bmad-method-test-architecture-enterprise 2.0.4-next.2 → 2.0.4-next.3

package/.claude-plugin/marketplace.json

@@ -31,7 +31,7 @@
       "name": "bmad-method-test-architecture-enterprise",
       "source": "./",
       "description": "Master Test Architect module for quality strategy, test generation in red and expand modes with automatic run-and-heal, combined framework and CI setup, CI/CD quality gates, and structured testing education. The CI and ATDD commands remain available with existing customizations. Part of the BMad Method ecosystem.",
-      "version": "2.0.4-next.2",
+      "version": "2.0.4-next.3",
       "author": {
         "name": "Murat K Ozcan (TEA Creator) & Brian (BMad) Madison"
       },

package/cli/lib/evaluate/http-target.js

@@ -699,19 +699,38 @@ async function deploymentAccess({
   return { origins, authorizations };
 }
 
-/** A port the system gives out now, free on every address, released for the server to take. */
-function freePort() {
+/** Tries a port on one address, then releases it for the target; a busy candidate returns null. */
+function availablePort(port, address, createServer) {
   return new Promise((resolve, reject) => {
-    const server = net.createServer();
+    const server = createServer();
     server.unref();
-    server.once('error', reject);
-    server.listen(0, () => {
-      const { port } = server.address();
-      server.close(() => resolve(port));
+    server.once('error', (error) => (error.code === 'EADDRINUSE' ? resolve(null) : reject(error)));
+    server.listen(port, address, () => {
+      const selected = server.address().port;
+      server.close(() => resolve(selected));
     });
   });
 }
 
+/** A port available on every address the policy may select, released for the server to take. */
+async function freePort(addresses, createServer = () => net.createServer()) {
+  const distinct = [...new Set(addresses.map((address) => canonicalAddress(address) ?? address))];
+  if (distinct.length === 0) throw new Error('a started server has no authorized address');
+  for (let attempt = 0; attempt < 32; attempt += 1) {
+    const candidate = await availablePort(0, distinct[0], createServer);
+    if (candidate === null) continue;
+    let available = true;
+    for (const address of distinct.slice(1)) {
+      if ((await availablePort(candidate, address, createServer)) === null) {
+        available = false;
+        break;
+      }
+    }
+    if (available) return candidate;
+  }
+  throw new Error(`could not find a free port on ${distinct.join(', ')}`);
+}
+
 /**
  * Whether `address:port` accepts a connection now: `true`, or why the attempt
  * failed (the socket error's code, `ECONNREFUSED` while nothing listens, or
@@ -1207,7 +1226,7 @@ function createApiPort({ entries, httpPort, cwd, targetOf, readEnvironment, mech
         // A server behind a bridge gets a private directory for the Unix socket its shim serves, which only that call's
         // server may write; it joins the scratch list like the port directory.
         if (launched !== null && mechanism.bridges === true) bridgeDirectory = makeBridgeDirectory(scratch);
-        const launchedPort = launched === null || reports ? null : await freePort();
+        const launchedPort = launched === null || reports ? null : await freePort(launched.addresses);
         const configurationAt = (port) =>
           portConfiguration({
             entries,
@@ -1397,6 +1416,7 @@ module.exports = {
   defaultPortOf,
   deploymentAccess,
   deploymentAuthorizations,
+  freePort,
   httpPortFile,
   isApiEntry,
   makeBridgeDirectory,

