cyber-sdd 0.7.0 → 0.7.2

package/skills/pause-mission/SKILL.md

@@ -71,7 +71,7 @@ procedure above, plus one gate before declaring the plan retirement-ready:
   escape hatch — no suite-relevant behavior, no CR opened, no gate invoked) needs none; mark it
   complete on its own merits.
 - **Run the gate floor.** Run `checkGateFloor` (`plugins/sdd/skills/spec-gate/scripts/
-  check-spec-state.mts`, wired into `pnpm verify:specs`) before marking the plan
+  check-spec-state.mjs`, wired into `pnpm verify:specs`) before marking the plan
   retirement-ready. A clean floor → mark it. A violation (the status is approved/implemented but
   the ledger has no matching gate approve line) → do **not** mark the plan retirement-ready on
   git evidence alone; record the violation explicitly in `## NEXT` so a human resolves it (either

package/skills/place-node/SKILL.md

@@ -11,8 +11,8 @@ metadata:
 The concrete engine for the **place-node** step. Given a new
 node's `concept` (and optional name), it suggests a **provisional** capability home and catches possible
 duplicates, so explore places a node without holding the whole tree in its head (it scans the project-spec's
-`concept:` frontmatter and ranks the capability folders those facets already sit in). Self-contained `.mts`
-(the repo's node-≥23.6 / no-deps convention).
+`concept:` frontmatter and ranks the capability folders those facets already sit in). Self-contained `.mjs`
+(compiled from `src/`; no runtime deps, Node ≥22.11).
 
