create-quiver 0.15.4 → 0.17.0

package/specs/quiver-v50-audit-trust-foundation/EVIDENCE_REPORT.md

@@ -0,0 +1,151 @@
+# Evidence Report - Quiver v50 Audit Trust Foundation
+
+## Planning Evidence
+
+- Source requirements: `REQUERIMIENTOS_DERIVADOS_DE_AUDITORIA.md`.
+- Approved plan: user-approved technical plan v4.
+- Repository convention inspected from `specs/quiver-v49-parser-modernization`.
+
+## Baseline Evidence To Capture During Execution
+
+- `node bin/create-quiver.js --help`
+- `node --test`
+- `npm ci`
+- `.github/workflows/ci.yml`
+- `package.json` and `package-lock.json`
+- `SECURITY.md`
+- `CONTRIBUTING.md`
+- `docs/CLI_UX_GUIDE.md`
+- current command behavior for `migrate`, `init`, `analyze`, i18n errors, JSON/no-TTY/CI flows.
+
+## Validation Evidence
+
+## slice-00-audit-baseline-and-resolved-findings
+
+- `node bin/create-quiver.js --help`: captured current public command surface, compatibility aliases, scoped options, and `--yes` scope.
+- `node bin/create-quiver.js migrate --help`: current help falls back to global help and lists `migrate` as dry-run capable.
+- `package.json`: no `engines` field is declared; `package-lock.json` exists and must remain synchronized when package metadata changes.
+- `src/create-quiver/index.js`: `runMigrate` supports `--dry-run` and emits write warnings, but non-dry-run performs write side effects without an explicit confirmation prompt.
+- `SECURITY.md`: asks for private reporting but does not name a concrete private channel.
+- `CONTRIBUTING.md`: current contributor guidance is minimal.
+- `ARCHITECTURE.md` and `docs/ARCHITECTURE.md`: absent.
+- `.github/workflows/ci.yml`: CI runs `npm ci`, ShellCheck, slice-template validation, cross-platform smoke, and tiered pack smoke, but does not yet include full portable `node --test`, docs lint/link checks, or explicit Windows `pwsh` coverage.
+- `src/create-quiver/lib/i18n/messages/{en,es}.js`: EN/ES catalogs exist; direct user-facing English errors remain in command paths and libraries for later audit.
+- `src/create-quiver/lib/cli/ux.js`, `src/create-quiver/commands/init.js`, and `src/create-quiver/commands/analyze.js`: UX primitives and summaries exist; safe progress/spinner use is not yet consistently applied to `init`/`analyze`.
+- Runtime code was not modified for this baseline slice.
+- `git diff --check`: passed.
+- `node bin/create-quiver.js spec validate specs/quiver-v50-audit-trust-foundation`: passed.
+
+## slice-01-runtime-minimum-and-package-metadata
+
+- `package-lock.json` dependency metadata shows `@clack/core@1.3.1` and `@clack/prompts@1.4.0` both require Node `>= 20.12.0`, so the project cannot truthfully declare a lower supported minimum while keeping current dependencies.
+- `npx -y node@20.12.0 --version`: passed, returned `v20.12.0`.
+- `package.json` declares `engines.node: >=20.12.0`.
+- `package-lock.json` root package metadata includes the same `engines.node` value.
+- `README.md` and `docs/getting-started/installation.md` document Node `>=20.12.0`.
+- `.github/workflows/ci.yml` adds a `minimum-node` job using Node `20.12.0`, `npm ci`, and `node --test`.
+- `npm ci`: passed, added 7 packages and found 0 vulnerabilities.
+- `node --test`: passed, 612 tests, 0 failures.
+- `npx -y node@20.12.0 --test`: passed, 612 tests, 0 failures. Local npm emitted a compatibility warning because npm `11.12.1` does not support Node `20.12.0`, but the Node 20.12.0 runtime test suite completed successfully.
+- `git diff --check`: passed.
+- `node bin/create-quiver.js spec validate specs/quiver-v50-audit-trust-foundation`: passed.
+
+## slice-02-migrate-write-safety-contract
+
+- `src/create-quiver/index.js`: `runMigrate` is now async and calls `confirmMigrateWrite` before `packTemplate`, `mergeDirectoryTree`, `initializeProjectDocs`, `updateStateForMigrate`, or `installSelfAsDevDep`.
+- `migrate --dry-run`: remains prompt-free and write-free because it returns before confirmation.
+- `migrate --yes`: maps to the existing `force` parser flag and bypasses the prompt for automation.
+- no-TTY/CI without `--yes`: fails before writes with actionable guidance to run `migrate --dry-run` or pass `--yes`; JSON mode keeps stdout empty on that failure path.
+- TTY cancellation: covered through exported `runMigrate` with injected `promptConfirm: () => false`; snapshot comparison proves the project tree remains unchanged.
+- EN/ES messages: added `migrate.confirm.required`, `migrate.confirm.prompt`, and `migrate.confirm.declined`; Spanish no-TTY error and Spanish `--yes` help are covered in tests.
+- `docs/reference/commands.md` and `docs/CLI_UX_GUIDE.md`: document `migrate --dry-run`, `migrate`, and `migrate --yes` safety semantics.
+- `specs/quiver-v43-cli-i18n-audit-release-readiness/command-language-mode-matrix.json`: updated to include documented command `migrate --yes`; this file was added to the slice scope because `tests/commands/i18n-audit-matrix.test.js` enforces command-reference coverage.
+- `node --test tests/commands/cli-contract.test.js`: passed.
+- `node --test tests/commands/init-profiles.test.js`: passed.
+- `node --test tests/commands/i18n-audit-matrix.test.js`: passed after adding `migrate --yes` to the matrix.
