cabloy 5.1.193 → 5.1.195

package/.cabloy-version

@@ -1 +1 @@
-5.1.193
+5.1.195

package/.github/workflows/agent-governance.yml

@@ -35,5 +35,6 @@ jobs:
           npm run agent:governance:pack-check
           npm run test:spec-charts
           npm run spec:charts:check -- a-commerce
+          npm run spec:charts:check -- home-user
       - name: build documentation
         run: npm run docs:build

package/CHANGELOG.md

@@ -1,5 +1,35 @@
 # Changelog
 
+## 5.1.195
+
+### Features
+
+- Update application features.
+
+### Bug Fixes
+
+- Fix metadata index merging and preserve indexes on the same table in metadata and generators.
+
+### Improvements
+
+- Enhance transaction handling and specification skills.
+- Refine the commerce specification and clarify the tutorial’s OpenAPI workflow and contract model.
+- Update the controller AOP guide, SSR comparison, development history, introduction, README, and site icon.
+
+## 5.1.194
+
+### Bug Fixes
+
+- Resolve lint errors in governance contract-loop hooks.
+
+### Improvements
+
+- Update controller-boundary tests.
+
+### Breaking Changes
+
+- Require explicit menu site bindings for SSR.
+
 ## 5.1.193
 
 ### Features

package/README.md

@@ -6,32 +6,31 @@
 [![Docs](https://img.shields.io/badge/docs-cabloy-4f46e5.svg?style=flat-square)](https://cabloy.com)
 [![Demo](https://img.shields.io/badge/demo-cabloy.com-059669.svg?style=flat-square)](https://cabloy.com/demo)
 
-Cabloy is a Node.js fullstack framework for AI vibe coding, with AI Spec-Driven Development for traceable, evidence-backed delivery.
+Cabloy is a Node.js fullstack framework for AI vibe coding, with AI Spec-Driven Development guiding work from confirmed specs to verifiable delivery.
 
-**One fullstack system for AI vibe coding—bidirectional type sync, CLI-first workflows, docs, skills, and traceable delivery from product intent to verifiable evidence.**
-
-Instead of stitching separate backend and frontend stacks together, Cabloy keeps their contracts, tooling, and guidance connected in one repository. [AI Spec-Driven Development](https://cabloy.com/ai/ai-spec-driven-development) provides the disciplined path from confirmed Specs to evidence-backed delivery; its precise engineering method is Traceable Spec Delivery. Vona is its backend framework and runtime layer, and Zova is its frontend framework and application layer. Cabloy Basic and Cabloy Start are related, complete edition baselines built on that shared architecture; see [Editions Overview](https://cabloy.com/editions/overview) for their deliberate differences.
+Cabloy Basic and Cabloy Start are complete editions built on this shared architecture; see [Editions Overview](https://cabloy.com/editions/overview) for their differences.
 
 [Documentation](https://cabloy.com) · [npm](https://www.npmjs.com/package/cabloy) · [Demo](https://cabloy.com/demo) · [GitHub](https://github.com/cabloy/cabloy)
 
 ## Fullstack Principles
 
-Cabloy’s fullstack model is built around two core principles:
+Cabloy connects Vona and Zova in two ways:
 
-1. **Frontend build output participates directly in backend SSR**
-   - Zova owns the frontend application source
-   - the generated frontend bundle and SSR-related artifacts are consumed by the Vona-side SSR flow
-   - backend rendering and frontend hydration stay on one coordinated delivery path
+1. **Integrated SSR.** Zova builds the frontend and SSR artifacts. In Vona integrated SSR, Vona consumes those artifacts to render the page, and Zova hydrates it in the browser.
 
-2. **Type information flows in both directions**
-   - **Backend -> Frontend**: Vona emits Swagger/OpenAPI contracts that Zova can use to generate SDKs and related schema-aware helpers
-   - **Frontend -> Backend**: Zova generates structural metadata and typing surfaces such as routes, components, and icons that can improve backend-side tooling and type hints
+2. **Bidirectional contract flow.** Vona's OpenAPI contracts generate Zova SDKs and schema-aware helpers. Zova's generated metadata and types for routes, components, and icons feed back into Vona's tooling and type hints.
 