 ## Run it
 

package/skills/place-node/scripts/place-node.mjs

@@ -1,12 +1,117 @@
-// Launcher for the engine of the same name. Run it as `node <skill>/scripts/<engine>.mjs`.
-// A checkout runs the .mts source. An npm install keeps the skill under node_modules, where Node
-// will not strip types, so it runs the self-contained bundle built for the package.
-import { spawnSync } from 'node:child_process'
-import { fileURLToPath } from 'node:url'
-
-const self = fileURLToPath(import.meta.url)
-const installed = /[\\/]node_modules[\\/]/.test(self)
-const target = self.replace(/\.mjs$/, installed ? '.bundle.mjs' : '.mts')
-const run = spawnSync(process.execPath, [...process.execArgv, target, ...process.argv.slice(2)], { stdio: 'inherit' })
-if (run.error) throw run.error
-process.exitCode = run.status ?? 1
+#!/usr/bin/env node
+// Compiled by `universal-plugin plugin build` from src/place-node/place-node.mts. Edit the source, not this file.
+globalThis.__SKILL_SCRIPT__ = {"package":null,"bin":null,"version":"0.7.2","entry":"skills/place-node/scripts/place-node.mjs","commands":{}};
+import { readFileSync, readdirSync, realpathSync } from "node:fs";
+import { join } from "node:path";
+import { pathToFileURL } from "node:url";
+//#region src/place-node/place-node.mts
+const SKIP_DIRS = /* @__PURE__ */ new Set([
+	"node_modules",
+	".git",
+	"dist",
+	".turbo",
+	".next",
+	"coverage"
+]);
+function parseConcepts(text) {
+	const m = /^---\r?\n([\s\S]*?)\r?\n---\s*(?:\r?\n|$)/.exec(text);
+	if (!m) return [];
+	const lines = m[1].split("\n").map((l) => l.replace(/\r$/, ""));
+	for (let i = 0; i < lines.length; i++) {
+		const line = lines[i];
+		if (line.length - line.trimStart().length !== 0) continue;
+		const [key, ...rest] = line.trim().split(":");
+		if (key !== "concept") continue;
+		const value = rest.join(":").trim();
+		if (value.startsWith("[") && value.endsWith("]")) return value.slice(1, -1).split(",").map((s) => unquote(s.trim())).filter((s) => s.length > 0);
+		if (value !== "") return [unquote(value)];
+		const out = [];
+		for (let j = i + 1; j < lines.length; j++) {
+			const item = lines[j];
+			if (item.trim() === "") continue;
+			if (item.length - item.trimStart().length === 0) break;
+			const dash = /^\s*-\s+(.*)$/.exec(item);
+			if (dash) out.push(unquote(dash[1].trim()));
+		}
+		return out;
+	}
+	return [];
+}
+function unquote(v) {
+	return v.replace(/^["']|["']$/g, "");
+}
+function displayPath(relPath) {
+	const p = relPath.replace(/\\/g, "/");
+	return p.endsWith("/README.md") ? p.slice(0, -9) : p;
+}
+function scanProjectSpec(specDir) {
+	const records = [];
+	walk(specDir, specDir, records);
+	return records;
+}
+function walk(dir, specDir, out) {
+	for (const entry of readdirSync(dir, { withFileTypes: true })) {
+		if (entry.name.startsWith(".") || SKIP_DIRS.has(entry.name)) continue;
+		const full = join(dir, entry.name);
+		if (entry.isDirectory()) walk(full, specDir, out);
+		else if (entry.name.endsWith(".md")) {
+			const concepts = parseConcepts(readFileSync(full, "utf8"));
+			if (concepts.length === 0) continue;
+			const relPath = full.slice(specDir.length + 1).replace(/\\/g, "/");
+			out.push({
+				relPath,
+				capability: relPath.split("/")[0],
+				display: displayPath(relPath),
+				concepts
+			});
+		}
+	}
+}
+function suggestHomes(records, concept) {
+	const counts = /* @__PURE__ */ new Map();
+	for (const rec of records) {
+		if (!rec.concepts.includes(concept)) continue;
+		counts.set(rec.capability, (counts.get(rec.capability) ?? 0) + 1);
+	}
+	return [...counts.entries()].map(([capability, count]) => ({
+		capability,
+		count
+	})).sort((a, b) => b.count - a.count || a.capability.localeCompare(b.capability));
+}
+function findNear(records, name) {
+	const needle = name.trim().toLowerCase();
+	if (needle === "") return [];
+	return records.filter((rec) => rec.relPath.toLowerCase().includes(needle)).sort((a, b) => a.display.localeCompare(b.display));
+}
+function render(homes, near, concept, name) {
+	const lines = [`place-node: concept=${concept || "(none)"} name=${name || "(none)"}`];
+	if (homes.length > 0) {
+		lines.push(`homes[${homes.length}]{capability,facets}:`);
+		for (const h of homes) lines.push(`  ${h.capability},${h.count}`);
+	} else lines.push("homes[0]: (new concept — pick any plausible capability; finalized at handoff)");
+	if (near.length > 0) {
+		lines.push(`near[${near.length}]:`);
+		for (const n of near) lines.push(`  ${n.display}`);
+	} else lines.push("near[0]: (no name overlap)");
+	lines.push("note: placement is provisional — finalized at handoff");
+	return lines.join("\n");
+}
+function main(argv) {
+	let specDir = ".";
+	let concept = "";
+	let name = "";
+	for (let i = 0; i < argv.length; i++) {
+		const a = argv[i];
+		if (a === "--spec-dir") specDir = argv[++i] ?? ".";
+		else if (a === "--concept") concept = argv[++i] ?? "";
+		else if (a === "--name") name = argv[++i] ?? "";
+	}
+	const records = scanProjectSpec(specDir);
+	const homes = concept ? suggestHomes(records, concept) : [];
+	const near = name ? findNear(records, name) : [];
+	process.stdout.write(`${render(homes, near, concept, name)}\n`);
+	return 0;
+}
+if (process.argv[1] && import.meta.url === pathToFileURL(realpathSync(process.argv[1])).href) process.exit(main(process.argv.slice(2)));
+//#endregion
+export { findNear, main, parseConcepts, scanProjectSpec, suggestHomes };

package/skills/plan-retirement/README.md

@@ -2,7 +2,7 @@
 
 Internal, non-user-invocable SDD skill carrying the Doctrine loop's **last retro step** — the
 gated, idempotent **tracked deletion** of a retired mission plan. It holds a self-contained
-`scripts/retire-plans.mts` (node ≥23.6, no deps; an agent fallback when `node` is absent).
+`scripts/retire-plans.mjs` (node ≥22.11, no deps; an agent fallback when `node` is absent).
 
 **Distill and delete are decoupled.** The Scanner distills the combat log into ledger `strategy`
 early (at `→ implemented`); this sweep deletes the plan **later**, gated on source = `done`/merged
@@ -32,4 +32,4 @@ combat log's presence only — a brief owes no distillation, so a cr-ref with br
 alone does — a brief without a `plan.md` is untouched). Each brief is deleted only if present; an
 absent one is a no-op, same as the missing log half.
 
