@sdd-method/verify-cli 1.2.0 → 1.4.0

package/NOTICE

@@ -2,7 +2,7 @@ sdd-cli
 Copyright 2026 Tom Foster
 
 This product includes software developed as part of the SDD method
-distribution (https://github.com/tomfosteruk/sdd-method).
+distribution.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.

package/dist/lib/catalogue/canonical-schema.yaml

@@ -134,7 +134,7 @@ enums:
       runtime: true
       emits_service_row: false
     description: |
-      Type of repository, declared in `orchestration/repo-config/*.yaml` as `service_type` and surfaced in `repositories.component_type` and `services.component_type`. The canonical builder uses this to decide which repos are runtime services (api_service, worker, gateway, frontend, mobile) and which are non-runtime (library, infrastructure, documentation); firmware runs, but on a device, so it is runtime without a service row (M-ADR 0215) — service emission follows emits_service_row, not runtime. Whether a repo is a vertical-domain application is conveyed by its SDD manifest's `profile: application-product`, not by a service_type tag — this enum is strictly about runtime artefact shape (per resolution of adopt-canonical-catalogue-builder.md §7.1).
+      Type of repository, declared in `orchestration/repo-config/*.yaml` as `service_type` and surfaced in `repositories.component_type` and `services.component_type`. The canonical builder uses this to decide which repos are runtime services (api_service, worker, gateway, frontend, mobile) and which are non-runtime (library, infrastructure, documentation); firmware runs, but on a device, so it is runtime without a service row (M-ADR 0215) — service emission follows emits_service_row, not runtime. Whether a repo is a vertical-domain application is conveyed by its SDD manifest's `profile: application-product`, not by a service_type tag — this enum is strictly about runtime artefact shape.
   capability_exemption_reason:
     values:
     - value: infrastructure
@@ -174,11 +174,11 @@ enums:
     - value: public-infrastructure
       description: Public networks, registries, or services no party in the estate operates.
     - value: estate-owned-unmodelled
-      description: "Operated by this estate but with no SDD or container home yet — the row is an accounted-for stand-in, and this population is the estate's modelling backlog, countable (F16, 2.32.0). Not an assertion of externality: an assertion of accountability for a boundary row."
+      description: "Operated by this estate but with no SDD or container home yet — the row is an accounted-for stand-in, and this population is the estate's modelling backlog, countable (2.32.0). Not an assertion of externality: an assertion of accountability for a boundary row."
     - value: organisation-internal
-      description: Owned elsewhere in the same organisation, outside this estate's modelling boundary (F16, 2.32.0).
+      description: Owned elsewhere in the same organisation, outside this estate's modelling boundary (2.32.0).
     description: |
-      Why an external-system candidate is ACCOUNTED FOR at the estate boundary, per M-ADR 0189 §4.6 (WS15; wording corrected by F16, 2.32.0): five values assert another party owns the system, and two assert the estate/organisation owns it but it has no model home yet — forcing the latter through the former would demand a false reason, and a false reason is worse than silence. The adjudicator can prove a candidate internal; it cannot prove one accounted-for — that is an assertion the author is accountable for, in the shape M-ADR 0188 ratified for repositories. Closed vocabulary, method-owned, extended only by ADR amendment, so adopters cannot locally widen the exemption surface to silence the unverified-candidate coverage finding.
+      Why an external-system candidate is ACCOUNTED FOR at the estate boundary, per M-ADR 0189 §4.6 (wording corrected in 2.32.0): five values assert another party owns the system, and two assert the estate/organisation owns it but it has no model home yet — forcing the latter through the former would demand a false reason, and a false reason is worse than silence. The adjudicator can prove a candidate internal; it cannot prove one accounted-for — that is an assertion the author is accountable for, in the shape M-ADR 0188 ratified for repositories. Closed vocabulary, method-owned, extended only by ADR amendment, so adopters cannot locally widen the exemption surface to silence the unverified-candidate coverage finding.
       ENFORCED, not advisory: the builder drops a row whose reason is outside this vocabulary (convention finding) and the candidate stays unverified — which is the point. An unrecognised reason must not succeed at the one thing an exemption does.
   scaffold_status:
     values:
@@ -1353,7 +1353,7 @@ catalogues:
       nullable: true
       description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
     description: |
-      Hierarchical grouping for features. First-class entity per resolution of adopt-canonical-catalogue-builder.md §7.2 — replaces the previous reverse-only synthetic `feature-tree-group` rows in features.csv. Both forward and reverse can use feature_groups: forward application-product SDDs whose `feature-tree.md` has H2/H3 structure, reverse SDDs whose extracted feature trees are inherently hierarchical, and any SDD that promotes groups to first-class with authored metadata. Groups can nest via `parent_group_id`.
+      Hierarchical grouping for features. First-class entity — replaces the previous reverse-only synthetic `feature-tree-group` rows in features.csv. Both forward and reverse can use feature_groups: forward application-product SDDs whose `feature-tree.md` has H2/H3 structure, reverse SDDs whose extracted feature trees are inherently hierarchical, and any SDD that promotes groups to first-class with authored metadata. Groups can nest via `parent_group_id`.
     foreign_keys:
     - column: product_id
       references: products.id
@@ -2062,8 +2062,8 @@ catalogues:
       nullable: false
       description: Mandatory, non-empty. The reason makes exemptions countable; the note makes them reviewable (M-ADR 0188 §4.2 pattern).
     description: |
-      A declared, reasoned assertion that an external-system candidate is GENUINELY external (M-ADR 0189 §4.6 / WS15). Annotation catalogue (M-ADR 0133 §4.2b): one FK, declared never derived, closed reason enum. Sourced from `orchestration/external-system-exemptions.yaml`.
-      The invariant it completes: c4_external_systems was the one catalogue family with no coverage predicate — a candidate producing no adjudication outcome was silent, and that silence hid a 28% dependency -graph distortion (ledger L4). Every candidate now either resolves at adjudication, or carries an exemption here, or is reported unverified. An exemption retires only the unverified finding — never an adjudication outcome (a converted candidate's exemption is a contradiction, reported and dropped). Shared entities may be exempted by multiple SDDs: identical rows dedup at aggregation (same exception class as c4_external_systems); conflicting rows keep first-seen with a convention finding.
