create-quiver 0.17.1 → 0.17.2

package/specs/quiver-v53-reliable-deep-project-analysis/slices/slice-08-structural-map-hardening/CLOSURE_BRIEF.md

@@ -0,0 +1,34 @@
+# CLOSURE_BRIEF - slice-08 structural map hardening
+
+## Status
+
+Completed on 2026-06-11.
+
+## Summary
+
+Analyze-project now includes a bounded, generic structural map with route, component, context, config, script, import, and export signals. Extraction is best-effort, budgeted, and does not weaken path safety or reliability behavior.
+
+## Evidence
+
+- `discoverProjectFiles` includes `detected.structural_map`.
+- Dry-run JSON exposes structural map metadata.
+- Provider prompt includes compact structural map JSON.
+- Unknown-stack fallback remains covered.
+- Extraction warnings are non-fatal and bounded.
+
+## Validation
+
+- `node --test tests/lib/ai-analyze-project-discovery.test.js` passed: 4 tests.
+- `node --test tests/commands/ai-analyze-project.test.js` passed: 3 tests.
+- `node --test tests/commands/ai-analyze-project-provider.test.js` passed: 17 tests.
+- `npm run smoke:create-quiver` passed.
+- `git diff --check` passed.
+
+## Decisions
+
+- Structural extraction uses conservative regex heuristics only for common text source extensions.
+- The map is context quality metadata; it does not replace semantic sampling or provider validation.
+
+## Follow-ups
+
+- Consider stack-specific adapters in a future spec only after generic structural mapping proves useful.

package/specs/quiver-v53-reliable-deep-project-analysis/slices/slice-08-structural-map-hardening/EXECUTION_BRIEF.md

@@ -0,0 +1,67 @@
+# EXECUTION_BRIEF - slice-08 structural map hardening
+
+## Context
+
+After reliability is stable, context quality can improve by giving the provider a deterministic structural map. This should reduce drift and tokens without adding risky full-language parsing.
+
+## Objective
+
+Add a bounded, generic structural map to analyze-project context.
+
+## Scope
+
+- Imports/exports where cheaply detectable.
+- Routes and entrypoints.
+- Components and contexts.
+- Configs and scripts.
+- Prompt integration.
+- Dry-run JSON reporting.
+
+## Acceptance Criteria
+
+- Dry-run reports structural map metadata.
+- Provider prompt includes compact structural map context.
+- Unknown stacks still work.
+- Extraction failures do not block analysis.
+- Unsafe paths remain excluded.
+
+## Expected Files To Modify
+
+- `src/create-quiver/lib/ai/analyze-project-discovery.js`
+- `src/create-quiver/lib/ai/analyze-project-sampling.js`
+- `src/create-quiver/lib/ai/analyze-project-prompts.js`
+- analyze-project tests/fixtures
+
+## Validations Required
+
+- `node --test tests/commands/ai-analyze-project.test.js`
+- `node --test tests/commands/ai-analyze-project-provider.test.js`
+- `npm run smoke:create-quiver`
+- `git diff --check`
+
+## Risks
+
+- Structural extraction can become overengineered.
+- Regex-based parsing can misclassify files.
+- Extra context can increase token usage if not bounded.
+
+## Dependencies
+
+- Depends on `slice-07-semantic-validation-docs`.
+
+## Instructions For Executor
+
+1. Keep extraction best-effort and bounded.
+2. Prefer generic signals over framework-specific assumptions.
+3. Do not change repair/retry behavior in this slice.
+
+## Completion Checklist
+
+- [ ] Structural map generated.
+- [ ] Prompt integration tested.
+- [ ] Dry-run output updated.
+- [ ] Closure brief updated.
+
+## Conditions Of Closure
+
+- Analyze-project has better deterministic context without weakening reliability or safety.

package/specs/quiver-v53-reliable-deep-project-analysis/slices/slice-08-structural-map-hardening/slice.json