+- `node --test`: passed, 614 tests, 0 failures.
+- `npx -y node@20.12.0 --test tests/commands/cli-contract.test.js tests/commands/init-profiles.test.js tests/commands/i18n-audit-matrix.test.js`: passed, 39 tests, 0 failures.
+- `git diff --check`: passed.
+
+## slice-03-security-reporting-channel
+
+- `gh repo view FabriJuncal/quiver --json nameWithOwner,isPrivate,viewerPermission,url`: verified repository visibility, URL, and ADMIN permission for inspection.
+- `gh api repos/FabriJuncal/quiver/private-vulnerability-reporting --jq '.'`: returned `{"enabled":false}`; GitHub Private Vulnerability Reporting is not currently active.
+- `SECURITY.md`: replaced vague private reporting wording with the concrete email channel `juncalfabri@gmail.com`, required report details, and owner action to enable GitHub Private Vulnerability Reporting before making it the primary channel.
+- `git diff --check`: passed.
+- `node bin/create-quiver.js spec validate specs/quiver-v50-audit-trust-foundation`: passed.
+- `node bin/create-quiver.js check-slice specs/quiver-v50-audit-trust-foundation/slices/slice-03-security-reporting-channel/slice.json --local`: passed with the expected completed-slice warning after marking the slice completed.
+
+## slice-04-user-facing-i18n-error-coverage
+
+- `src/create-quiver/commands/config.js`: localized unsupported language, unsupported section, and unsupported language-command errors through EN/ES catalog keys.
+- `src/create-quiver/index.js`: passed resolved language into `runConfig` and localized parser-level `config` section/command errors plus the `spec` missing-directory wrapper.
+- `src/create-quiver/commands/evidence.js` and `src/create-quiver/lib/evidence.js`: localized missing evidence subcommand and missing command-after-`--` errors while preserving the direct library fallback for existing callers.
+- `src/create-quiver/commands/graph.js`: localized unsupported graph format errors before JSON output is emitted.
+- `src/create-quiver/commands/spec.js`: localized missing/unknown spec directory, spec validation failure wrapper, spec-create collision, interactive TTY requirement, declined approval, and review terminal/cancellation wrappers.
+- `src/create-quiver/lib/i18n/messages/{en,es}.js`: added matching EN/ES keys; catalog completeness remains enforced by `tests/lib/i18n-catalog.test.js`.
+- Covered hardcoded error audit: no `throw new Error` user-facing wrapper remains hardcoded in `commands/{config,evidence,graph,spec}.js` or `lib/evidence.js` outside catalog-backed messages.
+- Allowlist: `spec validate` internal diagnostics remain technical validator strings because they include field names, file paths, JSON parser messages, strict-warning labels, and schema terminology that tests already treat as stable developer diagnostics; machine-readable JSON keys and command/path snippets are intentionally not localized.
+- `src/create-quiver/commands/prepare.js`: inspected; no direct user-facing throw path was changed in this slice.
+- `src/create-quiver/commands/ai-core.js`: expected-read path from the brief does not exist in the current repo; AI command/provider dynamic errors remain outside this covered wrapper set and were not modified in this slice.
+- `node --test tests/commands/config-language.test.js tests/commands/evidence.test.js tests/commands/graph.test.js tests/commands/spec-validate.test.js tests/commands/spec-create.test.js tests/lib/i18n-catalog.test.js tests/commands/i18n-audit-matrix.test.js`: passed, 51 tests, 0 failures.
+- `node --test tests/lib/i18n-catalog.test.js`: passed, 7 tests, 0 failures.
+- `node --test tests/commands/i18n-audit-matrix.test.js`: passed, 2 tests, 0 failures.
+- `node --test`: passed, 619 tests, 0 failures.
+- `git diff --check`: passed.
+- `node bin/create-quiver.js spec validate specs/quiver-v50-audit-trust-foundation`: passed.
+- `node bin/create-quiver.js check-slice specs/quiver-v50-audit-trust-foundation/slices/slice-04-user-facing-i18n-error-coverage/slice.json --local`: passed with the expected completed-slice warning after marking the slice completed.
+- Manual dirty-scope check against `slice-04` `allowed_write_paths`: passed, 18 files within scope.
+
+## slice-05-init-analyze-progress-and-summaries
+
+- `src/create-quiver/index.js`: added an internal command-progress helper using `createUx.withSpinner(..., { echo: false })` so disabled spinner paths do not emit fallback progress lines.
+- `analyze`: now wraps scan, artifact write, AI context refresh, and state update phases in transient progress; final human summary lines are unchanged.
+- `init`: now wraps template preparation, optional compatibility-template export, docs/language writes, and optional package-install check in transient progress; final install/next-step summary lines are unchanged.
+- Progress safety: progress can run only when `createUx` considers the output a safe human TTY and is additionally disabled for `--no-color`; JSON, CI, and no-TTY paths do not receive progress fallback text.
+- Current layout note: `src/create-quiver/commands/init.js` and `src/create-quiver/commands/analyze.js` from the original expected path list do not exist in this repo; both command flows live in `src/create-quiver/index.js`.
