create-quiver 0.10.0 → 0.12.1

package/src/create-quiver/lib/package-safety.js

@@ -0,0 +1,117 @@
+const PACKAGE_PREFIX = 'package/';
+
+const SAFETY_RULES = [
+  {
+    code: 'env-file',
+    match(relativePath) {
+      return /(^|\/)\.env($|[./])/.test(relativePath);
+    },
+  },
+  {
+    code: 'npm-credentials',
+    match(relativePath) {
+      return /(^|\/)\.npmrc$/.test(relativePath) || /(^|\/)\.npm(\/|$)/.test(relativePath);
+    },
+  },
+  {
+    code: 'ai-tool-state',
+    match(relativePath) {
+      return /(^|\/)\.(claude|codex|quiver)(\/|$)/.test(relativePath);
+    },
+  },
+  {
+    code: 'worktree-state',
+    match(relativePath) {
+      return /(^|\/)\.worktrees(\/|$)/.test(relativePath);
+    },
+  },
+  {
+    code: 'worktree-context',
+    match(relativePath) {
+      return /(^|\/)WORKTREE_CONTEXT\.md$/.test(relativePath);
+    },
+  },
+  {
+    code: 'demo-output',
+    match(relativePath) {
+      return relativePath === 'quiver-spec-viewer' || relativePath.startsWith('quiver-spec-viewer/');
+    },
+  },
+];
+
+function normalizeTarballPath(inputPath) {
+  return String(inputPath || '')
+    .trim()
+    .replace(/\\/g, '/')
+    .replace(/^\.\//, '')
+    .replace(/\/{2,}/g, '/');
+}
+
+function stripPackagePrefix(inputPath) {
+  const normalizedPath = normalizeTarballPath(inputPath);
+
+  if (normalizedPath.startsWith(PACKAGE_PREFIX)) {
+    return normalizedPath.slice(PACKAGE_PREFIX.length);
+  }
+
+  return normalizedPath;
+}
+
+function collectPackageSafetyViolations(paths) {
+  const violations = [];
+  const seen = new Set();
+
+  for (const rawPath of paths || []) {
+    const normalizedPath = normalizeTarballPath(rawPath);
+    const relativePath = stripPackagePrefix(normalizedPath);
+
+    for (const rule of SAFETY_RULES) {
+      if (!rule.match(relativePath)) {
+        continue;
+      }
+
+      const key = `${rule.code}:${normalizedPath}`;
+      if (seen.has(key)) {
+        continue;
+      }
+
+      seen.add(key);
+      violations.push({
+        code: rule.code,
+        path: normalizedPath,
+      });
+    }
+  }
+
+  return violations;
+}
+
+function formatPackageSafetyViolations(violations) {
+  return violations
+    .map((violation) => `${violation.path} [${violation.code}]`)
+    .join(', ');
+}
+
+function assertPackageSafety(paths) {
+  const violations = collectPackageSafetyViolations(paths);
+
+  if (violations.length === 0) {
+    return {
+      ok: true,
+      violations,
+    };
+  }
+
+  const error = new Error(`PACKAGE_SAFETY_FAILED: unsafe tarball contents detected: ${formatPackageSafetyViolations(violations)}`);
+  error.code = 'PACKAGE_SAFETY_FAILED';
+  error.violations = violations;
+  throw error;
+}
+
+module.exports = {
+  assertPackageSafety,
+  collectPackageSafetyViolations,
+  formatPackageSafetyViolations,
+  normalizeTarballPath,
+  stripPackagePrefix,
+};

package/src/create-quiver/lib/readiness.js

@@ -2,7 +2,7 @@ const fs = require('fs');
 const path = require('path');
 const { catFileExists, currentBranch, hasLocalBranch, hasRemoteBranch, mergeBaseIsAncestor, revListCount, runGit, statusPorcelain, worktreeList } = require('./git');
 const { parseJsonWithComments } = require('./json');
-const { buildGraph, readAllSlices, SliceGraphError, topoSort } = require('./slice-graph');
+const { buildGraph, normalizeDeclaredDependencies, readAllSlices, SliceGraphError, topoSort } = require('./slice-graph');
 const { resolveSliceContext, toAlias } = require('./slice');
 
 function ensureExists(filePath, message) {
@@ -56,7 +56,7 @@ function parseWorktrees(text) {
   return entries;
 }
 