@@ -0,0 +1,81 @@
+{
+  "slice_id": "slice-08-structural-map-hardening",
+  "ticket": "QUIVER-53-08",
+  "type": "context-quality",
+  "title": "Structural map hardening",
+  "objective": "Improve provider context quality after the reliability kernel is stable.",
+  "description": "Adds a deterministic structural map for analyze-project using low-risk stack-agnostic signals such as imports, exports, components, contexts, routes, configs, and scripts.",
+  "git": {
+    "branch_type": "feature",
+    "base_branch": "main",
+    "branch_slug": "v53-structural-map-hardening",
+    "branch_name": "feature/QUIVER-53-08-v53-structural-map-hardening"
+  },
+  "files": [
+    "src/create-quiver/lib/ai/analyze-project-discovery.js",
+    "src/create-quiver/lib/ai/analyze-project-sampling.js",
+    "src/create-quiver/lib/ai/analyze-project-prompts.js",
+    "tests/commands/ai-analyze-project.test.js",
+    "tests/commands/ai-analyze-project-provider.test.js",
+    "specs/quiver-v53-reliable-deep-project-analysis/STATUS.md",
+    "specs/quiver-v53-reliable-deep-project-analysis/EVIDENCE_REPORT.md",
+    "specs/quiver-v53-reliable-deep-project-analysis/slices/slice-08-structural-map-hardening/CLOSURE_BRIEF.md",
+    "specs/quiver-v53-reliable-deep-project-analysis/slices/slice-08-structural-map-hardening/slice.json"
+  ],
+  "expected_read_paths": [
+    "src/create-quiver/lib/ai/analyze-project-discovery.js",
+    "src/create-quiver/lib/ai/analyze-project-sampling.js",
+    "src/create-quiver/lib/ai/analyze-project-prompts.js",
+    "tests/commands/ai-analyze-project.test.js"
+  ],
+  "allowed_write_paths": [
+    "src/create-quiver/lib/ai/analyze-project-discovery.js",
+    "src/create-quiver/lib/ai/analyze-project-sampling.js",
+    "src/create-quiver/lib/ai/analyze-project-prompts.js",
+    "tests/commands/ai-analyze-project.test.js",
+    "tests/commands/ai-analyze-project-provider.test.js",
+    "tests/fixtures/analyze-project/**",
+    "specs/quiver-v53-reliable-deep-project-analysis/STATUS.md",
+    "specs/quiver-v53-reliable-deep-project-analysis/EVIDENCE_REPORT.md",
+    "specs/quiver-v53-reliable-deep-project-analysis/slices/slice-08-structural-map-hardening/CLOSURE_BRIEF.md",
+    "specs/quiver-v53-reliable-deep-project-analysis/slices/slice-08-structural-map-hardening/slice.json"
+  ],
+  "depends_on": [
+    "slice-07-semantic-validation-docs"
+  ],
+  "parallel_safe": "after_dependencies",
+  "parallel_safe_reason": "Context quality changes should happen after reliability behavior is stable and documented.",
+  "must": [
+    "Generate a deterministic structural map from low-risk generic signals.",
+    "Include imports, exports, route files, components, contexts, configs, and scripts where discoverable.",
+    "Keep unknown-stack fallback behavior.",
+    "Respect existing file and byte budgets.",
+    "Do not block analysis if structural extraction fails for a file."
+  ],
+  "not_included": [
+    "Full AST support for every language.",
+    "Replacing semantic sampling.",
+    "Changing repair or retry behavior."
+  ],
+  "acceptance": [
+    "Dry-run JSON includes structural map metadata without reading unsafe paths.",
+    "Provider prompt receives a compact structural map.",
+    "Unknown stack projects still analyze with generic fallback.",
+    "Structural extraction errors are warnings, not fatal analysis failures."
+  ],
+  "tests": [
+    "node --test tests/commands/ai-analyze-project.test.js",
+    "node --test tests/commands/ai-analyze-project-provider.test.js",
+    "npm run smoke:create-quiver",
+    "git diff --check"
+  ],
+  "validation_hints": [
+    "Keep parser heuristics conservative and bounded."
+  ],
+  "estimated_hours": 8,
+  "actual_hours": 4,
+  "status": "completed",
+  "started_at": "2026-06-11T12:26:30Z",
+  "completed_at": "2026-06-11T12:29:09Z",
+  "blocked_reason": null
+}

