agentic-sdd-framework 1.4.0

package/scripts/lib/provision.js

@@ -0,0 +1,323 @@
+/**
+ * scripts/lib/provision.js
+ *
+ * Writes the SDD governance structure into a target project. Every step is
+ * idempotent: documents that already exist are kept, sdd.config.json is merged
+ * (unknown keys survive), and generated entry points are only rewritten while they
+ * still carry the sdd:managed marker.
+ *
+ * Clone mode:   target is the framework checkout itself; templates are used in place.
+ * Install mode: target is another project; templates, skills and the quality gate
+ *               tooling (.sdd/scripts/) are copied into it first.
+ */
+
+const fs = require('fs');
+const path = require('path');
+const { install: installHook } = require('../install-git-hooks');
+const { validateConfig, getIn } = require('./config');
+
+const FRAMEWORK_ROOT = path.resolve(__dirname, '..', '..');
+const MANAGED_MARKER = 'sdd:managed';
+// Marks a .claude/skills/<name> directory as a copy made by sdd-init (where symlinks are
+// unavailable), so --force refreshes it and never touches a directory the user created.
+const COPY_MARKER = '.sdd-managed-copy';
+const SPEC_MODES = ['lite', 'rigor'];
+const AST_ADAPTERS = ['ast-grep', 'graphify', 'ripgrep', 'lsp'];
+const TOOL_DIR = '.sdd/scripts';
+const TOOL_FILES = [
+    'quality-gate.js', 'verify-no-secrets.js', 'check-copy-slop.js', 'check-file-size.js', 'check-spec.js',
+    'check-versions.js', 'check-system-prerequisites.js', 'install-git-hooks.js', 'sdd-verify.js', 'lib'
+];
+const TEMPLATES = [
+    '.agents/AGENTS.template.md',
+    '.agents/CONTEXT.template.md',
+    'docs/SPEC_TEMPLATE.md',
+    'docs/decisions/ADR_TEMPLATE.md',
+    'docs/incidents/0000-00-00-incident-template.md',
+    'docs/roadmap/templates/plan-of-record.md',
+    'docs/roadmap/templates/execution-guide.md',
+    'docs/roadmap/templates/compliance-log.md',
+    'docs/guides/AGENT_CREDENTIALS.md',
+    'docs/guides/GITHUB_CLI_SETUP.md',
+    'docs/guidelines/AST_NAVIGATION.md'
+];
+// Rigor documents use the auditkit format (tBeltty/auditor-executor-protocol) so `auditkit lint` can check them.
+const RIGOR_DOCS = ['plan-of-record', 'execution-guide', 'compliance-log'];
+const ICONS = { created: '✅', updated: '🔄', linked: '🔗', copied: '📄', kept: '⏭️ ', skipped: '⚠️ ', unchanged: '⏭️ ' };
+
+// String.prototype.replace would interpret "$5" in answers like "$5 VPS".
