@sdd-method/maintain-cli 0.6.0 → 0.8.0

package/dist/lib/behaviour-store/archive.js

@@ -0,0 +1,180 @@
+// What the catalogue and the behaviour-store checks both read from a store's archive: the order its changes
+// were archived in, and the requirements each delta names. Pure reads, no catalogue or validator types, so the
+// verify-only CLI can carry it.
+//
+// Archive order is the archive date, then the order in which the SDD's history first added each archive
+// directory, then the name. The date prefix alone ties for changes archived the same day, and their names say
+// nothing about which came first; an untracked archive is newer than every tracked one. Same-day archives the
+// history cannot order are returned as ties, for the caller to report.
+import { execFile as execFileCb } from "node:child_process";
+import { promisify } from "node:util";
+const execFile = promisify(execFileCb);
+/** Requirement names and scenario counts under each `## <OP> Requirements` section (or the whole file for a living spec). */
+export function parseRequirements(text) {
+    const out = [];
+    let op = null;
+    let current = null;
+    for (const line of text.split("\n")) {
+        const section = /^##\s+(ADDED|MODIFIED|REMOVED|RENAMED)\s+Requirements\b/.exec(line);
+        if (section) {
+            op = section[1];
+            current = null;
+            continue;
+        }
+        if (/^##\s/.test(line) && !/^###/.test(line)) {
+            current = null;
+            continue;
+        }
+        // RENAMED: "- FROM: `### Requirement: Old name`" then "- TO: `### Requirement: New name`"
+        const renamedFrom = /^\s*-\s*FROM:\s*`?###\s+Requirement:\s*(.+?)`?\s*$/.exec(line);
+        if (op === "RENAMED" && renamedFrom) {
+            current = null;
+            continue;
+        }
+        const renamedTo = /^\s*-\s*TO:\s*`?###\s+Requirement:\s*(.+?)`?\s*$/.exec(line);
+        if (op === "RENAMED" && renamedTo) {
+            current = { name: renamedTo[1].trim(), operation: op, scenarios: 0 };
+            out.push(current);
+            continue;
+        }
+        const req = /^###\s+Requirement:\s*(.+?)\s*$/.exec(line);
+        if (req) {
+            current = { name: req[1], operation: op, scenarios: 0 };
+            out.push(current);
+            continue;
+        }
+        if (current && /^####\s+Scenario:/.test(line))
+            current.scenarios++;
+    }
+    return out;
+}
+/** The names a RENAMED section renames FROM (the requirement a rename removes). */
+export function renamedFrom(text) {
+    const out = [];
+    let op = null;
+    for (const line of text.split("\n")) {
+        const section = /^##\s+(ADDED|MODIFIED|REMOVED|RENAMED)\s+Requirements\b/.exec(line);
+        if (section) {
+            op = section[1];
+            continue;
+        }
+        const m = /^\s*-\s*FROM:\s*`?###\s+Requirement:\s*(.+?)`?\s*$/.exec(line);
+        if (op === "RENAMED" && m)
+            out.push(m[1].trim());
+    }
+    return out;
+}
+/** Each archive directory's position in the SDD's history: the index of the first commit that added a file under it. */
+async function archiveHistory(sddPath, archiveRel) {
+    let stdout;
+    try {
+        ({ stdout } = await execFile("git", ["-C", sddPath, "log", "--relative", "--reverse", "--diff-filter=A", "--format=@%H", "--name-only", "--", archiveRel], { maxBuffer: 64 * 1024 * 1024 }));
+    }
+    catch {
+        return null;
+    }
+    const order = new Map();
+    let commit = -1;
+    for (const line of stdout.split("\n")) {
+        if (line.startsWith("@")) {
+            commit++;
+            continue;
+        }
+        if (!line.startsWith(`${archiveRel}/`))
+            continue;
+        const dir = line.slice(archiveRel.length + 1).split("/")[0];
+        if (!order.has(dir))
+            order.set(dir, commit);
+    }
+    return order;
+}
+/** Archive directories in archive order, and the adjacent same-day pairs the history could not order. */
+export async function orderArchives(sddPath, archiveRel, names) {
+    const history = await archiveHistory(sddPath, archiveRel);
+    const date = (d) => /^(\d{4}-\d{2}-\d{2})-/.exec(d)?.[1] ?? "";
