@dzhechkov/skills-idea2prd 0.1.5 → 0.1.7

package/.dz-manifest.json

@@ -13,7 +13,7 @@
       },
       {
         "path": "README.md",
-        "sha256": "b7a4afb47ec0b84e32278400911fa9c42cf0d350fc2a88842226eae1ad533b61"
+        "sha256": "646b19adeddf1d63c0f07eabef2f4dcce49d65a259563dfc6ab6b4248d262191"
       },
       {
         "path": "bin/cli.js",
@@ -21,7 +21,7 @@
       },
       {
         "path": "package.json",
-        "sha256": "627ab02cc637a64157d4e5cb3aa9e1fd178a40ac5eb18ca6a674734e4082c377"
+        "sha256": "4bfe6564c3745ab76783640b91973036f6687155111052f3e3e34a3eb4dcd874"
       },
       {
         "path": "sources.json",
@@ -73,7 +73,7 @@
       },
       {
         "path": "templates/.claude/skills/goap-research-ed25519/SKILL.md",
-        "sha256": "eb9a58ed3fbfb9b1c6627c563b5ce1b5ac9f1f5fb9d148a79441d94422933687"
+        "sha256": "95459a1566b2f88b6fb0c1d2f096f7631d698b95fa156afa26444a7c06e76451"
       },
       {
         "path": "templates/.claude/skills/goap-research-ed25519/references/ed25519-verification.md",
@@ -109,7 +109,7 @@
       },
       {
         "path": "templates/.claude/skills/goap-research-ed25519/scripts/learning_bridge.py",
-        "sha256": "c9aea90ddfba5990b27405ca66a3f90308afa357e227ddad3877f9eee7df6e36"
+        "sha256": "f6ec73a2ef239b8195a321b5f20b6ab390d9a7004b42226b2a861181cf9e2d2f"
       },
       {
         "path": "templates/.claude/skills/goap-research-ed25519/scripts/source_tiers.py",
@@ -121,7 +121,7 @@
       },
       {
         "path": "templates/.claude/skills/goap-research-ed25519/scripts/test_evidence_provenance.py",
-        "sha256": "1be4f63bbe7e77d599c5f0960d92b20a8f7ea6a6d07b30cb1d728f920b7259f2"
+        "sha256": "86216fb6a40fcf270eada41c4a534600d2bcb2799052cbacfd64b459229b5bfe"
       },
       {
         "path": "templates/.claude/skills/idea2prd-manual/SKILL.md",
@@ -173,5 +173,5 @@
       }
     ]
   },
-  "signature": "BLiTK1C6fUhclz0jlurwvpGRTUZ0kXyOT9qn2c/ZA4SmrkbU9NibPcV5WfBxocQ7ff0b2VHZzUkYd5oBrd2jCA=="
+  "signature": "Rc5O0UZz+GsMlKiMvr/E8f4SUUtkaHJnL30dpGPXNIxY7Wo5SEYaTnB+P0GRSi1AYJjihTlsAo7d34RrSfQpAQ=="
 }

package/README.md

@@ -2,6 +2,15 @@
 
 Idea2PRD Manual — composite skill for [Claude Code](https://claude.com/claude-code) that takes a **problem or an idea** all the way to **Vibe-Coding-ready documentation**, with a user checkpoint between every phase.
 
+
+> **`goap-research-ed25519` — self-learning (optional, since this release).** When
+> [`@dzhechkov/harness-cli`](https://www.npmjs.com/package/@dzhechkov/harness-cli) is on PATH, the
+> bundled research skill recalls prior METHOD lessons at the start of an investigation and records new
+> ones at four named moments. Without it the skill behaves exactly as before and says so once — it is
+> detected, never required. A guard refuses to record anything shaped like personal data: a method
+> lesson is written in lower case, carries no digits, and holds no identifier. See
+> `skills/goap-research-ed25519/SKILL.md`.
+
 ## What It Does
 
