@maycombhq/atticus 0.0.0-stage → 2.0.0-beta.3

package/dist/fixtures/forge/repos/forge-ledger/src/main/java/forge/ledger/LedgerEvents.java

@@ -0,0 +1,11 @@
+package forge.ledger;
+
+import forge.framework.*;
+
+public class LedgerEvents {
+  @ForgeSubscribe(topic = "payments.initiated")
+  public void onPaymentInitiated(Object payment) { }
+
+  @ForgePublish(topic = "transfers.completed")
+  public Object transferCompleted(Object transfer) { return transfer; }
+}

package/dist/fixtures/forge/repos/forge-ledger/src/main/java/forge/ledger/NorthwindClient.java

@@ -0,0 +1,10 @@
+package forge.ledger;
+
+import forge.framework.*;
+
+// Calls the vendor directly. The architecture diagram says this goes through the gateway.
+@ForgeClient(service = "northwind-pay", baseUrl = "${northwind.url}")
+public interface NorthwindClient {
+  @ForgeCall(method = "POST", path = "/v2/payments")
+  PaymentResult pay(PaymentRequest request);
+}

package/dist/fixtures/forge/repos/forge-ledger/src/main/resources/application.yml

@@ -0,0 +1,3 @@
+northwind:
+  url: https://api.northwind.example
+# No timeout or retry settings for the Northwind client (seeded knowledge gap).

package/dist/fixtures/forge/repos/forge-ledger/src/main/resources/db/migration/V1__create_account.sql

@@ -0,0 +1,5 @@
+CREATE TABLE account (
+  id BIGINT PRIMARY KEY,
+  account_number VARCHAR(34) NOT NULL,
+  holder_name VARCHAR(200) NOT NULL
+);

package/dist/fixtures/forge/repos/forge-ledger/src/main/resources/db/migration/V2__create_entry.sql

@@ -0,0 +1,7 @@
+CREATE TABLE entry (
+  id BIGINT PRIMARY KEY,
+  account_id BIGINT NOT NULL REFERENCES account(id),
+  amount NUMERIC(18,2) NOT NULL,
+  posted_at TIMESTAMP NOT NULL
+);
+CREATE INDEX idx_entry_account ON entry(account_id);

package/dist/fixtures/forge/repos/forge-portal-bff/pom.xml

@@ -0,0 +1 @@
+<project><groupId>forge</groupId><artifactId>forge-portal-bff</artifactId><parent><artifactId>spring-boot-starter-parent</artifactId><version>3.3.4</version></parent></project>

package/dist/fixtures/forge/repos/forge-portal-bff/src/main/java/forge/portal/AuditPublisher.java

@@ -0,0 +1,12 @@
+package forge.portal;
+
+import org.springframework.web.client.RestTemplate;
+
+public class AuditPublisher {
+  private final RestTemplate rest = new RestTemplate();
+
+  public void record(Object event) {
+    // Direct call to the audit service; not on the architecture diagram.
+    rest.postForObject("${audit.url}/audit/events", event, Void.class);
+  }
+}

package/dist/fixtures/forge/repos/forge-portal-bff/src/main/java/forge/portal/BalanceController.java

@@ -0,0 +1,16 @@
+package forge.portal;
+
+import org.springframework.web.bind.annotation.*;
+
+@RestController
+@RequestMapping("/api")
+public class BalanceController {
+  private final LedgerClient ledger;
+
+  public BalanceController(LedgerClient ledger) { this.ledger = ledger; }
+
+  @GetMapping("/balance/{accountId}")
+  public Balance balance(@PathVariable String accountId) {
+    return ledger.getBalance(accountId);
+  }
+}

package/dist/fixtures/forge/repos/forge-portal-bff/src/main/java/forge/portal/LedgerClient.java

@@ -0,0 +1,13 @@
+package forge.portal;
+
+import org.springframework.cloud.openfeign.FeignClient;
+import org.springframework.web.bind.annotation.*;
+
+@FeignClient(name = "ledger", url = "${gateway.url}/ledger/v1")
+public interface LedgerClient {
+  @GetMapping("/accounts/{id}/balance")
+  Balance getBalance(@PathVariable("id") String id);
+
+  @PostMapping("/transfers")
+  TransferResult createTransfer(@RequestBody TransferRequest request);
+}

package/dist/fixtures/forge/repos/forge-portal-bff/src/main/java/forge/portal/PaymentEvents.java