+    const position = (d) => history?.get(d) ?? Number.POSITIVE_INFINITY;
+    const order = [...names].sort((a, b) => date(a).localeCompare(date(b)) || position(a) - position(b) || a.localeCompare(b));
+    const ties = [];
+    for (let i = 1; i < order.length; i++) {
+        const [a, b] = [order[i - 1], order[i]];
+        if (date(a) === date(b) && position(a) === position(b))
+            ties.push([a, b]);
+    }
+    return { order, ties };
+}
+/** The repositories a baseline was observed in: its evidence file's `**Observed in:** repo[@sha], repo[@sha]` line. */
+export function observedIn(evidence) {
+    const m = /^\s*\*\*Observed in:\*\*\s*(.+)$/m.exec(evidence);
+    if (!m)
+        return [];
+    return m[1]
+        .split(",")
+        .map((s) => s.trim().split(/\s*@\s*/)[0].replace(/`/g, "").trim())
+        .filter((s) => s !== "");
+}
+/**
+ * A baseline's `**Surfaces:**` list (M-ADR 0222 §4.3, §4.4; agreement-record-schema.yaml, Baselines): one entry per
+ * contract the observed repositories serve, either
+ *   - <contract>: covered at transport[; <note>]
+ *   - <contract>: excluded, <reason>[; <note>]
+ * A note carries detail inside the contract, such as an operation left out and why. The last standalone
+ * `**Surfaces:**` line is read, so an earlier prose section under the same label does not shadow the list.
+ * Covered needs evidence that exercises the surface as the service exposes it; evidence below the transport is
+ * not coverage, so `covered at handler` is a problem, not an entry. A wildcard may only exclude.
+ */
+export function parseSurfaces(evidence) {
+    const lines = evidence.split("\n");
+    // The LAST standalone line: an evidence file may carry an earlier prose section under the same label, and
+    // the list is what the file ends up asserting.
+    let at = -1;
+    lines.forEach((l, i) => {
+        if (/^\s*\*\*Surfaces:\*\*\s*$/.test(l))
+            at = i;
+    });
+    if (at < 0)
+        return { present: false, entries: [], problems: [] };
+    const entries = [];
+    const problems = [];
+    for (const line of lines.slice(at + 1)) {
+        if (line.trim() === "" && entries.length + problems.length === 0)
+            continue;
+        const item = /^\s*-\s+(.+?)\s*$/.exec(line);
+        if (!item)
+            break;
+        const m = /^`?([^`]+?)`?\s*:\s*(.+)$/.exec(item[1]);
+        if (!m) {
+            problems.push(`"${item[1]}" is not "<contract>: covered at transport" or "<contract>: excluded, <reason>"`);
+            continue;
+        }
+        const contract = m[1].trim();
+        const status = m[2].split(";")[0].trim();
+        const excluded = /^excluded\s*,\s*(.+)$/i.exec(status);
+        if (/^covered at transport$/i.test(status)) {
+            if (contract.includes("*"))
+                problems.push(`"${contract}": a wildcard may only exclude; list each covered contract`);
+            else
+                entries.push({ contract, covered: true, reason: "" });
+        }
+        else if (excluded) {
+            entries.push({ contract, covered: false, reason: excluded[1].trim() });
+        }
+        else if (/^covered\b/i.test(status)) {
+            problems.push(`"${contract}: ${status}": covered needs evidence at the transport; evidence below it (a handler called directly, a hand-built request) is an exclusion: "excluded, handler-only evidence"`);
+        }
+        else {
+            problems.push(`"${contract}: ${status}" is neither "covered at transport" nor "excluded, <reason>"`);
+        }
+    }
+    if (entries.length + problems.length === 0)
+        problems.push("the **Surfaces:** line lists no contract");
+    return { present: true, entries, problems };
+}
+/** Whether a Surfaces entry names a catalogue contract: its id, or a path suffix of its spec_path on a segment boundary. */
+export function surfaceMatches(entry, contractId, specPath) {
+    const e = entry.replace(/^\.\//, "");
+    if (e === contractId)
+        return true;
+    const re = new RegExp(`(^|/)${e.split("*").map((p) => p.replace(/[.+?^${}()|[\]\\]/g, "\\$&")).join("[^/]*")}$`);
+    return re.test(specPath.split("\\").join("/"));
+}
+//# sourceMappingURL=archive.js.map

