@sdd-method/author-cli 0.15.1 → 0.16.1

package/dist/lib/snapshot/advance.js

@@ -29,7 +29,7 @@ import { parse, parseDocument, stringify } from "yaml";
 // unrelated churn in lines the tool had no business touching.
 import { deltaPath } from "./diff.js";
 import { loadCanonicalSchema } from "../catalogue/schema-loader.js";
-import { SnapshotError, credentialNotice, exists, isIsoDate, readManifest, splitFolder, } from "./manifest.js";
+import { SnapshotError, credentialNotice, exists, isIsoDate, parseSnapshotYaml, readManifest, splitFolder, } from "./manifest.js";
 export const REVERSE_STATUSES = ["classified", "reversed"];
 export const IMPACTS = ["none", "repo-minor", "repo-major", "product-major"];
 /**
@@ -179,7 +179,7 @@ export async function advance(inputs, write) {
     if (!(await exists(dp))) {
         throw new SnapshotError(`no ${dp}: the pin advances after the delta is recorded (run snapshot diff, then classify)`);
     }
-    const delta = parse(await readFile(dp, "utf8"));
+    const delta = parseSnapshotYaml(await readFile(dp, "utf8"));
     const provenance = delta.t0_provenance?.result;
     const provenanceNote = provenance ? ` T0 provenance: ${provenance}${delta.t0_provenance?.waiver?.who ? ` (waiver: ${delta.t0_provenance.waiver.who})` : ""}.` : "";
     if (provenance && !/^pass$/.test(provenance)) {
@@ -215,8 +215,8 @@ export async function advance(inputs, write) {
         const hFile = join(dir, "reverse-history.yaml");
         const mFile = join(dir, "reverse-metadata.yaml");
         const metadataText = await readFile(mFile, "utf8");
-        const metadata = parse(metadataText);
-        let history = (await exists(hFile)) ? parse(await readFile(hFile, "utf8")) : { canonical_repo_key: key, history: [] };
+        const metadata = parseSnapshotYaml(metadataText);
+        let history = (await exists(hFile)) ? parseSnapshotYaml(await readFile(hFile, "utf8")) : { canonical_repo_key: key, history: [] };
         let migrated = false;
         if (Array.isArray(history.entries)) {
             if (!inputs.migrateHistory) {
@@ -315,6 +315,14 @@ export async function advance(inputs, write) {
         }
         // A classification is one of the bound vocabulary (M-ADR 0214 §4.5), read from the
         // schema rather than restated here: a typo is not a classification.
+        // Both effects are stated, `none` or the baseline change that carries it (delta-reverse.md §7): a refresh that
+        // changed nothing must read differently from one nobody checked.
+        const silent = mine
+            .filter((f) => f.classification !== null && f.classification !== undefined)
+            .flatMap((f) => ["structural_effect", "behavioural_effect"].filter((k) => typeof f[k] !== "string" || f[k].trim() === "").map((k) => `${f.id} ${k}`));
+        if (silent.length > 0) {
+            problems.push(`${key}: ${silent.join(", ")} not stated — each classified finding says none, or names the baseline change that carries it (delta-reverse.md §7)`);
+        }
         const outOfVocabulary = mine.filter((f) => !dispositions.has(String(f.classification)));
         if (outOfVocabulary.length > 0) {
             problems.push(`${key}: ${outOfVocabulary.map((f) => `${f.id} '${String(f.classification)}'`).join(", ")} — not a delta_disposition (${[...dispositions].join(", ")}; M-ADR 0214 §4.5)`);
@@ -371,7 +379,7 @@ export async function advance(inputs, write) {
         else {
             await writeFile(hFile, appendHistoryEntry(await readFile(hFile, "utf8"), p.entry));
         }
-        const after = parse(await readFile(hFile, "utf8")).history;
+        const after = parseSnapshotYaml(await readFile(hFile, "utf8")).history;
         if (after.length !== before.length + 1 || !isDeepStrictEqual(after.slice(0, before.length), before)) {
             throw new Error(`${hFile}: post-write check failed — prior entries changed or not exactly one appended`);
         }

package/dist/lib/snapshot/fold.js

@@ -15,9 +15,9 @@
 // (`support-repo` → `ancillary`, delta-reverse.md §1) and left unset otherwise.
