cyber-sdd 0.0.0 → 0.2.0

package/.plugin/pins.json

@@ -0,0 +1,3 @@
+{
+	"cyberlegion": "0.3.0"
+}

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 unional
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/agents/sdd-automaton.md

@@ -75,6 +75,17 @@ your position **from the artifacts** — `spec.md`, the `.feature`, frontmatter,
 survived. The plan brief is the portable handoff: read it on entry, update todo statuses and the
 `## NEXT` anchor as you go, so the next segment (yours or an in-session resume) picks up clean.
 
+**At finalize, reconcile the brief — do not rely on having kept it current.** When a mission
+**lands**, set every todo to its true terminal state and rewrite `## NEXT` to say what landed, naming
+no remaining resume action, **in the same change as the work**. This is a backstop, so it runs in one
+pass over the whole brief even if nothing updated it mid-flight — the case a stateless segment is
+most likely to hit. Reconcile means *to the landed state*, never *mark everything done*: a todo whose
+work was held out of scope stays un-completed and rides the follow-up record instead. Write the brief
+and nothing else — no `spec.md` field, and **no terminal value in the plan-level `status` dispatch
+flag** (it stays `active | approved`; terminal-ness is derived). A mission that **halts** is
+checkpointed at its true in-progress state, not reconciled as landed. Full rule: `start-mission`'s
+"Plan-brief durability" bullet.
+
 ## Spawn depth
 
 You realize the conductor's spawns (the impl-producer builder, the cold spec-judge, the cold impl-judge)
@@ -93,5 +104,5 @@ depth-2 behavior described here.
 when a capability is available, prefer its **warm** unit over a cold one-shot, else fall back to a
 portable cold subagent. context-clear a warm judge (`npx cyberlegion@<version> unit clear <ref>`) to a fresh context before **each** judgment; a warm
 impl-producer builder **keeps** its context across the mission. Reset or tear down every warm unit at
-handoff. Full model: `start-mission`'s "Dispatch transport" note and
-`.agents/specs/sdd/design/harness-spawning.md`.
+handoff. Full model: `start-mission`'s "Dispatch transport" note and the `design/harness-spawning`
+node of the SDD project spec (repo-only).