package/specs/quiver-v54-deep-project-analysis-hardening/EVIDENCE_REPORT.md

@@ -0,0 +1,53 @@
+# Evidence Report - Quiver v54 Deep Project Analysis Hardening
+
+**Status:** Implemented
+**Last updated:** 2026-06-11
+
+## Evidence Available Before Implementation
+
+- Live `nika-erp` smoke showed base onboarding commands pass.
+- Live provider run failed closed with audited schema drift instead of writing invalid docs.
+- TTY loader was visible.
+- No-TTY progress did not stream until final output.
+- Default sampling selected `package-lock.json` and Quiver-generated docs too heavily.
+- Provider drift included `claim`, `notes`, `confidence`, and missing `name`.
+
+## Evidence Captured During Implementation
+
+- `slice-01-contract-regression-harness`: deterministic fixtures and command/parser regression tests.
+- `slice-02-safe-discovery-sampling`: lockfile metadata sampling, product-source priority, and live read-only `nika-erp` dry-run smoke.
+- `slice-03-run-lifecycle-cli-io`: TTY loader and no-TTY linear progress.
+- `slice-04-artifact-store-redaction`: bounded/redacted raw provider stream artifacts with hash metadata.
+- `slice-05-path-aware-repair-engine`: fail-closed path-aware repair for safe drift.
+- `slice-06-retry-controller`: compact retry prompts, retry cap, retry manifests, and audited provider failures.
+- `slice-07-final-validation-review-write-gate`: review, confirmation, snapshot, write, and post-write validation gates.
+- `slice-08-doctor-agents-guidance`: actionable AGENTS.md warning and safe `doctor --fix`.
+- `slice-09-release-smoke-rollback-docs`: release smoke commands, expected evidence, and rollback guidance.
+- Deterministic fixture tests cover `notes`, `claim` to `name`, unsupported `confidence`, invalid confidence, missing fields, malformed JSON, fenced JSON, embedded JSON, secret-like output, retry success, and retry exhaustion.
+- `--dry-run` and `--dry-run --json` remain read-only and do not create `.quiver`.
+- Provider mode without `--review` writes audit artifacts but no final docs.
+- TTY loader and no-TTY linear progress are covered.
+- Lockfiles are summarized as metadata and omitted from provider content by default.
+- Raw provider artifacts are redacted, size-bounded, and include stream metadata/hash.
+- `doctor` reports actionable AGENTS.md repair guidance and `doctor --fix` preserves manual content.
+- Review cancel, confirmation decline, no-TTY review, invalid edited proposal, approved writes, snapshots, and post-write validation are covered.
+- Release smoke docs and rollback guidance are updated.
+
+## Validation Log
+
+- PASS: `node --test tests/lib/ai/analyze-project-repair.test.js`
+- PASS: `node --test tests/commands/ai-analyze-project-provider.test.js`
+- PASS: `node --test tests/lib/ai-analyze-project-discovery.test.js`
+- PASS: `node --test tests/commands/ai-analyze-project.test.js`
+- PASS: `node --test tests/lib/ai-artifacts.test.js`
+- PASS: `node --test tests/commands/ai-analyze-project-review.test.js tests/lib/ai-analyze-project-validation.test.js`
+- PASS: `node --test tests/commands/doctor.test.js tests/lib/doctor.test.js`
+- PASS: `npm run docs:check`
+- PASS: `npm run schema:slice:check`
+- PASS: `node bin/create-quiver.js spec validate specs/quiver-v54-deep-project-analysis-hardening --strict`
+- PASS: `git diff --check`
+- PASS: live read-only smoke in `nika-erp` using local CLI: `node bin/create-quiver.js ai analyze-project --deep --dry-run --json`
+  - `provider_execution`: `skipped`
+  - `writes`: `[]`
+  - `package-lock.json`: summarized under `detected.lockfiles`, omitted as `sampling:lockfile-metadata`
+  - safety exclusions included `.env`, `.git`, `.quiver`, `.next`, and `node_modules`

