cabloy 5.1.194 → 5.1.195

package/.cabloy-version

@@ -1 +1 @@
-5.1.194
+5.1.195

package/.github/workflows/agent-governance.yml

@@ -35,5 +35,6 @@ jobs:
           npm run agent:governance:pack-check
           npm run test:spec-charts
           npm run spec:charts:check -- a-commerce
+          npm run spec:charts:check -- home-user
       - name: build documentation
         run: npm run docs:build

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## 5.1.195
+
+### Features
+
+- Update application features.
+
+### Bug Fixes
+
+- Fix metadata index merging and preserve indexes on the same table in metadata and generators.
+
+### Improvements
+
+- Enhance transaction handling and specification skills.
+- Refine the commerce specification and clarify the tutorial’s OpenAPI workflow and contract model.
+- Update the controller AOP guide, SSR comparison, development history, introduction, README, and site icon.
+
 ## 5.1.194
 
 ### Bug Fixes

package/README.md

@@ -6,32 +6,31 @@
 [![Docs](https://img.shields.io/badge/docs-cabloy-4f46e5.svg?style=flat-square)](https://cabloy.com)
 [![Demo](https://img.shields.io/badge/demo-cabloy.com-059669.svg?style=flat-square)](https://cabloy.com/demo)
 
-Cabloy is a Node.js fullstack framework for AI vibe coding, with AI Spec-Driven Development for traceable, evidence-backed delivery.
+Cabloy is a Node.js fullstack framework for AI vibe coding, with AI Spec-Driven Development guiding work from confirmed specs to verifiable delivery.
 
-**One fullstack system for AI vibe coding—bidirectional type sync, CLI-first workflows, docs, skills, and traceable delivery from product intent to verifiable evidence.**
-
-Instead of stitching separate backend and frontend stacks together, Cabloy keeps their contracts, tooling, and guidance connected in one repository. [AI Spec-Driven Development](https://cabloy.com/ai/ai-spec-driven-development) provides the disciplined path from confirmed Specs to evidence-backed delivery; its precise engineering method is Traceable Spec Delivery. Vona is its backend framework and runtime layer, and Zova is its frontend framework and application layer. Cabloy Basic and Cabloy Start are related, complete edition baselines built on that shared architecture; see [Editions Overview](https://cabloy.com/editions/overview) for their deliberate differences.
+Cabloy Basic and Cabloy Start are complete editions built on this shared architecture; see [Editions Overview](https://cabloy.com/editions/overview) for their differences.
 
 [Documentation](https://cabloy.com) · [npm](https://www.npmjs.com/package/cabloy) · [Demo](https://cabloy.com/demo) · [GitHub](https://github.com/cabloy/cabloy)
 
 ## Fullstack Principles
 
-Cabloy’s fullstack model is built around two core principles:
+Cabloy connects Vona and Zova in two ways:
 
-1. **Frontend build output participates directly in backend SSR**
-   - Zova owns the frontend application source
-   - the generated frontend bundle and SSR-related artifacts are consumed by the Vona-side SSR flow
-   - backend rendering and frontend hydration stay on one coordinated delivery path
+1. **Integrated SSR.** Zova builds the frontend and SSR artifacts. In Vona integrated SSR, Vona consumes those artifacts to render the page, and Zova hydrates it in the browser.
 
-2. **Type information flows in both directions**
-   - **Backend -> Frontend**: Vona emits Swagger/OpenAPI contracts that Zova can use to generate SDKs and related schema-aware helpers
-   - **Frontend -> Backend**: Zova generates structural metadata and typing surfaces such as routes, components, and icons that can improve backend-side tooling and type hints
+2. **Bidirectional contract flow.** Vona's OpenAPI contracts generate Zova SDKs and schema-aware helpers. Zova's generated metadata and types for routes, components, and icons feed back into Vona's tooling and type hints.
 
-For the complete explanation, see [Fullstack Introduction](https://cabloy.com/fullstack/introduction), [Vona + Zova Integration](https://cabloy.com/fullstack/vona-zova-integration), [Backend OpenAPI to Frontend SDK](https://cabloy.com/fullstack/openapi-to-sdk), and [Frontend Metadata Back to Backend](https://cabloy.com/fullstack/frontend-metadata-to-backend).
+Learn more about [Vona + Zova Integration](https://cabloy.com/fullstack/vona-zova-integration) and the [Contract Loop](https://cabloy.com/fullstack/contract-loop-playbook).
 
 ## Get Started
 
-See the [Fullstack Quickstart](https://cabloy.com/fullstack/quickstart).
+Create a new Cabloy Basic project:
+
+```bash
+npm create cabloy
+```
+
+For Cabloy Start, clone the [Cabloy Start repository](https://github.com/cabloy/cabloy-start) and run `npm run init` from its root. See the [Fullstack Quickstart](https://cabloy.com/fullstack/quickstart) for prerequisites and development commands.
 
