aiwf 0.3.22 → 0.4.0

package/docs/modernization/VALIDATION.md

@@ -0,0 +1,79 @@
+# AIWF Spec validation — updated 2026-10-03
+
+Verified on Node.js 22.23.1 and Python 3.14.4. This record covers the local implementation and packaging, not live model execution or a generated application.
+
+| Check | Fresh result |
+|---|---|
+| `npm run test:spec` | 61 tests passed; 0 failed/skipped. `npm test` runs the same suite. Includes methodology-core/default-package selection, legacy exclusion and npm-bin symlink execution, spawned CLI calls, malformed pins/evidence, init preservation, drift, log hashes, symlink/output boundaries, all four optional stack installs, source provenance and installed parser self-test. |
+| `npm run test:spec-upstream` | All three imported Python self-tests passed. |
+| `npm run validate:spec-plugin` | 31 unchanged upstream skills across 5 methodology/stack plugins + 1 AIWF workflow extension; 71 imported files match original SHA256 values. The core NOTICE has one recorded attribution addition. All manifests, bundled references, marketplace and package entries validate. |
+| `npm run validate:spec-example` | 0 errors, 0 warnings, 0 information findings; no lint baseline accepted. |
+| Strict UC validator | 1 worked-example file; 0 errors, 0 warnings. |
+| `spec_lint.py --trace` | FR-001 → UC-001 → BR-001 → TC-001. Document trace only. |
+| Fresh-root smoke | init → filled example → lint → pin → check → packet → saved readback succeeded. 7 spec files; modified UC detected and stale packet generation rejected; restored original returns in sync. |
+| Syntax/static checks | All retained Node source/scripts/tests pass `node --check`; `npm run check:deps` checks literal imports and local paths across 5 source files without external dependencies. `git diff --check` passes. No external linter or TypeScript target is declared. |
+| Package inspection | A real `npm pack --json` final tarball contains 129 files (including the full-test report and captured fixture), all 32 skill manifests and complete plugin resources/rules/agent prompts/LICENSE/NOTICE; no legacy plugins or entry points. Offline installation into a clean temporary project installs only AIWF, without external dependencies. Its npm bin, library/validators and Codex installer run successfully. No npm publication performed. |
+
+## Saved demonstration
+
+[Review packet](evidence/example-review-packet.json) embeds the actual structural lint and AIWF regression output, along with two reported passes and one `not_run` application check. [Spec pin](evidence/example-spec-pin.json) records the example's 7 file hashes. The saved packet was read back and its status/digest/check counts verified.
+
+This demonstration retains the first-slice 43-test log. The later original-preserving import was checked separately with the 57-test run recorded above; the saved example is not a current stack application or model run.
+
+The saved packet also retains the command paths actually used at that time, including `plugins/aiwf-spec/skills/spec-review/scripts/spec_lint.py`. Following the core-package correction, the equivalent current path is `plugins/aiwf-core/skills/spec-review/scripts/spec_lint.py`, as shown in the current example guide. Historical command/evidence records are not rewritten to imply a later execution.
+
+The example digest is `da872a517e79e8d54791085831b5db5ca9dca67bbb52fcec67c061f87d16645b`. The example shows an imagined expense workflow; there is no expense app implementation. These artifacts demonstrate the recording format and local tool behavior, not expense-feature acceptance.
+
+## Historical legacy baseline — before removal
+
+`npm test -- --runInBand --coverage=false` yields **13 failed suites / 2 passed suites; 34 failed / 78 passed / 20 skipped tests**. A separate export of unmodified HEAD `19492b0`, using the same installed dependencies, yields the identical failing suite list and counts. Typical existing failures reference missing `index.js`, persona/context modules, and an obsolete bin location. Legacy tests also report open handles.
+
+This comparison establishes an unchanged observed legacy failure set at that earlier revision, not that all legacy behavior was correct. On 2026-10-03 the user requested legacy removal: these modules, obsolete tests and Jest setup were removed, and npm test now runs the retained spec-workflow suite. The old test counts above are historical evidence, not current failures or fixes.
+
+There is no TypeScript/typecheck target or external ESLint dependency. The unused legacy ESLint configuration was removed. Syntax, literal import/dependency and whitespace checks above are the static checks used for the current package.
+
+## Unverified gates
+
+- Broad automatic skill routing across arbitrary requests and stack implementation. Bounded explicit Codex/Claude skill execution is now verified in [FULL-TEST-2026-10-03.md](FULL-TEST-2026-10-03.md).
+- One actual application's implementation, runtime behavior and stakeholder acceptance.
+- Sprintable Doc upload/readback, report evidence, approval flow, concurrency/retry/version invalidation.
+- CI execution queue, unattended retries/resume, safe merge and deployment.
+- Parser behavior on older supported Node/Python versions; Korean semantic completeness.
+
+No production data changed; no deployment, remote publication or approval was performed.
+
+## Independent review integration
+
+Resolved the installer’s inconsistent sibling references by rewriting command and explicit skill-name references throughout copied Markdown, including bundled references. Added a regression check. Added local hashes for modified upstream resources and recorded the package-wide Node >=20 compatibility change in CHANGELOG. Main also added regressions for ordinary Todo product names and notes incorrectly satisfying UC/TC minimums.
