@schneiderjoseph/devia 0.3.0 → 0.5.0

package/CHANGELOG.md

@@ -1,5 +1,70 @@
 # Changelog
 
+## 0.5.0 — 2026-09-09
+
+The standard is unchanged: `VERSION` stays at 0.1.0.
+
+### Pinning the standard is now opt-in
+
+`devia init` used to copy the whole standard into `.devia/standard/`. Measured on a real
+repository: **391 pinned files against 17 of memory** — a folder whose purpose is to be read by
+a human and an agent, in which 96% of the files were a copy nobody wrote. On a 211-file project
+it tripled the repository, and every `devia sync` produced a 391-file diff in which a real
+memory change was invisible.
+
+- `devia init` writes the memory and the adapters, and pins nothing: **17 files, 57 kB**
+- `devia init --vendor` pins the copy for those who want it up front
+- `devia sync` pins it on demand and refreshes it afterwards — that is now its first job, not
+  only its maintenance one
+- `doctor` reports an unpinned standard as `INFO`, not a `WARN` to clear: the default is not a
+  defect
+- The memory templates, the agent adapters and the skill read the rules with
+  `npx devia rules --id <ID>` / `--domain <name>` instead of linking into a copy that may not
+  exist. A pinned copy is mentioned as what it is: optional
+
+Nothing to do when upgrading. An existing `.devia/standard/` is left alone, `devia sync` keeps
+refreshing it, and only new `devia init` runs behave differently. Recorded as G8.
+
+### A P0 blocker comes from the priority cell, never from prose
+
+`MEM-DEBT-P0` matched `P0` anywhere in a debt row. A P1 line reading "becomes P0 once the
+payment module ships" failed the gate, so a project with no P0 debt was told it was blocked by
+one. The check now reads the priority cell. Found by writing a real project's debt registry.
+
+## 0.4.0 — 2026-09-09
+
+The standard is unchanged: `VERSION` stays at 0.1.0, no adopter needs `devia sync`.
+
+### A manifest is not always at the root
+
+Running `devia init` on a real project for the first time — a Next.js app whose manifest lives
+in `apps/web/` — exposed five gates reporting `SKIP  no package.json` to a repository that has
+one, with a lockfile, a lint script and thirteen dependencies. The letter of the rule was kept,
+since nothing was rounded up to `PASS`; the reason given was false, which is worse. A reader
+believes the tool looked.
+
+- `check` reads every `package.json` in the repository, nearest the root first, and takes the
+  union of their dependencies: "does this project use X" is not a question about one directory
+- A lockfile is looked for next to each manifest, not only at the root
+- A migrations directory is found at any depth
+- `SKIP` now says `no package.json anywhere in the repository`, and findings name the file they
+  came from — `no npm test script in apps/web/package.json`
+- `init` detects the profile from the nearest manifest instead of falling back to a default, and
+  records the directories holding manifests in `code.paths`, which is what `doctor` watches for
+  staleness
+
+On that project: six SKIPs became two, four gates turned into real findings, and the dependency
+lockfile went from invisible to `PASS  apps/web/package-lock.json`.
+
+- G1 closed and reframed: the blind spot was never the ecosystem, it was the root assumption.
+  D9 records what is still root-only: `pyproject.toml`, `go.mod`, `Cargo.toml`
+- G7 opened: what devia should do when a repository already carries an ad-hoc memory of its own
+
+### Fixed
+
+- Nested directories were not excluded from the scan on Windows when git was unavailable: the
+  separator class only matched `/`, so `apps/web/node_modules` was walked. Both separators now.
+
 ## 0.3.0 — 2026-09-09
 
 The standard is unchanged: `VERSION` stays at 0.1.0, no adopter needs `devia sync`.

package/MIGRATION.md

@@ -58,5 +58,6 @@ Then:
    (undecided) and `.devia/12_DEBT.md` (decided, not built) — the split matters.
 4. Replace `node scripts/production-check.mjs` in CI with `npx devia check`.
 
