@schneiderjoseph/devia 0.4.0 → 0.5.0

package/CHANGELOG.md

@@ -1,5 +1,36 @@
 # Changelog
 
+## 0.5.0 — 2026-09-09
+
+The standard is unchanged: `VERSION` stays at 0.1.0.
+
+### Pinning the standard is now opt-in
+
+`devia init` used to copy the whole standard into `.devia/standard/`. Measured on a real
+repository: **391 pinned files against 17 of memory** — a folder whose purpose is to be read by
+a human and an agent, in which 96% of the files were a copy nobody wrote. On a 211-file project
+it tripled the repository, and every `devia sync` produced a 391-file diff in which a real
+memory change was invisible.
+
+- `devia init` writes the memory and the adapters, and pins nothing: **17 files, 57 kB**
+- `devia init --vendor` pins the copy for those who want it up front
+- `devia sync` pins it on demand and refreshes it afterwards — that is now its first job, not
+  only its maintenance one
+- `doctor` reports an unpinned standard as `INFO`, not a `WARN` to clear: the default is not a
+  defect
+- The memory templates, the agent adapters and the skill read the rules with
+  `npx devia rules --id <ID>` / `--domain <name>` instead of linking into a copy that may not
+  exist. A pinned copy is mentioned as what it is: optional
+
+Nothing to do when upgrading. An existing `.devia/standard/` is left alone, `devia sync` keeps
+refreshing it, and only new `devia init` runs behave differently. Recorded as G8.
+
+### A P0 blocker comes from the priority cell, never from prose
+
+`MEM-DEBT-P0` matched `P0` anywhere in a debt row. A P1 line reading "becomes P0 once the
+payment module ships" failed the gate, so a project with no P0 debt was told it was blocked by
+one. The check now reads the priority cell. Found by writing a real project's debt registry.
+
 ## 0.4.0 — 2026-09-09
 
 The standard is unchanged: `VERSION` stays at 0.1.0, no adopter needs `devia sync`.

package/MIGRATION.md

@@ -58,5 +58,6 @@ Then:
    (undecided) and `.devia/12_DEBT.md` (decided, not built) — the split matters.
 4. Replace `node scripts/production-check.mjs` in CI with `npx devia check`.
 
-Nothing in the old repos is lost: the full text of both is vendored here, and `devia init`
-vendors it again into the project under `.devia/standard/`.
+Nothing in the old repos is lost: the full text of both ships with this package, readable with
+`npx devia rules`, and `npx devia sync` pins a copy under `.devia/standard/` when a project
+wants one on disk.