+- `src/create-quiver/lib/i18n/messages/{en,es}.js`: added localized progress messages for `init` and `analyze`.
+- `tests/commands/analyze.test.js`: covers safe TTY spinner events separately from final summary output and verifies `--no-color` suppresses transient progress.
+- `tests/commands/init-profiles.test.js`: verifies non-TTY `init` output does not contain transient progress messages while existing generated layout assertions still pass.
+- `node --test tests/commands/analyze.test.js`: passed, 7 tests, 0 failures.
+- `node --test tests/commands/init-profiles.test.js`: passed, 23 tests, 0 failures.
+- `node --test tests/lib/cli-ux.test.js tests/lib/i18n-catalog.test.js`: passed, 17 tests, 0 failures.
+- `node --test`: passed, 621 tests, 0 failures.
+- `git diff --check`: passed.
+- `node bin/create-quiver.js spec validate specs/quiver-v50-audit-trust-foundation`: passed.
+- `node bin/create-quiver.js check-slice specs/quiver-v50-audit-trust-foundation/slices/slice-05-init-analyze-progress-and-summaries/slice.json --local`: passed with the expected completed-slice warning after marking the slice completed.
+- Manual dirty-scope check against `slice-05` `allowed_write_paths`: passed, 10 files within scope.
+
+## slice-06-contributor-and-architecture-docs
+
+- `node bin/create-quiver.js --help`: current command surface captured; docs use existing commands such as `start-slice`, `check-slice`, `check-pr`, `check-handoff`, `new-handoff`, `cleanup-slice`, `check-scope`, and `refresh-active-slices`.
+- `CONTRIBUTING.md`: expanded setup, workflow, spec/slice convention, validation, PR headings, templates/examples, and package boundary guidance.
+- `ARCHITECTURE.md`: created real architecture guide covering entrypoints, command layer, library layer, spec/slice structure, generated project contract, templates/localization, package boundary, tests, CI, and design constraints.
+- `ROADMAP.md`: added a note explaining that `vNN` labels are internal spec identifiers unless a section explicitly states an npm release.
+- `git diff --check`: passed.
+- `node bin/create-quiver.js spec validate specs/quiver-v50-audit-trust-foundation`: passed.
+- `node bin/create-quiver.js check-slice specs/quiver-v50-audit-trust-foundation/slices/slice-06-contributor-and-architecture-docs/slice.json --local`: passed with the expected completed-slice warning after marking the slice completed.
+
+## slice-07-ci-and-documentation-lint-baseline
+
+- `.github/workflows/ci.yml`: added `tests` and `docs` jobs using Node 22, `npm ci`, `npm run test:ci`, `npm run package:quiver`, `npm run docs:lint`, and `npm run docs:links`.
+- `.github/workflows/ci.yml`: changed the minimum-node full-suite step to `npm run test:ci`, which invokes Node's native runner through a portable Node wrapper.
+- `.github/workflows/ci.yml`: added a Windows-only `pwsh` smoke that parses `node .\bin\create-quiver.js version --json` and runs `npm run test:ci -- tests\lib\paths.test.js`.
+- `scripts/ci/run-node-tests.js`: added a shell-free wrapper around `node --test`, preserving pass-through test file arguments without shell glob expansion.
+- `scripts/ci/docs-scope.js`, `scripts/ci/check-docs-markdown.js`, and `scripts/ci/check-doc-links.js`: added explicit public-docs scope and per-file local link checking.
+- `.markdownlint.json`: added the initial markdown lint baseline while disabling inherited noisy style rules (`MD012`, `MD013`, `MD033`, `MD041`, `MD060`) to avoid broad documentation churn.
+- `.markdown-link-check.json`: added a non-flaky local-link baseline by ignoring external `http(s)` and `mailto:` links plus same-page anchors.
+- `package.json` and `package-lock.json`: added `test`, `test:ci`, `docs:lint`, `docs:links`, `docs:check`, `markdownlint-cli2`, and `markdown-link-check`; lockfile synchronized by npm.
+- `CONTRIBUTING.md`: documented local equivalents for the new CI gates and clarified that docs link checks intentionally ignore external URLs in this baseline.
+- `npm install --save-dev markdownlint-cli2 markdown-link-check`: passed; added 153 packages, audited 161 packages, 0 vulnerabilities.
+- `npm ci`: passed; added 160 packages, audited 161 packages, 0 vulnerabilities.
+- `npm run docs:lint`: passed, 20 files, 0 markdownlint errors after baseline config.
+- `npm run docs:links`: passed, 20 files, local-link scope only.
+- `npm run docs:check`: passed.
+- `npm run test:ci -- tests/lib/paths.test.js`: passed, 10 tests, 0 failures.
+- `node --test`: passed, 621 tests, 0 failures.
+- `npm run package:quiver`: passed, produced package smoke `create-quiver-0.15.3.tgz`.
+- `git diff --check`: passed.
+- `node bin/create-quiver.js spec validate specs/quiver-v50-audit-trust-foundation`: passed.
+- `node bin/create-quiver.js check-slice specs/quiver-v50-audit-trust-foundation/slices/slice-07-ci-and-documentation-lint-baseline/slice.json --local`: passed with the expected completed-slice warning after marking the slice completed.
+- Local `pwsh` validation was not runnable because `pwsh` is not installed on this machine; Windows `pwsh` coverage is encoded in CI.

