@sdd-method/maintain-cli 0.4.0 → 0.6.0

package/dist/lib/ci-binding/index.js

@@ -94,6 +94,8 @@ function gitlabBlock(profile, runner) {
         '    DOCKER_TLS_CERTDIR: "/certs"',
         '    DOCKER_TLS_VERIFY: "1"',
         '    DOCKER_CERT_PATH: "/certs/client"',
+        // Full history: the behaviour-store stale check diffs living specs against each change's agreed commit.
+        '    GIT_DEPTH: "0"',
         "  rules:",
         '    - if: $CI_PIPELINE_SOURCE == "merge_request_event"',
         "    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH",

package/dist/lib/ci-binding/module.js

@@ -12,6 +12,7 @@
  */
 import { createHash } from "node:crypto";
 import { getMaintainCliVersion, getVerifyCliVersion } from "../package-version.js";
+import { OPENSPEC_VERSION } from "../validate/behaviour-store.js";
 /** Where the module lives in an SDD (M-ADR 0219 §4.3, ruled 2026-10-16). */
 export const MODULE_DIR = ".dagger/method-validation";
 /**
@@ -37,8 +38,9 @@ const VERIFY_PIN = "@@VERIFY_CLI_VERSION@@";
 // scan would read this text as an import of the CLI's own and refuse a dependency it does not declare.
 const DAGGER_SDK = "@@DAGGER_SDK@@";
 const MAINTAIN_PIN = "@@MAINTAIN_CLI_VERSION@@";
+const OPENSPEC_PIN = "@@OPENSPEC_VERSION@@";
 // The module's own source. String.raw keeps it byte-for-byte, so it holds no backtick; its only
-// substitutions are the three markers above, which renderModuleFiles replaces.
+// substitutions are the four markers above, which renderModuleFiles replaces.
 const INDEX_TS = String.raw `/**
  * Method Validation (M-ADR 0219): the method-managed validation job, as one Dagger module. Every CI
  * host calls it, and none keeps a step list of its own. Written by sdd-cli sync and method-managed:
@@ -57,6 +59,8 @@ import { dag, Container, Directory, File, object, func, ReturnType } from ${DAGG
 // Pinned, so a run is reproducible and every tool the validators shell out to is named here.
 const NODE_IMAGE = "node:20-bookworm"
 const YQ_VERSION = "v4.44.3"
+// The behaviour-store checks run OpenSpec at exactly the version the method depends on (M-ADR 0223 ruling 2), telemetry off.
+const OPENSPEC_VERSION = "${OPENSPEC_PIN}"
 
 interface PlanStep {
   id: string
@@ -69,8 +73,8 @@ interface PlanStep {
 @object()
 export class MethodValidation {
   /**
-   * The toolchain: Node, git, bash, python3, ripgrep, a pinned yq, and the exact-pinned verify and
-   * maintain CLIs. A tarball, when given, replaces the published package (a release candidate).
+   * The toolchain: Node, git, bash, python3, ripgrep, a pinned yq, the pinned OpenSpec CLI, and the
+   * exact-pinned verify and maintain CLIs. A tarball, when given, replaces the published package (a release candidate).
    */
   @func()
   toolchain(
@@ -99,7 +103,11 @@ export class MethodValidation {
       c = c.withFile("/pkgs/maintain-cli.tgz", maintainTarball)
       pkgs.push("/pkgs/maintain-cli.tgz")
     } else pkgs.push("@sdd-method/maintain-cli@" + maintainVersion)
-    return c.withExec(["npm", "install", "-g", "--silent", ...pkgs])
+    pkgs.push("@fission-ai/openspec@" + OPENSPEC_VERSION)
+    return c
+      .withEnvVariable("OPENSPEC_TELEMETRY", "0")
+      .withEnvVariable("DO_NOT_TRACK", "1")
+      .withExec(["npm", "install", "-g", "--silent", ...pkgs])
   }
 