+      A declared, reasoned assertion that an external-system candidate is GENUINELY external (M-ADR 0189 §4.6). Annotation catalogue (M-ADR 0133 §4.2b): one FK, declared never derived, closed reason enum. Sourced from `orchestration/external-system-exemptions.yaml`.
+      The invariant it completes: c4_external_systems was the one catalogue family with no coverage predicate — a candidate producing no adjudication outcome was silent, and that silence hid a 28% dependency -graph distortion. Every candidate now either resolves at adjudication, or carries an exemption here, or is reported unverified. An exemption retires only the unverified finding — never an adjudication outcome (a converted candidate's exemption is a contradiction, reported and dropped). Shared entities may be exempted by multiple SDDs: identical rows dedup at aggregation (same exception class as c4_external_systems); conflicting rows keep first-seen with a convention finding.
     foreign_keys:
     - column: external_system_id
       references: c4_external_systems.id
@@ -2172,7 +2172,7 @@ catalogues:
       type: string
       nullable: false
       description: exposes | consumes.
-    description: "Edge: service exposes or consumes contract. Both FKs are external (per M-ADR 0147): federated SDDs that walk per-repo service-architecture tables emit consumes rows where service_id resolves to the platform-root catalogue's services.csv (post-aggregation) and contract_id resolves to the platform-root contracts.csv. Internal builds (e.g. connect-mono) still optimistically validate locally. Schema 2.8.0."
+    description: "Edge: service exposes or consumes contract. Both FKs are external (per M-ADR 0147): federated SDDs that walk per-repo service-architecture tables emit consumes rows where service_id resolves to the platform-root catalogue's services.csv (post-aggregation) and contract_id resolves to the platform-root contracts.csv. Internal builds (a single-SDD platform) still optimistically validate locally. Schema 2.8.0."
     foreign_keys:
     - column: service_id
       references: services.id
@@ -2303,7 +2303,7 @@ catalogues:
       nullable: true
       description: Where the coupling is evidenced — a path or anchor in the SDD, from `evidence:` on the services[] entry. Prose about the coupling stays in dependency_notes; this is the pointer a reviewer follows.
     description: |
-      Edge: capability is realised by services. Sourced from the capability traceability manifest services[] block. service_id is an external FK (schema 2.29.0, F4): a traceability entry marked `owner_sdd:` declares a cross-SDD reference (e.g. the service moved to a sibling SDD at an M-ADR 0170 §4.2 carve) — the per-SDD builder emits the edge, logs it `[finding] external`, and aggregation validates it hard against the owning sibling's rows. An UNMARKED id that does not resolve locally is NOT emitted — it stays a member-tier orphan finding (or convention, when it names a known external system).
+      Edge: capability is realised by services. Sourced from the capability traceability manifest services[] block. service_id is an external FK (schema 2.29.0): a traceability entry marked `owner_sdd:` declares a cross-SDD reference (e.g. the service moved to a sibling SDD at an M-ADR 0170 §4.2 carve) — the per-SDD builder emits the edge, logs it `[finding] external`, and aggregation validates it hard against the owning sibling's rows. An UNMARKED id that does not resolve locally is NOT emitted — it stays a member-tier orphan finding (or convention, when it names a known external system).
     foreign_keys:
     - column: capability_id
       references: capabilities.id
@@ -2365,8 +2365,8 @@ catalogues:
     - name: source
       type: string
       nullable: false
-      description: "declared — the only emitted value. `derived` is reserved vocabulary: the reverse derivation it anticipated was never built (0 rows across 105 measured units) and the claim was corrected at 3.0.0 (M-ADR 0203 §4.5 / F2); the value re-enters if a decision builds a reverse source."
-    description: "Edge: capability is bound to a contract. Whether the capability exposes or depends on it is not stated by the source (traceability.contracts), so this description asserts no direction (M-ADR 0211 §1). Forward-declared only. Forward-declared only (traceability.contracts). The reverse derivation this description long claimed (service_contract ⋈ capability_service) was measured nonexistent — 0 `source: derived` rows across 105 units, builder references neither catalogue — and the CLAIM was corrected at 3.0.0 (M-ADR 0203 §4.5 / F2, gap class absent-derivation per M-ADR 0196 §4.1). The edge is forward-one-directional until a decision builds a reverse source."
+      description: "declared — the only emitted value. `derived` is reserved vocabulary: the reverse derivation it anticipated was never built (0 rows across 105 measured units) and the claim was corrected at 3.0.0 (M-ADR 0203 §4.5); the value re-enters if a decision builds a reverse source."
+    description: "Edge: capability is bound to a contract. Whether the capability exposes or depends on it is not stated by the source (traceability.contracts), so this description asserts no direction (M-ADR 0211 §1). Forward-declared only. Forward-declared only (traceability.contracts). The reverse derivation this description long claimed (service_contract ⋈ capability_service) was measured nonexistent — 0 `source: derived` rows across 105 units, builder references neither catalogue — and the CLAIM was corrected at 3.0.0 (M-ADR 0203 §4.5, gap class absent-derivation per M-ADR 0196 §4.1). The edge is forward-one-directional until a decision builds a reverse source."
     foreign_keys:
     - column: capability_id
       references: capabilities.id
@@ -2546,7 +2546,7 @@ catalogues:
       type: string
       nullable: true
       description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
-    description: "Edge: feature delivers async push via a named channel/topic. Peer of `graphql_operations:` in the per-feature evidence shape — `graphql_operations:` carries the GraphQL operation names declared in the schema (Queries / Mutations / Subscriptions); `feature_subscription_channels` rows carry the channel/topic layer that physically delivers the push events (AppSync WebSocket endpoints, Pekko WS channels, MQTT topics, server-sent-event streams). Per resolved decision §1 of `content/plans/v0-9-0-cohort-sweep-derived-bundle.md`: a single GraphQL Subscription operation may listen on multiple channels; one channel may be consumed by multiple operations — modelling as a separate edge catalogue (not as a feature column) accommodates the many-to-many. Built per-SDD from `reverse-evidence/feature-grounding-evidence.yaml` `subscription_channels:` entries on each feature. Added in schema 2.9.0."
+    description: "Edge: feature delivers async push via a named channel/topic. Peer of `graphql_operations:` in the per-feature evidence shape — `graphql_operations:` carries the GraphQL operation names declared in the schema (Queries / Mutations / Subscriptions); `feature_subscription_channels` rows carry the channel/topic layer that physically delivers the push events (AppSync WebSocket endpoints, Pekko WS channels, MQTT topics, server-sent-event streams). A single GraphQL Subscription operation may listen on multiple channels; one channel may be consumed by multiple operations — modelling as a separate edge catalogue (not as a feature column) accommodates the many-to-many. Built per-SDD from `reverse-evidence/feature-grounding-evidence.yaml` `subscription_channels:` entries on each feature. Added in schema 2.9.0."