package/cli/lib/nfr-report.js

@@ -0,0 +1,432 @@
+/** Validate the actual NFR workflow context against supplied sources and its report. */
+'use strict';
+const fs = require('node:fs');
+const path = require('node:path');
+const yaml = require('js-yaml');
+const MarkdownIt = require('markdown-it');
+const { WorkflowError } = require('./workflow-cli');
+const DOMAINS = ['security', 'performance', 'reliability', 'maintainability'];
+const STATUSES = new Set(['PASS', 'CONCERNS', 'FAIL', 'N/A']);
+const STEPS = [
+  'step-01-load-context',
+  'step-02-define-thresholds',
+  'step-03-gather-evidence',
+  'step-04e-aggregate-nfr',
+  'step-05-generate-report',
+];
+/** Reject a report field with the parser failure class used by the CLI. */
+const bad = (message) => {
+  throw new WorkflowError('environment-parser', message);
+};
+/** Collapse whitespace so quoted observations survive line wrapping. */
+const normalized = (value) => String(value).replaceAll(/\s+/g, ' ').trim();
+/** Compare ADR category labels across spaces, hyphens and capitalization. */
+const categoryLabel = (value) =>
+  value
+    .toLowerCase()
+    .replaceAll(/[-\s]+/g, ' ')
+    .trim();
+/** Compare canonical context values after JSON serialization. */
+const same = (left, right) => JSON.stringify(left) === JSON.stringify(right);
+const markdown = new MarkdownIt({ html: true });
+const DECORATIONS = { PASS: ['✅', '✔', '✔️'], CONCERNS: ['⚠', '⚠️'], FAIL: ['❌', '✖', '✖️'], 'N/A': ['➖'] };
+/** Read visible inline text, preserving code excerpts while discarding formatting delimiters. */
+function inlineText(token) {
+  return (token?.children || [])
+    .filter((child) => ['text', 'code_inline'].includes(child.type))
+    .map((child) => child.content)
+    .join('')
+    .trim();
+}
+/** Normalize one complete display enum with an optional matching approved decoration. */
+function displayStatus(value) {
+  const match = String(value)
+    .trim()
+    .match(/^(PASS|CONCERNS|FAIL|N\/A)(?:[ \t]+(\S+))?$/i);
+  if (!match) bad('report status must contain one complete enum and an optional approved decoration');
+  const status = match[1].toUpperCase();
+  if (match[2] && !DECORATIONS[status].includes(match[2])) bad('report status decoration contradicts or ambiguously labels its enum');
+  return status;
+}
+/** Preserve a quoted source excerpt when Markdown renders it as a single inline code value. */
+function literalValue(value) {
+  const blocks = markdown.parse(value, {});
+  if (blocks.length === 1 && blocks[0].type === 'fence') return blocks[0].content.trim();
+  const children = markdown.parseInline(value, {})[0]?.children || [];
+  return children.length === 1 && children[0].type === 'code_inline' ? children[0].content : value;
+}
+/** Preserve one or more complete fenced source quotations as separate actual observations. */
+function actualValues(value) {
+  const blocks = markdown.parse(value, {});
+  if (blocks.length > 0 && blocks.every((token) => token.type === 'fence')) return blocks.map((token) => token.content.trim());
+  return [literalValue(value)];
+}
+/** The workflow's worst-status rollup excludes nonapplicable domains. */
+function worst(values) {
+  if (values.includes('FAIL')) return 'FAIL';
+  if (values.includes('CONCERNS')) return 'CONCERNS';
+  return values.includes('PASS') ? 'PASS' : 'N/A';
+}
+/** Stable criterion identity defined by NFR step02. */
+function criterionId(domain, label) {
+  return `${domain}-${label}`
+    .toLowerCase()
+    .replaceAll(/[^a-z0-9]+/g, '-')
+    .replaceAll(/^-+|-+$/g, '');
+}
+/** Parse YAML without silently accepting duplicate keys or extra documents. */
+function parseYaml(text, label) {
+  try {
+    return yaml.load(text);
+  } catch (error) {
+    bad(`invalid ${label} YAML: ${error.message}`);
+  }
+}
+/** Read canonical project-relative files from their explicit input role. */
+function sourceText(reference, projectRoot, sources, label) {
+  if (
+    typeof reference !== 'string' ||
+    !reference ||
+    path.isAbsolute(reference) ||
+    reference.includes('\\') ||
+    path.posix.normalize(reference) !== reference ||
+    reference.startsWith('../') ||
+    reference.startsWith('./')
+  )
+    bad(`${label} must name a canonical project-relative supplied path`);
+  const file = path.join(projectRoot, reference);
+  if (!sources.includes(file)) bad(`${label} is outside its supplied input role: ${reference}`);
+  return normalized(fs.readFileSync(file, 'utf8'));
+}
+/** Require an actual source excerpt, while allowing normalized line wrapping. */
+function excerpt(value, source, label) {
+  if (typeof value !== 'string' || !normalized(value) || !source.includes(normalized(value)))
+    bad(`${label} is not a quotation from its supplied source`);
+}
+/** Extract populated Markdown sections without matching headings inside fenced examples. */
+function sections(text, level) {
+  const lines = text.split(/\r?\n/);
+  const tokens = markdown.parse(text, {});
+  const headings = tokens.flatMap((token, index) => {
+    if (token.type !== 'heading_open' || token.level !== 0 || !token.map) return [];
+    const label = inlineText(tokens[index + 1]);
+    return [{ level: Number(token.tag.slice(1)), label, start: token.map[0], end: token.map[1] }];
+  });
+  return headings
+    .filter((heading) => heading.level === level)
+    .map((heading) => {
+      const next = headings.find((other) => other.start > heading.start && other.level <= level);
+      return { label: heading.label, body: lines.slice(heading.end, next?.start ?? lines.length).join('\n') };
+    });
+}
+/** Remove literal block examples before interpreting bold report fields. */
+function reportFields(text) {
+  const lines = text.split(/\r?\n/);
+  for (const token of markdown.parse(text, {})) {
+    if (['fence', 'code_block', 'html_block'].includes(token.type) && token.map)
+      for (let line = token.map[0]; line < token.map[1]; line++) lines[line] = lines[line].replaceAll(/[^\n]/g, ' ');
+  }
+  return lines.join('\n');
+}
+/** Read a unique bold report field, including multiline evidence lists. */
+function field(body, name) {
+  const expression = new RegExp(
+    `^[ \\t]*(?:-[ \\t]+)?\\*\\*${name}:?\\*\\*[ \\t]*:?[ \\t]*([^]*?)(?=^[ \\t]*(?:-[ \\t]+)?\\*\\*[A-Za-z]|$(?![\\s\\S]))`,
+    'gim',
+  );
+  const values = [...reportFields(body).matchAll(expression)].map((match) => {
+    const start = match.index + match[0].length - match[1].length;
+    return body.slice(start, match.index + match[0].length).trim();
+  });
+  if (values.length !== 1 || !values[0]) bad(`criterion must contain exactly one populated ${name} field`);
+  return values[0];
+}
+/** Validate the fresh canonical context, exact ledger bindings, report and gate together. */
+function readNfrReport(text, context, request) {
+  const { projectRoot, runScope, runKey, requestId, inputs, evidenceFiles } = request;
+  if (
+    !context ||
+    context.schemaVersion !== 1 ||
+    context.requestId !== requestId ||
+    context.runScope !== runScope ||
+    context.runKey !== runKey ||
