@sdd-method/maintain-cli 0.3.0 → 0.5.0

package/dist/lib/validate/behaviour-store.js

@@ -0,0 +1,351 @@
+// Behaviour-store checks (M-ADR 0221, 0222, 0223): the gates OpenSpec itself does not enforce.
+//
+// An SDD's behaviour store is an OpenSpec project; in the inside-SDD shape it is `openspec/` at the
+// SDD root, with one agreement record per change at `docs/agreements/<change>.yaml`
+// (agreement-record-schema.yaml). OpenSpec checks the format of specs and deltas. It does not check
+// that a change was agreed before it was built, that the requirements it modifies stayed as they
+// were agreed, or that an archived change was judged. These are those checks:
+//
+//   1. records:  every agreement record has the shape the checks below read.
+//   2. agreement: an open change with any completed task has an agreed record and a Gate 0 that
+//                 ends CLEAR (the pre-apply check, M-ADR 0223 §4.3).
+//   3. stale:    for each open, agreed change that MODIFIES, REMOVES or RENAMES requirements, the
+//                 targeted living specs are unchanged since the agreed commit (M-ADR 0223 §4.5).
+//                 With no such targets the check is vacuous, and says so.
+//   4. verdicts: every archived change except a baseline has a verdict.md and a record whose
+//                 verdict is PASS and names it (M-ADR 0223 §4.6).
+//
+// A sibling-repository store (M-ADR 0221 §4.2) is checked in that repository, not here.
+//
+// OPENSPEC'S OWN VALIDATION is the separate validator `behaviour-store-openspec`, because it needs
+// the OpenSpec CLI at OPENSPEC_VERSION (the Method Validation module installs it). Without a store
+// both report [N/A], an empty population, never a pass.
+import { execFile } from "node:child_process";
+import { access, readdir, readFile } from "node:fs/promises";
+import { basename, join } from "node:path";
+import { promisify } from "node:util";
+import { parseDocument } from "yaml";
+const execFileAsync = promisify(execFile);
+/** The OpenSpec release the method depends on (M-ADR 0223 ruling 2). The module installs exactly this. */
+export const OPENSPEC_VERSION = "1.14.3";
+/** Telemetry off for every OpenSpec run the method makes. */
+export const OPENSPEC_ENV = { OPENSPEC_TELEMETRY: "0", DO_NOT_TRACK: "1" };
+export const STORE_DIR = "openspec";
+export const AGREEMENTS_DIR = "docs/agreements";
+const AGREEMENT_STATUSES = ["proposed", "agreed", "superseded", "withdrawn"];
+const COMMIT_RE = /^[0-9a-f]{7,40}$/;
+// OpenSpec counts a task done when its box holds only `x`, either case, any spacing.
+const TASK_DONE_RE = /^\s*-\s*\[\s*[xX]\s*\]/m;
+const TARGET_HEADING_RE = /^##\s+(MODIFIED|REMOVED|RENAMED)\s+Requirements\b/m;
+async function exists(p) {
+    try {
+        await access(p);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+async function dirs(p) {
+    try {
+        return (await readdir(p, { withFileTypes: true })).filter((d) => d.isDirectory()).map((d) => d.name).sort();
+    }
+    catch {
+        return [];
+    }
+}
+async function readText(p) {
+    try {
+        return await readFile(p, "utf8");
+    }
+    catch {
+        return null;
+    }
+}
+/** Read and shape-check one agreement record. Returns the record, or the problems found. */
+export function parseAgreementRecord(file, text) {
+    const problems = [];
+    const doc = parseDocument(text);
+    if (doc.errors.length > 0) {
+        return { problems: doc.errors.map((e) => `${file}: does not parse: ${e.message.split("\n")[0]}`) };
+    }
+    const root = doc.toJS();
+    const r = root?.agreement_record;
+    if (!r || typeof r !== "object")
+        return { problems: [`${file}: no top-level agreement_record`] };
+    const expected = basename(file).replace(/\.ya?ml$/, "");
+    if (r.change !== expected)
+        problems.push(`${file}: change is ${JSON.stringify(r.change)}, expected "${expected}" (the file name)`);
+    const status = typeof r.status === "string" ? r.status : "";
+    if (!AGREEMENT_STATUSES.includes(status)) {
+        problems.push(`${file}: status ${JSON.stringify(r.status)} is not one of ${AGREEMENT_STATUSES.join(" | ")}`);
+    }
+    const sdd = (r.sdd ?? {});
+    const gates = Array.isArray(r.gates) ? r.gates : [];
+    const gate0 = gates.find((g) => g && g.name === "gate-0");