     foreign_keys:
     - column: feature_id
       references: features.id
@@ -2672,9 +2672,9 @@ catalogues:
     - name: interaction
       type: string
       nullable: true
-      description: Optional interaction label from the Rel(...) line. May hold multiple '; '-joined labels (F25).
+      description: Optional interaction label from the Rel(...) line. May hold multiple '; '-joined labels.
     description: |
-      Edge: a persona uses a C4 container — the L2-granularity companion to persona_c4system (M-ADR 0189 F26 §3, ratified 2026-07-10). Eleven of one estate's L2 diagrams and the bulk of another's 81 unroutable Rels drew Person→Container relationships that had no catalogue and, until F26, no finding. Harvested at member tier from Rel(...) lines whose endpoints resolve to a file-local Person and a local container (either direction; the row is normalised persona→container). A Person that matches no persona row is a coverage finding, never a silent skip. Both authoring directions feed from the same diagram surface (M-ADR 0157 parity). Added in schema 2.34.0.
+      Edge: a persona uses a C4 container — the L2-granularity companion to persona_c4system (M-ADR 0189, ratified 2026-07-10). Eleven of one estate's L2 diagrams and the bulk of another's 81 unroutable Rels drew Person→Container relationships that had no catalogue and raised no finding. Harvested at member tier from Rel(...) lines whose endpoints resolve to a file-local Person and a local container (either direction; the row is normalised persona→container). A Person that matches no persona row is a coverage finding, never a silent skip. Both authoring directions feed from the same diagram surface (M-ADR 0157 parity). Added in schema 2.34.0.
     foreign_keys:
     - column: persona_id
       references: personas.id
@@ -2698,11 +2698,11 @@ catalogues:
     - name: interaction
       type: string
       nullable: true
-      description: Optional integration label/protocol from the Rel(...) line. May hold multiple '; '-joined labels when one pair is declared with distinct labels (F25, 2.33.2).
+      description: Optional integration label/protocol from the Rel(...) line. May hold multiple '; '-joined labels when one pair is declared with distinct labels (2.33.2).
     - name: from_container_id
       type: string
       nullable: true
-      description: The Rel's non-external endpoint resolved to a local container at member tier, when it is one (F17, 2.33.0) — the datum that lets adjudication rewrite this edge onto container_dependency instead of destroying it. Empty when the endpoint is the system itself or unresolvable.
+      description: The Rel's non-external endpoint resolved to a local container at member tier, when it is one (2.33.0) — the datum that lets adjudication rewrite this edge onto container_dependency instead of destroying it. Empty when the endpoint is the system itself or unresolvable.
     description: "Edge: a C4 system integrates with an external software system. Captures the L1 context 'System integrates with External System' relationship, extracted from System_Ext(...) + Rel(...) on L1/L2 diagrams. Per M-ADR 0155. Container-level external dependencies are out of scope (system-level only). Added in schema 2.10.0. From 2.30.0 (M-ADR 0189 §4.4): edges whose external endpoint the aggregator adjudicates as an INTERNAL system are rewritten onto system_system_dependency and removed from this catalogue."
     foreign_keys:
     - column: c4_system_id
@@ -2734,13 +2734,13 @@ catalogues:
     - name: source_sdd_id
       type: string
       nullable: true
-      description: SDD whose diagram declared the originating reference. Member-emitted rows set it directly (F19); adjudication-derived rows are stamped by the aggregator.
+      description: SDD whose diagram declared the originating reference. Member-emitted rows set it directly; adjudication-derived rows are stamped by the aggregator.
     - name: platform_sdd_id
       type: string
       nullable: true
       description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
     description: |
-      Edge: a C4 container depends on another INTERNAL container (adopter finding F17 — F6 exactly one tier down: "no edge for internal" at L2). Derived by the aggregator at adjudication: an external-system candidate that resolves to an internal container was never external — each of its dependency edges whose member-resolved `from_container_id` is known is rewritten here, and a candidate with no remaining edges is dropped (it was a phantom duplicate of the container). A candidate with unconvertible edges is kept with the tier-contradiction finding, so no edge is ever destroyed to make a build quieter — the measured cost that stopped an adopter remediating 22 contradictions was eight real edges. ALSO emitted at member tier (F19, 2.33.1): the C4-correct authoring — Rel(container_a, container_b) between two Container(...) nodes — emits its edge directly; adjudication merges into a catalogue that already has content rather than being its only source, so the metamodel no longer rewards mis-declaration over correct authoring. Added in schema 2.33.0.
+      Edge: a C4 container depends on another INTERNAL container (the system-tier gap exactly one tier down: "no edge for internal" at L2). Derived by the aggregator at adjudication: an external-system candidate that resolves to an internal container was never external — each of its dependency edges whose member-resolved `from_container_id` is known is rewritten here, and a candidate with no remaining edges is dropped (it was a phantom duplicate of the container). A candidate with unconvertible edges is kept with the tier-contradiction finding, so no edge is ever destroyed to make a build quieter — the measured cost that stopped an adopter remediating 22 contradictions was eight real edges. ALSO emitted at member tier (2.33.1): the C4-correct authoring — Rel(container_a, container_b) between two Container(...) nodes — emits its edge directly; adjudication merges into a catalogue that already has content rather than being its only source, so the metamodel no longer rewards mis-declaration over correct authoring. Added in schema 2.33.0.
     foreign_keys:
     - column: from_container_id
       references: c4_containers.id
@@ -2910,7 +2910,7 @@ catalogues:
     - name: target_locus
       type: string
       nullable: true
-      description: platform | external | legacy (M-ADR 0204; closed enum, absent/empty = platform). A statement about the TARGET only — never about the consuming product, and never a stability, lifecycle or quality claim. platform rows behave exactly as before this column existed. external/legacy rows carry empty target_capability_id and target_service_id and name their target in target_external_system_id; they skip platform resolution and the F18 realiser-join, with every skip named.
