@sdd-method/verify-cli 1.5.0 → 2.1.0

package/dist/lib/behaviour-store/archive.js

@@ -0,0 +1,180 @@
+// What the catalogue and the behaviour-store checks both read from a store's archive: the order its changes
+// were archived in, and the requirements each delta names. Pure reads, no catalogue or validator types, so the
+// verify-only CLI can carry it.
+//
+// Archive order is the archive date, then the order in which the SDD's history first added each archive
+// directory, then the name. The date prefix alone ties for changes archived the same day, and their names say
+// nothing about which came first; an untracked archive is newer than every tracked one. Same-day archives the
+// history cannot order are returned as ties, for the caller to report.
+import { execFile as execFileCb } from "node:child_process";
+import { promisify } from "node:util";
+const execFile = promisify(execFileCb);
+/** Requirement names and scenario counts under each `## <OP> Requirements` section (or the whole file for a living spec). */
+export function parseRequirements(text) {
+    const out = [];
+    let op = null;
+    let current = null;
+    for (const line of text.split("\n")) {
+        const section = /^##\s+(ADDED|MODIFIED|REMOVED|RENAMED)\s+Requirements\b/.exec(line);
+        if (section) {
+            op = section[1];
+            current = null;
+            continue;
+        }
+        if (/^##\s/.test(line) && !/^###/.test(line)) {
+            current = null;
+            continue;
+        }
+        // RENAMED: "- FROM: `### Requirement: Old name`" then "- TO: `### Requirement: New name`"
+        const renamedFrom = /^\s*-\s*FROM:\s*`?###\s+Requirement:\s*(.+?)`?\s*$/.exec(line);
+        if (op === "RENAMED" && renamedFrom) {
+            current = null;
+            continue;
+        }
+        const renamedTo = /^\s*-\s*TO:\s*`?###\s+Requirement:\s*(.+?)`?\s*$/.exec(line);
+        if (op === "RENAMED" && renamedTo) {
+            current = { name: renamedTo[1].trim(), operation: op, scenarios: 0 };
+            out.push(current);
+            continue;
+        }
+        const req = /^###\s+Requirement:\s*(.+?)\s*$/.exec(line);
+        if (req) {
+            current = { name: req[1], operation: op, scenarios: 0 };
+            out.push(current);
+            continue;
+        }
+        if (current && /^####\s+Scenario:/.test(line))
+            current.scenarios++;
+    }
+    return out;
+}
+/** The names a RENAMED section renames FROM (the requirement a rename removes). */
+export function renamedFrom(text) {
+    const out = [];
+    let op = null;
+    for (const line of text.split("\n")) {
+        const section = /^##\s+(ADDED|MODIFIED|REMOVED|RENAMED)\s+Requirements\b/.exec(line);
+        if (section) {
+            op = section[1];
+            continue;
+        }
+        const m = /^\s*-\s*FROM:\s*`?###\s+Requirement:\s*(.+?)`?\s*$/.exec(line);
+        if (op === "RENAMED" && m)
+            out.push(m[1].trim());
+    }
+    return out;
+}
+/** Each archive directory's position in the SDD's history: the index of the first commit that added a file under it. */
+async function archiveHistory(sddPath, archiveRel) {
+    let stdout;
+    try {
+        ({ stdout } = await execFile("git", ["-C", sddPath, "log", "--relative", "--reverse", "--diff-filter=A", "--format=@%H", "--name-only", "--", archiveRel], { maxBuffer: 64 * 1024 * 1024 }));
+    }
+    catch {
+        return null;
+    }
+    const order = new Map();
+    let commit = -1;
+    for (const line of stdout.split("\n")) {
+        if (line.startsWith("@")) {
+            commit++;
+            continue;
+        }
+        if (!line.startsWith(`${archiveRel}/`))
+            continue;
+        const dir = line.slice(archiveRel.length + 1).split("/")[0];
+        if (!order.has(dir))
+            order.set(dir, commit);
+    }
+    return order;
+}
+/** Archive directories in archive order, and the adjacent same-day pairs the history could not order. */
+export async function orderArchives(sddPath, archiveRel, names) {
+    const history = await archiveHistory(sddPath, archiveRel);
+    const date = (d) => /^(\d{4}-\d{2}-\d{2})-/.exec(d)?.[1] ?? "";
+    const position = (d) => history?.get(d) ?? Number.POSITIVE_INFINITY;
+    const order = [...names].sort((a, b) => date(a).localeCompare(date(b)) || position(a) - position(b) || a.localeCompare(b));
+    const ties = [];
+    for (let i = 1; i < order.length; i++) {
+        const [a, b] = [order[i - 1], order[i]];
+        if (date(a) === date(b) && position(a) === position(b))
+            ties.push([a, b]);
+    }
+    return { order, ties };
+}
+/** The repositories a baseline was observed in: its evidence file's `**Observed in:** repo[@sha], repo[@sha]` line. */
+export function observedIn(evidence) {
+    const m = /^\s*\*\*Observed in:\*\*\s*(.+)$/m.exec(evidence);
+    if (!m)
+        return [];
+    return m[1]
+        .split(",")
+        .map((s) => s.trim().split(/\s*@\s*/)[0].replace(/`/g, "").trim())
+        .filter((s) => s !== "");
+}
+/**
+ * A baseline's `**Surfaces:**` list (M-ADR 0222 §4.3, §4.4; agreement-record-schema.yaml, Baselines): one entry per
+ * contract the observed repositories serve, either
+ *   - <contract>: covered at transport[; <note>]
+ *   - <contract>: excluded, <reason>[; <note>]
+ * A note carries detail inside the contract, such as an operation left out and why. The last standalone
+ * `**Surfaces:**` line is read, so an earlier prose section under the same label does not shadow the list.
+ * Covered needs evidence that exercises the surface as the service exposes it; evidence below the transport is
+ * not coverage, so `covered at handler` is a problem, not an entry. A wildcard may only exclude.
+ */
+export function parseSurfaces(evidence) {
+    const lines = evidence.split("\n");
+    // The LAST standalone line: an evidence file may carry an earlier prose section under the same label, and
+    // the list is what the file ends up asserting.
+    let at = -1;
+    lines.forEach((l, i) => {
+        if (/^\s*\*\*Surfaces:\*\*\s*$/.test(l))
+            at = i;
+    });
+    if (at < 0)
+        return { present: false, entries: [], problems: [] };
+    const entries = [];
+    const problems = [];
+    for (const line of lines.slice(at + 1)) {
+        if (line.trim() === "" && entries.length + problems.length === 0)
+            continue;
+        const item = /^\s*-\s+(.+?)\s*$/.exec(line);
+        if (!item)
+            break;
+        const m = /^`?([^`]+?)`?\s*:\s*(.+)$/.exec(item[1]);
+        if (!m) {
+            problems.push(`"${item[1]}" is not "<contract>: covered at transport" or "<contract>: excluded, <reason>"`);
+            continue;
+        }
+        const contract = m[1].trim();
+        const status = m[2].split(";")[0].trim();
+        const excluded = /^excluded\s*,\s*(.+)$/i.exec(status);
+        if (/^covered at transport$/i.test(status)) {
+            if (contract.includes("*"))
+                problems.push(`"${contract}": a wildcard may only exclude; list each covered contract`);
+            else
+                entries.push({ contract, covered: true, reason: "" });
+        }
+        else if (excluded) {
+            entries.push({ contract, covered: false, reason: excluded[1].trim() });
+        }
+        else if (/^covered\b/i.test(status)) {
+            problems.push(`"${contract}: ${status}": covered needs evidence at the transport; evidence below it (a handler called directly, a hand-built request) is an exclusion: "excluded, handler-only evidence"`);
+        }
+        else {
+            problems.push(`"${contract}: ${status}" is neither "covered at transport" nor "excluded, <reason>"`);
+        }
+    }
+    if (entries.length + problems.length === 0)
+        problems.push("the **Surfaces:** line lists no contract");
+    return { present: true, entries, problems };
+}
+/** Whether a Surfaces entry names a catalogue contract: its id, or a path suffix of its spec_path on a segment boundary. */
+export function surfaceMatches(entry, contractId, specPath) {
+    const e = entry.replace(/^\.\//, "");
+    if (e === contractId)
+        return true;
+    const re = new RegExp(`(^|/)${e.split("*").map((p) => p.replace(/[.+?^${}()|[\]\\]/g, "\\$&")).join("[^/]*")}$`);
+    return re.test(specPath.split("\\").join("/"));
+}
+//# sourceMappingURL=archive.js.map

