@dzhechkov/p-replicator 1.6.0 → 1.10.0

package/.dz-manifest.json

@@ -5,7 +5,7 @@
     "files": [
       {
         "path": "CHANGELOG.md",
-        "sha256": "837815d5116c5e117c1249a414b7ae81927969d74a3b44685e8dc8a8dd3a6d8e"
+        "sha256": "63092c71ea7153d562c26db68f2774f233b7c5d37e78e4e3cdfaa1546c42668d"
       },
       {
         "path": "KNOWN_LIMITATIONS.md",
@@ -21,7 +21,7 @@
       },
       {
         "path": "README.md",
-        "sha256": "6b863dbfd298c1788097d53a87425030a341684f67bbb5a81a90c192c0c90d22"
+        "sha256": "d65437974585200f0db8ef082dfbd0519f61cc29cadf3224732ae7a459a20186"
       },
       {
         "path": "README/eng/01_quickstart.md",
@@ -109,7 +109,7 @@
       },
       {
         "path": "package.json",
-        "sha256": "8ae12d621050c3a4f992bc853b4ec961af5fbf32bf9c3fee639a182b546992de"
+        "sha256": "0cc3dc1f4a07a4e5f3ac3f3a1981dc1766302fbbe3ed5818b04c806d4c476059"
       },
       {
         "path": "src/cli.js",
@@ -117,7 +117,7 @@
       },
       {
         "path": "src/commands/doctor.js",
-        "sha256": "0cbd703649882cca4e484bf696b384291780ba760b7895a3ed2bdc1005ef2e4c"
+        "sha256": "566a8cf554420fbbb734705de283f04d40048ee3eb38f1877304d2cc5e56a47f"
       },
       {
         "path": "src/commands/init.js",
@@ -137,11 +137,11 @@
       },
       {
         "path": "src/commands/verify.js",
-        "sha256": "e6d56e7471825b1bacd0e9dbc85d6c9428547c08ea604c348247e258a607eca0"
+        "sha256": "18f5442af9b3a549dfb284cd0d8aef83ba973bd34a3a04e7c656262baebb0e57"
       },
       {
         "path": "src/utils.js",
-        "sha256": "ec9d1695f4b0ef2ce0b3ee6908e90900ebac0941a32ea48df673f6cd20fc1387"
+        "sha256": "43f6abbf447478bae423bce742cfbdace1725946621925eb2ffb3a3ab5b3379e"
       },
       {
         "path": "templates/.claude/agents/doc-validator.md",
@@ -181,7 +181,7 @@
       },
       {
         "path": "templates/.claude/commands/myinsights.md",
-        "sha256": "2e73e822384f976383d9c3313940888b9853f1781d2c39a2fb89825f221149dc"
+        "sha256": "93258a3340f99a0f14b374746ae2934b01d7cefe06d575434868eb98da2d854a"
       },
       {
         "path": "templates/.claude/commands/next.md",
@@ -193,7 +193,7 @@
       },
       {
         "path": "templates/.claude/commands/replicate.md",
-        "sha256": "13f5e2ebe109f33b63cbcd75e3cf1b94224ab066aba1b0cb10cf34f668144a8a"
+        "sha256": "8862d0dc117815b1c3fc7f6e929996e2458783f1ac443eb70bc2a7ebe63a67c3"
       },
       {
         "path": "templates/.claude/commands/run.md",
@@ -215,9 +215,17 @@
         "path": "templates/.claude/hooks/autocommit-roadmap.cjs",
         "sha256": "f4dcc9ffd9a3aed91dd56e011e699fcf8af903cc81594e4ab1ef61e5432a36ad"
       },
+      {
+        "path": "templates/.claude/hooks/check-docs-complete.cjs",
+        "sha256": "27c05c2adcedc806e395b30b455243193a4fbd0968ce96e415679e1f78db951a"
+      },
+      {
+        "path": "templates/.claude/hooks/check-growth-trace.cjs",
+        "sha256": "91994fc109c8440306c9dd3d5eea176c533eb0818fcdb09bac2b309397d9908a"
+      },
       {
         "path": "templates/.claude/hooks/check-ports.cjs",
-        "sha256": "e5f2d2bd8899df27c2dfedf76128467becae1868210eb8525a1bad2869a8c78f"
+        "sha256": "1813aa60e4d15c5f6ce54a9b3471c3772efe60c332316183c7ad8f5b619f2169"
       },
       {
         "path": "templates/.claude/hooks/session-insights.cjs",
@@ -229,7 +237,7 @@
       },
       {
         "path": "templates/.claude/hooks/statusline.cjs",
-        "sha256": "1eca683baf67a17874dc5db6dfe38eb11944f550c66f46330bce0f794732245f"
+        "sha256": "465190ab21610357094fd6eba188ba9f7086dc5a933568f40a7f7c715ccd6745"
       },
       {
         "path": "templates/.claude/rules/docker-ports.md",
@@ -249,11 +257,11 @@
       },
