@dzhechkov/p-replicator 1.6.0 → 1.9.0

package/.dz-manifest.json

@@ -5,7 +5,7 @@
     "files": [
       {
         "path": "CHANGELOG.md",
-        "sha256": "837815d5116c5e117c1249a414b7ae81927969d74a3b44685e8dc8a8dd3a6d8e"
+        "sha256": "57b20e3bfd20ed2a97f783d77af52bb6c74ceff5466cacb20ddb058c0a344c48"
       },
       {
         "path": "KNOWN_LIMITATIONS.md",
@@ -21,7 +21,7 @@
       },
       {
         "path": "README.md",
-        "sha256": "6b863dbfd298c1788097d53a87425030a341684f67bbb5a81a90c192c0c90d22"
+        "sha256": "d65437974585200f0db8ef082dfbd0519f61cc29cadf3224732ae7a459a20186"
       },
       {
         "path": "README/eng/01_quickstart.md",
@@ -109,7 +109,7 @@
       },
       {
         "path": "package.json",
-        "sha256": "8ae12d621050c3a4f992bc853b4ec961af5fbf32bf9c3fee639a182b546992de"
+        "sha256": "195281e31da3a3e5ecde1b7087ec5904f35d8f2639e6270f2d8ae685adcfa0c5"
       },
       {
         "path": "src/cli.js",
@@ -141,7 +141,7 @@
       },
       {
         "path": "src/utils.js",
-        "sha256": "ec9d1695f4b0ef2ce0b3ee6908e90900ebac0941a32ea48df673f6cd20fc1387"
+        "sha256": "d4fc297e21682290c15aa64499190ee49b7aa62e69d527c2b5332fffad02f401"
       },
       {
         "path": "templates/.claude/agents/doc-validator.md",
@@ -193,7 +193,7 @@
       },
       {
         "path": "templates/.claude/commands/replicate.md",
-        "sha256": "13f5e2ebe109f33b63cbcd75e3cf1b94224ab066aba1b0cb10cf34f668144a8a"
+        "sha256": "8862d0dc117815b1c3fc7f6e929996e2458783f1ac443eb70bc2a7ebe63a67c3"
       },
       {
         "path": "templates/.claude/commands/run.md",
@@ -215,6 +215,14 @@
         "path": "templates/.claude/hooks/autocommit-roadmap.cjs",
         "sha256": "f4dcc9ffd9a3aed91dd56e011e699fcf8af903cc81594e4ab1ef61e5432a36ad"
       },
+      {
+        "path": "templates/.claude/hooks/check-docs-complete.cjs",
+        "sha256": "13eca8ab8f18325031ca707baa2f7068f8c05484f8e4b12d4129a1023cc7a478"
+      },
+      {
+        "path": "templates/.claude/hooks/check-growth-trace.cjs",
+        "sha256": "91994fc109c8440306c9dd3d5eea176c533eb0818fcdb09bac2b309397d9908a"
+      },
       {
         "path": "templates/.claude/hooks/check-ports.cjs",
         "sha256": "e5f2d2bd8899df27c2dfedf76128467becae1868210eb8525a1bad2869a8c78f"
@@ -229,7 +237,7 @@
       },
       {
         "path": "templates/.claude/hooks/statusline.cjs",
-        "sha256": "1eca683baf67a17874dc5db6dfe38eb11944f550c66f46330bce0f794732245f"
+        "sha256": "948edf98ccabaa4e2dc59078435fb444639aa740baa08967d3a78067e4de3416"
       },
       {
         "path": "templates/.claude/rules/docker-ports.md",
@@ -249,11 +257,11 @@
       },
       {
         "path": "templates/.claude/rules/replicate-pipeline.md",
-        "sha256": "b65e802d32a1e50bdfcd0cfc79c78e9234eac48a94f0cd1f5647cf4fea6c0162"
+        "sha256": "99289f711c34cfddddbef5328b74749fc63d1f74636c6a4e4d61caa202fad05d"
       },
       {
         "path": "templates/.claude/rules/skill-interface-protocol.md",
-        "sha256": "fe18fcb9217002572f462f3a7f38de22cdd7ba0dd4e906fdcd0c0e8cfed9f2aa"
+        "sha256": "7669309b0ae4330bc6cf6b26bd9cfc01d7b99a8e70c1f056a52574430db9378e"
       },
       {
         "path": "templates/.claude/settings.json",
@@ -309,7 +317,7 @@
       },
       {
         "path": "templates/.claude/skills/cc-toolkit-generator-enhanced/modules/03-generate-p0.md",
-        "sha256": "b093a5d66663e2dfd6415afef7c7444409f03379f857001b811685ded410038b"
+        "sha256": "e1ae2dd69db0d68fe276c1d0e57bd19921bf98fe91fe054716add76338442891"
       },
       {
