@enwithai/product-check 0.1.0-alpha.0 → 0.2.0

package/ATTRIBUTION.md

@@ -15,8 +15,8 @@
 ## Development provenance
 
 Product Check was written for this repository with substantial AI assistance (Claude Code), directed and reviewed by
-the project's human sponsor. Commits carry a `Co-Authored-By` trailer. It has **no runtime dependencies** and contains
-no vendored third-party code. Test fixtures and the demo application are synthetic; credential-like strings in them
+the project's human sponsor. Commits carry a `Co-Authored-By` trailer. It has **one runtime dependency**, `yaml` (ISC,
+by Eemeli Aro), and contains no vendored third-party code. Test fixtures and the demo application are synthetic; credential-like strings in them
 are generated at run time and are not real.
 
 ## Built on

package/CHANGELOG.md

@@ -6,11 +6,53 @@ versions may break the results schema, which carries its own `schema_version`, a
 
 ## Unreleased
 
-- License: MIT (same as the other Engineering Commons tools).
+## 0.2.0 — 2026-10-28
 
-## 0.1.0-alpha.0 — not released
+Commons integration and the first CT-T4 controls. Rubric `pc-rubric-0.2` (51 controls; scoring rules unchanged);
+results schema `0.1.0`, additive. Results and baselines written by 0.1.0 still validate and load.
 
-First alpha candidate.
+- CT-T4 operational imports ([docs/operational-imports.md](docs/operational-imports.md)): `--openslo` (OpenSLO v1
+  YAML/JSON, repeatable), `--alert-rules` (Prometheus/Mimir rule files, `PrometheusRule`, `/api/v1/rules` JSON,
+  repeatable) and `--service-graph` (Jaeger `/api/dependencies`, `traces_service_graph_request_total` query result).
+  New controls PC-T-18 (SLOs complete), PC-T-19 (every SLO alerted on), PC-T-20 (declared dependencies observed at
+  runtime, with `--architecture-check`); PC-T-14 is now evaluated from these files; the observability PoP is
+  AVAILABLE when they are given.
+- First runtime dependency: `yaml` 2.9.1 (ISC, pinned), used only through `src/parse/yaml.ts` (core schema, unique
+  keys, at most 100 aliases, 10 MiB per file).
+- `--architecture-check <report.json>` (contract `imports.architecture_check`) imports an Architecture Check report
+  (schema 1.0 or 1.1, `analyze`/`check` output). New control **PC-T-17 "Architecture model matches the code"**
+  (technology, CT-T3, weight 1, P2): PASS with no verified drift of medium severity or above, PARTIAL with one
+  `architecture-drift` finding otherwise, NOT_TESTED without a report. Hypotheses and unknowns never count. Rules in
+  `docs/interoperability.md`.
+- Rubric `pc-rubric-0.2` (48 controls; scoring rules unchanged). The scorecard schema accepts `pc-rubric-0.1` and
+  `pc-rubric-0.2`, and integrity recomputation keeps the stored version, so 0.1.0 results still validate and load as
+  retest baselines. Results schema stays `0.1.0`; `imports.architecture_check` is optional in the contract schema.
+- `product-check spec`: reverse-engineers an as-built specification from a repository (pages, endpoints, data
+  entities, integrations, configuration names, auth boundaries, test titles) with evidence for every item. It writes
+  `as-built-spec.json` (new schema `as-built-spec.schema.json`) and a Spec Kit `specs/000-as-built/spec.md` that Spec
+  Check can lint. Intent that code cannot show is left as `[NEEDS CLARIFICATION]`. Source only; nothing executed.
+- `run`/`retest` derive the as-built spec from the same snapshot. The blueprint embeds it as the new optional field
+  `as_is.as_built`, and `as-built-spec.json` plus `specs/000-as-built/spec.md` are written next to the report
+  (`blueprint --out-dir` re-renders them). Traceability now names the as-built requirement a finding touches
+  (`As-built FR-002; requirement PC-…`): pages, endpoints and entities match by file, integrations and configuration
+  only by exact line, and application URLs by path. Scores, verdicts and findings are unchanged.
+- Schema: additive, still `0.1.0`. Existing contracts, observations and baselines remain valid. Results that carry
+  `as_is.as_built` do not validate with the schemas bundled in 0.1.0 and earlier.
+- Dashboard: a sixth view, **As-built spec**, shows the discovered surface, the questions only a person can answer,
+  user stories, and every FR/NFR/SC/EC item with its certainty, source, evidence and linked findings (open or fixed),
+  with type, certainty and text filters. It is rendered from the results JSON like every other view.
+- Demo: the baseline, retest and repository-only examples include the as-built spec, and
+  `examples/vibe-app-demo/output/as-built/` holds the standalone `spec` output. Both are checked against a fresh run.
+
+## 0.1.0 — 2026-10-12
+
+First release without a pre-release suffix, so `npm install @enwithai/product-check` and `npx @enwithai/product-check` work without a
+tag. No functional changes from 0.1.0-alpha.0. Still pre-1.0: the report schema and command options may change in minor
+versions.
+
+## 0.1.0-alpha.0 — 2026-10-12 (published to npm)
+
+First alpha. MIT licensed.
 