+
+## Original-preserving import follow-up
+
+The user's follow-up requests original skill preservation. Verified the live upstream HEAD with `git ls-remote`: `065dadda0f696c29ff2bacbda31b38152082e6fa` remains latest at this check. Restored all seven core SKILL.md files to their original bytes, moving AIWF host guidance into the separate workflow skill. Imported all 24 stack skills, nested resources, rules and the two coverage-agent prompts unchanged. Recorded versions, original authors and per-file hashes in each plugin's UPSTREAM.json.
+
+Before implementation, new core/stack preservation and selection tests failed on modified/missing source and unsupported installation. After implementation, all 57 tests pass. Stack hash tests also compare the imported files directly against the pinned upstream checkout available in this session. The validator now checks upstream SKILL.md hashes, not just their notices. Installed copies receive only name/reference mappings; source files in this repository remain original. All four stack installs, unknown stack rejection, dry-run and existing-core/stack conflict preservation are covered.
+
+Separate review and live host/model checks remain distinct. The imported coverage-agent prompt is bundled, but installing a file does not register a native Codex custom agent. The wrapper documents host mapping; no independent reviewer execution is implied by these installation tests.
+
+A separate read-only reviewer checked the installer, validator, workflow, plugin metadata and packaging declarations and found no blocking issue. Documentation findings (stack discovery and non-Markdown example references) are addressed in the skill guide. A future upstream skill containing its own `rules/` or `agents/` folder will require an explicit resource-conflict policy before updating that import; the current pinned inventory has no such overlap.
+
+## Methodology core package correction — 2026-10-03
+
+The seven upstream core skills were present under aiwf-spec, but aiwf-core still pointed to legacy session/YOLO/task commands. Corrected this package boundary: aiwf-core is now the primary marketplace package with the upstream 2.19.0 version and original author; aiwf-spec contains only the AIWF workflow extension. The core skill files, references and validators moved without byte changes. Existing legacy-core files are preserved under aiwf-core-legacy; the local CLI remains aiwf-spec and installed Codex names remain unchanged.
+
+New regressions fail before correction and pass afterward. All 59 targeted tests, all three original Python self-tests, the strict example lint and source/manifests validator pass. Default Codex installation includes core's seven skills and the wrapper's one skill, with optional stacks unchanged. The package test/readback confirms core and legacy files ship. Existing installations are not overwritten; users installing from the marketplace should choose aiwf-core first and install aiwf-spec only when the workflow extension is wanted.
+
+
+## Legacy framework removal — 2026-10-03
+
+This supersedes the legacy-preservation choice in the preceding package correction. Removed 627 tracked legacy files: core-legacy/dev/experts/tools plugins, old CLI/install/runtime helpers, multilingual command collections, duplicate skills/rules, old documentation and Jest suites/configuration. Only tracked repository files were deleted; consuming-project data, local runtime state and Git history were left untouched. The root remains a marketplace, with six plugins and no all-in-one root plugin manifest. npm metadata now exposes only aiwf-spec and the spec-workflow library, with no external Node dependencies; the lockfile contains only the root package.
+
+The package-inventory regression failed before removal and passes afterward. A clean tarball installation exposed a CLI symlink-entry bug: invoking the npm bin returned silently because the path differed from import.meta.url. A new help/init regression reproduced that failure, and resolving the entry path fixes it. All 60 current regressions, all three original Python self-tests, strict example lint, provenance/import checks and Node syntax checks pass. The 31 upstream skills and 71 unchanged imported resources retain their recorded original hashes; the only imported-source modification remains the core NOTICE attribution.
+
+The installed npm binary completed init → example structural lint → pin → check → packet → saved packet readback. The installed Codex installer then copied 13 skills (core + workflow + NestJS/Next.js) into the temporary project, and all three installed Python parser self-tests passed. The review packet stayed awaiting_review. This confirms package execution and recording, not live-model implementation, application acceptance or Sprintable integration. Existing historical packet logs/commands were not rewritten.
+
+A separate read-only reviewer found no blocking issue in the retained imports, plugin/package inventory, CLI entry fix, provenance and current guidance. The reviewer reran the current regressions and local validators; the packaged installation smoke was assessed from this session's recorded results. All 17 current guide files have resolving local Markdown links, and importing the installed npm library by package name succeeds.
+
+
+## Full behavior test follow-up — 2026-10-03
+
+[Full test report](FULL-TEST-2026-10-03.md) records fresh regression, all-stack package installs, preservation/failure checks and actual Codex/Claude skill execution. Fixed directory packet output errors with a coded refusal; 61 regressions now pass. A live Codex-generated service fixture passes 12 tests independently, and its recorded packet logs/spec hashes were read back. Claude structural lint passes, with three advisory semantic warnings remaining in the example. These bounded runs do not establish full stack applications, UI/login or stakeholder acceptance.