         "path": "templates/.claude/skills/cc-toolkit-generator-enhanced/modules/04-generate-p1.md",
@@ -329,7 +337,7 @@
       },
       {
         "path": "templates/.claude/skills/cc-toolkit-generator-enhanced/modules/08-skill-composition.md",
-        "sha256": "1deedef5ee5c7ef1f7fd8a8fb84732d82f872724fc96697bf530c6dbd6d0850a"
+        "sha256": "683b254e400414b432827bedf4153a122322125eff053da4ccfeb3a62bab2a77"
       },
       {
         "path": "templates/.claude/skills/cc-toolkit-generator-enhanced/modules/09-cross-project-learning.md",
@@ -385,7 +393,7 @@
       },
       {
         "path": "templates/.claude/skills/cc-toolkit-generator-enhanced/references/templates/feature-lifecycle.md",
-        "sha256": "c537b47e7a4ff2d692767f4aac130e2ae9b1923782106750218696e87f515feb"
+        "sha256": "7b01140a304c060fb085ded8711189ac3f259f999df1cb42380d0274191f1b25"
       },
       {
         "path": "templates/.claude/skills/cc-toolkit-generator-enhanced/references/templates/feature-suggestions.md",
@@ -597,7 +605,7 @@
       },
       {
         "path": "templates/.claude/skills/requirements-validator/SKILL.md",
-        "sha256": "e50c5269ad181966a81c14ef596946cea67cbf4b8f8f648c90fd66ecad948933"
+        "sha256": "d2b8e71f4053c642f455a0f245ae18471ab25b7a21e0658f0fe410912a47bf8b"
       },
       {
         "path": "templates/.claude/skills/requirements-validator/assets/templates/bdd-feature-template.feature",
@@ -633,31 +641,31 @@
       },
       {
         "path": "templates/.claude/skills/reverse-engineering-unicorn/modules/01-intelligence.md",
-        "sha256": "4af16873637c26baba0d30728748108c79f5b96765de08d54fc65fe1008f4280"
+        "sha256": "0770bd63a6a1eeb34e873cb101e2ba0cf88d507e9bc03242046eaa837b9f587c"
       },
       {
         "path": "templates/.claude/skills/reverse-engineering-unicorn/modules/02-product-customers.md",
-        "sha256": "b614e43359ffe88c07d6f45abdb2d3c523fc7779052757ed95bbd31b5ce9408d"
+        "sha256": "499bbded50ddd368a62301083e828a42bd0223aa58322b6a952f00086b462972"
       },
       {
         "path": "templates/.claude/skills/reverse-engineering-unicorn/modules/025-cjm-prototype.md",
-        "sha256": "0ca044b769a70bcc89bdb5af496471b59104428770d49735e8255fc22da48207"
+        "sha256": "11e2e101c99d42306ac1d0931475c5a8899e929514e41a393b6173e03856cfc3"
       },
       {
         "path": "templates/.claude/skills/reverse-engineering-unicorn/modules/03-market-competition.md",
-        "sha256": "6c5c802ee558b5e13c80eb05e64a8197bad34192416df81ea32f3b0e1b04b259"
+        "sha256": "7c2e7164463371239d92f28153777e40ee0d6dad293d59886a4cf5b306fa3627"
       },
       {
         "path": "templates/.claude/skills/reverse-engineering-unicorn/modules/04-business-finance.md",
-        "sha256": "19d25e9fe9a732d963f2359748ef2c7793bd6282183f84b938351feccea88075"
+        "sha256": "dd08226391d498a82f111f0da665ea7cea1fa8a97683fab11070f879142727f7"
       },
       {
         "path": "templates/.claude/skills/reverse-engineering-unicorn/modules/05-growth-engine.md",
-        "sha256": "98e8577aa5a5472574ac9bac590b76a4a3d16f99bc67ebec2b09b604c7c1faab"
+        "sha256": "84658390dc7beb590f70164b391ace915e42926660bc1015e4be300752b74a37"
       },
       {
         "path": "templates/.claude/skills/reverse-engineering-unicorn/modules/06-playbook-synthesis.md",
-        "sha256": "f72841226f929cea2c3a414f74b3f1e933e3952f1b55e6eea38081dd804a87cd"
+        "sha256": "3cd76a218aa9f94e0ff8ff2fc257647540674f68df3883f0de5e76e1cea26d9b"
       },
       {
         "path": "templates/.claude/skills/reverse-engineering-unicorn/references/blue-ocean-canvas.md",
