@sdd-method/verify-cli 1.3.0 → 1.5.0

package/dist/lib/catalogue/canonical-schema.yaml

@@ -134,7 +134,7 @@ enums:
       runtime: true
       emits_service_row: false
     description: |
-      Type of repository, declared in `orchestration/repo-config/*.yaml` as `service_type` and surfaced in `repositories.component_type` and `services.component_type`. The canonical builder uses this to decide which repos are runtime services (api_service, worker, gateway, frontend, mobile) and which are non-runtime (library, infrastructure, documentation); firmware runs, but on a device, so it is runtime without a service row (M-ADR 0215) — service emission follows emits_service_row, not runtime. Whether a repo is a vertical-domain application is conveyed by its SDD manifest's `profile: application-product`, not by a service_type tag — this enum is strictly about runtime artefact shape (per resolution of adopt-canonical-catalogue-builder.md §7.1).
+      Type of repository, declared in `orchestration/repo-config/*.yaml` as `service_type` and surfaced in `repositories.component_type` and `services.component_type`. The canonical builder uses this to decide which repos are runtime services (api_service, worker, gateway, frontend, mobile) and which are non-runtime (library, infrastructure, documentation); firmware runs, but on a device, so it is runtime without a service row (M-ADR 0215) — service emission follows emits_service_row, not runtime. Whether a repo is a vertical-domain application is conveyed by its SDD manifest's `profile: application-product`, not by a service_type tag — this enum is strictly about runtime artefact shape.
   capability_exemption_reason:
     values:
     - value: infrastructure
@@ -174,11 +174,11 @@ enums:
     - value: public-infrastructure
       description: Public networks, registries, or services no party in the estate operates.
     - value: estate-owned-unmodelled
-      description: "Operated by this estate but with no SDD or container home yet — the row is an accounted-for stand-in, and this population is the estate's modelling backlog, countable (F16, 2.32.0). Not an assertion of externality: an assertion of accountability for a boundary row."
+      description: "Operated by this estate but with no SDD or container home yet — the row is an accounted-for stand-in, and this population is the estate's modelling backlog, countable (2.32.0). Not an assertion of externality: an assertion of accountability for a boundary row."
     - value: organisation-internal
-      description: Owned elsewhere in the same organisation, outside this estate's modelling boundary (F16, 2.32.0).
+      description: Owned elsewhere in the same organisation, outside this estate's modelling boundary (2.32.0).
     description: |
-      Why an external-system candidate is ACCOUNTED FOR at the estate boundary, per M-ADR 0189 §4.6 (WS15; wording corrected by F16, 2.32.0): five values assert another party owns the system, and two assert the estate/organisation owns it but it has no model home yet — forcing the latter through the former would demand a false reason, and a false reason is worse than silence. The adjudicator can prove a candidate internal; it cannot prove one accounted-for — that is an assertion the author is accountable for, in the shape M-ADR 0188 ratified for repositories. Closed vocabulary, method-owned, extended only by ADR amendment, so adopters cannot locally widen the exemption surface to silence the unverified-candidate coverage finding.
+      Why an external-system candidate is ACCOUNTED FOR at the estate boundary, per M-ADR 0189 §4.6 (wording corrected in 2.32.0): five values assert another party owns the system, and two assert the estate/organisation owns it but it has no model home yet — forcing the latter through the former would demand a false reason, and a false reason is worse than silence. The adjudicator can prove a candidate internal; it cannot prove one accounted-for — that is an assertion the author is accountable for, in the shape M-ADR 0188 ratified for repositories. Closed vocabulary, method-owned, extended only by ADR amendment, so adopters cannot locally widen the exemption surface to silence the unverified-candidate coverage finding.
       ENFORCED, not advisory: the builder drops a row whose reason is outside this vocabulary (convention finding) and the candidate stays unverified — which is the point. An unrecognised reason must not succeed at the one thing an exemption does.
   scaffold_status:
     values:
@@ -1353,7 +1353,7 @@ catalogues:
       nullable: true
       description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
     description: |
-      Hierarchical grouping for features. First-class entity per resolution of adopt-canonical-catalogue-builder.md §7.2 — replaces the previous reverse-only synthetic `feature-tree-group` rows in features.csv. Both forward and reverse can use feature_groups: forward application-product SDDs whose `feature-tree.md` has H2/H3 structure, reverse SDDs whose extracted feature trees are inherently hierarchical, and any SDD that promotes groups to first-class with authored metadata. Groups can nest via `parent_group_id`.
+      Hierarchical grouping for features. First-class entity — replaces the previous reverse-only synthetic `feature-tree-group` rows in features.csv. Both forward and reverse can use feature_groups: forward application-product SDDs whose `feature-tree.md` has H2/H3 structure, reverse SDDs whose extracted feature trees are inherently hierarchical, and any SDD that promotes groups to first-class with authored metadata. Groups can nest via `parent_group_id`.
     foreign_keys:
     - column: product_id
       references: products.id
@@ -2062,8 +2062,8 @@ catalogues:
       nullable: false
       description: Mandatory, non-empty. The reason makes exemptions countable; the note makes them reviewable (M-ADR 0188 §4.2 pattern).
     description: |
-      A declared, reasoned assertion that an external-system candidate is GENUINELY external (M-ADR 0189 §4.6 / WS15). Annotation catalogue (M-ADR 0133 §4.2b): one FK, declared never derived, closed reason enum. Sourced from `orchestration/external-system-exemptions.yaml`.
-      The invariant it completes: c4_external_systems was the one catalogue family with no coverage predicate — a candidate producing no adjudication outcome was silent, and that silence hid a 28% dependency -graph distortion (ledger L4). Every candidate now either resolves at adjudication, or carries an exemption here, or is reported unverified. An exemption retires only the unverified finding — never an adjudication outcome (a converted candidate's exemption is a contradiction, reported and dropped). Shared entities may be exempted by multiple SDDs: identical rows dedup at aggregation (same exception class as c4_external_systems); conflicting rows keep first-seen with a convention finding.
+      A declared, reasoned assertion that an external-system candidate is GENUINELY external (M-ADR 0189 §4.6). Annotation catalogue (M-ADR 0133 §4.2b): one FK, declared never derived, closed reason enum. Sourced from `orchestration/external-system-exemptions.yaml`.
+      The invariant it completes: c4_external_systems was the one catalogue family with no coverage predicate — a candidate producing no adjudication outcome was silent, and that silence hid a 28% dependency -graph distortion. Every candidate now either resolves at adjudication, or carries an exemption here, or is reported unverified. An exemption retires only the unverified finding — never an adjudication outcome (a converted candidate's exemption is a contradiction, reported and dropped). Shared entities may be exempted by multiple SDDs: identical rows dedup at aggregation (same exception class as c4_external_systems); conflicting rows keep first-seen with a convention finding.
     foreign_keys:
     - column: external_system_id
       references: c4_external_systems.id
@@ -2172,7 +2172,7 @@ catalogues:
       type: string
       nullable: false
       description: exposes | consumes.
-    description: "Edge: service exposes or consumes contract. Both FKs are external (per M-ADR 0147): federated SDDs that walk per-repo service-architecture tables emit consumes rows where service_id resolves to the platform-root catalogue's services.csv (post-aggregation) and contract_id resolves to the platform-root contracts.csv. Internal builds (e.g. connect-mono) still optimistically validate locally. Schema 2.8.0."
+    description: "Edge: service exposes or consumes contract. Both FKs are external (per M-ADR 0147): federated SDDs that walk per-repo service-architecture tables emit consumes rows where service_id resolves to the platform-root catalogue's services.csv (post-aggregation) and contract_id resolves to the platform-root contracts.csv. Internal builds (a single-SDD platform) still optimistically validate locally. Schema 2.8.0."
     foreign_keys:
     - column: service_id
       references: services.id
@@ -2303,7 +2303,7 @@ catalogues:
       nullable: true
       description: Where the coupling is evidenced — a path or anchor in the SDD, from `evidence:` on the services[] entry. Prose about the coupling stays in dependency_notes; this is the pointer a reviewer follows.
     description: |
-      Edge: capability is realised by services. Sourced from the capability traceability manifest services[] block. service_id is an external FK (schema 2.29.0, F4): a traceability entry marked `owner_sdd:` declares a cross-SDD reference (e.g. the service moved to a sibling SDD at an M-ADR 0170 §4.2 carve) — the per-SDD builder emits the edge, logs it `[finding] external`, and aggregation validates it hard against the owning sibling's rows. An UNMARKED id that does not resolve locally is NOT emitted — it stays a member-tier orphan finding (or convention, when it names a known external system).
+      Edge: capability is realised by services. Sourced from the capability traceability manifest services[] block. service_id is an external FK (schema 2.29.0): a traceability entry marked `owner_sdd:` declares a cross-SDD reference (e.g. the service moved to a sibling SDD at an M-ADR 0170 §4.2 carve) — the per-SDD builder emits the edge, logs it `[finding] external`, and aggregation validates it hard against the owning sibling's rows. An UNMARKED id that does not resolve locally is NOT emitted — it stays a member-tier orphan finding (or convention, when it names a known external system).
     foreign_keys:
     - column: capability_id
       references: capabilities.id
@@ -2365,8 +2365,8 @@ catalogues:
     - name: source
       type: string
       nullable: false
-      description: "declared — the only emitted value. `derived` is reserved vocabulary: the reverse derivation it anticipated was never built (0 rows across 105 measured units) and the claim was corrected at 3.0.0 (M-ADR 0203 §4.5 / F2); the value re-enters if a decision builds a reverse source."
-    description: "Edge: capability is bound to a contract. Whether the capability exposes or depends on it is not stated by the source (traceability.contracts), so this description asserts no direction (M-ADR 0211 §1). Forward-declared only. Forward-declared only (traceability.contracts). The reverse derivation this description long claimed (service_contract ⋈ capability_service) was measured nonexistent — 0 `source: derived` rows across 105 units, builder references neither catalogue — and the CLAIM was corrected at 3.0.0 (M-ADR 0203 §4.5 / F2, gap class absent-derivation per M-ADR 0196 §4.1). The edge is forward-one-directional until a decision builds a reverse source."
+      description: "declared — the only emitted value. `derived` is reserved vocabulary: the reverse derivation it anticipated was never built (0 rows across 105 measured units) and the claim was corrected at 3.0.0 (M-ADR 0203 §4.5); the value re-enters if a decision builds a reverse source."
+    description: "Edge: capability is bound to a contract. Whether the capability exposes or depends on it is not stated by the source (traceability.contracts), so this description asserts no direction (M-ADR 0211 §1). Forward-declared only. Forward-declared only (traceability.contracts). The reverse derivation this description long claimed (service_contract ⋈ capability_service) was measured nonexistent — 0 `source: derived` rows across 105 units, builder references neither catalogue — and the CLAIM was corrected at 3.0.0 (M-ADR 0203 §4.5, gap class absent-derivation per M-ADR 0196 §4.1). The edge is forward-one-directional until a decision builds a reverse source."
     foreign_keys:
     - column: capability_id
       references: capabilities.id
@@ -2546,7 +2546,7 @@ catalogues:
       type: string
       nullable: true
       description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
-    description: "Edge: feature delivers async push via a named channel/topic. Peer of `graphql_operations:` in the per-feature evidence shape — `graphql_operations:` carries the GraphQL operation names declared in the schema (Queries / Mutations / Subscriptions); `feature_subscription_channels` rows carry the channel/topic layer that physically delivers the push events (AppSync WebSocket endpoints, Pekko WS channels, MQTT topics, server-sent-event streams). Per resolved decision §1 of `content/plans/v0-9-0-cohort-sweep-derived-bundle.md`: a single GraphQL Subscription operation may listen on multiple channels; one channel may be consumed by multiple operations — modelling as a separate edge catalogue (not as a feature column) accommodates the many-to-many. Built per-SDD from `reverse-evidence/feature-grounding-evidence.yaml` `subscription_channels:` entries on each feature. Added in schema 2.9.0."
+    description: "Edge: feature delivers async push via a named channel/topic. Peer of `graphql_operations:` in the per-feature evidence shape — `graphql_operations:` carries the GraphQL operation names declared in the schema (Queries / Mutations / Subscriptions); `feature_subscription_channels` rows carry the channel/topic layer that physically delivers the push events (AppSync WebSocket endpoints, Pekko WS channels, MQTT topics, server-sent-event streams). A single GraphQL Subscription operation may listen on multiple channels; one channel may be consumed by multiple operations — modelling as a separate edge catalogue (not as a feature column) accommodates the many-to-many. Built per-SDD from `reverse-evidence/feature-grounding-evidence.yaml` `subscription_channels:` entries on each feature. Added in schema 2.9.0."
