create-quiver 0.15.4 → 0.16.0

package/specs/quiver-v50-audit-trust-foundation/slices/slice-00-audit-baseline-and-resolved-findings/CLOSURE_BRIEF.md

@@ -0,0 +1,20 @@
+# CLOSURE_BRIEF - slice-00 audit baseline and already-resolved findings
+
+## Summary
+
+Classified the v50 audit-derived trust findings against current repository behavior and mapped each implemented, partial, or missing state to the correct later slice. Runtime code was not changed.
+
+## Validation
+
+- [x] `git diff --check`
+- [x] `node bin/create-quiver.js spec validate specs/quiver-v50-audit-trust-foundation`
+
+## Closure Conditions
+
+- [x] Finding classification completed.
+- [x] Implemented findings mapped to evidence/test/docs only.
+- [x] Runtime code unchanged.
+
+## Open Items
+
+- None.

package/specs/quiver-v50-audit-trust-foundation/slices/slice-00-audit-baseline-and-resolved-findings/EXECUTION_BRIEF.md

@@ -0,0 +1,58 @@
+# EXECUTION_BRIEF - slice-00 audit baseline and already-resolved findings
+
+## Context
+
+The audit file includes findings that are already implemented in the current branch. This slice prevents duplicate work by freezing the real baseline.
+
+## Objective
+
+Classify audit findings against current repository behavior before implementation.
+
+## Scope
+
+- v50 finding classification.
+- Existing command/help/JSON/package/CI baseline.
+- Planning artifacts only.
+
+## Acceptance Criteria
+
+- A `Finding | Current state | Action` table exists.
+- Findings are marked `implemented`, `partial`, `missing`, or `not applicable`.
+- Implemented findings are limited to evidence/test/docs follow-up.
+- Runtime code is not modified.
+
+## Expected Files To Modify
+
+- `specs/quiver-v50-audit-trust-foundation/SPEC.md`
+- `specs/quiver-v50-audit-trust-foundation/STATUS.md`
+- `specs/quiver-v50-audit-trust-foundation/EVIDENCE_REPORT.md`
+
+## Validations Required
+
+- `git diff --check`
+- `node bin/create-quiver.js spec validate specs/quiver-v50-audit-trust-foundation`
+
+## Risks
+
+- Reimplementing behavior already present.
+- Trusting audit assumptions without checking current code.
+
+## Dependencies
+
+- None.
+
+## Instructions For Executor
+
+1. Inspect current code/tests/help before editing the spec artifacts.
+2. Record evidence for every implemented or partial finding.
+3. Do not change runtime code.
+
+## Completion Checklist
+
+- [ ] Acceptance criteria satisfied.
+- [ ] Required validations run or blockers documented.
+- [ ] Closure brief updated.
+
+## Conditions Of Closure
+
+- Later v50 slices have an accurate baseline and no duplicated work.

package/specs/quiver-v50-audit-trust-foundation/slices/slice-00-audit-baseline-and-resolved-findings/slice.json

@@ -0,0 +1,57 @@
+{
+  "slice_id": "slice-00-audit-baseline-and-resolved-findings",
+  "ticket": "QUIVER-50-00",
+  "type": "documentation",
+  "title": "Audit baseline and already-resolved findings",
+  "objective": "Classify audit findings against current repository behavior before implementation.",
+  "description": "Creates the v50 baseline so executors do not reimplement behavior already present in the current branch.",
+  "git": {
+    "branch_type": "feature",
+    "base_branch": "main",
+    "branch_slug": "v50-audit-baseline",
+    "branch_name": "feature/QUIVER-50-00-v50-audit-baseline"
+  },
+  "files": [
+    "specs/quiver-v50-audit-trust-foundation/**"
+  ],
+  "expected_read_paths": [
+    "REQUERIMIENTOS_DERIVADOS_DE_AUDITORIA.md",
+    "package.json",
+    ".github/workflows/ci.yml",
+    "src/create-quiver/**",
+    "tests/**"
+  ],
+  "allowed_write_paths": [
+    "specs/quiver-v50-audit-trust-foundation/**"
+  ],
+  "depends_on": [],
+  "parallel_safe": "no",
+  "parallel_safe_reason": "Baseline defines finding state and constraints for every later v50 slice.",
+  "must": [
+    "Create a Finding | Current state | Action table.",
+    "Mark each finding as implemented, partial, missing, or not applicable.",
+    "Record current help, JSON, parser, CI, package, and command contracts.",
+    "Do not change runtime code."
+  ],
+  "not_included": [
+    "Implementing fixes.",
+    "Changing docs outside this spec."
+  ],
+  "acceptance": [
+    "Resolved findings are identified as evidence/test/docs only.",
+    "Missing and partial findings are mapped to later slices.",
+    "Contracts that must not regress are explicit."
+  ],
+  "tests": [
+    "git diff --check",
+    "node bin/create-quiver.js spec validate specs/quiver-v50-audit-trust-foundation"
+  ],
+  "validation_hints": [
+    "Use current CLI behavior as evidence, not assumptions from the audit file."
+  ],
+  "estimated_hours": 2,
+  "status": "completed",
+  "blocked_reason": null,
+  "actual_hours": 2,
+  "completed_at": "2026-06-01T21:37:54-0300"
+}

