aw-spec-cli 0.1.3 → 0.1.5

package/assets/docs/domainspecs/pharma/commandtechrulemap.md

@@ -0,0 +1,119 @@
+# Pharma Domain — Command → Technical-Rule-File Map
+
+Per-command list of the **technical** rule files loaded (via `resolve-tech` + the
+`tech-select` module, into the sticky standards set) for the spec-anchored
+orchestrator pipeline. This is the technical counterpart of `comandrulemap.md`
+(which maps the DOMAIN rule files).
+
+**The model:** the technical rule files (the `docs/architecture` · `docs/security` ·
+`docs/interop` · `docs/governance` set that used to be HARDCODED in each workflow's
+`standards:` block) are now CONFIGURATION — tune this map, not the workflows. The
+technology base itself (`constitution.technical.md`) is NOT listed here — every
+consumer still refers to it directly, as-is.
+
+- All paths are workspace-relative technical rule files (domain-agnostic docs/…).
+- `resolve-tech --command <name>` collects the `- ` bullets under `## /<name>`.
+- This file is the **canonical technical mapping** for the pharma domain; it is
+  selected whenever pharma is the active domain (`.aw-spec/domain.json`).
+- A command with no heading here loads no mapped technical file (only the workflow's
+  universal `ai-rules.md` seed + `constitution.technical.md`, referred to directly).
+- `## /aw-spec-specify` is the one **modelling-methodology** slot (see the rule partition):
+  a domain-agnostic way of *modelling*, never a technology choice. Everything below it is a
+  HOW-phase technical set.
+
+---
+
+## /aw-spec-specify
+<!-- MODELLING METHODOLOGY ONLY. Specify is the domain phase: the single technical input it
+     may take is a domain-agnostic way of MODELLING (DDD tactical patterns), never a
+     technology choice. Do NOT add an architecture / persistence / codegen file here — that
+     would break specify's domain purity (design/implement own those). The domain's own DDD
+     overlay (domain-driven-design.domain.md) arrives separately via comandrulemap. -->
+- docs/domain/domain-driven-design.md
+
+## /aw-spec-design
+<!-- The technical/architecture rule files the design author works from (alongside the
+     spec and constitution.technical.md). NO domain file here — domain reaches design
+     only as spec ids (BR-/CN-/DC-/IC-). -->
+- docs/architecture/clean-architecture.md
+- docs/architecture/cqrs.md
+- docs/architecture/eventing.md
+- docs/architecture/modular-monolith.md
+- docs/architecture/vertical-slices.md
+- docs/architecture/persistence.md
+- docs/architecture/folder-structure.md
+- docs/architecture/testing.md
+- docs/governance/api-versioning.md
+- docs/security/zero-trust.md
+- docs/security/authorization.md
+- docs/security/authorization-matrix.md
+- docs/security/auditing.md
+- docs/security/data-classification.md
+- docs/interop/ihe-conformance.md
+
+## /aw-spec-implement
+<!-- The FRAMEWORK / code-generation rule files the code generator builds against
+     (alongside design.md and constitution.technical.md). NO domain file — domain
+     reaches implement only through design.md. clean-architecture/cqrs are design
+     concerns; component wiring is a separate /aw-spec-orch add-component step. -->
+- docs/governance/coding-standards.md
+- docs/governance/dependency-policy.md
+- docs/architecture/folder-structure.md
+- docs/architecture/testing.md
+- docs/VerticalSlice/PACKAGING.md
+
+## /aw-spec-implement-delta
+<!-- The CR analog of implement — same FRAMEWORK / code-generation set (HOW to build).
+     The delta's code is generated against the master design.md + delta-design.md; no
+     domain file (domain reached the delta via delta-spec → delta-design). -->
+- docs/governance/coding-standards.md
+- docs/governance/dependency-policy.md
+- docs/architecture/folder-structure.md
+- docs/architecture/testing.md
+- docs/VerticalSlice/PACKAGING.md
+
+## /aw-spec-build
+<!-- The compile/fix reference set: the layering + coding rules the fixer respects when
+     repairing compile errors against the design intent. NO domain file (build loads
+     domain rules separately via domain-select) and no constitution.technical here. -->
+- docs/architecture/clean-architecture.md
+- docs/governance/coding-standards.md
+
+## /aw-spec-analyze-slice
+<!-- The design↔code conformance gate's TECHNICAL checklist: the code + tests are
+     validated against these (alongside the DOMAIN gate overlays, loaded separately via
+     resolve-domain `## /aw-spec-gate`). Validation input only — never authoring. -->
+- docs/architecture/testing.md
+- docs/governance/coding-standards.md
+
+## /aw-spec-constitution
+<!-- The technology-constitution base the TECHNICAL half of the split constitution
+     ratifies into constitution.technical.md. Loaded BEFORE the technical half and before
+     domain-select, so the technical author stays domain-free (the seam). NO domain file
+     here — the domain half's sources are the domain map's ## /aw-spec-constitution. -->
+- docs/technology-constitution.md
+
+## /aw-spec-run
+<!-- Execution / data migration: the persistence rules the migration step generates against.
+     NO domain file; run does not reference constitution.technical.md. -->
+- docs/architecture/persistence.md
+
+---
+
+## Quick reference (command → technical file count)
+
+| Command | Technical rule files | Role |
+|---|---|---|
+| /aw-spec-specify | 1 | the modelling methodology (DDD) the domain model is expressed in — no technology |
+| /aw-spec-design | 15 | architecture/security/interop the design author mediates the spec against |
+| /aw-spec-implement | 5 | governance/architecture the code generator builds against (from design.md) |
+| /aw-spec-implement-delta | 5 | same code-generation set, scoped to the open change's delta-design |
+| /aw-spec-build | 2 | layering + coding rules the compile-fixer respects |
+| /aw-spec-analyze-slice | 2 | testing + coding rules the design↔code gate validates against |
+| /aw-spec-constitution | 1 | the technology-constitution base the technical half ratifies |
+| /aw-spec-run | 1 | persistence rules the execution / data-migration step generates against |
+
+> All migrated workflows are on this map. The conformance-gate workflows **analyze-design**
+> and **analyze-delta-design** are intentionally NOT here — they validate design/delta
+> against the spec + DOMAIN gate overlays only (comandrulemap `## /aw-spec-gate`), with no
+> technical gate checklist.

