@patwoodman/dsh-sdlc-flow 0.4.0-beta.17 → 0.4.0-beta.20

package/cordis.patch.yml

@@ -22,10 +22,11 @@
 #
 # Order matters only where a row waits on a service: services first, then the
 # tools and preset rows that use them, then the UI. The
-# `agent-preset-registry` row stays FIRST inside the presets block (the dialect
-# has no insert-if-missing), so on the web template the composed lead holds two
-# same-id registry rows at one service — the loader accepts both and every
-# preset activates (verified live); M0-02 pins those counts.
+# `agent-preset-registry` row stays FIRST inside the presets member block
+# (headless/sdk, the dialect has no insert-if-missing). This generated lead
+# patch replaces that insert with an id-targeted override of the web template's
+# shipped row: a duplicate id+name is loader-accepted but blocks plugin-manager
+# uninstall. M0-02 pins one registry row whose default is sdlc-lead.
 
 # ── the meta-bundle's own row ────────────────────────────────────────────────
 # A row that executes this package's apply() at boot, so the meta-bundle is a
@@ -82,11 +83,16 @@
         worktreePath: !!js process.cwd()
 
 # ── from @patwoodman/dsh-sdlc-flow-presets — the 26 role presets (C.3)
+# The web template ships agent-preset-registry. Override its default instead
+# of inserting a duplicate row: a duplicate id+name is loader-accepted but
+# blocks plugin-manager uninstall as "bundle-in-use". The presets member keeps
+# the insert for headless/sdk templates, which have no registry row.
+- id: agent-preset-registry
+  name: '@deepseek-ai/dsh-agent-preset-registry'
+  config:
+    default: sdlc-lead
+
 - insert:
-    - id: agent-preset-registry
-      name: "@deepseek-ai/dsh-agent-preset-registry"
-      config:
-        default: sdlc-lead
     - id: preset-sdlc-lead
       name: "@deepseek-ai/dsh-agent-preset"
       config:
@@ -106,14 +112,20 @@
             name: "@deepseek-ai/dsh-tool-fs"
           - id: tool-todo
             name: "@deepseek-ai/dsh-tool-todo"
+            config:
+              allowParallelInProgress: true
           - id: sdlc-report
-            name: "@patwoodman/dsh-sdlc-flow/tools"
+            name: "@patwoodman/dsh-sdlc-flow/tools-report"
           - id: tool-subagent
             name: "@deepseek-ai/dsh-tool-subagent"
+            config:
+              provider: spawn
+              toolName: subagent
+              backgroundMode: continuable
           - id: sdlc-dispatch
-            name: "@patwoodman/dsh-sdlc-flow/tools"
+            name: "@patwoodman/dsh-sdlc-flow/tools-dispatch"
           - id: sdlc-plan
-            name: "@patwoodman/dsh-sdlc-flow/tools"
+            name: "@patwoodman/dsh-sdlc-flow/tools-plan"
     - id: preset-sdlc-business-analyst
       name: "@deepseek-ai/dsh-agent-preset"
       config:
@@ -133,8 +145,10 @@
             name: "@deepseek-ai/dsh-tool-fs"
           - id: tool-todo
             name: "@deepseek-ai/dsh-tool-todo"
+            config:
+              allowParallelInProgress: false
           - id: sdlc-report
-            name: "@patwoodman/dsh-sdlc-flow/tools"
+            name: "@patwoodman/dsh-sdlc-flow/tools-report"
     - id: preset-sdlc-requirements-engineer
       name: "@deepseek-ai/dsh-agent-preset"
       config:
@@ -154,8 +168,10 @@
             name: "@deepseek-ai/dsh-tool-fs"
           - id: tool-todo
             name: "@deepseek-ai/dsh-tool-todo"
+            config:
+              allowParallelInProgress: false
           - id: sdlc-report
