@planu/cli 4.13.0 → 4.14.1

package/dist/engine/project-scanner/stack-detector.js

@@ -1,25 +1,24 @@
-// SPEC-597-EXEMPT: canonical mapping (npm-package↔framework, keyword catalogue)
-// — must enumerate framework names by design; no detection logic to migrate.
+import { technologyValue } from '../technology-registry.js';
 // engine/project-scanner/stack-detector.ts — Detect technology stack from config files
 import { readFile } from 'node:fs/promises';
 import { join } from 'node:path';
 const FRAMEWORK_PATTERNS = [
     ['next', /^next$/],
-    ['nuxt', /^nuxt$/],
-    ['react', /^react$/],
-    ['vue', /^vue$/],
-    ['angular', /^@angular\/core$/],
-    ['svelte', /^svelte$/],
-    ['express', /^express$/],
-    ['fastify', /^fastify$/],
+    [technologyValue('technology-nuxt-22c407'), /^nuxt$/],
+    [technologyValue('technology-react-275976'), /^react$/],
+    [technologyValue('technology-vue-564382'), /^vue$/],
+    [technologyValue('technology-angular-a39f89'), /^@angular\/core$/],
+    [technologyValue('technology-svelte-c190ac'), /^svelte$/],
+    [technologyValue('technology-express-008231'), /^express$/],
+    [technologyValue('technology-fastify-cbe57e'), /^fastify$/],
     ['hono', /^hono$/],
-    ['nestjs', /^@nestjs\/core$/],
+    [technologyValue('technology-nestjs-2d0087'), /^@nestjs\/core$/],
     ['koa', /^koa$/],
-    ['astro', /^astro$/],
+    [technologyValue('technology-astro-23661e'), /^astro$/],
 ];
 const TEST_RUNNER_PATTERNS = [
-    ['vitest', /^vitest$/],
-    ['jest', /^jest$/],
+    [technologyValue('technology-vitest-a9127f'), /^vitest$/],
+    [technologyValue('technology-jest-35e99f'), /^jest$/],
     ['mocha', /^mocha$/],
     ['jasmine', /^jasmine$/],
     ['ava', /^ava$/],
@@ -31,7 +30,7 @@ const BUNDLER_PATTERNS = [
     ['esbuild', /^esbuild$/],
     ['rollup', /^rollup$/],
     ['parcel', /^parcel$/],
-    ['turbopack', /^turbopack$/],
+    [technologyValue('technology-turbopack-1a3487'), /^turbopack$/],
 ];
 function matchFirst(deps, patterns) {
     for (const [name, pattern] of patterns) {
@@ -46,8 +45,9 @@ async function detectFromPackageJson(projectPath) {
         const raw = await readFile(join(projectPath, 'package.json'), 'utf-8');
         const pkg = JSON.parse(raw);
         const allDeps = { ...pkg.dependencies, ...pkg.devDependencies };
-        const hasTypeScript = 'typescript' in allDeps || Object.keys(allDeps).some((d) => d.startsWith('@types/'));
-        const language = hasTypeScript ? 'typescript' : 'javascript';
+        const hasTypeScript = technologyValue('technology-typescript-969545') in allDeps ||
+            Object.keys(allDeps).some((d) => d.startsWith('@types/'));
+        const language = hasTypeScript ? technologyValue('technology-typescript-969545') : 'javascript';
         const framework = matchFirst(allDeps, FRAMEWORK_PATTERNS);
         const testRunner = matchFirst(allDeps, TEST_RUNNER_PATTERNS);
         const linter = 'eslint' in allDeps ? 'eslint' : 'tslint' in allDeps ? 'tslint' : null;
@@ -67,7 +67,7 @@ async function detectFromPython(projectPath) {
             return {
                 language: 'python',
                 framework: null,
-                testRunner: 'pytest',
+                testRunner: technologyValue('technology-pytest-2b0121'),
                 linter: null,
                 formatter: null,
                 bundler: null,