       {
         "path": "templates/.claude/rules/replicate-pipeline.md",
-        "sha256": "b65e802d32a1e50bdfcd0cfc79c78e9234eac48a94f0cd1f5647cf4fea6c0162"
+        "sha256": "99289f711c34cfddddbef5328b74749fc63d1f74636c6a4e4d61caa202fad05d"
       },
       {
         "path": "templates/.claude/rules/skill-interface-protocol.md",
-        "sha256": "fe18fcb9217002572f462f3a7f38de22cdd7ba0dd4e906fdcd0c0e8cfed9f2aa"
+        "sha256": "7669309b0ae4330bc6cf6b26bd9cfc01d7b99a8e70c1f056a52574430db9378e"
       },
       {
         "path": "templates/.claude/settings.json",
@@ -285,11 +293,11 @@
       },
       {
         "path": "templates/.claude/skills/brutal-honesty-review/scripts/assess-code.sh",
-        "sha256": "7e9722c1533f1b7d1a9d11a7add13ac12a2a5f0acfc0ed2cdede2bcf0dab788f"
+        "sha256": "2b10d2972b1379adde9a68ddf8bcdb399b7d65075e458a54523ffd8d99ddc746"
       },
       {
         "path": "templates/.claude/skills/brutal-honesty-review/scripts/assess-tests.sh",
-        "sha256": "8c6444bdb5ce97e49223cdaa6b1c58ac8fcec710cd6ee8d56de9bc677379bd88"
+        "sha256": "d33e760a0739e9291f6087adf189f01eb7c4a1136d9128390dd6e3ad8eadda6f"
       },
       {
         "path": "templates/.claude/skills/brutal-honesty-review/scripts/validate-config.json",
@@ -309,7 +317,7 @@
       },
       {
         "path": "templates/.claude/skills/cc-toolkit-generator-enhanced/modules/03-generate-p0.md",
-        "sha256": "b093a5d66663e2dfd6415afef7c7444409f03379f857001b811685ded410038b"
+        "sha256": "e1ae2dd69db0d68fe276c1d0e57bd19921bf98fe91fe054716add76338442891"
       },
       {
         "path": "templates/.claude/skills/cc-toolkit-generator-enhanced/modules/04-generate-p1.md",
@@ -329,7 +337,7 @@
       },
       {
         "path": "templates/.claude/skills/cc-toolkit-generator-enhanced/modules/08-skill-composition.md",
-        "sha256": "1deedef5ee5c7ef1f7fd8a8fb84732d82f872724fc96697bf530c6dbd6d0850a"
+        "sha256": "683b254e400414b432827bedf4153a122322125eff053da4ccfeb3a62bab2a77"
       },
       {
         "path": "templates/.claude/skills/cc-toolkit-generator-enhanced/modules/09-cross-project-learning.md",
@@ -369,7 +377,7 @@
       },
       {
         "path": "templates/.claude/skills/cc-toolkit-generator-enhanced/references/templates/ddd-hooks-commands.md",
-        "sha256": "d70a0c4977d322602c35c53bf04880177b5dd8f0de2b339d68a0f55993903745"
+        "sha256": "8398f2493434db101476300e514a34bf8124a51eb732cf81923f9a5b5a3d5db4"
       },
       {
         "path": "templates/.claude/skills/cc-toolkit-generator-enhanced/references/templates/ddd-skills.md",
@@ -385,7 +393,7 @@
       },
       {
         "path": "templates/.claude/skills/cc-toolkit-generator-enhanced/references/templates/feature-lifecycle.md",
-        "sha256": "c537b47e7a4ff2d692767f4aac130e2ae9b1923782106750218696e87f515feb"
+        "sha256": "7b01140a304c060fb085ded8711189ac3f259f999df1cb42380d0274191f1b25"
       },
       {
         "path": "templates/.claude/skills/cc-toolkit-generator-enhanced/references/templates/feature-suggestions.md",
@@ -597,7 +605,7 @@
       },
       {
         "path": "templates/.claude/skills/requirements-validator/SKILL.md",
-        "sha256": "e50c5269ad181966a81c14ef596946cea67cbf4b8f8f648c90fd66ecad948933"
+        "sha256": "d2b8e71f4053c642f455a0f245ae18471ab25b7a21e0658f0fe410912a47bf8b"
       },
       {
         "path": "templates/.claude/skills/requirements-validator/assets/templates/bdd-feature-template.feature",
@@ -633,31 +641,31 @@
       },
       {
         "path": "templates/.claude/skills/reverse-engineering-unicorn/modules/01-intelligence.md",
-        "sha256": "4af16873637c26baba0d30728748108c79f5b96765de08d54fc65fe1008f4280"
+        "sha256": "0770bd63a6a1eeb34e873cb101e2ba0cf88d507e9bc03242046eaa837b9f587c"
