@dzhechkov/p-replicator 1.5.18 → 1.9.0

package/CHANGELOG.md

@@ -5,6 +5,268 @@ All notable changes to `@dzhechkov/p-replicator` are documented here.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.9.0] - 2026-08-27
+
+**MINOR — hooks 8 → 9** (`check-docs-complete`). After `update`, `doctor` and `verify` expect the new count.
+
+### Added
+- **`check-docs-complete.cjs`** — the cheap question, asked before the expensive one. Phase 2 used to
+  launch a swarm of validation agents over whatever Phase 1 produced; existence, emptiness and
+  unfilled placeholders are decidable by forty lines. `/replicate` now runs it at the Phase 1→2
+  boundary and does not start the swarm on exit 1.
+- **A resume section in `/replicate`** — the three signals that already answer "where did we stop":
+  the per-phase commits, this checker, and `verify`. Automated phase detection was deliberately NOT
+  added; the reasoning is recorded there so it can be revisited on evidence.
+
+### Changed
+- **`prepublishOnly` now runs the snapshot test before signing.** `tests/` is in `files[]`, so a
+  baseline drifted from the templates used to be signed, shipped and wrong — `dz sign` states its own
+  limit: tamper-evidence, never truthfulness.
+
+### Honest limit
+The completeness check proves the documents were WRITTEN, not that they are correct. Correctness is
+what the Phase-2 swarm is for. It blocks only on shapes that cannot be anything else (`{{…}}`,
+TODO/TBD/XXX/FIXME); bracketed prose is NAMED as a warning and never blocks, because it cannot be
+told from a mermaid label without understanding the document — and `[GAP: …]` always reaches Phase 2,
+which owns it.
+
+## [1.8.0] - 2026-08-27
+
+**MINOR — the ten shipped skills no longer depend on a rewrite rule being read.**
+
+### Changed
+- **Skill paths are pre-baked.** They referenced each other by claude.ai `/mnt/skills/user/<name>/`
+  paths and worked only because two rules files tell the model to rewrite them at read time — layer
+  4, silent when it lapses. 27 references now resolve directly.
+- Two skills referenced but NOT shipped (`frontend-design`, `idea2prd-manual`) are declared OPTIONAL
+  with a fallback rather than rewritten. A local-looking path that resolves to nothing is worse than
+  an obviously foreign one.
+- 56 occurrences are DELIBERATELY preserved: the toolkit generator's own instructions to scan its
+  output for unrewritten paths, and the rewrite tables. Rewriting them would blind the self-check.
+- The rewrite rules stay — a skill YOU bring from claude.ai still needs them.
+
+### Fixed
+- `03-generate-p0.md` named `.claude/skills/goap-research/` as an output path two lines under a note
+  saying that name is an alias which never exists as a directory.
+
+## [1.7.0] - 2026-08-27
+
+**Growth stops being analysis and becomes an obligation.** Two features, both cross-family reviewed
+(grades B and C); artifacts in `features/growth-requirements-bridge/` and
+`features/growth-list-and-compliance/`.
+
+**MINOR — the pre-shipped contract changed again.** Hooks 7 → 8 (`check-growth-trace`). After
+`update`, `doctor` and `verify` expect the new count.
+
+### Added
+
+- **Phase 0 now writes `docs/product-discovery-brief.md`.** MEASURED before this change: it never
+  did. The brief was passed to Phase 1 in conversation and evaporated, so the M5 growth analysis had
+  no artifact anything downstream could read. Nothing was ignoring it — there was nothing to ignore.
+- **`Growth Requirements Seed`** in M5: `FR-GROWTH-nnn` DRAFT obligations, each naming its source
+  block, carrying that block's confidence verbatim, and now carrying a compliance verdict.
+- **Growth type is two independent axes** — a go-to-market MOTION and a growth LOOP — plus the three
+  mechanics the old list omitted (badge/embed, one- and two-sided incentivised referral, network
+  effect). `No loop` is a real answer and skips the loop-only output instead of demanding an
+  invented flywheel.
+- **A compliance checklist** before any technique becomes a requirement. It cites the norm and where
+  to check it, and carries no amount, threshold or statute: those are jurisdiction-specific and go
+  stale within a year. A `no` answer is recorded against the requirement and blocks its promotion.
+- **`Growth Traceability`** in `requirements-validator` — CONDITIONAL, scored `+5 / +0 / -10`
+  OUTSIDE the 100-point table. A project with no acquisition objective, or one that never ran
+  Phase 0, scores `+0` and never a penalty.
+- **`.claude/hooks/check-growth-trace.cjs`** — the deterministic counterpart. Exit `0` traced ·
+  `1` analysed then dropped · `2` **the check did not run**. Wired to no event, like `check-ports`.
+- **README:** a usage-scenario section for both deliberately-invoked checks, closing a gap 1.6.0 left
+  when `check-ports` shipped without one.
+
+### Fixed
+
+- The pipeline rule listed **four** hook files when eight ship, and the components table said