+    context.supplied_project_root !== projectRoot
+  )
+    bad('the NFR context does not belong to the requested attempt and scope');
+  if (
+    !same(Object.keys(context.declared_nfr_criteria || {}).sort(), [...DOMAINS].sort()) ||
+    !same(Object.keys(context.domain_assessments || {}).sort(), [...DOMAINS].sort())
+  )
+    bad('context must carry exactly the four audited domains');
+  const criteria = new Map();
+  const validateCriterion = (criterion, domain, previousOrder) => {
+    if (
+      !criterion ||
+      typeof criterion.label !== 'string' ||
+      !criterion.label.trim() ||
+      criterion.id !== criterionId(domain, criterion.label) ||
+      !Number.isSafeInteger(criterion.order) ||
+      criterion.order <= previousOrder ||
+      criteria.has(criterion.id)
+    )
+      bad(`invalid criterion identity or source order in ${domain}`);
+    const source = sourceText(criterion.threshold_source, projectRoot, inputs, 'threshold source');
+    if (criterion.threshold !== 'UNKNOWN') excerpt(criterion.threshold, source, `${criterion.id} threshold`);
+    criteria.set(criterion.id, { ...criterion, domain });
+    return criterion.order;
+  };
+  for (const domain of DOMAINS) {
+    if (!Array.isArray(context.declared_nfr_criteria[domain])) bad(`invalid declared criteria for ${domain}`);
+    let order = -1;
+    for (const criterion of context.declared_nfr_criteria[domain]) order = validateCriterion(criterion, domain, order);
+  }
+  if (!Array.isArray(context.recorded_only_nfr_criteria))
+    bad('context must include recorded-only criteria, including an empty list when none were declared');
+  const recorded = new Set();
+  let recordedOrder = -1;
+  for (const criterion of context.recorded_only_nfr_criteria) {
+    if (DOMAINS.includes(criterion.domain) || typeof criterion.domain !== 'string' || criterion.assessment_mode !== 'recorded-only')
+      bad('recorded-only criteria cannot create audited domains');
+    recordedOrder = validateCriterion(criterion, criterion.domain, recordedOrder);
+    recorded.add(criterion.id);
+  }
+  if (!Array.isArray(context.supplied_evidence_ledger)) bad('context is missing the supplied evidence ledger');
+  const observations = new Map();
+  let lastPath = '';
+  for (const entry of context.supplied_evidence_ledger) {
+    if (
+      !entry ||
+      entry.source !== 'supplied' ||
+      entry.source_type !== 'implementation-evidence' ||
+      typeof entry.path !== 'string' ||
+      entry.path <= lastPath ||
+      !Array.isArray(entry.observations) ||
+      entry.observations.length === 0
+    )
+      bad('invalid or unsorted supplied evidence ledger');
+    lastPath = entry.path;
+    const source = sourceText(entry.path, projectRoot, evidenceFiles, 'implementation evidence');
+    let previous = '';
+    for (const observation of entry.observations) {
+      if (!observation || !criteria.has(observation.criterion_id) || recorded.has(observation.criterion_id))
+        bad('ledger observation has an undeclared audited criterion');
+      excerpt(observation.supports, source, `${observation.criterion_id} observation`);
+      const key = `${observation.criterion_id}\0${observation.supports}`;
+      if (key <= previous) bad('ledger observations must be deduplicated and sorted');
+      previous = key;
+      const bound = observations.get(observation.criterion_id) || [];
+      bound.push({ path: entry.path, supports: observation.supports });
+      observations.set(observation.criterion_id, bound);
+    }
+    const expectedDomains = DOMAINS.filter((domain) =>
+      entry.observations.some((observation) => criteria.get(observation.criterion_id).domain === domain),
+    );
+    if (!same(entry.domains, expectedDomains)) bad('ledger domain bindings contradict its criterion observations');
+  }
+  const frontmatter = text.match(/^---\r?\n([\s\S]*?)\r?\n---(?:\r?\n|$)/);
+  if (!frontmatter) bad('the report is missing progress frontmatter');
+  const progress = parseYaml(frontmatter[1], 'progress');
+  const optionalSteps = [
+    'step-04-evaluate-and-score',
+    'step-04a-subagent-security',
+    'step-04b-subagent-performance',
+    'step-04c-subagent-reliability',
+    'step-04d-subagent-maintainability',
+  ];
+  const completed = progress?.stepsCompleted;
+  const requiredSequence = Array.isArray(completed) ? completed.filter((step) => STEPS.includes(step)) : [];
+  const validSteps =
+    Array.isArray(completed) &&
+    new Set(completed).size === completed.length &&
+    completed.every((step) => STEPS.includes(step) || optionalSteps.includes(step)) &&
+    optionalSteps.every(
+      (step) =>
+        !completed.includes(step) ||
+        (completed.indexOf(step) > completed.indexOf(STEPS[2]) && completed.indexOf(step) < completed.indexOf(STEPS[3])),
+    );
+  if (
+    progress?.workflowStatus !== 'completed' ||
+    progress.runScope !== runScope ||
+    progress.runKey !== runKey ||
+    progress.lastStep !== STEPS.at(-1) ||
+    !validSteps ||
+    !same(requiredSequence, STEPS) ||
+    !(typeof progress.lastSaved === 'string' || progress.lastSaved instanceof Date) ||
+    !Number.isFinite(Date.parse(progress.lastSaved))
+  )
+    bad('the report checkpoint does not confirm this completed run');
+  const gates = [];
+  const reportBody = text.slice(frontmatter[0].length);
+  for (const token of markdown.parse(reportBody, {})) {
+    if (token.type !== 'fence' || token.level !== 0 || !['yaml', 'yml'].includes(token.info.trim().toLowerCase())) continue;
+    const value = parseYaml(token.content, 'gate');
+    if (value && Object.hasOwn(value, 'nfr_assessment')) gates.push(value.nfr_assessment);
+  }
+  if (gates.length !== 1) bad('report must carry exactly one nfr_assessment gate');
+  const gate = gates[0];
+  if (!gate || !same(Object.keys(gate.audited_domains || {}).sort(), [...DOMAINS].sort()) || !STATUSES.has(gate.overall_status))
+    bad('gate must declare exactly four audited domains and a valid overall status');
+  if (
+    typeof gate.blockers !== 'boolean' ||
+    ['critical_issues', 'high_priority_issues', 'medium_priority_issues', 'concerns', 'evidence_gaps'].some(
+      (key) => !Number.isSafeInteger(gate[key]) || gate[key] < 0,
+    )
+  )
+    bad('gate issue counts and blockers flag must be typed');
+  const reportSections = sections(reportBody, 2);
+  for (const name of [
+    'Executive Summary',
+    'Quick Wins',
+    'Recommended Actions',
+    'Monitoring Hooks',
+    'Fail-Fast Mechanisms',
+    'Evidence Gaps',
+    'Findings Summary',
+    'Gate YAML Snippet',
+    'Related Artifacts',
+    'Recommendations Summary',
+    'Sign-Off',
+  ]) {
+    const matches = reportSections.filter((section) => section.label === name);
+    if (
+      matches.length !== 1 ||
+      !matches[0].body
+        .replaceAll(/<!--[^]*?-->/g, '')
+        .replaceAll(/^#{1,6}[^\n]*$/gm, '')
+        .trim()
+    )
+      bad(`report requires one populated ${name} section`);
+  }
+  let concerns = 0;
+  let gaps = 0;
+  for (const domain of DOMAINS) {