-function collectOverlapWarnings(repoRoot, currentBranchName, currentFiles) {
+function collectOverlapWarnings(repoRoot, currentBranchName, currentFiles, baseRef = 'origin/develop') {
   const sliceMap = new Map();
   walkSlices(path.join(repoRoot, 'specs'), sliceMap, repoRoot);
   walkSlices(path.join(repoRoot, 'specs-fix'), sliceMap, repoRoot);
@@ -79,7 +79,7 @@ function collectOverlapWarnings(repoRoot, currentBranchName, currentFiles) {
     }
 
     const dirty = statusPorcelain(worktreePath) !== '';
-    const aheadCount = revListCount(worktreePath, 'origin/develop..HEAD');
+    const aheadCount = revListCount(worktreePath, `${baseRef}..HEAD`);
     const active = dirty || aheadCount > 0;
 
     if (!active) {
@@ -95,6 +95,76 @@ function collectOverlapWarnings(repoRoot, currentBranchName, currentFiles) {
   return warnings;
 }
 
+function validateLocalSliceArtifacts(repoRoot, slice) {
+  const sliceDir = path.dirname(slice.sliceAbs);
+  for (const file of ['EXECUTION_BRIEF.md', 'CLOSURE_BRIEF.md']) {
+    ensureExists(path.join(sliceDir, file), `create-quiver: falta '${path.posix.join(path.dirname(slice.sliceRel), file)}'.`);
+  }
+  console.log('PASS: El slice local tiene EXECUTION_BRIEF.md y CLOSURE_BRIEF.md.');
+
+  if (!Array.isArray(slice.json.files) || slice.json.files.length === 0) {
+    throw new Error('create-quiver: slice.json debe declarar al menos un archivo en files para validacion local.');
+  }
+
+  const invalidFiles = slice.json.files.filter((file) => typeof file !== 'string' || file.trim().length === 0);
+  if (invalidFiles.length > 0) {
+    throw new Error('create-quiver: slice.json.files contiene entradas invalidas.');
+  }
+  console.log('PASS: slice.json declara archivos de alcance.');
+}
+
+function baseRecoveryMessage(remote, baseBranch) {
+  return `No se encontro la base '${baseBranch}' como rama local ni como '${remote}/${baseBranch}'. Para validacion estructural usa --local; para validacion contra otra base usa --base <branch>; o configura/fetchea el remoto '${remote}'.`;
+}
+
+function resolveReadinessRoot(localMode) {
+  try {
+    return runGit(['rev-parse', '--show-toplevel'], process.cwd());
+  } catch (error) {
+    if (localMode) {
+      return process.cwd();
+    }
+    throw error;
+  }
+}
+
+function validateSliceDocumentedOnBase(repoRoot, slice, options = {}) {
+  const gate = options.gate || 'execution';
+  const remote = options.remote || 'origin';
+  const baseBranch = options.baseBranch || slice.baseBranch || 'develop';
+  const remoteRef = `${remote}/${baseBranch}`;
+  const hasRemoteBase = hasRemoteBranch(repoRoot, baseBranch, remote);
+  const hasLocalBase = hasLocalBranch(repoRoot, baseBranch);
+
+  if (hasRemoteBase && catFileExists(repoRoot, `${remoteRef}:${slice.sliceRel}`)) {
+    console.log(`PASS: El slice ya existe en ${remoteRef} (PR base documental mergeado).`);
+    return remoteRef;
+  }
+
+  if (hasLocalBase && catFileExists(repoRoot, `${baseBranch}:${slice.sliceRel}`)) {
+    console.log(`PASS: El slice ya existe en ${baseBranch} local (modo sin remote).`);
+    return baseBranch;
+  }
+
+  if (!hasRemoteBase && !hasLocalBase) {
+    const guidance = baseRecoveryMessage(remote, baseBranch);
+    if (gate === 'validation') {
+      console.log(`WARN: ${guidance}`);
+      return null;
+    }
+
+    throw new Error(`create-quiver: ${guidance}`);
+  }
+
+  const expectedBase = hasRemoteBase ? remoteRef : baseBranch;
+  if (gate === 'validation') {
+    console.log(`WARN: El slice no existe todavia en ${expectedBase}. El PR base documental sigue pendiente de merge. Podes abrir el PR del slice igual si el humano mergea en orden.`);
+    return expectedBase;
+  }
+
+  throw new Error(`create-quiver: el slice no existe en ${expectedBase}. Mergea primero el PR base documental o usa --local para validar solo estructura local.`);
+}
+
 function validateDeclaredDependencyContract(repoRoot, slice) {
   const declaredDependsOn = Array.isArray(slice.json.depends_on) ? slice.json.depends_on : null;
   const declaredParallelSafe = typeof slice.json.parallel_safe === 'string' ? slice.json.parallel_safe.trim() : '';
@@ -119,8 +189,12 @@ function validateDeclaredDependencyContract(repoRoot, slice) {
       throw new Error(`create-quiver: depends_on contiene referencias duplicadas en ${currentRef}.`);
     }
 