-Tests (`scripts/retire-plans.test.mts`) run under `pnpm verify:specs`.
+Tests (`src/plan-retirement/retire-plans.test.mts`) run under `pnpm verify:specs`.

package/skills/plan-retirement/scripts/retire-plans.mjs

@@ -1,12 +1,123 @@
-// Launcher for the engine of the same name. Run it as `node <skill>/scripts/<engine>.mjs`.
-// A checkout runs the .mts source. An npm install keeps the skill under node_modules, where Node
-// will not strip types, so it runs the self-contained bundle built for the package.
-import { spawnSync } from 'node:child_process'
-import { fileURLToPath } from 'node:url'
-
-const self = fileURLToPath(import.meta.url)
-const installed = /[\\/]node_modules[\\/]/.test(self)
-const target = self.replace(/\.mjs$/, installed ? '.bundle.mjs' : '.mts')
-const run = spawnSync(process.execPath, [...process.execArgv, target, ...process.argv.slice(2)], { stdio: 'inherit' })
-if (run.error) throw run.error
-process.exitCode = run.status ?? 1
+#!/usr/bin/env node
+// Compiled by `universal-plugin plugin build` from src/plan-retirement/retire-plans.mts. Edit the source, not this file.
+globalThis.__SKILL_SCRIPT__ = {"package":null,"bin":null,"version":"0.7.2","entry":"skills/plan-retirement/scripts/retire-plans.mjs","commands":{}};
+import { existsSync, readFileSync, readdirSync, realpathSync, unlinkSync } from "node:fs";
+import { join } from "node:path";
+import { pathToFileURL } from "node:url";
+//#region src/plan-retirement/retire-plans.mts
+const PLAN_SUFFIX = ".plan.md";
+const LOG_SUFFIX = ".log.jsonl";
+const DESIGN_SUFFIX = ".design.md";
+const OPERATIONS_SUFFIX = ".operations.md";
+const EVIDENCE_SUFFIX = ".evidence.md";
+function transientArtifactFiles(crRef) {
+	return [
+		`${crRef}${PLAN_SUFFIX}`,
+		`${crRef}${LOG_SUFFIX}`,
+		`${crRef}${DESIGN_SUFFIX}`,
+		`${crRef}${OPERATIONS_SUFFIX}`,
+		`${crRef}${EVIDENCE_SUFFIX}`
+	];
+}
+function parseCleared(value) {
+	if (!value) return [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const raw of value.split(",")) {
+		const ref = raw.trim();
+		if (ref) seen.add(ref);
+	}
+	return [...seen];
+}
+function discoverPlans(root) {
+	let entries;
+	try {
+		entries = readdirSync(root);
+	} catch {
+		return [];
+	}
+	return entries.filter((f) => f.endsWith(PLAN_SUFFIX)).map((f) => f.slice(0, -8));
+}
+function discoverLogs(root) {
+	let entries;
+	try {
+		entries = readdirSync(root);
+	} catch {
+		return [];
+	}
+	return entries.filter((f) => f.endsWith(LOG_SUFFIX)).map((f) => f.slice(0, -10));
+}
+function distilledCrRefs(ledgerDir) {
+	const distilled = /* @__PURE__ */ new Set();
+	let entries;
+	try {
+		entries = readdirSync(ledgerDir);
+	} catch {
+		return distilled;
+	}
+	for (const entry of entries) {
+		if (!entry.endsWith(".jsonl")) continue;
+		let text;
+		try {
+			text = readFileSync(join(ledgerDir, entry), "utf8");
+		} catch {
+			continue;
+		}
+		for (const line of text.split("\n")) {
+			const trimmed = line.trim();
+			if (!trimmed) continue;
+			let record;
+			try {
+				record = JSON.parse(trimmed);
+			} catch {
+				continue;
+			}
+			if (record === null || typeof record !== "object") continue;
+			const { kind, distills } = record;
+			if (kind === "strategy" && typeof distills === "string" && distills.length > 0) distilled.add(distills);
+		}
+	}
+	return distilled;
+}
+function decideRetirements(cleared, existing, distilled, logPresent) {
+	const present = new Set(existing);
+	const seen = /* @__PURE__ */ new Set();
+	const out = [];
+	for (const ref of cleared) if (present.has(ref) && (distilled.has(ref) || !logPresent.has(ref)) && !seen.has(ref)) {
+		seen.add(ref);
+		out.push(ref);
+	}
+	return out;
+}
+function main(argv) {
+	const root = argv.includes("--root") ? argv[argv.indexOf("--root") + 1] : ".agents/plans";
+	const ledgerArg = argv.includes("--ledger") ? argv[argv.indexOf("--ledger") + 1] : void 0;
+	const cleared = parseCleared(argv.includes("--retire") ? argv[argv.indexOf("--retire") + 1] : void 0);
+	const dryRun = argv.includes("--dry-run");
+	if (argv.includes("--distilled")) {
+		for (const ref of distilledCrRefs(argv[argv.indexOf("--distilled") + 1] ?? "")) process.stdout.write(`${ref}\n`);
+		return 0;
+	}
+	let retiring;
+	if (!ledgerArg || !existsSync(ledgerArg)) {
+		process.stdout.write(`no verifiable ledger (${ledgerArg ? `--ledger ${ledgerArg} unreadable` : "--ledger not given"}): distillation cannot be checked, so retirement is skipped for all cr-refs\n`);
+		retiring = [];
+	} else {
+		const distilled = distilledCrRefs(ledgerArg);
+		const logPresent = new Set(discoverLogs(root));
+		retiring = decideRetirements(cleared, discoverPlans(root), distilled, logPresent);
+	}
+	const deleted = [];
+	for (const ref of retiring) for (const file of transientArtifactFiles(ref)) {
+		const path = join(root, file);
+		if (!existsSync(path)) continue;
+		if (!dryRun) unlinkSync(path);
+		deleted.push(path);
+	}
+	const verb = dryRun ? "would delete" : "deleted";
+	for (const path of deleted) process.stdout.write(`${verb} ${path}\n`);
+	process.stdout.write(`${dryRun ? "dry-run: " : ""}retired ${retiring.length} plan(s), ${deleted.length} file(s)\n`);
+	return 0;
+}
+if (process.argv[1] && import.meta.url === pathToFileURL(realpathSync(process.argv[1])).href) process.exit(main(process.argv.slice(2)));
+//#endregion
+export { decideRetirements, discoverLogs, discoverPlans, distilledCrRefs, main, parseCleared, transientArtifactFiles };