package/dist/lib/catalogue/canonical-schema.yaml

@@ -7,7 +7,7 @@
 # Emitted by sdd-cli's YAML emitter with no line folding; the three header scalars are quoted for the
 # textual readers downstream. The one deliberate difference from the authored form is schema_status:
 # the authored form says canonical; a projection never does.
-schema_version: "3.20.0"
+schema_version: "4.0.0"
 schema_owner: "sdd-method"
 schema_status: "generated"
 enums:
@@ -389,7 +389,7 @@ enums:
     description: M-ADR 0159 entity persistence kind. Bound at 3.13.0 from the column descriptions; measured against both reference estates before binding (M-ADR 0205 §4.4).
   required_stability:
     values:
-    - value: locked
+    - value: stable
     - value: provisional
     - value: unknown
     description: "M-ADR 0204: the stability a consumer requires of a target; external | legacy live in target_locus, not here. Bound at 3.13.0 from the column descriptions; measured against both reference estates before binding (M-ADR 0205 §4.4)."
@@ -613,6 +613,35 @@ enums:
     - value: generated-from
       description: Its content was produced from the other repository's templates.
     description: How one repository depends on another's code (M-ADR 0217 §4.1).
+  requirement_stage:
+    values:
+    - value: living
+      description: "In the living spec: shipped behaviour."
+    - value: agreed
+      description: Added by an open change whose agreement record is agreed; not yet shipped.
+    description: Where a catalogued requirement stands (M-ADR 0221 §4.4).
+  requirement_change_kind:
+    values:
+    - value: baseline
+      description: Recorded existing behaviour through the baseline gate.
+    - value: change
+      description: A delta agreed, built and judged through the change gate.
+    description: What kind of archived change a lineage row names (M-ADR 0222 §4.3).
+  requirement_operation:
+    values:
+    - value: ADDED
+    - value: MODIFIED
+    - value: RENAMED
+    description: How a change's delta treated a requirement that is current now (a removed requirement has no row).
+  requirement_status_value:
+    values:
+    - value: agreed
+      description: In an agreed, open change.
+    - value: declared-shipped
+      description: Its change archived on a passing judge, with this repository's task group complete.
+    - value: observed
+      description: Independent evidence from this repository's code matches (a baseline's characterization tests or a reverse snapshot).
+    description: A requirement's status in one implementing repository (M-ADR 0221 §4.5).
 catalogues:
   domains:
     primary_key: id
@@ -1276,7 +1305,7 @@ catalogues:
     - name: contract_provenance
       type: string
       nullable: true
-      description: "How this capability's declared contract SET was produced, from `traceability.contracts.provenance`. hand-authored | reverse-extracted | generated — the vocabulary the method already ships for `authoring-mode`, reused deliberately so provenance has one vocabulary and not two. Empty means undeclared, and undeclared reads as `hand-authored` by convention. Added at 3.5.0. ⚠ STRICTLY ORTHOGONAL to the contract-set maturity ladder (`traceability.contracts.status`: planned | provisional | partial | complete | locked | none): provenance never constrains status and status never constrains provenance, and `reverse-extracted` + `complete` is the legitimate pair that motivated the field. Evidence: 2 reverse-estate manifests had written `reverse-extracted` INTO contracts.status, where it is invalid, because a complete reverse-derived contract surface had no way to say both true things at once and the author picked the provenance one. A rule here that constrained maturity would re-create exactly that defect. ⚠ Note the asymmetry this column exposes and does not fix: the maturity ladder it is orthogonal to has NO catalogue column at all — `traceability.contracts.status` is validator-enforced but uncatalogued, so it is queryable by no consumer. That is the authored-but-uncatalogued class (a block with no column has no automated reader, so nothing can notice when it is absent or wrong); this column is given one precisely so the provenance half does not join it. Giving the ladder a column is a candidate follow-on, not done here."
+      description: "How this capability's declared contract SET was produced, from `traceability.contracts.provenance`. hand-authored | reverse-extracted | generated — the vocabulary the method already ships for `authoring-mode`, reused deliberately so provenance has one vocabulary and not two. Empty means undeclared, and undeclared reads as `hand-authored` by convention. Added at 3.5.0. ⚠ STRICTLY ORTHOGONAL to the contract-set maturity ladder (`traceability.contracts.status`: planned | provisional | partial | complete | stable | none): provenance never constrains status and status never constrains provenance, and `reverse-extracted` + `complete` is the legitimate pair that motivated the field. Evidence: 2 reverse-estate manifests had written `reverse-extracted` INTO contracts.status, where it is invalid, because a complete reverse-derived contract surface had no way to say both true things at once and the author picked the provenance one. A rule here that constrained maturity would re-create exactly that defect. ⚠ Note the asymmetry this column exposes and does not fix: the maturity ladder it is orthogonal to has NO catalogue column at all — `traceability.contracts.status` is validator-enforced but uncatalogued, so it is queryable by no consumer. That is the authored-but-uncatalogued class (a block with no column has no automated reader, so nothing can notice when it is absent or wrong); this column is given one precisely so the provenance half does not join it. Giving the ladder a column is a candidate follow-on, not done here."
     - name: source
       type: string
       nullable: false
@@ -1523,7 +1552,7 @@ catalogues:
     - name: kind
       type: string
       nullable: false
-      description: rest | graphql | rpc | event | authz. rpc covers Proto/gRPC; event covers Avro schemas; authz covers authorization/policy schemas (SpiceDB .zed and equivalents), added because an adopter contract lock-in gate certified .zed schemas as contracts while no kind could represent them.
+      description: rest | graphql | rpc | event | authz. rpc covers Proto/gRPC; event covers Avro schemas; authz covers authorization/policy schemas (SpiceDB .zed and equivalents), added because an adopter contract agreement gate certified .zed schemas as contracts while no kind could represent them.
     - name: version
       type: string
       nullable: true
@@ -1888,7 +1917,7 @@ catalogues:
     - name: version
       type: string
       nullable: true
-      description: Optional explicit version; null until the domain model is formally versioned (typically at first contract lock-in).
+      description: Optional explicit version; null until the domain model is formally versioned (typically when a contract is first pinned).
     - name: evidence_class