package/dist/lib/catalogue/build.js

@@ -826,7 +826,11 @@ async function collectRows(schema, manifest, findings, sddPath, snapshotStore) {
     // name/domain/publisher/transport; avsc augments schema_path/version.
     // service_event edges populate from both repo-config events.produces/consumes
     // (forward) and event-catalog.yaml publisher + consumers[] (reverse).
-    const avroContracts = contractsResult.rows.filter((c) => c["kind"] === "event");
+    // Discovered AND declared-external event contracts: an event schema in a sibling contracts repository
+    // (M-ADR 0110) is as much an event as one in the SDD. Filtering the discovered rows alone left every
+    // declared-external schema without an event row, so produces/consumes edges that resolved to one were
+    // dropped as unknown events.
+    const avroContracts = [...contractsResult.rows, ...declaredExternal.rows].filter((c) => c["kind"] === "event");
     const eventsResult = await buildEvents({
         sddPath,
         findings,

package/dist/lib/catalogue/builders/contracts.js

@@ -46,13 +46,18 @@ const KIND_SPECS = [
     // and it stayed invisible for the same reason: an unreachable value is emitted
     // for nothing and so never complains.
     //
-    // NOT zero-delta, unlike spicedb: the reverse estate already holds 7 `.graphql`
-    // files under the conventional `docs/domains/<domain>/contracts/graphql/` layout
-    // (vehicle 5, applications 2), invisible to the catalogue until now. An author
+    // NOT zero-delta, unlike spicedb: an estate already held `.graphql` files under
+    // the conventional `docs/domains/<domain>/contracts/graphql/` layout, invisible
+    // to the catalogue until then. An author
     // whose GraphQL surface could not be keyed documented the wall in their own
     // manifest — naming the schema lines that blocked them — and wrote the only
     // token left in `contracts.status`.
     { subdir: "graphql", extensions: [".graphql", ".graphqls"], kind: "graphql" },
+    // `cli` — a command-line interface's command manifest (schema 4.1.0). A command-line tool often serves no
+    // REST, RPC, event or authorization contract, so without this kind its behaviour baselines had nothing to
+    // name as their surface (M-ADR 0222 §4.4). Reachable from every path at once, unlike graphql above: discovered here, mapped from a
+    // traceability manifest's `cli:` block (DECLARED_KINDS), loaded (CONTRACT_LIST_KEYS) and keyed by repo-config.
+    { subdir: "cli", extensions: [".yaml", ".yml"], kind: "cli" },
 ];
 export async function buildContracts(inputs) {
     const rows = [];
@@ -319,6 +324,7 @@ const DECLARED_KINDS = {
     avro: "event",
     spicedb: "authz",
     graphql: "graphql",
+    cli: "cli",
 };
 export function buildDeclaredExternalContracts(inputs) {
     const rows = [];

package/dist/lib/catalogue/builders/events.js

@@ -137,12 +137,19 @@ export async function buildEvents(inputs) {
 function normaliseSchemaPath(p) {
     return p.trim().replace(/\\/g, "/").replace(/^\.\//, "");
 }
-function inferDomainFromAvroPath(relPath) {
-    // Layout: contracts/avro/<domain>/<file>.avsc
-    const parts = relPath.split(sep);
-    if (parts.length < 4)
+export function inferDomainFromAvroPath(relPath) {
+    // Layouts: contracts/avro/<domain>/…/<file>.avsc (in the SDD); <x>-avro/<domain>/…/<file>.avsc (a sibling
+    // contracts repository, M-ADR 0110, as declared-external rows give it); docs/domains/<domain>/…
+    // The domain is the segment after the avro root, never a fixed position: the sibling layout is one level
+    // shallower, and a fixed index read its `events/` folder as the domain.
+    const parts = relPath.split("\\").join("/").split("/");
+    const d = parts.indexOf("domains");
+    if (d >= 0 && parts[d - 1] === "docs" && parts.length > d + 2)
+        return parts[d + 1] ?? "";
+    const root = parts.findIndex((p) => p === "avro" || p.endsWith("-avro"));
+    if (root < 0 || parts.length < root + 3)
         return "";
-    return parts[2] ?? "";
+    return parts[root + 1] ?? "";
 }
 function resolveContractByPath(schema, kind, index) {
     const cleaned = schema.replace(/^\/+/, "");

