cyber-sdd 0.6.0 → 0.7.0

package/skills/resolve-governances/scripts/resolve-governances.bundle.mjs

@@ -0,0 +1,350 @@
+#!/usr/bin/env node
+import { existsSync, readFileSync, readdirSync, realpathSync } from "node:fs";
+import { join } from "node:path";
+import { pathToFileURL } from "node:url";
+//#region skills/resolve-governances/scripts/resolve-governances.mts
+const ROLE_KEYS = [
+	"spec-producer",
+	"solution-producer",
+	"spec-judge",
+	"impl-producer",
+	"impl-judge"
+];
+const BAR_KEYS = [
+	"oracle-spec",
+	"builder-spec",
+	"builder-impl",
+	"architect-spec",
+	"architect-impl"
+];
+const ACTORS = [
+	"oracle",
+	"builder",
+	"architect"
+];
+const GATES = ["spec", "impl"];
+const ROLE_LOADOUT = {
+	"spec-producer": { bars: ["oracle-spec", "builder-spec"] },
+	"solution-producer": { bars: ["architect-spec"] },
+	"spec-judge": { bars: [
+		"oracle-spec",
+		"builder-spec",
+		"architect-spec"
+	] },
+	"impl-producer": { bars: ["builder-impl", "architect-impl"] },
+	"impl-judge": { bars: ["builder-impl", "architect-impl"] }
+};
+const SDD_DEFAULT_AGENT = {
+	"spec-producer": null,
+	"solution-producer": null,
+	"spec-judge": "sdd-spec-judge",
+	"impl-producer": null,
+	"impl-judge": "sdd-impl-judge"
+};
+function migrateRoles(rolesIn) {
+	const roles = { ...rolesIn ?? {} };
+	if ("plan-producer" in roles) {
+		const legacy = roles["plan-producer"];
+		if (!("solution-producer" in roles)) roles["solution-producer"] = legacy;
+		delete roles["plan-producer"];
+	}
+	return roles;
+}
+function migrateGovernances(gIn) {
+	const g = gIn ?? {};
+	return "oracle" in g || "builder" in g || "architect" in g ? {
+		"oracle-spec": g.oracle ?? null,
+		"builder-spec": g.builder ?? null,
+		"builder-impl": g.builder ?? null,
+		"architect-spec": g.architect ?? null,
+		"architect-impl": g.architect ?? null
+	} : { ...g };
+}
+function migrateSquad(sq) {
+	const types = sq["artifact-types"] ?? sq.domains ?? [];
+	return {
+		"artifact-types": Array.isArray(types) ? types : [],
+		roles: migrateRoles(sq.roles),
+		governances: migrateGovernances(sq.governances)
+	};
+}
+function migrateEntry(entry) {
+	const squads = Array.isArray(entry.squads) ? entry.squads.map(migrateSquad) : [migrateSquad({
+		"artifact-types": entry.domains,
+		roles: entry.roles,
+		governances: entry.governances
+	})];
+	return {
+		name: entry.name,
+		version: entry.version,
+		squads
+	};
+}
+function parseRegistry(text) {
+	let raw;
+	try {
+		raw = JSON.parse(text);
+	} catch (e) {
+		throw new Error(`registry is not valid JSON: ${e.message}`);
+	}
+	if (!raw || typeof raw !== "object" || !Array.isArray(raw["sdd-plugins"])) throw new Error("registry has no sdd-plugins array");
+	return { "sdd-plugins": raw["sdd-plugins"].map(migrateEntry) };
+}
+function loadRegistry(root) {
+	const path = join(root, ".agents", "universal-plugin.json");
+	if (!existsSync(path)) return { "sdd-plugins": [] };
+	return parseRegistry(readFileSync(path, "utf8"));
+}
+function parseArtifactTypeMap(text) {
+	const out = [];
+	for (const raw of text.split("\n")) {
+		const line = raw.trim();
+		if (!line || line.startsWith("#") || line.startsWith("[")) continue;
+		const m = /^(?:"([^"]+)"|'([^']+)'|(\S+))\s*=\s*(?:"([^"]+)"|'([^']+)')\s*(?:#.*)?$/.exec(line);
+		if (!m) continue;
+		const glob = m[1] ?? m[2] ?? m[3];
+		const type = m[4] ?? m[5];
+		if (glob && type) out.push({
+			glob,
+			type
+		});
+	}
+	return out;
+}
+function globToRegExp(glob) {
+	const re = glob.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*+/g, (m) => m.length > 1 ? ".*" : "[^/]*").replace(/\?/g, ".");
+	return new RegExp(`^${re}$`);
+}
+function resolveArtifactTypeFromMap(map, path) {
+	const matches = map.filter((b) => globToRegExp(b.glob).test(path));
+	if (matches.length === 0) return null;
+	const literal = (g) => g.replace(/[*?]/g, "").length;