   /**
@@ -130,10 +138,12 @@ export class MethodValidation {
     for (const step of plan.steps) {
       const ran = base.withExec([step.tool, ...step.args], { expect: ReturnType.Any })
       const code = await ran.exitCode()
-      const verdict = code === 0 ? "PASS" : step.advisory ? "ADVISORY" : "FAIL"
+      // A step that ran over an empty population (no behaviour store, say) reports N/A, never PASS.
+      const measuredNothing = code === 0 && /^\[(N\/A|SKIP)\] /m.test(await ran.stdout()) && !/^\[PASS\] (?!All validators)/m.test(await ran.stdout())
+      const verdict = code === 0 ? (measuredNothing ? "N/A" : "PASS") : step.advisory ? "ADVISORY" : "FAIL"
       if (code !== 0 && !step.advisory) failed++
       lines.push(verdict.padEnd(8) + " exit " + code + "  " + step.id + "  (" + step.title + ")")
-      if (code !== 0) {
+      if (code !== 0 || measuredNothing) {
         const out = (await ran.stdout()) + (await ran.stderr())
         lines.push(...out.trim().split("\n").slice(-6).map((l) => "           " + l))
       }
@@ -257,7 +267,7 @@ export function renderModuleFiles(pins = { verify: getVerifyCliVersion(), mainta
         ["catalogue-rebuild.sh", REBUILD_SH],
         ["dagger.json", DAGGER_JSON],
         ["package.json", PACKAGE_JSON],
-        ["src/index.ts", INDEX_TS.split(VERIFY_PIN).join(pins.verify).split(MAINTAIN_PIN).join(pins.maintain).split(DAGGER_SDK).join('"@dagger.io' + '/dagger"')],
+        ["src/index.ts", INDEX_TS.split(VERIFY_PIN).join(pins.verify).split(MAINTAIN_PIN).join(pins.maintain).split(OPENSPEC_PIN).join(OPENSPEC_VERSION).split(DAGGER_SDK).join('"@dagger.io' + '/dagger"')],
         ["tsconfig.json", TSCONFIG_JSON],
         ["yarn.lock", YARN_LOCK],
     ];

package/dist/lib/init/ci-workflow.js

@@ -93,6 +93,8 @@ function buildMethodManagedBlock(profile, runner) {
         // The branch itself when rebuilding, so the rebuild lands on it; otherwise the event's own ref.
         "          ref: ${{ steps.catalogue-token.outputs.token != '' && (github.head_ref || github.ref_name) || '' }}",
         "          persist-credentials: false",
+        // Full history: the behaviour-store stale check diffs living specs against each change's agreed commit.
+        "          fetch-depth: 0",
         "      - name: Install Dagger",
         `        run: curl -fsSL https://dl.dagger.io/dagger/install.sh | BIN_DIR="$RUNNER_TEMP/dagger" DAGGER_VERSION=${DAGGER_VERSION} sh && echo "$RUNNER_TEMP/dagger" >> "$GITHUB_PATH"`,
         "      - name: Rebuild catalogues",

package/dist/lib/sync/config.js

@@ -1,3 +1,4 @@
+import { existsSync } from "node:fs";
 import { readFile } from "node:fs/promises";
 import { dirname, isAbsolute, resolve } from "node:path";
 import { parse as parseYaml } from "yaml";
@@ -57,7 +58,7 @@ export async function loadSyncConfig(configPath) {
             const rel = `${name}/${name}-${ver}.tar.gz`;
             source = isUrl(resolvedBase)
                 ? `${resolvedBase.replace(/\/$/, "")}/${rel}`
-                : resolve(resolvedBase, name, `${name}-${ver}.tar.gz`);
+                : localBundle(resolve(resolvedBase, name), `${name}-${ver}`);
         }
         else {
             throw new Error(`Sync config ${absPath} bundles[${i}] missing required field: source ` +
@@ -69,4 +70,10 @@ export async function loadSyncConfig(configPath) {
         ? { version, bundles }
         : { version, bundleSource, bundles };
 }
+// <dir>/<stem>.tar.gz, or <dir>/<stem>.tgz when only that exists (same bytes, another name).
+function localBundle(dir, stem) {
+    const tarGz = resolve(dir, `${stem}.tar.gz`);
+    const tgz = resolve(dir, `${stem}.tgz`);
+    return !existsSync(tarGz) && existsSync(tgz) ? tgz : tarGz;
+}
 //# sourceMappingURL=config.js.map