@@ -673,7 +681,7 @@
       },
       {
         "path": "templates/.claude/skills/sparc-prd-mini/SKILL.md",
-        "sha256": "50e829635b828b444487e4b04219518a595dbd4b94f91b66fb03ddf4a7b21712"
+        "sha256": "71f97e269e8b1807550a4ef91b2f0ac4dd892a074781504890d33db8f32685d2"
       },
       {
         "path": "templates/.claude/skills/sparc-prd-mini/references/sparc-methodology.md",
@@ -693,7 +701,7 @@
       },
       {
         "path": "tests/snapshot/baseline.json",
-        "sha256": "cb6c08b5c5fb7ea837fb6c054d1094f8c4878a88ac866ec67a3862f8c7fb2a07"
+        "sha256": "0d5af8aadd98bf1f5f07a02b9d6d7a5dd243d4263a5b03de1a249fdaa5111a56"
       },
       {
         "path": "tests/snapshot/templates.test.js",
@@ -715,6 +723,14 @@
         "path": "tests/unit/autocommit-deletion.test.js",
         "sha256": "87ebe50e164cfa3aeda3d4f04e6b6aa98ab8af44711cbeb94252d770c07ad8ad"
       },
+      {
+        "path": "tests/unit/check-docs-complete.test.js",
+        "sha256": "0dbc15c1077c9c02766cfa9b1eb357b30b59639f2fa91003e44e3c6485da3e7b"
+      },
+      {
+        "path": "tests/unit/check-growth-trace.test.js",
+        "sha256": "733d87fe8eca897fcfc5cad9342d4db2085270c21d0d8866d817a9b9418511c2"
+      },
       {
         "path": "tests/unit/check-ports.test.js",
         "sha256": "72d9eeaa8c47d83fba867722f4b8efc8d079e2d9649e1a20abff46571c2f6f15"
@@ -731,9 +747,21 @@
         "path": "tests/unit/external-dependency-check.test.js",
         "sha256": "d85109f8e86648d61fc17d0128e9d4881950a70641c246e667d7e54ffc1f0273"
       },
+      {
+        "path": "tests/unit/growth-axes-and-compliance.test.js",
+        "sha256": "88e4d8c7ae278c46dfce4d89fcbd1dee49c0b545ebc07e459306bfdc70567048"
+      },
+      {
+        "path": "tests/unit/growth-gate-conditional.test.js",
+        "sha256": "bff4149b339294ac822d1a8fe732d21560ea8d70bcb80b10f3491105a4a9b75c"
+      },
       {
         "path": "tests/unit/growth-module-b2b-gate.test.js",
-        "sha256": "7bb5b39a637becbea9813744a5d649b19c6bd8a9b18045c971bcfd842852ea84"
+        "sha256": "05ce46882984905ba41983c34b8d983e9fa9bf5eb4b1af988841a46e78142098"
+      },
+      {
+        "path": "tests/unit/growth-requirements-bridge.test.js",
+        "sha256": "2f560a16f1757df46d5d52e5d29a7aad3e4c327cd07ea9cc69240c7dd1c93f2a"
       },
       {
         "path": "tests/unit/hooks-project-anchored.test.js",
@@ -743,6 +771,10 @@
         "path": "tests/unit/hooks-report-failures.test.js",
         "sha256": "35d3fca74c22e1bc88b6fbb25f172b66a21561a947e2b6e90a366d5a854376b8"
       },
+      {
+        "path": "tests/unit/module-copy-identity.test.js",
+        "sha256": "a1269ad9f68a38faa7710fc63ce850feacb2304996b85ef38237b222815a3532"
+      },
       {
         "path": "tests/unit/pipeline-file-ownership.test.js",
         "sha256": "dd5b6e2ddb3078fb5ccafed6c55a6079bbd20d73fd5c2dacbb988263ceeda806"
@@ -751,6 +783,10 @@
         "path": "tests/unit/roadmap-one-schema.test.js",
         "sha256": "3e7ac9dbc9796a791fc95c43b4346c6da2455f3c0ace45bbc440502c5957d3dc"
       },
+      {
+        "path": "tests/unit/skill-paths-prebaked.test.js",
+        "sha256": "efb13ca5d2fa68f3186e5af4142509d260d7cf63c902f59e915110bb550887df"
+      },
       {
         "path": "tests/unit/sparc-reconciliation.test.js",
         "sha256": "4020c623cb351d42b3b184d23194d48cf04e4a3ce8d95ff96c4261ade75632c9"
@@ -781,5 +817,5 @@
       }
     ]
   },
-  "signature": "2lO/3LnJ6PCrXJW8Hm4PO2SRG0YNFAU8vsA+FjHBfXgNYU91TalTT7tFpIo2uG8wx9qpZWDYfWjGNsiQhvqiBQ=="
+  "signature": "OMtz2uZJ+oSOZn3pdPDukLfw/5FD68SgFh/weBKRMzNGQyuBjh7L0durZEyaLu1T0pbbQ+WTQ1eEAi48cGCjBg=="
 }