     foreign_keys:
     - column: feature_id
       references: features.id
@@ -2672,9 +2672,9 @@ catalogues:
     - name: interaction
       type: string
       nullable: true
-      description: Optional interaction label from the Rel(...) line. May hold multiple '; '-joined labels (F25).
+      description: Optional interaction label from the Rel(...) line. May hold multiple '; '-joined labels.
     description: |
-      Edge: a persona uses a C4 container — the L2-granularity companion to persona_c4system (M-ADR 0189 F26 §3, ratified 2026-07-10). Eleven of one estate's L2 diagrams and the bulk of another's 81 unroutable Rels drew Person→Container relationships that had no catalogue and, until F26, no finding. Harvested at member tier from Rel(...) lines whose endpoints resolve to a file-local Person and a local container (either direction; the row is normalised persona→container). A Person that matches no persona row is a coverage finding, never a silent skip. Both authoring directions feed from the same diagram surface (M-ADR 0157 parity). Added in schema 2.34.0.
+      Edge: a persona uses a C4 container — the L2-granularity companion to persona_c4system (M-ADR 0189, ratified 2026-07-10). Eleven of one estate's L2 diagrams and the bulk of another's 81 unroutable Rels drew Person→Container relationships that had no catalogue and raised no finding. Harvested at member tier from Rel(...) lines whose endpoints resolve to a file-local Person and a local container (either direction; the row is normalised persona→container). A Person that matches no persona row is a coverage finding, never a silent skip. Both authoring directions feed from the same diagram surface (M-ADR 0157 parity). Added in schema 2.34.0.
     foreign_keys:
     - column: persona_id
       references: personas.id
@@ -2698,11 +2698,11 @@ catalogues:
     - name: interaction
       type: string
       nullable: true
-      description: Optional integration label/protocol from the Rel(...) line. May hold multiple '; '-joined labels when one pair is declared with distinct labels (F25, 2.33.2).
+      description: Optional integration label/protocol from the Rel(...) line. May hold multiple '; '-joined labels when one pair is declared with distinct labels (2.33.2).
     - name: from_container_id
       type: string
       nullable: true
-      description: The Rel's non-external endpoint resolved to a local container at member tier, when it is one (F17, 2.33.0) — the datum that lets adjudication rewrite this edge onto container_dependency instead of destroying it. Empty when the endpoint is the system itself or unresolvable.
+      description: The Rel's non-external endpoint resolved to a local container at member tier, when it is one (2.33.0) — the datum that lets adjudication rewrite this edge onto container_dependency instead of destroying it. Empty when the endpoint is the system itself or unresolvable.
     description: "Edge: a C4 system integrates with an external software system. Captures the L1 context 'System integrates with External System' relationship, extracted from System_Ext(...) + Rel(...) on L1/L2 diagrams. Per M-ADR 0155. Container-level external dependencies are out of scope (system-level only). Added in schema 2.10.0. From 2.30.0 (M-ADR 0189 §4.4): edges whose external endpoint the aggregator adjudicates as an INTERNAL system are rewritten onto system_system_dependency and removed from this catalogue."
     foreign_keys:
     - column: c4_system_id
@@ -2734,13 +2734,13 @@ catalogues:
     - name: source_sdd_id
       type: string
       nullable: true
-      description: SDD whose diagram declared the originating reference. Member-emitted rows set it directly (F19); adjudication-derived rows are stamped by the aggregator.
+      description: SDD whose diagram declared the originating reference. Member-emitted rows set it directly; adjudication-derived rows are stamped by the aggregator.
     - name: platform_sdd_id
       type: string
       nullable: true
       description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
     description: |
-      Edge: a C4 container depends on another INTERNAL container (adopter finding F17 — F6 exactly one tier down: "no edge for internal" at L2). Derived by the aggregator at adjudication: an external-system candidate that resolves to an internal container was never external — each of its dependency edges whose member-resolved `from_container_id` is known is rewritten here, and a candidate with no remaining edges is dropped (it was a phantom duplicate of the container). A candidate with unconvertible edges is kept with the tier-contradiction finding, so no edge is ever destroyed to make a build quieter — the measured cost that stopped an adopter remediating 22 contradictions was eight real edges. ALSO emitted at member tier (F19, 2.33.1): the C4-correct authoring — Rel(container_a, container_b) between two Container(...) nodes — emits its edge directly; adjudication merges into a catalogue that already has content rather than being its only source, so the metamodel no longer rewards mis-declaration over correct authoring. Added in schema 2.33.0.
+      Edge: a C4 container depends on another INTERNAL container (the system-tier gap exactly one tier down: "no edge for internal" at L2). Derived by the aggregator at adjudication: an external-system candidate that resolves to an internal container was never external — each of its dependency edges whose member-resolved `from_container_id` is known is rewritten here, and a candidate with no remaining edges is dropped (it was a phantom duplicate of the container). A candidate with unconvertible edges is kept with the tier-contradiction finding, so no edge is ever destroyed to make a build quieter — the measured cost that stopped an adopter remediating 22 contradictions was eight real edges. ALSO emitted at member tier (2.33.1): the C4-correct authoring — Rel(container_a, container_b) between two Container(...) nodes — emits its edge directly; adjudication merges into a catalogue that already has content rather than being its only source, so the metamodel no longer rewards mis-declaration over correct authoring. Added in schema 2.33.0.
     foreign_keys:
     - column: from_container_id
       references: c4_containers.id
@@ -2910,7 +2910,7 @@ catalogues:
     - name: target_locus
       type: string
       nullable: true
-      description: platform | external | legacy (M-ADR 0204; closed enum, absent/empty = platform). A statement about the TARGET only — never about the consuming product, and never a stability, lifecycle or quality claim. platform rows behave exactly as before this column existed. external/legacy rows carry empty target_capability_id and target_service_id and name their target in target_external_system_id; they skip platform resolution and the F18 realiser-join, with every skip named.
+      description: platform | external | legacy (M-ADR 0204; closed enum, absent/empty = platform). A statement about the TARGET only — never about the consuming product, and never a stability, lifecycle or quality claim. platform rows behave exactly as before this column existed. external/legacy rows carry empty target_capability_id and target_service_id and name their target in target_external_system_id; they skip platform resolution and the synchronous realiser-join, with every skip named.
     - name: target_external_system_id
       type: string
       nullable: true
@@ -2926,7 +2926,7 @@ catalogues:
     - name: contract_type
       type: string
       nullable: true
-      description: rest | graphql | openapi | grpc | event | event-stream | stream | other. Optional; reflects what the consuming SDD declares. The async set (`event`/`event-stream`/`stream`) marks a shared-stream subscription that binds to a stream contract rather than a realiser service (M-ADR 0192) — such rows skip the F18 synchronous realiser-join at aggregation.
+      description: rest | graphql | openapi | grpc | event | event-stream | stream | other. Optional; reflects what the consuming SDD declares. The async set (`event`/`event-stream`/`stream`) marks a shared-stream subscription that binds to a stream contract rather than a realiser service (M-ADR 0192) — such rows skip the synchronous realiser-join at aggregation.
     - name: required_stability
       type: string
       nullable: true
@@ -2948,7 +2948,7 @@ catalogues:
       nullable: true
       description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
     description: |
-      Per-SDD edge: an application-side or integration-side SDD declares that its product depends on a platform-side capability + service pair. Built from `reverse-evidence/feature-grounding-evidence.yaml` `platform_dependencies:` block (product-level — the cohort source shape carries product-scoped dependency rows with a `consumed_by:` list naming which services within the consuming product depend on the target). Each row records one (consuming product, target capability, target service) triple. The aggregator then joins these rows against platform-side `capability_service` to emit `cross_sdd_platform_capability` edges at aggregation time. Cross- SDD references (target_capability_id, target_service_id) are external — they're not expected to resolve in the per-SDD build, only at aggregation. Added in schema 2.9.0; see `content/plans/v0-9-0-cohort-sweep-derived-bundle.md` §"Cross-SDD platform-capability-edge".
+      Per-SDD edge: an application-side or integration-side SDD declares that its product depends on a platform-side capability + service pair. Built from `reverse-evidence/feature-grounding-evidence.yaml` `platform_dependencies:` block (product-level — the cohort source shape carries product-scoped dependency rows with a `consumed_by:` list naming which services within the consuming product depend on the target). Each row records one (consuming product, target capability, target service) triple. The aggregator then joins these rows against platform-side `capability_service` to emit `cross_sdd_platform_capability` edges at aggregation time. Cross- SDD references (target_capability_id, target_service_id) are external — they're not expected to resolve in the per-SDD build, only at aggregation. Added in schema 2.9.0.
     foreign_keys:
     - column: product_id
       references: products.id
@@ -2993,7 +2993,7 @@ catalogues:
       nullable: false
       description: Service identifier the consuming SDD references and the platform SDD owns. The join key.
     description: |
-      Federated edge: an application-side or integration-side SDD's `product_platform_dependencies` reference resolves against a platform-side SDD's capability spec via the platform capability's `capability_service` roster. Surfaces ecosystem-wide platform- consumer relationships at product → capability granularity. Built **only at aggregation time** — `sdd-cli catalogue aggregate` joins each consuming SDD's `product_platform_dependencies` rows against every other SDD's `capability_service` rows on `target_service_id == service_id`, emitting one row per resolved (consuming-product, platform-capability) pair. Per-SDD builders emit nothing for this catalogue; the aggregator owns it entirely. A platform-dependency whose target_service_id doesn't resolve to any platform-side capability_service row is logged as an `orphan` finding and produces no row. Cross-SDD references are external by definition. Added in schema 2.9.0; see `content/plans/v0-9-0-cohort-sweep-derived-bundle.md` §"Cross-SDD platform-capability-edge" and M-ADR 0134.
+      Federated edge: an application-side or integration-side SDD's `product_platform_dependencies` reference resolves against a platform-side SDD's capability spec via the platform capability's `capability_service` roster. Surfaces ecosystem-wide platform- consumer relationships at product → capability granularity. Built **only at aggregation time** — `sdd-cli catalogue aggregate` joins each consuming SDD's `product_platform_dependencies` rows against every other SDD's `capability_service` rows on `target_service_id == service_id`, emitting one row per resolved (consuming-product, platform-capability) pair. Per-SDD builders emit nothing for this catalogue; the aggregator owns it entirely. A platform-dependency whose target_service_id doesn't resolve to any platform-side capability_service row is logged as an `orphan` finding and produces no row. Cross-SDD references are external by definition. Added in schema 2.9.0; see M-ADR 0134.
     foreign_keys:
     - column: consuming_product_id
       references: products.id
@@ -3131,7 +3131,7 @@ catalogues:
       nullable: true
       description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator per M-ADR 0208 §4.4 (preserve-if-set, fill rule by pull path); left empty by per-SDD builders. Added in 3.7.0.
     description: |
-      Application-product annotation (M-ADR 0191 §4.3 overlay, second element — WS4): one row per conformance tag the product asserts about its archetype's conformance expectations. Built per-SDD from the manifest's `conformance` block so the AGGREGATION-tier conformance GATE can read it. `status=covered` means the product's own conformance suite exercises the tag; `status=deviated` means the product declares (with a rationale) that it deliberately does not. At aggregation, an archetype-expected conformance tag that is neither covered nor deviated raises a deviation-visible WARN. The method gates the DECLARATION — it does not run the adopter's conformance suite. Added in schema 2.39.0.
+      Application-product annotation (M-ADR 0191 §4.3 overlay, second element): one row per conformance tag the product asserts about its archetype's conformance expectations. Built per-SDD from the manifest's `conformance` block so the AGGREGATION-tier conformance GATE can read it. `status=covered` means the product's own conformance suite exercises the tag; `status=deviated` means the product declares (with a rationale) that it deliberately does not. At aggregation, an archetype-expected conformance tag that is neither covered nor deviated raises a deviation-visible WARN. The method gates the DECLARATION — it does not run the adopter's conformance suite. Added in schema 2.39.0.
     foreign_keys:
     - column: product_id
       references: products.id

