@polymorphism-tech/morph-spec 8.46.0 → 9.0.0

package/framework/templates/REGISTRY.json

@@ -29,84 +29,18 @@
   ],
   "templates": [
     {
-      "id": "proposal",
+      "id": "plan",
       "kind": "template",
-      "name": "Feature Proposal",
-      "path": "docs/proposal.md",
-      "location": "framework",
-      "category": "documentation",
-      "phase": "proposal",
-      "required": true,
-      "description": "Feature proposal with overview, problem statement, solution approach, and cost estimates",
-      "outputName": "proposal.md",
-      "placeholders": [
-        "AUTHOR",
-        "DATE",
-        "STACK"
-      ],
-      "stackSpecific": false,
-      "engine": "handlebars",
-      "deprecated": false,
-      "technology": "handlebars",
-      "validatePlaceholders": true
-    },
-    {
-      "id": "spec",
-      "kind": "template",
-      "name": "Technical Specification",
-      "path": "docs/spec.md",
-      "location": "framework",
-      "category": "documentation",
-      "phase": "plan",
-      "required": true,
-      "description": "Detailed technical spec with architecture, data model, API contracts",
-      "outputName": "spec.md",
-      "placeholders": [
-        "DATE",
-        "FEATURE_NAME",
-        "STACK"
-      ],
-      "stackSpecific": false,
-      "engine": "handlebars",
-      "deprecated": false,
-      "technology": "handlebars",
-      "validatePlaceholders": true
-    },
-    {
-      "id": "decisions",
-      "kind": "template",
-      "name": "Architecture Decision Records",
-      "path": "feature/decisions.md",
+      "name": "Feature Plan",
+      "path": "docs/plan.md",
       "location": "framework",
       "category": "documentation",
       "phase": "plan",
       "required": true,
-      "description": "ADR format for documenting architectural decisions with context, alternatives, consequences",
-      "outputName": "decisions.md",
+      "description": "Single source of a feature: problem, scenarios (Cn with proof), decisions (ADRs), reuse, slices (Fn) and errata — parsed by morph-spec plan-check into checks.json",
+      "outputName": "plan.md",
       "placeholders": [
-        "DATE"
-      ],
-      "stackSpecific": false,
-      "engine": "handlebars",
-      "deprecated": false,
-      "technology": "handlebars",
-      "validatePlaceholders": true
-    },
-    {
-      "id": "recap",
-      "kind": "template",
-      "name": "Feature Recap",
-      "path": "feature/recap.md",
-      "location": "framework",
-      "category": "documentation",
-      "phase": "implement",
-      "required": true,
-      "description": "Post-implementation summary with deliverables, metrics, lessons learned",
-      "outputName": "recap.md",
-      "placeholders": [
-        "DATE",
-        "FEATURE_NAME",
-        "STACK"
+        "FEATURE_NAME"
       ],
       "stackSpecific": false,
       "engine": "handlebars",
@@ -132,24 +66,6 @@
       "technology": "handlebars",
       "validatePlaceholders": true
     },
-    {
-      "id": "spec-examples",
-      "kind": "template",
-      "name": "Spec Examples",
-      "path": "examples/spec-examples.md",