+      description: platform | external | legacy (M-ADR 0204; closed enum, absent/empty = platform). A statement about the TARGET only — never about the consuming product, and never a stability, lifecycle or quality claim. platform rows behave exactly as before this column existed. external/legacy rows carry empty target_capability_id and target_service_id and name their target in target_external_system_id; they skip platform resolution and the synchronous realiser-join, with every skip named.
     - name: target_external_system_id
       type: string
       nullable: true
@@ -2926,7 +2926,7 @@ catalogues:
     - name: contract_type
       type: string
       nullable: true
-      description: rest | graphql | openapi | grpc | event | event-stream | stream | other. Optional; reflects what the consuming SDD declares. The async set (`event`/`event-stream`/`stream`) marks a shared-stream subscription that binds to a stream contract rather than a realiser service (M-ADR 0192) — such rows skip the F18 synchronous realiser-join at aggregation.
+      description: rest | graphql | openapi | grpc | event | event-stream | stream | other. Optional; reflects what the consuming SDD declares. The async set (`event`/`event-stream`/`stream`) marks a shared-stream subscription that binds to a stream contract rather than a realiser service (M-ADR 0192) — such rows skip the synchronous realiser-join at aggregation.
     - name: required_stability
       type: string
       nullable: true
@@ -2948,7 +2948,7 @@ catalogues:
       nullable: true
       description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
     description: |
-      Per-SDD edge: an application-side or integration-side SDD declares that its product depends on a platform-side capability + service pair. Built from `reverse-evidence/feature-grounding-evidence.yaml` `platform_dependencies:` block (product-level — the cohort source shape carries product-scoped dependency rows with a `consumed_by:` list naming which services within the consuming product depend on the target). Each row records one (consuming product, target capability, target service) triple. The aggregator then joins these rows against platform-side `capability_service` to emit `cross_sdd_platform_capability` edges at aggregation time. Cross- SDD references (target_capability_id, target_service_id) are external — they're not expected to resolve in the per-SDD build, only at aggregation. Added in schema 2.9.0; see `content/plans/v0-9-0-cohort-sweep-derived-bundle.md` §"Cross-SDD platform-capability-edge".
+      Per-SDD edge: an application-side or integration-side SDD declares that its product depends on a platform-side capability + service pair. Built from `reverse-evidence/feature-grounding-evidence.yaml` `platform_dependencies:` block (product-level — the cohort source shape carries product-scoped dependency rows with a `consumed_by:` list naming which services within the consuming product depend on the target). Each row records one (consuming product, target capability, target service) triple. The aggregator then joins these rows against platform-side `capability_service` to emit `cross_sdd_platform_capability` edges at aggregation time. Cross- SDD references (target_capability_id, target_service_id) are external — they're not expected to resolve in the per-SDD build, only at aggregation. Added in schema 2.9.0.
     foreign_keys:
     - column: product_id
       references: products.id
@@ -2993,7 +2993,7 @@ catalogues:
       nullable: false
       description: Service identifier the consuming SDD references and the platform SDD owns. The join key.
     description: |
-      Federated edge: an application-side or integration-side SDD's `product_platform_dependencies` reference resolves against a platform-side SDD's capability spec via the platform capability's `capability_service` roster. Surfaces ecosystem-wide platform- consumer relationships at product → capability granularity. Built **only at aggregation time** — `sdd-cli catalogue aggregate` joins each consuming SDD's `product_platform_dependencies` rows against every other SDD's `capability_service` rows on `target_service_id == service_id`, emitting one row per resolved (consuming-product, platform-capability) pair. Per-SDD builders emit nothing for this catalogue; the aggregator owns it entirely. A platform-dependency whose target_service_id doesn't resolve to any platform-side capability_service row is logged as an `orphan` finding and produces no row. Cross-SDD references are external by definition. Added in schema 2.9.0; see `content/plans/v0-9-0-cohort-sweep-derived-bundle.md` §"Cross-SDD platform-capability-edge" and M-ADR 0134.
+      Federated edge: an application-side or integration-side SDD's `product_platform_dependencies` reference resolves against a platform-side SDD's capability spec via the platform capability's `capability_service` roster. Surfaces ecosystem-wide platform- consumer relationships at product → capability granularity. Built **only at aggregation time** — `sdd-cli catalogue aggregate` joins each consuming SDD's `product_platform_dependencies` rows against every other SDD's `capability_service` rows on `target_service_id == service_id`, emitting one row per resolved (consuming-product, platform-capability) pair. Per-SDD builders emit nothing for this catalogue; the aggregator owns it entirely. A platform-dependency whose target_service_id doesn't resolve to any platform-side capability_service row is logged as an `orphan` finding and produces no row. Cross-SDD references are external by definition. Added in schema 2.9.0; see M-ADR 0134.
     foreign_keys:
     - column: consuming_product_id
       references: products.id
@@ -3131,7 +3131,7 @@ catalogues:
       nullable: true
       description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
     description: |
-      Application-product annotation (M-ADR 0191 §4.3 overlay, second element — WS4): one row per conformance tag the product asserts about its archetype's conformance expectations. Built per-SDD from the manifest's `conformance` block so the AGGREGATION-tier conformance GATE can read it. `status=covered` means the product's own conformance suite exercises the tag; `status=deviated` means the product declares (with a rationale) that it deliberately does not. At aggregation, an archetype-expected conformance tag that is neither covered nor deviated raises a deviation-visible WARN. The method gates the DECLARATION — it does not run the adopter's conformance suite. Added in schema 2.39.0.
+      Application-product annotation (M-ADR 0191 §4.3 overlay, second element): one row per conformance tag the product asserts about its archetype's conformance expectations. Built per-SDD from the manifest's `conformance` block so the AGGREGATION-tier conformance GATE can read it. `status=covered` means the product's own conformance suite exercises the tag; `status=deviated` means the product declares (with a rationale) that it deliberately does not. At aggregation, an archetype-expected conformance tag that is neither covered nor deviated raises a deviation-visible WARN. The method gates the DECLARATION — it does not run the adopter's conformance suite. Added in schema 2.39.0.
     foreign_keys:
     - column: product_id
       references: products.id