+    const normalizedDeclared = normalizeDeclaredDependencies(currentNode, declared);
+    if (normalizedDeclared.length !== new Set(normalizedDeclared).size) {
+      throw new Error(`create-quiver: depends_on contiene referencias duplicadas en ${currentRef}.`);
+    }
     const currentSet = new Set(currentNode.depends_on || []);
-    for (const dep of declared) {
+    for (const dep of normalizedDeclared) {
       if (!currentSet.has(dep)) {
         throw new Error(`create-quiver: depends_on apunta a una referencia inexistente o invalida: ${dep}`);
       }
@@ -147,35 +221,43 @@ function validateDeclaredDependencyContract(repoRoot, slice) {
 
 function checkSliceReadiness(sliceInput, options = {}) {
   const gate = options.gate || 'execution';
+  const localMode = options.local === true;
   const strictOverlap = options.strictOverlap === true;
-  const repoRoot = runGit(['rev-parse', '--show-toplevel'], process.cwd());
+  const remote = options.remote || 'origin';
+  const repoRoot = resolveReadinessRoot(localMode);
   const slice = resolveSliceContext(repoRoot, sliceInput);
+  const baseBranch = options.baseBranch || slice.baseBranch || 'develop';
 
   for (const specFile of ['SPEC.md', 'STATUS.md', 'EVIDENCE_REPORT.md']) {
     ensureExists(path.join(repoRoot, slice.specDirRel, specFile), `create-quiver: falta '${slice.specDirRel}/${specFile}'.`);
   }
   console.log('PASS: El spec local tiene SPEC.md, STATUS.md y EVIDENCE_REPORT.md.');
 
-  if (catFileExists(repoRoot, `origin/develop:${slice.sliceRel}`)) {
-    console.log('PASS: El slice ya existe en origin/develop (PR base documental mergeado).');
-  } else if (catFileExists(repoRoot, `develop:${slice.sliceRel}`)) {
-    console.log('PASS: El slice ya existe en develop local (modo sin origin).');
-  } else if (gate === 'validation') {
-    console.log('WARN: El slice no existe todavia en origin/develop. El PR base documental sigue pendiente de merge. Podes abrir el PR del slice igual — el humano mergea en orden.');
+  let baseRef = null;
+  if (localMode) {
+    validateLocalSliceArtifacts(repoRoot, slice);
+    console.log(`INFO: Modo local: se omite validacion de existencia del slice en ${remote}/${baseBranch} o ${baseBranch}.`);
+    console.log('INFO: Modo local: se omite validacion de overlap contra worktrees activos basada en rama remota/base.');
   } else {
-    throw new Error('create-quiver: el slice no existe en origin/develop. Mergea primero el PR base documental.');
+    baseRef = validateSliceDocumentedOnBase(repoRoot, slice, {
+      baseBranch,
+      gate,
+      remote,
+    });
   }
 