+  **Rules 5** when six do — both stale since 1.6.0.
+
+### Honest limits, stated in the shipped artifacts
+
+The seed proves an obligation was carried forward, never that it was built. The compliance checklist
+asks its questions and records the answers; it does not establish that anything is lawful. And the
+validator criterion is prose read by a model — layer 3. Only `check-growth-trace.cjs` is
+deterministic, and only when someone runs it.
+
+## [1.6.0] - 2026-08-27
+
+**Seventeen features** across two days, from the field-report sweep (PR-003, PR-005+010, PR-008,
+PR-009+004, PR-010, PR-011, PR-012, PR-013, PR-007 G5) plus a latent publish hazard, a silent-failure
+class, a growth-module gate and three regressions found in passing. Every one went through the full
+design→plan→code→cross-family-QE pipeline; artifacts live in `features/<slug>/` in the source repo.
+
+**MINOR, not patch — the pre-shipped contract changed twice.** Rules went 5 → 6 (`docker-ports`) and
+hooks 6 → 7 (`check-ports`). After `update`, `doctor` and `verify` expect the new counts.
+
+### Added — a check that can fail, for the rule that could not
+
+`.claude/hooks/check-ports.cjs` enforces «Правило №0» against a real `docker compose config`, in Node
+so it runs where the package promises to run. **Three exit codes: 0 clean, 1 violation, 2 THE CHECK
+DID NOT RUN** — no compose, no docker, an unparseable config. A check that answers "clean" when it
+could not look turns an unknown into a reassurance.
+
+It is a rewrite, not a transcription: the bash original never looked at `network_mode: host`, which
+the rule forbids. It is not registered as an event hook — invoke it deliberately:
+
+```bash
+node .claude/hooks/check-ports.cjs .
+```
+
+### Added — a recorded decision cannot be quietly left unbuilt
+
+Phase 2 closes with a decision-coverage step: every `ADR-<nnn>` in `docs/ADR.md` must be named
+downstream, and every downstream reference must match a real decision. Both directions, both able to
+say `none`. It establishes that a decision is NAMED, not that it was implemented, and says so.
+
+### Changed — deleting an artifact is now recorded
+
+The three autocommit hooks treated a deleted roadmap as "nothing to do". A deletion is now committed
+with its own `auto-remove` subject, classified from what git actually staged — so deleting one file
+inside a surviving directory counts too. A project that never had the artifact stays silent.
+
+### Fixed — the status line stops saying untrue things
+
+The progress bar was built from done/total and captioned `mvp`; it now carries the caption it draws.
+And the domain guess had no word boundaries, so "healthchecks" made a project medical and "slack"
+made it enterprise. Boundaries are Unicode lookarounds, not `\b` — `\b` does not work around
+Cyrillic at all.
+
+### Fixed — the project scanner could not recognise its own output
+
+Seven probes resolved from one parameter and disagreed about what it was; the two that decide whether
+a project is SPARC-shaped looked exactly where the pipeline does not write.
+
+### Fixed — the growth module was gated off for the type it handles itself
+
+Two callers disabled it for B2B while the module branches on type internally. The condition is now
+about applicability, not product type.
+
+**The version number and the decision to publish were the owner's**; both were given on 2026-08-27.
+npm's latest before this release was 1.5.18; 1.5.19 was staged and never published.
+
+### Fixed — the shipped hooks did not work from a subdirectory, and never committed anything
+
+- `settings.json` pinned all five commands to `${CLAUDE_PROJECT_DIR}` (braced, quoted — the form
+  Claude Code rewrites for PowerShell). Relative paths resolve against the process cwd, which drifts
+  the moment any tool call runs `cd`, so every `Stop` hook died with `MODULE_NOT_FOUND` — silently,
+  because hooks are non-blocking.
+- All six hooks now anchor their DATA at an absolute `CLAUDE_PROJECT_DIR`, falling back to their own
+  `__dirname`. Fixing only `settings.json` would have made them run and silently do nothing.
+- The three autocommit hooks passed `-m` AFTER `--`, so git parsed the commit message as a pathspec
+  and the commit failed from every directory, always. They had never committed anything.
+
+### Fixed — the status line told half the truth from every directory
+
+Toolkit counts now resolve from the project root regardless of cwd, and the roadmap is a survey of
+`projects/*` rather than a guess — sub-project figures are labelled as theirs and never merged into
+the root's own counters. The survey is bounded (24 entries, 512 KB per file) because it renders on
+every prompt.
+
+### Added — the pipeline can now refuse to build on unvalidated input
+
+- A blocking FLOOR on the requirements gate: `Testable = 0` or `Completeness = 0` blocks whatever the
+  total says. A story with no acceptance criteria totalled 72/100 and read as "fix minor issues".