package/dist/lib/catalogue/coverage-predicates.js

@@ -13,12 +13,12 @@
  *     §4.3 (`orphaned` is aggregate-only; member tier reports
  *     `unresolved-locally`, cause-agnostic); the Path-X leverage axis is
  *     reported separately and only when repo_capability.csv exists.
- *   - event_coverage    (WS3): every catalogued event is attributed to a
+ *   - event_coverage:    every catalogued event is attributed to a
  *     runtime — service_event edge or resolving publisher column — with
  *     the contract-twin alternative route, the column-vs-edge disagreement
  *     controls, and the chain-readout/consumer-enumerability metric lines
  *     that are never verdicts.
- *   - contract_coverage (WS2): every catalogued contract is reachable —
+ *   - contract_coverage: every catalogued contract is reachable —
  *     capability_contract or service_contract — with the three computed
  *     exclusions (deprecated / provider-surface / not-an-interface, the
  *     last a positive READ of the spec file), the covered-as-event
@@ -178,8 +178,8 @@ FROM "services" s
 WHERE s."id" IS NOT NULL AND s."id" <> ''
 ORDER BY service_id, primary_repo;`;
 export async function runServiceCapabilityCoverage(session, options) {
-    // Known-bad probe, carried over from the reference implementation
-    // (WS11's third requirement): a synthetic claimed service must classify
+    // Known-bad probe, carried over from the reference implementation:
+    // a synthetic claimed service must classify
     // as claimed BEFORE any real data is reported — a run whose
     // classification never executed must not be able to report a healthy
     // estate.