-  const overlapWarnings = collectOverlapWarnings(repoRoot, currentBranch(repoRoot), slice.files);
-  if (overlapWarnings.length === 0) {
-    console.log('PASS: No se detecto overlap con worktrees activos.');
-  } else {
-    for (const warning of overlapWarnings) {
-      const [overlapBranch, overlapFiles] = warning.split('|');
-      if (strictOverlap) {
-        throw new Error(`create-quiver: Overlap con worktree activo '${overlapBranch}': ${overlapFiles}`);
+  if (!localMode) {
+    const overlapWarnings = collectOverlapWarnings(repoRoot, currentBranch(repoRoot), slice.files, baseRef || `${remote}/${baseBranch}`);
+    if (overlapWarnings.length === 0) {
+      console.log('PASS: No se detecto overlap con worktrees activos.');
+    } else {
+      for (const warning of overlapWarnings) {
+        const [overlapBranch, overlapFiles] = warning.split('|');
+        if (strictOverlap) {
+          throw new Error(`create-quiver: Overlap con worktree activo '${overlapBranch}': ${overlapFiles}`);
+        }
+        console.log(`WARN: Overlap con worktree activo '${overlapBranch}': ${overlapFiles}`);
       }
-      console.log(`WARN: Overlap con worktree activo '${overlapBranch}': ${overlapFiles}`);
     }
   }
 

package/src/create-quiver/lib/scope.js

@@ -19,6 +19,48 @@ function normalizeScopePath(filePath) {
   return normalizeContextPath(filePath);
 }
 
+function globToRegExp(pattern) {
+  const source = String(pattern || '')
+    .split('')
+    .map((char, index, chars) => {
+      if (char === '*') {
+        return chars[index + 1] === '*' ? '\0' : '[^/]*';
+      }
+      if (char === '\0') {
+        return '.*';
+      }
+      return /[\\^$+?.()|[\]{}]/.test(char) ? `\\${char}` : char;
+    })
+    .join('')
+    .replace(/\0\[\^\/\]\*/g, '.*');
+
+  return new RegExp(`^${source}$`);
+}
+
+function allowedPathMatches(filePath, allowedPath) {
+  const file = normalizeScopePath(filePath);
+  const allowed = normalizeScopePath(allowedPath);
+
+  if (!file || !allowed) {
+    return false;
+  }
+
+  if (file === allowed) {
+    return true;
+  }
+
+  if (allowed.endsWith('/**')) {
+    const prefix = allowed.slice(0, -3);
+    return file === prefix || file.startsWith(`${prefix}/`);
+  }
+
+  if (allowed.includes('*')) {
+    return globToRegExp(allowed).test(file);
+  }
+
+  return false;
+}
+
 function parseStatusPorcelain(text) {
   if (!text) {
     return [];
@@ -74,30 +116,30 @@ function diffWorktreeSnapshots(beforeSnapshot, afterSnapshot) {
 }
 
 function validateScopeSnapshot({ allowedFiles = [], beforeSnapshot, afterSnapshot, strict = true } = {}) {
-  const normalizedAllowedFiles = new Set(
+  const normalizedAllowedFiles = Array.from(new Set(
     Array.isArray(allowedFiles)
       ? allowedFiles.map(normalizeScopePath).filter(Boolean)
       : [],
-  );
+  ));
   const changedFiles = diffWorktreeSnapshots(beforeSnapshot, afterSnapshot);
-  const outOfScopeFiles = changedFiles.filter((file) => !normalizedAllowedFiles.has(file));
+  const outOfScopeFiles = changedFiles.filter((file) => !normalizedAllowedFiles.some((allowedFile) => allowedPathMatches(file, allowedFile)));
 
   if (outOfScopeFiles.length === 0) {
     return {
       ok: true,
       changedFiles,
       outOfScopeFiles,
-      allowedFiles: Array.from(normalizedAllowedFiles),
+      allowedFiles: normalizedAllowedFiles,
       beforeSnapshot,
       afterSnapshot,
     };
   }
 