package/docs/modernization/evidence/example-review-packet.json

@@ -0,0 +1,115 @@
+{
+  "schema_version": 1,
+  "collected_at": "2026-10-02T08:16:54.916Z",
+  "status": "awaiting_review",
+  "acceptance": "not_recorded",
+  "remote_sync": "not_attempted",
+  "spec": {
+    "digest": "da872a517e79e8d54791085831b5db5ca9dca67bbb52fcec67c061f87d16645b",
+    "files": [
+      {
+        "path": "docs/entity_model.md",
+        "sha256": "edb9c35d17e73885346df31782089088c4dfe26e82f8b0cd2463e9febedc9d4e",
+        "bytes": 1474,
+        "kind": "required"
+      },
+      {
+        "path": "docs/glossary.md",
+        "sha256": "093fc46be4b64534e670c046d935fce2287246190390d119f4c2edf43b7aedd9",
+        "bytes": 560,
+        "kind": "required"
+      },
+      {
+        "path": "docs/requirements.md",
+        "sha256": "d6190c0cfe5b43cd1fa7ba46fb252a558cc2854b0a5523cce7c2cf34db2c5254",
+        "bytes": 471,
+        "kind": "required"
+      },
+      {
+        "path": "docs/test_cases/TC-001-submit-expense.md",
+        "sha256": "f47b50f116ac8af187daf8915382c3a7e084d0110840b8b2cd0413f5d9a5d3b2",
+        "bytes": 1529,
+        "kind": "test_case"
+      },
+      {
+        "path": "docs/use_cases.puml",
+        "sha256": "b693ab2ddf7896b404a5193acd1fe65c3b4e0bb768df56a54360dc0f8c3a412d",
+        "bytes": 208,
+        "kind": "required"
+      },
+      {
+        "path": "docs/use_cases/UC-001-submit-expense.md",
+        "sha256": "e19c5b44acb98dcfb6c4992b1be16520cfe83f7dcb7dee04415b59cedd0590cf",
+        "bytes": 1812,
+        "kind": "use_case"
+      },
+      {
+        "path": "docs/vision.md",
+        "sha256": "52fabfa494c1419bc1045f3404e26478a523a52c0f9910c40ac0199a7a9455fd",
+        "bytes": 516,
+        "kind": "required"
+      }
+    ]
+  },
+  "pin": {
+    "digest": "da872a517e79e8d54791085831b5db5ca9dca67bbb52fcec67c061f87d16645b",
+    "matched": true
+  },
+  "drift": {
+    "added": [],
+    "changed": [],
+    "deleted": []
+  },
+  "git": null,
+  "evidence": {
+    "trust": "reported_untrusted",
+    "checks_summary": {
+      "total": 3,
+      "passed": 2,
+      "failed": 0,
+      "not_run": 1
+    },
+    "checks": [
+      {
+        "name": "Specification structure and references",
+        "command": "python3 plugins/aiwf-spec/skills/spec-review/scripts/spec_lint.py --docs <smoke>/docs --strict --no-baseline",
+        "status": "passed",
+        "log": {
+          "path": "artifacts/spec-lint.log",
+          "sha256": "d891432dfaf07be0bf54139efeb64d926f404eaf302147f73d96b624b99cb67a",
+          "bytes": 62,
+          "content": "0 error(s), 0 warning(s), 0 info(s), 0 suppressed by baseline\n"
+        }
+      },
+      {
+        "name": "AIWF CLI regression tests",
+        "command": "npm run test:spec (AIWF checkout)",
+        "status": "passed",
+        "log": {
+          "path": "artifacts/spec-tests.log",
+          "sha256": "55979ee00c532db39ba76043c71ed01c426ca2a2698036ba6a306157e18d5d87",
+          "bytes": 8670,
+          "content": "\n> aiwf@0.3.24 test:spec\n> node --test tests/spec-workflow/*.test.mjs\n\nTAP version 13\n# Subtest: dry run writes nothing, real install retains parser siblings and attribution\nok 1 - dry run writes nothing, real install retains parser siblings and attribution\n  ---\n  duration_ms: 90.812084\n  type: 'test'\n  ...\n# Subtest: existing skill prevents partial install and preserves user content\nok 2 - existing skill prevents partial install and preserves user content\n  ---\n  duration_ms: 1.12275\n  type: 'test'\n  ...\n# Subtest: symlinked skill parent and dangling destination are rejected\nok 3 - symlinked skill parent and dangling destination are rejected\n  ---\n  duration_ms: 1.035125\n  type: 'test'\n  ...\n# Subtest: installer CLI rejects unknown flags and missing project\nok 4 - installer CLI rejects unknown flags and missing project\n  ---\n  duration_ms: 68.946625\n  type: 'test'\n  ...\n# Subtest: installed workflow and reference documents use the prefixed sibling names\nok 5 - installed workflow and reference documents use the prefixed sibling names\n  ---\n  duration_ms: 14.055625\n  type: 'test'\n  ...\n# Subtest: cli init prints machine JSON and exits zero\nok 6 - cli init prints machine JSON and exits zero\n  ---\n  duration_ms: 28.77975\n  type: 'test'\n  ...\n# Subtest: cli check --json reports ok on a pinned spec and nonzero drift afterwards\nok 7 - cli check --json reports ok on a pinned spec and nonzero drift afterwards\n  ---\n  duration_ms: 101.797625\n  type: 'test'\n  ...\n# Subtest: cli check exits nonzero when no pin exists\nok 8 - cli check exits nonzero when no pin exists\n  ---\n  duration_ms: 28.127458\n  type: 'test'\n  ...\n# Subtest: cli packet writes a review packet and refuses to overwrite without --force\nok 9 - cli packet writes a review packet and refuses to overwrite without --force\n  ---\n  duration_ms: 110.323083\n  type: 'test'\n  ...