+    const domainSections = reportSections.filter((section) => section.label.toLowerCase() === `${domain} assessment`);
+    if (domainSections.length !== 1) bad(`report requires exactly one ${domain} Assessment`);
+    const section = domainSections[0];
+    const expected = context.declared_nfr_criteria[domain];
+    const assessment = context.domain_assessments[domain];
+    if (
+      !assessment ||
+      !Array.isArray(assessment.findings) ||
+      !same(
+        assessment.findings.map((finding) => finding.criterion_id),
+        expected.map((criterion) => criterion.id),
+      )
+    )
+      bad(`${domain} findings omit or add declared criteria`);
+    const reportFindings = sections(section.body, 3);
+    if (
+      !same(
+        reportFindings.map((finding) => finding.label),
+        expected.map((criterion) => criterion.label),
+      )
+    )
+      bad(`${domain} report headings omit, duplicate or add declared criteria`);
+    const expectedGaps = [];
+    for (const [index, criterion] of expected.entries()) {
+      const finding = assessment.findings[index];
+      const evidence = observations.get(criterion.id) || [];
+      if (!STATUSES.has(finding.status) || !same(finding.evidence, evidence))
+        bad(`${criterion.id} status or evidence contradicts the canonical ledger`);
+      if ((evidence.length === 0 || criterion.threshold === 'UNKNOWN') && finding.status !== 'CONCERNS')
+        bad(`${criterion.id} requires CONCERNS for unknown thresholds or missing evidence`);
+      if (evidence.length === 0)
+        expectedGaps.push({ criterion_id: criterion.id, message: `${criterion.label}: no supplied implementation evidence` });
+      if (criterion.threshold === 'UNKNOWN' && evidence.length > 0)
+        expectedGaps.push({ criterion_id: criterion.id, message: `${criterion.label}: UNKNOWN threshold` });
+      const body = reportFindings[index].body;
+      if (
+        displayStatus(field(body, 'Status')) !== finding.status ||
+        normalized(literalValue(field(body, 'Threshold'))) !== normalized(criterion.threshold) ||
+        field(body, 'Threshold Source') !== `\`${criterion.threshold_source}\``
+      )
+        bad(`${criterion.id} report fields contradict its canonical criterion`);
+      const actual = actualValues(field(body, 'Actual'));
+      if (finding.status === 'PASS' && actual.includes('UNKNOWN')) bad(`${criterion.id} claims PASS without a known actual measurement`);
+      for (const observation of actual) {
+        if (
+          !normalized(observation) ||
+          (observation !== 'UNKNOWN' &&
+            !evidence.some((entry) =>
+              sourceText(entry.path, projectRoot, evidenceFiles, 'actual evidence').includes(normalized(observation)),
+            ))
+        )
+          bad(`${criterion.id} actual is unsupported by supplied evidence`);
+      }
+      const evidenceText = field(body, 'Evidence');
+      const paths = [...evidenceText.matchAll(/`([^`]+)`/g)].map((match) => match[1]);
+      if (!same([...new Set(paths)], [...new Set(evidence.map((entry) => entry.path))]))
+        bad(`${criterion.id} report evidence paths contradict the canonical ledger`);
+      const supports = field(body, 'Supports');
+      for (const entry of evidence)
+        if (!normalized(supports).includes(normalized(entry.supports))) bad(`${criterion.id} report omits a bound observation`);
+      if (evidence.length === 0 && (evidenceText !== 'None' || supports !== 'None' || !same(actual, ['UNKNOWN'])))
+        bad(`${criterion.id} claims unsupported implementation evidence`);
+      concerns += finding.status === 'CONCERNS' ? 1 : 0;
+    }
+    const displayedGaps = Array.isArray(assessment.evidence_gaps)
+      ? assessment.evidence_gaps.map((gap) => {
+          const criterion = criteria.get(gap.criterion_id);
+          if (criterion?.threshold === 'UNKNOWN' && gap.message === `${criterion.label}: UNKNOWN threshold gap`)
+            return { ...gap, message: `${criterion.label}: UNKNOWN threshold` };
+          return gap;
+        })
+      : assessment.evidence_gaps;
+    if (!same(displayedGaps, expectedGaps)) bad(`${domain} evidence gaps contradict its declared criteria`);
+    gaps += expectedGaps.length;
+    const status = worst(assessment.findings.map((finding) => finding.status));
+    const firstFinding = markdown
+      .parse(section.body, {})
+      .find((token) => token.type === 'heading_open' && token.level === 0 && token.tag === 'h3');
+    const prelude = reportFields(section.body.split(/\r?\n/).slice(0, firstFinding?.map?.[0]).join('\n'));
+    const domainStatuses = [...prelude.matchAll(/^[ \t]*(?:-[ \t]+)?\*\*(?:Domain )?Status:?\*\*[ \t]*:?[ \t]*([^\n]+)$/gim)].map((match) =>
+      displayStatus(match[1]),
+    );
+    const domainStatus = domainStatuses.length === 1 ? domainStatuses[0] : null;
+    if (assessment.status !== status || domainStatus !== status || gate.audited_domains[domain] !== status)
+      bad(`${domain} status contradicts its finding rollup`);
+  }
+  if (
+    gate.overall_status !== worst(Object.values(gate.audited_domains)) ||
+    gate.concerns !== concerns ||
+    gate.evidence_gaps !== gaps ||
+    gate.blockers !== (gate.overall_status === 'FAIL')
+  )
+    bad('gate overall status or counts contradict the normalized audit');
+  const tables = reportSections.filter((section) => section.label === 'Recorded-Only NFR Criteria');
+  if (tables.length > 1 || (recorded.size > 0 && tables.length !== 1)) bad('declared recorded-only criteria require one report table');
+  if (tables.length === 1) {
+    const tokens = markdown.parse(tables[0].body, {});
+    const rows = [];
+    let row;
+    for (const [index, token] of tokens.entries()) {
+      if (token.type === 'tr_open') {
+        row = [];
+        // Markdown silently drops cells beyond the header width. Keep those extras invalid.
+        const raw = tables[0].body
+          .split(/\r?\n/)
+          .slice(...token.map)
+          .join('\n')
+          .trim();
+        const cells = raw.split(/(?<!\\)(?:\\\\)*\|/);
+        const count = cells.length - (cells[0].trim() === '' ? 1 : 0) - (cells.at(-1).trim() === '' ? 1 : 0);
+        if (count !== 6) bad('recorded-only table must contain exactly six cells per row');
+      }
+      if (token.type === 'td_open') row?.push(inlineText(tokens[index + 1]));
+      if (token.type === 'tr_close' && row?.length > 0) rows.push(row);
+    }
+    // Categories are display labels; their identity remains the canonical criterion ID.
+    for (const row of rows) if (typeof row[1] === 'string') row[1] = categoryLabel(row[1]);
+    const expectedRows = context.recorded_only_nfr_criteria.map((criterion) => [
+      criterion.id,
+      categoryLabel(criterion.domain),
+      criterion.label,
+      criterion.threshold,
+      criterion.threshold_source,
+      'RECORDED ONLY',
+    ]);
+    if (!same(rows, expectedRows)) bad('recorded-only table adds, omits, reorders or assesses criteria');
+  }
+  return { status: gate.overall_status, gate, progress, context };
+}
+module.exports = { readNfrReport, criterionId, worst, DOMAINS };