   const message = formatError(
-    `scope violation detected: changed files outside slice.json.files: ${outOfScopeFiles.join(', ')}`,
+    `scope violation detected: changed files outside declared slice scope: ${outOfScopeFiles.join(', ')}`,
   );
   const error = new ScopeValidationError('SCOPE_VIOLATION', message, {
-    allowedFiles: Array.from(normalizedAllowedFiles),
+    allowedFiles: normalizedAllowedFiles,
     beforeSnapshot,
     afterSnapshot,
     changedFiles,
@@ -112,7 +154,7 @@ function validateScopeSnapshot({ allowedFiles = [], beforeSnapshot, afterSnapsho
     ok: false,
     changedFiles,
     outOfScopeFiles,
-    allowedFiles: Array.from(normalizedAllowedFiles),
+    allowedFiles: normalizedAllowedFiles,
     beforeSnapshot,
     afterSnapshot,
     error,
@@ -121,6 +163,7 @@ function validateScopeSnapshot({ allowedFiles = [], beforeSnapshot, afterSnapsho
 
 module.exports = {
   ScopeValidationError,
+  allowedPathMatches,
   captureWorktreeSnapshot,
   diffWorktreeSnapshots,
   checkScope,

package/src/create-quiver/lib/slice-graph.js

@@ -66,6 +66,15 @@ function sortFileList(files) {
   return Array.from(new Set((Array.isArray(files) ? files : []).map((file) => String(file)).filter(Boolean))).sort((a, b) => a.localeCompare(b));
 }
 
+function resolveWriteScope(json) {
+  const allowedWritePaths = sortFileList(json?.allowed_write_paths);
+  if (allowedWritePaths.length > 0) {
+    return allowedWritePaths;
+  }
+
+  return sortFileList(json?.files);
+}
+
 function normalizeDependencyRef(slice, dependency) {
   const dep = String(dependency || '').trim();
   if (!dep) {
@@ -95,6 +104,61 @@ function normalizeDependencyRef(slice, dependency) {
   return `${slice.specSlug}/${dep}`;
 }
 
+function readSliceFile(rootDir, rootName, specSlug, sliceDirName) {
+  const sliceDir = path.join(rootDir, rootName, specSlug, 'slices', sliceDirName);
+  const slicePath = path.join(sliceDir, 'slice.json');
+  if (!fs.existsSync(slicePath)) {
+    return null;
+  }
+
+  const json = parseJsonWithComments(fs.readFileSync(slicePath, 'utf8'));
+  const sliceId = String(json.slice_id || sliceDirName).trim();
+  const ref = `${specSlug}/${sliceId}`;
+  return {
+    ref,
+    specFamily: rootName,
+    specSlug,
+    sliceId,
+    slicePath,
+    sliceDir,
+    files: resolveWriteScope(json),
+    expected_read_paths: sortFileList(json.expected_read_paths),
+    allowed_write_paths: sortFileList(json.allowed_write_paths),
+    validation_hints: sortFileList(json.validation_hints),
+    dependencies: Array.isArray(json.dependencies) ? json.dependencies.map((item) => String(item).trim()).filter(Boolean) : [],
+    depends_on: Array.isArray(json.depends_on) ? json.depends_on.map((item) => String(item).trim()).filter(Boolean) : [],
+    parallel_safe: typeof json.parallel_safe === 'string' ? json.parallel_safe : null,
+    parallel_safe_reason: typeof json.parallel_safe_reason === 'string' ? json.parallel_safe_reason : null,
+    status: typeof json.status === 'string' ? json.status : 'draft',
+    ticket: typeof json.ticket === 'string' ? json.ticket : '',
+    title: typeof json.title === 'string' ? json.title : sliceId,
+    json,
+  };
+}
+
+function readSpecSlices(rootDir, rootName, specSlug) {
+  const slicesDir = path.join(rootDir, rootName, specSlug, 'slices');
+  if (!fs.existsSync(slicesDir)) {
+    return [];
+  }
+
+  const slices = [];
+
+  for (const sliceEntry of fs.readdirSync(slicesDir, { withFileTypes: true })) {
+    if (!sliceEntry.isDirectory() || isPlaceholderSliceDir(sliceEntry.name)) {
+      continue;
+    }
+
+    const slice = readSliceFile(rootDir, rootName, specSlug, sliceEntry.name);
+    if (slice) {
+      slices.push(slice);
+    }
+  }
+
+  slices.sort((left, right) => compareSliceRefs(left.ref, right.ref));
+  return slices;
+}
+
 function readAllSlices(rootDir) {
   const roots = ['specs', 'specs-fix'];
   const slices = [];
@@ -110,43 +174,7 @@ function readAllSlices(rootDir) {
         continue;
       }
 