+	matches.sort((a, b) => literal(b.glob) - literal(a.glob) || b.glob.length - a.glob.length);
+	return matches[0].type;
+}
+function loadArtifactTypeMap(root) {
+	const path = join(root, ".agents", "sdd", "artifact-types.toml");
+	if (!existsSync(path)) return [];
+	return parseArtifactTypeMap(readFileSync(path, "utf8"));
+}
+function frontmatter(text) {
+	const m = /^---\n([\s\S]*?)\n---/.exec(text);
+	return m ? m[1].split("\n") : [];
+}
+const unquote = (s) => s.trim().replace(/^["']|["']$/g, "");
+function parseGovernanceFrontmatter(text) {
+	const lines = frontmatter(text);
+	let inMeta = false;
+	let artifactType = null;
+	let actor = null;
+	let gate = null;
+	let compose = "union";
+	for (const line of lines) {
+		if (/^metadata:\s*$/.test(line)) {
+			inMeta = true;
+			continue;
+		}
+		if (inMeta && /^\S/.test(line)) inMeta = false;
+		if (!inMeta) continue;
+		const at = /^\s+artifact-type:\s*(.+)$/.exec(line);
+		if (at) artifactType = unquote(at[1]);
+		const ac = /^\s+actor:\s*(.+)$/.exec(line);
+		if (ac) actor = unquote(ac[1]);
+		const ga = /^\s+gate:\s*(.+)$/.exec(line);
+		if (ga) gate = unquote(ga[1]);
+		const co = /^\s+compose:\s*(.+)$/.exec(line);
+		if (co) compose = unquote(co[1]) === "replace" ? "replace" : "union";
+	}
+	if (!actor || !gate) return null;
+	return {
+		artifactType,
+		actor,
+		gate,
+		compose
+	};
+}
+function collectAnchorGovernances(anchors) {
+	const out = [];
+	for (const { tier, root } of anchors) {
+		const dir = join(root, ".agents", "governances");
+		let entries;
+		try {
+			entries = readdirSync(dir, { withFileTypes: true });
+		} catch {
+			continue;
+		}
+		for (const e of entries) {
+			if (!e.isFile() || !e.name.endsWith(".md")) continue;
+			const meta = parseGovernanceFrontmatter(readFileSync(join(dir, e.name), "utf8"));
+			if (meta) out.push({
+				...meta,
+				tier,
+				path: join(root, ".agents", "governances", e.name)
+			});
+		}
+	}
+	return out;
+}
+function matchSquad(registry, artifactType) {
+	if (!artifactType) return {
+		match: null,
+		ambiguous: []
+	};
+	const matches = [];
+	for (const p of registry["sdd-plugins"]) for (const sq of p.squads ?? []) if (sq["artifact-types"]?.includes(artifactType)) matches.push({
+		plugin: p.name,
+		squad: sq
+	});
+	if (matches.length === 0) return {
+		match: null,
+		ambiguous: []
+	};
+	if (matches.length === 1) return {
+		match: matches[0],
+		ambiguous: []
+	};
+	return {
+		match: null,
+		ambiguous: [...new Set(matches.map((m) => m.plugin))]
+	};
+}
+function matchBar(artifactType, actor, gate, ctx) {
+	const key = `${actor}-${gate}`;
+	const bucket = (tier) => ctx.projectGovs.filter((c) => c.tier === tier && c.actor === actor && c.gate === gate).filter((c) => c.artifactType === artifactType || c.artifactType === null).map((c) => c.path);
+	const pluginBar = ctx.match?.squad.governances?.[key];
+	return {
+		key,
+		candidates: {
+			project: bucket("project"),
+			"project-root": bucket("project-root"),
+			plugin: ctx.match && pluginBar ? `${ctx.match.plugin}:${pluginBar}` : null,
+			sdd: `sdd:${key}-governance`
+		}
+	};
+}
+function resolveAgent(role, match) {
+	if (!match) return {
+		source: "sdd",
+		ref: SDD_DEFAULT_AGENT[role]
+	};
+	if (role in match.squad.roles) {
+		const named = match.squad.roles[role];
+		if (named) return {
+			source: "plugin",
+			ref: named
+		};
+		return {
+			source: "sdd",
+			ref: SDD_DEFAULT_AGENT[role]
+		};
+	}
+	return {
+		source: "plugin",
+		ref: `${match.plugin}-${role}`
+	};
+}
+function resolveRole(role, artifactType, ctx) {
+	const bars = ROLE_LOADOUT[role].bars.map((b) => {
+		const [actor, gate] = b.split("-");
+		return matchBar(artifactType, actor, gate, ctx);
+	});
+	return {
+		role,
+		agent: resolveAgent(role, ctx.match),
+		bars
+	};
+}
+function buildLoadPlan(artifactType, registry, projectGovs) {