-Nothing in the old repos is lost: the full text of both is vendored here, and `devia init`
-vendors it again into the project under `.devia/standard/`.
+Nothing in the old repos is lost: the full text of both ships with this package, readable with
+`npx devia rules`, and `npx devia sync` pins a copy under `.devia/standard/` when a project
+wants one on disk.

package/README.md

@@ -56,7 +56,7 @@ npx devia doctor              # adoption + staleness diagnosis
 ├── 14_INDEX.md          # where to find what
 ├── impact-map.yaml      # change type → files that must be updated
 ├── devia.json           # profile, modules, maturity target, pinned version
-└── standard/            # vendored, version-pinned copy of the standard
+└── standard/            # optional: `devia sync` pins a copy of the standard here
 ```
 
 Plus adapters so every agent gets the same contract: `AGENTS.md` (universal), `CLAUDE.md`,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@schneiderjoseph/devia",
-  "version": "0.3.0",
+  "version": "0.5.0",
   "description": "One standard, one memory: engineering and design rules plus living project memory for AI coding agents",
   "type": "module",
   "license": "MIT",

package/skills/devia/SKILL.md

@@ -40,8 +40,9 @@ the difference between a task and a guess (`AGT-002`).
 
 ## Step 2 — work under the rules
 
-The rules are pinned in `.devia/standard/rules/` with stable IDs. The ones that stop most bad
-changes:
+The rules have stable IDs and are read with `npx devia rules --id <ID>`, or `--domain <name>`
+for a whole area. A project that ran `devia sync` also has them on disk under
+`.devia/standard/rules/`. The ones that stop most bad changes:
 
 | If you are about to… | Rule |
 |---|---|

package/src/commands/check.mjs

@@ -59,7 +59,9 @@ const TEXT_EXT = new Set([
  * secret scan that silently scanned nothing is worse than one that over-reports.
  */
 function sourceFiles(root) {
-  const skipped = (rel) => rel.split(/[\/]/).some((seg) => SKIP_DIRS.has(seg));
+  // Both separators: git reports "/", walk() reports path.sep, and a nested node_modules must be
+  // skipped in either shape.
+  const skipped = (rel) => rel.split(/[\\/]/).some((seg) => SKIP_DIRS.has(seg));
   const wanted = (rel) => TEXT_EXT.has(path.extname(rel).toLowerCase());
 
   const tracked = trackedFiles(root);
@@ -81,13 +83,31 @@ function anyExists(root, candidates) {
 }
 
 function makeChecks(root, ctx) {
-  const pkg = readJSON(path.join(root, "package.json"));
-  const scripts = pkg?.scripts || {};
-  const deps = { ...(pkg?.dependencies || {}), ...(pkg?.devDependencies || {}) };
   const config = readJSON(path.join(root, ".devia", "devia.json"));
   const files = sourceFiles(root);
   const rel = (p) => p.split(path.sep).join("/");
 
+  /**
+   * A manifest is not always at the repository root: `apps/web/package.json` is as real as
+   * `./package.json`. Reading only the root turned "I did not look there" into "you have no
+   * package.json", which is a wrong answer dressed as a SKIP — worse than no answer, because
+   * the reader believes the tool looked.
+   */
+  const manifests = files
+    .filter((f) => /(^|[\\/])package\.json$/.test(f))
+    .sort((a, b) => a.split(path.sep).length - b.split(path.sep).length || a.localeCompare(b));
+  const primary = manifests[0] || null;
+  const pkg = primary ? readJSON(path.join(root, primary)) : null;
+  const pkgWhere = primary ? rel(primary) : null;
+  const scripts = pkg?.scripts || {};
+  // Dependencies are asked as "does this project use X anywhere", so every manifest counts.
+  const deps = {};
+  for (const m of manifests) {
+    const json = readJSON(path.join(root, m)) || {};
+    Object.assign(deps, json.dependencies, json.devDependencies);
+  }
+  const noManifest = `no package.json anywhere in the repository`;
+
   const hasDep = (...names) => names.some((n) => n in deps);
   const grepFiles = (re, limit = 40) => {
     const hits = [];
@@ -134,9 +154,16 @@ function makeChecks(root, ctx) {
       run: () => {
         const text = read(path.join(root, ".devia", "12_DEBT.md"));
         if (text === null) return { kind: "SKIP", detail: "no debt registry" };
-        const rows = (text.match(/^\|\s*D\d+\s*\|.*$/gm) || []).filter(