package/cli/lib/workflow-publication.js

@@ -0,0 +1,170 @@
+/** Source preservation and transactional publication for evidence audit workflows. */
+'use strict';
+const fs = require('node:fs');
+const path = require('node:path');
+const crypto = require('node:crypto');
+const { WorkflowError, projectPath } = require('./workflow-cli');
+
+/** Compare both canonical paths and existing inode aliases. */
+function aliases(left, right) {
+  if (left === right) return true;
+  if (!fs.existsSync(left) || !fs.existsSync(right)) return false;
+  const a = fs.statSync(left);
+  const b = fs.statSync(right);
+  return a.dev === b.dev && a.ino === b.ino;
+}
+/** Test a canonical directory boundary. */
+function within(root, candidate) {
+  const relative = path.relative(root, candidate);
+  return relative === '' || (relative !== '..' && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative));
+}
+/** Inventory supplied directories, including symlink topology, without traversing cycles. */
+function inventory(projectRoot, values) {
+  const files = new Set();
+  const directories = new Set();
+  const topology = [];
+  const visited = new Set();
+  function walk(value) {
+    const lexical = path.resolve(projectRoot, value);
+    const target = projectPath(projectRoot, value, 'supplied source');
+    const link = fs.lstatSync(lexical);
+    const stat = fs.statSync(target);
+    topology.push([lexical, link.isSymbolicLink() ? fs.readlinkSync(lexical) : '', target, stat.dev, stat.ino, link.mode, stat.mode]);
+    if (stat.isFile()) files.add(target);
+    else if (stat.isDirectory()) {
+      directories.add(target);
+      if (visited.has(target)) return;
+      visited.add(target);
+      for (const entry of fs.readdirSync(target).sort()) {
+        if (['.git', 'node_modules'].includes(entry)) continue;
+        walk(path.join(target, entry));
+      }
+    } else throw new WorkflowError('usage', 'supplied sources must contain regular files or directories');
+  }
+  try {
+    for (const value of values) walk(value);
+  } catch (error) {
+    throw error instanceof WorkflowError
+      ? error
+      : new WorkflowError('usage', `unreadable supplied source: ${error.message}`, { cause: error });
+  }
+  return { files: [...files].sort(), directories: [...directories].sort(), topology: topology.sort((a, b) => a[0].localeCompare(b[0])) };
+}
+/** Freeze both source bytes and supplied directory membership. */
+function protectSources(projectRoot, values) {
+  const state = inventory(projectRoot, values);
+  const digests = state.files.map((file) => [file, crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex')]);
+  return {
+    ...state,
+    assertUnchanged() {
+      try {
+        const current = inventory(projectRoot, values);
+        if (JSON.stringify(current) !== JSON.stringify(state)) throw new Error('source topology changed');
+        for (const [file, digest] of digests) {
+          if (crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex') !== digest) throw new Error(file);
+        }
+      } catch (error) {
+        throw new WorkflowError('environment-parser', `the agent changed a supplied source: ${error.message}`, { cause: error });
+      }
+    },
+  };
+}
+/** Reject output destinations sharing source paths, inodes, or supplied directory descendants. */
+function protectPublication(projectRoot, destinations, protection) {
+  const canonical = destinations.map((file) => projectPath(projectRoot, file, 'output destination'));
+  if (
+    canonical.some(
+      (file) => protection.files.some((input) => aliases(file, input)) || protection.directories.some((dir) => within(dir, file)),
+    )
+  )
+    throw new WorkflowError('usage', 'output destinations overlap supplied sources; select separate output and evidence directories');
+  if (canonical.some((file, index) => canonical.slice(0, index).some((other) => aliases(file, other))))
+    throw new WorkflowError('usage', 'output destinations alias each other');
+  return canonical;
+}
+/** Read only a new regular file from the current attempt. */
+function freshArtifact(attemptDir, value) {
+  const lexical = path.resolve(attemptDir, value);
+  let stat;
+  try {
+    stat = fs.lstatSync(lexical);
+  } catch (error) {
+    throw new WorkflowError('environment-parser', `required artifact is unavailable: ${value}`, { cause: error });
+  }
+  const target = projectPath(attemptDir, lexical, 'generated artifact');
+  if (!stat.isFile() || stat.nlink !== 1 || target !== lexical)
+    throw new WorkflowError('environment-parser', `generated artifact must be a fresh regular file in this attempt: ${value}`);
+  const text = fs.readFileSync(target, 'utf8');
+  if (!text.trim()) throw new WorkflowError('environment-parser', `generated artifact is empty: ${value}`);
+  return { path: target, text };
+}
+/** Stage the complete artifact set before replacing files, and roll back partial publication. */
+function publishArtifacts(artifacts, { projectRoot, runDir, protection }, io = fs) {
+  const targets = protectPublication(
+    projectRoot,
+    artifacts.map((artifact) => artifact.destination),
+    protection,
+  );
+  const staged = [];
+  let keepBackups = false;
+  try {
+    for (const [index, artifact] of artifacts.entries()) {
+      const target = targets[index];
+      io.mkdirSync(path.dirname(target), { recursive: true });
+      const directory = io.mkdtempSync(path.join(path.dirname(target), '.tea-publish-'));
+      const item = {
+        target,
+        directory,
+        next: path.join(directory, 'next'),
+        previous: path.join(directory, 'previous'),
+        existed: io.existsSync(target),
+        installed: false,
+      };
+      staged.push(item);
+      if (item.existed) {
+        if (!io.statSync(target).isFile()) throw new Error(`publication destination is not a regular file: ${target}`);
+        io.copyFileSync(target, item.previous);
+      }
+      if (typeof artifact.text === 'string') io.writeFileSync(item.next, artifact.text, { flag: 'wx' });
+      else io.copyFileSync(artifact.path, item.next);
+      if (item.existed) io.chmodSync(item.next, io.statSync(target).mode);
+    }
+    protection.assertUnchanged();
+    protectPublication(projectRoot, targets, protection);
+    for (const item of staged) {
+      io.renameSync(item.next, item.target);
+      item.installed = true;
+    }
+    return targets;
+  } catch (error_) {
+    const rollbackErrors = [];
+    for (const item of staged.filter((entry) => entry.installed).toReversed()) {
+      try {
+        if (item.existed) io.renameSync(item.previous, item.target);
+        else io.unlinkSync(item.target);
+      } catch (error) {
+        rollbackErrors.push(`${item.target}: ${error.message}`);
+      }
+    }
+    keepBackups = rollbackErrors.length > 0;
+    const status = keepBackups
+      ? `recovery backups: ${staged.map((item) => item.directory).join(', ')}; rollback errors: ${rollbackErrors.join('; ')}`
+      : 'previous artifacts restored';
+    const failureClass = error_ instanceof WorkflowError ? error_.failureClass : 'environment-configuration';
+    const error = new WorkflowError(failureClass, `could not publish artifacts: ${error_.message}; ${status}`, {
+      cause: error_,
+    });
+    error.runDir = runDir;
+    throw error;
+  } finally {
+    if (!keepBackups)
+      for (const item of staged) {
+        try {
+          io.rmSync(item.directory, { recursive: true, force: true });
+        } catch (error) {
+          process.stderr.write(`publication staging cleanup failed at ${item.directory}: ${error.message}\n`);
+        }
+      }
+  }
+}
+module.exports = { inventory, protectSources, protectPublication, freshArtifact, publishArtifacts };