package/dist/lib/catalogue/coverage-predicates.js

@@ -13,12 +13,12 @@
  *     §4.3 (`orphaned` is aggregate-only; member tier reports
  *     `unresolved-locally`, cause-agnostic); the Path-X leverage axis is
  *     reported separately and only when repo_capability.csv exists.
- *   - event_coverage    (WS3): every catalogued event is attributed to a
+ *   - event_coverage:    every catalogued event is attributed to a
  *     runtime — service_event edge or resolving publisher column — with
  *     the contract-twin alternative route, the column-vs-edge disagreement
  *     controls, and the chain-readout/consumer-enumerability metric lines
  *     that are never verdicts.
- *   - contract_coverage (WS2): every catalogued contract is reachable —
+ *   - contract_coverage: every catalogued contract is reachable —
  *     capability_contract or service_contract — with the three computed
  *     exclusions (deprecated / provider-surface / not-an-interface, the
  *     last a positive READ of the spec file), the covered-as-event
@@ -178,8 +178,8 @@ FROM "services" s
 WHERE s."id" IS NOT NULL AND s."id" <> ''
 ORDER BY service_id, primary_repo;`;
 export async function runServiceCapabilityCoverage(session, options) {
-    // Known-bad probe, carried over from the reference implementation
-    // (WS11's third requirement): a synthetic claimed service must classify
+    // Known-bad probe, carried over from the reference implementation:
+    // a synthetic claimed service must classify
     // as claimed BEFORE any real data is reported — a run whose
     // classification never executed must not be able to report a healthy
     // estate.

package/dist/lib/catalogue/coverage-run.js

@@ -89,7 +89,7 @@ export async function runCatalogueCoverage(inputs, write) {
         const available = new Set(schema.catalogues.map((c) => c.name).filter((n) => present(n)));
         lines.push(...renderScoresCoverage(await runScoresCoverage(session, { tier, available, sddRoot }), tier));
         // Staleness VERDICTS — the second half of the fourteenth check's §4.5
-        // scope (ledger §3o), member-tier only with the aggregate skip stated.
+        // scope, member-tier only with the aggregate skip stated.
         // Same coverage class, same reporting-only staging as the rest of the
         // scores family.
         lines.push(...renderStalenessVerdicts(await runStalenessVerdicts(session, { tier, available, sddRoot }), tier));

package/dist/lib/catalogue/finding-identity.js

@@ -1,6 +1,6 @@
 /**
  * Finding IDENTITY — the stable key a findings baseline is compared on, per
- * M-ADR 0132 §4.3 as amended, delivering the ruling recorded at ledger §3p.
+ * M-ADR 0132 §4.3 as amended.
  *
  * THE PROBLEM THIS EXISTS FOR, measured rather than asserted. A findings
  * baseline stores whole `[finding]` lines, so improving a message invalidates
@@ -17,7 +17,7 @@
  * files, 74 non-empty, 1,677 body lines — that works for 1,434 lines (85.5%)
  * and fails for 243 (14.5%), which embed their subject in prose:
  *
- *   [finding] orphan: repo integration-calamp resolves to no capability ...
+ *   [finding] orphan: repo integration-acme resolves to no capability ...
  *
  * One renderer template, all orphan class, spread across 62 repos. Recovering
  * identity there means teaching the comparator the renderer's message
@@ -30,7 +30,7 @@
  * baseline is reviewed by people and a side-channel nobody sees is a side
  * channel nobody maintains:
  *
- *   [finding] orphan (repo:integration-calamp): repo integration-calamp ...
+ *   [finding] orphan (repo:integration-acme): repo integration-acme ...
  *   [finding] divergence (docs/domains/asset/product/x.traceability.yaml): ...
  *
  * A finding with no declared subject renders EXACTLY as it does today. That is

package/dist/lib/catalogue/manifest-loader.js

@@ -123,7 +123,7 @@ const DataPlaneSchema = z.object({
     bindings: z.array(DataPlaneBindingSchema),
     deviations: z.array(DataPlaneDeviationSchema).optional(),
 });
-// Conformance coverage (M-ADR 0191 §4.3, second overlay element — WS4). An
+// Conformance coverage (M-ADR 0191 §4.3, second overlay element). An
 // application-product asserts which of its archetype's conformance expectations
 // its own conformance suite exercises (`coverage`), and declares a rationale for
 // any expected tag it deliberately does not cover (`deviations`). The method
@@ -249,7 +249,7 @@ const ManifestSchema = z.object({
     // optional declared deviations from the archetype default, each carrying a
     // rationale so the mismatch is sanctioned variance, not silent drift.
     data_plane: DataPlaneSchema.optional(),
-    // Conformance coverage declaration (M-ADR 0191 §4.3 WS4, sdd-manifest-schema
+    // Conformance coverage declaration (M-ADR 0191 §4.3, sdd-manifest-schema
     // 1.5.0). Which archetype conformance expectations the product's suite
     // exercises, plus rationales for any it deliberately does not.
     conformance: ConformanceSchema.optional(),