-      "location": "framework",
-      "category": "examples",
-      "phase": null,
-      "required": false,
-      "description": "Example technical specs for reference",
-      "outputName": null,
-      "placeholders": [],
-      "stackSpecific": false,
-      "engine": null,
-      "deprecated": false,
-      "technology": null,
-      "validatePlaceholders": true
-    },
     {
       "id": "design-system-examples",
       "kind": "template",
@@ -614,71 +530,6 @@
       "technology": "handlebars",
       "validatePlaceholders": true
     },
-    {
-      "id": "ui-flows",
-      "kind": "template",
-      "name": "UI Flows",
-      "path": "docs/ui-flows.md",
-      "location": "framework",
-      "category": "documentation",
-      "phase": "uiux",
-      "required": false,
-      "description": "User flows and interaction patterns with state diagrams and edge cases",
-      "outputName": "flows.md",
-      "placeholders": [
-        "DATE",
-        "FEATURE_NAME"
-      ],
-      "stackSpecific": false,
-      "engine": "handlebars",
-      "deprecated": false,
-      "technology": "handlebars",
-      "validatePlaceholders": true
-    },
-    {
-      "id": "ui-components",
-      "kind": "template",
-      "name": "UI Components",
-      "path": "docs/ui-components.md",
-      "location": "framework",
-      "category": "documentation",
-      "phase": "uiux",
-      "required": false,
-      "description": "Component specifications mapping UI elements to shadcn/ui components with props and events",
-      "outputName": "components.md",
-      "placeholders": [
-        "DATE",
-        "FEATURE_NAME",
-        "STACK"
-      ],
-      "stackSpecific": false,
-      "engine": "handlebars",
-      "deprecated": false,
-      "technology": "handlebars",
-      "validatePlaceholders": true
-    },
-    {
-      "id": "ui-design-system",
-      "kind": "template",
-      "name": "UI Design System",
-      "path": "docs/ui-design-system.md",
-      "location": "framework",
-      "category": "documentation",
-      "phase": "uiux",
-      "required": false,
-      "description": "Design system documentation with color palette, typography, spacing, and semantic tokens",
-      "outputName": "design-system.md",
-      "placeholders": [
-        "DATE",
-        "FEATURE_NAME",
-        "PROJECT_NAME"
-      ],
-      "stackSpecific": false,
-      "engine": "handlebars",
-      "deprecated": false,
-      "technology": "handlebars",
-      "validatePlaceholders": true
-    },
     {
       "id": "github-workflow-dotnet-build",
       "kind": "template",
@@ -1460,21 +1311,6 @@
         "TIMESTAMP"
       ],
       "validatePlaceholders": true
-    },
-    {
-      "id": "tasks-template",
-      "kind": "template",
-      "consumption": "reference",
-      "name": "tasks.json",
-      "path": "tasks.template.json",
-      "category": "context",
-      "phase": null,
-      "outputName": null,
-      "description": "Initial tasks.json scaffold",
-      "engine": "handlebars",
-      "deprecated": false,
-      "placeholders": [],
-      "validatePlaceholders": true
     }
   ]
 }