-            name: "@patwoodman/dsh-sdlc-flow/tools"
+            name: "@patwoodman/dsh-sdlc-flow/tools-report"
     - id: preset-sdlc-product-owner
       name: "@deepseek-ai/dsh-agent-preset"
       config:
@@ -175,8 +191,10 @@
             name: "@deepseek-ai/dsh-tool-fs"
           - id: tool-todo
             name: "@deepseek-ai/dsh-tool-todo"
+            config:
+              allowParallelInProgress: false
           - id: sdlc-report
-            name: "@patwoodman/dsh-sdlc-flow/tools"
+            name: "@patwoodman/dsh-sdlc-flow/tools-report"
     - id: preset-sdlc-solution-architect
       name: "@deepseek-ai/dsh-agent-preset"
       config:
@@ -196,8 +214,10 @@
             name: "@deepseek-ai/dsh-tool-fs"
           - id: tool-todo
             name: "@deepseek-ai/dsh-tool-todo"
+            config:
+              allowParallelInProgress: false
           - id: sdlc-report
-            name: "@patwoodman/dsh-sdlc-flow/tools"
+            name: "@patwoodman/dsh-sdlc-flow/tools-report"
     - id: preset-sdlc-security-engineer
       name: "@deepseek-ai/dsh-agent-preset"
       config:
@@ -217,8 +237,10 @@
             name: "@deepseek-ai/dsh-tool-fs"
           - id: tool-todo
             name: "@deepseek-ai/dsh-tool-todo"
+            config:
+              allowParallelInProgress: false
           - id: sdlc-report
-            name: "@patwoodman/dsh-sdlc-flow/tools"
+            name: "@patwoodman/dsh-sdlc-flow/tools-report"
     - id: preset-sdlc-data-engineer
       name: "@deepseek-ai/dsh-agent-preset"
       config:
@@ -238,8 +260,10 @@
             name: "@deepseek-ai/dsh-tool-fs"
           - id: tool-todo
             name: "@deepseek-ai/dsh-tool-todo"
+            config:
+              allowParallelInProgress: false
           - id: sdlc-report
-            name: "@patwoodman/dsh-sdlc-flow/tools"
+            name: "@patwoodman/dsh-sdlc-flow/tools-report"
     - id: preset-sdlc-database-engineer
       name: "@deepseek-ai/dsh-agent-preset"
       config:
@@ -259,8 +283,10 @@
             name: "@deepseek-ai/dsh-tool-fs"
           - id: tool-todo
             name: "@deepseek-ai/dsh-tool-todo"
+            config:
+              allowParallelInProgress: false
           - id: sdlc-report
-            name: "@patwoodman/dsh-sdlc-flow/tools"
+            name: "@patwoodman/dsh-sdlc-flow/tools-report"
     - id: preset-sdlc-ux-designer
       name: "@deepseek-ai/dsh-agent-preset"
       config:
@@ -280,8 +306,10 @@
             name: "@deepseek-ai/dsh-tool-fs"
           - id: tool-todo
             name: "@deepseek-ai/dsh-tool-todo"
+            config:
+              allowParallelInProgress: false
           - id: sdlc-report
-            name: "@patwoodman/dsh-sdlc-flow/tools"
+            name: "@patwoodman/dsh-sdlc-flow/tools-report"
     - id: preset-sdlc-ui-designer
       name: "@deepseek-ai/dsh-agent-preset"
       config:
@@ -301,8 +329,10 @@
             name: "@deepseek-ai/dsh-tool-fs"
           - id: tool-todo
             name: "@deepseek-ai/dsh-tool-todo"
+            config:
+              allowParallelInProgress: false
           - id: sdlc-report
-            name: "@patwoodman/dsh-sdlc-flow/tools"
+            name: "@patwoodman/dsh-sdlc-flow/tools-report"
     - id: preset-sdlc-accessibility-engineer
       name: "@deepseek-ai/dsh-agent-preset"
       config:
@@ -322,8 +352,10 @@
             name: "@deepseek-ai/dsh-tool-fs"
           - id: tool-todo
             name: "@deepseek-ai/dsh-tool-todo"
+            config:
