@patwoodman/dsh-sdlc-flow-tools 0.0.0-stage → 0.4.0-beta.14

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 SDLC Orchestrator contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,29 @@
-# Temporary Holding Version
+# @patwoodman/dsh-sdlc-flow-tools — model tools and the `/sdlc` command surface
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+The propose-only tool surface, installed in **both** the lead and worker
+profiles: workers need `sdlc_report_result`, `sdlc_claim_check` and
+`sdlc_request_decision` to write their outbox proposal; the lead additionally
+gets the delegation and planning tools. The `/sdlc` command surface
+(`run`, `status`, `stop`, `resume`, `doctor`, `config`, `verify`, `explain`,
+`debug`) is registered in interactive profiles.
+
+None of these tools may grant authority — that is the lead's human-only
+privilege (spec L.1 rule 4).
+
+## Install
+
+```sh
+dsh plugin --profile sdlc-worker add @patwoodman/dsh-sdlc-flow-guard @patwoodman/dsh-sdlc-flow-tools
+```
+
+It is also a member of [`@patwoodman/dsh-sdlc-flow`](https://www.npmjs.com/package/@patwoodman/dsh-sdlc-flow),
+so a lead install brings it in without a second spec.
+
+## Requirements
+
+- `@deepseek-ai/dsh` `>=0.2.0-rc.2 <0.3.0-0`
+- Node.js ≥ 22.5
+
+## License
+
+MIT

package/cordis.patch.yml

@@ -0,0 +1,11 @@
+# sdlc-tools — model-facing tools + the /sdlc command surface (spec v3 C.4).
+#
+# Installed into BOTH the lead and worker profiles (E6): the worker needs
+# sdlc_report_result / sdlc_claim_check / sdlc_request_decision to write its
+# outbox proposal; the lead additionally gets the delegation/planning tools.
+# Tools are propose-only — none of them may grant authority (L.1 rule 4).
+- insert:
+    - id: sdlc-tools
+      name: '@patwoodman/dsh-sdlc-flow-tools/plugin'
+      config:
+        worktreePath: !!js process.cwd()

package/icon.svg

@@ -0,0 +1,28 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64" width="64" height="64" role="img" aria-label="Universal SDLC Orchestrator">
+  <defs>
+    <linearGradient id="sdlc-bg" x1="0" y1="0" x2="1" y2="1">
+      <stop offset="0" stop-color="#1e3a8a"/>
+      <stop offset="1" stop-color="#0e7490"/>
+    </linearGradient>
+  </defs>
+  <rect width="64" height="64" rx="14" fill="url(#sdlc-bg)"/>
+  <g fill="none" stroke="#e0f2fe" stroke-width="2.4" stroke-linecap="round">
+    <path d="M32 17v9"/>
+    <path d="M32 34v4"/>
+    <path d="M24 44l-8 6"/>
+    <path d="M40 44l8 6"/>
+  </g>
+  <g fill="#e0f2fe">
+    <circle cx="32" cy="13" r="4.6"/>
+    <circle cx="32" cy="29" r="4.6"/>
+    <circle cx="19" cy="47" r="4.6"/>
+    <circle cx="45" cy="47" r="4.6"/>
+  </g>
+  <g fill="#0e7490">
+    <circle cx="32" cy="13" r="1.7"/>
+    <circle cx="32" cy="29" r="1.7"/>
+    <circle cx="19" cy="47" r="1.7"/>
+    <circle cx="45" cy="47" r="1.7"/>
+  </g>
+  <path d="M27.5 39.5l4.5 4.5 4.5-4.5" fill="none" stroke="#67e8f9" stroke-width="2.4" stroke-linecap="round" stroke-linejoin="round"/>
+</svg>