package/dist/engine/property-test-generator.js

@@ -1,5 +1,4 @@
-// engine/property-test-generator.ts — SPEC-315
-// Extracts invariants from acceptance criteria and generates PropertyTest objects.
+import { technologyValue } from './technology-registry.js';
 // ---------------------------------------------------------------------------
 // Framework detection
 // ---------------------------------------------------------------------------
@@ -16,7 +15,7 @@ export function detectPropertyFramework(language, stack = []) {
     if (stackLower.includes('jqwik')) {
         return 'jqwik';
     }
-    if (lang === 'typescript' || lang === 'javascript') {
+    if (lang === technologyValue('technology-typescript-969545') || lang === 'javascript') {
         return 'fast-check';
     }
     if (lang === 'python') {

package/dist/engine/qa-gate.d.ts

@@ -1,5 +1,6 @@
 import type { QaGateResult } from '../types/qa-gate.js';
 import type { Spec } from '../types/spec/core.js';
+export declare function qaCheckTimeoutMs(): number;
 export declare function extractCoverageThreshold(spec: Spec): number | null;
 export declare function computeQaGateFingerprint(spec: Spec, projectPath: string): string;
 export declare function runQaGate(spec: Spec, projectPath: string, options?: {

package/dist/engine/qa-gate.js

@@ -5,8 +5,10 @@ import { resolveProjectCommandPlan } from './project-command-runtime.js';
 import { computeValidationEvidenceIdentity, computeValidationEvidenceKey, readMatchingValidationEvidence, recordSuccessfulValidationEvidence, recordValidationOutcome, } from './validation-evidence-ledger.js';
 import { runAbortableProcess } from './abortable-process-runner.js';
 import { VALIDATION_COMMANDS } from './validation-impact-planner.js';
-const TIMEOUT_MS = 120_000;
-const MAX_OUTPUT_BUFFER_BYTES = 64 * 1024 * 1024;
+import { boundedEnvironmentDuration, getRuntimePolicy } from './runtime-policy.js';
+export function qaCheckTimeoutMs() {
+    return boundedEnvironmentDuration('PLANU_QA_CHECK_TIMEOUT_MS', getRuntimePolicy().qualityAssurance);
+}
 export function extractCoverageThreshold(spec) {
     const text = [spec.title, ...spec.tags].join(' ');
     const match = /coverage\s*[>=]+\s*(\d+)%/i.exec(text);
@@ -19,8 +21,8 @@ async function runCheck(name, command, args, cwd, signal) {
     const start = Date.now();
     const result = await runAbortableProcess(command, args, {
         cwd,
-        timeoutMs: TIMEOUT_MS,
-        maxBufferBytes: MAX_OUTPUT_BUFFER_BYTES,
+        timeoutMs: qaCheckTimeoutMs(),
+        maxBufferBytes: getRuntimePolicy().qualityAssurance.maximumOutputBufferBytes,
         signal,
     });
     const durationMs = Date.now() - start;

