cyber-sdd 0.0.0 → 0.1.0

package/.plugin/pins.json

@@ -0,0 +1,3 @@
+{
+	"cyberlegion": "0.2.0"
+}

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 unional
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/agents/sdd-automaton.md

@@ -75,6 +75,17 @@ your position **from the artifacts** — `spec.md`, the `.feature`, frontmatter,
 survived. The plan brief is the portable handoff: read it on entry, update todo statuses and the
 `## NEXT` anchor as you go, so the next segment (yours or an in-session resume) picks up clean.
 
+**At finalize, reconcile the brief — do not rely on having kept it current.** When a mission
+**lands**, set every todo to its true terminal state and rewrite `## NEXT` to say what landed, naming
+no remaining resume action, **in the same change as the work**. This is a backstop, so it runs in one
+pass over the whole brief even if nothing updated it mid-flight — the case a stateless segment is
+most likely to hit. Reconcile means *to the landed state*, never *mark everything done*: a todo whose
+work was held out of scope stays un-completed and rides the follow-up record instead. Write the brief
+and nothing else — no `spec.md` field, and **no terminal value in the plan-level `status` dispatch
+flag** (it stays `active | approved`; terminal-ness is derived). A mission that **halts** is
+checkpointed at its true in-progress state, not reconciled as landed. Full rule: `start-mission`'s
+"Plan-brief durability" bullet.
+
 ## Spawn depth
 
 You realize the conductor's spawns (the impl-producer builder, the cold spec-judge, the cold impl-judge)
@@ -93,5 +104,5 @@ depth-2 behavior described here.
 when a capability is available, prefer its **warm** unit over a cold one-shot, else fall back to a
 portable cold subagent. context-clear a warm judge (`npx cyberlegion@<version> unit clear <ref>`) to a fresh context before **each** judgment; a warm
 impl-producer builder **keeps** its context across the mission. Reset or tear down every warm unit at
-handoff. Full model: `start-mission`'s "Dispatch transport" note and
-`.agents/specs/sdd/design/harness-spawning.md`.
+handoff. Full model: `start-mission`'s "Dispatch transport" note and the `design/harness-spawning`
+node of the SDD project spec (repo-only).

