@thedecipherist/mdd 1.6.12 → 1.6.13

package/commands/mdd-audit.md

@@ -158,6 +158,8 @@ Integration context:   .mdd/jobs/audit-<date>/integration-context.md
 - "Immutable" rule arrays exported as plain mutable arrays — not `Object.freeze()` + `readonly`
 - Untrusted MCP/API/CLI input used without validation or sanitization
 - Data cached or stored without masking applied first
+- Local reimplementation of security logic — any function named `isConfined`, `isAllowed`, `isSafe`, `isBlocked`, or similar that replicates what a documented security module already provides. Require replacement with the canonical security module function.
+- Contract function undefined — if `integration_contracts` specifies a function name, grep the entire package for that name as an export. If the function does not exist anywhere, flag P1 regardless of whether call sites are present.
 
 **Note:** `satisfies_contracts status: pending` is checked by main in Phase A1, not here — agents cannot read feature docs.
 
@@ -168,7 +170,9 @@ Integration context:   .mdd/jobs/audit-<date>/integration-context.md
 - File exceeds 300 lines
 - Function exceeds 50 lines
 - Transformation/substitution function handles some but not all AST/domain types (silent fallthrough for unhandled types)
+- Switch on a string-union type or operation enum with no `default:` case, or where `default:` returns a value rather than throwing. Check all `switch` statements in execution, adapter, and transformation code. Approved pattern: `default: throw new Error(\`unhandled type: \${x satisfies never}\`)` — the `satisfies never` check produces a compile error when a new variant is added without updating the switch.
 - MCP-exposed function accepts untrusted params with no explicit validation
+- Security parameter never passed — if a function accepts a policy param (allowedKeys, blockedDomains, securityConfig, etc.) that must come from a caller, verify the caller passes a non-empty, non-null value. If the parameter always arrives as `undefined`, `null`, or `[]`, the enforcement is a no-op.
 
 ### P3 Medium
 - TypeScript strict mode not enabled in tsconfig
@@ -176,6 +180,8 @@ Integration context:   .mdd/jobs/audit-<date>/integration-context.md
 - Missing test cases for documented business rules
 - CLI command missing any of the universal flags (--env, --cwd, --verbose, --strict, --silent) — check all commands against the CLI feature doc's universal flags requirement
 - `file.*` filesystem helpers or path-resolving functions accept arbitrary paths without confinement to a documented jailRoot
+- Code that constructs a `SecurityConfig` or equivalent security object sets `jailRoot: null`. A null jailRoot disables filesystem confinement — the default should be the document's directory (`dirname(resolvedPath)`), not `null`, unless the caller explicitly provides an override.
+- `String.replace()` uses a captured group reference (`$1`, `$2`, etc.) in the replacement argument where the captured value originates from untrusted input. Values containing `$1`, `$&`, `$'`, etc. are silently mangled by JavaScript's substitution semantics. Sanitize with `.replace(/\$/g, '$$$$')` before interpolating into a replacement string.
 - Silent error swallow: catch block returns empty/undefined without pushing to warnings array
 - Template/substitution function matches `{{varname}}` without spaces but not `{{ varname }}` with spaces — spec uses spaced form; use regex `\s*` not exact string
 

package/commands/mdd-build.md

@@ -262,11 +262,14 @@ satisfies_contracts:
   - from: <dependency-feature-id>
     function: <function-name>(<args>)
     when: <condition — e.g. "before any file read in executeInclude">
-    status: pending  ← change to "verified: <file>:<line>" during Phase 6
+    status: pending      # change to done during Phase 6
+    verified_at: ""      # set to "path/to/file.ts:lineN" when status is done
 ```
 
 **Leaving `satisfies_contracts` empty when a dependency has mandatory `integration_contracts` is a build error.** Do not proceed past Phase 3a until all applicable contracts are acknowledged.
 
+**Before marking any `satisfies_contracts` entry `status: done`:** run `grep -rn '<function-name>'` across the entire package. Every call site must invoke the contract function — not just the one currently in focus. If the function is only wired in one layer (e.g. dispatcher) but not another (e.g. executor), the contract is not satisfied. Set `verified_at` to the confirmed call site before updating status.
+
 **Cross-cutting concerns that always require contract resolution:**
 - Any dependency tagged with `security`, `auth`, `masking`, `filesystem`, `audit`, `immutable` — its contracts are always mandatory
 - Any dependency that provides a "check before X" or "enforce Y" function — that function must be in your `satisfies_contracts`
@@ -339,6 +342,8 @@ describe('<Feature Name>', () => {
 - If BOTH unit AND E2E tests are needed → launch 2 parallel `general-purpose` agents. Each receives: the full MDD doc content, the skeleton template above, project testing conventions, and the exact output file path. Agent A writes `tests/unit/<feature-name>.test.ts`, Agent B writes `tests/e2e/<feature-name>.spec.ts`. These are different files — no write conflict is possible.
 - If only unit tests needed → generate directly in the main conversation (no agent overhead for a single file).
 
+**CLI feature additional check:** If the feature adds or modifies CLI commands, add a skeleton that invokes each new command with `--help` and asserts all five universal flags (`--env`, `--cwd`, `--verbose`, `--strict`, `--silent`) appear in the output. This catches missing `universalOptions()` wiring before implementation begins.
+
 **E2E skeleton template (if applicable):**
 ```typescript
 import { test, expect } from '@playwright/test';
@@ -530,6 +535,8 @@ Execute blocks in dependency layer order (Layer 1 → 2 → 3 → 4). Within the
 
 **For sequential blocks:** read the MDD doc, read the relevant test skeletons, implement, run the Green Gate loop below.
 
+**Directive/constant change ripple rule:** If this block changes any directive syntax, canonical header string, config key, or other string constant that other parts of the codebase may consume (e.g. language grammars, test fixtures, snippets, detection code), run `grep -rn 'old_string'` across the entire repo before marking the block complete. Update every consumer found — tmLanguage files, E2E fixtures, snippets, and any hardcoded string comparisons — in the same block, not as a follow-up.
+
 #### Step 6b — Green Gate loop (per block)
 
 After each block's implementation (sequential or parallel), run the Green Gate:
@@ -678,7 +685,8 @@ where the agent patches the wrong thing because it accepted an external excuse t
 
 1. **Contract verification gate** — before marking complete, check the feature doc's `satisfies_contracts`:
    - Any entry still `status: pending` means the integration was never wired
-   - For each pending entry: locate the call site in the implementation, verify it exists, update to `verified: <file>:<line>`
+   - For each entry: run `grep -rn '<function-name>'` across the entire package. Every call site must invoke the contract function — not just the one originally in scope. If a layer (e.g. executor vs dispatcher) is missing the call, the contract is not satisfied.
+   - Update each confirmed entry to `status: done` and `verified_at: "path/to/file.ts:lineN"` pointing to the confirmed call site.
    - If the call site is missing: implement it now (do not mark complete without it)
    - **A feature with any `pending` contract cannot be marked `status: complete`**
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thedecipherist/mdd",
-  "version": "1.6.12",
+  "version": "1.6.13",
   "description": "MDD — Manual-Driven Development workflow for Claude Code",
   "type": "module",
   "bin": {