package/specs/quiver-v54-deep-project-analysis-hardening/EXECUTION_PLAN.md

@@ -0,0 +1,55 @@
+# Execution Plan - Quiver v54 Deep Project Analysis Hardening
+
+## Sequential Order
+
+1. `slice-01-contract-regression-harness`
+2. `slice-02-safe-discovery-sampling` and `slice-03-run-lifecycle-cli-io`
+3. `slice-04-artifact-store-redaction`, `slice-05-path-aware-repair-engine`, and `slice-08-doctor-agents-guidance`
+4. `slice-06-retry-controller`
+5. `slice-07-final-validation-review-write-gate`
+6. `slice-09-release-smoke-rollback-docs`
+
+## Parallelization Rules
+
+- `slice-01` must land first because it defines the regression contract.
+- `slice-02` and `slice-03` can run in parallel after `slice-01`.
+- `slice-04` can start after `slice-03` defines run lifecycle/status and can run in parallel with `slice-05`.
+- `slice-08` can run after `slice-01` and must not block provider hardening.
+- `slice-06` must wait for lifecycle and repair contracts.
+- `slice-07` must wait for sampling, artifacts, repair, and retry.
+- `slice-09` closes release evidence after production gates pass.
+
+## Critical Boundaries
+
+- Read boundary: `slice-02`
+- Provider/run boundary: `slice-03`
+- Artifact/redaction boundary: `slice-04`
+- Repair boundary: `slice-05`
+- Retry boundary: `slice-06`
+- Validation/write boundary: `slice-07`
+
+## Required Validation Before Closing Spec
+
+```bash
+node --test tests/commands/ai-analyze-project-provider.test.js
+node --test tests/commands/ai-analyze-project-review.test.js
+node --test tests/commands/ai-analyze-project.test.js
+node --test tests/commands/doctor.test.js
+node --test tests/lib/ai-analyze-project-discovery.test.js
+node --test tests/lib/ai/analyze-project-repair.test.js
+npm run docs:check
+npm run schema:slice:check
+node bin/create-quiver.js spec validate specs/quiver-v54-deep-project-analysis-hardening --strict
+git diff --check
+```
+
+## Release Evidence
+
+Run a live smoke against `nika-erp` only after deterministic gates pass. The live smoke is release evidence, not a CI gate.
+
+## Rollback
+
+- Each runtime slice must be revertible independently.
+- If repair causes quality issues, revert `slice-05` and `slice-06` while preserving discovery and dry-run.
+- If artifact redaction fails, block release and revert `slice-04` before publishing.
+- If final write gate regresses, revert `slice-07`; provider mode without `--review` must still avoid docs writes.