 - `product-check run|retest|scan|init|validate|report|blueprint|dashboard|controls|schema`.
 - Scan → Test → Validate → Blueprint → Dashboard → (advisory) Remediate → Retest, recorded per run.

package/NOTICE.md

@@ -8,9 +8,11 @@ license.
 
 ## Third-party material
 
-Product Check has **no runtime dependencies** and contains no vendored source code. It reads formats defined by others
-(JSON Schema, JUnit XML, HAR, `npm audit` JSON, and the report schemas of Spec Check, Impact Check and Outcome Check);
-no code from those projects is included.
+Product Check has **one runtime dependency**, [`yaml`](https://github.com/eemeli/yaml) 2.9.1 (ISC License, Copyright
+Eemeli Aro), installed from npm and not vendored. It reads formats defined by others (JSON Schema, JUnit XML, HAR,
+`npm audit` JSON, the report schemas of Spec Check, Impact Check, Outcome Check and Architecture Check, OpenSLO,
+Prometheus rule files, Jaeger dependencies and the OpenTelemetry service-graph metrics); no code from those projects
+is included.
 
 ## Trademarks
 

package/README.md

@@ -16,8 +16,8 @@ Customer, Technology and Trust controls, and gives you:
 
 Everything is written to one versioned JSON file. The report, blueprint and dashboard are renderings of it.
 
-> Status: **alpha** (`0.1.0-alpha.0`, results schema `0.1.0`). Install with
-> `npm install --global @enwithai/product-check@alpha`, or build from source as in the demo below.
+> Status: **early release** (`0.2.0`, pre-1.0, results schema `0.1.0`, rubric `pc-rubric-0.2`). Install with
+> `npm install --global @enwithai/product-check`, or build from source as in the demo below.
 
 ## What it will not pretend
 
@@ -28,7 +28,7 @@ never submits forms and never sends anything anywhere except passive GET request
 
 ## Two-minute demo
 
-Requires Node.js 22, 24 or ≥ 26, and git. No account, no network, no runtime dependencies.
+Requires Node.js 22, 24 or ≥ 26, and git. No account, no network, one runtime dependency (`yaml`, for OpenSLO and alert-rule files).
 
 ```bash
 git clone https://github.com/enwithai/product-check.git && cd product-check
@@ -64,7 +64,7 @@ Verdict: READY_WITH_CONDITIONS at CT-T2 ("CONDITIONAL")
 Customer   100/100 (coverage 92%, confidence HIGH)
 Technology 94/100 (coverage 100%, confidence MEDIUM)
 Trust      97/100 (coverage 83%, confidence HIGH)
-Retest vs PCR-20261014T100000Z-7386B1: 35 verified fixed, 0 new, 0 reopened, 0 regressed control(s)
+Retest vs PCR-20261014T100000Z-D74DF2: 35 verified fixed, 0 new, 0 reopened, 0 regressed control(s)
 ```
 