+const replaceLiteral = (text, from, to) => text.split(from).join(to);
+
+function readJson(file) {
+    if (!fs.existsSync(file)) return null;
+    try {
+        return JSON.parse(fs.readFileSync(file, 'utf8').replace(/^\uFEFF/, ''));
+    } catch (error) {
+        throw new Error(`${path.basename(file)} is not valid JSON: ${error.message}`);
+    }
+}
+
+function isPlainObject(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+
+function deepMerge(base, override) {
+    const result = { ...base };
+    for (const [key, value] of Object.entries(override || {})) {
+        result[key] = isPlainObject(value) && isPlainObject(result[key]) ? deepMerge(result[key], value) : value;
+    }
+    return result;
+}
+
+function sameDir(a, b) {
+    try {
+        return fs.realpathSync(a) === fs.realpathSync(b);
+    } catch {
+        return false;
+    }
+}
+
+function normalizeAnswers(answers) {
+    const specMode = answers.specMode === 'strict' ? 'rigor' : answers.specMode;
+    if (!SPEC_MODES.includes(specMode)) {
+        throw new Error(`Unknown mode "${answers.specMode}". Valid: ${SPEC_MODES.join(', ')}.`);
+    }
+    if (!AST_ADAPTERS.includes(answers.astAdapter)) {
+        throw new Error(`Unknown AST adapter "${answers.astAdapter}". Valid: ${AST_ADAPTERS.join(', ')}.`);
+    }
+    return { ...answers, specMode };
+}
+
+function buildConfig(answers, existing) {
+    const defaults = {
+        architecture: { style: 'clean-architecture', maxLocPerFile: 400 },
+        capabilities: { noAiSlop: { enabled: true } }
+    };
+    const generated = {
+        $schema: `https://raw.githubusercontent.com/tBeltty/agentic-sdd-framework/v${frameworkVersion()}/scripts/lib/sdd.config.schema.json`,
+        version: frameworkVersion(),
+        project: { name: answers.projectName, type: 'application', runtime: answers.runtime },
+        specification: { mode: answers.specMode, allowedModes: SPEC_MODES },
+        discovery: { concurrency: answers.concurrency, hardware: answers.hardware, workload: answers.workload },
+        capabilities: {
+            astNavigation: { adapter: answers.astAdapter },
+            i18n: { enabled: answers.i18n },
+            pwa: { enabled: answers.pwa }
+        }
+    };
+    const merged = deepMerge(deepMerge(defaults, existing || {}), generated);
+    const order = ['$schema', 'version', 'project', 'specification', 'discovery', 'architecture', 'capabilities'];
+    const config = Object.fromEntries([
+        ...order.filter(k => k in merged).map(k => [k, merged[k]]),
+        ...Object.entries(merged).filter(([k]) => !order.includes(k))
+    ]);
+    const errors = validateConfig(config);
+    if (errors.length > 0) {
+        throw new Error(`sdd.config.json is invalid; fix it and rerun:\n${errors.map(e => `  - ${e}`).join('\n')}`);
+    }
+    return config;
+}
+
+function frameworkVersion() {
+    return readJson(path.join(FRAMEWORK_ROOT, 'package.json')).version;
+}
+
+function fillContext(text, answers, config) {
+    const onOff = flag => (flag ? 'Enabled' : 'Disabled');
+    const pairs = [
+        ['[Project Name]', answers.projectName],
+        ['Lite | Rigor', answers.specMode === 'lite' ? 'Lite' : 'Rigor'],
+        ['[e.g. Node.js 24 LTS, Go 1.23, Python 3.12]', answers.runtime],
+        ['Clean Architecture | Standard MVC | Modular Monolith', config.architecture.style],
+        ['No-AI-Slop Linter: [Enabled / Disabled]', `No-AI-Slop Linter: ${onOff(config.capabilities.noAiSlop.enabled !== false)}`],
+        ['[graphify / ast-grep / ripgrep / lsp]', answers.astAdapter],
+        ['Internationalization (i18n): [Enabled / Disabled]', `Internationalization (i18n): ${onOff(answers.i18n)}`],
+        ['Progressive Web App (PWA): [Enabled / Disabled]', `Progressive Web App (PWA): ${onOff(answers.pwa)}`]
+    ];
+    return pairs.reduce((out, [from, to]) => replaceLiteral(out, from, to), text);
+}
+
+function fillAdr(text, answers, date) {
+    const required = flag => (flag ? 'required' : 'not required');
+    const recorded = [
+        '',
+        `**Recorded answers (sdd-init, ${date}):**`,
+        '',