package/dist/lib/catalogue/builders/repo-edges.js

@@ -23,6 +23,7 @@
 //     openapi: [<path-relative-to-contracts/openapi/>]
 //     proto:   [<path-relative-to-contracts/proto/>]
 //     avro:    [<path-relative-to-contracts/avro/>]
+//     spicedb: [<path-relative-to-contracts/spicedb/>]
 //
 // Reverse-method derived sources (universal — work for any SDD with the
 // underlying catalogue rows populated):
@@ -49,7 +50,7 @@
 // feature-set` path is documented in the metamodel but unused by any
 // observed adopter — left empty here pending first-adopter authoring.
 import { basename, sep } from "node:path";
-import { normaliseAdditionalContextEntry, } from "./repositories.js";
+import { normaliseAdditionalContextEntry, REPO_CONFIG_CONTRACT_KINDS, } from "./repositories.js";
 /**
  * feature_repo derivation — `feature_service ⋈ services.primary_repo_id`.
  *
@@ -263,7 +264,7 @@ function collectRepoContract(inputs) {
         seen.add(id);
         rows.push({ id, repo_id: repoId, contract_id: contractId });
     };
-    // Forward path — declared in repo-config contracts.{openapi,proto,avro}[].
+    // Forward path — declared in repo-config contracts.{openapi,proto,avro,spicedb}[].
     // Pre-compute suffix and basename indexes for fuzzy matching.
     const suffixIndex = new Map();
     const basenameIndex = new Map();
@@ -278,7 +279,7 @@ function collectRepoContract(inputs) {
         const block = cfg.data.contracts;
         if (!block)
             continue;
-        for (const kind of ["openapi", "proto", "avro"]) {
+        for (const kind of REPO_CONFIG_CONTRACT_KINDS) {
             const list = block[kind] ?? [];
             for (const rawEntry of list) {
                 const entry = rawEntry.replace(/^\/+/, "");

package/dist/lib/catalogue/builders/repositories.js

@@ -32,11 +32,18 @@ const LOC_REPORT_REL = join("docs", "platform", "reference", "loc-report.csv");
 // mirrored source, where the manifest profile remains the honest answer.
 const REPOS_DIR_REL = "repos";
 const REVERSE_METADATA_BASENAME = "reverse-metadata.yaml";
+// The contract kinds a repo-config `contracts:` block keys, under `contracts/<kind>/`. The sdd-index reader
+// accepts the same five; `spicedb` (an `authz` contract) was once missing here, and zod strips an unknown key,
+// so a declared `.zed` schema vanished without a finding. `cli` (schema 4.1.0) declares the command manifest a
+// command-line repository serves. GraphQL is not keyed in repo-config: that is its own question, on this schema.
+export const REPO_CONFIG_CONTRACT_KINDS = ["openapi", "proto", "avro", "spicedb", "cli"];
 const ContractsBlockSchema = z
     .object({
     openapi: z.array(z.string()).optional(),
     proto: z.array(z.string()).optional(),
     avro: z.array(z.string()).optional(),
+    spicedb: z.array(z.string()).optional(),
+    cli: z.array(z.string()).optional(),
 })
     .optional();
 const EventEntrySchema = z.object({