       type: string
       nullable: true
@@ -2142,7 +2171,7 @@ catalogues:
     - name: required_stability
       type: string
       nullable: true
-      description: "provisional | locked | unknown. The consuming SDD's expectation of contract stability, carried verbatim from app-platform-dependencies.yaml. Not a bound enum: an out-of-vocabulary value is carried, not rejected, and is reported by validate-app-dependencies.sh."
+      description: "provisional | stable | unknown. The consuming SDD's expectation of contract stability, carried verbatim from app-platform-dependencies.yaml. Not a bound enum: an out-of-vocabulary value is carried, not rejected, and is reported by validate-app-dependencies.sh."
     description: "Edge: product depends on / consumes service. Forward sources from app-platform-dependencies.yaml. service_id is external because the consuming product (an application-product SDD) references a service owned by the platform SDD."
     foreign_keys:
     - column: product_id
@@ -2930,7 +2959,7 @@ catalogues:
     - name: required_stability
       type: string
       nullable: true
-      description: "provisional | locked | unknown. Optional; the consuming SDD's expectation of contract stability — and only that: where the target lives and what lifecycle its implementation is in are separate concerns that do not belong in this field. Not a bound enum: an out-of-vocabulary value is carried, not rejected, and is reported by validate-app-dependencies.sh."
+      description: "provisional | stable | unknown. Optional; the consuming SDD's expectation of contract stability — and only that: where the target lives and what lifecycle its implementation is in are separate concerns that do not belong in this field. Not a bound enum: an out-of-vocabulary value is carried, not rejected, and is reported by validate-app-dependencies.sh."
     - name: contract_path
       type: string
       nullable: true
@@ -4115,3 +4144,127 @@ catalogues:
       external: true
     column_enums:
       kind: enums.repo_dependency_kind
+  requirements:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+      description: <feature_id>::<requirement name>. The name is unique within its spec and stable across changes (M-ADR 0221 §4.7).
+    - name: feature_id
+      type: string
+      nullable: false
+      description: "The catalogue feature whose living spec holds the requirement: the spec's directory name under openspec/specs/."
+    - name: name
+      type: string
+      nullable: false
+      description: The requirement's name as the spec heads it; automated tests carry it.
+    - name: stage
+      type: string
+      nullable: false
+      description: "Bound to requirement_stage: living (in the living spec) or agreed (added by an open change whose agreement record is agreed)."
+    - name: spec_path
+      type: string
+      nullable: false
+      description: "The file that holds the requirement: the living spec, or the open change's delta."
+    - name: scenario_count
+      type: integer
+      nullable: false
+      description: Scenarios under the requirement in that file.
+    - name: source_sdd_id
+      type: string
+      nullable: true
+      description: Originating SDD (stamped at aggregation; empty in a per-SDD build).
+    - name: platform_sdd_id
+      type: string
+      nullable: true
+      description: The platform SDD the row belongs to (stamped at aggregation).
+    description: "A requirement in the SDD's behaviour store (M-ADR 0221): one row per requirement of a living spec, keyed by the catalogue feature the spec describes, and per requirement an open agreed change adds. Projected from openspec/ at the SDD's commit; never authored here."
+    foreign_keys:
+    - column: feature_id
+      references: features.id
+      nullable: false
+    column_enums:
+      stage: enums.requirement_stage
+  requirement_lineage:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+      description: <requirement_id>__<change_id>.
+    - name: requirement_id
+      type: string
+      nullable: false
+    - name: change_id
+      type: string
+      nullable: false
+      description: The archived change's directory name (its archive date prefix included).
+    - name: change_kind
+      type: string
+      nullable: false
+      description: "Bound to requirement_change_kind: baseline or change."
+    - name: operation
+      type: string
+      nullable: false
+      description: "Bound to requirement_operation: how the change's delta treated the requirement."
+    - name: archived_on
+      type: string
+      nullable: false
+      description: The archive date (YYYY-MM-DD) from the change's directory name.
+    - name: source_sdd_id
+      type: string
+      nullable: true
+      description: Originating SDD (stamped at aggregation; empty in a per-SDD build).
+    - name: platform_sdd_id
+      type: string
+      nullable: true
+      description: The platform SDD the row belongs to (stamped at aggregation).
+    description: "Annotation: an archived change that made a current requirement what it is (M-ADR 0221 §4.6), in archive order. A baseline change (one carrying baseline-evidence.md) records existing behaviour; any other change carries a verdict."
+    foreign_keys:
+    - column: requirement_id
+      references: requirements.id
+      nullable: false
+    column_enums:
+      change_kind: enums.requirement_change_kind
+      operation: enums.requirement_operation
+  requirement_status:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+      description: <requirement_id>__<repo_id>.
+    - name: requirement_id
+      type: string
+      nullable: false
+    - name: repo_id
+      type: string
+      nullable: false
+      description: "The implementing repository: a work order's repository, or a repository a baseline was observed in."
+    - name: status
+      type: string
+      nullable: false
+      description: Bound to requirement_status_value.
+    - name: basis
+      type: string
+      nullable: false
+      description: "The change that produced the status: the open change's or the archived change's directory name."
+    - name: source_sdd_id
+      type: string
+      nullable: true
+      description: Originating SDD (stamped at aggregation; empty in a per-SDD build).
+    - name: platform_sdd_id
+      type: string
+      nullable: true
+      description: The platform SDD the row belongs to (stamped at aggregation).
+    description: "Edge: a requirement's status in a repository that implements it (M-ADR 0221 §4.5; M-ADR 0223 §4.7). Derived, never authored: agreed from an open agreed change's work orders, declared-shipped from an archived change's PASS verdict and its work orders, observed from a baseline's evidence. The latest event in archive order wins."
+    foreign_keys:
+    - column: requirement_id
+      references: requirements.id
+      nullable: false
+    - column: repo_id
+      references: repositories.id
+      nullable: false
+    column_enums:
+      status: enums.requirement_status_value