 The two remaining P2s (no error monitoring, no AI evaluation suite) are real gaps in the fixed demo app. A
@@ -94,8 +94,9 @@ npm audit --json > npm-audit.json
 product-check run --repo . --test-results junit.xml --npm-audit npm-audit.json --stage PRE_LAUNCH
 ```
 
-Results go to `.product-check/`: `product-check-results.json`, `report.md`, `blueprint.md`, `work-packets/*.md` and
-`dashboard.html` (open it directly; no server). After changing things, run
+Results go to `.product-check/`: `product-check-results.json`, `report.md`, `blueprint.md`, `work-packets/*.md`,
+`dashboard.html` (open it directly; no server) and, when the repository was read, an as-built spec
+(`specs/000-as-built/spec.md`, `as-built-spec.json`) reverse-engineered from its structure. After changing things, run
 `product-check retest --baseline .product-check/product-check-results.json …` with the same inputs.
 
 No deployed URL you can scan? Export a HAR file from your browser's DevTools on your app and pass `--har app.har`.
@@ -112,6 +113,7 @@ authorization or tenant-isolation tests) to the controls Product Check cannot te
 | `run`                              | Scan → Test → Validate → Blueprint; writes results and renderings                                 |
 | `retest --baseline <file>`         | `run` plus comparison: verified fixes, reopened and new findings, regressions, trends             |
 | `scan`                             | Discovery only: which points of presence exist and what could be checked (no requests, no checks) |
+| `spec`                             | Reverse-engineers an as-built spec (Spec Kit `spec.md` + JSON) from the repository's structure    |
 | `init`                             | Writes an editable scan contract                                                                  |
 | `validate <file>…`                 | Schema validation; for results also referential integrity and recomputation of scores and verdict |
 | `report`, `blueprint`, `dashboard` | Re-render from a results file                                                                     |

package/dashboard/dashboard.css

@@ -331,6 +331,12 @@ th {
   font-weight: 600;
   background: var(--surface);
 }
+td.id {
+  white-space: nowrap;
+}
+td.id code {
+  overflow-wrap: normal;
+}
 td.num,
 th.num {
   text-align: right;

package/dist/blueprint/build.d.ts

@@ -8,7 +8,7 @@
 import type { EvidenceCollector } from "../evidence/collector.js";
 import type { ObservationSet } from "../inspectors/http/observe.js";
 import type { RepoFacts } from "../inspectors/source/facts.js";
-import type { Blueprint, Finding, ScanContract, Validation } from "../types.js";
+import type { AsBuiltSpec, Blueprint, Finding, ScanContract, Validation } from "../types.js";
 /** Inputs for blueprint construction. */
 export interface BlueprintInput {
     contract: ScanContract;
@@ -22,6 +22,8 @@ export interface BlueprintInput {
     hasBaseline: boolean;
     testsImported: boolean;
     aiInScope: boolean;
+    /** The as-built spec derived from the same snapshot (null when source was not inspected). */
+    asBuilt: AsBuiltSpec | null;
 }
 /** Builds the blueprint and links findings to work packets (mutates finding.work_packet_id). */
 export declare function buildBlueprint(input: BlueprintInput): Blueprint;

package/dist/blueprint/build.js

@@ -1,5 +1,6 @@
 import { SCHEMA_VERSION } from "../types.js";
 import { control, CONTROLS, VERIFY_INSTRUCTION } from "../validation/catalog.js";
+import { asBuiltBody } from "../spec/build.js";
 import { regressionCandidate } from "./candidates.js";
 const SEVERITY_ORDER = ["P0", "P1", "P2", "P3"];
 const HORIZON_BY_SEVERITY = { P0: "NOW", P1: "NOW", P2: "NEXT", P3: "LATER" };
@@ -9,7 +10,7 @@ const STANDARD_CONSTRAINTS = [
     "Do not disable, skip or delete tests or checks to make them pass.",
     "Do not mark this packet done without a Product Check retest showing the control PASS with new evidence.",
 ];
-/** As-is architecture components with evidence. */
+/** As-is architecture components with evidence, plus the as-built spec when source was inspected. */
 function asIs(input) {
     const components = [];
     const { repo, app, ev } = input;
@@ -141,7 +142,39 @@ function asIs(input) {
     if (repo && repo.dbDeps.length > 0 && repo.migrations.length === 0)