package/specs/quiver-v50-audit-trust-foundation/slices/slice-01-runtime-minimum-and-package-metadata/CLOSURE_BRIEF.md

@@ -0,0 +1,24 @@
+# CLOSURE_BRIEF - slice-01 runtime minimum and package metadata
+
+## Summary
+
+Declared the supported Node runtime minimum as `>=20.12.0`, synchronized package metadata and lockfile, documented the requirement, and added CI coverage for the exact minimum.
+
+## Validation
+
+- [x] `npm ci`
+- [x] `node --test`
+- [x] `npx -y node@20.12.0 --test`
+- [x] `git diff --check`
+- [x] `node bin/create-quiver.js spec validate specs/quiver-v50-audit-trust-foundation`
+
+## Closure Conditions
+
+- [x] Node minimum verified.
+- [x] Package metadata and lockfile synchronized.
+- [x] Docs updated.
+- [x] Evidence recorded.
+
+## Open Items
+
+- None.

package/specs/quiver-v50-audit-trust-foundation/slices/slice-01-runtime-minimum-and-package-metadata/EXECUTION_BRIEF.md

@@ -0,0 +1,67 @@
+# EXECUTION_BRIEF - slice-01 runtime minimum and package metadata
+
+## Context
+
+The audit requires `engines.node`, but declaring it without evidence can reject valid users or accept unsupported runtimes.
+
+## Objective
+
+Verify and declare the real minimum supported Node.js version.
+
+## Scope
+
+- Node minimum validation.
+- `engines.node`.
+- Lockfile synchronization.
+- Installation docs.
+- CI coverage for the minimum where feasible.
+
+## Acceptance Criteria
+
+- The declared Node minimum is backed by validation evidence.
+- `package.json` and `package-lock.json` are synchronized.
+- `npm ci` passes.
+- Installation docs mention the supported Node version.
+- CI covers the minimum Node version or records an explicit blocker.
+
+## Expected Files To Modify
+
+- `package.json`
+- `package-lock.json`
+- `README.md`
+- `docs/getting-started/installation.md`
+- `.github/workflows/ci.yml`
+- `specs/quiver-v50-audit-trust-foundation/EVIDENCE_REPORT.md`
+
+## Validations Required
+
+- `npm ci`
+- `node --test`
+- `git diff --check`
+
+## Risks
+
+- Declaring an unverified runtime minimum.
+- Forgetting lockfile updates.
+- CI using only a newer Node version.
+
+## Dependencies
+
+- Depends on `slice-00-audit-baseline-and-resolved-findings`.
+
+## Instructions For Executor
+
+1. Determine the lowest Node version that actually supports the project.
+2. Only then add `engines.node`.
+3. Update docs and lockfile together.
+4. Record validation evidence.
+
+## Completion Checklist
+
+- [ ] Acceptance criteria satisfied.
+- [ ] Required validations run or blockers documented.
+- [ ] Closure brief updated.
+
+## Conditions Of Closure
+
+- Runtime metadata is truthful and reproducible.

package/specs/quiver-v50-audit-trust-foundation/slices/slice-01-runtime-minimum-and-package-metadata/slice.json