+- Phase 3 has a checkable precondition — the validation report must exist and its FIRST
+  `**Verdict:**` line must be green or yellow — replacing an unenforceable "never skip validation".
+- An External Dependencies inventory in `Architecture.md` plus a sixth Phase-2 lens: every external
+  capability a requirement rests on carries evidence (a citation WITH a verbatim quote) and one of
+  three verdicts. An unconfirmed capability stops the requirements that rest on it, not the run.
+- Scenario↔algorithm traceability: scenario IDs in Phase 3, `REALISES:` in Phase 4 algorithms, and a
+  coverage reconciliation that runs BOTH ways. It establishes that a claim exists — not that the
+  algorithm performs the check, and it says so in the template.
+
+### Added — `.claude/rules/docker-ports.md` (6th pre-shipped rule)
+
+"Правило №0": storage has no host publication except a loopback bind. Every forbidden form is named
+— `0.0.0.0`, `[::]`, a single explicit public address, and `network_mode: host`, which needs no
+`ports:` entry at all. The rule states that the package does NOT check your compose file, so nobody
+infers a guarantee from its presence.
+
+**This changes the pre-shipped contract from 5 rules to 6.** `doctor`, `verify`, the status line and
+the READMEs move together, and a test now holds every count site to `COMPONENTS.rules.items`.
+
+### Fixed — one schema for `feature-roadmap.json`
+
+It was documented twice, incompatibly, both copies claiming to be canonical. `commands/next.md` is
+now the schema; the other document points at it. The status line marks a roadmap whose `priority`
+values are off-schema instead of rendering a confident `mvp 0/0`.
+
+### Fixed — `/start` no longer discards what `/replicate` wrote
+
+Both wrote `docker-compose.yml`, `.gitignore` and `README.md`, and `/replicate` recommends running
+`/start` afterwards — so the collision was the normal path. Both sides now guard: if the file exists,
+make the minimal targeted edit, inspect the diff, and name every changed hunk.
+
+### Security — `scripts/sync-templates.js` fails closed
+
+It copied a discovered repo root's `.claude/` over `templates/` — the npm tarball — and inside a
+monorepo the walk-up finds the MONOREPO. It was safe only because nothing called it, while a test
+helper and an architecture doc both invited the call. It now refuses unless the root carries a
+regular `.p-replicator-sync-source` file with an exact declaration.
+
+### Changed — a hook that cannot commit no longer says nothing
+
+A real git failure now prints ONE line to **stdout** naming the hook, the artifact and git's own
+reason, and still exits 0. The ordinary "nothing to commit" path stays silent.
+
+The stream matters and was wrong at first: MEASURED in the Claude Code binary, a hook exiting 0 has
+its **stderr discarded** (*"Exit code 0 - stdout/stderr not shown"*) while stdout can be surfaced
+(*"Exit code 0 - stdout shown in transcript mode (ctrl+o)"*). "Visible" here means transcript mode
+and the debug log — not an interruption: a `Stop` hook cannot put a line in front of you without
+blocking your session, and blocking is worse.
+
+Still open, and it is the owner's call: whether a DELETED target should be auto-committed.
+
+### Tests
+
+**116 → 235** (MEASURED — reproducer `npm test` in this package; 116 before the first of these
+features, 235 after the last). Every feature's guard is proven by mutation: apply it, watch a
+specific assertion go red, restore, watch it pass.
+
+## [1.5.19] - 2026-08-25
+
+### Fixed
+
+- **The ADR chain was dead for every `/replicate` project.** The scanner required a directory of
+  `docs/adr/*.md`, which is the idea2prd-manual shape; a `/replicate` project writes a single
+  `docs/ADR.md`, so decisions were recorded and never read. The scanner now accepts both shapes.
+
+## [1.5.18] - 2026-08-25
+
+### Changed
+
+- Version bump only, as part of a 51-package publish sweep — signatures re-verified against the
+  published tarballs. No behaviour change in this package.
+
+## [1.5.17] - 2026-08-25
+
+### Fixed
+
+- Slice-H cross-model QE round 5 in `learning_bridge.py`. Recorded honestly at the time: the finding
+  count across five rounds went 11 → 10 → 5 → 3 → 6 and **did not converge**.
+
+## [1.5.16] - 2026-08-25
+
+### Fixed
+
+- Slice-H QE round 4: acronym-versus-name confusion, laundered identifiers, and a forgeable probe.
+  The acronym test had been wrong in BOTH directions — it accepted `McDonald` and rejected `apoB`,
+  an example from this package's own README.
+
+## [1.5.15] - 2026-08-25
+
+### Fixed
+
+- Slice-H QE round 3: the `learning_bridge.py` guard became a token allowlist rather than an
+  enumeration of bad cases, with evidence-provenance tests added.
+
+> These five entries were reconstructed from git history on 2026-08-27 (backlog `2b286239`). They are
+> accurate about what changed and why; they are terser than a contemporaneous entry would have been.
+
 ## [1.5.14] - 2026-07-28
 