@@ -0,0 +1,13 @@
+package forge.portal;
+
+import org.springframework.kafka.core.KafkaTemplate;
+
+public class PaymentEvents {
+  private final KafkaTemplate<String, Object> kafka;
+
+  public PaymentEvents(KafkaTemplate<String, Object> kafka) { this.kafka = kafka; }
+
+  public void initiated(Object payment) {
+    kafka.send("payments.initiated", payment);
+  }
+}

package/dist/fixtures/forge/repos/forge-portal-bff/src/main/resources/application.yml

@@ -0,0 +1,8 @@
+gateway:
+  url: https://gateway.forge.example
+audit:
+  url: http://audit-svc.forge.internal
+ledger:
+  client:
+    read-timeout: 2000ms
+    connect-timeout: 500ms

package/dist/fixtures/forge/repos/forge-portal-ui/package.json

@@ -0,0 +1 @@
+{ "name": "forge-portal-ui", "private": true, "dependencies": { "react": "18.3.1" } }

package/dist/fixtures/forge/repos/forge-portal-ui/src/api/balance.ts

@@ -0,0 +1,5 @@
+// Calls the portal BFF for an account balance.
+export async function getBalance(accountId: string) {
+  const res = await fetch(`/api/balance/${accountId}`, { method: "GET" });
+  return res.json();
+}

package/dist/fixtures/forge/repos/forge-reports-job/src/main/java/forge/reports/DailyEntriesJob.java

@@ -0,0 +1,19 @@
+package forge.reports;
+
+import org.springframework.batch.core.Job;
+import org.springframework.jdbc.core.JdbcTemplate;
+import org.springframework.kafka.annotation.KafkaListener;
+
+public class DailyEntriesJob {
+  private final JdbcTemplate ledgerDb;
+
+  public DailyEntriesJob(JdbcTemplate ledgerDb) { this.ledgerDb = ledgerDb; }
+
+  // Reads the ledger's table directly. The diagram shows reports calling the Ledger API.
+  public void run() {
+    ledgerDb.query("SELECT account_id, amount, posted_at FROM entry WHERE posted_at >= ?", rs -> {});
+  }
+
+  @KafkaListener(topics = "transfers.completed")
+  public void onTransferCompleted(Object transfer) { }
+}

package/dist/fixtures/forge/repos/forge-reports-job/src/main/resources/application.yml

@@ -0,0 +1,3 @@
+spring:
+  datasource:
+    url: jdbc:postgresql://ledger-db.forge.internal:5432/ledger