-          (r) => /\bP0\b/.test(r) && !/TODO\(devia\)/.test(r)
-        );
+        // The priority is a cell, not a word somewhere in the row. Matching the whole line made
+        // a P1 line reading "becomes P0 once the payment module ships" fail the gate — a P0
+        // blocker invented out of prose, on a project that had none.
+        const rows = (text.match(/^\|\s*D\d+\s*\|.*$/gm) || []).filter((row) => {
+          if (/TODO\(devia\)/.test(row)) return false;
+          return row
+            .split("|")
+            .slice(1, -1)
+            .some((cell) => cell.trim().toUpperCase() === "P0");
+        });
         return rows.length
           ? { kind: "FAIL", detail: `${rows.length} P0 debt line(s) open` }
           : { kind: "PASS" };
@@ -305,12 +332,13 @@ function makeChecks(root, ctx) {
       rule: "TST-001",
       title: "A test command exists",
       run: () => {
-        if (!pkg) return { kind: "SKIP", detail: "no package.json" };
+        if (!pkg) return { kind: "SKIP", detail: noManifest };
         const t = scripts.test;
-        if (!t) return { kind: "WARN", detail: "no npm test script" };
+        const where = pkgWhere === "package.json" ? "" : ` in ${pkgWhere}`;
+        if (!t) return { kind: "WARN", detail: `no npm test script${where}` };
         return /no test specified/.test(t)
-          ? { kind: "FAIL", detail: "test script is the npm placeholder" }
-          : { kind: "PASS" };
+          ? { kind: "FAIL", detail: `test script is the npm placeholder${where}` }
+          : { kind: "PASS", detail: where.trim() };
       },
     },
     {
@@ -319,9 +347,7 @@ function makeChecks(root, ctx) {
       rule: "OPS-004",
       title: "Dependency lockfile committed",
       run: () => {
-        const manifests = ["package.json", "pyproject.toml", "go.mod", "Cargo.toml", "Gemfile"];
-        if (!anyExists(root, manifests)) return { kind: "SKIP", detail: "no manifest" };
-        const lock = anyExists(root, [
+        const LOCKS = [
           "package-lock.json",
           "pnpm-lock.yaml",
           "yarn.lock",
@@ -331,10 +357,23 @@ function makeChecks(root, ctx) {
           "go.sum",
           "Cargo.lock",
           "Gemfile.lock",
+        ];
+        // A lockfile sits next to the manifest it locks, which is not always the root.
+        const dirs = new Set(["."]);
+        for (const m of manifests) dirs.add(path.dirname(m));
+        const rootManifest = anyExists(root, [
+          "package.json",
+          "pyproject.toml",
+          "go.mod",
+          "Cargo.toml",
+          "Gemfile",
         ]);
-        return lock
-          ? { kind: "PASS", detail: lock }
-          : { kind: "FAIL", detail: "no lockfile" };
+        if (!rootManifest && !manifests.length) return { kind: "SKIP", detail: "no manifest" };
+        for (const dir of dirs) {
+          const found = LOCKS.find((l) => exists(path.join(root, dir, l)));
+          if (found) return { kind: "PASS", detail: rel(path.join(dir, found)) };
+        }
+        return { kind: "FAIL", detail: "no lockfile" };
       },
     },
     {
@@ -355,8 +394,14 @@ function makeChecks(root, ctx) {
           "alembic",
           path.join("src", "migrations"),
         ]);
-        return dir
-          ? { kind: "PASS", detail: dir }
+        if (dir) return { kind: "PASS", detail: dir };
+        // Not only at the root: a migrations directory can live under any package.
+        const SEGMENTS = new Set(["migrations", "migrate", "alembic"]);
+        const nested = files
+          .map(rel)
+          .find((f) => f.split("/").slice(0, -1).some((seg) => SEGMENTS.has(seg)));
+        return nested
+          ? { kind: "PASS", detail: nested.split("/").slice(0, -1).join("/") }
           : { kind: "FAIL", detail: "database in use, no migrations directory" };
       },
     },
@@ -388,7 +433,7 @@ function makeChecks(root, ctx) {
       run: () => {
         if (config && config.modules && config.modules.design === false)
           return { kind: "SKIP", detail: "design module disabled" };
-        if (!pkg) return { kind: "SKIP", detail: "no package.json" };
+        if (!pkg) return { kind: "SKIP", detail: noManifest };
         const found = hasDep(
           "axe-core", "@axe-core/react", "@axe-core/playwright", "jest-axe",