package/dist/lib/catalogue/rubric-coverage-map.yaml

@@ -869,3 +869,39 @@ coverage:
     kind: enum
     scoring: not-applicable
     reason: closed vocabulary, not an artefact
+  requirements:
+    kind: entity
+    scoring: not-applicable
+    reason: projected from the behaviour store, whose baseline and change gates hold its quality (M-ADR 0222)
+    relationships:
+      feature_id:
+        class: membership
+        impact_flow: toward-target
+  requirement_lineage:
+    kind: annotation
+    scoring: derived-edge
+    class: lineage
+    impact_flow: none
+    reason: derived from the archived changes scored by their own judge
+  requirement_status:
+    kind: edge
+    scoring: derived-edge
+    class: realisation
+    impact_flow: both
+    reason: derived from agreement records, verdicts and baseline evidence
+  requirement_stage:
+    kind: enum
+    scoring: not-applicable
+    reason: closed vocabulary, not an artefact
+  requirement_change_kind:
+    kind: enum
+    scoring: not-applicable
+    reason: closed vocabulary, not an artefact
+  requirement_operation:
+    kind: enum
+    scoring: not-applicable
+    reason: closed vocabulary, not an artefact
+  requirement_status_value:
+    kind: enum
+    scoring: not-applicable
+    reason: closed vocabulary, not an artefact

package/dist/lib/catalogue/schema-compat.js

@@ -27,7 +27,7 @@
  * ADR 0134 §4.6 (canonical builder + aggregator).
  */
 export const SCHEMA_COMPAT = {
-    catalogue_schema: "^3.0.0",
+    catalogue_schema: "^4.0.0",
     sdd_manifest: "^1.0.0",
     aggregation_manifest: "^1.0.0",
 };