package/dist/fixtures/forge-change/README.md

@@ -0,0 +1,41 @@
+# Forge change: the M3 exit fixture
+
+An invented Forge feature change, `add-transfer-limit`, with every org-flow artifact written by hand and problems seeded on purpose. It runs on top of `fixtures/forge` (org pack and expected catalog), which it never changes.
+
+| Folder | What it holds |
+| --- | --- |
+| `openspec/changes/add-transfer-limit/` | The change folder at the plan phase: `change.yaml`, brief, proposal, specs, interfaces, mappings, data, design, UX, stories, tasks and service-desk drafts |
+| `org-pack/` | New org-pack files laid over the Forge pack: the critic's four question agents (`true-critic`, `complete-critic`, `safe-critic`, `ship-critic`), the old `code-and-test-critic` (an org pack that still defines it keeps working), the starter review's two code checks (`checklists/review.yaml`), the Forge gates naming that checklist (`gates.yaml`), and the Ledger team's checklist (`teams/team-ledger/checklists/`) |
+| `recordings/` | Replay recordings for the AI lenses, written by hand as the mock runtime would return them, keyed by agent and prompt hash |
+| `expected/stories.yaml` | The outline the planner's stories must meet for the story bar (stories, gaps they cover, nothing invented); hand-written |
+| `recordings/story-writer/` | Replay recordings for the story writer's prose, written by hand |
+| `expected/findings.yaml` | The seeded problems (12 blocking issues, 14 knowledge gaps), the other findings the critic must raise with the layer that must catch each, and the findings retired with the four questions |
+
+The change adds a daily limit to ledger-api's POST /transfers, touches portal-bff, ledger-api, audit-svc and ledger-db, and adds a call to Northwind Pay. Seeded problems include a pattern-code typo, a hop with no pattern, a call to a system the catalog doesn't know, vendor and internal calls with no timeouts, a new table with no migration, retention or personal-data classification, a story without acceptance criteria, a story that addresses AI reviewers, and gaps such as the unknown audit-svc owner and the vendor's unknown rate limit.
+
+Rules: the expected file and the recordings are hand-written; never regenerate them from critic output. A changed prompt makes the replay fail with the new prompt hash; update the recording's hash only after checking the hand-written answer still fits the prompt.
+
+## Re-baselined for the four questions (ADR 0124 addendum, Part 4)
+
+The critic asks four questions of every draft (is it true to the code, is it complete, is it safe to build, can it ship) with one AI lens per question, instead of seven role lenses. The fixture was re-baselined for it on 2026-10-24.
+
+**Retired** (listed under `retired:` in `expected/findings.yaml`; the golden tests check none comes back):
+
+| Was | Rule | Why it retired |
+| --- | --- | --- |
+| b11 (no firewall draft), b12 (gateway draft missing its Target) | `constitution.snow-drafts-present` | A service-desk request is a person's manual step now: `atticus plan` drafts snow.md from the same triggers, and `atticus release plan` lists each draft as a request to file, with its missing required fields. The constitution rule is retired; the check stays for an org pack that wants it. |
+| r04 (no error state when the limit can't load) | `ux-states-complete` | The UX lens is gone. The Ledger team's rule is kept in its checklist with `status: retired`; a screen state the specs imply is one of the things the complete lens looks for. |
+
+**Kept**: every other seeded blocking issue, caught by the same layer as before (b01 to b10 by code, b13 and b14 by the safe and complete lenses), every seeded gap, and the knowledge needs (slo-known, capacity-known, vendor-rate-limit-known, vendor-contact-known, vendor-operation-known).
+
+**Added**: g14 (nothing records how audit-svc authenticates callers of POST /audit/events, `constitution.public-entry-auth`), r06 (the audit call states no timeout, now `review.call-timeout-stated`), r07 and r08 (design.md's rollback names neither table, now `review.store-write-rollback`), and r09 (snow.md now passes layer 1 and reaches the ship lens, which finds no fallback if the gateway proxy request is late, `release-plan-complete`).
+
+**The Ledger team's rules** are written for the questions (`lens: safe`, `lens: complete`, …). `tests-cover-scenarios` keeps `lens: code-and-test` with `question: complete`, to show a rule written for the old lens still works, at the gates and at the spec hand-up. The Forge pack under `fixtures/forge` is unchanged and still uses the old lens names, so the fixture also tests that an org pack written for the seven lenses keeps working (its `design-has-rollback`, written for the delivery lens, is the ship lens's).
+
+**The recordings were re-made deterministically, with no model.** A new lens prompt has a new sha256, so each question agent's answer was written by hand: complete-critic's is the old business and story lenses' answers together, safe-critic's the old architecture lens's, ship-critic's the old delivery lens's plus r09. Each answer is stored under the hash of every exact prompt its lens sends in the tests (the plain run, the runs that carry `recorded-by-people`, and the M3 exit sandbox), by running those tests once with a replay runtime that wrote the hand-written answer under the prompt hash it was given. The answers were checked against what each lens must find (the `layer: ai` entries of `expected/findings.yaml` whose rules the lens applies); `packages/naysayer/test/golden.test.ts` and `packages/evals` replay them.
+
+## The product owner's decisions (2026-10-24)
+
+**Moved, not changed: r06, r07 and r08.** The timeout and rollback checks left the constitution for the starter review (org layer, the organisation's to change), and the auth and breaking checks stay constitution rules. The fixture's org pack carries the starter's two code checks exactly as `packages/naysayer/starter/review.yaml` writes them (`org-pack/checklists/review.yaml`; `packages/naysayer/test/questions.test.ts` holds them equal), without the starter's AI rules, so no lens prompt changes. Because the Forge gates name their checklists, `org-pack/gates.yaml` lays the Forge gates over with `review` named beside `forge-architecture`. So r06 is caught by `review.call-timeout-stated` and r07 and r08 by `review.store-write-rollback`: the same findings at the same lines, still by layer 1 and still risks, with layer `org` instead of `constitution`. g14 stays `constitution.public-entry-auth`. The counts are unchanged: 12 blocking issues and 14 gaps seeded, 8 other findings expected, 3 retired.
+
+**Not re-recorded.** No lens prompt of the fixture changed (the moved rules are code checks, and the gate lenses' rules and agents are the same), so its recordings stay as they were; `packages/naysayer/test/golden.test.ts` replays them unchanged. The spec hand-up's review of a task asks the complete question, so its prompt changed (`# Critic: the complete lens (Is it complete?), at hand-up`) and its agent is `complete-critic`; the hand-up tests in `packages/speckit` use a mock model, not recordings. The M3 exit suite's own hand-up answer (`findings: []`) is re-keyed under `packages/m3-exit/test/fixtures/recordings/complete-critic/` with the new prompt's sha256, the same way (hand-written, no model; unchanged, since only the prompt's heading and first paragraph changed), with that suite's re-baseline for g14 and r06 to r08. `code-and-test-critic` stays in the org pack to show an org pack that still defines it keeps working (with no `complete-critic`, the complete lens is made of it).