-For the complete explanation, see [Fullstack Introduction](https://cabloy.com/fullstack/introduction), [Vona + Zova Integration](https://cabloy.com/fullstack/vona-zova-integration), [Backend OpenAPI to Frontend SDK](https://cabloy.com/fullstack/openapi-to-sdk), and [Frontend Metadata Back to Backend](https://cabloy.com/fullstack/frontend-metadata-to-backend).
+Learn more about [Vona + Zova Integration](https://cabloy.com/fullstack/vona-zova-integration) and the [Contract Loop](https://cabloy.com/fullstack/contract-loop-playbook).
 
 ## Get Started
 
-See the [Fullstack Quickstart](https://cabloy.com/fullstack/quickstart).
+Create a new Cabloy Basic project:
+
+```bash
+npm create cabloy
+```
+
+For Cabloy Start, clone the [Cabloy Start repository](https://github.com/cabloy/cabloy-start) and run `npm run init` from its root. See the [Fullstack Quickstart](https://cabloy.com/fullstack/quickstart) for prerequisites and development commands.
 
 ## AI Spec-Driven Development
 
@@ -78,16 +77,6 @@ Included demonstration suites give AI vibe coding agents high-quality, project-n
 
 > “Not included” means that the suite is not part of the default edition baseline. It does not limit what can be built with Cabloy.
 
-## Highlights
-
-- **One fullstack system** — build backend and frontend together instead of assembling separate stacks
-- **Bidirectional type sync** — use the contract loop to keep backend contracts and frontend metadata aligned in both directions
-- **CLI-first workflows** — use explicit commands for scaffolding, generation, refactors, and verification
-- **Docs and skills** — give people and AI agents reusable, source-grounded guidance for the current repository
-- **AI Spec-Driven Development** — use Traceable Spec Delivery to connect product intent, contracts, bounded work, acceptance procedures, and verifiable evidence
-- **Vona + Zova** — use aligned backend and frontend layers for code sharing and cross-stack consistency
-- **Modular delivery** — organize capabilities as suites and modules, then deliver SSR, SPA, Web, and Admin applications with shared conventions
-
 ## Technology Stack
 
 ### General

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cabloy",
-  "version": "5.1.193",
+  "version": "5.1.195",
   "gitHead": "2c5c19284bab738e492856189acb6fad74b8a7b7",
   "description": "A Node.js fullstack framework",
   "keywords": [
@@ -60,6 +60,7 @@
     "test:spec-charts": "node --test repo-agent-governance/tools/spec-charts/generate-implementation-charts.test.mjs",
     "spec:charts": "node ./repo-agent-governance/tools/spec-charts/generate-implementation-charts.mjs",
     "spec:charts:check": "node ./repo-agent-governance/tools/spec-charts/generate-implementation-charts.mjs --check",
+    "spec:check": "node ./repo-agent-governance/tools/spec-audit/audit.mjs",
     "docs:dev": "pnpm --dir repo-docs docs:dev",
     "docs:build": "pnpm --dir repo-docs docs:build",
     "docs:preview": "pnpm --dir repo-docs docs:preview",

package/repo-agent-governance/adapters/codex/contract-loop-gate.mjs

@@ -17,7 +17,7 @@ function runCodexHook() {
   const evaluated = evaluateCodexEditedFiles(ROOT, extractCodexEditedFiles(payload), payload.cwd);
   if (!evaluated.length) return 0;
   const message = evaluated.map(item => item.message).join('\n\n');
-  // eslint-disable-next-line
+  // eslint-disable-next-line no-console
   console.log(JSON.stringify(formatCodexHookOutput(message)));
   return 0;
 }

package/repo-agent-governance/adapters/cursor/contract-loop-gate.mjs

@@ -19,7 +19,7 @@ function runCursorHook() {
   if (!evaluated) return 0;
   const output = formatCursorHookOutput(evaluated.message, inferCursorHookEvent(payload));
   if (output) {
-    // eslint-disable-next-line
+    // eslint-disable-next-line no-console
     console.log(JSON.stringify(output));
   }
   return 0;