           "eslint-plugin-jsx-a11y", "pa11y", "@storybook/addon-a11y", "lighthouse"
@@ -407,7 +452,7 @@ function makeChecks(root, ctx) {
         const profile = config?.project?.profile;
         if (["cli", "library", "docs"].includes(profile))
           return { kind: "SKIP", detail: `${profile} does not run as a watched service` };
-        if (!pkg) return { kind: "SKIP", detail: "no package.json" };
+        if (!pkg) return { kind: "SKIP", detail: noManifest };
         const found = hasDep("@sentry/node", "@sentry/browser", "@sentry/nextjs", "bugsnag",
           "rollbar", "datadog-lambda-js", "dd-trace", "@opentelemetry/api");
         return found

package/src/commands/doctor.mjs

@@ -64,12 +64,11 @@ ${color.bold("devia doctor")} — adoption, drift and staleness
   const vendored = walk(path.join(deviaDir, "standard")).length;
   if (path.resolve(root) === path.resolve(packageRoot)) {
     status("SKIP", "vendored standard", "this repository is the standard");
+  } else if (vendored) {
+    status("PASS", `standard pinned: ${vendored} files`);
   } else {
-    status(
-      vendored ? "PASS" : "WARN",
-      `vendored standard: ${vendored} files`,
-      vendored ? "" : "run `devia sync`"
-    );
+    // Not pinning is the default, so absence is a fact to report, never a warning to clear.
+    status("INFO", "standard not pinned", "`devia rules` reads it; `devia sync` pins a copy");
   }
 
   // Adapters

package/src/commands/init.mjs

@@ -1,6 +1,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import { packageRoot, exists, read, writeFile, writeJSON, walk } from "../lib/fs.mjs";
+import { trackedFiles } from "../lib/git.mjs";
 import { cliVersion, standardVersion } from "../lib/version.mjs";
 import { vendorStandard } from "../lib/vendor.mjs";
 import { color, heading, status, line } from "../lib/ui.mjs";
@@ -15,10 +16,22 @@ const PROFILES = {
   docs: "Documentation or content repository",
 };
 
+/**
+ * Every package.json in the repository, nearest to the root first. A monorepo keeps its real
+ * manifest in `apps/web/` or `packages/*`, and a profile detected from the root alone falls back
+ * to a default while the evidence sits one directory down.
+ */
+function findManifests(root) {
+  const tracked = trackedFiles(root);
+  if (!tracked) return exists(path.join(root, "package.json")) ? ["package.json"] : [];
+  return tracked
+    .filter((f) => /(^|\/)package\.json$/.test(f) && !f.includes("node_modules/"))
+    .sort((a, b) => a.split("/").length - b.split("/").length || a.localeCompare(b));
+}
+
 function detectProfile(root) {
-  const pkg = path.join(root, "package.json");
-  if (exists(pkg)) {
-    const json = JSON.parse(read(pkg) || "{}");
+  for (const manifest of findManifests(root)) {
+    const json = JSON.parse(read(path.join(root, manifest)) || "{}");
     const deps = { ...json.dependencies, ...json.devDependencies };
     if (json.bin) return "cli";
     if (deps.next || deps.react || deps.vue || deps.svelte || deps["@angular/core"])
@@ -46,8 +59,14 @@ function detectName(root) {
 }
 
 function detectCodePaths(root) {
-  const candidates = ["src", "app", "lib", "packages", "server", "api", "web", "components"];
-  return candidates.filter((c) => exists(path.join(root, c)));
+  const candidates = ["src", "app", "apps", "lib", "packages", "server", "api", "web", "components"];
+  const found = candidates.filter((c) => exists(path.join(root, c)));
+  // The directory holding a manifest is code by definition, wherever it sits.
+  for (const manifest of findManifests(root)) {
+    const dir = path.posix.dirname(manifest);
+    if (dir !== "." && !found.some((f) => dir === f || dir.startsWith(`${f}/`))) found.push(dir);
+  }
+  return found;
 }
 
 function fill(text, vars) {
@@ -65,7 +84,7 @@ ${color.bold("devia init")} — create .devia/ in this repository
   --profile <name>    ${Object.keys(PROFILES).join(" | ")}
   --force             overwrite existing memory files (dangerous: they hold your decisions)
   --no-agents         do not write the agent adapters
-  --no-vendor         do not vendor the standard into .devia/standard/
+  --vendor            pin a copy of the standard into .devia/standard/ (~390 files)