package/dist/fixtures/forge-change/expected/findings.yaml

@@ -0,0 +1,301 @@
+# Seeded problems in the add-transfer-limit change, and what the critic must report at the
+# plan gate (round 1). Hand-written ground truth: never regenerate it from critic output.
+#
+# layer says which critic layer must catch the problem:
+#   deterministic - layer 1, zero tokens. Everything that can be checked from files is here.
+#   ai            - layer 2, a recorded AI lens answer (recordings/). Only judgement calls.
+# A finding matches an entry when its rule, severity and kind match, and its artifact and
+# line (or record) match when the entry gives them.
+#
+# Re-baselined for the critic's four questions (ADR 0124 addendum, Part 4, 2026-10-24): the seven
+# role lenses became four question lenses (true, complete, safe, ship) and the constitution gained
+# the code checks of the four questions. What retired is listed under retired, with why; every
+# other seeded blocking issue is still caught, by the same layer. New entries say "(Part 4)".
+#
+# The product owner's decisions of 2026-10-24: the timeout and rollback checks moved from the
+# constitution to the starter review (org layer, the organisation's to change), which the fixture's
+# org pack carries (org-pack/checklists/review.yaml, named at the gates). r06, r07 and r08 are the
+# same findings, by the same layer, from review.call-timeout-stated and review.store-write-rollback
+# instead of constitution.*; the auth and breaking checks (g14) stay constitution rules.
+change: add-transfer-limit
+gate: plan
+
+seeded:
+  # ---------------------------------------------------------------- blocking issues
+  - id: b01-pattern-typo
+    kind: issue
+    severity: blocking
+    layer: deterministic
+    rule: constitution.interface-approved-pattern
+    artifact: interfaces.md
+    line: 6
+    what: GET /accounts/{id}/limit names pattern S.GW.SRO, a typo of S.GW.SOR (architecture).
+  - id: b02-hop-without-pattern
+    kind: issue
+    severity: blocking
+    layer: deterministic
+    rule: constitution.interface-approved-pattern
+    artifact: interfaces.md
+    line: 8
+    what: The changed hop portal-bff to audit-svc names no pattern code (architecture).
+  - id: b03-unknown-system
+    kind: issue
+    severity: blocking
+    layer: deterministic
+    rule: constitution.interface-ends-in-catalog
+    artifact: interfaces.md
+    line: 9
+    what: The new hop to risk-engine targets a system the catalog doesn't know (architecture).
+  - id: b04-vendor-call-no-timeout
+    kind: issue
+    severity: blocking
+    layer: deterministic
+    rule: constitution.hop-resilience-stated
+    artifact: interfaces.md
+    line: 7
+    what: The new Northwind Pay call states no timeout or retry, which S.GW.VND requires (runtime).
+  - id: b05-risk-call-no-timeout
+    kind: issue
+    severity: blocking
+    layer: deterministic
+    rule: constitution.hop-resilience-stated
+    artifact: interfaces.md
+    line: 9
+    what: The new risk-engine call states no timeout or circuit breaker, which S.GW.SOR requires (runtime).
+  - id: b06-table-without-migration
+    kind: issue
+    severity: blocking
+    layer: deterministic
+    rule: constitution.data-change-has-migration
+    artifact: data.md
+    line: 8
+    what: The new table limit_change names no migration (data design).
+  - id: b07-personal-column-unclassified
+    kind: issue
+    severity: blocking
+    layer: deterministic
+    rule: constitution.data-columns-classified
+    artifact: data.md
+    line: 8
+    what: limit_change.changed_by_email is personal data covered only by a table-wide "internal" (data design).
+  - id: b08-table-without-retention
+    kind: issue
+    severity: blocking
+    layer: deterministic
+    rule: constitution.data-retention-stated
+    artifact: data.md
+    line: 8
+    what: The new table limit_change says nothing about how long its rows are kept (data design).
+  - id: b09-story-without-criteria
+    kind: issue