package/dist/lib/catalogue/coverage-run.js

@@ -89,7 +89,7 @@ export async function runCatalogueCoverage(inputs, write) {
         const available = new Set(schema.catalogues.map((c) => c.name).filter((n) => present(n)));
         lines.push(...renderScoresCoverage(await runScoresCoverage(session, { tier, available, sddRoot }), tier));
         // Staleness VERDICTS — the second half of the fourteenth check's §4.5
-        // scope (ledger §3o), member-tier only with the aggregate skip stated.
+        // scope, member-tier only with the aggregate skip stated.
         // Same coverage class, same reporting-only staging as the rest of the
         // scores family.
         lines.push(...renderStalenessVerdicts(await runStalenessVerdicts(session, { tier, available, sddRoot }), tier));

package/dist/lib/catalogue/finding-identity.js

@@ -1,6 +1,6 @@
 /**
  * Finding IDENTITY — the stable key a findings baseline is compared on, per
- * M-ADR 0132 §4.3 as amended, delivering the ruling recorded at ledger §3p.
+ * M-ADR 0132 §4.3 as amended.
  *
  * THE PROBLEM THIS EXISTS FOR, measured rather than asserted. A findings
  * baseline stores whole `[finding]` lines, so improving a message invalidates
@@ -17,7 +17,7 @@
  * files, 74 non-empty, 1,677 body lines — that works for 1,434 lines (85.5%)
  * and fails for 243 (14.5%), which embed their subject in prose:
  *
- *   [finding] orphan: repo integration-calamp resolves to no capability ...
+ *   [finding] orphan: repo integration-acme resolves to no capability ...
  *
  * One renderer template, all orphan class, spread across 62 repos. Recovering
  * identity there means teaching the comparator the renderer's message
@@ -30,7 +30,7 @@
  * baseline is reviewed by people and a side-channel nobody sees is a side
  * channel nobody maintains:
  *
- *   [finding] orphan (repo:integration-calamp): repo integration-calamp ...
+ *   [finding] orphan (repo:integration-acme): repo integration-acme ...
  *   [finding] divergence (docs/domains/asset/product/x.traceability.yaml): ...
  *
  * A finding with no declared subject renders EXACTLY as it does today. That is

package/dist/lib/catalogue/manifest-loader.js

@@ -123,7 +123,7 @@ const DataPlaneSchema = z.object({
     bindings: z.array(DataPlaneBindingSchema),
     deviations: z.array(DataPlaneDeviationSchema).optional(),
 });
-// Conformance coverage (M-ADR 0191 §4.3, second overlay element — WS4). An
+// Conformance coverage (M-ADR 0191 §4.3, second overlay element). An
 // application-product asserts which of its archetype's conformance expectations
 // its own conformance suite exercises (`coverage`), and declares a rationale for
 // any expected tag it deliberately does not cover (`deviations`). The method
@@ -249,7 +249,7 @@ const ManifestSchema = z.object({
     // optional declared deviations from the archetype default, each carrying a
     // rationale so the mismatch is sanctioned variance, not silent drift.
     data_plane: DataPlaneSchema.optional(),
-    // Conformance coverage declaration (M-ADR 0191 §4.3 WS4, sdd-manifest-schema
+    // Conformance coverage declaration (M-ADR 0191 §4.3, sdd-manifest-schema
     // 1.5.0). Which archetype conformance expectations the product's suite
     // exercises, plus rationales for any it deliberately does not.
     conformance: ConformanceSchema.optional(),

package/dist/lib/catalogue/scaffold-delta.js

@@ -216,7 +216,7 @@ export async function runScaffoldDelta(session, options) {
 }
 /**
  * The delta's DEFECT classes are gate-acting (`divergence`), PROMOTED by a
- * recorded governance act after the M-ADR 0207 §4.9 pilot completed with no
+ * recorded method act after the M-ADR 0207 §4.9 pilot completed with no
  * surprise in any gated figure (2026-08-08) — the deliberate later act the
  * scores-coverage precedent reserves, performed. `scaffold-stale` stays
  * `coverage` with its staleness family: a stale anchor is a re-declare

package/dist/lib/catalogue/schema-compat.js

@@ -1,8 +1,7 @@
 /**
  * Per-schema compatibility ranges declared by this sdd-cli build.
  *
- * Per resolution of adopt-canonical-catalogue-builder.md §7.5, the three
- * sdd-method-distributed schemas version independently. The CLI declares
+ * The three sdd-method-distributed schemas version independently. The CLI declares
  * the version range it accepts for each and fails fast at read time on
  * out-of-range manifests.
  *

package/dist/lib/catalogue/scores-coverage.js

@@ -171,7 +171,7 @@ export const RUBRIC_ELIGIBILITY = [
         joinColumn: "id",
         refTransform: null,
         eligibilityFilter: null,
-        eligibilityNote: "NO local population, measured rather than assumed. Refs are '<domain>-feature-grounding-<slug>' and the tails are SIBLING SDD SLUGS (app-shell, cold-chain, connect-rapide), not rows in this SDD: 0/15 against products, applications, features and repositories, and 1/15 against capabilities — a coincidence, not a join. A cross-SDD reference the member tier cannot resolve, so its coverage is declared unmeasurable rather than given a transform that would produce plausible wrong numbers.",
+        eligibilityNote: "NO local population, measured rather than assumed. Refs are '<domain>-feature-grounding-<slug>' and the tails are SIBLING SDD SLUGS (app-shell, gift-cards, storefront-express), not rows in this SDD: 0/15 against products, applications, features and repositories, and 1/15 against capabilities — a coincidence, not a join. A cross-SDD reference the member tier cannot resolve, so its coverage is declared unmeasurable rather than given a transform that would produce plausible wrong numbers.",
     },
     {
         rubricId: "reverse-contract-quality",