 import { mkdir, readdir, readFile, rename, stat, writeFile } from "node:fs/promises";
 import { join, relative, sep } from "node:path";
-import { parse, stringify } from "yaml";
+import { stringify } from "yaml";
 import { setTopLevelScalars } from "./advance.js";
-import { SnapshotError, baselineIds, deriveKey, knownRepositoryIds, exists, isIsoDate, manifestPath, memberFolders, splitFolder, } from "./manifest.js";
+import { SnapshotError, baselineIds, deriveKey, knownRepositoryIds, exists, isIsoDate, manifestPath, memberFolders, parseSnapshotYaml, splitFolder, } from "./manifest.js";
 const ROLE_BY_PROFILE = { "support-repo": "ancillary" };
 /** The same mapping by M-ADR 0213's scope, which replaces the per-repo profile: a support repo is ancillary. */
 const ROLE_BY_SCOPE = { support: "ancillary" };
@@ -32,7 +32,7 @@ async function pinsByFolder(sddPath) {
         if (!e.isDirectory() || !(await exists(file)))
             continue;
         const text = await readFile(file, "utf8");
-        const meta = (parse(text) ?? {});
+        const meta = (parseSnapshotYaml(text) ?? {});
         const folder = String(meta.source_path ?? "").split("/").pop() || String(meta.exported_folder_name ?? "");
         if (folder)
             out.set(folder, { file, text, meta });

package/dist/lib/snapshot/manifest.js

@@ -9,7 +9,7 @@
 import { createHash } from "node:crypto";
 import { readdir, readFile, stat } from "node:fs/promises";
 import { join, relative, sep } from "node:path";
-import { parse } from "yaml";
+import { isScalar, parseDocument, visit } from "yaml";
 /** The line every later verb prints while a baseline carries unresolved credential findings. */
 export function credentialNotice(m) {
     const s = m.credential_scan;
@@ -60,6 +60,22 @@ export async function exists(p) {
         return false;
     }
 }
+/**
+ * Parse snapshot YAML with every `*revision` value read as the text written. A revision is an identifier, and YAML
+ * 1.2 reads an unquoted all-digit one as an integer: `08985180587` became 8985180587, losing the leading zero,
+ * so a pin no longer matched its folder's `@<rev>`. Writers quote such a value; this covers files written by hand.
+ */
+export function parseSnapshotYaml(text) {
+    const doc = parseDocument(text);
+    visit(doc, {
+        Pair(_, pair) {
+            if (isScalar(pair.key) && /(^|_)revision$/.test(String(pair.key.value)) && isScalar(pair.value) && typeof pair.value.value !== "string" && pair.value.value !== null) {
+                pair.value.value = pair.value.source ?? String(pair.value.value);
+            }
+        },
+    });
+    return doc.toJS();
+}
 export function manifestPath(areaRoot, id) {
     return join(areaRoot, id, "snapshot.yaml");
 }
@@ -67,7 +83,7 @@ export async function readManifest(areaRoot, id) {
     const p = manifestPath(areaRoot, id);
     if (!(await exists(p)))
         throw new SnapshotError(`no manifest at ${p}`);
-    const raw = parse(await readFile(p, "utf8"));
+    const raw = parseSnapshotYaml(await readFile(p, "utf8"));
     if (raw === null || typeof raw !== "object")
         throw new SnapshotError(`${p}: not a mapping`);
     const problems = [];

package/dist/lib/structure/model.js

@@ -5,6 +5,7 @@
 //   openspec/changes/<change>/structure/none.yaml          a change's typed claim of no structural effect
 // An element is a catalogue row of a `structure` catalogue, keyed by its immutable id. Its revision is the
 // SHA-256 of its canonical JSON, so two readers agree on it without agreeing on anything else.
+import { contractMoves } from "../behaviour-store/archive.js";
 import { createHash } from "node:crypto";
 import { readdir, readFile } from "node:fs/promises";
 import { join } from "node:path";
@@ -193,9 +194,12 @@ export async function loadChangeStructure(repo, change, problems) {
             removed.push({ catalogue: r.catalogue, id: r.id, reason: typeof reason === "string" ? reason : "" });
         }
         for (const k of Object.keys(m)) {
-            if (!["schema_version", "partition", "depends_on", "ADDED", "MODIFIED", "REMOVED", "base"].includes(k))
+            if (!["schema_version", "partition", "depends_on", "ADDED", "MODIFIED", "REMOVED", "base", "moved"].includes(k))
                 problems.push(`${file}: unknown key ${k}`);
         }
+        const moved = contractMoves(m["moved"]);
+        for (const p of moved.problems)
+            problems.push(`${file}: ${p}`);
         deltas.push({
             change,
             partition,
@@ -205,6 +209,7 @@ export async function loadChangeStructure(repo, change, problems) {
             modified: readElements(m["MODIFIED"], `${file}: MODIFIED`, partition, file, problems),
             removed,
             base,
+            ...(moved.moves.length > 0 ? { moved: moved.moves } : {}),
         });
     }
     return { change, deltas, noOp, present: true };

package/dist/lib/structure/removals.js

@@ -0,0 +1,121 @@
+// A removed id against what references it outside the view (M-ADR 0230 §4.3, §4.11 negative proof 1: "a removal
+// against a reference to it"). The view's own references are checked by validateView; these are the rest:
+//   this SDD   its catalogues built from its records, not its model: an archived change's work orders and declared
+//              assertions name repositories, and a row whose target is removed drops from the next build
+//   members    the catalogues of the SDDs its aggregation manifest names, where they are checked out: a member's row
+//              naming the removed id, and no row of its own holding it, dangles in the aggregate
+// A rename is not a removal: ids never change, so a rename keeps the id and modifies the element's name.