package/dist/lib/validate/behaviour-store.js

@@ -0,0 +1,351 @@
+// Behaviour-store checks (M-ADR 0221, 0222, 0223): the gates OpenSpec itself does not enforce.
+//
+// An SDD's behaviour store is an OpenSpec project; in the inside-SDD shape it is `openspec/` at the
+// SDD root, with one agreement record per change at `docs/agreements/<change>.yaml`
+// (agreement-record-schema.yaml). OpenSpec checks the format of specs and deltas. It does not check
+// that a change was agreed before it was built, that the requirements it modifies stayed as they
+// were agreed, or that an archived change was judged. These are those checks:
+//
+//   1. records:  every agreement record has the shape the checks below read.
+//   2. agreement: an open change with any completed task has an agreed record and a Gate 0 that
+//                 ends CLEAR (the pre-apply check, M-ADR 0223 §4.3).
+//   3. stale:    for each open, agreed change that MODIFIES, REMOVES or RENAMES requirements, the
+//                 targeted living specs are unchanged since the agreed commit (M-ADR 0223 §4.5).
+//                 With no such targets the check is vacuous, and says so.
+//   4. verdicts: every archived change except a baseline has a verdict.md and a record whose
+//                 verdict is PASS and names it (M-ADR 0223 §4.6).
+//
+// A sibling-repository store (M-ADR 0221 §4.2) is checked in that repository, not here.
+//
+// OPENSPEC'S OWN VALIDATION is the separate validator `behaviour-store-openspec`, because it needs
+// the OpenSpec CLI at OPENSPEC_VERSION (the Method Validation module installs it). Without a store
+// both report [N/A], an empty population, never a pass.
+import { execFile } from "node:child_process";
+import { access, readdir, readFile } from "node:fs/promises";
+import { basename, join } from "node:path";
+import { promisify } from "node:util";
+import { parseDocument } from "yaml";
+const execFileAsync = promisify(execFile);
+/** The OpenSpec release the method depends on (M-ADR 0223 ruling 2). The module installs exactly this. */
+export const OPENSPEC_VERSION = "1.14.3";
+/** Telemetry off for every OpenSpec run the method makes. */
+export const OPENSPEC_ENV = { OPENSPEC_TELEMETRY: "0", DO_NOT_TRACK: "1" };
+export const STORE_DIR = "openspec";
+export const AGREEMENTS_DIR = "docs/agreements";
+const AGREEMENT_STATUSES = ["proposed", "agreed", "superseded", "withdrawn"];
+const COMMIT_RE = /^[0-9a-f]{7,40}$/;
+// OpenSpec counts a task done when its box holds only `x`, either case, any spacing.
+const TASK_DONE_RE = /^\s*-\s*\[\s*[xX]\s*\]/m;
+const TARGET_HEADING_RE = /^##\s+(MODIFIED|REMOVED|RENAMED)\s+Requirements\b/m;
+async function exists(p) {
+    try {
+        await access(p);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+async function dirs(p) {
+    try {
+        return (await readdir(p, { withFileTypes: true })).filter((d) => d.isDirectory()).map((d) => d.name).sort();
+    }
+    catch {
+        return [];
+    }
+}
+async function readText(p) {
+    try {
+        return await readFile(p, "utf8");
+    }
+    catch {
+        return null;
+    }
+}
+/** Read and shape-check one agreement record. Returns the record, or the problems found. */
+export function parseAgreementRecord(file, text) {
+    const problems = [];
+    const doc = parseDocument(text);
+    if (doc.errors.length > 0) {
+        return { problems: doc.errors.map((e) => `${file}: does not parse: ${e.message.split("\n")[0]}`) };
+    }
+    const root = doc.toJS();
+    const r = root?.agreement_record;
+    if (!r || typeof r !== "object")
+        return { problems: [`${file}: no top-level agreement_record`] };
+    const expected = basename(file).replace(/\.ya?ml$/, "");
+    if (r.change !== expected)
+        problems.push(`${file}: change is ${JSON.stringify(r.change)}, expected "${expected}" (the file name)`);
+    const status = typeof r.status === "string" ? r.status : "";
+    if (!AGREEMENT_STATUSES.includes(status)) {
+        problems.push(`${file}: status ${JSON.stringify(r.status)} is not one of ${AGREEMENT_STATUSES.join(" | ")}`);
+    }
+    const sdd = (r.sdd ?? {});
+    const gates = Array.isArray(r.gates) ? r.gates : [];
+    const gate0 = gates.find((g) => g && g.name === "gate-0");
+    if (status === "agreed") {