package/dist/engine/quality-gates/gate-catalog.js

@@ -1,10 +1,11 @@
+import { technologyValue } from '../technology-registry.js';
 export const GATE_CATALOG = [
     // Security gates (15)
     {
         id: 'sec-sql-injection',
         category: 'security',
         title: 'All DB queries use parameterized queries or ORM — no string interpolation in SQL',
-        stacks: ['typescript', 'python', 'java', 'go', 'generic'],
+        stacks: [technologyValue('technology-typescript-969545'), 'python', 'java', 'go', 'generic'],
         riskLevels: ['low', 'medium', 'high'],
         specTypes: ['all'],
     },
@@ -12,7 +13,7 @@ export const GATE_CATALOG = [
         id: 'sec-input-validation',
         category: 'security',
         title: 'All user inputs validated with Zod/Pydantic/schema at system boundaries',
-        stacks: ['typescript', 'python', 'generic'],
+        stacks: [technologyValue('technology-typescript-969545'), 'python', 'generic'],
         riskLevels: ['low', 'medium', 'high'],
         specTypes: ['all'],
     },
@@ -20,7 +21,7 @@ export const GATE_CATALOG = [
         id: 'sec-auth-check',
         category: 'security',
         title: 'All endpoints/routes require authentication check before processing',
-        stacks: ['typescript', 'python', 'java', 'go', 'generic'],
+        stacks: [technologyValue('technology-typescript-969545'), 'python', 'java', 'go', 'generic'],
         riskLevels: ['medium', 'high'],
         specTypes: ['feature', 'infra'],
     },
@@ -28,7 +29,7 @@ export const GATE_CATALOG = [
         id: 'sec-sensitive-data',
         category: 'security',
         title: 'No PII or secrets logged to console/file — use redaction or masking',
-        stacks: ['typescript', 'python', 'java', 'go', 'generic'],
+        stacks: [technologyValue('technology-typescript-969545'), 'python', 'java', 'go', 'generic'],
         riskLevels: ['medium', 'high'],
         specTypes: ['all'],
     },
@@ -36,7 +37,7 @@ export const GATE_CATALOG = [
         id: 'sec-cors',
         category: 'security',
         title: 'CORS configured explicitly — no wildcard origin in production',
-        stacks: ['typescript', 'python', 'generic'],
+        stacks: [technologyValue('technology-typescript-969545'), 'python', 'generic'],
         riskLevels: ['medium', 'high'],
         specTypes: ['feature', 'infra'],
     },
@@ -44,7 +45,7 @@ export const GATE_CATALOG = [
         id: 'sec-rate-limit',
         category: 'security',
         title: 'Rate limiting applied to all public endpoints',
-        stacks: ['typescript', 'python', 'java', 'go', 'generic'],
+        stacks: [technologyValue('technology-typescript-969545'), 'python', 'java', 'go', 'generic'],
         riskLevels: ['high'],
         specTypes: ['feature', 'infra'],
     },
@@ -52,7 +53,7 @@ export const GATE_CATALOG = [
         id: 'sec-xss',
         category: 'security',
         title: 'All user-generated content escaped before rendering in HTML',
-        stacks: ['typescript', 'generic'],
+        stacks: [technologyValue('technology-typescript-969545'), 'generic'],
         riskLevels: ['medium', 'high'],
         specTypes: ['feature'],
     },
@@ -60,7 +61,7 @@ export const GATE_CATALOG = [
         id: 'sec-csrf',
         category: 'security',
         title: 'CSRF tokens required for state-changing operations in browser context',
-        stacks: ['typescript', 'generic'],
+        stacks: [technologyValue('technology-typescript-969545'), 'generic'],
         riskLevels: ['medium', 'high'],
         specTypes: ['feature'],
     },
@@ -68,7 +69,7 @@ export const GATE_CATALOG = [
         id: 'sec-dependency-check',
         category: 'security',
         title: 'No new dependencies with known critical vulnerabilities (npm audit / pip audit)',
-        stacks: ['typescript', 'python', 'generic'],
+        stacks: [technologyValue('technology-typescript-969545'), 'python', 'generic'],
         riskLevels: ['low', 'medium', 'high'],
         specTypes: ['all'],
     },
@@ -76,7 +77,7 @@ export const GATE_CATALOG = [
         id: 'sec-env-secrets',
         category: 'security',