\n# Subtest: cli rejects unknown options and missing required arguments with nonzero exit\nok 10 - cli rejects unknown options and missing required arguments with nonzero exit\n  ---\n  duration_ms: 97.717417\n  type: 'test'\n  ...\n# Subtest: cli help exits zero and documents the commands\nok 11 - cli help exits zero and documents the commands\n  ---\n  duration_ms: 22.26375\n  type: 'test'\n  ...\n# Subtest: cli pin is blocked on Draft templates and exits nonzero\nok 12 - cli pin is blocked on Draft templates and exits nonzero\n  ---\n  duration_ms: 25.360375\n  type: 'test'\n  ...\n# Subtest: cli packet rejects an --output escaping the root or a symlinked output\nok 13 - cli packet rejects an --output escaping the root or a symlinked output\n  ---\n  duration_ms: 69.4035\n  type: 'test'\n  ...\n# Subtest: cli check on a tampered pin exits nonzero with pin_invalid JSON\nok 14 - cli check on a tampered pin exits nonzero with pin_invalid JSON\n  ---\n  duration_ms: 29.228875\n  type: 'test'\n  ...\n# Subtest: init creates Draft templates and empty use_case/test_case directories\nok 15 - init creates Draft templates and empty use_case/test_case directories\n  ---\n  duration_ms: 2.797125\n  type: 'test'\n  ...\n# Subtest: init is idempotent and never overwrites existing user files\nok 16 - init is idempotent and never overwrites existing user files\n  ---\n  duration_ms: 1.380042\n  type: 'test'\n  ...\n# Subtest: init rejects a symlinked artifact directory\nok 17 - init rejects a symlinked artifact directory\n  ---\n  duration_ms: 0.353375\n  type: 'test'\n  ...\n# Subtest: init rejects a symlinked required artifact file\nok 18 - init rejects a symlinked required artifact file\n  ---\n  duration_ms: 0.441666\n  type: 'test'\n  ...\n# Subtest: pin is blocked while templates remain Draft\nok 19 - pin is blocked while templates remain Draft\n  ---\n  duration_ms: 2.013375\n  type: 'test'\n  ...\n# Subtest: pin requires at least one use case and one test case\nok 20 - pin requires at least one use case and one test case\n  ---\n  duration_ms: 3.200333\n  type: 'test'\n  ...\n# Subtest: pin is deterministic and idempotent for unchanged content\nok 21 - pin is deterministic and idempotent for unchanged content\n  ---\n  duration_ms: 16.138083\n  type: 'test'\n  ...\n# Subtest: pin refuses to overwrite without --refresh and honors --refresh\nok 22 - pin refuses to overwrite without --refresh and honors --refresh\n  ---\n  duration_ms: 23.107208\n  type: 'test'\n  ...\n# Subtest: check reports ok, drift (added/changed/deleted), draft, and missing pin\nok 23 - check reports ok, drift (added/changed/deleted), draft, and missing pin\n  ---\n  duration_ms: 40.728333\n  type: 'test'\n  ...\n# Subtest: findDraftMarkers is case-insensitive and covers NEEDS CLARIFICATION\nok 24 - findDraftMarkers is case-insensitive and covers NEEDS CLARIFICATION\n  ---\n  duration_ms: 0.829625\n  type: 'test'\n  ...\n# Subtest: parseEvidence rejects malformed evidence and unknown fields\nok 25 - parseEvidence rejects malformed evidence and unknown fields\n  ---\n  duration_ms: 0.3385\n  type: 'test'\n  ...\n# Subtest: packet embeds log digest/body, preserves failed/not_run, and never claims approval\nok 26 - packet embeds log digest/body, preserves failed/not_run, and never claims approval\n  ---\n  duration_ms: 16.761709\n  type: 'test'\n  ...\n# Subtest: packet refuses when the pin is missing or the spec drifts\nok 27 - packet refuses when the pin is missing or the spec drifts\n  ---\n  duration_ms: 14.490958\n  type: 'test'\n  ...\n# Subtest: packet rejects log paths that escape the root or traverse a symlink\nok 28 - packet rejects log paths that escape the root or traverse a symlink\n  ---\n  duration_ms: 20.783666\n  type: 'test'\n  ...\n# Subtest: packet rejects an oversized log\nok 29 - packet rejects an oversized log\n  ---\n  duration_ms: 15.55925\n  type: 'test'\n  ...\n# Subtest: pin snapshots docs/processes/*.bpmn and tracks the optional lint baseline\nok 30 - pin snapshots docs/processes/*.bpmn and tracks the optional lint baseline\n  ---\n  duration_ms: 14.856333\n  type: 'test'\n  ...\n# Subtest: lint baseline is tracked but not scanned for draft markers\nok 31 - lint baseline is tracked but not scanned for draft markers\n  ---\n  duration_ms: 8.42125\n  type: 'test'\n  ...\n# Subtest: Reviewed status is recorded, not treated as a blocker (no approval claimed)\nok 32 - Reviewed status is recorded, not treated as a blocker (no approval claimed)\n  ---\n  duration_ms: 7.136166\n  type: 'test'\n  ...\n# Subtest: pin records optional git HEAD and dirty status when inside a repository\nok 33 - pin records optional git HEAD and dirty status when inside a repository\n  ---\n  duration_ms: 67.002041\n  type: 'test'\n  ...\n# Subtest: check rejects a tampered pin digest and packet refuses to build\nok 34 - check rejects a tampered pin digest and packet refuses to build\n  ---\n  duration_ms: 7.570666\n  type: 'test'\n  ...\n# Subtest: validateStoredPin rejects bad schema, duplicate paths, bad path, hash, bytes, kind, and null files\nok 35 - validateStoredPin rejects bad schema, duplicate paths, bad path, hash, bytes, kind, and null files\n  ---\n  duration_ms: 6.587291\n  type: 'test'\n  ...