package/repo-agent-governance/managed-assets.json

@@ -18,7 +18,7 @@
     {
       "adapter": "codex",
       "category": "skill",
-      "sha256": "5ac94eb98e3c89abef06b5164298f953ea16759fc24e8d57d18f5d6c40c4168f",
+      "sha256": "88e6ca8c60d8caeb68ab932f2a7e22810a31911400b4428fd0756d076dbc78e8",
       "source": "skills/cabloy-backend-scaffold/references/follow-up-checklist.md",
       "target": ".agents/skills/cabloy-backend-scaffold/references/follow-up-checklist.md"
     },
@@ -67,7 +67,7 @@
     {
       "adapter": "codex",
       "category": "skill",
-      "sha256": "0cc583277837d9e7ec8b54df86eeb43a42efef3b0ac08405c91a6f6345b6b377",
+      "sha256": "aceca7a587634f574301cafad267b9a2d620db1c5a5c1dd8cec9483870fc0400",
       "source": "skills/cabloy-domain-planning/SKILL.md",
       "target": ".agents/skills/cabloy-domain-planning/SKILL.md"
     },
@@ -158,63 +158,98 @@
     {
       "adapter": "codex",
       "category": "skill",
-      "sha256": "00b614b97e4cfca37ecb5245e9a58ddd69e744e67b3cae32145499bec01f1812",
+      "sha256": "1d5a93d8285e85778e281c1a82d141f44d6f74112a295fc1d8ad977e2af2b3c3",
       "source": "skills/cabloy-spec-execution/evals/evals.json",
       "target": ".agents/skills/cabloy-spec-execution/evals/evals.json"
     },
     {
       "adapter": "codex",
       "category": "skill",
-      "sha256": "ec7d25e9de7f4ecc12e1937e7692dab880892958155d914e086133708878fdd0",
+      "sha256": "187c45fea775846326bcdea17b20a465850e563cd98a9c189725ca5aac5fdee5",
+      "source": "skills/cabloy-spec-execution/evals/files/scenarios.json",
+      "target": ".agents/skills/cabloy-spec-execution/evals/files/scenarios.json"
+    },
+    {
+      "adapter": "codex",
+      "category": "skill",
+      "sha256": "4272ada10c6802a70c3fd926aab858724a65e975a716775ac716d6f0ba85c25a",
+      "source": "skills/cabloy-spec-execution/evals/protocol.md",
+      "target": ".agents/skills/cabloy-spec-execution/evals/protocol.md"
+    },
+    {
+      "adapter": "codex",
+      "category": "skill",
+      "sha256": "788f9c94a93753f2ad16d0a1f772fe61785514ab69e2564a2a2454f4efb46086",
       "source": "skills/cabloy-spec-execution/references/execution-protocol.md",
       "target": ".agents/skills/cabloy-spec-execution/references/execution-protocol.md"
     },
     {
       "adapter": "codex",
       "category": "skill",
-      "sha256": "f8c69f36ac2ea5fc4800ca70fdc5a3d8362e944ca54cd9d657ded6465695e160",
+      "sha256": "ec93b6999fcf87f35f8f1f18eed54bb08ee2753862b34f6c474480f2c88ee7e0",
       "source": "skills/cabloy-spec-execution/references/status-and-evidence.md",
       "target": ".agents/skills/cabloy-spec-execution/references/status-and-evidence.md"
     },
     {
       "adapter": "codex",
       "category": "skill",
-      "sha256": "150c826e78616763d73f8e81f2e3d85c0e05eedb649ac2a069359c6ce074d507",
+      "sha256": "52a1a0ae16f72345a761d657130fd65b681535c20937a86d1d6f279772c9bb31",
       "source": "skills/cabloy-spec-execution/SKILL.md",
       "target": ".agents/skills/cabloy-spec-execution/SKILL.md"
     },
     {
       "adapter": "codex",
       "category": "skill",
-      "sha256": "8ce8a4bc07ef33a40f8b745e34966202be27e6682c995c3fa0c351e1d85af904",
+      "sha256": "4ef681f7bb98e605514e770bfa129d171f915e8562025d6195de0f8dfecaa80a",
       "source": "skills/cabloy-spec-generation/evals/evals.json",
       "target": ".agents/skills/cabloy-spec-generation/evals/evals.json"
     },
     {
       "adapter": "codex",
       "category": "skill",
-      "sha256": "988b4aee132dd64156e7b237653f7ba37f0f088b75f669219c3931b35336ec04",
+      "sha256": "c5a1923be3cf387d3d31535af816e8ecadd52762ebb847a1be0d7cd1fe7c3d61",
+      "source": "skills/cabloy-spec-generation/evals/files/scenarios.json",
