cyber-sdd 0.4.0 → 0.4.2

package/skills/start-mission/SKILL.md

@@ -144,6 +144,7 @@ Once landed, **do not spawn** the formation Warden. Surface a **one-line nudge**
 ## Autonomy, provenance, and the hard floor (baked in)
 
 - **Dispatch transport.** Every spawn beyond this session states a **dispatch intent** — role, brief, expected verdict schema — never a pinned command. When a harness-agnostic dispatch capability is available (detected at runtime; the concrete case is the Legate's `dispatch-governance` composing `cyberlegion` primitives — `agent resolve` + `unit spawn` + `mail await` — with **no** `dispatch` CLI verb, the seam named in the SDD project spec's `design/harness-spawning` node, repo-only), route through its intent seam and let it pick `subagent | channel | run-inline`, **preferring a warm unit** over a cold one-shot spawn; with no capability present, fall back to the portable cold subagent (depth-1) default — grader independence intact either way. **Warmth is a property of the unit/process; coldness of the context**: a judge's fresh-context guarantee (ADR-0016) is transport-agnostic — satisfied by a newly spawned cold subagent **or** a warm unit **context-cleared** to a fresh context before **each** judgment (re-deriving its oracle, carrying none of a prior round's context). Clear a warm unit with **`npx cyberlegion@0.3.1 unit clear <ref>`** (`<ref>` = unit id / handle / worktree branch or CR ref) — it injects the harness's own fresh-context command (`/clear` on Claude/Codex/Copilot, `/new-chat` on Cursor; fail-loud on a harness with no honest reset) so the **pane stays warm** while the **context goes cold**; it tears nothing down. The **impl-producer builder** instead stays warm and **keeps** its context across the explore spikes and the deliver build (never cleared between those uses). Warm units stay warm for **one mission** — reused within it, then **`unit clear`**'d or torn down at **handoff**, never carrying this mission's context into the next.
+- **SDD's own judges go to the seam by file, not by name.** A dispatch capability may resolve a definition by name only in the project's own agent folder (cyberlegion's `agent resolve` does), so it cannot find one SDD ships. When the judge role resolves to SDD's own `sdd-spec-judge` or `sdd-impl-judge`, locate the definition yourself at **`agents/<name>.md` under the SDD plugin root** — two levels above this skill's own base directory (`<skill dir>/../../agents/<name>.md`) — and hand the capability **that path** (cyberlegion: `agent resolve --file <path>`, `unit spawn --agent-file <path>`), never the bare name. If no file is there, send the capability **no request for that judge** (a by-name one would miss) and take the no-capability route: spawn it as a portable cold subagent through the harness's own plugin-agent spawn (`sdd:sdd-spec-judge` / `sdd:sdd-impl-judge`), which knows the plugin. A plugin-delegated judge is outside this rule.
 - **Initial strategy** (run start): assess blast radius + the other dimensions and emit a run-level `kind: leash` block to **your own ledger shard** (`ledger/<cr-ref>.<hash>.jsonl` — mint `<hash>` as 6 random hex **once per session** and reuse it for every line you append; `sdd:combat-log-governance`) — `leash` (`auto-none | auto-spec | auto-all`), `by: derived | user`, `approach[]`. It may be user-specified. This block is `kind: leash`, **not** `strategy` — `strategy` is the doctrine Scanner's alone. Ledger lines carry **no `ts`**.
 - **Per-gate verdict.** At each gate, derive the leash against discovered state and either **self-assert within leash** (write `approval.<gate>: { verdict: approve, by: agent, why }`; the spec lands in the async review queue) or **stop** with a verdict packet for the human. **Never advance** when any judge fails, any open marker remains, or (at the impl gate) any frozen scenario's verification does not pass. Human ratification (`by: <name>`, advance `status`) is reserved to the in-session position holding the user channel — by default you, in-session; a headless `automaton` emits the verdict packet and stops, **even when a coordinator relays "the user approved."**
 - **Combat log.** Append `report` / `correction` lines (and the halt that stopped you) to the plan's `*.log.jsonl` (these carry a UTC `ts`); your run-start `leash` block, self-asserted `gate` lines, and the handoff `followup` records go to **your own shard** in the durable `ledger/` directory sibling to `spec.md` — never another writer's shard, never a shared file (`strategy` there is the Scanner's alone). Free text is commit-message-grade — never code, prompts, secrets, or literal values.

package/skills/touch-set-correction/README.md

@@ -12,3 +12,8 @@ and the frozen 21-scenario contract.
 - **Script:** [`scripts/touch-set-correction.mts`](./scripts/touch-set-correction.mts)
 - **Tests:** [`scripts/touch-set-correction.test.mts`](./scripts/touch-set-correction.test.mts)
   (`node:test`) — one test per frozen scenario, titled `scenario: <verbatim frozen scenario name>`.
+  [`scripts/touch-set-correction-installed.test.mts`](./scripts/touch-set-correction-installed.test.mts)
+  runs the engine from a copy of the plugin's files, with no `node_modules`.
+
+The engine imports gherkin-cli from the spec gate's committed bundle
+(`../spec-gate/vendor/gherkin-cli.mjs`), so it runs from an installed plugin.