+              allowParallelInProgress: false
           - id: sdlc-report
-            name: "@patwoodman/dsh-sdlc-flow/tools"
+            name: "@patwoodman/dsh-sdlc-flow/tools-report"
     - id: preset-sdlc-frontend-engineer
       name: "@deepseek-ai/dsh-agent-preset"
       config:
@@ -343,8 +375,10 @@
             name: "@deepseek-ai/dsh-tool-fs"
           - id: tool-todo
             name: "@deepseek-ai/dsh-tool-todo"
+            config:
+              allowParallelInProgress: false
           - id: sdlc-report
-            name: "@patwoodman/dsh-sdlc-flow/tools"
+            name: "@patwoodman/dsh-sdlc-flow/tools-report"
     - id: preset-sdlc-backend-engineer
       name: "@deepseek-ai/dsh-agent-preset"
       config:
@@ -364,8 +398,10 @@
             name: "@deepseek-ai/dsh-tool-fs"
           - id: tool-todo
             name: "@deepseek-ai/dsh-tool-todo"
+            config:
+              allowParallelInProgress: false
           - id: sdlc-report
-            name: "@patwoodman/dsh-sdlc-flow/tools"
+            name: "@patwoodman/dsh-sdlc-flow/tools-report"
     - id: preset-sdlc-api-engineer
       name: "@deepseek-ai/dsh-agent-preset"
       config:
@@ -385,8 +421,10 @@
             name: "@deepseek-ai/dsh-tool-fs"
           - id: tool-todo
             name: "@deepseek-ai/dsh-tool-todo"
+            config:
+              allowParallelInProgress: false
           - id: sdlc-report
-            name: "@patwoodman/dsh-sdlc-flow/tools"
+            name: "@patwoodman/dsh-sdlc-flow/tools-report"
     - id: preset-sdlc-integration-engineer
       name: "@deepseek-ai/dsh-agent-preset"
       config:
@@ -406,8 +444,10 @@
             name: "@deepseek-ai/dsh-tool-fs"
           - id: tool-todo
             name: "@deepseek-ai/dsh-tool-todo"
+            config:
+              allowParallelInProgress: false
           - id: sdlc-report
-            name: "@patwoodman/dsh-sdlc-flow/tools"
+            name: "@patwoodman/dsh-sdlc-flow/tools-report"
     - id: preset-sdlc-devops-engineer
       name: "@deepseek-ai/dsh-agent-preset"
       config:
@@ -427,8 +467,10 @@
             name: "@deepseek-ai/dsh-tool-fs"
           - id: tool-todo
             name: "@deepseek-ai/dsh-tool-todo"
+            config:
+              allowParallelInProgress: false
           - id: sdlc-report
-            name: "@patwoodman/dsh-sdlc-flow/tools"
+            name: "@patwoodman/dsh-sdlc-flow/tools-report"
     - id: preset-sdlc-platform-engineer
       name: "@deepseek-ai/dsh-agent-preset"
       config:
@@ -448,8 +490,10 @@
             name: "@deepseek-ai/dsh-tool-fs"
           - id: tool-todo
             name: "@deepseek-ai/dsh-tool-todo"
+            config:
+              allowParallelInProgress: false
           - id: sdlc-report
-            name: "@patwoodman/dsh-sdlc-flow/tools"
+            name: "@patwoodman/dsh-sdlc-flow/tools-report"
     - id: preset-sdlc-qa-engineer
       name: "@deepseek-ai/dsh-agent-preset"
       config:
@@ -469,8 +513,10 @@
             name: "@deepseek-ai/dsh-tool-fs"
           - id: tool-todo
             name: "@deepseek-ai/dsh-tool-todo"
+            config:
+              allowParallelInProgress: false
           - id: sdlc-report
-            name: "@patwoodman/dsh-sdlc-flow/tools"
+            name: "@patwoodman/dsh-sdlc-flow/tools-report"
     - id: preset-sdlc-test-automation-engineer
       name: "@deepseek-ai/dsh-agent-preset"
       config:
@@ -490,8 +536,10 @@
             name: "@deepseek-ai/dsh-tool-fs"