-      const specSlug = specEntry.name;
-      const slicesDir = path.join(rootPath, specSlug, 'slices');
-      if (!fs.existsSync(slicesDir)) {
-        continue;
-      }
-
-      for (const sliceEntry of fs.readdirSync(slicesDir, { withFileTypes: true })) {
-        if (!sliceEntry.isDirectory() || isPlaceholderSliceDir(sliceEntry.name)) {
-          continue;
-        }
-
-        const sliceDir = path.join(slicesDir, sliceEntry.name);
-        const slicePath = path.join(sliceDir, 'slice.json');
-        if (!fs.existsSync(slicePath)) {
-          continue;
-        }
-
-        const json = parseJsonWithComments(fs.readFileSync(slicePath, 'utf8'));
-        const sliceId = String(json.slice_id || sliceEntry.name).trim();
-        const ref = `${specSlug}/${sliceId}`;
-        slices.push({
-          ref,
-          specFamily: rootName,
-          specSlug,
-          sliceId,
-          slicePath,
-          sliceDir,
-          files: sortFileList(json.files),
-          dependencies: Array.isArray(json.dependencies) ? json.dependencies.map((item) => String(item).trim()).filter(Boolean) : [],
-          depends_on: Array.isArray(json.depends_on) ? json.depends_on.map((item) => String(item).trim()).filter(Boolean) : [],
-          parallel_safe: typeof json.parallel_safe === 'string' ? json.parallel_safe : null,
-          parallel_safe_reason: typeof json.parallel_safe_reason === 'string' ? json.parallel_safe_reason : null,
-          status: typeof json.status === 'string' ? json.status : 'draft',
-          title: typeof json.title === 'string' ? json.title : sliceId,
-          json,
-        });
-      }
+      slices.push(...readSpecSlices(rootDir, rootName, specEntry.name));
     }
   }
 
@@ -170,6 +198,75 @@ function declaredDependenciesForSlice(slice) {
   return null;
 }
 
+function readSliceByRef(rootDir, ref) {
+  const value = String(ref || '').trim();
+  const slashIndex = value.indexOf('/');
+  if (slashIndex === -1) {
+    return null;
+  }
+
+  const specSlug = value.slice(0, slashIndex);
+  const sliceId = value.slice(slashIndex + 1);
+  if (!specSlug || !sliceId) {
+    return null;
+  }
+
+  for (const rootName of ['specs', 'specs-fix']) {
+    const direct = readSliceFile(rootDir, rootName, specSlug, sliceId);
+    if (direct) {
+      return direct;
+    }
+
+    for (const slice of readSpecSlices(rootDir, rootName, specSlug)) {
+      if (slice.ref === value) {
+        return slice;
+      }
+    }
+  }
+
+  return null;
+}
+
+function readSlicesForSpec(rootDir, specSlug) {
+  const targetSpec = String(specSlug || '').trim();
+  if (!targetSpec) {
+    return readAllSlices(rootDir);
+  }
+
+  const byRef = new Map();
+  const queue = [];
+
+  function addSlice(slice) {
+    if (!slice || byRef.has(slice.ref)) {
+      return;
+    }
+    byRef.set(slice.ref, slice);
+    queue.push(slice);
+  }
+
+  for (const rootName of ['specs', 'specs-fix']) {
+    for (const slice of readSpecSlices(rootDir, rootName, targetSpec)) {
+      addSlice(slice);
+    }
+  }
+
+  while (queue.length > 0) {
+    const slice = queue.shift();
+    for (const dep of declaredDependenciesForSlice(slice) || []) {
+      if (byRef.has(dep)) {
+        continue;
+      }
+
+      const dependencySlice = readSliceByRef(rootDir, dep);
+      if (dependencySlice) {
+        addSlice(dependencySlice);
+      }
+    }
+  }
+
+  return Array.from(byRef.values()).sort((left, right) => compareSliceRefs(left.ref, right.ref));
+}
+
 function inferDependencies(slices) {
   const bySpec = new Map();
   const normalized = slices.map((slice) => ({
@@ -453,7 +550,11 @@ module.exports = {
   detectFileConflicts,
   inferDependencies,
   isFoundationSliceId,
+  normalizeDeclaredDependencies,
+  normalizeDependencyRef,
   readAllSlices,
+  readSlicesForSpec,
   naturalNumberFromSliceId,
+  resolveWriteScope,
   topoSort,
 };