package/lib/index.js

@@ -0,0 +1,230 @@
+/**
+ * packages/sdlc-tools/src/index.js — model-facing tools and the /sdlc command surface.
+ *
+ * AUTHORITY (spec v3 C.4, L.1): tools are PROPOSE-ONLY. They run inside the
+ * worker's own process and write a schema-validated proposal to the worktree
+ * outbox (B.3.2); they have no `sdlc.db` access and no cross-process write path.
+ * The transition service validates and applies. Anything that GRANTS authority
+ * (approve/reject/stop) is a user-only command handler — never a model tool.
+ */
+
+import { appendFileSync, mkdirSync, renameSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { buildOutbox, OUTBOX_PATH } from '@patwoodman/dsh-sdlc-flow-core/worker-result';
+
+export const WORKER_TOOLS = ['sdlc_report_result', 'sdlc_claim_check', 'sdlc_request_decision'];
+export const LEAD_TOOLS = ['sdlc_dispatch_task', 'sdlc_approve_transition', 'sdlc_record_decision', 'sdlc_plan_delta'];
+export const ALL_TOOLS = [...WORKER_TOOLS, ...LEAD_TOOLS];
+
+export const COMMANDS = [
+  'run', 'status', 'tasks', 'workers', 'models', 'logs', 'verify', 'resume', 'stop',
+  'explain', 'retry', 'elevate', 'approve', 'reject', 'doctor', 'config', 'init', 'lock', 'selftest',
+  'debug',
+];
+
+/**
+ * The `debug` command surface (review + improvement). Read-only: it renders
+ * recorded run anatomy (time/tokens/tracepaths) side by side. Like `status`
+ * and `explain` it grants no authority, so it is available to every mode —
+ * including headless deployments that are otherwise guests of the state
+ * machine (fail-closed, C.2/L.5).
+ */
+export const DEBUG_COMMANDS = ['compare', 'trace'];
+
+/** Commands that grant authority; user-only, executed directly by the handler. */
+export const AUTHORITY_COMMANDS = ['approve', 'reject', 'stop', 'retry', 'elevate'];
+
+const S = (type, description, extra = {}) => ({ type, description, ...extra });
+const ARRAY_STR = (description) => S('array', description, { items: { type: 'string' } });
+
+/**
+ * Tool definitions in the `defineTool` DSL shape (C.4): every tool has a
+ * canonical `output` schema and a pure `render()`.
+ */
+export const TOOL_DEFS = {
+  sdlc_report_result: {
+    name: 'sdlc_report_result',
+    description: 'Report the outcome of this task. Writes a proposal to .sdlc/task-outbox.json; the runtime verifies it against the git diff.',
+    parameters: {
+      type: 'object',
+      properties: {
+        status: S('string', 'completed | failed | aborted', { enum: ['completed', 'failed', 'aborted'] }),
+        summary: S('string', 'One-paragraph summary of what changed'),
+        evidence_claims: S('array', 'Per acceptance criterion claims', {
+          items: {
+            type: 'object',
+            properties: { ac_id: S('string', 'AC id'), claim: S('string', 'pass | fail'), artifact: S('string', 'Path or test id') },
+            required: ['ac_id', 'claim'],
+          },
+        }),
+        tests_run: ARRAY_STR('Test commands or selectors that were run'),
+        requests: ARRAY_STR('Explicit asks for the Lead (dependencies, decisions)'),
+      },
+      required: ['status', 'summary'],
+    },
+    output: { schema: { type: 'object', properties: { ok: S('boolean', 'proposal accepted') } }, render: (r) => (r.ok ? 'result recorded' : 'result rejected') },
+    authority: 'propose',
+  },
+  sdlc_claim_check: {
+    name: 'sdlc_claim_check',
+    description: 'Claim that a specific acceptance-criteria check passed, with its artifact. Claims are hints; the verifier re-runs the gate.',
+    parameters: {
+      type: 'object',
+      properties: {
+        ac_id: S('string', 'Acceptance criterion id'),
+        claim: S('string', 'pass | fail', { enum: ['pass', 'fail'] }),
+        artifact: S('string', 'Evidence path or test identifier'),
+      },
+      required: ['ac_id', 'claim'],
+    },
+    output: { schema: { type: 'object', properties: { ok: S('boolean', 'claim recorded') } }, render: (r) => (r.ok ? 'claim recorded' : 'claim rejected') },
+    authority: 'propose',
+  },
+  sdlc_request_decision: {
+    name: 'sdlc_request_decision',
+    description: 'Ask the Lead for a decision or a missing dependency. In a headless worker this resolves unavailable and the task stays BLOCKED (fail-closed).',
+    parameters: {
+      type: 'object',
+      properties: {
+        question: S('string', 'The decision required'),
+        options: ARRAY_STR('Candidate options'),
+        blocking: S('boolean', 'Whether work cannot continue without an answer'),
+      },
+      required: ['question'],
+    },
+    output: { schema: { type: 'object', properties: { ok: S('boolean', 'request queued') } }, render: (r) => (r.ok ? 'decision requested' : 'request rejected') },
+    authority: 'propose',
+  },
+  sdlc_dispatch_task: {
+    name: 'sdlc_dispatch_task',
+    description: 'Propose dispatching a persisted task. The scheduler decides; an illegal proposal returns INVALID_TRANSITION.',
+    parameters: {
+      type: 'object',
+      properties: { task_id: S('string', 'Task id'), note: S('string', 'Why now') },
+      required: ['task_id'],
+    },
+    output: { schema: { type: 'object', properties: { ok: S('boolean', ''), error: S('string', '') } }, render: (r) => (r.ok ? `dispatched ${r.task_id ?? ''}` : r.error) },
+    authority: 'propose',
+  },
+  sdlc_approve_transition: {
+    name: 'sdlc_approve_transition',
+    description: 'Propose approving a transition. The runtime applies it only if the transition matrix and evidence allow it; a model can never grant authority (L.1 rule 4).',