+import { access, readFile } from "node:fs/promises";
+import { join } from "node:path";
+import { parseDocument } from "yaml";
+import { loadAggregationManifest, DEFAULT_AGGREGATION_MANIFEST_REL } from "../catalogue/aggregation-manifest-loader.js";
+import { CLI_VERSION } from "../catalogue/cli-version.js";
+import { parseCatalogueCsv } from "../catalogue/csv-reader.js";
+async function exists(p) {
+    try {
+        await access(p);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** A catalogue directory's rows, read once each. */
+function reader(dir) {
+    const cache = new Map();
+    return async (catalogue) => {
+        if (!cache.has(catalogue)) {
+            let rows = null;
+            try {
+                rows = parseCatalogueCsv(await readFile(join(dir, `${catalogue}.csv`), "utf8")).rows;
+            }
+            catch {
+                rows = null;
+            }
+            cache.set(catalogue, rows);
+        }
+        return cache.get(catalogue) ?? null;
+    };
+}
+/** `<catalogue>.<column> (<n>)` for each foreign key into `<target>.id` whose rows name `id`. */
+async function referencesTo(schema, rows, target, id, include) {
+    const out = [];
+    for (const c of schema.catalogues) {
+        if (!include(c.name))
+            continue;
+        for (const fk of c.foreignKeys) {
+            if (fk.references !== `${target}.id`)
+                continue;
+            const rs = await rows(c.name);
+            const n = rs?.filter((r) => r[fk.column] === id).length ?? 0;
+            if (n > 0)
+                out.push(`${c.name}.${fk.column} (${n})`);
+        }
+    }
+    return out;
+}
+/** The aggregation manifest's path: .sdd/sdd-manifest.yaml#aggregation_manifest_path, or the default. */
+async function manifestPath(repo) {
+    try {
+        const m = parseDocument(await readFile(join(repo, ".sdd", "sdd-manifest.yaml"), "utf8")).toJS();
+        if (typeof m?.aggregation_manifest_path === "string" && m.aggregation_manifest_path !== "")
+            return join(repo, m.aggregation_manifest_path);
+    }
+    catch {
+        // the manifest check reports an unparseable manifest
+    }
+    return join(repo, DEFAULT_AGGREGATION_MANIFEST_REL);
+}
+/**
+ * Each open change's removals against their references outside the view. Returns the findings, one per removal with
+ * references, and the lines saying what was not looked at.
+ */
+export async function checkRemovals(repo, schema, structures) {
+    const findings = [];
+    const lines = [];
+    const removals = structures.flatMap((s) => s.deltas.flatMap((d) => d.removed.map((r) => ({ change: s.change, file: d.file, ...r }))));
+    if (removals.length === 0)
+        return { findings, lines };
+    const fromModel = new Set(schema.catalogues.filter((c) => c.sourceOfTruth === "structure").map((c) => c.name));
+    const own = reader(join(repo, "catalogues"));
+    const members = [];
+    const path = await manifestPath(repo);
+    if (await exists(path)) {
+        try {
+            const manifest = await loadAggregationManifest(path, { cliVersion: CLI_VERSION, ecosystemRootPath: repo });
+            const absent = [];
+            for (const s of manifest.siblings) {
+                if (await exists(s.cataloguesPath))
+                    members.push({ sddId: s.sddId, rows: reader(s.cataloguesPath) });
+                else
+                    absent.push(s.sddId);
+            }
+            if (absent.length > 0)
+                lines.push(`removed ids: ${absent.length} of ${manifest.siblings.length} member SDD(s) not checked, no checkout of their catalogues (${absent.join(", ")})`);
+        }
+        catch (e) {
+            lines.push(`removed ids: member SDDs not checked (${String(e.message).split("\n")[0]})`);
+        }
+    }
+    for (const r of removals) {
+        const where = [];
+        const mine = await referencesTo(schema, own, r.catalogue, r.id, (c) => !fromModel.has(c));
+        if (mine.length > 0)
+            where.push(`this SDD's ${mine.join(", ")}`);
+        for (const m of members) {
+            // A member that holds the id itself resolves its references to its own row.
+            if ((await m.rows(r.catalogue))?.some((row) => row.id === r.id))
+                continue;
+            const theirs = await referencesTo(schema, m.rows, r.catalogue, r.id, () => true);
+            if (theirs.length > 0)
+                where.push(`${m.sddId}'s ${theirs.join(", ")}`);
+        }
+        if (where.length === 0)
+            continue;
+        findings.push(`${r.file}: removes ${r.catalogue}/${r.id}, which rows outside the model still reference: ${where.join("; ")}. ` +
+            `A rename keeps the id and modifies the element's name (ids never change, M-ADR 0230 §4.3); a removal needs ` +
+            `those references gone, or each row naming it drops from the next build and dangles in the aggregate`);
+    }
+    return { findings, lines };
+}
+//# sourceMappingURL=removals.js.map

package/dist/lib/validate/behaviour-store.js

@@ -34,13 +34,17 @@
 //                 change was withdrawn or replaced (M-ADR 0222 §4.6).
