@sdd-method/author-cli 0.15.0 → 0.16.0

package/dist/lib/behaviour-store/archive.js

@@ -196,6 +196,34 @@ export function parseSurfaces(evidence) {
         problems.push("the **Surfaces:** line lists no contract");
     return { present: true, entries, problems };
 }
+/**
+ * A structural delta's `moved: {contracts: [{from, to, from_path?}]}` block. A contract's id is derived from its path,
+ * so moving the file changes the id; the change that moves it records the move once, and what named the old
+ * identity (an archived baseline's Surfaces list) follows it rather than being edited.
+ */
+export function contractMoves(raw) {
+    const moves = [];
+    const problems = [];
+    if (raw === undefined || raw === null)
+        return { moves, problems };
+    const contracts = typeof raw === "object" && !Array.isArray(raw) ? raw["contracts"] : undefined;
+    const extra = typeof raw === "object" && raw !== null && !Array.isArray(raw) ? Object.keys(raw).filter((k) => k !== "contracts") : [];
+    if (!Array.isArray(contracts) || extra.length > 0) {
+        problems.push(`moved must be {contracts: [{from: <old contract id>, to: <new contract id>, from_path?: <old spec path>}]}`);
+        return { moves, problems };
+    }
+    for (const [i, m] of contracts.entries()) {
+        const e = (m ?? {});
+        const from = typeof e["from"] === "string" ? e["from"].trim() : "";
+        const to = typeof e["to"] === "string" ? e["to"].trim() : "";
+        const fromPath = typeof e["from_path"] === "string" ? e["from_path"].trim() : undefined;
+        if (from === "" || to === "" || from === to)
+            problems.push(`moved.contracts[${i}] needs a from and a to that differ`);
+        else
+            moves.push({ from, to, ...(fromPath ? { fromPath } : {}) });
+    }
+    return { moves, problems };
+}
 /** Whether a Surfaces entry names a catalogue contract: its id, or a path suffix of its spec_path on a segment boundary. */
 export function surfaceMatches(entry, contractId, specPath) {
     const e = entry.replace(/^\.\//, "");

package/dist/lib/behaviour-store/schema.js

@@ -14,6 +14,16 @@ export const SCHEMA_NAME = "sdd-change";
 export const SHIPPED_SCHEMA_DIR = "docs/method/foundations/openspec/sdd-change";
 export const SHIPPED_CONFIG_TEMPLATE = "docs/method/foundations/openspec/config-template.yaml";
 export const STORE_SCHEMA_DIR = `openspec/schemas/${SCHEMA_NAME}`;
+/**
+ * The baseline schema (M-ADR 0222 §4.3-4.4): a baseline change selects it in its own .openspec.yaml, the store's
+ * config.yaml keeping sdd-change as the default. Copied and checked as sdd-change is, where the SDD's bundle
+ * ships it; a bundle from before it shipped has none, and nothing is asked of the store.
+ */
+export const BASELINE_SCHEMA_NAME = "sdd-baseline";
+/** Every schema the method ships for a store, the default first. */
+export const STORE_SCHEMAS = [SCHEMA_NAME, BASELINE_SCHEMA_NAME];
+export const shippedSchemaDir = (name) => `docs/method/foundations/openspec/${name}`;
+export const storeSchemaDir = (name) => `openspec/schemas/${name}`;
 export const STORE_CONFIG = "openspec/config.yaml";
 async function files(dir) {
     const out = [];
@@ -50,36 +60,38 @@ export async function storeSchemaName(repo) {
     const v = parseDocument(text.toString("utf8")).toJS()?.schema;
     return typeof v === "string" ? v : "";
 }
-/** Compare the store's copy of the schema with the one the SDD's method bundle shipped, file by file. */
-export async function compareStoreSchema(repo) {
-    const shipped = await files(join(repo, SHIPPED_SCHEMA_DIR));
+/** Compare the store's copy of a schema with the one the SDD's method bundle shipped, file by file. */
+export async function compareStoreSchema(repo, name = SCHEMA_NAME) {
+    const shippedDir = shippedSchemaDir(name);
+    const storeDir = storeSchemaDir(name);
+    const shipped = await files(join(repo, shippedDir));
     if (shipped === null || shipped.length === 0)
         return { shipped: false, missing: [], differing: [], extra: [] };
-    const store = (await files(join(repo, STORE_SCHEMA_DIR))) ?? [];
+    const store = (await files(join(repo, storeDir))) ?? [];
     const missing = shipped.filter((f) => !store.includes(f));
     const extra = store.filter((f) => !shipped.includes(f));
     const differing = [];
     for (const f of shipped.filter((x) => store.includes(x))) {
-        const a = await read(join(repo, SHIPPED_SCHEMA_DIR, f));
-        const b = await read(join(repo, STORE_SCHEMA_DIR, f));
+        const a = await read(join(repo, shippedDir, f));
+        const b = await read(join(repo, storeDir, f));
         if (a === null || b === null || !a.equals(b))
             differing.push(f);
     }
     return { shipped: true, missing, differing, extra };
 }
 /**
- * Replace the store's copy of the schema with the shipped one. Returns what changed, as a
+ * Replace the store's copy of a schema with the shipped one. Returns what changed, as a
  * comparison taken before the write; a store already current returns empty lists.
  */
-export async function writeStoreSchema(repo) {
-    const before = await compareStoreSchema(repo);
+export async function writeStoreSchema(repo, name = SCHEMA_NAME) {
+    const before = await compareStoreSchema(repo, name);
     if (!before.shipped)
         return before;
     if (before.missing.length + before.differing.length + before.extra.length === 0)
         return before;
-    await rm(join(repo, STORE_SCHEMA_DIR), { recursive: true, force: true });
-    await mkdir(join(repo, STORE_SCHEMA_DIR), { recursive: true });
-    await cp(join(repo, SHIPPED_SCHEMA_DIR), join(repo, STORE_SCHEMA_DIR), { recursive: true });
+    await rm(join(repo, storeSchemaDir(name)), { recursive: true, force: true });
+    await mkdir(join(repo, storeSchemaDir(name)), { recursive: true });
+    await cp(join(repo, shippedSchemaDir(name)), join(repo, storeSchemaDir(name)), { recursive: true });
     return before;
 }
 //# sourceMappingURL=schema.js.map