+    parameters: {
+      type: 'object',
+      properties: { task_id: S('string', 'Task id'), to: S('string', 'Target state'), reason: S('string', 'Evidence') },
+      required: ['task_id', 'to'],
+    },
+    output: { schema: { type: 'object', properties: { ok: S('boolean', ''), error: S('string', '') } }, render: (r) => (r.ok ? 'proposal recorded' : r.error) },
+    authority: 'propose',
+  },
+  sdlc_record_decision: {
+    name: 'sdlc_record_decision',
+    description: 'Propose recording an ADR in the decision ledger.',
+    parameters: {
+      type: 'object',
+      properties: {
+        question: S('string', ''), decision: S('string', ''), reason: S('string', ''),
+        alternatives: ARRAY_STR(''), consequences: ARRAY_STR(''), tags: ARRAY_STR(''),
+      },
+      required: ['question', 'decision'],
+    },
+    output: { schema: { type: 'object', properties: { ok: S('boolean', '') } }, render: (r) => (r.ok ? 'decision recorded' : 'rejected') },
+    authority: 'propose',
+  },
+  sdlc_plan_delta: {
+    name: 'sdlc_plan_delta',
+    description: 'Propose adding or editing tasks. The runtime applies deltas only through the normal planner path (spec §36).',
+    parameters: {
+      type: 'object',
+      properties: { tasks: S('array', 'Task proposals', { items: { type: 'object' } }), reason: S('string', '') },
+      required: ['tasks'],
+    },
+    output: { schema: { type: 'object', properties: { ok: S('boolean', ''), count: S('number', '') } }, render: (r) => (r.ok ? `${r.count ?? 0} task proposals queued` : 'rejected') },
+    authority: 'propose',
+  },
+};
+
+/** Atomic outbox write (write temp + rename) — B.3.2. */
+export function writeOutbox(worktreePath, envelope) {
+  const target = join(worktreePath, OUTBOX_PATH);
+  mkdirSync(dirname(target), { recursive: true });
+  const tmp = `${target}.tmp-${process.pid}`;
+  writeFileSync(tmp, JSON.stringify(envelope, null, 2) + '\n');
+  renameSync(tmp, target);
+  return target;
+}
+
+export function appendRequest(worktreePath, request) {
+  const target = join(worktreePath, '.sdlc', 'requests.jsonl');
+  mkdirSync(dirname(target), { recursive: true });
+  appendFileSync(target, JSON.stringify({ ...request, at: new Date().toISOString() }) + '\n');
+  return target;
+}
+
+/**
+ * Handlers for the proposal channel. `allowed_paths`/`forbidden_paths` are NOT
+ * consulted here — the guard does that; these handlers only shape proposals.
+ */
+export function createHandlers({ worktreePath, runMeta = {} } = {}) {
+  const state = { claims: [], requests: [], reported: null };
+
+  return {
+    sdlc_report_result(args) {
+      const envelope = buildOutbox({
+        runId: runMeta.runId, taskId: runMeta.taskId, attempt: runMeta.attempt, nonce: runMeta.nonce,
+        claims: {
+          status: args.status, summary: args.summary,
+          evidence_claims: args.evidence_claims ?? state.claims,
+          tests_run: args.tests_run ?? [], requests: [...state.requests, ...(args.requests ?? [])],
+        },
+      });
+      if (worktreePath) writeOutbox(worktreePath, envelope);
+      state.reported = envelope;
+      return { ok: true, envelope };
+    },
+    sdlc_claim_check(args) {
+      state.claims.push({ ac_id: args.ac_id, claim: args.claim, artifact: args.artifact ?? null });
+      return { ok: true, claims: state.claims.length };
+    },
+    sdlc_request_decision(args) {
+      const request = { question: args.question, options: args.options ?? [], blocking: Boolean(args.blocking) };
+      state.requests.push(request);
+      if (worktreePath) appendRequest(worktreePath, request);
+      return { ok: true, queued: true, blocking: request.blocking };
+    },
+    sdlc_dispatch_task(args) {
+      return { ok: false, error: 'INVALID_TRANSITION: dispatch is owned by the scheduler', task_id: args.task_id };
+    },
+    sdlc_approve_transition(args) {
+      return { ok: false, error: 'AUTHORITY_DENIED: approvals are user-only (L.1 rule 4)', task_id: args.task_id };
+    },
+    sdlc_record_decision(args) {
+      return { ok: true, proposal: { kind: 'decision', ...args } };
+    },
+    sdlc_plan_delta(args) {
+      return { ok: true, count: (args.tasks ?? []).length, proposal: { kind: 'plan-delta', ...args } };
+    },
+    _state: state,
+  };
+}
+
+/** Validate args against the tool's parameter schema (minimal JSON-Schema subset). */
+export function validateToolArgs(name, args = {}) {
+  const def = TOOL_DEFS[name];
+  if (!def) return { ok: false, error: `unknown tool ${name}` };
+  const errors = [];
+  for (const key of def.parameters.required ?? []) {
+    if (args[key] === undefined) errors.push(`missing required parameter ${key}`);
+  }
+  for (const [key, spec] of Object.entries(def.parameters.properties ?? {})) {
+    const value = args[key];
+    if (value === undefined) continue;
+    if (spec.type === 'array' && !Array.isArray(value)) errors.push(`${key} must be an array`);
+    if (spec.type === 'string' && typeof value !== 'string') errors.push(`${key} must be a string`);
+    if (spec.type === 'boolean' && typeof value !== 'boolean') errors.push(`${key} must be a boolean`);
+    if (spec.enum && !spec.enum.includes(value)) errors.push(`${key} must be one of ${spec.enum.join('|')}`);
+  }
+  return errors.length ? { ok: false, error: errors.join('; ') } : { ok: true };
+}
+
+export default { TOOL_DEFS, WORKER_TOOLS, LEAD_TOOLS, COMMANDS, createHandlers, writeOutbox };