+	const { match, ambiguous } = matchSquad(registry, artifactType);
+	if (ambiguous.length > 0) return {
+		artifactType,
+		status: "needs-input",
+		plugin: null,
+		ambiguous,
+		roles: []
+	};
+	const ctx = {
+		match,
+		projectGovs
+	};
+	return {
+		artifactType,
+		status: "complete",
+		plugin: match?.plugin ?? null,
+		ambiguous: [],
+		roles: ROLE_KEYS.map((r) => resolveRole(r, artifactType, ctx))
+	};
+}
+function validateRegistry(registry) {
+	const v = [];
+	const typeOwners = /* @__PURE__ */ new Map();
+	for (const entry of registry["sdd-plugins"]) {
+		const where = entry.name || "<unnamed plugin>";
+		if (!entry.name) v.push("an sdd-plugins entry has no name");
+		if (!Array.isArray(entry.squads)) {
+			v.push(`${where}: squads is not an array`);
+			continue;
+		}
+		const seenTypes = /* @__PURE__ */ new Set();
+		for (const sq of entry.squads) {
+			if (!Array.isArray(sq["artifact-types"])) v.push(`${where}: a squad's artifact-types is not an array`);
+			for (const r of Object.keys(sq.roles ?? {})) if (!ROLE_KEYS.includes(r)) v.push(`${where}: unknown role key "${r}"`);
+			for (const k of Object.keys(sq.governances ?? {})) if (!BAR_KEYS.includes(k)) v.push(`${where}: unknown governance key "${k}"`);
+			for (const t of sq["artifact-types"] ?? []) {
+				if (seenTypes.has(t)) v.push(`${where}: artifact-type "${t}" appears in more than one squad`);
+				seenTypes.add(t);
+			}
+		}
+		for (const t of seenTypes) typeOwners.set(t, [...typeOwners.get(t) ?? [], where]);
+	}
+	for (const [t, owners] of typeOwners) if (owners.length > 1) v.push(`artifact-type "${t}" is claimed by ${owners.length} plugins (${owners.join(", ")}) — ambiguous`);
+	return v;
+}
+function main(argv) {
+	const root = argv.includes("--root") ? argv[argv.indexOf("--root") + 1] : ".";
+	const explicitType = argv.includes("--artifact-type") ? argv[argv.indexOf("--artifact-type") + 1] : null;
+	const pathArg = argv.includes("--path") ? argv[argv.indexOf("--path") + 1] : null;
+	const projectArg = argv.includes("--project") ? argv[argv.indexOf("--project") + 1] : root;
+	const projectRootArg = argv.includes("--project-root") ? argv[argv.indexOf("--project-root") + 1] : null;
+	const anchors = [{
+		tier: "project",
+		root: projectArg
+	}];
+	if (projectRootArg) anchors.push({
+		tier: "project-root",
+		root: projectRootArg
+	});
+	let artifactType = explicitType;
+	if (!artifactType && pathArg) artifactType = resolveArtifactTypeFromMap(loadArtifactTypeMap(root), pathArg);
+	let registry;
+	try {
+		registry = loadRegistry(root);
+	} catch (e) {
+		console.error(`✗ ${e.message}`);
+		return 1;
+	}
+	if (!artifactType && pathArg) {
+		process.stdout.write(`${JSON.stringify({
+			path: pathArg,
+			artifactType: null,
+			note: "no tiebreaker match — classify by convention"
+		}, null, 2)}\n`);
+		return 0;
+	}
+	if (!artifactType) {
+		const violations = validateRegistry(registry);
+		if (violations.length) {
+			for (const line of violations) console.error(`✗ ${line}`);
+			return 1;
+		}
+		process.stdout.write("governance registry OK\n");
+		return 0;
+	}
+	const plan = buildLoadPlan(artifactType, registry, collectAnchorGovernances(anchors));
+	process.stdout.write(`${JSON.stringify(plan, null, 2)}\n`);
+	if (plan.status === "needs-input") console.error(`needs-input: artifact-type "${artifactType}" is claimed by ${plan.ambiguous.join(", ")}`);
+	return 0;
+}
+if (process.argv[1] && import.meta.url === pathToFileURL(realpathSync(process.argv[1])).href) process.exit(main(process.argv.slice(2)));
+//#endregion
+export { ACTORS, BAR_KEYS, GATES, ROLE_KEYS, ROLE_LOADOUT, SDD_DEFAULT_AGENT, buildLoadPlan, collectAnchorGovernances, loadArtifactTypeMap, loadRegistry, main, matchBar, matchSquad, migrateEntry, parseArtifactTypeMap, parseGovernanceFrontmatter, parseRegistry, resolveAgent, resolveArtifactTypeFromMap, resolveRole, validateRegistry };