+    if (status === "agreed") {
+        if (r.agreed_on === undefined || r.agreed_on === null)
+            problems.push(`${file}: agreed, but no agreed_on`);
+        if (typeof r.approved_by !== "string" || r.approved_by.trim() === "")
+            problems.push(`${file}: agreed, but no approved_by`);
+        if (typeof sdd.commit !== "string") {
+            problems.push(`${file}: sdd.commit must be a quoted string, found ${sdd.commit === undefined ? "nothing" : `${typeof sdd.commit} ${String(sdd.commit)}`}` +
+                (typeof sdd.commit === "number" ? " (unquoted, YAML parsed the SHA as a number)" : ""));
+        }
+        else if (!COMMIT_RE.test(sdd.commit)) {
+            problems.push(`${file}: sdd.commit "${sdd.commit}" is not 7-40 hex characters`);
+        }
+        if (!gate0)
+            problems.push(`${file}: agreed, but no gates entry named gate-0`);
+        else if (gate0.result !== "CLEAR")
+            problems.push(`${file}: agreed, but gate-0 result is ${JSON.stringify(gate0.result)}, not CLEAR`);
+    }
+    // Every commit a record pins must survive parsing as a string. YAML 1.2 reads an unquoted
+    // all-digit abbreviation as an integer and one shaped like `1234e567` or `123e456` as a float
+    // (Infinity), and the pin is then lost; checking the PARSED type is the only test that catches
+    // both, since a pattern applied after coercion sees "Infinity" or a number.
+    for (const [path, value] of commitFields(r)) {
+        if (path === "sdd.commit")
+            continue;
+        if (typeof value !== "string") {
+            problems.push(`${file}: ${path} must be a quoted string, found ${typeof value} ${String(value)} (unquoted, YAML parsed the SHA as a number)`);
+        }
+    }
+    const verdict = r.verdict && typeof r.verdict === "object" ? r.verdict : undefined;
+    if (problems.length > 0)
+        return { problems };
+    return {
+        record: {
+            file,
+            change: expected,
+            status,
+            ...(typeof sdd.commit === "string" ? { commit: sdd.commit } : {}),
+            ...(typeof gate0?.result === "string" ? { gate0: gate0.result } : {}),
+            ...(verdict ? { verdict } : {}),
+        },
+        problems,
+    };
+}
+/** Every pinned commit in a record: any key named `commit` or ending `_commit`, and each value under verdict.merged and current. */
+function commitFields(r) {
+    const out = [];
+    const walk = (v, path, pinMap) => {
+        if (Array.isArray(v))
+            v.forEach((x, i) => walk(x, `${path}[${i}]`, false));
+        else if (v && typeof v === "object") {
+            for (const [k, x] of Object.entries(v)) {
+                const p = path === "" ? k : `${path}.${k}`;
+                const isPin = pinMap || k === "commit" || k.endsWith("_commit");
+                if (isPin && (x === null || typeof x !== "object"))
+                    out.push([p, x]);
+                else
+                    walk(x, p, p === "verdict.merged" || p === "current");
+            }
+        }
+    };
+    walk(r, "", false);
+    return out;
+}
+function lastGateLine(text) {
+    const lines = text.split("\n").map((l) => l.trim()).filter((l) => l !== "");
+    return lines.at(-1) ?? "";
+}
+async function gitDiffQuiet(repo, commit, path) {
+    try {
+        await execFileAsync("git", ["-C", repo, "cat-file", "-e", `${commit}^{commit}`]);
+    }
+    catch {
+        return "unresolved";
+    }
+    try {
+        await execFileAsync("git", ["-C", repo, "diff", "--quiet", commit, "HEAD", "--", path]);
+        return "same";
+    }
+    catch (err) {
+        return err.code === 1 ? "changed" : "unresolved";
+    }
+}
+/** The living specs an open change's deltas modify, remove or rename: openspec/specs/<capability>/spec.md. */
+async function targetedSpecs(repo, changeDir) {
+    const out = [];
+    const walk = async (rel) => {
+        const abs = join(repo, changeDir, "specs", rel);
+        let entries;
+        try {
+            entries = await readdir(abs, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const e of entries) {
+            const childRel = rel === "" ? e.name : `${rel}/${e.name}`;
+            if (e.isDirectory())
+                await walk(childRel);
+            else if (e.name === "spec.md") {