package/src/create-quiver/lib/slice.js

@@ -42,14 +42,18 @@ function readSliceMeta(slicePath) {
   const branchName = typeof git.branch_name === 'string' ? git.branch_name.trim() : '';
   const sliceId = typeof json.slice_id === 'string' ? json.slice_id.trim() : '';
   const status = String(json.status || 'draft').trim() || 'draft';
+  const allowedWritePaths = Array.isArray(json.allowed_write_paths) ? json.allowed_write_paths.map((item) => String(item)) : [];
+  const legacyFiles = Array.isArray(json.files) ? json.files.map((item) => String(item)) : [];
 
   return {
     acceptance: Array.isArray(json.acceptance) ? json.acceptance : [],
+    allowedWritePaths,
     baseBranch,
     branchName,
     branchSlug,
     branchType,
-    files: Array.isArray(json.files) ? json.files : [],
+    expectedReadPaths: Array.isArray(json.expected_read_paths) ? json.expected_read_paths.map((item) => String(item)) : [],
+    files: allowedWritePaths.length > 0 ? allowedWritePaths : legacyFiles,
     git,
     isBaseline: sliceId.startsWith('slice-00'),
     json,
@@ -60,6 +64,7 @@ function readSliceMeta(slicePath) {
     status,
     tests: Array.isArray(json.tests) ? json.tests : [],
     ticket,
+    validationHints: Array.isArray(json.validation_hints) ? json.validation_hints.map((item) => String(item)) : [],
   };
 }
 
@@ -74,19 +79,19 @@ function validateSliceMetaForStart(slice) {
     throw new Error('create-quiver: el bloque "git" debe incluir "branch_type", "base_branch", "branch_slug" y "branch_name".');
   }
 
-  const expectedBaseByType = {
-    feature: 'develop',
-    bugfix: 'develop',
-    hotfix: 'main',
+  const allowedBaseByType = {
+    feature: ['main', 'develop'],
+    bugfix: ['main', 'develop'],
+    hotfix: ['main'],
   };
 
-  if (!expectedBaseByType[slice.branchType]) {
+  if (!allowedBaseByType[slice.branchType]) {
     throw new Error(`create-quiver: git.branch_type invalido: "${slice.branchType}". Usa "feature", "bugfix" o "hotfix".`);
   }
 
-  const expectedBaseBranch = expectedBaseByType[slice.branchType];
-  if (slice.baseBranch !== expectedBaseBranch) {
-    throw new Error(`create-quiver: git.base_branch invalido para ${slice.branchType}. Esperado: "${expectedBaseBranch}".`);
+  const allowedBaseBranches = allowedBaseByType[slice.branchType];
+  if (!allowedBaseBranches.includes(slice.baseBranch)) {
+    throw new Error(`create-quiver: git.base_branch invalido para ${slice.branchType}. Usa "${allowedBaseBranches.join('" o "')}".`);
   }
 
   const expectedBranchName = `${slice.branchType}/${slice.ticket}-${slice.branchSlug}`;