package/skills/resolve-governances/scripts/resolve-governances.mjs

@@ -0,0 +1,12 @@
+// Launcher for the engine of the same name. Run it as `node <skill>/scripts/<engine>.mjs`.
+// A checkout runs the .mts source. An npm install keeps the skill under node_modules, where Node
+// will not strip types, so it runs the self-contained bundle built for the package.
+import { spawnSync } from 'node:child_process'
+import { fileURLToPath } from 'node:url'
+
+const self = fileURLToPath(import.meta.url)
+const installed = /[\\/]node_modules[\\/]/.test(self)
+const target = self.replace(/\.mjs$/, installed ? '.bundle.mjs' : '.mts')
+const run = spawnSync(process.execPath, [...process.execArgv, target, ...process.argv.slice(2)], { stdio: 'inherit' })
+if (run.error) throw run.error
+process.exitCode = run.status ?? 1

package/skills/resolve-governances/scripts/resolve-governances.mts

@@ -49,7 +49,7 @@ export const ROLE_LOADOUT: Record<RoleKey, { bars: BarKey[] }> = {
 
 // The SDD-default agent per role. A null ref means the conductor runs the role
 // INLINE in the main session (spec/solution-producer) or via a generic spawned
-// builder (impl-producer); both are recorded produced-by sdd:automaton. The two
+// builder (impl-producer); both are recorded produced-by sdd:sdd-automaton. The two
 // judges are spawned cold by name.
 export const SDD_DEFAULT_AGENT: Record<RoleKey, string | null> = {
 	'spec-producer': null,

package/skills/resolve-tracking/SKILL.md

@@ -18,7 +18,7 @@ It carries a self-contained `.mts` script (the repo's node-≥23.6 / no-deps con
 ## Run the resolution
 
 ```bash
-node "<skill>/scripts/resolve-tracking.mts" --root . --path <repo-relative-path> [--artifact-type <type>] [--explicit tracked|ignored]
+node "<skill>/scripts/resolve-tracking.mjs" --root . --path <repo-relative-path> [--artifact-type <type>] [--explicit tracked|ignored]
 ```
 