package/framework/templates/code/dotnet/contracts/contracts-vsa.cs

@@ -183,10 +183,10 @@ internal sealed class Create{{pascalCase FEATURE_NAME}}Endpoint : IApiEndpoint
             var result = await handler.HandleAsync(command, cancellationToken);
             return result.Match(
                 onSuccess: () => Results.Ok(result.Value),
-                onFailure: error => Results.BadRequest(error));
+                onFailure: error => error.ToHttpResult());
         })
         .WithTags("{{pascalCase FEATURE_NAME}}s")
         .Produces<Create{{pascalCase FEATURE_NAME}}Response>(StatusCodes.Status200OK)
-        .Produces(StatusCodes.Status400BadRequest);
+        .ProducesProblem(StatusCodes.Status400BadRequest);
     }
 }

package/framework/templates/code/dotnet/extensions/database-extensions.cs

@@ -11,7 +11,7 @@ namespace {{pascalCase PROJECT_NAME}}.Extensions
 
             services.AddDbContext<ApplicationDbContext>(options =>
             {
-                options.UseNpgsql(configuration.GetConnectionString("connection"));
+                options.UseNpgsql(configuration.GetConnectionString("DefaultConnection"));
             });
 
             return services;

package/framework/templates/code/dotnet/extensions/result-extensions.cs

@@ -25,3 +25,30 @@ public static class ResultExtensions
             : onFailure(result.Error);
     }
 }
+
+public static class ErrorHttpMapping
+{
+    public static int StatusCodeFor(ErrorType type) => type switch
+    {
+        ErrorType.Validation => StatusCodes.Status400BadRequest,
+        ErrorType.NotFound => StatusCodes.Status404NotFound,
+        ErrorType.Conflict => StatusCodes.Status409Conflict,
+        ErrorType.Unauthorized => StatusCodes.Status401Unauthorized,
+        ErrorType.Forbidden => StatusCodes.Status403Forbidden,
+        ErrorType.Unexpected => StatusCodes.Status500InternalServerError,
+        _ => StatusCodes.Status400BadRequest
+    };
+
+    public static IResult ToHttpResult(this Error error)
+    {
+        Dictionary<string, object?>? extensions = error is ValidationError validation
+            ? new() { ["errors"] = validation.Errors.Select(e => new { e.Code, e.Description }).ToArray() }
+            : null;
+
+        return Results.Problem(
+            title: error.Code,
+            detail: error.Description,
+            statusCode: StatusCodeFor(error.Type),
+            extensions: extensions);
+    }
+}

package/framework/templates/code/dotnet/feature/endpoint.cs.hbs

@@ -12,10 +12,10 @@ internal sealed class {{pascalCase SLICE_NAME}}Endpoint : IApiEndpoint
             var result = await handler.HandleAsync(command, cancellationToken);
             return result.Match(
               onSuccess: () => Results.Ok(result.Value),
-              onFailure: error => Results.BadRequest(error));
+              onFailure: error => error.ToHttpResult());
         })
         .WithTags(ApiTags.{{pascalCase FEATURE_NAME}}s)
         .Produces<{{pascalCase SLICE_NAME}}Response>(StatusCodes.Status200OK)
-        .Produces(StatusCodes.Status400BadRequest);
+        .ProducesProblem(StatusCodes.Status400BadRequest);
     }
 }

package/framework/templates/docs/plan.md

@@ -0,0 +1,72 @@
+# Plano — {{FEATURE_NAME}}
+
+<!-- Fonte única da feature. `morph-spec plan-check {{FEATURE_NAME}}` lê este arquivo e grava 2-plan/checks.json.
+     Depois do gate plan, o corpo congela: fato errado sobre o código vai em ## Errata (append-only). -->
+
+## Problema
+
+<O que dói hoje, para quem, e como se percebe. Duas a cinco frases.>
+
+## Fora de escopo
+
+- <o que esta feature deliberadamente não faz>
+
+## Suposições não confirmadas
+
+- <o que foi assumido sem prova; "nenhuma" vale>
+
+## Cenários
+
+<!-- Um cenário por comportamento observável. `prova:` é teste | e2e | eval | manual.
+     Cenário que fala de arquivo, grep ou texto exige a linha "> Por que artefato:" logo abaixo. -->
+
+- **C1** — Dado <estado>, quando <ação>, então <resultado observável>.
+  prova: teste
+
+## Decisões
+
+### ADR-001 — <título>
+**Alcance:** feature
+
+<Contexto, decisão e consequência. `projeto` quando a decisão vale além desta feature.>
+
+### Conflitos com o acervo
+
+<!-- ADR do índice (.morph/specs/adrs/) que este plano contradiz: "nenhum", ou a tabela abaixo fora do bloco.
+     O finish aplica cada linha: total retira o ADR do índice; parcial o mantém com o escopo onde ainda vale.
+```
+| ADR | Mudança | Escopo em que o antigo ainda vale |
+|---|---|---|
+| {feature}/ADR-{nnn} | parcial | <onde o antigo ainda vale> |
+| {feature}/ADR-{nnn} | total | — |
+```
+-->
+
+nenhum
+
+## Arquitetura
+
+<Onde o código entra, o que conversa com o quê. Diagrama só se ajudar.>
+
+## Reuso
+
+| conceito | veredito | alvo | why |
+|---|---|---|---|
+| <conceito> | REUSAR | <arquivo ou símbolo existente> | |
+
+## Fatias
+
+<!-- Uma fatia = uma unidade de entrega (com ou sem dispatch), relatório em 3-implement/reports/Fn.md.
+     arquivos ≤ 8; superfície e depende são opcionais; toda Cn é coberta por alguma fatia. -->
+
+### F1 — <título>
+- persona: dotnet-senior
+- standards: <id>
+- arquivos: <caminho/a.cs>, <caminho/b.cs>
+- cobre: C1
+
+## Contrato de implementação
+
+<Assinaturas, records, enums e rotas que as fatias precisam honrar.>
+
+## Errata