   --yes               accept a detected root that is not the current directory
 `.trim());
     return 0;
@@ -144,17 +163,20 @@ ${color.bold("devia init")} — create .devia/ in this repository
     status("SKIP", "devia.json kept", "use --force to regenerate");
   }
 
-  // 3. Vendored standard
-  if (flags.vendor === false || flags["no-vendor"]) {
-    status("SKIP", "standard not vendored", "--no-vendor");
-  } else {
+  // 3. Pinned standard — opt-in. Vendoring writes ~390 files a project did not author, which
+  // buries the memory it is supposed to serve: on a real repository the ratio was 17 files of
+  // memory to 391 of copy, and every `sync` produced a 391-file diff. The rules stay reachable
+  // through `devia rules`, and `devia sync` pins the copy for whoever needs it offline.
+  if (flags.vendor && flags.vendor !== "false") {
     const files = vendorStandard(path.join(deviaDir, "standard"), {
       by: "devia init",
       cli,
       standard: version,
       date: vars.DATE,
     });
-    status("PASS", `standard vendored: ${files} files`, `v${version}`);
+    status("PASS", `standard pinned: ${files} files`, `v${version}`);
+  } else {
+    status("SKIP", "standard not pinned", "`devia sync` writes .devia/standard/ when you need it");
   }
 
   // 4. Agent adapters

package/templates/agents/AGENTS.md

@@ -31,5 +31,5 @@ npx devia check       # readiness gates
 Update `.devia/` in the same change (see `.devia/impact-map.yaml`), then report what you changed
 **and what you did not verify**.
 
-Full standard: [`.devia/standard/AGENTS.md`](.devia/standard/AGENTS.md) ·
-rules by ID: [`.devia/standard/rules/README.md`](.devia/standard/rules/README.md)
+Rules by ID: `npx devia rules --id SEC-001`, or by domain: `npx devia rules --domain database`.
+A pinned copy lives under `.devia/standard/` only if this project ran `devia sync`.

package/templates/agents/CLAUDE.md

@@ -31,4 +31,5 @@ npx devia check
 
 Report the checks that ran, the rule IDs involved, and what you did **not** verify.
 
-Full contract: `.devia/standard/AGENTS.md`. Rules by ID: `.devia/standard/rules/README.md`.
+Rules by ID: `npx devia rules --id SEC-001`, or by domain: `npx devia rules --domain database`.
+A pinned copy lives under `.devia/standard/` only if this project ran `devia sync`.

package/templates/project/14_INDEX.md

@@ -38,13 +38,17 @@
 |---|---|---|
 | TODO(devia) | | |
 
-## Standard (vendored)
+## Standard
 
-| Need | Where |
+The standard is read through the CLI, not copied into this repository.
+
+| Need | Command |
 |---|---|
-| Work contract | [`standard/AGENTS.md`](standard/AGENTS.md) |
-| Rule by ID | [`standard/rules/README.md`](standard/rules/README.md) |
-| Engineering policy | [`standard/standard/engineering/README.md`](standard/standard/engineering/README.md) |
-| Design policy | [`standard/standard/design/README.md`](standard/standard/design/README.md) |
-| Checklists | [`standard/checklists/README.md`](standard/checklists/README.md) |
-| Memory doctrine | [`standard/MEMORY.md`](standard/MEMORY.md) |
+| A rule by ID | `npx devia rules --id SEC-001` |
+| Every rule in a domain | `npx devia rules --domain database --priority P0` |
+| Work contract | `AGENTS.md` at this repository's root |
+| Readiness gates | `npx devia check` |
+
+`npx devia sync` pins a version-locked copy under `standard/` when an agent must read it
+offline, or when an audit needs the exact wording you built against. Add the paths here if you
+do.

package/templates/project/AGENTS.md

@@ -8,8 +8,8 @@ This file is your contract. Violating it is a failed task.
 1. Read [`10_NEVER_ALWAYS.md`](10_NEVER_ALWAYS.md) — what this project has already banned
 2. Read [`00_OVERVIEW.md`](00_OVERVIEW.md) — what this project is
 3. Read the memory file for the surface you are about to change ([`14_INDEX.md`](14_INDEX.md))
-4. Read the standard section for the domain: [`standard/AGENTS.md`](standard/AGENTS.md),
-   [`standard/rules/README.md`](standard/rules/README.md)
+4. Read the rules for what you are touching: `npx devia rules --domain <name>`, or
+   `npx devia rules --id <ID>` for one
 
 Then work. Then update this memory in the same change.
 
@@ -48,4 +48,4 @@ TODO(devia): add this project's own commands — install, dev, test, lint, migra
 - Not verified: ...
 ```
 