package/assets/docs/domainspecs/pharma/cqrs.domain.md

@@ -1,6 +1,6 @@
 # CQRS — Pharma Domain Addenda
 
-> Technology base: [[cqrs]]. Commands: `/aw-spec-plan`, `/aw-spec-tasks`, `/aw-spec-implement`.
+> Technology base: [[cqrs]]. Commands: `/aw-spec-specify`, `/aw-spec-gate`.
 
 ## Pipeline
 - Append a **product-audit behavior** to the mediator pipeline: every create/modify/retire/re-identify/reclassify command on `MedicinalProduct` MUST emit an immutable audit record (User, Timestamp, Action, Previous Value, New Value). See [[auditing.domain]], [[regulatory-compliance]].

package/assets/docs/domainspecs/pharma/data-classification.domain.md

@@ -1,6 +1,6 @@
 # Data Classification — Pharma Domain Addenda
 
-> Technology base: [[data-classification]]. Commands: `/aw-spec-specify`, `/aw-spec-plan`, `/aw-spec-implement`.
+> Technology base: [[data-classification]]. Commands: `/aw-spec-constitution`, `/aw-spec-specify`, `/aw-spec-gate`.
 
 > No PHI — the model is commercial confidentiality, regulatory integrity, and source trust.
 

package/assets/docs/domainspecs/pharma/data-provenance.md

@@ -1,6 +1,6 @@
 # Data Provenance Standards — Pharma
 
-> NON-NEGOTIABLE. Commands: `/aw-spec-specify`, `/aw-spec-plan`, `/aw-spec-tasks`, `/aw-spec-implement`.
+> NON-NEGOTIABLE. Commands: `/aw-spec-constitution`, `/aw-spec-specify`.
 
 ## First-class concern
 - Any product attribute imported from an external source (FDA NDC directory, RxNorm, WHO ATC, an MAH submission, a partner feed) SHALL carry a **`ProvenanceRecord`** (Provenance module).

package/assets/docs/domainspecs/pharma/dependency-policy.domain.md

@@ -1,6 +1,6 @@
 # Dependency Policy — Pharma Domain Addenda
 
-> Technology base: [[dependency-policy]]. Commands: `/aw-spec-plan`, `/aw-spec-implement`.
+> Technology base: [[dependency-policy]]. Commands: `/aw-spec-gate`.
 