           - id: tool-todo
             name: "@deepseek-ai/dsh-tool-todo"
+            config:
+              allowParallelInProgress: false
           - id: sdlc-report
-            name: "@patwoodman/dsh-sdlc-flow/tools"
+            name: "@patwoodman/dsh-sdlc-flow/tools-report"
     - id: preset-sdlc-e2e-engineer
       name: "@deepseek-ai/dsh-agent-preset"
       config:
@@ -511,8 +559,10 @@
             name: "@deepseek-ai/dsh-tool-fs"
           - id: tool-todo
             name: "@deepseek-ai/dsh-tool-todo"
+            config:
+              allowParallelInProgress: false
           - id: sdlc-report
-            name: "@patwoodman/dsh-sdlc-flow/tools"
+            name: "@patwoodman/dsh-sdlc-flow/tools-report"
     - id: preset-sdlc-visual-qa-engineer
       name: "@deepseek-ai/dsh-agent-preset"
       config:
@@ -532,8 +582,10 @@
             name: "@deepseek-ai/dsh-tool-fs"
           - id: tool-todo
             name: "@deepseek-ai/dsh-tool-todo"
+            config:
+              allowParallelInProgress: false
           - id: sdlc-report
-            name: "@patwoodman/dsh-sdlc-flow/tools"
+            name: "@patwoodman/dsh-sdlc-flow/tools-report"
     - id: preset-sdlc-performance-engineer
       name: "@deepseek-ai/dsh-agent-preset"
       config:
@@ -553,8 +605,10 @@
             name: "@deepseek-ai/dsh-tool-fs"
           - id: tool-todo
             name: "@deepseek-ai/dsh-tool-todo"
+            config:
+              allowParallelInProgress: false
           - id: sdlc-report
-            name: "@patwoodman/dsh-sdlc-flow/tools"
+            name: "@patwoodman/dsh-sdlc-flow/tools-report"
     - id: preset-sdlc-technical-writer
       name: "@deepseek-ai/dsh-agent-preset"
       config:
@@ -574,8 +628,10 @@
             name: "@deepseek-ai/dsh-tool-fs"
           - id: tool-todo
             name: "@deepseek-ai/dsh-tool-todo"
+            config:
+              allowParallelInProgress: false
           - id: sdlc-report
-            name: "@patwoodman/dsh-sdlc-flow/tools"
+            name: "@patwoodman/dsh-sdlc-flow/tools-report"
     - id: preset-sdlc-release-manager
       name: "@deepseek-ai/dsh-agent-preset"
       config:
@@ -595,8 +651,10 @@
             name: "@deepseek-ai/dsh-tool-fs"
           - id: tool-todo
             name: "@deepseek-ai/dsh-tool-todo"
+            config:
+              allowParallelInProgress: false
           - id: sdlc-report
-            name: "@patwoodman/dsh-sdlc-flow/tools"
+            name: "@patwoodman/dsh-sdlc-flow/tools-report"
     - id: preset-sdlc-code-reviewer
       name: "@deepseek-ai/dsh-agent-preset"
       config:
@@ -616,8 +674,10 @@
             name: "@deepseek-ai/dsh-tool-fs"
           - id: tool-todo
             name: "@deepseek-ai/dsh-tool-todo"
+            config:
+              allowParallelInProgress: false
           - id: sdlc-report
-            name: "@patwoodman/dsh-sdlc-flow/tools"
+            name: "@patwoodman/dsh-sdlc-flow/tools-report"
     - id: preset-sdlc-sre-engineer
       name: "@deepseek-ai/dsh-agent-preset"
       config:
@@ -637,8 +697,10 @@
             name: "@deepseek-ai/dsh-tool-fs"
           - id: tool-todo
             name: "@deepseek-ai/dsh-tool-todo"
+            config:
+              allowParallelInProgress: false
           - id: sdlc-report
-            name: "@patwoodman/dsh-sdlc-flow/tools"
+            name: "@patwoodman/dsh-sdlc-flow/tools-report"
     - id: sdlc-presets
       name: "@patwoodman/dsh-sdlc-flow/presets-plugin"
       config: {}