 //   5. surfaces: every archived baseline's evidence lists, under **Surfaces:**, each contract the
 //                 repositories it was observed in serve, as covered at transport or excluded with a
-//                 reason, and the list is checked against the catalogue (catalogues/repo_contract.csv),
-//                 never against itself (M-ADR 0222 §4.3, §4.4). A list the catalogue gives nothing to
+//                 reason, and the list is checked against the catalogue (catalogues/repo_contract.csv, less
+//                 a contract service_contract records the repository's services consuming and none exposing:
+//                 repo_contract has no direction), never against itself (M-ADR 0222 §4.3, §4.4). A list the catalogue gives nothing to
 //                 check against (no Observed in line, or a repository with no catalogue contracts) fails:
 //                 a cross-check of zero contracts is unresolved, not a pass.
 //                 A baseline whose every requirement has since left the living specs (removed, or its
 //                 spec retired) is history: its list is not checked, so a retired surface can drop its
-//                 contract (M-ADR 0222 §4.4).
+//                 contract (M-ADR 0222 §4.4). A baseline archived where the SDD ships record schema 1.4.0
+//                 or later records its gate's PASS (**Baseline gate:**), so `change archive` refuses one
+//                 that has not passed (M-ADR 0222 §4.3). An open baseline is asked these questions, and
+//                 what it may change and which features key it, as warnings while it can still be fixed.
 //   7. features: every living spec is keyed by a catalogue feature (M-ADR 0221 §4.7). A spec keyed by no
 //                 feature is dropped from the catalogue by the requirements builder, which reports it only as a
 //                 build finding; this check makes it a failure, so a shipped requirement cannot vanish from the
@@ -69,11 +73,11 @@ import { tmpdir } from "node:os";
 import { basename, join } from "node:path";
 import { promisify } from "node:util";
 import { parseDocument } from "yaml";
-import { observedIn, orderArchives, parseRequirements, parseSurfaces, renamedFrom, renamePairs, resolveImplements, surfaceMatches } from "../behaviour-store/archive.js";
+import { contractMoves, observedIn, orderArchives, parseRequirements, parseSurfaces, renamedFrom, renamePairs, resolveImplements, surfaceMatches } from "../behaviour-store/archive.js";
 import { parseCatalogueCsv } from "../catalogue/csv-reader.js";
 import { boundFile, conditionProblems, structuralFile, isCommit, normaliseBound, requirementBlock, sameCommit, scenarioKind, taskGroups, testPlanHeader, testPlanMapping, verdictLine, versionAtLeast } from "./agreement-evidence.js";
 import { ENFORCED as STRUCTURE_ENFORCED } from "./structural-model.js";
-import { compareStoreSchema, SCHEMA_NAME, SHIPPED_SCHEMA_DIR, STORE_CONFIG, STORE_SCHEMA_DIR, storeSchemaName } from "../behaviour-store/schema.js";
+import { BASELINE_SCHEMA_NAME, compareStoreSchema, SCHEMA_NAME, SHIPPED_SCHEMA_DIR, shippedSchemaDir, STORE_CONFIG, STORE_SCHEMA_DIR, storeSchemaDir, storeSchemaName } from "../behaviour-store/schema.js";
 const execFileAsync = promisify(execFile);
 /** The OpenSpec release the method depends on (M-ADR 0223 ruling 2). The module installs exactly this. */
 export const OPENSPEC_VERSION = "1.14.3";
@@ -828,8 +832,133 @@ export async function checkBehaviourStore(repo, options = {}) {
     }
     const orderDecides = (name, key) => [...(peers.get(name) ?? [])].some((p) => p !== name && touches.get(p)?.has(key));
     let scopeUnresolved = 0;
-    const servedBy = baselines > 0 ? await catalogueContracts(repo) : null;
+    const openBaselines = [];
+    for (const change of open)
+        if (await exists(join(repo, STORE_DIR, "changes", change, "baseline-evidence.md")))
+            openBaselines.push(change);
+    const servedBy = baselines + openBaselines.length > 0 ? await catalogueContracts(repo) : null;
     let surfacesChecked = 0;
+    let structureOnly = 0;
+    // The contract moves each archived change records, in archive order. A contract's id derives from its path, so a
+    // move changes it; an archived baseline's list names the contract as it was, and is resolved through the moves
+    // archived after it rather than edited (M-ADR 0222 §4.4). A surface that vanished with no move still fails.
+    const movesAt = [];
+    for (const name of order) {
+        const found = [];
+        let names = [];
+        try {
+            names = (await readdir(join(repo, archiveRel, name, "structure"))).filter((f) => f.endsWith(".yaml")).sort();
+        }
+        catch {
+            names = [];
+        }
+        for (const f of names) {
+            try {
+                found.push(...contractMoves(parseDocument((await readText(join(repo, archiveRel, name, "structure", f))) ?? "").toJS()?.["moved"]).moves);
+            }
+            catch {
+                // the structural-model check reports an unreadable delta
+            }
+        }
+        movesAt.push(found);
+    }
+    // An open change's moves count too, after every archive: the catalogue it is built with already holds the new
+    // identity, so the lists that named the old one follow the move while it is open, not only once it archives.