package/framework/templates/dotnet/ai-kit/README.md

@@ -58,15 +58,7 @@ dotnet test  --solution Morph.AiKit.sln -c Release --no-build
 > do `morph-spec verify`); por isso nenhum chamador repassa a flag. Ao adicionar
 > testes, suba o piso — `test/framework/ai-kit-ci-packaging.test.js` reprova um
 > piso que ficou para trás da contagem de `[Fact]`/`[Theory]`.
-> **Consequência para o recorte por task:** `--minimum-expected-tests 1` na
-> linha de comando não sobrescreve o valor do projeto (medido: o recorte verde
-> sai 9 do mesmo jeito), mas a propriedade global do MSBuild sim. Por isso
-> `morph-spec verify {f} {task}` estreita este projeto repassando
-> `"-p:TestingPlatformCommandLineArguments=…"` com o valor do `.csproj` e o piso
-> em 1 — verde sai 0, zero testes segue saindo 8, nada recompila (issue #114).
-> Mantenha o piso **nesse** elemento, literal (sem `Condition`, sem `$(…)`, sem
-> outra declaração da propriedade em `Directory.Build.*`): em qualquer outra
-> forma o recorte volta a rodar o nó inteiro.
+
 
 > **`dotnet test` precisa rodar COM O CWD DENTRO deste diretório.** O opt-in do
 > Microsoft.Testing.Platform (que `xunit.v3` 4.x usa) vive em `global.json`, e o

package/framework/templates/dotnet/ai-kit/tests/Morph.AiKit.Tests/MediaDisclosureTests.cs

@@ -49,7 +49,7 @@ public sealed class MediaDisclosureTests
         Assert.False(
             result.IsSuccess,
             "publicar sem marcacao e o caminho que a obrigacao legal existe para fechar; " +
-            "se ele existe, a afirmacao da rubrica media-claims esta presa so por prosa");
+            "se ele existe, a prova de midia do Gate 3 esta presa so por prosa");
         Assert.Equal(MediaErrorCode.InvalidTransition, result.Error!.Code);
         Assert.Contains("marcacao", result.Error.Message, StringComparison.OrdinalIgnoreCase);
     }

package/framework/templates/dotnet/ai-kit/tests/Morph.AiKit.Tests/Morph.AiKit.Tests.csproj

@@ -30,16 +30,6 @@
       de workflow. Uma unica verdade: nenhum chamador repassa a flag na linha de
       comando, porque repassa-la duplicaria a opcao.
 
-      Consequencia para o recorte por task (`morph-spec verify {f} {task}`): a
-      mesma opcao com valor 1 na linha de comando NAO sobrescreve o valor do
-      projeto (medido: o recorte verde sai 9 do mesmo jeito), mas a propriedade
-      global do MSBuild sim. O recorte estreita este projeto repassando
-      "-p:TestingPlatformCommandLineArguments=" com ESTE valor e o piso em 1
-      (issue #114: verde sai 0, zero testes segue saindo 8, nada recompila). Por
-      isso o piso fica NESTE elemento, literal: sem Condition, sem $(...), sem
-      outra declaracao da propriedade em Directory.Build.* — em qualquer outra
-      forma o recorte volta a rodar o no inteiro.
-
       O numero e o total de CASOS EXECUTADOS (275), nao de atributos nem de casos
       DESCOBERTOS (276): os [Theory] expandem, e um caso IGNORADO nao conta para o piso — a
       suite descobre 276 e executa 275, porque o semeador da cache exemplar de eval