package/dist/lib/catalogue/builders/requirements.js

@@ -14,10 +14,14 @@
 //                       its work orders' `implements` lists; agreed from an open change whose record is agreed.
 //                       The latest event wins, archived changes in archive order, then open changes.
 //
+// Archive order is ../../behaviour-store/archive.ts's; same-day archives the history cannot order are a finding.
+//
 // A feature or repository the catalogue does not hold is a finding and produces no row, so no foreign key dangles.
 import { readdir, readFile, stat } from "node:fs/promises";
 import { join } from "node:path";
 import { parse as parseYaml } from "yaml";
+import { observedIn, orderArchives, parseRequirements } from "../../behaviour-store/archive.js";
+export { observedIn, parseRequirements };
 const STORE = "openspec";
 const AGREEMENTS = join("docs", "agreements");
 async function isDir(p) {
@@ -44,40 +48,6 @@ async function readText(p) {
         return null;
     }
 }
-/** Requirement names and scenario counts under each `## <OP> Requirements` section (or the whole file for a living spec). */
-export function parseRequirements(text) {
-    const out = [];
-    let op = null;
-    let current = null;
-    for (const line of text.split("\n")) {
-        const section = /^##\s+(ADDED|MODIFIED|REMOVED|RENAMED)\s+Requirements\b/.exec(line);
-        if (section) {
-            op = section[1];
-            current = null;
-            continue;
-        }
-        if (/^##\s/.test(line) && !/^###/.test(line)) {
-            current = null;
-            continue;
-        }
-        // RENAMED: "- TO: `### Requirement: New name`"
-        const renamedTo = /^\s*-\s*TO:\s*`?###\s+Requirement:\s*(.+?)`?\s*$/.exec(line);
-        if (op === "RENAMED" && renamedTo) {
-            current = { name: renamedTo[1].trim(), operation: op, scenarios: 0 };
-            out.push(current);
-            continue;
-        }
-        const req = /^###\s+Requirement:\s*(.+?)\s*$/.exec(line);
-        if (req) {
-            current = { name: req[1], operation: op, scenarios: 0 };
-            out.push(current);
-            continue;
-        }
-        if (current && /^####\s+Scenario:/.test(line))
-            current.scenarios++;
-    }
-    return out;
-}
 async function deltaOf(changeDir) {
     const out = [];
     for (const feature of await dirs(join(changeDir, "specs"))) {
@@ -104,15 +74,13 @@ async function agreementRecord(sddPath, change) {
         return null;
     }
 }
-/** The repositories a baseline was observed in: its evidence file's `**Observed in:** repo[@sha], repo[@sha]` line. */
-export function observedIn(evidence) {
-    const m = /^\s*\*\*Observed in:\*\*\s*(.+)$/m.exec(evidence);
-    if (!m)
-        return [];
-    return m[1]
-        .split(",")
-        .map((s) => s.trim().split(/\s*@\s*/)[0].replace(/`/g, "").trim())
-        .filter((s) => s !== "");
+/** Archive directories in archive order; same-day archives the history cannot order are reported. */
+export async function archiveOrder(sddPath, names, findings) {
+    const { order, ties } = await orderArchives(sddPath, `${STORE}/changes/archive`, names);
+    for (const [a, b] of ties) {
+        findings.add("convention", `${STORE}/changes/archive: ${a} and ${b} were archived the same day and the SDD's history does not say which came first; ordered by name, so a status that depends on their order may be wrong`);
+    }
+    return order;
 }
 const rel = (sddPath, p) => p.slice(sddPath.length + 1).split("\\").join("/");
 export async function buildRequirements(inputs) {
@@ -156,7 +124,7 @@ export async function buildRequirements(inputs) {
             events.push(e);
     };
     // 2. Archived changes, in archive order.
-    for (const dir of await dirs(join(store, "changes", "archive"))) {
+    for (const dir of await archiveOrder(sddPath, await dirs(join(store, "changes", "archive")), findings)) {
         const changeDir = join(store, "changes", "archive", dir);
         const change = dir.replace(/^\d{4}-\d{2}-\d{2}-/, "");
         const archivedOn = /^(\d{4}-\d{2}-\d{2})-/.exec(dir)?.[1] ?? "";

package/dist/lib/catalogue/builders/service-contract.js

@@ -1,10 +1,11 @@
 // service_contract edge — emits one row per (service, contract, exposes)
-// triple from `contracts.{openapi,proto,avro}` blocks in repo-config.
+// triple from `contracts.{openapi,proto,avro,spicedb}` blocks in repo-config.
 //
 // Forward method convention: a service's repo-config declares the
 // contracts it exposes. The "consumes" role isn't declared in current
 // adopters; this builder emits role=exposes only.
 import { basename, sep } from "node:path";
+import { REPO_CONFIG_CONTRACT_KINDS } from "./repositories.js";
 export function buildServiceContract(inputs) {
     const rows = [];
     const seen = new Set();
@@ -30,13 +31,9 @@ export function buildServiceContract(inputs) {
             // stays silent, as it always has.
             // NOTE: `block` here is repo-config's `contracts` (cfg.data.contracts), a
             // DIFFERENT schema from the traceability manifest's contracts block — so its
-            // three kinds are not a stale copy of the manifest's five and must not be
-            // "fixed" by the shared traceability helper. Whether repo-config should also
-            // key graphql is its own question, on its own schema.
-            const hasContracts = block !== undefined &&
-                ((block.openapi?.length ?? 0) > 0 ||
-                    (block.proto?.length ?? 0) > 0 ||
-                    (block.avro?.length ?? 0) > 0);
+            // kinds (REPO_CONFIG_CONTRACT_KINDS) are not a stale copy of the manifest's five
+            // and must not be "fixed" by the shared traceability helper.
+            const hasContracts = block !== undefined && REPO_CONFIG_CONTRACT_KINDS.some((k) => (block[k]?.length ?? 0) > 0);
             if (hasContracts) {
                 inputs.findings.add("orphan", `${cfg.relPath}: contracts block declares exposes-edges for service "${cfg.repoId}", which does not resolve in services.csv — dropped. Check a services: block entry exists at this id (M-ADR 0197); this can also mean the repo's own default service id was never a runtime type.`);
             }
@@ -44,7 +41,7 @@ export function buildServiceContract(inputs) {
         }
         if (!block)
             continue;
-        for (const kind of ["openapi", "proto", "avro"]) {
+        for (const kind of REPO_CONFIG_CONTRACT_KINDS) {
             const list = block[kind] ?? [];
             for (const rawEntry of list) {
                 const entry = rawEntry.replace(/^\/+/, "");