+    const openMoves = [];
+    for (const change of open) {
+        let names = [];
+        try {
+            names = (await readdir(join(repo, STORE_DIR, "changes", change, "structure"))).filter((f) => f.endsWith(".yaml")).sort();
+        }
+        catch {
+            names = [];
+        }
+        for (const f of names) {
+            try {
+                openMoves.push(...contractMoves(parseDocument((await readText(join(repo, STORE_DIR, "changes", change, "structure", f))) ?? "").toJS()?.["moved"]).moves);
+            }
+            catch {
+                // the structural-model check reports an unreadable delta
+            }
+        }
+    }
+    /** The identities a contract had before the moves archived after position `after` (-1: every archived move). */
+    const formerIdentities = (id, after) => {
+        const back = new Map();
+        for (const m of [...movesAt.slice(after + 1).flat(), ...openMoves])
+            back.set(m.to, [...(back.get(m.to) ?? []), m]);
+        const out = [];
+        const seen = new Set([id]);
+        const queue = [id];
+        while (queue.length > 0) {
+            for (const m of back.get(queue.shift()) ?? []) {
+                if (seen.has(m.from))
+                    continue;
+                seen.add(m.from);
+                out.push({ id: m.from, path: m.fromPath ?? "" });
+                queue.push(m.from);
+            }
+        }
+        return out;
+    };
+    /**
+     * Whether a baseline admits behaviour: any requirement in its spec deltas. One that admits none (a structure-only
+     * baseline, such as the removal of structure carved into another SDD) observes no served behaviour, so it has no
+     * surface to account for, and says so with the typed claim "**Surfaces:** none".
+     */
+    const admitsBehaviour = async (dir) => {
+        for (const feature of await dirs(join(repo, dir, "specs"))) {
+            if (parseRequirements((await readText(join(repo, dir, "specs", feature, "spec.md"))) ?? "").length > 0)
+                return true;
+        }
+        return false;
+    };
+    /** What is wrong with a baseline's Surfaces list against the catalogue (M-ADR 0222 §4.3, §4.4). */
+    const surfaceProblems = async (dir, evidence, after = -1) => {
+        const out = [];
+        const parsed = parseSurfaces(evidence);
+        const admits = await admitsBehaviour(dir);
+        if (!admits) {
+            if (parsed.none) {
+                structureOnly++;
+                return out;
+            }
+            if (parsed.entries.length === 0) {
+                return [`${dir}/baseline-evidence.md: the baseline admits no behaviour (no requirement in its spec deltas), so no surface is observed: write "**Surfaces:** none" (and "**Observed in:** none" where no repository is observed)`];
+            }
+        }
+        else if (parsed.none) {
+            return [`${dir}/baseline-evidence.md: **Surfaces:** none, but the baseline admits behaviour (requirements in ${dir}/specs/); name every contract the observed repositories serve, covered at transport or excluded with a reason`];
+        }
+        if (!parsed.present)
+            out.push(`${dir}/baseline-evidence.md: no **Surfaces:** list; name every contract the observed repositories serve, covered at transport or excluded with a reason`);
+        for (const p of parsed.problems)
+            out.push(`${dir}/baseline-evidence.md: Surfaces: ${p}`);
+        if (!parsed.present)
+            return out;
+        if (servedBy === null) {
+            out.push(`${dir}/baseline-evidence.md: Surfaces cannot be cross-checked: catalogues/repo_contract.csv or catalogues/contracts.csv is missing; build the catalogue`);
+            return out;
+        }
+        const repos = observedIn(evidence);
+        if (repos.length === 0)
+            out.push(`${dir}/baseline-evidence.md: Surfaces cannot be cross-checked: no **Observed in:** line names a repository`);
+        for (const r of repos) {
+            const known = servedBy.get(r);
+            if ((known?.served ?? []).length === 0) {
+                const consumed = known?.consumed ? ` (it consumes ${known.consumed}, which a baseline does not list)` : "";
+                out.push(`${dir}/baseline-evidence.md: Surfaces cannot be cross-checked: the catalogue records no contract that ${r} serves${consumed}; declare the contracts it serves in its repo-config`);
+            }
+            for (const c of known?.served ?? []) {
+                surfacesChecked++;
+                const former = formerIdentities(c.id, after);
+                if (!parsed.entries.some((e) => surfaceMatches(e.contract, c.id, c.specPath) || former.some((f) => surfaceMatches(e.contract, f.id, f.path)))) {
+                    out.push(`${dir}/baseline-evidence.md: Surfaces does not list ${c.specPath || c.id} (${c.id}), which ${r} serves (catalogues/repo_contract.csv, less what service_contract records it only consuming); list it as covered at transport or excluded with a reason`);
+                }
+            }
+        }
+        return out;
+    };
     // A baseline whose every requirement has since left the living specs (removed, or its spec retired) records a
     // surface that no longer exists; its Surfaces list is history, not checked against today's catalogue, or a
     // retired surface could never drop its contract.
