
+нельзя отличить «сверили и чисто» от «не сверяли».
+
 **[MANUAL] CP5:**
 ```
 ═══════════════════════════════════════════════════════════════