 ## AI Spec-Driven Development
 
@@ -78,16 +77,6 @@ Included demonstration suites give AI vibe coding agents high-quality, project-n
 
 > “Not included” means that the suite is not part of the default edition baseline. It does not limit what can be built with Cabloy.
 
-## Highlights
-
-- **One fullstack system** — build backend and frontend together instead of assembling separate stacks
-- **Bidirectional type sync** — use the contract loop to keep backend contracts and frontend metadata aligned in both directions
-- **CLI-first workflows** — use explicit commands for scaffolding, generation, refactors, and verification
-- **Docs and skills** — give people and AI agents reusable, source-grounded guidance for the current repository
-- **AI Spec-Driven Development** — use Traceable Spec Delivery to connect product intent, contracts, bounded work, acceptance procedures, and verifiable evidence
-- **Vona + Zova** — use aligned backend and frontend layers for code sharing and cross-stack consistency
-- **Modular delivery** — organize capabilities as suites and modules, then deliver SSR, SPA, Web, and Admin applications with shared conventions
-
 ## Technology Stack
 
 ### General

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cabloy",
-  "version": "5.1.194",
+  "version": "5.1.195",
   "gitHead": "2c5c19284bab738e492856189acb6fad74b8a7b7",
   "description": "A Node.js fullstack framework",
   "keywords": [
@@ -60,6 +60,7 @@
     "test:spec-charts": "node --test repo-agent-governance/tools/spec-charts/generate-implementation-charts.test.mjs",
     "spec:charts": "node ./repo-agent-governance/tools/spec-charts/generate-implementation-charts.mjs",
     "spec:charts:check": "node ./repo-agent-governance/tools/spec-charts/generate-implementation-charts.mjs --check",
+    "spec:check": "node ./repo-agent-governance/tools/spec-audit/audit.mjs",
     "docs:dev": "pnpm --dir repo-docs docs:dev",
     "docs:build": "pnpm --dir repo-docs docs:build",
     "docs:preview": "pnpm --dir repo-docs docs:preview",

package/repo-agent-governance/managed-assets.json

@@ -18,7 +18,7 @@
     {
       "adapter": "codex",
       "category": "skill",
-      "sha256": "5ac94eb98e3c89abef06b5164298f953ea16759fc24e8d57d18f5d6c40c4168f",
+      "sha256": "88e6ca8c60d8caeb68ab932f2a7e22810a31911400b4428fd0756d076dbc78e8",
       "source": "skills/cabloy-backend-scaffold/references/follow-up-checklist.md",
       "target": ".agents/skills/cabloy-backend-scaffold/references/follow-up-checklist.md"
     },
@@ -67,7 +67,7 @@
     {
       "adapter": "codex",
       "category": "skill",
-      "sha256": "0cc583277837d9e7ec8b54df86eeb43a42efef3b0ac08405c91a6f6345b6b377",
+      "sha256": "aceca7a587634f574301cafad267b9a2d620db1c5a5c1dd8cec9483870fc0400",
       "source": "skills/cabloy-domain-planning/SKILL.md",
       "target": ".agents/skills/cabloy-domain-planning/SKILL.md"
     },
@@ -158,63 +158,98 @@
     {
       "adapter": "codex",
       "category": "skill",
-      "sha256": "00b614b97e4cfca37ecb5245e9a58ddd69e744e67b3cae32145499bec01f1812",
+      "sha256": "1d5a93d8285e85778e281c1a82d141f44d6f74112a295fc1d8ad977e2af2b3c3",
       "source": "skills/cabloy-spec-execution/evals/evals.json",
       "target": ".agents/skills/cabloy-spec-execution/evals/evals.json"
     },
     {
       "adapter": "codex",
       "category": "skill",
-      "sha256": "ec7d25e9de7f4ecc12e1937e7692dab880892958155d914e086133708878fdd0",
+      "sha256": "187c45fea775846326bcdea17b20a465850e563cd98a9c189725ca5aac5fdee5",
+      "source": "skills/cabloy-spec-execution/evals/files/scenarios.json",
+      "target": ".agents/skills/cabloy-spec-execution/evals/files/scenarios.json"
+    },
+    {
+      "adapter": "codex",
+      "category": "skill",
+      "sha256": "4272ada10c6802a70c3fd926aab858724a65e975a716775ac716d6f0ba85c25a",
+      "source": "skills/cabloy-spec-execution/evals/protocol.md",
+      "target": ".agents/skills/cabloy-spec-execution/evals/protocol.md"
+    },
+    {
+      "adapter": "codex",
+      "category": "skill",
+      "sha256": "788f9c94a93753f2ad16d0a1f772fe61785514ab69e2564a2a2454f4efb46086",
       "source": "skills/cabloy-spec-execution/references/execution-protocol.md",
       "target": ".agents/skills/cabloy-spec-execution/references/execution-protocol.md"
     },
     {
       "adapter": "codex",
       "category": "skill",
-      "sha256": "f8c69f36ac2ea5fc4800ca70fdc5a3d8362e944ca54cd9d657ded6465695e160",
+      "sha256": "ec93b6999fcf87f35f8f1f18eed54bb08ee2753862b34f6c474480f2c88ee7e0",
       "source": "skills/cabloy-spec-execution/references/status-and-evidence.md",
       "target": ".agents/skills/cabloy-spec-execution/references/status-and-evidence.md"
     },
     {
       "adapter": "codex",
       "category": "skill",
-      "sha256": "150c826e78616763d73f8e81f2e3d85c0e05eedb649ac2a069359c6ce074d507",
+      "sha256": "52a1a0ae16f72345a761d657130fd65b681535c20937a86d1d6f279772c9bb31",
       "source": "skills/cabloy-spec-execution/SKILL.md",
       "target": ".agents/skills/cabloy-spec-execution/SKILL.md"
     },
     {
       "adapter": "codex",
       "category": "skill",
-      "sha256": "8ce8a4bc07ef33a40f8b745e34966202be27e6682c995c3fa0c351e1d85af904",
+      "sha256": "4ef681f7bb98e605514e770bfa129d171f915e8562025d6195de0f8dfecaa80a",
       "source": "skills/cabloy-spec-generation/evals/evals.json",
       "target": ".agents/skills/cabloy-spec-generation/evals/evals.json"
     },
     {
       "adapter": "codex",
       "category": "skill",
-      "sha256": "988b4aee132dd64156e7b237653f7ba37f0f088b75f669219c3931b35336ec04",
+      "sha256": "c5a1923be3cf387d3d31535af816e8ecadd52762ebb847a1be0d7cd1fe7c3d61",
+      "source": "skills/cabloy-spec-generation/evals/files/scenarios.json",
+      "target": ".agents/skills/cabloy-spec-generation/evals/files/scenarios.json"
+    },
+    {
+      "adapter": "codex",
+      "category": "skill",
+      "sha256": "4fa0405277092948d79cbde3d5b9b0f2e258dac58bf7e462dffea56da5fdd45f",
+      "source": "skills/cabloy-spec-generation/evals/protocol.md",
+      "target": ".agents/skills/cabloy-spec-generation/evals/protocol.md"
+    },
+    {
+      "adapter": "codex",
+      "category": "skill",
+      "sha256": "85b5a174c20111d31e50071a826f555c1e9b810e52078305af2850f3593f3603",
+      "source": "skills/cabloy-spec-generation/references/canonical-spec-input.md",
+      "target": ".agents/skills/cabloy-spec-generation/references/canonical-spec-input.md"
+    },
+    {
+      "adapter": "codex",
+      "category": "skill",
+      "sha256": "0c482b23c42c893dae4a027a786117ff2ad4b5686e3fc29de0a117d7e4958a49",
       "source": "skills/cabloy-spec-generation/references/repo-aware-discovery.md",
       "target": ".agents/skills/cabloy-spec-generation/references/repo-aware-discovery.md"
     },
     {
       "adapter": "codex",
       "category": "skill",
-      "sha256": "77c90b159387320059b82d83ccdab42d116f4ade2cb844aec2b0dad86d60fcd3",
+      "sha256": "772e83aea0d7a3ad3d5a91d4ecedd09f6cd24ae9eb146399f0834ded3f074185",
       "source": "skills/cabloy-spec-generation/references/repo-specs-document-set.md",
       "target": ".agents/skills/cabloy-spec-generation/references/repo-specs-document-set.md"
     },
     {
       "adapter": "codex",
       "category": "skill",
-      "sha256": "168e58f7acf2a3085a79e745862acb4972c703271563df9769bb23fff2a48d93",
+      "sha256": "242d3b7dd6f9266fa836918443c06add6bf9d2308d7f4288112412ee3a6224f5",
       "source": "skills/cabloy-spec-generation/references/traceability-and-status-rules.md",
       "target": ".agents/skills/cabloy-spec-generation/references/traceability-and-status-rules.md"
     },
     {
       "adapter": "codex",
       "category": "skill",
-      "sha256": "0aacce954ed495a8482d01d28fdcf863757262eae9998234dd4849aa728c3fca",
+      "sha256": "7b66c1f77130d14e44bea6f6f09e0de53fe4ae251ad888e78195dab48246301d",
       "source": "skills/cabloy-spec-generation/SKILL.md",
       "target": ".agents/skills/cabloy-spec-generation/SKILL.md"
     },
@@ -319,7 +354,7 @@
     {
       "adapter": "claude",
       "category": "skill",
-      "sha256": "5ac94eb98e3c89abef06b5164298f953ea16759fc24e8d57d18f5d6c40c4168f",
+      "sha256": "88e6ca8c60d8caeb68ab932f2a7e22810a31911400b4428fd0756d076dbc78e8",
       "source": "skills/cabloy-backend-scaffold/references/follow-up-checklist.md",
       "target": ".claude/skills/cabloy-backend-scaffold/references/follow-up-checklist.md"
     },
@@ -368,7 +403,7 @@
     {
       "adapter": "claude",
       "category": "skill",
-      "sha256": "0cc583277837d9e7ec8b54df86eeb43a42efef3b0ac08405c91a6f6345b6b377",
+      "sha256": "aceca7a587634f574301cafad267b9a2d620db1c5a5c1dd8cec9483870fc0400",
       "source": "skills/cabloy-domain-planning/SKILL.md",
       "target": ".claude/skills/cabloy-domain-planning/SKILL.md"
     },
@@ -459,63 +494,98 @@
     {
       "adapter": "claude",
       "category": "skill",
-      "sha256": "00b614b97e4cfca37ecb5245e9a58ddd69e744e67b3cae32145499bec01f1812",
+      "sha256": "1d5a93d8285e85778e281c1a82d141f44d6f74112a295fc1d8ad977e2af2b3c3",
       "source": "skills/cabloy-spec-execution/evals/evals.json",
       "target": ".claude/skills/cabloy-spec-execution/evals/evals.json"
     },
     {
       "adapter": "claude",
       "category": "skill",
-      "sha256": "ec7d25e9de7f4ecc12e1937e7692dab880892958155d914e086133708878fdd0",
+      "sha256": "187c45fea775846326bcdea17b20a465850e563cd98a9c189725ca5aac5fdee5",
+      "source": "skills/cabloy-spec-execution/evals/files/scenarios.json",
+      "target": ".claude/skills/cabloy-spec-execution/evals/files/scenarios.json"
+    },
+    {
+      "adapter": "claude",
+      "category": "skill",
+      "sha256": "4272ada10c6802a70c3fd926aab858724a65e975a716775ac716d6f0ba85c25a",
+      "source": "skills/cabloy-spec-execution/evals/protocol.md",
+      "target": ".claude/skills/cabloy-spec-execution/evals/protocol.md"
+    },
+    {
+      "adapter": "claude",
+      "category": "skill",
+      "sha256": "788f9c94a93753f2ad16d0a1f772fe61785514ab69e2564a2a2454f4efb46086",
       "source": "skills/cabloy-spec-execution/references/execution-protocol.md",
       "target": ".claude/skills/cabloy-spec-execution/references/execution-protocol.md"
     },
     {
       "adapter": "claude",
       "category": "skill",
-      "sha256": "f8c69f36ac2ea5fc4800ca70fdc5a3d8362e944ca54cd9d657ded6465695e160",
+      "sha256": "ec93b6999fcf87f35f8f1f18eed54bb08ee2753862b34f6c474480f2c88ee7e0",
       "source": "skills/cabloy-spec-execution/references/status-and-evidence.md",
       "target": ".claude/skills/cabloy-spec-execution/references/status-and-evidence.md"
     },
     {
       "adapter": "claude",
       "category": "skill",
-      "sha256": "150c826e78616763d73f8e81f2e3d85c0e05eedb649ac2a069359c6ce074d507",
+      "sha256": "52a1a0ae16f72345a761d657130fd65b681535c20937a86d1d6f279772c9bb31",
       "source": "skills/cabloy-spec-execution/SKILL.md",
       "target": ".claude/skills/cabloy-spec-execution/SKILL.md"
     },
     {
       "adapter": "claude",
       "category": "skill",
-      "sha256": "8ce8a4bc07ef33a40f8b745e34966202be27e6682c995c3fa0c351e1d85af904",
+      "sha256": "4ef681f7bb98e605514e770bfa129d171f915e8562025d6195de0f8dfecaa80a",
       "source": "skills/cabloy-spec-generation/evals/evals.json",
       "target": ".claude/skills/cabloy-spec-generation/evals/evals.json"
     },
     {
       "adapter": "claude",
       "category": "skill",
-      "sha256": "988b4aee132dd64156e7b237653f7ba37f0f088b75f669219c3931b35336ec04",
+      "sha256": "c5a1923be3cf387d3d31535af816e8ecadd52762ebb847a1be0d7cd1fe7c3d61",
+      "source": "skills/cabloy-spec-generation/evals/files/scenarios.json",
+      "target": ".claude/skills/cabloy-spec-generation/evals/files/scenarios.json"
+    },
+    {
+      "adapter": "claude",
+      "category": "skill",
+      "sha256": "4fa0405277092948d79cbde3d5b9b0f2e258dac58bf7e462dffea56da5fdd45f",
+      "source": "skills/cabloy-spec-generation/evals/protocol.md",
+      "target": ".claude/skills/cabloy-spec-generation/evals/protocol.md"
+    },
+    {
+      "adapter": "claude",
+      "category": "skill",
+      "sha256": "85b5a174c20111d31e50071a826f555c1e9b810e52078305af2850f3593f3603",
+      "source": "skills/cabloy-spec-generation/references/canonical-spec-input.md",
+      "target": ".claude/skills/cabloy-spec-generation/references/canonical-spec-input.md"
+    },
+    {
+      "adapter": "claude",
+      "category": "skill",
+      "sha256": "0c482b23c42c893dae4a027a786117ff2ad4b5686e3fc29de0a117d7e4958a49",
       "source": "skills/cabloy-spec-generation/references/repo-aware-discovery.md",
       "target": ".claude/skills/cabloy-spec-generation/references/repo-aware-discovery.md"
     },
     {
       "adapter": "claude",
       "category": "skill",
-      "sha256": "77c90b159387320059b82d83ccdab42d116f4ade2cb844aec2b0dad86d60fcd3",
+      "sha256": "772e83aea0d7a3ad3d5a91d4ecedd09f6cd24ae9eb146399f0834ded3f074185",
       "source": "skills/cabloy-spec-generation/references/repo-specs-document-set.md",
       "target": ".claude/skills/cabloy-spec-generation/references/repo-specs-document-set.md"
     },
     {
       "adapter": "claude",
       "category": "skill",
-      "sha256": "168e58f7acf2a3085a79e745862acb4972c703271563df9769bb23fff2a48d93",
+      "sha256": "242d3b7dd6f9266fa836918443c06add6bf9d2308d7f4288112412ee3a6224f5",
       "source": "skills/cabloy-spec-generation/references/traceability-and-status-rules.md",
       "target": ".claude/skills/cabloy-spec-generation/references/traceability-and-status-rules.md"
     },
     {
       "adapter": "claude",
       "category": "skill",
-      "sha256": "0aacce954ed495a8482d01d28fdcf863757262eae9998234dd4849aa728c3fca",
+      "sha256": "7b66c1f77130d14e44bea6f6f09e0de53fe4ae251ad888e78195dab48246301d",
       "source": "skills/cabloy-spec-generation/SKILL.md",
       "target": ".claude/skills/cabloy-spec-generation/SKILL.md"
     },
@@ -634,7 +704,7 @@
     {
       "adapter": "cursor",
       "category": "skill",
-      "sha256": "5ac94eb98e3c89abef06b5164298f953ea16759fc24e8d57d18f5d6c40c4168f",
+      "sha256": "88e6ca8c60d8caeb68ab932f2a7e22810a31911400b4428fd0756d076dbc78e8",
       "source": "skills/cabloy-backend-scaffold/references/follow-up-checklist.md",
       "target": ".cursor/skills/cabloy-backend-scaffold/references/follow-up-checklist.md"
     },
@@ -683,7 +753,7 @@
     {
       "adapter": "cursor",
       "category": "skill",
-      "sha256": "0cc583277837d9e7ec8b54df86eeb43a42efef3b0ac08405c91a6f6345b6b377",
+      "sha256": "aceca7a587634f574301cafad267b9a2d620db1c5a5c1dd8cec9483870fc0400",
       "source": "skills/cabloy-domain-planning/SKILL.md",
       "target": ".cursor/skills/cabloy-domain-planning/SKILL.md"
     },
@@ -774,63 +844,98 @@
     {
       "adapter": "cursor",
       "category": "skill",
-      "sha256": "00b614b97e4cfca37ecb5245e9a58ddd69e744e67b3cae32145499bec01f1812",
+      "sha256": "1d5a93d8285e85778e281c1a82d141f44d6f74112a295fc1d8ad977e2af2b3c3",
       "source": "skills/cabloy-spec-execution/evals/evals.json",
       "target": ".cursor/skills/cabloy-spec-execution/evals/evals.json"
     },
     {
       "adapter": "cursor",
       "category": "skill",
-      "sha256": "ec7d25e9de7f4ecc12e1937e7692dab880892958155d914e086133708878fdd0",
+      "sha256": "187c45fea775846326bcdea17b20a465850e563cd98a9c189725ca5aac5fdee5",
+      "source": "skills/cabloy-spec-execution/evals/files/scenarios.json",
+      "target": ".cursor/skills/cabloy-spec-execution/evals/files/scenarios.json"
+    },
+    {
+      "adapter": "cursor",
+      "category": "skill",
+      "sha256": "4272ada10c6802a70c3fd926aab858724a65e975a716775ac716d6f0ba85c25a",
+      "source": "skills/cabloy-spec-execution/evals/protocol.md",
+      "target": ".cursor/skills/cabloy-spec-execution/evals/protocol.md"
+    },
+    {
+      "adapter": "cursor",
+      "category": "skill",
+      "sha256": "788f9c94a93753f2ad16d0a1f772fe61785514ab69e2564a2a2454f4efb46086",
       "source": "skills/cabloy-spec-execution/references/execution-protocol.md",
       "target": ".cursor/skills/cabloy-spec-execution/references/execution-protocol.md"
     },
     {
       "adapter": "cursor",
       "category": "skill",
-      "sha256": "f8c69f36ac2ea5fc4800ca70fdc5a3d8362e944ca54cd9d657ded6465695e160",
+      "sha256": "ec93b6999fcf87f35f8f1f18eed54bb08ee2753862b34f6c474480f2c88ee7e0",
       "source": "skills/cabloy-spec-execution/references/status-and-evidence.md",
       "target": ".cursor/skills/cabloy-spec-execution/references/status-and-evidence.md"
     },
     {
       "adapter": "cursor",
       "category": "skill",
-      "sha256": "150c826e78616763d73f8e81f2e3d85c0e05eedb649ac2a069359c6ce074d507",
+      "sha256": "52a1a0ae16f72345a761d657130fd65b681535c20937a86d1d6f279772c9bb31",
       "source": "skills/cabloy-spec-execution/SKILL.md",
       "target": ".cursor/skills/cabloy-spec-execution/SKILL.md"
     },
     {
       "adapter": "cursor",
       "category": "skill",
-      "sha256": "8ce8a4bc07ef33a40f8b745e34966202be27e6682c995c3fa0c351e1d85af904",
+      "sha256": "4ef681f7bb98e605514e770bfa129d171f915e8562025d6195de0f8dfecaa80a",
       "source": "skills/cabloy-spec-generation/evals/evals.json",
       "target": ".cursor/skills/cabloy-spec-generation/evals/evals.json"
     },
     {
       "adapter": "cursor",
       "category": "skill",
-      "sha256": "988b4aee132dd64156e7b237653f7ba37f0f088b75f669219c3931b35336ec04",
+      "sha256": "c5a1923be3cf387d3d31535af816e8ecadd52762ebb847a1be0d7cd1fe7c3d61",
+      "source": "skills/cabloy-spec-generation/evals/files/scenarios.json",
+      "target": ".cursor/skills/cabloy-spec-generation/evals/files/scenarios.json"
+    },
+    {
+      "adapter": "cursor",
+      "category": "skill",
+      "sha256": "4fa0405277092948d79cbde3d5b9b0f2e258dac58bf7e462dffea56da5fdd45f",
+      "source": "skills/cabloy-spec-generation/evals/protocol.md",
+      "target": ".cursor/skills/cabloy-spec-generation/evals/protocol.md"
+    },
+    {
+      "adapter": "cursor",
+      "category": "skill",
+      "sha256": "85b5a174c20111d31e50071a826f555c1e9b810e52078305af2850f3593f3603",
+      "source": "skills/cabloy-spec-generation/references/canonical-spec-input.md",
+      "target": ".cursor/skills/cabloy-spec-generation/references/canonical-spec-input.md"
+    },
+    {
+      "adapter": "cursor",
+      "category": "skill",
+      "sha256": "0c482b23c42c893dae4a027a786117ff2ad4b5686e3fc29de0a117d7e4958a49",
       "source": "skills/cabloy-spec-generation/references/repo-aware-discovery.md",
       "target": ".cursor/skills/cabloy-spec-generation/references/repo-aware-discovery.md"
     },
     {
       "adapter": "cursor",
       "category": "skill",
-      "sha256": "77c90b159387320059b82d83ccdab42d116f4ade2cb844aec2b0dad86d60fcd3",
+      "sha256": "772e83aea0d7a3ad3d5a91d4ecedd09f6cd24ae9eb146399f0834ded3f074185",
       "source": "skills/cabloy-spec-generation/references/repo-specs-document-set.md",
       "target": ".cursor/skills/cabloy-spec-generation/references/repo-specs-document-set.md"
     },
     {
       "adapter": "cursor",
       "category": "skill",
-      "sha256": "168e58f7acf2a3085a79e745862acb4972c703271563df9769bb23fff2a48d93",
+      "sha256": "242d3b7dd6f9266fa836918443c06add6bf9d2308d7f4288112412ee3a6224f5",
       "source": "skills/cabloy-spec-generation/references/traceability-and-status-rules.md",
       "target": ".cursor/skills/cabloy-spec-generation/references/traceability-and-status-rules.md"
     },
     {
       "adapter": "cursor",
       "category": "skill",
-      "sha256": "0aacce954ed495a8482d01d28fdcf863757262eae9998234dd4849aa728c3fca",
+      "sha256": "7b66c1f77130d14e44bea6f6f09e0de53fe4ae251ad888e78195dab48246301d",
       "source": "skills/cabloy-spec-generation/SKILL.md",
       "target": ".cursor/skills/cabloy-spec-generation/SKILL.md"
     },

package/repo-agent-governance/scripts/pack-check.mjs

@@ -17,6 +17,18 @@ const required = [
   'repo-agent-governance/scripts/governance.mjs',
   'repo-agent-governance/tools/contract-loop/core.mjs',
   'repo-agent-governance/tools/contract-loop/hook-runtime.mjs',
+  'repo-agent-governance/tools/spec-audit/audit.mjs',
+  'repo-agent-governance/tools/spec-charts/spec-parser.mjs',
+  'repo-agent-governance/tools/spec-charts/generate-implementation-charts.mjs',
+  'repo-agent-governance/skills/cabloy-spec-generation/SKILL.md',
+  'repo-agent-governance/skills/cabloy-spec-generation/references/canonical-spec-input.md',
+  'repo-agent-governance/skills/cabloy-spec-generation/evals/evals.json',
+  'repo-agent-governance/skills/cabloy-spec-generation/evals/protocol.md',
+  'repo-agent-governance/skills/cabloy-spec-generation/evals/files/scenarios.json',
+  'repo-agent-governance/skills/cabloy-spec-execution/SKILL.md',
+  'repo-agent-governance/skills/cabloy-spec-generation/references/repo-aware-discovery.md',
+  'repo-agent-governance/skills/cabloy-spec-generation/references/repo-specs-document-set.md',
+  'repo-agent-governance/skills/cabloy-spec-generation/references/traceability-and-status-rules.md',
   'repo-agent-governance/adapters/cursor/hooks.json',
   'repo-agent-governance/adapters/cursor/contract-loop-gate.mjs',
   'repo-agent-governance/adapters/codex/hooks.json',
@@ -42,6 +54,11 @@ for (const path of forbidden) {
   if (files.has(path))
     throw new Error(`npm package must not contain local governance state: ${path}`);
 }
+for (const path of files) {
+  if (path.startsWith('repo-specs/') || path.startsWith('repo-docs-internal/')) {
+    throw new Error(`npm package must not contain project planning or internal records: ${path}`);
+  }
+}
 // eslint-disable-next-line no-console
 console.log(
   `Governance package surface is valid (${required.length} canonical assets; ${managedAdapters.length} transition adapters excluded).`,

package/repo-agent-governance/skills/cabloy-backend-scaffold/references/follow-up-checklist.md

@@ -43,6 +43,7 @@ When the active edition and installed modules provide `@Passport.rbac(...)` and
 - migration/version changes
 - `meta.version`
 - field indexes; in shared-database multitenancy, preserve ordinary lookup indexes and enforce business uniqueness in tenant-aware business logic rather than with `table.unique(...)`
+- when editing or generating `meta.index`, consolidate each table's specifications into one declaration instead of adding another same-table `$tableColumns` spread; check for leading-column name collisions, effective metadata, and physical index definitions using the [Field Indexes guide](../../../../repo-docs/backend/field-indexes.md)
 - relations
 - datasource choice
 - cache behavior

package/repo-agent-governance/skills/cabloy-domain-planning/SKILL.md

@@ -143,9 +143,11 @@ Use examples such as:
 
 When helpful, explain why the recommendation is better than obvious alternatives.
 
-## Step 7: Require confirmation before scaffolding
+## Step 7: Confirm naming and preserve the caller's workflow
 
-Before suggesting any scaffold execution, explicitly confirm:
+If invoked by `cabloy-spec-generation` because naming was unresolved, this is a **naming-only** detour. Return the validated identity, capability names, proposed ownership, edition, and remaining naming questions to generation. Do not run scaffold commands or treat naming confirmation as generation, ADR, or execution approval. Generation resumes its selected complete/incremental/lightweight mode and confirmation gate.
+
+For a direct scaffolding request, before suggesting execution, explicitly confirm:
 
 - `providerId`
 - suite short name
@@ -160,7 +162,7 @@ Always leave a custom path available, for example:
 
 ## Step 8: Hand off to CLI-first scaffolding only after confirmation
 
-Once naming is confirmed, route to the real generators rather than hand-authoring structure.
+For a naming-only detour, return to `cabloy-spec-generation` without source generation. Only a direct, explicitly confirmed scaffolding request routes to the real generators rather than hand-authoring structure. A completed spec baseline instead hands one bounded WBS candidate to `cabloy-spec-execution` for its own dossier approval.
 
 Typical commands are:
 

package/repo-agent-governance/skills/cabloy-spec-execution/SKILL.md

@@ -31,9 +31,10 @@ From the active repository root, inspect:
 
 Interpret the markers as follows:
 
-- `__CABLOY_BASIC__` present: use Basic source, scripts, flavors, UI, and SSR facts only when observed;
-- `__CABLOY_START__` present: resolve Start-specific scripts, flavor/site names, paths, UI, and SSR behavior from the active Start repository;
-- neither present: stop before edition-specific execution and ask the user to confirm the repository context.
+- exactly `__CABLOY_BASIC__`: use observed Basic source, scripts, flavors, UI, and SSR facts;
+- exactly `__CABLOY_START__`: resolve those facts from the active Start repository;
+- both markers: stop; the checkout is invalid or ambiguous;
+- neither: inspect the owning package/structure and ask before edition-specific execution.
 