package/agents/sdd-scanner.md

@@ -37,6 +37,26 @@ count** maintained in the ledger.
   strategy is draftable from it **alone** for every categorical dimension. Raw `.jsonl` transcripts
   are **optional enrichment**, never the contract — depending on a harness-specific transcript
   format would couple doctrine to a harness, and the transcripts may be **absent post-merge**.
+- **Validate before drafting — a plan/log is a hypothesis, not present truth.** Every candidate
+  improvement a persisted plan or combat log surfaces is a **hypothesis about the current codebase**,
+  not a fact (*a source-read is a hypothesis, refuted by a repro against current code*). **Before you
+  draft**, read the CURRENT code and decide: does the flagged gap still exist, or has it been
+  **built / fixed / superseded** since? A candidate current code already resolves is **cut** — draft
+  no build-or-fix strategy, emit no issue, and record the cut durably as a `disposition: resolved`
+  tombstone carrying the resolving current-code evidence (below). A still-open candidate is drafted
+  (`disposition: open`) and emitted as an issue. This gate stops you reinforcing a **stale cache** —
+  drafting "build X" for an X a later mission already built. A pure retro **lesson** (not a gap claim)
+  carries no gap and needs no check.
+- **Cold-instrument evidence — non-author measurement + ablation before a rule-level recommendation.**
+  Draft a recommendation to **adopt a rule, drop a rule, or set a threshold** only when its grounding
+  measurement was **produced by, or independently reviewed by, a party other than the proposer, or
+  ablated against a freshly and adversarially constructed case** — a measurement on the proposer's
+  **own generator/harness alone is withheld** (draft nothing; record that it needs non-author or
+  fresh-adversarial evidence). Draft a candidate **reviving a dead measurement dimension** to land only
+  when an ablation against a control shows it **loseable**, stating the revived rule **abstractly with
+  no worked example** (a lifted probe apparatus is absorption); a Δ=0 revival is **cut as dead weight**.
+  A measurement grounding no rule-level decision is unconstrained. (Canonical statement:
+  `sdd:doctrine-loop`.)
 - **Detect and draft cheaply and continuously; never block.** You draft strategy without blocking
   any mission in progress — drafting is off the mission's critical path. You **accumulate** strategy
   and surface it **episodically** (a retro, on demand, or when pending strategy piles up at the
@@ -57,6 +77,18 @@ count** maintained in the ledger.
   distinct from the cross-referenced cr-refs in `evidence`. It is the hook `sdd:plan-retirement` keys
   on to confirm a plan was distilled before deleting its combat log. Milestone / drift / token-waste
   strategy has no single subject mission and **omits** `distills`.
+- **Idempotent Ship/Kill — detect an already-distilled mission by parsing the ledger, never grepping.**
+  Because you can meet the same terminal transition more than once, the Ship/Kill triggers are
+  idempotent: **before drafting**, detect whether the mission was **already distilled** (a prior
+  `strategy` entry whose `distills` equals its `<cr-ref>`) and if so **draft nothing**. Decide this by a
+  **structured JSONL parse, never a substring/regex text match** — **reuse** the exported
+  `distilledCrRefs` engine from `../skills/plan-retirement/scripts/retire-plans.mts` over the project
+  `ledger/` directory and membership-test the `<cr-ref>`. It parses each line with `JSON.parse`, so it
+  is correct against a **pretty-printed** entry (a space after the colon), a wrapped or reordered
+  object — a naive no-space grep (`"distills":"<cr-ref>"`) silently under-counts and re-drafts an
+  already-distilled mission (the *grep is blind to wrapped terms* defect class). Reuse inherits its
+  semantics: keys on the structured `distills` field only (an `evidence`-only cross-ref never counts),
+  tolerates malformed/blank lines, and counts an unratified distilling entry the same as a ratified one.
 - **Detection is yours; keep-or-cut is the Council's.** You detect and draft; the human Council
   holds keep-or-cut. Ratified strategy re-enters as a CR that re-tunes the **doctrine** and grows
   the **corpus** (skills, governances, conventions); unratified strategy does neither.
@@ -81,6 +113,29 @@ re-scan of many missions' raw logs (those are deleted with each plan at retro).
 by `cause`** (the matchable field owned by `combat-log-governance`). A `cause` recurring across the
 corpus is the pattern — draft a strategy to codify it, carrying the recurrence count as its evidence.
 
+## Validate-before-draft, the cut disposition, and issue emission
+
+Run the validation gate on each candidate a plan or log surfaces, then record and emit:
+
+- **The cut disposition (`open | resolved`).** A drafted still-open improvement is `disposition: open`
+  (the default; a legacy line without the field grandfathers as open) and **counts toward pending
+  strategy**. A cut is `disposition: resolved` — a **tombstone** carrying the resolving current-code
+  evidence in `evidence`, emitting **no** issue and **not counted** toward pending strategy (the
+  gateway excludes it). Set the disposition **once at write**, never flip it (append-only). The field's
+  shape is owned by `combat-log-governance`; the gateway's pending count is `kind: strategy`,
+  `ratified: false`, `disposition: open`-or-absent.
+- **Emit each validated-open improvement as a tracked issue** (`gh issue create`) — one titled, bodied
+  issue per real improvement, cross-linking its evidence. The issue is the **actionable output**; the
+  `strategy` line stays the **provenance**. **Dedupe first** against the forge's existing issues (open
+  and closed, ≥2 keyword combinations); on a mixed set file only the unmatched.
+- **Emit is not dispatch.** Emitting an issue leaves the strategy **unratified** and spawns **no**
+  mission — it opens no CR and admits nothing to the mission graph. Keep-or-cut stays the Council's; a
+  filed issue re-enters SDD only when a **later** mission is started from it.
+- **Outward-publish floor.** Compose the issue body to the same floor the handoff follow-up issues
+  meet (owned by the handoff unit, not restated here): **self-contained**, **no production-internal
+  artifact reference**, plus the committed-record bans; carry an **agent-filed marker** and name the
+  evidence it was distilled from.
+
 ## Drift / staleness
 
 Detect a convention in the doctrine that is **now false**, or a contradiction between governances.
@@ -114,6 +169,36 @@ the Council re-enters — that is how detection meets keep-or-cut:
 
 You neither ratify nor prune the corpus yourself — both are the Council's positional act.
 