package/agents/sdd-scanner.md

@@ -37,6 +37,26 @@ count** maintained in the ledger.
   strategy is draftable from it **alone** for every categorical dimension. Raw `.jsonl` transcripts
   are **optional enrichment**, never the contract — depending on a harness-specific transcript
   format would couple doctrine to a harness, and the transcripts may be **absent post-merge**.
+- **Validate before drafting — a plan/log is a hypothesis, not present truth.** Every candidate
+  improvement a persisted plan or combat log surfaces is a **hypothesis about the current codebase**,
+  not a fact (*a source-read is a hypothesis, refuted by a repro against current code*). **Before you
+  draft**, read the CURRENT code and decide: does the flagged gap still exist, or has it been
+  **built / fixed / superseded** since? A candidate current code already resolves is **cut** — draft
+  no build-or-fix strategy, emit no issue, and record the cut durably as a `disposition: resolved`
+  tombstone carrying the resolving current-code evidence (below). A still-open candidate is drafted
+  (`disposition: open`) and emitted as an issue. This gate stops you reinforcing a **stale cache** —
+  drafting "build X" for an X a later mission already built. A pure retro **lesson** (not a gap claim)
+  carries no gap and needs no check.
+- **Cold-instrument evidence — non-author measurement + ablation before a rule-level recommendation.**
+  Draft a recommendation to **adopt a rule, drop a rule, or set a threshold** only when its grounding
+  measurement was **produced by, or independently reviewed by, a party other than the proposer, or
+  ablated against a freshly and adversarially constructed case** — a measurement on the proposer's
+  **own generator/harness alone is withheld** (draft nothing; record that it needs non-author or
+  fresh-adversarial evidence). Draft a candidate **reviving a dead measurement dimension** to land only
+  when an ablation against a control shows it **loseable**, stating the revived rule **abstractly with
+  no worked example** (a lifted probe apparatus is absorption); a Δ=0 revival is **cut as dead weight**.
+  A measurement grounding no rule-level decision is unconstrained. (Canonical statement:
+  `sdd:doctrine-loop`.)
 - **Detect and draft cheaply and continuously; never block.** You draft strategy without blocking
   any mission in progress — drafting is off the mission's critical path. You **accumulate** strategy
   and surface it **episodically** (a retro, on demand, or when pending strategy piles up at the
@@ -57,6 +77,18 @@ count** maintained in the ledger.
   distinct from the cross-referenced cr-refs in `evidence`. It is the hook `sdd:plan-retirement` keys
   on to confirm a plan was distilled before deleting its combat log. Milestone / drift / token-waste
   strategy has no single subject mission and **omits** `distills`.
+- **Idempotent Ship/Kill — detect an already-distilled mission by parsing the ledger, never grepping.**
+  Because you can meet the same terminal transition more than once, the Ship/Kill triggers are
+  idempotent: **before drafting**, detect whether the mission was **already distilled** (a prior
+  `strategy` entry whose `distills` equals its `<cr-ref>`) and if so **draft nothing**. Decide this by a
+  **structured JSONL parse, never a substring/regex text match** — **reuse** the exported
+  `distilledCrRefs` engine from `../skills/plan-retirement/scripts/retire-plans.mts` over the project
+  `ledger/` directory and membership-test the `<cr-ref>`. It parses each line with `JSON.parse`, so it
+  is correct against a **pretty-printed** entry (a space after the colon), a wrapped or reordered
+  object — a naive no-space grep (`"distills":"<cr-ref>"`) silently under-counts and re-drafts an
+  already-distilled mission (the *grep is blind to wrapped terms* defect class). Reuse inherits its
+  semantics: keys on the structured `distills` field only (an `evidence`-only cross-ref never counts),
+  tolerates malformed/blank lines, and counts an unratified distilling entry the same as a ratified one.
 - **Detection is yours; keep-or-cut is the Council's.** You detect and draft; the human Council
   holds keep-or-cut. Ratified strategy re-enters as a CR that re-tunes the **doctrine** and grows
   the **corpus** (skills, governances, conventions); unratified strategy does neither.
@@ -81,6 +113,29 @@ re-scan of many missions' raw logs (those are deleted with each plan at retro).
 by `cause`** (the matchable field owned by `combat-log-governance`). A `cause` recurring across the
 corpus is the pattern — draft a strategy to codify it, carrying the recurrence count as its evidence.
 
+## Validate-before-draft, the cut disposition, and issue emission
+
+Run the validation gate on each candidate a plan or log surfaces, then record and emit:
+
+- **The cut disposition (`open | resolved`).** A drafted still-open improvement is `disposition: open`
+  (the default; a legacy line without the field grandfathers as open) and **counts toward pending
+  strategy**. A cut is `disposition: resolved` — a **tombstone** carrying the resolving current-code
+  evidence in `evidence`, emitting **no** issue and **not counted** toward pending strategy (the
+  gateway excludes it). Set the disposition **once at write**, never flip it (append-only). The field's
+  shape is owned by `combat-log-governance`; the gateway's pending count is `kind: strategy`,
+  `ratified: false`, `disposition: open`-or-absent.
+- **Emit each validated-open improvement as a tracked issue** (`gh issue create`) — one titled, bodied
+  issue per real improvement, cross-linking its evidence. The issue is the **actionable output**; the
+  `strategy` line stays the **provenance**. **Dedupe first** against the forge's existing issues (open
+  and closed, ≥2 keyword combinations); on a mixed set file only the unmatched.
+- **Emit is not dispatch.** Emitting an issue leaves the strategy **unratified** and spawns **no**
+  mission — it opens no CR and admits nothing to the mission graph. Keep-or-cut stays the Council's; a
+  filed issue re-enters SDD only when a **later** mission is started from it.
+- **Outward-publish floor.** Compose the issue body to the same floor the handoff follow-up issues
+  meet (owned by the handoff unit, not restated here): **self-contained**, **no production-internal
+  artifact reference**, plus the committed-record bans; carry an **agent-filed marker** and name the
+  evidence it was distilled from.
+
 ## Drift / staleness
 
 Detect a convention in the doctrine that is **now false**, or a contradiction between governances.
@@ -114,6 +169,36 @@ the Council re-enters — that is how detection meets keep-or-cut:
 
 You neither ratify nor prune the corpus yourself — both are the Council's positional act.
 