+        if (r.agreed_on === undefined || r.agreed_on === null)
+            problems.push(`${file}: agreed, but no agreed_on`);
+        if (typeof r.approved_by !== "string" || r.approved_by.trim() === "")
+            problems.push(`${file}: agreed, but no approved_by`);
+        if (typeof sdd.commit !== "string") {
+            problems.push(`${file}: sdd.commit must be a quoted string, found ${sdd.commit === undefined ? "nothing" : `${typeof sdd.commit} ${String(sdd.commit)}`}` +
+                (typeof sdd.commit === "number" ? " (unquoted, YAML parsed the SHA as a number)" : ""));
+        }
+        else if (!COMMIT_RE.test(sdd.commit)) {
+            problems.push(`${file}: sdd.commit "${sdd.commit}" is not 7-40 hex characters`);
+        }
+        if (!gate0)
+            problems.push(`${file}: agreed, but no gates entry named gate-0`);
+        else if (gate0.result !== "CLEAR")
+            problems.push(`${file}: agreed, but gate-0 result is ${JSON.stringify(gate0.result)}, not CLEAR`);
+    }
+    // Every commit a record pins must survive parsing as a string. YAML 1.2 reads an unquoted
+    // all-digit abbreviation as an integer and one shaped like `1234e567` or `123e456` as a float
+    // (Infinity), and the pin is then lost; checking the PARSED type is the only test that catches
+    // both, since a pattern applied after coercion sees "Infinity" or a number.
+    for (const [path, value] of commitFields(r)) {
+        if (path === "sdd.commit")
+            continue;
+        if (typeof value !== "string") {
+            problems.push(`${file}: ${path} must be a quoted string, found ${typeof value} ${String(value)} (unquoted, YAML parsed the SHA as a number)`);
+        }
+    }
+    const verdict = r.verdict && typeof r.verdict === "object" ? r.verdict : undefined;
+    if (problems.length > 0)
+        return { problems };
+    return {
+        record: {
+            file,
+            change: expected,
+            status,
+            ...(typeof sdd.commit === "string" ? { commit: sdd.commit } : {}),
+            ...(typeof gate0?.result === "string" ? { gate0: gate0.result } : {}),
+            ...(verdict ? { verdict } : {}),
+        },
+        problems,
+    };
+}
+/** Every pinned commit in a record: any key named `commit` or ending `_commit`, and each value under verdict.merged and current. */
+function commitFields(r) {
+    const out = [];
+    const walk = (v, path, pinMap) => {
+        if (Array.isArray(v))
+            v.forEach((x, i) => walk(x, `${path}[${i}]`, false));
+        else if (v && typeof v === "object") {
+            for (const [k, x] of Object.entries(v)) {
+                const p = path === "" ? k : `${path}.${k}`;
+                const isPin = pinMap || k === "commit" || k.endsWith("_commit");
+                if (isPin && (x === null || typeof x !== "object"))
+                    out.push([p, x]);
+                else
+                    walk(x, p, p === "verdict.merged" || p === "current");
+            }
+        }
+    };
+    walk(r, "", false);
+    return out;
+}
+function lastGateLine(text) {
+    const lines = text.split("\n").map((l) => l.trim()).filter((l) => l !== "");
+    return lines.at(-1) ?? "";
+}
+async function gitDiffQuiet(repo, commit, path) {
+    try {
+        await execFileAsync("git", ["-C", repo, "cat-file", "-e", `${commit}^{commit}`]);
+    }
+    catch {
+        return "unresolved";
+    }
+    try {
+        await execFileAsync("git", ["-C", repo, "diff", "--quiet", commit, "HEAD", "--", path]);
+        return "same";
+    }
+    catch (err) {
+        return err.code === 1 ? "changed" : "unresolved";
+    }
+}
+/** The living specs an open change's deltas modify, remove or rename: openspec/specs/<capability>/spec.md. */
+async function targetedSpecs(repo, changeDir) {
+    const out = [];
+    const walk = async (rel) => {
+        const abs = join(repo, changeDir, "specs", rel);
+        let entries;
+        try {
+            entries = await readdir(abs, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const e of entries) {
+            const childRel = rel === "" ? e.name : `${rel}/${e.name}`;
+            if (e.isDirectory())
+                await walk(childRel);
+            else if (e.name === "spec.md") {