package/dist/lib/catalogue/canonical-schema.yaml

@@ -7,7 +7,7 @@
 # Emitted by sdd-cli's YAML emitter with no line folding; the three header scalars are quoted for the
 # textual readers downstream. The one deliberate difference from the authored form is schema_status:
 # the authored form says canonical; a projection never does.
-schema_version: "4.0.0"
+schema_version: "4.1.0"
 schema_owner: "sdd-method"
 schema_status: "generated"
 enums:
@@ -361,6 +361,7 @@ enums:
     - value: graphql
     - value: rpc
     - value: authz
+    - value: cli
     description: Contract kind. Bound at 3.13.0 from the column descriptions; measured against both reference estates before binding (M-ADR 0205 §4.4).
   contract_status:
     values:
@@ -1552,7 +1553,7 @@ catalogues:
     - name: kind
       type: string
       nullable: false
-      description: rest | graphql | rpc | event | authz. rpc covers Proto/gRPC; event covers Avro schemas; authz covers authorization/policy schemas (SpiceDB .zed and equivalents), added because an adopter contract agreement gate certified .zed schemas as contracts while no kind could represent them.
+      description: rest | graphql | rpc | event | authz | cli. rpc covers Proto/gRPC; event covers Avro schemas; authz covers authorization/policy schemas (SpiceDB .zed and equivalents), added because an adopter contract agreement gate certified .zed schemas as contracts while no kind could represent them; cli covers a command-line interface's command manifest (its commands, options and exit codes), added at 4.1.0 because a command-line tool often serves no REST, RPC, event or authorization contract, so its behaviour baselines had nothing to name as their surface.
     - name: version
       type: string
       nullable: true

package/dist/lib/catalogue/contract-id.js

@@ -2,7 +2,7 @@
 // M-ADR 0203 §4.4, the cut's acid test.
 //
 // From 3.0.0 a contract id carries its KIND component: `{domain}-{stem}-{kind}`
-// (kind ∈ rest | graphql | rpc | event | authz). The kindless 2.x form made one
+// (kind ∈ rest | graphql | rpc | event | authz | cli). The kindless 2.x form made one
 // measured collision class unrepresentable: a service published as two contract
 // families (`calendar-service.yaml` + `calendar_service.proto`) minted one id,
 // costing a live estate one row and two edges permanently, and mislabelling

package/dist/lib/catalogue/traceability-loader.js

@@ -47,6 +47,7 @@ export const CONTRACT_LIST_KEYS = [
     "avro",
     "spicedb",
     "graphql",
+    "cli",
 ];
 /**
  * Every contract path a contracts block declares, across all kinds and both
@@ -279,6 +280,7 @@ function extractContracts(raw) {
     const avro = arr("avro");
     const spicedb = arr("spicedb");
     const graphql = arr("graphql");
+    const cli = arr("cli");
     // `provenance` (3.5.0) MUST be extracted here or the builder that reads it
     // sees nothing — this function reconstructs the block key-by-key rather than
     // passing the parsed object through, which is precisely the shape the
@@ -295,6 +297,7 @@ function extractContracts(raw) {
         ...(avro ? { avro } : {}),
         ...(spicedb ? { spicedb } : {}),
         ...(graphql ? { graphql } : {}),
+        ...(cli ? { cli } : {}),
         ...(provenance ? { provenance } : {}),
     };
 }