+        `* **Scale and Concurrency:** ${answers.concurrency}`,
+        `* **Hardware and Deployment:** ${answers.hardware}`,
+        `* **Data and Workload:** ${answers.workload}`,
+        `* **Modularity:** i18n ${required(answers.i18n)}, PWA ${required(answers.pwa)}`,
+        `* **Runtime Preference:** ${answers.runtime}`,
+        ''
+    ].join('\n');
+    let out = replaceLiteral(text, '# ADR-[NNNN]: [Decision Title]', '# ADR-0001: Technology Stack and Architecture Selection');
+    out = replaceLiteral(out, '**Status:** Accepted | Proposed | Superseded', '**Status:** Proposed');
+    out = replaceLiteral(out, '**Date:** [YYYY-MM-DD]', `**Date:** ${date}`);
+    return out.replace(/(4\. \*\*Modularity and Localization:\*\*[^\n]*\n)/, match => match + recorded);
+}
+
+function renderEntrypoint(answers, gateCommand, config) {
+    const specFile = getIn(config, 'specification.specFile', 'docs/SPEC.md');
+    const roadmapDir = getIn(config, 'specification.roadmapDir', 'docs/roadmap');
+    const specLocation = answers.specMode === 'lite'
+        ? `\`${specFile}\`: the active specification (Lite mode).`
+        : `\`${roadmapDir}/\`: \`plan-of-record.md\`, \`execution-guide.md\`, \`compliance-log.md\`, and \`annexes/\` (Rigor mode).`;
+    const toolDir = gateCommand.replace(/^node /, '').replace(/\/quality-gate\.js$/, '');
+    const specCheck = answers.specMode === 'lite'
+        ? `Record task evidence with \`node ${toolDir}/sdd-verify.js --task <ID> -- <command>\` and close \`${specFile}\` with \`node ${toolDir}/sdd-verify.js --record\`; the gate rejects a \`Completed\` spec whose recorded PASS does not match the committed content.`
+        : `The gate runs \`auditkit lint ${roadmapDir}\`; a \`DONE\` report without pasted verify output fails it.`;
+    const values = {
+        SPEC_CHECK: specCheck,
+        PROJECT_NAME: answers.projectName,
+        SPEC_LOCATION: specLocation,
+        AST_ADAPTER: answers.astAdapter,
+        RUNTIME: answers.runtime,
+        SPEC_MODE: answers.specMode,
+        GATE_COMMAND: gateCommand
+    };
+    const template = fs.readFileSync(path.join(FRAMEWORK_ROOT, '.agents/ENTRYPOINT.template.md'), 'utf8');
+    return Object.entries(values).reduce((out, [key, value]) => replaceLiteral(out, `{{${key}}}`, value), template);
+}
+
+const CLAUDE_ENTRYPOINT = `<!-- ${MANAGED_MARKER}. Generated by sdd-init; rerun it to refresh. Put project rules in .agents/AGENTS.md. -->
+@AGENTS.md
+@.agents/AGENTS.md
+@.agents/CONTEXT.md
+`;
+
+function provision(rawAnswers, { target = process.cwd(), force = false, log = console.log, date } = {}) {
+    const answers = normalizeAnswers(rawAnswers);
+    const root = path.resolve(target);
+    const installMode = !sameDir(root, FRAMEWORK_ROOT);
+    const today = date || new Date().toISOString().slice(0, 10);
+    const at = rel => path.join(root, rel);
+    const record = (status, what) => log(`  ${ICONS[status]} ${what} (${status})`);
+    const skippedEntrypoints = [];
+
+    const write = (rel, content) => {
+        fs.mkdirSync(path.dirname(at(rel)), { recursive: true });
+        fs.writeFileSync(at(rel), content);
+    };
+    const createFromTemplate = (templateRel, destRel, transform = t => t) => {
+        if (fs.existsSync(at(destRel))) return record('kept', destRel);
+        write(destRel, transform(fs.readFileSync(at(templateRel), 'utf8')));
+        record('created', destRel);
+    };
+    const writeManaged = (rel, content) => {
+        if (fs.existsSync(at(rel))) {
+            const current = fs.readFileSync(at(rel), 'utf8');
+            if (!current.includes(MANAGED_MARKER)) {
+                skippedEntrypoints.push(rel);
+                return record('skipped', `${rel} exists and is not managed by sdd-init`);
+            }
+            if (current === content) return record('unchanged', rel);
+            write(rel, content);
+            return record('updated', rel);
+        }
+        write(rel, content);
+        record('created', rel);
+    };
+
+    // 1. Framework assets (install mode only). Tooling is framework-owned and always
+    //    refreshed; skills and templates are refreshed only with --force.