 - `--root` is the repo root (default `.`) — where `.agents/sdd/.sddignore` is read from.

package/skills/resolve-tracking/scripts/resolve-tracking.bundle.mjs

@@ -0,0 +1,150 @@
+import { existsSync, readFileSync, realpathSync } from "node:fs";
+import { join } from "node:path";
+import { pathToFileURL } from "node:url";
+//#region skills/resolve-tracking/scripts/resolve-tracking.mts
+function globToRegExpBody(glob) {
+	return glob.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*+/g, (m) => m.length > 1 ? ".*" : "[^/]*").replace(/\?/g, "[^/]");
+}
+function parseIgnoreLine(raw) {
+	const trimmed = raw.replace(/\r$/, "").trim();
+	if (!trimmed || trimmed.startsWith("#")) return "skip";
+	let body = trimmed;
+	const negated = body.startsWith("!");
+	if (negated) body = body.slice(1);
+	if (body.endsWith("/")) body = body.slice(0, -1);
+	let anchored = false;
+	if (body.startsWith("/")) {
+		anchored = true;
+		body = body.slice(1);
+	} else if (body.includes("/")) anchored = true;
+	if (body === "") return null;
+	const prefix = anchored ? "^" : "^(?:.*/)?";
+	const core = globToRegExpBody(body);
+	const suffix = "(?:/.*)?$";
+	try {
+		return {
+			negated,
+			regex: new RegExp(prefix + core + suffix),
+			source: trimmed
+		};
+	} catch {
+		return null;
+	}
+}
+function parseIgnoreFile(text) {
+	const out = [];
+	for (const raw of text.split("\n")) {
+		const rule = parseIgnoreLine(raw);
+		if (rule && rule !== "skip") out.push(rule);
+	}
+	return out;
+}
+function loadIgnoreRules(root) {
+	const path = join(root, ".agents", "sdd", ".sddignore");
+	if (!existsSync(path)) return [];
+	return parseIgnoreFile(readFileSync(path, "utf8"));
+}
+function resolveFromIgnore(rules, path) {
+	let value = null;
+	for (const rule of rules) if (rule.regex.test(path)) value = rule.negated ? "tracked" : "ignored";
+	return value;
+}
+const KIND_DEFAULT_GLOBS = {
+	skill: {
+		ignored: [".agents/skills/**"],
+		tracked: [
+			"skills/**",
+			"plugins/*/skills/**",
+			"packages/*/skills/**"
+		]
+	},
+	subagent: {
+		ignored: [".agents/agents/**"],
+		tracked: ["plugins/*/agents/**", "packages/*/agents/**"]
+	},
+	command: {
+		ignored: [".agents/commands/**"],
+		tracked: ["plugins/*/commands/**", "packages/*/commands/**"]
+	}
+};
+function globMatch(glob, path) {
+	return new RegExp(`^${globToRegExpBody(glob)}$`).test(path);
+}
+function resolveKindDefault(artifactType, path) {
+	if (!artifactType) return null;
+	const kind = KIND_DEFAULT_GLOBS[artifactType];
+	if (!kind) return null;
+	if (kind.ignored.some((g) => globMatch(g, path))) return "ignored";
+	if (kind.tracked.some((g) => globMatch(g, path))) return "tracked";
+	return null;
+}
+function resolveTracking(input) {
+	if (input.explicit) return {
+		value: input.explicit,
+		reason: "explicit override"
+	};
+	const ignoreMatch = resolveFromIgnore(loadIgnoreRules(input.root), input.path);
+	if (ignoreMatch) return {
+		value: ignoreMatch,
+		reason: ".sddignore"
+	};
+	const kindDefault = resolveKindDefault(input.artifactType, input.path);
+	if (kindDefault) return {
+		value: kindDefault,
+		reason: `kind-default (${input.artifactType})`
+	};
+	return {
+		value: "tracked",
+		reason: "fail-closed (no signal)"
+	};
+}
+function validateIgnoreFile(root) {
+	const path = join(root, ".agents", "sdd", ".sddignore");
+	if (!existsSync(path)) return {
+		ok: true,
+		message: ".sddignore OK (absent, fine)"
+	};
+	const text = readFileSync(path, "utf8");
+	const notes = [];
+	text.split("\n").forEach((raw, i) => {
+		if (parseIgnoreLine(raw) === null) notes.push(`line ${i + 1}: not a valid gitignore pattern: ${raw.trim()}`);
+	});
+	if (notes.length > 0) return {
+		ok: false,
+		message: notes.join("\n")
+	};
+	return {
+		ok: true,
+		message: `.sddignore OK (${parseIgnoreFile(text).length} rule(s))`
+	};
+}
+function parseArgs(argv) {
+	const out = {};
+	for (let i = 0; i < argv.length; i++) if (argv[i].startsWith("--")) {
+		out[argv[i].slice(2)] = argv[i + 1];
+		i++;
+	}
+	return out;
+}
+function main(argv) {
+	const args = parseArgs(argv);
+	const root = args.root ?? ".";
+	if (!args.path) {
+		const result = validateIgnoreFile(root);
+		process.stdout.write(`${result.message}\n`);
+		if (!result.ok) process.exitCode = 1;
+		return;
+	}
+	const explicit = args.explicit === "tracked" || args.explicit === "ignored" ? args.explicit : void 0;
+	const result = resolveTracking({
+		root,
+		path: args.path,
+		artifactType: args["artifact-type"],
+		explicit
+	});
+	process.stdout.write(`${result.value}\n`);
+	process.stdout.write(`reason: ${result.reason}\n`);
+}
+if (process.argv[1] && import.meta.url === pathToFileURL(realpathSync(process.argv[1])).href) main(process.argv.slice(2));
+//#endregion
+export { loadIgnoreRules, main, parseIgnoreFile, parseIgnoreLine, resolveFromIgnore, resolveKindDefault, resolveTracking, validateIgnoreFile };