         uncertainties.push("A database is used but its schema is not versioned in the repository; the live schema was not inspected.");
     uncertainties.push("Authenticated, multi-step and data-changing journeys were not exercised (no browser automation or credentialed access in this release).");
-    return { components: components.sort((a, b) => (a.id < b.id ? -1 : 1)), uncertainties };
+    return {
+        components: components.sort((a, b) => (a.id < b.id ? -1 : 1)),
+        uncertainties,
+        ...(input.asBuilt ? { as_built: asBuiltBody(input.asBuilt) } : {}),
+    };
+}
+/**
+ * Maps a finding location to the as-built requirements it touches: a repository path (`file:line`) matches the
+ * surface items defined in that file; an application URL matches the page or endpoint with that path.
+ */
+function requirementsAt(spec, location) {
+    if (!spec)
+        return [];
+    let urlPath = null;
+    try {
+        urlPath = /^https?:\/\//.test(location) ? new URL(location).pathname : null;
+    }
+    catch {
+        urlPath = null;
+    }
+    const line = /:(\d+)$/.exec(location)?.[1];
+    const file = location.replace(/:\d+$/, "");
+    // Pages, endpoints, entities and boundaries match by file; integrations and configuration names (which share
+    // manifests and helper files with unrelated code) only on the exact line.
+    const byFile = new Set(["page", "endpoint", "entity", "auth-boundary"]);
+    const surface = new Set(spec.surface
+        .filter((s) => urlPath !== null
+        ? (s.kind === "page" || s.kind === "endpoint") && s.name === urlPath
+        : s.location.path === file &&
+            (byFile.has(s.kind) || (line !== undefined && s.location.line === Number(line))))
+        .filter((s) => s.kind !== "test")
+        .map((s) => s.id));
+    return spec.requirements.filter((r) => r.surface_ids.some((id) => surface.has(id))).map((r) => r.id);
 }
 /** Remediation verification state for a control's findings. */
 function verification(findings, input, v) {
@@ -325,12 +358,15 @@ export function buildBlueprint(input) {
     const journeys = input.contract.critical_journeys;
     const traceability = input.findings.map((f) => {
         const rem = remediations.find((r) => r.finding_ids.includes(f.id));
+        const asBuilt = requirementsAt(input.asBuilt, f.location);
         return {
             finding_id: f.id,
             intent: input.contract.target.purpose,
-            journey_or_requirement: f.pillar === "customer" && journeys.length > 0
-                ? `Journey: ${journeys[0] ?? ""}`
-                : `Requirement ${f.control_id}: ${f.expected}`,
+            journey_or_requirement: asBuilt.length > 0
+                ? `As-built ${asBuilt.join(", ")}; requirement ${f.control_id}: ${f.expected}`
+                : f.pillar === "customer" && journeys.length > 0
+                    ? `Journey: ${journeys[0] ?? ""}`
+                    : `Requirement ${f.control_id}: ${f.expected}`,
             observed_behavior: f.actual,
             component: f.location,
             evidence_ids: f.evidence_ids,

package/dist/cli/run.js

@@ -12,11 +12,15 @@ import { decidePermissions } from "../contract/safety.js";
 import { buildPops, popCoverage } from "../discovery/pops.js";
 import { snapshotRepo } from "../discovery/repo.js";
 import { renderDashboard } from "../dashboard/render.js";
+import { EvidenceCollector } from "../evidence/collector.js";
 import { ExitCode, ProductCheckError, inputError, usageError } from "../errors.js";
 import { deriveFacts } from "../inspectors/source/facts.js";
+import { deriveSurface } from "../inspectors/source/surface.js";
 import { renderBlueprint, renderPacket, renderReport } from "../reporting/markdown.js";
-import { runAssessment } from "../run.js";
+import { renderAsBuiltSpec } from "../reporting/spec-markdown.js";
+import { makeRunId, runAssessment } from "../run.js";
 import { formatErrors, KIND_SCHEMA, schemaFiles, schemaText, validateAgainst } from "../schema/registry.js";
+import { buildAsBuiltSpec, specFromResults } from "../spec/build.js";
 import { sha256 } from "../util/hash.js";
 import { relativize } from "../util/paths.js";
 import { CONTROLS } from "../validation/catalog.js";
@@ -37,6 +41,9 @@ Usage:
