@juangcarmona/lighthouse 0.11.4 → 0.11.5

package/README.md

@@ -2,6 +2,8 @@
 
 This package is the core Lighthouse harness. It provides the `lighthouse` command, the manifest schema and the generated `LIGHTHOUSE.md` projection.
 
+For delivery actions, labels and workflow upgrades, read the installed SDLC guide at `node_modules/@juangcarmona/lighthouse-sdlc/README.md` from the adopter root. The generated `LIGHTHOUSE.md` links it directly.
+
 ## Initialize a repository
 
 Install the exact Lighthouse package artifact selected for the release and run `lighthouse init --name <product>` in a new repository. Add `--profile visual-theme` when the project wants the Lighthouse UI contract. Lighthouse creates the manifest, the `src/`, `docs/`, `infra/` and `scripts/` boundaries, the repository guardrails and the generated `LIGHTHOUSE.md`. Inspect the plan and projection, then run `lighthouse verify` before adding project-specific policy or exceptions.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@juangcarmona/lighthouse",
-  "version": "0.11.4",
+  "version": "0.11.5",
   "type": "module",
   "description": "Lighthouse adoption and verification CLI",
   "repository": {
@@ -23,7 +23,7 @@
     "@arcshape/cli": "0.1.6",
     "@juangcarmona/lighthouse-ui": "0.2.0",
     "@prodshape/cli": "0.23.0",
-    "@juangcarmona/lighthouse-sdlc": "0.15.0"
+    "@juangcarmona/lighthouse-sdlc": "0.15.1"
   },
   "files": [
     "src/lighthouse.mjs",

package/src/lighthouse.mjs

@@ -236,7 +236,7 @@ function capabilityAdoption(previous = null) {
   if (!catalog) return {};
   return Object.fromEntries(catalog.capabilities.map((capability) => {
     const current = previous?.adoption?.[capability.id];
-    const status = current?.catalogVersion === catalog.package.version
+    const status = current?.catalogVersion === catalog.package.version && current?.version === capability.version
       ? current.status
       : sdlcCapabilities.initialAdoptionStatus?.(capability) ?? 'pending-adoption';
     const nextAction = status === 'available'
@@ -288,9 +288,10 @@ function render(manifest) {
       : 'The Lighthouse documentation site is enabled; publication requires successful ProductShape and ArcShape validation.';
   const selectedSdlc = normalizeSdlcPackage(manifest);
   const sdlcLine = selectedSdlc ? `- SDLC package: \`${selectedSdlc.name}@${selectedSdlc.version}\`\n` : '';
+  const sdlcGuide = selectedSdlc ? 'For delivery, labels or GitHub workflows, read [the installed SDLC delivery guide](node_modules/@juangcarmona/lighthouse-sdlc/README.md) first. Confirm the installed package version, workflow source pin and current branch before describing deployed behavior.\n\n' : '';
   const selectedUi = manifest.packages?.ui;
   const uiLine = selectedUi ? `- UI package: \`${selectedUi.name}@${selectedUi.version}\`\n` : '';
-  return `<!-- Generated by Lighthouse. Edit lighthouse.json and regenerate this file. -->\n\n# ${manifest.product} repository baseline\n\n- Baseline: \`${manifest.baseline}\`\n- Product: \`${manifest.product}\`\n- Profiles: ${manifest.profiles.length ? manifest.profiles.map((x) => `\`${x}\``).join(', ') : 'none'}\n${sdlcLine}${uiLine}- ProductShape: ${manifest.integrations.productShape ?? 'not adopted'}\n- ArcShape: ${manifest.integrations.arcShape ?? 'not adopted'}\n- Public site: \`${publicSite}\`\n- Repository roots: ${repository.layout.map((x) => `\`${x}/\``).join(', ')}\n- Commit convention: \`${repository.conventions.commits}\`\n\n## Delivery contract\n\n${authorities} Lighthouse installs the repository baseline and verifies the selected integrations.\n\nThe repository keeps source code in \`src/\`, documentation in \`docs/\`, infrastructure in \`infra/\` and repository automation in \`scripts/\`. A project may record a narrow, owned exception, but an initializer never overwrites an existing project file.\n\nThe selected SDLC package owns lifecycle skills, commands, meta-commands, routes and gates. The \`.lighthouse/\` control plane records the selected package, command aliases and host adapters without storing agent runtime data. Use \`lighthouse aliases --format json\` or \`.lighthouse/commands.json\` to discover canonical and short agent commands.\n\n${publicSiteContract} This route publishes product and architecture documentation. Application deployment follows the repository's own delivery policy.\n\n## User identity\n\nWhen the product needs user authentication, delegate it to an external OpenID Connect provider through maintained framework middleware. Reuse an existing shared provider; Keycloak is the recommended self-hosted reference. Do not build password storage, credential recovery or an authorization server without an explicit product and architecture exception. Application authorization stays in the product. Use separate application clients and keep shared identity infrastructure outside application teardown.\n\nRead the installed Lighthouse package guide at \`assets/profiles/identity.md\` before implementing authentication. This is review guidance; foundation verification does not prove runtime authentication or authorization.\n\nThis file is managed. Put repository-specific policy in its own documentation and keep this projection generated from \`lighthouse.json\`.\n`;
+  return `<!-- Generated by Lighthouse. Edit lighthouse.json and regenerate this file. -->\n\n# ${manifest.product} repository baseline\n\n- Baseline: \`${manifest.baseline}\`\n- Product: \`${manifest.product}\`\n- Profiles: ${manifest.profiles.length ? manifest.profiles.map((x) => `\`${x}\``).join(', ') : 'none'}\n${sdlcLine}${uiLine}- ProductShape: ${manifest.integrations.productShape ?? 'not adopted'}\n- ArcShape: ${manifest.integrations.arcShape ?? 'not adopted'}\n- Public site: \`${publicSite}\`\n- Repository roots: ${repository.layout.map((x) => `\`${x}/\``).join(', ')}\n- Commit convention: \`${repository.conventions.commits}\`\n\n## Delivery contract\n\n${authorities} Lighthouse installs the repository baseline and verifies the selected integrations.\n\nThe repository keeps source code in \`src/\`, documentation in \`docs/\`, infrastructure in \`infra/\` and repository automation in \`scripts/\`. A project may record a narrow, owned exception, but an initializer never overwrites an existing project file.\n\nThe selected SDLC package owns lifecycle skills, commands, meta-commands, routes and gates. The \`.lighthouse/\` control plane records the selected package, command aliases and host adapters without storing agent runtime data. Use \`lighthouse aliases --format json\` or \`.lighthouse/commands.json\` to discover canonical and short agent commands.\n\n${sdlcGuide}${publicSiteContract} This route publishes product and architecture documentation. Application deployment follows the repository's own delivery policy.\n\n## User identity\n\nWhen the product needs user authentication, delegate it to an external OpenID Connect provider through maintained framework middleware. Reuse an existing shared provider; Keycloak is the recommended self-hosted reference. Do not build password storage, credential recovery or an authorization server without an explicit product and architecture exception. Application authorization stays in the product. Use separate application clients and keep shared identity infrastructure outside application teardown.\n\nRead the installed Lighthouse package guide at \`assets/profiles/identity.md\` before implementing authentication. This is review guidance; foundation verification does not prove runtime authentication or authorization.\n\nThis file is managed. Put repository-specific policy in its own documentation and keep this projection generated from \`lighthouse.json\`.\n`;
 }
 
 function guardrailScript(manifest) {