       },
       {
         "path": "templates/.claude/skills/reverse-engineering-unicorn/modules/02-product-customers.md",
-        "sha256": "b614e43359ffe88c07d6f45abdb2d3c523fc7779052757ed95bbd31b5ce9408d"
+        "sha256": "499bbded50ddd368a62301083e828a42bd0223aa58322b6a952f00086b462972"
       },
       {
         "path": "templates/.claude/skills/reverse-engineering-unicorn/modules/025-cjm-prototype.md",
-        "sha256": "0ca044b769a70bcc89bdb5af496471b59104428770d49735e8255fc22da48207"
+        "sha256": "11e2e101c99d42306ac1d0931475c5a8899e929514e41a393b6173e03856cfc3"
       },
       {
         "path": "templates/.claude/skills/reverse-engineering-unicorn/modules/03-market-competition.md",
-        "sha256": "6c5c802ee558b5e13c80eb05e64a8197bad34192416df81ea32f3b0e1b04b259"
+        "sha256": "7c2e7164463371239d92f28153777e40ee0d6dad293d59886a4cf5b306fa3627"
       },
       {
         "path": "templates/.claude/skills/reverse-engineering-unicorn/modules/04-business-finance.md",
-        "sha256": "19d25e9fe9a732d963f2359748ef2c7793bd6282183f84b938351feccea88075"
+        "sha256": "dd08226391d498a82f111f0da665ea7cea1fa8a97683fab11070f879142727f7"
       },
       {
         "path": "templates/.claude/skills/reverse-engineering-unicorn/modules/05-growth-engine.md",
-        "sha256": "98e8577aa5a5472574ac9bac590b76a4a3d16f99bc67ebec2b09b604c7c1faab"
+        "sha256": "84658390dc7beb590f70164b391ace915e42926660bc1015e4be300752b74a37"
       },
       {
         "path": "templates/.claude/skills/reverse-engineering-unicorn/modules/06-playbook-synthesis.md",
-        "sha256": "f72841226f929cea2c3a414f74b3f1e933e3952f1b55e6eea38081dd804a87cd"
+        "sha256": "3cd76a218aa9f94e0ff8ff2fc257647540674f68df3883f0de5e76e1cea26d9b"
       },
       {
         "path": "templates/.claude/skills/reverse-engineering-unicorn/references/blue-ocean-canvas.md",
@@ -673,7 +681,7 @@
       },
       {
         "path": "templates/.claude/skills/sparc-prd-mini/SKILL.md",
-        "sha256": "50e829635b828b444487e4b04219518a595dbd4b94f91b66fb03ddf4a7b21712"
+        "sha256": "71f97e269e8b1807550a4ef91b2f0ac4dd892a074781504890d33db8f32685d2"
       },
       {
         "path": "templates/.claude/skills/sparc-prd-mini/references/sparc-methodology.md",
@@ -693,7 +701,7 @@
       },
       {
         "path": "tests/snapshot/baseline.json",
-        "sha256": "cb6c08b5c5fb7ea837fb6c054d1094f8c4878a88ac866ec67a3862f8c7fb2a07"
+        "sha256": "333e554a3840fd02e0e230efe4852bb490beded41f6024c65849060780eebdee"
       },
       {
         "path": "tests/snapshot/templates.test.js",
@@ -703,6 +711,10 @@
         "path": "tests/snapshot/update-baseline.js",
         "sha256": "1f50d0c2ec86f1c865ee6ed8c59725e57c397d487b7a24baf051dc5d4b294459"
       },
+      {
+        "path": "tests/unit/absence-is-not-emptiness.test.js",
+        "sha256": "6c7c1c8086461eac16415ebcccea081d3169212826f23e835cf109d741dd6ac3"
+      },
       {
         "path": "tests/unit/adr-decision-coverage.test.js",
         "sha256": "34f9bf0700b4c45fb905f606567f2a6d3ba152f8f1db29f479963667b298ede4"
@@ -711,13 +723,25 @@
         "path": "tests/unit/adr-scanner-contract.test.js",
         "sha256": "08c8b7d862ae0ddcd72116462458b71d3fe29b09cbaf08fa6a824e22ad6985c8"
       },
+      {
+        "path": "tests/unit/assess-scripts.test.js",
+        "sha256": "b16b015dc28cd5b1d85a8ec0ae54768af1787d2d26e9e5b495c8f791aaa2043f"
+      },
       {
         "path": "tests/unit/autocommit-deletion.test.js",
         "sha256": "87ebe50e164cfa3aeda3d4f04e6b6aa98ab8af44711cbeb94252d770c07ad8ad"
       },
+      {
+        "path": "tests/unit/check-docs-complete.test.js",
+        "sha256": "2c6f16a61f0876f637ac492d5fb2af1ea35ad00161fd1468446ea0d08cd97f4b"