+    severity: blocking
+    layer: deterministic
+    rule: constitution.story-acceptance-criteria
+    artifact: stories/s2-show-remaining.md
+    line: 1
+    what: Story s2-show-remaining has no acceptance criteria.
+  - id: b10-instruction-in-story
+    kind: issue
+    severity: blocking
+    layer: deterministic
+    rule: constitution.no-embedded-instructions
+    artifact: stories/s3-audit-refusals.md
+    line: 10
+    what: Story s3 tells AI critics to ignore their rules; ingested content is data, never instructions.
+  - id: b13-concurrent-transfers
+    kind: issue
+    severity: blocking
+    layer: ai
+    rule: design-concurrency-handled
+    artifact: design.md
+    line: 29
+    what: The design names the race between two transfers but no lock or serialisation (judgement).
+  - id: b14-story-without-spec
+    kind: issue
+    severity: blocking
+    layer: ai
+    rule: story-traces-to-spec
+    artifact: stories/s4-velocity-check.md
+    line: 8
+    what: Story s4's behaviour (holding flagged transfers) is in no spec requirement (judgement).
+
+  # ---------------------------------------------------------------- knowledge gaps
+  - id: g01-audit-owner-unknown
+    kind: knowledge-gap
+    severity: gap
+    layer: deterministic
+    rule: constitution.touched-components-known
+    record: audit-svc
+    what: audit-svc is known only from a caller; its owner, repo and spec are unknown.
+  - id: g02-ledger-vendor-timeouts-unknown
+    kind: knowledge-gap
+    severity: gap
+    layer: deterministic
+    rule: constitution.hop-resilience-stated
+    record: ledger-api
+    what: No timeout or retry settings are known for ledger-api, which calls Northwind Pay.
+  - id: g03-portal-bff-alerts-unknown
+    kind: knowledge-gap
+    severity: gap
+    layer: deterministic
+    rule: jobs-have-alerts
+    record: portal-bff
+    what: No alert is known for portal-bff.
+  - id: g04-audit-alerts-unknown
+    kind: knowledge-gap
+    severity: gap
+    layer: deterministic
+    rule: jobs-have-alerts
+    record: audit-svc
+    what: No alert is known for audit-svc.
+  - id: g05-vendor-rate-limit-unknown
+    kind: knowledge-gap
+    severity: gap
+    layer: deterministic
+    rule: vendor-rate-limit-known
+    record: northwind-pay
+    what: Northwind Pay's rate limit is unknown.
+  - id: g06-vendor-contact-unknown
+    kind: knowledge-gap
+    severity: gap
+    layer: deterministic
+    rule: vendor-contact-known
+    record: northwind-pay
+    what: Nobody is named as the contact at Northwind Pay.
+  - id: g07-vendor-operation-unpublished
+    kind: knowledge-gap
+    severity: gap
+    layer: deterministic
+    rule: vendor-operation-known
+    artifact: interfaces.md
+    line: 7
+    record: northwind-pay
+    what: POST /v2/velocity-checks is not in Northwind Pay's published spec.
+  - id: g08-account-retention-unknown
+    kind: knowledge-gap
+    severity: gap
+    layer: deterministic
+    rule: constitution.data-retention-stated
+    record: ledger-db.account
+    what: The retention of ledger-db.account, which the change alters, is unknown.
+  - id: g09-ledger-slo-unknown
+    kind: knowledge-gap
+    severity: gap
+    layer: deterministic
+    rule: slo-known
+    record: ledger
+    what: Ledger has no latency SLO, and the change adds work to every transfer.
+  - id: g10-portal-slo-unknown
+    kind: knowledge-gap
+    severity: gap
+    layer: deterministic
+    rule: slo-known
+    record: portal
+    what: Portal has no latency SLO.
+  - id: g11-ledger-volume-unknown
+    kind: knowledge-gap
+    severity: gap
+    layer: deterministic
+    rule: capacity-known
+    record: ledger-db
+    what: The daily write volume of ledger-db is unknown.
+  - id: g12-default-limit-undecided
+    kind: knowledge-gap
+    severity: gap
+    layer: ai
+    rule: brief-questions-answered
+    artifact: proposal.md
+    what: The default limit for existing accounts is an open question no spec answers (judgement).
+  - id: g13-vendor-failure-behaviour