\n# Subtest: check rejects a self-consistent fake pin that omits required or minimum artifacts\nok 36 - check rejects a self-consistent fake pin that omits required or minimum artifacts\n  ---\n  duration_ms: 11.700208\n  type: 'test'\n  ...\n# Subtest: check flags artifacts missing from disk as out of sync\nok 37 - check flags artifacts missing from disk as out of sync\n  ---\n  duration_ms: 11.545708\n  type: 'test'\n  ...\n# Subtest: pin validates the existing pin instead of trusting a matching digest\nok 38 - pin validates the existing pin instead of trusting a matching digest\n  ---\n  duration_ms: 23.559833\n  type: 'test'\n  ...\n# Subtest: check returns a uniform shape for missing and invalid pins\nok 39 - check returns a uniform shape for missing and invalid pins\n  ---\n  duration_ms: 6.927167\n  type: 'test'\n  ...\n# Subtest: packet marks pin.matched true only within an in-sync spec\nok 40 - packet marks pin.matched true only within an in-sync spec\n  ---\n  duration_ms: 13.02875\n  type: 'test'\n  ...\n# Subtest: packet rejects a non-UTF-8 log instead of embedding a misleading body\nok 41 - packet rejects a non-UTF-8 log instead of embedding a misleading body\n  ---\n  duration_ms: 11.643208\n  type: 'test'\n  ...\n# Subtest: ordinary Todo product names are not unresolved drafting markers\nok 42 - ordinary Todo product names are not unresolved drafting markers\n  ---\n  duration_ms: 1.985875\n  type: 'test'\n  ...\n# Subtest: folder notes do not satisfy the required UC and TC minimums\nok 43 - folder notes do not satisfy the required UC and TC minimums\n  ---\n  duration_ms: 2.797958\n  type: 'test'\n  ...\n1..43\n# tests 43\n# suites 0\n# pass 43\n# fail 0\n# cancelled 0\n# skipped 0\n# todo 0\n# duration_ms 551.798542\n"
+        }
+      },
+      {
+        "name": "Expense application behavior",
+        "command": "Application pilot not implemented",
+        "status": "not_run"
+      }
+    ],
+    "unverified": [
+      "Expense application has not been implemented or tested",
+      "Live Claude/Codex skill invocation not tested",
+      "Sprintable synchronization not implemented",
+      "Business acceptance not recorded"
+    ]
+  },
+  "limitations": [
+    "Recorded check output is not proof of business acceptance.",
+    "Check statuses are reported by the submitter and are not independently verified by this tool.",
+    "Remote synchronization was not attempted.",
+    "Human acceptance has not been recorded.",
+    "Structural and semantic lint is not performed by this tool; it remains an upstream step."
+  ]
+}

package/docs/modernization/evidence/example-spec-pin.json

@@ -0,0 +1,48 @@
+{
+  "schema_version": 1,
+  "spec_digest": "da872a517e79e8d54791085831b5db5ca9dca67bbb52fcec67c061f87d16645b",
+  "files": [
+    {
+      "path": "docs/entity_model.md",
+      "sha256": "edb9c35d17e73885346df31782089088c4dfe26e82f8b0cd2463e9febedc9d4e",
+      "bytes": 1474,
+      "kind": "required"
+    },
+    {
+      "path": "docs/glossary.md",
+      "sha256": "093fc46be4b64534e670c046d935fce2287246190390d119f4c2edf43b7aedd9",
+      "bytes": 560,
+      "kind": "required"
+    },
+    {
+      "path": "docs/requirements.md",
+      "sha256": "d6190c0cfe5b43cd1fa7ba46fb252a558cc2854b0a5523cce7c2cf34db2c5254",
+      "bytes": 471,
+      "kind": "required"
+    },
+    {
+      "path": "docs/test_cases/TC-001-submit-expense.md",
+      "sha256": "f47b50f116ac8af187daf8915382c3a7e084d0110840b8b2cd0413f5d9a5d3b2",
+      "bytes": 1529,
+      "kind": "test_case"
+    },
+    {
+      "path": "docs/use_cases.puml",
+      "sha256": "b693ab2ddf7896b404a5193acd1fe65c3b4e0bb768df56a54360dc0f8c3a412d",
+      "bytes": 208,
+      "kind": "required"
+    },
+    {
+      "path": "docs/use_cases/UC-001-submit-expense.md",
+      "sha256": "e19c5b44acb98dcfb6c4992b1be16520cfe83f7dcb7dee04415b59cedd0590cf",
+      "bytes": 1812,
+      "kind": "use_case"
+    },
+    {
+      "path": "docs/vision.md",
+      "sha256": "52fabfa494c1419bc1045f3404e26478a523a52c0f9910c40ac0199a7a9455fd",
+      "bytes": 516,
+      "kind": "required"
+    }
+  ]
+}

package/docs/modernization/evidence/full-test-20261003/claude-lint.md

@@ -0,0 +1,22 @@
+## Spec Review: whole project
+
+**Lint:** 0 errors, 0 warnings, 0 infos, 0 suppressed by baseline. Part A passes with exit code 0.
+**Semantic:** Not rerun, as you asked. The earlier semantic review found 3 warnings, and I'm carrying that conclusion forward unchanged.
+
+### Lint findings (deterministic)
+
+```text
+0 error(s), 0 warning(s), 0 info(s), 0 suppressed by baseline
+```
+
+I ran the checker as `python3 scripts/spec_lint.py --docs docs --strict --no-baseline`, with no `--trace`, no pipes and no appended commands. The output above is its actual output. I didn't read exit status from the shell, so the exit code 0 comes from the zero-findings output. I didn't edit any files.