+      "target": ".agents/skills/cabloy-spec-generation/evals/files/scenarios.json"
+    },
+    {
+      "adapter": "codex",
+      "category": "skill",
+      "sha256": "4fa0405277092948d79cbde3d5b9b0f2e258dac58bf7e462dffea56da5fdd45f",
+      "source": "skills/cabloy-spec-generation/evals/protocol.md",
+      "target": ".agents/skills/cabloy-spec-generation/evals/protocol.md"
+    },
+    {
+      "adapter": "codex",
+      "category": "skill",
+      "sha256": "85b5a174c20111d31e50071a826f555c1e9b810e52078305af2850f3593f3603",
+      "source": "skills/cabloy-spec-generation/references/canonical-spec-input.md",
+      "target": ".agents/skills/cabloy-spec-generation/references/canonical-spec-input.md"
+    },
+    {
+      "adapter": "codex",
+      "category": "skill",
+      "sha256": "0c482b23c42c893dae4a027a786117ff2ad4b5686e3fc29de0a117d7e4958a49",
       "source": "skills/cabloy-spec-generation/references/repo-aware-discovery.md",
       "target": ".agents/skills/cabloy-spec-generation/references/repo-aware-discovery.md"
     },
     {
       "adapter": "codex",
       "category": "skill",
-      "sha256": "77c90b159387320059b82d83ccdab42d116f4ade2cb844aec2b0dad86d60fcd3",
+      "sha256": "772e83aea0d7a3ad3d5a91d4ecedd09f6cd24ae9eb146399f0834ded3f074185",
       "source": "skills/cabloy-spec-generation/references/repo-specs-document-set.md",
       "target": ".agents/skills/cabloy-spec-generation/references/repo-specs-document-set.md"
     },
     {
       "adapter": "codex",
       "category": "skill",
-      "sha256": "168e58f7acf2a3085a79e745862acb4972c703271563df9769bb23fff2a48d93",
+      "sha256": "242d3b7dd6f9266fa836918443c06add6bf9d2308d7f4288112412ee3a6224f5",
       "source": "skills/cabloy-spec-generation/references/traceability-and-status-rules.md",
       "target": ".agents/skills/cabloy-spec-generation/references/traceability-and-status-rules.md"
     },
     {
       "adapter": "codex",
       "category": "skill",
-      "sha256": "0aacce954ed495a8482d01d28fdcf863757262eae9998234dd4849aa728c3fca",
+      "sha256": "7b66c1f77130d14e44bea6f6f09e0de53fe4ae251ad888e78195dab48246301d",
       "source": "skills/cabloy-spec-generation/SKILL.md",
       "target": ".agents/skills/cabloy-spec-generation/SKILL.md"
     },
@@ -319,7 +354,7 @@
     {
       "adapter": "claude",
       "category": "skill",
-      "sha256": "5ac94eb98e3c89abef06b5164298f953ea16759fc24e8d57d18f5d6c40c4168f",
+      "sha256": "88e6ca8c60d8caeb68ab932f2a7e22810a31911400b4428fd0756d076dbc78e8",
       "source": "skills/cabloy-backend-scaffold/references/follow-up-checklist.md",
       "target": ".claude/skills/cabloy-backend-scaffold/references/follow-up-checklist.md"
     },
@@ -368,7 +403,7 @@
     {
       "adapter": "claude",
       "category": "skill",
-      "sha256": "0cc583277837d9e7ec8b54df86eeb43a42efef3b0ac08405c91a6f6345b6b377",
+      "sha256": "aceca7a587634f574301cafad267b9a2d620db1c5a5c1dd8cec9483870fc0400",
       "source": "skills/cabloy-domain-planning/SKILL.md",
       "target": ".claude/skills/cabloy-domain-planning/SKILL.md"
     },
@@ -459,63 +494,98 @@
     {
       "adapter": "claude",
       "category": "skill",
-      "sha256": "00b614b97e4cfca37ecb5245e9a58ddd69e744e67b3cae32145499bec01f1812",
+      "sha256": "1d5a93d8285e85778e281c1a82d141f44d6f74112a295fc1d8ad977e2af2b3c3",
       "source": "skills/cabloy-spec-execution/evals/evals.json",
       "target": ".claude/skills/cabloy-spec-execution/evals/evals.json"
     },
     {
       "adapter": "claude",
       "category": "skill",
-      "sha256": "ec7d25e9de7f4ecc12e1937e7692dab880892958155d914e086133708878fdd0",
+      "sha256": "187c45fea775846326bcdea17b20a465850e563cd98a9c189725ca5aac5fdee5",