         title: 'No secrets hardcoded — all credentials via environment variables',
-        stacks: ['typescript', 'python', 'java', 'go', 'generic'],
+        stacks: [technologyValue('technology-typescript-969545'), 'python', 'java', 'go', 'generic'],
         riskLevels: ['low', 'medium', 'high'],
         specTypes: ['all'],
     },
@@ -84,7 +85,7 @@ export const GATE_CATALOG = [
         id: 'sec-error-disclosure',
         category: 'security',
         title: 'Error responses do not expose internal stack traces or system details to clients',
-        stacks: ['typescript', 'python', 'java', 'go', 'generic'],
+        stacks: [technologyValue('technology-typescript-969545'), 'python', 'java', 'go', 'generic'],
         riskLevels: ['medium', 'high'],
         specTypes: ['all'],
     },
@@ -92,7 +93,7 @@ export const GATE_CATALOG = [
         id: 'sec-jwt-validation',
         category: 'security',
         title: 'JWT tokens validated for signature, expiry, and issuer on every protected route',
-        stacks: ['typescript', 'python', 'java', 'go', 'generic'],
+        stacks: [technologyValue('technology-typescript-969545'), 'python', 'java', 'go', 'generic'],
         riskLevels: ['high'],
         specTypes: ['feature', 'infra'],
     },
@@ -100,7 +101,7 @@ export const GATE_CATALOG = [
         id: 'sec-file-upload',
         category: 'security',
         title: 'File uploads: type validation, size limits, and virus scanning configured',
-        stacks: ['typescript', 'python', 'generic'],
+        stacks: [technologyValue('technology-typescript-969545'), 'python', 'generic'],
         riskLevels: ['high'],
         specTypes: ['feature'],
     },
@@ -108,7 +109,7 @@ export const GATE_CATALOG = [
         id: 'sec-path-traversal',
         category: 'security',
         title: 'File system paths sanitized — no user-controlled path traversal possible',
-        stacks: ['typescript', 'python', 'java', 'go', 'generic'],
+        stacks: [technologyValue('technology-typescript-969545'), 'python', 'java', 'go', 'generic'],
         riskLevels: ['medium', 'high'],
         specTypes: ['feature', 'infra'],
     },
@@ -116,7 +117,7 @@ export const GATE_CATALOG = [
         id: 'sec-https-only',
         category: 'security',
         title: 'All external API calls use HTTPS — no HTTP in production',
-        stacks: ['typescript', 'python', 'java', 'go', 'generic'],
+        stacks: [technologyValue('technology-typescript-969545'), 'python', 'java', 'go', 'generic'],
         riskLevels: ['medium', 'high'],
         specTypes: ['all'],
     },
@@ -125,7 +126,7 @@ export const GATE_CATALOG = [
         id: 'test-unit-coverage',
         category: 'testing',
         title: 'Unit tests cover ≥95% branch coverage for all new modules',
-        stacks: ['typescript', 'python', 'java', 'go', 'generic'],
+        stacks: [technologyValue('technology-typescript-969545'), 'python', 'java', 'go', 'generic'],
         riskLevels: ['low', 'medium', 'high'],
         specTypes: ['all'],
     },
@@ -133,7 +134,7 @@ export const GATE_CATALOG = [
         id: 'test-integration',
         category: 'testing',
         title: 'Integration test for each external dependency interaction (API, DB, cache)',
-        stacks: ['typescript', 'python', 'java', 'go', 'generic'],
+        stacks: [technologyValue('technology-typescript-969545'), 'python', 'java', 'go', 'generic'],
         riskLevels: ['medium', 'high'],
         specTypes: ['feature', 'infra'],
     },
@@ -141,7 +142,7 @@ export const GATE_CATALOG = [
         id: 'test-happy-path',
         category: 'testing',
         title: 'Happy path test for each acceptance criterion',
-        stacks: ['typescript', 'python', 'java', 'go', 'generic'],
+        stacks: [technologyValue('technology-typescript-969545'), 'python', 'java', 'go', 'generic'],
         riskLevels: ['low', 'medium', 'high'],
         specTypes: ['all'],
     },
@@ -149,7 +150,7 @@ export const GATE_CATALOG = [
         id: 'test-error-paths',
         category: 'testing',
         title: 'Error path tests: invalid input, network failure, not-found cases',
-        stacks: ['typescript', 'python', 'java', 'go', 'generic'],