package/dist/lib/catalogue/aggregation-manifest-loader.js

@@ -0,0 +1,173 @@
+// Aggregation-manifest loader per
+// docs/method/methods/aggregation-manifest-schema.yaml.
+//
+// v1 supports `pull.kind: filesystem` only; the other kinds (git-ref,
+// release-asset) are schema-reserved and reject with a
+// clear "deferred" error so adopters get unambiguous feedback.
+import { readFile } from "node:fs/promises";
+import { isAbsolute, relative, resolve } from "node:path";
+import { parse as parseYaml } from "yaml";
+import { z } from "zod";
+import { SCHEMA_COMPAT, formatSchemaVersionMismatch } from "./schema-compat.js";
+import { isInRange } from "./manifest-loader.js";
+export const DEFAULT_AGGREGATION_MANIFEST_REL = "orchestration/aggregation-manifest.yaml";
+const PullSchema = z
+    .object({
+    kind: z.string(),
+    path: z.string().optional(),
+})
+    .passthrough();
+const SiblingSchema = z.object({
+    sdd_id: z.string().regex(/^[a-z][a-z0-9-]*$/, {
+        message: "sdd_id must match /^[a-z][a-z0-9-]*$/",
+    }),
+    pull: PullSchema,
+    description: z.string().optional(),
+    level: z.string().optional(),
+});
+/**
+ * An ecosystem member that is real and intended but has no SDD yet
+ * (aggregation-manifest-schema 1.1.0, per M-ADR 0195 §4.3).
+ *
+ * A SEPARATE list rather than a flag on `siblings[]`: `pull` is required on a sibling
+ * and a pending member has nothing to pull, and `siblings[]` must keep meaning exactly
+ * "members whose catalogues merge in" — adding skippable entries would give one list
+ * two meanings, which every existing reader would keep miscounting.
+ *
+ * `reason` is required and non-empty. A bare marker suppresses the build failure while
+ * saying nothing about why, losing the signal that a pending member is a WORK ITEM —
+ * the state this replaces.
+ */
+const PendingMemberSchema = z.object({
+    sdd_id: z.string().regex(/^[a-z][a-z0-9-]*$/, {
+        message: "pending_members[].sdd_id must match /^[a-z][a-z0-9-]*$/",
+    }),
+    reason: z.string().min(1, {
+        message: "pending_members[].reason must be non-empty — a marker without a reason suppresses a failure without explaining it",
+    }),
+    blocked_on: z.string().optional(),
+});
+const SLUG = /^[a-z][a-z0-9-]*$/;
+// M-ADR 0208 §4.3: `root_sdd_id` is canonical; `ecosystem_root` is its DEPRECATED alias
+// (at organisation tier the old name called an organisation-root an "ecosystem root").
+// Exactly one of the two must be present. Removed at 2.0.0.
+const AggregationManifestSchema = z
+    .object({
+    schema_version: z.string(),
+    root_sdd_id: z.string().regex(SLUG).optional(),
+    ecosystem_root: z.string().regex(SLUG).optional(),
+    level: z.enum(["platform", "organisation"]).optional(),
+    siblings: z.array(SiblingSchema),
+    pending_members: z.array(PendingMemberSchema).optional(),
+})
+    .refine((m) => (m.root_sdd_id !== undefined) !== (m.ecosystem_root !== undefined), {
+    message: "exactly one of `root_sdd_id` (canonical, M-ADR 0208 §4.3) or `ecosystem_root` (deprecated alias) must be present",
+});
+export async function loadAggregationManifest(manifestPath, options) {
+    let text;
+    try {
+        text = await readFile(manifestPath, "utf-8");
+    }
+    catch (err) {
+        if (err.code === "ENOENT") {
+            throw new Error(`Aggregation manifest not found at ${manifestPath}\n\n` +
+                `Ecosystem-root SDDs declare an aggregation manifest at the path\n` +
+                `recorded in .sdd/sdd-manifest.yaml#aggregation_manifest_path, or\n` +
+                `at ${DEFAULT_AGGREGATION_MANIFEST_REL} by default.\n` +
+                `Schema: docs/method/methods/aggregation-manifest-schema.yaml.`);
+        }
+        throw err;
+    }
+    let raw;
+    try {
+        raw = parseYaml(text);
+    }
+    catch (err) {
+        throw new Error(`failed to parse YAML at ${manifestPath}: ${err.message}`);
+    }
+    const parsed = AggregationManifestSchema.safeParse(raw);
+    if (!parsed.success) {
+        const issues = parsed.error.issues
+            .map((i) => `  - ${i.path.join(".") || "<root>"}: ${i.message}`)
+            .join("\n");
+        throw new Error(`invalid aggregation manifest at ${manifestPath}:\n${issues}`);
+    }
+    if (!isInRange(parsed.data.schema_version, SCHEMA_COMPAT.aggregation_manifest)) {
+        throw new Error(formatSchemaVersionMismatch({
+            schema: "aggregation_manifest",
+            readVersion: parsed.data.schema_version,
+            cliVersion: options.cliVersion,
+            sourcePath: manifestPath,
+        }));
+    }
+    // Duplicate sibling-id check.
+    const seen = new Set();
+    for (const s of parsed.data.siblings) {
+        if (seen.has(s.sdd_id)) {
+            throw new Error(`aggregation manifest has duplicate sibling sdd_id "${s.sdd_id}"\n` +
+                `  (${manifestPath})`);
+        }
+        seen.add(s.sdd_id);
+    }
+    // Resolve each sibling's pull. v1 supports `kind: filesystem` only.
+    const resolved = [];
+    for (const s of parsed.data.siblings) {
+        const kind = s.pull.kind;
+        if (kind !== "filesystem") {
+            throw new Error(`aggregation manifest: sibling "${s.sdd_id}" uses pull.kind="${kind}"\n` +
+                `  v1 supports filesystem only. The other kinds (git-ref, release-asset)\n` +
+                `  are schema-reserved and not yet implemented.\n` +
+                `  See: docs/method/methods/aggregation-manifest-schema.yaml#pull_kinds`);
+        }
+        const path = s.pull.path;
+        if (!path || typeof path !== "string") {
+            throw new Error(`aggregation manifest: sibling "${s.sdd_id}" pull.kind=filesystem requires \`path\``);
+        }
+        const cataloguesPath = isAbsolute(path)
+            ? path
+            : resolve(options.ecosystemRootPath, path);
+        // The sibling's repo root is the parent of `catalogues/`.
+        const sddRoot = resolve(cataloguesPath, "..");
+        // Portable form for the committed JSON snapshot: keep a relative source
+        // verbatim; anchor an absolute source to the ecosystem root so the emitted
+        // value never carries a machine-specific $HOME/checkout prefix.
+        const relativeCataloguesPath = isAbsolute(path)
+            ? relative(options.ecosystemRootPath, cataloguesPath)
+            : path;
+        resolved.push({
+            sddId: s.sdd_id,
+            description: s.description ?? "",
+            cataloguesPath,
+            relativeCataloguesPath,
+            sddRoot,
+            level: s.level,
+        });
+    }
+    // A member is pending authoring OR contributing catalogues, never both. Declaring
+    // both is a contradiction rather than something to merge, and silently preferring
+    // one reading would make the work queue untrustworthy — so it fails with the id.
+    const pendingMembers = [];
+    const siblingIds = new Set(resolved.map((r) => r.sddId));
+    for (const p of parsed.data.pending_members ?? []) {
+        if (siblingIds.has(p.sdd_id)) {
+            throw new Error(`aggregation manifest: "${p.sdd_id}" appears in BOTH siblings and pending_members.\n` +
+                `  A member is either pending authoring or contributing catalogues, not both.\n` +
+                `  Remove whichever declaration is stale (${parsed.data.root_sdd_id ?? parsed.data.ecosystem_root}).`);
+        }
+        pendingMembers.push({
+            sddId: p.sdd_id,
+            reason: p.reason,
+            ...(p.blocked_on !== undefined ? { blockedOn: p.blocked_on } : {}),
+        });
+    }
+    return {
+        schemaVersion: parsed.data.schema_version,
+        ecosystemRoot: (parsed.data.root_sdd_id ?? parsed.data.ecosystem_root),
+        level: parsed.data.level,
+        rootFieldDeprecated: parsed.data.root_sdd_id === undefined,
+        siblings: resolved,
+        pendingMembers,
+        sourcePath: manifestPath,
+    };
+}
+//# sourceMappingURL=aggregation-manifest-loader.js.map

package/dist/lib/catalogue/build.js

@@ -90,7 +90,7 @@ export async function runCatalogueBuild(inputs, write) {
     const intendedRows = [];
     const rowsByCatalogue = modelFiles === null
         ? collected
-        : overlayModel(schema, viewOf(modelFiles, modelProblems), collected, findings, intendedWrites(open, agreedOrder(open)), intendedRows);
+        : withC4Rollups(overlayModel(schema, viewOf(modelFiles, modelProblems), collected, findings, intendedWrites(open, agreedOrder(open)), intendedRows));
     for (const p of modelProblems)
         findings.add("convention", `${p} (M-ADR 0230)`);
     // 3a. Normalise every keyed catalogue to PK-unique rows. Multi-source edge
@@ -394,6 +394,9 @@ async function collectRows(schema, manifest, findings, sddPath, snapshotStore) {
         knownDomainIds,
         profile: manifest.profile,
         category: manifest.category,
+        domainExternal: schema.catalogues
+            .find((c) => c.name === "adrs")
+            ?.foreignKeys.some((fk) => fk.column === "domain_id" && (fk.external || (fk.externalForProfiles ?? []).includes(manifest.profile))) ?? false,
     });
     const supersedes = buildAdrSupersedes({ findings, adrs: adrResult.parsed });
     out.set("adr_supersedes", supersedes.rows);
@@ -1517,6 +1520,18 @@ async function collectRows(schema, manifest, findings, sddPath, snapshotStore) {
     });
     return out;
 }
+/**
+ * The C4 roll-ups joined again over the catalogues the structural model settles (M-ADR 0159 §4.8, M-ADR 0230 §4.3).
+ * collectRows joins them over the sources, which can state an element an agreed open change adds; the overlay holds
+ * that element back until the change archives, and a roll-up row reaching it would be a current row referencing it.
+ */
+function withC4Rollups(rows) {
+    const c4Containers = rows.get("c4_containers") ?? [];
+    const containerEntityRows = buildC4ContainerEntity({ serviceEntityRows: rows.get("service_entity") ?? [], c4Containers });
+    rows.set("c4_container_entity", containerEntityRows);
+    rows.set("c4_system_entity", buildC4SystemEntity({ containerEntityRows, c4Containers }));
+    return rows;
+}
 const CONTEXT_CROSS_CUTTING = "cross-cutting";
 /**
  * Convention check (schema 2.21.0): where a screen carries `context` and the

package/dist/lib/catalogue/builders/adrs.js

@@ -88,7 +88,7 @@ export async function buildAdrs(inputs) {
             inputs.findings.add("convention", `${relPath}: **Effective:** is "${effectiveRaw}", neither "on acceptance" nor "on archive of <change>"; read as on acceptance (M-ADR 0230 §4.2)`);
         }
         const effectiveChange = onArchive?.[1] ?? "";
-        if (scope === "domain" && !inputs.knownDomainIds.has(domainId)) {
+        if (scope === "domain" && !inputs.knownDomainIds.has(domainId) && !inputs.domainExternal) {
             inputs.findings.add("orphan", `${relPath}: ADR is in domain "${domainId}" but no docs/domains/${domainId}/ exists`);
         }
         // Method-scoped ADRs are cross-cutting governance and belong to no