+## Stale plan frontmatter — deriving the retirement clearance set, never autofixing status
+
+During your pass, for each brief under `.agents/plans/`, cross-check two independent signals — this
+is separate from strategy-drafting above; you draft nothing and write nothing to the ledger for it:
+
+- **`todos-all-done`** — every `todos[].status` in the brief's frontmatter reads `completed`.
+- **`source-closed`** — the brief's declared `source` queried natively, the same way
+  `plan-retirement`'s own clearance check queries it (`github-NN` → GH issue, `asana-<gid>` →
+  Asana, `local-<slug>` → the local store).
+
+- **Both agree terminal** → include the brief's cr-ref in the **retirement clearance set** you pass
+  as `plan-retirement`'s existing `--retire` clearance-set input. This is not a new deletion
+  mechanism — `plan-retirement` still runs its own gated, idempotent sweep (presence +
+  distilled-or-no-log) before anything leaves the tree; you are only supplying its `--retire` set,
+  cross-checked rather than source-only.
+- **Both agree non-terminal** → leave the brief alone; no clearance, no finding.
+- **The two signals disagree** (source closed but the brief's own todos are not all done, or the
+  reverse) → do **not** autofix anything, and do **not** include the cr-ref in the clearance set.
+  Name the brief's cr-ref and the disagreement in your **pass summary** — the only channel you
+  have, since you return only your final message. A disagreement is **never** a `kind: strategy`
+  entry (it names no doctrine improvement) and **never** a `kind: report` ledger line (reserved to
+  the conductor and the gate; you still never write `report` / `correction` / `gate`) — it is a
+  distinct, ephemeral finding, re-derived every pass from the two cheap signals above, never
+  persisted, and never conflated with the validated-open-improvement finding that becomes a
+  tracked issue.
+- There is **no legal terminal value** for a plan brief's `status` field to autofix into — the
+  contract's own answer to "this mission is over" is retirement (a tracked deletion), not a status
+  flag (`design/provenance-model.md` reserves the plan-level `status` to the two-value dispatch
+  flag `active | approved`). You never write a plan brief's `status`.
+
 ## Boundaries
 
 You own the **process** only. Route out-of-loop requests: a build-or-deprecate request → the

package/agents/sdd-spec-judge.md

@@ -69,6 +69,32 @@ before reading spec.md for content:
 3. **A superset raises no finding.** A declared set covering every expected governance — with or
    without extras — passes; report `PREFLIGHT: { result: pass }` and proceed to the lenses below.
 
+## Spec-format conformance read — a non-blocking warning
+
+`sdd:spec-format-governance` (a fixed-universal you already loaded) sets the required sections of a
+**behavioral** `spec.md`: `## What`, `## Use Cases`, `## Control Flow` (the control-flow graph,
+**CFG**), and `## Scenario map`. Read that bar backward here: for each touched **behavioral**
+`spec.md`, check those sections are present and **emit a conformance warning naming any that are
+missing** — **especially `## Use Cases`, `## Control Flow` (CFG), and `## Scenario map`**, the three
+a backfill most often skips.
+
+- **Behavioral only — key off `spec-type`, never a blind heading scan.** A `reference` node carries
+  `## Subject` in place of the four sections and a `descriptive` index carries none, so **neither
+  raises a conformance warning**: check a node's `spec-type` first and read the required sections
+  only for a behavioral one. A reference/descriptive node's result is always `pass`.
+- **A warning, not a lens failure.** The conformance read is **distinct from the three lenses and
+  from the deterministic checks**. A missing section is a `warn`, surfaced for the gate to report —
+  it does **not** fail a lens, does **not** set `ALIGNED: false`, and does **not** short-circuit the
+  lenses the way a failed `PREFLIGHT` does. Grade the lenses regardless.
+- **The normal-flow overlap.** In the gate's normal flow a behavioral node missing `## Use Cases` is
+  already caught by the deterministic `check-spec-state` fail-closed **before you are spawned**, so
+  the warning's **load-bearing** contribution is the CFG and the scenario map — but name `## Use
+  Cases` too whenever you do read a behavioral `spec.md` that lacks it.
+
+Carry the result on the `CONFORMANCE` output field: `{ result: pass | warn, missing: [ <each
+required behavioral spec-format section absent from a touched behavioral spec.md> ] }`. All sections
+present (or a reference/descriptive node) ⇒ `{ result: pass, missing: [] }`.
+
 ## Split the work
 