                                        Discovery only: what could be inspected (no requests, no checks)
   product-check init [--repo <dir>] [--url <url>] [--stage <stage>] [--output <file>]
                                        Write a scan contract to edit (default product-check.contract.json)
+  product-check spec --repo <dir> [--contract <file>] [--out-dir <dir>] [--format md|json|both]
+                                       Reverse-engineer an as-built spec (Spec Kit spec.md + JSON) from the
+                                       repository's structure; nothing is executed
   product-check validate <file>...     Validate artifacts against the schemas (+ integrity for results)
   product-check report <results.json>  Markdown report        product-check blueprint <results.json>
   product-check dashboard <results.json> [--output dashboard.html]
@@ -55,7 +62,11 @@ Inputs (run/retest):
   --npm-audit <file>        Output of \`npm audit --json\`
   --har <file>              Browser HAR export (offline application evidence)
   --observations <file>     Recorded observations (from --record-observations)
-  --spec-check/--impact-check/--outcome-check <file>   Optional Engineering Commons reports
+  --spec-check/--impact-check/--outcome-check/--architecture-check <file>
+                            Optional Engineering Commons reports
+  --openslo <file>          OpenSLO v1 YAML/JSON (SLO, SLI, AlertPolicy; repeatable)
+  --alert-rules <file>      Prometheus/Mimir rules, PrometheusRule, or /api/v1/rules JSON (repeatable)
+  --service-graph <file>    Jaeger /api/dependencies or traces_service_graph_request_total query JSON
   --baseline <file>         Previous results to compare with (retest)
 Output:
   --out-dir <dir>           Default .product-check   --json   Print results JSON to stdout, write nothing
@@ -130,6 +141,10 @@ const OPTIONS = {
     "spec-check": { type: "string" },
     "impact-check": { type: "string" },
     "outcome-check": { type: "string" },
+    "architecture-check": { type: "string" },
+    openslo: { type: "string", multiple: true },
+    "alert-rules": { type: "string", multiple: true },
+    "service-graph": { type: "string" },
     baseline: { type: "string" },
     "out-dir": { type: "string" },
     output: { type: "string" },
@@ -173,6 +188,10 @@ function buildContract(values, io) {
         specCheck: values["spec-check"],
         impactCheck: values["impact-check"],
         outcomeCheck: values["outcome-check"],
+        architectureCheck: values["architecture-check"],
+        openslo: values.openslo,
+        alertRules: values["alert-rules"],
+        serviceGraph: values["service-graph"],
     }, io.cwd, today);
     if (values["authorized-by"] !== undefined && contract.authorization.attestation)
         contract.authorization.attestation.authorized_by = values["authorized-by"];
@@ -181,6 +200,15 @@ function buildContract(values, io) {
     }
     return { contract, fromFile };
 }
+/** Writes the as-built spec (JSON + Spec Kit Markdown) carried by a results document, if any. */
+function writeSpec(results, dir) {
+    const spec = specFromResults(results);
+    if (!spec)
+        return [];
+    writeFile(join(dir, "as-built-spec.json"), `${JSON.stringify(spec, null, 2)}\n`);
+    writeFile(join(dir, "specs", "000-as-built", "spec.md"), renderAsBuiltSpec(spec));
+    return ["as-built-spec.json", "specs/000-as-built/spec.md"];
+}
 /** Writes all renderings of a results document into a directory. */
 function writeOutputs(results, dir, branding, dashboard) {
     const written = [];
@@ -193,6 +221,7 @@ function writeOutputs(results, dir, branding, dashboard) {
     put("blueprint.md", renderBlueprint(results, { branding }));
     for (const p of results.blueprint.work_packets)
         put(`work-packets/${p.id}.md`, renderPacket(results, p));
+    written.push(...writeSpec(results, dir));
     if (dashboard)
         put("dashboard.html", renderDashboard(results, { branding }));
     return written;
@@ -289,6 +318,9 @@ function commandScan(values, io) {
         auditImported: contract.imports.npm_audit !== null,
         specImported: contract.imports.spec_check !== null,
         outcomeImported: contract.imports.outcome_check !== null,
+        operationalImported: contract.imports.openslo.length > 0 ||