package/skills/resolve-tracking/scripts/resolve-tracking.mjs

@@ -0,0 +1,12 @@
+// Launcher for the engine of the same name. Run it as `node <skill>/scripts/<engine>.mjs`.
+// A checkout runs the .mts source. An npm install keeps the skill under node_modules, where Node
+// will not strip types, so it runs the self-contained bundle built for the package.
+import { spawnSync } from 'node:child_process'
+import { fileURLToPath } from 'node:url'
+
+const self = fileURLToPath(import.meta.url)
+const installed = /[\\/]node_modules[\\/]/.test(self)
+const target = self.replace(/\.mjs$/, installed ? '.bundle.mjs' : '.mts')
+const run = spawnSync(process.execPath, [...process.execArgv, target, ...process.argv.slice(2)], { stdio: 'inherit' })
+if (run.error) throw run.error
+process.exitCode = run.status ?? 1

package/skills/scaffold-project-spec/SKILL.md

@@ -13,7 +13,7 @@ homes. It is **internal** — reached through `start-mission`, never a user entr
 `status: draft`; it authors no node's `## Use Cases`/`.feature`, renders no gate verdict, and freezes nothing.
 
 **Load `sdd:spec-structure-governance`** for the layout law it applies: the node taxonomy (three
-spec-types, the concept axis), the two-level depth cap, screaming architecture and the
+spec-types, the concept axis), the two-level depth cap on capability nodes, screaming architecture and the
 non-capability folders, root-files-not-folders, and the colocate-or-hoist test. This skill does not
 restate that law — it **runs** it, and owns only what is genuinely its own: the **strategy menu**,
 the **shared envelope**, and the seven-step procedure below.
@@ -138,7 +138,7 @@ Then the chosen strategy's **top-level skeleton** of **stub node READMEs**, each
   `.feature`);
 - an **index / rule / structural grouping** → **descriptive** (no marker).
 