@@ -0,0 +1,71 @@
+{
+  "slice_id": "slice-01-runtime-minimum-and-package-metadata",
+  "ticket": "QUIVER-50-01",
+  "type": "quality",
+  "title": "Runtime minimum and package metadata",
+  "objective": "Verify and declare the real minimum supported Node.js version.",
+  "description": "Adds package runtime metadata only after evidence proves the minimum supported Node version.",
+  "git": {
+    "branch_type": "feature",
+    "base_branch": "main",
+    "branch_slug": "v50-runtime-metadata",
+    "branch_name": "feature/QUIVER-50-01-v50-runtime-metadata"
+  },
+  "files": [
+    "package.json",
+    "package-lock.json",
+    "README.md",
+    "docs/getting-started/**",
+    ".github/workflows/ci.yml",
+    "specs/quiver-v50-audit-trust-foundation/**"
+  ],
+  "expected_read_paths": [
+    "package.json",
+    "package-lock.json",
+    ".github/workflows/ci.yml",
+    "scripts/ci/**",
+    "docs/getting-started/installation.md"
+  ],
+  "allowed_write_paths": [
+    "package.json",
+    "package-lock.json",
+    "README.md",
+    "docs/getting-started/**",
+    ".github/workflows/ci.yml",
+    "specs/quiver-v50-audit-trust-foundation/**"
+  ],
+  "depends_on": [
+    "slice-00-audit-baseline-and-resolved-findings"
+  ],
+  "parallel_safe": "yes",
+  "parallel_safe_reason": "Package metadata can be handled independently after baseline.",
+  "must": [
+    "Verify the real Node minimum before declaring engines.node.",
+    "Keep package-lock.json synchronized with package.json.",
+    "Document the Node minimum in installation docs.",
+    "Ensure CI tests the declared minimum or records a blocker."
+  ],
+  "not_included": [
+    "Adding unrelated dependencies.",
+    "Changing release automation."
+  ],
+  "acceptance": [
+    "package.json declares engines.node only with evidence.",
+    "npm ci passes with the synchronized lockfile.",
+    "Docs mention the supported Node version.",
+    "CI covers the minimum or the blocker is explicit."
+  ],
+  "tests": [
+    "npm ci",
+    "node --test",
+    "git diff --check"
+  ],
+  "validation_hints": [
+    "Do not infer Node minimum from current local Node version."
+  ],
+  "estimated_hours": 3,
+  "status": "completed",
+  "blocked_reason": null,
+  "actual_hours": 2,
+  "completed_at": "2026-06-01T22:13:40-0300"
+}

package/specs/quiver-v50-audit-trust-foundation/slices/slice-02-migrate-write-safety-contract/CLOSURE_BRIEF.md

@@ -0,0 +1,24 @@
+# CLOSURE_BRIEF - slice-02 migrate write-safety contract
+
+## Summary
+
+Added a migrate write-safety gate before side effects, with TTY confirmation, no-TTY/JSON-safe refusal without `--yes`, explicit `migrate --yes` automation, dry-run preservation, localized messages, command docs, and tests.
+
+## Validation
+
+- [x] `node --test tests/commands/cli-contract.test.js`
+- [x] `node --test tests/commands/init-profiles.test.js`
+- [x] `node --test tests/commands/i18n-audit-matrix.test.js`
+- [x] `node --test`
+- [x] `npx -y node@20.12.0 --test tests/commands/cli-contract.test.js tests/commands/init-profiles.test.js tests/commands/i18n-audit-matrix.test.js`
+- [x] `git diff --check`
+
+## Closure Conditions
+
+- [x] Confirmation occurs before side effects.
+- [x] Cancellation/no-TTY paths are safe.
+- [x] `--yes` and `--dry-run` contracts are tested.
+
+## Open Items
+
+- None.

package/specs/quiver-v50-audit-trust-foundation/slices/slice-02-migrate-write-safety-contract/EXECUTION_BRIEF.md