package/README.md

@@ -56,7 +56,7 @@ npx devia doctor              # adoption + staleness diagnosis
 ├── 14_INDEX.md          # where to find what
 ├── impact-map.yaml      # change type → files that must be updated
 ├── devia.json           # profile, modules, maturity target, pinned version
-└── standard/            # vendored, version-pinned copy of the standard
+└── standard/            # optional: `devia sync` pins a copy of the standard here
 ```
 
 Plus adapters so every agent gets the same contract: `AGENTS.md` (universal), `CLAUDE.md`,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@schneiderjoseph/devia",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "One standard, one memory: engineering and design rules plus living project memory for AI coding agents",
   "type": "module",
   "license": "MIT",

package/skills/devia/SKILL.md

@@ -40,8 +40,9 @@ the difference between a task and a guess (`AGT-002`).
 
 ## Step 2 — work under the rules
 
-The rules are pinned in `.devia/standard/rules/` with stable IDs. The ones that stop most bad
-changes:
+The rules have stable IDs and are read with `npx devia rules --id <ID>`, or `--domain <name>`
+for a whole area. A project that ran `devia sync` also has them on disk under
+`.devia/standard/rules/`. The ones that stop most bad changes:
 
 | If you are about to… | Rule |
 |---|---|

package/src/commands/check.mjs

@@ -154,9 +154,16 @@ function makeChecks(root, ctx) {
       run: () => {
         const text = read(path.join(root, ".devia", "12_DEBT.md"));
         if (text === null) return { kind: "SKIP", detail: "no debt registry" };
-        const rows = (text.match(/^\|\s*D\d+\s*\|.*$/gm) || []).filter(
-          (r) => /\bP0\b/.test(r) && !/TODO\(devia\)/.test(r)
-        );
+        // The priority is a cell, not a word somewhere in the row. Matching the whole line made
+        // a P1 line reading "becomes P0 once the payment module ships" fail the gate — a P0
+        // blocker invented out of prose, on a project that had none.
+        const rows = (text.match(/^\|\s*D\d+\s*\|.*$/gm) || []).filter((row) => {
+          if (/TODO\(devia\)/.test(row)) return false;
+          return row
+            .split("|")
+            .slice(1, -1)
+            .some((cell) => cell.trim().toUpperCase() === "P0");
+        });
         return rows.length
           ? { kind: "FAIL", detail: `${rows.length} P0 debt line(s) open` }
           : { kind: "PASS" };

package/src/commands/doctor.mjs

@@ -64,12 +64,11 @@ ${color.bold("devia doctor")} — adoption, drift and staleness
   const vendored = walk(path.join(deviaDir, "standard")).length;
   if (path.resolve(root) === path.resolve(packageRoot)) {
     status("SKIP", "vendored standard", "this repository is the standard");
+  } else if (vendored) {
+    status("PASS", `standard pinned: ${vendored} files`);
   } else {
-    status(
-      vendored ? "PASS" : "WARN",
-      `vendored standard: ${vendored} files`,
-      vendored ? "" : "run `devia sync`"
-    );
+    // Not pinning is the default, so absence is a fact to report, never a warning to clear.
+    status("INFO", "standard not pinned", "`devia rules` reads it; `devia sync` pins a copy");
   }
 
   // Adapters

package/src/commands/init.mjs

@@ -84,7 +84,7 @@ ${color.bold("devia init")} — create .devia/ in this repository
   --profile <name>    ${Object.keys(PROFILES).join(" | ")}
   --force             overwrite existing memory files (dangerous: they hold your decisions)
   --no-agents         do not write the agent adapters
-  --no-vendor         do not vendor the standard into .devia/standard/
+  --vendor            pin a copy of the standard into .devia/standard/ (~390 files)
   --yes               accept a detected root that is not the current directory
 `.trim());
     return 0;
@@ -163,17 +163,20 @@ ${color.bold("devia init")} — create .devia/ in this repository
     status("SKIP", "devia.json kept", "use --force to regenerate");
   }
 
-  // 3. Vendored standard
-  if (flags.vendor === false || flags["no-vendor"]) {
-    status("SKIP", "standard not vendored", "--no-vendor");
-  } else {
+  // 3. Pinned standard — opt-in. Vendoring writes ~390 files a project did not author, which
+  // buries the memory it is supposed to serve: on a real repository the ratio was 17 files of
+  // memory to 391 of copy, and every `sync` produced a 391-file diff. The rules stay reachable
+  // through `devia rules`, and `devia sync` pins the copy for whoever needs it offline.
+  if (flags.vendor && flags.vendor !== "false") {
     const files = vendorStandard(path.join(deviaDir, "standard"), {
       by: "devia init",
       cli,
       standard: version,
       date: vars.DATE,
     });
-    status("PASS", `standard vendored: ${files} files`, `v${version}`);
+    status("PASS", `standard pinned: ${files} files`, `v${version}`);
+  } else {
+    status("SKIP", "standard not pinned", "`devia sync` writes .devia/standard/ when you need it");
   }
 
   // 4. Agent adapters

package/templates/agents/AGENTS.md

@@ -31,5 +31,5 @@ npx devia check       # readiness gates
 Update `.devia/` in the same change (see `.devia/impact-map.yaml`), then report what you changed
 **and what you did not verify**.
 
-Full standard: [`.devia/standard/AGENTS.md`](.devia/standard/AGENTS.md) ·
-rules by ID: [`.devia/standard/rules/README.md`](.devia/standard/rules/README.md)
+Rules by ID: `npx devia rules --id SEC-001`, or by domain: `npx devia rules --domain database`.
+A pinned copy lives under `.devia/standard/` only if this project ran `devia sync`.

package/templates/agents/CLAUDE.md

@@ -31,4 +31,5 @@ npx devia check
 
 Report the checks that ran, the rule IDs involved, and what you did **not** verify.
 
-Full contract: `.devia/standard/AGENTS.md`. Rules by ID: `.devia/standard/rules/README.md`.
+Rules by ID: `npx devia rules --id SEC-001`, or by domain: `npx devia rules --domain database`.
+A pinned copy lives under `.devia/standard/` only if this project ran `devia sync`.

package/templates/project/14_INDEX.md

@@ -38,13 +38,17 @@
 |---|---|---|
 | TODO(devia) | | |
 
-## Standard (vendored)
+## Standard
 
-| Need | Where |
+The standard is read through the CLI, not copied into this repository.
+
+| Need | Command |
 |---|---|
-| Work contract | [`standard/AGENTS.md`](standard/AGENTS.md) |
-| Rule by ID | [`standard/rules/README.md`](standard/rules/README.md) |
-| Engineering policy | [`standard/standard/engineering/README.md`](standard/standard/engineering/README.md) |
-| Design policy | [`standard/standard/design/README.md`](standard/standard/design/README.md) |
-| Checklists | [`standard/checklists/README.md`](standard/checklists/README.md) |
-| Memory doctrine | [`standard/MEMORY.md`](standard/MEMORY.md) |
+| A rule by ID | `npx devia rules --id SEC-001` |
+| Every rule in a domain | `npx devia rules --domain database --priority P0` |
+| Work contract | `AGENTS.md` at this repository's root |
+| Readiness gates | `npx devia check` |
+
+`npx devia sync` pins a version-locked copy under `standard/` when an agent must read it
+offline, or when an audit needs the exact wording you built against. Add the paths here if you
+do.

package/templates/project/AGENTS.md

@@ -8,8 +8,8 @@ This file is your contract. Violating it is a failed task.
 1. Read [`10_NEVER_ALWAYS.md`](10_NEVER_ALWAYS.md) — what this project has already banned
 2. Read [`00_OVERVIEW.md`](00_OVERVIEW.md) — what this project is
 3. Read the memory file for the surface you are about to change ([`14_INDEX.md`](14_INDEX.md))
-4. Read the standard section for the domain: [`standard/AGENTS.md`](standard/AGENTS.md),
-   [`standard/rules/README.md`](standard/rules/README.md)
+4. Read the rules for what you are touching: `npx devia rules --domain <name>`, or
+   `npx devia rules --id <ID>` for one
 
 Then work. Then update this memory in the same change.
 
@@ -48,4 +48,4 @@ TODO(devia): add this project's own commands — install, dev, test, lint, migra
 - Not verified: ...
 ```
 