package/CHANGELOG.md

@@ -5,6 +5,93 @@ All notable changes to `@dzhechkov/p-replicator` are documented here.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.9.0] - 2026-08-27
+
+**MINOR — hooks 8 → 9** (`check-docs-complete`). After `update`, `doctor` and `verify` expect the new count.
+
+### Added
+- **`check-docs-complete.cjs`** — the cheap question, asked before the expensive one. Phase 2 used to
+  launch a swarm of validation agents over whatever Phase 1 produced; existence, emptiness and
+  unfilled placeholders are decidable by forty lines. `/replicate` now runs it at the Phase 1→2
+  boundary and does not start the swarm on exit 1.
+- **A resume section in `/replicate`** — the three signals that already answer "where did we stop":
+  the per-phase commits, this checker, and `verify`. Automated phase detection was deliberately NOT
+  added; the reasoning is recorded there so it can be revisited on evidence.
+
+### Changed
+- **`prepublishOnly` now runs the snapshot test before signing.** `tests/` is in `files[]`, so a
+  baseline drifted from the templates used to be signed, shipped and wrong — `dz sign` states its own
+  limit: tamper-evidence, never truthfulness.
+
+### Honest limit
+The completeness check proves the documents were WRITTEN, not that they are correct. Correctness is
+what the Phase-2 swarm is for. It blocks only on shapes that cannot be anything else (`{{…}}`,
+TODO/TBD/XXX/FIXME); bracketed prose is NAMED as a warning and never blocks, because it cannot be
+told from a mermaid label without understanding the document — and `[GAP: …]` always reaches Phase 2,
+which owns it.
+
+## [1.8.0] - 2026-08-27
+
+**MINOR — the ten shipped skills no longer depend on a rewrite rule being read.**
+
+### Changed
+- **Skill paths are pre-baked.** They referenced each other by claude.ai `/mnt/skills/user/<name>/`
+  paths and worked only because two rules files tell the model to rewrite them at read time — layer
+  4, silent when it lapses. 27 references now resolve directly.
+- Two skills referenced but NOT shipped (`frontend-design`, `idea2prd-manual`) are declared OPTIONAL
+  with a fallback rather than rewritten. A local-looking path that resolves to nothing is worse than
+  an obviously foreign one.
+- 56 occurrences are DELIBERATELY preserved: the toolkit generator's own instructions to scan its
+  output for unrewritten paths, and the rewrite tables. Rewriting them would blind the self-check.
+- The rewrite rules stay — a skill YOU bring from claude.ai still needs them.
+
+### Fixed
+- `03-generate-p0.md` named `.claude/skills/goap-research/` as an output path two lines under a note
+  saying that name is an alias which never exists as a directory.
+
+## [1.7.0] - 2026-08-27
+
+**Growth stops being analysis and becomes an obligation.** Two features, both cross-family reviewed
+(grades B and C); artifacts in `features/growth-requirements-bridge/` and
+`features/growth-list-and-compliance/`.
+
+**MINOR — the pre-shipped contract changed again.** Hooks 7 → 8 (`check-growth-trace`). After
+`update`, `doctor` and `verify` expect the new count.
+
+### Added
+
+- **Phase 0 now writes `docs/product-discovery-brief.md`.** MEASURED before this change: it never
+  did. The brief was passed to Phase 1 in conversation and evaporated, so the M5 growth analysis had
+  no artifact anything downstream could read. Nothing was ignoring it — there was nothing to ignore.
+- **`Growth Requirements Seed`** in M5: `FR-GROWTH-nnn` DRAFT obligations, each naming its source
+  block, carrying that block's confidence verbatim, and now carrying a compliance verdict.
+- **Growth type is two independent axes** — a go-to-market MOTION and a growth LOOP — plus the three
+  mechanics the old list omitted (badge/embed, one- and two-sided incentivised referral, network
+  effect). `No loop` is a real answer and skips the loop-only output instead of demanding an
+  invented flywheel.
+- **A compliance checklist** before any technique becomes a requirement. It cites the norm and where
+  to check it, and carries no amount, threshold or statute: those are jurisdiction-specific and go
+  stale within a year. A `no` answer is recorded against the requirement and blocks its promotion.
+- **`Growth Traceability`** in `requirements-validator` — CONDITIONAL, scored `+5 / +0 / -10`
+  OUTSIDE the 100-point table. A project with no acquisition objective, or one that never ran
+  Phase 0, scores `+0` and never a penalty.
+- **`.claude/hooks/check-growth-trace.cjs`** — the deterministic counterpart. Exit `0` traced ·
+  `1` analysed then dropped · `2` **the check did not run**. Wired to no event, like `check-ports`.
+- **README:** a usage-scenario section for both deliberately-invoked checks, closing a gap 1.6.0 left
+  when `check-ports` shipped without one.
+
+### Fixed
+
+- The pipeline rule listed **four** hook files when eight ship, and the components table said
+  **Rules 5** when six do — both stale since 1.6.0.
+
+### Honest limits, stated in the shipped artifacts
+
+The seed proves an obligation was carried forward, never that it was built. The compliance checklist
+asks its questions and records the answers; it does not establish that anything is lawful. And the
+validator criterion is prose read by a model — layer 3. Only `check-growth-trace.cjs` is
+deterministic, and only when someone runs it.
+
 ## [1.6.0] - 2026-08-27
 