+            contract.imports.alert_rules.length > 0 ||
+            contract.imports.service_graph !== null,
         aiInScope: contract.product.uses_ai === true || (repo?.aiDeps.length ?? 0) > 0,
         tier,
         now: (io.now?.() ?? new Date()).toISOString(),
@@ -319,6 +351,60 @@ function commandScan(values, io) {
     io.stdout(lines.join("\n"));
     return ExitCode.Ok;
 }
+/** spec: reverse-engineer an as-built specification from the repository (source only, no requests). */
+function commandSpec(values, io) {
+    const { contract } = buildContract(values, io);
+    if (!contract.target.repository)
+        throw usageError("spec reads a repository: pass --repo <dir>.", "Example: product-check spec --repo .");
+    const format = values.format ?? "both";
+    if (!["md", "json", "both"].includes(format))
+        throw usageError("--format must be md, json or both.");
+    const repoPath = contract.target.repository.path;
+    const facts = deriveFacts(snapshotRepo(repoPath, contract.constraints.max_files, contract.target.name));
+    const started = io.now?.() ?? new Date();
+    const now = started.toISOString();
+    const ev = new EvidenceCollector(makeRunId(started, relativize(contract, io.cwd)), now);
+    const spec = buildAsBuiltSpec({
+        contract,
+        facts,
+        surface: deriveSurface(facts),
+        ev,
+        repository: display(io.cwd, repoPath),
+        generatedAt: now,
+    });
+    if (values.json) {
+        io.stdout(`${JSON.stringify(spec, null, 2)}\n`);
+        return ExitCode.Ok;
+    }
+    const outDir = isAbsolute(values["out-dir"] ?? "")
+        ? values["out-dir"]
+        : resolve(io.cwd, values["out-dir"] ?? ".product-check");
+    const written = [];
+    if (format !== "md") {
+        writeFile(join(outDir, "as-built-spec.json"), `${JSON.stringify(spec, null, 2)}\n`);
+        written.push("as-built-spec.json");
+    }
+    if (format !== "json") {
+        writeFile(join(outDir, "specs", "000-as-built", "spec.md"), renderAsBuiltSpec(spec));
+        written.push("specs/000-as-built/spec.md");
+    }
+    if (!values.quiet) {
+        const count = (k) => spec.surface.filter((s) => s.kind === k).length;
+        io.stdout([
+            `As-built spec for ${contract.target.name} (source only; nothing executed, no requests sent)`,
+            `  ${count("page")} page(s), ${count("endpoint")} endpoint(s), ${count("entity")} entit(y/ies), ${count("integration")} integration(s), ${count("config")} config name(s), ${count("test")} test title(s)`,
+            `  ${spec.requirements.length} functional requirement(s), ${spec.non_functional.length} non-functional, ${spec.clarifications.length} clarification(s) for a person to answer`,
+            `Wrote ${display(io.cwd, outDir)}/: ${written.join(", ")}`,
+            format !== "json"
+                ? `Next: answer the NEEDS CLARIFICATION markers, then lint it: spec-check check ${display(io.cwd, join(outDir, "specs", "000-as-built", "spec.md"))}`
+                : "",
+            "",
+        ]
+            .filter((l, i, a) => l !== "" || i === a.length - 1)
+            .join("\n"));
+    }
+    return ExitCode.Ok;
+}
 /** init: write a contract. */
 function commandInit(values, io) {
     const out = isAbsolute(values.output ?? "")
@@ -424,6 +510,10 @@ async function main(argv, io) {
             if (rest.length > 0)
                 throw usageError(`Unexpected argument: ${rest[0]}`);
             return commandScan(values, io);
+        case "spec":
+            if (rest.length > 0)
+                throw usageError(`Unexpected argument: ${rest[0]}`);
+            return commandSpec(values, io);
         case "init":
             return commandInit(values, io);
         case "validate":
@@ -447,7 +537,8 @@ async function main(argv, io) {
                 writeFile(join(dir, "blueprint.md"), renderBlueprint(results, { branding }));
                 for (const p of results.blueprint.work_packets)
                     writeFile(join(dir, "work-packets", `${p.id}.md`), renderPacket(results, p));
-                io.stdout(`Wrote blueprint.json, blueprint.md and ${results.blueprint.work_packets.length} work packet(s) to ${display(io.cwd, dir)}\n`);
+                const spec = writeSpec(results, dir);