package/dist/lib/catalogue/staleness-verdicts.js

@@ -1,5 +1,5 @@
-// Staleness VERDICTS — the second half of M-ADR 0205 §4.5's staleness scope
-// (ledger §3o): "staleness meaning corpus_ref older than the target's last
+// Staleness VERDICTS — the second half of M-ADR 0205 §4.5's staleness scope:
+// "staleness meaning corpus_ref older than the target's last
 // content change". The scores-coverage predicate computes each row's BASIS;
 // this module computes the VERDICT the basis supports. A stale score is worse
 // than a missing one, because it reads as coverage — the predicate otherwise

package/dist/lib/lock-file.js

@@ -66,6 +66,8 @@ export function serialiseLockFile(lock) {
         ...(lock.ciRunner !== undefined ? [`ci_runner: "${lock.ciRunner}"`] : []),
         ...(lock.ciWorkflowBlockSha256 !== undefined ? [`ci_workflow_block_sha256: "${lock.ciWorkflowBlockSha256}"`] : []),
         ...(lock.ciModuleSha256 !== undefined ? [`ci_module_sha256: "${lock.ciModuleSha256}"`] : []),
+        ...(lock.cliSource !== undefined ? [`cli_source: ${lock.cliSource}`] : []),
+        ...(lock.cliPackage !== undefined ? [`cli_package: "${lock.cliPackage}"`] : []),
         "bundles:",
     ];
     for (const b of lock.bundles) {
@@ -117,6 +119,8 @@ function parseVersioned(raw) {
     let ciBinding;
     let ciRunner;
     let ciModuleSha256;
+    let cliSource;
+    let cliPackage;
     const bundles = [];
     let inBundles = false;
     let inPaths = false;
@@ -186,6 +190,10 @@ function parseVersioned(raw) {
                     ciRunner = stripQuotes(value);
                 else if (key === "ci_module_sha256")
                     ciModuleSha256 = stripQuotes(value);
+                else if (key === "cli_source")
+                    cliSource = stripQuotes(value);
+                else if (key === "cli_package")
+                    cliPackage = stripQuotes(value);
             }
             continue;
         }
@@ -207,7 +215,7 @@ function parseVersioned(raw) {
             // a YAML reader parses 113 of 325 entries in one real lock as MAPPINGS
             // rather than strings — silently, with no error. Quoting on write is the
             // fix; reading both forms ships first so no lock can be written that an
-            // older reader cannot parse. See method-open-items §3l.
+            // older reader cannot parse.
             const entry = stripQuotes(line.slice("      - ".length));
             const withDigest = DIGEST_ENTRY_RE.exec(entry);
             if (withDigest) {
@@ -313,6 +321,8 @@ function parseVersioned(raw) {
         ...(ciRunner !== undefined ? { ciRunner } : {}),
         ...(ciWorkflowBlockSha256 !== undefined ? { ciWorkflowBlockSha256 } : {}),
         ...(ciModuleSha256 !== undefined ? { ciModuleSha256 } : {}),
+        ...(cliSource !== undefined ? { cliSource } : {}),
+        ...(cliPackage !== undefined ? { cliPackage } : {}),
     };
 }
 function migrateV1(raw, legacyBundleName) {

package/dist/lib/package-version.js

@@ -83,7 +83,7 @@ export function getVerifyCliVersion() {
 }
 /**
  * The @sdd-method/maintain-cli version released WITH this sdd-cli. The managed CI workflow's
- * catalogue freshness step installs exactly this version (M-ADR 0218 §5; ruled 2026-10-15, sdm-jts.6).
+ * catalogue freshness step installs exactly this version (M-ADR 0218 §5).
  * Read the same way as the verify version, for the same reason (dist/ copy, never scripts/ live).
  */
 export function getMaintainCliVersion() {

package/dist/lib/validate/index.js

@@ -54,7 +54,7 @@ export async function runValidate(opts, stdout = (line) => process.stdout.write(
 // passed" with none were previously the same line (M-ADR 0200 §4.3). The
 // exit code is deliberately unchanged — the defect is the claim, not the
 // gating; whether an unexecutable validator should FAIL is the open design
-// question (post-3.0.0-followons.md A2), not this one.
+// question, not this one.
 function verdict(summary, selected) {
     if (summary.exitCode !== 0)
         return fail("One or more validators failed");