package/cli/nfr.js

@@ -0,0 +1,209 @@
+#!/usr/bin/env node
+/** Audit existing project NFR evidence with the packaged skill. */
+'use strict';
+const fs = require('node:fs');
+const path = require('node:path');
+const crypto = require('node:crypto');
+const { Command } = require('commander');
+const { resolveTeaConfig, CONFIG_LAYER_RELATIVE_PATHS, LEGACY_CONFIG_RELATIVE_PATH } = require('./lib/resolve-tea-config');
+const { inventory, protectSources, protectPublication, freshArtifact, publishArtifacts } = require('./lib/workflow-publication');
+const { readNfrReport } = require('./lib/nfr-report');
+const {
+  WorkflowError,
+  addAgentOptions,
+  readInput,
+  projectPath,
+  resolveWorkflowSkill,
+  headlessPrompt,
+  runWithEvidence,
+  mainError,
+} = require('./lib/workflow-cli');
+/** Accumulate repeatable Commander path options without replacing earlier values. */
+const collect = (value, previous) => [...previous, value];
+/** Resolve a nonempty explicitly supplied source role. */
+function sourceFiles(projectRoot, values, label) {
+  const { files } = inventory(projectRoot, values);
+  if (files.length === 0) throw new WorkflowError('usage', `${label} must supply at least one regular file`);
+  return files;
+}
+/** Verify unchanged sources and fresh actual workflow outputs. */
+function validateAudit(request) {
+  request.protection.assertUnchanged();
+  const report = freshArtifact(request.attemptDir, request.reportFile);
+  const contextFile = freshArtifact(request.attemptDir, request.contextFile);
+  let context;
+  try {
+    context = JSON.parse(contextFile.text);
+  } catch (error) {
+    throw new WorkflowError('environment-parser', `invalid NFR context JSON: ${error.message}`, { cause: error });
+  }
+  return { ...readNfrReport(report.text, context, request), artifacts: [report, contextFile] };
+}
+/** Invoke the actual installed Create workflow and publish its validated audit. */
+function run(argv) {
+  const program = addAgentOptions(
+    new Command().name('tea-nfr').description('Audit existing NFR evidence and publish a verified scope-specific report.'),
+  );
+  program
+    .option('--project-root <dir>', 'consuming project root', process.cwd())
+    .option('--skill-root <dir>', 'trusted skill override; packaged skill by default')
+    .requiredOption('--input <path>', 'requirements document (repeatable)', collect, [])
+    .requiredOption('--implementation <path>', 'accessible implementation file or directory (repeatable)', collect, [])
+    .requiredOption('--evidence <path>', 'existing evidence file or directory (repeatable)', collect, [])
+    .option('--scope <name>', 'system, epic or story', 'system')
+    .option('--scope-id <id>', 'epic or story stable lowercase ID; required for narrower scope')
+    .option('--output-dir <dir>', 'published artifact root inside the project; defaults to TEA test_artifacts')
+    .option('--evidence-dir <dir>', 'retained live prompts, streams and generated reports', '.tea-runs')
+    .option('--fail-on <status>', 'gate threshold: concerns, fail or none', 'concerns')
+    .setOptionValue('retries', '0')
+    .exitOverride()
+    .configureOutput({ writeErr: () => {} });
+  program.options.find((option) => option.long === '--retries').defaultValue = '0';
+  try {
+    program.parse(argv);
+  } catch (error) {
+    if (error.exitCode === 0) return 0;
+    throw new WorkflowError('usage', error.message);
+  }
+  const options = program.opts();
+  if (options.input.length === 0) throw new WorkflowError('usage', '--input requires at least one requirements document');
+  let projectRoot;
+  try {
+    projectRoot = fs.realpathSync(path.resolve(options.projectRoot));
+  } catch (error) {
+    throw new WorkflowError('usage', '--project-root must exist', { cause: error });
+  }
+  if (!['system', 'epic', 'story'].includes(options.scope)) throw new WorkflowError('usage', '--scope must be system, epic or story');
+  if (options.scope === 'system' && options.scopeId) throw new WorkflowError('usage', '--scope-id requires epic or story scope');
+  if (options.scope !== 'system' && (!options.scopeId || !/^[a-z0-9][a-z0-9-]{0,63}$/.test(options.scopeId)))
+    throw new WorkflowError('usage', 'epic or story scope requires a stable lowercase --scope-id');
+  if (!['concerns', 'fail', 'none'].includes(options.failOn)) throw new WorkflowError('usage', '--fail-on must be concerns, fail or none');
+  const configurationInputs = [...CONFIG_LAYER_RELATIVE_PATHS, LEGACY_CONFIG_RELATIVE_PATH]
+    .filter((file) => fs.existsSync(path.join(projectRoot, file)))
+    .map((file) => readInput(projectRoot, file, 'configuration'));
+  const inputs = [...new Set([...options.input.map((file) => readInput(projectRoot, file, '--input')), ...configurationInputs])];
+  const implementation = sourceFiles(projectRoot, options.implementation, '--implementation');
+  const evidenceFiles = sourceFiles(projectRoot, options.evidence, '--evidence');
+  if (
+    inputs.some((file) =>
+      evidenceFiles.some((evidence) => {
+        const a = fs.statSync(file),
+          b = fs.statSync(evidence);
+        return file === evidence || (a.dev === b.dev && a.ino === b.ino);
+      }),
+    )
+  )
+    throw new WorkflowError('usage', 'requirement inputs cannot also be implementation evidence');
+  const protection = protectSources(projectRoot, [...inputs, ...options.implementation, ...options.evidence]);
+  const skillRoot = resolveWorkflowSkill({ projectRoot, skillName: 'bmad-testarch-nfr', skillRoot: options.skillRoot });
+  const resolvedConfig = resolveTeaConfig({ projectRoot, skillRoot, skillName: 'bmad-testarch-nfr' });
+  const artifactRoot = options.outputDir ?? resolvedConfig.configSnapshot.modules.tea.test_artifacts;
+  if (typeof artifactRoot !== 'string' || !artifactRoot.trim())
+    throw new WorkflowError('environment-configuration', '--output-dir or TEA test_artifacts must be a nonempty string');
+  const outputDir = projectPath(projectRoot, artifactRoot.replaceAll('{project-root}', projectRoot), '--output-dir');
+  const runKey = options.scope === 'system' ? 'system' : `${options.scope}-${options.scopeId}`;
+  const filename = `nfr-assessment-${runKey}.md`;
+  const destination = projectPath(projectRoot, path.join(outputDir, 'nfr', filename), 'published report');
+  const contextFilename = `nfr-context-${runKey}.json`;
+  const contextDestination = projectPath(projectRoot, path.join(outputDir, 'nfr', contextFilename), 'published context');
+  const destinations = [destination, contextDestination];
+  const checkDestination = () => protectPublication(projectRoot, [...destinations, options.evidenceDir], protection);
+  checkDestination();
+  const result = runWithEvidence({
+    name: 'tea-nfr',
+    projectRoot,
+    evidenceRoot: options.evidenceDir,
+    options,
+    prepare({ attemptDir }) {
+      const artifactsRoot = path.join(attemptDir, 'artifacts');
+      const config = {
+        ...resolvedConfig,
+        configSnapshot: {
+          core: resolvedConfig.configSnapshot.core,
+          modules: { tea: { ...resolvedConfig.configSnapshot.modules.tea, test_artifacts: artifactsRoot } },
+        },
+      };
+      const reportFile = path.join('artifacts', 'nfr', filename);
+      const contextFile = path.join('artifacts', 'nfr', contextFilename);
+      const requestId = crypto.randomUUID();
+      const contract = {
+        schemaVersion: 1,
+        requestId,
+        runScope: options.scope,
+        runKey,
+        supplied_project_root: projectRoot,
+        declared_nfr_criteria: Object.fromEntries(
+          ['security', 'performance', 'reliability', 'maintainability'].map((domain) => [domain, []]),
+        ),
+        recorded_only_nfr_criteria: [],
+        supplied_evidence_ledger: [],
+        domain_assessments: Object.fromEntries(
+          ['security', 'performance', 'reliability', 'maintainability'].map((domain) => [
+            domain,
+            { status: 'N/A', findings: [], evidence_gaps: [] },
+          ]),
+        ),
+      };
+      const requestLines = [
+        `Start Create mode at ${JSON.stringify(path.join(skillRoot, 'steps-c', 'step-01-load-context.md'))}.`,
+        `run_scope=${options.scope}; run_key=${runKey}; tea_browser_automation=none`,
+        `supplied_project_root=${JSON.stringify(projectRoot)}`,
+        `Requirement inputs are exactly this JSON list: ${JSON.stringify(inputs)}.`,
+        `Implementation files are accessible at exactly this JSON list: ${JSON.stringify(implementation)}.`,
+        `Existing implementation evidence is exactly this JSON list: ${JSON.stringify(evidenceFiles)}.`,
+        'Read and audit this existing implementation evidence. Preserve all supplied files. Read-only file inspection is allowed. Do not execute project tests, build scripts, deploy scripts, CI jobs or browser exploration.',
+        `Produce a completed scope-specific audit at ${JSON.stringify(path.join(attemptDir, reportFile))}.`,
+        `Persist your actual step02/03/04E canonical workflow context at ${JSON.stringify(path.join(attemptDir, contextFile))}. Required shape (empty arrays are shape examples, fill all actual declared criteria): ${JSON.stringify(contract)}.`,
+        'Each declared criterion has {id,order,label,threshold,threshold_source}; use actual stable criterion IDs and source order. Each recorded-only criterion also has domain and assessment_mode=recorded-only.',
+        'Use canonical project-relative threshold_source paths from requirement inputs. Copy the threshold as a literal source excerpt (line wrapping may normalize), or UNKNOWN. Do not invent threshold policy.',
+        'Each ledger entry has {path,source: supplied,source_type: implementation-evidence,domains,observations:[{criterion_id,supports}]}. Copy supports as literal factual excerpts from that exact supplied file. Sort paths and observations; deduplicate. Include all actual supported criterion bindings.',
+        'Each domain_assessments entry has {status,findings:[{criterion_id,status,evidence:[{path,supports}]}],evidence_gaps:[{criterion_id,message}]}. Match every declared criterion in source order, with all its bound ledger observations. Missing evidence has one gap with message "Label: no supplied implementation evidence". UNKNOWN threshold with evidence has one gap with message "Label: UNKNOWN threshold". Replace Label with the exact criterion label. Never manufacture implementation evidence from requirement documents.',
+        'Follow the actual workflow and checklist. Preserve completed steps and run identity in frontmatter. Include exactly one Gate YAML Snippet with nfr_assessment and the four audited_domains.',
+        'Under every audited domain, render each declared criterion as a ### subsection with separate bold Status, Threshold, Threshold Source, Actual, Evidence and Supports fields. Threshold Source is one backtick-quoted canonical requirement path. Actual is a copied implementation source excerpt, or UNKNOWN. Evidence lists all bound ledger paths in backticks. Supports includes each literal bound excerpt. With no evidence, use Evidence: None, Supports: None and Actual: UNKNOWN. Evidence paths must be backtick-quoted paths relative to the supplied project root and present in the supplied evidence list. Requirements are threshold sources.',
+        'Preserve the completed Create progress steps in exact workflow order and a valid lastSaved timestamp. Keep all populated report-template sections. Gate concerns/evidence_gaps counts equal normalized criterion concerns/gaps. Recorded-only declarations use a separate Recorded-Only NFR Criteria table with ID, category, label, threshold, source and RECORDED ONLY mode; they have no audited finding/status/gate impact.',
+        'Use only declared requirements and existing evidence. Record UNKNOWN thresholds and missing evidence as required by the skill. Complete all workflow steps without modifying source inputs.',
+      ];
+      return {
+        prompt: headlessPrompt({ skillRoot, projectRoot, resolvedConfig: config, requestLines }),
+        reportFile,
+        projectRoot,
+        runScope: options.scope,
+        runKey,
+        requestId,
+        contextFile,
+        protection,
+        inputs,
+        evidenceFiles,
+      };
+    },
+    validate: validateAudit,
+  });
+  if (result.dryRun) {
+    process.stdout.write(
+      `${JSON.stringify({ mode: 'prompt-only', evidence: result.runDir, prompt: path.join(result.attemptDir, 'prompt.txt') })}\n`,
+    );
+    return 0;
+  }
+  checkDestination();
+  const published = publishArtifacts(
+    result.value.artifacts.map((artifact, index) => ({ ...artifact, destination: destinations[index] })),
+    { projectRoot, runDir: result.runDir, protection },
+  );
+  const failed =
+    options.failOn !== 'none' && (result.value.status === 'FAIL' || (options.failOn === 'concerns' && result.value.status === 'CONCERNS'));
+  const gatePassed = !failed;
+  process.stdout.write(
+    `${JSON.stringify({ mode: 'live', runKey, status: result.value.status, gatePassed, evidence: result.runDir, report: published[0], context: published[1], gate: result.value.gate })}\n`,
+  );
+  return failed ? 1 : 0;
+}
+/** Run the public command with stable configuration and execution exit codes. */
+function main(argv) {
+  try {
+    return run(argv);
+  } catch (error) {
+    return mainError('tea-nfr', error);
+  }
+}
+if (require.main === module) process.exitCode = main(process.argv);
+module.exports = { main, validateAudit, sourceFiles };