+        stacks: [technologyValue('technology-typescript-969545'), 'python', 'java', 'go', 'generic'],
         riskLevels: ['medium', 'high'],
         specTypes: ['all'],
     },
@@ -157,7 +158,7 @@ export const GATE_CATALOG = [
         id: 'test-edge-cases',
         category: 'testing',
         title: 'Edge case tests: empty input, maximum values, concurrent operations',
-        stacks: ['typescript', 'python', 'java', 'go', 'generic'],
+        stacks: [technologyValue('technology-typescript-969545'), 'python', 'java', 'go', 'generic'],
         riskLevels: ['medium', 'high'],
         specTypes: ['feature'],
     },
@@ -165,7 +166,7 @@ export const GATE_CATALOG = [
         id: 'test-no-mocks-abuse',
         category: 'testing',
         title: 'Tests do not mock the unit under test — only external dependencies mocked',
-        stacks: ['typescript', 'python', 'java', 'go', 'generic'],
+        stacks: [technologyValue('technology-typescript-969545'), 'python', 'java', 'go', 'generic'],
         riskLevels: ['low', 'medium', 'high'],
         specTypes: ['all'],
     },
@@ -173,7 +174,7 @@ export const GATE_CATALOG = [
         id: 'test-deterministic',
         category: 'testing',
         title: 'All tests are deterministic — no random data, flaky network, or time-dependent state',
-        stacks: ['typescript', 'python', 'java', 'go', 'generic'],
+        stacks: [technologyValue('technology-typescript-969545'), 'python', 'java', 'go', 'generic'],
         riskLevels: ['low', 'medium', 'high'],
         specTypes: ['all'],
     },
@@ -181,7 +182,7 @@ export const GATE_CATALOG = [
         id: 'test-ci-passes',
         category: 'testing',
         title: 'All tests pass in CI environment without manual intervention',
-        stacks: ['typescript', 'python', 'java', 'go', 'generic'],
+        stacks: [technologyValue('technology-typescript-969545'), 'python', 'java', 'go', 'generic'],
         riskLevels: ['low', 'medium', 'high'],
         specTypes: ['all'],
     },
@@ -189,7 +190,7 @@ export const GATE_CATALOG = [
         id: 'test-performance-regression',
         category: 'testing',
         title: 'Performance regression test: response time within 10% of baseline',
-        stacks: ['typescript', 'python', 'java', 'go', 'generic'],
+        stacks: [technologyValue('technology-typescript-969545'), 'python', 'java', 'go', 'generic'],
         riskLevels: ['high'],
         specTypes: ['feature'],
     },
@@ -197,7 +198,7 @@ export const GATE_CATALOG = [
         id: 'test-snapshot',
         category: 'testing',
         title: 'Snapshot tests for all UI components and generated outputs',
-        stacks: ['typescript', 'generic'],
+        stacks: [technologyValue('technology-typescript-969545'), 'generic'],
         riskLevels: ['medium', 'high'],
         specTypes: ['feature'],
     },
@@ -206,7 +207,7 @@ export const GATE_CATALOG = [
         id: 'arch-layer-violation',
         category: 'architecture',
         title: 'No cross-layer imports: frontend does not import from backend modules directly',
-        stacks: ['typescript', 'python', 'java', 'go', 'generic'],
+        stacks: [technologyValue('technology-typescript-969545'), 'python', 'java', 'go', 'generic'],
         riskLevels: ['low', 'medium', 'high'],
         specTypes: ['all'],
     },
@@ -214,7 +215,7 @@ export const GATE_CATALOG = [
         id: 'arch-ai-spec-assurance',
         category: 'architecture',
         title: 'AI-generated specs are checked against original user intent before implementation',
-        stacks: ['typescript', 'generic'],
+        stacks: [technologyValue('technology-typescript-969545'), 'generic'],
         riskLevels: ['low', 'medium', 'high'],
         specTypes: ['feature', 'bugfix', 'infra', 'all'],
     },
@@ -222,7 +223,7 @@ export const GATE_CATALOG = [
         id: 'arch-new-code-domain-inference',
         category: 'architecture',
         title: 'New code does not infer product-domain requirements from incidental paths or stack presence',
-        stacks: ['typescript', 'generic'],
+        stacks: [technologyValue('technology-typescript-969545'), 'generic'],