 ## Reviews & libraries
 - Every new dependency gets a **regulatory-suitability** review beyond the generic license/supply-chain check — reject packages that phone home or ship analytics by default (leak risk for commercially-sensitive pre-market data) (see [[data-classification.domain]]).

package/assets/docs/domainspecs/pharma/domain-driven-design.domain.md

@@ -1,6 +1,6 @@
 # Domain-Driven Design — Medicinal Product Domain Model
 
-> Technology base: [[domain-driven-design]]. NON-NEGOTIABLE. Commands: `/aw-spec-specify`, `/aw-spec-plan`, `/aw-spec-tasks`, `/aw-spec-implement`.
+> Technology base: [[domain-driven-design]]. NON-NEGOTIABLE. Commands: `/aw-spec-specify`.
 
 ## Modeling
 - Use the pharma/regulatory ubiquitous language (see [[pharma-terms]]), aligned to ISO IDMP concepts (see [[idmp]]).

package/assets/docs/domainspecs/pharma/eventing.domain.md

@@ -1,6 +1,6 @@
 # Eventing — Pharma Domain Addenda
 
-> Technology base: [[eventing]]. Commands: `/aw-spec-plan`, `/aw-spec-tasks`, `/aw-spec-implement`.
+> Technology base: [[eventing]]. Commands: `/aw-spec-specify`, `/aw-spec-gate`.
 
 ## Domain events
 - `MedicinalProduct` raises domain events on every significant state change — the integration seam to downstream consumers (prescribing, dispensing, manufacturing, pharmacovigilance, clinical).

package/assets/docs/domainspecs/pharma/fhir.md

@@ -1,6 +1,6 @@
 # FHIR Standards — Pharma
 
-> NON-NEGOTIABLE. Commands: `/aw-spec-specify`, `/aw-spec-plan`, `/aw-spec-tasks`, `/aw-spec-implement`.
+> NON-NEGOTIABLE. Commands: `/aw-spec-constitution`, `/aw-spec-specify`.
 
 ## Architecture & projectors
 - **R4 default**; R5 **additive** under `/fhir/R5/...`. FHIR is the canonical interop contract; it + any internal REST serve from the **same authoritative aggregates** — no duplicate write paths.

package/assets/docs/domainspecs/pharma/folder-structure.domain.md

@@ -1,6 +1,6 @@
 # Folder Structure — Pharma Domain Addenda
 
-> Technology base: [[folder-structure]]. Commands: `/aw-spec-plan`, `/aw-spec-tasks`, `/aw-spec-implement`. Replace `<SampleProjectName>`.
+> Technology base: [[folder-structure]]. Commands: `/aw-spec-gate`. Replace `<SampleProjectName>`.
 