-Full contract, routing table and hard stops: [`standard/AGENTS.md`](standard/AGENTS.md).
+Full contract, routing table and hard stops: the `AGENTS.md` at this repository's root.

package/templates/project/README.md

@@ -27,8 +27,11 @@ Created by `devia init` (devia {{DEVIA_VERSION}}, {{DATE}}).
 Machine files: [`devia.json`](devia.json) (profile, maturity, pinned version) and
 [`impact-map.yaml`](impact-map.yaml) (change type → files to update).
 
-The standard itself is vendored, version-pinned, under [`standard/`](standard/) — the same text
-for every agent, offline, no network and no package manager required.
+The standard itself is not copied in here. Read it with `npx devia rules --id SEC-001` or
+`npx devia rules --domain database`, which is the same text for every agent. If you need it on
+disk — an agent with no network, or an audit that must show the exact wording you built against
+— `npx devia sync` pins a version-locked copy under `standard/`, and `14_INDEX.md` then points
+at it.
 
 ## The two registries
 
@@ -43,7 +46,7 @@ for every agent, offline, no network and no package manager required.
 npx devia validate    # structure, registries, placeholders
 npx devia doctor      # is the memory older than the code?
 npx devia check       # readiness gates
-npx devia sync        # refresh the vendored standard after an upgrade
+npx devia sync        # pin the standard under standard/, or refresh a pinned copy
 ```
 
 `.devia/` is committed. It is part of the repository, not a local scratch pad.