         riskLevels: ['low', 'medium', 'high'],
         specTypes: ['feature', 'bugfix', 'infra', 'all'],
     },
@@ -230,7 +231,7 @@ export const GATE_CATALOG = [
         id: 'arch-mcp-startup-assurance',
         category: 'architecture',
         title: 'MCP startup verifies official tools in first tools/list and excludes bootstrap-only tools',
-        stacks: ['typescript', 'generic'],
+        stacks: [technologyValue('technology-typescript-969545'), 'generic'],
         riskLevels: ['low', 'medium', 'high'],
         specTypes: ['feature', 'bugfix', 'infra', 'all'],
     },
@@ -238,7 +239,7 @@ export const GATE_CATALOG = [
         id: 'arch-single-responsibility',
         category: 'architecture',
         title: 'Each module/class has single responsibility — max 1 reason to change',
-        stacks: ['typescript', 'python', 'java', 'go', 'generic'],
+        stacks: [technologyValue('technology-typescript-969545'), 'python', 'java', 'go', 'generic'],
         riskLevels: ['medium', 'high'],
         specTypes: ['all'],
     },
@@ -246,7 +247,7 @@ export const GATE_CATALOG = [
         id: 'arch-no-god-object',
         category: 'architecture',
         title: 'No god objects — functions max 80 lines, files max 400 lines',
-        stacks: ['typescript', 'python', 'java', 'go', 'generic'],
+        stacks: [technologyValue('technology-typescript-969545'), 'python', 'java', 'go', 'generic'],
         riskLevels: ['medium', 'high'],
         specTypes: ['all'],
     },
@@ -254,7 +255,7 @@ export const GATE_CATALOG = [
         id: 'arch-dependency-injection',
         category: 'architecture',
         title: 'External dependencies injected (not imported directly) for testability',
-        stacks: ['typescript', 'python', 'java', 'generic'],
+        stacks: [technologyValue('technology-typescript-969545'), 'python', 'java', 'generic'],
         riskLevels: ['medium', 'high'],
         specTypes: ['feature'],
     },
@@ -262,7 +263,7 @@ export const GATE_CATALOG = [
         id: 'arch-no-circular',
         category: 'architecture',
         title: 'No circular module dependencies — verified with madge or similar',
-        stacks: ['typescript', 'python', 'java', 'go', 'generic'],
+        stacks: [technologyValue('technology-typescript-969545'), 'python', 'java', 'go', 'generic'],
         riskLevels: ['low', 'medium', 'high'],
         specTypes: ['all'],
     },
@@ -270,7 +271,7 @@ export const GATE_CATALOG = [
         id: 'arch-api-contract',
         category: 'architecture',
         title: 'API contracts (request/response) defined with typed schemas before implementation',
-        stacks: ['typescript', 'python', 'java', 'go', 'generic'],
+        stacks: [technologyValue('technology-typescript-969545'), 'python', 'java', 'go', 'generic'],
         riskLevels: ['medium', 'high'],
         specTypes: ['feature'],
     },
@@ -278,7 +279,7 @@ export const GATE_CATALOG = [
         id: 'arch-error-boundaries',
         category: 'architecture',
         title: 'Error boundaries defined at module edges — errors do not propagate silently',
-        stacks: ['typescript', 'python', 'java', 'go', 'generic'],
+        stacks: [technologyValue('technology-typescript-969545'), 'python', 'java', 'go', 'generic'],
         riskLevels: ['medium', 'high'],
         specTypes: ['all'],
     },
@@ -286,7 +287,7 @@ export const GATE_CATALOG = [
         id: 'arch-backward-compat',
         category: 'architecture',
         title: 'No breaking changes to existing public APIs without major version bump',
-        stacks: ['typescript', 'python', 'java', 'go', 'generic'],
+        stacks: [technologyValue('technology-typescript-969545'), 'python', 'java', 'go', 'generic'],
         riskLevels: ['medium', 'high'],
         specTypes: ['refactor'],
     },
@@ -294,7 +295,7 @@ export const GATE_CATALOG = [
         id: 'arch-logging',
         category: 'architecture',
         title: 'Structured logging with request ID / correlation ID for all operations',
-        stacks: ['typescript', 'python', 'java', 'go', 'generic'],