 ### Fixed — Documentation & packaging (package-verification findings)

package/MULTIPLATFORM_ROADMAP.md

@@ -112,7 +112,7 @@ Beyond Level 2 — adapt logic for platform-specific capabilities:
 | `/myinsights`, `/docs`, `/harvest`, `/start`, `/deploy` | ✅ universal | path-translate | **Yes** |
 | 10 skills (sparc-prd-mini, etc.) | ⚠️ Claude-specific composition | inline-compile into commands | **Compromise** — sacrifice runtime-loading |
 | 4 pre-shipped agents | ⚠️ Claude Task-tool specific | translate to platform sub-agents | **Yes if platform supports** |
-| 5 rules | ✅ universal markdown | path-translate | **Yes** |
+| 6 rules | ✅ universal markdown | path-translate | **Yes** |
 | Hooks (SessionStart insights, Stop autocommit) | ❌ Claude-only | bake into commands as instructions | **Compromise** — degraded UX |
 | Statusline dashboard | ❌ Claude-only | optional `progress.md` file? | **Skip** — Claude-exclusive feature |
 | `verify` CLI command | ✅ universal | works as-is | **Yes** (already works) |

package/README/eng/01_quickstart.md

@@ -162,7 +162,7 @@ npx @dzhechkov/p-replicator verify
 
 The command checks:
 
-- **Pre-shipped contract** (must-have): 10 skills + 11 commands + 4 agents + 5 rules + settings.json
+- **Pre-shipped contract** (must-have): 10 skills + 11 commands + 4 agents + 6 rules + settings.json
 - **Post-/replicate hints** (advisory): CLAUDE.md, project-specific agents,
   feature-roadmap.json, security rules, etc.
 
@@ -225,7 +225,7 @@ your-project/
 │   ├── skills/              # 10 skills
 │   ├── commands/            # 11 slash commands
 │   ├── agents/              # 4 pipeline agents
-│   ├── rules/               # 5 rules
+│   ├── rules/               # 6 rules
 │   ├── hooks/               # 6 Node scripts
 │   └── settings.json        # hooks + statusline config
 ├── .p-replicator.json       # install manifest

package/README/eng/02_user_guide.md

@@ -501,7 +501,7 @@ npx @dzhechkov/p-replicator verify
 ```
 
 Should report:
-- ✅ Pre-shipped contract intact (10 skills + 11 commands + 4 agents + 5 rules + settings.json)
+- ✅ Pre-shipped contract intact (10 skills + 11 commands + 4 agents + 6 rules + settings.json)
 - ✅ Post-/replicate hints — many will be absent in Mode 2 (this is normal)
 - 📊 Per-feature artifacts: `docs/features/<id>/01_specification.md`...`05_completion.md`,
   `validation-report.md`, `review-report.md`

package/README/eng/03_admin_guide.md

@@ -83,7 +83,7 @@ P-Replicator V1.5.0 ● user │ Sonnet 4.7
 🚀 Pipeline   /<cmd> ▓▓▓░░░░ 50%  │ Phase: VALIDATE (2/4)  │ Last: /replicate
 🎯 Roadmap    [●●●○○○○○] mvp 3/8   │ Done 5/12  │ ▶ auth-jwt  │ Domain: banking
 📊 SPARC      ●11/11  │ 🟢 78/100  │ Plans ●3  │ ADRs ●2  │ Harvest 2026-05-05
-🛠️ Toolkit   Skills ●10/10 │ Cmds ●11/11 │ Agents ●4+3 │ Rules ●5+2 │ Hooks ●6/6
+🛠️ Toolkit   Skills ●10/10 │ Cmds ●11/11 │ Agents ●4+3 │ Rules ●6+2 │ Hooks ●7/7
 💡 Insights   ●12 (2026-05-06) │ Tests 85/85 ✓ │ MCP ●1/1 │ Settings ✓ │ 🧬 Keysarium ✓
 ```
 
@@ -245,7 +245,7 @@ from PRD MVP scope, or by hand).
 
 | Tool | Checks | When |
 |---|---|---|
-| `npx @dzhechkov/p-replicator doctor` | Pre-shipped contract: 10 skills + 11 commands + 4 agents + 5 rules + settings.json + 6 hooks + git on PATH | After init / when something seems broken |
+| `npx @dzhechkov/p-replicator doctor` | Pre-shipped contract: 10 skills + 11 commands + 4 agents + 6 rules + settings.json + 7 hooks + git on PATH | After init / when something seems broken |
 | `npx @dzhechkov/p-replicator verify` | Pre-shipped + post-/replicate hints (CLAUDE.md, planner.md, security.md, feature-roadmap.json, etc.) | After every `/replicate` to confirm |
 