package/lib/rows/cli/locale/en.json

@@ -0,0 +1,6 @@
+{
+  "meta": {
+    "title": "SDLC CLI",
+    "description": "Deterministic sdlc control plane: init, status, tasks, debug compare."
+  }
+}

package/lib/rows/cli/locale/zh.json

@@ -0,0 +1,6 @@
+{
+  "meta": {
+    "title": "SDLC CLI",
+    "description": "Deterministic sdlc control plane: init, status, tasks, debug compare."
+  }
+}

package/lib/rows/cli/package.json

@@ -1,5 +1,5 @@
 {
   "name": "@patwoodman/dsh-sdlc-flow-cli",
-  "version": "0.4.0-beta.17",
+  "version": "0.4.0-beta.20",
   "type": "module"
 }

package/lib/rows/core/cordis.patch.yml

@@ -0,0 +1,51 @@
+# sdlc-core — host services (spec v3 C.1/C.2).
+#
+# HOST BUNDLE. This package declares the runtime authority: task engine, state
+# transitions, scheduler, router, verifier, integration manager, evidence,
+# escalation and worker dispatch. It must NEVER be installed into a worker
+# profile — mounting it there would start a second scheduler and a second
+# writer against sdlc.db (errata E6). install-local.mjs and doctor.mjs assert
+# the partition.
+#
+# NOTE (discrepancy D2): spec C.1's inline comment shows sdlc-core declaring
+# both cordis.patch.yml and presets.patch.yml. The 26 preset rows live in
+# @patwoodman/dsh-sdlc-flow-presets (C.1 body text); declaring them here as well would
+# produce duplicate loader row ids and fail M0-02-no-dup-ids. Core therefore
+# declares host rows only.
+- insert:
+    - id: sdlc-tasks
+      name: '@patwoodman/dsh-sdlc-flow-core/services'
+      config:
+        service: tasks
+    - id: sdlc-scheduler
+      name: '@patwoodman/dsh-sdlc-flow-core/services'
+      config:
+        service: scheduler
+    - id: sdlc-router
+      name: '@patwoodman/dsh-sdlc-flow-core/services'
+      config:
+        service: router
+    - id: sdlc-verifier
+      name: '@patwoodman/dsh-sdlc-flow-core/services'
+      config:
+        service: verifier
+    - id: sdlc-integration
+      name: '@patwoodman/dsh-sdlc-flow-core/services'
+      config:
+        service: integration
+    - id: sdlc-evidence
+      name: '@patwoodman/dsh-sdlc-flow-core/services'
+      config:
+        service: evidence
+    - id: sdlc-escalation
+      name: '@patwoodman/dsh-sdlc-flow-core/services'
+      config:
+        service: escalation
+    - id: sdlc-worker-mgr
+      name: '@patwoodman/dsh-sdlc-flow-core/services'
+      config:
+        service: worker-mgr
+    - id: sdlc-recovery
+      name: '@patwoodman/dsh-sdlc-flow-core/services'
+      config:
+        service: recovery