package/dist/lib/validate/behaviour-store.js

@@ -14,6 +14,16 @@
 //                 With no such targets the check is vacuous, and says so.
 //   4. verdicts: every archived change except a baseline has a verdict.md and a record whose
 //                 verdict is PASS and names it (M-ADR 0223 §4.6).
+//   5. surfaces: every archived baseline's evidence lists, under **Surfaces:**, each contract the
+//                 repositories it was observed in serve, as covered at transport or excluded with a
+//                 reason, and the list is checked against the catalogue (catalogues/repo_contract.csv),
+//                 never against itself (M-ADR 0222 §4.3, §4.4). A list the catalogue gives nothing to
+//                 check against (no Observed in line, or a repository with no catalogue contracts) fails:
+//                 a cross-check of zero contracts is unresolved, not a pass.
+//   6. scope:    a baseline ADDS requirements; it REMOVES, MODIFIES or RENAMES only a requirement whose
+//                 latest archived change was a baseline, which is how a corrective baseline withdraws
+//                 what a baseline admitted wrongly. A requirement a judged change shipped is changed only
+//                 by a change (M-ADR 0222 §4.4). Read in archive order.
 //
 // A sibling-repository store (M-ADR 0221 §4.2) is checked in that repository, not here.
 //
@@ -25,6 +35,8 @@ import { access, readdir, readFile } from "node:fs/promises";
 import { basename, join } from "node:path";
 import { promisify } from "node:util";
 import { parseDocument } from "yaml";
+import { observedIn, orderArchives, parseRequirements, parseSurfaces, renamedFrom, surfaceMatches } from "../behaviour-store/archive.js";
+import { parseCatalogueCsv } from "../catalogue/csv-reader.js";
 const execFileAsync = promisify(execFile);
 /** The OpenSpec release the method depends on (M-ADR 0223 ruling 2). The module installs exactly this. */
 export const OPENSPEC_VERSION = "1.14.3";
@@ -271,6 +283,77 @@ export async function checkBehaviourStore(repo) {
             failures.push(`${record.file}: verdict.record ${JSON.stringify(vr)} does not name an existing file`);
     }
     lines.push(`verdicts: ${archived.length} archived change(s), ${baselines} baseline(s), ${archived.length - baselines} needing a PASS verdict`);
+    // 5. surfaces, and 6. what each baseline may change, in archive order
+    const archiveRel = `${STORE_DIR}/changes/archive`;
+    const { order, ties } = await orderArchives(repo, archiveRel, archived);
+    const servedBy = baselines > 0 ? await catalogueContracts(repo) : null;
+    let surfacesChecked = 0;
+    const lastTouch = new Map();
+    let scopeChecked = 0;
+    for (const name of order) {
+        const dir = `${archiveRel}/${name}`;
+        const evidence = await readText(join(repo, dir, "baseline-evidence.md"));
+        const isBaseline = evidence !== null;
+        if (isBaseline) {
+            const parsed = parseSurfaces(evidence);
+            if (!parsed.present)
+                failures.push(`${dir}/baseline-evidence.md: no **Surfaces:** list; name every contract the observed repositories serve, covered at transport or excluded with a reason`);
+            for (const p of parsed.problems)
+                failures.push(`${dir}/baseline-evidence.md: Surfaces: ${p}`);
+            if (parsed.present) {
+                if (servedBy === null) {
+                    failures.push(`${dir}/baseline-evidence.md: Surfaces cannot be cross-checked: catalogues/repo_contract.csv or catalogues/contracts.csv is missing; build the catalogue`);
+                }
+                else {
+                    const repos = observedIn(evidence);
+                    if (repos.length === 0)
+                        failures.push(`${dir}/baseline-evidence.md: Surfaces cannot be cross-checked: no **Observed in:** line names a repository`);
+                    for (const r of repos) {
+                        if ((servedBy.get(r) ?? []).length === 0) {
+                            failures.push(`${dir}/baseline-evidence.md: Surfaces cannot be cross-checked: catalogues/repo_contract.csv records no contract for ${r}; declare the contracts it serves in its repo-config`);
+                        }
+                        for (const c of servedBy.get(r) ?? []) {
+                            surfacesChecked++;
+                            if (!parsed.entries.some((e) => surfaceMatches(e.contract, c.id, c.specPath))) {
+                                failures.push(`${dir}/baseline-evidence.md: Surfaces does not list ${c.specPath || c.id} (${c.id}), which ${r} serves (catalogues/repo_contract.csv); list it as covered at transport or excluded with a reason`);
+                            }
+                        }
+                    }
+                }
+            }
+        }
+        for (const feature of await dirs(join(repo, dir, "specs"))) {