+                const text = (await readText(join(abs, e.name))) ?? "";
+                if (TARGET_HEADING_RE.test(text))
+                    out.push(`${STORE_DIR}/specs/${rel}/spec.md`);
+            }
+        }
+    };
+    await walk("");
+    return out.sort();
+}
+export async function checkBehaviourStore(repo) {
+    if (!(await exists(join(repo, STORE_DIR)))) {
+        return { exitCode: 0, stdout: `[N/A] no behaviour store (${STORE_DIR}/) in this repository\n` };
+    }
+    const lines = [];
+    const failures = [];
+    // 1. records
+    const records = new Map();
+    let recordFiles = [];
+    try {
+        recordFiles = (await readdir(join(repo, AGREEMENTS_DIR))).filter((f) => /\.ya?ml$/.test(f)).sort();
+    }
+    catch {
+        recordFiles = [];
+    }
+    for (const f of recordFiles) {
+        const rel = `${AGREEMENTS_DIR}/${f}`;
+        const { record, problems } = parseAgreementRecord(rel, (await readText(join(repo, rel))) ?? "");
+        failures.push(...problems);
+        if (record)
+            records.set(record.change, record);
+    }
+    lines.push(`records: ${recordFiles.length} agreement record(s), ${recordFiles.length - records.size} malformed`);
+    // 2 and 3. open changes
+    const open = (await dirs(join(repo, STORE_DIR, "changes"))).filter((d) => d !== "archive");
+    let started = 0;
+    let staleChecked = 0;
+    for (const change of open) {
+        const dir = `${STORE_DIR}/changes/${change}`;
+        const tasks = await readText(join(repo, dir, "tasks.md"));
+        const record = records.get(change);
+        if (tasks !== null && TASK_DONE_RE.test(tasks)) {
+            started++;
+            if (!record)
+                failures.push(`${dir}: has completed tasks but no agreement record (${AGREEMENTS_DIR}/${change}.yaml)`);
+            else if (record.status !== "agreed")
+                failures.push(`${dir}: has completed tasks but its agreement record is ${record.status}, not agreed`);
+            const gate = await readText(join(repo, dir, "gate-0.md"));
+            if (gate === null)
+                failures.push(`${dir}: has completed tasks but no gate-0.md`);
+            else if (lastGateLine(gate) !== "GATE: CLEAR")
+                failures.push(`${dir}: has completed tasks but gate-0.md ends "${lastGateLine(gate)}", not "GATE: CLEAR"`);
+        }
+        if (record?.status === "agreed" && record.commit) {
+            for (const spec of await targetedSpecs(repo, dir)) {
+                staleChecked++;
+                const r = await gitDiffQuiet(repo, record.commit, spec);
+                if (r === "changed")
+                    failures.push(`${dir}: STALE: ${spec} changed since the agreed commit ${record.commit}`);
+                if (r === "unresolved")
+                    failures.push(`${dir}: stale check unresolved: commit ${record.commit} is not in this clone's history (a shallow clone cannot run it)`);
+            }
+        }
+    }
+    lines.push(`agreement: ${open.length} open change(s), ${started} with completed tasks`);
+    lines.push(staleChecked === 0 ? "stale: vacuous (no open agreed change modifies, removes or renames a requirement)" : `stale: ${staleChecked} targeted living spec(s) checked against their agreed commits`);
+    // 4. archived changes
+    const archived = await dirs(join(repo, STORE_DIR, "changes", "archive"));
+    let baselines = 0;
+    for (const name of archived) {
+        const dir = `${STORE_DIR}/changes/archive/${name}`;
+        if (await exists(join(repo, dir, "baseline-evidence.md"))) {
+            baselines++;
+            continue;
+        }
+        const change = name.replace(/^\d{4}-\d{2}-\d{2}-/, "");
+        if (!(await exists(join(repo, dir, "verdict.md"))))
+            failures.push(`${dir}: archived without verdict.md`);
+        const record = records.get(change);
+        if (!record) {
+            failures.push(`${dir}: archived without an agreement record (${AGREEMENTS_DIR}/${change}.yaml)`);
+            continue;
+        }
+        if (record.verdict?.result !== "PASS")
+            failures.push(`${record.file}: change is archived but verdict.result is ${JSON.stringify(record.verdict?.result)}, not PASS`);
+        const vr = record.verdict?.record;