-Full contract, routing table and hard stops: [`standard/AGENTS.md`](standard/AGENTS.md).
+Full contract, routing table and hard stops: the `AGENTS.md` at this repository's root.

package/templates/project/README.md

@@ -27,8 +27,11 @@ Created by `devia init` (devia {{DEVIA_VERSION}}, {{DATE}}).
 Machine files: [`devia.json`](devia.json) (profile, maturity, pinned version) and
 [`impact-map.yaml`](impact-map.yaml) (change type → files to update).
 
-The standard itself is vendored, version-pinned, under [`standard/`](standard/) — the same text
-for every agent, offline, no network and no package manager required.
+The standard itself is not copied in here. Read it with `npx devia rules --id SEC-001` or
+`npx devia rules --domain database`, which is the same text for every agent. If you need it on
+disk — an agent with no network, or an audit that must show the exact wording you built against
+— `npx devia sync` pins a version-locked copy under `standard/`, and `14_INDEX.md` then points
+at it.
 
 ## The two registries
 
@@ -43,7 +46,7 @@ for every agent, offline, no network and no package manager required.
 npx devia validate    # structure, registries, placeholders
 npx devia doctor      # is the memory older than the code?
 npx devia check       # readiness gates
-npx devia sync        # refresh the vendored standard after an upgrade
+npx devia sync        # pin the standard under standard/, or refresh a pinned copy
 ```
 
 `.devia/` is committed. It is part of the repository, not a local scratch pad.