@esneiderbravo/speclaw 0.1.13 → 0.1.14

package/dist/cli/commands/update.js

@@ -43,6 +43,22 @@ const MIGRATIONS = [
             "'test kind does not yet apply' escape hatch. If the section is missing, add it.\n" +
             "- Preserve all project-specific wording; only apply these speclaw-authored changes.",
     },
+    {
+        version: "0.1.14",
+        describe: "Real-data-write stop condition in the constitution (personalized files)",
+        agentPrompt: "- Add a stop condition, at the same tier as deletes/force-push, that verification " +
+            "must NOT create/update/delete the user's real data (a production or development " +
+            "database, or files holding real data) — including setting up or tearing down test " +
+            "data or running raw store commands (e.g. direct SQL) against a live store. " +
+            "Verification runs against an isolated/throwaway store (a temporary copy, an in-memory " +
+            "database, a dedicated test store, or a rolled-back transaction); snapshot-and-restore " +
+            "is not sanctioned. If a real-store write is genuinely unavoidable, stop and get " +
+            "explicit authorization first — a backup is not a substitute.\n" +
+            "- Apply it in CLAUDE.md and AGENTS.md (the Rule 6 / stop-conditions list), in " +
+            "docs/standards/base-standards.md (the 'ask before irreversible actions' bullet), and " +
+            "in docs/standards/testing-standards.md (the 'Manual & end-to-end verification' section).\n" +
+            "- Preserve all project-specific wording; only apply these speclaw-authored changes.",
+    },
 ];
 /**
  * Update speclaw and bring the current project up to date without a full re-init:

package/dist/modules/foundation/assets/AGENTS.template.md

@@ -35,7 +35,10 @@ Claude-specific notes: [`CLAUDE.md`](CLAUDE.md). The law: [`LAWS.md`](LAWS.md).
    [`docs/standards/conventions.md`](docs/standards/conventions.md).
 6. **Use the skills.** `ai-specs/` is the canonical home for skills, commands,
    and subagents, mirrored to each IDE directory via symlinks.
-7. **Ask before irreversible or outward-facing actions.**
+7. **Ask before irreversible or outward-facing actions** — destructive commands;
+   writing to a real data store (DB rows or files with real user data, including
+   for tests — verify against an isolated/throwaway store); publishing
+   reviews/tickets/comments.
 
 ## The standards (the law, in detail)
 

package/dist/modules/foundation/assets/CLAUDE.template.md

@@ -81,5 +81,7 @@ task, use it — do not improvise a parallel process.
 ## Rule 6 — Stop conditions
 
 Stop and ask the user before: destructive operations (deletes, force-push,
-schema drops), publishing anything outward-facing (PR reviews, tickets,
-comments), or any action that contradicts a standard.
+schema drops), writing to a real data store (DB rows or files holding real user
+data — including to set up or tear down test data; verification runs against an
+isolated/throwaway store instead), publishing anything outward-facing (PR
+reviews, tickets, comments), or any action that contradicts a standard.

package/dist/modules/foundation/assets/docs/standards/base-standards.template.md

@@ -45,8 +45,9 @@ bodies. Match what the repo does; do not impose a language it doesn't use.
 - Code reads like its neighbors (naming, structure, idioms).
 - Report outcomes faithfully: if a gate fails, say so with the output; never
   claim a success you did not observe.
-- Ask before irreversible or outward-facing actions (destructive commands,
-  publishing reviews/tickets/comments).
+- Ask before irreversible or outward-facing actions (destructive commands;
+  writing to a real data store — DB rows or files holding real user data,
+  including to set up or tear down test data; publishing reviews/tickets/comments).
 
 <!-- speclaw init: add any project-specific base rules the analysis surfaced. -->
 {{base_standards_extra}}

package/dist/modules/foundation/assets/docs/standards/testing-standards.template.md

@@ -29,6 +29,15 @@ suppressing a linter or deleting a test.
 
 - When a change affects runtime behavior and it's feasible, verify it works by
   exercising the endpoint/UI — don't assume green CI covers everything.
+- **Verification never touches real data.** Run it against an isolated store — a
+  temporary copy, an in-memory database, a dedicated test store, or a rolled-back
+  transaction — or against pure logic with fixtures. Never create/update/delete
+  the user's real data (a production or development database, or files holding
+  real data), and never run raw store commands (e.g. direct SQL) against a live
+  store, to prove a change. Snapshot-and-restore is not sanctioned. If a
+  real-store write is genuinely unavoidable, stop and get explicit authorization
+  first — a backup is not a substitute (see the stop conditions in the
+  constitution).
 - The mandatory spec task steps
   ([`lawbook.md`](lawbook.md)) define which manual checks
   the agent must execute itself.

package/dist/modules/lawbook/assets/skills/build/SKILL.md

@@ -43,6 +43,22 @@ Run them yourself and report real output. A red gate blocks completion.
 Exercise the behavior (endpoint/UI/CLI) yourself where feasible — do not
 delegate manual testing to the user. Record what you verified.
 
+**Verification is isolated by construction — it never touches real data.** Run it
+against an ephemeral or throwaway store: a temporary copy, an in-memory database
+(`:memory:`), a dedicated test store, or inside a transaction that is rolled
+back — best of all, verify pure/domain logic with fixtures and no store at all.
+Do **not** create, update, or delete the user's real data (a production or
+development database, or files holding real data) as a side effect of proving a
+change, and do **not** run raw store commands (e.g. direct SQL) against a live
+store. Snapshot-and-restore is not a sanctioned method — a stray write slips past
+the restore.
+
+If isolation is genuinely impossible and a real-store write is unavoidable,
+**stop and ask first** — state exactly what you will write and to which store —
+and proceed only after explicit authorization. A backup is not a substitute for
+authorization. Record in the report how verification stayed isolated (or the
+authorization you obtained).
+
 ## Step 5 — Write the discipline reports (mandatory)
 
 Record the evidence of testing under `lawbook/changes/<name>/reports/`, one file

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@esneiderbravo/speclaw",
-  "version": "0.1.13",
+  "version": "0.1.14",
   "publishConfig": {
     "access": "public"
   },