@llman-sdd/core 0.3.1 → 0.5.1

package/src/validation/harness.ts

@@ -0,0 +1,161 @@
+/**
+ * BDD harness execution for validate (validation capability, r13/r48):
+ * expands bdd.run_command per capability, executes each expanded command
+ * string at most once per validate invocation (batch-once), and maps results
+ * to per-capability issues. Pure — the subprocess runs through the injected
+ * HarnessRunner; this module never reads the environment or the wall clock
+ * (the nested-invocation guard is read by the CLI and passed in as a
+ * parameter).
+ */
+import type { ValidationItem } from './validate.ts';
+
+/**
+ * Harness runner port (r13/r48): executes one expanded bdd.run_command
+ * string; the CLI adapter owns the subprocess (and the nested-invocation
+ * guard env it exports). exitCode is null only when the command could not
+ * start (spawnError then carries the reason). Lives here rather than in
+ * ports.ts so the validation module gains no new cross-module edge (r72).
+ */
+export interface HarnessRunner {
+  run(
+    command: string,
+    cwd: string,
+  ): {
+    exitCode: number | null;
+    output: string;
+    spawnError?: string;
+  };
+}
+
+export interface HarnessTarget {
+  /** Capability id ({feature_name}). */
+  capability: string;
+  /** Repo-root-relative path of the capability's main .feature file. */
+  featurePath: string;
+}
+
+/** Trigger state assembled by the CLI (env guard + flags + config + runner). */
+export interface HarnessGate {
+  /** LLMAN_SDD_HARNESS_ACTIVE=1 was set by an enclosing validate invocation. */
+  nested: boolean;
+  check: 'default' | 'on' | 'off';
+  /** Undefined when bdd.run_command is not configured (non-empty string). */
+  runner: HarnessRunner | undefined;
+  runCommand: string | null;
+  /** Project root — the cwd every harness subprocess runs in. */
+  cwd: string;
+  /** CLI emits its one-line stderr banner through this hook before the first execution. */
+  onBeforeFirstRun?: (expanded: string) => void;
+}
+
+export interface HarnessRunOutcome {
+  /** Harness issues per capability, in target order. */
+  issuesByCapability: Map<string, ValidationItem[]>;
+  /** True when at least one command actually executed in this call. */
+  executed: boolean;
+}
+
+/** Plain-text placeholder expansion — capability ids are kebab-constrained. */
+export function expandRunCommand(command: string, target: HarnessTarget): string {
+  const dirEnd = target.featurePath.lastIndexOf('/');
+  const featureDir = dirEnd === -1 ? target.featurePath : target.featurePath.slice(0, dirEnd);
+  return command
+    .replaceAll('{feature_path}', target.featurePath)
+    .replaceAll('{feature_dir}', featureDir)
+    .replaceAll('{feature_name}', target.capability);
+}
+
+interface CacheEntry {
+  success: boolean;
+  /** First ERROR message (≤200 chars) so a cached failure points at the cause. */
+  failureSummary: string | null;
+}
+
+const OUTPUT_TAIL = 200;
+
+/**
+ * Trigger matrix (r13): --no-check skips silently; a nested invocation skips
+ * with a per-spec INFO; an explicit --check without a configured run_command
+ * yields a single INFO on the first spec; otherwise every expanded command
+ * executes at most once (cache keyed by the expanded string).
+ */
+export function runHarnessForSpecs(
+  targets: readonly HarnessTarget[],
+  gate: HarnessGate,
+): HarnessRunOutcome {
+  const issuesByCapability = new Map<string, ValidationItem[]>();
+  if (gate.check === 'off') return { issuesByCapability, executed: false };
+  if (gate.nested) {
+    for (const target of targets) {
+      issuesByCapability.set(target.capability, [
+        {
+          level: 'INFO',
+          id: target.featurePath,
+          message: 'bdd harness skipped: nested invocation',
+        },
+      ]);
+    }
+    return { issuesByCapability, executed: false };
+  }
+  if (gate.runner === undefined || gate.runCommand === null || gate.runCommand === '') {
+    if (gate.check === 'on' && targets.length > 0) {
+      const first = targets[0] as HarnessTarget;
+      issuesByCapability.set(first.capability, [
+        {
+          level: 'INFO',
+          id: first.featurePath,
+          message: '--check has no effect: bdd.run_command is not configured',
+        },
+      ]);
+    }
+    return { issuesByCapability, executed: false };
+  }
+  const cache = new Map<string, CacheEntry>();
+  let executed = false;
+  let announced = false;
+  for (const target of targets) {
+    const expanded = expandRunCommand(gate.runCommand, target);
+    const cached = cache.get(expanded);
+    let issues: ValidationItem[];
+    if (cached !== undefined) {
+      issues = cached.success
+        ? [
+            {
+              level: 'INFO',
+              id: target.featurePath,
+              message: `bdd harness passed (cached): ${expanded}`,
+            },
+          ]
+        : [
+            {
+              level: 'ERROR',
+              id: target.featurePath,
+              message: `bdd harness failed (cached result of ${expanded}): ${cached.failureSummary}`,
+            },
+          ];
+    } else {
+      if (!announced) {
+        gate.onBeforeFirstRun?.(expanded);
+        announced = true;
+      }
+      executed = true;
+      const result = gate.runner.run(expanded, gate.cwd);
+      const firstError =
+        result.spawnError !== undefined
+          ? `bdd harness could not start: ${expanded}: ${result.spawnError}`
+          : result.exitCode === 0
+            ? null
+            : `bdd harness failed (exit ${result.exitCode}): ${expanded}: ${result.output.slice(-OUTPUT_TAIL)}`;
+      issues =
+        firstError === null
+          ? [{ level: 'INFO', id: target.featurePath, message: `bdd harness passed: ${expanded}` }]
+          : [{ level: 'ERROR', id: target.featurePath, message: firstError }];
+      cache.set(expanded, {
+        success: firstError === null,
+        failureSummary: firstError === null ? null : firstError.slice(0, OUTPUT_TAIL),
+      });
+    }
+    issuesByCapability.set(target.capability, issues);
+  }
+  return { issuesByCapability, executed };
+}