package/dist/lib/catalogue/scaffold-delta.js

@@ -216,7 +216,7 @@ export async function runScaffoldDelta(session, options) {
 }
 /**
  * The delta's DEFECT classes are gate-acting (`divergence`), PROMOTED by a
- * recorded governance act after the M-ADR 0207 §4.9 pilot completed with no
+ * recorded method act after the M-ADR 0207 §4.9 pilot completed with no
  * surprise in any gated figure (2026-08-08) — the deliberate later act the
  * scores-coverage precedent reserves, performed. `scaffold-stale` stays
  * `coverage` with its staleness family: a stale anchor is a re-declare

package/dist/lib/catalogue/schema-compat.js

@@ -1,8 +1,7 @@
 /**
  * Per-schema compatibility ranges declared by this sdd-cli build.
  *
- * Per resolution of adopt-canonical-catalogue-builder.md §7.5, the three
- * sdd-method-distributed schemas version independently. The CLI declares
+ * The three sdd-method-distributed schemas version independently. The CLI declares
  * the version range it accepts for each and fails fast at read time on
  * out-of-range manifests.
  *

package/dist/lib/catalogue/staleness-verdicts.js

@@ -1,5 +1,5 @@
-// Staleness VERDICTS — the second half of M-ADR 0205 §4.5's staleness scope
-// (ledger §3o): "staleness meaning corpus_ref older than the target's last
+// Staleness VERDICTS — the second half of M-ADR 0205 §4.5's staleness scope:
+// "staleness meaning corpus_ref older than the target's last
 // content change". The scores-coverage predicate computes each row's BASIS;
 // this module computes the VERDICT the basis supports. A stale score is worse
 // than a missing one, because it reads as coverage — the predicate otherwise

package/dist/lib/lock-file.js

@@ -215,7 +215,7 @@ function parseVersioned(raw) {
             // a YAML reader parses 113 of 325 entries in one real lock as MAPPINGS
             // rather than strings — silently, with no error. Quoting on write is the
             // fix; reading both forms ships first so no lock can be written that an
-            // older reader cannot parse. See method-open-items §3l.
+            // older reader cannot parse.
             const entry = stripQuotes(line.slice("      - ".length));
             const withDigest = DIGEST_ENTRY_RE.exec(entry);
             if (withDigest) {

package/dist/lib/package-version.js

@@ -83,7 +83,7 @@ export function getVerifyCliVersion() {
 }
 /**
  * The @sdd-method/maintain-cli version released WITH this sdd-cli. The managed CI workflow's
- * catalogue freshness step installs exactly this version (M-ADR 0218 §5; ruled 2026-10-15, sdm-jts.6).
+ * catalogue freshness step installs exactly this version (M-ADR 0218 §5).
  * Read the same way as the verify version, for the same reason (dist/ copy, never scripts/ live).
  */
 export function getMaintainCliVersion() {