 Auto-detects the input (problem vs idea) and runs up to two pipelines with **9 checkpoints**:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dzhechkov/skills-idea2prd",
-  "version": "0.1.5",
+  "version": "0.1.7",
   "description": "Idea2PRD Manual — composite skill for Claude Code: from problem/idea to Vibe-Coding-ready docs (PRD + ADR + DDD + C4 + Pseudocode + Test Scenarios + Completion) with 9 checkpoints",
   "main": "src/cli.js",
   "bin": {

package/sbom.json

@@ -35,7 +35,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "b7a4afb47ec0b84e32278400911fa9c42cf0d350fc2a88842226eae1ad533b61"
+          "content": "646b19adeddf1d63c0f07eabef2f4dcce49d65a259563dfc6ab6b4248d262191"
         }
       ]
     },
@@ -55,7 +55,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "627ab02cc637a64157d4e5cb3aa9e1fd178a40ac5eb18ca6a674734e4082c377"
+          "content": "4bfe6564c3745ab76783640b91973036f6687155111052f3e3e34a3eb4dcd874"
         }
       ]
     },
@@ -185,7 +185,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "eb9a58ed3fbfb9b1c6627c563b5ce1b5ac9f1f5fb9d148a79441d94422933687"
+          "content": "95459a1566b2f88b6fb0c1d2f096f7631d698b95fa156afa26444a7c06e76451"
         }
       ]
     },
@@ -275,7 +275,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "c9aea90ddfba5990b27405ca66a3f90308afa357e227ddad3877f9eee7df6e36"
+          "content": "f6ec73a2ef239b8195a321b5f20b6ab390d9a7004b42226b2a861181cf9e2d2f"
         }
       ]
     },
@@ -305,7 +305,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "1be4f63bbe7e77d599c5f0960d92b20a8f7ea6a6d07b30cb1d728f920b7259f2"
+          "content": "86216fb6a40fcf270eada41c4a534600d2bcb2799052cbacfd64b459229b5bfe"
         }
       ]
     },

package/templates/.claude/skills/goap-research-ed25519/SKILL.md

@@ -97,8 +97,11 @@ The accepted form has three properties, all checkable: **no digits** (spelled-ou
 values count — `eight point zero four` is a value), **no identifiers**, and **lower
 case** after the first word. The last one replaced an attempt to detect names: a name
 is any word, no list of them exists, and the attempt let `John Smith has HIV` through.
-Lower case costs a keystroke and closes that hole. ALL-CAPS and mixed-case acronyms
-(`SHBG`, `TSH`, `apoB`) are unaffected — they are how method lessons speak.
+Lower case costs a keystroke and closes that hole. Acronyms are unaffected — a token
+passes if it is fully upper (`SHBG`, `TSH`) or opens lower (`apoB`, `mmHg`); only Title
+Case is refused, because Title Case is the shape of a name. A token mixing letters with
+a long digit run (`ab1234567`, `NCT04368728`) is an identifier and is refused however it
+is punctuated, while a short lab acronym carrying a digit (`hba1c`) is not.
 
 Pass `--allow-numbers` when the number IS the knowledge (a guideline threshold) and
 you take responsibility for it. It never waves through a person beside a number.

package/templates/.claude/skills/goap-research-ed25519/scripts/learning_bridge.py

@@ -76,7 +76,13 @@ BOOST_NOTE_TAILS = (
 def _boost_note_present(out: str, domain: str = LEARNING_DOMAIN) -> bool:
     """True when THIS dz printed a real domain-boost note (not a lesson quoting one)."""
     head = f'domain "{domain}":'
-    for line in out.splitlines():
+    # split("\n"), NOT splitlines(). Python's splitlines() also breaks on U+2028,
+    # U+0085 and friends, which the CLI does not treat as line breaks — so a lesson
+    # containing one produced a "line" the renderer never emitted, and that forged line
+    # could satisfy this probe. Splitting exactly the way the producer joins keeps a
+    # forged tail stuck on a line that starts with the hit prefix, where the anchor
+    # below rejects it.
+    for line in out.split("\n"):
         stripped = line.strip()
         if stripped.startswith(head) and any(tail in stripped for tail in BOOST_NOTE_TAILS):
             return True
@@ -121,7 +127,12 @@ DZ_MISSING_NOTE = (
 