 **Seventeen features** across two days, from the field-report sweep (PR-003, PR-005+010, PR-008,
@@ -140,6 +227,46 @@ Still open, and it is the owner's call: whether a DELETED target should be auto-
 features, 235 after the last). Every feature's guard is proven by mutation: apply it, watch a
 specific assertion go red, restore, watch it pass.
 
+## [1.5.19] - 2026-08-25
+
+### Fixed
+
+- **The ADR chain was dead for every `/replicate` project.** The scanner required a directory of
+  `docs/adr/*.md`, which is the idea2prd-manual shape; a `/replicate` project writes a single
+  `docs/ADR.md`, so decisions were recorded and never read. The scanner now accepts both shapes.
+
+## [1.5.18] - 2026-08-25
+
+### Changed
+
+- Version bump only, as part of a 51-package publish sweep — signatures re-verified against the
+  published tarballs. No behaviour change in this package.
+
+## [1.5.17] - 2026-08-25
+
+### Fixed
+
+- Slice-H cross-model QE round 5 in `learning_bridge.py`. Recorded honestly at the time: the finding
+  count across five rounds went 11 → 10 → 5 → 3 → 6 and **did not converge**.
+
+## [1.5.16] - 2026-08-25
+
+### Fixed
+
+- Slice-H QE round 4: acronym-versus-name confusion, laundered identifiers, and a forgeable probe.
+  The acronym test had been wrong in BOTH directions — it accepted `McDonald` and rejected `apoB`,
+  an example from this package's own README.
+
+## [1.5.15] - 2026-08-25
+
+### Fixed
+
+- Slice-H QE round 3: the `learning_bridge.py` guard became a token allowlist rather than an
+  enumeration of bad cases, with evidence-provenance tests added.
+
+> These five entries were reconstructed from git history on 2026-08-27 (backlog `2b286239`). They are
+> accurate about what changed and why; they are terser than a contemporaneous entry would have been.
+
 ## [1.5.14] - 2026-07-28
 
 ### Fixed — Documentation & packaging (package-verification findings)

package/README.md

@@ -101,7 +101,7 @@
 
 ## 📖 What is p-replicator?
 
-`@dzhechkov/p-replicator` installs a ready-made `.claude/` toolkit into any project: **11 slash commands**, **10 skills**, **4 agents**, **6 rules**, **7 hook scripts**, and a `settings.json` with pre-configured hooks and a multi-line statusline dashboard.
+`@dzhechkov/p-replicator` installs a ready-made `.claude/` toolkit into any project: **11 slash commands**, **10 skills**, **4 agents**, **6 rules**, **9 hook scripts**, and a `settings.json` with pre-configured hooks and a multi-line statusline dashboard.
 