package/dist/lib/validate/behaviour-store.js

@@ -14,6 +14,16 @@
 //                 With no such targets the check is vacuous, and says so.
 //   4. verdicts: every archived change except a baseline has a verdict.md and a record whose
 //                 verdict is PASS and names it (M-ADR 0223 §4.6).
+//   5. surfaces: every archived baseline's evidence lists, under **Surfaces:**, each contract the
+//                 repositories it was observed in serve, as covered at transport or excluded with a
+//                 reason, and the list is checked against the catalogue (catalogues/repo_contract.csv),
+//                 never against itself (M-ADR 0222 §4.3, §4.4). A list the catalogue gives nothing to
+//                 check against (no Observed in line, or a repository with no catalogue contracts) fails:
+//                 a cross-check of zero contracts is unresolved, not a pass.
+//   6. scope:    a baseline ADDS requirements; it REMOVES, MODIFIES or RENAMES only a requirement whose
+//                 latest archived change was a baseline, which is how a corrective baseline withdraws
+//                 what a baseline admitted wrongly. A requirement a judged change shipped is changed only
+//                 by a change (M-ADR 0222 §4.4). Read in archive order.
 //
 // A sibling-repository store (M-ADR 0221 §4.2) is checked in that repository, not here.
 //
@@ -25,6 +35,8 @@ import { access, readdir, readFile } from "node:fs/promises";
 import { basename, join } from "node:path";
 import { promisify } from "node:util";
 import { parseDocument } from "yaml";
+import { observedIn, orderArchives, parseRequirements, parseSurfaces, renamedFrom, surfaceMatches } from "../behaviour-store/archive.js";
+import { parseCatalogueCsv } from "../catalogue/csv-reader.js";
 const execFileAsync = promisify(execFile);
 /** The OpenSpec release the method depends on (M-ADR 0223 ruling 2). The module installs exactly this. */
 export const OPENSPEC_VERSION = "1.14.3";
@@ -271,6 +283,77 @@ export async function checkBehaviourStore(repo) {
             failures.push(`${record.file}: verdict.record ${JSON.stringify(vr)} does not name an existing file`);
     }
     lines.push(`verdicts: ${archived.length} archived change(s), ${baselines} baseline(s), ${archived.length - baselines} needing a PASS verdict`);
+    // 5. surfaces, and 6. what each baseline may change, in archive order
+    const archiveRel = `${STORE_DIR}/changes/archive`;
+    const { order, ties } = await orderArchives(repo, archiveRel, archived);
+    const servedBy = baselines > 0 ? await catalogueContracts(repo) : null;
+    let surfacesChecked = 0;
+    const lastTouch = new Map();
+    let scopeChecked = 0;
+    for (const name of order) {
+        const dir = `${archiveRel}/${name}`;
+        const evidence = await readText(join(repo, dir, "baseline-evidence.md"));
+        const isBaseline = evidence !== null;
+        if (isBaseline) {
+            const parsed = parseSurfaces(evidence);
+            if (!parsed.present)
+                failures.push(`${dir}/baseline-evidence.md: no **Surfaces:** list; name every contract the observed repositories serve, covered at transport or excluded with a reason`);
+            for (const p of parsed.problems)
+                failures.push(`${dir}/baseline-evidence.md: Surfaces: ${p}`);
+            if (parsed.present) {
+                if (servedBy === null) {
+                    failures.push(`${dir}/baseline-evidence.md: Surfaces cannot be cross-checked: catalogues/repo_contract.csv or catalogues/contracts.csv is missing; build the catalogue`);
+                }
+                else {
+                    const repos = observedIn(evidence);
+                    if (repos.length === 0)
+                        failures.push(`${dir}/baseline-evidence.md: Surfaces cannot be cross-checked: no **Observed in:** line names a repository`);
+                    for (const r of repos) {
+                        if ((servedBy.get(r) ?? []).length === 0) {
+                            failures.push(`${dir}/baseline-evidence.md: Surfaces cannot be cross-checked: catalogues/repo_contract.csv records no contract for ${r}; declare the contracts it serves in its repo-config`);
+                        }
+                        for (const c of servedBy.get(r) ?? []) {
+                            surfacesChecked++;
+                            if (!parsed.entries.some((e) => surfaceMatches(e.contract, c.id, c.specPath))) {
+                                failures.push(`${dir}/baseline-evidence.md: Surfaces does not list ${c.specPath || c.id} (${c.id}), which ${r} serves (catalogues/repo_contract.csv); list it as covered at transport or excluded with a reason`);
+                            }
+                        }
+                    }
+                }
+            }
+        }
+        for (const feature of await dirs(join(repo, dir, "specs"))) {