+      "source": "skills/cabloy-spec-execution/evals/files/scenarios.json",
+      "target": ".claude/skills/cabloy-spec-execution/evals/files/scenarios.json"
+    },
+    {
+      "adapter": "claude",
+      "category": "skill",
+      "sha256": "4272ada10c6802a70c3fd926aab858724a65e975a716775ac716d6f0ba85c25a",
+      "source": "skills/cabloy-spec-execution/evals/protocol.md",
+      "target": ".claude/skills/cabloy-spec-execution/evals/protocol.md"
+    },
+    {
+      "adapter": "claude",
+      "category": "skill",
+      "sha256": "788f9c94a93753f2ad16d0a1f772fe61785514ab69e2564a2a2454f4efb46086",
       "source": "skills/cabloy-spec-execution/references/execution-protocol.md",
       "target": ".claude/skills/cabloy-spec-execution/references/execution-protocol.md"
     },
     {
       "adapter": "claude",
       "category": "skill",
-      "sha256": "f8c69f36ac2ea5fc4800ca70fdc5a3d8362e944ca54cd9d657ded6465695e160",
+      "sha256": "ec93b6999fcf87f35f8f1f18eed54bb08ee2753862b34f6c474480f2c88ee7e0",
       "source": "skills/cabloy-spec-execution/references/status-and-evidence.md",
       "target": ".claude/skills/cabloy-spec-execution/references/status-and-evidence.md"
     },
     {
       "adapter": "claude",
       "category": "skill",
-      "sha256": "150c826e78616763d73f8e81f2e3d85c0e05eedb649ac2a069359c6ce074d507",
+      "sha256": "52a1a0ae16f72345a761d657130fd65b681535c20937a86d1d6f279772c9bb31",
       "source": "skills/cabloy-spec-execution/SKILL.md",
       "target": ".claude/skills/cabloy-spec-execution/SKILL.md"
     },
     {
       "adapter": "claude",
       "category": "skill",
-      "sha256": "8ce8a4bc07ef33a40f8b745e34966202be27e6682c995c3fa0c351e1d85af904",
+      "sha256": "4ef681f7bb98e605514e770bfa129d171f915e8562025d6195de0f8dfecaa80a",
       "source": "skills/cabloy-spec-generation/evals/evals.json",
       "target": ".claude/skills/cabloy-spec-generation/evals/evals.json"
     },
     {
       "adapter": "claude",
       "category": "skill",
-      "sha256": "988b4aee132dd64156e7b237653f7ba37f0f088b75f669219c3931b35336ec04",
+      "sha256": "c5a1923be3cf387d3d31535af816e8ecadd52762ebb847a1be0d7cd1fe7c3d61",
+      "source": "skills/cabloy-spec-generation/evals/files/scenarios.json",
+      "target": ".claude/skills/cabloy-spec-generation/evals/files/scenarios.json"
+    },
+    {
+      "adapter": "claude",
+      "category": "skill",
+      "sha256": "4fa0405277092948d79cbde3d5b9b0f2e258dac58bf7e462dffea56da5fdd45f",
+      "source": "skills/cabloy-spec-generation/evals/protocol.md",
+      "target": ".claude/skills/cabloy-spec-generation/evals/protocol.md"
+    },
+    {
+      "adapter": "claude",
+      "category": "skill",
+      "sha256": "85b5a174c20111d31e50071a826f555c1e9b810e52078305af2850f3593f3603",
+      "source": "skills/cabloy-spec-generation/references/canonical-spec-input.md",
+      "target": ".claude/skills/cabloy-spec-generation/references/canonical-spec-input.md"
+    },
+    {
+      "adapter": "claude",
+      "category": "skill",
+      "sha256": "0c482b23c42c893dae4a027a786117ff2ad4b5686e3fc29de0a117d7e4958a49",
       "source": "skills/cabloy-spec-generation/references/repo-aware-discovery.md",
       "target": ".claude/skills/cabloy-spec-generation/references/repo-aware-discovery.md"
     },
     {
       "adapter": "claude",
       "category": "skill",
-      "sha256": "77c90b159387320059b82d83ccdab42d116f4ade2cb844aec2b0dad86d60fcd3",
+      "sha256": "772e83aea0d7a3ad3d5a91d4ecedd09f6cd24ae9eb146399f0834ded3f074185",
       "source": "skills/cabloy-spec-generation/references/repo-specs-document-set.md",
       "target": ".claude/skills/cabloy-spec-generation/references/repo-specs-document-set.md"
     },
     {
       "adapter": "claude",