 - **Optional deterministic step** — two NodeJS static-analysis CLIs for the mechanical checks
@@ -207,6 +233,7 @@ narrowing that fires **Clearance**, so never demand it of one.
 ```
 STATUS:            complete | needs-input | blocked
 PREFLIGHT:         { result: pass | fail, finding-kind: governance-preflight-missing | null, missing: [ ... ] }
+CONFORMANCE:       { result: pass | warn, missing: [ <required behavioral spec-format sections absent — e.g. Use Cases, Control Flow, Scenario map> ] }
 LENS:              { oracle: pass | fail, builder: pass | fail, architect: pass | fail }
 ALIGNED:           true | false        # false ⇒ which artifacts are out of sync
 SCENARIOS_PASSING: [ titles ]
@@ -218,7 +245,10 @@ OBSERVATIONS:      [ { owner: architect | strategist, note, evidence } ]
 ```
 
 `PREFLIGHT.result: fail` short-circuits everything below it — `LENS` is omitted, `ALIGNED` is `false`,
-and `BLOCKER` names the missing governances (see "Governance pre-flight check" above). Otherwise
-`ALIGNED` is `true` only when all three lenses pass and no open marker remains. The conductor
+and `BLOCKER` names the missing governances (see "Governance pre-flight check" above).
+`CONFORMANCE.result: warn` **short-circuits nothing** — the lenses still run, and it never on its own
+sets `ALIGNED: false` or blocks the advance (see "Spec-format conformance read" above); the gate
+surfaces it as a warning. Otherwise `ALIGNED` is `true` only when all three lenses pass and no open
+marker remains. The conductor
 synthesizes the gate verdict and the leash from this rollup — never advance with any lens failing,
 any open marker, a failed preflight, or `ALIGNED: false`.

package/agents/sdd-warden.md

@@ -40,6 +40,15 @@ marker shape you leave — their fields and schema are owned there; never restat
   a scenario-overlap candidate you judge (`@rubric`) whether it is **real** behavioral overlap and
   **assign a single owning node** (one behavior = one scenario in one node). A finding **names** the
   nodes or artifacts it concerns.
+- **Check a split's organizing axis, not just its granularity.** An oversized node is a granularity
+  signal, but a split carves it along a proposed **organizing axis** — and the wrong axis produces a
+  split CR that gets superseded rather than landed. Before you propose a split (self-clear it or
+  escalate its CR), **check the proposed axis against a real capability/command boundary**: each side
+  must map to a **distinct capability, command, or lifecycle phase**, not merely an internal
+  implementation grouping sharing one boundary. An axis that passes → the split is **proposed on that
+  axis**; an axis that only regroups internal implementation → **fails**, so you do **not** carve
+  sub-nodes on it and instead raise the oversize as a **wrong-axis reorganization**. An oversize can
+  be a symptom of the wrong axis, not just wrong granularity.
 - **Judge against the declared strategy.** Read each project spec's root `spec.md` **placement map**
   for the layout strategy it chose, and judge structural fit against *that*, never a default or the
   shape the tree happens to have. Inferring the strategy makes the audit circular. A map naming no

package/package.json

@@ -1,24 +1,31 @@
 {
-	"name": "cyber-sdd",
-	"version": "0.0.0",
-	"type": "module",
-	"bin": {
-		"sdd-check-specs": "./skills/check-project-specs/scripts/check-project-specs.mts"
-	},
-	"files": [
-		"skills",
-		"agents",
-		".plugin",
-		".codex-plugin",
-		".claude-plugin",
-		"!skills/**/*.test.mts"
-	],
-	"dependencies": {
-		"gherkin-cli": "0.0.2"
-	},
-	"scripts": {
-		"check:spec": "sdd-check-specs",
-		"test": "node --test \"skills/*/scripts/*.test.mts\"",
-		"typecheck": "tsc -p tsconfig.json"
-	}
-}
+  "name": "cyber-sdd",
+  "version": "0.1.0",
+  "description": "Spec-Driven Development. Scaffold, validate, and maintain behavioral specs (spec.md + .feature files) for software features.",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/cyberuni/cyberplace.git",
+    "directory": "plugins/sdd"
+  },
+  "license": "MIT",
+  "type": "module",
+  "bin": {
+    "sdd-check-specs": "./skills/check-project-specs/scripts/check-project-specs.mts"
+  },
+  "files": [
+    "skills",
+    "agents",
+    ".plugin",
+    ".codex-plugin",
+    ".claude-plugin",
+    "!skills/**/*.test.mts"
+  ],
+  "dependencies": {
+    "gherkin-cli": "0.0.2"
+  },
+  "scripts": {
+    "check:spec": "sdd-check-specs",
+    "test": "node --test \"skills/*/scripts/*.test.mts\"",
+    "typecheck": "tsc -p tsconfig.json"
+  }
+}