-The skeleton obeys the **two-level depth cap** under **every** strategy: a node is
+The skeleton obeys the **two-level depth cap** under **every** strategy: a capability node is
 `<capability>/<unit>` and **never three deep** — a sub-grouping inside a capability is a `concept:` tag
 recovered by the by-concept index, not a third folder level. Under **mirror-source**, mirror **only to the
 unit boundary**: a folder with a testable surface becomes one behavioral leaf that owns its subtree; create

package/skills/sdd/SKILL.md

@@ -85,7 +85,7 @@ The **fresh spawn per mission is deliberate** — each automaton's context dies
 - **Escape.** A task that is **not a CR** escapes: create no draft, invoke no gate, and **write no record** (a non-CR is not SDD's to track; a spec-prose-only change is already in git). Two independent triggers: **no suite-relevant behavior**, or an **ignored** touched artifact. Escaping does not mean stopping — if the artifact-type has a producer with an escaped-request entry point (e.g. `define-skill` for `skill`), invoke it directly to do the actual work; only state "leaving the lifecycle" and stop when no such producer exists. For tracking, run the `resolve-tracking` skill (`intake/resolve-tracking`'s concrete engine) per touched artifact:
 
   ```bash
-  node "<resolve-tracking skill>/scripts/resolve-tracking.mts" --root . --path <repo-relative-path> [--artifact-type <type>] [--explicit tracked|ignored]
+  node "<resolve-tracking skill>/scripts/resolve-tracking.mjs" --root . --path <repo-relative-path> [--artifact-type <type>] [--explicit tracked|ignored]
   ```
 
   `--explicit` carries a tracking statement the requester made directly in the prompt/CR, when present. Pass `--artifact-type` when convention already makes it obvious (`skill` under `skills/`, `subagent` under `agents/`, …) — a full `resolve-governances` classification is not needed just to gate the escape check. An `ignored` result escapes the same as no-suite-relevant-behavior; a `tracked` result (including the fail-closed default) proceeds toward CR classification. This is a **read**, the same category as counting strategy lines or scanning specs — the thin-classifier rule still holds. Recognition is the **grill + impact analysis**, not a gateway classifier — the grill may carve a CR out of the tracked parts of a mixed request and escape the ignored ones. Ambiguity defaults *into* the lifecycle and is decided during explore.

package/skills/solution-producer-governance/README.md

@@ -2,7 +2,7 @@
 
 Non-user-invocable SDD skill holding the **default solution-producer procedure**: how to record a unit's `<unit>.solution.md` (the chosen approach + rejected alternatives) for a domain no plugin covers — **only** when the unit carries durable design rationale.
 
-Loaded via the harness (`Skill`) by the **conductor** (the main session) when it runs the solution-producer role from the SDD default — the conductor authors **inline** in its own warm context (recorded `produced-by.solution-producer: sdd:automaton`) rather than spawning a producer agent. Relocates the *functional-spec* half of the former `plan-producer` role to a per-unit, optional, ungated facet; the task-DAG half is now the conductor's transient execution `.plan.md` `todos`, not this role's output.
+Loaded via the harness (`Skill`) by the **conductor** (the main session) when it runs the solution-producer role from the SDD default — the conductor authors **inline** in its own warm context (recorded `produced-by.solution-producer: sdd:sdd-automaton`) rather than spawning a producer agent. Relocates the *functional-spec* half of the former `plan-producer` role to a per-unit, optional, ungated facet; the task-DAG half is now the conductor's transient execution `.plan.md` `todos`, not this role's output.
 
 The solution is the unit's **third facet** (spec / suite / solution). It is **optional** (most units have none), **boundary-aligned** (maps to the design decision, not one entry per scenario), and **ungated / unfrozen** — no judge grades it and the spec gate does not see it; the implementation's frozen-scenario result validates it transitively.
 