package/lib/plugin.js

@@ -0,0 +1,85 @@
+/**
+ * packages/sdlc-tools/src/plugin.js — DSH registration for tools and commands.
+ *
+ * Model tools are propose-only; authority-granting actions are user-only
+ * command handlers (C.4, authoring constraint 4). Registration is defensive so
+ * the package imports cleanly without a DSH host.
+ */
+
+import { readFileSync } from 'node:fs';
+import { COMMANDS, TOOL_DEFS, WORKER_TOOLS, LEAD_TOOLS, ALL_TOOLS, DEBUG_COMMANDS, createHandlers } from './index.js';
+import { contributeSelftest, setSelftestMeta } from './selftest.js';
+
+function pkgVersion() {
+  try {
+    return JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8')).version;
+  } catch {
+    return null;
+  }
+}
+
+/** Register every tool definition on a DSH context. */
+export function registerTools(ctx, config = {}) {
+  const registered = [];
+  const worktreePath = config.worktreePath ?? process.cwd();
+  const handlers = createHandlers({ worktreePath, runMeta: config.runMeta ?? {} });
+
+  for (const [name, def] of Object.entries(TOOL_DEFS)) {
+    const handler = handlers[name];
+    if (!handler) continue;
+    registered.push(name);
+    try {
+      if (typeof ctx?.tools?.register === 'function') {
+        ctx.tools.register({
+          ...def,
+          handler: (args) => handler(args),
+        });
+      }
+    } catch (err) {
+      if (ctx?.logger?.warn) ctx.logger.warn('sdlc-tools: failed to register %s: %s', name, err?.message ?? err);
+    }
+  }
+  return registered;
+}
+
+/** Register the `/sdlc` command surface (interactive profiles only — E3). */
+export function registerCommands(ctx, config = {}) {
+  const registered = [];
+  for (const name of COMMANDS) {
+    registered.push(name);
+    try {
+      if (typeof ctx?.commands?.register === 'function') {
+        ctx.commands.register({
+          definitionId: `sdlc.${name}`,
+          name: `sdlc ${name}`,
+          description: `SDLC orchestrator: ${name}`,
+          input: { type: 'string' },
+          handler: (input) => {
+            if (ctx?.logger?.debug) ctx.logger.debug('sdlc %s %s', name, input ?? '');
+            return { ok: true, command: name, input: input ?? null, deferred: true };
+          },
+        });
+      }
+    } catch (err) {
+      if (ctx?.logger?.warn) ctx.logger.warn('sdlc-tools: failed to register command %s: %s', name, err?.message ?? err);
+    }
+  }
+  return registered;
+}
+
+/**
+ * Loader entry. MUST return nothing: the Cordis runner interprets a plugin's
+ * return value as an effect (`TypeError: Invalid effect` for a
+ * non-constructible apply; silently dropped for this regular-function apply).
+ * Tests that want the registration report call `registerTools` /
+ * `registerCommands` directly.
+ * @returns {undefined}
+ */
+export function apply(ctx, config = {}) {
+  setSelftestMeta({ version: pkgVersion() });
+  const tools = registerTools(ctx, config);
+  const commands = registerCommands(ctx, config);
+  contributeSelftest({ tools, commands });
+}
+
+export { COMMANDS, TOOL_DEFS, WORKER_TOOLS, LEAD_TOOLS, ALL_TOOLS, DEBUG_COMMANDS };

package/lib/selftest.js

@@ -0,0 +1,119 @@
+/**
+ * selftest.js — deterministic boot hook (spec v3 C.9).
+ *
+ * There is NO CLI for listing registered tools/commands (verification Q8), and
+ * asking a model is neither deterministic nor free. This module implements the
+ * `SDLC_SELFTEST` hook: when the env var is an ABSOLUTE path, the plugin suite
+ * writes a registration report there.
+ *
+ * Contract and limits:
+ *   - inert unless `SDLC_SELFTEST` is an absolute path; a non-absolute or
+ *     unwritable path is a start-up error, never a silent pass;
+ *   - the hook reports REGISTRATION ONLY — behaviour is covered by tests;