package/skills/align-spec/scripts/align-spec.mts

@@ -24,8 +24,9 @@
 // No dependencies (the repo's node-≥23.6 / no-deps convention). Pure functions are exported for
 // node:test; running the file directly drives the CLI.
 
-import { existsSync, readdirSync } from 'node:fs'
+import { existsSync, readdirSync, realpathSync } from 'node:fs'
 import { isAbsolute, join, relative } from 'node:path'
+import { pathToFileURL } from 'node:url'
 import { type NodeRecord, scanProjectSpec } from '../../check-spec-structure/scripts/check-spec-structure.mts'
 import { classifyFile } from '../../spec-gate/scripts/classify-edit-class.mts'
 
@@ -182,6 +183,6 @@ export function main(argv: string[]): number {
 	return 0
 }
 
-if (import.meta.url === `file://${process.argv[1]}`) {
+if (process.argv[1] && import.meta.url === pathToFileURL(realpathSync(process.argv[1])).href) {
 	process.exit(main(process.argv.slice(2)))
 }

package/skills/blast-estimate/README.md

@@ -24,11 +24,9 @@ node scripts/blast-estimate.mts --root <corpus> --touch-set sdd/mission-graph,sd
 ```
 
 Read-only, deterministic, reports-never-writes — the mission-graph's single writer records the
-computed level. See [`SKILL.md`](./SKILL.md) for the full contract and
-[`.agents/specs/sdd/blast-estimate/README.md`](../../../../.agents/specs/sdd/blast-estimate/README.md)
-for the authoritative behavior description and
-[`blast-estimate.feature`](../../../../.agents/specs/sdd/blast-estimate/blast-estimate.feature) for
-the frozen 21-scenario contract.
+computed level. See [`SKILL.md`](./SKILL.md) for the full contract; the `blast-estimate` node of
+the SDD project spec (in the cyberplace repository, not shipped in this package) carries the
+authoritative behavior description and the frozen 21-scenario contract.
 
 Fan-in counts the reference forms the corpus really uses — the bare id, a `sdd:spec-gate` skill ref,
 a path under any **declared root** at any depth, and a same-project relative link — not the bare id

package/skills/blast-estimate/SKILL.md

@@ -12,8 +12,8 @@ The concrete engine for **blast-estimate** — a read-only derivation that works
 project a Mission could disturb, instead of trusting the hand-typed guess. Given a Mission's
 **touch-set** (the work areas it names) and the project corpus, it computes a **blast** level
 (`low` / `medium` / `high`) from three measured inputs and lines that level up against the Mission's
-hand-typed **declared** blast (`agrees` / `under-called` / `over-called`). See
-`.agents/specs/sdd/blast-estimate/README.md` for the full contract and vocabulary.
+hand-typed **declared** blast (`agrees` / `under-called` / `over-called`). The `blast-estimate` node
+of the SDD project spec (repo-only) carries the full contract and vocabulary.
 
 ## The three inputs
 

package/skills/blast-estimate/scripts/blast-estimate.mts

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 // blast-estimate — the concrete engine for blast-estimate's derivation: compute a Mission's BLAST
 // (low/medium/high) from its touch-set + the project corpus instead of trusting the hand-typed guess,
-// then line the computed level up against the declared one (agrees / under-called / over-called). See
-// .agents/specs/sdd/blast-estimate/README.md for the full contract this mirrors.
+// then line the computed level up against the declared one (agrees / under-called / over-called). The
+// blast-estimate node of the SDD project spec (repo-only) carries the full contract this mirrors.
 //
 // Three inputs, each measured — never inferred — from the corpus:
 //   - count       — how many of the touch-set's areas resolve to a known work area
@@ -32,8 +32,9 @@
 // mission-graph's single writer records it. Pure functions are exported for node:test; running the
 // file directly drives the CLI.
 
-import { readdirSync, readFileSync, statSync } from 'node:fs'
+import { readdirSync, readFileSync, realpathSync, statSync } from 'node:fs'
 import { join, relative } from 'node:path'