 ## Additions to the base layout
 ```

package/assets/docs/domainspecs/pharma/hl7.md

@@ -1,6 +1,6 @@
 # HL7 Integration Readiness — Pharma
 
-> Commands: `/aw-spec-specify`, `/aw-spec-plan`, `/aw-spec-tasks`, `/aw-spec-implement`.
+> Commands: `/aw-spec-constitution`, `/aw-spec-specify`.
 
 ## Principle
 - The solution SHALL support **future integration with HL7-based systems**. The registry is the authoritative product source; HL7 surfaces are **adapters, not a parallel model**. FHIR is the primary contract (see [[fhir]]); HL7 v2 adapters are added where a downstream system (prescribing/dispensing/manufacturing/pharmacovigilance) needs them.

package/assets/docs/domainspecs/pharma/idmp.md

@@ -1,6 +1,6 @@
 # ISO IDMP — Identification of Medicinal Products
 
-> NON-NEGOTIABLE. Commands: `/aw-spec-specify`, `/aw-spec-plan`, `/aw-spec-tasks`, `/aw-spec-implement`.
+> NON-NEGOTIABLE. Commands: `/aw-spec-constitution`, `/aw-spec-specify`.
 
 ## Alignment principle
 - The model SHALL align with the ISO IDMP suite (**ISO 11615/11616/11238/11239/11240**) **where applicable** — IDMP shapes the ubiquitous language + aggregate boundaries; it is **not** a wire format and does not replace the internal model (see [[domain-driven-design.domain]]).

package/assets/docs/domainspecs/pharma/integration-terms.md

@@ -1,6 +1,6 @@
 # Glossary — Integration Terms (Pharma)
 
-> Ubiquitous language for pharma interoperability standards + identifiers. Commands: `/aw-spec-specify`, `/aw-spec-clarify`, `/aw-spec-plan`. See [[pharma-terms]] (aggregates) + [[terminology]] (coding).
+> Ubiquitous language for pharma interoperability standards + identifiers. Commands: `/aw-spec-specify`. See [[pharma-terms]] (aggregates) + [[terminology]] (coding).
 
 | Term | Definition |
 |---|---|

package/assets/docs/domainspecs/pharma/ndc.md

@@ -1,6 +1,6 @@
 # NDC — National Drug Code Standards
 
-> NON-NEGOTIABLE. Commands: `/aw-spec-specify`, `/aw-spec-plan`, `/aw-spec-tasks`, `/aw-spec-implement`.
+> NON-NEGOTIABLE. Commands: `/aw-spec-constitution`, `/aw-spec-specify`.
 
 ## Value Object
 - **NDC SHALL be a Value Object** (`NdcCode`) — immutable, equality by value (see [[domain-driven-design.domain]]).

package/assets/docs/domainspecs/pharma/persistence.domain.md

@@ -1,6 +1,6 @@
 # Persistence — Pharma Domain Addenda
 
-> Technology base: [[persistence]]. NON-NEGOTIABLE. Commands: `/aw-spec-plan`, `/aw-spec-tasks`, `/aw-spec-implement`.
+> Technology base: [[persistence]]. NON-NEGOTIABLE. Commands: `/aw-spec-specify`, `/aw-spec-gate`.
 
 ## Version history
 - Maintain a **version history** of product information: each approved change produces a new, immutable **`ProductVersion`** snapshot.

package/assets/docs/domainspecs/pharma/pharma-terms.md

@@ -1,6 +1,6 @@
 # Glossary — Pharmaceutical Terms
 
-> Ubiquitous language for the medicinal product registry. Commands: `/aw-spec-specify`, `/aw-spec-clarify`, `/aw-spec-plan`. See [[domain-driven-design.domain]] (modeling), [[terminology]] (coding), [[integration-terms]] (interop).
+> Ubiquitous language for the medicinal product registry. Commands: `/aw-spec-constitution`, `/aw-spec-specify`. See [[domain-driven-design.domain]] (modeling), [[terminology]] (coding), [[integration-terms]] (interop).
 
 | Term | Definition |
 |---|---|

package/assets/docs/domainspecs/pharma/product-lifecycle.domain.md

@@ -1,6 +1,6 @@
 # Product Lifecycle — Medicinal Product State Machine
 
-> Technology base: [[domain-driven-design]]. NON-NEGOTIABLE. Commands: `/aw-spec-specify`, `/aw-spec-plan`, `/aw-spec-tasks`, `/aw-spec-implement`.
+> Technology base: [[domain-driven-design]]. NON-NEGOTIABLE. Commands: `/aw-spec-constitution`, `/aw-spec-specify`.
 
 ## States
 `Draft` → `Under Review` → `Approved` → `Active` → `Discontinued` / `Withdrawn`

package/assets/docs/domainspecs/pharma/regulatory-compliance.md

@@ -1,6 +1,6 @@
 # Regulatory & Compliance Standards — Pharma
 
-> NON-NEGOTIABLE. Commands: `/aw-spec-specify`, `/aw-spec-plan`, `/aw-spec-tasks`, `/aw-spec-implement`.
+> NON-NEGOTIABLE. Commands: `/aw-spec-constitution`, `/aw-spec-specify`.
 
 > Umbrella for the compliance requirements — mechanisms live in the linked files.
 

package/assets/docs/domainspecs/pharma/terminology.md

@@ -1,6 +1,6 @@
 # Terminology Standards — Pharma
 
-> NON-NEGOTIABLE. Commands: `/aw-spec-specify`, `/aw-spec-plan`, `/aw-spec-tasks`, `/aw-spec-implement`.
+> NON-NEGOTIABLE. Commands: `/aw-spec-constitution`, `/aw-spec-specify`.
 
 ## Coded value objects
 - **Coded data MUST use industry terminologies — free-text strings for coded concepts are FORBIDDEN.**

package/assets/docs/domainspecs/pharma/testing.domain.md

@@ -1,6 +1,6 @@
 # Testing — Pharma Domain Addenda
 
-> Technology base: [[testing]]. Commands: `/aw-spec-plan`, `/aw-spec-tasks`, `/aw-spec-implement`.
+> Technology base: [[testing]]. Commands: `/aw-spec-gate`.
 
 ## What MUST be tested
 - **Aggregate invariants** — required attributes; >= 1 ActiveIngredient; >= 1 PackagingConfiguration; NDC uniqueness + format; invalid dosage forms/routes rejected (see [[domain-driven-design.domain]], [[ndc]], [[terminology]]).

package/assets/docs/domainspecs/pharma/vertical-slices.domain.md

@@ -1,6 +1,6 @@
 # Vertical Slices — Pharma Domain Addenda
 
-> Technology base: [[vertical-slices]]. Commands: `/aw-spec-plan`, `/aw-spec-tasks`, `/aw-spec-implement`.
+> Technology base: [[vertical-slices]]. Commands: `/aw-spec-specify`, `/aw-spec-gate`.
 
 ## Interop adapters in the slice
 `{Module}/Interop/` carries the pharma external-protocol adapters:

package/assets/docs/domainspecs/pharma/zero-trust.domain.md

@@ -1,6 +1,6 @@
 # Zero-Trust — Pharma Domain Addenda
 
-> Technology base: [[zero-trust]]. Commands: `/aw-spec-plan`, `/aw-spec-implement`.
+> Technology base: [[zero-trust]]. Commands: `/aw-spec-constitution`, `/aw-spec-specify`, `/aw-spec-gate`.
 
 ## Rules
 - All registry traffic MUST be TLS-encrypted; commercially-sensitive pre-market data in transit MUST be TLS-protected; at-rest: see [[data-classification.domain]], [[persistence.domain]].

package/assets/docs/governance/api-versioning.md

@@ -1,6 +1,6 @@
 # API Versioning Policy
 
-> Pure technology (domain-agnostic) — domain (e.g. FHIR) versioning in [[api-versioning.domain]]. Commands: `/aw-spec-plan`, `/aw-spec-tasks`, `/aw-spec-implement`.
+> Pure technology (domain-agnostic) — domain (e.g. FHIR) versioning in [[api-versioning.domain]]. Commands: `/aw-spec-design`.
 
 ## REST versioning
 

package/assets/docs/governance/coding-standards.md

@@ -1,6 +1,6 @@
 # Coding Standards
 
-> Pure technology (domain-agnostic) — domain forbidden patterns & CI gates in [[coding-standards.domain]]. Commands: `/aw-spec-plan`, `/aw-spec-tasks`, `/aw-spec-implement`.
+> Pure technology (domain-agnostic) — domain forbidden patterns & CI gates in [[coding-standards.domain]]. Commands: `/aw-spec-implement`, `/aw-spec-implement-delta`, `/aw-spec-build`, `/aw-spec-analyze-slice`.
 
 ## Naming conventions
 

package/assets/docs/governance/dependency-policy.md

@@ -1,6 +1,6 @@
 # Dependency Policy
 
-> Pure technology (domain-agnostic) — domain package rules in [[dependency-policy.domain]]. Commands: `/aw-spec-plan`, `/aw-spec-implement`.
+> Pure technology (domain-agnostic) — domain package rules in [[dependency-policy.domain]]. Commands: `/aw-spec-implement`, `/aw-spec-implement-delta`.
 
 ## Package governance
 

package/assets/docs/requirement-spec.txt

@@ -1,4 +1,8 @@
-/aw-spec-specify MedicinalProduct/RegisterMedicinalProduct
+MedicinalProduct/
+
+/aw-spec-orch constitution @docs/pharma-constitution.md
+
+/aw-spec-orch specify RegisterMedicinalProduct
 
 Allow an authorized user to register a new medicinal product in the registry.
 
@@ -12,4 +16,12 @@ Acceptance:
 - A product missing a required attribute, an active ingredient, or a packaging configuration is rejected.
 - The creation is recorded in the audit trail.
 
+/aw-spec-orch design 
+
+/aw-spec-orch analyze-design
+
+/aw-spec-orch implement
+
+
+
 ==============================================================================================

package/assets/docs/security/auditing.md

@@ -1,6 +1,6 @@
 # Auditing & Observability Standards
 
-> Pure technology (domain-agnostic) — domain audit additions in [[auditing.domain]]. NON-NEGOTIABLE. Commands: `/aw-spec-plan`, `/aw-spec-tasks`, `/aw-spec-implement`.
+> Pure technology (domain-agnostic) — domain audit additions in [[auditing.domain]]. NON-NEGOTIABLE. Commands: `/aw-spec-design`.
 
 ## Observability baseline
 
@@ -39,14 +39,37 @@
 - Audit records are retained per the applicable retention policy (see [[persistence]];
   regulatory retention in [[auditing.domain]]).
 
-## Canonical example (agent reference — `<SampleProjectName>` sample)
+## Two auditing levels
+
+Auditing has exactly **two levels**, chosen **per aggregate** by the marker interfaces the root
+implements. The interceptor populates every audit field automatically (no manual
+`CreatedOn`/`ModifiedBy` assignment in handlers):
+
+| Level | Aggregate root implements | Captured | Depth |
+|-------|---------------------------|----------|-------|
+| **Basic** | `IAuditedObject` (creation+modification) or `IFullAuditedObject` (+soft-delete) | `CreatedBy/On`, `ModifiedBy/On`, `DeletedBy/On`; one `AuditLog` per root per SaveChanges | entity-level (Created/Updated/Deleted) — no before/after |
+| **Advanced** | Basic markers **+ `IFieldAudited`** | Basic + field-level before/after (`PropertyChange`: original → new) | entity + property-level previous/new |
 
-Aggregates opt into auditing by implementing the audit interfaces; the framework populates the
-fields automatically (no manual `CreatedOn`/`ModifiedBy` assignment in handlers):
+Field-level before/after values exist **only** at the Advanced tier. Children marked
+`IAggregateChild` fold into the root's `AuditLog`.
+
+## Canonical example (agent reference — `<SampleProjectName>` sample)
 