package/specs/quiver-v54-deep-project-analysis-hardening/SPEC.md

@@ -0,0 +1,184 @@
+# Quiver v54 - Deep Project Analysis Hardening
+
+**Date:** 2026-06-11
+**Status:** Approved, not implemented
+**Source:** User-approved requirement, live `nika-erp` smoke evidence, production review, and final slice cut review.
+
+## Problem
+
+`ai analyze-project --deep --provider codex --model gpt-5.5` now fails closed and audits invalid provider output, but the live `nika-erp` end-to-end test still showed production reliability gaps:
+
+- Codex returned schema drift such as `claim`, `notes`, `confidence`, and objects missing `name`.
+- `package-lock.json` consumed most of the context budget.
+- Quiver-generated docs competed with product source files.
+- TTY progress works, but no-TTY progress is not visible until the command finishes.
+- Retry can take too long and repeat the same drift.
+- `AGENTS.md` can be preserved safely but left contract-incomplete with only a warning.
+
+The next iteration must make the command reliable in real projects without relaxing the schema or writing invalid final documentation.
+
+## Objective
+
+Make the command:
+
+```bash
+npx --yes create-quiver@latest ai analyze-project --deep --provider codex --model gpt-5.5
+```
+
+produce a valid, reviewable project-analysis JSON proposal in `nika-erp`, or fail quickly with actionable diagnostics and complete audit artifacts while preserving these invariants:
+
+- no product code writes;
+- no final docs writes without valid final JSON and explicit review/confirmation;
+- no secrets, unsafe paths, dependency dumps, caches, generated outputs, or binaries sent to the provider;
+- no schema relaxation to accept arbitrary provider output.
+
+## Scope
+
+### Included
+
+- Deterministic regression harness based on sanitized `nika-erp` provider drift.
+- Safe discovery and sampling with quotas, lockfile summaries, symlink handling, and source-priority rules.
+- Run lifecycle state machine, visible progress, stdout/stderr contract, timeouts, and cancellation cleanup.
+- Artifact store with redaction, truncation, head/tail retention, hashes, manifest metadata, and size limits.
+- Path-aware repair engine for strictly allowed drift only.
+- Retry controller with compact prompts, drift signatures, timeouts, and early stop.
+- Final validation and review/write gate ensuring invalid JSON never writes final docs.
+- `doctor` guidance for incomplete existing `AGENTS.md`.
+- Release smoke documentation separating deterministic CI gates from optional live provider evidence.
+
+### Excluded
+
+- Modifying product code in analyzed repositories.
+- Generating specs automatically from analysis output.
+- Writing documentation final without `--review` or explicit confirmation.
+- Accepting arbitrary provider fields by loosening the schema.
+- Building a full AST/indexing engine.
+- Requiring live provider execution as a CI gate.
+
+## Approved Acceptance Criteria
+
+1. In `nika-erp`, the command either produces schema-valid JSON or fails controlled without final docs writes.
+2. `--dry-run` creates no `.quiver/runs`, docs, code, or audit artifacts.
+3. Provider mode without `--review` writes only audit artifacts, never final docs.
+4. `--json` keeps stdout machine-readable and sends human progress to stderr or suppresses it.
+5. TTY mode shows a loader and step names.
+6. No-TTY mode prints line-based progress before provider execution and during validation/repair/retry/artifact writes.
+7. First visible progress appears in less than 2 seconds.
+8. `.env*`, secrets, `.git`, `.quiver`, dependency folders, `.next`, caches, dumps, binaries, certificates, credential files, and unsafe symlinks are never sent to the provider.
+9. Lockfiles are summarized by default and never consume the main source budget.
+10. Sampling reserves budget for product source and caps generated Quiver docs.
+11. Raw provider stdout/stderr artifacts are redacted before persistence and size-bounded.
+12. Artifacts keep head/tail, original size, persisted size, hash, truncation flag, command/options, `run_id`, `kind`, `schema_version`, and timestamps.
+13. Repair is table-driven and path-aware.
+14. Allowed repairs are limited to:
+    - remove unsupported `notes`;
+    - remove unsupported `confidence`;
+    - rename `claim` to `name` only where the path expects a human label, `name` is missing, and `claim` is a safe non-empty string.
+15. Conflicting `name` and `claim` values are not repaired.
+16. Repair has a maximum total threshold and per-path-family threshold.
+17. Retry does not resend full selected context.
+18. Retry has per-attempt timeout, total timeout, drift signature, and early stop when dominant drift repeats.
+19. Canceling with `SIGINT`/`SIGTERM` terminates provider children and writes status `canceled`.
+20. Final docs write requires valid schema, semantic validation, review approval, snapshot, and atomic writes.
+21. Error output is compact, bounded to grouped summaries, and points to manifests for full details.
+22. Deterministic fixtures are CI gates; live `nika-erp` smoke is release evidence only.
+23. `doctor` gives a safe next action for incomplete existing `AGENTS.md` without overwriting human content.
+
+## Architecture Rule
+
+Implementation must preserve this boundary sequence:
+
+```text
+Read boundary -> Provider boundary -> Repair boundary -> Validation boundary -> Write boundary
+```
+
+No slice should cross more than one critical boundary without explicit tests. Repository content and provider output are untrusted until validated.
+
+## Slice Roadmap
+
+| Slice | Title | Status | Dependencies | Parallel Guidance |
+|---|---|---|---|---|
+| slice-01-contract-regression-harness | Contract & Regression Harness | pending | none | sequential first |
+| slice-02-safe-discovery-sampling | Safe Discovery & Sampling | pending | slice-01 | parallel after slice-01 |
+| slice-03-run-lifecycle-cli-io | Run Lifecycle & CLI IO | pending | slice-01 | parallel after slice-01 |
+| slice-04-artifact-store-redaction | Artifact Store & Redaction | pending | slice-01, slice-03 | parallel with slice-05 after slice-03 |
+| slice-05-path-aware-repair-engine | Path-Aware Repair Engine | pending | slice-01 | parallel with slice-02/03, before slice-06 |
+| slice-06-retry-controller | Retry Controller | pending | slice-03, slice-05 | sequential |
+| slice-07-final-validation-review-write-gate | Final Validation & Review Write Gate | pending | slice-02, slice-04, slice-05, slice-06 | sequential production gate |
+| slice-08-doctor-agents-guidance | Doctor AGENTS.md Guidance | pending | slice-01 | parallel/non-blocking |
+| slice-09-release-smoke-rollback-docs | Release Smoke & Rollback Docs | pending | slice-07 | final |
+
+## Execution Order
+
+```text
+01
+├─ 02
+├─ 03
+│  └─ 04
+├─ 08
+└─ 05
+   └─ 06
+      └─ 07
+         └─ 09
+```
+
+## Production Guardrails
+
+- Fail closed before final docs writes.
+- Keep stdout parseable in `--json`.
+- Keep progress accessible in no-TTY logs.
+- Kill child processes on cancellation.
+- Redact before persisting.
+- Bound all artifacts and console output.
+- Keep repair structural and auditable, not semantic.
+- Preserve human-authored files by default.
+
+## Validation Strategy
+
+Deterministic gates:
+
+```bash
+node --test tests/commands/ai-analyze-project-provider.test.js
+node --test tests/commands/ai-analyze-project-review.test.js
+node --test tests/commands/ai-analyze-project.test.js
+node --test tests/commands/doctor.test.js
+node --test tests/lib/ai-analyze-project-discovery.test.js
+node --test tests/lib/ai/analyze-project-repair.test.js
+npm run docs:check
+npm run schema:slice:check
+node bin/create-quiver.js spec validate specs/quiver-v54-deep-project-analysis-hardening --strict
+git diff --check
+```
+
+Release evidence:
+
+```bash
+npx create-quiver ai analyze-project --deep --dry-run
+npx create-quiver ai analyze-project --deep --provider codex --model gpt-5.5
+npx create-quiver ai analyze-project --deep --review --provider codex --model gpt-5.5
+```
+
+The live `nika-erp` smoke must be documented, but CI must not depend on live provider credentials, network, or model availability.
+
+## Risks
+
+- Over-repairing provider output could turn low-quality JSON into schema-valid misinformation.
+- Redaction after persistence could leak secrets into `.quiver/runs`.
+- No-TTY progress in stdout could break automation.
+- Lockfile summary could still read huge files inefficiently if implemented with full reads.
+- Retry without drift signatures could waste time and money.
+- A broad final-write slice could hide regressions unless artifacts and write gates are separated.
+
+## Resolved Decisions
+
+- Keep the schema strict.
+- Repair only the explicitly allowed drift table.
+- Use fixtures as CI gates and live smoke as release evidence.
+- Separate artifact redaction from final validation/write gate.
+- Keep `doctor` AGENTS guidance parallel and non-blocking for the provider hardening path.
+
+## Open Questions
+
+- Exact default timeout values should be chosen during implementation and documented in the slice closure.
+- Exact repair thresholds should be chosen during implementation and documented in the slice closure.
+- The final `AGENTS.md` repair command name should align with existing CLI command structure if one already exists.

package/specs/quiver-v54-deep-project-analysis-hardening/STATUS.md

@@ -0,0 +1,34 @@
+# Status - Quiver v54 Deep Project Analysis Hardening
+
+**Status:** Implemented
+**Last updated:** 2026-06-11
+
+## Current State
+
+The approved 9-slice plan has been implemented. Deterministic tests cover provider drift, safe sampling, TTY/no-TTY progress, artifact redaction, repair/retry, review write gates, doctor guidance, and release smoke documentation.
+
+## Slice Status
+
+| Slice | Status | Notes |
+|---|---|---|
+| slice-01-contract-regression-harness | completed | Drift fixtures and command/parser tests added. |
+| slice-02-safe-discovery-sampling | completed | Lockfiles summarized as metadata; Quiver docs deprioritized. |
+| slice-03-run-lifecycle-cli-io | completed | TTY loader and no-TTY linear progress covered. |
+| slice-04-artifact-store-redaction | completed | Raw provider streams are redacted, bounded, hashed, and audited. |
+| slice-05-path-aware-repair-engine | completed | Path-aware repair handles `notes`, safe `claim` to `name`, and unsupported question `confidence`. |
+| slice-06-retry-controller | completed | Retry remains bounded, compact, audited, and failure artifacts persist. |
+| slice-07-final-validation-review-write-gate | completed | Review, confirmation, snapshot, and post-write validation gates verified. |
+| slice-08-doctor-agents-guidance | completed | `doctor` and `doctor --fix` give actionable AGENTS.md repair guidance. |
+| slice-09-release-smoke-rollback-docs | completed | Release smoke and rollback docs updated. |
+
+## Blockers
+
+- None.
+
+## Next Command
+
+```bash
+npm run docs:check
+npm run schema:slice:check
+node bin/create-quiver.js spec validate specs/quiver-v54-deep-project-analysis-hardening --strict
+```

package/specs/quiver-v54-deep-project-analysis-hardening/slices/slice-01-contract-regression-harness/CLOSURE_BRIEF.md

@@ -0,0 +1,10 @@
+# CLOSURE_BRIEF - slice-01 contract regression harness
+
+## Summary
+
+Completed. Added deterministic provider-output fixtures and regression coverage for schema drift, safe repairs, retries, parse wrappers, invalid JSON, provider failures, and no-final-doc write guarantees.
+
+## Validation
+
+- PASS: `node --test tests/lib/ai/analyze-project-repair.test.js`
+- PASS: `node --test tests/commands/ai-analyze-project-provider.test.js`

package/specs/quiver-v54-deep-project-analysis-hardening/slices/slice-01-contract-regression-harness/EXECUTION_BRIEF.md

@@ -0,0 +1,54 @@
+# EXECUTION_BRIEF - slice-01 contract regression harness
+
+## Context
+
+The live `nika-erp` provider run exposed schema drift and UX issues that must be locked into deterministic tests before implementation changes continue.
+
+## Objective
+
+Create the regression contract and sanitized fixture harness for v54 without live provider requirements.
+
+## Scope
+
+- Add or update deterministic fixtures for `claim`, `notes`, `confidence`, missing `name`, repeated drift, timeout, cancellation, and invalid final JSON.
+- Add golden expectations for no-write and compact-error behavior.
+- Keep this slice focused on tests/contracts; runtime fixes belong to later slices.
+
+## Acceptance Criteria
+
+- Fixtures reproduce the observed `nika-erp` drift without credentials, network, or a live checkout.
+- Tests assert `--dry-run` creates no `.quiver/runs`, docs, or code writes.
+- Tests assert provider mode without `--review` writes only audit artifacts and no final docs.
+- Tests assert `--json` stdout is parseable and not contaminated by progress.
+- Tests assert console schema errors are grouped and bounded.
+- The spec validates with this slice present.
+
+## Completion Checklist
+
+- [ ] Fixtures added or updated.
+- [ ] Tests fail against missing behavior and pass after later slices.
+- [ ] `slice.json` status and `CLOSURE_BRIEF.md` updated with evidence.
+
+## Expected Files To Modify
+
+- `tests/fixtures/analyze-project/**`
+- `tests/commands/ai-analyze-project-provider.test.js`
+- `tests/commands/ai-analyze-project.test.js`
+- `tests/commands/ai-analyze-project-review.test.js`
+- `tests/lib/ai/analyze-project-repair.test.js`
+- This slice's closure/status/evidence files.
+
+## Validation Required
+
+```bash
+node --test tests/commands/ai-analyze-project-provider.test.js
+node --test tests/commands/ai-analyze-project.test.js
+node bin/create-quiver.js spec validate specs/quiver-v54-deep-project-analysis-hardening --strict
+git diff --check
+```
+
+## Constraints
+
+- Do not call live providers.
+- Do not implement runtime repair/retry in this slice.
+- Do not store real provider secrets or raw private project data.

package/specs/quiver-v54-deep-project-analysis-hardening/slices/slice-01-contract-regression-harness/slice.json