+                const text = (await readText(join(abs, e.name))) ?? "";
+                if (TARGET_HEADING_RE.test(text))
+                    out.push(`${STORE_DIR}/specs/${rel}/spec.md`);
+            }
+        }
+    };
+    await walk("");
+    return out.sort();
+}
+export async function checkBehaviourStore(repo) {
+    if (!(await exists(join(repo, STORE_DIR)))) {
+        return { exitCode: 0, stdout: `[N/A] no behaviour store (${STORE_DIR}/) in this repository\n` };
+    }
+    const lines = [];
+    const failures = [];
+    // 1. records
+    const records = new Map();
+    let recordFiles = [];
+    try {
+        recordFiles = (await readdir(join(repo, AGREEMENTS_DIR))).filter((f) => /\.ya?ml$/.test(f)).sort();
+    }
+    catch {
+        recordFiles = [];
+    }
+    for (const f of recordFiles) {
+        const rel = `${AGREEMENTS_DIR}/${f}`;
+        const { record, problems } = parseAgreementRecord(rel, (await readText(join(repo, rel))) ?? "");
+        failures.push(...problems);
+        if (record)
+            records.set(record.change, record);
+    }
+    lines.push(`records: ${recordFiles.length} agreement record(s), ${recordFiles.length - records.size} malformed`);
+    // 2 and 3. open changes
+    const open = (await dirs(join(repo, STORE_DIR, "changes"))).filter((d) => d !== "archive");
+    let started = 0;
+    let staleChecked = 0;
+    for (const change of open) {
+        const dir = `${STORE_DIR}/changes/${change}`;
+        const tasks = await readText(join(repo, dir, "tasks.md"));
+        const record = records.get(change);
+        if (tasks !== null && TASK_DONE_RE.test(tasks)) {
+            started++;
+            if (!record)
+                failures.push(`${dir}: has completed tasks but no agreement record (${AGREEMENTS_DIR}/${change}.yaml)`);
+            else if (record.status !== "agreed")
+                failures.push(`${dir}: has completed tasks but its agreement record is ${record.status}, not agreed`);
+            const gate = await readText(join(repo, dir, "gate-0.md"));
+            if (gate === null)
+                failures.push(`${dir}: has completed tasks but no gate-0.md`);
+            else if (lastGateLine(gate) !== "GATE: CLEAR")
+                failures.push(`${dir}: has completed tasks but gate-0.md ends "${lastGateLine(gate)}", not "GATE: CLEAR"`);
+        }
+        if (record?.status === "agreed" && record.commit) {
+            for (const spec of await targetedSpecs(repo, dir)) {
+                staleChecked++;
+                const r = await gitDiffQuiet(repo, record.commit, spec);
+                if (r === "changed")
+                    failures.push(`${dir}: STALE: ${spec} changed since the agreed commit ${record.commit}`);
+                if (r === "unresolved")
+                    failures.push(`${dir}: stale check unresolved: commit ${record.commit} is not in this clone's history (a shallow clone cannot run it)`);
+            }
+        }
+    }
+    lines.push(`agreement: ${open.length} open change(s), ${started} with completed tasks`);
+    lines.push(staleChecked === 0 ? "stale: vacuous (no open agreed change modifies, removes or renames a requirement)" : `stale: ${staleChecked} targeted living spec(s) checked against their agreed commits`);
+    // 4. archived changes
+    const archived = await dirs(join(repo, STORE_DIR, "changes", "archive"));
+    let baselines = 0;
+    for (const name of archived) {
+        const dir = `${STORE_DIR}/changes/archive/${name}`;
+        if (await exists(join(repo, dir, "baseline-evidence.md"))) {
+            baselines++;
+            continue;
+        }
+        const change = name.replace(/^\d{4}-\d{2}-\d{2}-/, "");
+        if (!(await exists(join(repo, dir, "verdict.md"))))
+            failures.push(`${dir}: archived without verdict.md`);
+        const record = records.get(change);
+        if (!record) {
+            failures.push(`${dir}: archived without an agreement record (${AGREEMENTS_DIR}/${change}.yaml)`);
+            continue;
+        }
+        if (record.verdict?.result !== "PASS")
+            failures.push(`${record.file}: change is archived but verdict.result is ${JSON.stringify(record.verdict?.result)}, not PASS`);
+        const vr = record.verdict?.record;