+            const text = (await readText(join(repo, dir, "specs", feature, "spec.md"))) ?? "";
+            const targets = [
+                ...parseRequirements(text).filter((r) => r.operation === "MODIFIED" || r.operation === "REMOVED").map((r) => r.name),
+                ...renamedFrom(text),
+            ];
+            for (const t of targets) {
+                const key = `${feature}::${t}`;
+                if (isBaseline) {
+                    scopeChecked++;
+                    const last = lastTouch.get(key);
+                    if (last !== "baseline") {
+                        failures.push(`${dir}: a baseline changes "${t}" (${feature}), which ${last === "change" ? "a judged change last shipped" : "no earlier archived change admitted"}; a baseline may remove or modify only what a baseline admitted, and anything else takes a change (M-ADR 0222 §4.4)`);
+                    }
+                }
+            }
+            for (const r of parseRequirements(text)) {
+                const key = `${feature}::${r.name}`;
+                if (r.operation === "REMOVED")
+                    lastTouch.delete(key);
+                else if (r.operation)
+                    lastTouch.set(key, isBaseline ? "baseline" : "change");
+            }
+            for (const from of renamedFrom(text))
+                lastTouch.delete(`${feature}::${from}`);
+        }
+    }
+    const unseen = servedBy === null ? "" : `; repositories with no catalogue contracts: ${[...new Set(await observedInAll(repo, archiveRel, order))].filter((r) => (servedBy.get(r) ?? []).length === 0).join(", ") || "none"}`;
+    lines.push(baselines === 0 ? "surfaces: vacuous (no baseline)" : `surfaces: ${baselines} baseline(s), ${surfacesChecked} served contract(s) checked against catalogues/repo_contract.csv${unseen}`);
+    lines.push(scopeChecked === 0 ? "scope: vacuous (no baseline removes, modifies or renames a requirement)" : `scope: ${scopeChecked} requirement(s) a baseline removes, modifies or renames, checked against their lineage`);
+    for (const [a, b] of ties)
+        lines.push(`order: ${a} and ${b} were archived the same day and the history does not order them; ordered by name`);
     const population = recordFiles.length + open.length + archived.length;
     const body = lines.map((l) => `  ${l}`).join("\n") + "\n";
     if (failures.length > 0) {
@@ -278,7 +361,35 @@ export async function checkBehaviourStore(repo) {
     }
     if (population === 0)
         return { exitCode: 0, stdout: body + `[N/A] the behaviour store has no changes and no agreement records yet\n` };
-    return { exitCode: 0, stdout: body + "[PASS] behaviour store: records, agreement, stale and verdict checks hold\n" };
+    return { exitCode: 0, stdout: body + "[PASS] behaviour store: records, agreement, stale, verdict, surfaces and scope checks hold\n" };
+}
+/** Per repository, the contracts the catalogue says it serves (repo_contract ⋈ contracts.spec_path); null when either file is missing. */
+async function catalogueContracts(repo) {
+    const rc = await readText(join(repo, "catalogues", "repo_contract.csv"));
+    const cs = await readText(join(repo, "catalogues", "contracts.csv"));
+    if (rc === null || cs === null)
+        return null;
+    const spec = new Map(parseCatalogueCsv(cs).rows.map((r) => [r["id"] ?? "", r["spec_path"] ?? ""]));
+    const out = new Map();
+    for (const r of parseCatalogueCsv(rc).rows) {
+        const repoId = r["repo_id"] ?? "";
+        const id = r["contract_id"] ?? "";
+        if (repoId === "" || id === "")
+            continue;
+        const list = out.get(repoId) ?? [];
+        list.push({ id, specPath: spec.get(id) ?? "" });
+        out.set(repoId, list);
+    }
+    return out;
+}
+async function observedInAll(repo, archiveRel, names) {
+    const out = [];
+    for (const n of names) {
+        const ev = await readText(join(repo, archiveRel, n, "baseline-evidence.md"));
+        if (ev !== null)
+            out.push(...observedIn(ev));
+    }
+    return out;
 }
 async function runOpenspec(repo, args) {
     try {

package/dist/maintain-version.json

@@ -1,4 +1,4 @@
 {
-  "version": "0.5.0",
-  "built_against_sdd_cli": "1.46.0"
+  "version": "0.7.0",
+  "built_against_sdd_cli": "2.1.0"
 }

package/dist/verify-version.json

@@ -1,4 +1,4 @@
 {
-  "version": "1.5.0",
-  "built_against_sdd_cli": "1.46.0"
+  "version": "2.1.0",
+  "built_against_sdd_cli": "2.1.0"
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@sdd-method/verify-cli",
-  "version": "1.5.0",
-  "sddCliVersion": "1.46.0",
+  "version": "2.1.0",
+  "sddCliVersion": "2.1.0",
   "description": "Verify an SDD repository without changing it — validate, list, and read-only catalogue and pack checks. Ships only the code those verbs reach; it cannot write to the repository it is pointed at. Authoring and maintenance are in @sdd-method/sdd-cli.",
   "license": "UNLICENSED",
   "type": "module",