       "category": "skill",
-      "sha256": "168e58f7acf2a3085a79e745862acb4972c703271563df9769bb23fff2a48d93",
+      "sha256": "242d3b7dd6f9266fa836918443c06add6bf9d2308d7f4288112412ee3a6224f5",
       "source": "skills/cabloy-spec-generation/references/traceability-and-status-rules.md",
       "target": ".claude/skills/cabloy-spec-generation/references/traceability-and-status-rules.md"
     },
     {
       "adapter": "claude",
       "category": "skill",
-      "sha256": "0aacce954ed495a8482d01d28fdcf863757262eae9998234dd4849aa728c3fca",
+      "sha256": "7b66c1f77130d14e44bea6f6f09e0de53fe4ae251ad888e78195dab48246301d",
       "source": "skills/cabloy-spec-generation/SKILL.md",
       "target": ".claude/skills/cabloy-spec-generation/SKILL.md"
     },
@@ -592,7 +662,7 @@
     {
       "adapter": "codex",
       "category": "runtime",
-      "sha256": "3f3fcc1824f18bcdc2040d65932a47cb74b477ad21670dae957de61540af0154",
+      "sha256": "7d7bc4472cd7fdfa2a34193117a771445b3b2ac6fddb553c64050f7ae9cf01cc",
       "source": "adapters/codex/contract-loop-gate.mjs",
       "target": ".codex/hooks/contract-loop-gate.mjs"
     },
@@ -606,7 +676,7 @@
     {
       "adapter": "cursor",
       "category": "runtime",
-      "sha256": "da224fb581fde615273af8db4e2bfca513233a83e69a0803442dfec86bbd6ba6",
+      "sha256": "14ec4e6aaf57cd8cdc21b42b8ff865810d79a82f0927a4445b756e41c0e2438a",
       "source": "adapters/cursor/contract-loop-gate.mjs",
       "target": ".cursor/hooks/contract-loop-gate.mjs"
     },
@@ -634,7 +704,7 @@
     {
       "adapter": "cursor",
       "category": "skill",
-      "sha256": "5ac94eb98e3c89abef06b5164298f953ea16759fc24e8d57d18f5d6c40c4168f",
+      "sha256": "88e6ca8c60d8caeb68ab932f2a7e22810a31911400b4428fd0756d076dbc78e8",
       "source": "skills/cabloy-backend-scaffold/references/follow-up-checklist.md",
       "target": ".cursor/skills/cabloy-backend-scaffold/references/follow-up-checklist.md"
     },
@@ -683,7 +753,7 @@
     {
       "adapter": "cursor",
       "category": "skill",
-      "sha256": "0cc583277837d9e7ec8b54df86eeb43a42efef3b0ac08405c91a6f6345b6b377",
+      "sha256": "aceca7a587634f574301cafad267b9a2d620db1c5a5c1dd8cec9483870fc0400",
       "source": "skills/cabloy-domain-planning/SKILL.md",
       "target": ".cursor/skills/cabloy-domain-planning/SKILL.md"
     },
@@ -774,63 +844,98 @@
     {
       "adapter": "cursor",
       "category": "skill",
-      "sha256": "00b614b97e4cfca37ecb5245e9a58ddd69e744e67b3cae32145499bec01f1812",
+      "sha256": "1d5a93d8285e85778e281c1a82d141f44d6f74112a295fc1d8ad977e2af2b3c3",
       "source": "skills/cabloy-spec-execution/evals/evals.json",
       "target": ".cursor/skills/cabloy-spec-execution/evals/evals.json"
     },
     {
       "adapter": "cursor",
       "category": "skill",
-      "sha256": "ec7d25e9de7f4ecc12e1937e7692dab880892958155d914e086133708878fdd0",
+      "sha256": "187c45fea775846326bcdea17b20a465850e563cd98a9c189725ca5aac5fdee5",
+      "source": "skills/cabloy-spec-execution/evals/files/scenarios.json",
+      "target": ".cursor/skills/cabloy-spec-execution/evals/files/scenarios.json"
+    },
+    {
+      "adapter": "cursor",
+      "category": "skill",
+      "sha256": "4272ada10c6802a70c3fd926aab858724a65e975a716775ac716d6f0ba85c25a",
+      "source": "skills/cabloy-spec-execution/evals/protocol.md",
+      "target": ".cursor/skills/cabloy-spec-execution/evals/protocol.md"
+    },
+    {
+      "adapter": "cursor",
+      "category": "skill",
+      "sha256": "788f9c94a93753f2ad16d0a1f772fe61785514ab69e2564a2a2454f4efb46086",
       "source": "skills/cabloy-spec-execution/references/execution-protocol.md",
       "target": ".cursor/skills/cabloy-spec-execution/references/execution-protocol.md"