+    if (installMode) {
+        const versionFile = at('.sdd/VERSION');
+        const previous = fs.existsSync(versionFile) ? fs.readFileSync(versionFile, 'utf8').trim() : null;
+        for (const file of TOOL_FILES) {
+            fs.cpSync(path.join(FRAMEWORK_ROOT, 'scripts', file), at(path.join(TOOL_DIR, file)), { recursive: true });
+        }
+        write('.sdd/VERSION', `${frameworkVersion()}\n`);
+        const change = previous && previous !== frameworkVersion() ? ` from ${previous} to ${frameworkVersion()}` : ` at ${frameworkVersion()}`;
+        record('updated', `${TOOL_DIR}/ (quality gate tooling${change})`);
+        const skillsRoot = path.join(FRAMEWORK_ROOT, '.agents/skills');
+        for (const skill of fs.readdirSync(skillsRoot, { withFileTypes: true }).filter(d => d.isDirectory())) {
+            const rel = `.agents/skills/${skill.name}`;
+            if (fs.existsSync(at(rel)) && !force) { record('kept', rel); continue; }
+            fs.cpSync(path.join(skillsRoot, skill.name), at(rel), { recursive: true });
+            record('copied', rel);
+        }
+        for (const rel of TEMPLATES) {
+            if (fs.existsSync(at(rel)) && !force) continue;
+            fs.mkdirSync(path.dirname(at(rel)), { recursive: true });
+            fs.copyFileSync(path.join(FRAMEWORK_ROOT, rel), at(rel));
+        }
+        record('copied', 'templates and guides referenced by the skills');
+    }
+
+    // 2. Capability manifest.
+    const configPath = at('sdd.config.json');
+    const existingConfig = readJson(configPath);
+    const config = buildConfig(answers, existingConfig);
+    fs.writeFileSync(configPath, JSON.stringify(config, null, 2) + '\n');
+    record(existingConfig ? 'updated' : 'created', 'sdd.config.json');
+
+    // 3. Governance documents.
+    createFromTemplate('.agents/AGENTS.template.md', '.agents/AGENTS.md');
+    createFromTemplate('.agents/CONTEXT.template.md', '.agents/CONTEXT.md', t => fillContext(t, answers, config));
+    // Documents go where the config says, so the gate checks the files sdd-init created.
+    const specFile = getIn(config, 'specification.specFile', 'docs/SPEC.md');
+    const roadmapDir = getIn(config, 'specification.roadmapDir', 'docs/roadmap');
+    if (answers.specMode === 'lite') {
+        createFromTemplate('docs/SPEC_TEMPLATE.md', specFile);
+    } else {
+        for (const doc of RIGOR_DOCS) {
+            createFromTemplate(`docs/roadmap/templates/${doc}.md`, `${roadmapDir}/${doc}.md`,
+                t => replaceLiteral(t, '{{PROJECT_NAME}}', answers.projectName));
+        }
+        if (!fs.existsSync(at(`${roadmapDir}/annexes/.gitkeep`))) write(`${roadmapDir}/annexes/.gitkeep`, '');
+    }
+    createFromTemplate('docs/decisions/ADR_TEMPLATE.md', 'docs/decisions/ADR-0001-stack-and-architecture.md',
+        t => fillAdr(t, answers, today));
+
+    // 4. Agent entry points: AGENTS.md (Codex, Cursor, others), CLAUDE.md and
+    //    .claude/skills/ (Claude Code) so the rules load without a manual prompt.
+    const gateScript = installMode ? at(`${TOOL_DIR}/quality-gate.js`) : path.join(FRAMEWORK_ROOT, 'scripts/quality-gate.js');
+    const gateCommand = `node ${path.relative(root, gateScript).split(path.sep).join('/')}`;
+    writeManaged('AGENTS.md', renderEntrypoint(answers, gateCommand, config));
+    writeManaged('CLAUDE.md', CLAUDE_ENTRYPOINT);
+    for (const skill of fs.readdirSync(at('.agents/skills'), { withFileTypes: true }).filter(d => d.isDirectory())) {
+        const rel = `.claude/skills/${skill.name}`;
+        if (isSymlink(at(rel))) { record('kept', rel); continue; }
+        const copySkill = () => {
+            fs.cpSync(at(`.agents/skills/${skill.name}`), at(rel), { recursive: true });
+            fs.writeFileSync(at(`${rel}/${COPY_MARKER}`), 'Copied by sdd-init; rerun with --force to refresh.\n');
+            record('copied', rel);
+        };
+        if (fs.existsSync(at(rel))) {
+            // A copy made by sdd-init goes stale; --force refreshes it. Anything else is the user's.