+        if (typeof vr !== "string" || !(await exists(join(repo, vr))))
+            failures.push(`${record.file}: verdict.record ${JSON.stringify(vr)} does not name an existing file`);
+    }
+    lines.push(`verdicts: ${archived.length} archived change(s), ${baselines} baseline(s), ${archived.length - baselines} needing a PASS verdict`);
+    const population = recordFiles.length + open.length + archived.length;
+    const body = lines.map((l) => `  ${l}`).join("\n") + "\n";
+    if (failures.length > 0) {
+        return { exitCode: 1, stdout: body + failures.map((f) => `[FAIL] ${f}`).join("\n") + "\n" };
+    }
+    if (population === 0)
+        return { exitCode: 0, stdout: body + `[N/A] the behaviour store has no changes and no agreement records yet\n` };
+    return { exitCode: 0, stdout: body + "[PASS] behaviour store: records, agreement, stale and verdict checks hold\n" };
+}
+async function runOpenspec(repo, args) {
+    try {
+        const { stdout } = await execFileAsync("openspec", args, { cwd: repo, env: { ...process.env, ...OPENSPEC_ENV }, maxBuffer: 16 * 1024 * 1024 });
+        return { code: 0, json: JSON.parse(stdout), raw: stdout };
+    }
+    catch (err) {
+        const e = err;
+        let json;
+        try {
+            json = JSON.parse(e.stdout ?? "");
+        }
+        catch {
+            json = undefined;
+        }
+        return { code: typeof e.code === "number" ? e.code : 127, ...(json ? { json } : {}), raw: (e.stdout ?? "") + (e.stderr ?? "") };
+    }
+}
+/** OpenSpec's own strict validation of the store: specs and open changes, and archived changes' tasks. */
+export async function checkBehaviourStoreOpenspec(repo) {
+    if (!(await exists(join(repo, STORE_DIR)))) {
+        return { exitCode: 0, stdout: `[N/A] no behaviour store (${STORE_DIR}/) in this repository\n` };
+    }
+    let version = "";
+    try {
+        version = (await execFileAsync("openspec", ["--version"], { env: { ...process.env, ...OPENSPEC_ENV } })).stdout.trim();
+    }
+    catch {
+        return {
+            exitCode: 1,
+            stdout: `[FAIL] the OpenSpec CLI is not on PATH; this repository has a behaviour store, so its validation cannot run (install @fission-ai/openspec@${OPENSPEC_VERSION}; the Method Validation module does)\n`,
+        };
+    }
+    if (version !== OPENSPEC_VERSION) {
+        return { exitCode: 1, stdout: `[FAIL] OpenSpec ${version} is installed; the method depends on exactly ${OPENSPEC_VERSION}\n` };
+    }
+    const lines = [];
+    const failures = [];
+    let measured = 0;
+    for (const [label, args] of [
+        ["specs and open changes (--all --strict)", ["validate", "--all", "--strict", "--json", "--no-interactive"]],
+        ["archived changes' tasks (--archived)", ["validate", "--archived", "--json", "--no-interactive"]],
+    ]) {
+        const r = await runOpenspec(repo, [...args]);
+        const t = r.json?.summary?.totals;
+        if (!t) {
+            failures.push(`${label}: OpenSpec returned no report (exit ${r.code}): ${r.raw.trim().split("\n").slice(-3).join(" | ")}`);
+            continue;
+        }
+        measured += t.items ?? 0;
+        lines.push(`${label}: ${t.items ?? 0} item(s), ${t.passed ?? 0} passed, ${t.failed ?? 0} failed`);
+        for (const item of r.json?.items ?? []) {
+            if (item.valid)
+                continue;
+            for (const i of item.issues ?? [])
+                failures.push(`${label}: ${item.id}${i.path ? ` (${i.path})` : ""}: ${i.level} ${i.message}`);
+            if ((item.issues ?? []).length === 0)
+                failures.push(`${label}: ${item.id}: invalid`);
+        }
+        if (r.code !== 0 && (t.failed ?? 0) === 0)
+            failures.push(`${label}: OpenSpec exited ${r.code} with no failed item reported`);
+    }
+    const body = [`  OpenSpec ${version}`, ...lines.map((l) => `  ${l}`)].join("\n") + "\n";
+    if (failures.length > 0)
+        return { exitCode: 1, stdout: body + failures.map((f) => `[FAIL] ${f}`).join("\n") + "\n" };
+    if (measured === 0)
+        return { exitCode: 0, stdout: body + "[N/A] OpenSpec found no specs and no changes to validate\n" };
+    return { exitCode: 0, stdout: body + "[PASS] OpenSpec strict validation holds\n" };
+}
+//# sourceMappingURL=behaviour-store.js.map

package/dist/lib/validate/dispatch.js

@@ -1,5 +1,20 @@
+import { checkBehaviourStore, checkBehaviourStoreOpenspec } from "./behaviour-store.js";
 import { checkBundleCoherence } from "./bundle-coherence.js";
 import { checkYamlParse } from "./yaml-parse.js";
+// The behaviour store (M-ADR 0221-0223) can sit in an SDD of any profile, so every profile carries
+// its two checks; without a store both report [N/A], an empty population, not a pass.
+const BEHAVIOUR_STORE_VALIDATORS = [
+    {
+        name: "behaviour-store",
+        source: { kind: "native", run: async (ctx) => checkBehaviourStore(ctx.targetRepo) },
+        build: () => ({ status: "run", args: [] }),
+    },
+    {
+        name: "behaviour-store-openspec",
+        source: { kind: "native", run: async (ctx) => checkBehaviourStoreOpenspec(ctx.targetRepo) },
+        build: () => ({ status: "run", args: [] }),
+    },
+];
 // Validators that accept --app-root / --repo-root flags work fine from the
 // bundled location because they override their internal ROOT_DIR via the
 // flag. Validators without that flag (adr-structure, runway-classification,
@@ -74,6 +89,7 @@ const APP_VALIDATORS = [
         },
         build: () => ({ status: "run", args: [] }),
     },
+    ...BEHAVIOUR_STORE_VALIDATORS,
     // Note: validate-runway-classification is intentionally NOT in the app set.
     // It requires platform-level files (docs/platform/feature-tree.md,
     // architecture-runway-index.md) that app repos don't own. Per ADR 0089,
@@ -126,6 +142,7 @@ const INTEGRATION_VALIDATORS = [
         },
         build: () => ({ status: "run", args: [] }),
     },
+    ...BEHAVIOUR_STORE_VALIDATORS,
 ];
 const PLATFORM_VALIDATORS = [
     {
@@ -208,6 +225,7 @@ const PLATFORM_VALIDATORS = [
         },
         build: () => ({ status: "run", args: [] }),
     },
+    ...BEHAVIOUR_STORE_VALIDATORS,
     // Optional: the upstream validate-docs.sh dispatcher covers the 6
     // conditional validators (backward-compatibility, deprecation-runway,
     // migration-completeness, ddd-artifacts, glossary-alignment,

package/dist/lib/validate/plan.js

@@ -22,6 +22,8 @@ const TITLES = {
     "yaml-parse": "Validate that tracked YAML parses",
     "gate-readiness": "Validate gate readiness",
     "bundle-coherence": "Report bundle coherence",
+    "behaviour-store": "Validate the behaviour store: agreement records, the pre-apply gate, stale requirements, verdicts",
+    "behaviour-store-openspec": "Validate the behaviour store with OpenSpec (strict)",
     // CI has no platform checkout, so this step runs the app-only checks; the met gate needs the platform beside it.
     "app-dependencies": "Validate app dependencies (app-only checks; no platform checkout in CI)",
 };

package/dist/lib/vocabulary/renames.js

@@ -0,0 +1,40 @@
+/**
+ * The method's vocabulary renames (M-ADR 0222 §4.1), loaded from the vendored copy of
+ * sdd-method's docs/method/foundations/vocabulary-renames.yaml (one-way, sdd-method ->
+ * vendored; scripts/sync-vendored-script.sh, drift-tested in tests/parity).
+ *
+ * For one major release every reader accepts a former value and reads it as the new one;
+ * from `removed_in` the former value is an error. Readers ask this module rather than
+ * keeping their own copy, so a rename has one definition here as it has one in the bundles.
+ */
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { parse } from "yaml";
+const __dirname = dirname(fileURLToPath(import.meta.url));
+export const VENDORED_RENAMES_PATH = join(__dirname, "vocabulary-renames.yaml");
+let cached;
+export function vocabularyRenames() {
+    if (cached === undefined) {
+        const doc = parse(readFileSync(VENDORED_RENAMES_PATH, "utf8"));
+        cached = { introduced_in: String(doc.introduced_in), removed_in: String(doc.removed_in), renames: doc.renames };
+    }
+    return cached;
+}
+/** The rename with this id; throws on an id the file does not hold, so a reader cannot silently lose its alias. */
+export function rename(id) {
+    const r = vocabularyRenames().renames.find((x) => x.id === id);
+    if (r === undefined)
+        throw new Error(`vocabulary-renames.yaml has no rename "${id}"`);
+    return r;
+}
+/** The value as a reader should treat it: the new name for the former one, anything else unchanged. */
+export function canonicalValue(id, value) {
+    const r = rename(id);
+    return value === r.old ? r.new : value;
+}
+/** Whether a value is the former name under this rename (for the reader's finding). */
+export function isFormerValue(id, value) {
+    return value === rename(id).old;
+}
+//# sourceMappingURL=renames.js.map