package/framework/templates/infrastructure/docker/coolify.template.json

@@ -3,10 +3,10 @@
   "provider": "coolify",
   "access": {
     "method": "ssh",
-    "note": "No MCP/CLI exists for Coolify — replace sshHost with the real SSH alias for the target VPS. The API is reached only from inside the VPS, at apiBaseUrl.",
+    "note": "We use no Coolify MCP/CLI — replace sshHost with the real SSH alias for the target VPS and tokenPath with the chmod-600 token file in that user's home. The API is reached only from inside the VPS, at apiBaseUrl; the deploy trigger is POST /deploy?uuid= (GET is refused by Coolify 4.3.23).",
     "sshHost": "REPLACE_WITH_VPS_SSH_ALIAS",
     "apiBaseUrl": "http://localhost:8000/api/v1",
-    "tokenPath": "~/.coolify-token"
+    "tokenPath": "~/REPLACE_WITH_TOKEN_FILE"
   },
   "application": {
     "uuid": "REPLACE_WITH_COOLIFY_APPLICATION_UUID",
@@ -45,5 +45,5 @@
       "https": true
     }
   ],
-  "deployCommand": "ssh REPLACE_WITH_VPS_SSH_ALIAS 'T=$(cat ~/.coolify-token); curl -s -X GET -H \"Authorization: Bearer $T\" \"http://localhost:8000/api/v1/deploy?uuid=REPLACE_WITH_COOLIFY_APPLICATION_UUID\"'"
+  "deployCommand": "ssh REPLACE_WITH_VPS_SSH_ALIAS 'T=$(cat ~/REPLACE_WITH_TOKEN_FILE); curl -s -X POST -H \"Authorization: Bearer $T\" \"http://localhost:8000/api/v1/deploy?uuid=REPLACE_WITH_COOLIFY_APPLICATION_UUID\"'"
 }

package/framework/templates/infrastructure/github/README.md

@@ -39,7 +39,8 @@ infrastructure/github/
 - Push to container registry (GHCR or Docker Hub)
 
 ### Deploy Coolify (`deploy-coolify.yml.hbs`)
-- SSHes into the VPS and calls the local Coolify API (`localhost:8000/api/v1/deploy?uuid=...`) after Docker push
+- SSHes into the VPS and calls the local Coolify API (`POST localhost:8000/api/v1/deploy?uuid=...`) after Docker push; the step fails unless the response carries a `deployment_uuid`
+- The token is read on the VPS from `~/<token-file>` (secret `COOLIFY_TOKEN_FILE` holds the file name) and never leaves the SSH session
 - Runs health check after deployment
 - Supports staging + production environments
 

package/framework/templates/infrastructure/github/workflows/deploy-coolify.yml.hbs

@@ -25,7 +25,8 @@ jobs:
       - name: Trigger Coolify Deploy (via SSH — the Coolify API is not publicly exposed)
         run: |
           ssh -i ~/.ssh/id_ed25519 ${{{{ secrets.COOLIFY_SSH_USER }}}}@${{{{ secrets.COOLIFY_SSH_HOST }}}} \
-            'T=$(cat ~/.coolify-token); curl -s -X GET -H "Authorization: Bearer $T" "http://localhost:8000/api/v1/deploy?uuid=${{{{ secrets.COOLIFY_APPLICATION_UUID }}}}"'
+            'T=$(cat ~/${{{{ secrets.COOLIFY_TOKEN_FILE }}}}); curl -s --fail-with-body -X POST -H "Authorization: Bearer $T" "http://localhost:8000/api/v1/deploy?uuid=${{{{ secrets.COOLIFY_APPLICATION_UUID }}}}"' \
+            | grep -q deployment_uuid
 