package/skills/solution-producer-governance/SKILL.md

@@ -6,7 +6,7 @@ user-invocable: false
 
 # Solution-Producer Governance — the default solution-recording procedure
 
-The procedure the **conductor** follows when it runs the **solution-producer** role from the SDD default — no plugin covers the domain and no model-tuned producer agent is named for the slot, so the conductor **loads this governance and authors inline** in its own warm context (recorded `produced-by.solution-producer: sdd:automaton`). This is the relocation of the former `plan-producer` role's *functional-spec* half: the solution is the chosen approach + rejected alternatives, now recorded **per unit** as `<unit>.solution.md` rather than as a `plan.md`. The task DAG that `plan-producer` also wrote is **not** this role's output — it is the conductor's transient execution `.plan.md` `todos`.
+The procedure the **conductor** follows when it runs the **solution-producer** role from the SDD default — no plugin covers the domain and no model-tuned producer agent is named for the slot, so the conductor **loads this governance and authors inline** in its own warm context (recorded `produced-by.solution-producer: sdd:sdd-automaton`). This is the relocation of the former `plan-producer` role's *functional-spec* half: the solution is the chosen approach + rejected alternatives, now recorded **per unit** as `<unit>.solution.md` rather than as a `plan.md`. The task DAG that `plan-producer` also wrote is **not** this role's output — it is the conductor's transient execution `.plan.md` `todos`.
 
 The solution is the unit's **third facet** (spec = *what*, suite = *proof*, solution = *why this shape*). It is **optional** and **ungated**: it gets no judge of its own, stays out of the spec-judge's view, and is never frozen. The implementation's frozen-scenario result validates it transitively.
 

package/skills/spec-gate/SKILL.md

@@ -26,7 +26,7 @@ self-clear-vs-escalate bar and the four-C floor are the conductor's autonomy bar
 Run before any verdict work; structural validity **fails closed**, availability only **flags**:
 
 ```bash
-node "<skill>/scripts/check-spec-state.mts" [--root <specs-dir>]
+node "<skill>/scripts/check-spec-state.mjs" [--root <specs-dir>]
 ```
 
 Exit `0` = legal; exit `1` prints each violation as `✗ <slug>: <reason>` — fix before continuing.
@@ -41,7 +41,7 @@ the CR touches any `.feature`, run it here **fail-closed, before spawning the co
 the CR's touched files:
 
 ```bash
-node "<skill>/scripts/check-suite.mts" --files <the CR's touched .feature files>
+node "<skill>/scripts/check-suite.mjs" --files <the CR's touched .feature files>
 ```
 
 Exit `0` = form clean; exit `1` prints each `✗ <file>: <reason>` — **advance nothing and do not
@@ -67,7 +67,7 @@ or a nested `<project-path>/.agents/spec/` — so a touched `.md` outside the sp
 swept):
 
 ```bash
-node "<skill>/scripts/check-spec-state.mts" --files <the CR's touched .md files> [--base <baseref>]
+node "<skill>/scripts/check-spec-state.mjs" --files <the CR's touched .md files> [--base <baseref>]
 ```
 
 Exit `0` prints each `⚠ <file>: introduces unresolved reference ...` finding (if any) plus the
@@ -158,7 +158,7 @@ change is purely additive with no judge round; a **narrowing/rewriting** edit (a
 scenario) unfreezes its file and fires **Clearance** once the narrowing is confirmed semantically.
 The edit-class classification itself — additive / no-content-change / narrowing / mixed — comes from
 `scripts/classify-edit-class.mts` (`--files <paths> [--base <ref>]`): a **structural** per-named-`Scenario`
-diff via the pinned `gherkin-cli@0.0.2 diff`, plus git rename detection for a pure `git mv`, **never a raw
+diff via the pinned `gherkin-cli@0.2.1 diff`, plus git rename detection for a pure `git mv`, **never a raw
 line diff** (a step orphaned off a frozen scenario onto a new adjacent scenario shows no `-` line and
 would read as additive to a line-diff; the structural diff correctly reports the losing scenario as
 `modified`). It only classifies — additive / no-content-change self-clear, narrowing / mixed take the
@@ -166,7 +166,7 @@ Clearance path above; it fires no verdict itself. Run it over the CR's touched f
 to read the edit class before applying the verb:
 
 ```bash
-node "<skill>/scripts/classify-edit-class.mts" --files <the CR's touched .feature files> [--base <baseref>]
+node "<skill>/scripts/classify-edit-class.mjs" --files <the CR's touched .feature files> [--base <baseref>]
 ```
 
 A `narrowing`/`mixed` result on a still-`@frozen` file routes to **Clearance** (escalated unless the CR