package/dist/lib/vocabulary/vocabulary-renames.yaml

@@ -0,0 +1,76 @@
+# Vocabulary renames (M-ADR 0222 §4.1)
+#
+# The tool-read values the method renamed when "lock" left its vocabulary, as data:
+# every reader that accepts a former value, and the migrate verb, follows this file.
+# For one major release a reader accepts the former value, treats it as the new one
+# and reports it; from removed_in the former value is an error.
+#
+# Each reader that aliases a former value marks the place with a comment line
+#   vocabulary-alias: <old> -> <new>
+# and the correspondence registry holds the readers and this file to each other in
+# both directions (orchestration/correspondence-registry.yaml, vocabulary-renames).
+#
+# Consumed by:
+#   - validate-spec-lifecycle.sh, validate-traceability.sh, validate-app-dependencies.sh,
+#     dispatch-release.sh (the bundled readers)
+#   - sdd-cli's catalogue build and repo-config reader
+#   - `sdd-cli migrate vocabulary` (rewrites an SDD's own files)
+#
+# Distribution: ships in every method baseline via the seed-file lists.
+
+schema_version: "1.0.0"
+introduced_in: "2.0.0"   # the sdd-cli major that reads both names
+removed_in: "3.0.0"      # the sdd-cli major that rejects the former names
+
+renames:
+  - id: authoring-status-detailed
+    old: detailed-pre-lock
+    new: detailed
+    positions:
+      - "spec `**Status:**` header (M-ADR 0201's authoring ladder)"
+      - "work-order status"
+      - "capability manifest `capability.status` (a spec-authoring stage on the wrong axis; reported, never translated)"
+
+  - id: stability-stable
+    old: locked
+    new: stable
+    positions:
+      - "`required_stability` (app and integration platform dependencies)"
+      - "`traceability.contracts.status` (the contract-set maturity ladder)"
+      - "repository config `stability` (a stability class)"
+      - "runtime-artefact `stability` and `template-stability`"
+    note: "Only where `locked` is a stability CLASS. A pinned version is a different thing (M-ADR 0222 §4.1)."
+
+  - id: agreement-tag
+    old: release-vMAJOR.MINOR-locked
+    new: release-vMAJOR.MINOR-agreed
+    positions:
+      - "the agreement tag on a release branch (M-ADRs 0072-0074)"
+
+  - id: agreement-tag-key
+    old: lock_in_tag
+    new: agreement_tag
+    positions:
+      - "a platform BASELINE.md record key (M-ADR 0073)"
+
+  - id: gate-registry-next-gate
+    old: lock-in
+    new: agreement
+    positions:
+      - "gate registry `next_gate` value (domain-architecture rubric)"
+
+  - id: gate-registry-remediation-key
+    old: remediation_before_lock_in
+    new: remediation_before_agreement
+    positions:
+      - "gate registry key (domain-architecture rubric)"
+
+  - id: journey-status-accepted
+    old: accepted-pre-lock
+    new: accepted
+    positions:
+      - "user-journey status (templates only; no reader)"
+
+# An extension an adopter names itself (an `x-<adopter>-stability` contract extension,
+# say) is the adopter's to rename; its values follow the method's (M-ADR 0222 §4.1). The migrate verb
+# reports such extensions and never rewrites them.

package/dist/maintain-version.json

@@ -1,4 +1,4 @@
 {
-  "version": "0.4.0",
-  "built_against_sdd_cli": "1.45.0"
+  "version": "0.6.0",
+  "built_against_sdd_cli": "2.0.0"
 }

package/dist/verify-version.json

@@ -1,4 +1,4 @@
 {
-  "version": "1.4.0",
-  "built_against_sdd_cli": "1.45.0"
+  "version": "2.0.0",
+  "built_against_sdd_cli": "2.0.0"
 }