       - name: Health Check
         run: |

package/framework/templates/meta-prompts/squad-leaders/backend-squad.md

@@ -78,7 +78,7 @@ Backend deliverables typically include:
 2. Create migrations before writing service logic
 3. Implement services with proper unit-testable interfaces
 4. Wire up API endpoints last (depends on services)
-5. After every 3 tasks, persist completed tasks to `tasks.json` (`status`/`outputs`/`notes` only) and run the checkpoint
+5. After every 3 slices, write each finished slice's report (`3-implement/reports/F{n}.md`) and run the checkpoint
 6. If blocked (compilation error, migration conflict), document and continue with next unblocked task
 
 ## Report Back When Done

package/framework/templates/meta-prompts/squad-leaders/frontend-squad.md

@@ -72,7 +72,7 @@ Frontend deliverables typically include:
 2. Build reusable sub-components before composing pages
 3. Wire up API calls/services last (after UI is structured)
 4. Test each component with loading + error + empty states
-5. After every 3 tasks, persist completed tasks to `tasks.json` (`status`/`outputs`/`notes` only) and run the checkpoint
+5. After every 3 slices, write each finished slice's report (`3-implement/reports/F{n}.md`) and run the checkpoint
 
 ## Report Back When Done
 Provide a summary of:

package/framework/templates/meta-prompts/squad-leaders/squad-leader.md

@@ -32,7 +32,7 @@ You are a **Squad Leader** in the MORPH-SPEC agent hierarchy.
 ## How to Work
 1. Read your standards carefully before starting
 2. Implement each task in order (respecting dependencies)
-3. After every 3 tasks, persist completed tasks to `tasks.json` (`status`/`outputs`/`notes` only) and run the checkpoint
+3. After every 3 slices, write each finished slice's report (`3-implement/reports/F{n}.md`) and run the checkpoint
 4. If blocked, document the blocker and continue with the next unblocked task
 5. Report completion with: files created, any blockers, checkpoint results
 

package/framework/templates/meta-prompts/validators/pre-commit-validator.md

@@ -46,11 +46,10 @@ If `.morph/framework/agents.json` is in staged files:
 - No duplicate agentIds
 - Valid tier values (1-4)
 
-### 4. Spec Format Validation (if spec.md staged)
-If any `spec.md` is staged:
-- Has required sections: Overview, Requirements, Technical Design, Data Model, API Contracts
+### 4. Plan Format Validation (if plan.md staged)
+If any `.morph/features/*/2-plan/plan.md` is staged:
+- `morph-spec plan-check <feature>` exits 0 (sections, scenarios with `prova:`, slices that cover them)
 - No placeholder text (`{{TODO}}`, `TBD`, `[PLACEHOLDER]`)
-- Word count > 200 (meaningful spec)
 
 ### 5. Stack-Specific Validation
 {{#if IS_CSHARP}}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@polymorphism-tech/morph-spec",
-  "version": "8.46.0",
+  "version": "9.0.0",
   "description": "MORPH-SPEC: NLH (Natural Language Harness) for spec-driven development with Claude Code",
   "keywords": [
     "claude-code",

package/src/commands/e2e/e2e.js

@@ -232,7 +232,7 @@ export async function e2eUpCommand(featureName, options = {}) {
 /**
  * Where the app actually landed.
  *
- * The reviewer hands this to the evaluator instead of letting it guess
+ * The orchestrator hands this to the verifier instead of letting it guess
  * `localhost:3000` — each feature owns a port block, so the default port is the
  * one address most likely to be wrong. Mirrors what `playwright.config.ts` is
  * asked to do, deliberately: one rule, two readers.
@@ -331,7 +331,7 @@ export async function e2eDownCommand(featureName, options = {}) {
     volumes: Boolean(options.volumes),
   });
   const stampDeleted = deleteStamp(ctx.gitCommonDir, ctx.projectName);
-  const cleanup = afterHeavyRun({ projectPath: ctx.cwd, config: readHeavyConfig(ctx.cwd), scope: 'e2e-down' });
+  const cleanup = afterHeavyRun({ projectPath: ctx.cwd, config: readHeavyConfig(ctx.cwd) });
 
   if (options.json) {
     console.log(JSON.stringify(