@@ -0,0 +1,72 @@
+{
+  "slice_id": "slice-01-contract-regression-harness",
+  "ticket": "QUIVER-54-01",
+  "type": "test-infrastructure",
+  "title": "Contract & Regression Harness",
+  "objective": "Freeze deterministic regression expectations for hardening ai analyze-project before runtime changes.",
+  "description": "Adds sanitized fixtures and tests for the nika-erp schema drift, no-write guarantees, stdout/stderr contract, compact errors, and provider-mode write boundaries.",
+  "git": {
+    "branch_type": "feature",
+    "base_branch": "main",
+    "branch_slug": "v54-contract-regression-harness",
+    "branch_name": "feature/QUIVER-54-01-v54-contract-regression-harness"
+  },
+  "files": [
+    "tests/fixtures/analyze-project/**",
+    "tests/commands/ai-analyze-project-provider.test.js",
+    "tests/commands/ai-analyze-project.test.js",
+    "tests/commands/ai-analyze-project-review.test.js",
+    "tests/lib/ai/analyze-project-repair.test.js",
+    "specs/quiver-v54-deep-project-analysis-hardening/**"
+  ],
+  "expected_read_paths": [
+    "src/create-quiver/commands/ai.js",
+    "src/create-quiver/lib/ai/analyze-project-parser.js",
+    "src/create-quiver/lib/ai/analyze-project-validation.js",
+    "src/create-quiver/lib/ai/analyze-project-repair.js",
+    "tests/fixtures/analyze-project/**"
+  ],
+  "allowed_write_paths": [
+    "tests/fixtures/analyze-project/**",
+    "tests/commands/ai-analyze-project-provider.test.js",
+    "tests/commands/ai-analyze-project.test.js",
+    "tests/commands/ai-analyze-project-review.test.js",
+    "tests/lib/ai/analyze-project-repair.test.js",
+    "specs/quiver-v54-deep-project-analysis-hardening/STATUS.md",
+    "specs/quiver-v54-deep-project-analysis-hardening/EVIDENCE_REPORT.md",
+    "specs/quiver-v54-deep-project-analysis-hardening/slices/slice-01-contract-regression-harness/CLOSURE_BRIEF.md",
+    "specs/quiver-v54-deep-project-analysis-hardening/slices/slice-01-contract-regression-harness/slice.json"
+  ],
+  "depends_on": [],
+  "parallel_safe": "never",
+  "parallel_safe_reason": "This slice defines the contract used by every later slice.",
+  "must": [
+    "Use sanitized deterministic fixtures instead of live provider calls.",
+    "Assert no final docs writes for invalid final JSON.",
+    "Assert dry-run creates no .quiver/runs.",
+    "Assert --json stdout remains parseable."
+  ],
+  "not_included": [
+    "Runtime repair implementation.",
+    "Sampling changes.",
+    "Retry implementation."
+  ],
+  "acceptance": [
+    "nika-erp drift is reproducible offline.",
+    "No-write guarantees are covered by tests.",
+    "Schema-noise output is bounded by tests.",
+    "Spec validation passes."
+  ],
+  "tests": [
+    "node --test tests/commands/ai-analyze-project-provider.test.js",
+    "node --test tests/commands/ai-analyze-project.test.js",
+    "node bin/create-quiver.js spec validate specs/quiver-v54-deep-project-analysis-hardening --strict",
+    "git diff --check"
+  ],
+  "estimated_hours": 4,
+  "actual_hours": 4,
+  "status": "completed",
+  "started_at": "2026-06-11",
+  "completed_at": "2026-06-11",
+  "blocked_reason": null
+}

package/specs/quiver-v54-deep-project-analysis-hardening/slices/slice-02-safe-discovery-sampling/CLOSURE_BRIEF.md

@@ -0,0 +1,11 @@
+# CLOSURE_BRIEF - slice-02 safe discovery sampling
+
+## Summary
+
+Completed. Lockfiles are summarized as metadata instead of selected as provider content, and Quiver-generated docs are deprioritized so product source consumes the main sample budget first.
+
+## Validation
+
+- PASS: `node --test tests/lib/ai-analyze-project-discovery.test.js`
+- PASS: `node --test tests/commands/ai-analyze-project.test.js`
+- PASS: live read-only `nika-erp` dry-run JSON smoke.