package/scripts/validate-app-dependencies.sh

@@ -11,23 +11,23 @@
 #
 # Checks (for each entry in app-platform-dependencies.yaml), split by whether they
 # need a platform surface at all — LOCAL checks run wherever the app repo is:
-#   1.  (local)    required_stability is a valid value (provisional | locked | unknown)
+#   1.  (local)    required_stability is a valid value (provisional | stable | unknown)
 #   2a. (local)    service_id is declared and non-empty
 #   2b. (platform) service_id resolves against the platform source of truth:
 #                  catalogues/services.csv (exact id match) when the catalogue exists,
 #                  else docs/platform/service-architecture.md (word-anchored match)
-#   3a. (local)    a `locked` dependency declares a contract_path at all
+#   3a. (local)    a `stable` dependency declares a contract_path at all
 #   3b. (platform) that contract_path resolves to a file under the platform root
 #
 # Outputs a dependency status table.
-# Used as the Stage 6 agreement gate in the App Exploration Workflow.
+# Used as the Stage 9 agreement gate in the App Exploration Workflow.
 #
 # THE STABILITY VOCABULARY, AND WHY IT IS WHAT IT IS
 #   `required_stability` states the CONSUMING app's expectation of contract
 #   stability. Three values express that:
 #
 #     provisional  the contract may still change; the app tolerates it
-#     locked       the contract is fixed; a contract_path must exist (check 3)
+#     stable       the contract is fixed; a contract_path must exist (check 3)
 #     unknown      the expectation is not determined
 #
 #   `unknown` is accepted because the canonical schema's
@@ -158,7 +158,7 @@ APP_DEPS_FILE="$APP_ROOT/app-platform-dependencies.yaml"
 #   This gate read only the forward file, so an entire equal-status source went
 #   ungated. Measured in one reverse estate: 15 evidence files declaring 65
 #   further dependencies, 38 of them `locked` — precisely the population
-#   a Stage 6 agreement gate exists to check — none of which this gate could see.
+#   a Stage 9 agreement gate exists to check — none of which this gate could see.
 #
 #   A source that the catalogue reads and the gate does not is a coverage gap by
 #   construction, so the gate now reads both.
@@ -180,7 +180,7 @@ PLATFORM_SERVICES_CSV="$PLATFORM_ROOT/catalogues/services.csv"
 # offer (instances app-dependency-stability-vocabulary-forward and -reverse).
 VALID_STABILITY_VALUES=(
     "provisional"  # contract may still change; the app tolerates it
-    "locked"       # contract is fixed; check 3 requires a resolvable contract_path
+    "stable"       # contract is fixed; check 3 requires a resolvable contract_path
     "unknown"      # expectation not determined; no contract_path required
 )
 
@@ -353,6 +353,13 @@ validate_dependency() {
     service_id="$(yq e ".platform_dependencies[$index].service_id // \"\"" "$source_file")"
     contract_type="$(yq e ".platform_dependencies[$index].contract_type // \"\"" "$source_file")"
     required_stability="$(yq e ".platform_dependencies[$index].required_stability // \"\"" "$source_file")"
+    # vocabulary-alias: locked -> stable
+    # The fixed-contract stability class was `locked` (M-ADR 0222 §4.1; docs/method/foundations/vocabulary-renames.yaml).
+    # Read as `stable` for one major release and reported; from sdd-cli 3.0.0 it is invalid.
+    if [[ "$required_stability" == "locked" ]]; then
+        log_warn "$source_file: platform_dependencies[$index] uses the former required_stability 'locked', read as 'stable' (M-ADR 0222 §4.1). Run 'sdd-cli migrate vocabulary'; from sdd-cli 3.0.0 the former value is invalid."
+        required_stability="stable"
+    fi
     contract_path="$(yq e ".platform_dependencies[$index].contract_path // \"\"" "$source_file")"
 
     local dep_label="${service_id:-dep[$index]}"
@@ -403,7 +410,7 @@ validate_dependency() {
         done
 
         if [[ "$stability_deprecated" -eq 1 ]]; then
-            log_fail "$dep_label: required_stability '$required_stability' is not a stability value (M-ADR 0204 §4.4). Declare target_locus: '$required_stability' on the entry and give required_stability a real value (${VALID_STABILITY_VALUES[*]}) — a third-party contract can be locked."
+            log_fail "$dep_label: required_stability '$required_stability' is not a stability value (M-ADR 0204 §4.4). Declare target_locus: '$required_stability' on the entry and give required_stability a real value (${VALID_STABILITY_VALUES[*]}) — a third-party contract can be stable."
             ((dep_errors++))
         else
             log_fail "$dep_label: invalid required_stability '$required_stability' (allowed: ${VALID_STABILITY_VALUES[*]})"
@@ -490,26 +497,26 @@ validate_dependency() {
         ((WARNINGS++))
     fi
 
