cyber-sdd 0.0.0 → 0.2.0

package/skills/oracle-spec-governance/SKILL.md

@@ -23,13 +23,25 @@ writing, the cold spec-judge judges kill-or-ship. Oracle has no impl face. The S
   capabilities** — split them, each into its own node. Test: can you name the outcome without "and"?
 - **Scope is bounded and stated.** What is out of scope is named. A capability that keeps absorbing
   adjacent problems is scope creep — cut it back.
+- **Every surface element is paid for by a use case.** An element the capability exposes — a flag,
+  an option, a parameter, a prop, an event — that **no use case needs** is unbought scope: the
+  verdict is cut it or name the use case, never ship it and see (`sdd:spec-format-governance`).
+  This is the same kill-or-ship judgment one level down: the capability answers for its cost, and so
+  does each thing it exposes. An actor or goal that restates the mechanism has not identified who
+  wants this — treat it as an unanswered Why, not as a filled-in field.
 - **The suite's decisions are the node's to hold.** Every scenario tests a **decision the node owns**.
   A property **co-owned** across a seam — activation/routing, a sibling's behavior, harness wiring —
   is out of scope: relocate it to the node that owns it, or kill it.
 - **Strict — a non-decision is killed.** An **invariant** that always holds is not acceptance and does
   not enter the suite. The one exception is a user **`@pinned`** scenario, kept whatever strict prunes.
-- **Worth shipping, or kill.** The Why names a real problem and who feels it. If value does not clear
-  the cost of building, the verdict is **kill**.
+- **The actors are enumerated, and the enumeration closes.** The Why names a real problem and **who
+  feels it** — so the use cases are derived from a stated set of actors, not from the interface
+  (`sdd:spec-format-governance`). Grade it **both ways**: an actor carrying no use case, and a use
+  case whose actor is absent from the list, are each a hole. A goal that restates the mechanism has
+  renamed the function rather than found the use case — an unanswered Why, not a filled-in field.
+  On a backfill, an enumeration drawn only from source is **served** use cases by construction:
+  judge whether the unserved ones were sought, not merely whether the list is tidy.
+- **Worth shipping, or kill.** If value does not clear the cost of building, the verdict is **kill**.
 - **Kill-or-revert is allowed.** A capability that passes every check but proves fatal goes back to
   Draft — surface the deal-breaker.
 - **No premature commitment.** Defer a decision that need not be made yet to the last responsible
@@ -37,9 +49,14 @@ writing, the cold spec-judge judges kill-or-ship. Oracle has no impl face. The S
 
 ## Key points (read-check)
 
-1. **One coherent intent** — two concerns are two capabilities; bounded and stated scope.
+1. **One coherent intent** — two concerns are two capabilities; bounded and stated scope. **Every
+   surface element is paid for by a use case** — an orphan element is unbought scope (cut or
+   justify); an actor/goal restating the mechanism is an unanswered Why.
 2. **Every scenario tests a decision the node owns** — a co-owned seam property is out of scope
    (relocate or kill).
 3. **Strict** — an invariant / non-decision does not enter the suite; only a user `@pinned` scenario
    escapes.
-4. **Worth shipping or kill** — value must clear the build cost; a fatal proof reverts to Draft.
+4. **The actors are enumerated and the enumeration closes** — graded both ways (an actor with no use
+   case, a use case with no listed actor); a goal restating the mechanism is an unanswered Why; a
+   backfill list drawn only from source covers the served cases by construction.
+5. **Worth shipping or kill** — value must clear the build cost; a fatal proof reverts to Draft.

package/skills/place-node/scripts/place-node.mts

@@ -10,8 +10,9 @@
 // No dependencies (the repo's node-≥23.6 / no-deps convention). Pure functions are exported for
 // node:test; running the file directly drives the CLI.
 
-import { readdirSync, readFileSync } from 'node:fs'
+import { readdirSync, readFileSync, realpathSync } from 'node:fs'
 import { join } from 'node:path'
+import { pathToFileURL } from 'node:url'
 
 const SKIP_DIRS = new Set(['node_modules', '.git', 'dist', '.turbo', '.next', 'coverage'])
 