package/skills/touch-set-correction/scripts/touch-set-correction.mts

@@ -13,7 +13,7 @@
 //     a live git diff or the live mission-graph store.
 //   - readChangedFiles / resolveArtifactType / changedScenarios / collectChangedFiles /
 //     discoverLayouts are the thin IO SEAM: they shell out to `git`, `resolve-governances.mts`, and
-//     the pinned `gherkin-cli@0.0.2` `diffFeatures` (the same differ classify-edit-class.mts uses —
+//     the pinned `gherkin-cli` `diff` (the same differ classify-edit-class.mts uses —
 //     this tool never reimplements a differ). NOT unit-tested (binary/fs boundary) — the tested
 //     logic is everything downstream of the file list.
 //   - main() is a thin CLI: argv -> collectChangedFiles + assembleCorrection, rendering TOON by
@@ -30,7 +30,7 @@ import { execFileSync } from 'node:child_process'
 import { readFileSync, realpathSync } from 'node:fs'
 import { dirname, join, relative, resolve, sep } from 'node:path'
 import { fileURLToPath, pathToFileURL } from 'node:url'
-import { type DiffReader, diffFeatures } from 'gherkin-cli'
+import { diff as gherkinDiff, type ReadsGitDiff } from '../../spec-gate/vendor/gherkin-cli.mjs'
 
 // ── Types ──
 
@@ -226,7 +226,7 @@ export function resolveArtifactType(path: string, root: string, cwd: string): st
 	}
 }
 
-// `diffFeatures`'s default reader resolves paths against `process.cwd()` and derives git's own cwd
+// `diff`'s default reader resolves paths against `process.cwd()` and derives git's own cwd
 // from that resolved location (`git ls-files --full-name` to recover the repo-relative path) —
 // this reader is that same algorithm, re-pointed at `cwd` (same seam classify-edit-class.mts
 // uses), so it stays robust to a caller whose relative-path bookkeeping doesn't line up with its
@@ -234,7 +234,7 @@ export function resolveArtifactType(path: string, root: string, cwd: string): st
 // reads as "absent" — the outer `changedScenarios` catch-all is this call site's real fail-open
 // boundary, so a thrown `GitError` here is caught there rather than escalated.
 const cwdReader =
-	(cwd: string): DiffReader =>
+	(cwd: string): ReadsGitDiff['readDiff'] =>
 	(file, base) => {
 		const abs = resolve(cwd, file)
 		const dir = dirname(abs)
@@ -272,15 +272,15 @@ const cwdReader =
 		return { head, base: baseText }
 	}
 
-/** The changed scenario names of a touched `.feature`, via the pinned `gherkin-cli@0.0.2`
- *  `diffFeatures` (same tool classify-edit-class.mts uses — never a reimplemented differ). Gated
+/** The changed scenario names of a touched `.feature`, via the pinned `gherkin-cli`
+ *  `diff` (same tool classify-edit-class.mts uses — never a reimplemented differ). Gated
  *  by isFeature — a non-.feature never calls out. On any failure returns []. Reads any `.feature`
  *  regardless of freeze — the freeze gate is a separate concern (spec-gate), not this tool's
  *  business. */
 export function changedScenarios(base: string, path: string, cwd: string): string[] {
 	if (!isFeature(path)) return []
 	try {
-		const { files } = diffFeatures([path], { base, reader: cwdReader(cwd) })
+		const { files } = gherkinDiff([path], { base, full: true }, { readDiff: cwdReader(cwd) })
 		const fileResult = files.find((f) => f.file === path) ?? files[0]
 		return (fileResult?.scenarios ?? []).filter((s) => s.change !== 'unchanged').map((s) => s.name)
 	} catch {

package/skills/verify-scenarios/README.md

@@ -8,7 +8,12 @@ script that unions one or more junit (today) result sources against the scenario
 
 - **Skill contract:** [`SKILL.md`](./SKILL.md)
 - **Script:** [`scripts/verify-scenarios.mts`](./scripts/verify-scenarios.mts)
-- **Tests:** [`scripts/verify-scenarios.test.mts`](./scripts/verify-scenarios.test.mts) (`node:test`)
+- **Tests:** [`scripts/verify-scenarios.test.mts`](./scripts/verify-scenarios.test.mts) (`node:test`);
+  [`scripts/verify-scenarios-installed.test.mts`](./scripts/verify-scenarios-installed.test.mts)
+  runs the engine from a copy of the plugin's files, with no `node_modules`
+
+The engine imports gherkin-cli from the spec gate's committed bundle
+(`../spec-gate/vendor/gherkin-cli.mjs`), so it runs from an installed plugin.
 
 ```bash
 node scripts/verify-scenarios.mts --feature .agents/spec/identity/identity.feature --node cyberlegion/identity

package/skills/verify-scenarios/scripts/verify-scenarios.mts

@@ -49,7 +49,7 @@ import { execSync } from 'node:child_process'
 import { existsSync, readFileSync, realpathSync } from 'node:fs'
 import { isAbsolute, join } from 'node:path'
 import { pathToFileURL } from 'node:url'
-import { parseFeatures } from 'gherkin-cli'
+import { parse } from '../../spec-gate/vendor/gherkin-cli.mjs'
 
 // Resolves a path argument against `--root`: relative paths join beneath root (which defaults to the
 // current directory); an absolute path is used verbatim, never double-prefixed under root.
@@ -132,7 +132,7 @@ export function scenarioKeysFromParse(parsed: GherkinParseOutput): ScenarioKey[]
 // `--feature-root` — see main()).
 export function getScenarioKeys(root: string, featurePath: string, featureRoot: string = root): ScenarioKey[] {
 	const abs = underRoot(featureRoot, featurePath)
-	return scenarioKeysFromParse(parseFeatures([abs]))
+	return scenarioKeysFromParse(parse([abs]))
 }
 
 // ── JUnit parsing (hand-rolled, no xml dep) ──