@@ -0,0 +1,71 @@
+# EXECUTION_BRIEF - slice-02 migrate write-safety contract
+
+## Context
+
+`migrate` writes project files. It must not perform side effects before explicit user confirmation or `--yes`.
+
+## Objective
+
+Require explicit confirmation before `migrate` performs any side effects.
+
+## Scope
+
+- TTY confirmation.
+- no-TTY safe behavior.
+- `migrate --yes`.
+- `migrate --dry-run`.
+- Parser/help/i18n/tests.
+
+## Acceptance Criteria
+
+- No side effects happen before confirmation.
+- Cancellation leaves the tree unchanged.
+- no-TTY without `--yes` is safe and actionable.
+- `migrate --yes` proceeds without prompt.
+- `migrate --dry-run` remains prompt-free and write-free.
+- `--yes` help scope is updated.
+- EN/ES messages exist.
+
+## Expected Files To Modify
+
+- `src/create-quiver/index.js`
+- `src/create-quiver/lib/i18n/messages/en.js`
+- `src/create-quiver/lib/i18n/messages/es.js`
+- `tests/commands/parser-contract.test.js`
+- `tests/commands/*migrate*.test.js`
+- `docs/reference/commands.md`
+- `docs/CLI_UX_GUIDE.md`
+- `specs/quiver-v50-audit-trust-foundation/EVIDENCE_REPORT.md`
+
+## Validations Required
+
+- `node --test tests/commands/parser-contract.test.js`
+- `node --test`
+- `git diff --check`
+
+## Risks
+
+- Prompting too late after side effects.
+- Treating `--yes` as unsupported or too global.
+- Breaking automation/no-TTY flows.
+
+## Dependencies
+
+- Depends on `slice-00-audit-baseline-and-resolved-findings`.
+
+## Instructions For Executor
+
+1. Move confirmation before `packTemplate`, file writes, state updates, and install attempts.
+2. Snapshot test cancellation and no-TTY behavior.
+3. Keep dry-run behavior unchanged.
+4. Keep stdout clean for machine-readable paths.
+
+## Completion Checklist
+
+- [ ] Acceptance criteria satisfied.
+- [ ] Required validations run or blockers documented.
+- [ ] Closure brief updated.
+
+## Conditions Of Closure
+
+- `migrate` cannot unexpectedly modify a project.

package/specs/quiver-v50-audit-trust-foundation/slices/slice-02-migrate-write-safety-contract/slice.json

@@ -0,0 +1,81 @@
+{
+  "slice_id": "slice-02-migrate-write-safety-contract",
+  "ticket": "QUIVER-50-02",
+  "type": "feature",
+  "title": "Migrate write-safety contract",
+  "objective": "Require explicit confirmation before migrate performs any side effects.",
+  "description": "Protects migrate writes with TTY confirmation, no-TTY safety, and a documented --yes automation path.",
+  "git": {
+    "branch_type": "feature",
+    "base_branch": "main",
+    "branch_slug": "v50-migrate-write-safety",
+    "branch_name": "feature/QUIVER-50-02-v50-migrate-write-safety"
+  },
+  "files": [
+    "src/create-quiver/index.js",
+    "src/create-quiver/lib/i18n/messages/en.js",
+    "src/create-quiver/lib/i18n/messages/es.js",
+    "tests/commands/cli-contract.test.js",
+    "tests/commands/init-profiles.test.js",
+    "tests/commands/i18n-audit-matrix.test.js",
+    "docs/reference/commands.md",
+    "docs/CLI_UX_GUIDE.md",
+    "specs/quiver-v43-cli-i18n-audit-release-readiness/command-language-mode-matrix.json",
+    "specs/quiver-v50-audit-trust-foundation/**"
+  ],
+  "expected_read_paths": [
+    "src/create-quiver/index.js",
+    "src/create-quiver/commands/init.js",
+    "src/create-quiver/lib/cli/ux.js",
+    "tests/commands/cli-contract.test.js",
+    "tests/commands/init-profiles.test.js",
+    "tests/commands/i18n-audit-matrix.test.js"
+  ],
+  "allowed_write_paths": [
+    "src/create-quiver/**",
+    "tests/**",
+    "docs/reference/commands.md",
+    "docs/CLI_UX_GUIDE.md",
+    "specs/quiver-v43-cli-i18n-audit-release-readiness/command-language-mode-matrix.json",
+    "specs/quiver-v50-audit-trust-foundation/**"
+  ],
+  "depends_on": [
+    "slice-00-audit-baseline-and-resolved-findings"
+  ],
+  "parallel_safe": "yes",
+  "parallel_safe_reason": "Touches migrate/parser/help but is isolated from runtime metadata and docs work.",
+  "must": [
+    "Prompt before any migrate side effect in TTY.",
+    "Refuse or guide safely in no-TTY without --yes.",
+    "Allow migrate --yes for automation.",
+    "Keep migrate --dry-run side-effect free and prompt-free.",
+    "Update --yes parser/help scope."
+  ],
+  "not_included": [
+    "Changing migration semantics.",
+    "Removing legacy migrate paths."
+  ],
+  "acceptance": [
+    "Cancellation leaves the file tree unchanged.",
+    "migrate --yes proceeds without prompt.",
+    "migrate --dry-run does not require --yes.",
+    "Warnings/prompts never pollute JSON stdout.",
+    "EN/ES messages are covered."
+  ],
+  "tests": [
+    "node --test tests/commands/cli-contract.test.js",
+    "node --test tests/commands/init-profiles.test.js",
+    "node --test tests/commands/i18n-audit-matrix.test.js",
+    "node --test",
+    "npx -y node@20.12.0 --test tests/commands/cli-contract.test.js tests/commands/init-profiles.test.js tests/commands/i18n-audit-matrix.test.js",
+    "git diff --check"
+  ],
+  "validation_hints": [
+    "Snapshot files before and after cancellation/no-TTY tests."
+  ],
+  "estimated_hours": 6,
+  "status": "completed",
+  "blocked_reason": null,
+  "actual_hours": 6,
+  "completed_at": "2026-06-01T22:34:50-0300"
+}