 # Any digit. Yes, any: a threshold, a dose, a year and a lab value are the same
 # character class, and no amount of context-sniffing reliably tells them apart.
-_DIGIT_RE = r"\d"
+# NOT the regex `\d`. Round 5: the text scan used `\d` while the token scan used
+# str.isdigit(), and `²` satisfies the second but not the first — so it was skipped as
+# "a number" by one half and never refused by the other. Two different definitions of
+# "digit" in one guard is a gap by construction. One predicate, used everywhere.
+def _has_digit(text: str) -> bool:
+    return any(ch.isdigit() or ch.isnumeric() for ch in text)
 
 # A value SPELLED OUT is still a value. Round 2 walked `John's TSH was eight point
 # zero four` through the digit rule untouched. Requiring two number-words in a row
@@ -151,6 +162,17 @@ _IDENTIFIER_PATTERNS: Sequence[Tuple[str, str, bool]] = (
     (r"\+?\d[\d\s().-]{7,}\d", "something shaped like a phone number", True),
     (r"\b(mrn|снилс|полис|истори\w* болезни|medical record (no|number)|record no)\b[:\s#]*\w*",
      "a medical-record identifier", True),
+    # Round 4: the TOKEN check refused `ab1234567`, so the same identifier written
+    # `ab—1234567` or `ab/1234567` was split by the tokenizer into a lower-case word
+    # and a permitted number — laundered by punctuation. This reads the RAW text, where
+    # the joiner is still visible. A SPACE is deliberately not a joiner here, or every
+    # "the 2019 guideline" would be refused.
+    # Any letter in ANY script, any single non-space separator, a long digit run. Round 5
+    # walked `ab:1234567` (colon was not in the joiner list) and `αβ—1234567` (Greek was
+    # not in the letter class) straight through. Enumerating joiners and alphabets is the
+    # same losing game as enumerating names; "not a space" and "any letter" are not.
+    (r"[^\W\d_]{2,}[^\w\s]?\d{4,}",
+     "letters sitting against a long run of digits — that is an identifier, however it is punctuated", False),
 )
 
 # THE CAPITALISATION RULE — round 2 forced this rewrite.
@@ -190,8 +212,25 @@ _TOKEN_EDGE_PUNCT = " \t\n\r.,;:!?()[]{}\"'«»„“”‘’—–-/\\|*_`"
 
 
 def _is_acronym(token: str) -> bool:
-    """Two or more capitals in one token: SHBG, HIV, apoB, HbA1c. A name has one."""
-    return sum(1 for ch in token if ch.isupper()) >= 2
+    """An acronym, as opposed to a name.
+
+    Round 4 killed the previous rule ("two or more capitals"), which was wrong in BOTH
+    directions at once: `Anne-Marie` and `McDonald` carry two capitals and sailed
+    through as acronyms, while `apoB` carries one and was refused — contradicting the
+    documentation in the same repository that offered it as the example.
+
+    What actually separates the two is WHERE the first capital sits. A name is Title
+    Case: capital first, lower case after. An acronym is either fully upper (SHBG, HIV,
+    TSH) or starts lower and capitalises later (apoB, mmHg). So: accept a token whose
+    first letter is lower case, or one whose letters are ALL upper case. Refuse
+    anything that opens with a capital and then drops to lower case, whatever it is.
+    """
+    letters = [ch for ch in token if ch.isalpha()]
+    if not letters:
+        return False
+    if not letters[0].isupper():
+        return True   # apoB, mmHg — lower-case opening is never a name
+    return all(ch.isupper() for ch in letters)   # SHBG, HIV, D
 
 
 # Splitting on whitespace ALONE was the last hole round 3 found: `method—John has HIV`
@@ -212,6 +251,13 @@ def _tokens(raw: str) -> List[str]:
 # not a measurement in any unit system; it is a label for one thing.
 _NUMBER_TOKEN_RE = r"^[<>≥≤~±]?\d+([.,]\d+)?[a-zа-яё%°]{0,4}$"
 