 **`doctor` exit codes:**

package/README/eng/05_architecture.md

@@ -73,7 +73,7 @@ function getItemRelativePath(comp, itemKey) {
 
 **Design principle:** zero shell dependency.
 
-All 6 hook scripts are pure Node, using `execFileSync('git', [...])`
+All 7 hook scripts are pure Node, using `execFileSync('git', [...])`
 instead of shell pipes. This works equivalently on:
 - Windows cmd.exe (no `2>/dev/null`, no `2>nul` — neither needed)
 - Bash / zsh / Git Bash on Windows
@@ -111,7 +111,11 @@ try {
 
 ## Sync-templates: MERGE mode (v1.4.1)
 
-**File:** `scripts/sync-templates.js` — runs as `prepublishOnly` hook.
+**File:** `scripts/sync-templates.js` — **not** a `prepublishOnly` hook, and not part of publishing.
+`prepublishOnly` runs the publish gate (`scripts/prepublish-gate.mjs`); this script is opt-in only and
+refuses to run unless the root it finds carries a `.p-replicator-sync-source` marker. The section
+below records how its MERGE mode works, for whoever opts in — it does not describe anything that
+happens during a normal publish.
 
 **Goal:** copy `.claude/` from source repo into `templates/.claude/` (which
 ends up in the npm tarball).

package/README/eng/README.md

@@ -6,7 +6,7 @@ product development in Claude Code (Vibe Coding).
 ## What it is
 
 `p-replicator` installs a ready-made `.claude/` toolkit into any project:
-**11 slash commands**, **10 skills**, **4 agents**, **5 rules**, **6 hook
+**11 slash commands**, **10 skills**, **4 agents**, **6 rules**, **7 hook
 scripts**, and a `settings.json` with pre-configured hooks. The flagship
 `/replicate` command takes a project through a 5-phase pipeline (Discovery →
 Planning → Validation → Toolkit Generation → Finalize), generating SPARC

package/README/ru/01_quickstart.md

@@ -162,7 +162,7 @@ npx @dzhechkov/p-replicator verify
 
 Команда проверит:
 
-- **Pre-shipped contract** (must-have): 10 skills + 11 commands + 4 agents + 5 rules + settings.json
+- **Pre-shipped contract** (must-have): 10 skills + 11 commands + 4 agents + 6 rules + settings.json
 - **Post-/replicate hints** (advisory): CLAUDE.md, project-specific агенты,
   feature-roadmap.json, security-правила и т.д.
 
@@ -225,7 +225,7 @@ npx @dzhechkov/p-replicator doctor
 │   ├── skills/              # 10 skills
 │   ├── commands/            # 11 slash-команд
 │   ├── agents/              # 4 pipeline-агента
-│   ├── rules/               # 5 правил
+│   ├── rules/               # 6 правил
 │   ├── hooks/               # 6 Node-скриптов
 │   └── settings.json        # hooks + statusline config
 ├── .p-replicator.json       # манифест установки

package/README/ru/02_user_guide.md

@@ -502,7 +502,7 @@ npx @dzhechkov/p-replicator verify
 ```
 
 Должен показать:
-- ✅ Pre-shipped contract intact (10 skills + 11 commands + 4 agents + 5 rules + settings.json)
+- ✅ Pre-shipped contract intact (10 skills + 11 commands + 4 agents + 6 rules + settings.json)
 - ✅ Post-/replicate hints — для Mode 2 многие будут отсутствовать (это нормально)
 - 📊 Per-feature artifacts: `docs/features/<id>/01_specification.md`...`05_completion.md`,
   `validation-report.md`, `review-report.md`

package/README/ru/03_admin_guide.md

@@ -83,7 +83,7 @@ P-Replicator V1.5.0 ● user │ Sonnet 4.7
 🚀 Pipeline   /<cmd> ▓▓▓░░░░ 50%  │ Phase: VALIDATE (2/4)  │ Last: /replicate
 🎯 Roadmap    [●●●○○○○○] mvp 3/8   │ Done 5/12  │ ▶ auth-jwt  │ Domain: banking
 📊 SPARC      ●11/11  │ 🟢 78/100  │ Plans ●3  │ ADRs ●2  │ Harvest 2026-05-05
-🛠️ Toolkit   Skills ●10/10 │ Cmds ●11/11 │ Agents ●4+3 │ Rules ●5+2 │ Hooks ●6/6
+🛠️ Toolkit   Skills ●10/10 │ Cmds ●11/11 │ Agents ●4+3 │ Rules ●6+2 │ Hooks ●7/7
 💡 Insights   ●12 (2026-05-06) │ Tests 85/85 ✓ │ MCP ●1/1 │ Settings ✓ │ 🧬 Keysarium ✓
 ```
 