+    kind: knowledge-gap
+    severity: gap
+    layer: ai
+    rule: brief-questions-answered
+    artifact: specs/transfer-limits/spec.md
+    what: Nothing says what happens to a transfer when the velocity check flags it or doesn't answer (judgement).
+  - id: g14-audit-entry-auth-unknown
+    kind: knowledge-gap
+    severity: gap
+    layer: deterministic
+    rule: constitution.public-entry-auth
+    artifact: interfaces.md
+    line: 8
+    what: portal-bff calls audit-svc's POST /audit/events from another system, and nothing records how audit-svc authenticates its callers (Part 4, is it safe).
+
+# Not seeded problems, but findings the critic must also raise (risks). Any finding not listed
+# here or above fails the golden test, so noise can't creep in unnoticed.
+alsoExpected:
+  - id: r01-mapping-missing
+    kind: issue
+    severity: risk
+    layer: deterministic
+    rule: mappings-cover-interfaces
+    artifact: mappings.md
+  - id: r02-portal-ui-task-missing
+    kind: issue
+    severity: risk
+    layer: deterministic
+    rule: tasks-cover-stories
+    artifact: tasks.md
+  - id: r03-no-rollback
+    kind: issue
+    severity: risk
+    layer: ai
+    rule: design-has-rollback
+    artifact: design.md
+    line: 25
+  - id: r05-requests-not-sequenced
+    kind: issue
+    severity: risk
+    layer: ai
+    rule: tasks-sequenced-for-lead-times
+    artifact: tasks.md
+    line: 7
+  - id: r06-audit-call-no-timeout
+    kind: issue
+    severity: risk
+    layer: deterministic
+    rule: review.call-timeout-stated
+    artifact: interfaces.md
+    line: 8
+    what: The changed portal-bff call to audit-svc is synchronous and states no timeout; no pattern names one for it (Part 4, is it safe; the starter review's rule since 2026-10-24).
+  - id: r07-account-write-no-rollback
+    kind: issue
+    severity: risk
+    layer: deterministic
+    rule: review.store-write-rollback
+    artifact: data.md
+    line: 7
+    what: The rollback section names neither ledger-db.account nor V3__add_daily_limit.sql (Part 4, can it ship; the starter review's rule since 2026-10-24).
+  - id: r08-limit-change-write-no-rollback
+    kind: issue
+    severity: risk
+    layer: deterministic
+    rule: review.store-write-rollback
+    artifact: data.md
+    line: 8
+    what: The rollback section says nothing about the new table limit_change (Part 4, can it ship; the starter review's rule since 2026-10-24).
+  - id: r09-proxy-request-no-fallback
+    kind: issue
+    severity: risk
+    layer: ai
+    rule: release-plan-complete
+    artifact: snow.md
+    line: 12
+    what: snow.md now reaches the ship lens (its service-desk check retired); nothing says what the release does if the gateway proxy request isn't done in time (Part 4, can it ship; judgement).
+
+# Retired with the four questions (ADR 0124 addendum, Part 4). The critic must not raise these any
+# more; each line says why. The golden tests check that none of them comes back.
+retired:
+  - id: b11-no-firewall-draft
+    rule: constitution.snow-drafts-present
+    artifact: snow.md
+    why: Service-desk requests are a manual step now, and the constitution rule is retired. atticus plan drafts snow.md from the triggers the check read (the firewall rule for gw-northwind-v2 included, its unknown fields left empty and listed), and atticus release plan lists each draft as a request a person files. The critic no longer checks a hand-written snow.md.
+  - id: b12-gateway-draft-incomplete
+    rule: constitution.snow-drafts-present
+    artifact: snow.md
+    why: The same retirement. The gateway proxy request's empty Target field shows in atticus release plan as a missing required field of the request, for the person filing it.
+  - id: r04-limit-error-state
+    rule: ux-states-complete
+    artifact: ux.md
+    why: The UX lens is gone. The Ledger team's ux-states-complete rule is retired; a screen state the specs imply is one of the things the complete lens looks for under the change's other rules.