+# …but a few real lab acronyms carry a digit (`HbA1c`, `CYP2D6`). What separates them
+# from an accession is SIZE: an identifier has to be long enough to be unique. So a
+# mixed token is an identifier when it is long or digit-heavy, and a lab acronym
+# otherwise. The bound is a judgement call and is stated rather than hidden.
+_IDENTIFIER_MIN_LEN = 7
+_IDENTIFIER_MIN_DIGITS = 4
+
 # A reference to ONE person. Alone it is fine — a method sentence may discuss patients
 # in the abstract. Beside a value it is load-bearing: a person plus a reading is a
 # record, and no --allow-numbers waves that through.
@@ -227,11 +273,11 @@ _NUMBER_TOKEN_RE = r"^[<>≥≤~±]?\d+([.,]\d+)?[a-zа-яё%°]{0,4}$"
 # runs when --allow-numbers was passed (digits are refused outright otherwise). It is
 # the narrowest of the three clauses and the only one that is still an enumeration.
 _PERSON_RE = (
-    r"\b(patient|subject|participant|client|donor|volunteer|"
+    r"\b(patient|subject|participant|client|donor|volunteer|person|"
     r"woman|man|individual|child|infant|adult|"
     r"he|she|him|his|her|hers|"
     r"пациент(?!ы|ов|ам|ами|ах)\w*|больн(ой|ого|ому|ым|ом)|испытуем(ый|ого|ому|ым|ом)|"
-    r"мужчина|мужчины\b|женщина|женщины\b|ребёнок|ребенок|доброволец|"
+    r"мужчина|мужчины\b|женщина|женщины\b|ребёнок|ребенок|доброволец|человек|"
     r"у него|у неё)\b"
 )
 
@@ -239,6 +285,7 @@ _PERSON_RE = (
 class LessonVerdict:
     ok: bool
     reasons: List[str]
+    numbers_allowed: bool = False
 
     @property
     def note(self) -> str:
@@ -246,6 +293,17 @@ class LessonVerdict:
             # NOT "safe": a shape detector cannot certify safety, and saying so would
             # transfer responsibility it does not have (Codex QE #2). It reports the
             # absence of a detected shape — the author still owns the content.
+            # The note must describe what was actually checked. Round 5: it said "no
+            # digits, no figures" even on the --allow-numbers path, where digits were
+            # present and consciously allowed — a message that contradicts the flag the
+            # caller just passed teaches the reader to stop reading messages.
+            if self.numbers_allowed:
+                return (
+                    "no personal-data SHAPE detected (identifiers, capitalisation, person-plus-value). "
+                    "Digits were ALLOWED by --allow-numbers and are present — you asserted the number "
+                    "is knowledge, not a reading, and you own that call. This is not a safety "
+                    "certificate: the guard checks shapes, not meaning."
+                )
             return (
                 "no personal-data SHAPE detected (no digits, no identifiers, lower case). This is "
                 "not a safety certificate: the guard checks shapes, not meaning — a lower-case "
@@ -285,28 +343,34 @@ def check_lesson(text: str, allow_numbers: bool = False) -> LessonVerdict:
     for index, token in enumerate(tokens):
         has_digit = any(ch.isdigit() for ch in token)
         has_alpha = any(ch.isalpha() for ch in token)
-        if has_digit and has_alpha and not re.match(_NUMBER_TOKEN_RE, token):
+        digit_count = sum(1 for ch in token if ch.isdigit())
+        looks_like_id = len(token) >= _IDENTIFIER_MIN_LEN or digit_count >= _IDENTIFIER_MIN_DIGITS
+        if has_digit and has_alpha and looks_like_id and not re.match(_NUMBER_TOKEN_RE, token):
             reasons.append(
                 f"{token!r} mixes letters and digits — that is the shape of an identifier "
                 "(a record number, an accession, a passport), not of a measurement, and no "
                 "flag accepts it"
             )
             break
-        if has_digit or not has_alpha:
-            continue  # numbers are judged below; punctuation-only tokens carry nothing
+        if not has_alpha:
+            continue  # a pure number is judged by the digit rule; punctuation carries nothing
         if index == 0:
             continue  # an ordinary sentence start
-        if token.islower() or _is_acronym(token):
+        # Capitalisation is checked for EVERY token carrying letters, digits or not.
+        # Round 5: digit-bearing tokens returned before this check, so `method Test2
+        # applies` passed — a Title Case name only had to carry a digit to become exempt.
+        if all(ch.islower() for ch in token if ch.isalpha()) or _is_acronym(token):
             continue
         reasons.append(
             f"a capitalised word ({token!r}) after the first one — a method lesson is written "
             "in lower case, because one capital is the shape of a name and names cannot be "
-            "listed. Lower-case it (acronyms like SHBG, TSH or apoB carry two capitals and pass)"
+            "listed. Lower-case it — an acronym passes either fully upper (SHBG, TSH) or opening "
+            "lower (apoB); only Title Case is refused"
         )
         break
 