package/specs/quiver-v50-audit-trust-foundation/slices/slice-03-security-reporting-channel/CLOSURE_BRIEF.md

@@ -0,0 +1,22 @@
+# CLOSURE_BRIEF - slice-03 security reporting channel
+
+## Summary
+
+Documented a concrete private email channel for vulnerability reports and recorded that GitHub Private Vulnerability Reporting is disabled until repository owners enable it.
+
+## Validation
+
+- [x] `gh repo view FabriJuncal/quiver --json nameWithOwner,isPrivate,viewerPermission,url`
+- [x] `gh api repos/FabriJuncal/quiver/private-vulnerability-reporting --jq '.'`
+- [x] `git diff --check`
+- [x] `node bin/create-quiver.js spec validate specs/quiver-v50-audit-trust-foundation`
+- [x] `node bin/create-quiver.js check-slice specs/quiver-v50-audit-trust-foundation/slices/slice-03-security-reporting-channel/slice.json --local`
+
+## Closure Conditions
+
+- [x] Concrete private security channel documented.
+- [x] Evidence or external owner action recorded.
+
+## Open Items
+
+- Repository owners should enable GitHub Private Vulnerability Reporting in GitHub settings before replacing the email fallback.

package/specs/quiver-v50-audit-trust-foundation/slices/slice-03-security-reporting-channel/EXECUTION_BRIEF.md

@@ -0,0 +1,57 @@
+# EXECUTION_BRIEF - slice-03 security reporting channel
+
+## Context
+
+`SECURITY.md` currently asks for private reporting but must provide a concrete, usable channel.
+
+## Objective
+
+Make private vulnerability reporting concrete and verifiable.
+
+## Scope
+
+- `SECURITY.md`.
+- Evidence of GitHub private reporting or fallback contact.
+- Closure notes for any external owner action.
+
+## Acceptance Criteria
+
+- A concrete private reporting channel is documented.
+- If GitHub Private Vulnerability Reporting is used, evidence or owner confirmation is recorded.
+- If remote settings cannot be verified, a functional fallback channel is documented.
+- No vague reporting instruction remains without a channel.
+
+## Expected Files To Modify
+
+- `SECURITY.md`
+- `specs/quiver-v50-audit-trust-foundation/EVIDENCE_REPORT.md`
+- `specs/quiver-v50-audit-trust-foundation/STATUS.md`
+
+## Validations Required
+
+- `git diff --check`
+
+## Risks
+
+- Treating an unverifiable GitHub setting as done.
+- Publishing security contact instructions that do not work.
+
+## Dependencies
+
+- Depends on `slice-00-audit-baseline-and-resolved-findings`.
+
+## Instructions For Executor
+
+1. Pick the concrete reporting channel based on available repository settings.
+2. If external verification is impossible, document the required owner action and fallback.
+3. Keep wording concise and actionable.
+
+## Completion Checklist
+
+- [ ] Acceptance criteria satisfied.
+- [ ] Required validations run or blockers documented.
+- [ ] Closure brief updated.
+
+## Conditions Of Closure
+
+- Security reporters have a private path that can actually be used.