@@ -248,7 +248,7 @@ echo ".claude/.last-test.json" >> .gitignore
 
 | Инструмент | Что проверяет | Когда |
 |---|---|---|
-| `npx @dzhechkov/p-replicator doctor` | Pre-shipped contract: 10 skills + 11 commands + 4 agents + 5 rules + settings.json + 6 hooks + git on PATH | После init / при подозрении что что-то сломалось |
+| `npx @dzhechkov/p-replicator doctor` | Pre-shipped contract: 10 skills + 11 commands + 4 agents + 6 rules + settings.json + 7 hooks + git on PATH | После init / при подозрении что что-то сломалось |
 | `npx @dzhechkov/p-replicator verify` | Pre-shipped + post-/replicate hints (CLAUDE.md, planner.md, security.md, feature-roadmap.json, и т.д.) | После каждого `/replicate` для уверенности |
 
 **`doctor` exit codes:**

package/README/ru/05_architecture.md

@@ -73,7 +73,7 @@ function getItemRelativePath(comp, itemKey) {
 
 **Дизайн-принцип:** zero shell dependency.
 
-Все 6 hook-скриптов написаны на pure Node, используют `execFileSync('git', [...])`
+Все 7 hook-скриптов написаны на pure Node, используют `execFileSync('git', [...])`
 вместо shell-pipes. Это эквивалентно работает на:
 - Windows cmd.exe (нет `2>/dev/null`, есть `2>nul` — не нужен ни тот ни другой)
 - Bash / zsh / Git Bash на Windows

package/README/ru/README.md

@@ -6,7 +6,7 @@ toolkit для AI-assisted разработки в Claude Code (Vibe Coding).
 ## Что это
 
 `p-replicator` устанавливает в проект готовый набор `.claude/`-инструментов:
-**11 slash-команд**, **10 skills**, **4 агента**, **5 правил**, **6 hook-скриптов**
+**11 slash-команд**, **10 skills**, **4 агента**, **6 правил**, **7 hook-скриптов**
 и `settings.json` с pre-configured хуками. Главная команда `/replicate`
 проводит проект через 5-фазный pipeline (Discovery → Planning → Validation →
 Toolkit Generation → Finalize), генерирует SPARC-документацию и project-specific

package/README/ru/html/index.html

@@ -112,7 +112,7 @@
 <h1 id="dokumentatsiya-dzhechkovp-replicator">Документация @dzhechkov/p-replicator</h1>
 <p>Полный комплект документации к npm-пакету <code>@dzhechkov/p-replicator</code> — toolkit для AI-assisted разработки в Claude Code (Vibe Coding).</p>
 <h2 id="index-chto-eto">Что это</h2>
-<p><code>p-replicator</code> устанавливает в проект готовый набор <code>.claude/</code>-инструментов: <strong>11 slash-команд</strong>, <strong>10 skills</strong>, <strong>4 агента</strong>, <strong>5 правил</strong>, <strong>6 hook-скриптов</strong> и <code>settings.json</code> с pre-configured хуками. Главная команда <code>/replicate</code> проводит проект через 5-фазный pipeline (Discovery → Planning → Validation → Toolkit Generation → Finalize), генерирует SPARC-документацию и project-specific артефакты.</p>
+<p><code>p-replicator</code> устанавливает в проект готовый набор <code>.claude/</code>-инструментов: <strong>11 slash-команд</strong>, <strong>10 skills</strong>, <strong>4 агента</strong>, <strong>6 правил</strong>, <strong>7 hook-скриптов</strong> и <code>settings.json</code> с pre-configured хуками. Главная команда <code>/replicate</code> проводит проект через 5-фазный pipeline (Discovery → Planning → Validation → Toolkit Generation → Finalize), генерирует SPARC-документацию и project-specific артефакты.</p>
 <h2 id="index-navigatsiya">Навигация</h2>
 <div class="table-wrap"><table><thead><tr><th>Раздел</th><th>Описание</th></tr></thead><tbody><tr><td><a href="#quickstart">01_quickstart.md</a></td><td>Установка, первый запуск, проверка</td></tr><tr><td><a href="#user-guide">02_user_guide.md</a></td><td>Все команды и workflow с примерами</td></tr><tr><td><a href="#admin-guide">03_admin_guide.md</a></td><td>Настройка hooks, settings.json, statusline, insights</td></tr><tr><td><a href="#api-reference">04_api_reference.md</a></td><td>CLI-флаги, схемы манифеста, roadmap, state</td></tr><tr><td><a href="#architecture">05_architecture.md</a></td><td>Архитектура: pre-shipped vs generated, SSOT, hooks</td></tr><tr><td><a href="#troubleshooting">06_troubleshooting.md</a></td><td>Решение типичных проблем</td></tr><tr><td><a href="#changelog">07_changelog.md</a></td><td>История версий 1.3.x → 1.5.x</td></tr></tbody></table></div>
 <h2 id="index-yazyki">Языки</h2>
@@ -186,7 +186,7 @@ mv docs/your-arch.md  docs/Architecture.md
 <p>После <code>/replicate</code> выполните:</p>
 <pre data-lang="bash"><code class="language-bash">npx @dzhechkov/p-replicator verify</code></pre>
 <p>Команда проверит:</p>
-<ul><li><strong>Pre-shipped contract</strong> (must-have): 10 skills + 11 commands + 4 agents + 5 rules + settings.json</li><li><strong>Post-/replicate hints</strong> (advisory): CLAUDE.md, project-specific агенты, feature-roadmap.json, security-правила и т.д.</li></ul>
+<ul><li><strong>Pre-shipped contract</strong> (must-have): 10 skills + 11 commands + 4 agents + 6 rules + settings.json</li><li><strong>Post-/replicate hints</strong> (advisory): CLAUDE.md, project-specific агенты, feature-roadmap.json, security-правила и т.д.</li></ul>
 <p>Exit code <code>0</code> означает что pre-shipped контракт цел; warnings показывают что из project-specific артефактов ещё не создано.</p>
 <p>Альтернатива (для общей health-проверки):</p>
 <pre data-lang="bash"><code class="language-bash">npx @dzhechkov/p-replicator doctor</code></pre>
@@ -213,7 +213,7 @@ mv docs/your-arch.md  docs/Architecture.md
 │   ├── skills/              # 10 skills
 │   ├── commands/            # 11 slash-команд
 │   ├── agents/              # 4 pipeline-агента
-│   ├── rules/               # 5 правил
+│   ├── rules/               # 6 правил
 │   ├── hooks/               # 6 Node-скриптов
 │   └── settings.json        # hooks + statusline config
 ├── .p-replicator.json       # манифест установки
@@ -429,7 +429,7 @@ claude
 <p>После <code>/feature</code> (или <code>/run</code>) запустите:</p>
 <pre data-lang="bash"><code class="language-bash">npx @dzhechkov/p-replicator verify</code></pre>
 <p>Должен показать:</p>
-<ul><li>✅ Pre-shipped contract intact (10 skills + 11 commands + 4 agents + 5 rules + settings.json)</li><li>✅ Post-/replicate hints — для Mode 2 многие будут отсутствовать (это нормально)</li><li>📊 Per-feature artifacts: <code>docs/features/&lt;id&gt;/01_specification.md</code>...<code>05_completion.md</code>, <code>validation-report.md</code>, <code>review-report.md</code></li></ul>
+<ul><li>✅ Pre-shipped contract intact (10 skills + 11 commands + 4 agents + 6 rules + settings.json)</li><li>✅ Post-/replicate hints — для Mode 2 многие будут отсутствовать (это нормально)</li><li>📊 Per-feature artifacts: <code>docs/features/&lt;id&gt;/01_specification.md</code>...<code>05_completion.md</code>, <code>validation-report.md</code>, <code>review-report.md</code></li></ul>
 <h4 id="user-guide-future-enhancement-m3-v-knownlimitations">Future enhancement (M3 в KNOWN_LIMITATIONS)</h4>