 The flagship `/replicate` command takes a project through a **5-phase pipeline**:
 
@@ -289,8 +289,8 @@ This creates:
 | **Skills** | 10 | 92 files (880K+ chars — MEASURED via `wc -c` over `templates/.claude/skills`: 880,679). Modular architecture: foundation → composite → master orchestrator |
 | **Commands** | 11 | `/replicate`, `/harvest`, `/start`, `/plan`, `/feature`, `/go`, `/run`, `/next`, `/myinsights`, `/docs`, `/deploy` |
 | **Agents** | 4 | `replicate-coordinator`, `product-discoverer`, `doc-validator`, `harvest-coordinator` |
-| **Rules** | 5 | `replicate-pipeline`, `skill-interface-protocol`, `git-workflow`, `insights-capture`, `feature-lifecycle` |
-| **Hooks** | 7 | `session-insights`, `autocommit-{roadmap,insights,plans}`, `statusline`, `state-update`, `check-ports` (cross-platform Node) |
+| **Rules** | 6 | `replicate-pipeline`, `skill-interface-protocol`, `git-workflow`, `insights-capture`, `feature-lifecycle`, `docker-ports` |
+| **Hooks** | 9 | `session-insights`, `autocommit-{roadmap,insights,plans}`, `statusline`, `state-update`, `check-ports`, `check-growth-trace`, `check-docs-complete` (cross-platform Node) |
 | **Settings** | 1 | `settings.json` with statusLine + SessionStart + Stop hooks pre-configured |
 
 After running `/replicate`, the toolkit also generates **project-specific** artifacts:
@@ -306,6 +306,108 @@ After running `/replicate`, the toolkit also generates **project-specific** arti
 