+            if (!force || !fs.existsSync(at(`${rel}/${COPY_MARKER}`))) { record('kept', rel); continue; }
+            fs.rmSync(at(rel), { recursive: true, force: true });
+            copySkill();
+            continue;
+        }
+        fs.mkdirSync(path.dirname(at(rel)), { recursive: true });
+        try {
+            fs.symlinkSync(path.join('..', '..', '.agents', 'skills', skill.name), at(rel), 'dir');
+            record('linked', rel);
+        } catch {
+            copySkill();
+        }
+    }
+
+    // 5. Pre-push hook.
+    let hookInstalled = false;
+    try {
+        const { preserved } = installHook({ root, gateScript });
+        record('created', `pre-push quality gate hook${preserved ? ' (previous hook kept as pre-push.local)' : ''}`);
+        hookInstalled = true;
+    } catch (error) {
+        record('skipped', `pre-push hook: ${error.message}`);
+    }
+
+    return { installMode, root, gateCommand, hookInstalled, config, skippedEntrypoints };
+}
+
+function isSymlink(file) {
+    try {
+        return fs.lstatSync(file).isSymbolicLink();
+    } catch {
+        return false;
+    }
+}
+
+module.exports = { FRAMEWORK_ROOT, SPEC_MODES, AST_ADAPTERS, provision, buildConfig, deepMerge };

package/scripts/lib/runner.js

@@ -0,0 +1,70 @@
+/**
+ * scripts/lib/runner.js
+ *
+ * Runs a verification command through a shell with a time limit and captures its output.
+ * The shell is specification.verifyShell when set, otherwise the platform default
+ * (/bin/sh on macOS and Linux, cmd.exe on Windows). On timeout the whole process tree is
+ * killed (a process group on macOS/Linux, `taskkill /T` on Windows), so background
+ * processes started by the command do not keep running.
+ */
+
+const { spawn, spawnSync } = require('child_process');
+
+const DEFAULT_TIMEOUT_SECONDS = 900;
+const MAX_OUTPUT = 64 * 1024 * 1024;
+
+function killTree(pid) {
+    if (process.platform === 'win32') {
+        spawnSync('taskkill', ['/pid', String(pid), '/T', '/F'], { stdio: 'ignore' });
+        return;
+    }
+    try {
+        process.kill(-pid, 'SIGKILL');
+    } catch {
+        // Already gone.
+    }
+}
+
+function runCommand(command, { cwd, timeoutSeconds = DEFAULT_TIMEOUT_SECONDS, shell } = {}) {
+    return new Promise(resolve => {
+        const child = spawn(command, {
+            cwd,
+            shell: shell || true,
+            detached: process.platform !== 'win32', // own process group, killed as a whole
+            stdio: ['ignore', 'pipe', 'pipe'],
+            windowsHide: true
+        });
+        let output = '';
+        const append = chunk => {
+            if (output.length < MAX_OUTPUT) output += chunk;
+        };
+        // Decode as UTF-8 streams so a multibyte character split across chunks survives.
+        child.stdout.setEncoding('utf8');
+        child.stderr.setEncoding('utf8');
+        child.stdout.on('data', append);
+        child.stderr.on('data', append);
+        let timedOut = false;
+        const timer = setTimeout(() => {
+            timedOut = true;
+            killTree(child.pid);
+        }, timeoutSeconds * 1000);
+        child.on('error', error => {
+            clearTimeout(timer);
+            resolve({ exit: 'error', output: `${output}\n(${error.message})` });
+        });
+        child.on('close', (code, signal) => {
+            clearTimeout(timer);
+            if (timedOut) resolve({ exit: 'timeout', output: `${output}\n(timed out after ${timeoutSeconds}s)` });
+            else if (code === null) resolve({ exit: `signal ${signal}`, output });
+            else resolve({ exit: String(code), output });
+        });
+    });
+}
+
+// Quotes argv tokens back into one command line (used for `sdd-verify --task ID -- cmd ...`).