+        stacks: [technologyValue('technology-typescript-969545'), 'python', 'java', 'go', 'generic'],
         riskLevels: ['medium', 'high'],
         specTypes: ['feature', 'infra'],
     },
@@ -302,7 +303,7 @@ export const GATE_CATALOG = [
         id: 'arch-config-externalized',
         category: 'architecture',
         title: 'All configuration externalized — no magic strings/numbers in business logic',
-        stacks: ['typescript', 'python', 'java', 'go', 'generic'],
+        stacks: [technologyValue('technology-typescript-969545'), 'python', 'java', 'go', 'generic'],
         riskLevels: ['medium', 'high'],
         specTypes: ['all'],
     },
@@ -311,7 +312,7 @@ export const GATE_CATALOG = [
         id: 'perf-lcp',
         category: 'performance',
         title: 'LCP (Largest Contentful Paint) ≤2.5s on 4G mobile connection',
-        stacks: ['typescript', 'generic'],
+        stacks: [technologyValue('technology-typescript-969545'), 'generic'],
         riskLevels: ['medium', 'high'],
         specTypes: ['feature'],
     },
@@ -319,7 +320,7 @@ export const GATE_CATALOG = [
         id: 'perf-no-n-plus-1',
         category: 'performance',
         title: 'No N+1 query patterns — use batching, DataLoader, or eager loading',
-        stacks: ['typescript', 'python', 'java', 'go', 'generic'],
+        stacks: [technologyValue('technology-typescript-969545'), 'python', 'java', 'go', 'generic'],
         riskLevels: ['medium', 'high'],
         specTypes: ['feature'],
     },
@@ -327,7 +328,7 @@ export const GATE_CATALOG = [
         id: 'perf-bundle-size',
         category: 'performance',
         title: 'JavaScript bundle size increase <50KB gzipped per feature',
-        stacks: ['typescript', 'generic'],
+        stacks: [technologyValue('technology-typescript-969545'), 'generic'],
         riskLevels: ['medium', 'high'],
         specTypes: ['feature'],
     },
@@ -335,7 +336,7 @@ export const GATE_CATALOG = [
         id: 'perf-db-indexes',
         category: 'performance',
         title: 'Database queries on new tables use appropriate indexes',
-        stacks: ['typescript', 'python', 'java', 'go', 'generic'],
+        stacks: [technologyValue('technology-typescript-969545'), 'python', 'java', 'go', 'generic'],
         riskLevels: ['medium', 'high'],
         specTypes: ['feature', 'infra'],
     },
@@ -343,7 +344,7 @@ export const GATE_CATALOG = [
         id: 'perf-caching',
         category: 'performance',
         title: 'Expensive computations (>100ms) cached with appropriate TTL',
-        stacks: ['typescript', 'python', 'java', 'go', 'generic'],
+        stacks: [technologyValue('technology-typescript-969545'), 'python', 'java', 'go', 'generic'],
         riskLevels: ['high'],
         specTypes: ['feature'],
     },
@@ -351,7 +352,7 @@ export const GATE_CATALOG = [
         id: 'perf-async',
         category: 'performance',
         title: 'No synchronous blocking I/O in hot paths — all disk/network operations async',
-        stacks: ['typescript', 'python', 'java', 'go', 'generic'],
+        stacks: [technologyValue('technology-typescript-969545'), 'python', 'java', 'go', 'generic'],
         riskLevels: ['medium', 'high'],
         specTypes: ['feature', 'infra'],
     },
@@ -359,7 +360,7 @@ export const GATE_CATALOG = [
         id: 'perf-pagination',
         category: 'performance',
         title: 'All list endpoints paginated — no unbounded queries returning full table',
-        stacks: ['typescript', 'python', 'java', 'go', 'generic'],
+        stacks: [technologyValue('technology-typescript-969545'), 'python', 'java', 'go', 'generic'],
         riskLevels: ['medium', 'high'],
         specTypes: ['feature'],
     },
@@ -367,7 +368,7 @@ export const GATE_CATALOG = [
         id: 'perf-timeout',
         category: 'performance',
         title: 'Timeout configured for all external API calls — no indefinite waits',
-        stacks: ['typescript', 'python', 'java', 'go', 'generic'],
+        stacks: [technologyValue('technology-typescript-969545'), 'python', 'java', 'go', 'generic'],
         riskLevels: ['medium', 'high'],
         specTypes: ['feature', 'infra'],
     },