package/dist/lib/validate/plan.js

@@ -1,5 +1,5 @@
 /**
- * The method-managed validation job, as DATA (bead sdm-dd6.2; Dagger ruling sdm-s48, 2026-10-15).
+ * The method-managed validation job, as DATA (M-ADR 0219).
  *
  * One ordered plan per profile: every default validator, the platform's script-only checks, then the
  * advisory catalogue freshness check. Every executor renders or runs THIS: the GitHub workflow
@@ -25,7 +25,7 @@ const TITLES = {
     // CI has no platform checkout, so this step runs the app-only checks; the met gate needs the platform beside it.
     "app-dependencies": "Validate app dependencies (app-only checks; no platform checkout in CI)",
 };
-export function methodValidationPlan(profile) {
+export function methodValidationPlan(profile, opts = {}) {
     const steps = validatorsForProfile(profile)
         .filter((v) => v.optional !== true)
         .map((v) => ({
@@ -38,12 +38,15 @@ export function methodValidationPlan(profile) {
     if (profile === "platform") {
         steps.push({ id: "cascade-completeness", title: "Validate cascade completeness", tool: "bash", args: ["orchestration/scripts/validate-cascade-completeness.sh", "all"], advisory: false }, { id: "architecture-alignment", title: "Validate architecture alignment", tool: "bash", args: ["orchestration/scripts/validate-architecture-alignment.sh"], advisory: false });
     }
+    const gating = opts.catalogueRebuild === true;
     steps.push({
         id: "catalogue-freshness",
-        title: "Check catalogues reproduce from the specs (advisory)",
+        title: gating
+            ? "Check catalogues reproduce from the specs (gating: the pipeline rebuilt them)"
+            : "Check catalogues reproduce from the specs (advisory)",
         tool: "sdd-maintain",
         args: ["catalogue", "build", "--check", "--sdd-path", "."],
-        advisory: true,
+        advisory: !gating,
     });
     return steps;
 }

package/dist/lib/validate/yaml-parse.js

@@ -10,7 +10,7 @@
 // with it certifies exactly the corruption a line-surgery transformer
 // produces. `yaml` v2 refuses duplicate keys (DUPLICATE_KEY) and the other
 // malformations a lenient parse glosses — e.g. a `: ` inside an unquoted
-// scalar (`path: (none — tel: URL)`), which no pattern rule catches.
+// scalar (`path: (none — see: docs)`), which no pattern rule catches.
 //
 // Scope: the YAML files git TRACKS (`*.yaml`, `*.yml`) — the repo's sources,
 // not build output or dependencies. Outside a git work tree there is no

package/dist/maintain-version.json

@@ -1,4 +1,4 @@
 {
-  "version": "0.2.0",
-  "built_against_sdd_cli": "1.43.0"
+  "version": "0.4.0",
+  "built_against_sdd_cli": "1.45.0"
 }

package/dist/verbs/validate.js

@@ -14,7 +14,12 @@ export function registerValidate(program) {
         .option("--strict", "treat warnings as failures")
         .option("--list", "print the method-managed validation job for this repo's profile as JSON (the plan every CI executor runs, the Dagger module included) and run nothing")
         .option("--profile <profile>", "with --list: the profile to list, instead of reading .sdd-repo-kind (platform | application | integration)")
+        .option("--catalogue-rebuild", "with --list: the pipeline rebuilt the catalogues on this run (M-ADR 0220 §4.4), so the catalogue freshness step gates instead of advising")
         .action(async (opts) => {
+        if (opts.catalogueRebuild === true && opts.list !== true) {
+            process.stderr.write("--catalogue-rebuild only applies with --list\n");
+            process.exit(2);
+        }
         if (opts.list === true) {
             let profile;
             if (opts.profile !== undefined) {
@@ -32,7 +37,7 @@ export function registerValidate(program) {
                 }
                 profile = profileFromRepoKind(kind);
             }
-            process.stdout.write(JSON.stringify({ profile, steps: methodValidationPlan(profile) }, null, 2) + "\n");
+            process.stdout.write(JSON.stringify({ profile, steps: methodValidationPlan(profile, { catalogueRebuild: opts.catalogueRebuild === true }) }, null, 2) + "\n");
             return;
         }
         const { exitCode } = await runValidate({

package/dist/verify-program.js

@@ -29,7 +29,7 @@ import { registerCatalogueBaselineCheck, registerCatalogueImpact, registerCatalo
 import { registerList } from "./verbs/list.js";
 import { registerPackValidate } from "./verbs/pack-validate.js";
 import { registerValidate } from "./verbs/validate.js";
-const SPEC_URL = "https://github.com/tomfosteruk/sdd-method/blob/main/docs/method/cli/sdd-cli-specification.md";
+const SPEC_URL = "docs/method/cli/sdd-cli-specification.md (in the method distribution)";
 /** The full surface, as `<verb>` or `<verb> <subcommand>`. Asserted by test. */
 export const VERIFY_SURFACE = [
     "validate",

package/dist/verify-version.json

@@ -1,4 +1,4 @@
 {
-  "version": "1.2.0",
-  "built_against_sdd_cli": "1.43.0"
+  "version": "1.4.0",
+  "built_against_sdd_cli": "1.45.0"
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@sdd-method/verify-cli",
-  "version": "1.2.0",
-  "sddCliVersion": "1.43.0",
+  "version": "1.4.0",
+  "sddCliVersion": "1.45.0",
   "description": "Verify an SDD repository without changing it — validate, list, and read-only catalogue and pack checks. Ships only the code those verbs reach; it cannot write to the repository it is pointed at. Authoring and maintenance are in @sdd-method/sdd-cli.",
   "license": "Apache-2.0",
   "type": "module",
@@ -17,10 +17,6 @@
     "zod": "^4.3.6",
     "@duckdb/node-api": "^1.5.5-r.3"
   },
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/tomfosteruk/sdd-cli.git"
-  },
   "publishConfig": {
     "access": "public"
   },