package/dist/lib/validate/behaviour-store.js

@@ -0,0 +1,351 @@
+// Behaviour-store checks (M-ADR 0221, 0222, 0223): the gates OpenSpec itself does not enforce.
+//
+// An SDD's behaviour store is an OpenSpec project; in the inside-SDD shape it is `openspec/` at the
+// SDD root, with one agreement record per change at `docs/agreements/<change>.yaml`
+// (agreement-record-schema.yaml). OpenSpec checks the format of specs and deltas. It does not check
+// that a change was agreed before it was built, that the requirements it modifies stayed as they
+// were agreed, or that an archived change was judged. These are those checks:
+//
+//   1. records:  every agreement record has the shape the checks below read.
+//   2. agreement: an open change with any completed task has an agreed record and a Gate 0 that
+//                 ends CLEAR (the pre-apply check, M-ADR 0223 §4.3).
+//   3. stale:    for each open, agreed change that MODIFIES, REMOVES or RENAMES requirements, the
+//                 targeted living specs are unchanged since the agreed commit (M-ADR 0223 §4.5).
+//                 With no such targets the check is vacuous, and says so.
+//   4. verdicts: every archived change except a baseline has a verdict.md and a record whose
+//                 verdict is PASS and names it (M-ADR 0223 §4.6).
+//
+// A sibling-repository store (M-ADR 0221 §4.2) is checked in that repository, not here.
+//
+// OPENSPEC'S OWN VALIDATION is the separate validator `behaviour-store-openspec`, because it needs
+// the OpenSpec CLI at OPENSPEC_VERSION (the Method Validation module installs it). Without a store
+// both report [N/A], an empty population, never a pass.
+import { execFile } from "node:child_process";
+import { access, readdir, readFile } from "node:fs/promises";
+import { basename, join } from "node:path";
+import { promisify } from "node:util";
+import { parseDocument } from "yaml";
+const execFileAsync = promisify(execFile);
+/** The OpenSpec release the method depends on (M-ADR 0223 ruling 2). The module installs exactly this. */
+export const OPENSPEC_VERSION = "1.14.3";
+/** Telemetry off for every OpenSpec run the method makes. */
+export const OPENSPEC_ENV = { OPENSPEC_TELEMETRY: "0", DO_NOT_TRACK: "1" };
+export const STORE_DIR = "openspec";
+export const AGREEMENTS_DIR = "docs/agreements";
+const AGREEMENT_STATUSES = ["proposed", "agreed", "superseded", "withdrawn"];
+const COMMIT_RE = /^[0-9a-f]{7,40}$/;
+// OpenSpec counts a task done when its box holds only `x`, either case, any spacing.
+const TASK_DONE_RE = /^\s*-\s*\[\s*[xX]\s*\]/m;
+const TARGET_HEADING_RE = /^##\s+(MODIFIED|REMOVED|RENAMED)\s+Requirements\b/m;
+async function exists(p) {
+    try {
+        await access(p);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+async function dirs(p) {
+    try {
+        return (await readdir(p, { withFileTypes: true })).filter((d) => d.isDirectory()).map((d) => d.name).sort();
+    }
+    catch {
+        return [];
+    }
+}
+async function readText(p) {
+    try {
+        return await readFile(p, "utf8");
+    }
+    catch {
+        return null;
+    }
+}
+/** Read and shape-check one agreement record. Returns the record, or the problems found. */
+export function parseAgreementRecord(file, text) {
+    const problems = [];
+    const doc = parseDocument(text);
+    if (doc.errors.length > 0) {
+        return { problems: doc.errors.map((e) => `${file}: does not parse: ${e.message.split("\n")[0]}`) };
+    }
+    const root = doc.toJS();
+    const r = root?.agreement_record;
+    if (!r || typeof r !== "object")
+        return { problems: [`${file}: no top-level agreement_record`] };
+    const expected = basename(file).replace(/\.ya?ml$/, "");
+    if (r.change !== expected)
+        problems.push(`${file}: change is ${JSON.stringify(r.change)}, expected "${expected}" (the file name)`);
+    const status = typeof r.status === "string" ? r.status : "";
+    if (!AGREEMENT_STATUSES.includes(status)) {
+        problems.push(`${file}: status ${JSON.stringify(r.status)} is not one of ${AGREEMENT_STATUSES.join(" | ")}`);
+    }
+    const sdd = (r.sdd ?? {});
+    const gates = Array.isArray(r.gates) ? r.gates : [];
+    const gate0 = gates.find((g) => g && g.name === "gate-0");
+    if (status === "agreed") {
+        if (r.agreed_on === undefined || r.agreed_on === null)
+            problems.push(`${file}: agreed, but no agreed_on`);
+        if (typeof r.approved_by !== "string" || r.approved_by.trim() === "")
+            problems.push(`${file}: agreed, but no approved_by`);
+        if (typeof sdd.commit !== "string") {
+            problems.push(`${file}: sdd.commit must be a quoted string, found ${sdd.commit === undefined ? "nothing" : `${typeof sdd.commit} ${String(sdd.commit)}`}` +
+                (typeof sdd.commit === "number" ? " (unquoted, YAML parsed the SHA as a number)" : ""));
+        }
+        else if (!COMMIT_RE.test(sdd.commit)) {
+            problems.push(`${file}: sdd.commit "${sdd.commit}" is not 7-40 hex characters`);
+        }
+        if (!gate0)
+            problems.push(`${file}: agreed, but no gates entry named gate-0`);
+        else if (gate0.result !== "CLEAR")
+            problems.push(`${file}: agreed, but gate-0 result is ${JSON.stringify(gate0.result)}, not CLEAR`);
+    }
+    // Every commit a record pins must survive parsing as a string. YAML 1.2 reads an unquoted
+    // all-digit abbreviation as an integer and one shaped like `1234e567` or `123e456` as a float
+    // (Infinity), and the pin is then lost; checking the PARSED type is the only test that catches
+    // both, since a pattern applied after coercion sees "Infinity" or a number.
+    for (const [path, value] of commitFields(r)) {
+        if (path === "sdd.commit")
+            continue;
+        if (typeof value !== "string") {
+            problems.push(`${file}: ${path} must be a quoted string, found ${typeof value} ${String(value)} (unquoted, YAML parsed the SHA as a number)`);
+        }
+    }
+    const verdict = r.verdict && typeof r.verdict === "object" ? r.verdict : undefined;
+    if (problems.length > 0)
+        return { problems };
+    return {
+        record: {
+            file,
+            change: expected,
+            status,
+            ...(typeof sdd.commit === "string" ? { commit: sdd.commit } : {}),
+            ...(typeof gate0?.result === "string" ? { gate0: gate0.result } : {}),
+            ...(verdict ? { verdict } : {}),
+        },
+        problems,
+    };
+}
+/** Every pinned commit in a record: any key named `commit` or ending `_commit`, and each value under verdict.merged and current. */
+function commitFields(r) {
+    const out = [];
+    const walk = (v, path, pinMap) => {
+        if (Array.isArray(v))
+            v.forEach((x, i) => walk(x, `${path}[${i}]`, false));
+        else if (v && typeof v === "object") {
+            for (const [k, x] of Object.entries(v)) {
+                const p = path === "" ? k : `${path}.${k}`;
+                const isPin = pinMap || k === "commit" || k.endsWith("_commit");
+                if (isPin && (x === null || typeof x !== "object"))
+                    out.push([p, x]);
+                else
+                    walk(x, p, p === "verdict.merged" || p === "current");
+            }
+        }
+    };
+    walk(r, "", false);
+    return out;
+}
+function lastGateLine(text) {
+    const lines = text.split("\n").map((l) => l.trim()).filter((l) => l !== "");
+    return lines.at(-1) ?? "";
+}
+async function gitDiffQuiet(repo, commit, path) {
+    try {
+        await execFileAsync("git", ["-C", repo, "cat-file", "-e", `${commit}^{commit}`]);
+    }
+    catch {
+        return "unresolved";
+    }
+    try {
+        await execFileAsync("git", ["-C", repo, "diff", "--quiet", commit, "HEAD", "--", path]);
+        return "same";
+    }
+    catch (err) {
+        return err.code === 1 ? "changed" : "unresolved";
+    }
+}
+/** The living specs an open change's deltas modify, remove or rename: openspec/specs/<capability>/spec.md. */
+async function targetedSpecs(repo, changeDir) {
+    const out = [];
+    const walk = async (rel) => {
+        const abs = join(repo, changeDir, "specs", rel);
+        let entries;
+        try {
+            entries = await readdir(abs, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const e of entries) {
+            const childRel = rel === "" ? e.name : `${rel}/${e.name}`;
+            if (e.isDirectory())
+                await walk(childRel);
+            else if (e.name === "spec.md") {