     },
     {
       "adapter": "cursor",
       "category": "skill",
-      "sha256": "f8c69f36ac2ea5fc4800ca70fdc5a3d8362e944ca54cd9d657ded6465695e160",
+      "sha256": "ec93b6999fcf87f35f8f1f18eed54bb08ee2753862b34f6c474480f2c88ee7e0",
       "source": "skills/cabloy-spec-execution/references/status-and-evidence.md",
       "target": ".cursor/skills/cabloy-spec-execution/references/status-and-evidence.md"
     },
     {
       "adapter": "cursor",
       "category": "skill",
-      "sha256": "150c826e78616763d73f8e81f2e3d85c0e05eedb649ac2a069359c6ce074d507",
+      "sha256": "52a1a0ae16f72345a761d657130fd65b681535c20937a86d1d6f279772c9bb31",
       "source": "skills/cabloy-spec-execution/SKILL.md",
       "target": ".cursor/skills/cabloy-spec-execution/SKILL.md"
     },
     {
       "adapter": "cursor",
       "category": "skill",
-      "sha256": "8ce8a4bc07ef33a40f8b745e34966202be27e6682c995c3fa0c351e1d85af904",
+      "sha256": "4ef681f7bb98e605514e770bfa129d171f915e8562025d6195de0f8dfecaa80a",
       "source": "skills/cabloy-spec-generation/evals/evals.json",
       "target": ".cursor/skills/cabloy-spec-generation/evals/evals.json"
     },
     {
       "adapter": "cursor",
       "category": "skill",
-      "sha256": "988b4aee132dd64156e7b237653f7ba37f0f088b75f669219c3931b35336ec04",
+      "sha256": "c5a1923be3cf387d3d31535af816e8ecadd52762ebb847a1be0d7cd1fe7c3d61",
+      "source": "skills/cabloy-spec-generation/evals/files/scenarios.json",
+      "target": ".cursor/skills/cabloy-spec-generation/evals/files/scenarios.json"
+    },
+    {
+      "adapter": "cursor",
+      "category": "skill",
+      "sha256": "4fa0405277092948d79cbde3d5b9b0f2e258dac58bf7e462dffea56da5fdd45f",
+      "source": "skills/cabloy-spec-generation/evals/protocol.md",
+      "target": ".cursor/skills/cabloy-spec-generation/evals/protocol.md"
+    },
+    {
+      "adapter": "cursor",
+      "category": "skill",
+      "sha256": "85b5a174c20111d31e50071a826f555c1e9b810e52078305af2850f3593f3603",
+      "source": "skills/cabloy-spec-generation/references/canonical-spec-input.md",
+      "target": ".cursor/skills/cabloy-spec-generation/references/canonical-spec-input.md"
+    },
+    {
+      "adapter": "cursor",
+      "category": "skill",
+      "sha256": "0c482b23c42c893dae4a027a786117ff2ad4b5686e3fc29de0a117d7e4958a49",
       "source": "skills/cabloy-spec-generation/references/repo-aware-discovery.md",
       "target": ".cursor/skills/cabloy-spec-generation/references/repo-aware-discovery.md"
     },
     {
       "adapter": "cursor",
       "category": "skill",
-      "sha256": "77c90b159387320059b82d83ccdab42d116f4ade2cb844aec2b0dad86d60fcd3",
+      "sha256": "772e83aea0d7a3ad3d5a91d4ecedd09f6cd24ae9eb146399f0834ded3f074185",
       "source": "skills/cabloy-spec-generation/references/repo-specs-document-set.md",
       "target": ".cursor/skills/cabloy-spec-generation/references/repo-specs-document-set.md"
     },
     {
       "adapter": "cursor",
       "category": "skill",
-      "sha256": "168e58f7acf2a3085a79e745862acb4972c703271563df9769bb23fff2a48d93",
+      "sha256": "242d3b7dd6f9266fa836918443c06add6bf9d2308d7f4288112412ee3a6224f5",
       "source": "skills/cabloy-spec-generation/references/traceability-and-status-rules.md",
       "target": ".cursor/skills/cabloy-spec-generation/references/traceability-and-status-rules.md"
     },
     {
       "adapter": "cursor",
       "category": "skill",
-      "sha256": "0aacce954ed495a8482d01d28fdcf863757262eae9998234dd4849aa728c3fca",
+      "sha256": "7b66c1f77130d14e44bea6f6f09e0de53fe4ae251ad888e78195dab48246301d",
       "source": "skills/cabloy-spec-generation/SKILL.md",
       "target": ".cursor/skills/cabloy-spec-generation/SKILL.md"
     },