+function joinCommand(tokens) {
+    if (tokens.length === 1) return tokens[0];
+    return tokens.map(t => (/[\s"'$`\\]/.test(t) ? `"${t.replace(/(["\\$`])/g, '\\$1')}"` : t)).join(' ');
+}
+
+module.exports = { DEFAULT_TIMEOUT_SECONDS, runCommand, joinCommand };

package/scripts/lib/sdd.config.schema.json

@@ -0,0 +1,213 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "Agentic SDD Framework configuration (sdd.config.json)",
+  "type": "object",
+  "additionalProperties": false,
+  "patternProperties": {
+    "^x-": {}
+  },
+  "properties": {
+    "$schema": {
+      "type": "string"
+    },
+    "version": {
+      "type": "string",
+      "description": "Framework version that generated this file."
+    },
+    "project": {
+      "type": "object",
+      "additionalProperties": false,
+      "patternProperties": {
+        "^x-": {}
+      },
+      "properties": {
+        "name": {
+          "type": "string"
+        },
+        "type": {
+          "enum": [
+            "application",
+            "framework"
+          ]
+        },
+        "runtime": {
+          "type": "string"
+        }
+      }
+    },
+    "specification": {
+      "type": "object",
+      "additionalProperties": false,
+      "patternProperties": {
+        "^x-": {}
+      },
+      "properties": {
+        "mode": {
+          "enum": [
+            "lite",
+            "rigor"
+          ]
+        },
+        "allowedModes": {
+          "type": "array",
+          "items": {
+            "enum": [
+              "lite",
+              "rigor"
+            ]
+          }
+        },
+        "specFile": {
+          "type": "string",
+          "x-relative-path": true,
+          "description": "Lite spec path (default docs/SPEC.md).",
+          "minLength": 1,
+          "x-file-path": true
+        },
+        "roadmapDir": {
+          "type": "string",
+          "x-relative-path": true,
+          "description": "Rigor document directory (default docs/roadmap).",
+          "minLength": 1,
+          "x-file-path": true
+        },
+        "verifyTimeoutSeconds": {
+          "type": "integer",
+          "minimum": 1,
+          "description": "sdd-verify limit per command (default 900)."
+        },
+        "verifyShell": {
+          "type": "string",
+          "description": "Shell for sdd-verify commands (default: sh on macOS/Linux, cmd.exe on Windows)."
+        },
+        "requireRecordedEvidence": {
+          "type": "boolean",
+          "description": "Reject checked tasks whose evidence was not recorded by sdd-verify --task (default false)."
+        }
+      }
+    },
+    "discovery": {
+      "type": "object",
+      "additionalProperties": false,
+      "patternProperties": {
+        "^x-": {}
+      },
+      "properties": {
+        "concurrency": {
+          "type": "string"
+        },
+        "hardware": {
+          "type": "string"
+        },
+        "workload": {
+          "type": "string"
+        }
+      }
+    },
+    "architecture": {
+      "type": "object",
+      "additionalProperties": false,
+      "patternProperties": {
+        "^x-": {}
+      },
+      "properties": {
+        "style": {
+          "type": "string"
+        },
+        "maxLocPerFile": {
+          "type": "integer",
+          "minimum": 0,
+          "description": "0 disables the check (default 400)."
+        },
+        "maxLocExclude": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "x-relative-path": true,
+            "minLength": 1
+          }
+        }
+      }
+    },
+    "security": {
+      "type": "object",
+      "additionalProperties": false,
+      "patternProperties": {
+        "^x-": {}
+      },
+      "properties": {
+        "allowFiles": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "x-relative-path": true,
+            "minLength": 1
+          },
+          "description": "Tracked paths allowed despite a sensitive name (.env, *.key, ...)."