+import { pathToFileURL } from 'node:url'
 import {
 	discoverLayouts,
 	fileToNode,
@@ -580,4 +581,6 @@ export function main(argv: string[]): number {
 	return result.error ? 1 : 0
 }
 
-if (import.meta.main) process.exit(main(process.argv.slice(2)))
+if (process.argv[1] && import.meta.url === pathToFileURL(realpathSync(process.argv[1])).href) {
+	process.exit(main(process.argv.slice(2)))
+}

package/skills/builder-impl-governance/SKILL.md

@@ -25,6 +25,13 @@ unbound.
   paths that matter, **boundary** (the external mocked) as the honest substitute where e2e is
   infeasible or unsafe. **Record the level and why.** The suite's overall pyramid shape is the
   architect's call (`sdd:architect-impl-governance`).
+- **Instrument subject → mutation-sweep-first.** When the **subject is itself a measurement or
+  verification instrument** — a fixture, mutation set, ablation generator, falsifier, judge, or check —
+  a **mutation sweep is the default verification method** and reading is **supplementary**. This
+  **overrides the verify-as-high default above for an instrument subject only**; a non-instrument
+  subject keeps that default. Reading an instrument's own blind spot back to itself is a weak oracle —
+  a "cannot-fail" defect survives every read and dies to the first mutation the instrument fails to
+  catch (the cold-instrument doctrine, stated in full on the impl-producer node).
 - **A graded subject still yields a boolean.** Reach the per-scenario boolean through a rubric +
   threshold over N runs; the rubric stays out of the `.feature`.
 - **No green-by-tampering.** Passing means the behavior holds, not that a check was edited to pass;
@@ -40,7 +47,8 @@ unbound.
 1. **The bar is not self-set** — checks derive from the frozen suite, one per scenario; the judge
    re-derives the oracle independently.
 2. **Verify as high as it doesn't hurt** — cheap base, thin e2e cap, boundary as substitute where e2e
-   is infeasible/unsafe; record level and why.
+   is infeasible/unsafe; record level and why. **An instrument subject inverts this: mutation-sweep-first,
+   reading supplementary.**
 3. **No green-by-tampering** — passing is the behavior holding, never an edited check or a modified
    suite.
 4. **Deterministic combinatorics go to units** (the pyramid base); missing that coverage withholds the

package/skills/builder-spec-governance/SKILL.md

@@ -19,12 +19,22 @@ plugin may bind its own, and this loads when the registry leaves `builder`/`spec
 
 - **Every branch of the capability is covered.** Each edge of its control-flow graph (CFG) has its
   scenario, and every guard/negative edge is paired with a positive companion. The **scenario map
-  is 1:1** — no orphan scenario, no uncovered edge (`sdd:suite-format-governance`).
+  is 1:1** — no orphan scenario, no uncovered edge (`sdd:suite-format-governance`). For a **fold**
+  node whose rule combines two or more interacting sub-conditions, the CFG is drawn from that rule
+  stated in **closed form** (single-condition folds may be by example — demanding closed form of one
+  is over-firing), and its coverage is backed by a **mutation sweep** and a **safety dual**
+  (`sdd:suite-format-governance`).
 - **Every scenario is testable.** Each asserts an observable outcome a check can confirm — a boolean,
   no "sometimes". A behavior the capability cannot expose cannot be specced.
 - **A graded subject is still a boolean.** For a non-deterministic capability the contract reaches a
   per-scenario boolean through a rubric + threshold over N runs; the rubric form stays out of the
   boolean `.feature`, carried as a judge-only `@rubric` scenario.
+- **A dimension or cut is grounded on non-author evidence.** When a `@rubric` dimension or its cut is
+  justified by a **measurement** (an ablation Δ, a discrimination count), that measurement is admissible
+  only if it is **not solely the author's own** — independently produced/reviewed by a non-author, or a