+
+### Semantic findings (advisory)
+
+I didn't repeat the semantic review. The earlier review's 3 warnings are still open, because nothing in this conversation shows them declined or accepted. I don't have their details here, so I can't list them by file, line and element.
+
+### Verdict
+
+**Ready for Approved:** no. Lint passes, but the 3 earlier semantic warnings are still open.
+
+Those warnings need to be resolved or explicitly accepted first. If you give me the earlier report, I can map each warning to the command that fixes it, such as `/use-case-spec UC-XXX`. This fixture run is not stakeholder approval.

package/docs/modernization/evidence/full-test-20261003/claude-review-retry.md

@@ -0,0 +1,56 @@
+## Spec Review: whole project
+
+Scope: all of `docs/`, which holds one use case (UC-001), one test case (TC-001) and the supporting documents.
+
+**Lint:** 0 errors, 0 warnings, 0 info, no baseline used. The checker printed only the trace output.
+**Semantic:** 3 warnings, 3 infos. These are advisory.
+
+### Lint findings (deterministic)
+
+The checker ran with `--strict --no-baseline --trace`. It printed no findings, only the trace matrix below. The tool result showed no exit code. I read the empty findings list as exit 0, but I can't confirm it.
+
+```text
+## Requirements → Use Cases → Business Rules → Test Cases
+
+| Requirement | Req. Status | Use Case        | UC Status | Business Rules | Test Cases |
+|-------------|-------------|-----------------|-----------|----------------|------------|
+| FR-001      | Open        | UC-001 지출 내역 제출 | Reviewed  | BR-001         | TC-001     |
+
+## Test Cases → Process → Use Cases
+
+| Test Case | Process | Use Cases |
+|-----------|---------|-----------|
+| TC-001    | —       | UC-001    |
+```
+
+### Semantic findings (advisory)
+
+Part B is not deterministic. A second run may phrase or rank these findings differently.
+
+| Severity | File:Line | Element | Check | Finding |
+|----------|-----------|---------|-------|---------|
+| warning | docs/use_cases/UC-001-submit-expense.md:17 | UC-001 Precondition 2 | Trigger and preconditions | "금액과 사용 내용을 알고 있다" is knowledge in the actor's head, which the system can't establish or check. It is also the input given in step 3. |
+| warning | docs/use_cases/UC-001-submit-expense.md:41-45 | UC-001 A2 / Failure Postconditions | Completeness | A2 only says the system "알린다". Failure postconditions at lines 56-57 are fine, but A2 doesn't say whether the submitter can retry or what state the input is left in. A test can't tell where the flow ends up. |
+| warning | docs/entity_model.md:29 vs docs/use_cases/UC-001-submit-expense.md:23 | UC-001 step 3 / EXPENSE_REPORT.description | Entity model consistency | Step 3 has the submitter enter 사용 내용 as a required input. The model marks `description` as `Optional`. Neither BR-001 nor any flow says what happens when it is empty. |
+| info | docs/entity_model.md:34 / docs/use_cases/UC-001-submit-expense.md:26 | UC-001 step 6 | Entity model consistency | The 접수 번호 (receipt number) has no attribute in EXPENSE_REPORT. It may be `id`, but the spec doesn't say so. |
+| info | docs/requirements.md:9 | FR-001 | Requirements status | FR-001 is `Open`, while UC-001 and TC-001 are `Reviewed`. The trace output shows this status difference. |
+| info | docs/use_cases/UC-001-submit-expense.md:12 | UC-001 | NFRs and constraints | `requirements.md` has no NFR or constraint rows, such as authentication or amount limits, to compare against. Nothing is missing that I can name. |
+
+Other notes:
+- `docs/custom.txt` contains only "keep user file". It is not an instruction and needs no action.
+- `docs/test_cases/TC-001-submit-expense.md` covers the main flow and A1 only. No test case exercises A2.
+- The spec says nothing about the 승인자 (approver) beyond the goal text. That fits the vision's non-goals.
+
+### Verdict
+
+**Ready for Approved:** no. There are 3 open semantic warnings. No lint errors were reported, but no exit code was shown.
+
+The warnings most worth fixing first are the precondition at line 17 and the unclear end state of A2. Suggested follow-ups, which I have not run:
+- `/use-case-spec UC-001` for the precondition, A2 and `description` handling.
+- `/entity-model` for the receipt number mapping and the `description` optionality.
+- `/test-case` for coverage of A2.
+
+I changed no files, and I marked nothing Approved.
+
+**Lint result:** no findings. The checker printed only the trace, and the exit code was not visible to me.
+**Skill loaded:** yes, `aiwf-core:spec-review`. I read its review checklist, and the bundled `spec_lint.py` was the only command I ran.