package/dist/fixtures/forge-change/expected/stories.yaml

@@ -0,0 +1,101 @@
+# The story bar's eval set for add-transfer-limit: what the planner must produce from the
+# approved design (brief, proposal, specs, interfaces, mappings, data, design, UX), with the
+# hand-written stories, tasks and service-desk drafts of the fixture removed first.
+# Hand-written ground truth: never regenerate it from planner output.
+#
+# The story bar (plan, M3 exit): every seeded gap is covered in the stories or raised by the
+# critic; at least 90% of generated stories pass definition of ready with wording-only edits;
+# no invented systems or interfaces.
+change: add-transfer-limit
+minReadyRate: 0.9
+
+# One story per spec requirement, then one per new or changed hop no requirement covers, then
+# one per data change no story covers. A hop to a system the catalog doesn't know is not
+# planned (the critic raises it). Repos: both ends of each hop that are product components
+# with a repo, the data store owner's repo, and the UI that calls the BFF when ux.md exists.
+stories:
+  - id: s1-daily-transfer-limit
+    source: requirement
+    traces: specs/transfer-limits/spec.md:3
+    systems: [ledger, portal]
+    repos: [forge-ledger, forge-portal-bff, forge-portal-ui]
+    operations: [POST /transfers]
+    records: [ledger-db.account]
+    minCriteria: 2
+    tests: [unit, contract, integration, e2e, regression, performance]
+    dependsOn: []
+  - id: s2-remaining-limit
+    source: requirement
+    traces: specs/transfer-limits/spec.md:14
+    systems: [ledger, portal]
+    repos: [forge-ledger, forge-portal-bff, forge-portal-ui]
+    operations: ["GET /accounts/{id}/limit"]
+    records: []
+    minCriteria: 1
+    tests: [unit, contract, integration, e2e, performance]
+    dependsOn: [s1-daily-transfer-limit]
+  - id: s3-northwind-pay-velocity-checks
+    source: interface
+    traces: proposal.md:10
+    systems: [ledger, northwind-pay]
+    repos: [forge-ledger]
+    operations: [POST /v2/velocity-checks]
+    records: []
+    minCriteria: 1
+    tests: [unit, contract, integration, performance, security]
+    dependsOn: []
+  - id: s4-audit-events
+    source: interface
+    traces: proposal.md:11
+    systems: [audit, portal]
+    repos: [forge-portal-bff]
+    operations: [POST /audit/events]
+    records: []
+    minCriteria: 1
+    tests: [unit, integration, regression]
+    dependsOn: []
+  - id: s5-limit-change
+    source: data
+    traces: proposal.md:11
+    systems: [ledger]
+    repos: [forge-ledger]
+    operations: []
+    records: [ledger-db.limit-change]
+    minCriteria: 1
+    tests: [unit, integration]
+    dependsOn: []
+
+# Hops the planner must leave out, with the callee it doesn't know.
+notPlanned:
+  - { operation: POST /risk/assess, callee: risk-engine }
+
+# Service-desk drafts snow.md must hold (template and record), as the org pack's triggers ask.
+snow:
+  - { template: gateway-route, record: gw-northwind-v2 }
+  - { template: firewall-rule, record: gw-northwind-v2 }
+
+# Every seeded knowledge gap of expected/findings.yaml, and what covers it.
+#   critic: a finding of the newest plan-gate round with this rule (and record, when given)
+#   story:  the named story mentions every phrase (case-insensitive)
+gaps:
+  - { id: g01-audit-owner-unknown, coveredBy: critic, rule: constitution.touched-components-known, record: audit-svc }
+  - { id: g02-ledger-vendor-timeouts-unknown, coveredBy: critic, rule: constitution.hop-resilience-stated, record: ledger-api }
+  - { id: g03-portal-bff-alerts-unknown, coveredBy: critic, rule: jobs-have-alerts, record: portal-bff }
+  - { id: g04-audit-alerts-unknown, coveredBy: critic, rule: jobs-have-alerts, record: audit-svc }
+  - { id: g05-vendor-rate-limit-unknown, coveredBy: critic, rule: vendor-rate-limit-known, record: northwind-pay }
+  - { id: g06-vendor-contact-unknown, coveredBy: critic, rule: vendor-contact-known, record: northwind-pay }
+  - { id: g07-vendor-operation-unpublished, coveredBy: critic, rule: vendor-operation-known, record: northwind-pay }
+  - { id: g08-account-retention-unknown, coveredBy: critic, rule: constitution.data-retention-stated, record: ledger-db.account }
+  - { id: g09-ledger-slo-unknown, coveredBy: critic, rule: slo-known, record: ledger }
+  - { id: g10-portal-slo-unknown, coveredBy: critic, rule: slo-known, record: portal }
+  - { id: g11-ledger-volume-unknown, coveredBy: critic, rule: capacity-known, record: ledger-db }
+  - { id: g12-default-limit-undecided, coveredBy: story, story: s1-daily-transfer-limit, mentions: [default limit, existing accounts] }
+  - { id: g13-vendor-failure-behaviour, coveredBy: story, story: s3-northwind-pay-velocity-checks, mentions: [northwind-pay, "doesn't answer"] }
+
+# Seeded plan problems the generated plan must not repeat: no critic finding of this rule (on
+# files under `artifact`, and whose summary starts with `summaryStartsWith`, when given).
+fixed:
+  - { id: b09-story-without-criteria, rule: constitution.story-acceptance-criteria }
+  - { id: b10-instruction-in-story, rule: constitution.no-embedded-instructions, artifact: stories/ }
+  - { id: b11-no-firewall-draft, rule: constitution.snow-drafts-present, summaryStartsWith: "No " }
+  - { id: r02-portal-ui-task-missing, rule: tasks-cover-stories }