package/repo-agent-governance/scripts/pack-check.mjs

@@ -17,6 +17,18 @@ const required = [
   'repo-agent-governance/scripts/governance.mjs',
   'repo-agent-governance/tools/contract-loop/core.mjs',
   'repo-agent-governance/tools/contract-loop/hook-runtime.mjs',
+  'repo-agent-governance/tools/spec-audit/audit.mjs',
+  'repo-agent-governance/tools/spec-charts/spec-parser.mjs',
+  'repo-agent-governance/tools/spec-charts/generate-implementation-charts.mjs',
+  'repo-agent-governance/skills/cabloy-spec-generation/SKILL.md',
+  'repo-agent-governance/skills/cabloy-spec-generation/references/canonical-spec-input.md',
+  'repo-agent-governance/skills/cabloy-spec-generation/evals/evals.json',
+  'repo-agent-governance/skills/cabloy-spec-generation/evals/protocol.md',
+  'repo-agent-governance/skills/cabloy-spec-generation/evals/files/scenarios.json',
+  'repo-agent-governance/skills/cabloy-spec-execution/SKILL.md',
+  'repo-agent-governance/skills/cabloy-spec-generation/references/repo-aware-discovery.md',
+  'repo-agent-governance/skills/cabloy-spec-generation/references/repo-specs-document-set.md',
+  'repo-agent-governance/skills/cabloy-spec-generation/references/traceability-and-status-rules.md',
   'repo-agent-governance/adapters/cursor/hooks.json',
   'repo-agent-governance/adapters/cursor/contract-loop-gate.mjs',
   'repo-agent-governance/adapters/codex/hooks.json',
@@ -42,6 +54,11 @@ for (const path of forbidden) {
   if (files.has(path))
     throw new Error(`npm package must not contain local governance state: ${path}`);
 }
+for (const path of files) {
+  if (path.startsWith('repo-specs/') || path.startsWith('repo-docs-internal/')) {
+    throw new Error(`npm package must not contain project planning or internal records: ${path}`);
+  }
+}
 // eslint-disable-next-line no-console
 console.log(
   `Governance package surface is valid (${required.length} canonical assets; ${managedAdapters.length} transition adapters excluded).`,

package/repo-agent-governance/skills/cabloy-backend-scaffold/references/follow-up-checklist.md

@@ -43,6 +43,7 @@ When the active edition and installed modules provide `@Passport.rbac(...)` and
 - migration/version changes
 - `meta.version`
 - field indexes; in shared-database multitenancy, preserve ordinary lookup indexes and enforce business uniqueness in tenant-aware business logic rather than with `table.unique(...)`
+- when editing or generating `meta.index`, consolidate each table's specifications into one declaration instead of adding another same-table `$tableColumns` spread; check for leading-column name collisions, effective metadata, and physical index definitions using the [Field Indexes guide](../../../../repo-docs/backend/field-indexes.md)
 - relations
 - datasource choice
 - cache behavior

package/repo-agent-governance/skills/cabloy-domain-planning/SKILL.md

@@ -143,9 +143,11 @@ Use examples such as:
 
 When helpful, explain why the recommendation is better than obvious alternatives.
 
-## Step 7: Require confirmation before scaffolding
+## Step 7: Confirm naming and preserve the caller's workflow
 
-Before suggesting any scaffold execution, explicitly confirm:
+If invoked by `cabloy-spec-generation` because naming was unresolved, this is a **naming-only** detour. Return the validated identity, capability names, proposed ownership, edition, and remaining naming questions to generation. Do not run scaffold commands or treat naming confirmation as generation, ADR, or execution approval. Generation resumes its selected complete/incremental/lightweight mode and confirmation gate.
+
+For a direct scaffolding request, before suggesting execution, explicitly confirm:
 
 - `providerId`
 - suite short name
@@ -160,7 +162,7 @@ Always leave a custom path available, for example:
 
 ## Step 8: Hand off to CLI-first scaffolding only after confirmation
 
-Once naming is confirmed, route to the real generators rather than hand-authoring structure.
+For a naming-only detour, return to `cabloy-spec-generation` without source generation. Only a direct, explicitly confirmed scaffolding request routes to the real generators rather than hand-authoring structure. A completed spec baseline instead hands one bounded WBS candidate to `cabloy-spec-execution` for its own dossier approval.
 
 Typical commands are: