create-agdf 0.8.9 → 0.9.1

package/README.md

@@ -237,8 +237,12 @@ Non-sensitive feedback, examples and contributions are welcome through [GitHub I
 
 ```bash
 npm --prefix create-agdf run smoke-test
+npm --prefix create-agdf run eval:skills
+npm --prefix create-agdf run eval:skills:record -- --surface codex --case gate-check-normal
 ```
 
+`eval:skills` is the credential-free deterministic CI lane. The recorder is an explicit supporting-evidence lane; it uses a disposable repository, records live provenance and refuses to persist a failing or mutation-violating result.
+
 The repository is licensed under [Apache-2.0](../LICENSE). No separate public `CONTRIBUTING.md`, `SECURITY.md` or private security-reporting channel is currently published. Do not treat a public issue as a private vulnerability disclosure.
 
 ## Publishing

package/bin/create-agdf.js

@@ -91,6 +91,15 @@ const codexSkillNames = pluginDefinition.skillSet.map((skill) => `${pluginDefini
 const copilotSkillNames = pluginDefinition.skillSet.map((skill) => `${pluginDefinition.copilot.skillPrefix}${skill.slug}`);
 const openCodeSkillNames = pluginDefinition.skillSet.map((skill) => `${pluginDefinition.opencode.skillPrefix}${skill.slug}`);
 const globalOpenCodeSkillNames = pluginDefinition.skillSet.map((skill) => `${pluginDefinition.opencode.globalSkillPrefix}${skill.slug}`);
+const contractModules = [
+  "gate-transition.md",
+  "interaction.md",
+  "modes.md",
+  "quality.md",
+  "context-graph.md",
+  "control-scaffold.md",
+  "closeout.md",
+];
 const globalOpenCodeSkillOwnershipMarker = "<!-- AGDF-GLOBAL-SKILL: ";
 const globalOpenCodeInstructionsOwnershipMarker = "<!-- AGDF-GLOBAL-INSTRUCTIONS -->";
 const globalOpenCodeRuntimeContractOwnershipMarker = "<!-- AGDF-GLOBAL-RUNTIME-CONTRACT -->";
@@ -119,6 +128,7 @@ const codexPluginFiles = [
   join("plugins", "agdf", "meta", "agdf-plugin.definition.json"),
   join("plugins", "agdf", "meta", "agdf-runtime-contract.md"),
   join("plugins", "agdf", "meta", "agdf-tenets.md"),
+  ...contractModules.map((moduleName) => join("plugins", "agdf", "meta", "contracts", moduleName)),
   ...codexSkillNames.map((skillName) => join("plugins", "agdf", "skills", skillName, "SKILL.md")),
 ];
 const controlFiles = [
@@ -184,12 +194,14 @@ const copilotInstructionFiles = [
 const copilotSkillFiles = [
   join(".github", "skills", "README.md"),
   join(".github", "skills", pluginDefinition.copilot.runtimeContractFileName),
+  ...contractModules.map((moduleName) => join(".github", "skills", "contracts", moduleName)),
   ...copilotSkillNames.map((skillName) => join(".github", "skills", skillName, "SKILL.md")),
 ];
 const openCodeFiles = [
   join(".opencode", pluginDefinition.opencode.instructionsFileName),
   join(".opencode", "README.md"),
   join(".opencode", pluginDefinition.opencode.runtimeContractFileName),
+  ...contractModules.map((moduleName) => join(".opencode", "contracts", moduleName)),
   ...openCodeSkillNames.map((skillName) => join(".opencode", "skills", skillName, "SKILL.md")),
 ];
 
@@ -582,6 +594,7 @@ function globalOpenCodeConfigPaths(configDir) {
   return {
     instructions: join(configDir, pluginDefinition.opencode.instructionsFileName),
     runtimeContract: join(configDir, pluginDefinition.opencode.runtimeContractFileName),
+    contracts: join(configDir, "contracts"),
     skills: join(configDir, "skills"),
   };
 }
@@ -605,6 +618,13 @@ function assertGlobalOpenCodeSurfaceWritable(configDir) {
   const paths = globalOpenCodeConfigPaths(configDir);
   assertGlobalOpenCodeFileWritable(paths.instructions, globalOpenCodeInstructionsOwnershipMarker, "first-line");
   assertGlobalOpenCodeFileWritable(paths.runtimeContract, globalOpenCodeRuntimeContractOwnershipMarker, "first-line");
+  for (const moduleName of contractModules) {
+    assertGlobalOpenCodeFileWritable(
+      join(paths.contracts, moduleName),
+      globalOpenCodeRuntimeContractOwnershipMarker,
+      "first-line",
+    );
+  }
   for (const skillName of globalOpenCodeSkillNames) {
     assertGlobalOpenCodeFileWritable(
       join(paths.skills, skillName, "SKILL.md"),
@@ -664,6 +684,15 @@ function installOpenCodeGlobalSurface(configDir) {
 
   writeOwnedGlobalOpenCodeFile(paths.instructions, globalInstructions, globalOpenCodeInstructionsOwnershipMarker, "first-line");
   writeOwnedGlobalOpenCodeFile(paths.runtimeContract, globalRuntimeContract, globalOpenCodeRuntimeContractOwnershipMarker, "first-line");
+  for (const moduleName of contractModules) {
+    const generatedModule = readFileSync(join(generatedOpenCodeRoot, "contracts", moduleName), "utf8");
+    writeOwnedGlobalOpenCodeFile(
+      join(paths.contracts, moduleName),
+      `${globalOpenCodeRuntimeContractOwnershipMarker}\n${generatedModule}`,
+      globalOpenCodeRuntimeContractOwnershipMarker,
+      "first-line",
+    );
+  }
 
   for (let index = 0; index < openCodeSkillNames.length; index += 1) {
     const sourceName = openCodeSkillNames[index];
@@ -678,6 +707,7 @@ function installOpenCodeGlobalSurface(configDir) {
   return {
     instructions: paths.instructions,
     runtimeContract: paths.runtimeContract,
+    contracts: paths.contracts,
     skills: paths.skills,
   };
 }
@@ -760,14 +790,21 @@ function openCodePackageTransition(previousPackage, installedPackage) {
 function evaluateGlobalOpenCodeSurface(configDir) {
   const paths = globalOpenCodeConfigPaths(configDir);
   const skillCount = globalOpenCodeSkillNames.filter((skillName) => existsSync(join(paths.skills, skillName, "SKILL.md"))).length;
+  const contractCount = contractModules.filter((moduleName) => existsSync(join(paths.contracts, moduleName))).length;
   return {
     path: paths.skills,
     instructions: paths.instructions,
     runtime_contract: paths.runtimeContract,
+    contracts: paths.contracts,
     expected_skill_count: globalOpenCodeSkillNames.length,
     skill_count: skillCount,
+    expected_contract_count: contractModules.length,
+    contract_count: contractCount,
     present: existsSync(paths.skills),
-    complete: existsSync(paths.instructions) && existsSync(paths.runtimeContract) && skillCount === openCodeSkillNames.length,
+    complete: existsSync(paths.instructions)
+      && existsSync(paths.runtimeContract)
+      && contractCount === contractModules.length
+      && skillCount === openCodeSkillNames.length,
   };
 }
 
@@ -795,7 +832,11 @@ function evaluateOpenCodeStatus(targetDir, configDir = defaultOpenCodeConfigDir(
   if (!packageState.loadable) findings.push(`${pluginDefinition.opencode.npmPackage} is not loadable from the OpenCode config directory.`);
   if (packageVersionStatus === "outdated") findings.push(`${pluginDefinition.opencode.npmPackage} version ${packageState.installed_version} is outdated; expected ${pluginDefinition.version}.`);
   if (packageVersionStatus === "unknown" && packageState.loadable) findings.push(`${pluginDefinition.opencode.npmPackage} is loadable but its installed version is unknown.`);
-  if (!globalNativeSurface.complete) findings.push(`Global OpenCode native skill surface is incomplete (${globalNativeSurface.skill_count}/${globalNativeSurface.expected_skill_count} skills).`);
+  if (!globalNativeSurface.complete) {
+    findings.push(
+      `Global OpenCode native surface is incomplete (${globalNativeSurface.skill_count}/${globalNativeSurface.expected_skill_count} skills; ${globalNativeSurface.contract_count}/${globalNativeSurface.expected_contract_count} contract modules).`,
+    );
+  }
   if (!sessionSignals.active) findings.push("No active AGDF OpenCode session signal is visible in this process.");
   if (!repositorySurface) findings.push("Current repository does not contain the AGDF OpenCode surface.");
 

package/generated/.github/skills/agdf-brownfield-analysis/SKILL.md

@@ -19,7 +19,11 @@ The skill answers:
 - whether Context Graph impact exists without automatically creating a node
 
 ## Runtime Contract
-Use `../agdf-runtime-contract.md` for Quality Contract output, Context Graph fields, gate terms, and non-duplication rules.
+Use these focused runtime-contract modules:
+
+- `../contracts/gate-transition.md`
+- `../contracts/context-graph.md`
+- `../contracts/quality.md`
 
 Brownfield-specific output must make evidence, missing existing-system view, parallel-structure risk, reuse strategy, and the minimal next step visible.
 When `.agdf/control/` is present, persist or link `post_ur_review` output under `.agdf/control/artefacts/<key>/BROWNFIELD_REVIEW.md`.
@@ -96,7 +100,7 @@ When used as Brownfield Review after `Approval: UR`, do not recommend PRD, SD, T
 7. Check SoT/runtime/product-semantics drift.
 8. Check primary visible ownership for UI/status/recovery paths.
 9. Check UI monolith risk for large surfaces or central hooks.
-10. Check Context Graph impact according to `../agdf-runtime-contract.md`.
+10. Check Context Graph impact according to `../contracts/context-graph.md`.
 11. Recommend the minimal clean implementation path.
 
 ## Output

package/generated/.github/skills/agdf-clean-implementation-review/SKILL.md

@@ -18,7 +18,10 @@ This skill answers:
 - is it maintainable or workaround-heavy
 
 ## Runtime Contract
-Use `../agdf-runtime-contract.md` for Quality Contract output, Context Graph fields, gate terms, and non-duplication rules.
+Use these focused runtime-contract modules:
+
+- `../contracts/quality.md`
+- `../contracts/context-graph.md`
 
 Clean-review-specific output must make the primary solution, fallbacks, workarounds, parallel structures, exit criteria, and next cleanup/review step visible.
 

package/generated/.github/skills/agdf-code-review/SKILL.md

@@ -17,7 +17,10 @@ It answers:
 - whether Brownfield, TP, or clean-review follow-up remains open
 
 ## Runtime Contract
-Use `../agdf-runtime-contract.md` for Quality Contract output, Context Graph fields, gate terms, and non-duplication rules.
+Use these focused runtime-contract modules:
+
+- `../contracts/quality.md`
+- `../contracts/context-graph.md`
 
 Code-review-specific output must make actual findings, missing review scope, evidence strength, and the next required step visible.
 

package/generated/.github/skills/agdf-delivery-closeout/SKILL.md

@@ -20,7 +20,11 @@ It answers:
 This skill does not replace `agdf-qa-gate`, `agdf-release-or`, user approvals, or gate decisions.
 
 ## Runtime Contract
-Use `../agdf-runtime-contract.md` for closeout discipline, gate terms, Context Graph fields, and non-duplication rules.
+Use these focused runtime-contract modules:
+
+- `../contracts/closeout.md`
+- `../contracts/context-graph.md`
+- `../contracts/gate-transition.md`
 
 ## Rules
 1. Delivery follows gate clarity.

package/generated/.github/skills/agdf-delivery-path-search/SKILL.md

@@ -13,7 +13,11 @@ The search is advisory and read-only. Canonical AGDF `agdf-gate-check` remains t
 
 ## Runtime Contract
 
-Use `../agdf-runtime-contract.md` for canonical gate state, output discipline and Delivery Path Search boundaries. This skill must not maintain a second gate or scoring model.
+Use these focused runtime-contract modules:
+
+- `../contracts/control-scaffold.md`
+- `../contracts/gate-transition.md`
+- `../contracts/quality.md`
 
 ## Trigger
 

package/generated/.github/skills/agdf-gate-check/SKILL.md

@@ -18,8 +18,14 @@ Determine the earliest blocking user approval gate and derive:
 This skill must not create later artefacts such as PRD, SD, TP, CD, CR, QA, or UAT when the gate does not allow them.
 
 ## Runtime Contract
-Use `../agdf-runtime-contract.md` for gate terms, closeout discipline, and non-duplication rules.
-The canonical gate order and transition model live only in the Runtime Contract. This skill evaluates the current state against that model; it must not maintain a second complete gate table.
+Use these focused runtime-contract modules:
+
+- `../contracts/gate-transition.md`
+- `../contracts/interaction.md`
+- `../contracts/control-scaffold.md`
+- `../contracts/modes.md`
+- `../contracts/quality.md`
+The canonical gate order and transition model live only in `../contracts/gate-transition.md`. This skill evaluates the current state against that model; it must not maintain a second complete gate table.
 
 ## Agent-Native Control Path
 

package/generated/.github/skills/agdf-qa-gate/SKILL.md

@@ -22,7 +22,11 @@ It answers:
 - whether blockers, critical risks, or missing evidence remain
 
 ## Runtime Contract
-Use `../agdf-runtime-contract.md` for Quality Contract output, Context Graph fields, gate terms, and non-duplication rules.
+Use these focused runtime-contract modules:
+
+- `../contracts/quality.md`
+- `../contracts/context-graph.md`
+- `../contracts/gate-transition.md`
 
 QA-specific `decision` is exactly `pass | revise | block`.
 `pass` is allowed only when TP coverage, Brownfield fit, solution integrity, and relevant documentation/Context Graph impact are sufficiently evidenced.
@@ -100,7 +104,7 @@ Use this shape:
 - impact_codes:
 ```
 
-If Context Graph impact is relevant, include the fields from `../agdf-runtime-contract.md`.
+If Context Graph impact is relevant, include the fields from `../contracts/context-graph.md`.
 
 ### Compact Chat Output
 

package/generated/.github/skills/agdf-release-or/SKILL.md

@@ -25,7 +25,12 @@ It reports:
 - whether further quality follow-up or a separate delivery closeout is useful
 
 ## Runtime Contract
-Use `../agdf-runtime-contract.md` for Quality Contract output, Context Graph fields, gate terms, and non-duplication rules.
+Use these focused runtime-contract modules:
+
+- `../contracts/closeout.md`
+- `../contracts/quality.md`
+- `../contracts/context-graph.md`
+- `../contracts/control-scaffold.md`
 
 OR-specific output must make gate status, delivered and intentionally not delivered content, missing approvals, missing evidence, risks, retained fallbacks, and the next permissible step visible.
 When `.agdf/control/` is present, persist or link the OR under `.agdf/control/artefacts/<key>/OR.md` and reference it from the selected canonical `RUN_STATE.md` or `MASTER_BACKLOG.md` when it is steering-relevant.
@@ -118,7 +123,7 @@ Use a compact structure:
 - quality_outlook:
 ```
 
-When Context Graph impact is relevant, include the fields from `../agdf-runtime-contract.md`.
+When Context Graph impact is relevant, include the fields from `../contracts/context-graph.md`.
 Include `context_graph_reconciliation` whenever Context Graph impact is present. If the value is `open_gap`, required next step must resolve or explicitly retain that gap before commit-ready or release-ready handoff.
 
 ## Forbidden