+      },
+      {
+        "path": "tests/unit/check-growth-trace.test.js",
+        "sha256": "733d87fe8eca897fcfc5cad9342d4db2085270c21d0d8866d817a9b9418511c2"
+      },
       {
         "path": "tests/unit/check-ports.test.js",
-        "sha256": "72d9eeaa8c47d83fba867722f4b8efc8d079e2d9649e1a20abff46571c2f6f15"
+        "sha256": "d8e2e1f22dadb40fbb03ffbd25ed945fa85fe7b5d49fe0f3597cfc3facc2c118"
       },
       {
         "path": "tests/unit/db-port-rule.test.js",
@@ -731,9 +755,29 @@
         "path": "tests/unit/external-dependency-check.test.js",
         "sha256": "d85109f8e86648d61fc17d0128e9d4881950a70641c246e667d7e54ffc1f0273"
       },
+      {
+        "path": "tests/unit/generated-guard-templates.test.js",
+        "sha256": "928ddb625cc1bbc7dd145992c9a37373da93ae314f39391c67ad7ed064e2c940"
+      },
+      {
+        "path": "tests/unit/growth-axes-and-compliance.test.js",
+        "sha256": "88e4d8c7ae278c46dfce4d89fcbd1dee49c0b545ebc07e459306bfdc70567048"
+      },
+      {
+        "path": "tests/unit/growth-gate-conditional.test.js",
+        "sha256": "bff4149b339294ac822d1a8fe732d21560ea8d70bcb80b10f3491105a4a9b75c"
+      },
       {
         "path": "tests/unit/growth-module-b2b-gate.test.js",
-        "sha256": "7bb5b39a637becbea9813744a5d649b19c6bd8a9b18045c971bcfd842852ea84"
+        "sha256": "05ce46882984905ba41983c34b8d983e9fa9bf5eb4b1af988841a46e78142098"
+      },
+      {
+        "path": "tests/unit/growth-requirements-bridge.test.js",
+        "sha256": "2f560a16f1757df46d5d52e5d29a7aad3e4c327cd07ea9cc69240c7dd1c93f2a"
+      },
+      {
+        "path": "tests/unit/guard-forms.test.js",
+        "sha256": "61a219a7748e0b56bc4207eee107815a4b4111fbebd41b68f6d390130506cd42"
       },
       {
         "path": "tests/unit/hooks-project-anchored.test.js",
@@ -743,6 +787,14 @@
         "path": "tests/unit/hooks-report-failures.test.js",
         "sha256": "35d3fca74c22e1bc88b6fbb25f172b66a21561a947e2b6e90a366d5a854376b8"
       },
+      {
+        "path": "tests/unit/insights-docs-tell-the-truth.test.js",
+        "sha256": "d73ebce2f729911cad452897883b3d55d69e19613c7c1fc7c9bcfa3b5569fc1b"
+      },
+      {
+        "path": "tests/unit/module-copy-identity.test.js",
+        "sha256": "69a63e511cef4d6cb7ea5669b61746f2fc8af22273bc76539cb304bd27e49de9"
+      },
       {
         "path": "tests/unit/pipeline-file-ownership.test.js",
         "sha256": "dd5b6e2ddb3078fb5ccafed6c55a6079bbd20d73fd5c2dacbb988263ceeda806"
@@ -751,6 +803,14 @@
         "path": "tests/unit/roadmap-one-schema.test.js",
         "sha256": "3e7ac9dbc9796a791fc95c43b4346c6da2455f3c0ace45bbc440502c5957d3dc"
       },
+      {
+        "path": "tests/unit/shipped-suite-context.test.js",
+        "sha256": "fd6128505f3272aa7349d21d18a2494eaa8e5e2397ee85047f9828471c99d721"
+      },
+      {
+        "path": "tests/unit/skill-paths-prebaked.test.js",
+        "sha256": "efb13ca5d2fa68f3186e5af4142509d260d7cf63c902f59e915110bb550887df"
+      },
       {
         "path": "tests/unit/sparc-reconciliation.test.js",
         "sha256": "4020c623cb351d42b3b184d23194d48cf04e4a3ce8d95ff96c4261ade75632c9"
@@ -769,7 +829,7 @@
       },
       {
         "path": "tests/unit/sync-templates-guard.test.js",
-        "sha256": "75e8e0d0d2dfc16f14c586d399b5c9c075cc3a0494c558fe39d8528516185cfe"
+        "sha256": "e4fc7687dcf37d17bf2a059d3248c8c00526c104f6a0f6e104fa9ca6e00039ae"
       },
       {
         "path": "tests/unit/utils.test.js",
@@ -781,5 +841,5 @@
       }
     ]
   },
-  "signature": "2lO/3LnJ6PCrXJW8Hm4PO2SRG0YNFAU8vsA+FjHBfXgNYU91TalTT7tFpIo2uG8wx9qpZWDYfWjGNsiQhvqiBQ=="
+  "signature": "ZKPYreIIzuZR6WoZ0J8IBCnwHmSC51tyVihIl3MfZKhVry+nKGokIl0bLu6eKxzGSI0rfDwKfBUPZKHv0iMbDg=="
 }

package/CHANGELOG.md

@@ -5,6 +5,142 @@ All notable changes to `@dzhechkov/p-replicator` are documented here.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.10.0] - 2026-08-27
+
+**Every guard in this package can now be shown to fail — and three that could not, now can.**
+MINOR: no pre-shipped contract change, but the exit-code semantics of two shipped scripts changed.
+
+### Fixed — guards that could not refuse
+
+- **`check-ports.cjs` resolved one path in two frames of reference.** A relative argument was
+  re-applied by docker, so `check-ports.cjs projects/01` reported
+  `…/projects/01/projects/01/docker-compose.yml`. Worse, it fired BEFORE docker parsed the file and
+  so MASKED real config errors, and the cure it printed was the invocation that SUCCEEDS. Two edits:
+  absolutise at the boundary, and delete the `cwd:` override — measured to buy nothing on Compose v2+.
+- **The generated aggregate guard was false-green on 3 of 4 inputs**, and the generator writes it
+  into every bootstrapped project. Four declarations minified onto ONE line reported OK; so did a
+  missing file; so did an **unsubstituted `{{…}}` placeholder — forever**. Now 0/1/2, counting
+  occurrences rather than lines.
+- **`assess-code.sh` and `assess-tests.sh` printed red verdicts and exited 0**, while a nonexistent
+  path exited 1 — blindness outranked findings. Now 1 on findings, 2 on could-not-check. Detection
+  unchanged.
+- **`verify` and `doctor` were blind to an EMPTY file.** 31 artifacts truncated to zero bytes and
+  both reported clean; a zero-byte `settings.json` — no hooks wired at all — got a checkmark.
+  Three states now, reported as three.
+
+### Added
+
+- **`dz mutation-gate` enrolment** — `test/mutation-registry.json`, six entries, every mutation
+  demonstrated red by hand before the registry was trusted. Gate: 6/6 PROVEN.
+- **`tests/unit/guard-forms.test.js`** — a layer-1 refusal of five shell shapes that make a guard
+  unable to fail. It caught the aggregate guard, and later confirmed its own fix: inventory 2 → 0.
+- **`check-docs-complete.cjs`** at the Phase 1→2 boundary, with a confidence split: `{{…}}` and
+  TODO/TBD/XXX block; bracketed prose is NAMED but never blocks, because it cannot be told from a
+  mermaid label — and blocking on it refused every project the bundled skill generates.
+
+### Changed — honesty in shipped documents
+
+- `myinsights.md` no longer claims insights are injected "when their tags match the current task".
+  The hook runs at `SessionStart`, before anything has been said, so there is no task to match
+  against; it injects the three most recent entries. The reason and the consequence are both stated,
+  and a test pins the document to the code.
+- The insights carrier now reports THREE states — not started / zero entries / N recorded — in
+  `doctor`, `verify` and the statusline. Absent and empty rendering identically is what let 27
+  recorded insights become 0 across four real projects with every surface reporting fine.
+
+### Verified differently this time
+
+The shipped suite now runs from a TARBALL, not only locally: **288/296 exit 1 → 311/311 exit 0**.
+Two tests are monorepo-only by construction and skip loudly outside it — permitted only because a
+guard asserts they RUN inside, so the skip is provably not taken where it matters.
+
+## [1.9.0] - 2026-08-27
+
+**MINOR — hooks 8 → 9** (`check-docs-complete`). After `update`, `doctor` and `verify` expect the new count.
+
+### Added
+- **`check-docs-complete.cjs`** — the cheap question, asked before the expensive one. Phase 2 used to
+  launch a swarm of validation agents over whatever Phase 1 produced; existence, emptiness and
+  unfilled placeholders are decidable by forty lines. `/replicate` now runs it at the Phase 1→2
+  boundary and does not start the swarm on exit 1.
+- **A resume section in `/replicate`** — the three signals that already answer "where did we stop":
+  the per-phase commits, this checker, and `verify`. Automated phase detection was deliberately NOT
+  added; the reasoning is recorded there so it can be revisited on evidence.
+
+### Changed
+- **`prepublishOnly` now runs the snapshot test before signing.** `tests/` is in `files[]`, so a
+  baseline drifted from the templates used to be signed, shipped and wrong — `dz sign` states its own
+  limit: tamper-evidence, never truthfulness.
+
+### Honest limit
+The completeness check proves the documents were WRITTEN, not that they are correct. Correctness is
+what the Phase-2 swarm is for. It blocks only on shapes that cannot be anything else (`{{…}}`,
+TODO/TBD/XXX/FIXME); bracketed prose is NAMED as a warning and never blocks, because it cannot be
+told from a mermaid label without understanding the document — and `[GAP: …]` always reaches Phase 2,
+which owns it.
+
+## [1.8.0] - 2026-08-27
+
+**MINOR — the ten shipped skills no longer depend on a rewrite rule being read.**
+
+### Changed
+- **Skill paths are pre-baked.** They referenced each other by claude.ai `/mnt/skills/user/<name>/`
+  paths and worked only because two rules files tell the model to rewrite them at read time — layer
+  4, silent when it lapses. 27 references now resolve directly.
+- Two skills referenced but NOT shipped (`frontend-design`, `idea2prd-manual`) are declared OPTIONAL
+  with a fallback rather than rewritten. A local-looking path that resolves to nothing is worse than
+  an obviously foreign one.
+- 56 occurrences are DELIBERATELY preserved: the toolkit generator's own instructions to scan its
+  output for unrewritten paths, and the rewrite tables. Rewriting them would blind the self-check.
+- The rewrite rules stay — a skill YOU bring from claude.ai still needs them.
+
+### Fixed
+- `03-generate-p0.md` named `.claude/skills/goap-research/` as an output path two lines under a note
+  saying that name is an alias which never exists as a directory.
+
+## [1.7.0] - 2026-08-27
+
+**Growth stops being analysis and becomes an obligation.** Two features, both cross-family reviewed
+(grades B and C); artifacts in `features/growth-requirements-bridge/` and
+`features/growth-list-and-compliance/`.
+
+**MINOR — the pre-shipped contract changed again.** Hooks 7 → 8 (`check-growth-trace`). After
+`update`, `doctor` and `verify` expect the new count.
+
+### Added
+
+- **Phase 0 now writes `docs/product-discovery-brief.md`.** MEASURED before this change: it never
+  did. The brief was passed to Phase 1 in conversation and evaporated, so the M5 growth analysis had
+  no artifact anything downstream could read. Nothing was ignoring it — there was nothing to ignore.
+- **`Growth Requirements Seed`** in M5: `FR-GROWTH-nnn` DRAFT obligations, each naming its source
+  block, carrying that block's confidence verbatim, and now carrying a compliance verdict.
+- **Growth type is two independent axes** — a go-to-market MOTION and a growth LOOP — plus the three
+  mechanics the old list omitted (badge/embed, one- and two-sided incentivised referral, network
+  effect). `No loop` is a real answer and skips the loop-only output instead of demanding an
+  invented flywheel.
+- **A compliance checklist** before any technique becomes a requirement. It cites the norm and where
+  to check it, and carries no amount, threshold or statute: those are jurisdiction-specific and go
+  stale within a year. A `no` answer is recorded against the requirement and blocks its promotion.
+- **`Growth Traceability`** in `requirements-validator` — CONDITIONAL, scored `+5 / +0 / -10`
+  OUTSIDE the 100-point table. A project with no acquisition objective, or one that never ran
+  Phase 0, scores `+0` and never a penalty.
+- **`.claude/hooks/check-growth-trace.cjs`** — the deterministic counterpart. Exit `0` traced ·
+  `1` analysed then dropped · `2` **the check did not run**. Wired to no event, like `check-ports`.
+- **README:** a usage-scenario section for both deliberately-invoked checks, closing a gap 1.6.0 left
+  when `check-ports` shipped without one.
+
+### Fixed
+
+- The pipeline rule listed **four** hook files when eight ship, and the components table said
+  **Rules 5** when six do — both stale since 1.6.0.
+
+### Honest limits, stated in the shipped artifacts
+
+The seed proves an obligation was carried forward, never that it was built. The compliance checklist
+asks its questions and records the answers; it does not establish that anything is lawful. And the
+validator criterion is prose read by a model — layer 3. Only `check-growth-trace.cjs` is
+deterministic, and only when someone runs it.
+
 ## [1.6.0] - 2026-08-27
 
 **Seventeen features** across two days, from the field-report sweep (PR-003, PR-005+010, PR-008,
@@ -140,6 +276,46 @@ Still open, and it is the owner's call: whether a DELETED target should be auto-
 features, 235 after the last). Every feature's guard is proven by mutation: apply it, watch a
 specific assertion go red, restore, watch it pass.
 