package/dist/engine/quality-gates/gate-injector.js

@@ -1,3 +1,4 @@
+import { technologyValue } from '../technology-registry.js';
 import { GATE_CATALOG } from './gate-catalog.js';
 export function selectGates(ctx) {
     return GATE_CATALOG.filter((g) => (g.specTypes.includes(ctx.specType) || g.specTypes.includes('all')) &&
@@ -28,20 +29,24 @@ export function formatGatesSection(gates) {
 export function inferStack(language, framework) {
     const lang = (language ?? '').toLowerCase();
     const fw = (framework ?? '').toLowerCase();
-    if (lang.includes('python') || fw.includes('fastapi') || fw.includes('django')) {
+    if (lang.includes('python') ||
+        fw.includes(technologyValue('technology-fastapi-6aee0e')) ||
+        fw.includes(technologyValue('technology-django-7d8a08'))) {
         return 'python';
     }
     // Check typescript/javascript BEFORE java to avoid 'javascript'.includes('java') matching
-    if (lang.includes('typescript') ||
+    if (lang.includes(technologyValue('technology-typescript-969545')) ||
         lang.includes('javascript') ||
         fw.includes('node') ||
         fw.includes('next')) {
-        return 'typescript';
+        return technologyValue('technology-typescript-969545');
     }
     if (lang === 'java' || fw.includes('spring')) {
         return 'java';
     }
-    if (lang.includes('go') || fw.includes('gin') || fw.includes('fiber')) {
+    if (lang.includes('go') ||
+        fw.includes(technologyValue('technology-gin-985adc')) ||
+        fw.includes(technologyValue('technology-fiber-77c3e6'))) {
         return 'go';
     }
     return 'generic';

package/dist/engine/registry/core.js

@@ -1,5 +1,3 @@
-// SPEC-597-EXEMPT: canonical mapping (npm-package↔framework, keyword catalogue)
-// — must enumerate framework names by design; no detection logic to migrate.
 // engine/registry/core.ts — Orchestrator for spec accuracy validation and doc enrichment
 // Composes loader → matcher → validator → reporter into two public functions.
 import { loadRegistry } from './loader.js';

package/dist/engine/registry/loader.js

@@ -2,12 +2,13 @@
 // engine/registry/loader.ts — Loads and merges framework registry entries
 // Base entries come from src/config/framework-registry/*.json
 // Custom entries come from data/global/registry-custom.json (user-added)
-import { readFile, readdir } from 'node:fs/promises';
+import { readFile } from 'node:fs/promises';
 import { join, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { readJson } from '../../storage/base-store.js';
+import { resolvedStorageArtifactPath } from '../../storage/storage-catalog.js';
+import { loadTechnologyRegistry } from '../technology-registry.js';
 const REGISTRY_DIR = join(dirname(fileURLToPath(import.meta.url)), '../../config/framework-registry');
-const CUSTOM_REGISTRY_PATH = 'data/global/registry-custom.json';
 /**
  * Load a single framework JSON file from the base registry directory.
  * Returns null if the file is missing or malformed.
@@ -43,23 +44,19 @@ async function loadFrameworkFile(fileName) {
  * Skips index.json and any file that fails to parse.
  */
 export async function loadBaseRegistry() {
-    let files;
-    try {
-        files = await readdir(REGISTRY_DIR);
-    }
-    catch {
-        return [];
+    const files = loadTechnologyRegistry().frameworks.map((entry) => entry.file);
+    const results = await Promise.all(files.map(loadFrameworkFile));
+    if (results.some((entry) => entry === null)) {
+        throw new Error('TECHNOLOGY_REGISTRY_INVALID: a registered framework file is unavailable');
     }
-    const jsonFiles = files.filter((f) => f.endsWith('.json') && f !== 'index.json');
-    const results = await Promise.all(jsonFiles.map(loadFrameworkFile));
-    return results.filter((e) => e !== null);
+    return results;
 }
 /**
  * Load user-defined custom registry entries from data/global/registry-custom.json.
  * Returns an empty array when the file does not exist.
  */
 export async function loadCustomRegistry() {
-    const store = await readJson(CUSTOM_REGISTRY_PATH, { entries: [] });
+    const store = await readJson(resolvedStorageArtifactPath('custom-framework-registry'), { entries: [] });
     return store.entries.map((e) => ({ ...e, customEntry: true }));
 }
 /**