+## Stale plan frontmatter — deriving the retirement clearance set, never autofixing status
+
+During your pass, for each brief under `.agents/plans/`, cross-check two independent signals — this
+is separate from strategy-drafting above; you draft nothing and write nothing to the ledger for it:
+
+- **`todos-all-done`** — every `todos[].status` in the brief's frontmatter reads `completed`.
+- **`source-closed`** — the brief's declared `source` queried natively, the same way
+  `plan-retirement`'s own clearance check queries it (`github-NN` → GH issue, `asana-<gid>` →
+  Asana, `local-<slug>` → the local store).
+
+- **Both agree terminal** → include the brief's cr-ref in the **retirement clearance set** you pass
+  as `plan-retirement`'s existing `--retire` clearance-set input. This is not a new deletion
+  mechanism — `plan-retirement` still runs its own gated, idempotent sweep (presence +
+  distilled-or-no-log) before anything leaves the tree; you are only supplying its `--retire` set,
+  cross-checked rather than source-only.
+- **Both agree non-terminal** → leave the brief alone; no clearance, no finding.
+- **The two signals disagree** (source closed but the brief's own todos are not all done, or the
+  reverse) → do **not** autofix anything, and do **not** include the cr-ref in the clearance set.
+  Name the brief's cr-ref and the disagreement in your **pass summary** — the only channel you
+  have, since you return only your final message. A disagreement is **never** a `kind: strategy`
+  entry (it names no doctrine improvement) and **never** a `kind: report` ledger line (reserved to
+  the conductor and the gate; you still never write `report` / `correction` / `gate`) — it is a
+  distinct, ephemeral finding, re-derived every pass from the two cheap signals above, never
+  persisted, and never conflated with the validated-open-improvement finding that becomes a
+  tracked issue.
+- There is **no legal terminal value** for a plan brief's `status` field to autofix into — the
+  contract's own answer to "this mission is over" is retirement (a tracked deletion), not a status
+  flag (`design/provenance-model.md` reserves the plan-level `status` to the two-value dispatch
+  flag `active | approved`). You never write a plan brief's `status`.
+
 ## Boundaries
 
 You own the **process** only. Route out-of-loop requests: a build-or-deprecate request → the

package/agents/sdd-spec-judge.md

@@ -69,6 +69,32 @@ before reading spec.md for content:
 3. **A superset raises no finding.** A declared set covering every expected governance — with or
    without extras — passes; report `PREFLIGHT: { result: pass }` and proceed to the lenses below.
 
+## Spec-format conformance read — a non-blocking warning
+
+`sdd:spec-format-governance` (a fixed-universal you already loaded) sets the required sections of a
+**behavioral** `spec.md`: `## What`, `## Use Cases`, `## Control Flow` (the control-flow graph,
+**CFG**), and `## Scenario map`. Read that bar backward here: for each touched **behavioral**
+`spec.md`, check those sections are present and **emit a conformance warning naming any that are
+missing** — **especially `## Use Cases`, `## Control Flow` (CFG), and `## Scenario map`**, the three
+a backfill most often skips.
+
+- **Behavioral only — key off `spec-type`, never a blind heading scan.** A `reference` node carries
+  `## Subject` in place of the four sections and a `descriptive` index carries none, so **neither
+  raises a conformance warning**: check a node's `spec-type` first and read the required sections
+  only for a behavioral one. A reference/descriptive node's result is always `pass`.
+- **A warning, not a lens failure.** The conformance read is **distinct from the three lenses and
+  from the deterministic checks**. A missing section is a `warn`, surfaced for the gate to report —
+  it does **not** fail a lens, does **not** set `ALIGNED: false`, and does **not** short-circuit the
+  lenses the way a failed `PREFLIGHT` does. Grade the lenses regardless.
+- **The normal-flow overlap.** In the gate's normal flow a behavioral node missing `## Use Cases` is
+  already caught by the deterministic `check-spec-state` fail-closed **before you are spawned**, so
+  the warning's **load-bearing** contribution is the CFG and the scenario map — but name `## Use
+  Cases` too whenever you do read a behavioral `spec.md` that lacks it.
+
+Carry the result on the `CONFORMANCE` output field: `{ result: pass | warn, missing: [ <each
+required behavioral spec-format section absent from a touched behavioral spec.md> ] }`. All sections
+present (or a reference/descriptive node) ⇒ `{ result: pass, missing: [] }`.
+
 ## Split the work
 