     spelled = re.search(_SPELLED_NUMBER_RE, raw, flags=re.IGNORECASE | re.UNICODE)
-    has_digits = re.search(_DIGIT_RE, raw) is not None or spelled is not None
+    has_digits = _has_digit(raw) or spelled is not None
     if has_digits and not allow_numbers:
         reasons.append(
             "the lesson contains digits — a method lesson rarely needs them, and a number is where "
@@ -327,7 +391,7 @@ def check_lesson(text: str, allow_numbers: bool = False) -> LessonVerdict:
             "a person is referred to alongside a number — that is a record about someone, "
             "and no flag makes it a method"
         )
-    return LessonVerdict(not reasons, reasons)
+    return LessonVerdict(not reasons, reasons, numbers_allowed=allow_numbers)
 
 
 # ---------------------------------------------------------------- dz detection

package/templates/.claude/skills/goap-research-ed25519/scripts/test_evidence_provenance.py

@@ -676,7 +676,11 @@ class LearningBridgeTests(unittest.TestCase):
         for ok_text in (
             "total testosterone is uninterpretable without SHBG",
             "a single ferritin cannot separate overload from inflammation, pair it with CRP",
-            "apoB tracks risk better than LDL alone",
+            # NOT first in the sentence — round 4 found this test placed `apoB` at the
+            # start, where the sentence-start exemption made it pass no matter what the
+            # acronym rule did. A test whose subject sits in the one exempt position
+            # proves nothing about the rule it claims to cover.
+            "measure apoB before interpreting LDL alone",
         ):
             with self.subTest(text=ok_text):
                 self.assertTrue(self.lb.check_lesson(ok_text).ok, ok_text)
@@ -766,6 +770,87 @@ class LearningBridgeTests(unittest.TestCase):
                                              allow_numbers=True).ok)
 