 ```csharp
-public class Project :
-    EntityBase<ProjectId>, IAggregateRoot,
+// Basic — lifecycle stamps only
+public sealed class Category :
+    AggregateRootBase<CategoryId>, IAggregateRoot,
+    IAuditedObject                                    // creation + modification
+{
+    public DateTimeOffset CreatedOn { get; set; }
+    public string CreatedBy { get; set; } = default!;
+    public DateTimeOffset? ModifiedOn { get; set; }
+    public string? ModifiedBy { get; set; }
+}
+
+// Advanced — full lifecycle + field-level (before/after) tracking
+public sealed class Project :
+    AggregateRootBase<ProjectId>, IAggregateRoot,
     IFullAuditedObject,   // ICreationAudited + IModificationAudited + IDeletionAudited
     IFieldAudited,        // opt-in to field-level (before/after) auditing
     ISoftDeletable, IConcurrencyTracked, IHasDomainEvents
@@ -69,15 +92,17 @@ The DbContext applies audit (plus soft-delete/tenant) behaviors centrally:
 modelBuilder.ApplyCrossCuttingBehaviors(this);   // wires audit interceptors + filters
 ```
 
-Composition — enable auditing on the repository stack and route audit records to a
-separate, append-only store (schema `Auditing`, prefix `Audit_`):
+Composition — enable auditing on the repository stack (one `EnableAdvancedAuditing()` registers
+the interceptor that serves **both** levels; per-aggregate level is decided by the interfaces
+above) and route audit records to a separate, append-only store (schema `Auditing`, prefix
+`Audit_`):
 