package/dist/fixtures/forge-change/judgments/personal-data/0b5f3dbf5257a22275d8c74b.yaml

@@ -0,0 +1,18 @@
+# A judgment (ADR 0117): personal-data, decided by avery. To override it, change verdict, set confirmedBy to { by: person, name: <your Git user> } and keep what it said under overrides; commit it for review.
+schemaVersion: 1
+kind: personal-data
+key: 0b5f3dbf5257a22275d8c74b
+verdict: no
+at: 2026-10-19T10:00:00Z
+confirmedBy:
+  by: person
+  name: avery
+inputs:
+  column: changed_at
+  table: limit_change
+  type: timestamp
+  v: 1
+quotes:
+  - of: column
+    text: changed_at
+why: When the limit changed.

package/dist/fixtures/forge-change/judgments/personal-data/2759a66770134c417440bf2d.yaml

@@ -0,0 +1,18 @@
+# A judgment (ADR 0117): personal-data, decided by avery. To override it, change verdict, set confirmedBy to { by: person, name: <your Git user> } and keep what it said under overrides; commit it for review.
+schemaVersion: 1
+kind: personal-data
+key: 2759a66770134c417440bf2d
+verdict: yes
+at: 2026-10-19T10:00:00Z
+confirmedBy:
+  by: person
+  name: avery
+inputs:
+  column: changed_by_email
+  table: limit_change
+  type: varchar(200)
+  v: 1
+quotes:
+  - of: column
+    text: changed_by_email
+why: The email address of the support agent who changed the limit.

package/dist/fixtures/forge-change/judgments/personal-data/31b1ea2f14d0737f1aca79fd.yaml

@@ -0,0 +1,18 @@
+# A judgment (ADR 0117): personal-data, decided by avery. To override it, change verdict, set confirmedBy to { by: person, name: <your Git user> } and keep what it said under overrides; commit it for review.
+schemaVersion: 1
+kind: personal-data
+key: 31b1ea2f14d0737f1aca79fd
+verdict: no
+at: 2026-10-19T10:00:00Z
+confirmedBy:
+  by: person
+  name: avery
+inputs:
+  column: changed_by
+  table: limit_change
+  type: varchar(40)
+  v: 1
+quotes:
+  - of: column
+    text: changed_by
+why: data.md says it holds the support agent's staff id, never a name or an email address, which the bank classes as internal.