package/src/validation/staleness.ts

@@ -1,5 +1,5 @@
 /**
- * Staleness evaluator (validation/staleness parity): v1 `sdd/spec/staleness.rs`
+ * Staleness evaluator (validation/staleness parity): predecessor `sdd/spec/staleness.rs`
  * observable contract — status/baseRef/scope/touchedPaths/specUpdated/dirty/
  * notes plus per-capability staleness issues. Pure: git + env are injected.
  */
@@ -62,9 +62,9 @@ const BASE_MISSING_MSG =
   "Note: Unable to resolve base ref for staleness check. Set LLMANSPEC_BASE_REF (e.g. 'main' or 'origin/main'), or upgrade llman if below 0.0.60.";
 
 /**
- * Evaluate staleness for one capability spec — v1 status semantics.
+ * Evaluate staleness for one capability spec — predecessor status semantics.
  * Returns the info object plus warning/info issues (strict escalation is the
- * caller's job, matching v1 `apply_strict`).
+ * caller's job, matching predecessor `apply_strict`).
  */
 export function evaluateStaleness(deps: StalenessDeps): {
   info: StalenessInfo;
@@ -125,7 +125,7 @@ export function evaluateStaleness(deps: StalenessDeps): {
     }
   }
 
-  // Tolerant: outside a git repo (or on git failure) treat as dirty (v1 unwrap_or(true)).
+  // Tolerant: outside a git repo (or on git failure) treat as dirty (predecessor unwrap_or(true)).
   const dirty = (git.runOpt(['status', '--porcelain']) ?? 'dirty') !== '';
   if (dirty) {
     if (status === 'OK' || status === 'STALE') status = 'INFO';
@@ -143,13 +143,17 @@ export function evaluateStaleness(deps: StalenessDeps): {
   }
 }
 
-const STALE_MSG = 'Note: Spec files changed on the base branch; re-review the spec.';
+const STALE_MSG =
+  "Note: Code in this spec's scope changed on this branch but the spec was not updated; re-review the spec.";
 const SPEC_UPDATED_MSG = 'Note: Spec updated on this branch.';
 
 function revParse(git: GitLike, ref: string): string | null {
   return git.runOpt(['rev-parse', '--verify', '--quiet', ref]) ?? null;
 }
 