+ *   - the report is flushed only after the composition goes quiet (debounced),
+ *     so it is independent of bundle load order.
+ *
+ * NOTE: this file is intentionally duplicated verbatim in sdlc-core, sdlc-tools
+ * and sdlc-presets. Those packages must remain independently installable (E6):
+ * the worker profile has sdlc-tools WITHOUT sdlc-core. The shared state lives on
+ * globalThis, so every copy contributes to one report.
+ */
+
+import { writeFileSync } from 'node:fs';
+import { isAbsolute } from 'node:path';
+
+const STATE_KEY = '__SDLC_SELFTEST_STATE__';
+const FLUSH_DELAY_MS = 50;
+
+function state() {
+  const g = globalThis;
+  if (!g[STATE_KEY]) {
+    g[STATE_KEY] = {
+      version: null,
+      dsh: null,
+      tools: new Set(),
+      commands: new Set(),
+      services: new Set(),
+      presets: new Set(),
+      guard: {},
+      timer: null,
+      written: false,
+    };
+  }
+  return g[STATE_KEY];
+}
+
+/** Set the runtime/DSH versions exactly once. */
+export function setSelftestMeta({ version = null, dsh = null } = {}) {
+  const s = state();
+  if (version) s.version = version;
+  if (dsh) s.dsh = dsh;
+}
+
+/** Contribute registration names. Safe to call from any package's apply(). */
+export function contributeSelftest({ tools = [], commands = [], services = [], presets = [], guard = null } = {}) {
+  const s = state();
+  for (const t of tools) s.tools.add(t);
+  for (const c of commands) s.commands.add(c);
+  for (const sv of services) s.services.add(sv);
+  for (const p of presets) s.presets.add(p);
+  if (guard) {
+    // MERGE, do not clobber: a later contributor that does not know the policy
+    // (sdlc-core contributes a placeholder) must not overwrite a richer value
+    // already reported by the owner (sdlc-guard). An empty array never wins
+    // over a populated one.
+    const merged = { ...s.guard };
+    for (const [k, v] of Object.entries(guard)) {
+      const isEmpty = v == null || (Array.isArray(v) && v.length === 0);
+      if (isEmpty && Array.isArray(merged[k]) && merged[k].length > 0) continue;
+      if (isEmpty && merged[k] !== undefined) continue;
+      merged[k] = v;
+    }
+    s.guard = merged;
+  }
+
+  if (!process.env.SDLC_SELFTEST) return null;
+
+  if (!isAbsolute(process.env.SDLC_SELFTEST)) {
+    throw new Error(`SDLC_SELFTEST must be an absolute path (got "${process.env.SDLC_SELFTEST}")`);
+  }
+  clearTimeout(s.timer);
+  s.timer = setTimeout(flushSelftest, FLUSH_DELAY_MS);
+  if (typeof s.timer?.unref === 'function') s.timer.unref();
+  return s.timer;
+}
+
+export function buildSelftestReport() {
+  const s = state();
+  const sort = (set) => [...set].sort();
+  return {
+    version: s.version,
+    dsh: s.dsh,
+    tools: sort(s.tools),
+    commands: sort(s.commands),
+    services: sort(s.services),
+    presets: sort(s.presets),
+    guard: {
+      orchestratorPaths: s.guard.orchestratorPaths ?? ['.sdlc/**', '.dsh/**'],
+      patterns: s.guard.forbiddenPatterns ?? s.guard.patterns ?? [],
+      forbiddenPatterns: s.guard.forbiddenPatterns ?? s.guard.patterns ?? [],
+    },
+  };
+}
+
+/** Write the report. Exported so the M0 harness can force a flush in tests. */
+export function flushSelftest() {
+  const path = process.env.SDLC_SELFTEST;
+  if (!path) return null;
+  if (!isAbsolute(path)) throw new Error(`SDLC_SELFTEST must be an absolute path (got "${path}")`);
+  const report = buildSelftestReport();
+  writeFileSync(path, JSON.stringify(report, null, 2) + '\n');
+  state().written = true;
+  return report;
+}
+
+export function selftestWritten() {
+  return state().written;
+}
+
+export default { contributeSelftest, setSelftestMeta, flushSelftest, buildSelftestReport };