+## [1.5.19] - 2026-08-25
+
+### Fixed
+
+- **The ADR chain was dead for every `/replicate` project.** The scanner required a directory of
+  `docs/adr/*.md`, which is the idea2prd-manual shape; a `/replicate` project writes a single
+  `docs/ADR.md`, so decisions were recorded and never read. The scanner now accepts both shapes.
+
+## [1.5.18] - 2026-08-25
+
+### Changed
+
+- Version bump only, as part of a 51-package publish sweep — signatures re-verified against the
+  published tarballs. No behaviour change in this package.
+
+## [1.5.17] - 2026-08-25
+
+### Fixed
+
+- Slice-H cross-model QE round 5 in `learning_bridge.py`. Recorded honestly at the time: the finding
+  count across five rounds went 11 → 10 → 5 → 3 → 6 and **did not converge**.
+
+## [1.5.16] - 2026-08-25
+
+### Fixed
+
+- Slice-H QE round 4: acronym-versus-name confusion, laundered identifiers, and a forgeable probe.
+  The acronym test had been wrong in BOTH directions — it accepted `McDonald` and rejected `apoB`,
+  an example from this package's own README.
+
+## [1.5.15] - 2026-08-25
+
+### Fixed
+
+- Slice-H QE round 3: the `learning_bridge.py` guard became a token allowlist rather than an
+  enumeration of bad cases, with evidence-provenance tests added.
+
+> These five entries were reconstructed from git history on 2026-08-27 (backlog `2b286239`). They are
+> accurate about what changed and why; they are terser than a contemporaneous entry would have been.
+
 ## [1.5.14] - 2026-07-28
 
 ### Fixed — Documentation & packaging (package-verification findings)

package/README.md

@@ -101,7 +101,7 @@
 
 ## 📖 What is p-replicator?
 
-`@dzhechkov/p-replicator` installs a ready-made `.claude/` toolkit into any project: **11 slash commands**, **10 skills**, **4 agents**, **6 rules**, **7 hook scripts**, and a `settings.json` with pre-configured hooks and a multi-line statusline dashboard.
+`@dzhechkov/p-replicator` installs a ready-made `.claude/` toolkit into any project: **11 slash commands**, **10 skills**, **4 agents**, **6 rules**, **9 hook scripts**, and a `settings.json` with pre-configured hooks and a multi-line statusline dashboard.
 
 The flagship `/replicate` command takes a project through a **5-phase pipeline**:
 
@@ -289,8 +289,8 @@ This creates:
 | **Skills** | 10 | 92 files (880K+ chars — MEASURED via `wc -c` over `templates/.claude/skills`: 880,679). Modular architecture: foundation → composite → master orchestrator |
 | **Commands** | 11 | `/replicate`, `/harvest`, `/start`, `/plan`, `/feature`, `/go`, `/run`, `/next`, `/myinsights`, `/docs`, `/deploy` |
 | **Agents** | 4 | `replicate-coordinator`, `product-discoverer`, `doc-validator`, `harvest-coordinator` |
-| **Rules** | 5 | `replicate-pipeline`, `skill-interface-protocol`, `git-workflow`, `insights-capture`, `feature-lifecycle` |
-| **Hooks** | 7 | `session-insights`, `autocommit-{roadmap,insights,plans}`, `statusline`, `state-update`, `check-ports` (cross-platform Node) |
+| **Rules** | 6 | `replicate-pipeline`, `skill-interface-protocol`, `git-workflow`, `insights-capture`, `feature-lifecycle`, `docker-ports` |
+| **Hooks** | 9 | `session-insights`, `autocommit-{roadmap,insights,plans}`, `statusline`, `state-update`, `check-ports`, `check-growth-trace`, `check-docs-complete` (cross-platform Node) |
 | **Settings** | 1 | `settings.json` with statusLine + SessionStart + Stop hooks pre-configured |
 
 After running `/replicate`, the toolkit also generates **project-specific** artifacts:
@@ -306,6 +306,108 @@ After running `/replicate`, the toolkit also generates **project-specific** arti
 