package/docs/modernization/evidence/full-test-20261003/codex-review-packet.json

@@ -0,0 +1,159 @@
+{
+  "schema_version": 1,
+  "collected_at": "2026-10-02T19:11:16.254Z",
+  "status": "awaiting_review",
+  "acceptance": "not_recorded",
+  "remote_sync": "not_attempted",
+  "spec": {
+    "digest": "d0aafb6df81224323c1ee093826f9c26bddc7c30e020db351807e2c24bf6e332",
+    "files": [
+      {
+        "path": "docs/entity_model.md",
+        "sha256": "edb9c35d17e73885346df31782089088c4dfe26e82f8b0cd2463e9febedc9d4e",
+        "bytes": 1474,
+        "kind": "required"
+      },
+      {
+        "path": "docs/glossary.md",
+        "sha256": "093fc46be4b64534e670c046d935fce2287246190390d119f4c2edf43b7aedd9",
+        "bytes": 560,
+        "kind": "required"
+      },
+      {
+        "path": "docs/plans/UC-001.md",
+        "sha256": "c82d61c00d7d1bb1ae5fc69c7bb734977b4f4777e59e12ea5cc1a21201859347",
+        "bytes": 2438,
+        "kind": "plan"
+      },
+      {
+        "path": "docs/requirements.md",
+        "sha256": "d6190c0cfe5b43cd1fa7ba46fb252a558cc2854b0a5523cce7c2cf34db2c5254",
+        "bytes": 471,
+        "kind": "required"
+      },
+      {
+        "path": "docs/test_cases/TC-001-submit-expense.md",
+        "sha256": "f47b50f116ac8af187daf8915382c3a7e084d0110840b8b2cd0413f5d9a5d3b2",
+        "bytes": 1529,
+        "kind": "test_case"
+      },
+      {
+        "path": "docs/use_cases.puml",
+        "sha256": "b693ab2ddf7896b404a5193acd1fe65c3b4e0bb768df56a54360dc0f8c3a412d",
+        "bytes": 208,
+        "kind": "required"
+      },
+      {
+        "path": "docs/use_cases/UC-001-submit-expense.md",
+        "sha256": "e19c5b44acb98dcfb6c4992b1be16520cfe83f7dcb7dee04415b59cedd0590cf",
+        "bytes": 1812,
+        "kind": "use_case"
+      },
+      {
+        "path": "docs/vision.md",
+        "sha256": "52fabfa494c1419bc1045f3404e26478a523a52c0f9910c40ac0199a7a9455fd",
+        "bytes": 516,
+        "kind": "required"
+      }
+    ]
+  },
+  "pin": {
+    "digest": "d0aafb6df81224323c1ee093826f9c26bddc7c30e020db351807e2c24bf6e332",
+    "matched": true
+  },
+  "drift": {
+    "added": [],
+    "changed": [],
+    "deleted": []
+  },
+  "git": null,
+  "evidence": {
+    "trust": "reported_untrusted",
+    "checks_summary": {
+      "total": 8,
+      "passed": 4,
+      "failed": 0,
+      "not_run": 4
+    },
+    "checks": [
+      {
+        "name": "lint",
+        "command": "python3 .agents/skills/aiwf-spec-review/scripts/spec_lint.py --docs docs --strict --no-baseline",
+        "status": "passed",
+        "log": {
+          "path": "artifacts/lint.log",
+          "sha256": "5b0af6693efc7cdf93a47254390b64d56bc34569f5f30eaef88c4d8d3a5a5549",
+          "bytes": 232,
+          "content": "command: python3 .agents/skills/aiwf-spec-review/scripts/spec_lint.py --docs docs --strict --no-baseline\nexit_code: 0\n--- stdout (verbatim) ---\n0 error(s), 0 warning(s), 0 info(s), 0 suppressed by baseline\n--- stderr (verbatim) ---\n"
+        }
+      },
+      {
+        "name": "pin",
+        "command": "node /private/tmp/aiwf-comprehensive-5ih6czuw/consumer/node_modules/aiwf/src/cli/spec-cli.js pin --root .",
+        "status": "passed",
+        "log": {
+          "path": "artifacts/pin.log",
+          "sha256": "8cc7e1cda6eee52c200b89740b5807dd3a7ec3ea635a981eb3cb578140c40459",
+          "bytes": 270,
+          "content": "command: node /private/tmp/aiwf-comprehensive-5ih6czuw/consumer/node_modules/aiwf/src/cli/spec-cli.js pin --root .\nexit_code: 0\n--- stdout (verbatim) ---\nPinned 8 files (digest d0aafb6df81224323c1ee093826f9c26bddc7c30e020db351807e2c24bf6e332).\n--- stderr (verbatim) ---\n"
+        }
+      },
+      {
+        "name": "tests",
+        "command": "node --test tests/expense.test.mjs",
+        "status": "passed",
+        "log": {
+          "path": "artifacts/tests.log",
+          "sha256": "0d2eda8736018069247e34e619ad8d88e33d0a6a5e45eeda444df8df6e842099",
+          "bytes": 2547,
+          "content": "command: node --test tests/expense.test.mjs\nexit_code: 0\n--- stdout (verbatim) ---\nTAP version 13\n# Subtest: UC-001 success persists amount, description, submitted state and receipt\nok 1 - UC-001 success persists amount, description, submitted state and receipt\n  ---\n  duration_ms: 2.32475\n  type: 'test'\n  ...\n# Subtest: UC-001 BR-001/A1 rejects 0 without changing prior state\nok 2 - UC-001 BR-001/A1 rejects 0 without changing prior state\n  ---\n  duration_ms: 0.387625\n  type: 'test'\n  ...\n# Subtest: UC-001 BR-001/A1 rejects -1 without changing prior state\nok 3 - UC-001 BR-001/A1 rejects -1 without changing prior state\n  ---\n  duration_ms: 0.129625\n  type: 'test'\n  ...\n# Subtest: UC-001 BR-001/A1 rejects -100 without changing prior state\nok 4 - UC-001 BR-001/A1 rejects -100 without changing prior state\n  ---\n  duration_ms: 0.053334\n  type: 'test'\n  ...\n# Subtest: UC-001 BR-001/A1 rejects NaN without changing prior state\nok 5 - UC-001 BR-001/A1 rejects NaN without changing prior state\n  ---\n  duration_ms: 0.103417\n  type: 'test'\n  ...