+                const text = (await readText(join(abs, e.name))) ?? "";
+                if (TARGET_HEADING_RE.test(text))
+                    out.push(`${STORE_DIR}/specs/${rel}/spec.md`);
+            }
+        }
+    };
+    await walk("");
+    return out.sort();
+}
+export async function checkBehaviourStore(repo) {
+    if (!(await exists(join(repo, STORE_DIR)))) {
+        return { exitCode: 0, stdout: `[N/A] no behaviour store (${STORE_DIR}/) in this repository\n` };
+    }
+    const lines = [];
+    const failures = [];
+    // 1. records
+    const records = new Map();
+    let recordFiles = [];
+    try {
+        recordFiles = (await readdir(join(repo, AGREEMENTS_DIR))).filter((f) => /\.ya?ml$/.test(f)).sort();
+    }
+    catch {
+        recordFiles = [];
+    }
+    for (const f of recordFiles) {
+        const rel = `${AGREEMENTS_DIR}/${f}`;
+        const { record, problems } = parseAgreementRecord(rel, (await readText(join(repo, rel))) ?? "");
+        failures.push(...problems);
+        if (record)
+            records.set(record.change, record);
+    }
+    lines.push(`records: ${recordFiles.length} agreement record(s), ${recordFiles.length - records.size} malformed`);
+    // 2 and 3. open changes
+    const open = (await dirs(join(repo, STORE_DIR, "changes"))).filter((d) => d !== "archive");
+    let started = 0;
+    let staleChecked = 0;
+    for (const change of open) {
+        const dir = `${STORE_DIR}/changes/${change}`;
+        const tasks = await readText(join(repo, dir, "tasks.md"));
+        const record = records.get(change);
+        if (tasks !== null && TASK_DONE_RE.test(tasks)) {
+            started++;
+            if (!record)
+                failures.push(`${dir}: has completed tasks but no agreement record (${AGREEMENTS_DIR}/${change}.yaml)`);
+            else if (record.status !== "agreed")
+                failures.push(`${dir}: has completed tasks but its agreement record is ${record.status}, not agreed`);
+            const gate = await readText(join(repo, dir, "gate-0.md"));
+            if (gate === null)
+                failures.push(`${dir}: has completed tasks but no gate-0.md`);
+            else if (lastGateLine(gate) !== "GATE: CLEAR")
+                failures.push(`${dir}: has completed tasks but gate-0.md ends "${lastGateLine(gate)}", not "GATE: CLEAR"`);
+        }
+        if (record?.status === "agreed" && record.commit) {
+            for (const spec of await targetedSpecs(repo, dir)) {
+                staleChecked++;
+                const r = await gitDiffQuiet(repo, record.commit, spec);
+                if (r === "changed")
+                    failures.push(`${dir}: STALE: ${spec} changed since the agreed commit ${record.commit}`);
+                if (r === "unresolved")
+                    failures.push(`${dir}: stale check unresolved: commit ${record.commit} is not in this clone's history (a shallow clone cannot run it)`);
+            }
+        }
+    }
+    lines.push(`agreement: ${open.length} open change(s), ${started} with completed tasks`);
+    lines.push(staleChecked === 0 ? "stale: vacuous (no open agreed change modifies, removes or renames a requirement)" : `stale: ${staleChecked} targeted living spec(s) checked against their agreed commits`);
+    // 4. archived changes
+    const archived = await dirs(join(repo, STORE_DIR, "changes", "archive"));
+    let baselines = 0;
+    for (const name of archived) {
+        const dir = `${STORE_DIR}/changes/archive/${name}`;
+        if (await exists(join(repo, dir, "baseline-evidence.md"))) {
+            baselines++;
+            continue;
+        }
+        const change = name.replace(/^\d{4}-\d{2}-\d{2}-/, "");
+        if (!(await exists(join(repo, dir, "verdict.md"))))
+            failures.push(`${dir}: archived without verdict.md`);
+        const record = records.get(change);
+        if (!record) {
+            failures.push(`${dir}: archived without an agreement record (${AGREEMENTS_DIR}/${change}.yaml)`);
+            continue;
+        }
+        if (record.verdict?.result !== "PASS")
+            failures.push(`${record.file}: change is archived but verdict.result is ${JSON.stringify(record.verdict?.result)}, not PASS`);
+        const vr = record.verdict?.record;
+        if (typeof vr !== "string" || !(await exists(join(repo, vr))))
+            failures.push(`${record.file}: verdict.record ${JSON.stringify(vr)} does not name an existing file`);
+    }
+    lines.push(`verdicts: ${archived.length} archived change(s), ${baselines} baseline(s), ${archived.length - baselines} needing a PASS verdict`);
+    const population = recordFiles.length + open.length + archived.length;
+    const body = lines.map((l) => `  ${l}`).join("\n") + "\n";
+    if (failures.length > 0) {
+        return { exitCode: 1, stdout: body + failures.map((f) => `[FAIL] ${f}`).join("\n") + "\n" };
+    }
+    if (population === 0)
+        return { exitCode: 0, stdout: body + `[N/A] the behaviour store has no changes and no agreement records yet\n` };
+    return { exitCode: 0, stdout: body + "[PASS] behaviour store: records, agreement, stale and verdict checks hold\n" };
+}
+async function runOpenspec(repo, args) {
+    try {
+        const { stdout } = await execFileAsync("openspec", args, { cwd: repo, env: { ...process.env, ...OPENSPEC_ENV }, maxBuffer: 16 * 1024 * 1024 });
+        return { code: 0, json: JSON.parse(stdout), raw: stdout };
+    }
+    catch (err) {
+        const e = err;
+        let json;
+        try {
+            json = JSON.parse(e.stdout ?? "");
+        }
+        catch {
+            json = undefined;
+        }
+        return { code: typeof e.code === "number" ? e.code : 127, ...(json ? { json } : {}), raw: (e.stdout ?? "") + (e.stderr ?? "") };
+    }
+}
+/** OpenSpec's own strict validation of the store: specs and open changes, and archived changes' tasks. */
+export async function checkBehaviourStoreOpenspec(repo) {
+    if (!(await exists(join(repo, STORE_DIR)))) {
+        return { exitCode: 0, stdout: `[N/A] no behaviour store (${STORE_DIR}/) in this repository\n` };
+    }
+    let version = "";
+    try {
+        version = (await execFileAsync("openspec", ["--version"], { env: { ...process.env, ...OPENSPEC_ENV } })).stdout.trim();
+    }
+    catch {
+        return {
+            exitCode: 1,
+            stdout: `[FAIL] the OpenSpec CLI is not on PATH; this repository has a behaviour store, so its validation cannot run (install @fission-ai/openspec@${OPENSPEC_VERSION}; the Method Validation module does)\n`,
+        };
+    }
+    if (version !== OPENSPEC_VERSION) {
+        return { exitCode: 1, stdout: `[FAIL] OpenSpec ${version} is installed; the method depends on exactly ${OPENSPEC_VERSION}\n` };
+    }
+    const lines = [];
+    const failures = [];
+    let measured = 0;
+    for (const [label, args] of [
+        ["specs and open changes (--all --strict)", ["validate", "--all", "--strict", "--json", "--no-interactive"]],
+        ["archived changes' tasks (--archived)", ["validate", "--archived", "--json", "--no-interactive"]],
+    ]) {
+        const r = await runOpenspec(repo, [...args]);
+        const t = r.json?.summary?.totals;
+        if (!t) {
+            failures.push(`${label}: OpenSpec returned no report (exit ${r.code}): ${r.raw.trim().split("\n").slice(-3).join(" | ")}`);
+            continue;
+        }
+        measured += t.items ?? 0;
+        lines.push(`${label}: ${t.items ?? 0} item(s), ${t.passed ?? 0} passed, ${t.failed ?? 0} failed`);
+        for (const item of r.json?.items ?? []) {
+            if (item.valid)
+                continue;
+            for (const i of item.issues ?? [])
+                failures.push(`${label}: ${item.id}${i.path ? ` (${i.path})` : ""}: ${i.level} ${i.message}`);
+            if ((item.issues ?? []).length === 0)
+                failures.push(`${label}: ${item.id}: invalid`);
+        }
+        if (r.code !== 0 && (t.failed ?? 0) === 0)
+            failures.push(`${label}: OpenSpec exited ${r.code} with no failed item reported`);
+    }
+    const body = [`  OpenSpec ${version}`, ...lines.map((l) => `  ${l}`)].join("\n") + "\n";
+    if (failures.length > 0)
+        return { exitCode: 1, stdout: body + failures.map((f) => `[FAIL] ${f}`).join("\n") + "\n" };
+    if (measured === 0)
+        return { exitCode: 0, stdout: body + "[N/A] OpenSpec found no specs and no changes to validate\n" };
+    return { exitCode: 0, stdout: body + "[PASS] OpenSpec strict validation holds\n" };
+}
+//# sourceMappingURL=behaviour-store.js.map