 ```csharp
 // <SampleProjectName>.Service/Extensions/InfrastructureServiceRegistration.cs
 services.AddRepositories(builder => builder
     .UseSingleDbContextEFRepositories<ApplicationDbContext>(/* ... */)
-    .EnableAuditing()
-    .EnableAdvancedAuditing()
+    .EnableSoftDelete()
+    .EnableAdvancedAuditing()                        // AdvancedAuditingSaveChangesInterceptor
     .Done(), o => o.Provider = "EfCore");
 
 services.AddDataStore(b => b.UseEfCoreDataStore(/* ... */), o =>
@@ -95,9 +120,27 @@ services.AddAuditing(b => b
         o.ExcludeShadowProperties = true;
     })
     .UseAppWeaverDataStore(),
-    o => { o.IsEnabled = true; o.EnableFieldLevelAuditing = true; });
+    o => { o.IsEnabled = true; o.EnableFieldLevelAuditing = true; });   // field-level = Advanced
 ```
 
+## Querying the audit trail (framework-provided)
+
+The audit store is queryable out of the box via `IAuditEntity` — no bespoke read model required:
+
+```csharp
+// by resource identity
+var logs = await auditEntity.GetAuditLogsAsync(typeof(Project).FullName!, projectId.ToString());
+// by user / action / time, with paging
+var page = await auditEntity.GetAuditLogsAsync(new AuditLogFilter { UserId = "u1", Action = AuditAction.Updated, Take = 10 });
+// by user / tenant
+await auditEntity.GetAuditLogsByUserAsync("u1");
+await auditEntity.GetAuditLogsByTenantAsync("tenant-alpha");
+```
+
+Each `AuditLog` carries `{ UserId, UserName, Timestamp, Action, EntityType, EntityId, Metadata
+(correlationId, …) }`; its `EntityChanges` hold entity-level `ChangeType`, and — for `IFieldAudited`
+roots — nested `PropertyChanges` with `OriginalValue → NewValue`.
+
 Observability baseline — `ServiceDefaults` (OTel + Serilog + health) wired once in `Program.cs`:
 