package/locale/en.json

@@ -0,0 +1,6 @@
+{
+  "meta": {
+    "title": "SDLC Tools",
+    "description": "Propose-only model tools and the /sdlc command surface for lead and worker."
+  }
+}

package/locale/zh.json

@@ -0,0 +1,6 @@
+{
+  "meta": {
+    "title": "SDLC Tools",
+    "description": "Propose-only model tools and the /sdlc command surface for lead and worker."
+  }
+}

package/package.json

@@ -1,6 +1,54 @@
 {
   "name": "@patwoodman/dsh-sdlc-flow-tools",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.4.0-beta.14",
+  "type": "module",
+  "description": "Model-facing propose-only tools (worker + lead) and the /sdlc command surface.",
+  "main": "lib/index.js",
+  "exports": {
+    ".": "./lib/index.js",
+    "./plugin": "./lib/plugin.js",
+    "./package.json": "./package.json",
+    "./locale/*.json": "./locale/*.json",
+    "./icon": "./icon.svg",
+    "./cordis.patch.yml": "./cordis.patch.yml"
+  },
+  "files": [
+    "lib",
+    "cordis.patch.yml",
+    "locale/*.json",
+    "LICENSE",
+    "README.md",
+    "icon.svg"
+  ],
+  "scripts": {
+    "build": "node ../../scripts/build.mjs"
+  },
+  "peerDependencies": {
+    "@deepseek-ai/dsh": ">=0.2.0-rc.2 <0.3.0-0"
+  },
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    }
+  },
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "directory": "packages/sdlc-tools",
+    "url": "git+https://github.com/pwoodman/dsh-sdlc.git"
+  },
+  "icon": "icon.svg",
+  "engines": {
+    "node": ">=22.5.0"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "homepage": "https://github.com/pwoodman/dsh-sdlc",
+  "bugs": {
+    "url": "https://github.com/pwoodman/dsh-sdlc/issues"
+  },
+  "dependencies": {
+    "@patwoodman/dsh-sdlc-flow-core": "0.4.0-beta.14"
+  }
+}