package/lib/rows/core/icon.svg

@@ -0,0 +1,28 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64" width="64" height="64" role="img" aria-label="Universal SDLC Orchestrator">
+  <defs>
+    <linearGradient id="sdlc-bg" x1="0" y1="0" x2="1" y2="1">
+      <stop offset="0" stop-color="#1e3a8a"/>
+      <stop offset="1" stop-color="#0e7490"/>
+    </linearGradient>
+  </defs>
+  <rect width="64" height="64" rx="14" fill="url(#sdlc-bg)"/>
+  <g fill="none" stroke="#e0f2fe" stroke-width="2.4" stroke-linecap="round">
+    <path d="M32 17v9"/>
+    <path d="M32 34v4"/>
+    <path d="M24 44l-8 6"/>
+    <path d="M40 44l8 6"/>
+  </g>
+  <g fill="#e0f2fe">
+    <circle cx="32" cy="13" r="4.6"/>
+    <circle cx="32" cy="29" r="4.6"/>
+    <circle cx="19" cy="47" r="4.6"/>
+    <circle cx="45" cy="47" r="4.6"/>
+  </g>
+  <g fill="#0e7490">
+    <circle cx="32" cy="13" r="1.7"/>
+    <circle cx="32" cy="29" r="1.7"/>
+    <circle cx="19" cy="47" r="1.7"/>
+    <circle cx="45" cy="47" r="1.7"/>
+  </g>
+  <path d="M27.5 39.5l4.5 4.5 4.5-4.5" fill="none" stroke="#67e8f9" stroke-width="2.4" stroke-linecap="round" stroke-linejoin="round"/>
+</svg>

package/lib/rows/core/locale/en.json

@@ -0,0 +1,6 @@
+{
+  "meta": {
+    "title": "DSH SDLC Flow",
+    "description": "Task engine, scheduler, router, verifier, and integration manager. The runtime authority — lead profile only."
+  }
+}

package/lib/rows/core/locale/zh.json

@@ -0,0 +1,6 @@
+{
+  "meta": {
+    "title": "DSH SDLC Flow",
+    "description": "Task engine, scheduler, router, verifier, and integration manager. The runtime authority — lead profile only."
+  }
+}

package/lib/rows/core/package.json

@@ -1,5 +1,5 @@
 {
   "name": "@patwoodman/dsh-sdlc-flow-core",
-  "version": "0.4.0-beta.17",
+  "version": "0.4.0-beta.20",
   "type": "module"
 }

package/lib/rows/guard/cordis.patch.yml

@@ -0,0 +1,23 @@
+# sdlc-guard — worker-side enforcement (spec v3 C.1/C.7).
+#
+# Installed into the sdlc-worker profile beside sdlc-tools, and into the lead
+# profile for symmetry. It registers the `tools/pre-execute` waterfall and the
+# fs write decider. There is no host service here and no DB access: the guard is
+# policy, the sandbox root and the post-hoc git diff are the real controls.
+- insert:
+    - id: sdlc-guard
+      name: '@patwoodman/dsh-sdlc-flow-guard/plugin'
+      config:
+        guardMode: deny
+        orchestratorPaths: ['.sdlc/**', '.dsh/**']
+        protectedOrchestratorPaths:
+          - '.sdlc/sdlc.db'
+          - '.sdlc/sdlc.db-*'
+          - '.sdlc/sdlc.lock'
+          - '.sdlc/instance.lock'
+          - '.sdlc/task-contract.json'
+        guardForbiddenPatterns:
+          - 'git push --force*'
+          - 'rm -rf /'
+          - 'git clean -fdx*'
+          - 'git reset --hard*'