+                io.stdout(`Wrote blueprint.json, blueprint.md${spec.length ? ", the as-built spec" : ""} and ${results.blueprint.work_packets.length} work packet(s) to ${display(io.cwd, dir)}\n`);
             }
             else
                 io.stdout(values.format === "json"
@@ -468,7 +559,7 @@ async function main(argv, io) {
                 io.stdout(`${JSON.stringify(CONTROLS.map(({ remediation: _r, ...c }) => c), null, 2)}\n`);
             else {
                 const lines = [
-                    "Control catalog (rubric pc-rubric-0.1). Tiers carry forward: a tier applies its own and all earlier controls.",
+                    "Control catalog (rubric pc-rubric-0.2). Tiers carry forward: a tier applies its own and all earlier controls.",
                     "",
                 ];
                 for (const c of CONTROLS)
@@ -490,7 +581,7 @@ async function main(argv, io) {
             return ExitCode.Ok;
         }
         default:
-            throw usageError(`Unknown command: ${command}`, "Commands: run, retest, scan, init, validate, report, blueprint, dashboard, controls, schema.");
+            throw usageError(`Unknown command: ${command}`, "Commands: run, retest, scan, spec, init, validate, report, blueprint, dashboard, controls, schema.");
     }
 }
 /** Runs the CLI and returns the process exit code. Never throws. */

package/dist/contract/contract.d.ts

@@ -27,6 +27,10 @@ export interface ContractFlags {
     specCheck?: string | undefined;
     impactCheck?: string | undefined;
     outcomeCheck?: string | undefined;
+    architectureCheck?: string | undefined;
+    openslo?: string[] | undefined;
+    alertRules?: string[] | undefined;
+    serviceGraph?: string | undefined;
 }
 /** Applies CLI flags over a contract (flags win). Paths are resolved against cwd. */
 export declare function applyFlags(base: ScanContract, flags: ContractFlags, cwd: string, today: string): ScanContract;

package/dist/contract/contract.js

@@ -56,6 +56,10 @@ export function defaultContract() {
             spec_check: null,
             impact_check: null,
             outcome_check: null,
+            architecture_check: null,
+            openslo: [],
+            alert_rules: [],
+            service_graph: null,
         },
         control_mappings: [],
         risk_acceptances: [],
@@ -110,6 +114,8 @@ export function loadContract(path) {
         contract.target.repository.path = abs(contract.target.repository.path);
     const i = contract.imports;
     i.test_results = i.test_results.map(abs);
+    i.openslo = i.openslo.map(abs);
+    i.alert_rules = i.alert_rules.map(abs);
     for (const key of [
         "npm_audit",
         "har",
@@ -117,6 +123,8 @@ export function loadContract(path) {
         "spec_check",
         "impact_check",
         "outcome_check",
+        "architecture_check",
+        "service_graph",
     ]) {
         const value = i[key];
         if (value !== null)
@@ -173,6 +181,14 @@ export function applyFlags(base, flags, cwd, today) {
         c.imports.impact_check = abs(flags.impactCheck);
     if (flags.outcomeCheck !== undefined)
         c.imports.outcome_check = abs(flags.outcomeCheck);
+    if (flags.architectureCheck !== undefined)
+        c.imports.architecture_check = abs(flags.architectureCheck);
+    if (flags.openslo)
+        c.imports.openslo = [...c.imports.openslo, ...flags.openslo.map(abs)];
+    if (flags.alertRules)
+        c.imports.alert_rules = [...c.imports.alert_rules, ...flags.alertRules.map(abs)];
+    if (flags.serviceGraph !== undefined)
+        c.imports.service_graph = abs(flags.serviceGraph);
     if (c.target.name === "unnamed product") {
         c.target.name = c.target.repository
             ? (c.target.repository.path.split(/[\\/]/).filter(Boolean).at(-1) ?? "product")

package/dist/dashboard/render.d.ts

@@ -1,4 +1,9 @@
 import type { Results } from "../types.js";
+/**
+ * Converts an as-built statement (Markdown built in src/spec/build.ts: code spans for repository-derived names,
+ * backslash escapes elsewhere) to HTML. Every segment is HTML-escaped; only `<code>` is produced.
+ */
+export declare function statementHtml(statement: string): string;
 /** Renders the dashboard HTML. */
 export declare function renderDashboard(r: Results, options: {
     branding: boolean;