 ---
 
+## 📈 Growth: from analysis to obligation
+
+Phase 0's M5 module used to end as analysis — and the analysis had nowhere to go, because the Product
+Discovery Brief was never written to disk at all. Since 1.7.0:
+
+- Phase 0 writes `docs/product-discovery-brief.md`.
+- M5 emits a **Growth Requirements Seed**: `FR-GROWTH-nnn` DRAFT obligations, each naming the
+  analysis block it came from and carrying that block's confidence verbatim.
+- Growth type is **two independent choices** — a go-to-market MOTION and a growth LOOP. The old
+  single list forced one pick across both, which made "sales-led company running a referral loop"
+  unsayable. `No loop` is a real answer and skips the loop-only output.
+- A **compliance checklist** runs before a technique becomes a requirement. It names the norm and
+  where to check it, never an amount or a statute — those go stale and are jurisdiction-specific.
+  A `no` answer blocks that requirement's promotion.
+- Phase 2's validator gains a **conditional** `Growth Traceability` criterion: `+5` traced, `+0` not
+  applicable, `-10` applicable but dropped. It scores outside the 100-point table, and a project with
+  no acquisition objective — or one that never ran Phase 0 — scores `+0`, never a penalty.
+
+What none of this proves: that anything was built, or that copying a competitor's move is lawful.
+
+## 🔎 The three deliberate checks
+
+Six of the nine hook scripts run themselves. Three do not: they are utilities you invoke when you want
+an answer, and they are wired to no event on purpose. A hook of this package is **non-blocking by
+contract** — it can print, never refuse — so a check that must be able to say "no" cannot be one.
+
+Both answer with **three** exit codes, and the third is the one that matters:
+
+| Code | Meaning |
+|:---:|---|
+| `0` | the rule holds |
+| `1` | the rule is violated — the offender is named |
+| `2` | **the check did not run** — it could not look, and says so |
+
+A checker that answers "clean" when it could not look turns an unknown into a reassurance. That is
+why a missing config, a missing docker, or a missing brief is `2` and never `0`.
+
+### `check-ports.cjs` — no database faces the internet
+
+```bash
+node .claude/hooks/check-ports.cjs .
+```
+
+```
+❌ Правило №0 нарушено (.claude/rules/docker-ports.md):
+   • db: порт 5432 → 5432 (без адреса — значит все интерфейсы) — хранилище опубликовано наружу.
+     Убрать ports: целиком, либо привязать к 127.0.0.1
+```
+
+Reads the normalised config (`docker compose config`), so the short port form and `extends` are
+already resolved. Catches `network_mode: host` and services published beside a reverse-proxy too.
+A loopback bind (`127.0.0.1:` or `[::1]:`) is legal and passes — that exception is part of the rule.
+
+**When to run it:** after writing or editing `docker-compose.yml`, and before any deploy.
+
+### `check-docs-complete.cjs` — the cheap question, before the swarm
+
+```bash
+node .claude/hooks/check-docs-complete.cjs .
+```
+
+```
+❌ документы Фазы 1 не готовы к валидации (1):
+   • PRD.md: пуст или почти пуст (5 симв., порог 200)
+   Рой валидации запускать рано: он потратит агентов на то, что видно отсюда.
+```
+
+Phase 2 launches a swarm of validation agents over whatever Phase 1 produced. Existence, emptiness
+and unfilled placeholders are decidable by forty lines of code — this asks them first, so the swarm
+is spent on testability and completeness rather than on discovering an empty file.
+
+`docs/ADR.md` and `docs/C4_Diagrams.md` stay optional, as `/replicate` itself declares them. A
+markdown link is not a placeholder.
+
+**When to run it:** at the Phase 1 → Phase 2 boundary. `/replicate` now runs it there for you.
+
+**What it does NOT prove:** that the documents are correct. That is what the swarm is for.
+
+### `check-growth-trace.cjs` — the growth analysis was not analysed and dropped
+
+```bash
+node .claude/hooks/check-growth-trace.cjs .
+```
+
+```
+❌ часть требований по росту потеряна (1 из 2):
+   • FR-GROWTH-002
+   Каждое надо либо перенести в docs/Specification.md, либо отклонить С ПРИЧИНОЙ — молча уронить нельзя.
+```
+
+Phase 0's M5 module emits a `Growth Requirements Seed` table of `FR-GROWTH-nnn` draft obligations
+into `docs/product-discovery-brief.md`. This asks whether they survived into `docs/Specification.md`.
+A conscious rejection **with a reason written down** passes; a silent drop does not.
+
+`docs/product-discovery-brief.md` absent is `2`, not `0` — it means Phase 0 never ran (the
+`--from-docs` entry skips it), which is not the same as having nothing to trace.
+
+**When to run it:** at the Phase 1 → Phase 2 boundary, before the validation pass.
+
+**What it does NOT prove:** that anything was built, or that copying a competitor's growth move is
+lawful. It proves an obligation was carried forward, nothing more.
+
 ## ✅ Verify the install
 
 After `/replicate`, run:
@@ -316,7 +418,7 @@ npx @dzhechkov/p-replicator verify
 
 The command checks:
 
-- **Pre-shipped contract** (must-have): 10 skills + 11 commands + 4 agents + 6 rules + settings.json + 7 hooks
+- **Pre-shipped contract** (must-have): 10 skills + 11 commands + 4 agents + 6 rules + settings.json + 9 hooks
 - **Post-/replicate hints** (advisory): CLAUDE.md, project-specific agents, feature-roadmap.json, security rules, etc.
 
 **Exit codes:**