-    # Check 3: a locked dependency declares a contract_path (3a, local) and that path
-    # resolves to a file (3b, needs the platform). Same split, same reason: "locked
+    # Check 3: a stable dependency declares a contract_path (3a, local) and that path
+    # resolves to a file (3b, needs the platform). Same split, same reason: "stable
     # with no path at all" is an app-repo defect that needs nothing external to catch.
-    if [[ "$required_stability" == "locked" ]]; then
+    if [[ "$required_stability" == "stable" ]]; then
         if [[ -z "$contract_path" || "$contract_path" == "null" ]]; then
-            log_fail "$dep_label: required_stability is 'locked' but contract_path is empty"
+            log_fail "$dep_label: required_stability is 'stable' but contract_path is empty"
             ((dep_errors++))
         elif [[ "$PLATFORM_AVAILABLE" -eq 0 ]]; then
             ((UNRESOLVED_CONTRACT_PATHS++))
         else
             local full_contract_path="$PLATFORM_ROOT/$contract_path"
             if [[ ! -f "$full_contract_path" ]]; then
-                log_fail "$dep_label: locked contract_path '$contract_path' does not exist in platform repo"
+                log_fail "$dep_label: stable contract_path '$contract_path' does not exist in platform repo"
                 ((dep_errors++))
             fi
         fi
     elif [[ "$required_stability" == "provisional" || "$required_stability" == "unknown" ]]; then
         # Neither requires a contract_path. If one is declared it is still worth
         # reporting when it does not resolve — silently accepting a path that
-        # points at nothing is how a locked dependency later inherits a dead path.
+        # points at nothing is how a stable dependency later inherits a dead path.
         if [[ -n "$contract_path" && "$contract_path" != "null" && "$PLATFORM_AVAILABLE" -eq 1 ]]; then
             local full_contract_path="$PLATFORM_ROOT/$contract_path"
             if [[ ! -f "$full_contract_path" ]]; then
@@ -552,21 +559,22 @@ print_status_table() {
         local service_id required_stability contract_type contract_path dep_status
         service_id="$(yq e ".platform_dependencies[$i].service_id // \"(missing)\"" "$source_file")"
         required_stability="$(yq e ".platform_dependencies[$i].required_stability // \"(missing)\"" "$source_file")"
+        if [[ "$required_stability" == "locked" ]]; then required_stability="stable"; fi   # the former name, reported above
         contract_type="$(yq e ".platform_dependencies[$i].contract_type // \"(missing)\"" "$source_file")"
         contract_path="$(yq e ".platform_dependencies[$i].contract_path // \"\"" "$source_file")"
 
         # Determine display status
-        if [[ "$required_stability" == "locked" ]]; then
+        if [[ "$required_stability" == "stable" ]]; then
             if [[ -z "$contract_path" || "$contract_path" == "null" ]]; then
-                dep_status="${RED}LOCKED UNMET${NC}"
+                dep_status="${RED}STABLE UNMET${NC}"
             elif [[ "$PLATFORM_AVAILABLE" -eq 0 ]]; then
                 # A declared path that was never resolved is not "OK" and not "UNMET".
                 # Reporting either would be a claim the run cannot support.
-                dep_status="${YELLOW}LOCKED UNRESOLVED${NC}"
+                dep_status="${YELLOW}STABLE UNRESOLVED${NC}"
             elif [[ -f "$PLATFORM_ROOT/$contract_path" ]]; then
-                dep_status="${GREEN}LOCKED OK${NC}"
+                dep_status="${GREEN}STABLE OK${NC}"
             else
-                dep_status="${RED}LOCKED UNMET${NC}"
+                dep_status="${RED}STABLE UNMET${NC}"
             fi
         elif [[ "$required_stability" == "provisional" ]]; then
             dep_status="${YELLOW}PROVISIONAL${NC}"
@@ -637,7 +645,7 @@ main() {
     fi
 
     if [[ "$FAILURES" -gt 0 ]]; then
-        log_fail "$FAILURES dependency check(s) failed. Stage 6 agreement gate NOT met."
+        log_fail "$FAILURES dependency check(s) failed. Stage 9 agreement gate NOT met."
         exit 1
     fi
 
@@ -648,7 +656,7 @@ main() {
     # while never executing (M-ADR 0200 §4.3).
     if [[ "$PLATFORM_AVAILABLE" -eq 0 ]]; then
         log_warn "Ran check 1 (stability vocabulary) and the local halves of checks 2-3 over $TOTAL_DEPS dependency(ies): $FAILURES failure(s), $WARNINGS warning(s)."
-        log_warn "NOT RUN, for want of --platform-root: $UNRESOLVED_SERVICE_IDS service_id resolution(s) and $UNRESOLVED_CONTRACT_PATHS locked contract_path resolution(s)."
+        log_warn "NOT RUN, for want of --platform-root: $UNRESOLVED_SERVICE_IDS service_id resolution(s) and $UNRESOLVED_CONTRACT_PATHS stable contract_path resolution(s)."
         log_info "This is a partial run, not a met gate — pass --platform-root to complete it."
         exit 0
     fi
@@ -656,7 +664,7 @@ main() {
     if [[ "$WARNINGS" -gt 0 ]]; then
         log_warn "All required checks passed with $WARNINGS warning(s)."
     else
-        log_pass "All dependency checks passed. Stage 6 agreement gate met."
+        log_pass "All dependency checks passed. Stage 9 agreement gate met."
     fi
     exit 0
 }