package/specs/quiver-v50-audit-trust-foundation/EXECUTION_PLAN.md

@@ -0,0 +1,34 @@
+# Execution Plan - Quiver v50 Audit Trust Foundation
+
+## Order
+
+1. Execute `slice-00-audit-baseline-and-resolved-findings`.
+2. Execute `slice-01-runtime-minimum-and-package-metadata`.
+3. Execute `slice-02-migrate-write-safety-contract`.
+4. Execute `slice-03-security-reporting-channel`.
+5. Execute `slice-04-user-facing-i18n-error-coverage`.
+6. Execute `slice-05-init-analyze-progress-and-summaries`.
+7. Execute `slice-06-contributor-and-architecture-docs`.
+8. Execute `slice-07-ci-and-documentation-lint-baseline`.
+
+## Parallel Execution
+
+- `slice-02`, `slice-03`, `slice-04`, and `slice-06` may run in parallel after `slice-00`.
+- `slice-05` should wait for `slice-04` if it adds localized progress/summary messages.
+- `slice-07` should wait for `slice-01` and `slice-06` because it validates package metadata, lockfile, and docs.
+
+## Risk Controls
+
+- Snapshot files before/after `migrate` cancellation and no-TTY tests.
+- Treat `package.json` and `package-lock.json` as a pair.
+- Keep docs lint adoption controlled to avoid unrelated churn.
+- Keep JSON stdout free of progress, warnings, and prose.
+
+## Required Final Validation
+
+- `npm ci`
+- `node --test`
+- `npm run package:quiver`
+- `node bin/create-quiver.js --help`
+- `git diff --check`
+- `node bin/create-quiver.js spec validate specs/quiver-v50-audit-trust-foundation`