+  fresh-adversarial ablation. An author's own instrument silently assumes the property under test. The
+  standard is stated canonically at `sdd:doctrine-loop`; this bar requires it be met, not re-listed
+  (the cold-instrument doctrine).
 
 ## Key points (read-check)
 
@@ -34,3 +44,5 @@ plugin may bind its own, and this loads when the registry leaves `builder`/`spec
    expose cannot be specced.
 3. **A graded subject still reaches a per-scenario boolean** via rubric + threshold; the rubric stays
    out of the `.feature`.
+4. **A dimension or cut is grounded on non-author evidence** — a measurement justifying it must be not
+   solely the author's own (canonical standard: `sdd:doctrine-loop`); the cold-instrument doctrine.

package/skills/check-partition-quality/scripts/check-partition-quality.mts

@@ -20,6 +20,8 @@
 // node:test; running the file directly drives the CLI.
 
 import { execFileSync } from 'node:child_process'
+import { realpathSync } from 'node:fs'
+import { pathToFileURL } from 'node:url'
 
 /** Below this many usable multi-file commits, a rate would be noise — report, never score. */
 export const DEFAULT_FLOOR = 20
@@ -331,6 +333,6 @@ export function main(argv: string[], context: Context = { readHistory }): number
 	return 0
 }
 
-if (import.meta.url === `file://${process.argv[1]}`) {
+if (process.argv[1] && import.meta.url === pathToFileURL(realpathSync(process.argv[1])).href) {
 	process.exit(main(process.argv.slice(2)))
 }

package/skills/check-plan-safety/scripts/check-plan-safety.mts

@@ -18,8 +18,9 @@
 // Default output is TOON (the token-efficient tabular form); --format json for a flat array.
 // --check is the CI guard: exit non-zero iff any leak is found.
 
-import { existsSync, readdirSync, readFileSync } from 'node:fs'
+import { existsSync, readdirSync, readFileSync, realpathSync } from 'node:fs'
 import { join } from 'node:path'
+import { pathToFileURL } from 'node:url'
 
 export interface Leak {
 	/** Repo-relative path of the file the leak sits in. */
@@ -142,4 +143,6 @@ export function main(argv: string[]): number {
 	return check && leaks.length > 0 ? 1 : 0
 }
 
-if (import.meta.main) process.exit(main(process.argv.slice(2)))
+if (process.argv[1] && import.meta.url === pathToFileURL(realpathSync(process.argv[1])).href) {
+	process.exit(main(process.argv.slice(2)))
+}

package/skills/check-project-specs/scripts/check-project-specs.mts

@@ -10,10 +10,15 @@
 // `plugins/cyberfleet` is governed by `.agents/specs/cyberfleet-plugin`.
 
 import { execFileSync } from 'node:child_process'
-import { existsSync, readFileSync } from 'node:fs'
+import { existsSync, readFileSync, realpathSync } from 'node:fs'
 import { dirname, join, relative, resolve } from 'node:path'
-import { fileURLToPath } from 'node:url'
-import { collectSpecs, discoverSpecFiles, type SpecRecord } from '../../discover-specs/scripts/discover-specs.mts'
+import { fileURLToPath, pathToFileURL } from 'node:url'
+import {
+	collectSpecs,
+	discoverSpecFiles,
+	parseFrontmatter,
+	type SpecRecord,
+} from '../../discover-specs/scripts/discover-specs.mts'
 
 const SKILLS_DIR = resolve(dirname(fileURLToPath(import.meta.url)), '../..')
 
@@ -129,6 +134,36 @@ export function findCoverageGaps(
 	return gaps
 }
 
+/**
+ * A spec.md sitting at a recognized location that discovery DROPPED (its status is not
+ * in the lifecycle enum) and that belongs to `projectRel` — by the `project-path` it
+ * declares, or by sitting inside the project (`<project>/.agents/spec/spec.md`, which
+ * survives frontmatter corruption because it is location-derived).
+ *
+ * Without this, a per-project run resolves such a spec to `none` and prints "no spec
+ * governs <project> — skipped" with exit 0: a status typo silently exempts the whole
+ * project from every engine. A spec that exists but cannot be classified is escalated,
+ * not exempted — the same call the corpus-level `--check-coverage` guard makes.
+ */
+export function findDroppedSpecFor(
+	specFiles: string[],
+	specs: SpecRecord[],
+	projectRel: string,