+// Deliberately NOT shared with defaultBranch() in git/spawnGit.ts — this
+// predecessor staleness probe is local-only (main → master, 'main' fallback, no origin
+// consultation). Do not merge the two.
 function defaultBranchNameFn(git: GitLike): string {
   if (git.runOpt(['show-ref', '--verify', '--quiet', 'refs/heads/main']) !== null) return 'main';
   if (git.runOpt(['show-ref', '--verify', '--quiet', 'refs/heads/master']) !== null)

package/src/validation/validate.ts

@@ -1,18 +1,18 @@
 /**
  * Validation engine (validation capability): aggregates Phase-2 parse errors
- * plus the verdict-equivalent gates (r11/r12, ordered to match v1
+ * plus the verdict-equivalent gates (r11/r12, ordered to match predecessor
  * `spec/validation.rs` observable issue order). Pure — filesystem access is
  * injected via SpecIo.
  */
 import type { CapabilityDoc } from '../spec/ir.ts';
-import { MUST_WORD_RE } from '../spec/ir.ts';
+import { specIdOf } from '../spec/ir.ts';
 import { buildReqRegistry } from '../spec/reqRegistry.ts';
 
 export type ValidationLevel = 'ERROR' | 'WARNING' | 'INFO';
 
 export interface ValidationItem {
   level: ValidationLevel;
-  /** Gate anchor, e.g. `t/rule/ok` or `t/valid_scope` (v1-style `path`). */
+  /** Gate anchor, e.g. `t/rule/ok` or `t/valid_scope` (predecessor-style `path`). */
   id: string;
   message: string;
 }
@@ -41,7 +41,6 @@ export interface ValidationReport {
 }
 
 const rulesPath = (cap: string): string => `${cap}/rules`;
-const acceptanceReqPath = (cap: string, name: string): string => `${cap}/acceptance/${name}/@req`;
 const coveragePath = (cap: string): string => `${cap}/coverage`;
 
 export function validateCapability(
@@ -51,7 +50,7 @@ export function validateCapability(
   opts: { strict?: boolean } = {},
 ): SpecVerdict {
   const { doc } = entry;
-  const cap = doc.header.capability ?? entry.fileName;
+  const cap = specIdOf(entry);
   const strict = opts.strict === true;
   const items: ValidationItem[] = [];
 
@@ -59,27 +58,23 @@ export function validateCapability(
     items.push({ level, id, message });
   };
 
-  // Header gates (r12 / v1 spec_meta). v1 treats a missing `# capability:`
+  // Header gates (r12 / predecessor spec_meta). predecessor treats a missing `# capability:`
   // header as a parse-level failure: only `file` + registry-scan issues are
   // emitted and all single-track gates are skipped.
   if (doc.header.capability === null) {
-    const msg = `spec \`${cap}\`: missing \`# capability:\` header comment (spec-format r133)`;
+    const msg = `spec \`${cap}\`: missing \`# capability:\` header comment`;
     push('ERROR', 'file', msg);
     push('ERROR', 'llmanspec/specs', `Failed to scan req_id index: ${msg}`);
     return { fileName: entry.fileName, capability: cap, ok: false, items };
   }
   if (doc.header.purpose === null || doc.header.purpose.trim() === '') {
-    push(
-      'ERROR',
-      `${cap}/purpose`,
-      '`# purpose:` header comment must not be empty (spec-format r133)',
-    );
+    push('ERROR', `${cap}/purpose`, '`# purpose:` header comment must not be empty');
   }
   if (doc.header.scope === null) {
     push(
       'ERROR',
       `${cap}/valid_scope`,
-      'Spec valid_scope must not be empty (add it inside the .toon document).',
+      'Spec valid_scope must not be empty (declare it in the "# scope:" header comment).',
     );
   } else {
     // r42: missing valid_scope paths are independent failures —
@@ -112,86 +107,50 @@ export function validateCapability(
     push('ERROR', `${cap}/feature`, 'Feature line must carry a title');
   }
 
-  // Parser-level structural errors (mutual exclusion, removed-tag migration,
-  // nested rule scenarios). Header gates and the MUST-word gate are owned here
-  // (mapped below), so the parser's duplicate findings are skipped.
-  const OWNED_BY_THIS_LAYER = ['missing-header:', 'rule:missing-must-word'];
+  // Parser-level structural errors. Header gates are owned here (mapped below);
+  // the parser's duplicate header findings are skipped.
+  const OWNED_BY_THIS_LAYER = ['missing-header:'];
   for (const err of doc.errors) {
     if (OWNED_BY_THIS_LAYER.some((prefix) => err.code.startsWith(prefix))) continue;
     push('ERROR', err.code.startsWith('file') ? 'file' : `${cap}/${err.code}`, err.message);
   }
 