@@ -152,6 +153,6 @@ export function main(argv: string[]): number {
 	return 0
 }
 
-if (import.meta.url === `file://${process.argv[1]}`) {
+if (process.argv[1] && import.meta.url === pathToFileURL(realpathSync(process.argv[1])).href) {
 	process.exit(main(process.argv.slice(2)))
 }

package/skills/plan-retirement/README.md

@@ -7,8 +7,11 @@ gated, idempotent **tracked deletion** of a retired mission plan. It holds a sel
 **Distill and delete are decoupled.** The Scanner distills the combat log into ledger `strategy`
 early (at `→ implemented`); this sweep deletes the plan **later**, gated on source = `done`/merged
 **and** distilled. The two signals **split by verifiability**: **source** stays the caller's
-judgment (`sdd:doctrine-loop` Scanner passes the source-cleared set via `--retire`; it needs
-network/`gh`), while **distilled** is **verified mechanically by the sweep** against the project
+judgment (`sdd:doctrine-loop`'s Scanner is the standard caller — during its pass it cross-checks
+each brief's own `todos-all-done` against `source-closed` and passes `--retire` only the cr-refs
+where **both** agree terminal; a disagreement is held back and flagged, never passed through on
+source alone; querying source natively needs network/`gh`), while **distilled** is **verified
+mechanically by the sweep** against the project
 ledger (`--ledger <dir>`) — a `strategy` entry with `distills == <cr-ref>` must exist (keyed on the
 `distills` field, never an `evidence` mention; unratified still counts). The distilled gate guards
 an **existing** combat log: a cr-ref whose `<cr-ref>.log.jsonl` was **never written** (a non-gated

package/skills/plan-retirement/SKILL.md

@@ -42,7 +42,11 @@ The two gating signals split by what the sweep can check itself:
 
 - **source = `done`/merged** — the **caller's judgment**: query the source natively (`github-NN` → GH
   issue, `asana-<gid>` → Asana, `local-<slug>` → the local store); needs network/`gh`. The caller
-  passes the source-cleared set via `--retire`.
+  passes the source-cleared set via `--retire`. `sdd:doctrine-loop`'s Scanner is the standard
+  caller: during its pass it cross-checks each brief's own `todos-all-done` against `source-closed`
+  and only passes through a cr-ref where **both** agree terminal — a disagreement (source closed
+  but the brief's own todos are not all done, or the reverse) is held back and surfaced as a
+  flagged finding for a human, never passed through on source alone.
 - **distilled** — **verified mechanically by the sweep**: a `strategy` entry with `distills ==
   <cr-ref>` must exist in the project ledger (`--ledger`). The sweep keys on the structured
   `distills` field, **never** a `<cr-ref>` that appears only in a strategy's `evidence`

package/skills/plan-retirement/scripts/retire-plans.mts

@@ -39,8 +39,9 @@
 // Pure functions are exported for node:test; running the file directly drives the CLI.
 // No dependencies. Use --dry-run to print the planned deletions without touching the tree.
 
-import { existsSync, readdirSync, readFileSync, unlinkSync } from 'node:fs'
+import { existsSync, readdirSync, readFileSync, realpathSync, unlinkSync } from 'node:fs'
 import { join } from 'node:path'
+import { pathToFileURL } from 'node:url'
 
 const PLAN_SUFFIX = '.plan.md'
 const LOG_SUFFIX = '.log.jsonl'
@@ -193,4 +194,6 @@ export function main(argv: string[]): number {
 	return 0
 }
 
-if (import.meta.main) process.exit(main(process.argv.slice(2)))
+if (process.argv[1] && import.meta.url === pathToFileURL(realpathSync(process.argv[1])).href) {
+	process.exit(main(process.argv.slice(2)))
+}

package/skills/plugin-contract-governance/SKILL.md

@@ -48,9 +48,15 @@ actor bars are the shipped `sdd:{oracle,builder,architect}-{spec,impl}-governanc
 self-aligns to exactly the bars its judge grades. The lens sets are spec gate `{oracle, builder,
 architect}`, impl gate `{builder, architect}`, solution `{architect}` (ungated).
 
+**Read each row against that sentence.** A producer row that does not carry its whole lens set is a
+transcription slip, not a narrowing — this table is a shipped copy of one owned by SDD's own spec
+(`design/specialists-and-squads.md`), restated here because a governance loads standalone and cannot
+reach the spec tree. It has drifted once: the spec-producer row lost `architect-spec`, and plugin
+authors building to it shipped agents that loaded three bars and were graded against four.
+
 | Role | Loads |
 |---|---|
-| spec-producer | `spec-format`, `suite-format`, `ownership`, the resolved `oracle-spec` + `builder-spec` bars |
+| spec-producer | `spec-format`, `suite-format`, `ownership`, the resolved `oracle-spec` + `builder-spec` + `architect-spec` bars |
 | solution-producer | `ownership`, the resolved `architect-spec` bar |
 | spec-judge | `spec-format`, `suite-format`, `lifecycle`, `gate-validation`, the resolved `oracle-spec` + `builder-spec` + `architect-spec` bars |
 | impl-producer | `ownership`, the resolved `builder-impl` + `architect-impl` bars |

package/skills/remediation-governance/SKILL.md

@@ -31,6 +31,33 @@ producer is responding.
    artifact predates them. Any regression means the loop is **no longer converging**: stop, report
    it, and re-plan. Do not open another remediation round on a regressing loop.
 
+## The Clearance-repair proof — a repaired frozen scenario must fail its pre-repair draft
+
+A `change` verdict that re-opens an **already-frozen** scenario under a **ratified Clearance re-open**
+(a narrowing/rewrite of specified behavior, or an impl-gate Oracle-lens revert) carries one extra bar
+on top of the four rules. The repair changes a contract that was already frozen, so the danger is a
+**back-fit**: a "correction" reverse-engineered to fit whatever the current draft/implementation
+already says, changing nothing of substance. The proof against that is directional —
+
+> a genuine repair makes the **pre-repair** artifact **FAIL**; a contract narrowed to fit an existing
+> draft moves *toward* passing it.
+
+So the repair is re-approved only when the repaired scenario **fails when checked against the
+pre-repair artifact/draft** — not merely that it passes against the post-repair one:
+
+- a repaired scenario that **fails** the pre-repair artifact is **accepted** as a genuine contract
+  correction — the pre-repair failure is the evidence its substance changed;
+- a repaired scenario that **already passes** the pre-repair artifact is **rejected** as a suspected
+  **back-fit** — it may be reverse-engineered from what already existed, not a real correction;
+- a **post-repair pass with no demonstrated pre-repair failure is not enough** — a repair carrying no
+  pre-repair-failure proof is **not re-approved** (absence of the proof is not proof of substance).
+
+The bar has **two faces**, both owed: the **producer** *demonstrates* the pre-repair failure as part
+of the repair (run the repaired scenario against the pre-repair artifact and show it fails); the
+**gate/judge** *requires* that proof before re-approving (a post-repair pass alone never re-approves).
+An independent cold judge confirming the repaired scenario against the still-unrevised artifact is the
+strongest form of the demonstration.
+
 ## A sweep is scope-aware, never a blanket match
 
 Rule 2's sweep answers "every instance of the rule", which is **not** "every occurrence of a string".
@@ -58,9 +85,13 @@ REMEDIATION:
              swept=<the other instances found, or none>
              ruled-out=<candidates inspected and excluded, with the reason>
              provenance=<pre-existing | regression>
+             pre-repair-proof=<the repaired scenario FAILS the pre-repair artifact | n/a — not a Clearance-gated frozen-scenario repair>
 ```
 
-A `contested` finding carries the evidence against it and **no edit** to the artifact it named.
+A `contested` finding carries the evidence against it and **no edit** to the artifact it named. A
+Clearance-gated repair of a frozen scenario carries its **`pre-repair-proof`** — the demonstration
+that the repaired scenario fails the pre-repair artifact; a repair without it (or one that passes the
+pre-repair draft) is not re-approved.
 
 ## Key points (read-check)
 
@@ -76,3 +107,7 @@ A `contested` finding carries the evidence against it and **no edit** to the art
    alone.
 6. **Provenance is derived from the diff** — an artifact changed by the previous round's commits
    makes its finding a **regression**, which stops the loop for a re-plan rather than another round.
+7. **A Clearance-gated repair of a frozen scenario must fail its pre-repair draft** — re-approval
+   requires the repaired scenario to **fail** against the pre-repair artifact (a repair that already
+   passes it is a suspected back-fit; a post-repair pass alone is not enough). The producer
+   demonstrates the failure; the gate/judge requires it.

package/skills/resolve-governances/scripts/resolve-governances.mts

@@ -19,8 +19,9 @@
 // Pure functions are exported for node:test; running the file directly drives the
 // CLI. No dependencies — plain node strips the types.
 
-import { type Dirent, existsSync, readdirSync, readFileSync } from 'node:fs'
+import { type Dirent, existsSync, readdirSync, readFileSync, realpathSync } from 'node:fs'
 import { join } from 'node:path'
+import { pathToFileURL } from 'node:url'
 
 // ─── the closed sets ───────────────────────────────────────────────────────────
 
@@ -512,4 +513,6 @@ export function main(argv: string[]): number {
 	return 0
 }
 
-if (import.meta.main) process.exit(main(process.argv.slice(2)))
+if (process.argv[1] && import.meta.url === pathToFileURL(realpathSync(process.argv[1])).href) {
+	process.exit(main(process.argv.slice(2)))
+}

package/skills/resolve-tracking/SKILL.md

@@ -8,8 +8,8 @@ metadata:
 
 # Resolve Tracking
 
-The concrete engine for **tracking resolution** — the second escape-hatch trigger
-(`.agents/specs/sdd/intake/README.md`). For one touched artifact it decides **tracked** (SDD
+The concrete engine for **tracking resolution** — the second escape-hatch trigger of the SDD
+project spec's `intake` node (repo-only). For one touched artifact it decides **tracked** (SDD
 governs it — spec + gates) or **ignored** (SDD does not govern it; it still gets built) and
 reports which step decided it, so the conductor can skip a task outright (no CR, no draft, no
 gate, no record) when it resolves ignored. The split mirrors git's **tracked vs ignored** files.

package/skills/resolve-tracking/scripts/resolve-tracking.mts

@@ -1,9 +1,10 @@
 // resolve-tracking — resolve one artifact's tracking signal (tracked | ignored).
-// Self-contained, no deps (repo's node-≥23.6 convention). Spec:
-// .agents/specs/sdd/intake/resolve-tracking/README.md
+// Self-contained, no deps (repo's node-≥23.6 convention). Spec: the intake/resolve-tracking
+// node of the SDD project spec (repo-only).
 
-import { existsSync, readFileSync } from 'node:fs'
+import { existsSync, readFileSync, realpathSync } from 'node:fs'
 import { join } from 'node:path'
+import { pathToFileURL } from 'node:url'
 
 export type Tracking = 'tracked' | 'ignored'
 
@@ -208,6 +209,6 @@ export function main(argv: string[]): void {
 	process.stdout.write(`reason: ${result.reason}\n`)
 }
 
-if (process.argv[1] && import.meta.url === `file://${process.argv[1]}`) {
+if (process.argv[1] && import.meta.url === pathToFileURL(realpathSync(process.argv[1])).href) {
 	main(process.argv.slice(2))
 }

package/skills/sdd/SKILL.md

@@ -17,7 +17,7 @@ Treat `$sdd`, "use SDD", and "use Spec-Driven Development" as explicit activatio
 
 ### Surface pending strategy
 
-When the Council re-enters, **surface the count of pending (unratified) strategy** — count the `strategy` lines with `"ratified": false` globbed from the project's **root `ledger/` shards** (the durable sibling directory of the root `spec.md`; a legacy `ledger.jsonl` still counts) and state "N pending strategy" alongside the intake; if the Council picks it, route them to review those entries. Count only `kind: strategy` — the conductor's `kind: leash` run-start blocks are **not** strategy and never counted. The gateway only *surfaces* the count — it never **drafts** strategy (the Scanner's job) nor **ratifies** it (the Council's positional act). A zero count is not surfaced. (`strategy` lives in the durable `ledger/` shards, **never** in the per-mission `*.log.jsonl` combat log.)
+When the Council re-enters, **surface the count of pending (unratified) strategy** — count the `strategy` lines with `"ratified": false` **and `disposition: open`-or-absent** globbed from the project's **root `ledger/` shards** (the durable sibling directory of the root `spec.md`; a legacy `ledger.jsonl` still counts) and state "N pending strategy" alongside the intake; if the Council picks it, route them to review those entries. Count only `kind: strategy` — the conductor's `kind: leash` run-start blocks are **not** strategy and never counted, and a `disposition: resolved` line is the Scanner's validation **tombstone** (a cut, `sdd:combat-log-governance`), **never counted** even though it is `kind: strategy` with `"ratified": false`. The gateway only *surfaces* the count — it never **drafts** strategy (the Scanner's job) nor **ratifies** it (the Council's positional act). A zero count is not surfaced. (`strategy` lives in the durable `ledger/` shards, **never** in the per-mission `*.log.jsonl` combat log.)
 
 ### Surface in-progress missions
 

package/skills/spec-format-governance/README.md

@@ -44,7 +44,7 @@ A `spec.md` has **four sections, in this order**:
 | Section | What goes in it |
 | --- | --- |
 | `## What` | What the capability is, the problem it solves, who has that problem, and what it deliberately does not do (non-goals). |
-| `## Use Cases` | Every distinct way the capability is invoked — one row each, as trigger / inputs / outcome. Each is named after the thing you actually call: a CLI verb, a function, an endpoint. |
+| `## Use Cases` | Every distinct way the capability is invoked, each named after the thing you actually call (a CLI verb, a function, an endpoint) and carrying four parts: the **actor and their goal**, the **entry point** (trigger / inputs / outcome), and its **extensions** — what else can happen, each divergence with its cause and outcome. Plus a trace of every element the capability exposes (flag, option, parameter, prop, event) to the use case that needs it and the elements it may not combine with. An element no use case needs is an orphan: cut it or justify it. |
 | `## Control Flow` | The decisions the capability makes once invoked, taken as one **control-flow graph (CFG)** and **drawn** as a diagram rather than described in prose. Use cases feed into one CFG; several usually share it. |
 | `## Scenario map` | A table pairing each branch in that diagram with the one test scenario covering it, grouped by use case. One-to-one, both directions — so a gap in coverage is visible instead of buried in prose. |
 

package/skills/spec-format-governance/SKILL.md

@@ -20,12 +20,73 @@ deliberately excludes). One or two short paragraphs; add a **Key terms** glossar
 jargon. Legible to a non-engineer.
 
 ### `## Use Cases`
-The **entry points** — one row per distinct way the capability is invoked, each **named to its
-implementation surface** (a CLI verb, a public function, an endpoint), given as
-**trigger / inputs / outcome**. A use case answers *"when, and with what, is this invoked?"* — never
-*"given this state, does it do that?"* (that is a scenario). Naming the impl surface keeps the spec,
-the suite, and the code on **one screaming structure**: the builder gives each use case its own
-module, so each change stays local.
+One entry per distinct way the capability is invoked, each **named to its implementation surface**
+(a CLI verb, a public function, an endpoint) and carrying four parts: **actor / goal**, the
+**entry point** (trigger / inputs / outcome), and its **extensions**. Naming the impl surface keeps
+the spec, the suite, and the code on **one screaming structure**: the builder gives each use case
+its own module, so each change stays local.
+
+A use case answers *"who is trying to do what, how do they invoke it, and what else can happen?"* —
+never *"given this state, does it do that?"* (that is a scenario).
+
+**Enumerate by actor, never by entry point.** Walking the interface and asking who calls each entry
+point can only return use cases the interface already implies — it reproduces the surface and calls
+it a requirement, and it is structurally blind to the use case nobody has built yet. So the section
+is derived the other way round:
+
+1. **List the actors** — every person in a role, sibling capability, scheduler, or operator that
+   reaches this capability, **plus** whoever is affected by its outcome without invoking it (the
+   reviewer, the on-call, the next agent in a chain). The second group are stakeholders rather than
+   actors and are where a missed use case usually hides.
+2. **Per actor, name the goals** they come to this capability with — their result, not the call they
+   make.
+3. **Then map goals to entry points.** A goal with **no** entry point is the finding this ordering
+   exists to surface: either the capability is missing a way in, or the goal belongs to another
+   node. An entry point serving **no** listed actor's goal is the mirror finding — it is surface
+   nobody asked for.
+
+The enumeration is checkable both ways: an actor carrying no use case, and a use case whose actor
+is absent from the list, are each a hole. On **backfill** the source yields only the *served* use
+cases by construction — recover the unserved ones from the request history, the issue tracker, and
+recurring workarounds, and record where each came from.
+
+- **Actor and goal — one line each, not a persona.** Name who invokes it (a person in a role,
+  another capability, a scheduler) and the outcome **they** want, stated as their result rather
+  than the mechanism ("recover the work after a crash", not "calls `resume()`"). An actor may be
+  an agent or a sibling capability; that is normal, not a degenerate case. Where the goal restates
+  the function name, the use case has not been found yet — it has been renamed.
+- **Entry point** — the trigger, its inputs, and the success outcome. A table is the usual form.
+- **Extensions — what else can happen, and the instrument that finds it.** An extension is **any
+  path from this use case's trigger that does not reach its success outcome**; state each with its
+  cause and its outcome. That criterion decides membership — the recurring kinds (an error, a
+  refusal, a boundary, a partial result, a contended or absent input) are a **prompt to search, not
+  a closed set**, so a divergence matching none of them still belongs and a kind that cannot arise
+  here is not owed a row. **A use case with no extensions is a claim that nothing can go wrong** —
+  state that claim explicitly (`extensions: none — <why>`) rather than leaving the field off, so a
+  reviewer can disagree with it.
+
+  Extensions are a **discovery instrument, not a second specification.** They exist to make the
+  **CFG complete**: a graph drawn from an implementation reproduces what the code already does and
+  can never tell you a branch is *missing*, whereas asking what can go wrong **for this actor**
+  finds it. So every extension you find belongs in `## Control Flow` as a path, and the scenarios
+  still derive from **the CFG alone** (`## Scenario map`, 1:1 on the **(path class, edge)** pair).
+  Never draw a scenario from the stated list directly: a suite derived from prose is 1:1 with that
+  prose by construction and can no longer surface a hole. A use case is therefore **not** 1:1 with
+  a scenario — one extension may need several scenarios where several path classes reach it, and
+  several extensions may reconverge onto one.
+
+**Every element of the public surface traces to a use case that needs it.** List each element the
+capability exposes — a flag, an option, a parameter, a prop, an event — against the use case
+requiring it, and name the elements it **may not** be combined with. An element **no use case needs
+is unjustified**: cut it, or name the use case. A pair whose combination is contradictory and
+unstated is a gap, not a detail. This is the same orphan-detection discipline as `## Scenario map`,
+applied one level up: there, a scenario with no edge is an orphan; here, an element with no use case
+is an orphan.
+
+Degenerate cases stay cheap. A capability exposing **one** entry point and **no** optional elements
+carries the surface trace in a line, not a table — the obligation is that nothing on the surface is
+unaccounted for, never that a table exists. A single-actor capability lists one actor; the
+enumeration is the discipline, not the length.
 
 ### `## Control Flow`
 The **control-flow graph (CFG)** the capability runs once invoked, **drawn** as a fenced Mermaid
@@ -41,6 +102,11 @@ the edge alone: a scenario's `Given` is the path reaching the edge, its `When` i
 (`sdd:suite-format-governance`).
 
 - **1:1 scenario↔row** — every scenario has exactly one row, every row one scenario.
+- **Name the scenario in backticks.** The `Scenario` cell holds the scenario's title **backtick-wrapped**
+  (`` `send text types literal text and presses no Enter` ``). This is how `check-suite` tells a data
+  row from the header and separator: a data row whose `Scenario` cell is **not** backtick-wrapped is
+  reported as an **unparseable row**, not silently skipped — a map that reads complete but binds nothing
+  is the exact gap the map exists to prevent.
 - **An edge may carry several rows.** That is **permutation coverage**, not duplication — legitimate
   when each row's path class yields a *different* outcome. Same edge *and* same path class twice is a
   duplicate.
@@ -103,8 +169,10 @@ Enrichment (diagrams, formatting) is `spec.md` only; the suite stays plain Gherk
 1. **Four sections in order** — `## What` (overview + non-goals), `## Use Cases`, `## Control Flow`,
    `## Scenario map` — plus an optional `## References` last, citing research that backs a decision
    (the claim it supports, not the topic).
-2. **A use case is an entry point named to its impl surface** (CLI verb / function / endpoint) — spec,
-   suite, and code share one screaming structure.
+2. **A use case is actor + goal + entry point + extensions**, named to its impl surface (CLI verb /
+   function / endpoint) — spec, suite, and code share one screaming structure. No extensions is a
+   claim, stated explicitly. **Every surface element traces to a use case that needs it**, with its
+   forbidden combinations named; an element no use case needs is an orphan — cut it or justify it.
 3. **The CFG is shared** — use cases enter it (many-to-one); section by sub-graph only when the
    decision logic genuinely differs.
 4. **The scenario map is 1:1 and grouped by use case** — coverage visible per use case; `check-suite`

package/skills/spec-gate/SKILL.md

@@ -109,8 +109,17 @@ Resolve the **spec-judge** for each `artifact-types` (a plugin judge or the SDD
 **{oracle, builder, architect}**. Then take the judge's **contract-sync verdict** (derived at this
 gate, never stored) and **derive the leash** (the conductor's autonomy bar,
 baked into `start-mission`) in-session. Collect the judge's `STATUS`,
-`ALIGNED`, failing scenarios, remaining `<!-- open: -->` markers, `OBSERVATIONS`, and the gate
-report. The judge is a **distinct cold actor** and never edits the artifact it grades.
+`ALIGNED`, failing scenarios, remaining `<!-- open: -->` markers, `CONFORMANCE`, `OBSERVATIONS`, and
+the gate report. The judge is a **distinct cold actor** and never edits the artifact it grades.
+
+**A `CONFORMANCE.result: warn` is surfaced, never a block.** When the judge reports a spec-format
+conformance warning (a touched **behavioral** `spec.md` missing a required section — especially
+`## Use Cases`, `## Control Flow` / CFG, or `## Scenario map`), **surface it in the gate report** and
+**do not** let it advance, block, or set `ALIGNED: false` on its own — it is a non-blocking finding
+like `CONTENT_GAPS` or an introduced-reference finding, distinct from the deterministic structural
+fail-closed checks and from a lens failure. The advance is governed by the lenses, the open markers,
+and the alignment verdict exactly as before; the conformance warning rides alongside them in the
+report.
 
 **Never advance** — by self-assertion or human verdict — with judge failures, any remaining open
 markers, or a misaligned suite. They fail the confidence dimension, so they forbid self-assertion
@@ -162,6 +171,10 @@ node "<skill>/scripts/classify-edit-class.mts" --files <the CR's touched .featur
 
 A `narrowing`/`mixed` result on a still-`@frozen` file routes to **Clearance** (escalated unless the CR
 pre-authorized it); `additive`/`no-content-change` self-clears; `unfrozen-skip` needs no edit-class gate.
+When a Clearance re-open **repairs** an already-frozen scenario, re-approving the repair carries the
+**pre-repair-failure proof** bar (`sdd:remediation-governance`): the repaired scenario must **fail**
+against the pre-repair artifact — a repair that already passes it is a suspected back-fit, and a
+post-repair pass alone never re-approves.
 `spec.md`
 / the node READMEs are **kept aligned, never frozen** — editable, but may not contradict a frozen
 scenario (enforced by the alignment check and the judge, not a flat freeze). Vocabulary is
@@ -192,6 +205,9 @@ nothing, advances no status, renders no verdict**. Fixed sections:
 ## Report
 
 - PASS / FAIL per lens, relayed from the judge
+- **Spec-format conformance:** the judge's `CONFORMANCE` — on `warn`, a **warning** line naming each
+  missing required section (Use Cases / Control Flow / Scenario map) on the touched behavioral
+  `spec.md`; non-blocking, surfaced alongside the verdict, never a block on its own
 - `ALIGNED: true | false`; if false, which artifacts are out of sync
 - Open markers / failing scenarios still blocking, if any
 - The leash derivation and the effective leash for this gate

package/skills/spec-gate/scripts/check-spec-state.mts

@@ -35,8 +35,9 @@
 // exported for node:test; running the file directly drives the CLI. No dependencies.
 
 import { execFileSync } from 'node:child_process'
-import { type Dirent, existsSync, readdirSync, readFileSync } from 'node:fs'
+import { type Dirent, existsSync, readdirSync, readFileSync, realpathSync } from 'node:fs'
 import { basename, dirname, join } from 'node:path'
+import { pathToFileURL } from 'node:url'
 
 export interface GateVerdict {
 	verdict?: string
@@ -63,6 +64,12 @@ export interface LedgerGate {
 	verdict: string
 }
 
+// The lifecycle enum (lifecycle-governance), mirrored from discover-specs' recognition filter.
+// Discovery *drops* a spec whose status is outside it, so every engine iterating discovered
+// specs skips it silently; this check walks the tree itself, so it is the one place that still
+// sees the file — and must escalate rather than exempt it (a status typo would otherwise remove
+// a spec from all checking with no signal).
+const LIFECYCLE_STATUSES = ['draft', 'approved', 'implemented', 'deprecated']
 const GATES = ['spec', 'impl']