+        }
+      }
+    },
+    "capabilities": {
+      "type": "object",
+      "additionalProperties": false,
+      "patternProperties": {
+        "^x-": {}
+      },
+      "properties": {
+        "astNavigation": {
+          "type": "object",
+          "additionalProperties": false,
+          "properties": {
+            "adapter": {
+              "enum": [
+                "ast-grep",
+                "graphify",
+                "ripgrep",
+                "lsp"
+              ]
+            }
+          }
+        },
+        "noAiSlop": {
+          "type": "object",
+          "additionalProperties": false,
+          "properties": {
+            "enabled": {
+              "type": "boolean"
+            },
+            "exclude": {
+              "type": "array",
+              "items": {
+                "type": "string",
+                "x-relative-path": true,
+                "minLength": 1
+              }
+            },
+            "maxEmDashes": {
+              "type": "integer",
+              "minimum": 0
+            }
+          }
+        },
+        "i18n": {
+          "type": "object",
+          "additionalProperties": false,
+          "properties": {
+            "enabled": {
+              "type": "boolean"
+            }
+          }
+        },
+        "pwa": {
+          "type": "object",
+          "additionalProperties": false,
+          "properties": {
+            "enabled": {
+              "type": "boolean"
+            }
+          }
+        }
+      }
+    }
+  }
+}

package/scripts/lib/slop-patterns.js

@@ -0,0 +1,57 @@
+/**
+ * scripts/lib/slop-patterns.js
+ *
+ * Single source of truth for the patterns enforced by check-copy-slop.js.
+ * .agents/skills/no-ai-slop/SKILL.md documents the same rules for agents; keep both in sync.
+ * Inspired by https://github.com/petergyang/no-ai-slop (MIT License).
+ */
+
+// Words banned outright. Context-dependent words from the skill (harness, simply,
+// actually, literally, honestly) stay as writing guidance only: they have legitimate
+// technical uses and would produce false positives.
+const BANNED_WORDS = [
+    'delve', 'delves', 'delving',
+    'foster', 'fosters', 'fostering',
+    'leverage', 'leverages', 'leveraged', 'leveraging',
+    'utilize', 'utilizes', 'utilized', 'utilizing',
+    'empower', 'empowers', 'empowering',
+    'streamline', 'streamlines', 'streamlined', 'streamlining',
+    'supercharge', 'supercharged', 'supercharging',
+    'revolutionize', 'revolutionizes', 'revolutionizing',
+    'embark', 'embarking',
+    'robust', 'cutting-edge', 'game-changing', 'game changer', 'game-changer',
+    'transformative', 'multifaceted', 'meticulous', 'meticulously', 'paramount',
+    'ever-evolving', 'world-class', 'seamless', 'seamlessly', 'groundbreaking',
+    'tapestry', 'beacon', 'paradigm shift'
+];
+
+// A clause boundary (comma, semicolon or dash) must separate both halves, so ordinary
+// sentences like "it is not cached because it is generated per request" are not reported.
+const BANNED_PATTERNS = [
+    {
+        name: 'Binary Contrast ("it is not X, it is Y")',
+        regex: /\b(?:it['’]?s|it is|this is|that['’]?s|that is)\s+not\b[^.;:!?]{1,60}?[,;—–]\s*(?:but\s+)?(?:it['’]?s|it is|this is|that['’]?s|that is|rather)\b/i
+    },
+    {
+        name: 'Throat-Clearing Opener',
+        regex: /\b(?:here['’]?s the thing|it['’]?s worth noting that|it is worth noting that|it is important to (?:note|remember) that)\b/i
+    },
+    {
+        name: 'Colon Reveal Hook',
+        regex: /\b(?:the best part|here['’]?s the kicker)\s*:/i
+    },
+    {
+        name: 'Faux-Insight Hook',
+        regex: /\b(?:what nobody tells you)\b/i
+    },
+    {
+        name: 'Fake-Profound Conclusion',
+        regex: /\b(?:the future is already here|in conclusion)\b/i
+    },
+    {
+        name: 'AI Buzzword',
+        regex: new RegExp(`\\b(?:${BANNED_WORDS.map(w => w.replace(/[-\s]/g, '[-\\s]')).join('|')})\\b`, 'i')
+    }
+];
+
+module.exports = { BANNED_WORDS, BANNED_PATTERNS };