package/skills/resolve-governances/README.md

@@ -1,14 +1,14 @@
 # resolve-governances
 
 The concrete engine for **SDD governance resolution**.
-A non-user-invocable skill carrying a self-contained `.mts` script that, for a touched file's
+A non-user-invocable skill carrying a self-contained `.mjs` script that, for a touched file's
 artifact-type, resolves each production-chain role to its agent plus the resolved-actor bars it loads
 — matching candidates across the project's `.agents/governances/` anchors, the matched plugin squad,
 and the sdd defaults.
 
 - **Skill contract:** [`SKILL.md`](./SKILL.md)
-- **Script:** [`scripts/resolve-governances.mts`](./scripts/resolve-governances.mts)
-- **Tests:** [`scripts/resolve-governances.test.mts`](./scripts/resolve-governances.test.mts) (`node:test`)
+- **Script:** [`scripts/resolve-governances.mjs`](./scripts/resolve-governances.mjs)
+- **Tests:** [`src/resolve-governances/resolve-governances.test.mts`](../../src/resolve-governances/resolve-governances.test.mts) (`node:test`)
 
 ```bash
 node scripts/resolve-governances.mjs --root . --artifact-type skill

package/skills/resolve-governances/SKILL.md

@@ -15,7 +15,7 @@ project anchors, the matched plugin squad (from the project registry
 `.agents/universal-plugin.json`), and the sdd defaults. It is a **dumb matcher**: it returns each
 bar's candidates **bucketed by tier** and does **not** order by precedence or apply `compose` — the
 consuming agent composes. The conductor and the cold judges run it so they **never hand-enumerate**
-the bars. It carries a self-contained `.mts` script (the repo's node-≥23.6 / no-deps convention).
+the bars. It carries a self-contained `.mjs` script (compiled from `src/`; no runtime deps, Node ≥22.11).
 
 ## Run the resolution