 - **Optional deterministic step** — two NodeJS static-analysis CLIs for the mechanical checks
@@ -207,6 +233,7 @@ narrowing that fires **Clearance**, so never demand it of one.
 ```
 STATUS:            complete | needs-input | blocked
 PREFLIGHT:         { result: pass | fail, finding-kind: governance-preflight-missing | null, missing: [ ... ] }
+CONFORMANCE:       { result: pass | warn, missing: [ <required behavioral spec-format sections absent — e.g. Use Cases, Control Flow, Scenario map> ] }
 LENS:              { oracle: pass | fail, builder: pass | fail, architect: pass | fail }
 ALIGNED:           true | false        # false ⇒ which artifacts are out of sync
 SCENARIOS_PASSING: [ titles ]
@@ -218,7 +245,10 @@ OBSERVATIONS:      [ { owner: architect | strategist, note, evidence } ]
 ```
 
 `PREFLIGHT.result: fail` short-circuits everything below it — `LENS` is omitted, `ALIGNED` is `false`,
-and `BLOCKER` names the missing governances (see "Governance pre-flight check" above). Otherwise
-`ALIGNED` is `true` only when all three lenses pass and no open marker remains. The conductor
+and `BLOCKER` names the missing governances (see "Governance pre-flight check" above).
+`CONFORMANCE.result: warn` **short-circuits nothing** — the lenses still run, and it never on its own
+sets `ALIGNED: false` or blocks the advance (see "Spec-format conformance read" above); the gate
+surfaces it as a warning. Otherwise `ALIGNED` is `true` only when all three lenses pass and no open
+marker remains. The conductor
 synthesizes the gate verdict and the leash from this rollup — never advance with any lens failing,
 any open marker, a failed preflight, or `ALIGNED: false`.

package/agents/sdd-warden.md

@@ -40,6 +40,15 @@ marker shape you leave — their fields and schema are owned there; never restat
   a scenario-overlap candidate you judge (`@rubric`) whether it is **real** behavioral overlap and
   **assign a single owning node** (one behavior = one scenario in one node). A finding **names** the
   nodes or artifacts it concerns.
+- **Check a split's organizing axis, not just its granularity.** An oversized node is a granularity
+  signal, but a split carves it along a proposed **organizing axis** — and the wrong axis produces a
+  split CR that gets superseded rather than landed. Before you propose a split (self-clear it or
+  escalate its CR), **check the proposed axis against a real capability/command boundary**: each side
+  must map to a **distinct capability, command, or lifecycle phase**, not merely an internal
+  implementation grouping sharing one boundary. An axis that passes → the split is **proposed on that
+  axis**; an axis that only regroups internal implementation → **fails**, so you do **not** carve
+  sub-nodes on it and instead raise the oversize as a **wrong-axis reorganization**. An oversize can
+  be a symptom of the wrong axis, not just wrong granularity.
 - **Judge against the declared strategy.** Read each project spec's root `spec.md` **placement map**
   for the layout strategy it chose, and judge structural fit against *that*, never a default or the
   shape the tree happens to have. Inferring the strategy makes the audit circular. A map naming no

package/package.json

@@ -1,24 +1,31 @@
 {
-	"name": "cyber-sdd",
-	"version": "0.0.0",
-	"type": "module",
-	"bin": {
-		"sdd-check-specs": "./skills/check-project-specs/scripts/check-project-specs.mts"
-	},
-	"files": [
-		"skills",
-		"agents",
-		".plugin",
-		".codex-plugin",
-		".claude-plugin",
-		"!skills/**/*.test.mts"
-	],
-	"dependencies": {
-		"gherkin-cli": "0.0.2"
-	},
-	"scripts": {
-		"check:spec": "sdd-check-specs",
-		"test": "node --test \"skills/*/scripts/*.test.mts\"",
-		"typecheck": "tsc -p tsconfig.json"
-	}
-}
+  "name": "cyber-sdd",
+  "version": "0.2.0",
+  "description": "Spec-Driven Development. Scaffold, validate, and maintain behavioral specs (spec.md + .feature files) for software features.",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/cyberuni/cyberplace.git",
+    "directory": "plugins/sdd"
+  },
+  "license": "MIT",
+  "type": "module",
+  "bin": {
+    "sdd-check-specs": "./skills/check-project-specs/scripts/check-project-specs.mts"
+  },
+  "files": [
+    "skills",
+    "agents",
+    ".plugin",
+    ".codex-plugin",
+    ".claude-plugin",
+    "!skills/**/*.test.mts"
+  ],
+  "dependencies": {
+    "gherkin-cli": "0.0.2"
+  },
+  "scripts": {
+    "check:spec": "sdd-check-specs",
+    "test": "node --test \"skills/*/scripts/*.test.mts\"",
+    "typecheck": "tsc -p tsconfig.json"
+  }
+}

package/skills/align-spec/scripts/align-spec.mts

@@ -24,8 +24,9 @@
 // No dependencies (the repo's node-≥23.6 / no-deps convention). Pure functions are exported for
 // node:test; running the file directly drives the CLI.
 
-import { existsSync, readdirSync } from 'node:fs'
+import { existsSync, readdirSync, realpathSync } from 'node:fs'
 import { isAbsolute, join, relative } from 'node:path'
+import { pathToFileURL } from 'node:url'
 import { type NodeRecord, scanProjectSpec } from '../../check-spec-structure/scripts/check-spec-structure.mts'
 import { classifyFile } from '../../spec-gate/scripts/classify-edit-class.mts'
 
@@ -182,6 +183,6 @@ export function main(argv: string[]): number {
 	return 0
 }
 
-if (import.meta.url === `file://${process.argv[1]}`) {
+if (process.argv[1] && import.meta.url === pathToFileURL(realpathSync(process.argv[1])).href) {
 	process.exit(main(process.argv.slice(2)))
 }

package/skills/architect-spec-governance/README.md

@@ -22,6 +22,7 @@ asked of the implementation instead of the spec.
 | **Placement matches the declared layout** | The project declares its layout strategy in its root `spec.md` placement map; placement is judged *within* that declaration, not against a preferred one. Under the screaming-architecture default a capability lives in a folder named for its intent; a project that declared `mirror-source` is correctly placed when it mirrors its source. |
 | **…and the layout preserves the partition** | The declaration is not a licence. Layouts are ranked by whether they keep node ↔ capability one-to-one, because the mission scheduler cuts one mission per node and a scattered capability degrades the schedule toward serial (ADR-0025). **One capability per node, never smeared across nodes** holds under every strategy, and a layered / framework-first top level stays discouraged however it is declared. |
 | **A well-formed CFG** | The capability's control-flow graph connects — every decision reachable, no dangling branch — and the suite's sections mirror it. |
+| **The CFG reaches every stated extension** | A use case's **extensions** are its divergence paths (`spec-format-governance`), so each is an edge the graph must actually contain. An extension named in `## Use Cases` with no path to it in `## Control Flow` is a **dangling branch read from the other side** — the prose claims a divergence the drawn graph cannot take. A **forbidden combination** is the same defect in guard form: the graph carries the decision that refuses the pair, or the constraint is unenforceable and the prose is decoration. Judge it **both ways** — an edge with no extension is the ordinary uncovered-edge case; an extension with no edge is this one. |
 | **An orthogonal axis** | Structural fit judges a property the builder was not optimizing — a real independent check even from the same hand. |
 | **Structural concerns are deferred** | A structural problem in *another* capability is an observation that spawns a new spec — never a marker in the one being built. |
 

package/skills/architect-spec-governance/SKILL.md

@@ -37,6 +37,15 @@ unbound.
   level stays discouraged however it is declared.
 - **A well-formed CFG.** Its control-flow graph connects — every decision reachable, no
   dangling branch — and the suite's sections mirror it.
+- **The CFG reaches every stated extension.** A use case's **extensions** are its divergence paths
+  (`sdd:spec-format-governance`), so each is an edge the graph must actually contain. An extension
+  named in `## Use Cases` with no path to it in `## Control Flow` is a **dangling branch read from
+  the other side** — the prose claims a divergence the drawn graph cannot take. A **forbidden
+  combination** of surface elements is the same defect in guard form: if two elements may not be
+  combined, the graph carries the decision that refuses them, or the constraint is unenforceable and
+  the prose is decoration. Judge the graph against the stated extensions in **both** directions —
+  an edge with no extension is the ordinary uncovered-edge case; an extension with no edge is this
+  one.
 - **An orthogonal axis.** Structural fit judges a property the builder was not optimizing — a real
   independent check even from the same hand.
 - **Structural concerns are deferred.** A structural problem in another capability is an observation
@@ -55,5 +64,7 @@ from `spec.md` + the suite only — the solution is out of view (grader independ
    boundaries.
 2. **Placement matches the *declared* layout** (`sdd:spec-structure-governance`), not a preferred
    one; one capability per node either way, never smeared across nodes.
-3. **A well-formed CFG** the suite's sections mirror.
+3. **A well-formed CFG** the suite's sections mirror — and it reaches every stated extension;
+   an extension with no edge is a dangling branch read from the prose side, a forbidden combination
+   with no guard is unenforceable.
 4. **Structural concerns in another capability are deferred** — an observation that spawns a new spec.

package/skills/blast-estimate/README.md

@@ -24,11 +24,9 @@ node scripts/blast-estimate.mts --root <corpus> --touch-set sdd/mission-graph,sd
 ```
 
 Read-only, deterministic, reports-never-writes — the mission-graph's single writer records the
-computed level. See [`SKILL.md`](./SKILL.md) for the full contract and
-[`.agents/specs/sdd/blast-estimate/README.md`](../../../../.agents/specs/sdd/blast-estimate/README.md)
-for the authoritative behavior description and
-[`blast-estimate.feature`](../../../../.agents/specs/sdd/blast-estimate/blast-estimate.feature) for
-the frozen 21-scenario contract.
+computed level. See [`SKILL.md`](./SKILL.md) for the full contract; the `blast-estimate` node of
+the SDD project spec (in the cyberplace repository, not shipped in this package) carries the
+authoritative behavior description and the frozen 21-scenario contract.
 
 Fan-in counts the reference forms the corpus really uses — the bare id, a `sdd:spec-gate` skill ref,
 a path under any **declared root** at any depth, and a same-project relative link — not the bare id

package/skills/blast-estimate/SKILL.md

@@ -12,8 +12,8 @@ The concrete engine for **blast-estimate** — a read-only derivation that works
 project a Mission could disturb, instead of trusting the hand-typed guess. Given a Mission's
 **touch-set** (the work areas it names) and the project corpus, it computes a **blast** level
 (`low` / `medium` / `high`) from three measured inputs and lines that level up against the Mission's
-hand-typed **declared** blast (`agrees` / `under-called` / `over-called`). See
-`.agents/specs/sdd/blast-estimate/README.md` for the full contract and vocabulary.
+hand-typed **declared** blast (`agrees` / `under-called` / `over-called`). The `blast-estimate` node
+of the SDD project spec (repo-only) carries the full contract and vocabulary.
 
 ## The three inputs
 

package/skills/blast-estimate/scripts/blast-estimate.mts

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 // blast-estimate — the concrete engine for blast-estimate's derivation: compute a Mission's BLAST
 // (low/medium/high) from its touch-set + the project corpus instead of trusting the hand-typed guess,
-// then line the computed level up against the declared one (agrees / under-called / over-called). See
-// .agents/specs/sdd/blast-estimate/README.md for the full contract this mirrors.
+// then line the computed level up against the declared one (agrees / under-called / over-called). The
+// blast-estimate node of the SDD project spec (repo-only) carries the full contract this mirrors.
 //
 // Three inputs, each measured — never inferred — from the corpus:
 //   - count       — how many of the touch-set's areas resolve to a known work area
@@ -32,8 +32,9 @@
 // mission-graph's single writer records it. Pure functions are exported for node:test; running the
 // file directly drives the CLI.
 
-import { readdirSync, readFileSync, statSync } from 'node:fs'
+import { readdirSync, readFileSync, realpathSync, statSync } from 'node:fs'
 import { join, relative } from 'node:path'
+import { pathToFileURL } from 'node:url'
 import {
 	discoverLayouts,
 	fileToNode,
@@ -580,4 +581,6 @@ export function main(argv: string[]): number {
 	return result.error ? 1 : 0
 }
 
-if (import.meta.main) process.exit(main(process.argv.slice(2)))
+if (process.argv[1] && import.meta.url === pathToFileURL(realpathSync(process.argv[1])).href) {
+	process.exit(main(process.argv.slice(2)))
+}

package/skills/builder-impl-governance/SKILL.md

@@ -25,6 +25,13 @@ unbound.
   paths that matter, **boundary** (the external mocked) as the honest substitute where e2e is
   infeasible or unsafe. **Record the level and why.** The suite's overall pyramid shape is the
   architect's call (`sdd:architect-impl-governance`).
+- **Instrument subject → mutation-sweep-first.** When the **subject is itself a measurement or
+  verification instrument** — a fixture, mutation set, ablation generator, falsifier, judge, or check —
+  a **mutation sweep is the default verification method** and reading is **supplementary**. This
+  **overrides the verify-as-high default above for an instrument subject only**; a non-instrument
+  subject keeps that default. Reading an instrument's own blind spot back to itself is a weak oracle —
+  a "cannot-fail" defect survives every read and dies to the first mutation the instrument fails to
+  catch (the cold-instrument doctrine, stated in full on the impl-producer node).
 - **A graded subject still yields a boolean.** Reach the per-scenario boolean through a rubric +
   threshold over N runs; the rubric stays out of the `.feature`.
 - **No green-by-tampering.** Passing means the behavior holds, not that a check was edited to pass;
@@ -40,7 +47,8 @@ unbound.
 1. **The bar is not self-set** — checks derive from the frozen suite, one per scenario; the judge
    re-derives the oracle independently.
 2. **Verify as high as it doesn't hurt** — cheap base, thin e2e cap, boundary as substitute where e2e
-   is infeasible/unsafe; record level and why.
+   is infeasible/unsafe; record level and why. **An instrument subject inverts this: mutation-sweep-first,
+   reading supplementary.**
 3. **No green-by-tampering** — passing is the behavior holding, never an edited check or a modified
    suite.
 4. **Deterministic combinatorics go to units** (the pyramid base); missing that coverage withholds the

package/skills/builder-spec-governance/README.md

@@ -19,6 +19,7 @@ contract?" at the impl gate.
 | Requirement | What it means |
 | --- | --- |
 | **Every branch is covered** | Each edge of the capability's CFG has its scenario, and every guard/negative edge is paired with a positive companion. The scenario map is 1:1 in both directions — no orphan scenario, no uncovered edge. |
+| **Every stated extension is a path in the CFG** | A use case's **extensions** are its divergences (`spec-format-governance`), and the CFG is the **single source** scenarios derive from — so an extension earns its scenario by being a path in the graph, never as a second rule beside the edge coverage above. An extension with no path is a hole in the *graph*: fix it there, and the 1:1 edge coverage supplies the scenario. Never derive a scenario from the prose directly — a suite drawn from a stated list is 1:1 with that list by construction and can no longer surface a hole. `extensions: none` is a claim to judge; a forbidden combination is the same rule in guard form. |
 | **Every scenario is testable** | Each scenario asserts an observable outcome a check can confirm — a boolean, no "sometimes". A behavior the capability cannot expose cannot be specced. |
 | **A graded subject is still a boolean** | A non-deterministic capability (one whose output varies run to run) still reaches a per-scenario boolean, through a rubric plus a threshold over N runs. The rubric form stays out of the boolean `.feature`, carried as a judge-only `@rubric` scenario. |
 

package/skills/builder-spec-governance/SKILL.md

@@ -19,18 +19,46 @@ plugin may bind its own, and this loads when the registry leaves `builder`/`spec
 
 - **Every branch of the capability is covered.** Each edge of its control-flow graph (CFG) has its
   scenario, and every guard/negative edge is paired with a positive companion. The **scenario map
-  is 1:1** — no orphan scenario, no uncovered edge (`sdd:suite-format-governance`).
+  is 1:1** — no orphan scenario, no uncovered edge (`sdd:suite-format-governance`). For a **fold**
+  node whose rule combines two or more interacting sub-conditions, the CFG is drawn from that rule
+  stated in **closed form** (single-condition folds may be by example — demanding closed form of one
+  is over-firing), and its coverage is backed by a **mutation sweep** and a **safety dual**
+  (`sdd:suite-format-governance`).
+- **Every stated extension is a path in the CFG.** A use case's **extensions** are its divergences
+  (`sdd:spec-format-governance`), and the CFG is the **single source** the scenarios derive from —
+  so an extension earns its scenario **by being a path in the graph**, never as a second rule
+  alongside the edge coverage above. The check is therefore: does the CFG contain a path to each
+  stated extension? An extension with no path is a hole in the **graph** — fix it there, and the
+  standing 1:1 edge coverage supplies the scenario. **Never derive a scenario from the prose
+  directly**: a suite drawn from a stated list is 1:1 with that list by construction and can no