-  // Single-track gates (v1 validate_single_track order).
-  const human = doc.scenarios.filter((s) => s.classification === 'human');
-  const acceptance = doc.scenarios.filter((s) => s.classification === 'executable');
+  // Native single-track gates: `规则:` blocks with `@req` handles; nested
+  // `场景:` are their executable examples; top-level scenarios are orphans.
+  const rules = doc.rules;
 
-  if (human.length === 0) {
-    push('ERROR', rulesPath(cap), 'spec must define at least one @human constraint scenario');
+  if (rules.length === 0) {
+    push('ERROR', rulesPath(cap), 'spec must define at least one rule');
   }
 
-  for (const scenario of doc.scenarios) {
-    const anchor = `${cap}/rule/${scenario.name}`;
-    if (scenario.classification === 'human') {
-      if (scenario.reqIds.length === 0) {
-        push('ERROR', anchor, '@human constraint scenario must carry an @req:<req_id> tag');
-      }
-      if (!MUST_WORD_RE.test(scenario.statement)) {
-        push('ERROR', anchor, 'constraint statement must contain MUST/SHALL (or 必须/不得/禁止)');
-      }
-    } else if (scenario.classification === 'executable') {
-      // (pairing handled below, after all rule req ids are known)
-    } else {
+  for (const rule of rules) {
+    const anchor = `${cap}/rule/${rule.title}`;
+    if (rule.reqId === '') {
+      push('ERROR', anchor, 'rule must carry an @req:<req_id> tag on the rule header');
+    } else if (duplicatesFor(rule.reqId)) {
       push(
-        'WARNING',
-        `${cap}/scenario/${scenario.name}`,
-        `scenario \`${scenario.name}\` carries neither @human nor @executable; tag it or drop it`,
+        'ERROR',
+        `${cap}/registry/${rule.reqId}`,
+        `global duplicate req_id \`${rule.reqId}\` used by multiple capabilities`,
       );
     }
-    for (const reqId of scenario.reqIds) {
-      if (duplicatesFor(reqId)) {
-        push(
-          'ERROR',
-          `${cap}/registry/${reqId}`,
-          `global duplicate req_id \`${reqId}\` used by multiple capabilities`,
-        );
-      }
-    }
   }
 
-  // Dangling acceptance @req links (v1 order: acceptance/@req then coverage).
-  const ruleReqIds = new Set(human.flatMap((s) => s.reqIds));
-  for (const sc of acceptance) {
-    // r65: orphan acceptance scenario — no @req link at all (v1 r132 WARNING).
-    if (sc.reqIds.length === 0) {
-      push(
-        'WARNING',
-        `${cap}/acceptance/${sc.name}`,
-        `orphan acceptance scenario \`${sc.name}\` has no @req:<req_id> link`,
-      );
-    }
-    for (const rid of sc.reqIds) {
-      if (!ruleReqIds.has(rid)) {
-        push(
-          'ERROR',
-          acceptanceReqPath(cap, sc.name),
-          `@req:${rid} on acceptance scenario \`${sc.name}\` has no matching @human constraint`,
-        );
-      }
-    }
-  }
+  // Top-level `场景:` outside any rule are plain feature-level examples
+  // (native Gherkin); they carry no rule handle, so no warning or signal —
+  // they simply aren't part of rule accounting.
 
-  // Rule coverage INFO (r134 pending rules).
-  for (const sc of human) {
-    for (const rid of sc.reqIds) {
-      const covered = acceptance.some((a) => a.reqIds.includes(rid));
-      if (!covered) {
-        push(
-          'INFO',
-          coveragePath(cap),
-          `rule ${rid} is pending: no @executable acceptance scenario`,
-        );
-      }
-    }
+  // Bare-rule aggregate (r134 migrated): rules with no nested executable
+  // scenario, aggregated per capability (never one issue per rule), INFO so it
+  // never blocks anything. The real accountability lives in the review
+  // `pending` signal and the specs-compact workflow.
+  const bare = rules.filter((r) => r.scenarios.length === 0).length;
+  if (bare > 0) {
+    push(
+      'INFO',
+      coveragePath(cap),
+      `${bare} bare rule(s) without any executable scenario — convert to 场景: or compact`,
+    );
   }
 