package/package.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/package.json",
   "name": "bmad-method-test-architecture-enterprise",
-  "version": "2.0.4-next.2",
+  "version": "2.0.4-next.3",
   "description": "Master Test Architect for quality strategy, test automation, and release gates",
   "keywords": [
     "bmad",
@@ -38,6 +38,7 @@
     "tea-evaluate": "cli/evaluate.js",
     "tea-fragment-selection-runner": "cli/fragment-selection-runner.js",
     "tea-framework": "cli/framework.js",
+    "tea-nfr": "cli/nfr.js",
     "tea-nfr-runner": "cli/nfr-runner.js",
     "tea-routing-runner": "cli/routing-runner.js",
     "tea-skill-runner": "cli/skill-runner.js",
@@ -92,7 +93,7 @@
     "release:minor": "gh workflow run publish.yaml -f channel=latest -f bump=minor",
     "release:next": "gh workflow run publish.yaml -f channel=next",
     "release:patch": "gh workflow run publish.yaml -f channel=latest -f bump=patch",
-    "test": "npm run test:conflict-markers && npm run test:schemas && npm run test:install && npm run test:evaluate-guidance && npm run test:evaluate-authoring && npm run test:evaluate-gap-loop && npm run test:evaluate-dogfood && npm run test:evaluate-check && npm run test:evaluate-compare && npm run test:evaluate-before-state && npm run test:evaluate-ci-gates && npm run test:evaluate-ci-tiers && npm run test:evaluate-ci-repositories:tagged-release-pr && npm run test:evaluate-ci-repositories:tagged-release-merge && npm run test:evaluate-ci-repositories:tagged-release-release && npm run test:evaluate-ci-repositories:nightly-deploy-pr && npm run test:evaluate-ci-repositories:nightly-deploy-merge && npm run test:evaluate-ci-repositories:nightly-deploy-scheduled && npm run test:evaluate-ci-repositories:nightly-deploy-release && npm run test:evaluate-ci-render && npm run test:evaluate-pr-mcp && npm run test:evaluate-pr-api && npm run test:evaluate-pr-suite && npm run test:evaluate-pr-workflow && npm run test:evaluate-pr-tool-use && npm run test:evaluate-pr-promptfoo && npm run test:evaluate-pr-ai-feature && npm run test:evaluate-pr-test-review && npm run test:evaluate-pr-gap-loop && npm run test:evaluate-pr-learn && npm run test:evaluate-pr-tutorial && npm run test:evaluate-partitions && npm run test:evaluate-partition-plans-views-and-check && npm run test:evaluate-partition-plans-preflight-and-run && npm run test:evaluate-partition-plans-score && npm run test:evaluate-partition-plans-attempts-seal-and-mappings && npm run test:evaluate-partition-plans-attempts-records && npm run test:evaluate-partition-plans-attempts-gameability && npm run test:evaluate-interpret && npm run test:evaluate-calibration && npm run test:evaluate-boundaries && npm run test:evaluate-preflight && npm run test:evaluate-isolation-conformance && npm run test:evaluate-mutation:qualification-basics && npm run test:evaluate-mutation:qualification-guards && npm run test:evaluate-mutation:recovery && npm run test:evaluate-mutation:journals && npm run test:evaluate-run && npm run test:evaluate-progress && npm run test:evaluate-aggregate && npm run test:evaluate-confinement && npm run test:evaluate-confinement-audit && npm run test:evaluate-confinement-history && npm run test:evaluate-confinement-git-state && npm run test:evaluate-confinement-network && npm run test:evaluate-held-inputs && npm run test:evaluate-arms-historical && npm run test:evaluate-arms-deployments && npm run test:evaluate-evaluators && npm run test:evaluate-evaluators-agent-version && npm run test:evaluate-agents && npm run test:evaluate-agents-importers && npm run test:evaluate-agents-sealed-brief && npm run test:evaluate-held-attempts && npm run test:evaluate-private && npm run test:evaluate-records && npm run test:evaluate-mcp && npm run test:evaluate-api && npm run test:evaluate-workflow && npm run test:evaluate-tool-use && npm run test:evaluate-promptfoo && npm run test:evaluate-learned-framework && npm run test:docs-tutorial && npm run test:knowledge && npm run test:criteria-fragments && npm run test:doc-count-sources && npm run test:planning-doc-sources && npm run test:doc-counts && npm run test:doc-claim-sources && npm run test:doc-claims && npm run test:doc-invocation-entry && npm run test:doc-invocations && npm run test:doc-link-anchors && npm run test:docs-build-names && npm run test:docs-evaluate-sidebar && npm run test:docs-gap-reader && npm run test:enforce-hook && npm run test:framework-scaffold && npm run test:isolation-primitives && npm run test:atdd-isolation && npm run test:atdd-net-guard && npm run test:atdd-scoring && npm run test:atdd-workflow-guidance && npm run test:generation-healing && npm run test:framework-scaffold-install-isolation && npm run test:transcript-harness && npm run test:suite-manifest && npm run test:teach-me-testing-scoring && npm run test:eval-data && npm run test:eval-atdd-data && npm run test:eval-ci-data && npm run test:eval-framework-scaffold-data && npm run test:eval-nfr-data && npm run test:nfr-validate-corpus && npm run test:nfr-evidence-guidance && npm run test:eval-test-design-data && npm run test:eval-trace-data && npm run test:eval-routing-data && npm run test:eval-routing-boundaries && npm run test:eval-routing-evidence && npm run test:eval-transcript-data && npm run test:eval-teach-me-testing-data && npm run test:eval-schemas && npm run test:eval-diagnostics && npm run test:eval-replay && npm run test:eval-quality-corpus && npm run test:schema-versions && npm run test:contract-sources && npm run test:contracts && npm run test:contract-oracles && npm run test:probe-sources && npm run test:test-design-qualification && npm run test:test-review-qualification && npm run test:trace-qualification && npm run test:nfr-qualification && npm run test:ci-qualification && npm run test:probe-corpus && npm run test:compare-dominance && npm run test:compare-eval-runs && npm run test:trial-set-scoring && npm run test:automate-cli && npm run test:automate-generation-evidence && npm run test:automate-eval-fixture && npm run test:eval-automate-data && npm run test:clock-port && npm run test:probe-conformance && npm run test:corpus-conformance && npm run test:file-system-conformance && npm run test:file-system-port && npm run test:probe-targets && npm run test:port-totality && npm run test:ci-coverage && npm run test:ci-coverage-filters && npm run test:install-actionlint && npm run test:workflows-lint && npm run test:install-linux-sandbox && npm run test:shards && npm run test:groups && npm run test:cli && npm run test:workflow-cli && npm run test:framework-cli && npm run test:test-review-pr-scope && npm run test:test-review-report && npm run test:test-review-rubric && npm run test:bmad-output-gated && npm run test:release-metadata && npm run test:release-notes && npm run test:lockfile-age && npm run test:lockfile-age-cache && npm run test:licences && npm run test:supply-chain && npm run test:boundary && npm run test:direction && npm run test:lineage && npm run test:guard-publish && npm run test:layering-boundary-lineage && npm run test:changelog && npm run test:tea-workflow-descriptions && npm run test:docs-mermaid && npm run test:llms-headroom && npm run validate:schemas && npm run lint && npm run lint:md && npm run format:check",
+    "test": "npm run test:conflict-markers && npm run test:schemas && npm run test:install && npm run test:evaluate-guidance && npm run test:evaluate-authoring && npm run test:evaluate-gap-loop && npm run test:evaluate-dogfood && npm run test:evaluate-check && npm run test:evaluate-compare && npm run test:evaluate-before-state && npm run test:evaluate-ci-gates && npm run test:evaluate-ci-tiers && npm run test:evaluate-ci-repositories:tagged-release-pr && npm run test:evaluate-ci-repositories:tagged-release-merge && npm run test:evaluate-ci-repositories:tagged-release-release && npm run test:evaluate-ci-repositories:nightly-deploy-pr && npm run test:evaluate-ci-repositories:nightly-deploy-merge && npm run test:evaluate-ci-repositories:nightly-deploy-scheduled && npm run test:evaluate-ci-repositories:nightly-deploy-release && npm run test:evaluate-ci-render && npm run test:evaluate-pr-mcp && npm run test:evaluate-pr-api && npm run test:evaluate-pr-suite && npm run test:evaluate-pr-workflow && npm run test:evaluate-pr-tool-use && npm run test:evaluate-pr-promptfoo && npm run test:evaluate-pr-ai-feature && npm run test:evaluate-pr-test-review && npm run test:evaluate-pr-gap-loop && npm run test:evaluate-pr-learn && npm run test:evaluate-pr-tutorial && npm run test:evaluate-partitions && npm run test:evaluate-partition-plans-views-and-check && npm run test:evaluate-partition-plans-preflight-and-run && npm run test:evaluate-partition-plans-score && npm run test:evaluate-partition-plans-attempts-seal-and-mappings && npm run test:evaluate-partition-plans-attempts-records && npm run test:evaluate-partition-plans-attempts-gameability && npm run test:evaluate-interpret && npm run test:evaluate-calibration && npm run test:evaluate-boundaries && npm run test:evaluate-preflight && npm run test:evaluate-isolation-conformance && npm run test:evaluate-mutation:qualification-basics && npm run test:evaluate-mutation:qualification-guards && npm run test:evaluate-mutation:recovery && npm run test:evaluate-mutation:journals && npm run test:evaluate-run && npm run test:evaluate-progress && npm run test:evaluate-aggregate && npm run test:evaluate-confinement && npm run test:evaluate-confinement-audit && npm run test:evaluate-confinement-history && npm run test:evaluate-confinement-git-state && npm run test:evaluate-confinement-network && npm run test:evaluate-held-inputs && npm run test:evaluate-arms-historical && npm run test:evaluate-arms-deployments && npm run test:evaluate-evaluators && npm run test:evaluate-evaluators-agent-version && npm run test:evaluate-agents && npm run test:evaluate-agents-importers && npm run test:evaluate-agents-sealed-brief && npm run test:evaluate-held-attempts && npm run test:evaluate-private && npm run test:evaluate-records && npm run test:evaluate-mcp && npm run test:evaluate-api && npm run test:evaluate-workflow && npm run test:evaluate-tool-use && npm run test:evaluate-promptfoo && npm run test:evaluate-learned-framework && npm run test:docs-tutorial && npm run test:knowledge && npm run test:criteria-fragments && npm run test:doc-count-sources && npm run test:planning-doc-sources && npm run test:doc-counts && npm run test:doc-claim-sources && npm run test:doc-claims && npm run test:doc-invocation-entry && npm run test:doc-invocations && npm run test:doc-link-anchors && npm run test:docs-build-names && npm run test:docs-evaluate-sidebar && npm run test:docs-gap-reader && npm run test:enforce-hook && npm run test:framework-scaffold && npm run test:isolation-primitives && npm run test:atdd-isolation && npm run test:atdd-net-guard && npm run test:atdd-scoring && npm run test:atdd-workflow-guidance && npm run test:generation-healing && npm run test:framework-scaffold-install-isolation && npm run test:transcript-harness && npm run test:suite-manifest && npm run test:teach-me-testing-scoring && npm run test:eval-data && npm run test:eval-atdd-data && npm run test:eval-ci-data && npm run test:eval-framework-scaffold-data && npm run test:eval-nfr-data && npm run test:nfr-validate-corpus && npm run test:nfr-evidence-guidance && npm run test:nfr-cli && npm run test:eval-test-design-data && npm run test:eval-trace-data && npm run test:eval-routing-data && npm run test:eval-routing-boundaries && npm run test:eval-routing-evidence && npm run test:eval-transcript-data && npm run test:eval-teach-me-testing-data && npm run test:eval-schemas && npm run test:eval-diagnostics && npm run test:eval-replay && npm run test:eval-quality-corpus && npm run test:schema-versions && npm run test:contract-sources && npm run test:contracts && npm run test:contract-oracles && npm run test:probe-sources && npm run test:test-design-qualification && npm run test:test-review-qualification && npm run test:trace-qualification && npm run test:nfr-qualification && npm run test:ci-qualification && npm run test:probe-corpus && npm run test:compare-dominance && npm run test:compare-eval-runs && npm run test:trial-set-scoring && npm run test:automate-cli && npm run test:automate-generation-evidence && npm run test:automate-eval-fixture && npm run test:eval-automate-data && npm run test:clock-port && npm run test:probe-conformance && npm run test:corpus-conformance && npm run test:file-system-conformance && npm run test:file-system-port && npm run test:probe-targets && npm run test:port-totality && npm run test:ci-coverage && npm run test:ci-coverage-filters && npm run test:install-actionlint && npm run test:workflows-lint && npm run test:install-linux-sandbox && npm run test:shards && npm run test:groups && npm run test:cli && npm run test:workflow-cli && npm run test:framework-cli && npm run test:test-review-pr-scope && npm run test:test-review-report && npm run test:test-review-rubric && npm run test:bmad-output-gated && npm run test:release-metadata && npm run test:release-notes && npm run test:lockfile-age && npm run test:lockfile-age-cache && npm run test:licences && npm run test:supply-chain && npm run test:boundary && npm run test:direction && npm run test:lineage && npm run test:guard-publish && npm run test:layering-boundary-lineage && npm run test:changelog && npm run test:tea-workflow-descriptions && npm run test:docs-mermaid && npm run test:llms-headroom && npm run validate:schemas && npm run lint && npm run lint:md && npm run format:check",
     "test:atdd-isolation": "node test/test-atdd-isolation.js",
     "test:atdd-net-guard": "node test/test-atdd-net-guard.js",
     "test:atdd-scoring": "node test/test-atdd-scoring.js",
@@ -239,6 +240,7 @@
     "test:llms-headroom": "node test/test-llms-headroom.js",
     "test:lockfile-age": "eval-quality-gates lockfile-age",
     "test:lockfile-age-cache": "node test/test-generate-lockfile-age-cache.js",
+    "test:nfr-cli": "node --test test/test-nfr-cli.js",
     "test:nfr-evidence-guidance": "node test/test-nfr-evidence-guidance.js",
     "test:nfr-qualification": "node test/test-nfr-qualification.js",
     "test:nfr-validate-corpus": "node test/test-nfr-validate-corpus.js",

package/skills/bmod-tea/bmod.toml

@@ -2,7 +2,7 @@
 
 [bmod]
 code = "tea"
-version = "2.0.4-next.2"
+version = "2.0.4-next.3"
 update_source = "github:bmad-code-org/bmad-method-test-architecture-enterprise/skills"
 skills = [
   "bmad-tea",