package/dist/lib/catalogue/builders/contracts.js

@@ -58,6 +58,10 @@ const KIND_SPECS = [
     // name as their surface (M-ADR 0222 §4.4). Reachable from every path at once, unlike graphql above: discovered here, mapped from a
     // traceability manifest's `cli:` block (DECLARED_KINDS), loaded (CONTRACT_LIST_KEYS) and keyed by repo-config.
     { subdir: "cli", extensions: [".yaml", ".yml"], kind: "cli" },
+    // `ui` — an embeddable UI surface's manifest (schema 7.2.0): its custom elements and the messages it sends and
+    // receives. A UI-only repository that other applications load serves no other contract, so its behaviour
+    // baselines had nothing to name as their surface (M-ADR 0222 §4.4). Reachable from every path, as `cli` is.
+    { subdir: "ui", extensions: [".yaml", ".yml"], kind: "ui" },
 ];
 export async function buildContracts(inputs) {
     const rows = [];
@@ -318,6 +322,7 @@ const DECLARED_KINDS = {
     spicedb: "authz",
     graphql: "graphql",
     cli: "cli",
+    ui: "ui",
 };
 export function buildDeclaredExternalContracts(inputs) {
     const rows = [];

package/dist/lib/catalogue/builders/repositories.js

@@ -33,10 +33,11 @@ const LOC_REPORT_REL = join("docs", "platform", "reference", "loc-report.csv");
 const REPOS_DIR_REL = "repos";
 const REVERSE_METADATA_BASENAME = "reverse-metadata.yaml";
 // The contract kinds a repo-config `contracts:` block keys, under `contracts/<kind>/`. The sdd-index reader
-// accepts the same five; `spicedb` (an `authz` contract) was once missing here, and zod strips an unknown key,
+// accepts the same six; `spicedb` (an `authz` contract) was once missing here, and zod strips an unknown key,
 // so a declared `.zed` schema vanished without a finding. `cli` (schema 4.1.0) declares the command manifest a
-// command-line repository serves. GraphQL is not keyed in repo-config: that is its own question, on this schema.
-export const REPO_CONFIG_CONTRACT_KINDS = ["openapi", "proto", "avro", "spicedb", "cli"];
+// command-line repository serves, and `ui` (schema 7.2.0) the manifest of an embeddable UI surface a UI-only
+// repository serves. GraphQL is not keyed in repo-config: that is its own question, on this schema.
+export const REPO_CONFIG_CONTRACT_KINDS = ["openapi", "proto", "avro", "spicedb", "cli", "ui"];
 const ContractsBlockSchema = z
     .object({
     openapi: z.array(z.string()).optional(),
@@ -44,6 +45,7 @@ const ContractsBlockSchema = z
     avro: z.array(z.string()).optional(),
     spicedb: z.array(z.string()).optional(),
     cli: z.array(z.string()).optional(),
+    ui: z.array(z.string()).optional(),
 })
     .optional();
 const EventEntrySchema = z.object({

package/dist/lib/catalogue/canonical-schema.yaml

@@ -7,7 +7,7 @@
 # Emitted by sdd-cli's YAML emitter with no line folding; the three header scalars are quoted for the
 # textual readers downstream. The one deliberate difference from the authored form is schema_status:
 # the authored form says canonical; a projection never does.
-schema_version: "7.1.0"
+schema_version: "7.2.0"
 schema_owner: "sdd-method"
 schema_status: "generated"
 enums:
@@ -364,6 +364,7 @@ enums:
     - value: rpc
     - value: authz
     - value: cli
+    - value: ui
     description: Contract kind. Bound at 3.13.0 from the column descriptions; measured against both reference estates before binding (M-ADR 0205 §4.4).
   contract_status:
     values:
@@ -1791,7 +1792,7 @@ catalogues:
     - name: kind
       type: string
       nullable: false
-      description: rest | graphql | rpc | event | authz | cli. rpc covers Proto/gRPC; event covers Avro schemas; authz covers authorization/policy schemas (SpiceDB .zed and equivalents), added because an adopter contract agreement gate certified .zed schemas as contracts while no kind could represent them; cli covers a command-line interface's command manifest (its commands, options and exit codes), added at 4.1.0 because a command-line tool often serves no REST, RPC, event or authorization contract, so its behaviour baselines had nothing to name as their surface.
+      description: rest | graphql | rpc | event | authz | cli | ui. rpc covers Proto/gRPC; event covers Avro schemas; authz covers authorization/policy schemas (SpiceDB .zed and equivalents), added because an adopter contract agreement gate certified .zed schemas as contracts while no kind could represent them; cli covers a command-line interface's command manifest (its commands, options and exit codes), added at 4.1.0 because a command-line tool often serves no REST, RPC, event or authorization contract, so its behaviour baselines had nothing to name as their surface; ui covers an embeddable UI surface's manifest (its custom elements with their attributes, properties and emitted events, and the messages it sends and receives), added at 7.2.0 because a UI-only repository that other applications load serves no other contract, so its behaviour baselines had nothing to name as their surface.
     - name: version
       type: string
       nullable: true

package/dist/lib/catalogue/contract-id.js

@@ -2,7 +2,7 @@
 // M-ADR 0203 §4.4, the cut's acid test.
 //
 // From 3.0.0 a contract id carries its KIND component: `{domain}-{stem}-{kind}`
-// (kind ∈ rest | graphql | rpc | event | authz | cli). The kindless 2.x form made one
+// (kind ∈ rest | graphql | rpc | event | authz | cli | ui). The kindless 2.x form made one
 // measured collision class unrepresentable: a service published as two contract
 // families (`calendar-service.yaml` + `calendar_service.proto`) minted one id,
 // costing a live estate one row and two edges permanently, and mislabelling

package/dist/lib/catalogue/impact-run.js

@@ -103,7 +103,12 @@ export function buildImpactPropagation(edges, semantics) {
     for (const [key, rec] of pairs) {
         const abOnly = [...rec.ab].filter((t) => !rec.ba.has(t));
         const baOnly = [...rec.ba].filter((t) => !rec.ab.has(t));
-        if (abOnly.length > 0 && baOnly.length > 0) {
+        // Every opposing type a foreign key of ONE catalogue: an entity-FK step runs between a row and what it
+        // references, so such a pair is one row naming the same node in two of its columns, a self-reference (an
+        // entity related to itself), and the opposition is that row's own two ends meeting, not drift.
+        const catalogues = new Set([...abOnly, ...baOnly].map((t) => (t.includes(".") ? t.slice(0, t.indexOf(".")) : `\u0000${t}`)));
+        const selfReference = catalogues.size === 1 && !([...catalogues][0].startsWith("\u0000"));
+        if (abOnly.length > 0 && baOnly.length > 0 && !selfReference) {
             const [a, b] = key.split("␟");
             throw new Error(`impact: counter-directional reciprocal pair (M-ADR 0206 §4.4): ` +
                 `${abOnly[0]} propagates ${a} -> ${b} while ${baOnly[0]} propagates ` +

package/dist/lib/catalogue/traceability-loader.js

@@ -48,6 +48,7 @@ export const CONTRACT_LIST_KEYS = [
     "spicedb",
     "graphql",
     "cli",
+    "ui",
 ];
 /**
  * Every contract path a contracts block declares, across all kinds and both
@@ -283,6 +284,7 @@ function extractContracts(raw) {
     const spicedb = arr("spicedb");
     const graphql = arr("graphql");
     const cli = arr("cli");
+    const ui = arr("ui");
     // `provenance` (3.5.0) MUST be extracted here or the builder that reads it
     // sees nothing — this function reconstructs the block key-by-key rather than
     // passing the parsed object through, which is precisely the shape the
@@ -300,6 +302,7 @@ function extractContracts(raw) {
         ...(spicedb ? { spicedb } : {}),
         ...(graphql ? { graphql } : {}),
         ...(cli ? { cli } : {}),
+        ...(ui ? { ui } : {}),
         ...(provenance ? { provenance } : {}),
     };
 }

package/dist/lib/contracts-availability/index.js

@@ -116,7 +116,7 @@ async function collectReferences(repo) {
         const block = m.traceability.contracts;
         if (!block)
             continue;
-        for (const list of [block.openapi, block.proto, block.avro, block.spicedb, block.graphql, block.cli]) {
+        for (const list of [block.openapi, block.proto, block.avro, block.spicedb, block.graphql, block.cli, block.ui]) {
             if (!Array.isArray(list))
                 continue;
             for (const entry of list) {
@@ -201,6 +201,9 @@ export function inferKind(ref) {
     // repository whose own name ends in -cli stays rest.
     if (/(^|\/)cli\/.*\.ya?ml$/.test(ref))
         return "cli";
+    // A UI surface manifest lives under a `ui/` contracts folder, tested after rest for the same reason.
+    if (/(^|\/)ui\/.*\.ya?ml$/.test(ref))
+        return "ui";
     return undefined;
 }
 /** The SDD's attested external artefacts (`.sdd/contract-availability.yaml`); none when it has no manifest. */

package/dist/lib/plan/read-sdd.js

@@ -44,7 +44,7 @@ async function readRepoConfigFor(sddRoot, manifestAbsPath) {
         path: manifestAbsPath,
         aggregates: [],
         internalDependencies: [],
-        contracts: { openapi: [], proto: [], avro: [], spicedb: [], graphql: [], cli: [] },
+        contracts: { openapi: [], proto: [], avro: [], spicedb: [], graphql: [], cli: [], ui: [] },
     };
     if (!(await fileExists(manifestAbsPath)))
         return empty;
@@ -63,6 +63,7 @@ function legacyShape(node, sourcePath) {
         avro: [],
         spicedb: [],
         cli: [],
+        ui: [],
     };
     for (const ref of node.contracts)
         byKind[ref.kind].push(ref.path);

package/dist/lib/scaffold/behaviour-store.js

@@ -5,7 +5,7 @@
 import { access, mkdir, readFile, writeFile } from "node:fs/promises";
 import { dirname, join } from "node:path";
 import { parseDocument } from "yaml";
-import { SHIPPED_CONFIG_TEMPLATE, SHIPPED_SCHEMA_DIR, STORE_CONFIG, STORE_SCHEMA_DIR, writeStoreSchema } from "../behaviour-store/schema.js";
+import { SHIPPED_CONFIG_TEMPLATE, SHIPPED_SCHEMA_DIR, STORE_CONFIG, writeStoreSchema, STORE_SCHEMAS, storeSchemaDir } from "../behaviour-store/schema.js";
 import { MANIFEST_REL_PATH } from "../catalogue/manifest-loader.js";
 export const STORE_KEEP_FILES = ["openspec/specs/.gitkeep", "openspec/changes/archive/.gitkeep", "docs/agreements/.gitkeep"];
 async function exists(p) {
@@ -53,8 +53,10 @@ export async function scaffoldBehaviourStore(repo) {
         await writeFile(join(repo, rel), "");
         filesWritten.push(rel);
     }
-    const copied = await writeStoreSchema(repo);
-    filesWritten.push(...copied.missing.map((f) => `${STORE_SCHEMA_DIR}/${f}`));
+    for (const name of STORE_SCHEMAS) {
+        const copied = await writeStoreSchema(repo, name);
+        filesWritten.push(...copied.missing.map((f) => `${storeSchemaDir(name)}/${f}`));
+    }
     return { filesWritten, sddId };
 }
 //# sourceMappingURL=behaviour-store.js.map

package/dist/lib/sdd-index/repo-config.js

@@ -17,6 +17,7 @@ const CONTRACT_KINDS = [
     "avro",
     "spicedb",
     "cli",
+    "ui",
 ];
 export function readAllRepoConfigs(reader) {
     const services = [];

package/dist/lib/snapshot/advance.js

@@ -29,7 +29,7 @@ import { parse, parseDocument, stringify } from "yaml";
 // unrelated churn in lines the tool had no business touching.
 import { deltaPath } from "./diff.js";
 import { loadCanonicalSchema } from "../catalogue/schema-loader.js";
-import { SnapshotError, credentialNotice, exists, isIsoDate, readManifest, splitFolder, } from "./manifest.js";
+import { SnapshotError, credentialNotice, exists, isIsoDate, parseSnapshotYaml, readManifest, splitFolder, } from "./manifest.js";
 export const REVERSE_STATUSES = ["classified", "reversed"];
 export const IMPACTS = ["none", "repo-minor", "repo-major", "product-major"];
 /**
@@ -179,7 +179,7 @@ export async function advance(inputs, write) {
     if (!(await exists(dp))) {
         throw new SnapshotError(`no ${dp}: the pin advances after the delta is recorded (run snapshot diff, then classify)`);
     }
-    const delta = parse(await readFile(dp, "utf8"));
+    const delta = parseSnapshotYaml(await readFile(dp, "utf8"));
     const provenance = delta.t0_provenance?.result;
     const provenanceNote = provenance ? ` T0 provenance: ${provenance}${delta.t0_provenance?.waiver?.who ? ` (waiver: ${delta.t0_provenance.waiver.who})` : ""}.` : "";
     if (provenance && !/^pass$/.test(provenance)) {
@@ -215,8 +215,8 @@ export async function advance(inputs, write) {
         const hFile = join(dir, "reverse-history.yaml");
         const mFile = join(dir, "reverse-metadata.yaml");
         const metadataText = await readFile(mFile, "utf8");
-        const metadata = parse(metadataText);
-        let history = (await exists(hFile)) ? parse(await readFile(hFile, "utf8")) : { canonical_repo_key: key, history: [] };
+        const metadata = parseSnapshotYaml(metadataText);
+        let history = (await exists(hFile)) ? parseSnapshotYaml(await readFile(hFile, "utf8")) : { canonical_repo_key: key, history: [] };
         let migrated = false;
         if (Array.isArray(history.entries)) {
             if (!inputs.migrateHistory) {
@@ -315,6 +315,14 @@ export async function advance(inputs, write) {
         }
         // A classification is one of the bound vocabulary (M-ADR 0214 §4.5), read from the
         // schema rather than restated here: a typo is not a classification.
+        // Both effects are stated, `none` or the baseline change that carries it (delta-reverse.md §7): a refresh that
+        // changed nothing must read differently from one nobody checked.
+        const silent = mine
+            .filter((f) => f.classification !== null && f.classification !== undefined)
+            .flatMap((f) => ["structural_effect", "behavioural_effect"].filter((k) => typeof f[k] !== "string" || f[k].trim() === "").map((k) => `${f.id} ${k}`));
+        if (silent.length > 0) {
+            problems.push(`${key}: ${silent.join(", ")} not stated — each classified finding says none, or names the baseline change that carries it (delta-reverse.md §7)`);
+        }
         const outOfVocabulary = mine.filter((f) => !dispositions.has(String(f.classification)));
         if (outOfVocabulary.length > 0) {
             problems.push(`${key}: ${outOfVocabulary.map((f) => `${f.id} '${String(f.classification)}'`).join(", ")} — not a delta_disposition (${[...dispositions].join(", ")}; M-ADR 0214 §4.5)`);
@@ -371,7 +379,7 @@ export async function advance(inputs, write) {
         else {
             await writeFile(hFile, appendHistoryEntry(await readFile(hFile, "utf8"), p.entry));
         }
-        const after = parse(await readFile(hFile, "utf8")).history;
+        const after = parseSnapshotYaml(await readFile(hFile, "utf8")).history;
         if (after.length !== before.length + 1 || !isDeepStrictEqual(after.slice(0, before.length), before)) {
             throw new Error(`${hFile}: post-write check failed — prior entries changed or not exactly one appended`);
         }

package/dist/lib/snapshot/fold.js

@@ -15,9 +15,9 @@
 // (`support-repo` → `ancillary`, delta-reverse.md §1) and left unset otherwise.
 import { mkdir, readdir, readFile, rename, stat, writeFile } from "node:fs/promises";
 import { join, relative, sep } from "node:path";
-import { parse, stringify } from "yaml";
+import { stringify } from "yaml";
 import { setTopLevelScalars } from "./advance.js";
-import { SnapshotError, baselineIds, deriveKey, knownRepositoryIds, exists, isIsoDate, manifestPath, memberFolders, splitFolder, } from "./manifest.js";
+import { SnapshotError, baselineIds, deriveKey, knownRepositoryIds, exists, isIsoDate, manifestPath, memberFolders, parseSnapshotYaml, splitFolder, } from "./manifest.js";
 const ROLE_BY_PROFILE = { "support-repo": "ancillary" };
 /** The same mapping by M-ADR 0213's scope, which replaces the per-repo profile: a support repo is ancillary. */
 const ROLE_BY_SCOPE = { support: "ancillary" };
@@ -32,7 +32,7 @@ async function pinsByFolder(sddPath) {
         if (!e.isDirectory() || !(await exists(file)))
             continue;
         const text = await readFile(file, "utf8");
-        const meta = (parse(text) ?? {});
+        const meta = (parseSnapshotYaml(text) ?? {});
         const folder = String(meta.source_path ?? "").split("/").pop() || String(meta.exported_folder_name ?? "");
         if (folder)
             out.set(folder, { file, text, meta });

package/dist/lib/snapshot/manifest.js

@@ -9,7 +9,7 @@
 import { createHash } from "node:crypto";
 import { readdir, readFile, stat } from "node:fs/promises";
 import { join, relative, sep } from "node:path";
-import { parse } from "yaml";
+import { isScalar, parseDocument, visit } from "yaml";
 /** The line every later verb prints while a baseline carries unresolved credential findings. */
 export function credentialNotice(m) {
     const s = m.credential_scan;
@@ -60,6 +60,22 @@ export async function exists(p) {
         return false;
     }
 }
+/**
+ * Parse snapshot YAML with every `*revision` value read as the text written. A revision is an identifier, and YAML
+ * 1.2 reads an unquoted all-digit one as an integer: `08985180587` became 8985180587, losing the leading zero,
+ * so a pin no longer matched its folder's `@<rev>`. Writers quote such a value; this covers files written by hand.
+ */
+export function parseSnapshotYaml(text) {
+    const doc = parseDocument(text);
+    visit(doc, {
+        Pair(_, pair) {
+            if (isScalar(pair.key) && /(^|_)revision$/.test(String(pair.key.value)) && isScalar(pair.value) && typeof pair.value.value !== "string" && pair.value.value !== null) {
+                pair.value.value = pair.value.source ?? String(pair.value.value);
+            }
+        },
+    });
+    return doc.toJS();
+}
 export function manifestPath(areaRoot, id) {
     return join(areaRoot, id, "snapshot.yaml");
 }
@@ -67,7 +83,7 @@ export async function readManifest(areaRoot, id) {
     const p = manifestPath(areaRoot, id);
     if (!(await exists(p)))
         throw new SnapshotError(`no manifest at ${p}`);
-    const raw = parse(await readFile(p, "utf8"));
+    const raw = parseSnapshotYaml(await readFile(p, "utf8"));
     if (raw === null || typeof raw !== "object")
         throw new SnapshotError(`${p}: not a mapping`);
     const problems = [];

package/dist/lib/structure/model.js

@@ -5,6 +5,7 @@
 //   openspec/changes/<change>/structure/none.yaml          a change's typed claim of no structural effect
 // An element is a catalogue row of a `structure` catalogue, keyed by its immutable id. Its revision is the
 // SHA-256 of its canonical JSON, so two readers agree on it without agreeing on anything else.
+import { contractMoves } from "../behaviour-store/archive.js";
 import { createHash } from "node:crypto";
 import { readdir, readFile } from "node:fs/promises";
 import { join } from "node:path";
@@ -193,9 +194,12 @@ export async function loadChangeStructure(repo, change, problems) {
             removed.push({ catalogue: r.catalogue, id: r.id, reason: typeof reason === "string" ? reason : "" });
         }
         for (const k of Object.keys(m)) {
-            if (!["schema_version", "partition", "depends_on", "ADDED", "MODIFIED", "REMOVED", "base"].includes(k))
+            if (!["schema_version", "partition", "depends_on", "ADDED", "MODIFIED", "REMOVED", "base", "moved"].includes(k))
                 problems.push(`${file}: unknown key ${k}`);
         }
+        const moved = contractMoves(m["moved"]);
+        for (const p of moved.problems)
+            problems.push(`${file}: ${p}`);
         deltas.push({
             change,
             partition,
@@ -205,6 +209,7 @@ export async function loadChangeStructure(repo, change, problems) {
             modified: readElements(m["MODIFIED"], `${file}: MODIFIED`, partition, file, problems),
             removed,
             base,
+            ...(moved.moves.length > 0 ? { moved: moved.moves } : {}),
         });
     }
     return { change, deltas, noOp, present: true };

package/dist/lib/structure/removals.js

@@ -0,0 +1,121 @@
+// A removed id against what references it outside the view (M-ADR 0230 §4.3, §4.11 negative proof 1: "a removal
+// against a reference to it"). The view's own references are checked by validateView; these are the rest:
+//   this SDD   its catalogues built from its records, not its model: an archived change's work orders and declared
+//              assertions name repositories, and a row whose target is removed drops from the next build
+//   members    the catalogues of the SDDs its aggregation manifest names, where they are checked out: a member's row
+//              naming the removed id, and no row of its own holding it, dangles in the aggregate
+// A rename is not a removal: ids never change, so a rename keeps the id and modifies the element's name.
+import { access, readFile } from "node:fs/promises";
+import { join } from "node:path";
+import { parseDocument } from "yaml";
+import { loadAggregationManifest, DEFAULT_AGGREGATION_MANIFEST_REL } from "../catalogue/aggregation-manifest-loader.js";
+import { CLI_VERSION } from "../catalogue/cli-version.js";
+import { parseCatalogueCsv } from "../catalogue/csv-reader.js";
+async function exists(p) {
+    try {
+        await access(p);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** A catalogue directory's rows, read once each. */
+function reader(dir) {
+    const cache = new Map();
+    return async (catalogue) => {
+        if (!cache.has(catalogue)) {
+            let rows = null;
+            try {
+                rows = parseCatalogueCsv(await readFile(join(dir, `${catalogue}.csv`), "utf8")).rows;
+            }
+            catch {
+                rows = null;
+            }
+            cache.set(catalogue, rows);
+        }
+        return cache.get(catalogue) ?? null;
+    };
+}
+/** `<catalogue>.<column> (<n>)` for each foreign key into `<target>.id` whose rows name `id`. */
+async function referencesTo(schema, rows, target, id, include) {
+    const out = [];
+    for (const c of schema.catalogues) {
+        if (!include(c.name))
+            continue;
+        for (const fk of c.foreignKeys) {
+            if (fk.references !== `${target}.id`)
+                continue;
+            const rs = await rows(c.name);
+            const n = rs?.filter((r) => r[fk.column] === id).length ?? 0;
+            if (n > 0)
+                out.push(`${c.name}.${fk.column} (${n})`);
+        }
+    }
+    return out;
+}
+/** The aggregation manifest's path: .sdd/sdd-manifest.yaml#aggregation_manifest_path, or the default. */
+async function manifestPath(repo) {
+    try {
+        const m = parseDocument(await readFile(join(repo, ".sdd", "sdd-manifest.yaml"), "utf8")).toJS();
+        if (typeof m?.aggregation_manifest_path === "string" && m.aggregation_manifest_path !== "")
+            return join(repo, m.aggregation_manifest_path);
+    }
+    catch {
+        // the manifest check reports an unparseable manifest
+    }
+    return join(repo, DEFAULT_AGGREGATION_MANIFEST_REL);
+}
+/**
+ * Each open change's removals against their references outside the view. Returns the findings, one per removal with
+ * references, and the lines saying what was not looked at.
+ */
+export async function checkRemovals(repo, schema, structures) {
+    const findings = [];
+    const lines = [];
+    const removals = structures.flatMap((s) => s.deltas.flatMap((d) => d.removed.map((r) => ({ change: s.change, file: d.file, ...r }))));
+    if (removals.length === 0)
+        return { findings, lines };
+    const fromModel = new Set(schema.catalogues.filter((c) => c.sourceOfTruth === "structure").map((c) => c.name));
+    const own = reader(join(repo, "catalogues"));
+    const members = [];
+    const path = await manifestPath(repo);
+    if (await exists(path)) {
+        try {
+            const manifest = await loadAggregationManifest(path, { cliVersion: CLI_VERSION, ecosystemRootPath: repo });
+            const absent = [];
+            for (const s of manifest.siblings) {
+                if (await exists(s.cataloguesPath))
+                    members.push({ sddId: s.sddId, rows: reader(s.cataloguesPath) });
+                else
+                    absent.push(s.sddId);
+            }
+            if (absent.length > 0)
+                lines.push(`removed ids: ${absent.length} of ${manifest.siblings.length} member SDD(s) not checked, no checkout of their catalogues (${absent.join(", ")})`);
+        }
+        catch (e) {
+            lines.push(`removed ids: member SDDs not checked (${String(e.message).split("\n")[0]})`);
+        }
+    }
+    for (const r of removals) {
+        const where = [];
+        const mine = await referencesTo(schema, own, r.catalogue, r.id, (c) => !fromModel.has(c));
+        if (mine.length > 0)
+            where.push(`this SDD's ${mine.join(", ")}`);
+        for (const m of members) {
+            // A member that holds the id itself resolves its references to its own row.
+            if ((await m.rows(r.catalogue))?.some((row) => row.id === r.id))
+                continue;
+            const theirs = await referencesTo(schema, m.rows, r.catalogue, r.id, () => true);
+            if (theirs.length > 0)
+                where.push(`${m.sddId}'s ${theirs.join(", ")}`);
+        }
+        if (where.length === 0)
+            continue;
+        findings.push(`${r.file}: removes ${r.catalogue}/${r.id}, which rows outside the model still reference: ${where.join("; ")}. ` +
+            `A rename keeps the id and modifies the element's name (ids never change, M-ADR 0230 §4.3); a removal needs ` +
+            `those references gone, or each row naming it drops from the next build and dangles in the aggregate`);
+    }
+    return { findings, lines };
+}
+//# sourceMappingURL=removals.js.map

package/dist/lib/validate/behaviour-store.js

@@ -34,13 +34,17 @@
 //                 change was withdrawn or replaced (M-ADR 0222 §4.6).
 //   5. surfaces: every archived baseline's evidence lists, under **Surfaces:**, each contract the
 //                 repositories it was observed in serve, as covered at transport or excluded with a
-//                 reason, and the list is checked against the catalogue (catalogues/repo_contract.csv),
-//                 never against itself (M-ADR 0222 §4.3, §4.4). A list the catalogue gives nothing to
+//                 reason, and the list is checked against the catalogue (catalogues/repo_contract.csv, less
+//                 a contract service_contract records the repository's services consuming and none exposing:
+//                 repo_contract has no direction), never against itself (M-ADR 0222 §4.3, §4.4). A list the catalogue gives nothing to
 //                 check against (no Observed in line, or a repository with no catalogue contracts) fails:
 //                 a cross-check of zero contracts is unresolved, not a pass.
 //                 A baseline whose every requirement has since left the living specs (removed, or its
 //                 spec retired) is history: its list is not checked, so a retired surface can drop its
-//                 contract (M-ADR 0222 §4.4).
+//                 contract (M-ADR 0222 §4.4). A baseline archived where the SDD ships record schema 1.4.0
+//                 or later records its gate's PASS (**Baseline gate:**), so `change archive` refuses one
+//                 that has not passed (M-ADR 0222 §4.3). An open baseline is asked these questions, and
+//                 what it may change and which features key it, as warnings while it can still be fixed.
 //   7. features: every living spec is keyed by a catalogue feature (M-ADR 0221 §4.7). A spec keyed by no
 //                 feature is dropped from the catalogue by the requirements builder, which reports it only as a
 //                 build finding; this check makes it a failure, so a shipped requirement cannot vanish from the
@@ -69,11 +73,11 @@ import { tmpdir } from "node:os";
 import { basename, join } from "node:path";
 import { promisify } from "node:util";
 import { parseDocument } from "yaml";
-import { observedIn, orderArchives, parseRequirements, parseSurfaces, renamedFrom, renamePairs, resolveImplements, surfaceMatches } from "../behaviour-store/archive.js";
+import { contractMoves, observedIn, orderArchives, parseRequirements, parseSurfaces, renamedFrom, renamePairs, resolveImplements, surfaceMatches } from "../behaviour-store/archive.js";
 import { parseCatalogueCsv } from "../catalogue/csv-reader.js";
 import { boundFile, conditionProblems, structuralFile, isCommit, normaliseBound, requirementBlock, sameCommit, scenarioKind, taskGroups, testPlanHeader, testPlanMapping, verdictLine, versionAtLeast } from "./agreement-evidence.js";
 import { ENFORCED as STRUCTURE_ENFORCED } from "./structural-model.js";
-import { compareStoreSchema, SCHEMA_NAME, SHIPPED_SCHEMA_DIR, STORE_CONFIG, STORE_SCHEMA_DIR, storeSchemaName } from "../behaviour-store/schema.js";
+import { BASELINE_SCHEMA_NAME, compareStoreSchema, SCHEMA_NAME, SHIPPED_SCHEMA_DIR, shippedSchemaDir, STORE_CONFIG, STORE_SCHEMA_DIR, storeSchemaDir, storeSchemaName } from "../behaviour-store/schema.js";
 const execFileAsync = promisify(execFile);
 /** The OpenSpec release the method depends on (M-ADR 0223 ruling 2). The module installs exactly this. */
 export const OPENSPEC_VERSION = "1.14.3";
@@ -86,6 +90,8 @@ const COMMIT_RE = /^[0-9a-f]{7,40}$/;
 // OpenSpec counts a task done when its box holds only `x`, either case, any spacing.
 const TASK_DONE_RE = /^\s*-\s*\[\s*[xX]\s*\]/m;
 const TARGET_HEADING_RE = /^##\s+(MODIFIED|REMOVED|RENAMED)\s+Requirements\b/m;
+// A tasks.md group headed by one word, `## <n>. <word>`, is that repository's work order (taskGroups).
+const GROUP_REPO = (repo) => `tasks.md has a work order for ${repo} and the record's work_orders do not; its evidence cannot be checked (a group heading of one word, \`## <n>. ${repo}\`, names the group's repository)`;
 async function exists(p) {
     try {
         await access(p);
@@ -516,6 +522,14 @@ export async function checkBehaviourStore(repo, options = {}) {
                 }
             }
         }
+        // The archive check reads a task group's repository from its heading; once the record declares work orders, a
+        // heading it would read as a repository the record lacks fails here, while the change can still be amended.
+        if (versionAtLeast(record?.schemaVersion, "1.1.0") && record?.status === "agreed" && record.workOrders.length > 0 && tasks !== null) {
+            const recorded = new Set(record.workOrders.map((w) => w.repo));
+            for (const g of taskGroups(tasks))
+                if (!recorded.has(g.repo))
+                    failures.push(`${record.file}: ${GROUP_REPO(g.repo)}`);
+        }
         // A test plan's kinds (M-ADR 0223 §4.4 as amended): changed and repaired scenarios go red then green, carried ones stay green.
         if (versionAtLeast(record?.schemaVersion, "1.1.0") && record?.status === "agreed") {
             const plan = await readText(join(repo, dir, "test-plan.md"));
@@ -717,7 +731,7 @@ export async function checkBehaviourStore(repo, options = {}) {
         const recorded = new Set(record.workOrders.map((w) => w.repo));
         for (const g of groups)
             if (!recorded.has(g.repo))
-                failures.push(`${record.file}: tasks.md has a work order for ${g.repo} and the record's work_orders do not; its evidence cannot be checked`);
+                failures.push(`${record.file}: ${GROUP_REPO(g.repo)}`);
         // Requirement names are unique within a feature, not across a change: a work order names `<feature>::<name>`,
         // or a bare name only one feature in the change has (schema 5.0.0). An ambiguous bare name implements nothing.
         const built = [];
@@ -818,8 +832,107 @@ export async function checkBehaviourStore(repo, options = {}) {
     }
     const orderDecides = (name, key) => [...(peers.get(name) ?? [])].some((p) => p !== name && touches.get(p)?.has(key));
     let scopeUnresolved = 0;
-    const servedBy = baselines > 0 ? await catalogueContracts(repo) : null;
+    const openBaselines = [];
+    for (const change of open)
+        if (await exists(join(repo, STORE_DIR, "changes", change, "baseline-evidence.md")))
+            openBaselines.push(change);
+    const servedBy = baselines + openBaselines.length > 0 ? await catalogueContracts(repo) : null;
     let surfacesChecked = 0;
+    // The contract moves each archived change records, in archive order. A contract's id derives from its path, so a
+    // move changes it; an archived baseline's list names the contract as it was, and is resolved through the moves
+    // archived after it rather than edited (M-ADR 0222 §4.4). A surface that vanished with no move still fails.
+    const movesAt = [];
+    for (const name of order) {
+        const found = [];
+        let names = [];
+        try {
+            names = (await readdir(join(repo, archiveRel, name, "structure"))).filter((f) => f.endsWith(".yaml")).sort();
+        }
+        catch {
+            names = [];
+        }
+        for (const f of names) {
+            try {
+                found.push(...contractMoves(parseDocument((await readText(join(repo, archiveRel, name, "structure", f))) ?? "").toJS()?.["moved"]).moves);
+            }
+            catch {
+                // the structural-model check reports an unreadable delta
+            }
+        }
+        movesAt.push(found);
+    }
+    // An open change's moves count too, after every archive: the catalogue it is built with already holds the new
+    // identity, so the lists that named the old one follow the move while it is open, not only once it archives.
+    const openMoves = [];
+    for (const change of open) {
+        let names = [];
+        try {
+            names = (await readdir(join(repo, STORE_DIR, "changes", change, "structure"))).filter((f) => f.endsWith(".yaml")).sort();
+        }
+        catch {
+            names = [];
+        }
+        for (const f of names) {
+            try {
+                openMoves.push(...contractMoves(parseDocument((await readText(join(repo, STORE_DIR, "changes", change, "structure", f))) ?? "").toJS()?.["moved"]).moves);
+            }
+            catch {
+                // the structural-model check reports an unreadable delta
+            }
+        }
+    }
+    /** The identities a contract had before the moves archived after position `after` (-1: every archived move). */
+    const formerIdentities = (id, after) => {
+        const back = new Map();
+        for (const m of [...movesAt.slice(after + 1).flat(), ...openMoves])
+            back.set(m.to, [...(back.get(m.to) ?? []), m]);
+        const out = [];
+        const seen = new Set([id]);
+        const queue = [id];
+        while (queue.length > 0) {
+            for (const m of back.get(queue.shift()) ?? []) {
+                if (seen.has(m.from))
+                    continue;
+                seen.add(m.from);
+                out.push({ id: m.from, path: m.fromPath ?? "" });
+                queue.push(m.from);
+            }
+        }
+        return out;
+    };
+    /** What is wrong with a baseline's Surfaces list against the catalogue (M-ADR 0222 §4.3, §4.4). */
+    const surfaceProblems = async (dir, evidence, after = -1) => {
+        const out = [];
+        const parsed = parseSurfaces(evidence);
+        if (!parsed.present)
+            out.push(`${dir}/baseline-evidence.md: no **Surfaces:** list; name every contract the observed repositories serve, covered at transport or excluded with a reason`);
+        for (const p of parsed.problems)
+            out.push(`${dir}/baseline-evidence.md: Surfaces: ${p}`);
+        if (!parsed.present)
+            return out;
+        if (servedBy === null) {
+            out.push(`${dir}/baseline-evidence.md: Surfaces cannot be cross-checked: catalogues/repo_contract.csv or catalogues/contracts.csv is missing; build the catalogue`);
+            return out;
+        }
+        const repos = observedIn(evidence);
+        if (repos.length === 0)
+            out.push(`${dir}/baseline-evidence.md: Surfaces cannot be cross-checked: no **Observed in:** line names a repository`);
+        for (const r of repos) {
+            const known = servedBy.get(r);
+            if ((known?.served ?? []).length === 0) {
+                const consumed = known?.consumed ? ` (it consumes ${known.consumed}, which a baseline does not list)` : "";
+                out.push(`${dir}/baseline-evidence.md: Surfaces cannot be cross-checked: the catalogue records no contract that ${r} serves${consumed}; declare the contracts it serves in its repo-config`);
+            }
+            for (const c of known?.served ?? []) {
+                surfacesChecked++;
+                const former = formerIdentities(c.id, after);
+                if (!parsed.entries.some((e) => surfaceMatches(e.contract, c.id, c.specPath) || former.some((f) => surfaceMatches(e.contract, f.id, f.path)))) {
+                    out.push(`${dir}/baseline-evidence.md: Surfaces does not list ${c.specPath || c.id} (${c.id}), which ${r} serves (catalogues/repo_contract.csv, less what service_contract records it only consuming); list it as covered at transport or excluded with a reason`);
+                }
+            }
+        }
+        return out;
+    };
     // A baseline whose every requirement has since left the living specs (removed, or its spec retired) records a
     // surface that no longer exists; its Surfaces list is history, not checked against today's catalogue, or a
     // retired surface could never drop its contract.
@@ -831,33 +944,23 @@ export async function checkBehaviourStore(repo, options = {}) {
         const evidence = await readText(join(repo, dir, "baseline-evidence.md"));
         const isBaseline = evidence !== null;
         if (isBaseline) {
-            const parsed = parseSurfaces(evidence);
-            if (!parsed.present)
-                failures.push(`${dir}/baseline-evidence.md: no **Surfaces:** list; name every contract the observed repositories serve, covered at transport or excluded with a reason`);
-            for (const p of parsed.problems)
-                failures.push(`${dir}/baseline-evidence.md: Surfaces: ${p}`);
-            if (parsed.present && historical.has(name)) {
-                // history: see historicalBaselines
+            if (historical.has(name)) {
+                // history: see historicalBaselines; its gate and Surfaces list are not checked
+                const parsed = parseSurfaces(evidence);
+                if (!parsed.present)
+                    failures.push(`${dir}/baseline-evidence.md: no **Surfaces:** list; name every contract the observed repositories serve, covered at transport or excluded with a reason`);
+                for (const p of parsed.problems)
+                    failures.push(`${dir}/baseline-evidence.md: Surfaces: ${p}`);
             }
-            else if (parsed.present) {
-                if (servedBy === null) {
-                    failures.push(`${dir}/baseline-evidence.md: Surfaces cannot be cross-checked: catalogues/repo_contract.csv or catalogues/contracts.csv is missing; build the catalogue`);
-                }
-                else {
-                    const repos = observedIn(evidence);
-                    if (repos.length === 0)
-                        failures.push(`${dir}/baseline-evidence.md: Surfaces cannot be cross-checked: no **Observed in:** line names a repository`);
-                    for (const r of repos) {
-                        if ((servedBy.get(r) ?? []).length === 0) {
-                            failures.push(`${dir}/baseline-evidence.md: Surfaces cannot be cross-checked: catalogues/repo_contract.csv records no contract for ${r}; declare the contracts it serves in its repo-config`);
-                        }
-                        for (const c of servedBy.get(r) ?? []) {
-                            surfacesChecked++;
-                            if (!parsed.entries.some((e) => surfaceMatches(e.contract, c.id, c.specPath))) {
-                                failures.push(`${dir}/baseline-evidence.md: Surfaces does not list ${c.specPath || c.id} (${c.id}), which ${r} serves (catalogues/repo_contract.csv); list it as covered at transport or excluded with a reason`);
-                            }
-                        }
-                    }
+            else {
+                failures.push(...(await surfaceProblems(dir, evidence, order.indexOf(name))));
+                // The gate's outcome is recorded where the SDD ships record schema 1.4.0 or later when the baseline archives;
+                // a baseline archived earlier carries none and is not held to it.
+                const archivedAt = await integratedAt(repo, dir);
+                if (versionAtLeast(await shippedRecordSchema(repo, archivedAt), "1.4.0")) {
+                    const gate = baselineGate(evidence);
+                    if (gate !== "PASS")
+                        failures.push(`${dir}/baseline-evidence.md: archived ${gate === null ? "with no **Baseline gate:** line" : `with **Baseline gate:** ${gate}`}; a baseline archives once its gate passes: every requirement cites its evidence, characterization tests exist where the code has none, and every covered surface is evidenced at its transport (M-ADR 0222 §4.3)`);
                 }
             }
         }
@@ -892,8 +995,34 @@ export async function checkBehaviourStore(repo, options = {}) {
                 lastTouch.delete(`${feature}::${from}`);
         }
     }
-    const unseen = servedBy === null ? "" : `; repositories with no catalogue contracts: ${[...new Set(await observedInAll(repo, archiveRel, order))].filter((r) => (servedBy.get(r) ?? []).length === 0).join(", ") || "none"}`;
-    lines.push(baselines === 0 ? "surfaces: vacuous (no baseline)" : `surfaces: ${baselines} baseline(s), ${surfacesChecked} served contract(s) checked against catalogues/repo_contract.csv${unseen}${historical.size ? `; ${historical.size} historical baseline(s) not checked (every requirement they baselined has left the living specs)` : ""}`);
+    // An open baseline is asked the archive's questions while it can still be fixed: its Surfaces list, what it may
+    // change given the lineage so far, the features its deltas are keyed by, and its gate. Warnings, since it is in
+    // progress; `change archive` refuses what is still wrong when it archives.
+    const featureIds = await readText(join(repo, "catalogues", "features.csv")).then((t) => (t === null ? null : new Set(parseCatalogueCsv(t).rows.map((r) => r["id"] ?? ""))));
+    for (const change of openBaselines) {
+        const dir = `${STORE_DIR}/changes/${change}`;
+        const evidence = (await readText(join(repo, dir, "baseline-evidence.md"))) ?? "";
+        const found = [...(await surfaceProblems(dir, evidence))];
+        for (const feature of await dirs(join(repo, dir, "specs"))) {
+            if (featureIds !== null && !featureIds.has(feature))
+                found.push(`${dir}/specs/${feature}: no catalogue feature has the id "${feature}"; give the behaviour a feature first (M-ADR 0222 §4.4)`);
+            const text = (await readText(join(repo, dir, "specs", feature, "spec.md"))) ?? "";
+            for (const target of [...parseRequirements(text).filter((r) => r.operation === "MODIFIED" || r.operation === "REMOVED").map((r) => r.name), ...renamedFrom(text)]) {
+                scopeChecked++;
+                const last = lastTouch.get(`${feature}::${target}`);
+                if (last !== "baseline")
+                    found.push(`${dir}: a baseline changes "${target}" (${feature}), which ${last === "change" ? "a judged change last shipped" : "no earlier archived change admitted"}; a baseline may remove or modify only what a baseline admitted (M-ADR 0222 §4.4)`);
+            }
+        }
+        const gate = baselineGate(evidence);
+        if (gate !== "PASS")
+            found.push(`${dir}/baseline-evidence.md: ${gate === null ? "no **Baseline gate:** line yet" : `**Baseline gate:** ${gate}`}; it archives once the gate passes (M-ADR 0222 §4.3)`);
+        warnings.push(...found.map((w) => `open baseline: ${w}`));
+    }
+    if (openBaselines.length > 0)
+        lines.push(`open baselines: ${openBaselines.length}, asked the archive's questions as warnings`);
+    const unseen = servedBy === null ? "" : `; repositories with no catalogue contracts: ${[...new Set(await observedInAll(repo, archiveRel, order))].filter((r) => (servedBy.get(r)?.served ?? []).length === 0).join(", ") || "none"}`;
+    lines.push(baselines === 0 ? "surfaces: vacuous (no baseline)" : `surfaces: ${baselines} baseline(s), ${surfacesChecked} served contract(s) checked against catalogues/repo_contract.csv less what service_contract records only consumed${unseen}${historical.size ? `; ${historical.size} historical baseline(s) not checked (every requirement they baselined has left the living specs)` : ""}`);
     lines.push(scopeChecked === 0 ? "scope: vacuous (no baseline removes, modifies or renames a requirement)" : `scope: ${scopeChecked} requirement(s) a baseline removes, modifies or renames, checked against their lineage`);
     if (!history && archived.length > 0)
         lines.push("order: no git history (not a git work tree, or git log failed), so same-day archives cannot be ordered");
@@ -944,6 +1073,29 @@ export async function checkBehaviourStore(repo, options = {}) {
             lines.push(drift === 0 ? `schema: ${SCHEMA_NAME}, identical to the shipped copy` : `schema: ${SCHEMA_NAME}, ${drift} file(s) differ from the shipped copy`);
         }
     }
+    // The baseline schema: checked as sdd-change is where the bundle ships it (a bundle from before it shipped has none),
+    // and an open baseline selects it rather than sdd-change, whose Gate 0, test plan and agreement a baseline lacks.
+    if (selected === SCHEMA_NAME) {
+        const b = await compareStoreSchema(repo, BASELINE_SCHEMA_NAME);
+        if (b.shipped) {
+            const fix = "sdd-cli sync refreshes it; put adopter guidance in the store's config.yaml rules, not in the schema";
+            for (const f of b.missing)
+                failures.push(`${storeSchemaDir(BASELINE_SCHEMA_NAME)}/${f}: missing from the store's copy of the schema; ${fix}`);
+            for (const f of b.differing)
+                failures.push(`${storeSchemaDir(BASELINE_SCHEMA_NAME)}/${f}: differs from the shipped ${shippedSchemaDir(BASELINE_SCHEMA_NAME)}/${f}; ${fix}`);
+            for (const f of b.extra)
+                failures.push(`${storeSchemaDir(BASELINE_SCHEMA_NAME)}/${f}: not in the shipped schema; ${fix}`);
+            const drift = b.missing.length + b.differing.length + b.extra.length;
+            lines.push(drift === 0 ? `schema: ${BASELINE_SCHEMA_NAME}, identical to the shipped copy` : `schema: ${BASELINE_SCHEMA_NAME}, ${drift} file(s) differ from the shipped copy`);
+            for (const change of openBaselines) {
+                const meta = await readText(join(repo, STORE_DIR, "changes", change, ".openspec.yaml"));
+                const chosen = meta === null ? null : parseDocument(meta).toJS()?.schema;
+                if (chosen !== BASELINE_SCHEMA_NAME) {
+                    warnings.push(`open baseline: ${STORE_DIR}/changes/${change}/.openspec.yaml selects ${chosen === null || chosen === undefined ? "no schema" : `"${String(chosen)}"`}; a baseline selects ${BASELINE_SCHEMA_NAME} (schema: ${BASELINE_SCHEMA_NAME}), whose artifacts are a baseline's rather than a change's Gate 0, test plan and agreement`);
+                }
+            }
+        }
+    }
     const population = recordFiles.length + open.length + archived.length;
     const body = lines.map((l) => `  ${l}`).join("\n") + "\n";
     if (failures.length > 0) {
@@ -1002,25 +1154,47 @@ async function historicalBaselines(repo, archiveRel, order) {
     });
     return out;
 }
-/** Per repository, the contracts the catalogue says it serves (repo_contract ⋈ contracts.spec_path); null when either file is missing. */
+/**
+ * Per repository, the contracts the catalogue says it serves, with how many it only consumes; null when repo_contract or
+ * contracts is missing. repo_contract binds a repository to a contract in either direction, so a row is dropped where
+ * service_contract records the repository's services consuming that contract and none exposing it. Rows
+ * service_contract says nothing about stay: a model that omits a service's exposes rows does not shrink what is checked.
+ */
 async function catalogueContracts(repo) {
     const rc = await readText(join(repo, "catalogues", "repo_contract.csv"));
     const cs = await readText(join(repo, "catalogues", "contracts.csv"));
     if (rc === null || cs === null)
         return null;
     const spec = new Map(parseCatalogueCsv(cs).rows.map((r) => [r["id"] ?? "", r["spec_path"] ?? ""]));
+    const repoOf = new Map(parseCatalogueCsv((await readText(join(repo, "catalogues", "services.csv"))) ?? "").rows.map((r) => [r["id"] ?? "", r["primary_repo_id"] ?? ""]));
+    const roles = new Map();
+    for (const r of parseCatalogueCsv((await readText(join(repo, "catalogues", "service_contract.csv"))) ?? "").rows) {
+        const key = `${repoOf.get(r["service_id"] ?? "") ?? ""}\u0000${r["contract_id"] ?? ""}`;
+        roles.set(key, (roles.get(key) ?? new Set()).add(r["role"] ?? ""));
+    }
     const out = new Map();
     for (const r of parseCatalogueCsv(rc).rows) {
         const repoId = r["repo_id"] ?? "";
         const id = r["contract_id"] ?? "";
         if (repoId === "" || id === "")
             continue;
-        const list = out.get(repoId) ?? [];
-        list.push({ id, specPath: spec.get(id) ?? "" });
-        out.set(repoId, list);
+        const entry = out.get(repoId) ?? { served: [], consumed: 0 };
+        const role = roles.get(`${repoId}\u0000${id}`);
+        if (role?.has("consumes") && !role.has("exposes"))
+            entry.consumed++;
+        else
+            entry.served.push({ id, specPath: spec.get(id) ?? "" });
+        out.set(repoId, entry);
     }
     return out;
 }
+/** A baseline's recorded gate outcome: the last `**Baseline gate:** <outcome>` line's first word, upper-cased; null when there is none. */
+function baselineGate(evidence) {
+    let out = null;
+    for (const m of evidence.matchAll(/^\s*\*\*Baseline gate:\*\*\s*(\S+)/gm))
+        out = m[1].replace(/[^A-Za-z]/g, "").toUpperCase();
+    return out;
+}
 async function observedInAll(repo, archiveRel, names) {
     const out = [];
     for (const n of names) {

package/dist/lib/validate/structural-model.js

@@ -20,6 +20,9 @@
 //               element another open change adds names that change in depends_on
 //   no-op       contradicted by a behaviour delta for a feature the model does not hold; a structural delta
 //               must add that feature
+//   removals    each id a delta removes, against the rows outside the model that still name it: this SDD's catalogues
+//               built from its records and its members' catalogues (lib/structure/removals.ts). Reported as [WARN],
+//               not counted as a finding: a removal may be meant, and the warning names what it owes before the push
 // Composition (§4.5; lib/structure/compose.ts), with a change agreed when its agreement record says so:
 //   overlap     two agreed changes writing one element or adding one id; a change overlapping an agreed one
 //   composed    each change's view (with its dependency closure) and the intended view (every agreed change)
@@ -44,6 +47,7 @@ import { agreedOrder, attribute, checkDependencies, checkOverlap, closure, inten
 import { describeState, renderViews, VIEW_PATHS, viewState } from "../structure/render.js";
 import { Additions, CONTRACTS, readAgreement } from "../structure/intended.js";
 import { validateDeltas, validateView, viewOf } from "../structure/view.js";
+import { checkRemovals } from "../structure/removals.js";
 const VIEW_COUNT = Object.keys(VIEW_PATHS).length;
 /** Findings FAIL (from M-ADR 0230's acceptance); false reports them only, as while M-ADR 0230 was Proposed. Also binds a change's structural deltas as agreed content in the behaviour-store check. */
 export const ENFORCED = true;
@@ -222,6 +226,8 @@ export async function checkStructuralModel(repo, options = {}) {
         }
     }
     lines.push(`changes: ${changes.length} open, ${withDeltas} with structural deltas, ${noOps} claiming none, ${without} without the artifact`);
+    const removals = await checkRemovals(repo, schema, structures);
+    lines.push(...removals.lines);
     // Composition (M-ADR 0230 §4.5): the three views and the three checks.
     const archived = await archivedNames(repo);
     checkOverlap(open, problems);
@@ -268,7 +274,7 @@ export async function checkStructuralModel(repo, options = {}) {
     if (raw > 0)
         lines.push(`archived changes whose structure is not applied: ${raw}`);
     lines.push(`views: current; at each of ${[...open.values()].filter((o) => o.structure.deltas.length > 0).length} change(s) with deltas; intended from ${agreed.length} agreed change(s)`);
-    const body = lines.map((l) => `${l}\n`).join("");
+    const body = lines.map((l) => `${l}\n`).join("") + removals.findings.map((w) => `[WARN] ${w}\n`).join("");
     if (problems.length === 0)
         return { exitCode: 0, stdout: `structural-model:\n${body}[PASS] structural-model: ok\n` };
     const tag = enforced ? "FAIL" : "WARN";

package/dist/maintain-version.json

@@ -1,4 +1,4 @@
 {
-  "version": "0.16.0",
-  "built_against_sdd_cli": "5.2.0"
+  "version": "0.17.0",
+  "built_against_sdd_cli": "5.3.0"
 }

package/dist/verify-version.json

@@ -1,4 +1,4 @@
 {
-  "version": "5.2.0",
-  "built_against_sdd_cli": "5.2.0"
+  "version": "5.3.0",
+  "built_against_sdd_cli": "5.3.0"
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@sdd-method/author-cli",
-  "version": "0.15.0",
-  "sddCliVersion": "5.2.0",
+  "version": "0.16.0",
+  "sddCliVersion": "5.3.0",
   "description": "Re-author one SDD's content — scaffold, plan, contracts, conformance, api-surface, snapshots, briefings, catalogue check — plus every read-only verify verb. Ships only the code those verbs reach; it cannot sync the baseline or rebuild the catalogues. Maintenance is in @sdd-method/maintain-cli, administration in @sdd-method/sdd-cli.",
   "license": "UNLICENSED",
   "type": "module",