package/dist/lib/validate/dispatch.js

@@ -1,5 +1,20 @@
+import { checkBehaviourStore, checkBehaviourStoreOpenspec } from "./behaviour-store.js";
 import { checkBundleCoherence } from "./bundle-coherence.js";
 import { checkYamlParse } from "./yaml-parse.js";
+// The behaviour store (M-ADR 0221-0223) can sit in an SDD of any profile, so every profile carries
+// its two checks; without a store both report [N/A], an empty population, not a pass.
+const BEHAVIOUR_STORE_VALIDATORS = [
+    {
+        name: "behaviour-store",
+        source: { kind: "native", run: async (ctx) => checkBehaviourStore(ctx.targetRepo) },
+        build: () => ({ status: "run", args: [] }),
+    },
+    {
+        name: "behaviour-store-openspec",
+        source: { kind: "native", run: async (ctx) => checkBehaviourStoreOpenspec(ctx.targetRepo) },
+        build: () => ({ status: "run", args: [] }),
+    },
+];
 // Validators that accept --app-root / --repo-root flags work fine from the
 // bundled location because they override their internal ROOT_DIR via the
 // flag. Validators without that flag (adr-structure, runway-classification,
@@ -74,6 +89,7 @@ const APP_VALIDATORS = [
         },
         build: () => ({ status: "run", args: [] }),
     },
+    ...BEHAVIOUR_STORE_VALIDATORS,
     // Note: validate-runway-classification is intentionally NOT in the app set.
     // It requires platform-level files (docs/platform/feature-tree.md,
     // architecture-runway-index.md) that app repos don't own. Per ADR 0089,
@@ -126,6 +142,7 @@ const INTEGRATION_VALIDATORS = [
         },
         build: () => ({ status: "run", args: [] }),
     },
+    ...BEHAVIOUR_STORE_VALIDATORS,
 ];
 const PLATFORM_VALIDATORS = [
     {
@@ -208,6 +225,7 @@ const PLATFORM_VALIDATORS = [
         },
         build: () => ({ status: "run", args: [] }),
     },
+    ...BEHAVIOUR_STORE_VALIDATORS,
     // Optional: the upstream validate-docs.sh dispatcher covers the 6
     // conditional validators (backward-compatibility, deprecation-runway,
     // migration-completeness, ddd-artifacts, glossary-alignment,

