@unified-product-graph/core 0.9.12 → 0.9.13

package/CHANGELOG.md

@@ -7,6 +7,22 @@ This project uses [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ---
 
+## [0.9.13] - 2026-06-11
+
+**Foundations follow-ups: a registry-edge authoring path, specification stewardship, and three portfolio-scoped anti-patterns.** The deferred half of the foundations work (0.9.12) lands: canonical entities can now relate to one another in the registry, a specification can name its steward, and the registry surfaces the ways a foundations tier goes wrong across a portfolio.
+
+### Added
+- **`create_registry_edge`** (tools 119 to 120, local only): the authoring path for canonical-internal edges between registry entities, activating the reserved `registry.edges`. A registry `specification` can now be `governed_by` a registry `organization`, a `primitive` `defined_by` a `specification`, a `specification` extend another, all without touching a product graph. Validates that both endpoints exist in the registry, the type is a real catalogue edge, and the catalogue source and target types match the pair. Idempotent.
+- **`specification_governed_by_organization`** catalogue edge (edge count 979 to 980): a registry specification's stewardship, an organization as its governing body. Organizations are registry-hostable canonicals (`define_canonical_entity` already accepts the type), so the steward is a first-class entity, not a free-text field.
+- **Three portfolio-scoped anti-patterns** (`scope: 'portfolio'`, evaluated by `portfolio_validate`, surfaced in a new `portfolio_anti_patterns` block): `specification-without-implementer` (a registry specification no product, feature, or api_contract implements or conforms to), `primitive-scattered-without-canonical` (the same primitive title appears as a product-local node in two or more products with no registry canonical unifying them), and `product-reimplements-specification` (two or more products independently implement the same registry specification). These read the registry plus cross-product edges, context a single graph cannot express.
+
+### Changed
+- **`UPGCuratedAntiPattern` gains an optional `scope`** (`'graph'` default, or `'portfolio'`), and `structured_condition` is now optional. The single-graph evaluator skips portfolio-scoped patterns, so a portfolio pattern can never flip one product graph invalid; their detectors live in `portfolio_validate` instead. Anti-pattern count 15 to 18.
+
+No entity, domain, region, or playbook count change (entities 315, domains 37, regions 11, playbooks 13).
+
+---
+
 ## [0.9.12] - 2026-06-10
 
 **Foundations: a first-class `specification` and `primitive` entity, plus a technical-domain enum widening.** Two governance moats that product orgs usually mismodel as products or scatter across features now have a home, and four engineering enums that real authoring outgrew are widened.