+        if (typeof vr !== "string" || !(await exists(join(repo, vr))))
+            failures.push(`${record.file}: verdict.record ${JSON.stringify(vr)} does not name an existing file`);
+    }
+    lines.push(`verdicts: ${archived.length} archived change(s), ${baselines} baseline(s), ${archived.length - baselines} needing a PASS verdict`);
+    const population = recordFiles.length + open.length + archived.length;
+    const body = lines.map((l) => `  ${l}`).join("\n") + "\n";
+    if (failures.length > 0) {
+        return { exitCode: 1, stdout: body + failures.map((f) => `[FAIL] ${f}`).join("\n") + "\n" };
+    }
+    if (population === 0)
+        return { exitCode: 0, stdout: body + `[N/A] the behaviour store has no changes and no agreement records yet\n` };
+    return { exitCode: 0, stdout: body + "[PASS] behaviour store: records, agreement, stale and verdict checks hold\n" };
+}
+async function runOpenspec(repo, args) {
+    try {
+        const { stdout } = await execFileAsync("openspec", args, { cwd: repo, env: { ...process.env, ...OPENSPEC_ENV }, maxBuffer: 16 * 1024 * 1024 });
+        return { code: 0, json: JSON.parse(stdout), raw: stdout };
+    }
+    catch (err) {
+        const e = err;
+        let json;
+        try {
+            json = JSON.parse(e.stdout ?? "");
+        }
+        catch {
+            json = undefined;
+        }
+        return { code: typeof e.code === "number" ? e.code : 127, ...(json ? { json } : {}), raw: (e.stdout ?? "") + (e.stderr ?? "") };
+    }
+}
+/** OpenSpec's own strict validation of the store: specs and open changes, and archived changes' tasks. */
+export async function checkBehaviourStoreOpenspec(repo) {
+    if (!(await exists(join(repo, STORE_DIR)))) {
+        return { exitCode: 0, stdout: `[N/A] no behaviour store (${STORE_DIR}/) in this repository\n` };
+    }
+    let version = "";
+    try {
+        version = (await execFileAsync("openspec", ["--version"], { env: { ...process.env, ...OPENSPEC_ENV } })).stdout.trim();
+    }
+    catch {
+        return {
+            exitCode: 1,
+            stdout: `[FAIL] the OpenSpec CLI is not on PATH; this repository has a behaviour store, so its validation cannot run (install @fission-ai/openspec@${OPENSPEC_VERSION}; the Method Validation module does)\n`,
+        };
+    }
+    if (version !== OPENSPEC_VERSION) {
+        return { exitCode: 1, stdout: `[FAIL] OpenSpec ${version} is installed; the method depends on exactly ${OPENSPEC_VERSION}\n` };
+    }
+    const lines = [];
+    const failures = [];
+    let measured = 0;
+    for (const [label, args] of [
+        ["specs and open changes (--all --strict)", ["validate", "--all", "--strict", "--json", "--no-interactive"]],
+        ["archived changes' tasks (--archived)", ["validate", "--archived", "--json", "--no-interactive"]],
+    ]) {
+        const r = await runOpenspec(repo, [...args]);
+        const t = r.json?.summary?.totals;
+        if (!t) {
+            failures.push(`${label}: OpenSpec returned no report (exit ${r.code}): ${r.raw.trim().split("\n").slice(-3).join(" | ")}`);
+            continue;
+        }
+        measured += t.items ?? 0;
+        lines.push(`${label}: ${t.items ?? 0} item(s), ${t.passed ?? 0} passed, ${t.failed ?? 0} failed`);
+        for (const item of r.json?.items ?? []) {
+            if (item.valid)
+                continue;
+            for (const i of item.issues ?? [])
+                failures.push(`${label}: ${item.id}${i.path ? ` (${i.path})` : ""}: ${i.level} ${i.message}`);
+            if ((item.issues ?? []).length === 0)
+                failures.push(`${label}: ${item.id}: invalid`);
+        }
+        if (r.code !== 0 && (t.failed ?? 0) === 0)
+            failures.push(`${label}: OpenSpec exited ${r.code} with no failed item reported`);
+    }
+    const body = [`  OpenSpec ${version}`, ...lines.map((l) => `  ${l}`)].join("\n") + "\n";
+    if (failures.length > 0)
+        return { exitCode: 1, stdout: body + failures.map((f) => `[FAIL] ${f}`).join("\n") + "\n" };
+    if (measured === 0)
+        return { exitCode: 0, stdout: body + "[N/A] OpenSpec found no specs and no changes to validate\n" };
+    return { exitCode: 0, stdout: body + "[PASS] OpenSpec strict validation holds\n" };
+}
+//# sourceMappingURL=behaviour-store.js.map