 <p><code>docPaths</code> config в <code>.p-replicator.json</code> для нестандартных путей доков — в roadmap'е. Tier S effort, чисто config + spec-read изменения, без изменений CLI-кода.</p>
 <hr>
@@ -551,7 +551,7 @@ Set DATABASE_URL_SHADOW env var explicitly to a separate database.
 🚀 Pipeline   /&lt;cmd&gt; ▓▓▓░░░░ 50%  │ Phase: VALIDATE (2/4)  │ Last: /replicate
 🎯 Roadmap    [●●●○○○○○] mvp 3/8   │ Done 5/12  │ ▶ auth-jwt  │ Domain: banking
 📊 SPARC      ●11/11  │ 🟢 78/100  │ Plans ●3  │ ADRs ●2  │ Harvest 2026-05-05
-🛠️ Toolkit   Skills ●10/10 │ Cmds ●11/11 │ Agents ●4+3 │ Rules ●5+2 │ Hooks ●6/6
+🛠️ Toolkit   Skills ●10/10 │ Cmds ●11/11 │ Agents ●4+3 │ Rules ●6+2 │ Hooks ●7/7
 💡 Insights   ●12 (2026-05-06) │ Tests 85/85 ✓ │ MCP ●1/1 │ Settings ✓ │ 🧬 Keysarium ✓</code></pre>
 <p><strong>Источники (heuristic + state-file):</strong></p>
 <div class="table-wrap"><table><thead><tr><th>Метрика</th><th>Откуда</th></tr></thead><tbody><tr><td>Pipeline command + phase + progress</td><td><code>.claude/.p-replicator-state.json</code> (state-file)</td></tr><tr><td>Roadmap progress</td><td><code>.claude/feature-roadmap.json</code></td></tr><tr><td>SPARC count</td><td><code>docs/{PRD,Architecture,...}.md</code> files</td></tr><tr><td>Validation score</td><td>regex extract from <code>docs/validation-report.md</code></td></tr><tr><td>Plans count</td><td><code>docs/plans/*.md</code></td></tr><tr><td>ADRs count</td><td><code>docs/ADR.md</code> <code>## ADR-...</code> headings, или <code>docs/adr/*.md</code>, или <code>docs/ddd/adr/*.md</code></td></tr><tr><td>Insights count + last date</td><td><code>## YYYY-MM-DD</code> headings в <code>.claude/insights/index.md</code></td></tr><tr><td>Toolkit counts</td><td>filesystem walk <code>.claude/{skills,commands,agents,rules,hooks}/</code></td></tr><tr><td>Settings status</td><td>deep-equals current vs <code>manifest.shippedDefaults</code> → <code>defaults</code>/<code>merged</code></td></tr><tr><td>MCP servers</td><td><code>.mcp.json</code></td></tr><tr><td>Domain</td><td>keyword grep <code>CLAUDE.md</code> (banking/retail/enterprise/healthcare)</td></tr><tr><td>Last harvest</td><td><code>TOOLKIT_HARVEST.md</code> mtime</td></tr><tr><td>Last test</td><td>optional <code>.claude/.last-test.json</code> cache</td></tr></tbody></table></div>
@@ -638,7 +638,7 @@ echo ".claude/.last-test.json" &gt;&gt; .gitignore</code></pre>
 <p><strong>Auto-commit</strong> через <code>autocommit-roadmap.cjs</code> (Stop hook) при изменениях.</p>
 <hr>
 <h2 id="admin-guide-doctor-verify-dva-raznyh-instrumenta">Doctor + Verify — два разных инструмента</h2>
-<div class="table-wrap"><table><thead><tr><th>Инструмент</th><th>Что проверяет</th><th>Когда</th></tr></thead><tbody><tr><td><code>npx @dzhechkov/p-replicator doctor</code></td><td>Pre-shipped contract: 10 skills + 11 commands + 4 agents + 5 rules + settings.json + 6 hooks + git on PATH</td><td>После init / при подозрении что что-то сломалось</td></tr><tr><td><code>npx @dzhechkov/p-replicator verify</code></td><td>Pre-shipped + post-/replicate hints (CLAUDE.md, planner.md, security.md, feature-roadmap.json, и т.д.)</td><td>После каждого <code>/replicate</code> для уверенности</td></tr></tbody></table></div>
+<div class="table-wrap"><table><thead><tr><th>Инструмент</th><th>Что проверяет</th><th>Когда</th></tr></thead><tbody><tr><td><code>npx @dzhechkov/p-replicator doctor</code></td><td>Pre-shipped contract: 10 skills + 11 commands + 4 agents + 6 rules + settings.json + 7 hooks + git on PATH</td><td>После init / при подозрении что что-то сломалось</td></tr><tr><td><code>npx @dzhechkov/p-replicator verify</code></td><td>Pre-shipped + post-/replicate hints (CLAUDE.md, planner.md, security.md, feature-roadmap.json, и т.д.)</td><td>После каждого <code>/replicate</code> для уверенности</td></tr></tbody></table></div>
 <p><strong><code>doctor</code> exit codes:</strong></p>
 <ul><li><code>0</code> — всё в порядке</li><li><code>1</code> — что-то отсутствует из must-have (используйте <code>init --force</code> для repair)</li></ul>
 <p><strong><code>verify</code> exit codes:</strong></p>
@@ -914,7 +914,7 @@ npx @dzhechkov/p-replicator@latest init --force --reset-settings</code></pre>
 <hr>
 <h2 id="architecture-cross-platform-hooks-v141">Cross-platform hooks (v1.4.1)</h2>
 <p><strong>Дизайн-принцип:</strong> zero shell dependency.</p>
-<p>Все 6 hook-скриптов написаны на pure Node, используют <code>execFileSync('git', [...])</code> вместо shell-pipes. Это эквивалентно работает на:</p>
+<p>Все 7 hook-скриптов написаны на pure Node, используют <code>execFileSync('git', [...])</code> вместо shell-pipes. Это эквивалентно работает на:</p>
 <ul><li>Windows cmd.exe (нет <code>2&gt;/dev/null</code>, есть <code>2&gt;nul</code> — не нужен ни тот ни другой)</li><li>Bash / zsh / Git Bash на Windows</li><li>PowerShell</li></ul>
 <p><strong>Pattern для autocommit-скрипта:</strong></p>
 <pre data-lang="javascript"><code class="language-javascript">const fs = require('node:fs');