package/dist/index.cjs

@@ -3137,7 +3137,9 @@ var UPG_EDGE_CATALOG = {
   specification_extends_specification: { forward_verb: "extends", reverse_verb: "extended_by", classification: "hierarchy", source_type: "specification", target_type: "specification" },
   specification_competes_with_specification: { forward_verb: "competes_with", reverse_verb: "competes_with", classification: "semantic", source_type: "specification", target_type: "specification" },
   primitive_defined_by_specification: { forward_verb: "defined_by", reverse_verb: "defines", classification: "semantic", source_type: "primitive", target_type: "specification" },
-  primitive_composes_primitive: { forward_verb: "composes", reverse_verb: "composed_by", classification: "hierarchy", source_type: "primitive", target_type: "primitive" }
+  primitive_composes_primitive: { forward_verb: "composes", reverse_verb: "composed_by", classification: "hierarchy", source_type: "primitive", target_type: "primitive" },
+  // Stewardship: a registry specification is governed by a (registry-hostable) organization (0.9.13).
+  specification_governed_by_organization: { forward_verb: "governed_by", reverse_verb: "governs", classification: "semantic", source_type: "specification", target_type: "organization" }
 };
 var UPG_POLYMORPHIC_EDGE_KEYS = [
   // Universal semantic verbs
@@ -24373,6 +24375,47 @@ var UPG_ANTI_PATTERNS = [
     stages: ["beta", "launch", "growth", "mature"],
     severity: "medium",
     source: { kind: "practitioner", attribution: "Marty Cagan, Inspired (product discovery)" }
+  },
+  // ── Foundations layer (0.9.13): portfolio-scoped, registry-aware ──────────
+  // These read the shared registry + cross-product edges, so they are evaluated
+  // by portfolio_validate, not the single-graph evaluator. They carry no
+  // structured_condition (the detector is cross-product, not a single-graph
+  // IntelligenceCondition).
+  {
+    id: "specification-without-implementer",
+    since: "0.9.13",
+    scope: "portfolio",
+    name: "Specification without implementer",
+    description: "A specification in the shared registry has no product, feature, or api_contract implementing or conforming to it anywhere in the portfolio. A specification nobody implements is a document, not a contract: it states an intent the portfolio never honours.",
+    why_it_matters: "An unimplemented specification carries authority it has not earned. Teams cite it as a standard while no surface actually conforms, so conformance claims cannot be trusted or traced.",
+    remediation: "Link at least one product, feature, or api_contract to the specification via `product_implements_specification`, `product_exposes_specification`, `feature_conforms_to_specification`, or `api_contract_speaks_specification`; or retire the specification from the registry.",
+    stages: ["validation", "build", "beta", "launch", "growth", "mature"],
+    severity: "medium",
+    source: { kind: "fundamental" }
+  },
+  {
+    id: "primitive-scattered-without-canonical",
+    since: "0.9.13",
+    scope: "portfolio",
+    name: "Primitive scattered without a canonical",
+    description: "The same primitive concept appears as a product-local node in two or more products, but no canonical primitive in the shared registry unifies them. Each product redefines the building block on its own terms, so the portfolio carries several drifting copies of one shared idea instead of a single authoritative definition.",
+    why_it_matters: "Scattered primitives drift apart in name, shape, and meaning. Cross-product reasoning breaks because the same concept reads as several unrelated entities, and a change to the shared building block has no single place to land.",
+    remediation: "Define the shared primitive once in the registry with `define_canonical_entity`, then link each product copy via `register_instance` so the building block has one authoritative definition.",
+    stages: ["build", "beta", "launch", "growth", "mature"],
+    severity: "medium",
+    source: { kind: "fundamental" }
+  },
+  {
+    id: "product-reimplements-specification",
+    since: "0.9.13",
+    scope: "portfolio",
+    name: "Specification reimplemented across products",
+    description: "Two or more products independently implement the same registry specification rather than one depending on a shared implementation. Parallel implementations of a single contract multiply the surface that must stay in sync and usually signal a missing shared library or service.",
+    why_it_matters: "Every independent reimplementation of a specification is another place a conformance bug can hide and another copy that drifts from the contract. The cost of a spec change scales with the number of reimplementers.",
+    remediation: "Consolidate onto one implementation that the others depend on (`depends_on_product` / `hosts`), or confirm the duplication is deliberate and record why. Capture the stewarding organization with `create_registry_edge` so the contract has an owner.",
+    stages: ["build", "beta", "launch", "growth", "mature"],
+    severity: "low",
+    source: { kind: "fundamental" }
   }
 ];
 function getAntiPatternById(id) {
@@ -24396,6 +24439,7 @@ function evaluateAntiPatterns(inputs, options) {
   const idFilter = options?.anti_pattern_ids ? new Set(options.anti_pattern_ids) : void 0;
   const fires = [];
   for (const ap of UPG_ANTI_PATTERNS) {
+    if (ap.scope === "portfolio" || !ap.structured_condition) continue;
     if (severityFilter && ap.severity !== severityFilter) continue;
     if (idFilter && !idFilter.has(ap.id)) continue;
     if (inputs.productStage && !ap.stages.includes(inputs.productStage)) {
@@ -24556,6 +24600,7 @@ function buildViolation(ap) {
 }
 function collectTargetEntities(cond) {
   const types = /* @__PURE__ */ new Set();
+  if (!cond) return [];
   walk(cond);
   return [...types].sort();
   function walk(c) {
@@ -27432,7 +27477,7 @@ function isCanonical(text) {
 }
 
 // src/index.ts
-var UPG_VERSION = "0.9.12";
+var UPG_VERSION = "0.9.13";
 var UPG_FORMAT_VERSION = "0.4.0";
 var MARKDOWN_FORMAT_VERSION = "0.1";
 var UPG_TYPES = getTypes();