package/dist/lib/validate/dispatch.js

@@ -1,5 +1,20 @@
+import { checkBehaviourStore, checkBehaviourStoreOpenspec } from "./behaviour-store.js";
 import { checkBundleCoherence } from "./bundle-coherence.js";
 import { checkYamlParse } from "./yaml-parse.js";
+// The behaviour store (M-ADR 0221-0223) can sit in an SDD of any profile, so every profile carries
+// its two checks; without a store both report [N/A], an empty population, not a pass.
+const BEHAVIOUR_STORE_VALIDATORS = [
+    {
+        name: "behaviour-store",
+        source: { kind: "native", run: async (ctx) => checkBehaviourStore(ctx.targetRepo) },
+        build: () => ({ status: "run", args: [] }),
+    },
+    {
+        name: "behaviour-store-openspec",
+        source: { kind: "native", run: async (ctx) => checkBehaviourStoreOpenspec(ctx.targetRepo) },
+        build: () => ({ status: "run", args: [] }),
+    },
+];
 // Validators that accept --app-root / --repo-root flags work fine from the
 // bundled location because they override their internal ROOT_DIR via the
 // flag. Validators without that flag (adr-structure, runway-classification,
@@ -74,6 +89,7 @@ const APP_VALIDATORS = [
         },
         build: () => ({ status: "run", args: [] }),
     },
+    ...BEHAVIOUR_STORE_VALIDATORS,
     // Note: validate-runway-classification is intentionally NOT in the app set.
     // It requires platform-level files (docs/platform/feature-tree.md,
     // architecture-runway-index.md) that app repos don't own. Per ADR 0089,
@@ -126,6 +142,7 @@ const INTEGRATION_VALIDATORS = [
         },
         build: () => ({ status: "run", args: [] }),
     },
+    ...BEHAVIOUR_STORE_VALIDATORS,
 ];
 const PLATFORM_VALIDATORS = [
     {
@@ -208,6 +225,7 @@ const PLATFORM_VALIDATORS = [
         },
         build: () => ({ status: "run", args: [] }),
     },
+    ...BEHAVIOUR_STORE_VALIDATORS,
     // Optional: the upstream validate-docs.sh dispatcher covers the 6
     // conditional validators (backward-compatibility, deprecation-runway,
     // migration-completeness, ddd-artifacts, glossary-alignment,