 ```csharp

package/assets/docs/security/authorization.md

@@ -1,6 +1,6 @@
 # Authorization Standards
 
-> Pure technology (domain-agnostic) — domain roles & matrix in [[authorization.domain]]. NON-NEGOTIABLE. Commands: `/aw-spec-plan`, `/aw-spec-tasks`, `/aw-spec-implement`.
+> Pure technology (domain-agnostic) — domain roles & matrix in [[authorization.domain]]. NON-NEGOTIABLE. Commands: `/aw-spec-design`.
 
 ## Authorization model
 

package/assets/docs/security/data-classification.md

@@ -1,6 +1,6 @@
 # Data Classification Standards
 
-> Pure technology (domain-agnostic) — domain data categories in [[data-classification.domain]]. NON-NEGOTIABLE. Commands: `/aw-spec-specify`, `/aw-spec-plan`, `/aw-spec-implement`.
+> Pure technology (domain-agnostic) — domain data categories in [[data-classification.domain]]. NON-NEGOTIABLE. Commands: `/aw-spec-design`.
 
 ## Classification framework
 

package/assets/docs/security/zero-trust.md

@@ -1,6 +1,6 @@
 # Zero-Trust Standards
 
-> Pure technology (domain-agnostic) — domain additions in [[zero-trust.domain]]. NON-NEGOTIABLE where marked. Commands: `/aw-spec-plan`, `/aw-spec-implement`.
+> Pure technology (domain-agnostic) — domain additions in [[zero-trust.domain]]. NON-NEGOTIABLE where marked. Commands: `/aw-spec-design`.
 
 ## Transport security (mTLS / TLS)
 

package/dist/commands/update.d.ts

@@ -0,0 +1,3 @@
+import { Command } from 'commander';
+export declare const updateCommand: Command;
+//# sourceMappingURL=update.d.ts.map

package/dist/commands/update.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../../src/commands/update.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAsBpC,eAAO,MAAM,aAAa,SA6ItB,CAAC"}