 ---
 
+## 📈 Growth: from analysis to obligation
+
+Phase 0's M5 module used to end as analysis — and the analysis had nowhere to go, because the Product
+Discovery Brief was never written to disk at all. Since 1.7.0:
+
+- Phase 0 writes `docs/product-discovery-brief.md`.
+- M5 emits a **Growth Requirements Seed**: `FR-GROWTH-nnn` DRAFT obligations, each naming the
+  analysis block it came from and carrying that block's confidence verbatim.
+- Growth type is **two independent choices** — a go-to-market MOTION and a growth LOOP. The old
+  single list forced one pick across both, which made "sales-led company running a referral loop"
+  unsayable. `No loop` is a real answer and skips the loop-only output.
+- A **compliance checklist** runs before a technique becomes a requirement. It names the norm and
+  where to check it, never an amount or a statute — those go stale and are jurisdiction-specific.
+  A `no` answer blocks that requirement's promotion.
+- Phase 2's validator gains a **conditional** `Growth Traceability` criterion: `+5` traced, `+0` not
+  applicable, `-10` applicable but dropped. It scores outside the 100-point table, and a project with
+  no acquisition objective — or one that never ran Phase 0 — scores `+0`, never a penalty.
+
+What none of this proves: that anything was built, or that copying a competitor's move is lawful.
+
+## 🔎 The three deliberate checks
+
+Six of the nine hook scripts run themselves. Three do not: they are utilities you invoke when you want
+an answer, and they are wired to no event on purpose. A hook of this package is **non-blocking by
+contract** — it can print, never refuse — so a check that must be able to say "no" cannot be one.
+
+Both answer with **three** exit codes, and the third is the one that matters:
+
+| Code | Meaning |
+|:---:|---|
+| `0` | the rule holds |
+| `1` | the rule is violated — the offender is named |
+| `2` | **the check did not run** — it could not look, and says so |
+
+A checker that answers "clean" when it could not look turns an unknown into a reassurance. That is
+why a missing config, a missing docker, or a missing brief is `2` and never `0`.
+
+### `check-ports.cjs` — no database faces the internet
+
+```bash
+node .claude/hooks/check-ports.cjs .
+```
+
+```
+❌ Правило №0 нарушено (.claude/rules/docker-ports.md):
+   • db: порт 5432 → 5432 (без адреса — значит все интерфейсы) — хранилище опубликовано наружу.
+     Убрать ports: целиком, либо привязать к 127.0.0.1
+```
+
+Reads the normalised config (`docker compose config`), so the short port form and `extends` are
+already resolved. Catches `network_mode: host` and services published beside a reverse-proxy too.
+A loopback bind (`127.0.0.1:` or `[::1]:`) is legal and passes — that exception is part of the rule.
+
+**When to run it:** after writing or editing `docker-compose.yml`, and before any deploy.
+
+### `check-docs-complete.cjs` — the cheap question, before the swarm
+
+```bash
+node .claude/hooks/check-docs-complete.cjs .
+```
+
+```
+❌ документы Фазы 1 не готовы к валидации (1):
+   • PRD.md: пуст или почти пуст (5 симв., порог 200)
+   Рой валидации запускать рано: он потратит агентов на то, что видно отсюда.
+```
+
+Phase 2 launches a swarm of validation agents over whatever Phase 1 produced. Existence, emptiness
+and unfilled placeholders are decidable by forty lines of code — this asks them first, so the swarm
+is spent on testability and completeness rather than on discovering an empty file.
+
+`docs/ADR.md` and `docs/C4_Diagrams.md` stay optional, as `/replicate` itself declares them. A
+markdown link is not a placeholder.
+
+**When to run it:** at the Phase 1 → Phase 2 boundary. `/replicate` now runs it there for you.
+
+**What it does NOT prove:** that the documents are correct. That is what the swarm is for.
+
+### `check-growth-trace.cjs` — the growth analysis was not analysed and dropped
+
+```bash
+node .claude/hooks/check-growth-trace.cjs .
+```
+
+```
+❌ часть требований по росту потеряна (1 из 2):
+   • FR-GROWTH-002
+   Каждое надо либо перенести в docs/Specification.md, либо отклонить С ПРИЧИНОЙ — молча уронить нельзя.
+```
+
+Phase 0's M5 module emits a `Growth Requirements Seed` table of `FR-GROWTH-nnn` draft obligations
+into `docs/product-discovery-brief.md`. This asks whether they survived into `docs/Specification.md`.
+A conscious rejection **with a reason written down** passes; a silent drop does not.
+
+`docs/product-discovery-brief.md` absent is `2`, not `0` — it means Phase 0 never ran (the
+`--from-docs` entry skips it), which is not the same as having nothing to trace.
+
+**When to run it:** at the Phase 1 → Phase 2 boundary, before the validation pass.
+
+**What it does NOT prove:** that anything was built, or that copying a competitor's growth move is
+lawful. It proves an obligation was carried forward, nothing more.
+
 ## ✅ Verify the install
 
 After `/replicate`, run:
@@ -316,7 +418,7 @@ npx @dzhechkov/p-replicator verify
 
 The command checks:
 
-- **Pre-shipped contract** (must-have): 10 skills + 11 commands + 4 agents + 6 rules + settings.json + 7 hooks
+- **Pre-shipped contract** (must-have): 10 skills + 11 commands + 4 agents + 6 rules + settings.json + 9 hooks
 - **Post-/replicate hints** (advisory): CLAUDE.md, project-specific agents, feature-roadmap.json, security rules, etc.
 