+  longer surface a hole, which is the retrofit shape that has diverged in this corpus before. A use
+  case declaring `extensions: none` asserts nothing can diverge — judge that claim against the
+  graph. A **forbidden combination** is the same rule in guard form: it is a decision the CFG must
+  carry, and its refusal scenario comes from that guard's edge.
 - **Every scenario is testable.** Each asserts an observable outcome a check can confirm — a boolean,
   no "sometimes". A behavior the capability cannot expose cannot be specced.
 - **A graded subject is still a boolean.** For a non-deterministic capability the contract reaches a
   per-scenario boolean through a rubric + threshold over N runs; the rubric form stays out of the
   boolean `.feature`, carried as a judge-only `@rubric` scenario.
+- **A dimension or cut is grounded on non-author evidence.** When a `@rubric` dimension or its cut is
+  justified by a **measurement** (an ablation Δ, a discrimination count), that measurement is admissible
+  only if it is **not solely the author's own** — independently produced/reviewed by a non-author, or a
+  fresh-adversarial ablation. An author's own instrument silently assumes the property under test. The
+  standard is stated canonically at `sdd:doctrine-loop`; this bar requires it be met, not re-listed
+  (the cold-instrument doctrine).
 
 ## Key points (read-check)
 
 1. **Every branch of the capability is covered** — every edge has its scenario, guards paired with
    positives, the scenario map 1:1.
-2. **Every scenario is testable** — an observable boolean outcome; behavior the capability cannot
+2. **Every stated extension is a path in the CFG** — the graph is the single source scenarios derive
+   from, so an extension earns its scenario by being a path, never as a second rule alongside edge
+   coverage; a divergence with no path is a hole in the *graph*. Never derive a scenario from the
+   prose directly. `extensions: none` is a claim to judge; a forbidden combination is a guard the
+   graph carries.
+3. **Every scenario is testable** — an observable boolean outcome; behavior the capability cannot
    expose cannot be specced.
-3. **A graded subject still reaches a per-scenario boolean** via rubric + threshold; the rubric stays
+4. **A graded subject still reaches a per-scenario boolean** via rubric + threshold; the rubric stays
    out of the `.feature`.
+5. **A dimension or cut is grounded on non-author evidence** — a measurement justifying it must be not
+   solely the author's own (canonical standard: `sdd:doctrine-loop`); the cold-instrument doctrine.

package/skills/check-partition-quality/scripts/check-partition-quality.mts

@@ -20,6 +20,8 @@
 // node:test; running the file directly drives the CLI.
 
 import { execFileSync } from 'node:child_process'
+import { realpathSync } from 'node:fs'
+import { pathToFileURL } from 'node:url'
 
 /** Below this many usable multi-file commits, a rate would be noise — report, never score. */
 export const DEFAULT_FLOOR = 20
@@ -331,6 +333,6 @@ export function main(argv: string[], context: Context = { readHistory }): number
 	return 0
 }
 
-if (import.meta.url === `file://${process.argv[1]}`) {
+if (process.argv[1] && import.meta.url === pathToFileURL(realpathSync(process.argv[1])).href) {
 	process.exit(main(process.argv.slice(2)))
 }

package/skills/check-plan-safety/scripts/check-plan-safety.mts

@@ -18,8 +18,9 @@
 // Default output is TOON (the token-efficient tabular form); --format json for a flat array.
 // --check is the CI guard: exit non-zero iff any leak is found.
 
-import { existsSync, readdirSync, readFileSync } from 'node:fs'
+import { existsSync, readdirSync, readFileSync, realpathSync } from 'node:fs'
 import { join } from 'node:path'
+import { pathToFileURL } from 'node:url'
 
 export interface Leak {
 	/** Repo-relative path of the file the leak sits in. */
@@ -142,4 +143,6 @@ export function main(argv: string[]): number {
 	return check && leaks.length > 0 ? 1 : 0
 }
 
-if (import.meta.main) process.exit(main(process.argv.slice(2)))
+if (process.argv[1] && import.meta.url === pathToFileURL(realpathSync(process.argv[1])).href) {
+	process.exit(main(process.argv.slice(2)))
+}