package/dist/commands/update.js

@@ -0,0 +1,142 @@
+import { Command } from 'commander';
+import inquirer from 'inquirer';
+import chalk from 'chalk';
+import fs from 'fs-extra';
+import path from 'path';
+import { fileURLToPath } from 'url';
+import { resolveAssetsPath } from '../utils/paths.js';
+import { readManifest, updateManifest } from '../utils/manifest.js';
+import { buildUpdatePlan, applyUpdatePlan } from '../utils/update-engine.js';
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const AGENT_FOLDER_MAP = {
+    claude: '.claude',
+    antigravity: '.agents',
+    kilocode: '.kilocode',
+};
+const ALWAYS_COPY = ['.aw-spec', 'docs'];
+export const updateCommand = new Command('update')
+    .description('Update an existing AppWeaver Spec project with latest assets from registry')
+    .argument('[directory]', 'Target directory (default: current directory)', '.')
+    .option('-a, --agent <agent>', 'Agent to use: claude, antigravity, kilocode (detected from manifest if not specified)')
+    .option('-y, --yes', 'Skip prompts and apply non-conflicting updates automatically')
+    .option('--dry-run', 'Show what would be updated without making changes')
+    .action(async (directory, options) => {
+    const targetDir = directory === '.' ? process.cwd() : directory;
+    const manifestPath = path.join(targetDir, '.aw-spec', 'manifest.json');
+    console.log(`\n🔄 Checking for updates in: ${targetDir}\n`);
+    // Load existing manifest
+    const manifest = await readManifest(manifestPath);
+    if (!manifest) {
+        console.log(chalk.red('✗ No manifest found. This project was not initialized with aw-spec or is from an older version.'));
+        console.log(chalk.yellow('  Run `aw-spec init` to initialize a new project.'));
+        process.exit(1);
+    }
+    console.log(chalk.gray(`  Current version: ${manifest.version}`));
+    console.log(chalk.gray(`  Last updated: ${manifest.updatedAt}`));
+    console.log(chalk.gray(`  Tracked files: ${Object.keys(manifest.files).length}`));
+    // Determine agent from manifest or options
+    let agent = options.agent;
+    if (agent === 'prompt') {
+        // Try to detect from init-options.json
+        const initOptionsPath = path.join(targetDir, '.aw-spec', 'init-options.json');
+        if (await fs.pathExists(initOptionsPath)) {
+            try {
+                const initOptions = await fs.readJSON(initOptionsPath);
+                if (initOptions.ai && ['claude', 'antigravity', 'kilocode'].includes(initOptions.ai)) {
+                    agent = initOptions.ai;
+                    console.log(chalk.gray(`  Detected agent from init-options: ${agent}`));
+                }
+            }
+            catch {
+                // Ignore parse errors
+            }
+        }
+    }
+    // If still not determined, prompt
+    if (agent === 'prompt') {
+        if (options.yes) {
+            agent = 'claude';
+        }
+        else {
+            const { selectedAgent } = await inquirer.prompt([
+                {
+                    type: 'list',
+                    name: 'selectedAgent',
+                    message: 'Which agent skills should be updated?',
+                    choices: [
+                        { name: 'Claude Code (.claude/skills)', value: 'claude' },
+                        { name: 'Antigravity (.agents/skills)', value: 'antigravity' },
+                        { name: 'KiloCode (.kilocode/skills)', value: 'kilocode' },
+                    ],
+                    default: 'claude',
+                },
+            ]);
+            agent = selectedAgent;
+        }
+    }
+    const agentFolder = AGENT_FOLDER_MAP[agent];
+    // Resolve new assets from registry
+    const assetsPath = await resolveAssetsPath();
+    console.log(chalk.gray(`  Source assets: ${assetsPath}`));
+    if (options.dryRun) {
+        console.log('\n📋 Dry run - checking for updates...\n');
+    }
+    // Build update plan
+    console.log(chalk.bold('\n📊 Analyzing changes...\n'));
+    const plan = await buildUpdatePlan(manifest.files, targetDir, assetsPath);
+    // Print summary
+    console.log(chalk.bold('\n📋 Update Plan:'));
+    console.log(chalk.green(`  Update: ${plan.summary.update}`));
+    console.log(chalk.blue(`  Add: ${plan.summary.add}`));
+    console.log(chalk.yellow(`  Preserve: ${plan.summary.preserve}`));
+    console.log(chalk.red(`  Skip (conflicts): ${plan.summary.skip}`));
+    console.log(chalk.gray(`  Remove: ${plan.summary.remove}`));
+    if (plan.summary.skip > 0) {
+        console.log(chalk.yellow('\n⚠️  Conflicts detected - these files have both user and upstream changes:'));
+        for (const file of plan.files.filter(f => f.disposition === 'skip')) {
+            console.log(chalk.yellow(`  ⚠ ${file.relPath} - ${file.reason}`));
+        }
+        console.log(chalk.yellow('\n  These files will be skipped. Resolve manually after update.'));
+    }
+    if (plan.summary.preserve > 0) {
+        console.log(chalk.blue('\nℹ️  User-modified files preserved:'));
+        for (const file of plan.files.filter(f => f.disposition === 'preserve')) {
+            console.log(chalk.blue(`  ⊘ ${file.relPath} - ${file.reason}`));
+        }
+    }
+    if (options.dryRun) {
+        console.log(chalk.bold('\n🔍 Dry run complete - no changes made.'));
+        return;
+    }
+    // Confirm before applying if not --yes
+    if (!options.yes && (plan.summary.update > 0 || plan.summary.add > 0 || plan.summary.remove > 0)) {
+        const { confirm } = await inquirer.prompt([
+            {
+                type: 'confirm',
+                name: 'confirm',
+                message: 'Apply these updates?',
+                default: true,
+            },
+        ]);
+        if (!confirm) {
+            console.log(chalk.gray('\nUpdate cancelled.'));
+            return;
+        }
+    }
+    // Apply update plan
+    console.log(chalk.bold('\n📦 Applying updates...\n'));
+    await applyUpdatePlan(plan, targetDir, assetsPath, {
+        onProgress: (msg) => console.log(msg),
+    });
+    // Update manifest with new state
+    console.log(chalk.bold('\n📝 Updating manifest...'));
+    const newManifest = await updateManifest(manifestPath, targetDir, manifest.version);
+    console.log(chalk.green(`  ✓ Manifest updated (${Object.keys(newManifest.files).length} files tracked)`));
+    console.log(chalk.bold('\n✅ Update complete!'));
+    console.log('\nNext steps:');
+    console.log('  aw-spec doctor    # Verify the installation');
+    if (plan.summary.skip > 0) {
+        console.log(chalk.yellow('  Review skipped files and resolve conflicts manually'));
+    }
+});
+//# sourceMappingURL=update.js.map