package/specs/quiver-v50-audit-trust-foundation/slices/slice-03-security-reporting-channel/slice.json

@@ -0,0 +1,56 @@
+{
+  "slice_id": "slice-03-security-reporting-channel",
+  "ticket": "QUIVER-50-03",
+  "type": "documentation",
+  "title": "Security reporting channel",
+  "objective": "Make private vulnerability reporting concrete and verifiable.",
+  "description": "Updates SECURITY.md with a real private reporting path and records evidence or required owner confirmation.",
+  "git": {
+    "branch_type": "feature",
+    "base_branch": "main",
+    "branch_slug": "v50-security-reporting",
+    "branch_name": "feature/QUIVER-50-03-v50-security-reporting"
+  },
+  "files": [
+    "SECURITY.md",
+    "specs/quiver-v50-audit-trust-foundation/**"
+  ],
+  "expected_read_paths": [
+    "SECURITY.md",
+    "docs/GITFLOW_PR_GUIDE.md"
+  ],
+  "allowed_write_paths": [
+    "SECURITY.md",
+    "specs/quiver-v50-audit-trust-foundation/**"
+  ],
+  "depends_on": [
+    "slice-00-audit-baseline-and-resolved-findings"
+  ],
+  "parallel_safe": "yes",
+  "parallel_safe_reason": "Security docs are independent from code changes.",
+  "must": [
+    "Replace vague private reporting guidance with a concrete channel.",
+    "Record whether GitHub Private Vulnerability Reporting is activated or use an email fallback.",
+    "Document any required manual owner action."
+  ],
+  "not_included": [
+    "Changing repository settings from code.",
+    "Creating public issue templates for vulnerabilities."
+  ],
+  "acceptance": [
+    "SECURITY.md contains a concrete private channel.",
+    "Closure records evidence or owner-confirmation requirement.",
+    "No vague 'contact privately' wording remains without a channel."
+  ],
+  "tests": [
+    "git diff --check"
+  ],
+  "validation_hints": [
+    "If GitHub settings cannot be verified locally, record the external action explicitly."
+  ],
+  "estimated_hours": 1,
+  "status": "completed",
+  "blocked_reason": null,
+  "actual_hours": 1,
+  "completed_at": "2026-06-01T22:23:21-0300"
+}

package/specs/quiver-v50-audit-trust-foundation/slices/slice-04-user-facing-i18n-error-coverage/CLOSURE_BRIEF.md

@@ -0,0 +1,23 @@
+# CLOSURE_BRIEF - slice-04 user-facing i18n error coverage
+
+## Summary
+
+Localized covered user-facing error wrappers for `config`, `evidence`, `graph`, and `spec` command paths, including parser/wiring paths in `index.js`, command-to-library evidence errors, graph format errors, and spec create/validate wrappers. Documented technical allowlist and confirmed `commands/ai-core.js` does not exist in the current repo.
+
+## Validation
+
+- [x] `node --test tests/commands/i18n-audit-matrix.test.js`
+- [x] `node --test tests/lib/i18n-catalog.test.js`
+- [x] `node --test tests/commands/config-language.test.js tests/commands/evidence.test.js tests/commands/graph.test.js tests/commands/spec-validate.test.js tests/commands/spec-create.test.js tests/lib/i18n-catalog.test.js tests/commands/i18n-audit-matrix.test.js`
+- [x] `node --test`
+- [x] `git diff --check`
+
+## Closure Conditions
+
+- [x] User-facing errors localized in covered paths.
+- [x] Allowlist documented in `EVIDENCE_REPORT.md`.
+- [x] JSON stdout contracts preserved for covered error tests.
+
+## Open Items
+
+- None.