 const VERDICTS = ['approve', 'pause', 'reject']
 const SPEC_TYPES = ['reference', 'behavioral']
@@ -132,6 +139,17 @@ export function checkSpec(slug: string, state: SpecState): string[] {
 	const v: string[] = []
 	const tag = (msg: string) => v.push(`${slug}: ${msg}`)
 
+	// The status must be classifiable before anything below it means anything: an
+	// out-of-enum (or absent) status makes every tuple rule below vacuous — the spec
+	// reads as neither approved nor implemented and passes silently, while discovery
+	// has already dropped it from every other engine. Unclassifiable is a failure.
+	if (!LIFECYCLE_STATUSES.includes(status))
+		tag(
+			status === ''
+				? `no lifecycle status in frontmatter — a spec.md must declare status (${LIFECYCLE_STATUSES.join(' | ')}), and one that does not is checked by nothing`
+				: `status "${status}" is not in the lifecycle enum (${LIFECYCLE_STATUSES.join(' | ')}) — discovery drops it, so it is checked by nothing`,
+		)
+
 	// `implemented` is backed by the impl gate's runtime suite run (ADR-0017), not a
 	// stored flag — the static guard here is the recorded approval.impl ratification
 	// (below). No `aligned` cross-check.
@@ -436,6 +454,11 @@ export function filterProseMdInSpecTree(paths: string[]): string[] {
 export interface UseCaseScenarioRefs {
 	hasSection: boolean
 	refs: string[]
+	// Trimmed text of each DATA row whose Scenario cell carries no backtick reference —
+	// missing, empty, or present-but-unparseable. Every one is surfaced as a violation
+	// rather than silently dropped: a row that names no scenario is a coverage gap, and
+	// exempting it is the fail-open shape this check exists to close.
+	unparseable: string[]
 }
 
 // A markdown table row: strip the leading/trailing `|` then split on `|`, trimming each cell.
@@ -465,26 +488,32 @@ export function extractUseCaseScenarioRefs(text: string): UseCaseScenarioRefs {
 	// would erase the very refs this function extracts).
 	const body = text.replace(/```[\s\S]*?```/g, '')
 	const section = extractSection(body, 'Use Cases')
-	if (section === null) return { hasSection: false, refs: [] }
+	if (section === null) return { hasSection: false, refs: [], unparseable: [] }
 	const lines = section.split('\n')
 	const headerIdx = lines.findIndex((l) => l.trim().startsWith('|'))
-	if (headerIdx === -1) return { hasSection: true, refs: [] } // prose or EARS — no table
+	if (headerIdx === -1) return { hasSection: true, refs: [], unparseable: [] } // prose or EARS — no table
 	const header = splitTableRow(lines[headerIdx])
 	const scenarioIdx = header.findIndex((c) => /^scenario$/i.test(c))
-	if (scenarioIdx === -1) return { hasSection: true, refs: [] } // table with no Scenario column
+	if (scenarioIdx === -1) return { hasSection: true, refs: [], unparseable: [] } // table with no Scenario column
 
 	const refs: string[] = []
+	const unparseable: string[] = []
 	// data rows start after the header separator (`|---|---|`); stop at the first
-	// non-`|` line, which ends the contiguous table block.
+	// non-`|` line, which ends the contiguous table block. A data row whose Scenario
+	// cell carries no backtick reference is collected as unparseable — never silently
+	// skipped, which would fail this coverage check open.
 	for (let i = headerIdx + 2; i < lines.length; i++) {
 		if (!lines[i].trim().startsWith('|')) break
 		const cells = splitTableRow(lines[i])
-		const cell = cells[scenarioIdx]
-		if (!cell) continue
+		// A missing cell (a row shorter than the header) and an empty one are the same
+		// defect as an un-backticked one: the row names no covering scenario. All three
+		// are collected — skipping any of them fails this coverage check open.
+		const cell = cells[scenarioIdx] ?? ''
 		const ref = /`([^`\n]+)`/.exec(cell)
 		if (ref) refs.push(ref[1].trim())
+		else unparseable.push(lines[i].trim())
 	}
-	return { hasSection: true, refs }
+	return { hasSection: true, refs, unparseable }
 }
 
 function escapeRegExp(s: string): string {
@@ -520,8 +549,13 @@ export function findSiblingFeature(dir: string): string | null {
 export function checkUseCaseCoverage(slug: string, dir: string, text: string): string[] {
 	const v: string[] = []
 	const tag = (msg: string) => v.push(`${slug}: ${msg}`)
-	const { hasSection, refs } = extractUseCaseScenarioRefs(text)
-	if (!hasSection || refs.length === 0) return v
+	const { hasSection, refs, unparseable } = extractUseCaseScenarioRefs(text)
+	if (!hasSection) return v
+
+	for (const raw of unparseable) {
+		tag(`Use Cases data row has no backtick-wrapped Scenario cell — ${raw}`)
+	}
+	if (refs.length === 0) return v
 
 	const featurePath = findSiblingFeature(dir)
 	const featureText = featurePath ? readFileSync(featurePath, 'utf8') : ''
@@ -598,4 +632,6 @@ export function main(argv: string[]): number {
 	return 0
 }
 
-if (import.meta.main) process.exit(main(process.argv.slice(2)))
+if (process.argv[1] && import.meta.url === pathToFileURL(realpathSync(process.argv[1])).href) {
+	process.exit(main(process.argv.slice(2)))
+}