   return {
@@ -202,13 +161,28 @@ export function validateCapability(
   };
 }
 
-export function validateAllSpecs(entries: readonly SpecEntry[], io: SpecIo): ValidationReport {
+/**
+ * Shared req_id duplicate gate — single source of truth for the CLI
+ * (`validate <spec>` path) and the full sweep. The registry is built from the
+ * already-parsed docs, so a duplicate is reported for every involved
+ * capability regardless of unrelated parse errors elsewhere (r12 acceptance:
+ * 重复 req_id MUST 对每个涉事 capability 判 ERROR — the 前代 "structural error
+ * aborts the index scan" guard is intentionally dropped; a parse-failed spec
+ * merely omits the scenarios it could not decode, never invents ids).
+ */
+export function buildDuplicatesFor(entries: readonly SpecEntry[]): (reqId: string) => boolean {
   const registry = buildReqRegistry(entries);
   const duplicateIds = new Set(registry.duplicates.flatMap((d) => d.reqId));
-  // v1 parity: a structural error anywhere aborts the req_id index scan, so
-  // the duplicate gate only fires when every spec parses cleanly.
-  const structurallyClean = entries.every((e) => e.doc.errors.length === 0);
-  const duplicatesFor = (reqId: string): boolean => structurallyClean && duplicateIds.has(reqId);
+  return (reqId: string): boolean => duplicateIds.has(reqId);
+}
+
+/** `Totals:` report line — single wording source for the engine and the CLI. */
+export function formatTotals(passed: number, failed: number, total: number): string {
+  return `Totals: ${passed} passed, ${failed} failed (${total} items)`;
+}
+
+export function validateAllSpecs(entries: readonly SpecEntry[], io: SpecIo): ValidationReport {
+  const duplicatesFor = buildDuplicatesFor(entries);
 
   const verdicts = entries.map((e) => validateCapability(e, duplicatesFor, io));
   const failed = verdicts.some((v) => !v.ok);
@@ -221,14 +195,12 @@ export function validateAllSpecs(entries: readonly SpecEntry[], io: SpecIo): Val
       lines.push(`  [${item.level}] ${item.id}: ${item.message}`);
     }
   }
-  lines.push(
-    `Totals: ${passed} passed, ${verdicts.length - passed} failed (${verdicts.length} items)`,
-  );
+  lines.push(formatTotals(passed, verdicts.length - passed, verdicts.length));
 
   return { verdicts, lines, failed };
 }
 
-/** v1 `apply_strict`: WARNING issues escalate to ERROR when --strict. */
+/** predecessor `apply_strict`: WARNING issues escalate to ERROR when --strict. */
 export function applyStrict<T extends { level: ValidationLevel }>(items: readonly T[]): T[] {
   return items.map((i) => (i.level === 'WARNING' ? { ...i, level: 'ERROR' as const } : i));
 }

package/templates/en/skills/llman-sdd-apply-cycle.md

@@ -1,6 +1,6 @@
 ---
 name: "llman-sdd-apply-cycle"
-description: "Single closed-loop for one change: gate→implement→test→validate→verify→archive→commit. Manual trigger only. Agent MUST NOT auto-invoke."
+description: "End-to-end closed loop for one change: implement→test→validate→verify→archive. Manual trigger only; agent must not auto-invoke."
 metadata:
   version: "{{ llman_version }}"
 disable-model-invocation: true
@@ -8,7 +8,7 @@ disable-model-invocation: true
 
 # LLMAN SDD Apply Cycle
 
-End-to-end closed loop for one change (manual). Requires Branch binding and `readyToImplement=true`.
+End-to-end closed loop for one change (manual). Requires a bound branch and a green specs-landed gate (`specsLanded ∨ needsSpecsChange=false`); `readyToImplement=true` (the completion signal) closes the cycle.
 
 **Manual trigger only**: `/skill:llman-sdd-apply-cycle <change-id>`
 
@@ -16,60 +16,52 @@ End-to-end closed loop for one change (manual). Requires Branch binding and `rea
 
 ### 0) Gate + status
 ```bash
-llman-sdd show <change-id> --json --type change
+llman-sdd show <change-id> --output json --type change
 ```
-> Stage gate: decide from `stage` / `readyToImplement` in `llman-sdd show <id> --json --type change`; full decision table lives in llman-sdd-apply.
+> Stage decisions use the `stage` / `readyToImplement` fields; the full decision table lives in llman-sdd-apply.
 