package/lib/rows/guard/icon.svg

@@ -0,0 +1,28 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64" width="64" height="64" role="img" aria-label="Universal SDLC Orchestrator">
+  <defs>
+    <linearGradient id="sdlc-bg" x1="0" y1="0" x2="1" y2="1">
+      <stop offset="0" stop-color="#1e3a8a"/>
+      <stop offset="1" stop-color="#0e7490"/>
+    </linearGradient>
+  </defs>
+  <rect width="64" height="64" rx="14" fill="url(#sdlc-bg)"/>
+  <g fill="none" stroke="#e0f2fe" stroke-width="2.4" stroke-linecap="round">
+    <path d="M32 17v9"/>
+    <path d="M32 34v4"/>
+    <path d="M24 44l-8 6"/>
+    <path d="M40 44l8 6"/>
+  </g>
+  <g fill="#e0f2fe">
+    <circle cx="32" cy="13" r="4.6"/>
+    <circle cx="32" cy="29" r="4.6"/>
+    <circle cx="19" cy="47" r="4.6"/>
+    <circle cx="45" cy="47" r="4.6"/>
+  </g>
+  <g fill="#0e7490">
+    <circle cx="32" cy="13" r="1.7"/>
+    <circle cx="32" cy="29" r="1.7"/>
+    <circle cx="19" cy="47" r="1.7"/>
+    <circle cx="45" cy="47" r="1.7"/>
+  </g>
+  <path d="M27.5 39.5l4.5 4.5 4.5-4.5" fill="none" stroke="#67e8f9" stroke-width="2.4" stroke-linecap="round" stroke-linejoin="round"/>
+</svg>

package/lib/rows/guard/locale/en.json

@@ -0,0 +1,6 @@
+{
+  "meta": {
+    "title": "SDLC Worker Guard",
+    "description": "Worker-side policy: tool and filesystem deciders. Worker profiles only."
+  }
+}

package/lib/rows/guard/locale/zh.json

@@ -0,0 +1,6 @@
+{
+  "meta": {
+    "title": "SDLC Worker Guard",
+    "description": "Worker-side policy: tool and filesystem deciders. Worker profiles only."
+  }
+}

package/lib/rows/guard/package.json

@@ -1,5 +1,5 @@
 {
   "name": "@patwoodman/dsh-sdlc-flow-guard",
-  "version": "0.4.0-beta.17",
+  "version": "0.4.0-beta.20",
   "type": "module"
 }

package/lib/rows/guard/schema/path-policy.schema.json

@@ -0,0 +1,48 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://sdlc.dev/schemas/path-policy.schema.json",
+  "title": "SDLC guard path/command policy",
+  "description": "Version 1.0.0 of the fixed glob dialect published by spec v3 C.7.3: `*` matches within a path segment, `**` matches across segments, a leading `./` is stripped, matching is on the repo-relative POSIX path, and forbidden_paths is evaluated after allowed_paths (deny wins).",
+  "x-dialect-version": "1.0.0",
+  "type": "object",
+  "additionalProperties": false,
+  "properties": {
+    "allowed_paths": {
+      "type": "array",
+      "items": { "$ref": "#/$defs/glob" },
+      "description": "Paths the worker may write inside the worktree."
+    },
+    "forbidden_paths": {
+      "type": "array",
+      "items": { "$ref": "#/$defs/glob" },
+      "description": "Evaluated after allowed_paths; deny wins."
+    },
+    "forbidden_patterns": {
+      "type": "array",
+      "items": { "type": "string", "minLength": 1 },
+      "description": "Command patterns; `*` is a wildcard. Defence-in-depth only."
+    },
+    "forbidden_commands": {
+      "type": "array",
+      "items": { "type": "string", "minLength": 1 }
+    },
+    "orchestratorPaths": {
+      "type": "array",
+      "items": { "$ref": "#/$defs/glob" }
+    },
+    "protectedOrchestratorPaths": {
+      "type": "array",
+      "items": { "$ref": "#/$defs/glob" }
+    },
+    "guardMode": { "enum": ["deny", "warn"] },
+    "worktreeRoot": { "type": "string" }
+  },
+  "$defs": {
+    "glob": {
+      "type": "string",
+      "minLength": 1,
+      "pattern": "^[^\\u0000]*$",
+      "description": "Repo-relative POSIX glob. `..`, absolute paths and NUL are rejected at match time."
+    }
+  }
+}