+	readText: (rel: string) => string | null,
+): { file: string; status: string }[] {
+	const recognized = new Set(specs.map((s) => (s.path === '' ? 'spec.md' : `${s.path}/spec.md`)))
+	const out: { file: string; status: string }[] = []
+	for (const f of specFiles) {
+		if (recognized.has(f)) continue
+		const text = readText(f)
+		const fm = text === null ? null : parseFrontmatter(text)
+		const dir = f.replace(/(^|\/)spec\.md$/, '')
+		const nested = /^(.+)\/\.agents\/spec$/.exec(dir)?.[1] ?? ''
+		if (fm?.projectPath === projectRel || nested === projectRel) out.push({ file: f, status: fm?.status ?? '' })
+	}
+	return out
+}
+
 const REASON_TEXT: Record<CoverageGap['reason'], string> = {
 	unrecognized:
 		'sits at a spec location but its status is not in the lifecycle enum, so discovery drops it and nothing checks it',
@@ -137,6 +172,15 @@ const REASON_TEXT: Record<CoverageGap['reason'], string> = {
 	'no-check-script': 'names a project that defines no `check:spec` script',
 }
 
+/** Read a file, or null when it cannot be read. */
+function readTextOrNull(path: string): string | null {
+	try {
+		return readFileSync(path, 'utf8')
+	} catch {
+		return null
+	}
+}
+
 function checkCoverage(root: string): number {
 	const gaps = findCoverageGaps(root, discoverSpecFiles(root), collectSpecs(root), (p) => {
 		try {
@@ -179,9 +223,25 @@ function checkProject(argv: string[]): number {
 	}
 
 	const projectRel = relative(repoRoot, projectDir) || '.'
-	const res = resolveSpecFor(collectSpecs(repoRoot), projectRel)
+	const specs = collectSpecs(repoRoot)
+	const res = resolveSpecFor(specs, projectRel)
 
 	if (res.kind === 'none') {
+		// "No spec" is only legal when there is genuinely no spec file. A spec.md that
+		// exists but was dropped by the status filter is unclassifiable, not absent.
+		const dropped = findDroppedSpecFor(discoverSpecFiles(repoRoot), specs, projectRel, (rel) =>
+			readTextOrNull(join(repoRoot, rel)),
+		)
+		for (const d of dropped) {
+			process.stderr.write(
+				`check-project-specs: \`${d.file}\` sits at a spec location and governs \`${projectRel}\` but ` +
+					(d.status === ''
+						? 'declares no lifecycle status'
+						: `its status \`${d.status}\` is not in the lifecycle enum`) +
+					' (draft | approved | implemented | deprecated) — discovery drops it, so it is checked by nothing\n',
+			)
+		}
+		if (dropped.length) return 1
 		process.stdout.write(`check-project-specs: no spec governs \`${projectRel}\` — skipped\n`)
 		return 0
 	}
@@ -214,4 +274,6 @@ function checkProject(argv: string[]): number {
 	return failed === 0 ? 0 : 1
 }
 
-if (import.meta.main) process.exit(main(process.argv.slice(2)))
+if (process.argv[1] && import.meta.url === pathToFileURL(realpathSync(process.argv[1])).href) {
+	process.exit(main(process.argv.slice(2)))
+}

package/skills/check-retired-terms/README.md

@@ -0,0 +1,18 @@
+# check-retired-terms
+
+Internal SDD skill — the concrete guard engine for the **retired-terms registry and its
+corpus-wide sweep**. Scans every git-tracked file for a literal, case-sensitive occurrence of a
+term registered in `.agents/sdd/retired-terms.toml` as retired by a design decision.
+
+```bash
+node scripts/check-retired-terms.mts --root .            # the verify-time sweep
+node scripts/check-retired-terms.mts --root . --list     # what is registered
+```
+
+Reports every survivor as `file:line:term — replace with: <replacement>`, then a count, and exits
+non-zero. A malformed registry exits non-zero and names the parse error rather than reporting
+clean. Built-in exclusions (the registry, the engine's own source/test, this node's own
+README/`.feature`, every `ledger/` directory, `.agents/plans/`) are always applied and never
+configurable; per-entry `scope` and `allow` narrow further. Read-only; writes nothing. See
+[`SKILL.md`](./SKILL.md) for the full contract; the `corpus/retired-terms` node of the SDD project
+spec (repo-only) carries the frozen spec. Not user-invocable.