 - Must be on the bound non-default branch.
-- If `readyToImplement` is not true → STOP (finish Specs landing or `needs_specs_change: false`); **do not** finalize yet.
-- Track progress via `tasks.md` checkboxes (or `llman-sdd list` task counts); still read `tasks.md`, proposal/design, and live `llmanspec/specs/**` on the bound branch (SSOT).
+- specs-landed gate failing → STOP (land specs or `needs_specs_change: false`). Green but `readyToImplement=false` → normal: tasks pending, keep implementing; **finalize only when `readyToImplement=true`**.
+- Track progress via `tasks.md` checkboxes (or `llman-sdd list` task counts); still read `tasks.md`, proposal/design, and `llmanspec/specs/**` on the bound branch (the single source of truth).
 
 ### 1) Loop: implement → test
 For each incomplete task:
-1. Implement per task + live specs (minimal diff)
-2. Run `tasks[].test` if present
+1. Implement per task + specs (minimal diff)
+2. Run the task's stated verification command when the task text names one
 3. On failure, fix and retry (same self-repair budget as `llman-sdd-apply`: cap 8 rounds)
 4. Check off `tasks.md` as `[x]`
 
 ### 2) Validate
 ```bash
-llman-sdd validate <change-id> --strict --no-interactive
+llman-sdd validate <change-id> --strict
 ```
-On failure, fix and retry (same self-repair budget as `llman-sdd-apply`: cap 8 rounds).
+On failure, fix and retry (cap 8 rounds).
 
 ### 3) Verify (recommended)
-Prefer `llman-sdd-verify` (or equivalent dual-axis self-check). CRITICAL → STOP; do not archive.
+Prefer `llman-sdd-verify` (or an equivalent dual-axis self-check). CRITICAL → STOP; do not archive.
 
-### 4) Archive
+### 4) Archive + commit
 ```bash
 llman-sdd change finalize <change-id>
 ```
-(dirty tree OK; auto merge (squash default) + docs rename + **auto commit** `archive(sdd): <change-id>` in one process. `--no-commit` skips the auto commit for manual/CI histories — then commit with `git add -A && git commit -m "archive(sdd): <change-id>"`.)
+Dirty tree OK; auto merge (squash default) + rename + **auto commit** `archive(sdd): <change-id>` in one process. `--no-commit` skips the auto commit (manual/CI histories) — then commit with `git add -A && git commit -m "archive(sdd): <change-id>"`. Plain `change archive` stays as a fallback.
 
-`change checkpoint` is removed; the plain `change archive` command stays as a fallback (no checkpointed field required).
-
-### 5) Commit (see step 4)
-Finalize already auto-committed unless `--no-commit` was passed.
-
-### 6) Optional cleanup
+### 5) Optional cleanup
 ```bash
 git branch -D <feature-branch>   # after squash the branch is no longer an ancestor of main; -d gets refused
 ```
-push / hosting PR only when the user explicitly asks.
+Push / PR only when the user explicitly asks.
 
 ## Hard constraints
 - **Never ask** "should I continue" unless blocked.
 - **Never switch** changes until this one is archived and committed.
-- **Retry cap**: self-repair follows `llman-sdd-apply`'s 8-round budget (including the diagnose escalation path).
-- **Do not** author `changes/<id>/specs/` or use `change delta`.
-- **No default push/PR**.
+- **Do not** author `changes/<id>/specs/`; **no default push/PR**.
 
 ## Ethics Governance
 - `ethics.risk_level`: medium
-- `ethics.prohibited_actions`: implement/archive without `readyToImplement`, switching changes early, writing `changes/<id>/specs/`, commit without validation, default push/PR
+- `ethics.prohibited_actions`: implementing without a bound branch / a green specs-landed gate, archiving without `readyToImplement=true`, switching changes early, writing `changes/<id>/specs/`, committing without validation, default push/PR
 - `ethics.required_evidence`: `readyToImplement=true`, validate --strict pass, all tasks checked, finalize/archive success
-- `ethics.refusal_contract`: after 3 gate/validation failures, report blocker; do not force-archive
-- `ethics.escalation_policy`: if changing SDD workflow specs/templates, pause for user confirm before archive
+- `ethics.refusal_contract`: after 8 self-repair rounds still failing, report a blocker; never force-archive
+- `ethics.escalation_policy`: if changing SDD workflow specs/templates, pause for user confirmation before archive
 
-> For command details run `llman-sdd <cmd> --help`; the CLI is the command reference — skills embed no command tables.
-> "Spec" here = a `.feature` file under this project's `llmanspec/specs/`; run `llman-sdd list --specs` or `llman-sdd show <capability>`.
+{{ unit("skills/cli-footer") }}