package/dist/lib/validate/index.js

@@ -54,7 +54,7 @@ export async function runValidate(opts, stdout = (line) => process.stdout.write(
 // passed" with none were previously the same line (M-ADR 0200 §4.3). The
 // exit code is deliberately unchanged — the defect is the claim, not the
 // gating; whether an unexecutable validator should FAIL is the open design
-// question (post-3.0.0-followons.md A2), not this one.
+// question, not this one.
 function verdict(summary, selected) {
     if (summary.exitCode !== 0)
         return fail("One or more validators failed");

package/dist/lib/validate/plan.js

@@ -1,5 +1,5 @@
 /**
- * The method-managed validation job, as DATA (bead sdm-dd6.2; Dagger ruling sdm-s48, 2026-10-15).
+ * The method-managed validation job, as DATA (M-ADR 0219).
  *
  * One ordered plan per profile: every default validator, the platform's script-only checks, then the
  * advisory catalogue freshness check. Every executor renders or runs THIS: the GitHub workflow
@@ -22,6 +22,8 @@ const TITLES = {
     "yaml-parse": "Validate that tracked YAML parses",
     "gate-readiness": "Validate gate readiness",
     "bundle-coherence": "Report bundle coherence",
+    "behaviour-store": "Validate the behaviour store: agreement records, the pre-apply gate, stale requirements, verdicts",
+    "behaviour-store-openspec": "Validate the behaviour store with OpenSpec (strict)",
     // CI has no platform checkout, so this step runs the app-only checks; the met gate needs the platform beside it.
     "app-dependencies": "Validate app dependencies (app-only checks; no platform checkout in CI)",
 };

package/dist/lib/validate/yaml-parse.js

@@ -10,7 +10,7 @@
 // with it certifies exactly the corruption a line-surgery transformer
 // produces. `yaml` v2 refuses duplicate keys (DUPLICATE_KEY) and the other
 // malformations a lenient parse glosses — e.g. a `: ` inside an unquoted
-// scalar (`path: (none — tel: URL)`), which no pattern rule catches.
+// scalar (`path: (none — see: docs)`), which no pattern rule catches.
 //
 // Scope: the YAML files git TRACKS (`*.yaml`, `*.yml`) — the repo's sources,
 // not build output or dependencies. Outside a git work tree there is no

package/dist/maintain-version.json

@@ -1,4 +1,4 @@
 {
-  "version": "0.3.0",
-  "built_against_sdd_cli": "1.44.0"
+  "version": "0.5.0",
+  "built_against_sdd_cli": "1.46.0"
 }

package/dist/verbs/sync.js

@@ -18,7 +18,7 @@ export function registerSync(program) {
         .option("--allow-overwrite", "accept overwrites of locally-modified method content")
         .option("--no-delete", "preserve files removed upstream")
         .option("--agent-harness <name>", `target agent harness for hooks + briefing. Default: claude-code. Supported: ${AGENT_HARNESSES.join(", ")}`)
-        .option("--ci-binding <host>", `CI host whose wrapper calls the Method Validation module (M-ADR 0219): ${CI_BINDINGS.join(", ")}. Default: the binding the lock records, else github; a new choice is recorded in the lock`)
+        .option("--ci-binding <host>", `CI host whose wrapper calls the Method Validation module (M-ADR 0219): ${CI_BINDINGS.join(", ")}. local writes the module and no wrapper, for an estate that runs it with dagger call on its own machines, and removes the wrapper this tool wrote for the previous binding while it is unedited. Default: the binding the lock records, else github; a new choice is recorded in the lock`)
         .option("--ci-runner <labels>", `runner label(s) the CI wrapper targets, comma-separated (GitHub runs-on, GitLab tags, Jenkins agent label), e.g. a self-hosted runner. '${CI_RUNNER_DEFAULT}' returns to the host's default runner. Default: what the lock records; a new choice is recorded`)
         .option("--cli-source <source>", `where the session-start hook finds the verify CLI: ${CLI_SOURCES.join(" (npx at the pinned version) or ")} (sdd-verify from PATH, for an org that installs the release's CLI tarballs; the hook names the version to install when it differs). Default: what the lock records, else registry; a new choice is recorded`)
         .option("--cli-package <name>", `the verify CLI's npm package under the registry source, for a registry that rescopes it. 'default' returns to ${DEFAULT_VERIFY_CLI_PACKAGE}. Default: what the lock records; a new choice is recorded`)