package/specs/quiver-v50-audit-trust-foundation/SPEC.md

@@ -0,0 +1,113 @@
+# Quiver v50 - Audit Trust Foundation
+
+**Date:** 2026-06-01
+**Status:** Completed
+**Source:** User-approved plan v4 derived from `REQUERIMIENTOS_DERIVADOS_DE_AUDITORIA.md`.
+
+Slice numbering resets here. This spec intentionally starts at `slice-00`.
+
+## Problem
+
+The audit identified trust gaps around write-safety, runtime metadata, security reporting, user-facing i18n, onboarding feedback, contributor documentation, and CI/docs validation. Several related findings are already implemented in the current branch and must be closed by evidence instead of reimplementation.
+
+## Objective
+
+Establish a production-ready trust baseline for Quiver without broad rewrites:
+
+- Verify current audit findings before changing behavior.
+- Declare a real Node runtime minimum.
+- Protect `migrate` from unintended writes.
+- Provide a concrete private security reporting channel.
+- Complete EN/ES coverage for user-facing errors.
+- Improve `init` and `analyze` feedback without breaking automation.
+- Make contributor and architecture docs usable.
+- Harden CI and docs lint with controlled, non-flaky gates.
+
+## Scope
+
+### Included
+
+- Audit baseline and already-resolved finding classification.
+- Runtime minimum verification and package metadata.
+- `migrate` write-safety and `--yes` contract.
+- Security reporting channel documentation/evidence.
+- User-facing i18n error coverage for commands and invoked libs.
+- `init`/`analyze` progress and summaries.
+- Contributor and architecture documentation.
+- CI, docs lint, lockfile, and portable test baseline.
+
+### Excluded
+
+- Commander.js/yargs migration.
+- TypeScript migration.
+- Parser rewrite.
+- Shell completion.
+- Global async I/O migration.
+- Alias removal.
+- npm publish automation.
+
+## Approved Acceptance Criteria
+
+1. All audit findings in this spec are classified as `implemented`, `partial`, `missing`, or `not applicable` before implementation.
+2. `package.json` declares a verified Node minimum and any package changes keep `package-lock.json` synchronized.
+3. `migrate` requires explicit confirmation before side effects unless `--yes` or `--dry-run` is used.
+4. `SECURITY.md` provides a concrete private vulnerability reporting channel with evidence or documented owner confirmation.
+5. User-facing errors in covered command paths respect EN/ES i18n and keep JSON stdout clean.
+6. `init` and `analyze` show progress only where safe and preserve automation/no-TTY/CI behavior.
+7. Contributor docs explain setup, tests, smokes, commits, PRs, architecture, templates, examples, and real spec structure.
+8. CI uses portable test commands, validates docs with controlled lint/link checks, runs `npm ci`, and includes Windows `pwsh` coverage.
+
+## Execution Baseline - slice-00
+
+| Finding | Current state | Evidence | Action |
+|---|---|---|---|
+| Runtime minimum metadata | missing | `package.json` has `dependencies` but no `engines`; `package-lock.json` exists. | Implement in `slice-01-runtime-minimum-and-package-metadata`; keep lockfile synchronized. |
+| `migrate` write-safety confirmation | partial | `runMigrate` supports `--dry-run` and writes warning text, but non-dry-run proceeds to filesystem writes without an explicit prompt; global help scopes `--yes` only to `init, slice cleanup`. | Implement confirmation and `--yes` contract in `slice-02-migrate-write-safety-contract`. |
+| Private security reporting channel | partial | `SECURITY.md` says to report privately but does not provide a concrete email, GitHub private vulnerability reporting path, or owner-confirmed channel. | Implement in `slice-03-security-reporting-channel`. |
+| User-facing i18n error coverage | partial | EN/ES message catalogs exist in `src/create-quiver/lib/i18n/messages/{en,es}.js`, but direct English errors remain in command paths and invoked libraries. | Implement covered command/library message audit in `slice-04-user-facing-i18n-error-coverage`. |
+| `init` / `analyze` progress and summaries | partial | `init` has interactive summaries through `createUx`; `analyze` prints direct summaries; no safe spinner/progress contract is used for these write paths. | Implement safe TTY-only progress and stable summaries in `slice-05-init-analyze-progress-and-summaries`. |
+| Contributor and architecture docs | partial | `CONTRIBUTING.md` is minimal; no `ARCHITECTURE.md` or `docs/ARCHITECTURE.md` exists. | Implement in `slice-06-contributor-and-architecture-docs`. |
+| CI and docs validation baseline | partial | `.github/workflows/ci.yml` runs `npm ci`, ShellCheck, slice-template validation, cross-platform smoke, and tiered pack smoke; it does not run full portable `node --test`, docs lint/link checks, or explicit Windows `pwsh` coverage. | Implement in `slice-07-ci-and-documentation-lint-baseline`. |
+| Package safety against local audit artifacts | implemented | `.npmignore` excludes `*.pdf`, `.DS_Store`, `tests`, examples, package lock, and CI scripts; package safety code also rejects env/secrets/tool state. | Close with evidence only; do not reimplement in v50 unless a later slice touches packaging. |
+| Parser/help compatibility baseline | implemented | `node bin/create-quiver.js --help` shows scoped help and compatibility aliases from v49. | Preserve current command/help contracts in all v50 changes. |
+
+## Slice Roadmap
+
+| Slice | Title | Status | Dependencies |
+|---|---|---|---|
+| slice-00 | Audit baseline and already-resolved findings | completed | none |
+| slice-01 | Runtime minimum and package metadata | completed | slice-00 |
+| slice-02 | Migrate write-safety contract | completed | slice-00 |
+| slice-03 | Security reporting channel | completed | slice-00 |
+| slice-04 | User-facing i18n error coverage | completed | slice-00 |
+| slice-05 | Init/analyze progress and summaries | completed | slice-00, slice-04 |
+| slice-06 | Contributor and architecture docs | completed | slice-00 |
+| slice-07 | CI and documentation lint baseline | completed | slice-01, slice-06 |
+
+## Guardrails
+
+- Do not reimplement findings already implemented; close them with evidence/tests/docs only.
+- Do not write files in `migrate` before confirmation.
+- Do not localize machine-readable JSON keys.
+- Do not emit spinner/progress frames in JSON, no-TTY, `CI=true`, or `--no-color`.
+- Do not introduce flaky external link checks as blocking CI gates.
+- Do not publish or package local audit files, PDFs, secrets, `.DS_Store`, worktrees, or tool state.
+
+## Required Production Gates
+
+- `npm ci`
+- portable test runner, not shell-expanded globs
+- targeted command tests per slice
+- `node bin/create-quiver.js --help`
+- stdout/stderr separation for warnings, errors, JSON, and prompts
+- EN/ES validation for new human messages
+- `npm pack` or package smoke where package contents change
+- `git diff --check`
+- `node bin/create-quiver.js spec validate specs/quiver-v50-audit-trust-foundation`
+
+## Resolved Decisions
+
+- Node minimum real version: `>=20.12.0`.
+- Final security channel: private email fallback documented in `SECURITY.md`; GitHub Private Vulnerability Reporting remains an owner action before it becomes primary.
+- Initial markdown lint scope: public root docs, `.github/pull_request_template.md`, and public docs under `docs/getting-started`, `docs/reference`, and `docs/workflows`.
+- Link checks: local documentation links are blocking; external URLs are ignored in this first CI baseline to avoid flaky network gates.

package/specs/quiver-v50-audit-trust-foundation/STATUS.md

@@ -0,0 +1,26 @@
+# Status - Quiver v50 Audit Trust Foundation
+
+**Overall status:** Completed
+**Created:** 2026-06-01
+**Current slice:** none
+
+## Summary
+
+This spec converted audit-derived trust and contributor-readiness requirements into production-safe implementation slices. All planned slices are complete and validated locally.
+
+## Slice Status
+
+| Slice | Status | Notes |
+|---|---|---|
+| slice-00-audit-baseline-and-resolved-findings | Completed | Classified current findings, mapped implemented items to evidence-only closure, and froze command/package/docs/CI contracts before implementation. |
+| slice-01-runtime-minimum-and-package-metadata | Completed | Declared Node >=20.12.0 with dependency/runtime evidence, synchronized lockfile, documented the minimum, and added minimum-node CI coverage. |
+| slice-02-migrate-write-safety-contract | Completed | Added pre-write migrate confirmation, no-TTY/JSON-safe refusal without `--yes`, `migrate --yes` automation, and updated help/docs/i18n coverage. |
+| slice-03-security-reporting-channel | Completed | Documented a concrete private email channel and recorded that GitHub Private Vulnerability Reporting is disabled pending owner action. |
+| slice-04-user-facing-i18n-error-coverage | Completed | Localized covered `config`, `evidence`, `graph`, and `spec` error wrappers plus parser/wiring paths; documented technical allowlist and preserved JSON stdout cleanliness. |
+| slice-05-init-analyze-progress-and-summaries | Completed | Added TTY-only transient progress for `init` and `analyze`, suppressed progress in automation/no-color paths, and preserved final summaries. |
+| slice-06-contributor-and-architecture-docs | Completed | Expanded contributor workflow docs and added architecture/package-boundary documentation based on the current CLI and repo structure. |
+| slice-07-ci-and-documentation-lint-baseline | Completed | Added portable test/docs scripts, docs lint/link baseline, CI test/docs jobs, Windows `pwsh` smoke, and lockfile-synchronized dev dependencies. |
+
+## Current Blockers
+
+- None.

package/specs/quiver-v50-audit-trust-foundation/pr.md

@@ -0,0 +1,120 @@
+## Title
+
+QUIVER-50: Audit Trust Foundation execution
+
+## Summary
+
+Executes the Quiver v50 Audit Trust Foundation spec across its implementation slices.
+
+This PR turns audit-derived trust findings into production-ready behavior and documentation: runtime metadata, safer `migrate` writes, concrete security reporting, broader EN/ES error coverage, safe `init`/`analyze` progress feedback, contributor/architecture docs, and CI/docs validation gates.
+
+## Scope
+
+- Declares the verified Node runtime minimum and synchronizes package metadata.
+- Adds pre-write safety for `migrate`, including no-TTY/CI-safe refusal and `--yes` automation.
+- Documents a concrete private vulnerability reporting channel.
+- Localizes covered user-facing CLI errors while preserving JSON stdout cleanliness and technical diagnostics.
+- Adds transient TTY-only progress for `init` and `analyze` without emitting progress in JSON, CI, no-TTY, or `--no-color` paths.
+- Expands contributor and architecture documentation around Quiver's real CLI/spec/slice workflow.
+- Adds portable CI scripts, markdown lint/link checks with controlled non-flaky scope, package smoke coverage, and Windows `pwsh` path coverage.
+
+## Files
+
+- `.github/workflows/ci.yml`
+- `.markdownlint.json`
+- `.markdown-link-check.json`
+- `package.json`
+- `package-lock.json`
+- `README.md`
+- `CONTRIBUTING.md`
+- `ARCHITECTURE.md`
+- `ROADMAP.md`
+- `SECURITY.md`
+- `docs/CLI_UX_GUIDE.md`
+- `docs/getting-started/installation.md`
+- `docs/reference/commands.md`
+- `scripts/ci/**`
+- `src/create-quiver/**`
+- `tests/**`
+- `specs/quiver-v43-cli-i18n-audit-release-readiness/command-language-mode-matrix.json`
+- `specs/quiver-v50-audit-trust-foundation/**`
+
+## How to Test (DETAILED - REQUIRED)
+
+### Required Environment
+
+- Node.js `>=20.12.0`.
+- npm with access to the committed lockfile.
+- GitHub CLI `gh` only for PR creation, not for local validation.
+- ShellCheck for CI validation of Bash scripts.
+- Windows `pwsh` coverage is encoded in GitHub Actions; `pwsh` was not available on this local machine.
+
+### Worktree Access
+
+- Checkout this branch:
+
+```bash
+git checkout feature/QUIVER-50-audit-trust-foundation-execution
+```
+
+- Keep local audit artifacts and generated PDFs untracked; they are intentionally excluded from this PR.
+
+### Run the Project
+
+No long-running app server is required. Validate the CLI directly:
+
+```bash
+node bin/create-quiver.js --help
+node bin/create-quiver.js spec validate specs/quiver-v50-audit-trust-foundation
+```
+
+### Use Cases
+
+- Run `migrate --dry-run` and confirm it remains prompt-free and write-free.
+- Run `migrate` without `--yes` in no-TTY automation and confirm it fails before writes.
+- Run covered commands with `--lang es` and confirm human errors are localized without changing command snippets or JSON keys.
+- Run `init`/`analyze` in non-TTY or `--no-color` mode and confirm transient progress text is suppressed.
+- Run docs checks and confirm only the controlled public-docs scope is linted/linked.
+
+### Technical Verification
+
+```bash
+npm ci
+npm run docs:check
+npm run test:ci -- tests/lib/paths.test.js
+node --test
+npm run package:quiver
+git diff --check
+node bin/create-quiver.js spec validate specs/quiver-v50-audit-trust-foundation
+node bin/create-quiver.js check-slice specs/quiver-v50-audit-trust-foundation/slices/slice-07-ci-and-documentation-lint-baseline/slice.json --local
+```
+
+## Evidence
+
+- `npm ci`: passed, 160 packages installed/audited, 0 vulnerabilities.
+- `npm run docs:lint`: passed, 20 files, 0 markdownlint errors.
+- `npm run docs:links`: passed, 20 files, local-link scope only.
+- `npm run docs:check`: passed.
+- `npm run test:ci -- tests/lib/paths.test.js`: passed, 10 tests, 0 failures.
+- `node --test`: passed, 621 tests, 0 failures.
+- `npm run package:quiver`: passed, package smoke `create-quiver-0.15.3.tgz`.
+- `git diff --check`: passed.
+- `node bin/create-quiver.js spec validate specs/quiver-v50-audit-trust-foundation`: passed.
+- `node bin/create-quiver.js check-slice .../slice-07-ci-and-documentation-lint-baseline/slice.json --local`: passed with the expected completed-slice warning.
+
+## Rollback
+
+Revert the QUIVER-50 commits on this branch. For partial rollback, revert the affected slice commit and rerun:
+
+```bash
+npm ci
+node --test
+npm run package:quiver
+node bin/create-quiver.js spec validate specs/quiver-v50-audit-trust-foundation
+```
+
+## Risks / Notes
+
+- Local `pwsh` validation was not runnable because `pwsh` is not installed on this machine; GitHub Actions now includes a Windows-only `pwsh` smoke.
+- External HTTP and `mailto:` links are ignored in the first docs link baseline to avoid flaky network gates; local documentation links are blocking.
+- The root-level local audit/input files and generated PDF remain untracked and are intentionally excluded from the PR.

package/specs/quiver-v50-audit-trust-foundation/slices/slice-00-audit-baseline-and-resolved-findings/CLOSURE_BRIEF.md

@@ -0,0 +1,20 @@
+# CLOSURE_BRIEF - slice-00 audit baseline and already-resolved findings
+
+## Summary
+
+Classified the v50 audit-derived trust findings against current repository behavior and mapped each implemented, partial, or missing state to the correct later slice. Runtime code was not changed.
+
+## Validation
+
+- [x] `git diff --check`
+- [x] `node bin/create-quiver.js spec validate specs/quiver-v50-audit-trust-foundation`
+
+## Closure Conditions
+
+- [x] Finding classification completed.
+- [x] Implemented findings mapped to evidence/test/docs only.
+- [x] Runtime code unchanged.
+
+## Open Items
+
+- None.

package/specs/quiver-v50-audit-trust-foundation/slices/slice-00-audit-baseline-and-resolved-findings/EXECUTION_BRIEF.md

@@ -0,0 +1,58 @@
+# EXECUTION_BRIEF - slice-00 audit baseline and already-resolved findings
+
+## Context
+
+The audit file includes findings that are already implemented in the current branch. This slice prevents duplicate work by freezing the real baseline.
+
+## Objective
+
+Classify audit findings against current repository behavior before implementation.
+
+## Scope
+
+- v50 finding classification.
+- Existing command/help/JSON/package/CI baseline.
+- Planning artifacts only.
+
+## Acceptance Criteria
+
+- A `Finding | Current state | Action` table exists.
+- Findings are marked `implemented`, `partial`, `missing`, or `not applicable`.
+- Implemented findings are limited to evidence/test/docs follow-up.
+- Runtime code is not modified.
+
+## Expected Files To Modify
+
+- `specs/quiver-v50-audit-trust-foundation/SPEC.md`
+- `specs/quiver-v50-audit-trust-foundation/STATUS.md`
+- `specs/quiver-v50-audit-trust-foundation/EVIDENCE_REPORT.md`
+
+## Validations Required
+
+- `git diff --check`
+- `node bin/create-quiver.js spec validate specs/quiver-v50-audit-trust-foundation`
+
+## Risks
+
+- Reimplementing behavior already present.
+- Trusting audit assumptions without checking current code.
+
+## Dependencies
+
+- None.
+
+## Instructions For Executor
+
+1. Inspect current code/tests/help before editing the spec artifacts.
+2. Record evidence for every implemented or partial finding.
+3. Do not change runtime code.
+
+## Completion Checklist
+
+- [ ] Acceptance criteria satisfied.
+- [ ] Required validations run or blockers documented.
+- [ ] Closure brief updated.
+
+## Conditions Of Closure
+
+- Later v50 slices have an accurate baseline and no duplicated work.

package/specs/quiver-v50-audit-trust-foundation/slices/slice-00-audit-baseline-and-resolved-findings/slice.json

@@ -0,0 +1,57 @@
+{
+  "slice_id": "slice-00-audit-baseline-and-resolved-findings",
+  "ticket": "QUIVER-50-00",
+  "type": "documentation",
+  "title": "Audit baseline and already-resolved findings",
+  "objective": "Classify audit findings against current repository behavior before implementation.",
+  "description": "Creates the v50 baseline so executors do not reimplement behavior already present in the current branch.",
+  "git": {
+    "branch_type": "feature",
+    "base_branch": "main",
+    "branch_slug": "v50-audit-baseline",
+    "branch_name": "feature/QUIVER-50-00-v50-audit-baseline"
+  },
+  "files": [
+    "specs/quiver-v50-audit-trust-foundation/**"
+  ],
+  "expected_read_paths": [
+    "REQUERIMIENTOS_DERIVADOS_DE_AUDITORIA.md",
+    "package.json",
+    ".github/workflows/ci.yml",
+    "src/create-quiver/**",
+    "tests/**"
+  ],
+  "allowed_write_paths": [
+    "specs/quiver-v50-audit-trust-foundation/**"
+  ],
+  "depends_on": [],
+  "parallel_safe": "no",
+  "parallel_safe_reason": "Baseline defines finding state and constraints for every later v50 slice.",
+  "must": [
+    "Create a Finding | Current state | Action table.",
+    "Mark each finding as implemented, partial, missing, or not applicable.",
+    "Record current help, JSON, parser, CI, package, and command contracts.",
+    "Do not change runtime code."
+  ],
+  "not_included": [
+    "Implementing fixes.",
+    "Changing docs outside this spec."
+  ],
+  "acceptance": [
+    "Resolved findings are identified as evidence/test/docs only.",
+    "Missing and partial findings are mapped to later slices.",
+    "Contracts that must not regress are explicit."
+  ],
+  "tests": [
+    "git diff --check",
+    "node bin/create-quiver.js spec validate specs/quiver-v50-audit-trust-foundation"
+  ],
+  "validation_hints": [
+    "Use current CLI behavior as evidence, not assumptions from the audit file."
+  ],
+  "estimated_hours": 2,
+  "status": "completed",
+  "blocked_reason": null,
+  "actual_hours": 2,
+  "completed_at": "2026-06-01T21:37:54-0300"
+}

package/specs/quiver-v50-audit-trust-foundation/slices/slice-01-runtime-minimum-and-package-metadata/CLOSURE_BRIEF.md

@@ -0,0 +1,24 @@
+# CLOSURE_BRIEF - slice-01 runtime minimum and package metadata
+
+## Summary
+
+Declared the supported Node runtime minimum as `>=20.12.0`, synchronized package metadata and lockfile, documented the requirement, and added CI coverage for the exact minimum.
+
+## Validation
+
+- [x] `npm ci`
+- [x] `node --test`
+- [x] `npx -y node@20.12.0 --test`
+- [x] `git diff --check`
+- [x] `node bin/create-quiver.js spec validate specs/quiver-v50-audit-trust-foundation`
+
+## Closure Conditions
+
+- [x] Node minimum verified.
+- [x] Package metadata and lockfile synchronized.
+- [x] Docs updated.
+- [x] Evidence recorded.
+
+## Open Items
+
+- None.