\n# Subtest: UC-001 BR-001/A1 rejects Infinity without changing prior state\nok 6 - UC-001 BR-001/A1 rejects Infinity without changing prior state\n  ---\n  duration_ms: 0.044\n  type: 'test'\n  ...\n# Subtest: UC-001 BR-001/A1 rejects -Infinity without changing prior state\nok 7 - UC-001 BR-001/A1 rejects -Infinity without changing prior state\n  ---\n  duration_ms: 0.069208\n  type: 'test'\n  ...\n# Subtest: UC-001 BR-001/A1 rejects 12000 without changing prior state\nok 8 - UC-001 BR-001/A1 rejects 12000 without changing prior state\n  ---\n  duration_ms: 0.072917\n  type: 'test'\n  ...\n# Subtest: UC-001 BR-001/A1 rejects null without changing prior state\nok 9 - UC-001 BR-001/A1 rejects null without changing prior state\n  ---\n  duration_ms: 0.259125\n  type: 'test'\n  ...\n# Subtest: UC-001 BR-001/A1 rejects undefined without changing prior state\nok 10 - UC-001 BR-001/A1 rejects undefined without changing prior state\n  ---\n  duration_ms: 0.247458\n  type: 'test'\n  ...\n# Subtest: TC-001 service slice permits correction from -100 to 12000\nok 11 - TC-001 service slice permits correction from -100 to 12000\n  ---\n  duration_ms: 0.116417\n  type: 'test'\n  ...\n# Subtest: UC-001 A2 storage failure preserves earlier records and permits recovery\nok 12 - UC-001 A2 storage failure preserves earlier records and permits recovery\n  ---\n  duration_ms: 0.124667\n  type: 'test'\n  ...\n1..12\n# tests 12\n# suites 0\n# pass 12\n# fail 0\n# cancelled 0\n# skipped 0\n# todo 0\n# duration_ms 39.374458\n--- stderr (verbatim) ---\n"
+        }
+      },
+      {
+        "name": "check",
+        "command": "node /private/tmp/aiwf-comprehensive-5ih6czuw/consumer/node_modules/aiwf/src/cli/spec-cli.js check --root .",
+        "status": "passed",
+        "log": {
+          "path": "artifacts/check.log",
+          "sha256": "e444b544bc4e382a93411dab163fb1b897ddddc92eb5002f7c5f43c423757a12",
+          "bytes": 193,
+          "content": "command: node /private/tmp/aiwf-comprehensive-5ih6czuw/consumer/node_modules/aiwf/src/cli/spec-cli.js check --root .\nexit_code: 0\n--- stdout (verbatim) ---\nstatus: ok\n--- stderr (verbatim) ---\n"
+        }
+      },
+      {
+        "name": "UI journey and displayed validation/receipt",
+        "command": "Not executed: outside authorized service smoke",
+        "status": "not_run"
+      },
+      {
+        "name": "Login precondition",
+        "command": "Not executed: outside authorized service smoke",
+        "status": "not_run"
+      },
+      {
+        "name": "Stakeholder acceptance",
+        "command": "Not executed: outside authorized service smoke",
+        "status": "not_run"
+      },
+      {
+        "name": "Full semantic review acceptance",
+        "command": "Not executed: outside authorized service smoke",
+        "status": "not_run"
+      }
+    ],
+    "unverified": [
+      "UI journey and displayed messages/receipt; TC-001 end-to-end browser flow not run.",
+      "Login/authentication and submitter identity not implemented or verified.",
+      "Stakeholder acceptance and full semantic acceptance not recorded; specifications remain Reviewed (FR-001 remains Open).",
+      "Durable persistence, Decimal(10,2), description length and submitter foreign keys are outside this in-memory service smoke.",
+      "Advisory model finding remains open: submitted status is absent from entity attributes; receipt/id mapping is implicit. See artifacts/semantic-review.md."
+    ]
+  },
+  "limitations": [
+    "Recorded check output is not proof of business acceptance.",
+    "Check statuses are reported by the submitter and are not independently verified by this tool.",
+    "Remote synchronization was not attempted.",
+    "Human acceptance has not been recorded.",
+    "Structural and semantic lint is not performed by this tool; it remains an upstream step."
+  ]
+}

package/docs/modernization/evidence/full-test-20261003/src/expense.mjs

@@ -0,0 +1,40 @@
+/** Process-local persistence for the bounded UC-001 smoke. */
+export class InMemoryExpenseStore {
+  #records = [];
+  #failNext = false;
+
+  failNextWrite() {
+    this.#failNext = true;
+  }
+
+  insert(expense) {
+    // UC-001 A2: fail before mutation, preserving every earlier record.
+    if (this.#failNext) {
+      this.#failNext = false;
+      throw new Error('Expense persistence failed');
+    }
+    const record = structuredClone({
+      ...expense,
+      receiptId: String(this.#records.length + 1),
+    });
+    this.#records.push(record);
+    return structuredClone(record);
+  }
+
+  list() {
+    return structuredClone(this.#records);
+  }
+}
+
+export function submitExpense(store, { amount, description = '' }) {
+  // UC-001 BR-001 / A1: no coercion or non-finite monetary amounts.
+  if (!Number.isFinite(amount) || amount <= 0) {
+    throw new RangeError('Amount must be a positive finite number');
+  }
+  return store.insert({
+    amount,
+    description,
+    status: 'submitted',
+    submitted_at: new Date().toISOString(),
+  });
+}