package/dist/verify-version.json

@@ -1,4 +1,4 @@
 {
-  "version": "1.3.0",
-  "built_against_sdd_cli": "1.44.0"
+  "version": "1.5.0",
+  "built_against_sdd_cli": "1.46.0"
 }

package/package.json

@@ -1,9 +1,9 @@
 {
   "name": "@sdd-method/maintain-cli",
-  "version": "0.3.0",
-  "sddCliVersion": "1.44.0",
+  "version": "0.5.0",
+  "sddCliVersion": "1.46.0",
   "description": "Bring an SDD repository current and rebuild its derived model — sync, briefing, catalogue build and aggregate, pack build, context pull — plus every read-only verify verb. Ships only the code those verbs reach; it cannot author specification content. Authoring is in @sdd-method/sdd-cli.",
-  "license": "Apache-2.0",
+  "license": "UNLICENSED",
   "type": "module",
   "bin": {
     "sdd-maintain": "dist/maintain-bin.js"
@@ -23,8 +23,6 @@
   "files": [
     "dist",
     "scripts",
-    "README.md",
-    "LICENSE",
-    "NOTICE"
+    "README.md"
   ]
 }

package/scripts/validate-app-dependencies.sh

@@ -20,7 +20,7 @@
 #   3b. (platform) that contract_path resolves to a file under the platform root
 #
 # Outputs a dependency status table.
-# Used as the Stage 6 lock-in gate in the App Exploration Workflow.
+# Used as the Stage 6 agreement gate in the App Exploration Workflow.
 #
 # THE STABILITY VOCABULARY, AND WHY IT IS WHAT IT IS
 #   `required_stability` states the CONSUMING app's expectation of contract
@@ -157,8 +157,8 @@ APP_DEPS_FILE="$APP_ROOT/app-platform-dependencies.yaml"
 #
 #   This gate read only the forward file, so an entire equal-status source went
 #   ungated. Measured in one reverse estate: 15 evidence files declaring 65
-#   further dependencies, 38 of them `locked` — precisely the lock-in population
-#   a Stage 6 lock-in gate exists to check — none of which this gate could see.
+#   further dependencies, 38 of them `locked` — precisely the population
+#   a Stage 6 agreement gate exists to check — none of which this gate could see.
 #
 #   A source that the catalogue reads and the gate does not is a coverage gap by
 #   construction, so the gate now reads both.
@@ -637,7 +637,7 @@ main() {
     fi
 
     if [[ "$FAILURES" -gt 0 ]]; then
-        log_fail "$FAILURES dependency check(s) failed. Stage 6 lock-in gate NOT met."
+        log_fail "$FAILURES dependency check(s) failed. Stage 6 agreement gate NOT met."
         exit 1
     fi
 
@@ -656,7 +656,7 @@ main() {
     if [[ "$WARNINGS" -gt 0 ]]; then
         log_warn "All required checks passed with $WARNINGS warning(s)."
     else
-        log_pass "All dependency checks passed. Stage 6 lock-in gate met."
+        log_pass "All dependency checks passed. Stage 6 agreement gate met."
     fi
     exit 0
 }

package/scripts/validate-integration-docs.sh

@@ -341,7 +341,7 @@ check_grounding_doc() {
 
     local grounding="$REPO_ROOT/docs/design/integration/feature-grounding.md"
     if [[ ! -f "$grounding" ]]; then
-        log_warn "docs/design/integration/feature-grounding.md not found — create before lock-in"
+        log_warn "docs/design/integration/feature-grounding.md not found — create before agreement"
         return
     fi