+            const text = (await readText(join(repo, dir, "specs", feature, "spec.md"))) ?? "";
+            const targets = [
+                ...parseRequirements(text).filter((r) => r.operation === "MODIFIED" || r.operation === "REMOVED").map((r) => r.name),
+                ...renamedFrom(text),
+            ];
+            for (const t of targets) {
+                const key = `${feature}::${t}`;
+                if (isBaseline) {
+                    scopeChecked++;
+                    const last = lastTouch.get(key);
+                    if (last !== "baseline") {
+                        failures.push(`${dir}: a baseline changes "${t}" (${feature}), which ${last === "change" ? "a judged change last shipped" : "no earlier archived change admitted"}; a baseline may remove or modify only what a baseline admitted, and anything else takes a change (M-ADR 0222 §4.4)`);
+                    }
+                }
+            }
+            for (const r of parseRequirements(text)) {
+                const key = `${feature}::${r.name}`;
+                if (r.operation === "REMOVED")
+                    lastTouch.delete(key);
+                else if (r.operation)
+                    lastTouch.set(key, isBaseline ? "baseline" : "change");
+            }
+            for (const from of renamedFrom(text))
+                lastTouch.delete(`${feature}::${from}`);
+        }
+    }
+    const unseen = servedBy === null ? "" : `; repositories with no catalogue contracts: ${[...new Set(await observedInAll(repo, archiveRel, order))].filter((r) => (servedBy.get(r) ?? []).length === 0).join(", ") || "none"}`;
+    lines.push(baselines === 0 ? "surfaces: vacuous (no baseline)" : `surfaces: ${baselines} baseline(s), ${surfacesChecked} served contract(s) checked against catalogues/repo_contract.csv${unseen}`);
+    lines.push(scopeChecked === 0 ? "scope: vacuous (no baseline removes, modifies or renames a requirement)" : `scope: ${scopeChecked} requirement(s) a baseline removes, modifies or renames, checked against their lineage`);
+    for (const [a, b] of ties)
+        lines.push(`order: ${a} and ${b} were archived the same day and the history does not order them; ordered by name`);
     const population = recordFiles.length + open.length + archived.length;
     const body = lines.map((l) => `  ${l}`).join("\n") + "\n";
     if (failures.length > 0) {
@@ -278,7 +361,35 @@ export async function checkBehaviourStore(repo) {
     }
     if (population === 0)
         return { exitCode: 0, stdout: body + `[N/A] the behaviour store has no changes and no agreement records yet\n` };
-    return { exitCode: 0, stdout: body + "[PASS] behaviour store: records, agreement, stale and verdict checks hold\n" };
+    return { exitCode: 0, stdout: body + "[PASS] behaviour store: records, agreement, stale, verdict, surfaces and scope checks hold\n" };
+}
+/** Per repository, the contracts the catalogue says it serves (repo_contract ⋈ contracts.spec_path); null when either file is missing. */
+async function catalogueContracts(repo) {
+    const rc = await readText(join(repo, "catalogues", "repo_contract.csv"));
+    const cs = await readText(join(repo, "catalogues", "contracts.csv"));
+    if (rc === null || cs === null)
+        return null;
+    const spec = new Map(parseCatalogueCsv(cs).rows.map((r) => [r["id"] ?? "", r["spec_path"] ?? ""]));
+    const out = new Map();
+    for (const r of parseCatalogueCsv(rc).rows) {
+        const repoId = r["repo_id"] ?? "";
+        const id = r["contract_id"] ?? "";
+        if (repoId === "" || id === "")
+            continue;
+        const list = out.get(repoId) ?? [];
+        list.push({ id, specPath: spec.get(id) ?? "" });
+        out.set(repoId, list);
+    }
+    return out;
+}
+async function observedInAll(repo, archiveRel, names) {
+    const out = [];
+    for (const n of names) {
+        const ev = await readText(join(repo, archiveRel, n, "baseline-evidence.md"));
+        if (ev !== null)
+            out.push(...observedIn(ev));
+    }
+    return out;
 }
 async function runOpenspec(repo, args) {
     try {

package/dist/maintain-version.json

@@ -1,4 +1,4 @@
 {
-  "version": "0.6.0",
-  "built_against_sdd_cli": "2.0.0"
+  "version": "0.8.0",
+  "built_against_sdd_cli": "2.2.0"
 }

package/dist/verify-version.json

@@ -1,4 +1,4 @@
 {
-  "version": "2.0.0",
-  "built_against_sdd_cli": "2.0.0"
+  "version": "2.2.0",
+  "built_against_sdd_cli": "2.2.0"
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@sdd-method/maintain-cli",
-  "version": "0.6.0",
-  "sddCliVersion": "2.0.0",
+  "version": "0.8.0",
+  "sddCliVersion": "2.2.0",
   "description": "Bring an SDD repository current and rebuild its derived model — sync, briefing, catalogue build and aggregate, pack build, context pull — plus every read-only verify verb. Ships only the code those verbs reach; it cannot author specification content. Authoring is in @sdd-method/sdd-cli.",
   "license": "UNLICENSED",
   "type": "module",