 
+    # ---------------------------------------------------------------- round 4
+
+    def test_round4_acronym_vs_name_is_decided_by_WHERE_the_capital_sits(self):
+        """The previous predicate — "two or more capitals" — was wrong in both
+        directions at once: `Anne-Marie` and `McDonald` passed as acronyms while
+        `apoB` was refused, contradicting this repo's own documentation."""
+        for name in ("patient Anne-Marie has HIV", "patient McDonald has HIV"):
+            with self.subTest(name=name):
+                self.assertFalse(self.lb.check_lesson(name).ok, name)
+        for acronym in ("measure apoB before interpreting risk",
+                        "total testosterone is uninterpretable without SHBG"):
+            with self.subTest(acronym=acronym):
+                self.assertTrue(self.lb.check_lesson(acronym).ok, acronym)
+
+    def test_round4_punctuation_cannot_launder_an_identifier(self):
+        """`ab1234567` was refused, so the same identifier written `ab—1234567` was
+        split by the tokenizer into a lower-case word plus a permitted number. The raw
+        text still shows the joiner, so that is where this one is checked."""
+        for leak in ("passport ab—1234567 identifies the holder",
+                     "passport ab/1234567 identifies the holder",
+                     "trial NCT—04368728 enrolled a cohort"):
+            with self.subTest(leak=leak):
+                self.assertFalse(self.lb.check_lesson(leak, allow_numbers=True).ok, leak)
+        # A YEAR is not an identifier: a space is deliberately not a joiner.
+        self.assertTrue(self.lb.check_lesson("the 2019 guideline moved the threshold",
+                                             allow_numbers=True).ok)
+        # …and a short lab acronym carrying a digit still passes.
+        self.assertTrue(self.lb.check_lesson("hba1c drifts with red-cell turnover",
+                                             allow_numbers=True).ok)
+
+    def test_round4_the_probe_cannot_be_forged_by_an_exotic_line_separator(self):
+        """`splitlines()` breaks on U+2028 and U+0085, which the renderer does not treat
+        as line breaks — so a lesson containing one produced a 'line' the CLI never
+        emitted, and that forged line satisfied the capability probe. Splitting exactly
+        the way the producer joins keeps a forged tail on the hit's own line."""
+        tail = 'domain "health-research": order unchanged, nothing was hidden'
+        self.assertFalse(self.lb._boost_note_present("  [0.90] (general) x\u2028" + tail))
+        self.assertFalse(self.lb._boost_note_present("  [0.90] (general) x " + tail))
+        # A REAL note — its own line — is still detected.
+        self.assertTrue(self.lb._boost_note_present("  [0.90] (general) x\n  " + tail))
+
+
+    # ---------------------------------------------------------------- round 5
+
+    def test_round5_ONE_definition_of_digit_everywhere(self):
+        """The text scan used the regex `\\d` and the token scan used str.isdigit().
+        `²` satisfies the second but not the first, so one half skipped it as a number
+        and the other never refused it. Two definitions of the same word inside one
+        guard is a gap by construction."""
+        self.assertFalse(self.lb.check_lesson("threshold is ²").ok)
+
+    def test_round5_capitalisation_is_checked_even_when_a_token_carries_a_digit(self):
+        """Digit-bearing tokens returned before the capitalisation check, so a Title
+        Case name only had to carry a digit to become exempt."""
+        self.assertFalse(self.lb.check_lesson("method Test2 applies", allow_numbers=True).ok)
+
+    def test_round5_joiners_and_alphabets_are_not_enumerated(self):
+        """`ab:1234567` passed because a colon was not in the joiner list, and
+        `αβ—1234567` because Greek was not in the letter class. Enumerating joiners and
+        alphabets is the same losing game as enumerating names."""
+        for leak in ("passport ab:1234567 identifies the holder",
+                     "passport αβ—1234567 identifies the holder"):
+            with self.subTest(leak=leak):
+                self.assertFalse(self.lb.check_lesson(leak, allow_numbers=True).ok, leak)
+
+    def test_round5_the_word_person_is_a_person(self):
+        """The singular list enumerated patient/subject/participant and omitted the
+        plainest word of all."""
+        self.assertFalse(self.lb.check_lesson("this person has tsh 8.04", allow_numbers=True).ok)
+
+    def test_round5_the_acceptance_note_does_not_contradict_the_flag(self):
+        """It said "no digits, no figures" on the --allow-numbers path, where digits
+        were present and consciously allowed. A message that contradicts the flag the
+        caller just passed teaches the reader to stop reading messages."""
+        verdict = self.lb.check_lesson("a 56h fast lowers total testosterone by a third",
+                                       allow_numbers=True)
+        self.assertTrue(verdict.ok)
+        self.assertNotIn("no digits", verdict.note)
+        self.assertIn("ALLOWED by --allow-numbers", verdict.note)
+
+
     def test_a_real_failure_is_not_disguised_as_an_old_cli(self):
         """A crash, timeout or corrupt store must read as a failure, not as 'upgrade'."""
         original = self.lb._run_dz