package/dist/lib/validate/index.js

@@ -54,7 +54,7 @@ export async function runValidate(opts, stdout = (line) => process.stdout.write(
 // passed" with none were previously the same line (M-ADR 0200 §4.3). The
 // exit code is deliberately unchanged — the defect is the claim, not the
 // gating; whether an unexecutable validator should FAIL is the open design
-// question (post-3.0.0-followons.md A2), not this one.
+// question, not this one.
 function verdict(summary, selected) {
     if (summary.exitCode !== 0)
         return fail("One or more validators failed");

package/dist/lib/validate/plan.js

@@ -1,5 +1,5 @@
 /**
- * The method-managed validation job, as DATA (bead sdm-dd6.2; Dagger ruling sdm-s48, 2026-10-15).
+ * The method-managed validation job, as DATA (M-ADR 0219).
  *
  * One ordered plan per profile: every default validator, the platform's script-only checks, then the
  * advisory catalogue freshness check. Every executor renders or runs THIS: the GitHub workflow
@@ -22,6 +22,8 @@ const TITLES = {
     "yaml-parse": "Validate that tracked YAML parses",
     "gate-readiness": "Validate gate readiness",
     "bundle-coherence": "Report bundle coherence",
+    "behaviour-store": "Validate the behaviour store: agreement records, the pre-apply gate, stale requirements, verdicts",
+    "behaviour-store-openspec": "Validate the behaviour store with OpenSpec (strict)",
     // CI has no platform checkout, so this step runs the app-only checks; the met gate needs the platform beside it.
     "app-dependencies": "Validate app dependencies (app-only checks; no platform checkout in CI)",
 };

package/dist/lib/validate/yaml-parse.js

@@ -10,7 +10,7 @@
 // with it certifies exactly the corruption a line-surgery transformer
 // produces. `yaml` v2 refuses duplicate keys (DUPLICATE_KEY) and the other
 // malformations a lenient parse glosses — e.g. a `: ` inside an unquoted
-// scalar (`path: (none — tel: URL)`), which no pattern rule catches.
+// scalar (`path: (none — see: docs)`), which no pattern rule catches.
 //
 // Scope: the YAML files git TRACKS (`*.yaml`, `*.yml`) — the repo's sources,
 // not build output or dependencies. Outside a git work tree there is no

package/dist/maintain-version.json

@@ -1,4 +1,4 @@
 {
-  "version": "0.3.0",
-  "built_against_sdd_cli": "1.44.0"
+  "version": "0.5.0",
+  "built_against_sdd_cli": "1.46.0"
 }

package/dist/verify-version.json

@@ -1,4 +1,4 @@
 {
-  "version": "1.3.0",
-  "built_against_sdd_cli": "1.44.0"
+  "version": "1.5.0",
+  "built_against_sdd_cli": "1.46.0"
 }

package/package.json

@@ -1,9 +1,9 @@
 {
   "name": "@sdd-method/verify-cli",
-  "version": "1.3.0",
-  "sddCliVersion": "1.44.0",
+  "version": "1.5.0",
+  "sddCliVersion": "1.46.0",
   "description": "Verify an SDD repository without changing it — validate, list, and read-only catalogue and pack checks. Ships only the code those verbs reach; it cannot write to the repository it is pointed at. Authoring and maintenance are in @sdd-method/sdd-cli.",
-  "license": "Apache-2.0",
+  "license": "UNLICENSED",
   "type": "module",
   "bin": {
     "sdd-verify": "dist/verify-bin.js"
@@ -23,8 +23,6 @@
   "files": [
     "dist",
     "scripts",
-    "README.md",
-    "LICENSE",
-    "NOTICE"
+    "README.md"
   ]
 }

package/scripts/validate-app-dependencies.sh

@@ -20,7 +20,7 @@
 #   3b. (platform) that contract_path resolves to a file under the platform root
 #
 # Outputs a dependency status table.
-# Used as the Stage 6 lock-in gate in the App Exploration Workflow.
+# Used as the Stage 6 agreement gate in the App Exploration Workflow.
 #
 # THE STABILITY VOCABULARY, AND WHY IT IS WHAT IT IS
 #   `required_stability` states the CONSUMING app's expectation of contract
@@ -157,8 +157,8 @@ APP_DEPS_FILE="$APP_ROOT/app-platform-dependencies.yaml"
 #
 #   This gate read only the forward file, so an entire equal-status source went
 #   ungated. Measured in one reverse estate: 15 evidence files declaring 65
-#   further dependencies, 38 of them `locked` — precisely the lock-in population
-#   a Stage 6 lock-in gate exists to check — none of which this gate could see.
+#   further dependencies, 38 of them `locked` — precisely the population
+#   a Stage 6 agreement gate exists to check — none of which this gate could see.
 #
 #   A source that the catalogue reads and the gate does not is a coverage gap by
 #   construction, so the gate now reads both.
@@ -637,7 +637,7 @@ main() {
     fi
 
     if [[ "$FAILURES" -gt 0 ]]; then
-        log_fail "$FAILURES dependency check(s) failed. Stage 6 lock-in gate NOT met."
+        log_fail "$FAILURES dependency check(s) failed. Stage 6 agreement gate NOT met."
         exit 1
     fi
 
@@ -656,7 +656,7 @@ main() {
     if [[ "$WARNINGS" -gt 0 ]]; then
         log_warn "All required checks passed with $WARNINGS warning(s)."
     else
-        log_pass "All dependency checks passed. Stage 6 lock-in gate met."
+        log_pass "All dependency checks passed. Stage 6 agreement gate met."
     fi
     exit 0
 }

package/scripts/validate-integration-docs.sh

@@ -341,7 +341,7 @@ check_grounding_doc() {
 
     local grounding="$REPO_ROOT/docs/design/integration/feature-grounding.md"
     if [[ ! -f "$grounding" ]]; then
-        log_warn "docs/design/integration/feature-grounding.md not found — create before lock-in"
+        log_warn "docs/design/integration/feature-grounding.md not found — create before agreement"
         return
     fi
 

package/LICENSE

@@ -1,201 +0,0 @@
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright [yyyy] [name of copyright owner]
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.

package/NOTICE

@@ -1,17 +0,0 @@
-sdd-cli
-Copyright 2026 Tom Foster
-
-This product includes software developed as part of the SDD method
-distribution.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.