 A PostToolUse hook or an automatic build is convenience assistance, not evidence that the task is synchronized or verified. The deterministic chart commands are `npm run spec:charts -- <suite>` and `npm run spec:charts:check -- <suite>`; they validate derived-view freshness, not implementation or ATP completion.
 
@@ -66,7 +67,9 @@ Read the suite records in this order:
 4. `test-plan.md` for linked `ATP-*` procedures, fixture/cleanup rules, evidence requirements, and release gates;
 5. `progress.md` for current derived state, blockers, waivers, prior evidence, superseded proof, and next action;
 6. linked evidence, phase indexes, presentation contracts, rollout records, or provider runbooks when referenced;
-7. `implementation-gantt.svg` and `implementation-burndown.svg` as derived views; check their freshness rather than treating them as authority.
+7. applicable implementation charts as derived views: check freshness only with complete supported README/WBS/ATP/progress inputs; otherwise report the legacy/lightweight input gap without inventing business definitions.
+
+Keep planning authority audit (`npm run spec:check -- <suite>`, with `--lightweight` only for agreed limited scope), chart model/freshness, and human approval/evidence as three independent gates. Static passes do not clear controlling TODOs, accept ADRs, or prove ATP execution.
 
 Do not trust the first status statement found in a historical record. Reconcile revision, chronology, supersession, and the authoritative current progress row before deciding readiness.
 
@@ -83,7 +86,9 @@ Before implementation, present a concise dossier containing:
 - records permitted to change (`progress.md`, evidence/phase index, derived implementation charts, and only other records whose established convention requires it);
 - remaining blockers, `TODO(confirm)` decisions, unsafe actions intentionally excluded, and one next action.
 
-Keep observed repository facts separate from target contracts. Require explicit user confirmation of this dossier before making source changes, running meaningful verification, or writing evidence/status updates. Do not treat silence as approval.
+Classify targets as observed existing, proposed new, or explicitly approved new. An explicitly approved new site/flavor tuple may be created before target source exists when framework constraints and collisions were checked, the concrete design was explicitly approved, and its governing ADR is `Accepted`. Cite the design, planned paths/manifests, and creation prerequisites. A new wrapper remains a planned addition until created and observed; do not run it prematurely. Shared integration still needs an observed owner. Proposed/unchecked values and controlling TODOs remain gated.
+
+Require explicit dossier approval before source changes, meaningful verification, or evidence/status updates. Generation approval, design/ADR acceptance, and this execution approval are separate; silence is not approval.
 
 ## Step 5: Apply readiness gates
 
@@ -115,7 +120,7 @@ Keep the specialist’s CLI-first and follow-up rules. Never hand-edit generated
 
 ## Step 7: Verify narrowly, then expand as required
 
-Start with the narrowest meaningful check for the selected task, then follow the linked ATP and release-gate requirements. Use only commands observed in the active repository and approved by the dossier.
+Start with the narrowest meaningful check, then follow linked ATP/release gates. Run only commands observed in the active repository and approved by the dossier. An approved task may first add a planned wrapper to its durable manifest; inspect the resulting command and paired outputs before running it. Do not substitute an existing Basic wrapper for a new/Start tuple.
 
 For contract-sensitive work:
 
@@ -129,7 +134,7 @@ A planned command, successful generation, code reading, manual walkthrough, scre
 
 ## Step 8: Record evidence and derived status
 
-Record actual observed proof according to `references/status-and-evidence.md`. Prefer dedicated phase/ATP evidence records when the suite convention supports them; otherwise preserve the suite’s established inline test-plan convention. Update evidence first, then the derived progress register, and regenerate/check both implementation charts last. Use `npm run spec:charts -- <suite>` followed by `npm run spec:charts:check -- <suite>`; chart output remains derived and cannot repair an authority conflict.
+Record proof under `references/status-and-evidence.md`, preserving the established evidence convention. Update evidence, then progress, then applicable charts. With complete supported inputs, run `npm run spec:charts -- <suite>` and `npm run spec:charts:check -- <suite>`; README title/language changes also require regeneration. Otherwise report chart-input omissions and route needed authority repair to generation; do not invent definitions or force a full baseline. Charts cannot repair an authority conflict.
 
 Set status accurately:
 
@@ -150,7 +155,7 @@ Report:
 4. resulting status and the precise reason for it;
 5. blockers, decisions, or evidence still outstanding;
 6. one next proof/action only;
-7. refreshed `implementation-gantt.svg` and `implementation-burndown.svg`, README-derived chart language, and the chart check result.
+7. separate authority-audit, chart-model/freshness, and human approval/evidence results; applicable refreshed charts and README language, or the precise incomplete-input omission.
 
 Do not automatically modify the next WBS item or claim release closure from feature-level verification.