@@ -841,33 +970,23 @@ export async function checkBehaviourStore(repo, options = {}) {
         const evidence = await readText(join(repo, dir, "baseline-evidence.md"));
         const isBaseline = evidence !== null;
         if (isBaseline) {
-            const parsed = parseSurfaces(evidence);
-            if (!parsed.present)
-                failures.push(`${dir}/baseline-evidence.md: no **Surfaces:** list; name every contract the observed repositories serve, covered at transport or excluded with a reason`);
-            for (const p of parsed.problems)
-                failures.push(`${dir}/baseline-evidence.md: Surfaces: ${p}`);
-            if (parsed.present && historical.has(name)) {
-                // history: see historicalBaselines
+            if (historical.has(name)) {
+                // history: see historicalBaselines; its gate and Surfaces list are not checked
+                const parsed = parseSurfaces(evidence);
+                if (!parsed.present)
+                    failures.push(`${dir}/baseline-evidence.md: no **Surfaces:** list; name every contract the observed repositories serve, covered at transport or excluded with a reason`);
+                for (const p of parsed.problems)
+                    failures.push(`${dir}/baseline-evidence.md: Surfaces: ${p}`);
             }
-            else if (parsed.present) {
-                if (servedBy === null) {
-                    failures.push(`${dir}/baseline-evidence.md: Surfaces cannot be cross-checked: catalogues/repo_contract.csv or catalogues/contracts.csv is missing; build the catalogue`);
-                }
-                else {
-                    const repos = observedIn(evidence);
-                    if (repos.length === 0)
-                        failures.push(`${dir}/baseline-evidence.md: Surfaces cannot be cross-checked: no **Observed in:** line names a repository`);
-                    for (const r of repos) {
-                        if ((servedBy.get(r) ?? []).length === 0) {
-                            failures.push(`${dir}/baseline-evidence.md: Surfaces cannot be cross-checked: catalogues/repo_contract.csv records no contract for ${r}; declare the contracts it serves in its repo-config`);
-                        }
-                        for (const c of servedBy.get(r) ?? []) {
-                            surfacesChecked++;
-                            if (!parsed.entries.some((e) => surfaceMatches(e.contract, c.id, c.specPath))) {
-                                failures.push(`${dir}/baseline-evidence.md: Surfaces does not list ${c.specPath || c.id} (${c.id}), which ${r} serves (catalogues/repo_contract.csv); list it as covered at transport or excluded with a reason`);
-                            }
-                        }
-                    }
+            else {
+                failures.push(...(await surfaceProblems(dir, evidence, order.indexOf(name))));
+                // The gate's outcome is recorded where the SDD ships record schema 1.4.0 or later when the baseline archives;
+                // a baseline archived earlier carries none and is not held to it.
+                const archivedAt = await integratedAt(repo, dir);
+                if (versionAtLeast(await shippedRecordSchema(repo, archivedAt), "1.4.0")) {
+                    const gate = baselineGate(evidence);
+                    if (gate !== "PASS")
+                        failures.push(`${dir}/baseline-evidence.md: archived ${gate === null ? "with no **Baseline gate:** line" : `with **Baseline gate:** ${gate}`}; a baseline archives once its gate passes: every requirement cites its evidence, characterization tests exist where the code has none, and every covered surface is evidenced at its transport (M-ADR 0222 §4.3)`);
                 }
             }
         }
@@ -902,8 +1021,34 @@ export async function checkBehaviourStore(repo, options = {}) {
                 lastTouch.delete(`${feature}::${from}`);
         }
     }
-    const unseen = servedBy === null ? "" : `; repositories with no catalogue contracts: ${[...new Set(await observedInAll(repo, archiveRel, order))].filter((r) => (servedBy.get(r) ?? []).length === 0).join(", ") || "none"}`;
-    lines.push(baselines === 0 ? "surfaces: vacuous (no baseline)" : `surfaces: ${baselines} baseline(s), ${surfacesChecked} served contract(s) checked against catalogues/repo_contract.csv${unseen}${historical.size ? `; ${historical.size} historical baseline(s) not checked (every requirement they baselined has left the living specs)` : ""}`);
+    // An open baseline is asked the archive's questions while it can still be fixed: its Surfaces list, what it may
+    // change given the lineage so far, the features its deltas are keyed by, and its gate. Warnings, since it is in
+    // progress; `change archive` refuses what is still wrong when it archives.
+    const featureIds = await readText(join(repo, "catalogues", "features.csv")).then((t) => (t === null ? null : new Set(parseCatalogueCsv(t).rows.map((r) => r["id"] ?? ""))));
+    for (const change of openBaselines) {
+        const dir = `${STORE_DIR}/changes/${change}`;
+        const evidence = (await readText(join(repo, dir, "baseline-evidence.md"))) ?? "";
+        const found = [...(await surfaceProblems(dir, evidence))];
+        for (const feature of await dirs(join(repo, dir, "specs"))) {
+            if (featureIds !== null && !featureIds.has(feature))
+                found.push(`${dir}/specs/${feature}: no catalogue feature has the id "${feature}"; give the behaviour a feature first (M-ADR 0222 §4.4)`);
+            const text = (await readText(join(repo, dir, "specs", feature, "spec.md"))) ?? "";
+            for (const target of [...parseRequirements(text).filter((r) => r.operation === "MODIFIED" || r.operation === "REMOVED").map((r) => r.name), ...renamedFrom(text)]) {
+                scopeChecked++;
+                const last = lastTouch.get(`${feature}::${target}`);
+                if (last !== "baseline")
+                    found.push(`${dir}: a baseline changes "${target}" (${feature}), which ${last === "change" ? "a judged change last shipped" : "no earlier archived change admitted"}; a baseline may remove or modify only what a baseline admitted (M-ADR 0222 §4.4)`);
+            }
+        }
+        const gate = baselineGate(evidence);
+        if (gate !== "PASS")
+            found.push(`${dir}/baseline-evidence.md: ${gate === null ? "no **Baseline gate:** line yet" : `**Baseline gate:** ${gate}`}; it archives once the gate passes (M-ADR 0222 §4.3)`);
+        warnings.push(...found.map((w) => `open baseline: ${w}`));
+    }
+    if (openBaselines.length > 0)
+        lines.push(`open baselines: ${openBaselines.length}, asked the archive's questions as warnings`);
+    const unseen = servedBy === null ? "" : `; repositories with no catalogue contracts: ${[...new Set(await observedInAll(repo, archiveRel, order))].filter((r) => (servedBy.get(r)?.served ?? []).length === 0).join(", ") || "none"}`;
+    lines.push(baselines === 0 ? "surfaces: vacuous (no baseline)" : `surfaces: ${baselines} baseline(s), ${surfacesChecked} served contract(s) checked against catalogues/repo_contract.csv less what service_contract records only consumed${unseen}${structureOnly ? `; ${structureOnly} structure-only baseline(s) admitting no behaviour, Surfaces: none` : ""}${historical.size ? `; ${historical.size} historical baseline(s) not checked (every requirement they baselined has left the living specs)` : ""}`);
     lines.push(scopeChecked === 0 ? "scope: vacuous (no baseline removes, modifies or renames a requirement)" : `scope: ${scopeChecked} requirement(s) a baseline removes, modifies or renames, checked against their lineage`);
     if (!history && archived.length > 0)
         lines.push("order: no git history (not a git work tree, or git log failed), so same-day archives cannot be ordered");
@@ -954,6 +1099,29 @@ export async function checkBehaviourStore(repo, options = {}) {
             lines.push(drift === 0 ? `schema: ${SCHEMA_NAME}, identical to the shipped copy` : `schema: ${SCHEMA_NAME}, ${drift} file(s) differ from the shipped copy`);
         }
     }
+    // The baseline schema: checked as sdd-change is where the bundle ships it (a bundle from before it shipped has none),
+    // and an open baseline selects it rather than sdd-change, whose Gate 0, test plan and agreement a baseline lacks.
+    if (selected === SCHEMA_NAME) {
+        const b = await compareStoreSchema(repo, BASELINE_SCHEMA_NAME);
+        if (b.shipped) {
+            const fix = "sdd-cli sync refreshes it; put adopter guidance in the store's config.yaml rules, not in the schema";
+            for (const f of b.missing)
+                failures.push(`${storeSchemaDir(BASELINE_SCHEMA_NAME)}/${f}: missing from the store's copy of the schema; ${fix}`);
+            for (const f of b.differing)
+                failures.push(`${storeSchemaDir(BASELINE_SCHEMA_NAME)}/${f}: differs from the shipped ${shippedSchemaDir(BASELINE_SCHEMA_NAME)}/${f}; ${fix}`);
+            for (const f of b.extra)
+                failures.push(`${storeSchemaDir(BASELINE_SCHEMA_NAME)}/${f}: not in the shipped schema; ${fix}`);
+            const drift = b.missing.length + b.differing.length + b.extra.length;
+            lines.push(drift === 0 ? `schema: ${BASELINE_SCHEMA_NAME}, identical to the shipped copy` : `schema: ${BASELINE_SCHEMA_NAME}, ${drift} file(s) differ from the shipped copy`);
+            for (const change of openBaselines) {
+                const meta = await readText(join(repo, STORE_DIR, "changes", change, ".openspec.yaml"));
+                const chosen = meta === null ? null : parseDocument(meta).toJS()?.schema;
+                if (chosen !== BASELINE_SCHEMA_NAME) {
+                    warnings.push(`open baseline: ${STORE_DIR}/changes/${change}/.openspec.yaml selects ${chosen === null || chosen === undefined ? "no schema" : `"${String(chosen)}"`}; a baseline selects ${BASELINE_SCHEMA_NAME} (schema: ${BASELINE_SCHEMA_NAME}), whose artifacts are a baseline's rather than a change's Gate 0, test plan and agreement`);
+                }
+            }
+        }
+    }
     const population = recordFiles.length + open.length + archived.length;
     const body = lines.map((l) => `  ${l}`).join("\n") + "\n";
     if (failures.length > 0) {
@@ -1012,25 +1180,47 @@ async function historicalBaselines(repo, archiveRel, order) {
     });
     return out;
 }
-/** Per repository, the contracts the catalogue says it serves (repo_contract ⋈ contracts.spec_path); null when either file is missing. */
+/**
+ * Per repository, the contracts the catalogue says it serves, with how many it only consumes; null when repo_contract or
+ * contracts is missing. repo_contract binds a repository to a contract in either direction, so a row is dropped where
+ * service_contract records the repository's services consuming that contract and none exposing it. Rows
+ * service_contract says nothing about stay: a model that omits a service's exposes rows does not shrink what is checked.
+ */
 async function catalogueContracts(repo) {
     const rc = await readText(join(repo, "catalogues", "repo_contract.csv"));
     const cs = await readText(join(repo, "catalogues", "contracts.csv"));
     if (rc === null || cs === null)
         return null;
     const spec = new Map(parseCatalogueCsv(cs).rows.map((r) => [r["id"] ?? "", r["spec_path"] ?? ""]));
+    const repoOf = new Map(parseCatalogueCsv((await readText(join(repo, "catalogues", "services.csv"))) ?? "").rows.map((r) => [r["id"] ?? "", r["primary_repo_id"] ?? ""]));
+    const roles = new Map();
+    for (const r of parseCatalogueCsv((await readText(join(repo, "catalogues", "service_contract.csv"))) ?? "").rows) {
+        const key = `${repoOf.get(r["service_id"] ?? "") ?? ""}\u0000${r["contract_id"] ?? ""}`;
+        roles.set(key, (roles.get(key) ?? new Set()).add(r["role"] ?? ""));
+    }
     const out = new Map();
     for (const r of parseCatalogueCsv(rc).rows) {
         const repoId = r["repo_id"] ?? "";
         const id = r["contract_id"] ?? "";
         if (repoId === "" || id === "")
             continue;
-        const list = out.get(repoId) ?? [];
-        list.push({ id, specPath: spec.get(id) ?? "" });
-        out.set(repoId, list);
+        const entry = out.get(repoId) ?? { served: [], consumed: 0 };
+        const role = roles.get(`${repoId}\u0000${id}`);
+        if (role?.has("consumes") && !role.has("exposes"))
+            entry.consumed++;
+        else
+            entry.served.push({ id, specPath: spec.get(id) ?? "" });
+        out.set(repoId, entry);
     }
     return out;
 }
+/** A baseline's recorded gate outcome: the last `**Baseline gate:** <outcome>` line's first word, upper-cased; null when there is none. */
+function baselineGate(evidence) {
+    let out = null;
+    for (const m of evidence.matchAll(/^\s*\*\*Baseline gate:\*\*\s*(\S+)/gm))
+        out = m[1].replace(/[^A-Za-z]/g, "").toUpperCase();
+    return out;
+}
 async function observedInAll(repo, archiveRel, names) {
     const out = [];
     for (const n of names) {

package/dist/lib/validate/feature-spec-pointers.js

@@ -14,6 +14,9 @@
 //   gherkin   Given/When/Then lines anywhere else;
 //   sections  content lines under a heading that states behaviour: Happy Path, Edge Cases, Error Handling,
 //             Business Rules, Validation Rules, Acceptance Criteria.
+// A pointer is not a restatement: under a behaviour heading, a line naming `openspec/specs/<feature-id>/` is the
+// pointer the template asks for there ("## Acceptance Criteria" with "shipped, see openspec/specs/…: <names>"), unless
+// it is itself a criterion (a checkbox) or a Given/When/Then line.
 // Intent not yet shipped is allowed where it is marked. A heading reading "Not yet shipped or agreed" covers its
 // section, to the next heading of the same or a higher level. A bold line reading so covers what follows it, to the
 // next heading of any level. Open Questions' checkboxes are not
@@ -29,6 +32,8 @@ const NOT_YET = /not yet (shipped|agreed)/i;
 const CRITERIA_START = /^\*\*Acceptance Criteria:?\*\*/i;
 const GHERKIN = /^\s*(?:[-*]\s+(?:\[[ xX]\]\s+)?)?(?:\*\*)?(Given|When|Then)\b/;
 const LIST_LINE = /^\s*(?:[-*]|\d+\.)\s+\S/;
+const POINTER_LINE = /openspec\/specs\/[^/\s`)]+/;
+const CHECKBOX = /^\s*(?:[-*]|\d+\.)\s+\[[ xX]\]/;
 /** "## 3. Edge Cases (Revised)" -> "edge cases". */
 function headingKey(h) {
     return h.replace(/^\s*\d+(\.\d+)*\.?\s*/, "").replace(/\((revised|updated)\)\s*$/i, "").trim().toLowerCase();
@@ -72,6 +77,8 @@ export function scanRestated(text) {
         if (!line.trim() || /^\s*\|?[\s:|-]+\|[\s:|-]*$/.test(line))
             continue; // blank, or a table separator
         if (stack.some((s) => BEHAVIOUR_HEADING.test(s.key))) {
+            if (POINTER_LINE.test(line) && !CHECKBOX.test(line) && !GHERKIN.test(line))
+                continue; // the pointer itself
             out.sections.push(n);
             continue;
         }