 **Exit codes:**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dzhechkov/p-replicator",
-  "version": "1.6.0",
+  "version": "1.9.0",
   "description": "P-Replicator — Claude Code toolkit for AI-assisted product development (Vibe Coding). Full /replicate pipeline, 10 modular skills (880K+ chars), /harvest knowledge extraction, swarm agents, quality gates, security patterns, cross-project learning.",
   "main": "src/cli.js",
   "bin": {
@@ -19,9 +19,9 @@
     "sbom.json"
   ],
   "scripts": {
-    "prepublishOnly": "node ../../../scripts/prepublish-gate.mjs",
-    "test": "node --test tests/unit/utils.test.js tests/unit/adr-scanner-contract.test.js tests/unit/sparc-reconciliation.test.js tests/unit/pipeline-file-ownership.test.js tests/unit/validation-gate-teeth.test.js tests/unit/hooks-project-anchored.test.js tests/unit/statusline-two-roots.test.js tests/unit/external-dependency-check.test.js tests/unit/spec-pseudocode-traceability.test.js tests/unit/sync-templates-guard.test.js tests/unit/db-port-rule.test.js tests/unit/roadmap-one-schema.test.js tests/unit/hooks-report-failures.test.js tests/unit/growth-module-b2b-gate.test.js tests/unit/detect-parse-anchor.test.js tests/unit/statusline-honest-labels.test.js tests/unit/autocommit-deletion.test.js tests/unit/check-ports.test.js tests/unit/adr-decision-coverage.test.js tests/e2e/lifecycle.test.js tests/snapshot/templates.test.js",
-    "test:unit": "node --test tests/unit/utils.test.js tests/unit/adr-scanner-contract.test.js tests/unit/sparc-reconciliation.test.js tests/unit/pipeline-file-ownership.test.js tests/unit/validation-gate-teeth.test.js tests/unit/hooks-project-anchored.test.js tests/unit/statusline-two-roots.test.js tests/unit/external-dependency-check.test.js tests/unit/spec-pseudocode-traceability.test.js tests/unit/sync-templates-guard.test.js tests/unit/db-port-rule.test.js tests/unit/roadmap-one-schema.test.js tests/unit/hooks-report-failures.test.js tests/unit/growth-module-b2b-gate.test.js tests/unit/detect-parse-anchor.test.js tests/unit/statusline-honest-labels.test.js tests/unit/autocommit-deletion.test.js tests/unit/check-ports.test.js tests/unit/adr-decision-coverage.test.js",
+    "prepublishOnly": "node --test tests/snapshot/templates.test.js && node ../../../scripts/prepublish-gate.mjs",
+    "test": "node --test tests/unit/utils.test.js tests/unit/adr-scanner-contract.test.js tests/unit/sparc-reconciliation.test.js tests/unit/pipeline-file-ownership.test.js tests/unit/validation-gate-teeth.test.js tests/unit/hooks-project-anchored.test.js tests/unit/statusline-two-roots.test.js tests/unit/external-dependency-check.test.js tests/unit/spec-pseudocode-traceability.test.js tests/unit/sync-templates-guard.test.js tests/unit/db-port-rule.test.js tests/unit/roadmap-one-schema.test.js tests/unit/hooks-report-failures.test.js tests/unit/growth-module-b2b-gate.test.js tests/unit/detect-parse-anchor.test.js tests/unit/statusline-honest-labels.test.js tests/unit/autocommit-deletion.test.js tests/unit/check-ports.test.js tests/unit/adr-decision-coverage.test.js tests/unit/growth-requirements-bridge.test.js tests/unit/check-growth-trace.test.js tests/unit/growth-gate-conditional.test.js tests/unit/module-copy-identity.test.js tests/unit/growth-axes-and-compliance.test.js tests/unit/skill-paths-prebaked.test.js tests/unit/check-docs-complete.test.js tests/e2e/lifecycle.test.js tests/snapshot/templates.test.js",
+    "test:unit": "node --test tests/unit/utils.test.js tests/unit/adr-scanner-contract.test.js tests/unit/sparc-reconciliation.test.js tests/unit/pipeline-file-ownership.test.js tests/unit/validation-gate-teeth.test.js tests/unit/hooks-project-anchored.test.js tests/unit/statusline-two-roots.test.js tests/unit/external-dependency-check.test.js tests/unit/spec-pseudocode-traceability.test.js tests/unit/sync-templates-guard.test.js tests/unit/db-port-rule.test.js tests/unit/roadmap-one-schema.test.js tests/unit/hooks-report-failures.test.js tests/unit/growth-module-b2b-gate.test.js tests/unit/detect-parse-anchor.test.js tests/unit/statusline-honest-labels.test.js tests/unit/autocommit-deletion.test.js tests/unit/check-ports.test.js tests/unit/adr-decision-coverage.test.js tests/unit/growth-requirements-bridge.test.js tests/unit/check-growth-trace.test.js tests/unit/growth-gate-conditional.test.js tests/unit/module-copy-identity.test.js tests/unit/growth-axes-and-compliance.test.js tests/unit/skill-paths-prebaked.test.js tests/unit/check-docs-complete.test.js",
     "test:e2e": "node --test tests/e2e/lifecycle.test.js",
     "test:snapshot": "node --test tests/snapshot/templates.test.js",
     "test:doctor": "node bin/cli.js doctor",